@voltro/plugin-auth 0.85.0 → 0.86.0

package/dist/postgresUserStore.js

@@ -0,0 +1,463 @@
+import { UserAlreadyExistsError as e, UserNotFoundError as t, newAuthId as n } from "./userStore.js";
+import { Effect as r } from "effect";
+//#region src/postgresUserStore.ts
+var i = (e) => {
+	let t = e;
+	for (let e = 0; typeof t == "object" && t && e < 6; e++) {
+		let e = t.code;
+		if (typeof e == "string") return e;
+		let n = t;
+		t = n.reason ?? n.cause;
+	}
+}, a = (e) => {
+	let t = e?.columns ?? {};
+	return {
+		table: e?.table ?? "users",
+		col: {
+			id: t.id ?? "id",
+			email: t.email ?? "email",
+			tenantId: t.tenantId ?? "tenantId",
+			createdAt: t.createdAt ?? "createdAt",
+			passwordHash: t.passwordHash ?? "passwordHash",
+			updatedAt: t.updatedAt ?? "updatedAt",
+			mfaSecret: t.mfaSecret ?? "mfaSecret",
+			mfaEnrolledAt: t.mfaEnrolledAt ?? "mfaEnrolledAt",
+			emailVerifiedAt: t.emailVerifiedAt ?? "emailVerifiedAt",
+			deactivatedAt: t.deactivatedAt ?? !1
+		}
+	};
+}, o = (o, s = {}) => {
+	let c = a(s.identity), { col: l } = c, u = (e) => o`${o(l[e])}`, d = [
+		"id",
+		"email",
+		"passwordHash",
+		"tenantId",
+		"createdAt",
+		"mfaSecret",
+		"mfaEnrolledAt",
+		"emailVerifiedAt",
+		"deactivatedAt"
+	], f, p = () => f ??= {
+		usersTable: o.join(".", !1)(c.table.split(".").map((e) => o`${o(e)}`)),
+		selectList: o.csv(d.map((e) => l[e] === !1 ? o`NULL AS ${o(e)}` : o`${u(e)} AS ${o(e)}`))
+	}, m = (e, t) => /* @__PURE__ */ Error(`postgresUserStore: ${t} needs the "${e}" column, and identity.columns.${e} is false — this table has none`), h = (e) => l.updatedAt === !1 ? o`` : o`, ${u("updatedAt")} = ${e}`, g = (e) => ({
+		id: e.id,
+		email: e.email,
+		passwordHash: e.passwordHash,
+		tenantId: e.tenantId,
+		createdAt: e.createdAt,
+		mfaSecret: e.mfaSecret,
+		mfaEnrolledAt: e.mfaEnrolledAt,
+		emailVerifiedAt: e.emailVerifiedAt,
+		...l.deactivatedAt === !1 ? {} : { deactivatedAt: e.deactivatedAt ?? null }
+	}), _ = (e) => r.gen(function* () {
+		let t = yield* o`
+        SELECT ${p().selectList} FROM ${p().usersTable}
+        WHERE ${u("email")} = ${e.toLowerCase()}
+        LIMIT 1
+      `;
+		return t[0] ? g(t[0]) : null;
+	}).pipe(r.orElseSucceed(() => null)), v = (e) => r.gen(function* () {
+		let t = yield* o`
+        SELECT ${p().selectList} FROM ${p().usersTable}
+        WHERE ${u("id")} = ${e}
+        LIMIT 1
+      `;
+		return t[0] ? g(t[0]) : null;
+	}).pipe(r.orElseSucceed(() => null)), ee = (t) => r.gen(function* () {
+		let n = t.email.toLowerCase(), a = /* @__PURE__ */ new Date(), s = [
+			u("id"),
+			u("email"),
+			u("tenantId"),
+			u("createdAt")
+		], c = [
+			t.id,
+			n,
+			t.tenantId,
+			a
+		];
+		return l.passwordHash !== !1 && (s.push(u("passwordHash")), c.push(t.passwordHash ?? null)), l.updatedAt !== !1 && (s.push(u("updatedAt")), c.push(a)), yield* o`
+        INSERT INTO ${p().usersTable} (${o.csv(s)})
+        VALUES ${o.in(c)}
+      `.pipe(r.map(() => ({
+			...t,
+			email: n,
+			createdAt: a
+		})), r.catch((t) => i(t) === "23505" ? r.fail(new e({ email: n })) : r.die(t)));
+	}), y = (e) => r.gen(function* () {
+		let n = (yield* o`
+        SELECT ${p().selectList} FROM ${p().usersTable} WHERE ${u("id")} = ${e} LIMIT 1
+      `)[0];
+		return n ? g(n) : yield* r.fail(new t({ userId: e }));
+	}).pipe(r.catchTag("SqlError", (e) => r.die(e))), b = (e, t) => r.gen(function* () {
+		return l.passwordHash === !1 ? yield* r.die(m("passwordHash", "updatePassword")) : (yield* o`
+        UPDATE ${p().usersTable} SET ${u("passwordHash")} = ${t}${h(/* @__PURE__ */ new Date())}
+         WHERE ${u("id")} = ${e}
+      `.pipe(r.catchTag("SqlError", (e) => r.die(e))), yield* y(e));
+	}), x = (e, t) => r.gen(function* () {
+		return l.mfaSecret === !1 ? yield* r.die(m("mfaSecret", "setMfaSecret")) : l.mfaEnrolledAt === !1 ? yield* r.die(m("mfaEnrolledAt", "setMfaSecret")) : (yield* o`
+        UPDATE ${p().usersTable}
+           SET ${u("mfaSecret")} = ${t}, ${u("mfaEnrolledAt")} = ${null}
+         WHERE ${u("id")} = ${e}
+      `.pipe(r.catchTag("SqlError", (e) => r.die(e))), yield* y(e));
+	}), S = (e) => r.gen(function* () {
+		return l.mfaEnrolledAt === !1 ? yield* r.die(m("mfaEnrolledAt", "markMfaEnrolled")) : (yield* o`
+        UPDATE ${p().usersTable}
+           SET ${u("mfaEnrolledAt")} = ${/* @__PURE__ */ new Date()}
+         WHERE ${u("id")} = ${e}
+      `.pipe(r.catchTag("SqlError", (e) => r.die(e))), yield* y(e));
+	}), C = (e) => r.gen(function* () {
+		return l.mfaSecret === !1 ? yield* r.die(m("mfaSecret", "clearMfa")) : l.mfaEnrolledAt === !1 ? yield* r.die(m("mfaEnrolledAt", "clearMfa")) : (yield* o`
+        UPDATE ${p().usersTable}
+           SET ${u("mfaSecret")} = ${null}, ${u("mfaEnrolledAt")} = ${null}
+         WHERE ${u("id")} = ${e}
+      `.pipe(r.catchTag("SqlError", (e) => r.die(e))), yield* y(e));
+	}), w = (e) => r.gen(function* () {
+		return l.emailVerifiedAt === !1 ? yield* r.die(m("emailVerifiedAt", "markEmailVerified")) : (yield* o`
+        UPDATE ${p().usersTable}
+           SET ${u("emailVerifiedAt")} = ${/* @__PURE__ */ new Date()}${h(/* @__PURE__ */ new Date())}
+         WHERE ${u("id")} = ${e} AND ${u("emailVerifiedAt")} IS NULL
+      `.pipe(r.catchTag("SqlError", (e) => r.die(e))), yield* y(e));
+	}), T = (e) => r.gen(function* () {
+		return (yield* o`
+        SELECT "userId", "tenantId", role, "joinedAt"
+          FROM memberships WHERE "userId" = ${e}
+          ORDER BY "joinedAt" ASC
+      `).map((e) => ({ ...e }));
+	}).pipe(r.orElseSucceed(() => [])), E = (e) => r.gen(function* () {
+		let t = /* @__PURE__ */ new Date();
+		yield* o`
+        UPDATE memberships SET role = ${e.role}
+         WHERE "userId" = ${e.userId} AND "tenantId" = ${e.tenantId}
+      `;
+		let r = yield* o`
+        SELECT "userId", "tenantId", role, "joinedAt"
+          FROM memberships
+         WHERE "userId" = ${e.userId} AND "tenantId" = ${e.tenantId}
+         LIMIT 1
+      `;
+		return r[0] ? { ...r[0] } : (yield* o`
+        INSERT INTO memberships (id, "userId", "tenantId", role, "joinedAt")
+        VALUES (${n("mem")}, ${e.userId}, ${e.tenantId}, ${e.role}, ${t})
+      `, {
+			...e,
+			joinedAt: t
+		});
+	}).pipe(r.catch(() => r.succeed({
+		...e,
+		joinedAt: /* @__PURE__ */ new Date()
+	}))), D = (e, t) => r.gen(function* () {
+		return (yield* o`
+        SELECT role FROM memberships
+         WHERE "userId" = ${e} AND "tenantId" = ${t} LIMIT 1
+      `)[0]?.role ?? null;
+	}).pipe(r.orElseSucceed(() => null)), O = (e) => r.gen(function* () {
+		return (yield* o`
+        SELECT id, "userId", "tenantId", "expiresAt", "ipAddress", "userAgent", "createdAt", "lastSeenAt", "familyId", "rotatedAt"
+          FROM sessions WHERE "userId" = ${e} AND "rotatedAt" IS NULL
+          ORDER BY "createdAt" DESC
+      `).map((e) => ({ ...e }));
+	}).pipe(r.orElseSucceed(() => [])), k = (e) => r.gen(function* () {
+		let t = /* @__PURE__ */ new Date();
+		return yield* o`
+        INSERT INTO sessions (id, "userId", "tenantId", "expiresAt", "ipAddress", "userAgent", "createdAt", "lastSeenAt", "familyId", "rotatedAt")
+        VALUES (
+          ${e.id}, ${e.userId}, ${e.tenantId}, ${e.expiresAt},
+          ${e.ipAddress ?? null}, ${e.userAgent ?? null}, ${t}, ${t}, ${e.familyId ?? e.id}, ${e.rotatedAt ?? null}
+        )
+      `, {
+			...e,
+			familyId: e.familyId ?? e.id,
+			rotatedAt: e.rotatedAt ?? null,
+			createdAt: t,
+			lastSeenAt: t
+		};
+	}).pipe(r.orDie), A = (e) => r.gen(function* () {
+		let t = yield* o`
+        SELECT id, "userId", "tenantId", "expiresAt", "ipAddress", "userAgent", "createdAt", "lastSeenAt", "familyId", "rotatedAt"
+          FROM sessions WHERE id = ${e} AND "rotatedAt" IS NULL LIMIT 1
+      `;
+		return t[0] ? { ...t[0] } : null;
+	}).pipe(r.orElseSucceed(() => null)), j = (e, t) => o.withTransaction(r.gen(function* () {
+		let n = (yield* o`SELECT COALESCE("familyId", id) AS family, "userId" FROM sessions WHERE id = ${e}`)[0];
+		n && (yield* o`SELECT id FROM sessions WHERE id = ${n.family} AND "userId" = ${n.userId} FOR UPDATE`).length && (yield* o`UPDATE sessions SET "expiresAt" = ${t}, "lastSeenAt" = ${/* @__PURE__ */ new Date()} WHERE id = ${e} AND "userId" = ${n.userId} AND "rotatedAt" IS NULL RETURNING id`).length && (yield* o`UPDATE sessions SET "expiresAt" = GREATEST("expiresAt", ${t}) WHERE id = ${n.family} AND "userId" = ${n.userId}`);
+	})).pipe(r.asVoid, r.orDie), M = (e, t) => o.withTransaction(r.gen(function* () {
+		let n = (yield* o`SELECT COALESCE("familyId", id) AS family FROM sessions WHERE id = ${t} AND "userId" = ${e}`)[0]?.family;
+		return !n || !(yield* o`SELECT id FROM sessions WHERE id = ${n} AND "userId" = ${e} FOR UPDATE`).length ? !1 : (yield* o`DELETE FROM sessions WHERE "userId" = ${e} AND COALESCE("familyId", id) = ${n} RETURNING id`).length > 0;
+	})).pipe(r.orDie), N = (e, t) => o.withTransaction(r.gen(function* () {
+		let n = (yield* o`SELECT COALESCE("familyId", id) AS family FROM sessions WHERE id = ${t} AND "userId" = ${e}`)[0]?.family ?? "";
+		return yield* o`SELECT id FROM sessions WHERE "userId" = ${e} AND id = COALESCE("familyId", id) AND id <> ${n} ORDER BY id FOR UPDATE`, (yield* o`DELETE FROM sessions WHERE "userId" = ${e} AND COALESCE("familyId", id) <> ${n} RETURNING "rotatedAt"`).filter((e) => e.rotatedAt === null).length;
+	})).pipe(r.orDie), P = (e) => o.withTransaction(r.gen(function* () {
+		return yield* o`SELECT id FROM sessions WHERE "userId" = ${e} AND id = COALESCE("familyId", id) ORDER BY id FOR UPDATE`, (yield* o`DELETE FROM sessions WHERE "userId" = ${e} RETURNING "rotatedAt"`).filter((e) => e.rotatedAt === null).length;
+	})).pipe(r.orDie), te = (e) => r.gen(function* () {
+		let t = /* @__PURE__ */ new Date();
+		return yield* o`
+        INSERT INTO "authTokens" (id, "tokenHash", "userId", purpose, "expiresAt", "consumedAt", "createdAt")
+        VALUES (${e.id}, ${e.tokenHash}, ${e.userId}, ${e.purpose}, ${e.expiresAt}, ${null}, ${t})
+      `, {
+			...e,
+			consumedAt: null,
+			createdAt: t
+		};
+	}).pipe(r.catch(() => r.succeed({
+		...e,
+		consumedAt: null,
+		createdAt: /* @__PURE__ */ new Date()
+	}))), F = (e, t) => r.gen(function* () {
+		let n = yield* o`
+        UPDATE "authTokens"
+           SET "consumedAt" = ${/* @__PURE__ */ new Date()}
+         WHERE "tokenHash" = ${e}
+           AND purpose = ${t}
+           AND "consumedAt" IS NULL
+           AND "expiresAt" > ${/* @__PURE__ */ new Date()}
+        RETURNING id, "tokenHash", "userId", purpose, "expiresAt", "consumedAt", "createdAt"
+      `;
+		return n[0] ? { ...n[0] } : null;
+	}).pipe(r.orElseSucceed(() => null)), I = (e, t) => r.gen(function* () {
+		let n = yield* o`
+        SELECT id, "tokenHash", "userId", purpose, "expiresAt", "consumedAt", "createdAt"
+          FROM "authTokens"
+         WHERE "userId" = ${e} AND purpose = ${t}
+         ORDER BY "createdAt" DESC
+         LIMIT 1
+      `;
+		return n[0] ? { ...n[0] } : null;
+	}).pipe(r.orElseSucceed(() => null)), L = (e) => r.gen(function* () {
+		let t = /* @__PURE__ */ new Date(), n = e.email.toLowerCase();
+		return yield* o`
+        INSERT INTO invitations (
+          id, "tokenHash", email, "tenantId", role, "invitedByUserId",
+          "expiresAt", "acceptedAt", "acceptedByUserId", "revokedAt", "revokedByUserId", "createdAt"
+        ) VALUES (
+          ${e.id}, ${e.tokenHash}, ${n}, ${e.tenantId},
+          ${e.role}, ${e.invitedByUserId}, ${e.expiresAt},
+          ${null}, ${null}, ${null}, ${null}, ${t}
+        )
+      `, {
+			...e,
+			email: n,
+			acceptedAt: null,
+			acceptedByUserId: null,
+			revokedAt: null,
+			revokedByUserId: null,
+			createdAt: t
+		};
+	}).pipe(r.catch((e) => r.die(e))), R = (e) => r.gen(function* () {
+		let t = yield* o`
+        SELECT id, "tokenHash", email, "tenantId", role, "invitedByUserId", "expiresAt",
+               "acceptedAt", "acceptedByUserId", "revokedAt", "revokedByUserId", "createdAt"
+          FROM invitations WHERE "tokenHash" = ${e} LIMIT 1
+      `;
+		return t[0] ? { ...t[0] } : null;
+	}).pipe(r.orElseSucceed(() => null)), z = (e, t, n) => r.gen(function* () {
+		let r = yield* o`
+        UPDATE invitations
+           SET "acceptedAt" = ${n}, "acceptedByUserId" = ${t}
+         WHERE "tokenHash" = ${e}
+           AND "acceptedAt" IS NULL
+           AND "revokedAt" IS NULL
+           AND "expiresAt" > ${n}
+        RETURNING id, "tokenHash", email, "tenantId", role, "invitedByUserId", "expiresAt",
+                  "acceptedAt", "acceptedByUserId", "revokedAt", "revokedByUserId", "createdAt"
+      `;
+		return r[0] ? { ...r[0] } : null;
+	}).pipe(r.catch((e) => r.die(e))), B = (e, t, n, i) => r.gen(function* () {
+		return (yield* o`
+        UPDATE invitations
+           SET "revokedAt" = ${i}, "revokedByUserId" = ${n}
+         WHERE id = ${e}
+           AND "tenantId" = ${t}
+           AND "acceptedAt" IS NULL
+           AND "revokedAt" IS NULL
+        RETURNING id
+      `).length > 0;
+	}).pipe(r.catch((e) => r.die(e))), V = (e) => r.gen(function* () {
+		return (yield* o`
+        SELECT id, "tokenHash", email, "tenantId", role, "invitedByUserId", "expiresAt",
+               "acceptedAt", "acceptedByUserId", "revokedAt", "revokedByUserId", "createdAt"
+          FROM invitations WHERE "tenantId" = ${e}
+          ORDER BY "createdAt" DESC
+      `).map((e) => ({ ...e }));
+	}).pipe(r.orElseSucceed(() => [])), H = (e, t) => r.gen(function* () {
+		return (yield* o`
+        SELECT COUNT(*)::int AS n FROM invitations
+         WHERE "tenantId" = ${e}
+           AND "acceptedAt" IS NULL AND "revokedAt" IS NULL AND "expiresAt" > ${t}
+      `)[0]?.n ?? 0;
+	}).pipe(r.catch((e) => r.die(e))), U = (e, t, n, i) => r.gen(function* () {
+		return (yield* o`
+        UPDATE invitations
+           SET "revokedAt" = ${i}, "revokedByUserId" = ${n}
+         WHERE "tenantId" = ${e}
+           AND email = ${t.toLowerCase()}
+           AND "acceptedAt" IS NULL
+           AND "revokedAt" IS NULL
+        RETURNING id
+      `).length;
+	}).pipe(r.catch((e) => r.die(e))), W = (e) => r.gen(function* () {
+		let t = /* @__PURE__ */ new Date();
+		return yield* o`
+        INSERT INTO "impersonationGrants" (
+          id, "sessionId", "actorUserId", "actorSessionId", "targetUserId", "tenantId",
+          reason, "startedAt", "expiresAt", "endedAt", "endedReason", "ipAddress", "userAgent"
+        ) VALUES (
+          ${e.id}, ${e.sessionId}, ${e.actorUserId}, ${e.actorSessionId},
+          ${e.targetUserId}, ${e.tenantId}, ${e.reason ?? null}, ${t},
+          ${e.expiresAt}, ${null}, ${null}, ${e.ipAddress ?? null}, ${e.userAgent ?? null}
+        )
+      `, {
+			...e,
+			startedAt: t,
+			endedAt: null,
+			endedReason: null
+		};
+	}).pipe(r.catch((e) => r.die(e))), G = (e) => r.gen(function* () {
+		let t = yield* o`
+        SELECT id, "sessionId", "actorUserId", "actorSessionId", "targetUserId", "tenantId",
+               reason, "startedAt", "expiresAt", "endedAt", "endedReason", "ipAddress", "userAgent"
+          FROM "impersonationGrants" WHERE "sessionId" = ${e} LIMIT 1
+      `;
+		return t[0] ? { ...t[0] } : null;
+	}).pipe(r.orElseSucceed(() => null)), K = (e, t, n) => r.gen(function* () {
+		return (yield* o`
+        UPDATE "impersonationGrants"
+           SET "endedAt" = ${n}, "endedReason" = ${t}
+         WHERE "sessionId" = ${e} AND "endedAt" IS NULL
+        RETURNING id
+      `).length > 0;
+	}).pipe(r.catch((e) => r.die(e))), q = (e) => r.gen(function* () {
+		return (yield* o`
+        SELECT id, "credentialId", "userId", "publicKey", counter, transports, "createdAt", "lastUsedAt"
+          FROM passkeys WHERE "userId" = ${e}
+      `).map((e) => ({ ...e }));
+	}).pipe(r.orElseSucceed(() => [])), J = (e) => r.gen(function* () {
+		let t = yield* o`
+        SELECT id, "credentialId", "userId", "publicKey", counter, transports, "createdAt", "lastUsedAt"
+          FROM passkeys WHERE "credentialId" = ${e} LIMIT 1
+      `;
+		return t[0] ? { ...t[0] } : null;
+	}).pipe(r.orElseSucceed(() => null)), Y = (e) => r.gen(function* () {
+		let t = /* @__PURE__ */ new Date();
+		return yield* o`
+        INSERT INTO passkeys (id, "credentialId", "userId", "publicKey", counter, transports, "createdAt", "lastUsedAt")
+        VALUES (
+          ${e.id}, ${e.credentialId}, ${e.userId}, ${e.publicKey},
+          ${e.counter}, ${e.transports ?? null}, ${t}, ${null}
+        )
+      `, {
+			...e,
+			createdAt: t,
+			lastUsedAt: null
+		};
+	}).pipe(r.catch(() => r.succeed({
+		...e,
+		createdAt: /* @__PURE__ */ new Date(),
+		lastUsedAt: null
+	}))), X = (e, t) => r.gen(function* () {
+		return (yield* o`
+        UPDATE passkeys
+           SET counter = ${t}, "lastUsedAt" = ${/* @__PURE__ */ new Date()}
+         WHERE "credentialId" = ${e}
+           AND counter < ${t}
+        RETURNING id
+      `).length > 0;
+	}).pipe(r.orElseSucceed(() => !1)), Z = (e, t) => r.gen(function* () {
+		let r = /* @__PURE__ */ new Date();
+		yield* o`DELETE FROM "recoveryCodes" WHERE "userId" = ${e}`;
+		for (let i of t) yield* o`
+          INSERT INTO "recoveryCodes" (id, "userId", "codeHash", "consumedAt", "createdAt")
+          VALUES (${n("rc")}, ${e}, ${i}, ${null}, ${r})
+        `;
+	}).pipe(r.asVoid, r.orElseSucceed(() => void 0)), Q = (e, t) => r.gen(function* () {
+		return (yield* o`
+        UPDATE "recoveryCodes"
+           SET "consumedAt" = ${/* @__PURE__ */ new Date()}
+         WHERE "userId" = ${e}
+           AND "codeHash" = ${t}
+           AND "consumedAt" IS NULL
+        RETURNING id
+      `).length > 0;
+	}).pipe(r.orElseSucceed(() => !1)), ne = (e) => r.gen(function* () {
+		return (yield* o`
+        SELECT COUNT(*)::int AS n FROM "recoveryCodes"
+         WHERE "userId" = ${e} AND "consumedAt" IS NULL
+      `)[0]?.n ?? 0;
+	}).pipe(r.orElseSucceed(() => 0)), $ = (e, t) => r.catch((n) => r.logWarning(`[auth] lockout ${e} failed — brute-force protection is not counting`).pipe(r.annotateLogs("cause", String(n)), r.as(t)));
+	return {
+		findByEmail: _,
+		findById: v,
+		insert: ee,
+		updatePassword: b,
+		setMfaSecret: x,
+		markMfaEnrolled: S,
+		clearMfa: C,
+		markEmailVerified: w,
+		listMemberships: T,
+		addMembership: E,
+		membershipRole: D,
+		listSessions: O,
+		insertSession: k,
+		findSession: A,
+		touchSession: j,
+		revokeSession: M,
+		revokeAllOtherSessions: N,
+		revokeAllSessions: P,
+		insertToken: te,
+		consumeToken: F,
+		latestToken: I,
+		insertInvitation: L,
+		findInvitationByHash: R,
+		acceptInvitation: z,
+		revokeInvitation: B,
+		listInvitations: V,
+		countPendingInvitations: H,
+		supersedePendingInvitations: U,
+		insertImpersonationGrant: W,
+		findImpersonationGrantBySession: G,
+		endImpersonationGrant: K,
+		replaceRecoveryCodes: Z,
+		consumeRecoveryCode: Q,
+		countRecoveryCodes: ne,
+		listPasskeys: q,
+		findPasskey: J,
+		insertPasskey: Y,
+		advancePasskeyCounter: X,
+		isLockedOut: (e, t) => r.gen(function* () {
+			let n = (yield* o`
+        SELECT "lockedUntil" FROM "loginAttempts"
+         WHERE email = ${e.toLowerCase()} LIMIT 1
+      `)[0]?.lockedUntil ?? null;
+			return n != null && t < n.getTime() ? {
+				locked: !0,
+				retryAfterSeconds: Math.ceil((n.getTime() - t) / 1e3)
+			} : {
+				locked: !1,
+				retryAfterSeconds: 0
+			};
+		}).pipe($("read", {
+			locked: !1,
+			retryAfterSeconds: 0
+		})),
+		recordLoginFailure: (e, t, i) => r.gen(function* () {
+			let r = e.toLowerCase(), a = (yield* o`
+        SELECT "failedCount", "windowStartedAt", "lockedUntil"
+          FROM "loginAttempts" WHERE email = ${r} LIMIT 1
+      `)[0], s = a?.windowStartedAt?.getTime() ?? null, c = a?.lockedUntil?.getTime() ?? null, l = s == null || t - s >= i.windowMs, u = !a || l || c != null && t >= c, d = u ? 1 : a.failedCount + 1, f = u ? new Date(t) : new Date(s), p = d >= i.maxAttempts ? new Date(t + i.lockMs) : null, m = new Date(t);
+			yield* o`
+        INSERT INTO "loginAttempts" (id, email, "failedCount", "windowStartedAt", "lockedUntil", "createdAt", "updatedAt")
+        VALUES (${n("la")}, ${r}, ${d}, ${f}, ${p}, ${m}, ${m})
+        ON CONFLICT (email) DO UPDATE SET
+          "failedCount" = ${d},
+          "windowStartedAt" = ${f},
+          "lockedUntil" = ${p},
+          "updatedAt" = ${m}
+      `;
+		}).pipe(r.asVoid, $("record", void 0)),
+		clearLoginFailures: (e) => r.gen(function* () {
+			yield* o`DELETE FROM "loginAttempts" WHERE email = ${e.toLowerCase()}`;
+		}).pipe(r.asVoid, $("clear", void 0))
+	};
+};
+//#endregion
+export { o as postgresUserStore };

package/dist/revocation.js

@@ -0,0 +1,33 @@
+import { Effect as e } from "effect";
+//#region src/revocation.ts
+var t = 3e4, n = 1e4, r = (r, i = {}) => {
+	let a = i.ttlMs ?? t, o = i.maxEntries ?? n, s = i.now ?? Date.now, c = /* @__PURE__ */ new Map(), l = () => {
+		if (c.size <= o) return;
+		let e = s();
+		for (let [t, n] of c) n.freshUntil <= e && c.delete(t);
+		for (let e of c.keys()) {
+			if (c.size <= o) break;
+			c.delete(e);
+		}
+	}, u = (e) => e !== null && e.expiresAt.getTime() > s();
+	return {
+		ttlMs: a,
+		invalidate: (e) => {
+			c.delete(e);
+		},
+		isLive: (t) => e.gen(function* () {
+			let e = s();
+			if (a > 0) {
+				let n = c.get(t);
+				if (n && n.freshUntil > e) return n.live;
+			}
+			let n = yield* r.findSession(t), i = u(n);
+			return a > 0 && (c.set(t, {
+				live: i,
+				freshUntil: e + a
+			}), l()), i;
+		})
+	};
+};
+//#endregion
+export { r as makeSessionRevocationChecker };

package/dist/schema.d.ts

@@ -108,11 +108,10 @@ export declare const passkeysTable: TableLike;
 export declare const recoveryCodesTable: TableLike;
 
 /**
- * Sessions table. Active sessions enumerated server-side so apps can
- * implement "sign out other devices" + server-side revocation.
- * `handleSignIn` / `handleSignOut` do NOT write here (cookies are
- * self-describing HMAC-signed); apps that need device management
- * wire that up themselves.
+ * Sessions table used by the auth handlers and custom registered sessions.
+ * Rotation retains inactive aliases in a device family so sign-out using an
+ * earlier cookie also revokes its current successor. Only unrotated rows
+ * authenticate or appear in device lists.
  */
 export declare const sessionsTable: TableLike;
 

package/dist/schema.js

@@ -12,6 +12,8 @@ var a = n("users", {
 	updatedAt: i().default("now").onUpdate("now")
 }).index(["tenantId"]), o = n("sessions", {
 	id: e(),
+	familyId: r().nullable(),
+	rotatedAt: i().nullable(),
 	userId: r(),
 	tenantId: r(),
 	expiresAt: i(),
@@ -19,7 +21,7 @@ var a = n("users", {
 	userAgent: r().nullable(),
 	createdAt: i().default("now"),
 	lastSeenAt: i().default("now").onUpdate("now")
-}).index(["userId"]).index(["tenantId"]), s = n("memberships", {
+}).index(["userId"]).index(["tenantId"]).index(["familyId"]), s = n("memberships", {
 	id: e(),
 	userId: r(),
 	tenantId: r(),

package/dist/sessionRegistry.js

@@ -0,0 +1,118 @@
+import { issueSession as e } from "./session.js";
+import { newAuthId as t } from "./userStore.js";
+import { Effect as n } from "effect";
+import { eq as r } from "@voltro/database";
+//#region src/sessionRegistry.ts
+var i = "sessions", a = 604800, o = (e) => ({
+	...e,
+	expiresAt: new Date(e.expiresAt),
+	createdAt: new Date(e.createdAt),
+	lastSeenAt: new Date(e.lastSeenAt),
+	rotatedAt: e.rotatedAt == null ? null : new Date(e.rotatedAt)
+}), s = async (e, t, n = !1) => await e.query({
+	table: i,
+	predicate: t,
+	order: [],
+	take: void 0,
+	skip: void 0,
+	projection: void 0,
+	...n ? { lock: "update" } : {}
+}), c = (e, t, n) => t.transaction === "existing" ? n(e) : e.transactional((e) => n(e)), l = (e) => e.familyId ?? e.id, u = (e) => e.rotatedAt == null, d = async (e, t, n) => {
+	let i = (await s(e, r("id", n)))[0];
+	if (!i || i.userId !== t) return null;
+	let a = l(i), o = (await s(e, r("id", a), !0))[0];
+	if (!o || o.userId !== t || l(o) !== a) return null;
+	let c = (await s(e, r("userId", t))).filter((e) => l(e) === a), u = c.find((e) => e.id === n);
+	return u ? {
+		root: o,
+		current: u,
+		rows: c
+	} : null;
+}, f = async (e, t, n) => {
+	let r = await d(e, t, n);
+	if (!r) return {
+		removed: !1,
+		credentials: 0
+	};
+	let a = 0, o = !1;
+	for (let t of r.rows) await e.delete(i, t.id) && (o = !0, u(t) && (a += 1));
+	return {
+		removed: o,
+		credentials: a
+	};
+}, p = (e, t = {}) => ({
+	listSessions: (t) => n.promise(async () => (await s(e, r("userId", t))).filter(u).map(o).sort((e, t) => t.createdAt.getTime() - e.createdAt.getTime())),
+	insertSession: (t) => n.promise(async () => {
+		let n = /* @__PURE__ */ new Date(), r = {
+			...t,
+			familyId: t.familyId ?? t.id,
+			rotatedAt: t.rotatedAt ?? null,
+			createdAt: n,
+			lastSeenAt: n
+		};
+		return await e.insert(i, r), r;
+	}),
+	findSession: (t) => n.promise(async () => {
+		let n = (await s(e, r("id", t)))[0];
+		return n && u(n) ? o(n) : null;
+	}),
+	touchSession: (a, o) => n.promise(() => c(e, t, async (e) => {
+		let t = (await s(e, r("id", a)))[0];
+		if (!t) return;
+		let n = await d(e, t.userId, a);
+		n && u(n.current) && (await e.update(i, a, {
+			expiresAt: o,
+			lastSeenAt: /* @__PURE__ */ new Date()
+		}), n.root.id !== a && new Date(n.root.expiresAt) < o && await e.update(i, n.root.id, { expiresAt: o }));
+	})),
+	revokeSession: (r, i) => n.promise(() => c(e, t, async (e) => (await f(e, r, i)).removed)),
+	revokeAllOtherSessions: (i, a) => n.promise(() => c(e, t, async (e) => {
+		let t = await s(e, r("userId", i)), n = t.find((e) => e.id === a), o = n ? l(n) : void 0, c = [...new Set(t.map(l))].filter((e) => e !== o).sort(), u = 0;
+		for (let t of c) u += (await f(e, i, t)).credentials;
+		return u;
+	})),
+	revokeAllSessions: (i) => n.promise(() => c(e, t, async (e) => {
+		let t = [...new Set((await s(e, r("userId", i))).map(l))].sort(), n = 0;
+		for (let r of t) n += (await f(e, i, r)).credentials;
+		return n;
+	}))
+}), m = (e, t) => e.type === "user" ? {
+	...e,
+	metadata: {
+		...e.metadata ?? {},
+		sessionId: t
+	}
+} : e, h = async (r, i, o, s, c) => {
+	if (i.type !== "user") throw Error("issueRegisteredSession: only a user subject has a session row");
+	let l = t("sess"), u = s.ttlSeconds ?? a, d = (s.now ?? Date.now)();
+	await n.runPromise(r.insertSession({
+		id: l,
+		familyId: c ?? l,
+		rotatedAt: null,
+		userId: i.id,
+		tenantId: i.tenantId ?? "",
+		expiresAt: new Date(d + u * 1e3),
+		ipAddress: s.ipAddress ?? null,
+		userAgent: s.userAgent ?? null
+	}));
+	let { ipAddress: f, userAgent: p, ...h } = s;
+	return {
+		...e(m(i, l), o, h),
+		sessionId: l
+	};
+}, g = async (e, t, n, r = {}) => h(e, t, n, r), _ = async (e, t, n, r, o = {}) => t.type === "user" ? c(e, o, async (e) => {
+	let s = await d(e, t.id, n), c = (o.now ?? Date.now)();
+	if (!s || !u(s.current) || new Date(s.current.expiresAt).getTime() <= c) return null;
+	let l = new Date(c + (o.ttlSeconds ?? a) * 1e3);
+	await e.update(i, s.current.id, {
+		familyId: s.root.id,
+		rotatedAt: new Date(c)
+	}), await e.update(i, s.root.id, {
+		familyId: s.root.id,
+		expiresAt: new Date(Math.max(new Date(s.root.expiresAt).getTime(), l.getTime()))
+	});
+	let { transaction: f, ...m } = o;
+	return h(p(e, { transaction: "existing" }), t, r, m, s.root.id);
+}) : null;
+//#endregion
+export { p as dataStoreSessionRegistry, g as issueRegisteredSession, _ as rotateRegisteredSession, m as withSessionId };

package/dist/strategy.d.ts

@@ -224,6 +224,10 @@ declare interface PasskeyStore {
 /** A server-side session row — enumerated so apps can list active
  *  devices + revoke them. Written on sign-in; deleted on revoke. */
 declare interface SessionRecord {
+    /** Stable device lineage. The original row is its transaction lock anchor. */
+    readonly familyId?: string | null;
+    /** A replaced credential remains an inert revocation alias until the device ends. */
+    readonly rotatedAt?: Date | null;
     readonly id: string;
     readonly userId: string;
     readonly tenantId: string;