@voltro/plugin-auth 0.71.0 → 0.72.0

package/dist/strategy.d.ts

@@ -4,6 +4,26 @@ import { SessionSecrets } from '@voltro/protocol/session';
 import { VoidIfEmpty } from 'effect/Types';
 import { YieldableError } from 'effect/Cause';
 
+/** Identity — who a user is. The only role an app with its own identity table has to write itself; everything else composes from the shipped store. */
+declare interface IdentityStore {
+    readonly findByEmail: (email: string) => Effect.Effect<UserRecord | null>;
+    readonly findById: (id: string) => Effect.Effect<UserRecord | null>;
+    readonly insert: (user: Omit<UserRecord, 'createdAt'>) => Effect.Effect<UserRecord, UserAlreadyExistsError>;
+    /** Replace a user's stored password hash. Used by password-reset AND
+     *  by rehash-on-verify (silently upgrading an under-cost hash on a
+     *  successful sign-in). */
+    readonly updatePassword: (userId: string, newHash: string) => Effect.Effect<UserRecord, UserNotFoundError>;
+    /**
+     * Stamp `emailVerifiedAt` — the address has been proven.
+     *
+     * IDEMPOTENT and non-regressing: a user already verified keeps their
+     * ORIGINAL timestamp. "When was this address first proven" is the question
+     * the column answers, and re-stamping it on every later magic-link login
+     * would quietly turn it into "when did they last click something".
+     */
+    readonly markEmailVerified: (userId: string) => Effect.Effect<UserRecord, UserNotFoundError>;
+}
+
 /** One impersonation grant — "actor is acting as target, on this session,
  *  until this instant". See `impersonationGrantsTable`. */
 declare interface ImpersonationGrantRecord {
@@ -24,6 +44,17 @@ declare interface ImpersonationGrantRecord {
     readonly userAgent?: string | null;
 }
 
+/** Impersonation grants. */
+declare interface ImpersonationStore {
+    /** Record an impersonation grant when the impersonated session is minted. */
+    readonly insertImpersonationGrant: (grant: Omit<ImpersonationGrantRecord, 'startedAt' | 'endedAt' | 'endedReason'>) => Effect.Effect<ImpersonationGrantRecord>;
+    /** The grant for an impersonated session, or null. The stop path's lookup. */
+    readonly findImpersonationGrantBySession: (sessionId: string) => Effect.Effect<ImpersonationGrantRecord | null>;
+    /** Close a grant. Only an OPEN grant is closed (`endedAt IS NULL`), so a
+     *  double stop is a no-op rather than a rewritten end time. */
+    readonly endImpersonationGrant: (sessionId: string, endedReason: string, now: Date) => Effect.Effect<boolean>;
+}
+
 /**
  * A tenant invitation — the grant that turns into a `memberships` row when
  * redeemed. See `invitationsTable` for why `role` lives here and not in the
@@ -47,6 +78,38 @@ declare interface InvitationRecord {
     readonly createdAt: Date;
 }
 
+/** Tenant invitations. */
+declare interface InvitationStore {
+    /** Persist an invitation (token already hashed). */
+    readonly insertInvitation: (invitation: Omit<InvitationRecord, 'acceptedAt' | 'acceptedByUserId' | 'revokedAt' | 'revokedByUserId' | 'createdAt'>) => Effect.Effect<InvitationRecord>;
+    /** Look an invitation up by token hash WITHOUT redeeming it — the read the
+     *  "what am I being invited to" preview needs. Returns the row whatever its
+     *  state; the caller decides what an expired or revoked one means. */
+    readonly findInvitationByHash: (tokenHash: string) => Effect.Effect<InvitationRecord | null>;
+    /**
+     * Atomically redeem an invitation: returns the row only when it exists, is
+     * unaccepted, unrevoked and unexpired — and stamps `acceptedAt` +
+     * `acceptedByUserId` in the same step. Null otherwise.
+     *
+     * The single-use guard, and it has to be ONE statement: two clicks on the
+     * same emailed link race, and a read-then-write would let both through and
+     * write the membership twice.
+     */
+    readonly acceptInvitation: (tokenHash: string, acceptedByUserId: string, now: Date) => Effect.Effect<InvitationRecord | null>;
+    /** Withdraw a PENDING invitation, scoped to its tenant so an admin of one
+     *  tenant cannot revoke another's by id. Returns whether a row changed. */
+    readonly revokeInvitation: (invitationId: string, tenantId: string, revokedByUserId: string, now: Date) => Effect.Effect<boolean>;
+    /** Every invitation for a tenant, newest first. The admin list. */
+    readonly listInvitations: (tenantId: string) => Effect.Effect<ReadonlyArray<InvitationRecord>>;
+    /** How many invitations for this tenant are still redeemable — the bound
+     *  `maxPending` enforces. */
+    readonly countPendingInvitations: (tenantId: string, now: Date) => Effect.Effect<number>;
+    /** Revoke every pending invitation for (tenant, email). Called before
+     *  issuing a fresh one so re-inviting supersedes rather than accumulates —
+     *  otherwise every resend leaves a live token behind. Returns the count. */
+    readonly supersedePendingInvitations: (tenantId: string, email: string, revokedByUserId: string, now: Date) => Effect.Effect<number>;
+}
+
 /**
  * Brute-force lockout policy, resolved from `AuthConfig.lockout` and passed
  * INTO the store on each failure so the store itself stays policy-free.
@@ -67,6 +130,20 @@ declare interface LockoutState {
     readonly retryAfterSeconds: number;
 }
 
+/** Brute-force lockout, keyed by normalized email. */
+declare interface LockoutStore {
+    /** Is this email currently locked out? Reads only — never mutates. Returns
+     *  the remaining cooldown so the handler can surface a retry-after. */
+    readonly isLockedOut: (email: string, now: number) => Effect.Effect<LockoutState>;
+    /** Record one failed credential attempt for `email`. Opens a fresh window
+     *  when the previous one (or a prior lock) has expired, otherwise increments;
+     *  sets the lock once `failedCount` reaches `policy.maxAttempts`. Called only
+     *  for a NOT-currently-locked email (the handler checks `isLockedOut` first). */
+    readonly recordLoginFailure: (email: string, now: number, policy: LockoutPolicy) => Effect.Effect<void>;
+    /** Clear the counter for `email` on a completed login. */
+    readonly clearLoginFailures: (email: string) => Effect.Effect<void>;
+}
+
 /** One tenant a user belongs to. The active tenant lives on the Subject;
  *  the full set drives the switch-tenant menu + the switch-tenant guard. */
 declare interface MembershipRecord {
@@ -76,6 +153,46 @@ declare interface MembershipRecord {
     readonly joinedAt: Date;
 }
 
+/** Memberships + switch-tenant. */
+declare interface MembershipStore {
+    /** Every tenant the user belongs to. */
+    readonly listMemberships: (userId: string) => Effect.Effect<ReadonlyArray<MembershipRecord>>;
+    /** Idempotent grant: inserts the [userId, tenantId] membership or
+     *  updates its role if it already exists. The DB-level composite
+     *  UNIQUE on `[userId, tenantId]` (see `membershipsTable`) is the
+     *  source of truth; this upsert converges to it. */
+    readonly addMembership: (membership: Omit<MembershipRecord, 'joinedAt'>) => Effect.Effect<MembershipRecord>;
+    /** Resolve the role for a [userId, tenantId] pair, or null when the
+     *  user is NOT a member. The switch-tenant handler calls this to
+     *  validate the requested tenant before rebinding the connection. */
+    readonly membershipRole: (userId: string, tenantId: string) => Effect.Effect<string | null>;
+}
+
+/** TOTP enrolment + recovery codes. */
+declare interface MfaStore {
+    /** Stash a freshly-generated TOTP secret on the user. Called by
+     *  the MFA enrolment handler before the user verifies the first
+     *  code. */
+    readonly setMfaSecret: (userId: string, secret: string) => Effect.Effect<UserRecord, UserNotFoundError>;
+    /** Mark MFA as fully enrolled (called after the first successful
+     *  TOTP verify completes the enrolment ceremony). */
+    readonly markMfaEnrolled: (userId: string) => Effect.Effect<UserRecord, UserNotFoundError>;
+    /** Wipe the secret + enrolledAt. Used by /account/security's
+     *  "remove MFA" action. */
+    readonly clearMfa: (userId: string) => Effect.Effect<UserRecord, UserNotFoundError>;
+    /** Replace the user's recovery codes with a fresh (already hashed) set.
+     *  Called at enrolment / regeneration — wipes any prior codes so the
+     *  displayed set is the only valid one. */
+    readonly replaceRecoveryCodes: (userId: string, codeHashes: ReadonlyArray<string>) => Effect.Effect<void>;
+    /** Atomically redeem one recovery code by its hash: returns true only
+     *  when an unconsumed row for `userId` matched — and marks it consumed
+     *  in the same step (single-use). false otherwise. */
+    readonly consumeRecoveryCode: (userId: string, codeHash: string) => Effect.Effect<boolean>;
+    /** Count the user's remaining (unconsumed) recovery codes — surfaced so
+     *  the UI can warn when the user is running low. */
+    readonly countRecoveryCodes: (userId: string) => Effect.Effect<number>;
+}
+
 /** A registered WebAuthn credential. */
 declare interface PasskeyRecord {
     readonly id: string;
@@ -88,6 +205,21 @@ declare interface PasskeyRecord {
     readonly lastUsedAt: Date | null;
 }
 
+/** Passkeys (WebAuthn). */
+declare interface PasskeyStore {
+    readonly listPasskeys: (userId: string) => Effect.Effect<ReadonlyArray<PasskeyRecord>>;
+    readonly findPasskey: (credentialId: string) => Effect.Effect<PasskeyRecord | null>;
+    readonly insertPasskey: (passkey: Omit<PasskeyRecord, 'createdAt' | 'lastUsedAt'>) => Effect.Effect<PasskeyRecord>;
+    /** Atomically bump the stored signature counter, guarding against a
+     *  cloned authenticator (WebAuthn §6.1.1): the update only applies when
+     *  `newCounter` strictly exceeds the stored counter. Returns whether a
+     *  row was advanced. `false` with an unchanged stored counter is the
+     *  clone/replay signal the assertion handler rejects on — the check and
+     *  the write are ONE atomic statement at the store, so two replicas
+     *  racing the same counter can't both succeed. */
+    readonly advancePasskeyCounter: (credentialId: string, newCounter: number) => Effect.Effect<boolean>;
+}
+
 /** A server-side session row — enumerated so apps can list active
  *  devices + revoke them. Written on sign-in; deleted on revoke. */
 declare interface SessionRecord {
@@ -133,6 +265,29 @@ declare interface SessionRevocationOptions {
  *  or the keyed `{ current, previous? }` rotation set. */
 declare type SessionSecretInput = string | SessionSecrets;
 
+/** Server-side sessions — enumeration + revocation. */
+declare interface SessionStore {
+    /** Active sessions for a user (most recent first). */
+    readonly listSessions: (userId: string) => Effect.Effect<ReadonlyArray<SessionRecord>>;
+    /** Record a session on sign-in. */
+    readonly insertSession: (session: Omit<SessionRecord, 'createdAt' | 'lastSeenAt'>) => Effect.Effect<SessionRecord>;
+    /** Look up one session row by id. The request-time revocation check
+     *  (`makeSessionRevocationChecker`) calls this — a missing row means
+     *  the session was revoked. */
+    readonly findSession: (sessionId: string) => Effect.Effect<SessionRecord | null>;
+    /** Slide a session row forward: bump `expiresAt` + `lastSeenAt`. Called
+     *  when the sliding-window renewal re-issues the cookie, so the row
+     *  outlives the renewed cookie and the revocation check keeps passing. */
+    readonly touchSession: (sessionId: string, expiresAt: Date) => Effect.Effect<void>;
+    /** Revoke a single session — only if it belongs to `userId` (so a
+     *  caller can't revoke another user's session by id-guessing). Returns
+     *  whether a row was removed. */
+    readonly revokeSession: (userId: string, sessionId: string) => Effect.Effect<boolean>;
+    /** Revoke every session for the user EXCEPT `keepSessionId` — the
+     *  "sign out other devices" action. Returns the count removed. */
+    readonly revokeAllOtherSessions: (userId: string, keepSessionId: string) => Effect.Effect<number>;
+}
+
 declare type TokenPurpose = 'magic-link' | 'password-reset' | 'mfa-pending' | 'email-verify';
 
 /** A single-use, hashed, expiring token (magic-link / password-reset). */
@@ -146,6 +301,28 @@ declare interface TokenRecord {
     readonly createdAt: Date;
 }
 
+/** Single-use tokens: magic link, password reset, MFA pending, email verification. */
+declare interface TokenStore {
+    /** Persist a single-use token (already hashed). */
+    readonly insertToken: (token: Omit<TokenRecord, 'consumedAt' | 'createdAt'>) => Effect.Effect<TokenRecord>;
+    /** Atomically redeem a token by its hash + purpose: returns the row
+     *  only when it exists, matches the purpose, is unexpired, and was not
+     *  already consumed — and marks it consumed in the same step. Returns
+     *  null otherwise (single-use guard). */
+    readonly consumeToken: (tokenHash: string, purpose: TokenPurpose) => Effect.Effect<TokenRecord | null>;
+    /**
+     * The most recently CREATED token of this purpose for the user, consumed or
+     * not — or null when there is none.
+     *
+     * Exists for the resend cooldown, which is the only bound on an endpoint
+     * that sends mail to an address supplied by an unauthenticated caller. Note
+     * it deliberately does NOT filter on `consumedAt`: the cost being rate-
+     * limited is the EMAIL, and a token that was minted and then redeemed cost
+     * exactly as much to send as one still pending.
+     */
+    readonly latestToken: (userId: string, purpose: TokenPurpose) => Effect.Effect<TokenRecord | null>;
+}
+
 declare class UserAlreadyExistsError extends UserAlreadyExistsError_base<{
     readonly email: string;
 }> {
@@ -215,148 +392,8 @@ declare interface UserRecord {
     readonly deactivatedAt?: Date | null;
 }
 
-declare interface UserStore {
-    readonly findByEmail: (email: string) => Effect.Effect<UserRecord | null>;
-    readonly findById: (id: string) => Effect.Effect<UserRecord | null>;
-    readonly insert: (user: Omit<UserRecord, 'createdAt'>) => Effect.Effect<UserRecord, UserAlreadyExistsError>;
-    /** Replace a user's stored password hash. Used by password-reset AND
-     *  by rehash-on-verify (silently upgrading an under-cost hash on a
-     *  successful sign-in). */
-    readonly updatePassword: (userId: string, newHash: string) => Effect.Effect<UserRecord, UserNotFoundError>;
-    /** Stash a freshly-generated TOTP secret on the user. Called by
-     *  the MFA enrolment handler before the user verifies the first
-     *  code. */
-    readonly setMfaSecret: (userId: string, secret: string) => Effect.Effect<UserRecord, UserNotFoundError>;
-    /** Mark MFA as fully enrolled (called after the first successful
-     *  TOTP verify completes the enrolment ceremony). */
-    readonly markMfaEnrolled: (userId: string) => Effect.Effect<UserRecord, UserNotFoundError>;
-    /** Wipe the secret + enrolledAt. Used by /account/security's
-     *  "remove MFA" action. */
-    readonly clearMfa: (userId: string) => Effect.Effect<UserRecord, UserNotFoundError>;
-    /**
-     * Stamp `emailVerifiedAt` — the address has been proven.
-     *
-     * IDEMPOTENT and non-regressing: a user already verified keeps their
-     * ORIGINAL timestamp. "When was this address first proven" is the question
-     * the column answers, and re-stamping it on every later magic-link login
-     * would quietly turn it into "when did they last click something".
-     */
-    readonly markEmailVerified: (userId: string) => Effect.Effect<UserRecord, UserNotFoundError>;
-    /** Every tenant the user belongs to. */
-    readonly listMemberships: (userId: string) => Effect.Effect<ReadonlyArray<MembershipRecord>>;
-    /** Idempotent grant: inserts the [userId, tenantId] membership or
-     *  updates its role if it already exists. The DB-level composite
-     *  UNIQUE on `[userId, tenantId]` (see `membershipsTable`) is the
-     *  source of truth; this upsert converges to it. */
-    readonly addMembership: (membership: Omit<MembershipRecord, 'joinedAt'>) => Effect.Effect<MembershipRecord>;
-    /** Resolve the role for a [userId, tenantId] pair, or null when the
-     *  user is NOT a member. The switch-tenant handler calls this to
-     *  validate the requested tenant before rebinding the connection. */
-    readonly membershipRole: (userId: string, tenantId: string) => Effect.Effect<string | null>;
-    /** Active sessions for a user (most recent first). */
-    readonly listSessions: (userId: string) => Effect.Effect<ReadonlyArray<SessionRecord>>;
-    /** Record a session on sign-in. */
-    readonly insertSession: (session: Omit<SessionRecord, 'createdAt' | 'lastSeenAt'>) => Effect.Effect<SessionRecord>;
-    /** Look up one session row by id. The request-time revocation check
-     *  (`makeSessionRevocationChecker`) calls this — a missing row means
-     *  the session was revoked. */
-    readonly findSession: (sessionId: string) => Effect.Effect<SessionRecord | null>;
-    /** Slide a session row forward: bump `expiresAt` + `lastSeenAt`. Called
-     *  when the sliding-window renewal re-issues the cookie, so the row
-     *  outlives the renewed cookie and the revocation check keeps passing. */
-    readonly touchSession: (sessionId: string, expiresAt: Date) => Effect.Effect<void>;
-    /** Revoke a single session — only if it belongs to `userId` (so a
-     *  caller can't revoke another user's session by id-guessing). Returns
-     *  whether a row was removed. */
-    readonly revokeSession: (userId: string, sessionId: string) => Effect.Effect<boolean>;
-    /** Revoke every session for the user EXCEPT `keepSessionId` — the
-     *  "sign out other devices" action. Returns the count removed. */
-    readonly revokeAllOtherSessions: (userId: string, keepSessionId: string) => Effect.Effect<number>;
-    /** Persist a single-use token (already hashed). */
-    readonly insertToken: (token: Omit<TokenRecord, 'consumedAt' | 'createdAt'>) => Effect.Effect<TokenRecord>;
-    /** Atomically redeem a token by its hash + purpose: returns the row
-     *  only when it exists, matches the purpose, is unexpired, and was not
-     *  already consumed — and marks it consumed in the same step. Returns
-     *  null otherwise (single-use guard). */
-    readonly consumeToken: (tokenHash: string, purpose: TokenPurpose) => Effect.Effect<TokenRecord | null>;
-    /**
-     * The most recently CREATED token of this purpose for the user, consumed or
-     * not — or null when there is none.
-     *
-     * Exists for the resend cooldown, which is the only bound on an endpoint
-     * that sends mail to an address supplied by an unauthenticated caller. Note
-     * it deliberately does NOT filter on `consumedAt`: the cost being rate-
-     * limited is the EMAIL, and a token that was minted and then redeemed cost
-     * exactly as much to send as one still pending.
-     */
-    readonly latestToken: (userId: string, purpose: TokenPurpose) => Effect.Effect<TokenRecord | null>;
-    /** Persist an invitation (token already hashed). */
-    readonly insertInvitation: (invitation: Omit<InvitationRecord, 'acceptedAt' | 'acceptedByUserId' | 'revokedAt' | 'revokedByUserId' | 'createdAt'>) => Effect.Effect<InvitationRecord>;
-    /** Look an invitation up by token hash WITHOUT redeeming it — the read the
-     *  "what am I being invited to" preview needs. Returns the row whatever its
-     *  state; the caller decides what an expired or revoked one means. */
-    readonly findInvitationByHash: (tokenHash: string) => Effect.Effect<InvitationRecord | null>;
-    /**
-     * Atomically redeem an invitation: returns the row only when it exists, is
-     * unaccepted, unrevoked and unexpired — and stamps `acceptedAt` +
-     * `acceptedByUserId` in the same step. Null otherwise.
-     *
-     * The single-use guard, and it has to be ONE statement: two clicks on the
-     * same emailed link race, and a read-then-write would let both through and
-     * write the membership twice.
-     */
-    readonly acceptInvitation: (tokenHash: string, acceptedByUserId: string, now: Date) => Effect.Effect<InvitationRecord | null>;
-    /** Withdraw a PENDING invitation, scoped to its tenant so an admin of one
-     *  tenant cannot revoke another's by id. Returns whether a row changed. */
-    readonly revokeInvitation: (invitationId: string, tenantId: string, revokedByUserId: string, now: Date) => Effect.Effect<boolean>;
-    /** Every invitation for a tenant, newest first. The admin list. */
-    readonly listInvitations: (tenantId: string) => Effect.Effect<ReadonlyArray<InvitationRecord>>;
-    /** How many invitations for this tenant are still redeemable — the bound
-     *  `maxPending` enforces. */
-    readonly countPendingInvitations: (tenantId: string, now: Date) => Effect.Effect<number>;
-    /** Revoke every pending invitation for (tenant, email). Called before
-     *  issuing a fresh one so re-inviting supersedes rather than accumulates —
-     *  otherwise every resend leaves a live token behind. Returns the count. */
-    readonly supersedePendingInvitations: (tenantId: string, email: string, revokedByUserId: string, now: Date) => Effect.Effect<number>;
-    /** Record an impersonation grant when the impersonated session is minted. */
-    readonly insertImpersonationGrant: (grant: Omit<ImpersonationGrantRecord, 'startedAt' | 'endedAt' | 'endedReason'>) => Effect.Effect<ImpersonationGrantRecord>;
-    /** The grant for an impersonated session, or null. The stop path's lookup. */
-    readonly findImpersonationGrantBySession: (sessionId: string) => Effect.Effect<ImpersonationGrantRecord | null>;
-    /** Close a grant. Only an OPEN grant is closed (`endedAt IS NULL`), so a
-     *  double stop is a no-op rather than a rewritten end time. */
-    readonly endImpersonationGrant: (sessionId: string, endedReason: string, now: Date) => Effect.Effect<boolean>;
-    /** Replace the user's recovery codes with a fresh (already hashed) set.
-     *  Called at enrolment / regeneration — wipes any prior codes so the
-     *  displayed set is the only valid one. */
-    readonly replaceRecoveryCodes: (userId: string, codeHashes: ReadonlyArray<string>) => Effect.Effect<void>;
-    /** Atomically redeem one recovery code by its hash: returns true only
-     *  when an unconsumed row for `userId` matched — and marks it consumed
-     *  in the same step (single-use). false otherwise. */
-    readonly consumeRecoveryCode: (userId: string, codeHash: string) => Effect.Effect<boolean>;
-    /** Count the user's remaining (unconsumed) recovery codes — surfaced so
-     *  the UI can warn when the user is running low. */
-    readonly countRecoveryCodes: (userId: string) => Effect.Effect<number>;
-    readonly listPasskeys: (userId: string) => Effect.Effect<ReadonlyArray<PasskeyRecord>>;
-    readonly findPasskey: (credentialId: string) => Effect.Effect<PasskeyRecord | null>;
-    readonly insertPasskey: (passkey: Omit<PasskeyRecord, 'createdAt' | 'lastUsedAt'>) => Effect.Effect<PasskeyRecord>;
-    /** Atomically bump the stored signature counter, guarding against a
-     *  cloned authenticator (WebAuthn §6.1.1): the update only applies when
-     *  `newCounter` strictly exceeds the stored counter. Returns whether a
-     *  row was advanced. `false` with an unchanged stored counter is the
-     *  clone/replay signal the assertion handler rejects on — the check and
-     *  the write are ONE atomic statement at the store, so two replicas
-     *  racing the same counter can't both succeed. */
-    readonly advancePasskeyCounter: (credentialId: string, newCounter: number) => Effect.Effect<boolean>;
-    /** Is this email currently locked out? Reads only — never mutates. Returns
-     *  the remaining cooldown so the handler can surface a retry-after. */
-    readonly isLockedOut: (email: string, now: number) => Effect.Effect<LockoutState>;
-    /** Record one failed credential attempt for `email`. Opens a fresh window
-     *  when the previous one (or a prior lock) has expired, otherwise increments;
-     *  sets the lock once `failedCount` reaches `policy.maxAttempts`. Called only
-     *  for a NOT-currently-locked email (the handler checks `isLockedOut` first). */
-    readonly recordLoginFailure: (email: string, now: number, policy: LockoutPolicy) => Effect.Effect<void>;
-    /** Clear the counter for `email` on a completed login. */
-    readonly clearLoginFailures: (email: string) => Effect.Effect<void>;
+/** Every role at once — what the shipped stores return and what `authRoutesPlugin` takes. */
+declare interface UserStore extends IdentityStore, MfaStore, MembershipStore, SessionStore, TokenStore, InvitationStore, ImpersonationStore, PasskeyStore, LockoutStore {
 }
 
 export declare const voltroPasswordStrategy: (options?: VoltroPasswordStrategyOptions) => AuthStrategy;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voltro/plugin-auth",
-  "version": "0.71.0",
+  "version": "0.72.0",
   "description": "Authentication primitives: password hashing, session creation, schema mixin + tables. Pairs with the `auth` app template for the UI; both independently usable. Server-side only (uses node:crypto).",
   "keywords": [
     "voltro",
@@ -79,8 +79,8 @@
   },
   "dependencies": {
     "@effect/sql": "^0.52.1",
-    "@voltro/database": "0.71.0",
-    "@voltro/protocol": "0.71.0"
+    "@voltro/database": "0.72.0",
+    "@voltro/protocol": "0.72.0"
   },
   "peerDependencies": {
     "effect": "^3.22.1",