@voltro/plugin-auth 0.4.0 → 0.6.0

package/dist/plugin-CRt-kdEA.js

@@ -1,801 +0,0 @@
-import { hashPassword as e, verifyPassword as t, verifyPasswordWithRehash as n } from "./password.js";
-import { clearSessionCookie as r, issueSession as i, readSessionKeyed as a, sessionSecretsOf as o } from "./session.js";
-import { a as s, l as c, o as l, s as u, t as d } from "./strategy-CQ2YCIcr.js";
-import { hashToken as f, mintToken as p } from "./tokens.js";
-import { CSRF_COOKIE_NAME as m, CSRF_HEADER_NAME as h, issueCsrfToken as g, verifyCsrf as _ } from "./csrf.js";
-import { generateChallenge as v, verifyAssertion as y, verifyRegistration as ee } from "./webauthn.js";
-import { createHmac as te, randomBytes as b, timingSafeEqual as ne } from "node:crypto";
-import { Data as re, Effect as x } from "effect";
-import { buildSetCookie as ie, readCookie as ae } from "@voltro/protocol/session";
-import { definePlugin as oe } from "@voltro/protocol";
-//#region src/subjectGuard.ts
-var se = { ok: !0 }, S = (e, t) => x.gen(function* () {
-	for (let n of e) {
-		let e = yield* n(t);
-		if (!e.ok) return e;
-	}
-	return se;
-}), C = 30, w = 6, ce = 20, le = "sha1", ue = 1, T = class extends re.TaggedError("TotpVerifyError") {}, E = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567", de = (e) => {
-	let t = 0, n = 0, r = "";
-	for (let i of e) for (n = n << 8 | i, t += 8; t >= 5;) r += E[n >>> t - 5 & 31], t -= 5;
-	return t > 0 && (r += E[n << 5 - t & 31]), r;
-}, fe = (e) => {
-	let t = e.toUpperCase().replace(/[\s=]+/g, "");
-	if (!/^[A-Z2-7]+$/.test(t)) return null;
-	let n = new Uint8Array(Math.floor(t.length * 5 / 8)), r = 0, i = 0, a = 0;
-	for (let e of t) {
-		let t = E.indexOf(e);
-		if (t === -1) return null;
-		i = i << 5 | t, r += 5, r >= 8 && (n[a++] = i >>> r - 8 & 255, r -= 8);
-	}
-	return n.subarray(0, a);
-}, pe = (e) => {
-	let t = Buffer.alloc(8);
-	return t.writeBigUInt64BE(BigInt(e), 0), t;
-}, D = (e, t) => {
-	let n = te(le, Buffer.from(e));
-	n.update(pe(t));
-	let r = n.digest(), i = r[r.length - 1] & 15, a = (r[i] & 127) << 24 | (r[i + 1] & 255) << 16 | (r[i + 2] & 255) << 8 | r[i + 3] & 255;
-	return String(a % 10 ** w).padStart(w, "0");
-}, O = () => de(b(ce)), me = (e) => `otpauth://totp/${encodeURIComponent(`${e.issuer}:${e.accountName}`)}?${new URLSearchParams({
-	secret: e.secret,
-	issuer: e.issuer,
-	algorithm: "SHA1",
-	digits: String(w),
-	period: String(C)
-}).toString()}`, he = (e, t = Date.now()) => {
-	let n = fe(e);
-	return n ? D(n, Math.floor(t / 1e3 / C)) : "000000";
-}, k = (e, t, n = Date.now()) => x.gen(function* () {
-	let r = fe(e);
-	if (!r) return yield* x.fail(new T({ reason: "malformedSecret" }));
-	let i = t.replace(/\s+/g, "");
-	if (!/^[0-9]{6}$/.test(i)) return yield* x.fail(new T({ reason: "invalidCode" }));
-	let a = Math.floor(n / 1e3 / C), o = Buffer.from(i);
-	for (let e = -1; e <= ue; e++) {
-		let t = D(r, a + e), n = Buffer.from(t);
-		if (n.length === o.length && ne(n, o)) return !0;
-	}
-	return yield* x.fail(new T({ reason: "invalidCode" }));
-}), A = (e = 10) => {
-	let t = [];
-	for (let n = 0; n < e; n++) {
-		let e = de(b(16)).slice(0, 25).match(/.{1,5}/g) ?? [];
-		t.push(e.join("-"));
-	}
-	return t;
-}, j = (e) => e.secrets ?? o(e.secret), M = (e, t, n = {}) => ({
-	status: e,
-	body: JSON.stringify(t),
-	contentType: "application/json; charset=utf-8",
-	...n
-}), N = (e, t = {}) => ({
-	status: 302,
-	body: "",
-	contentType: "text/plain",
-	location: e,
-	...t
-}), P = 3600 * 24 * 7, F = (e, t) => e.type === "user" ? {
-	...e,
-	metadata: {
-		...e.metadata ?? {},
-		sessionId: t
-	}
-} : e, I = (e, t, n, r = {}) => x.gen(function* () {
-	let a = yield* t.listMemberships(e.id), o = s("sess");
-	yield* t.insertSession({
-		id: o,
-		userId: e.id,
-		tenantId: e.tenantId,
-		expiresAt: new Date(Date.now() + P * 1e3),
-		ipAddress: r.ipAddress ?? null,
-		userAgent: r.userAgent ?? null
-	}).pipe(x.ignore);
-	let c = F(u(e, { memberships: a }), o);
-	return {
-		setCookie: i(c, j(n), {
-			ttlSeconds: P,
-			...n.cookieDomain ? { domain: n.cookieDomain } : {},
-			secure: n.cookieSecure ?? !0
-		}).setCookie,
-		subject: c
-	};
-}), L = (e, t) => x.gen(function* () {
-	let n = t.subjectGuards ?? [];
-	if (n.length === 0) return null;
-	let r = yield* S(n, e);
-	return r.ok ? null : M(403, {
-		error: r.code,
-		message: r.message
-	});
-}), ge = 300, R = (r, i, a) => x.gen(function* () {
-	if (!r.email || !r.password) return M(400, { error: "email and password required" });
-	let o = yield* i.findByEmail(r.email), c = o ? yield* n(r.password, o.passwordHash) : yield* x.gen(function* () {
-		let n = yield* e("decoy-not-a-real-password").pipe(x.orElseSucceed(() => ""));
-		return yield* t(r.password, n), { valid: !1 };
-	});
-	if (!o || !c.valid) return M(401, { error: "invalid credentials" });
-	let l = yield* L(o, a);
-	if (l) return l;
-	if (c.rehash && (yield* i.updatePassword(o.id, c.rehash).pipe(x.ignore)), o.mfaEnrolledAt) {
-		let e = p("mfa-pending", 300);
-		return yield* i.insertToken({
-			id: s("tok"),
-			tokenHash: e.tokenHash,
-			userId: o.id,
-			purpose: "mfa-pending",
-			expiresAt: e.expiresAt
-		}).pipe(x.ignore), M(200, {
-			ok: !0,
-			mfaRequired: !0,
-			pendingToken: e.token,
-			expiresInSeconds: 300
-		});
-	}
-	let { setCookie: u, subject: d } = yield* I(o, i, a, {
-		ipAddress: r.ipAddress ?? null,
-		userAgent: r.userAgent ?? null
-	});
-	return r.redirectAfter ? N(a.successRedirect ?? "/", { setCookie: u }) : M(200, {
-		ok: !0,
-		subject: d
-	}, { setCookie: u });
-}), z = (e, t, n) => x.gen(function* () {
-	if (!e.pendingToken) return M(400, { error: "pending token required" });
-	if (!e.code && !e.recoveryCode) return M(400, { error: "code or recoveryCode required" });
-	let r = yield* t.consumeToken(f(e.pendingToken), "mfa-pending");
-	if (!r) return M(401, { error: "invalid or expired challenge" });
-	let i = yield* t.findById(r.userId);
-	if (!i || !i.mfaEnrolledAt || !i.mfaSecret) return M(401, { error: "mfa not enrolled" });
-	let a = yield* L(i, n);
-	if (a) return a;
-	if (!(e.recoveryCode ? yield* t.consumeRecoveryCode(i.id, f(e.recoveryCode.trim())) : yield* k(i.mfaSecret, e.code ?? "").pipe(x.map(() => !0), x.catchTag("TotpVerifyError", () => x.succeed(!1))))) return M(401, { error: "invalid_code" });
-	let { setCookie: o, subject: s } = yield* I(i, t, n, {
-		ipAddress: e.ipAddress ?? null,
-		userAgent: e.userAgent ?? null
-	});
-	return e.redirectAfter ? N(n.successRedirect ?? "/", { setCookie: o }) : M(200, {
-		ok: !0,
-		subject: s
-	}, { setCookie: o });
-}), B = (t, n, r) => x.gen(function* () {
-	if (!t.email || !t.password) return M(400, { error: "email and password required" });
-	if (t.password.length < 8) return M(400, { error: "password must be at least 8 characters" });
-	if (yield* n.findByEmail(t.email)) return M(409, { error: "email already registered" });
-	let a = t.tenantId ?? r.defaultTenantId, o = yield* e(t.password), c = yield* n.insert({
-		id: s("user"),
-		email: t.email,
-		passwordHash: o,
-		tenantId: a
-	});
-	yield* n.addMembership({
-		userId: c.id,
-		tenantId: a,
-		role: "owner"
-	}).pipe(x.ignore);
-	let l = yield* n.listMemberships(c.id), d = s("sess");
-	yield* n.insertSession({
-		id: d,
-		userId: c.id,
-		tenantId: a,
-		expiresAt: new Date(Date.now() + P * 1e3),
-		ipAddress: null,
-		userAgent: null
-	}).pipe(x.ignore);
-	let f = F(u(c, { memberships: l }), d), p = i(f, j(r), {
-		ttlSeconds: P,
-		...r.cookieDomain ? { domain: r.cookieDomain } : {},
-		secure: r.cookieSecure ?? !0
-	});
-	return t.redirectAfter ? N(r.successRedirect ?? "/", { setCookie: p.setCookie }) : M(200, {
-		ok: !0,
-		subject: f
-	}, { setCookie: p.setCookie });
-}).pipe(x.catchAll((e) => x.succeed(M(500, {
-	error: "signup_failed",
-	cause: String(e)
-})))), V = (e) => ({
-	status: 302,
-	body: "",
-	location: e.successRedirect ?? "/",
-	setCookie: r({
-		...e.cookieDomain ? { domain: e.cookieDomain } : {},
-		secure: e.cookieSecure ?? !0
-	})
-}), H = (e, t) => x.gen(function* () {
-	let n = yield* t.findById(e.userId);
-	if (!n) return M(404, { error: "user_not_found" });
-	let r = O();
-	return yield* t.setMfaSecret(n.id, r).pipe(x.catchAll(() => x.succeed(n))), M(200, {
-		ok: !0,
-		secret: r,
-		otpauthUrl: me({
-			issuer: e.issuer,
-			accountName: e.accountName,
-			secret: r
-		})
-	});
-}), U = (e, t) => x.gen(function* () {
-	let n = yield* t.findById(e.userId);
-	if (!n) return M(404, { error: "user_not_found" });
-	if (!n.mfaSecret) return M(400, { error: "no_enrollment_in_progress" });
-	if (n.mfaEnrolledAt) return M(409, { error: "already_enrolled" });
-	if (!(yield* k(n.mfaSecret, e.code).pipe(x.map(() => !0), x.catchTag("TotpVerifyError", () => x.succeed(!1))))) return M(401, { error: "invalid_code" });
-	yield* t.markMfaEnrolled(n.id).pipe(x.catchAll(() => x.succeed(n)));
-	let r = A();
-	return yield* t.replaceRecoveryCodes(n.id, r.map((e) => f(e))).pipe(x.ignore), M(200, {
-		ok: !0,
-		enrolled: !0,
-		recoveryCodes: r
-	});
-}), W = (e, t) => x.gen(function* () {
-	let n = yield* t.findById(e.userId);
-	if (!n) return M(404, { error: "user_not_found" });
-	if (!n.mfaEnrolledAt) return M(400, { error: "mfa_not_enrolled" });
-	let r = A();
-	return yield* t.replaceRecoveryCodes(n.id, r.map((e) => f(e))).pipe(x.ignore), M(200, {
-		ok: !0,
-		recoveryCodes: r
-	});
-}), G = (e, t) => x.gen(function* () {
-	let n = yield* t.findById(e.userId);
-	return n ? (yield* t.clearMfa(n.id).pipe(x.catchAll(() => x.succeed(n))), yield* t.replaceRecoveryCodes(n.id, []).pipe(x.ignore), M(200, {
-		ok: !0,
-		enrolled: !1
-	})) : M(404, { error: "user_not_found" });
-}), K = (e) => {
-	let t = g(e.secret), n = ie(m, t, {
-		httpOnly: !1,
-		sameSite: "lax",
-		secure: e.cookieSecure ?? !0,
-		...e.cookieDomain ? { domain: e.cookieDomain } : {},
-		path: "/"
-	});
-	return M(200, { csrfToken: t }, { setCookie: n });
-}, _e = (e, t, n) => `${e}${t}${t.includes("?") ? "&" : "?"}token=${encodeURIComponent(n)}`, ve = (e, t, n) => x.gen(function* () {
-	if (!e.email) return M(400, { error: "email required" });
-	let r = yield* t.findByEmail(e.email);
-	if (r) {
-		let i = p("magic-link");
-		yield* t.insertToken({
-			id: s("tok"),
-			tokenHash: i.tokenHash,
-			userId: r.id,
-			purpose: "magic-link",
-			expiresAt: i.expiresAt
-		}).pipe(x.ignore);
-		let a = _e(n.appBaseUrl ?? "", e.callbackPath ?? "/auth/magic-link/callback", i.token);
-		n.sendEmail && (yield* x.tryPromise(() => n.sendEmail({
-			to: r.email,
-			kind: "magic-link",
-			actionUrl: a,
-			subject: "Your sign-in link",
-			text: `Sign in: ${a}`,
-			html: `<p><a href="${a}">Sign in</a> — this link expires shortly.</p>`
-		})).pipe(x.ignore));
-	}
-	return M(202, { ok: !0 });
-}), ye = (e, t, n) => x.gen(function* () {
-	if (!e.token) return M(400, { error: "token required" });
-	let r = yield* t.consumeToken(f(e.token), "magic-link");
-	if (!r) return M(401, { error: "invalid or expired token" });
-	let a = yield* t.findById(r.userId);
-	if (!a) return M(401, { error: "invalid or expired token" });
-	let o = yield* L(a, n);
-	if (o) return o;
-	let c = yield* t.listMemberships(a.id), l = s("sess");
-	yield* t.insertSession({
-		id: l,
-		userId: a.id,
-		tenantId: a.tenantId,
-		expiresAt: new Date(Date.now() + P * 1e3),
-		ipAddress: null,
-		userAgent: null
-	}).pipe(x.ignore);
-	let d = F(u(a, { memberships: c }), l), p = i(d, j(n), {
-		ttlSeconds: P,
-		...n.cookieDomain ? { domain: n.cookieDomain } : {},
-		secure: n.cookieSecure ?? !0
-	});
-	return e.redirectAfter ? N(n.successRedirect ?? "/", { setCookie: p.setCookie }) : M(200, {
-		ok: !0,
-		subject: d
-	}, { setCookie: p.setCookie });
-}), be = (e, t, n) => x.gen(function* () {
-	if (!e.email) return M(400, { error: "email required" });
-	let r = yield* t.findByEmail(e.email);
-	if (r) {
-		let i = p("password-reset");
-		yield* t.insertToken({
-			id: s("tok"),
-			tokenHash: i.tokenHash,
-			userId: r.id,
-			purpose: "password-reset",
-			expiresAt: i.expiresAt
-		}).pipe(x.ignore);
-		let a = _e(n.appBaseUrl ?? "", e.callbackPath ?? "/auth/password-reset/callback", i.token);
-		n.sendEmail && (yield* x.tryPromise(() => n.sendEmail({
-			to: r.email,
-			kind: "password-reset",
-			actionUrl: a,
-			subject: "Reset your password",
-			text: `Reset your password: ${a}`,
-			html: `<p><a href="${a}">Reset your password</a> — this link expires shortly.</p>`
-		})).pipe(x.ignore));
-	}
-	return M(202, { ok: !0 });
-}), xe = (t, n) => x.gen(function* () {
-	if (!t.token || !t.newPassword) return M(400, { error: "token and newPassword required" });
-	if (t.newPassword.length < 8) return M(400, { error: "password must be at least 8 characters" });
-	let r = yield* n.consumeToken(f(t.token), "password-reset");
-	if (!r) return M(401, { error: "invalid or expired token" });
-	let i = yield* e(t.newPassword).pipe(x.orElseSucceed(() => ""));
-	return i ? (yield* n.updatePassword(r.userId, i).pipe(x.ignore), yield* n.revokeAllOtherSessions(r.userId, "__none__").pipe(x.ignore), M(200, { ok: !0 })) : M(500, { error: "hash_failed" });
-}), Se = (e, t) => x.gen(function* () {
-	return M(200, { sessions: (yield* t.listSessions(e.userId)).map((e) => ({
-		id: e.id,
-		tenantId: e.tenantId,
-		ipAddress: e.ipAddress ?? null,
-		userAgent: e.userAgent ?? null,
-		createdAt: e.createdAt.toISOString(),
-		lastSeenAt: e.lastSeenAt.toISOString(),
-		expiresAt: e.expiresAt.toISOString()
-	})) });
-}), Ce = (e, t) => x.gen(function* () {
-	return (yield* t.revokeSession(e.userId, e.sessionId)) ? M(200, {
-		ok: !0,
-		revoked: 1
-	}) : M(404, { error: "session_not_found" });
-}), we = (e, t) => x.gen(function* () {
-	return M(200, {
-		ok: !0,
-		revoked: yield* t.revokeAllOtherSessions(e.userId, e.keepSessionId)
-	});
-}), Te = (e, t, n, r) => x.gen(function* () {
-	let a = yield* t.findById(e.userId);
-	if (!a) return M(404, { error: "user_not_found" });
-	let o = yield* t.membershipRole(e.userId, e.targetTenantId);
-	if (o === null) return M(403, { error: "not a member of the target tenant" });
-	let s = yield* t.listMemberships(a.id), c = u(a, {
-		tenantId: e.targetTenantId,
-		memberships: s
-	}), l = e.sessionId ? F(c, e.sessionId) : c;
-	e.clientId !== void 0 && r && r(e.clientId, l);
-	let d = i(l, j(n), {
-		ttlSeconds: P,
-		...n.cookieDomain ? { domain: n.cookieDomain } : {},
-		secure: n.cookieSecure ?? !0
-	});
-	return M(200, {
-		ok: !0,
-		tenantId: e.targetTenantId,
-		role: o,
-		subject: l
-	}, { setCookie: d.setCookie });
-}), q = (e, t) => x.gen(function* () {
-	return M(200, { memberships: (yield* t.listMemberships(e.userId)).map((e) => ({
-		tenantId: e.tenantId,
-		role: e.role,
-		joinedAt: e.joinedAt.toISOString()
-	})) });
-}), J = (e, t, n = {}) => ({
-	status: e,
-	body: JSON.stringify(t),
-	contentType: "application/json; charset=utf-8",
-	...n
-}), Ee = 3600 * 24 * 7, De = () => {
-	let e = /* @__PURE__ */ new Map();
-	return {
-		put: (t, n, r) => x.sync(() => {
-			e.set(t, {
-				challenge: n,
-				expiresAt: Date.now() + r * 1e3
-			});
-		}),
-		take: (t) => x.sync(() => {
-			let n = e.get(t);
-			return e.delete(t), !n || n.expiresAt < Date.now() ? null : n.challenge;
-		})
-	};
-}, Oe = (e) => ({
-	put: (t, n, r) => x.gen(function* () {
-		let i = /* @__PURE__ */ new Date(), a = new Date(i.getTime() + r * 1e3);
-		(yield* e`
-        UPDATE "passkeyChallenges"
-           SET challenge = ${n}, "expiresAt" = ${a}, "createdAt" = ${i}
-         WHERE key = ${t}
-        RETURNING key
-      `).length === 0 && (yield* e`
-          INSERT INTO "passkeyChallenges" (id, key, challenge, "expiresAt", "createdAt")
-          VALUES (${s("pkc")}, ${t}, ${n}, ${a}, ${i})
-        `);
-	}).pipe(x.asVoid, x.orElseSucceed(() => void 0)),
-	take: (t) => x.gen(function* () {
-		let n = (yield* e`
-        DELETE FROM "passkeyChallenges" WHERE key = ${t}
-        RETURNING challenge, "expiresAt"
-      `)[0];
-		return n && n.expiresAt.getTime() > Date.now() ? n.challenge : null;
-	}).pipe(x.orElseSucceed(() => null))
-}), Y = 300, ke = (e, t, n, r) => x.gen(function* () {
-	if (!(yield* t.findById(e.userId))) return J(404, { error: "user_not_found" });
-	let i = v();
-	yield* n.put(`${e.userId}:register`, i, Y);
-	let a = yield* t.listPasskeys(e.userId);
-	return J(200, {
-		challenge: i,
-		rp: {
-			id: r.rpId,
-			name: r.rpName
-		},
-		user: {
-			id: e.userId,
-			name: e.userName,
-			displayName: e.userName
-		},
-		pubKeyCredParams: [{
-			type: "public-key",
-			alg: -7
-		}, {
-			type: "public-key",
-			alg: -257
-		}],
-		excludeCredentials: a.map((e) => ({
-			type: "public-key",
-			id: e.credentialId
-		})),
-		authenticatorSelection: {
-			userVerification: "preferred",
-			residentKey: "preferred"
-		},
-		timeout: Y * 1e3
-	});
-}), Ae = (e, t, n, r) => x.gen(function* () {
-	if (!(yield* t.findById(e.userId))) return J(404, { error: "user_not_found" });
-	let i = yield* n.take(`${e.userId}:register`);
-	if (!i) return J(400, { error: "no_pending_challenge" });
-	let a = ee({
-		clientDataJSON: e.clientDataJSON,
-		authenticatorData: e.authenticatorData,
-		expectedChallenge: i,
-		expectedOrigin: r.origin,
-		rpId: r.rpId
-	});
-	return a.ok ? (yield* t.insertPasskey({
-		id: s("pk"),
-		credentialId: a.result.credentialId,
-		userId: e.userId,
-		publicKey: a.result.publicKey,
-		counter: a.result.counter,
-		transports: e.transports ?? null
-	}).pipe(x.ignore), J(200, {
-		ok: !0,
-		credentialId: a.result.credentialId
-	})) : J(400, { error: a.error });
-}), je = (e, t, n, r) => x.gen(function* () {
-	let i = v(), a = e.userId ? `${e.userId}:assert` : "*:assert";
-	yield* n.put(a, i, Y);
-	let o = e.userId ? (yield* t.listPasskeys(e.userId)).map((e) => ({
-		type: "public-key",
-		id: e.credentialId
-	})) : [];
-	return J(200, {
-		challenge: i,
-		rpId: r.rpId,
-		allowCredentials: o,
-		userVerification: "preferred",
-		timeout: Y * 1e3
-	});
-}), Me = (e, t, n, r, a) => x.gen(function* () {
-	let o = yield* t.findPasskey(e.credentialId);
-	if (!o) return J(401, { error: "unknown_credential" });
-	let c = e.userId ? `${e.userId}:assert` : "*:assert", l = yield* n.take(c);
-	if (!l) return J(400, { error: "no_pending_challenge" });
-	let d = y({
-		clientDataJSON: e.clientDataJSON,
-		authenticatorData: e.authenticatorData,
-		signature: e.signature,
-		expectedChallenge: l,
-		expectedOrigin: r.origin,
-		rpId: r.rpId,
-		storedPublicKey: o.publicKey,
-		storedCounter: o.counter
-	});
-	if (!d.ok) return J(401, { error: d.error });
-	if (!(yield* t.advancePasskeyCounter(e.credentialId, d.result.newCounter)) && d.result.newCounter !== 0) return J(401, { error: "counter_regressed" });
-	let f = yield* t.findById(o.userId);
-	if (!f) return J(401, { error: "unknown_credential" });
-	let p = yield* L(f, a);
-	if (p) return p;
-	let m = yield* t.listMemberships(f.id), h = s("sess");
-	yield* t.insertSession({
-		id: h,
-		userId: f.id,
-		tenantId: f.tenantId,
-		expiresAt: new Date(Date.now() + Ee * 1e3),
-		ipAddress: null,
-		userAgent: null
-	}).pipe(x.ignore);
-	let g = u(f, { memberships: m }), _ = g.type === "user" ? {
-		...g,
-		metadata: {
-			...g.metadata ?? {},
-			sessionId: h
-		}
-	} : g, v = i(_, j(a), {
-		ttlSeconds: Ee,
-		...a.cookieDomain ? { domain: a.cookieDomain } : {},
-		secure: a.cookieSecure ?? !0
-	});
-	return J(200, {
-		ok: !0,
-		subject: _
-	}, { setCookie: v.setCookie });
-}), Ne = (e) => {
-	for (let t of e) if (Pe(t)) return t.auth.sessionStrategy;
-	return null;
-}, Pe = (e) => typeof e.auth == "object" && e.auth !== null && typeof e.auth.sessionStrategy == "object", Fe = "/auth", Ie = (e) => {
-	let t = Buffer.from(e.rawBody).toString("utf8");
-	if (!t) return {};
-	if ((e.headers["content-type"] ?? "").includes("application/x-www-form-urlencoded")) {
-		let e = new URLSearchParams(t), n = {};
-		for (let [t, r] of e) n[t] = r;
-		return n;
-	}
-	try {
-		let e = JSON.parse(t);
-		return typeof e == "object" && e ? e : {};
-	} catch {
-		return {};
-	}
-}, X = (e) => ({
-	status: e.status,
-	...e.body === void 0 ? {} : { body: e.body },
-	...e.contentType === void 0 ? {} : { contentType: e.contentType },
-	headers: {
-		...e.setCookie === void 0 ? {} : { "set-cookie": e.setCookie },
-		...e.location === void 0 ? {} : { location: e.location }
-	}
-}), Z = (e, t) => ({
-	status: e,
-	body: JSON.stringify(t),
-	contentType: "application/json; charset=utf-8"
-}), Q = (e) => typeof e == "string" ? e : void 0, $ = (e, t) => typeof t == "string" && t.length > 0 ? { [e]: t } : {}, Le = (e) => {
-	let t = e.prefix ?? Fe, n = e.store, r = e.challengeStore ?? De(), o = {
-		secret: e.secret,
-		...e.secrets === void 0 ? {} : { secrets: e.secrets },
-		defaultTenantId: e.defaultTenantId,
-		...e.cookieDomain === void 0 ? {} : { cookieDomain: e.cookieDomain },
-		...e.cookieSecure === void 0 ? {} : { cookieSecure: e.cookieSecure },
-		...e.successRedirect === void 0 ? {} : { successRedirect: e.successRedirect },
-		...e.sendEmail === void 0 ? {} : { sendEmail: e.sendEmail },
-		...e.appBaseUrl === void 0 ? {} : { appBaseUrl: e.appBaseUrl },
-		...e.subjectGuards === void 0 ? {} : { subjectGuards: e.subjectGuards }
-	}, s = c(n, e.sessionRevocation ?? {}), u = async (e) => {
-		let t = j(o), r = a(e.headers.cookie, t);
-		if (!r) return null;
-		let c = l(r.subject);
-		if (c && !await x.runPromise(s.isLive(c))) return null;
-		if (r.renew || r.kid !== t.current.kid) {
-			let e = Math.max(r.exp - r.iat, 60), a = i(r.subject, t, {
-				ttlSeconds: e,
-				...o.cookieDomain ? { domain: o.cookieDomain } : {},
-				secure: o.cookieSecure ?? !0
-			});
-			return c && await x.runPromise(n.touchSession(c, new Date(Date.now() + e * 1e3))), {
-				subject: r.subject,
-				sessionId: c,
-				renewSetCookie: a.setCookie
-			};
-		}
-		return {
-			subject: r.subject,
-			sessionId: c
-		};
-	}, f = (e, t) => {
-		if (!t) return e;
-		let n = e.headers ?? {};
-		return n["set-cookie"] ? e : {
-			...e,
-			headers: {
-				...n,
-				"set-cookie": t
-			}
-		};
-	}, p = (t) => {
-		let n = t.headers[h];
-		return _(n, ae(t.headers.cookie, m), e.secret);
-	}, g = (e, n) => e.path === `${t}${n}`, v = (e) => x.runPromise(e).then(X), y = {
-		method: "*",
-		path: t,
-		handle: async (i) => {
-			let a = i.method === "GET" ? {} : Ie(i);
-			if (i.method === "GET" && g(i, "/csrf")) return X(K(o));
-			if (i.method === "POST" && g(i, "/sign-in")) return v(R({
-				email: Q(a.email) ?? "",
-				password: Q(a.password) ?? "",
-				...a.redirectAfter === void 0 ? {} : { redirectAfter: !!a.redirectAfter },
-				...i.headers["x-forwarded-for"] ? { ipAddress: i.headers["x-forwarded-for"] } : {},
-				...i.headers["user-agent"] ? { userAgent: i.headers["user-agent"] } : {}
-			}, n, o));
-			if (i.method === "POST" && g(i, "/sign-up")) return v(B({
-				email: Q(a.email) ?? "",
-				password: Q(a.password) ?? "",
-				...$("tenantId", a.tenantId),
-				...a.redirectAfter === void 0 ? {} : { redirectAfter: !!a.redirectAfter }
-			}, n, o));
-			if (i.method === "POST" && g(i, "/sign-out")) {
-				let e = await u(i);
-				return e && e.subject.type === "user" && e.sessionId && (await x.runPromise(n.revokeSession(e.subject.id, e.sessionId)), s.invalidate(e.sessionId)), X(V(o));
-			}
-			if (i.method === "POST" && g(i, "/magic-link")) return v(ve({
-				email: Q(a.email) ?? "",
-				...$("callbackPath", a.callbackPath)
-			}, n, o));
-			if (i.method === "POST" && g(i, "/magic-link/callback")) return v(ye({
-				token: Q(a.token) ?? "",
-				...a.redirectAfter === void 0 ? {} : { redirectAfter: !!a.redirectAfter }
-			}, n, o));
-			if (i.method === "POST" && g(i, "/password-reset")) return v(be({
-				email: Q(a.email) ?? "",
-				...$("callbackPath", a.callbackPath)
-			}, n, o));
-			if (i.method === "POST" && g(i, "/password-reset/confirm")) return v(xe({
-				token: Q(a.token) ?? "",
-				newPassword: Q(a.newPassword) ?? ""
-			}, n));
-			if (i.method === "POST" && g(i, "/mfa/verify")) return v(z({
-				pendingToken: Q(a.pendingToken) ?? "",
-				...$("code", a.code),
-				...$("recoveryCode", a.recoveryCode),
-				...a.redirectAfter === void 0 ? {} : { redirectAfter: !!a.redirectAfter },
-				...i.headers["x-forwarded-for"] ? { ipAddress: i.headers["x-forwarded-for"] } : {},
-				...i.headers["user-agent"] ? { userAgent: i.headers["user-agent"] } : {}
-			}, n, o));
-			if (e.passkey && i.method === "POST" && g(i, "/passkey/assert/options")) return v(je({ ...$("userId", a.userId) }, n, r, e.passkey));
-			if (e.passkey && i.method === "POST" && g(i, "/passkey/assert/verify")) return v(Me({
-				credentialId: Q(a.credentialId) ?? "",
-				clientDataJSON: Q(a.clientDataJSON) ?? "",
-				authenticatorData: Q(a.authenticatorData) ?? "",
-				signature: Q(a.signature) ?? "",
-				...$("userId", a.userId)
-			}, n, r, e.passkey, o));
-			let c = await u(i), l = c?.subject ?? null, d = () => !l || l.type !== "user" ? Z(401, { error: "unauthenticated" }) : { userId: l.id }, m = () => p(i) ? null : Z(403, { error: "csrf" }), h = (e) => v(e).then((e) => f(e, c?.renewSetCookie));
-			if (i.method === "GET" && g(i, "/session")) {
-				let e = d();
-				return "status" in e ? e : f(Z(200, {
-					ok: !0,
-					subject: l,
-					renewed: c?.renewSetCookie !== void 0
-				}), c?.renewSetCookie);
-			}
-			if (i.method === "GET" && g(i, "/sessions")) {
-				let e = d();
-				return "status" in e ? e : h(Se({ userId: e.userId }, n));
-			}
-			if (i.method === "GET" && g(i, "/memberships")) {
-				let e = d();
-				return "status" in e ? e : h(q({ userId: e.userId }, n));
-			}
-			if (i.method === "POST" && g(i, "/sessions/revoke")) {
-				let e = d();
-				if ("status" in e) return e;
-				let t = m();
-				if (t) return t;
-				let r = Q(a.sessionId) ?? "";
-				return h(Ce({
-					userId: e.userId,
-					sessionId: r
-				}, n)).then((e) => (r && s.invalidate(r), e));
-			}
-			if (i.method === "POST" && g(i, "/sessions/revoke-others")) {
-				let e = d();
-				return "status" in e ? e : m() || h(we({
-					userId: e.userId,
-					keepSessionId: c?.sessionId ?? "__none__"
-				}, n));
-			}
-			if (i.method === "POST" && g(i, "/switch-tenant")) {
-				let t = d();
-				return "status" in t ? t : m() || v(Te({
-					userId: t.userId,
-					targetTenantId: Q(a.targetTenantId) ?? "",
-					...typeof a.clientId == "number" ? { clientId: a.clientId } : {},
-					...c?.sessionId ? { sessionId: c.sessionId } : {}
-				}, n, o, e.rebind));
-			}
-			if (e.mfa && i.method === "POST" && g(i, "/mfa/enroll/start")) {
-				let t = d();
-				if ("status" in t) return t;
-				let r = m();
-				if (r) return r;
-				let i = await x.runPromise(n.findById(t.userId));
-				return h(H({
-					userId: t.userId,
-					issuer: e.mfa.issuer,
-					accountName: i?.email ?? t.userId
-				}, n));
-			}
-			if (e.mfa && i.method === "POST" && g(i, "/mfa/enroll/verify")) {
-				let e = d();
-				return "status" in e ? e : m() || h(U({
-					userId: e.userId,
-					code: Q(a.code) ?? ""
-				}, n));
-			}
-			if (e.mfa && i.method === "POST" && g(i, "/mfa/unenroll")) {
-				let e = d();
-				return "status" in e ? e : m() || h(G({ userId: e.userId }, n));
-			}
-			if (e.mfa && i.method === "POST" && g(i, "/mfa/recovery-codes/regenerate")) {
-				let e = d();
-				return "status" in e ? e : m() || h(W({ userId: e.userId }, n));
-			}
-			if (e.passkey && i.method === "POST" && g(i, "/passkey/register/options")) {
-				let t = d();
-				return "status" in t ? t : m() || h(ke({
-					userId: t.userId,
-					userName: Q(a.userName) ?? t.userId
-				}, n, r, e.passkey));
-			}
-			if (e.passkey && i.method === "POST" && g(i, "/passkey/register/verify")) {
-				let t = d();
-				return "status" in t ? t : m() || h(Ae({
-					userId: t.userId,
-					credentialId: Q(a.credentialId) ?? "",
-					clientDataJSON: Q(a.clientDataJSON) ?? "",
-					authenticatorData: Q(a.authenticatorData) ?? "",
-					...$("transports", a.transports)
-				}, n, r, e.passkey));
-			}
-			return !e.passkey && i.path.startsWith(`${t}/passkey/`) ? Z(501, { error: "passkey_not_configured" }) : Z(404, { error: "not_found" });
-		}
-	};
-	return {
-		...oe({
-			name: e.name ? `@voltro/plugin-auth#${e.name}` : "@voltro/plugin-auth",
-			description: "Auth routes — mounts the full auth surface (password, magic-link, password-reset, CSRF, session probe/list/revoke, memberships, switch-tenant, passkey ceremonies) under /auth on the framework listener, with keyed secret rotation + request-time revocation.",
-			permissions: [],
-			declaredEnv: Re,
-			httpRoutes: [y],
-			onActivate: (n) => x.sync(() => {
-				n.logger.info("auth routes active", {
-					prefix: t,
-					passkey: e.passkey ? e.passkey.rpId : "disabled",
-					email: e.sendEmail ? "wired" : "unwired",
-					revocationWindowMs: s.ttlMs
-				});
-			}),
-			onDeactivate: () => x.void
-		}),
-		auth: { sessionStrategy: d({
-			secret: e.secrets ?? e.secret,
-			store: n,
-			revocation: s
-		}) }
-	};
-}, Re = [
-	{
-		name: "VOLTRO_SESSION_SECRET_PREVIOUS",
-		required: !1,
-		secret: !0,
-		description: "The session secret being rotated AWAY from. While set, cookies signed with it still verify (and get re-issued under the current secret on the next authenticated /auth response). Set the new secret as VOLTRO_SESSION_SECRET, move the old one here for one session lifetime, then drop it.",
-		example: "the-previous-signing-secret"
-	},
-	{
-		name: "VOLTRO_SESSION_KID",
-		required: !1,
-		secret: !1,
-		description: "Non-secret key-id label stamped into cookies signed with the current secret (default 'k0').",
-		example: "2026-07"
-	},
-	{
-		name: "VOLTRO_SESSION_KID_PREVIOUS",
-		required: !1,
-		secret: !1,
-		description: "Non-secret key-id label for the previous secret (default 'k-previous').",
-		example: "2026-01"
-	}
-];
-//#endregion
-export { I as A, be as C, V as D, R as E, me as F, k as I, S as L, A as M, he as N, B as O, O as P, xe as S, Ce as T, H as _, Me as a, G as b, De as c, L as d, K as f, ve as g, ye as h, je as i, T as j, Te as k, ge as l, Se as m, Ne as n, ke as o, q as p, Oe as r, Ae as s, Le as t, j as u, U as v, we as w, z as x, W as y };