@voltro/plugin-auth 0.84.0 → 0.86.0

package/dist/plugin.js

@@ -1,5 +1,498 @@
-import "./password.js";
-import "./session.js";
-import { n as e, t } from "./plugin-CNW-X70p.js";
-import "./csrf.js";
-export { t as authRoutesPlugin, e as getAuthSessionStrategy };
+import { hashPassword as e } from "./password.js";
+import { clearSessionCookie as t, issueSession as n, readSessionFromHeaders as r } from "./session.js";
+import { makeSessionRevocationChecker as i } from "./revocation.js";
+import { sessionIdOfSubject as a } from "./userStore.js";
+import { deferredUserStore as o } from "./appUserStore.js";
+import { CSRF_COOKIE_NAME as s, CSRF_HEADER_NAME as c, verifyCsrf as ee } from "./csrf.js";
+import { emailVerificationActive as te, emailVerificationGuard as ne, handleEmailVerifyConfirm as re, handleEmailVerifyRequest as l } from "./emailVerification.js";
+import { configSessionSecrets as ie, configSigningKey as ae, handleCsrf as oe, handleListMemberships as se, handleListSessions as ce, handleMagicLinkConsume as le, handleMagicLinkRequest as ue, handleMfaEnrollStart as de, handleMfaEnrollVerify as fe, handleMfaRegenerateRecoveryCodes as pe, handleMfaUnenroll as me, handleMfaVerify as he, handlePasswordResetConfirm as ge, handlePasswordResetRequest as _e, handleRevokeAllOtherSessions as ve, handleRevokeSession as ye, handleSignIn as be, handleSignOut as xe, handleSignUp as Se, handleSwitchTenant as Ce, issueUserSession as u } from "./handlers.js";
+import { handlePasskeyAssertOptions as d, handlePasskeyAssertVerify as f, handlePasskeyRegisterOptions as p, handlePasskeyRegisterVerify as m, memoryChallengeStore as h } from "./passkeyHandlers.js";
+import { handleAcceptInvitation as g, handleAcceptInvitationWithSignUp as _, handleCreateInvitation as v, handleListInvitations as y, handlePreviewInvitation as b, handleRevokeInvitation as x } from "./invitations.js";
+import { IMPERSONATION_FORBIDDEN_SUBPATHS as S, handleImpersonationStart as C, handleImpersonationStop as w, isImpersonated as T } from "./impersonation.js";
+import { handleNativeAuthorize as E, handleNativeComplete as D, handleNativeExchange as O } from "./nativeRoutes.js";
+import { voltroPasswordStrategy as k } from "./strategy.js";
+import { Effect as A } from "effect";
+import { SESSION_HEADER_NAME as j, readCookie as we } from "@voltro/protocol/session";
+import { registerRetention as M, retentionTtlMsFromEnv as N } from "@voltro/database";
+import { definePlugin as Te } from "@voltro/protocol";
+//#region src/plugin.ts
+var P = (e) => {
+	for (let t of e) if (F(t)) return t.auth.sessionStrategy;
+	return null;
+}, F = (e) => typeof e.auth == "object" && e.auth !== null && typeof e.auth.sessionStrategy == "object", Ee = "/auth", De = (e) => {
+	let t = Buffer.from(e.rawBody).toString("utf8");
+	if (!t) return {};
+	if ((e.headers["content-type"] ?? "").includes("application/x-www-form-urlencoded")) {
+		let e = new URLSearchParams(t), n = {};
+		for (let [t, r] of e) n[t] = r;
+		return n;
+	}
+	try {
+		let e = JSON.parse(t);
+		return typeof e == "object" && e ? e : {};
+	} catch {
+		return {};
+	}
+}, I = (e) => ({
+	status: e.status,
+	...e.body === void 0 ? {} : { body: e.body },
+	...e.contentType === void 0 ? {} : { contentType: e.contentType },
+	headers: {
+		...e.setCookie === void 0 ? {} : { "set-cookie": e.setCookie },
+		...e.location === void 0 ? {} : { location: e.location }
+	}
+}), Oe = "actors", L = (e, t) => ({
+	status: e,
+	body: JSON.stringify(t),
+	contentType: "application/json; charset=utf-8"
+}), R = (e) => typeof e == "string" ? e : void 0, z = (e, t) => typeof t == "string" && t.length > 0 ? { [e]: t } : {}, B = (P) => {
+	let F = P.prefix ?? Ee, B = { current: typeof P.store == "function" ? void 0 : P.store }, V = typeof P.store == "function" ? o(() => B.current) : P.store, H = P.challengeStore ?? h(), U = { current: void 0 }, W = P.admit === void 0 ? void 0 : (e, t) => P.admit(e, { store: t.store ?? U.current }), G = {
+		...P.secret === void 0 ? {} : { secret: P.secret },
+		...P.secrets === void 0 ? {} : { secrets: P.secrets },
+		defaultTenantId: P.defaultTenantId,
+		...P.cookieDomain === void 0 ? {} : { cookieDomain: P.cookieDomain },
+		...P.cookieSecure === void 0 ? {} : { cookieSecure: P.cookieSecure },
+		...P.successRedirect === void 0 ? {} : { successRedirect: P.successRedirect },
+		...P.signUpTenants === void 0 ? {} : { signUpTenants: P.signUpTenants },
+		...P.sendEmail === void 0 ? {} : { sendEmail: P.sendEmail },
+		...P.appBaseUrl === void 0 ? {} : { appBaseUrl: P.appBaseUrl },
+		subjectGuards: [...P.subjectGuards ?? [], ...te(P.emailVerification) ? [ne(P.emailVerification)] : []],
+		...P.lockout === void 0 ? {} : { lockout: P.lockout },
+		...P.now === void 0 ? {} : { now: P.now },
+		...W === void 0 ? {} : { admit: W },
+		ensureActor: P.ensureActor ?? ((e) => {
+			let t = U.current;
+			return t === void 0 ? A.void : A.promise(() => t.insertIgnore(Oe, {
+				id: e.id,
+				kind: "user",
+				displayName: null
+			}, { conflictColumns: ["id"] }));
+		}),
+		...P.emailVerification === void 0 ? {} : { emailVerification: P.emailVerification }
+	}, K = {
+		...P.appBaseUrl === void 0 ? {} : { appBaseUrl: P.appBaseUrl },
+		...P.sendEmail === void 0 ? {} : { sendEmail: P.sendEmail },
+		...P.invitations === void 0 ? {} : { invitations: P.invitations },
+		...P.now === void 0 ? {} : { now: P.now },
+		...W === void 0 ? {} : { admit: W }
+	};
+	P.invitations !== void 0 && M({
+		source: "plugin",
+		table: "invitations",
+		timeColumn: "createdAt",
+		ttlMs: N(process.env.VOLTRO_INVITATIONS_TTL_HOURS, 2160),
+		envVar: "VOLTRO_INVITATIONS_TTL_HOURS"
+	}), P.impersonation !== void 0 && M({
+		source: "plugin",
+		table: "impersonationGrants",
+		timeColumn: "startedAt",
+		ttlMs: N(process.env.VOLTRO_IMPERSONATION_GRANTS_TTL_HOURS, 8760),
+		envVar: "VOLTRO_IMPERSONATION_GRANTS_TTL_HOURS"
+	});
+	let q = i(V, P.sessionRevocation ?? {}), J = async (e) => {
+		let t = ie(G), i = r(e.headers, t);
+		if (!i) return null;
+		let o = e.headers[j] ? "header" : "cookie", s = a(i.subject);
+		if (s && !await A.runPromise(q.isLive(s))) return null;
+		if (i.renew || i.kid !== t.current.kid) {
+			let e = Math.max(i.exp - i.iat, 60), r = n(i.subject, t, {
+				ttlSeconds: e,
+				...G.cookieDomain ? { domain: G.cookieDomain } : {},
+				secure: G.cookieSecure ?? !0
+			});
+			return s && await A.runPromise(V.touchSession(s, new Date(Date.now() + e * 1e3))), {
+				subject: i.subject,
+				sessionId: s,
+				renewSetCookie: r.setCookie,
+				renewValue: r.value,
+				via: o,
+				expiresAt: Math.floor(Date.now() / 1e3) + e
+			};
+		}
+		return {
+			subject: i.subject,
+			sessionId: s,
+			via: o,
+			expiresAt: i.exp
+		};
+	}, Y = (e, t) => {
+		if (!t) return e;
+		let n = e.headers ?? {};
+		return n["set-cookie"] ? e : {
+			...e,
+			headers: {
+				...n,
+				"set-cookie": t
+			}
+		};
+	}, je = (e) => {
+		let t = e.headers[c], n = we(e.headers.cookie, s);
+		return ee(t, n, ae(P));
+	}, X = (e, t) => e.path === `${F}${t}`, Z = (e) => A.runPromise(e).then(I), Q = {
+		issue: (e, t) => u(e, V, G, {
+			sessionId: t.sessionId,
+			ttlSeconds: t.ttlSeconds,
+			metadata: t.metadata,
+			ipAddress: t.ipAddress ?? null,
+			userAgent: t.userAgent ?? null,
+			clearLoginFailures: !1
+		}),
+		reissue: (e, t) => u(e, V, G, {
+			sessionId: t.sessionId,
+			ttlSeconds: t.ttlSeconds,
+			sessionRow: "existing",
+			clearLoginFailures: !1
+		}),
+		clear: () => t({
+			...G.cookieDomain ? { domain: G.cookieDomain } : {},
+			secure: G.cookieSecure ?? !0
+		})
+	}, Me = {
+		method: "*",
+		path: F,
+		handle: async (t) => {
+			let n = t.method === "GET" ? {} : De(t);
+			if (P.native !== void 0) {
+				let e = {
+					prefix: F,
+					config: G,
+					native: P.native,
+					...P.now === void 0 ? {} : { now: P.now }
+				};
+				if (t.method === "GET" && X(t, "/native/authorize")) {
+					let n = await J(t);
+					return Z(E(new URLSearchParams(t.query), n, V, e));
+				}
+				if (t.method === "GET" && X(t, "/native/complete")) {
+					let n = await J(t);
+					return Z(D(t.headers.cookie, n, V, e));
+				}
+				if (t.method === "POST" && X(t, "/native/exchange")) return Z(O({
+					code: R(n.code) ?? "",
+					codeVerifier: R(n.codeVerifier) ?? ""
+				}, V, e));
+			} else if (t.path.startsWith(`${F}/native/`)) return L(501, { error: "native_login_not_configured" });
+			if (t.method === "GET" && X(t, "/csrf")) return I(oe(G));
+			if (t.method === "POST" && X(t, "/sign-in")) return Z(be({
+				email: R(n.email) ?? "",
+				password: R(n.password) ?? "",
+				...n.redirectAfter === void 0 ? {} : { redirectAfter: !!n.redirectAfter },
+				...t.remoteAddr ? { ipAddress: t.remoteAddr } : {},
+				...t.headers["user-agent"] ? { userAgent: t.headers["user-agent"] } : {}
+			}, V, G));
+			if (t.method === "POST" && X(t, "/sign-up")) {
+				let e = R(n.tenantId);
+				return e !== void 0 && e !== G.defaultTenantId && !(G.signUpTenants ?? []).includes(e) ? {
+					status: 400,
+					headers: { "content-type": "application/json" },
+					body: JSON.stringify({ error: "tenant_not_open" })
+				} : Z(Se({
+					email: R(n.email) ?? "",
+					password: R(n.password) ?? "",
+					...z("tenantId", e),
+					...n.redirectAfter === void 0 ? {} : { redirectAfter: !!n.redirectAfter }
+				}, V, G));
+			}
+			if (t.method === "POST" && X(t, "/sign-out")) {
+				let e = await J(t);
+				return e && e.subject.type === "user" && e.sessionId && (await A.runPromise(V.revokeSession(e.subject.id, e.sessionId)), q.invalidate(e.sessionId)), I(xe(G));
+			}
+			if (t.method === "POST" && X(t, "/magic-link")) return Z(ue({
+				email: R(n.email) ?? "",
+				...z("callbackPath", n.callbackPath)
+			}, V, G));
+			if (t.method === "POST" && X(t, "/magic-link/callback")) return Z(le({
+				token: R(n.token) ?? "",
+				...n.redirectAfter === void 0 ? {} : { redirectAfter: !!n.redirectAfter }
+			}, V, G));
+			if (t.method === "POST" && X(t, "/password-reset")) return Z(_e({
+				email: R(n.email) ?? "",
+				...z("callbackPath", n.callbackPath)
+			}, V, G));
+			if (t.method === "POST" && X(t, "/password-reset/confirm")) return Z(ge({
+				token: R(n.token) ?? "",
+				newPassword: R(n.newPassword) ?? ""
+			}, V));
+			if (t.method === "POST" && X(t, "/verify-email")) {
+				let e = R(n.email);
+				if (e) return Z(l({ email: e }, V, G));
+				let r = await J(t);
+				return !r || r.subject.type !== "user" ? L(400, { error: "email required" }) : Z(l({ userId: r.subject.id }, V, G));
+			}
+			if (t.method === "POST" && X(t, "/verify-email/callback")) return Z(re({ token: R(n.token) ?? "" }, V));
+			if (P.invitations && t.method === "POST" && X(t, "/invitations/preview")) return Z(b({ token: R(n.token) ?? "" }, V, K));
+			if (P.invitations && t.method === "POST" && X(t, "/invitations/sign-up")) return Z(_({
+				token: R(n.token) ?? "",
+				password: R(n.password) ?? ""
+			}, V, {
+				...K,
+				hashPassword: e
+			}));
+			if (t.method === "POST" && X(t, "/mfa/verify")) return Z(he({
+				pendingToken: R(n.pendingToken) ?? "",
+				...z("code", n.code),
+				...z("recoveryCode", n.recoveryCode),
+				...n.redirectAfter === void 0 ? {} : { redirectAfter: !!n.redirectAfter },
+				...t.remoteAddr ? { ipAddress: t.remoteAddr } : {},
+				...t.headers["user-agent"] ? { userAgent: t.headers["user-agent"] } : {}
+			}, V, G));
+			if (P.passkey && t.method === "POST" && X(t, "/passkey/assert/options")) return Z(d({ ...z("userId", n.userId) }, V, H, P.passkey));
+			if (P.passkey && t.method === "POST" && X(t, "/passkey/assert/verify")) return Z(f({
+				credentialId: R(n.credentialId) ?? "",
+				clientDataJSON: R(n.clientDataJSON) ?? "",
+				authenticatorData: R(n.authenticatorData) ?? "",
+				signature: R(n.signature) ?? "",
+				...z("userId", n.userId)
+			}, V, H, P.passkey, G));
+			let r = await J(t), i = r?.subject ?? null, a = () => !i || i.type !== "user" ? L(401, { error: "unauthenticated" }) : { userId: i.id }, o = () => je(t) ? null : L(403, { error: "csrf" }), s = (e) => Z(e).then((e) => Y(e, r?.renewSetCookie));
+			if (i && T(i)) {
+				let e = t.path.startsWith(F) ? t.path.slice(F.length) : "";
+				if (S.includes(e)) return L(403, {
+					error: "forbidden_while_impersonating",
+					message: "This action changes account credentials or session scope and is refused while impersonating. Stop the impersonation first."
+				});
+			}
+			if (t.method === "GET" && X(t, "/session")) {
+				let e = a();
+				return "status" in e ? e : Y(L(200, {
+					ok: !0,
+					subject: i,
+					renewed: r?.renewSetCookie !== void 0,
+					expiresAt: r?.expiresAt,
+					...r?.via === "header" && r.renewValue !== void 0 ? { session: r.renewValue } : {}
+				}), r?.renewSetCookie);
+			}
+			if (t.method === "GET" && X(t, "/sessions")) {
+				let e = a();
+				return "status" in e ? e : s(ce({ userId: e.userId }, V));
+			}
+			if (t.method === "GET" && X(t, "/memberships")) {
+				let e = a();
+				return "status" in e ? e : s(se({ userId: e.userId }, V));
+			}
+			if (t.method === "POST" && X(t, "/sessions/revoke")) {
+				let e = a();
+				if ("status" in e) return e;
+				let t = o();
+				if (t) return t;
+				let r = R(n.sessionId) ?? "";
+				return s(ye({
+					userId: e.userId,
+					sessionId: r
+				}, V)).then((e) => (r && q.invalidate(r), e));
+			}
+			if (t.method === "POST" && X(t, "/sessions/revoke-others")) {
+				let e = a();
+				return "status" in e ? e : o() || s(ve({
+					userId: e.userId,
+					keepSessionId: r?.sessionId ?? "__none__"
+				}, V));
+			}
+			if (P.invitations && t.method === "POST" && X(t, "/invitations")) {
+				let e = a();
+				return "status" in e ? e : o() || s(v({
+					inviterUserId: e.userId,
+					tenantId: R(n.tenantId) ?? i?.tenantId ?? "",
+					email: R(n.email) ?? "",
+					role: R(n.role) ?? ""
+				}, V, K));
+			}
+			if (P.invitations && t.method === "GET" && t.path === `${F}/invitations`) {
+				let e = a();
+				return "status" in e ? e : s(y({
+					callerUserId: e.userId,
+					tenantId: i?.tenantId ?? ""
+				}, V, K));
+			}
+			if (P.invitations && t.method === "POST" && X(t, "/invitations/revoke")) {
+				let e = a();
+				return "status" in e ? e : o() || s(x({
+					callerUserId: e.userId,
+					tenantId: R(n.tenantId) ?? i?.tenantId ?? "",
+					invitationId: R(n.invitationId) ?? ""
+				}, V, K));
+			}
+			if (P.invitations && t.method === "POST" && X(t, "/invitations/accept")) {
+				let e = a();
+				if (!("status" in e)) {
+					let e = o();
+					if (e) return e;
+				}
+				return s(g({
+					token: R(n.token) ?? "",
+					..."status" in e ? {} : { userId: e.userId }
+				}, V, K));
+			}
+			if (P.impersonation && t.method === "POST" && X(t, "/impersonate/start")) {
+				let e = a();
+				return "status" in e ? e : o() || Z(C({
+					actorSubject: i,
+					actorSessionId: r?.sessionId ?? "",
+					...z("targetUserId", n.userId),
+					...z("targetEmail", n.email),
+					...z("reason", n.reason),
+					...typeof n.durationSeconds == "number" ? { durationSeconds: n.durationSeconds } : {},
+					ipAddress: t.remoteAddr ?? null,
+					userAgent: t.headers["user-agent"] ?? null
+				}, V, {
+					impersonation: P.impersonation,
+					issuer: Q,
+					...P.now === void 0 ? {} : { now: P.now },
+					invalidateSession: (e) => q.invalidate(e)
+				}));
+			}
+			if (P.impersonation && t.method === "POST" && X(t, "/impersonate/stop")) {
+				let e = a();
+				return "status" in e ? e : o() || Z(w({
+					subject: i,
+					sessionId: r?.sessionId ?? ""
+				}, V, {
+					impersonation: P.impersonation,
+					issuer: Q,
+					...P.now === void 0 ? {} : { now: P.now },
+					invalidateSession: (e) => q.invalidate(e)
+				}));
+			}
+			if (t.method === "POST" && X(t, "/switch-tenant")) {
+				let e = a();
+				return "status" in e ? e : o() || Z(Ce({
+					userId: e.userId,
+					targetTenantId: R(n.targetTenantId) ?? "",
+					...typeof n.clientId == "number" ? { clientId: n.clientId } : {},
+					...r?.sessionId ? { sessionId: r.sessionId } : {},
+					...i?.type === "user" && i.metadata ? { metadata: i.metadata } : {}
+				}, V, G, P.rebind, U.current));
+			}
+			if (P.mfa && t.method === "POST" && X(t, "/mfa/enroll/start")) {
+				let e = a();
+				if ("status" in e) return e;
+				let t = o();
+				if (t) return t;
+				let n = await A.runPromise(V.findById(e.userId));
+				return s(de({
+					userId: e.userId,
+					issuer: P.mfa.issuer,
+					accountName: n?.email ?? e.userId
+				}, V));
+			}
+			if (P.mfa && t.method === "POST" && X(t, "/mfa/enroll/verify")) {
+				let e = a();
+				return "status" in e ? e : o() || s(fe({
+					userId: e.userId,
+					code: R(n.code) ?? ""
+				}, V));
+			}
+			if (P.mfa && t.method === "POST" && X(t, "/mfa/unenroll")) {
+				let e = a();
+				return "status" in e ? e : o() || s(me({ userId: e.userId }, V));
+			}
+			if (P.mfa && t.method === "POST" && X(t, "/mfa/recovery-codes/regenerate")) {
+				let e = a();
+				return "status" in e ? e : o() || s(pe({ userId: e.userId }, V));
+			}
+			if (P.passkey && t.method === "POST" && X(t, "/passkey/register/options")) {
+				let e = a();
+				return "status" in e ? e : o() || s(p({
+					userId: e.userId,
+					userName: R(n.userName) ?? e.userId
+				}, V, H, P.passkey));
+			}
+			if (P.passkey && t.method === "POST" && X(t, "/passkey/register/verify")) {
+				let e = a();
+				return "status" in e ? e : o() || s(m({
+					userId: e.userId,
+					credentialId: R(n.credentialId) ?? "",
+					clientDataJSON: R(n.clientDataJSON) ?? "",
+					authenticatorData: R(n.authenticatorData) ?? "",
+					...z("transports", n.transports)
+				}, V, H, P.passkey));
+			}
+			return !P.passkey && t.path.startsWith(`${F}/passkey/`) ? L(501, { error: "passkey_not_configured" }) : L(404, { error: "not_found" });
+		}
+	}, Ne = Te({
+		name: P.name ? `@voltro/plugin-auth#${P.name}` : "@voltro/plugin-auth",
+		description: "Auth routes — mounts the full auth surface (password, magic-link, password-reset, CSRF, session probe/list/revoke, memberships, switch-tenant, passkey ceremonies) under /auth on the framework listener, with keyed secret rotation + request-time revocation.",
+		permissions: [],
+		declaredEnv: Ae,
+		privacy: ke,
+		httpRoutes: [Me],
+		bindDataStore: (e, t) => {
+			U.current = e, typeof P.store == "function" && (B.current = P.store(t?.sql === void 0 ? {} : { sql: t.sql }));
+		},
+		onActivate: (e) => A.sync(() => {
+			e.logger.info("auth routes active", {
+				prefix: F,
+				passkey: P.passkey ? P.passkey.rpId : "disabled",
+				email: P.sendEmail ? "wired" : "unwired",
+				revocationWindowMs: q.ttlMs,
+				emailVerification: P.emailVerification?.policy ?? "off",
+				invitations: P.invitations ? "enabled" : "disabled",
+				impersonation: P.impersonation ? `enabled(max ${P.impersonation.maxDurationSeconds ?? 900}s)` : "disabled"
+			});
+		}),
+		onDeactivate: () => A.void
+	}), $ = P.secrets ?? P.secret;
+	return {
+		...Ne,
+		auth: { sessionStrategy: k({
+			...$ === void 0 ? {} : { secret: $ },
+			store: V,
+			revocation: q
+		}) }
+	};
+}, ke = { collects: [{
+	category: "identifiers",
+	linked: !0,
+	tracking: !1,
+	purposes: ["app-functionality"]
+}, {
+	category: "email",
+	linked: !0,
+	tracking: !1,
+	purposes: ["app-functionality"]
+}] }, Ae = [
+	{
+		name: "VOLTRO_SESSION_SECRET_PREVIOUS",
+		required: !1,
+		secret: !0,
+		description: "The session secret being rotated AWAY from. While set, cookies signed with it still verify (and get re-issued under the current secret on the next authenticated /auth response). Set the new secret as VOLTRO_SESSION_SECRET, move the old one here for one session lifetime, then drop it.",
+		example: "the-previous-signing-secret"
+	},
+	{
+		name: "VOLTRO_SESSION_KID",
+		required: !1,
+		secret: !1,
+		description: "Non-secret key-id label stamped into cookies signed with the current secret (default 'k0').",
+		example: "2026-07"
+	},
+	{
+		name: "VOLTRO_SESSION_KID_PREVIOUS",
+		required: !1,
+		secret: !1,
+		description: "Non-secret key-id label for the previous secret (default 'k-previous').",
+		example: "2026-01"
+	},
+	{
+		name: "VOLTRO_INVITATIONS_TTL_HOURS",
+		required: !1,
+		secret: !1,
+		description: "How long an `invitations` row is kept before the retention sweep DELETES it. Default 2160 (90 days). Only armed when `invitations` is configured. Every invitation is dead long before this — the lifetime that decides redeemability is `invitations.ttlSeconds` (7 days by default) — so this bounds the history, not the grant.",
+		example: "2160"
+	},
+	{
+		name: "VOLTRO_IMPERSONATION_GRANTS_TTL_HOURS",
+		required: !1,
+		secret: !1,
+		description: "How long an `impersonationGrants` row is kept before the retention sweep DELETES it. Default 8760 (365 days), matching the audit log — this table answers \"who was acting as whom, when\", which is compliance evidence rather than operational state. Only armed when `impersonation` is configured. Raise it to your audit-retention obligation; lowering it shortens how far back an impersonation can be traced.",
+		example: "8760"
+	},
+	{
+		name: "VOLTRO_AUTH_SCOPE_CACHE_TTL_MS",
+		required: !1,
+		secret: !1,
+		description: "How long a resolved authority (auth.resolveScopes) stays cached, in milliseconds. Default 30000 — the same window as the session-revocation check, so the two per-request store reads expire together. This is the staleness window for a role change: remove a permission and every live session observes it within this long. Set it to 0 to resolve on every request (staleness zero, one store read per request). An explicit ttlMs in code wins over this variable.",
+		example: "30000"
+	}
+];
+//#endregion
+export { B as authRoutesPlugin, P as getAuthSessionStrategy };