@voltro/plugin-auth 0.85.0 → 0.87.0

package/dist/postgresUserStore.js

@@ -0,0 +1,475 @@
+import { UserAlreadyExistsError as e, UserNotFoundError as t, newAuthId as n } from "./userStore.js";
+import { Effect as r } from "effect";
+//#region src/postgresUserStore.ts
+var i = (e) => {
+	let t = e;
+	for (let e = 0; typeof t == "object" && t && e < 6; e++) {
+		let e = t.code;
+		if (typeof e == "string") return e;
+		let n = t;
+		t = n.reason ?? n.cause;
+	}
+}, a = (e) => {
+	let t = e?.columns ?? {};
+	return {
+		table: e?.table ?? "users",
+		col: {
+			id: t.id ?? "id",
+			email: t.email ?? "email",
+			tenantId: t.tenantId ?? "tenantId",
+			createdAt: t.createdAt ?? "createdAt",
+			passwordHash: t.passwordHash ?? "passwordHash",
+			updatedAt: t.updatedAt ?? "updatedAt",
+			mfaSecret: t.mfaSecret ?? "mfaSecret",
+			mfaEnrolledAt: t.mfaEnrolledAt ?? "mfaEnrolledAt",
+			emailVerifiedAt: t.emailVerifiedAt ?? "emailVerifiedAt",
+			deactivatedAt: t.deactivatedAt ?? !1
+		}
+	};
+}, o = (o, s = {}) => {
+	let c = a(s.identity), { col: l } = c, u = (e) => o`${o(l[e])}`, d = [
+		"id",
+		"email",
+		"passwordHash",
+		"tenantId",
+		"createdAt",
+		"mfaSecret",
+		"mfaEnrolledAt",
+		"emailVerifiedAt",
+		"deactivatedAt"
+	], f, p = () => f ??= {
+		usersTable: o.join(".", !1)(c.table.split(".").map((e) => o`${o(e)}`)),
+		selectList: o.csv(d.map((e) => l[e] === !1 ? o`NULL AS ${o(e)}` : o`${u(e)} AS ${o(e)}`))
+	}, m = (e, t) => /* @__PURE__ */ Error(`postgresUserStore: ${t} needs the "${e}" column, and identity.columns.${e} is false — this table has none`), h = (e) => l.updatedAt === !1 ? o`` : o`, ${u("updatedAt")} = ${e}`, g = (e) => ({
+		id: e.id,
+		email: e.email,
+		passwordHash: e.passwordHash,
+		tenantId: e.tenantId,
+		createdAt: e.createdAt,
+		mfaSecret: e.mfaSecret,
+		mfaEnrolledAt: e.mfaEnrolledAt,
+		emailVerifiedAt: e.emailVerifiedAt,
+		...l.deactivatedAt === !1 ? {} : { deactivatedAt: e.deactivatedAt ?? null }
+	}), _ = (e) => r.gen(function* () {
+		let t = yield* o`
+        SELECT ${p().selectList} FROM ${p().usersTable}
+        WHERE ${u("email")} = ${e.toLowerCase()}
+        LIMIT 1
+      `;
+		return t[0] ? g(t[0]) : null;
+	}).pipe(r.orElseSucceed(() => null)), v = (e) => r.gen(function* () {
+		let t = yield* o`
+        SELECT ${p().selectList} FROM ${p().usersTable}
+        WHERE ${u("id")} = ${e}
+        LIMIT 1
+      `;
+		return t[0] ? g(t[0]) : null;
+	}).pipe(r.orElseSucceed(() => null)), ee = (t) => r.gen(function* () {
+		let n = t.email === null ? null : t.email.toLowerCase(), a = /* @__PURE__ */ new Date(), s = [
+			u("id"),
+			u("email"),
+			u("tenantId"),
+			u("createdAt")
+		], c = [
+			t.id,
+			n,
+			t.tenantId,
+			a
+		];
+		return l.passwordHash !== !1 && (s.push(u("passwordHash")), c.push(t.passwordHash ?? null)), l.updatedAt !== !1 && (s.push(u("updatedAt")), c.push(a)), yield* o`
+        INSERT INTO ${p().usersTable} (${o.csv(s)})
+        VALUES ${o.in(c)}
+      `.pipe(r.map(() => ({
+			...t,
+			email: n,
+			createdAt: a
+		})), r.catch((t) => i(t) === "23505" && n !== null ? r.fail(new e({ email: n })) : r.die(t)));
+	}), y = (e) => r.gen(function* () {
+		let n = (yield* o`
+        SELECT ${p().selectList} FROM ${p().usersTable} WHERE ${u("id")} = ${e} LIMIT 1
+      `)[0];
+		return n ? g(n) : yield* r.fail(new t({ userId: e }));
+	}).pipe(r.catchTag("SqlError", (e) => r.die(e))), b = (e, t) => r.gen(function* () {
+		return l.passwordHash === !1 ? yield* r.die(m("passwordHash", "updatePassword")) : (yield* o`
+        UPDATE ${p().usersTable} SET ${u("passwordHash")} = ${t}${h(/* @__PURE__ */ new Date())}
+         WHERE ${u("id")} = ${e}
+      `.pipe(r.catchTag("SqlError", (e) => r.die(e))), yield* y(e));
+	}), x = (e, t) => r.gen(function* () {
+		return l.mfaSecret === !1 ? yield* r.die(m("mfaSecret", "setMfaSecret")) : l.mfaEnrolledAt === !1 ? yield* r.die(m("mfaEnrolledAt", "setMfaSecret")) : (yield* o`
+        UPDATE ${p().usersTable}
+           SET ${u("mfaSecret")} = ${t}, ${u("mfaEnrolledAt")} = ${null}
+         WHERE ${u("id")} = ${e}
+      `.pipe(r.catchTag("SqlError", (e) => r.die(e))), yield* y(e));
+	}), S = (e) => r.gen(function* () {
+		return l.mfaEnrolledAt === !1 ? yield* r.die(m("mfaEnrolledAt", "markMfaEnrolled")) : (yield* o`
+        UPDATE ${p().usersTable}
+           SET ${u("mfaEnrolledAt")} = ${/* @__PURE__ */ new Date()}
+         WHERE ${u("id")} = ${e}
+      `.pipe(r.catchTag("SqlError", (e) => r.die(e))), yield* y(e));
+	}), C = (e) => r.gen(function* () {
+		return l.mfaSecret === !1 ? yield* r.die(m("mfaSecret", "clearMfa")) : l.mfaEnrolledAt === !1 ? yield* r.die(m("mfaEnrolledAt", "clearMfa")) : (yield* o`
+        UPDATE ${p().usersTable}
+           SET ${u("mfaSecret")} = ${null}, ${u("mfaEnrolledAt")} = ${null}
+         WHERE ${u("id")} = ${e}
+      `.pipe(r.catchTag("SqlError", (e) => r.die(e))), yield* y(e));
+	}), w = (e) => r.gen(function* () {
+		return l.emailVerifiedAt === !1 ? yield* r.die(m("emailVerifiedAt", "markEmailVerified")) : (yield* o`
+        UPDATE ${p().usersTable}
+           SET ${u("emailVerifiedAt")} = ${/* @__PURE__ */ new Date()}${h(/* @__PURE__ */ new Date())}
+         WHERE ${u("id")} = ${e} AND ${u("emailVerifiedAt")} IS NULL
+      `.pipe(r.catchTag("SqlError", (e) => r.die(e))), yield* y(e));
+	}), T = (e) => r.gen(function* () {
+		return (yield* o`
+        SELECT "userId", "tenantId", role, "joinedAt"
+          FROM memberships WHERE "userId" = ${e}
+          ORDER BY "joinedAt" ASC
+      `).map((e) => ({ ...e }));
+	}).pipe(r.orElseSucceed(() => [])), E = (e) => r.gen(function* () {
+		let t = /* @__PURE__ */ new Date();
+		yield* o`
+        UPDATE memberships SET role = ${e.role}
+         WHERE "userId" = ${e.userId} AND "tenantId" = ${e.tenantId}
+      `;
+		let r = yield* o`
+        SELECT "userId", "tenantId", role, "joinedAt"
+          FROM memberships
+         WHERE "userId" = ${e.userId} AND "tenantId" = ${e.tenantId}
+         LIMIT 1
+      `;
+		return r[0] ? { ...r[0] } : (yield* o`
+        INSERT INTO memberships (id, "userId", "tenantId", role, "joinedAt")
+        VALUES (${n("mem")}, ${e.userId}, ${e.tenantId}, ${e.role}, ${t})
+      `, {
+			...e,
+			joinedAt: t
+		});
+	}).pipe(r.catch(() => r.succeed({
+		...e,
+		joinedAt: /* @__PURE__ */ new Date()
+	}))), D = (e, t) => r.gen(function* () {
+		return (yield* o`
+        SELECT role FROM memberships
+         WHERE "userId" = ${e} AND "tenantId" = ${t} LIMIT 1
+      `)[0]?.role ?? null;
+	}).pipe(r.orElseSucceed(() => null)), O = (e) => r.gen(function* () {
+		return (yield* o`
+        SELECT credential.id, credential."userId", credential."tenantId", credential."expiresAt", credential."ipAddress", credential."userAgent", credential."createdAt", credential."lastSeenAt", credential."familyId", credential."rotatedAt"
+          FROM sessions AS credential
+        INNER JOIN sessions AS root
+          ON root.id = COALESCE(credential."familyId", credential.id)
+          AND root."userId" = credential."userId"
+          AND COALESCE(root."familyId", root.id) = root.id
+        WHERE credential."userId" = ${e} AND credential."rotatedAt" IS NULL
+          AND credential.id <> '' AND credential."userId" <> '' AND root.id <> ''
+          ORDER BY credential."createdAt" DESC
+      `).map((e) => ({ ...e }));
+	}).pipe(r.orElseSucceed(() => [])), k = (e) => r.gen(function* () {
+		let t = /* @__PURE__ */ new Date();
+		return yield* o`
+        INSERT INTO sessions (id, "userId", "tenantId", "expiresAt", "ipAddress", "userAgent", "createdAt", "lastSeenAt", "familyId", "rotatedAt")
+        VALUES (
+          ${e.id}, ${e.userId}, ${e.tenantId}, ${e.expiresAt},
+          ${e.ipAddress ?? null}, ${e.userAgent ?? null}, ${t}, ${t}, ${e.familyId ?? e.id}, ${e.rotatedAt ?? null}
+        )
+      `, {
+			...e,
+			familyId: e.familyId ?? e.id,
+			rotatedAt: e.rotatedAt ?? null,
+			createdAt: t,
+			lastSeenAt: t
+		};
+	}).pipe(r.orDie), A = (e) => r.gen(function* () {
+		let t = yield* o`
+        SELECT credential.id, credential."userId", credential."tenantId", credential."expiresAt", credential."ipAddress", credential."userAgent", credential."createdAt", credential."lastSeenAt", credential."familyId", credential."rotatedAt"
+          FROM sessions AS credential
+        INNER JOIN sessions AS root
+          ON root.id = COALESCE(credential."familyId", credential.id)
+          AND root."userId" = credential."userId"
+          AND COALESCE(root."familyId", root.id) = root.id
+        WHERE credential.id = ${e} AND credential."rotatedAt" IS NULL
+          AND credential.id <> '' AND credential."userId" <> '' AND root.id <> '' LIMIT 1
+      `;
+		return t[0] ? { ...t[0] } : null;
+	}).pipe(r.orElseSucceed(() => null)), j = (e, t) => o.withTransaction(r.gen(function* () {
+		let n = (yield* o`SELECT COALESCE("familyId", id) AS family, "userId" FROM sessions WHERE id = ${e}`)[0];
+		n && (yield* o`SELECT id FROM sessions WHERE id = ${n.family} AND "userId" = ${n.userId} FOR UPDATE`).length && (yield* o`UPDATE sessions SET "expiresAt" = ${t}, "lastSeenAt" = ${/* @__PURE__ */ new Date()} WHERE id = ${e} AND "userId" = ${n.userId} AND "rotatedAt" IS NULL RETURNING id`).length && (yield* o`UPDATE sessions SET "expiresAt" = GREATEST("expiresAt", ${t}) WHERE id = ${n.family} AND "userId" = ${n.userId}`);
+	})).pipe(r.asVoid, r.orDie), M = (e, t) => o.withTransaction(r.gen(function* () {
+		let n = (yield* o`SELECT COALESCE("familyId", id) AS family FROM sessions WHERE id = ${t} AND "userId" = ${e}`)[0]?.family;
+		return !n || !(yield* o`SELECT id FROM sessions WHERE id = ${n} AND "userId" = ${e} FOR UPDATE`).length ? !1 : (yield* o`DELETE FROM sessions WHERE "userId" = ${e} AND COALESCE("familyId", id) = ${n} RETURNING id`).length > 0;
+	})).pipe(r.orDie), N = (e, t) => o.withTransaction(r.gen(function* () {
+		let n = (yield* o`SELECT COALESCE("familyId", id) AS family FROM sessions WHERE id = ${t} AND "userId" = ${e}`)[0]?.family ?? "";
+		return yield* o`SELECT id FROM sessions WHERE "userId" = ${e} AND id = COALESCE("familyId", id) AND id <> ${n} ORDER BY id FOR UPDATE`, (yield* o`DELETE FROM sessions WHERE "userId" = ${e} AND COALESCE("familyId", id) <> ${n} RETURNING "rotatedAt"`).filter((e) => e.rotatedAt === null).length;
+	})).pipe(r.orDie), P = (e) => o.withTransaction(r.gen(function* () {
+		return yield* o`SELECT id FROM sessions WHERE "userId" = ${e} AND id = COALESCE("familyId", id) ORDER BY id FOR UPDATE`, (yield* o`DELETE FROM sessions WHERE "userId" = ${e} RETURNING "rotatedAt"`).filter((e) => e.rotatedAt === null).length;
+	})).pipe(r.orDie), te = (e) => r.gen(function* () {
+		let t = /* @__PURE__ */ new Date();
+		return yield* o`
+        INSERT INTO "authTokens" (id, "tokenHash", "userId", purpose, "expiresAt", "consumedAt", "createdAt")
+        VALUES (${e.id}, ${e.tokenHash}, ${e.userId}, ${e.purpose}, ${e.expiresAt}, ${null}, ${t})
+      `, {
+			...e,
+			consumedAt: null,
+			createdAt: t
+		};
+	}).pipe(r.catch(() => r.succeed({
+		...e,
+		consumedAt: null,
+		createdAt: /* @__PURE__ */ new Date()
+	}))), F = (e, t) => r.gen(function* () {
+		let n = yield* o`
+        UPDATE "authTokens"
+           SET "consumedAt" = ${/* @__PURE__ */ new Date()}
+         WHERE "tokenHash" = ${e}
+           AND purpose = ${t}
+           AND "consumedAt" IS NULL
+           AND "expiresAt" > ${/* @__PURE__ */ new Date()}
+        RETURNING id, "tokenHash", "userId", purpose, "expiresAt", "consumedAt", "createdAt"
+      `;
+		return n[0] ? { ...n[0] } : null;
+	}).pipe(r.orElseSucceed(() => null)), I = (e, t) => r.gen(function* () {
+		let n = yield* o`
+        SELECT id, "tokenHash", "userId", purpose, "expiresAt", "consumedAt", "createdAt"
+          FROM "authTokens"
+         WHERE "userId" = ${e} AND purpose = ${t}
+         ORDER BY "createdAt" DESC
+         LIMIT 1
+      `;
+		return n[0] ? { ...n[0] } : null;
+	}).pipe(r.orElseSucceed(() => null)), L = (e) => r.gen(function* () {
+		let t = /* @__PURE__ */ new Date(), n = e.email.toLowerCase();
+		return yield* o`
+        INSERT INTO invitations (
+          id, "tokenHash", email, "tenantId", role, "invitedByUserId",
+          "expiresAt", "acceptedAt", "acceptedByUserId", "revokedAt", "revokedByUserId", "createdAt"
+        ) VALUES (
+          ${e.id}, ${e.tokenHash}, ${n}, ${e.tenantId},
+          ${e.role}, ${e.invitedByUserId}, ${e.expiresAt},
+          ${null}, ${null}, ${null}, ${null}, ${t}
+        )
+      `, {
+			...e,
+			email: n,
+			acceptedAt: null,
+			acceptedByUserId: null,
+			revokedAt: null,
+			revokedByUserId: null,
+			createdAt: t
+		};
+	}).pipe(r.catch((e) => r.die(e))), R = (e) => r.gen(function* () {
+		let t = yield* o`
+        SELECT id, "tokenHash", email, "tenantId", role, "invitedByUserId", "expiresAt",
+               "acceptedAt", "acceptedByUserId", "revokedAt", "revokedByUserId", "createdAt"
+          FROM invitations WHERE "tokenHash" = ${e} LIMIT 1
+      `;
+		return t[0] ? { ...t[0] } : null;
+	}).pipe(r.orElseSucceed(() => null)), z = (e, t, n) => r.gen(function* () {
+		let r = yield* o`
+        UPDATE invitations
+           SET "acceptedAt" = ${n}, "acceptedByUserId" = ${t}
+         WHERE "tokenHash" = ${e}
+           AND "acceptedAt" IS NULL
+           AND "revokedAt" IS NULL
+           AND "expiresAt" > ${n}
+        RETURNING id, "tokenHash", email, "tenantId", role, "invitedByUserId", "expiresAt",
+                  "acceptedAt", "acceptedByUserId", "revokedAt", "revokedByUserId", "createdAt"
+      `;
+		return r[0] ? { ...r[0] } : null;
+	}).pipe(r.catch((e) => r.die(e))), B = (e, t, n, i) => r.gen(function* () {
+		return (yield* o`
+        UPDATE invitations
+           SET "revokedAt" = ${i}, "revokedByUserId" = ${n}
+         WHERE id = ${e}
+           AND "tenantId" = ${t}
+           AND "acceptedAt" IS NULL
+           AND "revokedAt" IS NULL
+        RETURNING id
+      `).length > 0;
+	}).pipe(r.catch((e) => r.die(e))), V = (e) => r.gen(function* () {
+		return (yield* o`
+        SELECT id, "tokenHash", email, "tenantId", role, "invitedByUserId", "expiresAt",
+               "acceptedAt", "acceptedByUserId", "revokedAt", "revokedByUserId", "createdAt"
+          FROM invitations WHERE "tenantId" = ${e}
+          ORDER BY "createdAt" DESC
+      `).map((e) => ({ ...e }));
+	}).pipe(r.orElseSucceed(() => [])), H = (e, t) => r.gen(function* () {
+		return (yield* o`
+        SELECT COUNT(*)::int AS n FROM invitations
+         WHERE "tenantId" = ${e}
+           AND "acceptedAt" IS NULL AND "revokedAt" IS NULL AND "expiresAt" > ${t}
+      `)[0]?.n ?? 0;
+	}).pipe(r.catch((e) => r.die(e))), U = (e, t, n, i) => r.gen(function* () {
+		return (yield* o`
+        UPDATE invitations
+           SET "revokedAt" = ${i}, "revokedByUserId" = ${n}
+         WHERE "tenantId" = ${e}
+           AND email = ${t.toLowerCase()}
+           AND "acceptedAt" IS NULL
+           AND "revokedAt" IS NULL
+        RETURNING id
+      `).length;
+	}).pipe(r.catch((e) => r.die(e))), W = (e) => r.gen(function* () {
+		let t = /* @__PURE__ */ new Date();
+		return yield* o`
+        INSERT INTO "impersonationGrants" (
+          id, "sessionId", "actorUserId", "actorSessionId", "targetUserId", "tenantId",
+          reason, "startedAt", "expiresAt", "endedAt", "endedReason", "ipAddress", "userAgent"
+        ) VALUES (
+          ${e.id}, ${e.sessionId}, ${e.actorUserId}, ${e.actorSessionId},
+          ${e.targetUserId}, ${e.tenantId}, ${e.reason ?? null}, ${t},
+          ${e.expiresAt}, ${null}, ${null}, ${e.ipAddress ?? null}, ${e.userAgent ?? null}
+        )
+      `, {
+			...e,
+			startedAt: t,
+			endedAt: null,
+			endedReason: null
+		};
+	}).pipe(r.catch((e) => r.die(e))), G = (e) => r.gen(function* () {
+		let t = yield* o`
+        SELECT id, "sessionId", "actorUserId", "actorSessionId", "targetUserId", "tenantId",
+               reason, "startedAt", "expiresAt", "endedAt", "endedReason", "ipAddress", "userAgent"
+          FROM "impersonationGrants" WHERE "sessionId" = ${e} LIMIT 1
+      `;
+		return t[0] ? { ...t[0] } : null;
+	}).pipe(r.orElseSucceed(() => null)), K = (e, t, n) => r.gen(function* () {
+		return (yield* o`
+        UPDATE "impersonationGrants"
+           SET "endedAt" = ${n}, "endedReason" = ${t}
+         WHERE "sessionId" = ${e} AND "endedAt" IS NULL
+        RETURNING id
+      `).length > 0;
+	}).pipe(r.catch((e) => r.die(e))), q = (e) => r.gen(function* () {
+		return (yield* o`
+        SELECT id, "credentialId", "userId", "publicKey", counter, transports, "createdAt", "lastUsedAt"
+          FROM passkeys WHERE "userId" = ${e}
+      `).map((e) => ({ ...e }));
+	}).pipe(r.orElseSucceed(() => [])), J = (e) => r.gen(function* () {
+		let t = yield* o`
+        SELECT id, "credentialId", "userId", "publicKey", counter, transports, "createdAt", "lastUsedAt"
+          FROM passkeys WHERE "credentialId" = ${e} LIMIT 1
+      `;
+		return t[0] ? { ...t[0] } : null;
+	}).pipe(r.orElseSucceed(() => null)), Y = (e) => r.gen(function* () {
+		let t = /* @__PURE__ */ new Date();
+		return yield* o`
+        INSERT INTO passkeys (id, "credentialId", "userId", "publicKey", counter, transports, "createdAt", "lastUsedAt")
+        VALUES (
+          ${e.id}, ${e.credentialId}, ${e.userId}, ${e.publicKey},
+          ${e.counter}, ${e.transports ?? null}, ${t}, ${null}
+        )
+      `, {
+			...e,
+			createdAt: t,
+			lastUsedAt: null
+		};
+	}).pipe(r.catch(() => r.succeed({
+		...e,
+		createdAt: /* @__PURE__ */ new Date(),
+		lastUsedAt: null
+	}))), X = (e, t) => r.gen(function* () {
+		return (yield* o`
+        UPDATE passkeys
+           SET counter = ${t}, "lastUsedAt" = ${/* @__PURE__ */ new Date()}
+         WHERE "credentialId" = ${e}
+           AND counter < ${t}
+        RETURNING id
+      `).length > 0;
+	}).pipe(r.orElseSucceed(() => !1)), Z = (e, t) => r.gen(function* () {
+		let r = /* @__PURE__ */ new Date();
+		yield* o`DELETE FROM "recoveryCodes" WHERE "userId" = ${e}`;
+		for (let i of t) yield* o`
+          INSERT INTO "recoveryCodes" (id, "userId", "codeHash", "consumedAt", "createdAt")
+          VALUES (${n("rc")}, ${e}, ${i}, ${null}, ${r})
+        `;
+	}).pipe(r.asVoid, r.orElseSucceed(() => void 0)), Q = (e, t) => r.gen(function* () {
+		return (yield* o`
+        UPDATE "recoveryCodes"
+           SET "consumedAt" = ${/* @__PURE__ */ new Date()}
+         WHERE "userId" = ${e}
+           AND "codeHash" = ${t}
+           AND "consumedAt" IS NULL
+        RETURNING id
+      `).length > 0;
+	}).pipe(r.orElseSucceed(() => !1)), ne = (e) => r.gen(function* () {
+		return (yield* o`
+        SELECT COUNT(*)::int AS n FROM "recoveryCodes"
+         WHERE "userId" = ${e} AND "consumedAt" IS NULL
+      `)[0]?.n ?? 0;
+	}).pipe(r.orElseSucceed(() => 0)), $ = (e, t) => r.catch((n) => r.logWarning(`[auth] lockout ${e} failed — brute-force protection is not counting`).pipe(r.annotateLogs("cause", String(n)), r.as(t)));
+	return {
+		findByEmail: _,
+		findById: v,
+		insert: ee,
+		updatePassword: b,
+		setMfaSecret: x,
+		markMfaEnrolled: S,
+		clearMfa: C,
+		markEmailVerified: w,
+		listMemberships: T,
+		addMembership: E,
+		membershipRole: D,
+		listSessions: O,
+		insertSession: k,
+		findSession: A,
+		touchSession: j,
+		revokeSession: M,
+		revokeAllOtherSessions: N,
+		revokeAllSessions: P,
+		insertToken: te,
+		consumeToken: F,
+		latestToken: I,
+		insertInvitation: L,
+		findInvitationByHash: R,
+		acceptInvitation: z,
+		revokeInvitation: B,
+		listInvitations: V,
+		countPendingInvitations: H,
+		supersedePendingInvitations: U,
+		insertImpersonationGrant: W,
+		findImpersonationGrantBySession: G,
+		endImpersonationGrant: K,
+		replaceRecoveryCodes: Z,
+		consumeRecoveryCode: Q,
+		countRecoveryCodes: ne,
+		listPasskeys: q,
+		findPasskey: J,
+		insertPasskey: Y,
+		advancePasskeyCounter: X,
+		isLockedOut: (e, t) => r.gen(function* () {
+			let n = (yield* o`
+        SELECT "lockedUntil" FROM "loginAttempts"
+         WHERE email = ${e.toLowerCase()} LIMIT 1
+      `)[0]?.lockedUntil ?? null;
+			return n != null && t < n.getTime() ? {
+				locked: !0,
+				retryAfterSeconds: Math.ceil((n.getTime() - t) / 1e3)
+			} : {
+				locked: !1,
+				retryAfterSeconds: 0
+			};
+		}).pipe($("read", {
+			locked: !1,
+			retryAfterSeconds: 0
+		})),
+		recordLoginFailure: (e, t, i) => r.gen(function* () {
+			let r = e.toLowerCase(), a = (yield* o`
+        SELECT "failedCount", "windowStartedAt", "lockedUntil"
+          FROM "loginAttempts" WHERE email = ${r} LIMIT 1
+      `)[0], s = a?.windowStartedAt?.getTime() ?? null, c = a?.lockedUntil?.getTime() ?? null, l = s == null || t - s >= i.windowMs, u = !a || l || c != null && t >= c, d = u ? 1 : a.failedCount + 1, f = u ? new Date(t) : new Date(s), p = d >= i.maxAttempts ? new Date(t + i.lockMs) : null, m = new Date(t);
+			yield* o`
+        INSERT INTO "loginAttempts" (id, email, "failedCount", "windowStartedAt", "lockedUntil", "createdAt", "updatedAt")
+        VALUES (${n("la")}, ${r}, ${d}, ${f}, ${p}, ${m}, ${m})
+        ON CONFLICT (email) DO UPDATE SET
+          "failedCount" = ${d},
+          "windowStartedAt" = ${f},
+          "lockedUntil" = ${p},
+          "updatedAt" = ${m}
+      `;
+		}).pipe(r.asVoid, $("record", void 0)),
+		clearLoginFailures: (e) => r.gen(function* () {
+			yield* o`DELETE FROM "loginAttempts" WHERE email = ${e.toLowerCase()}`;
+		}).pipe(r.asVoid, $("clear", void 0))
+	};
+};
+//#endregion
+export { o as postgresUserStore };

package/dist/revocation.js

@@ -0,0 +1,50 @@
+import { isSessionCredentialLiveFor as e } from "./sessionFamily.js";
+import { Effect as t } from "effect";
+//#region src/revocation.ts
+var n = 3e4, r = 1e4, i = (e) => {
+	if (typeof e != "object" || !e) throw TypeError("Session revocation options must be an object.");
+	if ("isLive" in e || "isLiveFor" in e || "invalidate" in e || Reflect.ownKeys(e).some((e) => typeof e != "string" || ![
+		"ttlMs",
+		"maxEntries",
+		"now"
+	].includes(e))) throw TypeError("Supply revocation options or a checker implementing isLiveFor(sessionId, userId), invalidate(sessionId) and ttlMs.");
+	if (e.ttlMs !== void 0 && (!Number.isFinite(e.ttlMs) || e.ttlMs < 0)) throw TypeError("Session revocation ttlMs must be finite and nonnegative.");
+	if (e.maxEntries !== void 0 && (!Number.isSafeInteger(e.maxEntries) || e.maxEntries < 0)) throw TypeError("Session revocation maxEntries must be a nonnegative safe integer.");
+	if (e.now !== void 0 && typeof e.now != "function") throw TypeError("Session revocation now must be a clock function.");
+}, a = (a, o = {}) => {
+	i(o);
+	let s = o.ttlMs ?? n, c = o.maxEntries ?? r, l = o.now ?? Date.now, u = /* @__PURE__ */ new Map(), d = () => {
+		if (u.size <= c) return;
+		let e = l();
+		for (let [t, n] of u) n.freshUntil <= e && u.delete(t);
+		for (let e of u.keys()) {
+			if (u.size <= c) break;
+			u.delete(e);
+		}
+	};
+	return {
+		ttlMs: s,
+		invalidate: (e) => {
+			u.delete(e);
+		},
+		isLiveFor: (n, r) => t.gen(function* () {
+			if (typeof n != "string" || n.length === 0 || typeof r != "string" || r.length === 0) return !1;
+			let t = l();
+			if (!Number.isFinite(t)) return !1;
+			if (s > 0) {
+				let e = u.get(n);
+				if (e && e.freshUntil > t) return e.live && e.userId === r;
+			}
+			let i = yield* a.findSession(n), o = l();
+			if (!Number.isFinite(o)) return !1;
+			let f = i !== null && i.id === n && typeof i.userId == "string" && i.userId.length > 0 ? i.userId : null, p = i?.expiresAt instanceof Date ? i.expiresAt.getTime() : NaN, m = f !== null && e(i, n, f, o);
+			return s > 0 && c > 0 && (u.set(n, {
+				userId: f,
+				live: m,
+				freshUntil: m ? Math.min(o + s, p) : o + s
+			}), d()), m && f === r;
+		})
+	};
+};
+//#endregion
+export { a as makeSessionRevocationChecker, i as validateSessionRevocationOptions };

package/dist/schema.d.ts

@@ -1,6 +1,29 @@
+import { ColumnBuilder } from '@voltro/database';
+import { FieldDefinitions } from '@voltro/database';
+import { Table } from '@voltro/database';
 import { TableLike } from '@voltro/database';
 
-/** Tables the plugin contributes, as an array. */
+/** Device credentials never appear in SQL, logs, exports or session claims. */
+export declare const authGuestDevicesTable: Table<"authGuestDevices", FieldDefinitions<{
+    readonly id: ColumnBuilder<string, "id", boolean>;
+    readonly guestId: ColumnBuilder<string, "text", boolean>;
+    readonly tenantId: ColumnBuilder<string, "text", boolean>;
+    readonly secretHash: ColumnBuilder<string, "text", boolean>;
+    readonly generation: ColumnBuilder<number, "integer", boolean>;
+    readonly expiresAt: ColumnBuilder<Date, "timestamp", boolean>;
+    readonly createdAt: ColumnBuilder<Date, "timestamp", boolean>;
+}>, true, never>;
+
+/** Guest identity is independent of the password user's email record. */
+export declare const authGuestsTable: Table<"authGuests", FieldDefinitions<{
+    readonly id: ColumnBuilder<string, "id", boolean>;
+    readonly tenantId: ColumnBuilder<string, "text", boolean>;
+    readonly upgradeable: ColumnBuilder<boolean, "boolean", boolean>;
+    readonly expiresAt: ColumnBuilder<Date, "timestamp", boolean>;
+    readonly createdAt: ColumnBuilder<Date, "timestamp", boolean>;
+    readonly lastSeenAt: ColumnBuilder<Date, "timestamp", boolean>;
+}>, true, never>;
+
 export declare const authTables: readonly [TableLike, TableLike, TableLike, TableLike, TableLike, TableLike, TableLike, TableLike, TableLike, TableLike];
 
 /**
@@ -12,6 +35,23 @@ export declare const authTables: readonly [TableLike, TableLike, TableLike, Tabl
  */
 export declare const authTokensTable: TableLike;
 
+export declare const guestTables: readonly [ Table<"authGuests", FieldDefinitions<{
+    readonly id: ColumnBuilder<string, "id", boolean>;
+    readonly tenantId: ColumnBuilder<string, "text", boolean>;
+    readonly upgradeable: ColumnBuilder<boolean, "boolean", boolean>;
+    readonly expiresAt: ColumnBuilder<Date, "timestamp", boolean>;
+    readonly createdAt: ColumnBuilder<Date, "timestamp", boolean>;
+    readonly lastSeenAt: ColumnBuilder<Date, "timestamp", boolean>;
+}>, true, never>, Table<"authGuestDevices", FieldDefinitions<{
+    readonly id: ColumnBuilder<string, "id", boolean>;
+    readonly guestId: ColumnBuilder<string, "text", boolean>;
+    readonly tenantId: ColumnBuilder<string, "text", boolean>;
+    readonly secretHash: ColumnBuilder<string, "text", boolean>;
+    readonly generation: ColumnBuilder<number, "integer", boolean>;
+    readonly expiresAt: ColumnBuilder<Date, "timestamp", boolean>;
+    readonly createdAt: ColumnBuilder<Date, "timestamp", boolean>;
+}>, true, never>];
+
 /**
  * Impersonation grants — one row per "support agent A is acting as user B",
  * written when the impersonated session is minted and closed when it ends.
@@ -108,11 +148,10 @@ export declare const passkeysTable: TableLike;
 export declare const recoveryCodesTable: TableLike;
 
 /**
- * Sessions table. Active sessions enumerated server-side so apps can
- * implement "sign out other devices" + server-side revocation.
- * `handleSignIn` / `handleSignOut` do NOT write here (cookies are
- * self-describing HMAC-signed); apps that need device management
- * wire that up themselves.
+ * Sessions table used by the auth handlers and custom registered sessions.
+ * Rotation retains inactive aliases in a device family so sign-out using an
+ * earlier cookie also revokes its current successor. Only unrotated rows
+ * authenticate or appear in device lists.
  */
 export declare const sessionsTable: TableLike;