@voltro/plugin-auth 0.85.0 → 0.87.0

package/dist/index.d.ts

@@ -1,13 +1,17 @@
 import { AuthStrategy } from '@voltro/protocol';
+import { ColumnBuilder } from '@voltro/database';
 import { ConnectionCredential } from '@voltro/protocol';
 import { DataStore } from '@voltro/database';
+import { Duration } from 'effect';
 import { Effect } from 'effect';
+import { FieldDefinitions } from '@voltro/database';
 import { KeyedSecret } from '@voltro/protocol/session';
 import { MembershipsSource } from '@voltro/protocol';
 import { SessionSecrets } from '@voltro/protocol/session';
 import { SqlClient } from 'effect/sql/SqlClient';
 import { Subject } from '@voltro/protocol';
 import { SubjectIdentity } from '@voltro/protocol';
+import { Table } from '@voltro/database';
 import { VerifyOptions } from '@voltro/protocol/session';
 import { VerifyResult } from '@voltro/protocol/session';
 import { VoidIfEmpty } from 'effect/Types';
@@ -42,6 +46,9 @@ export declare interface AdmissionRefusal {
 /** Decide whether a person may join a tenant — `null` to let them in. */
 export declare type AdmitJoining = (joining: Joining, context: AdmissionContext) => Effect.Effect<AdmissionRefusal | null> | Promise<AdmissionRefusal | null>;
 
+/** The page a ticket may open: same-origin, below an allowed path, no traversal. */
+export declare const allowedOverlayPage: (next: string, paths: ReadonlyArray<string>) => boolean;
+
 /**
  * Keep users in the app's own database.
  *
@@ -83,6 +90,16 @@ export declare interface AssertionVerifyInput {
     readonly storedCounter: number;
 }
 
+/** General authentication extensions; install `auth.guest(...)` or `auth.overlay(...)` in plugins. */
+export declare const auth: {
+    readonly guest: (options: GuestPluginOptions) => GuestAuthPlugin;
+    readonly overlay: (options: OverlayPluginOptions) => VoltroPlugin;
+};
+
+/** Non-session handoffs have separate signature domains. A signed OAuth
+ * cookie must never become a native login code or a registered session. */
+export declare type AuthClaimsPurpose = 'native-pending' | 'native-code' | 'social-login' | 'social-upgrade' | 'social-native-upgrade' | 'account-merge';
+
 export declare interface AuthConfig {
     /**
      * The session-signing key. OMIT IT and the value is read from
@@ -175,6 +192,27 @@ export declare interface AuthConfig {
     readonly emailVerification?: EmailVerificationConfig;
 }
 
+/** Device credentials never appear in SQL, logs, exports or session claims. */
+export declare const authGuestDevicesTable: Table<"authGuestDevices", FieldDefinitions<{
+    readonly id: ColumnBuilder<string, "id", boolean>;
+    readonly guestId: ColumnBuilder<string, "text", boolean>;
+    readonly tenantId: ColumnBuilder<string, "text", boolean>;
+    readonly secretHash: ColumnBuilder<string, "text", boolean>;
+    readonly generation: ColumnBuilder<number, "integer", boolean>;
+    readonly expiresAt: ColumnBuilder<Date, "timestamp", boolean>;
+    readonly createdAt: ColumnBuilder<Date, "timestamp", boolean>;
+}>, true, never>;
+
+/** Guest identity is independent of the password user's email record. */
+export declare const authGuestsTable: Table<"authGuests", FieldDefinitions<{
+    readonly id: ColumnBuilder<string, "id", boolean>;
+    readonly tenantId: ColumnBuilder<string, "text", boolean>;
+    readonly upgradeable: ColumnBuilder<boolean, "boolean", boolean>;
+    readonly expiresAt: ColumnBuilder<Date, "timestamp", boolean>;
+    readonly createdAt: ColumnBuilder<Date, "timestamp", boolean>;
+    readonly lastSeenAt: ColumnBuilder<Date, "timestamp", boolean>;
+}>, true, never>;
+
 export declare const authMemberships: (store: UserStore) => MembershipsSource;
 
 /**
@@ -183,7 +221,7 @@ export declare const authMemberships: (store: UserStore) => MembershipsSource;
  * routes use) so the framework's serve pipeline can slot it into the
  * per-app auth chain — the rpc/WS path then rejects revoked sessions
  * exactly like the `/auth/*` routes. Read it via
- * `getAuthSessionStrategy`.
+ * `getAuthSessionStrategies`.
  */
 export declare interface AuthPlugin extends VoltroPlugin {
     readonly auth: {
@@ -233,6 +271,15 @@ export declare interface AuthRoutesPluginOptions extends AuthConfig {
      * otherwise get 500s from a route it never asked for.
      */
     readonly invitations?: InvitationsConfig;
+    /**
+     * Guest → account with email and password. PRESENT mounts `POST /auth/upgrade-guest`
+     * (`{ credential, email, password }`, CSRF): the guest becomes a registered account under its
+     * own subject ID, so what it owns stays its own. Pass the installed guest lifecycle port,
+     * e.g. `{ service: () => guestPlugin.guest.service() }`. ABSENT mounts nothing.
+     */
+    readonly guestUpgrade?: {
+        readonly service: () => GuestAuthService;
+    };
     /**
      * User impersonation ("log in as"). PRESENT mounts `/auth/impersonate/start`
      * + `/stop`, arms the retention bound on `impersonationGrants`, and closes
@@ -267,6 +314,10 @@ export declare interface ChallengeStore {
  */
 export declare const clearSessionCookie: (options?: IssueSessionOptions) => string;
 
+/** Upgrade the presented guest to an email/password account under the same subject ID. An email
+ * that already has an account refuses (`email_taken`); this never merges accounts. */
+export declare const completeGuestPasswordUpgrade: (options: GuestPasswordUpgradeOptions) => Effect.Effect<GuestPasswordUpgradeResult>;
+
 /** The keyed secret set a handler signs/verifies with — the explicit
  *  `config.secrets` when set, else `config.secret` widened with the
  *  rotation env vars. */
@@ -304,13 +355,17 @@ export declare const CSRF_HEADER_NAME: "x-csrf-token";
  */
 export declare const dataStoreChallengeStore: (sql: SqlClient) => ChallengeStore;
 
+/** Uses the app's existing DataStore and session issuer. Device proof grants
+ * guest identity only; provider linking is a separate trusted-account operation. */
+export declare const dataStoreGuestAuth: (store: DataStore, options: GuestAuthOptions) => GuestAuthService;
+
 /**
  * Session rows in the app's own database — the `sessions` table from
  * `@voltro/plugin-auth/schema`, which the app registers like any other. Reads
  * and writes go through the store the framework opened, so there is no second
  * pool and no second schema.
  */
-export declare const dataStoreSessionRegistry: (store: DataStore) => SessionRegistry;
+export declare const dataStoreSessionRegistry: (store: DataStore, options?: SessionRegistryStoreOptions) => SessionRegistry;
 
 /** Default set of roles allowed to invite at all. */
 export declare const DEFAULT_INVITER_ROLES: ReadonlyArray<string>;
@@ -450,11 +505,12 @@ export declare const generateTotpCode: (secretBase32: string, nowMs?: number) =>
 export declare const generateTotpSecret: () => string;
 
 /**
- * Pull the pre-wired session strategy off a plugin list (the framework's
- * serve pipeline calls this when composing the auth chain). Returns the
- * FIRST auth plugin's strategy, or null when no auth plugin is present.
+ * Collect pre-wired session strategies in plugin declaration order. The
+ * framework inserts each original strategy into its shared auth chain, so
+ * prefix ordering, collision diagnostics and boot verification see them all.
+ * Only `skip` advances; rejected credentials never get another attempt.
  */
-export declare const getAuthSessionStrategy: (plugins: ReadonlyArray<VoltroPlugin>) => AuthStrategy | null;
+export declare const getAuthSessionStrategies: (plugins: ReadonlyArray<VoltroPlugin>) => ReadonlyArray<AuthStrategy>;
 
 export declare interface GrantRoleContext {
     /** The inviter's role in THIS tenant, as read from `memberships`. */
@@ -477,6 +533,149 @@ export declare interface GrantRoleContext {
  */
 export declare const guardSubject: (user: UserRecord, config: AuthConfig) => Effect.Effect<HandlerResult | null>;
 
+export declare class GuestAuthError extends GuestAuthError_base<{
+    readonly code: 'credential_rejected' | 'store_unavailable' | 'upgrade_conflict';
+}> {
+}
+
+declare const GuestAuthError_base: new <A extends Record<string, any> = {}>(args: VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => YieldableError & {
+    readonly _tag: "GuestAuthError";
+} & Readonly<A>;
+
+export declare interface GuestAuthOptions {
+    /** Server-owned tenant selection; never copied from a device or request body. */
+    readonly tenantId: string;
+    readonly secret: SessionSecretInput | (() => SessionSecretInput);
+    readonly upgradeable?: boolean;
+    readonly ttlSeconds?: number;
+    readonly sessionTtlSeconds?: number;
+    readonly secure?: boolean;
+    readonly now?: () => number;
+}
+
+export declare interface GuestAuthPlugin extends AuthPlugin {
+    readonly guest: {
+        /** Server-side lifecycle/privacy port, available after normal store binding. */
+        readonly service: () => GuestAuthService;
+    };
+}
+
+export declare const guestAuthPlugin: (options: GuestPluginOptions) => GuestAuthPlugin;
+
+/** Durable guest lifecycle port. Implementations must serialize every write
+ * against the guest identity and commit session rows before returning credentials. */
+export declare interface GuestAuthService {
+    readonly create: () => Effect.Effect<GuestSession, GuestAuthError>;
+    readonly resume: (credential: string) => Effect.Effect<GuestSession, GuestAuthError>;
+    /** Propose a fresh server-minted proof without replacing the active proof. */
+    readonly prepareRotation: (credential: string) => Effect.Effect<{
+        readonly deviceCredential: string;
+    }, GuestAuthError>;
+    /** The caller durably journals both proofs before this atomic replacement. */
+    readonly rotate: (credential: string, nextCredential: string) => Effect.Effect<GuestSession, GuestAuthError>;
+    readonly revoke: (credential: string) => Effect.Effect<void, GuestAuthError>;
+    /** Server-side privacy hook: the caller must authorize this subject ID. */
+    readonly erase: (subjectId: string) => Effect.Effect<boolean, GuestAuthError>;
+    /** Server-side privacy hook: excludes credential hashes and credential bytes. */
+    readonly export: (subjectId: string) => Effect.Effect<GuestExport | null, GuestAuthError>;
+    readonly isLive: (subject: SubjectIdentity) => Effect.Effect<boolean, GuestAuthError>;
+    /** Trusted server operation. The writer must use this transaction to create
+     * the registered `users` row with exactly the guest ID and tenant. The guest
+     * fence, writer, device removal and guest-session revocation commit together.
+     * No client-supplied kind/state can authorize an upgrade. */
+    readonly upgrade: <A>(credential: string, writer: GuestUpgradeWriter<A>) => Effect.Effect<A, GuestAuthError>;
+    /** Trusted, separately confirmed merge into an EXISTING registered subject.
+     * The coordinator must prove target ownership and run all data hooks through
+     * this same transaction. A device proof alone never proves target ownership. */
+    readonly mergeInto: <A>(credential: string, targetId: string, writer: GuestMergeWriter<A>) => Effect.Effect<A, GuestAuthError>;
+}
+
+export declare interface GuestExport {
+    readonly subject: {
+        readonly id: string;
+        readonly tenantId: string;
+        readonly kind: 'guest';
+        readonly upgradeable: boolean;
+        readonly createdAt: number;
+        readonly expiresAt: number;
+    };
+    readonly devices: ReadonlyArray<{
+        readonly id: string;
+        readonly generation: number;
+        readonly createdAt: number;
+        readonly expiresAt: number;
+    }>;
+    readonly sessions: ReadonlyArray<{
+        readonly id: string;
+        readonly expiresAt: number;
+    }>;
+}
+
+export declare type GuestIdentity = Extract<SubjectIdentity, {
+    readonly type: 'user';
+}> & {
+    readonly kind: 'guest';
+};
+
+export declare interface GuestMergeContext extends GuestUpgradeContext {
+    readonly targetId: string;
+}
+
+export declare type GuestMergeWriter<A> = (context: GuestMergeContext) => Promise<A>;
+
+export declare interface GuestPasswordUpgradeOptions {
+    /** The guest's device proof, as the guest client presents it. */
+    readonly credential: string;
+    readonly email: string;
+    readonly password: string;
+    /** The installed guest lifecycle port (`guestPlugin.guest.service()`). */
+    readonly service: GuestAuthService;
+    readonly users: UserStore;
+    readonly config: AuthConfig;
+    readonly ipAddress?: string | null;
+    readonly userAgent?: string | null;
+}
+
+export declare type GuestPasswordUpgradeResult = {
+    readonly kind: 'ok';
+    readonly userId: string;
+    readonly subject: unknown;
+    readonly setCookie: string;
+} | {
+    readonly kind: 'refused';
+    readonly status: number;
+    readonly code: string;
+    readonly message: string;
+};
+
+export declare interface GuestPluginOptions {
+    /** Server-owned tenant, required; client headers and device proof cannot pick it. */
+    readonly tenantId: string;
+    readonly upgradeable?: boolean;
+    readonly ttl?: Duration.Input;
+    readonly sessionTtl?: Duration.Input;
+    readonly secret?: SessionSecretInput;
+    readonly secure?: boolean;
+    readonly prefix?: string;
+    /** Inject a complete durable lifecycle port; never an ephemeral credential fallback. */
+    readonly service?: (store: DataStore) => GuestAuthService;
+}
+
+export declare interface GuestSession extends IssuedRegisteredSession {
+    readonly subject: GuestIdentity;
+    /** Opaque proof returned only on creation or explicit credential rotation. */
+    readonly deviceCredential?: string;
+}
+
+export declare interface GuestUpgradeContext {
+    readonly store: DataStore;
+    readonly subjectId: string;
+    readonly tenantId: string;
+    readonly createdAt: Date;
+}
+
+export declare type GuestUpgradeWriter<A> = (context: GuestUpgradeContext) => Promise<A>;
+
 /**
  * Accept an invitation as an ALREADY-AUTHENTICATED user.
  *
@@ -1234,11 +1433,6 @@ export declare interface IssuedSession {
     readonly setCookie: string;
 }
 
-/**
- * `issueSession` with a row behind it: writes the session to the registry,
- * stamps its id into the cookie and signs. A cookie issued here can be killed
- * before its `exp`; one issued with plain `issueSession` cannot.
- */
 export declare const issueRegisteredSession: (registry: Pick<SessionRegistry, "insertSession">, subject: Subject | SubjectIdentity, secret: SessionSecretInput, options?: IssueRegisteredSessionOptions) => Promise<IssuedRegisteredSession>;
 
 export declare interface IssueRegisteredSessionOptions extends IssueSessionOptions {
@@ -1375,6 +1569,13 @@ export declare interface LockoutStore {
     readonly clearLoginFailures: (email: string) => Effect.Effect<void>;
 }
 
+/** Read an owned, unrotated credential under its canonical family fence.
+ * Call only inside the caller's existing transaction, after any application
+ * account/tenant fences. Locks remain held until that transaction ends. This
+ * checks persistence identity, not the signed credential, expiry or permissions.
+ * Locking-read conflicts follow the selected store's transaction semantics. */
+export declare const lockRegisteredSession: (store: DataStore, userId: string, sessionId: string) => Promise<SessionRecord | null>;
+
 /** Default magic-link lifetime — short, since it's an inbox round-trip. */
 export declare const MAGIC_LINK_TTL_S: number;
 
@@ -1616,6 +1817,32 @@ export declare const otpauthUrl: (params: {
     readonly secret: string;
 }) => string;
 
+/**
+ * Mount the web overlay handoff: an engine client trades its header session
+ * for a one-time URL that signs an embedded browser in to `paths` of the web
+ * app with the same session row. Install as `auth.overlay({ paths: ['/overlay'] })`.
+ */
+export declare const overlayAuthPlugin: (options: OverlayPluginOptions) => VoltroPlugin;
+
+/** Options of `auth.overlay(...)`, the web overlay handoff for engine clients. */
+export declare interface OverlayPluginOptions {
+    /** Pages a ticket may open, e.g. `['/overlay']`. A page is allowed when its
+     *  path equals one of these or lies below it. Required: the handoff signs
+     *  the embedded browser in, so it lands only where the app expects it. */
+    readonly paths: ReadonlyArray<string>;
+    /** Lifetime of a ticket. Default 60 seconds, at most 5 minutes. */
+    readonly ttl?: Duration.Input;
+    /** Signing keys of the sessions this handoff accepts. Default: the
+     *  project's `VOLTRO_SESSION_SECRET` (and `_PREVIOUS`). */
+    readonly secret?: SessionSecretInput;
+    /** `Secure` on the cookie. Default `true`; `false` only for plain-http development. */
+    readonly secure?: boolean;
+    /** Cookie `Domain`, when the web app and the API share a parent domain. */
+    readonly domain?: string;
+    /** Route prefix. Default `/auth/overlay`. */
+    readonly prefix?: string;
+}
+
 declare interface ParsedHash {
     readonly N: number;
     readonly r: number;
@@ -1623,6 +1850,13 @@ declare interface ParsedHash {
     readonly keyLen: number;
 }
 
+/** Browser-safe shape only. Possession is verified against SQL on the server. */
+export declare const parseGuestCredential: (credential: string) => {
+    readonly guestId: string;
+    readonly deviceId: string;
+    readonly secret: string;
+} | null;
+
 /** Parse the scrypt parameters out of a stored hash. Returns null when the
  *  string isn't a well-formed `scrypt$N$r$p$salt$derived`, or when its
  *  parameters exceed the derivation ceiling. */
@@ -1799,6 +2033,9 @@ export declare interface RecoveryCodeRecord {
     readonly createdAt: Date;
 }
 
+export declare interface RegisteredSessionRotationOptions extends IssueRegisteredSessionOptions, SessionRegistryStoreOptions {
+}
+
 export declare type RegistrationOutcome = {
     readonly ok: true;
     readonly result: RegistrationResult;
@@ -1846,6 +2083,11 @@ declare interface RevokeSessionInput {
     readonly sessionId: string;
 }
 
+/** Rotate one live credential atomically. Retained inactive aliases let
+ * sign-out using an earlier signed cookie revoke this device's successor.
+ * The caller must separately validate current account and tenant authority. */
+export declare const rotateRegisteredSession: (store: DataStore, subject: Subject | SubjectIdentity, presentedSessionId: string, secret: SessionSecretInput, options?: RegisteredSessionRotationOptions) => Promise<IssuedRegisteredSession | null>;
+
 /**
  * Run the guards in order against `user`, short-circuiting on the FIRST
  * rejection. With no guards (or all allowing) it resolves `{ ok: true }`.
@@ -1891,6 +2133,10 @@ export declare const sessionIdOfSubject: (subject: Subject) => string | null;
 /** A server-side session row — enumerated so apps can list active
  *  devices + revoke them. Written on sign-in; deleted on revoke. */
 export declare interface SessionRecord {
+    /** Stable device lineage. The original row is its transaction lock anchor. */
+    readonly familyId?: string | null;
+    /** A replaced credential remains an inert revocation alias until the device ends. */
+    readonly rotatedAt?: Date | null;
     readonly id: string;
     readonly userId: string;
     readonly tenantId: string;
@@ -1905,11 +2151,19 @@ export declare interface SessionRecord {
  *  `UserStore`, usable without the rest of it. */
 export declare type SessionRegistry = SessionStore;
 
+export declare interface SessionRegistryStoreOptions {
+    /** Borrow an already owned transaction; otherwise registry writes open one.
+     * Account-wide revocation needs the application's real owner fence. With an
+     * older repeatable-read snapshot, root issuance must also change that owner's
+     * persisted revision so a conflicting old transaction retries or aborts. */
+    readonly transaction?: 'existing';
+}
+
 export declare interface SessionRevocationChecker {
-    /** Is this session still live? `false` means the row was revoked (or
-     *  is past its `expiresAt`) — the caller rejects the cookie. Verdicts
-     *  are cached for `ttlMs`. */
-    readonly isLive: (sessionId: string) => Effect.Effect<boolean>;
+    /** Is this exact session credential live for the signed subject's user ID?
+     * Refuse a missing/rotated/expired row or a different stored owner. Cache
+     * verdicts retain native owner identity, never the requested owner. */
+    readonly isLiveFor: (sessionId: string, userId: string) => Effect.Effect<boolean>;
     /** Drop the cached verdict for one session — called inline by
      *  sign-out / revoke handlers so the kill is immediate on THIS
      *  process (other replicas converge within `ttlMs`). */
@@ -1955,13 +2209,14 @@ export declare const sessionSecretsOf: (secret: SessionSecretInput) => SessionSe
 
 /** Server-side sessions — enumeration + revocation. */
 export declare interface SessionStore {
-    /** Active sessions for a user (most recent first). */
+    /** Unrotated credentials with an existing canonical root owned by the same user, most recent first. */
     readonly listSessions: (userId: string) => Effect.Effect<ReadonlyArray<SessionRecord>>;
     /** Record a session on sign-in. */
     readonly insertSession: (session: Omit<SessionRecord, 'createdAt' | 'lastSeenAt'>) => Effect.Effect<SessionRecord>;
-    /** Look up one session row by id. The request-time revocation check
-     *  (`makeSessionRevocationChecker`) calls this — a missing row means
-     *  the session was revoked. */
+    /** Look up an unrotated credential only while its canonical family root
+     * exists and belongs to the same user. A rotated root remains an anchor;
+     * its tenant does not replace the credential tenant. Custom stores must
+     * enforce this before returning a row to request-time revocation checks. */
     readonly findSession: (sessionId: string) => Effect.Effect<SessionRecord | null>;
     /** Slide a session row forward: bump `expiresAt` + `lastSeenAt`. Called
      *  when the sliding-window renewal re-issues the cookie, so the row
@@ -1980,6 +2235,8 @@ export declare interface SessionStore {
     readonly revokeAllSessions: (userId: string) => Effect.Effect<number>;
 }
 
+export declare const signAuthClaims: (claims: Readonly<Record<string, unknown>>, secret: string, purpose: AuthClaimsPurpose) => string;
+
 export declare interface SignInInput {
     readonly email: string;
     readonly password: string;
@@ -2159,7 +2416,7 @@ declare const UserNotFoundError_base: new <A extends Record<string, any> = {}>(a
 
 export declare interface UserRecord {
     readonly id: string;
-    readonly email: string;
+    readonly email: string | null;
     /**
      * The stored scrypt hash — OPTIONAL, because not every identity has a
      * password. An SSO-only, magic-link-only, passkey-only, or provider-PAT
@@ -2224,6 +2481,8 @@ export declare type UserStoreResolver = (ctx: UserStoreBindContext) => UserStore
 /** Verify a passkey assertion (sign-in). */
 export declare const verifyAssertion: (input: AssertionVerifyInput) => AssertionOutcome;
 
+export declare const verifyAuthClaims: (value: string | undefined, secret: string, purpose: AuthClaimsPurpose, now?: () => number) => Record<string, unknown> | null;
+
 /**
  * Verify a state-changing request's CSRF protection. Both the header
  * value and the cookie value must (a) be the SAME token and (b) carry a
@@ -2309,6 +2568,9 @@ export declare interface VoltroPasswordStrategyOptions {
      *  (stateless); with it, nothing but a registered session authenticates,
      *  and every session can be revoked. */
     readonly requireSessionId?: boolean;
+    /** Verified user identity kinds owned by this carrier. Other verified kinds
+     * skip to their own carrier; malformed, forged or expired values still fail. */
+    readonly userKinds?: ReadonlyArray<'registered' | 'guest'>;
 }
 
 export declare type WebAuthnError = 'bad-client-data' | 'wrong-type' | 'challenge-mismatch' | 'origin-mismatch' | 'rpid-mismatch' | 'user-not-present' | 'bad-auth-data' | 'no-credential' | 'unsupported-key' | 'bad-signature' | 'counter-replay';

package/dist/index.js

@@ -1,89 +1,31 @@
 import { PasswordEmptyError as e, PasswordHashError as t, hashPassword as n, needsRehash as r, parseScryptParams as i, verifyPassword as a, verifyPasswordWithRehash as o } from "./password.js";
-import { SESSION_COOKIE_NAME as ee, clearSessionCookie as te, issueSession as s, readSession as c, readSessionFromHeaders as ne, readSessionKeyed as re, resolveSessionSecret as ie, resolveSessionSecrets as ae, sessionSecretsOf as oe } from "./session.js";
-import { a as l, c as se, i as u, l as d, n as f, o as p, r as m, s as h, t as g } from "./strategy-XaGjSicX.js";
-import { $ as _, A as v, B as y, C as b, D as x, E as S, F as C, G as w, H as T, I as E, J as D, K as O, L as k, M as A, N as j, O as M, P as N, Q as P, R as F, S as I, T as L, U as R, V as z, W as B, X as V, Y as H, Z as U, _ as W, _t as G, a as K, at as ce, b as le, c as ue, ct as de, d as fe, dt as pe, et as me, f as he, ft as ge, g as _e, gt as ve, h as ye, ht as be, i as xe, it as Se, j as Ce, k as we, l as Te, lt as Ee, m as De, mt as Oe, n as ke, nt as Ae, o as je, ot as Me, p as Ne, pt as Pe, q as Fe, r as Ie, rt as Le, s as Re, st as ze, t as Be, tt as Ve, u as He, ut as Ue, v as We, vt as Ge, w as Ke, x as qe, y as Je, z as Ye } from "./plugin-CbmcyEJs.js";
-import { EMAIL_VERIFY_TTL_S as Xe, MAGIC_LINK_TTL_S as Ze, MFA_PENDING_TTL_S as Qe, NATIVE_CODE_TTL_S as $e, PASSWORD_RESET_TTL_S as et, hashToken as tt, mintSecret as nt, mintToken as rt } from "./tokens.js";
-import { CSRF_COOKIE_NAME as it, CSRF_HEADER_NAME as at, isCsrfTokenWellFormed as ot, issueCsrfToken as st, verifyCsrf as q } from "./csrf.js";
-import { generateChallenge as ct, verifyAssertion as lt, verifyRegistration as ut } from "./webauthn.js";
-import { Effect as J } from "effect";
-import { eq as Y } from "@voltro/database";
-//#region src/sessionRegistry.ts
-var X = "sessions", dt = 604800, Z = (e) => ({
-	...e,
-	expiresAt: new Date(e.expiresAt),
-	createdAt: new Date(e.createdAt),
-	lastSeenAt: new Date(e.lastSeenAt)
-}), Q = async (e, t) => await e.query({
-	table: X,
-	predicate: t,
-	order: [],
-	take: void 0,
-	skip: void 0,
-	projection: void 0
-}), ft = (e) => ({
-	listSessions: (t) => J.promise(async () => (await Q(e, Y("userId", t))).map(Z).sort((e, t) => t.createdAt.getTime() - e.createdAt.getTime())),
-	insertSession: (t) => J.promise(async () => {
-		let n = /* @__PURE__ */ new Date(), r = {
-			...t,
-			createdAt: n,
-			lastSeenAt: n
-		};
-		return await e.insert(X, r), r;
-	}),
-	findSession: (t) => J.promise(async () => {
-		let n = (await Q(e, Y("id", t)))[0];
-		return n === void 0 ? null : Z(n);
-	}),
-	touchSession: (t, n) => J.promise(async () => {
-		await e.update(X, t, {
-			expiresAt: n,
-			lastSeenAt: /* @__PURE__ */ new Date()
-		});
-	}),
-	revokeSession: (t, n) => J.promise(async () => {
-		let r = (await Q(e, Y("id", n)))[0];
-		return r === void 0 || r.userId !== t ? !1 : e.delete(X, n);
-	}),
-	revokeAllOtherSessions: (t, n) => J.promise(async () => {
-		let r = 0;
-		for (let i of await Q(e, Y("userId", t))) i.id !== n && await e.delete(X, i.id) && (r += 1);
-		return r;
-	}),
-	revokeAllSessions: (t) => J.promise(async () => {
-		let n = 0;
-		for (let r of await Q(e, Y("userId", t))) await e.delete(X, r.id) && (n += 1);
-		return n;
-	})
-}), $ = (e, t) => e.type === "user" ? {
-	...e,
-	metadata: {
-		...e.metadata ?? {},
-		sessionId: t
-	}
-} : e, pt = async (e, t, n, r = {}) => {
-	if (t.type !== "user") throw Error("issueRegisteredSession: only a user subject has a session row");
-	let i = l("sess"), a = r.ttlSeconds ?? dt, o = (r.now ?? Date.now)();
-	await J.runPromise(e.insertSession({
-		id: i,
-		userId: t.id,
-		tenantId: t.tenantId ?? "",
-		expiresAt: new Date(o + a * 1e3),
-		ipAddress: r.ipAddress ?? null,
-		userAgent: r.userAgent ?? null
-	}));
-	let { ipAddress: ee, userAgent: te, ...c } = r;
-	return {
-		...s($(t, i), n, c),
-		sessionId: i
-	};
-}, mt = (e) => async (t) => t.type === "user" ? (await J.runPromise(e.listMemberships(t.id))).map((e) => ({
-	tenantId: e.tenantId,
-	role: e.role
-})) : [], ht = (e) => (t) => J.runPromise(e.send({
-	to: t.to,
-	subject: t.subject,
-	html: t.html,
-	text: t.text
-}).pipe(J.asVoid, J.orElseSucceed(() => void 0)));
-//#endregion
-export { it as CSRF_COOKIE_NAME, at as CSRF_HEADER_NAME, _e as DEFAULT_INVITER_ROLES, W as DEFAULT_ROLE_RANK, me as EMAIL_NOT_VERIFIED_CODE, Ve as EMAIL_VERIFIED_METADATA_KEY, Ae as EMAIL_VERIFY_RESEND_COOLDOWN_S, Xe as EMAIL_VERIFY_TTL_S, Te as IMPERSONATION_DEFAULT_DURATION_S, He as IMPERSONATION_FORBIDDEN_SUBPATHS, We as INVITATION_MAX_PENDING, Je as INVITATION_TTL_S, Ze as MAGIC_LINK_TTL_S, Qe as MFA_PENDING_TTL_S, $e as NATIVE_CODE_TTL_S, Ie as NATIVE_PENDING_COOKIE, et as PASSWORD_RESET_TTL_S, e as PasswordEmptyError, t as PasswordHashError, ee as SESSION_COOKIE_NAME, Ue as TotpVerifyError, f as UserAlreadyExistsError, m as UserNotFoundError, G as appUserStore, mt as authMemberships, Be as authRoutesPlugin, te as clearSessionCookie, j as configSessionSecrets, x as dataStoreChallengeStore, ft as dataStoreSessionRegistry, le as defaultCanGrantRole, Le as emailVerificationActive, Se as emailVerificationGuard, ct as generateChallenge, pe as generateRecoveryCodes, ge as generateTotpCode, Pe as generateTotpSecret, ke as getAuthSessionStrategy, N as guardSubject, qe as handleAcceptInvitation, I as handleAcceptInvitationWithSignUp, b as handleCreateInvitation, C as handleCsrf, ce as handleEmailVerifyConfirm, Me as handleEmailVerifyRequest, fe as handleImpersonationStart, he as handleImpersonationStop, Ke as handleListInvitations, E as handleListMemberships, k as handleListSessions, F as handleMagicLinkConsume, Ye as handleMagicLinkRequest, y as handleMfaEnrollStart, z as handleMfaEnrollVerify, T as handleMfaRegenerateRecoveryCodes, R as handleMfaUnenroll, B as handleMfaVerify, xe as handleNativeAuthorize, K as handleNativeComplete, je as handleNativeExchange, M as handlePasskeyAssertOptions, we as handlePasskeyAssertVerify, v as handlePasskeyRegisterOptions, Ce as handlePasskeyRegisterVerify, w as handlePasswordResetConfirm, O as handlePasswordResetRequest, L as handlePreviewInvitation, Fe as handleRevokeAllOtherSessions, S as handleRevokeInvitation, D as handleRevokeSession, H as handleSignIn, V as handleSignOut, U as handleSignUp, P as handleSwitchTenant, n as hashPassword, tt as hashToken, Ne as impersonationAuditRedactor, De as impersonationOf, Re as isAllowedRedirectUri, ot as isCsrfTokenWellFormed, ze as isEmailVerified, ye as isImpersonated, st as issueCsrfToken, pt as issueRegisteredSession, s as issueSession, _ as issueUserSession, ht as mailSender, d as makeSessionRevocationChecker, A as memoryChallengeStore, u as memoryUserStore, nt as mintSecret, rt as mintToken, ue as nativeLoginRedirect, r as needsRehash, l as newAuthId, Oe as otpauthUrl, i as parseScryptParams, Ge as postgresUserStore, c as readSession, ne as readSessionFromHeaders, re as readSessionKeyed, ie as resolveSessionSecret, ae as resolveSessionSecrets, ve as runSubjectGuards, de as sendEmailVerification, p as sessionIdOfSubject, oe as sessionSecretsOf, h as subjectFromUser, se as subjectMemberships, Ee as userEmailVerified, lt as verifyAssertion, q as verifyCsrf, a as verifyPassword, o as verifyPasswordWithRehash, ut as verifyRegistration, be as verifyTotpCode, g as voltroPasswordStrategy, $ as withSessionId };
+import { SESSION_COOKIE_NAME as s, clearSessionCookie as c, issueSession as l, readSession as u, readSessionFromHeaders as d, readSessionKeyed as f, resolveSessionSecret as p, resolveSessionSecrets as m, sessionSecretsOf as h } from "./session.js";
+import { makeSessionRevocationChecker as g } from "./revocation.js";
+import { UserAlreadyExistsError as _, UserNotFoundError as v, memoryUserStore as y, newAuthId as b, sessionIdOfSubject as x, subjectFromUser as S, subjectMemberships as C } from "./userStore.js";
+import { dataStoreSessionRegistry as w, issueRegisteredSession as T, lockRegisteredSession as E, rotateRegisteredSession as D, withSessionId as O } from "./sessionRegistry.js";
+import { CSRF_COOKIE_NAME as k, CSRF_HEADER_NAME as A, isCsrfTokenWellFormed as j, issueCsrfToken as M, verifyCsrf as N } from "./csrf.js";
+import { parseGuestCredential as P } from "./guestCredential.js";
+import { GuestAuthError as F, dataStoreGuestAuth as I } from "./guestService.js";
+import { authGuestDevicesTable as L, authGuestsTable as R } from "./guestSchema.js";
+import { guestAuthPlugin as z } from "./guestPlugin.js";
+import { allowedOverlayPage as B, overlayAuthPlugin as V } from "./overlayPlugin.js";
+import { auth as H } from "./authExtensions.js";
+import { TotpVerifyError as U, generateRecoveryCodes as W, generateTotpCode as G, generateTotpSecret as K, otpauthUrl as q, verifyTotpCode as J } from "./totp.js";
+import { EMAIL_VERIFY_TTL_S as Y, MAGIC_LINK_TTL_S as X, MFA_PENDING_TTL_S as Z, NATIVE_CODE_TTL_S as Q, PASSWORD_RESET_TTL_S as $, hashToken as ee, mintSecret as te, mintToken as ne } from "./tokens.js";
+import { runSubjectGuards as re } from "./subjectGuard.js";
+import { EMAIL_NOT_VERIFIED_CODE as ie, EMAIL_VERIFIED_METADATA_KEY as ae, EMAIL_VERIFY_RESEND_COOLDOWN_S as oe, emailVerificationActive as se, emailVerificationGuard as ce, handleEmailVerifyConfirm as le, handleEmailVerifyRequest as ue, isEmailVerified as de, sendEmailVerification as fe, userEmailVerified as pe } from "./emailVerification.js";
+import { configSessionSecrets as me, guardSubject as he, handleCsrf as ge, handleListMemberships as _e, handleListSessions as ve, handleMagicLinkConsume as ye, handleMagicLinkRequest as be, handleMfaEnrollStart as xe, handleMfaEnrollVerify as Se, handleMfaRegenerateRecoveryCodes as Ce, handleMfaUnenroll as we, handleMfaVerify as Te, handlePasswordResetConfirm as Ee, handlePasswordResetRequest as De, handleRevokeAllOtherSessions as Oe, handleRevokeSession as ke, handleSignIn as Ae, handleSignOut as je, handleSignUp as Me, handleSwitchTenant as Ne, issueUserSession as Pe } from "./handlers.js";
+import { completeGuestPasswordUpgrade as Fe } from "./guestPasswordUpgrade.js";
+import { authMemberships as Ie } from "./memberships.js";
+import { postgresUserStore as Le } from "./postgresUserStore.js";
+import { appUserStore as Re } from "./appUserStore.js";
+import { generateChallenge as ze, verifyAssertion as Be, verifyRegistration as Ve } from "./webauthn.js";
+import { dataStoreChallengeStore as He, handlePasskeyAssertOptions as Ue, handlePasskeyAssertVerify as We, handlePasskeyRegisterOptions as Ge, handlePasskeyRegisterVerify as Ke, memoryChallengeStore as qe } from "./passkeyHandlers.js";
+import { DEFAULT_INVITER_ROLES as Je, DEFAULT_ROLE_RANK as Ye, INVITATION_MAX_PENDING as Xe, INVITATION_TTL_S as Ze, defaultCanGrantRole as Qe, handleAcceptInvitation as $e, handleAcceptInvitationWithSignUp as et, handleCreateInvitation as tt, handleListInvitations as nt, handlePreviewInvitation as rt, handleRevokeInvitation as it } from "./invitations.js";
+import { IMPERSONATION_DEFAULT_DURATION_S as at, IMPERSONATION_FORBIDDEN_SUBPATHS as ot, handleImpersonationStart as st, handleImpersonationStop as ct, impersonationAuditRedactor as lt, impersonationOf as ut, isImpersonated as dt } from "./impersonation.js";
+import { signAuthClaims as ft, verifyAuthClaims as pt } from "./signedClaims.js";
+import { NATIVE_PENDING_COOKIE as mt, handleNativeAuthorize as ht, handleNativeComplete as gt, handleNativeExchange as _t, isAllowedRedirectUri as vt, nativeLoginRedirect as yt } from "./nativeRoutes.js";
+import { voltroPasswordStrategy as bt } from "./strategy.js";
+import { authRoutesPlugin as xt, getAuthSessionStrategies as St } from "./plugin.js";
+import { mailSender as Ct } from "./mail.js";
+export { k as CSRF_COOKIE_NAME, A as CSRF_HEADER_NAME, Je as DEFAULT_INVITER_ROLES, Ye as DEFAULT_ROLE_RANK, ie as EMAIL_NOT_VERIFIED_CODE, ae as EMAIL_VERIFIED_METADATA_KEY, oe as EMAIL_VERIFY_RESEND_COOLDOWN_S, Y as EMAIL_VERIFY_TTL_S, F as GuestAuthError, at as IMPERSONATION_DEFAULT_DURATION_S, ot as IMPERSONATION_FORBIDDEN_SUBPATHS, Xe as INVITATION_MAX_PENDING, Ze as INVITATION_TTL_S, X as MAGIC_LINK_TTL_S, Z as MFA_PENDING_TTL_S, Q as NATIVE_CODE_TTL_S, mt as NATIVE_PENDING_COOKIE, $ as PASSWORD_RESET_TTL_S, e as PasswordEmptyError, t as PasswordHashError, s as SESSION_COOKIE_NAME, U as TotpVerifyError, _ as UserAlreadyExistsError, v as UserNotFoundError, B as allowedOverlayPage, Re as appUserStore, H as auth, L as authGuestDevicesTable, R as authGuestsTable, Ie as authMemberships, xt as authRoutesPlugin, c as clearSessionCookie, Fe as completeGuestPasswordUpgrade, me as configSessionSecrets, He as dataStoreChallengeStore, I as dataStoreGuestAuth, w as dataStoreSessionRegistry, Qe as defaultCanGrantRole, se as emailVerificationActive, ce as emailVerificationGuard, ze as generateChallenge, W as generateRecoveryCodes, G as generateTotpCode, K as generateTotpSecret, St as getAuthSessionStrategies, he as guardSubject, z as guestAuthPlugin, $e as handleAcceptInvitation, et as handleAcceptInvitationWithSignUp, tt as handleCreateInvitation, ge as handleCsrf, le as handleEmailVerifyConfirm, ue as handleEmailVerifyRequest, st as handleImpersonationStart, ct as handleImpersonationStop, nt as handleListInvitations, _e as handleListMemberships, ve as handleListSessions, ye as handleMagicLinkConsume, be as handleMagicLinkRequest, xe as handleMfaEnrollStart, Se as handleMfaEnrollVerify, Ce as handleMfaRegenerateRecoveryCodes, we as handleMfaUnenroll, Te as handleMfaVerify, ht as handleNativeAuthorize, gt as handleNativeComplete, _t as handleNativeExchange, Ue as handlePasskeyAssertOptions, We as handlePasskeyAssertVerify, Ge as handlePasskeyRegisterOptions, Ke as handlePasskeyRegisterVerify, Ee as handlePasswordResetConfirm, De as handlePasswordResetRequest, rt as handlePreviewInvitation, Oe as handleRevokeAllOtherSessions, it as handleRevokeInvitation, ke as handleRevokeSession, Ae as handleSignIn, je as handleSignOut, Me as handleSignUp, Ne as handleSwitchTenant, n as hashPassword, ee as hashToken, lt as impersonationAuditRedactor, ut as impersonationOf, vt as isAllowedRedirectUri, j as isCsrfTokenWellFormed, de as isEmailVerified, dt as isImpersonated, M as issueCsrfToken, T as issueRegisteredSession, l as issueSession, Pe as issueUserSession, E as lockRegisteredSession, Ct as mailSender, g as makeSessionRevocationChecker, qe as memoryChallengeStore, y as memoryUserStore, te as mintSecret, ne as mintToken, yt as nativeLoginRedirect, r as needsRehash, b as newAuthId, q as otpauthUrl, V as overlayAuthPlugin, P as parseGuestCredential, i as parseScryptParams, Le as postgresUserStore, u as readSession, d as readSessionFromHeaders, f as readSessionKeyed, p as resolveSessionSecret, m as resolveSessionSecrets, D as rotateRegisteredSession, re as runSubjectGuards, fe as sendEmailVerification, x as sessionIdOfSubject, h as sessionSecretsOf, ft as signAuthClaims, S as subjectFromUser, C as subjectMemberships, pe as userEmailVerified, Be as verifyAssertion, pt as verifyAuthClaims, N as verifyCsrf, a as verifyPassword, o as verifyPasswordWithRehash, Ve as verifyRegistration, J as verifyTotpCode, bt as voltroPasswordStrategy, O as withSessionId };