@voltro/plugin-auth 0.85.0 → 0.87.0

package/dist/userStore.js

@@ -0,0 +1,292 @@
+import { hasOwnedSessionFamily as e, indexSessionFamilies as t, sessionFamilyId as n } from "./sessionFamily.js";
+import { Data as r, Effect as i } from "effect";
+import { generateId as a } from "@voltro/database";
+//#region src/userStore.ts
+var o = class extends r.TaggedError("UserAlreadyExistsError") {}, s = class extends r.TaggedError("UserNotFoundError") {}, c = (e) => a({
+	kind: "typeid",
+	prefix: e
+}, e), l = (r = []) => {
+	let a = /* @__PURE__ */ new Map(), l = /* @__PURE__ */ new Map(), u = [], d = [], f = [], p = [], m = [], h = [], g = [], _ = /* @__PURE__ */ new Map();
+	for (let e of r) a.set(e.id, e), e.email !== null && l.set(e.email.toLowerCase(), e);
+	let v = (e, t) => i.gen(function* () {
+		let n = a.get(e);
+		if (!n) return yield* i.fail(new s({ userId: e }));
+		let r = t(n);
+		return a.set(e, r), r.email !== null && l.set(r.email.toLowerCase(), r), r;
+	});
+	return {
+		findByEmail: (e) => i.sync(() => l.get(e.toLowerCase()) ?? null),
+		findById: (e) => i.sync(() => a.get(e) ?? null),
+		insert: (e) => i.gen(function* () {
+			let t = e.email === null ? null : e.email.toLowerCase();
+			if (t !== null && l.has(t)) return yield* i.fail(new o({ email: t }));
+			let n = {
+				...e,
+				email: t,
+				createdAt: /* @__PURE__ */ new Date()
+			};
+			return a.set(n.id, n), t !== null && l.set(t, n), n;
+		}),
+		updatePassword: (e, t) => v(e, (e) => ({
+			...e,
+			passwordHash: t
+		})),
+		setMfaSecret: (e, t) => v(e, (e) => ({
+			...e,
+			mfaSecret: t,
+			mfaEnrolledAt: null
+		})),
+		markMfaEnrolled: (e) => v(e, (e) => ({
+			...e,
+			mfaEnrolledAt: /* @__PURE__ */ new Date()
+		})),
+		clearMfa: (e) => v(e, (e) => ({
+			...e,
+			mfaSecret: null,
+			mfaEnrolledAt: null
+		})),
+		markEmailVerified: (e) => v(e, (e) => e.emailVerifiedAt ? e : {
+			...e,
+			emailVerifiedAt: /* @__PURE__ */ new Date()
+		}),
+		listMemberships: (e) => i.sync(() => u.filter((t) => t.userId === e)),
+		addMembership: (e) => i.sync(() => {
+			let t = u.findIndex((t) => t.userId === e.userId && t.tenantId === e.tenantId), n = {
+				...e,
+				joinedAt: /* @__PURE__ */ new Date()
+			};
+			if (t >= 0) {
+				let e = u[t], r = {
+					...n,
+					joinedAt: e.joinedAt
+				};
+				return u[t] = r, r;
+			}
+			return u.push(n), n;
+		}),
+		membershipRole: (e, t) => i.sync(() => u.find((n) => n.userId === e && n.tenantId === t)?.role ?? null),
+		listSessions: (r) => i.sync(() => {
+			let i = t(d);
+			return d.filter((t) => t.userId === r && t.rotatedAt == null && i.get(t.id) === t && e(t, i.get(n(t) ?? ""))).map((e) => structuredClone(e)).sort((e, t) => t.createdAt.getTime() - e.createdAt.getTime());
+		}),
+		insertSession: (e) => i.sync(() => {
+			let t = /* @__PURE__ */ new Date(), n = {
+				...e,
+				familyId: e.familyId ?? e.id,
+				rotatedAt: e.rotatedAt ?? null,
+				createdAt: t,
+				lastSeenAt: t
+			};
+			return d.push(structuredClone(n)), structuredClone(n);
+		}),
+		findSession: (r) => i.sync(() => {
+			let i = t(d), a = i.get(r);
+			return a && a.rotatedAt == null && e(a, i.get(n(a) ?? "")) ? structuredClone(a) : null;
+		}),
+		touchSession: (e, t) => i.sync(() => {
+			let n = d.findIndex((t) => t.id === e);
+			if (n >= 0 && d[n].rotatedAt == null) {
+				d[n] = {
+					...d[n],
+					expiresAt: t,
+					lastSeenAt: /* @__PURE__ */ new Date()
+				};
+				let r = d[n].familyId ?? e, i = d.findIndex((e) => e.id === r);
+				i >= 0 && d[i].expiresAt < t && (d[i] = {
+					...d[i],
+					expiresAt: t
+				});
+			}
+		}),
+		revokeSession: (e, t) => i.sync(() => {
+			let n = d.find((n) => n.id === t && n.userId === e);
+			if (!n) return !1;
+			let r = n.familyId ?? n.id, i = !1;
+			for (let t = d.length - 1; t >= 0; t--) {
+				let n = d[t];
+				n.userId === e && (n.familyId ?? n.id) === r && (d.splice(t, 1), i = !0);
+			}
+			return i;
+		}),
+		revokeAllOtherSessions: (e, t) => i.sync(() => {
+			let n = d.find((n) => n.id === t && n.userId === e), r = n ? n.familyId ?? n.id : void 0, i = 0;
+			for (let t = d.length - 1; t >= 0; t--) {
+				let n = d[t];
+				n.userId === e && (n.familyId ?? n.id) !== r && (d.splice(t, 1), n.rotatedAt ?? (i += 1));
+			}
+			return i;
+		}),
+		revokeAllSessions: (e) => i.sync(() => {
+			let t = 0;
+			for (let n = d.length - 1; n >= 0; n--) if (d[n].userId === e) {
+				let e = d[n];
+				d.splice(n, 1), e.rotatedAt ?? t++;
+			}
+			return t;
+		}),
+		insertToken: (e) => i.sync(() => {
+			let t = {
+				...e,
+				consumedAt: null,
+				createdAt: /* @__PURE__ */ new Date()
+			};
+			return f.push(t), t;
+		}),
+		consumeToken: (e, t) => i.sync(() => {
+			let n = Date.now(), r = f.find((r) => r.tokenHash === e && r.purpose === t && r.consumedAt === null && r.expiresAt.getTime() > n);
+			if (!r) return null;
+			let i = {
+				...r,
+				consumedAt: /* @__PURE__ */ new Date()
+			}, a = f.indexOf(r);
+			return f[a] = i, i;
+		}),
+		latestToken: (e, t) => i.sync(() => {
+			let n = null;
+			for (let r of f) r.userId === e && r.purpose === t && (n === null || r.createdAt.getTime() > n.createdAt.getTime()) && (n = r);
+			return n;
+		}),
+		insertInvitation: (e) => i.sync(() => {
+			let t = {
+				...e,
+				email: e.email.toLowerCase(),
+				acceptedAt: null,
+				acceptedByUserId: null,
+				revokedAt: null,
+				revokedByUserId: null,
+				createdAt: /* @__PURE__ */ new Date()
+			};
+			return h.push(t), t;
+		}),
+		findInvitationByHash: (e) => i.sync(() => h.find((t) => t.tokenHash === e) ?? null),
+		acceptInvitation: (e, t, n) => i.sync(() => {
+			let r = h.findIndex((t) => t.tokenHash === e && t.acceptedAt === null && t.revokedAt === null && t.expiresAt.getTime() > n.getTime());
+			if (r < 0) return null;
+			let i = {
+				...h[r],
+				acceptedAt: n,
+				acceptedByUserId: t
+			};
+			return h[r] = i, i;
+		}),
+		revokeInvitation: (e, t, n, r) => i.sync(() => {
+			let i = h.findIndex((n) => n.id === e && n.tenantId === t && n.acceptedAt === null && n.revokedAt === null);
+			return i < 0 ? !1 : (h[i] = {
+				...h[i],
+				revokedAt: r,
+				revokedByUserId: n
+			}, !0);
+		}),
+		listInvitations: (e) => i.sync(() => h.filter((t) => t.tenantId === e).sort((e, t) => t.createdAt.getTime() - e.createdAt.getTime())),
+		countPendingInvitations: (e, t) => i.sync(() => h.filter((n) => n.tenantId === e && n.acceptedAt === null && n.revokedAt === null && n.expiresAt.getTime() > t.getTime()).length),
+		supersedePendingInvitations: (e, t, n, r) => i.sync(() => {
+			let i = t.toLowerCase(), a = 0;
+			for (let t = 0; t < h.length; t++) {
+				let o = h[t];
+				o.tenantId === e && o.email === i && o.acceptedAt === null && o.revokedAt === null && (h[t] = {
+					...o,
+					revokedAt: r,
+					revokedByUserId: n
+				}, a++);
+			}
+			return a;
+		}),
+		insertImpersonationGrant: (e) => i.sync(() => {
+			let t = {
+				...e,
+				startedAt: /* @__PURE__ */ new Date(),
+				endedAt: null,
+				endedReason: null
+			};
+			return g.push(t), t;
+		}),
+		findImpersonationGrantBySession: (e) => i.sync(() => g.find((t) => t.sessionId === e) ?? null),
+		endImpersonationGrant: (e, t, n) => i.sync(() => {
+			let r = g.findIndex((t) => t.sessionId === e && t.endedAt === null);
+			return r < 0 ? !1 : (g[r] = {
+				...g[r],
+				endedAt: n,
+				endedReason: t
+			}, !0);
+		}),
+		replaceRecoveryCodes: (e, t) => i.sync(() => {
+			for (let t = m.length - 1; t >= 0; t--) m[t].userId === e && m.splice(t, 1);
+			let n = /* @__PURE__ */ new Date();
+			for (let r of t) m.push({
+				id: c("rc"),
+				userId: e,
+				codeHash: r,
+				consumedAt: null,
+				createdAt: n
+			});
+		}),
+		consumeRecoveryCode: (e, t) => i.sync(() => {
+			let n = m.findIndex((n) => n.userId === e && n.codeHash === t && n.consumedAt === null);
+			return n < 0 ? !1 : (m[n] = {
+				...m[n],
+				consumedAt: /* @__PURE__ */ new Date()
+			}, !0);
+		}),
+		countRecoveryCodes: (e) => i.sync(() => m.filter((t) => t.userId === e && t.consumedAt === null).length),
+		listPasskeys: (e) => i.sync(() => p.filter((t) => t.userId === e)),
+		findPasskey: (e) => i.sync(() => p.find((t) => t.credentialId === e) ?? null),
+		insertPasskey: (e) => i.sync(() => {
+			let t = /* @__PURE__ */ new Date(), n = {
+				...e,
+				createdAt: t,
+				lastUsedAt: null
+			};
+			return p.push(n), n;
+		}),
+		advancePasskeyCounter: (e, t) => i.sync(() => {
+			let n = p.findIndex((t) => t.credentialId === e);
+			return n < 0 || t <= p[n].counter ? !1 : (p[n] = {
+				...p[n],
+				counter: t,
+				lastUsedAt: /* @__PURE__ */ new Date()
+			}, !0);
+		}),
+		isLockedOut: (e, t) => i.sync(() => {
+			let n = _.get(e.toLowerCase());
+			return n?.lockedUntil != null && t < n.lockedUntil ? {
+				locked: !0,
+				retryAfterSeconds: Math.ceil((n.lockedUntil - t) / 1e3)
+			} : {
+				locked: !1,
+				retryAfterSeconds: 0
+			};
+		}),
+		recordLoginFailure: (e, t, n) => i.sync(() => {
+			let r = e.toLowerCase(), i = _.get(r), a = i?.windowStartedAt == null || t - i.windowStartedAt >= n.windowMs, o = i?.lockedUntil != null && t >= i.lockedUntil, s = !i || a || o, c = s ? 1 : i.failedCount + 1, l = s ? t : i.windowStartedAt, u = c >= n.maxAttempts ? t + n.lockMs : null;
+			_.set(r, {
+				failedCount: c,
+				windowStartedAt: l,
+				lockedUntil: u
+			});
+		}),
+		clearLoginFailures: (e) => i.sync(() => {
+			_.delete(e.toLowerCase());
+		})
+	};
+}, u = (e, t = {}) => {
+	let n = { ...t.metadata };
+	return t.memberships && (n.memberships = t.memberships.map((e) => ({
+		tenantId: e.tenantId,
+		role: e.role
+	}))), {
+		type: "user",
+		id: e.id,
+		tenantId: t.tenantId ?? e.tenantId,
+		...Object.keys(n).length > 0 ? { metadata: n } : {}
+	};
+}, d = (e) => {
+	if (e.type !== "user") return null;
+	let t = e.metadata?.sessionId;
+	return typeof t == "string" && t.length > 0 ? t : null;
+}, f = (e) => {
+	if (e.type !== "user") return [];
+	let t = e.metadata?.memberships;
+	return Array.isArray(t) ? t.filter((e) => typeof e == "object" && !!e && typeof e.tenantId == "string" && typeof e.role == "string") : [];
+};
+//#endregion
+export { o as UserAlreadyExistsError, s as UserNotFoundError, l as memoryUserStore, c as newAuthId, d as sessionIdOfSubject, u as subjectFromUser, f as subjectMemberships };

package/dist/web/guestStorage.js

@@ -0,0 +1,47 @@
+//#region src/web/guestStorage.ts
+var e = (e) => {
+	if (!e.trim()) throw Error("Guest storage requires an app namespace");
+	let t = (t, n) => new Promise((r, i) => {
+		let a = !1, o = globalThis.indexedDB.open("voltro:guest:" + e, 1);
+		o.onupgradeneeded = () => {
+			o.result.createObjectStore("credentials");
+		}, o.onerror = () => i(/* @__PURE__ */ Error("Guest IndexedDB unavailable")), o.onblocked = () => {
+			a = !0, i(/* @__PURE__ */ Error("Guest IndexedDB blocked"));
+		}, o.onsuccess = () => {
+			let e = o.result;
+			if (a) {
+				e.close();
+				return;
+			}
+			let s, c;
+			try {
+				s = e.transaction("credentials", t), c = n(s.objectStore("credentials"));
+			} catch {
+				e.close(), i(/* @__PURE__ */ Error("Guest IndexedDB transaction unavailable"));
+				return;
+			}
+			s.oncomplete = () => {
+				e.close(), r(c.result);
+			}, s.onerror = s.onabort = () => {
+				e.close(), i(/* @__PURE__ */ Error("Guest IndexedDB transaction failed"));
+			};
+		};
+	});
+	return {
+		exclusive: (t) => globalThis.navigator?.locks ? globalThis.navigator.locks.request("voltro:guest:" + e, t) : Promise.reject(/* @__PURE__ */ Error("Guest cross-tab locking unavailable")),
+		read: async () => {
+			let e = await t("readonly", (e) => e.get("device"));
+			if (e === void 0) return null;
+			if (typeof e != "string" || !e) throw Error("Guest IndexedDB credential invalid");
+			return e;
+		},
+		write: async (e) => {
+			await t("readwrite", (t) => t.put(e, "device"));
+		},
+		remove: async () => {
+			await t("readwrite", (e) => e.delete("device"));
+		}
+	};
+};
+//#endregion
+export { e as indexedDbGuestStore };

package/dist/web/passkeyClient.js

@@ -0,0 +1,78 @@
+//#region src/web/passkeyClient.ts
+var e = (e) => {
+	let t = new Uint8Array(e), n = "";
+	for (let e of t) n += String.fromCharCode(e);
+	return btoa(n).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}, t = (e) => {
+	let t = e.replace(/-/g, "+").replace(/_/g, "/") + "=".repeat((4 - e.length % 4) % 4), n = atob(t), r = new Uint8Array(n.length);
+	for (let e = 0; e < n.length; e++) r[e] = n.charCodeAt(e);
+	return r.buffer;
+}, n = () => typeof window < "u" && window.PublicKeyCredential !== void 0 && typeof navigator < "u" && !!navigator.credentials, r = async (e, t, n) => await (await (n.fetchImpl ?? fetch)(e, {
+	method: "POST",
+	credentials: "include",
+	headers: {
+		"content-type": "application/json",
+		...n.csrfToken ? { "x-csrf-token": n.csrfToken } : {}
+	},
+	body: JSON.stringify(t)
+})).json(), i = async (i, a = {}) => {
+	if (!n()) throw Error("passkeys not supported in this browser");
+	let o = a.basePath ?? "/auth", s = await r(`${o}/passkey/register/options`, i, a), c = s.challenge, l = s.rp, u = s.user, d = s.excludeCredentials ?? [], f = await navigator.credentials.create({ publicKey: {
+		challenge: t(c),
+		rp: l,
+		user: {
+			id: new TextEncoder().encode(u.id),
+			name: u.name,
+			displayName: u.displayName
+		},
+		pubKeyCredParams: [{
+			type: "public-key",
+			alg: -7
+		}, {
+			type: "public-key",
+			alg: -257
+		}],
+		excludeCredentials: d.map((e) => ({
+			type: "public-key",
+			id: t(e.id)
+		})),
+		authenticatorSelection: {
+			userVerification: "preferred",
+			residentKey: "preferred"
+		},
+		timeout: 3e5
+	} });
+	if (!f) throw Error("credential creation was cancelled");
+	let p = f.response, m = typeof p.getAuthenticatorData == "function" ? p.getAuthenticatorData() : /* @__PURE__ */ new ArrayBuffer(0), h = await r(`${o}/passkey/register/verify`, {
+		userId: i.userId,
+		credentialId: e(f.rawId),
+		clientDataJSON: e(p.clientDataJSON),
+		authenticatorData: e(m)
+	}, a);
+	if (!h.ok) throw Error(`passkey registration failed: ${String(h.error)}`);
+	return { credentialId: h.credentialId };
+}, a = async (i = {}, a = {}) => {
+	if (!n()) throw Error("passkeys not supported in this browser");
+	let o = a.basePath ?? "/auth", s = await r(`${o}/passkey/assert/options`, i.userId ? { userId: i.userId } : {}, a), c = s.challenge, l = s.rpId, u = s.allowCredentials ?? [], d = await navigator.credentials.get({ publicKey: {
+		challenge: t(c),
+		rpId: l,
+		allowCredentials: u.map((e) => ({
+			type: "public-key",
+			id: t(e.id)
+		})),
+		userVerification: "preferred",
+		timeout: 3e5
+	} });
+	if (!d) throw Error("assertion was cancelled");
+	let f = d.response, p = await r(`${o}/passkey/assert/verify`, {
+		credentialId: e(d.rawId),
+		clientDataJSON: e(f.clientDataJSON),
+		authenticatorData: e(f.authenticatorData),
+		signature: e(f.signature),
+		...i.userId ? { userId: i.userId } : {}
+	}, a);
+	if (!p.ok) throw Error(`passkey sign-in failed: ${String(p.error)}`);
+	return { subject: p.subject };
+};
+//#endregion
+export { n as isPasskeySupported, i as registerPasskey, a as signInWithPasskey };

package/dist/web/requireAuth.js

@@ -0,0 +1,9 @@
+import { useOptionalSubject as e } from "./subjectContext.js";
+import { Fragment as t, jsx as n } from "react/jsx-runtime";
+//#region src/web/requireAuth.tsx
+var r = ({ children: r, fallback: i }) => {
+	let a = e();
+	return a ? typeof r == "function" ? /* @__PURE__ */ n(t, { children: r(a) }) : /* @__PURE__ */ n(t, { children: r }) : /* @__PURE__ */ n(t, { children: i });
+};
+//#endregion
+export { r as RequireAuth };

package/dist/web/subjectContext.js

@@ -0,0 +1,13 @@
+import { createContext as e, useContext as t } from "react";
+import { jsx as n } from "react/jsx-runtime";
+//#region src/web/subjectContext.tsx
+var r = e(null), i = ({ subject: e, children: t }) => /* @__PURE__ */ n(r.Provider, {
+	value: e,
+	children: t
+}), a = () => {
+	let e = t(r);
+	if (!e) throw Error("useSubject() called without a signed-in user. Use useOptionalSubject() or wrap the consumer in <RequireAuth>.");
+	return e;
+}, o = () => t(r);
+//#endregion
+export { i as SubjectProvider, o as useOptionalSubject, a as useSubject };

package/dist/web.d.ts

@@ -1,5 +1,99 @@
 import { ReactNode } from 'react';
 import { Subject } from '@voltro/protocol';
+import { SubjectIdentity } from '@voltro/protocol';
+
+/** Serializes operations in one client. A rejected existing credential never
+ * creates a replacement identity. Storage failures never enable memory fallback. */
+export declare const createGuestClient: (options: GuestClientOptions) => {
+    connect: () => Promise<GuestClientSession>;
+    /** Prepare without replacing the active proof, persist both proofs, then
+     * commit. A later connect recovers the same identity after a lost response. */
+    rotate: () => Promise<GuestClientSession>;
+    /** Revoke on the server first. Keep the durable proof on transport failure
+     * so the caller can retry; erase locally only after confirmed revocation. */
+    revoke: () => Promise<void>;
+    /** Turn this guest into an email/password account under the same subject ID
+     * (`authRoutesPlugin({ guestUpgrade })`). The device proof is erased only after the
+     * server confirmed the account; on any refusal or transport failure it stays. */
+    upgrade: (input: {
+        readonly email: string;
+        readonly password: string;
+    }) => Promise<{
+        readonly subject: unknown;
+    }>;
+    /** The registered account signed in on this device (cookie clients), or null. */
+    account: () => Promise<GuestClientAccount | null>;
+    /** The signed-in account if there is one, else this device's guest (resumed or created once).
+     * The usual entry for a game that offers accounts: a reload after `upgrade` or `signIn` stays the account. */
+    start: () => Promise<GuestClientPlayer>;
+    /** Sign in to an existing account with email and password (`authRoutesPlugin`), e.g. on a second
+     * device. This device's guest proof stays: after `signOut`, `start` resumes that guest. */
+    signIn: (input: {
+        readonly email: string;
+        readonly password: string;
+    }) => Promise<GuestClientAccount>;
+    /** End the account session on the server and clear its cookie. */
+    signOut: () => Promise<void>;
+};
+
+/** A registered account signed in on this device (by upgrade or sign-in), through the session cookie. */
+export declare interface GuestClientAccount {
+    readonly subject: Extract<SubjectIdentity, {
+        readonly type: 'user';
+    }>;
+}
+
+export declare class GuestClientError extends Error {
+    readonly code: 'storage_unavailable' | 'credential_rejected' | 'upgrade_conflict' | 'account_signed_in' | 'transport_failed' | 'invalid_response';
+    readonly status?: number | undefined;
+    constructor(code: 'storage_unavailable' | 'credential_rejected' | 'upgrade_conflict' | 'account_signed_in' | 'transport_failed' | 'invalid_response', status?: number | undefined);
+}
+
+export declare interface GuestClientOptions {
+    readonly apiBaseUrl: string;
+    readonly storage: GuestCredentialStore;
+    readonly prefix?: string;
+    readonly fetch?: typeof globalThis.fetch;
+    /** Web clients include cookies and obtain a signed CSRF token for each post. */
+    readonly cookies?: boolean;
+    /** Prefix of the app's auth routes, for `upgrade`, `account`, `signIn` and `signOut` (default `/auth`). */
+    readonly accountPrefix?: string;
+}
+
+/** What `start` found: the signed-in account, else this device's guest. */
+export declare type GuestClientPlayer = {
+    readonly kind: 'account';
+    readonly subject: GuestClientAccount['subject'];
+} | {
+    readonly kind: 'guest';
+    readonly subject: GuestClientSession['subject'];
+    readonly session: string;
+};
+
+export declare interface GuestClientSession {
+    readonly subject: Extract<SubjectIdentity, {
+        readonly type: 'user';
+    }> & {
+        readonly kind: 'guest';
+    };
+    readonly session: string;
+}
+
+/** Platform-backed durable secret storage. Native implementations use the
+ * operating system's secure store; writes resolve only after persistence. */
+export declare interface GuestCredentialStore {
+    /** Serialize the whole read/create/write operation across users of this
+     * namespace, including other browser tabs or native client instances. */
+    readonly exclusive: <A>(work: () => Promise<A>) => Promise<A>;
+    readonly read: () => Promise<string | null>;
+    /** Persist the opaque value, including an in-progress rotation journal. */
+    readonly write: (value: string) => Promise<void>;
+    readonly remove: () => Promise<void>;
+}
+
+/** IndexedDB is the web device-proof store. Missing/blocked storage rejects;
+ * there is deliberately no localStorage or volatile substitute. */
+export declare const indexedDbGuestStore: (namespace: string) => GuestCredentialStore;
 
 /** True when this browser can do WebAuthn at all. */
 export declare const isPasskeySupported: () => boolean;

package/dist/web.js

@@ -1,90 +1,6 @@
-import { createContext as e, useContext as t } from "react";
-import { Fragment as n, jsx as r } from "react/jsx-runtime";
-//#region src/web/subjectContext.tsx
-var i = e(null), a = ({ subject: e, children: t }) => /* @__PURE__ */ r(i.Provider, {
-	value: e,
-	children: t
-}), o = () => {
-	let e = t(i);
-	if (!e) throw Error("useSubject() called without a signed-in user. Use useOptionalSubject() or wrap the consumer in <RequireAuth>.");
-	return e;
-}, s = () => t(i), c = ({ children: e, fallback: t }) => {
-	let i = s();
-	return i ? typeof e == "function" ? /* @__PURE__ */ r(n, { children: e(i) }) : /* @__PURE__ */ r(n, { children: e }) : /* @__PURE__ */ r(n, { children: t });
-}, l = (e) => {
-	let t = new Uint8Array(e), n = "";
-	for (let e of t) n += String.fromCharCode(e);
-	return btoa(n).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-}, u = (e) => {
-	let t = e.replace(/-/g, "+").replace(/_/g, "/") + "=".repeat((4 - e.length % 4) % 4), n = atob(t), r = new Uint8Array(n.length);
-	for (let e = 0; e < n.length; e++) r[e] = n.charCodeAt(e);
-	return r.buffer;
-}, d = () => typeof window < "u" && window.PublicKeyCredential !== void 0 && typeof navigator < "u" && !!navigator.credentials, f = async (e, t, n) => await (await (n.fetchImpl ?? fetch)(e, {
-	method: "POST",
-	credentials: "include",
-	headers: {
-		"content-type": "application/json",
-		...n.csrfToken ? { "x-csrf-token": n.csrfToken } : {}
-	},
-	body: JSON.stringify(t)
-})).json(), p = async (e, t = {}) => {
-	if (!d()) throw Error("passkeys not supported in this browser");
-	let n = t.basePath ?? "/auth", r = await f(`${n}/passkey/register/options`, e, t), i = r.challenge, a = r.rp, o = r.user, s = r.excludeCredentials ?? [], c = await navigator.credentials.create({ publicKey: {
-		challenge: u(i),
-		rp: a,
-		user: {
-			id: new TextEncoder().encode(o.id),
-			name: o.name,
-			displayName: o.displayName
-		},
-		pubKeyCredParams: [{
-			type: "public-key",
-			alg: -7
-		}, {
-			type: "public-key",
-			alg: -257
-		}],
-		excludeCredentials: s.map((e) => ({
-			type: "public-key",
-			id: u(e.id)
-		})),
-		authenticatorSelection: {
-			userVerification: "preferred",
-			residentKey: "preferred"
-		},
-		timeout: 3e5
-	} });
-	if (!c) throw Error("credential creation was cancelled");
-	let p = c.response, m = typeof p.getAuthenticatorData == "function" ? p.getAuthenticatorData() : /* @__PURE__ */ new ArrayBuffer(0), h = await f(`${n}/passkey/register/verify`, {
-		userId: e.userId,
-		credentialId: l(c.rawId),
-		clientDataJSON: l(p.clientDataJSON),
-		authenticatorData: l(m)
-	}, t);
-	if (!h.ok) throw Error(`passkey registration failed: ${String(h.error)}`);
-	return { credentialId: h.credentialId };
-}, m = async (e = {}, t = {}) => {
-	if (!d()) throw Error("passkeys not supported in this browser");
-	let n = t.basePath ?? "/auth", r = await f(`${n}/passkey/assert/options`, e.userId ? { userId: e.userId } : {}, t), i = r.challenge, a = r.rpId, o = r.allowCredentials ?? [], s = await navigator.credentials.get({ publicKey: {
-		challenge: u(i),
-		rpId: a,
-		allowCredentials: o.map((e) => ({
-			type: "public-key",
-			id: u(e.id)
-		})),
-		userVerification: "preferred",
-		timeout: 3e5
-	} });
-	if (!s) throw Error("assertion was cancelled");
-	let c = s.response, p = await f(`${n}/passkey/assert/verify`, {
-		credentialId: l(s.rawId),
-		clientDataJSON: l(c.clientDataJSON),
-		authenticatorData: l(c.authenticatorData),
-		signature: l(c.signature),
-		...e.userId ? { userId: e.userId } : {}
-	}, t);
-	if (!p.ok) throw Error(`passkey sign-in failed: ${String(p.error)}`);
-	return { subject: p.subject };
-};
-//#endregion
-export { c as RequireAuth, a as SubjectProvider, d as isPasskeySupported, p as registerPasskey, m as signInWithPasskey, s as useOptionalSubject, o as useSubject };
+import { SubjectProvider as e, useOptionalSubject as t, useSubject as n } from "./web/subjectContext.js";
+import { RequireAuth as r } from "./web/requireAuth.js";
+import { GuestClientError as i, createGuestClient as a } from "./guestClient.js";
+import { indexedDbGuestStore as o } from "./web/guestStorage.js";
+import { isPasskeySupported as s, registerPasskey as c, signInWithPasskey as l } from "./web/passkeyClient.js";
+export { i as GuestClientError, r as RequireAuth, e as SubjectProvider, a as createGuestClient, o as indexedDbGuestStore, s as isPasskeySupported, c as registerPasskey, l as signInWithPasskey, t as useOptionalSubject, n as useSubject };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voltro/plugin-auth",
-  "version": "0.85.0",
+  "version": "0.87.0",
   "description": "Authentication primitives: password hashing, session creation, schema mixin + tables. Pairs with the `auth` app template for the UI; both independently usable. Server-side only (uses node:crypto).",
   "keywords": [
     "voltro",
@@ -73,6 +73,11 @@
       "import": "./dist/native.js",
       "default": "./dist/native.js"
     },
+    "./guest": {
+      "types": "./dist/guest.d.ts",
+      "import": "./dist/guest.js",
+      "default": "./dist/guest.js"
+    },
     "./package.json": "./package.json"
   },
   "main": "./dist/index.js",
@@ -83,8 +88,8 @@
     "node": ">=24.0.0"
   },
   "dependencies": {
-    "@voltro/database": "0.85.0",
-    "@voltro/protocol": "0.85.0"
+    "@voltro/database": "0.87.0",
+    "@voltro/protocol": "0.87.0"
   },
   "peerDependencies": {
     "effect": "4.0.1",