@voltro/plugin-auth 0.5.0 → 0.7.0

package/dist/plugin-CQ_NyxPr.js

@@ -0,0 +1,803 @@
+import { hashPassword as e, verifyPassword as t, verifyPasswordWithRehash as n } from "./password.js";
+import { clearSessionCookie as r, issueSession as i, readSessionKeyed as a, resolveSessionSecret as o, resolveSessionSecrets as s, sessionSecretsOf as c } from "./session.js";
+import { a as l, l as u, o as d, s as f, t as p } from "./strategy-D345j4df.js";
+import { hashToken as m, mintToken as h } from "./tokens.js";
+import { CSRF_COOKIE_NAME as g, CSRF_HEADER_NAME as _, issueCsrfToken as v, verifyCsrf as ee } from "./csrf.js";
+import { generateChallenge as y, verifyAssertion as b, verifyRegistration as te } from "./webauthn.js";
+import { createHmac as ne, randomBytes as x, timingSafeEqual as re } from "node:crypto";
+import { Data as ie, Effect as S } from "effect";
+import { buildSetCookie as ae, readCookie as oe } from "@voltro/protocol/session";
+import { definePlugin as se } from "@voltro/protocol";
+//#region src/subjectGuard.ts
+var ce = { ok: !0 }, C = (e, t) => S.gen(function* () {
+	for (let n of e) {
+		let e = yield* n(t);
+		if (!e.ok) return e;
+	}
+	return ce;
+}), w = 30, T = 6, le = 20, ue = "sha1", de = 1, E = class extends ie.TaggedError("TotpVerifyError") {}, D = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567", fe = (e) => {
+	let t = 0, n = 0, r = "";
+	for (let i of e) for (n = n << 8 | i, t += 8; t >= 5;) r += D[n >>> t - 5 & 31], t -= 5;
+	return t > 0 && (r += D[n << 5 - t & 31]), r;
+}, pe = (e) => {
+	let t = e.toUpperCase().replace(/[\s=]+/g, "");
+	if (!/^[A-Z2-7]+$/.test(t)) return null;
+	let n = new Uint8Array(Math.floor(t.length * 5 / 8)), r = 0, i = 0, a = 0;
+	for (let e of t) {
+		let t = D.indexOf(e);
+		if (t === -1) return null;
+		i = i << 5 | t, r += 5, r >= 8 && (n[a++] = i >>> r - 8 & 255, r -= 8);
+	}
+	return n.subarray(0, a);
+}, me = (e) => {
+	let t = Buffer.alloc(8);
+	return t.writeBigUInt64BE(BigInt(e), 0), t;
+}, O = (e, t) => {
+	let n = ne(ue, Buffer.from(e));
+	n.update(me(t));
+	let r = n.digest(), i = r[r.length - 1] & 15, a = (r[i] & 127) << 24 | (r[i + 1] & 255) << 16 | (r[i + 2] & 255) << 8 | r[i + 3] & 255;
+	return String(a % 10 ** T).padStart(T, "0");
+}, k = () => fe(x(le)), A = (e) => `otpauth://totp/${encodeURIComponent(`${e.issuer}:${e.accountName}`)}?${new URLSearchParams({
+	secret: e.secret,
+	issuer: e.issuer,
+	algorithm: "SHA1",
+	digits: String(T),
+	period: String(w)
+}).toString()}`, he = (e, t = Date.now()) => {
+	let n = pe(e);
+	return n ? O(n, Math.floor(t / 1e3 / w)) : "000000";
+}, j = (e, t, n = Date.now()) => S.gen(function* () {
+	let r = pe(e);
+	if (!r) return yield* S.fail(new E({ reason: "malformedSecret" }));
+	let i = t.replace(/\s+/g, "");
+	if (!/^[0-9]{6}$/.test(i)) return yield* S.fail(new E({ reason: "invalidCode" }));
+	let a = Math.floor(n / 1e3 / w), o = Buffer.from(i);
+	for (let e = -1; e <= de; e++) {
+		let t = O(r, a + e), n = Buffer.from(t);
+		if (n.length === o.length && re(n, o)) return !0;
+	}
+	return yield* S.fail(new E({ reason: "invalidCode" }));
+}), M = (e = 10) => {
+	let t = [];
+	for (let n = 0; n < e; n++) {
+		let e = fe(x(16)).slice(0, 25).match(/.{1,5}/g) ?? [];
+		t.push(e.join("-"));
+	}
+	return t;
+}, N = (e) => e.secrets ?? (e.secret === void 0 ? s() : c(e.secret)), P = (e) => e.secret ?? o(), F = (e, t, n = {}) => ({
+	status: e,
+	body: JSON.stringify(t),
+	contentType: "application/json; charset=utf-8",
+	...n
+}), I = (e, t = {}) => ({
+	status: 302,
+	body: "",
+	contentType: "text/plain",
+	location: e,
+	...t
+}), L = 3600 * 24 * 7, R = (e, t) => e.type === "user" ? {
+	...e,
+	metadata: {
+		...e.metadata ?? {},
+		sessionId: t
+	}
+} : e, z = (e, t, n, r = {}) => S.gen(function* () {
+	let a = yield* t.listMemberships(e.id), o = l("sess");
+	yield* t.insertSession({
+		id: o,
+		userId: e.id,
+		tenantId: e.tenantId,
+		expiresAt: new Date(Date.now() + L * 1e3),
+		ipAddress: r.ipAddress ?? null,
+		userAgent: r.userAgent ?? null
+	}).pipe(S.ignore);
+	let s = R(f(e, { memberships: a }), o);
+	return {
+		setCookie: i(s, N(n), {
+			ttlSeconds: L,
+			...n.cookieDomain ? { domain: n.cookieDomain } : {},
+			secure: n.cookieSecure ?? !0
+		}).setCookie,
+		subject: s
+	};
+}), B = (e, t) => S.gen(function* () {
+	let n = t.subjectGuards ?? [];
+	if (n.length === 0) return null;
+	let r = yield* C(n, e);
+	return r.ok ? null : F(403, {
+		error: r.code,
+		message: r.message
+	});
+}), ge = 300, V = (r, i, a) => S.gen(function* () {
+	if (!r.email || !r.password) return F(400, { error: "email and password required" });
+	let o = yield* i.findByEmail(r.email), s = o ? yield* n(r.password, o.passwordHash) : yield* S.gen(function* () {
+		let n = yield* e("decoy-not-a-real-password").pipe(S.orElseSucceed(() => ""));
+		return yield* t(r.password, n), { valid: !1 };
+	});
+	if (!o || !s.valid) return F(401, { error: "invalid credentials" });
+	let c = yield* B(o, a);
+	if (c) return c;
+	if (s.rehash && (yield* i.updatePassword(o.id, s.rehash).pipe(S.ignore)), o.mfaEnrolledAt) {
+		let e = h("mfa-pending", 300);
+		return yield* i.insertToken({
+			id: l("tok"),
+			tokenHash: e.tokenHash,
+			userId: o.id,
+			purpose: "mfa-pending",
+			expiresAt: e.expiresAt
+		}).pipe(S.ignore), F(200, {
+			ok: !0,
+			mfaRequired: !0,
+			pendingToken: e.token,
+			expiresInSeconds: 300
+		});
+	}
+	let { setCookie: u, subject: d } = yield* z(o, i, a, {
+		ipAddress: r.ipAddress ?? null,
+		userAgent: r.userAgent ?? null
+	});
+	return r.redirectAfter ? I(a.successRedirect ?? "/", { setCookie: u }) : F(200, {
+		ok: !0,
+		subject: d
+	}, { setCookie: u });
+}), H = (e, t, n) => S.gen(function* () {
+	if (!e.pendingToken) return F(400, { error: "pending token required" });
+	if (!e.code && !e.recoveryCode) return F(400, { error: "code or recoveryCode required" });
+	let r = yield* t.consumeToken(m(e.pendingToken), "mfa-pending");
+	if (!r) return F(401, { error: "invalid or expired challenge" });
+	let i = yield* t.findById(r.userId);
+	if (!i || !i.mfaEnrolledAt || !i.mfaSecret) return F(401, { error: "mfa not enrolled" });
+	let a = yield* B(i, n);
+	if (a) return a;
+	if (!(e.recoveryCode ? yield* t.consumeRecoveryCode(i.id, m(e.recoveryCode.trim())) : yield* j(i.mfaSecret, e.code ?? "").pipe(S.map(() => !0), S.catchTag("TotpVerifyError", () => S.succeed(!1))))) return F(401, { error: "invalid_code" });
+	let { setCookie: o, subject: s } = yield* z(i, t, n, {
+		ipAddress: e.ipAddress ?? null,
+		userAgent: e.userAgent ?? null
+	});
+	return e.redirectAfter ? I(n.successRedirect ?? "/", { setCookie: o }) : F(200, {
+		ok: !0,
+		subject: s
+	}, { setCookie: o });
+}), U = (t, n, r) => S.gen(function* () {
+	if (!t.email || !t.password) return F(400, { error: "email and password required" });
+	if (t.password.length < 8) return F(400, { error: "password must be at least 8 characters" });
+	if (yield* n.findByEmail(t.email)) return F(409, { error: "email already registered" });
+	let a = t.tenantId ?? r.defaultTenantId, o = yield* e(t.password), s = yield* n.insert({
+		id: l("user"),
+		email: t.email,
+		passwordHash: o,
+		tenantId: a
+	});
+	yield* n.addMembership({
+		userId: s.id,
+		tenantId: a,
+		role: "owner"
+	}).pipe(S.ignore);
+	let c = yield* n.listMemberships(s.id), u = l("sess");
+	yield* n.insertSession({
+		id: u,
+		userId: s.id,
+		tenantId: a,
+		expiresAt: new Date(Date.now() + L * 1e3),
+		ipAddress: null,
+		userAgent: null
+	}).pipe(S.ignore);
+	let d = R(f(s, { memberships: c }), u), p = i(d, N(r), {
+		ttlSeconds: L,
+		...r.cookieDomain ? { domain: r.cookieDomain } : {},
+		secure: r.cookieSecure ?? !0
+	});
+	return t.redirectAfter ? I(r.successRedirect ?? "/", { setCookie: p.setCookie }) : F(200, {
+		ok: !0,
+		subject: d
+	}, { setCookie: p.setCookie });
+}).pipe(S.catchAll((e) => S.succeed(F(500, {
+	error: "signup_failed",
+	cause: String(e)
+})))), W = (e) => ({
+	status: 302,
+	body: "",
+	location: e.successRedirect ?? "/",
+	setCookie: r({
+		...e.cookieDomain ? { domain: e.cookieDomain } : {},
+		secure: e.cookieSecure ?? !0
+	})
+}), G = (e, t) => S.gen(function* () {
+	let n = yield* t.findById(e.userId);
+	if (!n) return F(404, { error: "user_not_found" });
+	let r = k();
+	return yield* t.setMfaSecret(n.id, r).pipe(S.catchAll(() => S.succeed(n))), F(200, {
+		ok: !0,
+		secret: r,
+		otpauthUrl: A({
+			issuer: e.issuer,
+			accountName: e.accountName,
+			secret: r
+		})
+	});
+}), K = (e, t) => S.gen(function* () {
+	let n = yield* t.findById(e.userId);
+	if (!n) return F(404, { error: "user_not_found" });
+	if (!n.mfaSecret) return F(400, { error: "no_enrollment_in_progress" });
+	if (n.mfaEnrolledAt) return F(409, { error: "already_enrolled" });
+	if (!(yield* j(n.mfaSecret, e.code).pipe(S.map(() => !0), S.catchTag("TotpVerifyError", () => S.succeed(!1))))) return F(401, { error: "invalid_code" });
+	yield* t.markMfaEnrolled(n.id).pipe(S.catchAll(() => S.succeed(n)));
+	let r = M();
+	return yield* t.replaceRecoveryCodes(n.id, r.map((e) => m(e))).pipe(S.ignore), F(200, {
+		ok: !0,
+		enrolled: !0,
+		recoveryCodes: r
+	});
+}), q = (e, t) => S.gen(function* () {
+	let n = yield* t.findById(e.userId);
+	if (!n) return F(404, { error: "user_not_found" });
+	if (!n.mfaEnrolledAt) return F(400, { error: "mfa_not_enrolled" });
+	let r = M();
+	return yield* t.replaceRecoveryCodes(n.id, r.map((e) => m(e))).pipe(S.ignore), F(200, {
+		ok: !0,
+		recoveryCodes: r
+	});
+}), _e = (e, t) => S.gen(function* () {
+	let n = yield* t.findById(e.userId);
+	return n ? (yield* t.clearMfa(n.id).pipe(S.catchAll(() => S.succeed(n))), yield* t.replaceRecoveryCodes(n.id, []).pipe(S.ignore), F(200, {
+		ok: !0,
+		enrolled: !1
+	})) : F(404, { error: "user_not_found" });
+}), ve = (e) => {
+	let t = v(P(e)), n = ae(g, t, {
+		httpOnly: !1,
+		sameSite: "lax",
+		secure: e.cookieSecure ?? !0,
+		...e.cookieDomain ? { domain: e.cookieDomain } : {},
+		path: "/"
+	});
+	return F(200, { csrfToken: t }, { setCookie: n });
+}, ye = (e, t, n) => `${e}${t}${t.includes("?") ? "&" : "?"}token=${encodeURIComponent(n)}`, be = (e, t, n) => S.gen(function* () {
+	if (!e.email) return F(400, { error: "email required" });
+	let r = yield* t.findByEmail(e.email);
+	if (r) {
+		let i = h("magic-link");
+		yield* t.insertToken({
+			id: l("tok"),
+			tokenHash: i.tokenHash,
+			userId: r.id,
+			purpose: "magic-link",
+			expiresAt: i.expiresAt
+		}).pipe(S.ignore);
+		let a = ye(n.appBaseUrl ?? "", e.callbackPath ?? "/auth/magic-link/callback", i.token);
+		n.sendEmail && (yield* S.tryPromise(() => n.sendEmail({
+			to: r.email,
+			kind: "magic-link",
+			actionUrl: a,
+			subject: "Your sign-in link",
+			text: `Sign in: ${a}`,
+			html: `<p><a href="${a}">Sign in</a> — this link expires shortly.</p>`
+		})).pipe(S.ignore));
+	}
+	return F(202, { ok: !0 });
+}), xe = (e, t, n) => S.gen(function* () {
+	if (!e.token) return F(400, { error: "token required" });
+	let r = yield* t.consumeToken(m(e.token), "magic-link");
+	if (!r) return F(401, { error: "invalid or expired token" });
+	let a = yield* t.findById(r.userId);
+	if (!a) return F(401, { error: "invalid or expired token" });
+	let o = yield* B(a, n);
+	if (o) return o;
+	let s = yield* t.listMemberships(a.id), c = l("sess");
+	yield* t.insertSession({
+		id: c,
+		userId: a.id,
+		tenantId: a.tenantId,
+		expiresAt: new Date(Date.now() + L * 1e3),
+		ipAddress: null,
+		userAgent: null
+	}).pipe(S.ignore);
+	let u = R(f(a, { memberships: s }), c), d = i(u, N(n), {
+		ttlSeconds: L,
+		...n.cookieDomain ? { domain: n.cookieDomain } : {},
+		secure: n.cookieSecure ?? !0
+	});
+	return e.redirectAfter ? I(n.successRedirect ?? "/", { setCookie: d.setCookie }) : F(200, {
+		ok: !0,
+		subject: u
+	}, { setCookie: d.setCookie });
+}), Se = (e, t, n) => S.gen(function* () {
+	if (!e.email) return F(400, { error: "email required" });
+	let r = yield* t.findByEmail(e.email);
+	if (r) {
+		let i = h("password-reset");
+		yield* t.insertToken({
+			id: l("tok"),
+			tokenHash: i.tokenHash,
+			userId: r.id,
+			purpose: "password-reset",
+			expiresAt: i.expiresAt
+		}).pipe(S.ignore);
+		let a = ye(n.appBaseUrl ?? "", e.callbackPath ?? "/auth/password-reset/callback", i.token);
+		n.sendEmail && (yield* S.tryPromise(() => n.sendEmail({
+			to: r.email,
+			kind: "password-reset",
+			actionUrl: a,
+			subject: "Reset your password",
+			text: `Reset your password: ${a}`,
+			html: `<p><a href="${a}">Reset your password</a> — this link expires shortly.</p>`
+		})).pipe(S.ignore));
+	}
+	return F(202, { ok: !0 });
+}), Ce = (t, n) => S.gen(function* () {
+	if (!t.token || !t.newPassword) return F(400, { error: "token and newPassword required" });
+	if (t.newPassword.length < 8) return F(400, { error: "password must be at least 8 characters" });
+	let r = yield* n.consumeToken(m(t.token), "password-reset");
+	if (!r) return F(401, { error: "invalid or expired token" });
+	let i = yield* e(t.newPassword).pipe(S.orElseSucceed(() => ""));
+	return i ? (yield* n.updatePassword(r.userId, i).pipe(S.ignore), yield* n.revokeAllOtherSessions(r.userId, "__none__").pipe(S.ignore), F(200, { ok: !0 })) : F(500, { error: "hash_failed" });
+}), we = (e, t) => S.gen(function* () {
+	return F(200, { sessions: (yield* t.listSessions(e.userId)).map((e) => ({
+		id: e.id,
+		tenantId: e.tenantId,
+		ipAddress: e.ipAddress ?? null,
+		userAgent: e.userAgent ?? null,
+		createdAt: e.createdAt.toISOString(),
+		lastSeenAt: e.lastSeenAt.toISOString(),
+		expiresAt: e.expiresAt.toISOString()
+	})) });
+}), Te = (e, t) => S.gen(function* () {
+	return (yield* t.revokeSession(e.userId, e.sessionId)) ? F(200, {
+		ok: !0,
+		revoked: 1
+	}) : F(404, { error: "session_not_found" });
+}), Ee = (e, t) => S.gen(function* () {
+	return F(200, {
+		ok: !0,
+		revoked: yield* t.revokeAllOtherSessions(e.userId, e.keepSessionId)
+	});
+}), De = (e, t, n, r) => S.gen(function* () {
+	let a = yield* t.findById(e.userId);
+	if (!a) return F(404, { error: "user_not_found" });
+	let o = yield* t.membershipRole(e.userId, e.targetTenantId);
+	if (o === null) return F(403, { error: "not a member of the target tenant" });
+	let s = yield* t.listMemberships(a.id), c = e.metadata === void 0 ? void 0 : Object.fromEntries(Object.entries(e.metadata).filter(([e]) => e !== "memberships")), l = f(a, {
+		tenantId: e.targetTenantId,
+		memberships: s,
+		...c === void 0 ? {} : { metadata: c }
+	}), u = e.sessionId ? R(l, e.sessionId) : l;
+	e.clientId !== void 0 && r && r(e.clientId, u);
+	let d = i(u, N(n), {
+		ttlSeconds: L,
+		...n.cookieDomain ? { domain: n.cookieDomain } : {},
+		secure: n.cookieSecure ?? !0
+	});
+	return F(200, {
+		ok: !0,
+		tenantId: e.targetTenantId,
+		role: o,
+		subject: u
+	}, { setCookie: d.setCookie });
+}), Oe = (e, t) => S.gen(function* () {
+	return F(200, { memberships: (yield* t.listMemberships(e.userId)).map((e) => ({
+		tenantId: e.tenantId,
+		role: e.role,
+		joinedAt: e.joinedAt.toISOString()
+	})) });
+}), J = (e, t, n = {}) => ({
+	status: e,
+	body: JSON.stringify(t),
+	contentType: "application/json; charset=utf-8",
+	...n
+}), ke = 3600 * 24 * 7, Ae = () => {
+	let e = /* @__PURE__ */ new Map();
+	return {
+		put: (t, n, r) => S.sync(() => {
+			e.set(t, {
+				challenge: n,
+				expiresAt: Date.now() + r * 1e3
+			});
+		}),
+		take: (t) => S.sync(() => {
+			let n = e.get(t);
+			return e.delete(t), !n || n.expiresAt < Date.now() ? null : n.challenge;
+		})
+	};
+}, je = (e) => ({
+	put: (t, n, r) => S.gen(function* () {
+		let i = /* @__PURE__ */ new Date(), a = new Date(i.getTime() + r * 1e3);
+		(yield* e`
+        UPDATE "passkeyChallenges"
+           SET challenge = ${n}, "expiresAt" = ${a}, "createdAt" = ${i}
+         WHERE key = ${t}
+        RETURNING key
+      `).length === 0 && (yield* e`
+          INSERT INTO "passkeyChallenges" (id, key, challenge, "expiresAt", "createdAt")
+          VALUES (${l("pkc")}, ${t}, ${n}, ${a}, ${i})
+        `);
+	}).pipe(S.asVoid, S.orElseSucceed(() => void 0)),
+	take: (t) => S.gen(function* () {
+		let n = (yield* e`
+        DELETE FROM "passkeyChallenges" WHERE key = ${t}
+        RETURNING challenge, "expiresAt"
+      `)[0];
+		return n && n.expiresAt.getTime() > Date.now() ? n.challenge : null;
+	}).pipe(S.orElseSucceed(() => null))
+}), Y = 300, Me = (e, t, n, r) => S.gen(function* () {
+	if (!(yield* t.findById(e.userId))) return J(404, { error: "user_not_found" });
+	let i = y();
+	yield* n.put(`${e.userId}:register`, i, Y);
+	let a = yield* t.listPasskeys(e.userId);
+	return J(200, {
+		challenge: i,
+		rp: {
+			id: r.rpId,
+			name: r.rpName
+		},
+		user: {
+			id: e.userId,
+			name: e.userName,
+			displayName: e.userName
+		},
+		pubKeyCredParams: [{
+			type: "public-key",
+			alg: -7
+		}, {
+			type: "public-key",
+			alg: -257
+		}],
+		excludeCredentials: a.map((e) => ({
+			type: "public-key",
+			id: e.credentialId
+		})),
+		authenticatorSelection: {
+			userVerification: "preferred",
+			residentKey: "preferred"
+		},
+		timeout: Y * 1e3
+	});
+}), Ne = (e, t, n, r) => S.gen(function* () {
+	if (!(yield* t.findById(e.userId))) return J(404, { error: "user_not_found" });
+	let i = yield* n.take(`${e.userId}:register`);
+	if (!i) return J(400, { error: "no_pending_challenge" });
+	let a = te({
+		clientDataJSON: e.clientDataJSON,
+		authenticatorData: e.authenticatorData,
+		expectedChallenge: i,
+		expectedOrigin: r.origin,
+		rpId: r.rpId
+	});
+	return a.ok ? (yield* t.insertPasskey({
+		id: l("pk"),
+		credentialId: a.result.credentialId,
+		userId: e.userId,
+		publicKey: a.result.publicKey,
+		counter: a.result.counter,
+		transports: e.transports ?? null
+	}).pipe(S.ignore), J(200, {
+		ok: !0,
+		credentialId: a.result.credentialId
+	})) : J(400, { error: a.error });
+}), Pe = (e, t, n, r) => S.gen(function* () {
+	let i = y(), a = e.userId ? `${e.userId}:assert` : "*:assert";
+	yield* n.put(a, i, Y);
+	let o = e.userId ? (yield* t.listPasskeys(e.userId)).map((e) => ({
+		type: "public-key",
+		id: e.credentialId
+	})) : [];
+	return J(200, {
+		challenge: i,
+		rpId: r.rpId,
+		allowCredentials: o,
+		userVerification: "preferred",
+		timeout: Y * 1e3
+	});
+}), Fe = (e, t, n, r, a) => S.gen(function* () {
+	let o = yield* t.findPasskey(e.credentialId);
+	if (!o) return J(401, { error: "unknown_credential" });
+	let s = e.userId ? `${e.userId}:assert` : "*:assert", c = yield* n.take(s);
+	if (!c) return J(400, { error: "no_pending_challenge" });
+	let u = b({
+		clientDataJSON: e.clientDataJSON,
+		authenticatorData: e.authenticatorData,
+		signature: e.signature,
+		expectedChallenge: c,
+		expectedOrigin: r.origin,
+		rpId: r.rpId,
+		storedPublicKey: o.publicKey,
+		storedCounter: o.counter
+	});
+	if (!u.ok) return J(401, { error: u.error });
+	if (!(yield* t.advancePasskeyCounter(e.credentialId, u.result.newCounter)) && u.result.newCounter !== 0) return J(401, { error: "counter_regressed" });
+	let d = yield* t.findById(o.userId);
+	if (!d) return J(401, { error: "unknown_credential" });
+	let p = yield* B(d, a);
+	if (p) return p;
+	let m = yield* t.listMemberships(d.id), h = l("sess");
+	yield* t.insertSession({
+		id: h,
+		userId: d.id,
+		tenantId: d.tenantId,
+		expiresAt: new Date(Date.now() + ke * 1e3),
+		ipAddress: null,
+		userAgent: null
+	}).pipe(S.ignore);
+	let g = f(d, { memberships: m }), _ = g.type === "user" ? {
+		...g,
+		metadata: {
+			...g.metadata ?? {},
+			sessionId: h
+		}
+	} : g, v = i(_, N(a), {
+		ttlSeconds: ke,
+		...a.cookieDomain ? { domain: a.cookieDomain } : {},
+		secure: a.cookieSecure ?? !0
+	});
+	return J(200, {
+		ok: !0,
+		subject: _
+	}, { setCookie: v.setCookie });
+}), Ie = (e) => {
+	for (let t of e) if (Le(t)) return t.auth.sessionStrategy;
+	return null;
+}, Le = (e) => typeof e.auth == "object" && e.auth !== null && typeof e.auth.sessionStrategy == "object", Re = "/auth", ze = (e) => {
+	let t = Buffer.from(e.rawBody).toString("utf8");
+	if (!t) return {};
+	if ((e.headers["content-type"] ?? "").includes("application/x-www-form-urlencoded")) {
+		let e = new URLSearchParams(t), n = {};
+		for (let [t, r] of e) n[t] = r;
+		return n;
+	}
+	try {
+		let e = JSON.parse(t);
+		return typeof e == "object" && e ? e : {};
+	} catch {
+		return {};
+	}
+}, X = (e) => ({
+	status: e.status,
+	...e.body === void 0 ? {} : { body: e.body },
+	...e.contentType === void 0 ? {} : { contentType: e.contentType },
+	headers: {
+		...e.setCookie === void 0 ? {} : { "set-cookie": e.setCookie },
+		...e.location === void 0 ? {} : { location: e.location }
+	}
+}), Z = (e, t) => ({
+	status: e,
+	body: JSON.stringify(t),
+	contentType: "application/json; charset=utf-8"
+}), Q = (e) => typeof e == "string" ? e : void 0, $ = (e, t) => typeof t == "string" && t.length > 0 ? { [e]: t } : {}, Be = (e) => {
+	let t = e.prefix ?? Re, n = e.store, r = e.challengeStore ?? Ae(), o = {
+		...e.secret === void 0 ? {} : { secret: e.secret },
+		...e.secrets === void 0 ? {} : { secrets: e.secrets },
+		defaultTenantId: e.defaultTenantId,
+		...e.cookieDomain === void 0 ? {} : { cookieDomain: e.cookieDomain },
+		...e.cookieSecure === void 0 ? {} : { cookieSecure: e.cookieSecure },
+		...e.successRedirect === void 0 ? {} : { successRedirect: e.successRedirect },
+		...e.sendEmail === void 0 ? {} : { sendEmail: e.sendEmail },
+		...e.appBaseUrl === void 0 ? {} : { appBaseUrl: e.appBaseUrl },
+		...e.subjectGuards === void 0 ? {} : { subjectGuards: e.subjectGuards }
+	}, s = u(n, e.sessionRevocation ?? {}), c = async (e) => {
+		let t = N(o), r = a(e.headers.cookie, t);
+		if (!r) return null;
+		let c = d(r.subject);
+		if (c && !await S.runPromise(s.isLive(c))) return null;
+		if (r.renew || r.kid !== t.current.kid) {
+			let e = Math.max(r.exp - r.iat, 60), a = i(r.subject, t, {
+				ttlSeconds: e,
+				...o.cookieDomain ? { domain: o.cookieDomain } : {},
+				secure: o.cookieSecure ?? !0
+			});
+			return c && await S.runPromise(n.touchSession(c, new Date(Date.now() + e * 1e3))), {
+				subject: r.subject,
+				sessionId: c,
+				renewSetCookie: a.setCookie
+			};
+		}
+		return {
+			subject: r.subject,
+			sessionId: c
+		};
+	}, l = (e, t) => {
+		if (!t) return e;
+		let n = e.headers ?? {};
+		return n["set-cookie"] ? e : {
+			...e,
+			headers: {
+				...n,
+				"set-cookie": t
+			}
+		};
+	}, f = (t) => {
+		let n = t.headers[_];
+		return ee(n, oe(t.headers.cookie, g), P(e));
+	}, m = (e, n) => e.path === `${t}${n}`, h = (e) => S.runPromise(e).then(X), v = {
+		method: "*",
+		path: t,
+		handle: async (i) => {
+			let a = i.method === "GET" ? {} : ze(i);
+			if (i.method === "GET" && m(i, "/csrf")) return X(ve(o));
+			if (i.method === "POST" && m(i, "/sign-in")) return h(V({
+				email: Q(a.email) ?? "",
+				password: Q(a.password) ?? "",
+				...a.redirectAfter === void 0 ? {} : { redirectAfter: !!a.redirectAfter },
+				...i.headers["x-forwarded-for"] ? { ipAddress: i.headers["x-forwarded-for"] } : {},
+				...i.headers["user-agent"] ? { userAgent: i.headers["user-agent"] } : {}
+			}, n, o));
+			if (i.method === "POST" && m(i, "/sign-up")) return h(U({
+				email: Q(a.email) ?? "",
+				password: Q(a.password) ?? "",
+				...$("tenantId", a.tenantId),
+				...a.redirectAfter === void 0 ? {} : { redirectAfter: !!a.redirectAfter }
+			}, n, o));
+			if (i.method === "POST" && m(i, "/sign-out")) {
+				let e = await c(i);
+				return e && e.subject.type === "user" && e.sessionId && (await S.runPromise(n.revokeSession(e.subject.id, e.sessionId)), s.invalidate(e.sessionId)), X(W(o));
+			}
+			if (i.method === "POST" && m(i, "/magic-link")) return h(be({
+				email: Q(a.email) ?? "",
+				...$("callbackPath", a.callbackPath)
+			}, n, o));
+			if (i.method === "POST" && m(i, "/magic-link/callback")) return h(xe({
+				token: Q(a.token) ?? "",
+				...a.redirectAfter === void 0 ? {} : { redirectAfter: !!a.redirectAfter }
+			}, n, o));
+			if (i.method === "POST" && m(i, "/password-reset")) return h(Se({
+				email: Q(a.email) ?? "",
+				...$("callbackPath", a.callbackPath)
+			}, n, o));
+			if (i.method === "POST" && m(i, "/password-reset/confirm")) return h(Ce({
+				token: Q(a.token) ?? "",
+				newPassword: Q(a.newPassword) ?? ""
+			}, n));
+			if (i.method === "POST" && m(i, "/mfa/verify")) return h(H({
+				pendingToken: Q(a.pendingToken) ?? "",
+				...$("code", a.code),
+				...$("recoveryCode", a.recoveryCode),
+				...a.redirectAfter === void 0 ? {} : { redirectAfter: !!a.redirectAfter },
+				...i.headers["x-forwarded-for"] ? { ipAddress: i.headers["x-forwarded-for"] } : {},
+				...i.headers["user-agent"] ? { userAgent: i.headers["user-agent"] } : {}
+			}, n, o));
+			if (e.passkey && i.method === "POST" && m(i, "/passkey/assert/options")) return h(Pe({ ...$("userId", a.userId) }, n, r, e.passkey));
+			if (e.passkey && i.method === "POST" && m(i, "/passkey/assert/verify")) return h(Fe({
+				credentialId: Q(a.credentialId) ?? "",
+				clientDataJSON: Q(a.clientDataJSON) ?? "",
+				authenticatorData: Q(a.authenticatorData) ?? "",
+				signature: Q(a.signature) ?? "",
+				...$("userId", a.userId)
+			}, n, r, e.passkey, o));
+			let u = await c(i), d = u?.subject ?? null, p = () => !d || d.type !== "user" ? Z(401, { error: "unauthenticated" }) : { userId: d.id }, g = () => f(i) ? null : Z(403, { error: "csrf" }), _ = (e) => h(e).then((e) => l(e, u?.renewSetCookie));
+			if (i.method === "GET" && m(i, "/session")) {
+				let e = p();
+				return "status" in e ? e : l(Z(200, {
+					ok: !0,
+					subject: d,
+					renewed: u?.renewSetCookie !== void 0
+				}), u?.renewSetCookie);
+			}
+			if (i.method === "GET" && m(i, "/sessions")) {
+				let e = p();
+				return "status" in e ? e : _(we({ userId: e.userId }, n));
+			}
+			if (i.method === "GET" && m(i, "/memberships")) {
+				let e = p();
+				return "status" in e ? e : _(Oe({ userId: e.userId }, n));
+			}
+			if (i.method === "POST" && m(i, "/sessions/revoke")) {
+				let e = p();
+				if ("status" in e) return e;
+				let t = g();
+				if (t) return t;
+				let r = Q(a.sessionId) ?? "";
+				return _(Te({
+					userId: e.userId,
+					sessionId: r
+				}, n)).then((e) => (r && s.invalidate(r), e));
+			}
+			if (i.method === "POST" && m(i, "/sessions/revoke-others")) {
+				let e = p();
+				return "status" in e ? e : g() || _(Ee({
+					userId: e.userId,
+					keepSessionId: u?.sessionId ?? "__none__"
+				}, n));
+			}
+			if (i.method === "POST" && m(i, "/switch-tenant")) {
+				let t = p();
+				return "status" in t ? t : g() || h(De({
+					userId: t.userId,
+					targetTenantId: Q(a.targetTenantId) ?? "",
+					...typeof a.clientId == "number" ? { clientId: a.clientId } : {},
+					...u?.sessionId ? { sessionId: u.sessionId } : {},
+					...d?.type === "user" && d.metadata ? { metadata: d.metadata } : {}
+				}, n, o, e.rebind));
+			}
+			if (e.mfa && i.method === "POST" && m(i, "/mfa/enroll/start")) {
+				let t = p();
+				if ("status" in t) return t;
+				let r = g();
+				if (r) return r;
+				let i = await S.runPromise(n.findById(t.userId));
+				return _(G({
+					userId: t.userId,
+					issuer: e.mfa.issuer,
+					accountName: i?.email ?? t.userId
+				}, n));
+			}
+			if (e.mfa && i.method === "POST" && m(i, "/mfa/enroll/verify")) {
+				let e = p();
+				return "status" in e ? e : g() || _(K({
+					userId: e.userId,
+					code: Q(a.code) ?? ""
+				}, n));
+			}
+			if (e.mfa && i.method === "POST" && m(i, "/mfa/unenroll")) {
+				let e = p();
+				return "status" in e ? e : g() || _(_e({ userId: e.userId }, n));
+			}
+			if (e.mfa && i.method === "POST" && m(i, "/mfa/recovery-codes/regenerate")) {
+				let e = p();
+				return "status" in e ? e : g() || _(q({ userId: e.userId }, n));
+			}
+			if (e.passkey && i.method === "POST" && m(i, "/passkey/register/options")) {
+				let t = p();
+				return "status" in t ? t : g() || _(Me({
+					userId: t.userId,
+					userName: Q(a.userName) ?? t.userId
+				}, n, r, e.passkey));
+			}
+			if (e.passkey && i.method === "POST" && m(i, "/passkey/register/verify")) {
+				let t = p();
+				return "status" in t ? t : g() || _(Ne({
+					userId: t.userId,
+					credentialId: Q(a.credentialId) ?? "",
+					clientDataJSON: Q(a.clientDataJSON) ?? "",
+					authenticatorData: Q(a.authenticatorData) ?? "",
+					...$("transports", a.transports)
+				}, n, r, e.passkey));
+			}
+			return !e.passkey && i.path.startsWith(`${t}/passkey/`) ? Z(501, { error: "passkey_not_configured" }) : Z(404, { error: "not_found" });
+		}
+	}, y = se({
+		name: e.name ? `@voltro/plugin-auth#${e.name}` : "@voltro/plugin-auth",
+		description: "Auth routes — mounts the full auth surface (password, magic-link, password-reset, CSRF, session probe/list/revoke, memberships, switch-tenant, passkey ceremonies) under /auth on the framework listener, with keyed secret rotation + request-time revocation.",
+		permissions: [],
+		declaredEnv: Ve,
+		httpRoutes: [v],
+		onActivate: (n) => S.sync(() => {
+			n.logger.info("auth routes active", {
+				prefix: t,
+				passkey: e.passkey ? e.passkey.rpId : "disabled",
+				email: e.sendEmail ? "wired" : "unwired",
+				revocationWindowMs: s.ttlMs
+			});
+		}),
+		onDeactivate: () => S.void
+	}), b = e.secrets ?? e.secret;
+	return {
+		...y,
+		auth: { sessionStrategy: p({
+			...b === void 0 ? {} : { secret: b },
+			store: n,
+			revocation: s
+		}) }
+	};
+}, Ve = [
+	{
+		name: "VOLTRO_SESSION_SECRET_PREVIOUS",
+		required: !1,
+		secret: !0,
+		description: "The session secret being rotated AWAY from. While set, cookies signed with it still verify (and get re-issued under the current secret on the next authenticated /auth response). Set the new secret as VOLTRO_SESSION_SECRET, move the old one here for one session lifetime, then drop it.",
+		example: "the-previous-signing-secret"
+	},
+	{
+		name: "VOLTRO_SESSION_KID",
+		required: !1,
+		secret: !1,
+		description: "Non-secret key-id label stamped into cookies signed with the current secret (default 'k0').",
+		example: "2026-07"
+	},
+	{
+		name: "VOLTRO_SESSION_KID_PREVIOUS",
+		required: !1,
+		secret: !1,
+		description: "Non-secret key-id label for the previous secret (default 'k-previous').",
+		example: "2026-01"
+	}
+];
+//#endregion
+export { z as A, Se as C, W as D, V as E, A as F, j as I, C as L, M, he as N, U as O, k as P, Ce as S, Te as T, G as _, Fe as a, _e as b, Ae as c, B as d, ve as f, be as g, xe as h, Pe as i, E as j, De as k, ge as l, we as m, Ie as n, Me as o, Oe as p, je as r, Ne as s, Be as t, N as u, K as v, Ee as w, H as x, q as y };