@voltro/plugin-auth 0.84.0 → 0.86.0

package/dist/strategy.js

@@ -1,3 +1,65 @@
-import "./session.js";
-import { t as e } from "./strategy-XaGjSicX.js";
-export { e as voltroPasswordStrategy };
+import { sessionSecretsOf as e } from "./session.js";
+import { makeSessionRevocationChecker as t } from "./revocation.js";
+import { sessionIdOfSubject as n } from "./userStore.js";
+import { Effect as r } from "effect";
+import { readSessionValue as i, resolveSessionSecret as a, verifySessionKeyed as o } from "@voltro/protocol/session";
+//#region src/strategy.ts
+var s = (e) => typeof e.isLive == "function", c = (e) => e.revocation && s(e.revocation) ? e.revocation : e.store ? t(e.store, e.revocation ?? {}) : null, l = (l = {}) => {
+	let d = l.cookieName ?? "voltro:session", f = c(l), p = l.revocation && !s(l.revocation) ? l.revocation : {}, m = /* @__PURE__ */ new WeakMap(), h = (e) => {
+		if (f) return f;
+		let n = l.sessionRegistry;
+		if (n === void 0) return null;
+		if (typeof n != "function") return t(n, p);
+		if (e === void 0) return null;
+		let r = m.get(e);
+		if (r) return r;
+		let i = t(n(e), p);
+		return m.set(e, i), i;
+	};
+	return {
+		id: "voltro-password",
+		resolve: (t) => {
+			let s = i(t.headers, d);
+			if (!s) return { kind: "skip" };
+			let c = e(l.secret ?? a()), f = o(s, c);
+			if (!f) return {
+				kind: "failed",
+				reason: "voltro session cookie failed verification"
+			};
+			let p = u(f.subject, "voltro-password"), m = n(p);
+			if (!m) return l.requireSessionId === !0 ? {
+				kind: "failed",
+				reason: "voltro session cookie carries no session id"
+			} : {
+				kind: "matched",
+				subject: p
+			};
+			let g = h(t.store);
+			return g ? r.runPromise(g.isLive(m)).then((e) => e ? {
+				kind: "matched",
+				subject: p
+			} : {
+				kind: "failed",
+				reason: "voltro session revoked"
+			}) : l.requireSessionId === !0 && l.sessionRegistry !== void 0 ? {
+				kind: "failed",
+				reason: "session registry not available yet"
+			} : {
+				kind: "matched",
+				subject: p
+			};
+		}
+	};
+}, u = (e, t) => {
+	if (e.type === "anonymous") return e;
+	let n = e.metadata ?? {};
+	return {
+		...e,
+		metadata: {
+			...n,
+			provider: t
+		}
+	};
+};
+//#endregion
+export { l as voltroPasswordStrategy };

package/dist/subjectGuard.js

@@ -0,0 +1,11 @@
+import { Effect as e } from "effect";
+//#region src/subjectGuard.ts
+var t = { ok: !0 }, n = (n, r) => e.gen(function* () {
+	for (let e of n) {
+		let t = yield* e(r);
+		if (!t.ok) return t;
+	}
+	return t;
+});
+//#endregion
+export { n as runSubjectGuards };

package/dist/totp.js

@@ -0,0 +1,55 @@
+import { createHmac as e, randomBytes as t, timingSafeEqual as n } from "node:crypto";
+import { Data as r, Effect as i } from "effect";
+//#region src/totp.ts
+var a = 30, o = 6, s = 20, c = "sha1", l = 1, u = class extends r.TaggedError("TotpVerifyError") {}, d = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567", f = (e) => {
+	let t = 0, n = 0, r = "";
+	for (let i of e) for (n = n << 8 | i, t += 8; t >= 5;) r += d[n >>> t - 5 & 31], t -= 5;
+	return t > 0 && (r += d[n << 5 - t & 31]), r;
+}, p = (e) => {
+	let t = e.toUpperCase().replace(/[\s=]+/g, "");
+	if (!/^[A-Z2-7]+$/.test(t)) return null;
+	let n = new Uint8Array(Math.floor(t.length * 5 / 8)), r = 0, i = 0, a = 0;
+	for (let e of t) {
+		let t = d.indexOf(e);
+		if (t === -1) return null;
+		i = i << 5 | t, r += 5, r >= 8 && (n[a++] = i >>> r - 8 & 255, r -= 8);
+	}
+	return n.subarray(0, a);
+}, m = (e) => {
+	let t = Buffer.alloc(8);
+	return t.writeBigUInt64BE(BigInt(e), 0), t;
+}, h = (t, n) => {
+	let r = e(c, Buffer.from(t));
+	r.update(m(n));
+	let i = r.digest(), a = i[i.length - 1] & 15, s = (i[a] & 127) << 24 | (i[a + 1] & 255) << 16 | (i[a + 2] & 255) << 8 | i[a + 3] & 255;
+	return String(s % 10 ** o).padStart(o, "0");
+}, g = () => f(t(s)), _ = (e) => `otpauth://totp/${encodeURIComponent(`${e.issuer}:${e.accountName}`)}?${new URLSearchParams({
+	secret: e.secret,
+	issuer: e.issuer,
+	algorithm: "SHA1",
+	digits: String(o),
+	period: String(a)
+}).toString()}`, v = (e, t = Date.now()) => {
+	let n = p(e);
+	return n ? h(n, Math.floor(t / 1e3 / a)) : "000000";
+}, y = (e, t, r = Date.now()) => i.gen(function* () {
+	let o = p(e);
+	if (!o) return yield* i.fail(new u({ reason: "malformedSecret" }));
+	let s = t.replace(/\s+/g, "");
+	if (!/^[0-9]{6}$/.test(s)) return yield* i.fail(new u({ reason: "invalidCode" }));
+	let c = Math.floor(r / 1e3 / a), d = Buffer.from(s);
+	for (let e = -1; e <= l; e++) {
+		let t = h(o, c + e), r = Buffer.from(t);
+		if (r.length === d.length && n(r, d)) return !0;
+	}
+	return yield* i.fail(new u({ reason: "invalidCode" }));
+}), b = (e = 10) => {
+	let n = [];
+	for (let r = 0; r < e; r++) {
+		let e = f(t(16)).slice(0, 25).match(/.{1,5}/g) ?? [];
+		n.push(e.join("-"));
+	}
+	return n;
+};
+//#endregion
+export { u as TotpVerifyError, b as generateRecoveryCodes, v as generateTotpCode, g as generateTotpSecret, _ as otpauthUrl, y as verifyTotpCode };

package/dist/userStore.js

@@ -0,0 +1,285 @@
+import { Data as e, Effect as t } from "effect";
+import { generateId as n } from "@voltro/database";
+//#region src/userStore.ts
+var r = class extends e.TaggedError("UserAlreadyExistsError") {}, i = class extends e.TaggedError("UserNotFoundError") {}, a = (e) => n({
+	kind: "typeid",
+	prefix: e
+}, e), o = (e = []) => {
+	let n = /* @__PURE__ */ new Map(), o = /* @__PURE__ */ new Map(), s = [], c = [], l = [], u = [], d = [], f = [], p = [], m = /* @__PURE__ */ new Map();
+	for (let t of e) n.set(t.id, t), o.set(t.email.toLowerCase(), t);
+	let h = (e, r) => t.gen(function* () {
+		let a = n.get(e);
+		if (!a) return yield* t.fail(new i({ userId: e }));
+		let s = r(a);
+		return n.set(e, s), o.set(s.email.toLowerCase(), s), s;
+	});
+	return {
+		findByEmail: (e) => t.sync(() => o.get(e.toLowerCase()) ?? null),
+		findById: (e) => t.sync(() => n.get(e) ?? null),
+		insert: (e) => t.gen(function* () {
+			let i = e.email.toLowerCase();
+			if (o.has(i)) return yield* t.fail(new r({ email: i }));
+			let a = {
+				...e,
+				email: i,
+				createdAt: /* @__PURE__ */ new Date()
+			};
+			return n.set(a.id, a), o.set(i, a), a;
+		}),
+		updatePassword: (e, t) => h(e, (e) => ({
+			...e,
+			passwordHash: t
+		})),
+		setMfaSecret: (e, t) => h(e, (e) => ({
+			...e,
+			mfaSecret: t,
+			mfaEnrolledAt: null
+		})),
+		markMfaEnrolled: (e) => h(e, (e) => ({
+			...e,
+			mfaEnrolledAt: /* @__PURE__ */ new Date()
+		})),
+		clearMfa: (e) => h(e, (e) => ({
+			...e,
+			mfaSecret: null,
+			mfaEnrolledAt: null
+		})),
+		markEmailVerified: (e) => h(e, (e) => e.emailVerifiedAt ? e : {
+			...e,
+			emailVerifiedAt: /* @__PURE__ */ new Date()
+		}),
+		listMemberships: (e) => t.sync(() => s.filter((t) => t.userId === e)),
+		addMembership: (e) => t.sync(() => {
+			let t = s.findIndex((t) => t.userId === e.userId && t.tenantId === e.tenantId), n = {
+				...e,
+				joinedAt: /* @__PURE__ */ new Date()
+			};
+			if (t >= 0) {
+				let e = s[t], r = {
+					...n,
+					joinedAt: e.joinedAt
+				};
+				return s[t] = r, r;
+			}
+			return s.push(n), n;
+		}),
+		membershipRole: (e, n) => t.sync(() => s.find((t) => t.userId === e && t.tenantId === n)?.role ?? null),
+		listSessions: (e) => t.sync(() => c.filter((t) => t.userId === e && t.rotatedAt == null).sort((e, t) => t.createdAt.getTime() - e.createdAt.getTime())),
+		insertSession: (e) => t.sync(() => {
+			let t = /* @__PURE__ */ new Date(), n = {
+				...e,
+				familyId: e.familyId ?? e.id,
+				rotatedAt: e.rotatedAt ?? null,
+				createdAt: t,
+				lastSeenAt: t
+			};
+			return c.push(n), n;
+		}),
+		findSession: (e) => t.sync(() => c.find((t) => t.id === e && t.rotatedAt == null) ?? null),
+		touchSession: (e, n) => t.sync(() => {
+			let t = c.findIndex((t) => t.id === e);
+			if (t >= 0 && c[t].rotatedAt == null) {
+				c[t] = {
+					...c[t],
+					expiresAt: n,
+					lastSeenAt: /* @__PURE__ */ new Date()
+				};
+				let r = c[t].familyId ?? e, i = c.findIndex((e) => e.id === r);
+				i >= 0 && c[i].expiresAt < n && (c[i] = {
+					...c[i],
+					expiresAt: n
+				});
+			}
+		}),
+		revokeSession: (e, n) => t.sync(() => {
+			let t = c.find((t) => t.id === n && t.userId === e);
+			if (!t) return !1;
+			let r = t.familyId ?? t.id, i = !1;
+			for (let t = c.length - 1; t >= 0; t--) {
+				let n = c[t];
+				n.userId === e && (n.familyId ?? n.id) === r && (c.splice(t, 1), i = !0);
+			}
+			return i;
+		}),
+		revokeAllOtherSessions: (e, n) => t.sync(() => {
+			let t = c.find((t) => t.id === n && t.userId === e), r = t ? t.familyId ?? t.id : void 0, i = 0;
+			for (let t = c.length - 1; t >= 0; t--) {
+				let n = c[t];
+				n.userId === e && (n.familyId ?? n.id) !== r && (c.splice(t, 1), n.rotatedAt ?? (i += 1));
+			}
+			return i;
+		}),
+		revokeAllSessions: (e) => t.sync(() => {
+			let t = 0;
+			for (let n = c.length - 1; n >= 0; n--) if (c[n].userId === e) {
+				let e = c[n];
+				c.splice(n, 1), e.rotatedAt ?? t++;
+			}
+			return t;
+		}),
+		insertToken: (e) => t.sync(() => {
+			let t = {
+				...e,
+				consumedAt: null,
+				createdAt: /* @__PURE__ */ new Date()
+			};
+			return l.push(t), t;
+		}),
+		consumeToken: (e, n) => t.sync(() => {
+			let t = Date.now(), r = l.find((r) => r.tokenHash === e && r.purpose === n && r.consumedAt === null && r.expiresAt.getTime() > t);
+			if (!r) return null;
+			let i = {
+				...r,
+				consumedAt: /* @__PURE__ */ new Date()
+			}, a = l.indexOf(r);
+			return l[a] = i, i;
+		}),
+		latestToken: (e, n) => t.sync(() => {
+			let t = null;
+			for (let r of l) r.userId === e && r.purpose === n && (t === null || r.createdAt.getTime() > t.createdAt.getTime()) && (t = r);
+			return t;
+		}),
+		insertInvitation: (e) => t.sync(() => {
+			let t = {
+				...e,
+				email: e.email.toLowerCase(),
+				acceptedAt: null,
+				acceptedByUserId: null,
+				revokedAt: null,
+				revokedByUserId: null,
+				createdAt: /* @__PURE__ */ new Date()
+			};
+			return f.push(t), t;
+		}),
+		findInvitationByHash: (e) => t.sync(() => f.find((t) => t.tokenHash === e) ?? null),
+		acceptInvitation: (e, n, r) => t.sync(() => {
+			let t = f.findIndex((t) => t.tokenHash === e && t.acceptedAt === null && t.revokedAt === null && t.expiresAt.getTime() > r.getTime());
+			if (t < 0) return null;
+			let i = {
+				...f[t],
+				acceptedAt: r,
+				acceptedByUserId: n
+			};
+			return f[t] = i, i;
+		}),
+		revokeInvitation: (e, n, r, i) => t.sync(() => {
+			let t = f.findIndex((t) => t.id === e && t.tenantId === n && t.acceptedAt === null && t.revokedAt === null);
+			return t < 0 ? !1 : (f[t] = {
+				...f[t],
+				revokedAt: i,
+				revokedByUserId: r
+			}, !0);
+		}),
+		listInvitations: (e) => t.sync(() => f.filter((t) => t.tenantId === e).sort((e, t) => t.createdAt.getTime() - e.createdAt.getTime())),
+		countPendingInvitations: (e, n) => t.sync(() => f.filter((t) => t.tenantId === e && t.acceptedAt === null && t.revokedAt === null && t.expiresAt.getTime() > n.getTime()).length),
+		supersedePendingInvitations: (e, n, r, i) => t.sync(() => {
+			let t = n.toLowerCase(), a = 0;
+			for (let n = 0; n < f.length; n++) {
+				let o = f[n];
+				o.tenantId === e && o.email === t && o.acceptedAt === null && o.revokedAt === null && (f[n] = {
+					...o,
+					revokedAt: i,
+					revokedByUserId: r
+				}, a++);
+			}
+			return a;
+		}),
+		insertImpersonationGrant: (e) => t.sync(() => {
+			let t = {
+				...e,
+				startedAt: /* @__PURE__ */ new Date(),
+				endedAt: null,
+				endedReason: null
+			};
+			return p.push(t), t;
+		}),
+		findImpersonationGrantBySession: (e) => t.sync(() => p.find((t) => t.sessionId === e) ?? null),
+		endImpersonationGrant: (e, n, r) => t.sync(() => {
+			let t = p.findIndex((t) => t.sessionId === e && t.endedAt === null);
+			return t < 0 ? !1 : (p[t] = {
+				...p[t],
+				endedAt: r,
+				endedReason: n
+			}, !0);
+		}),
+		replaceRecoveryCodes: (e, n) => t.sync(() => {
+			for (let t = d.length - 1; t >= 0; t--) d[t].userId === e && d.splice(t, 1);
+			let t = /* @__PURE__ */ new Date();
+			for (let r of n) d.push({
+				id: a("rc"),
+				userId: e,
+				codeHash: r,
+				consumedAt: null,
+				createdAt: t
+			});
+		}),
+		consumeRecoveryCode: (e, n) => t.sync(() => {
+			let t = d.findIndex((t) => t.userId === e && t.codeHash === n && t.consumedAt === null);
+			return t < 0 ? !1 : (d[t] = {
+				...d[t],
+				consumedAt: /* @__PURE__ */ new Date()
+			}, !0);
+		}),
+		countRecoveryCodes: (e) => t.sync(() => d.filter((t) => t.userId === e && t.consumedAt === null).length),
+		listPasskeys: (e) => t.sync(() => u.filter((t) => t.userId === e)),
+		findPasskey: (e) => t.sync(() => u.find((t) => t.credentialId === e) ?? null),
+		insertPasskey: (e) => t.sync(() => {
+			let t = /* @__PURE__ */ new Date(), n = {
+				...e,
+				createdAt: t,
+				lastUsedAt: null
+			};
+			return u.push(n), n;
+		}),
+		advancePasskeyCounter: (e, n) => t.sync(() => {
+			let t = u.findIndex((t) => t.credentialId === e);
+			return t < 0 || n <= u[t].counter ? !1 : (u[t] = {
+				...u[t],
+				counter: n,
+				lastUsedAt: /* @__PURE__ */ new Date()
+			}, !0);
+		}),
+		isLockedOut: (e, n) => t.sync(() => {
+			let t = m.get(e.toLowerCase());
+			return t?.lockedUntil != null && n < t.lockedUntil ? {
+				locked: !0,
+				retryAfterSeconds: Math.ceil((t.lockedUntil - n) / 1e3)
+			} : {
+				locked: !1,
+				retryAfterSeconds: 0
+			};
+		}),
+		recordLoginFailure: (e, n, r) => t.sync(() => {
+			let t = e.toLowerCase(), i = m.get(t), a = i?.windowStartedAt == null || n - i.windowStartedAt >= r.windowMs, o = i?.lockedUntil != null && n >= i.lockedUntil, s = !i || a || o, c = s ? 1 : i.failedCount + 1, l = s ? n : i.windowStartedAt, u = c >= r.maxAttempts ? n + r.lockMs : null;
+			m.set(t, {
+				failedCount: c,
+				windowStartedAt: l,
+				lockedUntil: u
+			});
+		}),
+		clearLoginFailures: (e) => t.sync(() => {
+			m.delete(e.toLowerCase());
+		})
+	};
+}, s = (e, t = {}) => {
+	let n = { ...t.metadata };
+	return t.memberships && (n.memberships = t.memberships.map((e) => ({
+		tenantId: e.tenantId,
+		role: e.role
+	}))), {
+		type: "user",
+		id: e.id,
+		tenantId: t.tenantId ?? e.tenantId,
+		...Object.keys(n).length > 0 ? { metadata: n } : {}
+	};
+}, c = (e) => {
+	if (e.type !== "user") return null;
+	let t = e.metadata?.sessionId;
+	return typeof t == "string" && t.length > 0 ? t : null;
+}, l = (e) => {
+	if (e.type !== "user") return [];
+	let t = e.metadata?.memberships;
+	return Array.isArray(t) ? t.filter((e) => typeof e == "object" && !!e && typeof e.tenantId == "string" && typeof e.role == "string") : [];
+};
+//#endregion
+export { r as UserAlreadyExistsError, i as UserNotFoundError, o as memoryUserStore, a as newAuthId, c as sessionIdOfSubject, s as subjectFromUser, l as subjectMemberships };

package/dist/web/passkeyClient.js

@@ -0,0 +1,78 @@
+//#region src/web/passkeyClient.ts
+var e = (e) => {
+	let t = new Uint8Array(e), n = "";
+	for (let e of t) n += String.fromCharCode(e);
+	return btoa(n).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}, t = (e) => {
+	let t = e.replace(/-/g, "+").replace(/_/g, "/") + "=".repeat((4 - e.length % 4) % 4), n = atob(t), r = new Uint8Array(n.length);
+	for (let e = 0; e < n.length; e++) r[e] = n.charCodeAt(e);
+	return r.buffer;
+}, n = () => typeof window < "u" && window.PublicKeyCredential !== void 0 && typeof navigator < "u" && !!navigator.credentials, r = async (e, t, n) => await (await (n.fetchImpl ?? fetch)(e, {
+	method: "POST",
+	credentials: "include",
+	headers: {
+		"content-type": "application/json",
+		...n.csrfToken ? { "x-csrf-token": n.csrfToken } : {}
+	},
+	body: JSON.stringify(t)
+})).json(), i = async (i, a = {}) => {
+	if (!n()) throw Error("passkeys not supported in this browser");
+	let o = a.basePath ?? "/auth", s = await r(`${o}/passkey/register/options`, i, a), c = s.challenge, l = s.rp, u = s.user, d = s.excludeCredentials ?? [], f = await navigator.credentials.create({ publicKey: {
+		challenge: t(c),
+		rp: l,
+		user: {
+			id: new TextEncoder().encode(u.id),
+			name: u.name,
+			displayName: u.displayName
+		},
+		pubKeyCredParams: [{
+			type: "public-key",
+			alg: -7
+		}, {
+			type: "public-key",
+			alg: -257
+		}],
+		excludeCredentials: d.map((e) => ({
+			type: "public-key",
+			id: t(e.id)
+		})),
+		authenticatorSelection: {
+			userVerification: "preferred",
+			residentKey: "preferred"
+		},
+		timeout: 3e5
+	} });
+	if (!f) throw Error("credential creation was cancelled");
+	let p = f.response, m = typeof p.getAuthenticatorData == "function" ? p.getAuthenticatorData() : /* @__PURE__ */ new ArrayBuffer(0), h = await r(`${o}/passkey/register/verify`, {
+		userId: i.userId,
+		credentialId: e(f.rawId),
+		clientDataJSON: e(p.clientDataJSON),
+		authenticatorData: e(m)
+	}, a);
+	if (!h.ok) throw Error(`passkey registration failed: ${String(h.error)}`);
+	return { credentialId: h.credentialId };
+}, a = async (i = {}, a = {}) => {
+	if (!n()) throw Error("passkeys not supported in this browser");
+	let o = a.basePath ?? "/auth", s = await r(`${o}/passkey/assert/options`, i.userId ? { userId: i.userId } : {}, a), c = s.challenge, l = s.rpId, u = s.allowCredentials ?? [], d = await navigator.credentials.get({ publicKey: {
+		challenge: t(c),
+		rpId: l,
+		allowCredentials: u.map((e) => ({
+			type: "public-key",
+			id: t(e.id)
+		})),
+		userVerification: "preferred",
+		timeout: 3e5
+	} });
+	if (!d) throw Error("assertion was cancelled");
+	let f = d.response, p = await r(`${o}/passkey/assert/verify`, {
+		credentialId: e(d.rawId),
+		clientDataJSON: e(f.clientDataJSON),
+		authenticatorData: e(f.authenticatorData),
+		signature: e(f.signature),
+		...i.userId ? { userId: i.userId } : {}
+	}, a);
+	if (!p.ok) throw Error(`passkey sign-in failed: ${String(p.error)}`);
+	return { subject: p.subject };
+};
+//#endregion
+export { n as isPasskeySupported, i as registerPasskey, a as signInWithPasskey };

package/dist/web/requireAuth.js

@@ -0,0 +1,9 @@
+import { useOptionalSubject as e } from "./subjectContext.js";
+import { Fragment as t, jsx as n } from "react/jsx-runtime";
+//#region src/web/requireAuth.tsx
+var r = ({ children: r, fallback: i }) => {
+	let a = e();
+	return a ? typeof r == "function" ? /* @__PURE__ */ n(t, { children: r(a) }) : /* @__PURE__ */ n(t, { children: r }) : /* @__PURE__ */ n(t, { children: i });
+};
+//#endregion
+export { r as RequireAuth };

package/dist/web/subjectContext.js

@@ -0,0 +1,13 @@
+import { createContext as e, useContext as t } from "react";
+import { jsx as n } from "react/jsx-runtime";
+//#region src/web/subjectContext.tsx
+var r = e(null), i = ({ subject: e, children: t }) => /* @__PURE__ */ n(r.Provider, {
+	value: e,
+	children: t
+}), a = () => {
+	let e = t(r);
+	if (!e) throw Error("useSubject() called without a signed-in user. Use useOptionalSubject() or wrap the consumer in <RequireAuth>.");
+	return e;
+}, o = () => t(r);
+//#endregion
+export { i as SubjectProvider, o as useOptionalSubject, a as useSubject };

package/dist/web.js

@@ -1,90 +1,4 @@
-import { createContext as e, useContext as t } from "react";
-import { Fragment as n, jsx as r } from "react/jsx-runtime";
-//#region src/web/subjectContext.tsx
-var i = e(null), a = ({ subject: e, children: t }) => /* @__PURE__ */ r(i.Provider, {
-	value: e,
-	children: t
-}), o = () => {
-	let e = t(i);
-	if (!e) throw Error("useSubject() called without a signed-in user. Use useOptionalSubject() or wrap the consumer in <RequireAuth>.");
-	return e;
-}, s = () => t(i), c = ({ children: e, fallback: t }) => {
-	let i = s();
-	return i ? typeof e == "function" ? /* @__PURE__ */ r(n, { children: e(i) }) : /* @__PURE__ */ r(n, { children: e }) : /* @__PURE__ */ r(n, { children: t });
-}, l = (e) => {
-	let t = new Uint8Array(e), n = "";
-	for (let e of t) n += String.fromCharCode(e);
-	return btoa(n).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-}, u = (e) => {
-	let t = e.replace(/-/g, "+").replace(/_/g, "/") + "=".repeat((4 - e.length % 4) % 4), n = atob(t), r = new Uint8Array(n.length);
-	for (let e = 0; e < n.length; e++) r[e] = n.charCodeAt(e);
-	return r.buffer;
-}, d = () => typeof window < "u" && window.PublicKeyCredential !== void 0 && typeof navigator < "u" && !!navigator.credentials, f = async (e, t, n) => await (await (n.fetchImpl ?? fetch)(e, {
-	method: "POST",
-	credentials: "include",
-	headers: {
-		"content-type": "application/json",
-		...n.csrfToken ? { "x-csrf-token": n.csrfToken } : {}
-	},
-	body: JSON.stringify(t)
-})).json(), p = async (e, t = {}) => {
-	if (!d()) throw Error("passkeys not supported in this browser");
-	let n = t.basePath ?? "/auth", r = await f(`${n}/passkey/register/options`, e, t), i = r.challenge, a = r.rp, o = r.user, s = r.excludeCredentials ?? [], c = await navigator.credentials.create({ publicKey: {
-		challenge: u(i),
-		rp: a,
-		user: {
-			id: new TextEncoder().encode(o.id),
-			name: o.name,
-			displayName: o.displayName
-		},
-		pubKeyCredParams: [{
-			type: "public-key",
-			alg: -7
-		}, {
-			type: "public-key",
-			alg: -257
-		}],
-		excludeCredentials: s.map((e) => ({
-			type: "public-key",
-			id: u(e.id)
-		})),
-		authenticatorSelection: {
-			userVerification: "preferred",
-			residentKey: "preferred"
-		},
-		timeout: 3e5
-	} });
-	if (!c) throw Error("credential creation was cancelled");
-	let p = c.response, m = typeof p.getAuthenticatorData == "function" ? p.getAuthenticatorData() : /* @__PURE__ */ new ArrayBuffer(0), h = await f(`${n}/passkey/register/verify`, {
-		userId: e.userId,
-		credentialId: l(c.rawId),
-		clientDataJSON: l(p.clientDataJSON),
-		authenticatorData: l(m)
-	}, t);
-	if (!h.ok) throw Error(`passkey registration failed: ${String(h.error)}`);
-	return { credentialId: h.credentialId };
-}, m = async (e = {}, t = {}) => {
-	if (!d()) throw Error("passkeys not supported in this browser");
-	let n = t.basePath ?? "/auth", r = await f(`${n}/passkey/assert/options`, e.userId ? { userId: e.userId } : {}, t), i = r.challenge, a = r.rpId, o = r.allowCredentials ?? [], s = await navigator.credentials.get({ publicKey: {
-		challenge: u(i),
-		rpId: a,
-		allowCredentials: o.map((e) => ({
-			type: "public-key",
-			id: u(e.id)
-		})),
-		userVerification: "preferred",
-		timeout: 3e5
-	} });
-	if (!s) throw Error("assertion was cancelled");
-	let c = s.response, p = await f(`${n}/passkey/assert/verify`, {
-		credentialId: l(s.rawId),
-		clientDataJSON: l(c.clientDataJSON),
-		authenticatorData: l(c.authenticatorData),
-		signature: l(c.signature),
-		...e.userId ? { userId: e.userId } : {}
-	}, t);
-	if (!p.ok) throw Error(`passkey sign-in failed: ${String(p.error)}`);
-	return { subject: p.subject };
-};
-//#endregion
-export { c as RequireAuth, a as SubjectProvider, d as isPasskeySupported, p as registerPasskey, m as signInWithPasskey, s as useOptionalSubject, o as useSubject };
+import { SubjectProvider as e, useOptionalSubject as t, useSubject as n } from "./web/subjectContext.js";
+import { RequireAuth as r } from "./web/requireAuth.js";
+import { isPasskeySupported as i, registerPasskey as a, signInWithPasskey as o } from "./web/passkeyClient.js";
+export { r as RequireAuth, e as SubjectProvider, i as isPasskeySupported, a as registerPasskey, o as signInWithPasskey, t as useOptionalSubject, n as useSubject };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voltro/plugin-auth",
-  "version": "0.84.0",
+  "version": "0.86.0",
   "description": "Authentication primitives: password hashing, session creation, schema mixin + tables. Pairs with the `auth` app template for the UI; both independently usable. Server-side only (uses node:crypto).",
   "keywords": [
     "voltro",
@@ -83,12 +83,11 @@
     "node": ">=24.0.0"
   },
   "dependencies": {
-    "@effect/sql": "^0.52.1",
-    "@voltro/database": "0.84.0",
-    "@voltro/protocol": "0.84.0"
+    "@voltro/database": "0.86.0",
+    "@voltro/protocol": "0.86.0"
   },
   "peerDependencies": {
-    "effect": "^3.22.2",
+    "effect": "4.0.1",
     "react": "^19.0.0"
   },
   "peerDependenciesMeta": {