@voltro/plugin-auth 0.33.0 → 0.34.0

package/dist/plugin-ZXs8LFn0.js

@@ -1,820 +0,0 @@
-import { hashPassword as e, verifyPassword as t, verifyPasswordWithRehash as n } from "./password.js";
-import { clearSessionCookie as r, issueSession as i, readSessionKeyed as a, resolveSessionSecret as o, resolveSessionSecrets as s, sessionSecretsOf as c } from "./session.js";
-import { a as l, l as u, o as d, s as f, t as p } from "./strategy-Ce4FlGi4.js";
-import { hashToken as m, mintToken as h } from "./tokens.js";
-import { CSRF_COOKIE_NAME as g, CSRF_HEADER_NAME as _, issueCsrfToken as v, verifyCsrf as ee } from "./csrf.js";
-import { generateChallenge as y, verifyAssertion as b, verifyRegistration as te } from "./webauthn.js";
-import { createHmac as ne, randomBytes as x, timingSafeEqual as re } from "node:crypto";
-import { Data as ie, Effect as S } from "effect";
-import { buildSetCookie as ae, readCookie as oe } from "@voltro/protocol/session";
-import { definePlugin as se } from "@voltro/protocol";
-//#region src/subjectGuard.ts
-var ce = { ok: !0 }, C = (e, t) => S.gen(function* () {
-	for (let n of e) {
-		let e = yield* n(t);
-		if (!e.ok) return e;
-	}
-	return ce;
-}), w = 30, T = 6, le = 20, ue = "sha1", de = 1, E = class extends ie.TaggedError("TotpVerifyError") {}, D = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567", fe = (e) => {
-	let t = 0, n = 0, r = "";
-	for (let i of e) for (n = n << 8 | i, t += 8; t >= 5;) r += D[n >>> t - 5 & 31], t -= 5;
-	return t > 0 && (r += D[n << 5 - t & 31]), r;
-}, pe = (e) => {
-	let t = e.toUpperCase().replace(/[\s=]+/g, "");
-	if (!/^[A-Z2-7]+$/.test(t)) return null;
-	let n = new Uint8Array(Math.floor(t.length * 5 / 8)), r = 0, i = 0, a = 0;
-	for (let e of t) {
-		let t = D.indexOf(e);
-		if (t === -1) return null;
-		i = i << 5 | t, r += 5, r >= 8 && (n[a++] = i >>> r - 8 & 255, r -= 8);
-	}
-	return n.subarray(0, a);
-}, me = (e) => {
-	let t = Buffer.alloc(8);
-	return t.writeBigUInt64BE(BigInt(e), 0), t;
-}, he = (e, t) => {
-	let n = ne(ue, Buffer.from(e));
-	n.update(me(t));
-	let r = n.digest(), i = r[r.length - 1] & 15, a = (r[i] & 127) << 24 | (r[i + 1] & 255) << 16 | (r[i + 2] & 255) << 8 | r[i + 3] & 255;
-	return String(a % 10 ** T).padStart(T, "0");
-}, O = () => fe(x(le)), k = (e) => `otpauth://totp/${encodeURIComponent(`${e.issuer}:${e.accountName}`)}?${new URLSearchParams({
-	secret: e.secret,
-	issuer: e.issuer,
-	algorithm: "SHA1",
-	digits: String(T),
-	period: String(w)
-}).toString()}`, ge = (e, t = Date.now()) => {
-	let n = pe(e);
-	return n ? he(n, Math.floor(t / 1e3 / w)) : "000000";
-}, A = (e, t, n = Date.now()) => S.gen(function* () {
-	let r = pe(e);
-	if (!r) return yield* S.fail(new E({ reason: "malformedSecret" }));
-	let i = t.replace(/\s+/g, "");
-	if (!/^[0-9]{6}$/.test(i)) return yield* S.fail(new E({ reason: "invalidCode" }));
-	let a = Math.floor(n / 1e3 / w), o = Buffer.from(i);
-	for (let e = -1; e <= de; e++) {
-		let t = he(r, a + e), n = Buffer.from(t);
-		if (n.length === o.length && re(n, o)) return !0;
-	}
-	return yield* S.fail(new E({ reason: "invalidCode" }));
-}), j = (e = 10) => {
-	let t = [];
-	for (let n = 0; n < e; n++) {
-		let e = fe(x(16)).slice(0, 25).match(/.{1,5}/g) ?? [];
-		t.push(e.join("-"));
-	}
-	return t;
-}, _e = 5, ve = 900, ye = 900, M = (e) => ({
-	maxAttempts: e.lockout?.maxAttempts ?? _e,
-	windowMs: (e.lockout?.windowSeconds ?? ve) * 1e3,
-	lockMs: (e.lockout?.lockSeconds ?? ye) * 1e3
-}), N = (e) => e.secrets ?? (e.secret === void 0 ? s() : c(e.secret)), P = (e) => e.secret ?? o(), F = (e, t, n = {}) => ({
-	status: e,
-	body: JSON.stringify(t),
-	contentType: "application/json; charset=utf-8",
-	...n
-}), I = (e, t = {}) => ({
-	status: 302,
-	body: "",
-	contentType: "text/plain",
-	location: e,
-	...t
-}), L = 3600 * 24 * 7, R = (e, t) => e.type === "user" ? {
-	...e,
-	metadata: {
-		...e.metadata ?? {},
-		sessionId: t
-	}
-} : e, z = (e, t, n, r = {}) => S.gen(function* () {
-	yield* t.clearLoginFailures(e.email);
-	let a = yield* t.listMemberships(e.id), o = l("sess");
-	yield* t.insertSession({
-		id: o,
-		userId: e.id,
-		tenantId: e.tenantId,
-		expiresAt: new Date(Date.now() + L * 1e3),
-		ipAddress: r.ipAddress ?? null,
-		userAgent: r.userAgent ?? null
-	}).pipe(S.ignore);
-	let s = R(f(e, { memberships: a }), o);
-	return {
-		setCookie: i(s, N(n), {
-			ttlSeconds: L,
-			...n.cookieDomain ? { domain: n.cookieDomain } : {},
-			secure: n.cookieSecure ?? !0
-		}).setCookie,
-		subject: s
-	};
-}), B = (e, t) => S.gen(function* () {
-	let n = t.subjectGuards ?? [];
-	if (n.length === 0) return null;
-	let r = yield* C(n, e);
-	return r.ok ? null : F(403, {
-		error: r.code,
-		message: r.message
-	});
-}), be = 300, V = (r, i, a) => S.gen(function* () {
-	if (!r.email || !r.password) return F(400, { error: "email and password required" });
-	let o = yield* i.findByEmail(r.email), s = (a.now ?? Date.now)(), c = yield* i.isLockedOut(r.email, s);
-	if (c.locked) return F(429, {
-		error: "account_locked",
-		retryAfterSeconds: c.retryAfterSeconds
-	});
-	let u = o?.passwordHash, d = typeof u == "string" && u.length > 0 ? yield* n(r.password, u) : yield* S.gen(function* () {
-		let n = yield* e("decoy-not-a-real-password").pipe(S.orElseSucceed(() => ""));
-		return yield* t(r.password, n), { valid: !1 };
-	});
-	if (!o || !d.valid) return yield* i.recordLoginFailure(r.email, s, M(a)), F(401, { error: "invalid credentials" });
-	let f = yield* B(o, a);
-	if (f) return f;
-	if (d.rehash && (yield* i.updatePassword(o.id, d.rehash).pipe(S.ignore)), o.mfaEnrolledAt) {
-		let e = h("mfa-pending", 300);
-		return yield* i.insertToken({
-			id: l("tok"),
-			tokenHash: e.tokenHash,
-			userId: o.id,
-			purpose: "mfa-pending",
-			expiresAt: e.expiresAt
-		}).pipe(S.ignore), F(200, {
-			ok: !0,
-			mfaRequired: !0,
-			pendingToken: e.token,
-			expiresInSeconds: 300
-		});
-	}
-	let { setCookie: p, subject: m } = yield* z(o, i, a, {
-		ipAddress: r.ipAddress ?? null,
-		userAgent: r.userAgent ?? null
-	});
-	return r.redirectAfter ? I(a.successRedirect ?? "/", { setCookie: p }) : F(200, {
-		ok: !0,
-		subject: m
-	}, { setCookie: p });
-}), H = (e, t, n) => S.gen(function* () {
-	if (!e.pendingToken) return F(400, { error: "pending token required" });
-	if (!e.code && !e.recoveryCode) return F(400, { error: "code or recoveryCode required" });
-	let r = yield* t.consumeToken(m(e.pendingToken), "mfa-pending");
-	if (!r) return F(401, { error: "invalid or expired challenge" });
-	let i = yield* t.findById(r.userId);
-	if (!i || !i.mfaEnrolledAt || !i.mfaSecret) return F(401, { error: "mfa not enrolled" });
-	let a = (n.now ?? Date.now)(), o = yield* t.isLockedOut(i.email, a);
-	if (o.locked) return F(429, {
-		error: "account_locked",
-		retryAfterSeconds: o.retryAfterSeconds
-	});
-	let s = yield* B(i, n);
-	if (s) return s;
-	if (!(e.recoveryCode ? yield* t.consumeRecoveryCode(i.id, m(e.recoveryCode.trim())) : yield* A(i.mfaSecret, e.code ?? "").pipe(S.map(() => !0), S.catchTag("TotpVerifyError", () => S.succeed(!1))))) return yield* t.recordLoginFailure(i.email, a, M(n)), F(401, { error: "invalid_code" });
-	let { setCookie: c, subject: l } = yield* z(i, t, n, {
-		ipAddress: e.ipAddress ?? null,
-		userAgent: e.userAgent ?? null
-	});
-	return e.redirectAfter ? I(n.successRedirect ?? "/", { setCookie: c }) : F(200, {
-		ok: !0,
-		subject: l
-	}, { setCookie: c });
-}), U = (t, n, r) => S.gen(function* () {
-	if (!t.email || !t.password) return F(400, { error: "email and password required" });
-	if (t.password.length < 8) return F(400, { error: "password must be at least 8 characters" });
-	if (yield* n.findByEmail(t.email)) return F(409, { error: "email already registered" });
-	let a = t.tenantId ?? r.defaultTenantId, o = yield* e(t.password), s = yield* n.insert({
-		id: l("user"),
-		email: t.email,
-		passwordHash: o,
-		tenantId: a
-	});
-	yield* n.addMembership({
-		userId: s.id,
-		tenantId: a,
-		role: "owner"
-	}).pipe(S.ignore);
-	let c = yield* n.listMemberships(s.id), u = l("sess");
-	yield* n.insertSession({
-		id: u,
-		userId: s.id,
-		tenantId: a,
-		expiresAt: new Date(Date.now() + L * 1e3),
-		ipAddress: null,
-		userAgent: null
-	}).pipe(S.ignore);
-	let d = R(f(s, { memberships: c }), u), p = i(d, N(r), {
-		ttlSeconds: L,
-		...r.cookieDomain ? { domain: r.cookieDomain } : {},
-		secure: r.cookieSecure ?? !0
-	});
-	return t.redirectAfter ? I(r.successRedirect ?? "/", { setCookie: p.setCookie }) : F(200, {
-		ok: !0,
-		subject: d
-	}, { setCookie: p.setCookie });
-}).pipe(S.catchAll((e) => S.succeed(F(500, {
-	error: "signup_failed",
-	cause: String(e)
-})))), W = (e) => ({
-	status: 302,
-	body: "",
-	location: e.successRedirect ?? "/",
-	setCookie: r({
-		...e.cookieDomain ? { domain: e.cookieDomain } : {},
-		secure: e.cookieSecure ?? !0
-	})
-}), G = (e, t) => S.gen(function* () {
-	let n = yield* t.findById(e.userId);
-	if (!n) return F(404, { error: "user_not_found" });
-	let r = O();
-	return yield* t.setMfaSecret(n.id, r).pipe(S.catchAll(() => S.succeed(n))), F(200, {
-		ok: !0,
-		secret: r,
-		otpauthUrl: k({
-			issuer: e.issuer,
-			accountName: e.accountName,
-			secret: r
-		})
-	});
-}), K = (e, t) => S.gen(function* () {
-	let n = yield* t.findById(e.userId);
-	if (!n) return F(404, { error: "user_not_found" });
-	if (!n.mfaSecret) return F(400, { error: "no_enrollment_in_progress" });
-	if (n.mfaEnrolledAt) return F(409, { error: "already_enrolled" });
-	if (!(yield* A(n.mfaSecret, e.code).pipe(S.map(() => !0), S.catchTag("TotpVerifyError", () => S.succeed(!1))))) return F(401, { error: "invalid_code" });
-	yield* t.markMfaEnrolled(n.id).pipe(S.catchAll(() => S.succeed(n)));
-	let r = j();
-	return yield* t.replaceRecoveryCodes(n.id, r.map((e) => m(e))).pipe(S.ignore), F(200, {
-		ok: !0,
-		enrolled: !0,
-		recoveryCodes: r
-	});
-}), q = (e, t) => S.gen(function* () {
-	let n = yield* t.findById(e.userId);
-	if (!n) return F(404, { error: "user_not_found" });
-	if (!n.mfaEnrolledAt) return F(400, { error: "mfa_not_enrolled" });
-	let r = j();
-	return yield* t.replaceRecoveryCodes(n.id, r.map((e) => m(e))).pipe(S.ignore), F(200, {
-		ok: !0,
-		recoveryCodes: r
-	});
-}), xe = (e, t) => S.gen(function* () {
-	let n = yield* t.findById(e.userId);
-	return n ? (yield* t.clearMfa(n.id).pipe(S.catchAll(() => S.succeed(n))), yield* t.replaceRecoveryCodes(n.id, []).pipe(S.ignore), F(200, {
-		ok: !0,
-		enrolled: !1
-	})) : F(404, { error: "user_not_found" });
-}), Se = (e) => {
-	let t = v(P(e)), n = ae(g, t, {
-		httpOnly: !1,
-		sameSite: "lax",
-		secure: e.cookieSecure ?? !0,
-		...e.cookieDomain ? { domain: e.cookieDomain } : {},
-		path: "/"
-	});
-	return F(200, { csrfToken: t }, { setCookie: n });
-}, Ce = (e, t, n) => `${e}${t}${t.includes("?") ? "&" : "?"}token=${encodeURIComponent(n)}`, we = (e, t, n) => S.gen(function* () {
-	if (!e.email) return F(400, { error: "email required" });
-	let r = yield* t.findByEmail(e.email);
-	if (r) {
-		let i = h("magic-link");
-		yield* t.insertToken({
-			id: l("tok"),
-			tokenHash: i.tokenHash,
-			userId: r.id,
-			purpose: "magic-link",
-			expiresAt: i.expiresAt
-		}).pipe(S.ignore);
-		let a = Ce(n.appBaseUrl ?? "", e.callbackPath ?? "/auth/magic-link/callback", i.token);
-		n.sendEmail && (yield* S.tryPromise(() => n.sendEmail({
-			to: r.email,
-			kind: "magic-link",
-			actionUrl: a,
-			subject: "Your sign-in link",
-			text: `Sign in: ${a}`,
-			html: `<p><a href="${a}">Sign in</a> — this link expires shortly.</p>`
-		})).pipe(S.ignore));
-	}
-	return F(202, { ok: !0 });
-}), Te = (e, t, n) => S.gen(function* () {
-	if (!e.token) return F(400, { error: "token required" });
-	let r = yield* t.consumeToken(m(e.token), "magic-link");
-	if (!r) return F(401, { error: "invalid or expired token" });
-	let a = yield* t.findById(r.userId);
-	if (!a) return F(401, { error: "invalid or expired token" });
-	let o = yield* B(a, n);
-	if (o) return o;
-	let s = yield* t.listMemberships(a.id), c = l("sess");
-	yield* t.insertSession({
-		id: c,
-		userId: a.id,
-		tenantId: a.tenantId,
-		expiresAt: new Date(Date.now() + L * 1e3),
-		ipAddress: null,
-		userAgent: null
-	}).pipe(S.ignore);
-	let u = R(f(a, { memberships: s }), c), d = i(u, N(n), {
-		ttlSeconds: L,
-		...n.cookieDomain ? { domain: n.cookieDomain } : {},
-		secure: n.cookieSecure ?? !0
-	});
-	return e.redirectAfter ? I(n.successRedirect ?? "/", { setCookie: d.setCookie }) : F(200, {
-		ok: !0,
-		subject: u
-	}, { setCookie: d.setCookie });
-}), Ee = (e, t, n) => S.gen(function* () {
-	if (!e.email) return F(400, { error: "email required" });
-	let r = yield* t.findByEmail(e.email);
-	if (r) {
-		let i = h("password-reset");
-		yield* t.insertToken({
-			id: l("tok"),
-			tokenHash: i.tokenHash,
-			userId: r.id,
-			purpose: "password-reset",
-			expiresAt: i.expiresAt
-		}).pipe(S.ignore);
-		let a = Ce(n.appBaseUrl ?? "", e.callbackPath ?? "/auth/password-reset/callback", i.token);
-		n.sendEmail && (yield* S.tryPromise(() => n.sendEmail({
-			to: r.email,
-			kind: "password-reset",
-			actionUrl: a,
-			subject: "Reset your password",
-			text: `Reset your password: ${a}`,
-			html: `<p><a href="${a}">Reset your password</a> — this link expires shortly.</p>`
-		})).pipe(S.ignore));
-	}
-	return F(202, { ok: !0 });
-}), De = (t, n) => S.gen(function* () {
-	if (!t.token || !t.newPassword) return F(400, { error: "token and newPassword required" });
-	if (t.newPassword.length < 8) return F(400, { error: "password must be at least 8 characters" });
-	let r = yield* n.consumeToken(m(t.token), "password-reset");
-	if (!r) return F(401, { error: "invalid or expired token" });
-	let i = yield* e(t.newPassword).pipe(S.orElseSucceed(() => ""));
-	return i ? (yield* n.updatePassword(r.userId, i).pipe(S.ignore), yield* n.revokeAllOtherSessions(r.userId, "__none__").pipe(S.ignore), F(200, { ok: !0 })) : F(500, { error: "hash_failed" });
-}), Oe = (e, t) => S.gen(function* () {
-	return F(200, { sessions: (yield* t.listSessions(e.userId)).map((e) => ({
-		id: e.id,
-		tenantId: e.tenantId,
-		ipAddress: e.ipAddress ?? null,
-		userAgent: e.userAgent ?? null,
-		createdAt: e.createdAt.toISOString(),
-		lastSeenAt: e.lastSeenAt.toISOString(),
-		expiresAt: e.expiresAt.toISOString()
-	})) });
-}), ke = (e, t) => S.gen(function* () {
-	return (yield* t.revokeSession(e.userId, e.sessionId)) ? F(200, {
-		ok: !0,
-		revoked: 1
-	}) : F(404, { error: "session_not_found" });
-}), Ae = (e, t) => S.gen(function* () {
-	return F(200, {
-		ok: !0,
-		revoked: yield* t.revokeAllOtherSessions(e.userId, e.keepSessionId)
-	});
-}), je = (e, t, n, r) => S.gen(function* () {
-	let a = yield* t.findById(e.userId);
-	if (!a) return F(404, { error: "user_not_found" });
-	let o = yield* t.membershipRole(e.userId, e.targetTenantId);
-	if (o === null) return F(403, { error: "not a member of the target tenant" });
-	let s = yield* t.listMemberships(a.id), c = e.metadata === void 0 ? void 0 : Object.fromEntries(Object.entries(e.metadata).filter(([e]) => e !== "memberships")), l = f(a, {
-		tenantId: e.targetTenantId,
-		memberships: s,
-		...c === void 0 ? {} : { metadata: c }
-	}), u = e.sessionId ? R(l, e.sessionId) : l;
-	e.clientId !== void 0 && r && r(e.clientId, u);
-	let d = i(u, N(n), {
-		ttlSeconds: L,
-		...n.cookieDomain ? { domain: n.cookieDomain } : {},
-		secure: n.cookieSecure ?? !0
-	});
-	return F(200, {
-		ok: !0,
-		tenantId: e.targetTenantId,
-		role: o,
-		subject: u
-	}, { setCookie: d.setCookie });
-}), Me = (e, t) => S.gen(function* () {
-	return F(200, { memberships: (yield* t.listMemberships(e.userId)).map((e) => ({
-		tenantId: e.tenantId,
-		role: e.role,
-		joinedAt: e.joinedAt.toISOString()
-	})) });
-}), J = (e, t, n = {}) => ({
-	status: e,
-	body: JSON.stringify(t),
-	contentType: "application/json; charset=utf-8",
-	...n
-}), Ne = 3600 * 24 * 7, Pe = () => {
-	let e = /* @__PURE__ */ new Map();
-	return {
-		put: (t, n, r) => S.sync(() => {
-			e.set(t, {
-				challenge: n,
-				expiresAt: Date.now() + r * 1e3
-			});
-		}),
-		take: (t) => S.sync(() => {
-			let n = e.get(t);
-			return e.delete(t), !n || n.expiresAt < Date.now() ? null : n.challenge;
-		})
-	};
-}, Fe = (e) => ({
-	put: (t, n, r) => S.gen(function* () {
-		let i = /* @__PURE__ */ new Date(), a = new Date(i.getTime() + r * 1e3);
-		(yield* e`
-        UPDATE "passkeyChallenges"
-           SET challenge = ${n}, "expiresAt" = ${a}, "createdAt" = ${i}
-         WHERE key = ${t}
-        RETURNING key
-      `).length === 0 && (yield* e`
-          INSERT INTO "passkeyChallenges" (id, key, challenge, "expiresAt", "createdAt")
-          VALUES (${l("pkc")}, ${t}, ${n}, ${a}, ${i})
-        `);
-	}).pipe(S.asVoid, S.orElseSucceed(() => void 0)),
-	take: (t) => S.gen(function* () {
-		let n = (yield* e`
-        DELETE FROM "passkeyChallenges" WHERE key = ${t}
-        RETURNING challenge, "expiresAt"
-      `)[0];
-		return n && n.expiresAt.getTime() > Date.now() ? n.challenge : null;
-	}).pipe(S.orElseSucceed(() => null))
-}), Y = 300, Ie = (e, t, n, r) => S.gen(function* () {
-	if (!(yield* t.findById(e.userId))) return J(404, { error: "user_not_found" });
-	let i = y();
-	yield* n.put(`${e.userId}:register`, i, Y);
-	let a = yield* t.listPasskeys(e.userId);
-	return J(200, {
-		challenge: i,
-		rp: {
-			id: r.rpId,
-			name: r.rpName
-		},
-		user: {
-			id: e.userId,
-			name: e.userName,
-			displayName: e.userName
-		},
-		pubKeyCredParams: [{
-			type: "public-key",
-			alg: -7
-		}, {
-			type: "public-key",
-			alg: -257
-		}],
-		excludeCredentials: a.map((e) => ({
-			type: "public-key",
-			id: e.credentialId
-		})),
-		authenticatorSelection: {
-			userVerification: "preferred",
-			residentKey: "preferred"
-		},
-		timeout: Y * 1e3
-	});
-}), Le = (e, t, n, r) => S.gen(function* () {
-	if (!(yield* t.findById(e.userId))) return J(404, { error: "user_not_found" });
-	let i = yield* n.take(`${e.userId}:register`);
-	if (!i) return J(400, { error: "no_pending_challenge" });
-	let a = te({
-		clientDataJSON: e.clientDataJSON,
-		authenticatorData: e.authenticatorData,
-		expectedChallenge: i,
-		expectedOrigin: r.origin,
-		rpId: r.rpId
-	});
-	return a.ok ? (yield* t.insertPasskey({
-		id: l("pk"),
-		credentialId: a.result.credentialId,
-		userId: e.userId,
-		publicKey: a.result.publicKey,
-		counter: a.result.counter,
-		transports: e.transports ?? null
-	}).pipe(S.ignore), J(200, {
-		ok: !0,
-		credentialId: a.result.credentialId
-	})) : J(400, { error: a.error });
-}), Re = (e, t, n, r) => S.gen(function* () {
-	let i = y(), a = e.userId ? `${e.userId}:assert` : "*:assert";
-	yield* n.put(a, i, Y);
-	let o = e.userId ? (yield* t.listPasskeys(e.userId)).map((e) => ({
-		type: "public-key",
-		id: e.credentialId
-	})) : [];
-	return J(200, {
-		challenge: i,
-		rpId: r.rpId,
-		allowCredentials: o,
-		userVerification: "preferred",
-		timeout: Y * 1e3
-	});
-}), ze = (e, t, n, r, a) => S.gen(function* () {
-	let o = yield* t.findPasskey(e.credentialId);
-	if (!o) return J(401, { error: "unknown_credential" });
-	let s = e.userId ? `${e.userId}:assert` : "*:assert", c = yield* n.take(s);
-	if (!c) return J(400, { error: "no_pending_challenge" });
-	let u = b({
-		clientDataJSON: e.clientDataJSON,
-		authenticatorData: e.authenticatorData,
-		signature: e.signature,
-		expectedChallenge: c,
-		expectedOrigin: r.origin,
-		rpId: r.rpId,
-		storedPublicKey: o.publicKey,
-		storedCounter: o.counter
-	});
-	if (!u.ok) return J(401, { error: u.error });
-	if (!(yield* t.advancePasskeyCounter(e.credentialId, u.result.newCounter)) && u.result.newCounter !== 0) return J(401, { error: "counter_regressed" });
-	let d = yield* t.findById(o.userId);
-	if (!d) return J(401, { error: "unknown_credential" });
-	let p = yield* B(d, a);
-	if (p) return p;
-	let m = yield* t.listMemberships(d.id), h = l("sess");
-	yield* t.insertSession({
-		id: h,
-		userId: d.id,
-		tenantId: d.tenantId,
-		expiresAt: new Date(Date.now() + Ne * 1e3),
-		ipAddress: null,
-		userAgent: null
-	}).pipe(S.ignore);
-	let g = f(d, { memberships: m }), _ = g.type === "user" ? {
-		...g,
-		metadata: {
-			...g.metadata ?? {},
-			sessionId: h
-		}
-	} : g, v = i(_, N(a), {
-		ttlSeconds: Ne,
-		...a.cookieDomain ? { domain: a.cookieDomain } : {},
-		secure: a.cookieSecure ?? !0
-	});
-	return J(200, {
-		ok: !0,
-		subject: _
-	}, { setCookie: v.setCookie });
-}), Be = (e) => {
-	for (let t of e) if (Ve(t)) return t.auth.sessionStrategy;
-	return null;
-}, Ve = (e) => typeof e.auth == "object" && e.auth !== null && typeof e.auth.sessionStrategy == "object", He = "/auth", Ue = (e) => {
-	let t = Buffer.from(e.rawBody).toString("utf8");
-	if (!t) return {};
-	if ((e.headers["content-type"] ?? "").includes("application/x-www-form-urlencoded")) {
-		let e = new URLSearchParams(t), n = {};
-		for (let [t, r] of e) n[t] = r;
-		return n;
-	}
-	try {
-		let e = JSON.parse(t);
-		return typeof e == "object" && e ? e : {};
-	} catch {
-		return {};
-	}
-}, X = (e) => ({
-	status: e.status,
-	...e.body === void 0 ? {} : { body: e.body },
-	...e.contentType === void 0 ? {} : { contentType: e.contentType },
-	headers: {
-		...e.setCookie === void 0 ? {} : { "set-cookie": e.setCookie },
-		...e.location === void 0 ? {} : { location: e.location }
-	}
-}), Z = (e, t) => ({
-	status: e,
-	body: JSON.stringify(t),
-	contentType: "application/json; charset=utf-8"
-}), Q = (e) => typeof e == "string" ? e : void 0, $ = (e, t) => typeof t == "string" && t.length > 0 ? { [e]: t } : {}, We = (e) => {
-	let t = e.prefix ?? He, n = e.store, r = e.challengeStore ?? Pe(), o = {
-		...e.secret === void 0 ? {} : { secret: e.secret },
-		...e.secrets === void 0 ? {} : { secrets: e.secrets },
-		defaultTenantId: e.defaultTenantId,
-		...e.cookieDomain === void 0 ? {} : { cookieDomain: e.cookieDomain },
-		...e.cookieSecure === void 0 ? {} : { cookieSecure: e.cookieSecure },
-		...e.successRedirect === void 0 ? {} : { successRedirect: e.successRedirect },
-		...e.sendEmail === void 0 ? {} : { sendEmail: e.sendEmail },
-		...e.appBaseUrl === void 0 ? {} : { appBaseUrl: e.appBaseUrl },
-		...e.subjectGuards === void 0 ? {} : { subjectGuards: e.subjectGuards },
-		...e.lockout === void 0 ? {} : { lockout: e.lockout },
-		...e.now === void 0 ? {} : { now: e.now }
-	}, s = u(n, e.sessionRevocation ?? {}), c = async (e) => {
-		let t = N(o), r = a(e.headers.cookie, t);
-		if (!r) return null;
-		let c = d(r.subject);
-		if (c && !await S.runPromise(s.isLive(c))) return null;
-		if (r.renew || r.kid !== t.current.kid) {
-			let e = Math.max(r.exp - r.iat, 60), a = i(r.subject, t, {
-				ttlSeconds: e,
-				...o.cookieDomain ? { domain: o.cookieDomain } : {},
-				secure: o.cookieSecure ?? !0
-			});
-			return c && await S.runPromise(n.touchSession(c, new Date(Date.now() + e * 1e3))), {
-				subject: r.subject,
-				sessionId: c,
-				renewSetCookie: a.setCookie
-			};
-		}
-		return {
-			subject: r.subject,
-			sessionId: c
-		};
-	}, l = (e, t) => {
-		if (!t) return e;
-		let n = e.headers ?? {};
-		return n["set-cookie"] ? e : {
-			...e,
-			headers: {
-				...n,
-				"set-cookie": t
-			}
-		};
-	}, f = (t) => {
-		let n = t.headers[_];
-		return ee(n, oe(t.headers.cookie, g), P(e));
-	}, m = (e, n) => e.path === `${t}${n}`, h = (e) => S.runPromise(e).then(X), v = {
-		method: "*",
-		path: t,
-		handle: async (i) => {
-			let a = i.method === "GET" ? {} : Ue(i);
-			if (i.method === "GET" && m(i, "/csrf")) return X(Se(o));
-			if (i.method === "POST" && m(i, "/sign-in")) return h(V({
-				email: Q(a.email) ?? "",
-				password: Q(a.password) ?? "",
-				...a.redirectAfter === void 0 ? {} : { redirectAfter: !!a.redirectAfter },
-				...i.headers["x-forwarded-for"] ? { ipAddress: i.headers["x-forwarded-for"] } : {},
-				...i.headers["user-agent"] ? { userAgent: i.headers["user-agent"] } : {}
-			}, n, o));
-			if (i.method === "POST" && m(i, "/sign-up")) return h(U({
-				email: Q(a.email) ?? "",
-				password: Q(a.password) ?? "",
-				...$("tenantId", a.tenantId),
-				...a.redirectAfter === void 0 ? {} : { redirectAfter: !!a.redirectAfter }
-			}, n, o));
-			if (i.method === "POST" && m(i, "/sign-out")) {
-				let e = await c(i);
-				return e && e.subject.type === "user" && e.sessionId && (await S.runPromise(n.revokeSession(e.subject.id, e.sessionId)), s.invalidate(e.sessionId)), X(W(o));
-			}
-			if (i.method === "POST" && m(i, "/magic-link")) return h(we({
-				email: Q(a.email) ?? "",
-				...$("callbackPath", a.callbackPath)
-			}, n, o));
-			if (i.method === "POST" && m(i, "/magic-link/callback")) return h(Te({
-				token: Q(a.token) ?? "",
-				...a.redirectAfter === void 0 ? {} : { redirectAfter: !!a.redirectAfter }
-			}, n, o));
-			if (i.method === "POST" && m(i, "/password-reset")) return h(Ee({
-				email: Q(a.email) ?? "",
-				...$("callbackPath", a.callbackPath)
-			}, n, o));
-			if (i.method === "POST" && m(i, "/password-reset/confirm")) return h(De({
-				token: Q(a.token) ?? "",
-				newPassword: Q(a.newPassword) ?? ""
-			}, n));
-			if (i.method === "POST" && m(i, "/mfa/verify")) return h(H({
-				pendingToken: Q(a.pendingToken) ?? "",
-				...$("code", a.code),
-				...$("recoveryCode", a.recoveryCode),
-				...a.redirectAfter === void 0 ? {} : { redirectAfter: !!a.redirectAfter },
-				...i.headers["x-forwarded-for"] ? { ipAddress: i.headers["x-forwarded-for"] } : {},
-				...i.headers["user-agent"] ? { userAgent: i.headers["user-agent"] } : {}
-			}, n, o));
-			if (e.passkey && i.method === "POST" && m(i, "/passkey/assert/options")) return h(Re({ ...$("userId", a.userId) }, n, r, e.passkey));
-			if (e.passkey && i.method === "POST" && m(i, "/passkey/assert/verify")) return h(ze({
-				credentialId: Q(a.credentialId) ?? "",
-				clientDataJSON: Q(a.clientDataJSON) ?? "",
-				authenticatorData: Q(a.authenticatorData) ?? "",
-				signature: Q(a.signature) ?? "",
-				...$("userId", a.userId)
-			}, n, r, e.passkey, o));
-			let u = await c(i), d = u?.subject ?? null, p = () => !d || d.type !== "user" ? Z(401, { error: "unauthenticated" }) : { userId: d.id }, g = () => f(i) ? null : Z(403, { error: "csrf" }), _ = (e) => h(e).then((e) => l(e, u?.renewSetCookie));
-			if (i.method === "GET" && m(i, "/session")) {
-				let e = p();
-				return "status" in e ? e : l(Z(200, {
-					ok: !0,
-					subject: d,
-					renewed: u?.renewSetCookie !== void 0
-				}), u?.renewSetCookie);
-			}
-			if (i.method === "GET" && m(i, "/sessions")) {
-				let e = p();
-				return "status" in e ? e : _(Oe({ userId: e.userId }, n));
-			}
-			if (i.method === "GET" && m(i, "/memberships")) {
-				let e = p();
-				return "status" in e ? e : _(Me({ userId: e.userId }, n));
-			}
-			if (i.method === "POST" && m(i, "/sessions/revoke")) {
-				let e = p();
-				if ("status" in e) return e;
-				let t = g();
-				if (t) return t;
-				let r = Q(a.sessionId) ?? "";
-				return _(ke({
-					userId: e.userId,
-					sessionId: r
-				}, n)).then((e) => (r && s.invalidate(r), e));
-			}
-			if (i.method === "POST" && m(i, "/sessions/revoke-others")) {
-				let e = p();
-				return "status" in e ? e : g() || _(Ae({
-					userId: e.userId,
-					keepSessionId: u?.sessionId ?? "__none__"
-				}, n));
-			}
-			if (i.method === "POST" && m(i, "/switch-tenant")) {
-				let t = p();
-				return "status" in t ? t : g() || h(je({
-					userId: t.userId,
-					targetTenantId: Q(a.targetTenantId) ?? "",
-					...typeof a.clientId == "number" ? { clientId: a.clientId } : {},
-					...u?.sessionId ? { sessionId: u.sessionId } : {},
-					...d?.type === "user" && d.metadata ? { metadata: d.metadata } : {}
-				}, n, o, e.rebind));
-			}
-			if (e.mfa && i.method === "POST" && m(i, "/mfa/enroll/start")) {
-				let t = p();
-				if ("status" in t) return t;
-				let r = g();
-				if (r) return r;
-				let i = await S.runPromise(n.findById(t.userId));
-				return _(G({
-					userId: t.userId,
-					issuer: e.mfa.issuer,
-					accountName: i?.email ?? t.userId
-				}, n));
-			}
-			if (e.mfa && i.method === "POST" && m(i, "/mfa/enroll/verify")) {
-				let e = p();
-				return "status" in e ? e : g() || _(K({
-					userId: e.userId,
-					code: Q(a.code) ?? ""
-				}, n));
-			}
-			if (e.mfa && i.method === "POST" && m(i, "/mfa/unenroll")) {
-				let e = p();
-				return "status" in e ? e : g() || _(xe({ userId: e.userId }, n));
-			}
-			if (e.mfa && i.method === "POST" && m(i, "/mfa/recovery-codes/regenerate")) {
-				let e = p();
-				return "status" in e ? e : g() || _(q({ userId: e.userId }, n));
-			}
-			if (e.passkey && i.method === "POST" && m(i, "/passkey/register/options")) {
-				let t = p();
-				return "status" in t ? t : g() || _(Ie({
-					userId: t.userId,
-					userName: Q(a.userName) ?? t.userId
-				}, n, r, e.passkey));
-			}
-			if (e.passkey && i.method === "POST" && m(i, "/passkey/register/verify")) {
-				let t = p();
-				return "status" in t ? t : g() || _(Le({
-					userId: t.userId,
-					credentialId: Q(a.credentialId) ?? "",
-					clientDataJSON: Q(a.clientDataJSON) ?? "",
-					authenticatorData: Q(a.authenticatorData) ?? "",
-					...$("transports", a.transports)
-				}, n, r, e.passkey));
-			}
-			return !e.passkey && i.path.startsWith(`${t}/passkey/`) ? Z(501, { error: "passkey_not_configured" }) : Z(404, { error: "not_found" });
-		}
-	}, y = se({
-		name: e.name ? `@voltro/plugin-auth#${e.name}` : "@voltro/plugin-auth",
-		description: "Auth routes — mounts the full auth surface (password, magic-link, password-reset, CSRF, session probe/list/revoke, memberships, switch-tenant, passkey ceremonies) under /auth on the framework listener, with keyed secret rotation + request-time revocation.",
-		permissions: [],
-		declaredEnv: Ge,
-		httpRoutes: [v],
-		onActivate: (n) => S.sync(() => {
-			n.logger.info("auth routes active", {
-				prefix: t,
-				passkey: e.passkey ? e.passkey.rpId : "disabled",
-				email: e.sendEmail ? "wired" : "unwired",
-				revocationWindowMs: s.ttlMs
-			});
-		}),
-		onDeactivate: () => S.void
-	}), b = e.secrets ?? e.secret;
-	return {
-		...y,
-		auth: { sessionStrategy: p({
-			...b === void 0 ? {} : { secret: b },
-			store: n,
-			revocation: s
-		}) }
-	};
-}, Ge = [
-	{
-		name: "VOLTRO_SESSION_SECRET_PREVIOUS",
-		required: !1,
-		secret: !0,
-		description: "The session secret being rotated AWAY from. While set, cookies signed with it still verify (and get re-issued under the current secret on the next authenticated /auth response). Set the new secret as VOLTRO_SESSION_SECRET, move the old one here for one session lifetime, then drop it.",
-		example: "the-previous-signing-secret"
-	},
-	{
-		name: "VOLTRO_SESSION_KID",
-		required: !1,
-		secret: !1,
-		description: "Non-secret key-id label stamped into cookies signed with the current secret (default 'k0').",
-		example: "2026-07"
-	},
-	{
-		name: "VOLTRO_SESSION_KID_PREVIOUS",
-		required: !1,
-		secret: !1,
-		description: "Non-secret key-id label for the previous secret (default 'k-previous').",
-		example: "2026-01"
-	}
-];
-//#endregion
-export { z as A, Ee as C, W as D, V as E, k as F, A as I, C as L, j as M, ge as N, U as O, O as P, De as S, ke as T, G as _, ze as a, xe as b, Pe as c, B as d, Se as f, we as g, Te as h, Re as i, E as j, je as k, be as l, Oe as m, Be as n, Ie as o, Me as p, Fe as r, Le as s, We as t, N as u, K as v, Ae as w, H as x, q as y };