@voltro/plugin-auth 0.86.0 → 0.87.0

package/dist/plugin.js

@@ -2,24 +2,22 @@ import { hashPassword as e } from "./password.js";
 import { clearSessionCookie as t, issueSession as n, readSessionFromHeaders as r } from "./session.js";
 import { makeSessionRevocationChecker as i } from "./revocation.js";
 import { sessionIdOfSubject as a } from "./userStore.js";
-import { deferredUserStore as o } from "./appUserStore.js";
-import { CSRF_COOKIE_NAME as s, CSRF_HEADER_NAME as c, verifyCsrf as ee } from "./csrf.js";
-import { emailVerificationActive as te, emailVerificationGuard as ne, handleEmailVerifyConfirm as re, handleEmailVerifyRequest as l } from "./emailVerification.js";
-import { configSessionSecrets as ie, configSigningKey as ae, handleCsrf as oe, handleListMemberships as se, handleListSessions as ce, handleMagicLinkConsume as le, handleMagicLinkRequest as ue, handleMfaEnrollStart as de, handleMfaEnrollVerify as fe, handleMfaRegenerateRecoveryCodes as pe, handleMfaUnenroll as me, handleMfaVerify as he, handlePasswordResetConfirm as ge, handlePasswordResetRequest as _e, handleRevokeAllOtherSessions as ve, handleRevokeSession as ye, handleSignIn as be, handleSignOut as xe, handleSignUp as Se, handleSwitchTenant as Ce, issueUserSession as u } from "./handlers.js";
-import { handlePasskeyAssertOptions as d, handlePasskeyAssertVerify as f, handlePasskeyRegisterOptions as p, handlePasskeyRegisterVerify as m, memoryChallengeStore as h } from "./passkeyHandlers.js";
-import { handleAcceptInvitation as g, handleAcceptInvitationWithSignUp as _, handleCreateInvitation as v, handleListInvitations as y, handlePreviewInvitation as b, handleRevokeInvitation as x } from "./invitations.js";
-import { IMPERSONATION_FORBIDDEN_SUBPATHS as S, handleImpersonationStart as C, handleImpersonationStop as w, isImpersonated as T } from "./impersonation.js";
-import { handleNativeAuthorize as E, handleNativeComplete as D, handleNativeExchange as O } from "./nativeRoutes.js";
-import { voltroPasswordStrategy as k } from "./strategy.js";
-import { Effect as A } from "effect";
-import { SESSION_HEADER_NAME as j, readCookie as we } from "@voltro/protocol/session";
+import { CSRF_COOKIE_NAME as o, CSRF_HEADER_NAME as s, verifyCsrf as ee } from "./csrf.js";
+import { emailVerificationActive as te, emailVerificationGuard as ne, handleEmailVerifyConfirm as c, handleEmailVerifyRequest as l } from "./emailVerification.js";
+import { configSessionSecrets as re, configSigningKey as ie, handleCsrf as ae, handleListMemberships as oe, handleListSessions as se, handleMagicLinkConsume as ce, handleMagicLinkRequest as le, handleMfaEnrollStart as ue, handleMfaEnrollVerify as de, handleMfaRegenerateRecoveryCodes as fe, handleMfaUnenroll as pe, handleMfaVerify as me, handlePasswordResetConfirm as he, handlePasswordResetRequest as ge, handleRevokeAllOtherSessions as _e, handleRevokeSession as ve, handleSignIn as ye, handleSignOut as be, handleSignUp as xe, handleSwitchTenant as Se, issueUserSession as u } from "./handlers.js";
+import { completeGuestPasswordUpgrade as Ce } from "./guestPasswordUpgrade.js";
+import { deferredUserStore as d } from "./appUserStore.js";
+import { handlePasskeyAssertOptions as f, handlePasskeyAssertVerify as p, handlePasskeyRegisterOptions as m, handlePasskeyRegisterVerify as h, memoryChallengeStore as g } from "./passkeyHandlers.js";
+import { handleAcceptInvitation as _, handleAcceptInvitationWithSignUp as v, handleCreateInvitation as y, handleListInvitations as b, handlePreviewInvitation as x, handleRevokeInvitation as S } from "./invitations.js";
+import { IMPERSONATION_FORBIDDEN_SUBPATHS as C, handleImpersonationStart as w, handleImpersonationStop as T, isImpersonated as E } from "./impersonation.js";
+import { handleNativeAuthorize as D, handleNativeComplete as O, handleNativeExchange as k } from "./nativeRoutes.js";
+import { voltroPasswordStrategy as A } from "./strategy.js";
+import { Effect as j } from "effect";
+import { SESSION_HEADER_NAME as we, readCookie as Te } from "@voltro/protocol/session";
 import { registerRetention as M, retentionTtlMsFromEnv as N } from "@voltro/database";
-import { definePlugin as Te } from "@voltro/protocol";
+import { definePlugin as Ee } from "@voltro/protocol";
 //#region src/plugin.ts
-var P = (e) => {
-	for (let t of e) if (F(t)) return t.auth.sessionStrategy;
-	return null;
-}, F = (e) => typeof e.auth == "object" && e.auth !== null && typeof e.auth.sessionStrategy == "object", Ee = "/auth", De = (e) => {
+var P = (e) => e.filter(F).map((e) => e.auth.sessionStrategy), F = (e) => typeof e.auth == "object" && e.auth !== null && typeof e.auth.sessionStrategy == "object", De = "/auth", Oe = (e) => {
 	let t = Buffer.from(e.rawBody).toString("utf8");
 	if (!t) return {};
 	if ((e.headers["content-type"] ?? "").includes("application/x-www-form-urlencoded")) {
@@ -41,12 +39,12 @@ var P = (e) => {
 		...e.setCookie === void 0 ? {} : { "set-cookie": e.setCookie },
 		...e.location === void 0 ? {} : { location: e.location }
 	}
-}), Oe = "actors", L = (e, t) => ({
+}), ke = "actors", L = (e, t) => ({
 	status: e,
 	body: JSON.stringify(t),
 	contentType: "application/json; charset=utf-8"
 }), R = (e) => typeof e == "string" ? e : void 0, z = (e, t) => typeof t == "string" && t.length > 0 ? { [e]: t } : {}, B = (P) => {
-	let F = P.prefix ?? Ee, B = { current: typeof P.store == "function" ? void 0 : P.store }, V = typeof P.store == "function" ? o(() => B.current) : P.store, H = P.challengeStore ?? h(), U = { current: void 0 }, W = P.admit === void 0 ? void 0 : (e, t) => P.admit(e, { store: t.store ?? U.current }), G = {
+	let F = P.prefix ?? De, B = { current: typeof P.store == "function" ? void 0 : P.store }, V = typeof P.store == "function" ? d(() => B.current) : P.store, H = P.challengeStore ?? g(), U = { current: void 0 }, W = P.admit === void 0 ? void 0 : (e, t) => P.admit(e, { store: t.store ?? U.current }), G = {
 		...P.secret === void 0 ? {} : { secret: P.secret },
 		...P.secrets === void 0 ? {} : { secrets: P.secrets },
 		defaultTenantId: P.defaultTenantId,
@@ -62,7 +60,7 @@ var P = (e) => {
 		...W === void 0 ? {} : { admit: W },
 		ensureActor: P.ensureActor ?? ((e) => {
 			let t = U.current;
-			return t === void 0 ? A.void : A.promise(() => t.insertIgnore(Oe, {
+			return t === void 0 ? j.void : j.promise(() => t.insertIgnore(ke, {
 				id: e.id,
 				kind: "user",
 				displayName: null
@@ -90,17 +88,17 @@ var P = (e) => {
 		envVar: "VOLTRO_IMPERSONATION_GRANTS_TTL_HOURS"
 	});
 	let q = i(V, P.sessionRevocation ?? {}), J = async (e) => {
-		let t = ie(G), i = r(e.headers, t);
+		let t = re(G), i = r(e.headers, t);
 		if (!i) return null;
-		let o = e.headers[j] ? "header" : "cookie", s = a(i.subject);
-		if (s && !await A.runPromise(q.isLive(s))) return null;
+		let o = e.headers[we] ? "header" : "cookie", s = a(i.subject);
+		if (s && (i.subject.type !== "user" || !await j.runPromise(q.isLiveFor(s, i.subject.id)))) return null;
 		if (i.renew || i.kid !== t.current.kid) {
 			let e = Math.max(i.exp - i.iat, 60), r = n(i.subject, t, {
 				ttlSeconds: e,
 				...G.cookieDomain ? { domain: G.cookieDomain } : {},
 				secure: G.cookieSecure ?? !0
 			});
-			return s && await A.runPromise(V.touchSession(s, new Date(Date.now() + e * 1e3))), {
+			return s && await j.runPromise(V.touchSession(s, new Date(Date.now() + e * 1e3))), {
 				subject: i.subject,
 				sessionId: s,
 				renewSetCookie: r.setCookie,
@@ -125,10 +123,10 @@ var P = (e) => {
 				"set-cookie": t
 			}
 		};
-	}, je = (e) => {
-		let t = e.headers[c], n = we(e.headers.cookie, s);
-		return ee(t, n, ae(P));
-	}, X = (e, t) => e.path === `${F}${t}`, Z = (e) => A.runPromise(e).then(I), Q = {
+	}, Me = (e) => {
+		let t = e.headers[s], n = Te(e.headers.cookie, o);
+		return ee(t, n, ie(P));
+	}, X = (e, t) => e.path === `${F}${t}`, Z = (e) => j.runPromise(e).then(I), Q = {
 		issue: (e, t) => u(e, V, G, {
 			sessionId: t.sessionId,
 			ttlSeconds: t.ttlSeconds,
@@ -147,11 +145,11 @@ var P = (e) => {
 			...G.cookieDomain ? { domain: G.cookieDomain } : {},
 			secure: G.cookieSecure ?? !0
 		})
-	}, Me = {
+	}, Ne = {
 		method: "*",
 		path: F,
 		handle: async (t) => {
-			let n = t.method === "GET" ? {} : De(t);
+			let n = t.method === "GET" ? {} : Oe(t);
 			if (P.native !== void 0) {
 				let e = {
 					prefix: F,
@@ -161,19 +159,19 @@ var P = (e) => {
 				};
 				if (t.method === "GET" && X(t, "/native/authorize")) {
 					let n = await J(t);
-					return Z(E(new URLSearchParams(t.query), n, V, e));
+					return Z(D(new URLSearchParams(t.query), n, V, e));
 				}
 				if (t.method === "GET" && X(t, "/native/complete")) {
 					let n = await J(t);
-					return Z(D(t.headers.cookie, n, V, e));
+					return Z(O(t.headers.cookie, n, V, e));
 				}
-				if (t.method === "POST" && X(t, "/native/exchange")) return Z(O({
+				if (t.method === "POST" && X(t, "/native/exchange")) return Z(k({
 					code: R(n.code) ?? "",
 					codeVerifier: R(n.codeVerifier) ?? ""
 				}, V, e));
 			} else if (t.path.startsWith(`${F}/native/`)) return L(501, { error: "native_login_not_configured" });
-			if (t.method === "GET" && X(t, "/csrf")) return I(oe(G));
-			if (t.method === "POST" && X(t, "/sign-in")) return Z(be({
+			if (t.method === "GET" && X(t, "/csrf")) return I(ae(G));
+			if (t.method === "POST" && X(t, "/sign-in")) return Z(ye({
 				email: R(n.email) ?? "",
 				password: R(n.password) ?? "",
 				...n.redirectAfter === void 0 ? {} : { redirectAfter: !!n.redirectAfter },
@@ -186,30 +184,52 @@ var P = (e) => {
 					status: 400,
 					headers: { "content-type": "application/json" },
 					body: JSON.stringify({ error: "tenant_not_open" })
-				} : Z(Se({
+				} : Z(xe({
 					email: R(n.email) ?? "",
 					password: R(n.password) ?? "",
 					...z("tenantId", e),
 					...n.redirectAfter === void 0 ? {} : { redirectAfter: !!n.redirectAfter }
 				}, V, G));
 			}
+			if (P.guestUpgrade && t.method === "POST" && X(t, "/upgrade-guest")) {
+				let e = await j.runPromise(Ce({
+					credential: R(n.credential) ?? "",
+					email: R(n.email) ?? "",
+					password: R(n.password) ?? "",
+					service: P.guestUpgrade.service(),
+					users: V,
+					config: G,
+					ipAddress: t.remoteAddr ?? null,
+					userAgent: t.headers["user-agent"] ?? null
+				}));
+				return e.kind === "refused" ? L(e.status, {
+					error: e.code,
+					message: e.message
+				}) : {
+					...L(200, {
+						ok: !0,
+						subject: e.subject
+					}),
+					headers: { "set-cookie": e.setCookie }
+				};
+			}
 			if (t.method === "POST" && X(t, "/sign-out")) {
 				let e = await J(t);
-				return e && e.subject.type === "user" && e.sessionId && (await A.runPromise(V.revokeSession(e.subject.id, e.sessionId)), q.invalidate(e.sessionId)), I(xe(G));
+				return e && e.subject.type === "user" && e.sessionId && (await j.runPromise(V.revokeSession(e.subject.id, e.sessionId)), q.invalidate(e.sessionId)), I(be(G));
 			}
-			if (t.method === "POST" && X(t, "/magic-link")) return Z(ue({
+			if (t.method === "POST" && X(t, "/magic-link")) return Z(le({
 				email: R(n.email) ?? "",
 				...z("callbackPath", n.callbackPath)
 			}, V, G));
-			if (t.method === "POST" && X(t, "/magic-link/callback")) return Z(le({
+			if (t.method === "POST" && X(t, "/magic-link/callback")) return Z(ce({
 				token: R(n.token) ?? "",
 				...n.redirectAfter === void 0 ? {} : { redirectAfter: !!n.redirectAfter }
 			}, V, G));
-			if (t.method === "POST" && X(t, "/password-reset")) return Z(_e({
+			if (t.method === "POST" && X(t, "/password-reset")) return Z(ge({
 				email: R(n.email) ?? "",
 				...z("callbackPath", n.callbackPath)
 			}, V, G));
-			if (t.method === "POST" && X(t, "/password-reset/confirm")) return Z(ge({
+			if (t.method === "POST" && X(t, "/password-reset/confirm")) return Z(he({
 				token: R(n.token) ?? "",
 				newPassword: R(n.newPassword) ?? ""
 			}, V));
@@ -219,16 +239,16 @@ var P = (e) => {
 				let r = await J(t);
 				return !r || r.subject.type !== "user" ? L(400, { error: "email required" }) : Z(l({ userId: r.subject.id }, V, G));
 			}
-			if (t.method === "POST" && X(t, "/verify-email/callback")) return Z(re({ token: R(n.token) ?? "" }, V));
-			if (P.invitations && t.method === "POST" && X(t, "/invitations/preview")) return Z(b({ token: R(n.token) ?? "" }, V, K));
-			if (P.invitations && t.method === "POST" && X(t, "/invitations/sign-up")) return Z(_({
+			if (t.method === "POST" && X(t, "/verify-email/callback")) return Z(c({ token: R(n.token) ?? "" }, V));
+			if (P.invitations && t.method === "POST" && X(t, "/invitations/preview")) return Z(x({ token: R(n.token) ?? "" }, V, K));
+			if (P.invitations && t.method === "POST" && X(t, "/invitations/sign-up")) return Z(v({
 				token: R(n.token) ?? "",
 				password: R(n.password) ?? ""
 			}, V, {
 				...K,
 				hashPassword: e
 			}));
-			if (t.method === "POST" && X(t, "/mfa/verify")) return Z(he({
+			if (t.method === "POST" && X(t, "/mfa/verify")) return Z(me({
 				pendingToken: R(n.pendingToken) ?? "",
 				...z("code", n.code),
 				...z("recoveryCode", n.recoveryCode),
@@ -236,18 +256,18 @@ var P = (e) => {
 				...t.remoteAddr ? { ipAddress: t.remoteAddr } : {},
 				...t.headers["user-agent"] ? { userAgent: t.headers["user-agent"] } : {}
 			}, V, G));
-			if (P.passkey && t.method === "POST" && X(t, "/passkey/assert/options")) return Z(d({ ...z("userId", n.userId) }, V, H, P.passkey));
-			if (P.passkey && t.method === "POST" && X(t, "/passkey/assert/verify")) return Z(f({
+			if (P.passkey && t.method === "POST" && X(t, "/passkey/assert/options")) return Z(f({ ...z("userId", n.userId) }, V, H, P.passkey));
+			if (P.passkey && t.method === "POST" && X(t, "/passkey/assert/verify")) return Z(p({
 				credentialId: R(n.credentialId) ?? "",
 				clientDataJSON: R(n.clientDataJSON) ?? "",
 				authenticatorData: R(n.authenticatorData) ?? "",
 				signature: R(n.signature) ?? "",
 				...z("userId", n.userId)
 			}, V, H, P.passkey, G));
-			let r = await J(t), i = r?.subject ?? null, a = () => !i || i.type !== "user" ? L(401, { error: "unauthenticated" }) : { userId: i.id }, o = () => je(t) ? null : L(403, { error: "csrf" }), s = (e) => Z(e).then((e) => Y(e, r?.renewSetCookie));
-			if (i && T(i)) {
+			let r = await J(t), i = r?.subject ?? null, a = () => !i || i.type !== "user" ? L(401, { error: "unauthenticated" }) : { userId: i.id }, o = () => Me(t) ? null : L(403, { error: "csrf" }), s = (e) => Z(e).then((e) => Y(e, r?.renewSetCookie));
+			if (i && E(i)) {
 				let e = t.path.startsWith(F) ? t.path.slice(F.length) : "";
-				if (S.includes(e)) return L(403, {
+				if (C.includes(e)) return L(403, {
 					error: "forbidden_while_impersonating",
 					message: "This action changes account credentials or session scope and is refused while impersonating. Stop the impersonation first."
 				});
@@ -264,11 +284,11 @@ var P = (e) => {
 			}
 			if (t.method === "GET" && X(t, "/sessions")) {
 				let e = a();
-				return "status" in e ? e : s(ce({ userId: e.userId }, V));
+				return "status" in e ? e : s(se({ userId: e.userId }, V));
 			}
 			if (t.method === "GET" && X(t, "/memberships")) {
 				let e = a();
-				return "status" in e ? e : s(se({ userId: e.userId }, V));
+				return "status" in e ? e : s(oe({ userId: e.userId }, V));
 			}
 			if (t.method === "POST" && X(t, "/sessions/revoke")) {
 				let e = a();
@@ -276,21 +296,21 @@ var P = (e) => {
 				let t = o();
 				if (t) return t;
 				let r = R(n.sessionId) ?? "";
-				return s(ye({
+				return s(ve({
 					userId: e.userId,
 					sessionId: r
 				}, V)).then((e) => (r && q.invalidate(r), e));
 			}
 			if (t.method === "POST" && X(t, "/sessions/revoke-others")) {
 				let e = a();
-				return "status" in e ? e : o() || s(ve({
+				return "status" in e ? e : o() || s(_e({
 					userId: e.userId,
 					keepSessionId: r?.sessionId ?? "__none__"
 				}, V));
 			}
 			if (P.invitations && t.method === "POST" && X(t, "/invitations")) {
 				let e = a();
-				return "status" in e ? e : o() || s(v({
+				return "status" in e ? e : o() || s(y({
 					inviterUserId: e.userId,
 					tenantId: R(n.tenantId) ?? i?.tenantId ?? "",
 					email: R(n.email) ?? "",
@@ -299,14 +319,14 @@ var P = (e) => {
 			}
 			if (P.invitations && t.method === "GET" && t.path === `${F}/invitations`) {
 				let e = a();
-				return "status" in e ? e : s(y({
+				return "status" in e ? e : s(b({
 					callerUserId: e.userId,
 					tenantId: i?.tenantId ?? ""
 				}, V, K));
 			}
 			if (P.invitations && t.method === "POST" && X(t, "/invitations/revoke")) {
 				let e = a();
-				return "status" in e ? e : o() || s(x({
+				return "status" in e ? e : o() || s(S({
 					callerUserId: e.userId,
 					tenantId: R(n.tenantId) ?? i?.tenantId ?? "",
 					invitationId: R(n.invitationId) ?? ""
@@ -318,14 +338,14 @@ var P = (e) => {
 					let e = o();
 					if (e) return e;
 				}
-				return s(g({
+				return s(_({
 					token: R(n.token) ?? "",
 					..."status" in e ? {} : { userId: e.userId }
 				}, V, K));
 			}
 			if (P.impersonation && t.method === "POST" && X(t, "/impersonate/start")) {
 				let e = a();
-				return "status" in e ? e : o() || Z(C({
+				return "status" in e ? e : o() || Z(w({
 					actorSubject: i,
 					actorSessionId: r?.sessionId ?? "",
 					...z("targetUserId", n.userId),
@@ -343,7 +363,7 @@ var P = (e) => {
 			}
 			if (P.impersonation && t.method === "POST" && X(t, "/impersonate/stop")) {
 				let e = a();
-				return "status" in e ? e : o() || Z(w({
+				return "status" in e ? e : o() || Z(T({
 					subject: i,
 					sessionId: r?.sessionId ?? ""
 				}, V, {
@@ -355,7 +375,7 @@ var P = (e) => {
 			}
 			if (t.method === "POST" && X(t, "/switch-tenant")) {
 				let e = a();
-				return "status" in e ? e : o() || Z(Ce({
+				return "status" in e ? e : o() || Z(Se({
 					userId: e.userId,
 					targetTenantId: R(n.targetTenantId) ?? "",
 					...typeof n.clientId == "number" ? { clientId: n.clientId } : {},
@@ -368,8 +388,8 @@ var P = (e) => {
 				if ("status" in e) return e;
 				let t = o();
 				if (t) return t;
-				let n = await A.runPromise(V.findById(e.userId));
-				return s(de({
+				let n = await j.runPromise(V.findById(e.userId));
+				return s(ue({
 					userId: e.userId,
 					issuer: P.mfa.issuer,
 					accountName: n?.email ?? e.userId
@@ -377,29 +397,29 @@ var P = (e) => {
 			}
 			if (P.mfa && t.method === "POST" && X(t, "/mfa/enroll/verify")) {
 				let e = a();
-				return "status" in e ? e : o() || s(fe({
+				return "status" in e ? e : o() || s(de({
 					userId: e.userId,
 					code: R(n.code) ?? ""
 				}, V));
 			}
 			if (P.mfa && t.method === "POST" && X(t, "/mfa/unenroll")) {
 				let e = a();
-				return "status" in e ? e : o() || s(me({ userId: e.userId }, V));
+				return "status" in e ? e : o() || s(pe({ userId: e.userId }, V));
 			}
 			if (P.mfa && t.method === "POST" && X(t, "/mfa/recovery-codes/regenerate")) {
 				let e = a();
-				return "status" in e ? e : o() || s(pe({ userId: e.userId }, V));
+				return "status" in e ? e : o() || s(fe({ userId: e.userId }, V));
 			}
 			if (P.passkey && t.method === "POST" && X(t, "/passkey/register/options")) {
 				let e = a();
-				return "status" in e ? e : o() || s(p({
+				return "status" in e ? e : o() || s(m({
 					userId: e.userId,
 					userName: R(n.userName) ?? e.userId
 				}, V, H, P.passkey));
 			}
 			if (P.passkey && t.method === "POST" && X(t, "/passkey/register/verify")) {
 				let e = a();
-				return "status" in e ? e : o() || s(m({
+				return "status" in e ? e : o() || s(h({
 					userId: e.userId,
 					credentialId: R(n.credentialId) ?? "",
 					clientDataJSON: R(n.clientDataJSON) ?? "",
@@ -409,17 +429,17 @@ var P = (e) => {
 			}
 			return !P.passkey && t.path.startsWith(`${F}/passkey/`) ? L(501, { error: "passkey_not_configured" }) : L(404, { error: "not_found" });
 		}
-	}, Ne = Te({
+	}, Pe = Ee({
 		name: P.name ? `@voltro/plugin-auth#${P.name}` : "@voltro/plugin-auth",
 		description: "Auth routes — mounts the full auth surface (password, magic-link, password-reset, CSRF, session probe/list/revoke, memberships, switch-tenant, passkey ceremonies) under /auth on the framework listener, with keyed secret rotation + request-time revocation.",
 		permissions: [],
-		declaredEnv: Ae,
-		privacy: ke,
-		httpRoutes: [Me],
+		declaredEnv: je,
+		privacy: Ae,
+		httpRoutes: [Ne],
 		bindDataStore: (e, t) => {
 			U.current = e, typeof P.store == "function" && (B.current = P.store(t?.sql === void 0 ? {} : { sql: t.sql }));
 		},
-		onActivate: (e) => A.sync(() => {
+		onActivate: (e) => j.sync(() => {
 			e.logger.info("auth routes active", {
 				prefix: F,
 				passkey: P.passkey ? P.passkey.rpId : "disabled",
@@ -430,17 +450,18 @@ var P = (e) => {
 				impersonation: P.impersonation ? `enabled(max ${P.impersonation.maxDurationSeconds ?? 900}s)` : "disabled"
 			});
 		}),
-		onDeactivate: () => A.void
+		onDeactivate: () => j.void
 	}), $ = P.secrets ?? P.secret;
 	return {
-		...Ne,
-		auth: { sessionStrategy: k({
+		...Pe,
+		auth: { sessionStrategy: A({
 			...$ === void 0 ? {} : { secret: $ },
+			userKinds: ["registered"],
 			store: V,
 			revocation: q
 		}) }
 	};
-}, ke = { collects: [{
+}, Ae = { collects: [{
 	category: "identifiers",
 	linked: !0,
 	tracking: !1,
@@ -450,7 +471,7 @@ var P = (e) => {
 	linked: !0,
 	tracking: !1,
 	purposes: ["app-functionality"]
-}] }, Ae = [
+}] }, je = [
 	{
 		name: "VOLTRO_SESSION_SECRET_PREVIOUS",
 		required: !1,
@@ -495,4 +516,4 @@ var P = (e) => {
 	}
 ];
 //#endregion
-export { B as authRoutesPlugin, P as getAuthSessionStrategy };
+export { B as authRoutesPlugin, P as getAuthSessionStrategies };

package/dist/postgresUserStore.js

@@ -65,7 +65,7 @@ var i = (e) => {
       `;
 		return t[0] ? g(t[0]) : null;
 	}).pipe(r.orElseSucceed(() => null)), ee = (t) => r.gen(function* () {
-		let n = t.email.toLowerCase(), a = /* @__PURE__ */ new Date(), s = [
+		let n = t.email === null ? null : t.email.toLowerCase(), a = /* @__PURE__ */ new Date(), s = [
 			u("id"),
 			u("email"),
 			u("tenantId"),
@@ -83,7 +83,7 @@ var i = (e) => {
 			...t,
 			email: n,
 			createdAt: a
-		})), r.catch((t) => i(t) === "23505" ? r.fail(new e({ email: n })) : r.die(t)));
+		})), r.catch((t) => i(t) === "23505" && n !== null ? r.fail(new e({ email: n })) : r.die(t)));
 	}), y = (e) => r.gen(function* () {
 		let n = (yield* o`
         SELECT ${p().selectList} FROM ${p().usersTable} WHERE ${u("id")} = ${e} LIMIT 1
@@ -153,9 +153,15 @@ var i = (e) => {
       `)[0]?.role ?? null;
 	}).pipe(r.orElseSucceed(() => null)), O = (e) => r.gen(function* () {
 		return (yield* o`
-        SELECT id, "userId", "tenantId", "expiresAt", "ipAddress", "userAgent", "createdAt", "lastSeenAt", "familyId", "rotatedAt"
-          FROM sessions WHERE "userId" = ${e} AND "rotatedAt" IS NULL
-          ORDER BY "createdAt" DESC
+        SELECT credential.id, credential."userId", credential."tenantId", credential."expiresAt", credential."ipAddress", credential."userAgent", credential."createdAt", credential."lastSeenAt", credential."familyId", credential."rotatedAt"
+          FROM sessions AS credential
+        INNER JOIN sessions AS root
+          ON root.id = COALESCE(credential."familyId", credential.id)
+          AND root."userId" = credential."userId"
+          AND COALESCE(root."familyId", root.id) = root.id
+        WHERE credential."userId" = ${e} AND credential."rotatedAt" IS NULL
+          AND credential.id <> '' AND credential."userId" <> '' AND root.id <> ''
+          ORDER BY credential."createdAt" DESC
       `).map((e) => ({ ...e }));
 	}).pipe(r.orElseSucceed(() => [])), k = (e) => r.gen(function* () {
 		let t = /* @__PURE__ */ new Date();
@@ -174,8 +180,14 @@ var i = (e) => {
 		};
 	}).pipe(r.orDie), A = (e) => r.gen(function* () {
 		let t = yield* o`
-        SELECT id, "userId", "tenantId", "expiresAt", "ipAddress", "userAgent", "createdAt", "lastSeenAt", "familyId", "rotatedAt"
-          FROM sessions WHERE id = ${e} AND "rotatedAt" IS NULL LIMIT 1
+        SELECT credential.id, credential."userId", credential."tenantId", credential."expiresAt", credential."ipAddress", credential."userAgent", credential."createdAt", credential."lastSeenAt", credential."familyId", credential."rotatedAt"
+          FROM sessions AS credential
+        INNER JOIN sessions AS root
+          ON root.id = COALESCE(credential."familyId", credential.id)
+          AND root."userId" = credential."userId"
+          AND COALESCE(root."familyId", root.id) = root.id
+        WHERE credential.id = ${e} AND credential."rotatedAt" IS NULL
+          AND credential.id <> '' AND credential."userId" <> '' AND root.id <> '' LIMIT 1
       `;
 		return t[0] ? { ...t[0] } : null;
 	}).pipe(r.orElseSucceed(() => null)), j = (e, t) => o.withTransaction(r.gen(function* () {

package/dist/revocation.js

@@ -1,33 +1,50 @@
-import { Effect as e } from "effect";
+import { isSessionCredentialLiveFor as e } from "./sessionFamily.js";
+import { Effect as t } from "effect";
 //#region src/revocation.ts
-var t = 3e4, n = 1e4, r = (r, i = {}) => {
-	let a = i.ttlMs ?? t, o = i.maxEntries ?? n, s = i.now ?? Date.now, c = /* @__PURE__ */ new Map(), l = () => {
-		if (c.size <= o) return;
-		let e = s();
-		for (let [t, n] of c) n.freshUntil <= e && c.delete(t);
-		for (let e of c.keys()) {
-			if (c.size <= o) break;
-			c.delete(e);
+var n = 3e4, r = 1e4, i = (e) => {
+	if (typeof e != "object" || !e) throw TypeError("Session revocation options must be an object.");
+	if ("isLive" in e || "isLiveFor" in e || "invalidate" in e || Reflect.ownKeys(e).some((e) => typeof e != "string" || ![
+		"ttlMs",
+		"maxEntries",
+		"now"
+	].includes(e))) throw TypeError("Supply revocation options or a checker implementing isLiveFor(sessionId, userId), invalidate(sessionId) and ttlMs.");
+	if (e.ttlMs !== void 0 && (!Number.isFinite(e.ttlMs) || e.ttlMs < 0)) throw TypeError("Session revocation ttlMs must be finite and nonnegative.");
+	if (e.maxEntries !== void 0 && (!Number.isSafeInteger(e.maxEntries) || e.maxEntries < 0)) throw TypeError("Session revocation maxEntries must be a nonnegative safe integer.");
+	if (e.now !== void 0 && typeof e.now != "function") throw TypeError("Session revocation now must be a clock function.");
+}, a = (a, o = {}) => {
+	i(o);
+	let s = o.ttlMs ?? n, c = o.maxEntries ?? r, l = o.now ?? Date.now, u = /* @__PURE__ */ new Map(), d = () => {
+		if (u.size <= c) return;
+		let e = l();
+		for (let [t, n] of u) n.freshUntil <= e && u.delete(t);
+		for (let e of u.keys()) {
+			if (u.size <= c) break;
+			u.delete(e);
 		}
-	}, u = (e) => e !== null && e.expiresAt.getTime() > s();
+	};
 	return {
-		ttlMs: a,
+		ttlMs: s,
 		invalidate: (e) => {
-			c.delete(e);
+			u.delete(e);
 		},
-		isLive: (t) => e.gen(function* () {
-			let e = s();
-			if (a > 0) {
-				let n = c.get(t);
-				if (n && n.freshUntil > e) return n.live;
+		isLiveFor: (n, r) => t.gen(function* () {
+			if (typeof n != "string" || n.length === 0 || typeof r != "string" || r.length === 0) return !1;
+			let t = l();
+			if (!Number.isFinite(t)) return !1;
+			if (s > 0) {
+				let e = u.get(n);
+				if (e && e.freshUntil > t) return e.live && e.userId === r;
 			}
-			let n = yield* r.findSession(t), i = u(n);
-			return a > 0 && (c.set(t, {
-				live: i,
-				freshUntil: e + a
-			}), l()), i;
+			let i = yield* a.findSession(n), o = l();
+			if (!Number.isFinite(o)) return !1;
+			let f = i !== null && i.id === n && typeof i.userId == "string" && i.userId.length > 0 ? i.userId : null, p = i?.expiresAt instanceof Date ? i.expiresAt.getTime() : NaN, m = f !== null && e(i, n, f, o);
+			return s > 0 && c > 0 && (u.set(n, {
+				userId: f,
+				live: m,
+				freshUntil: m ? Math.min(o + s, p) : o + s
+			}), d()), m && f === r;
 		})
 	};
 };
 //#endregion
-export { r as makeSessionRevocationChecker };
+export { a as makeSessionRevocationChecker, i as validateSessionRevocationOptions };

package/dist/schema.d.ts

@@ -1,6 +1,29 @@
+import { ColumnBuilder } from '@voltro/database';
+import { FieldDefinitions } from '@voltro/database';
+import { Table } from '@voltro/database';
 import { TableLike } from '@voltro/database';
 
-/** Tables the plugin contributes, as an array. */
+/** Device credentials never appear in SQL, logs, exports or session claims. */
+export declare const authGuestDevicesTable: Table<"authGuestDevices", FieldDefinitions<{
+    readonly id: ColumnBuilder<string, "id", boolean>;
+    readonly guestId: ColumnBuilder<string, "text", boolean>;
+    readonly tenantId: ColumnBuilder<string, "text", boolean>;
+    readonly secretHash: ColumnBuilder<string, "text", boolean>;
+    readonly generation: ColumnBuilder<number, "integer", boolean>;
+    readonly expiresAt: ColumnBuilder<Date, "timestamp", boolean>;
+    readonly createdAt: ColumnBuilder<Date, "timestamp", boolean>;
+}>, true, never>;
+
+/** Guest identity is independent of the password user's email record. */
+export declare const authGuestsTable: Table<"authGuests", FieldDefinitions<{
+    readonly id: ColumnBuilder<string, "id", boolean>;
+    readonly tenantId: ColumnBuilder<string, "text", boolean>;
+    readonly upgradeable: ColumnBuilder<boolean, "boolean", boolean>;
+    readonly expiresAt: ColumnBuilder<Date, "timestamp", boolean>;
+    readonly createdAt: ColumnBuilder<Date, "timestamp", boolean>;
+    readonly lastSeenAt: ColumnBuilder<Date, "timestamp", boolean>;
+}>, true, never>;
+
 export declare const authTables: readonly [TableLike, TableLike, TableLike, TableLike, TableLike, TableLike, TableLike, TableLike, TableLike, TableLike];
 
 /**
@@ -12,6 +35,23 @@ export declare const authTables: readonly [TableLike, TableLike, TableLike, Tabl
  */
 export declare const authTokensTable: TableLike;
 
+export declare const guestTables: readonly [ Table<"authGuests", FieldDefinitions<{
+    readonly id: ColumnBuilder<string, "id", boolean>;
+    readonly tenantId: ColumnBuilder<string, "text", boolean>;
+    readonly upgradeable: ColumnBuilder<boolean, "boolean", boolean>;
+    readonly expiresAt: ColumnBuilder<Date, "timestamp", boolean>;
+    readonly createdAt: ColumnBuilder<Date, "timestamp", boolean>;
+    readonly lastSeenAt: ColumnBuilder<Date, "timestamp", boolean>;
+}>, true, never>, Table<"authGuestDevices", FieldDefinitions<{
+    readonly id: ColumnBuilder<string, "id", boolean>;
+    readonly guestId: ColumnBuilder<string, "text", boolean>;
+    readonly tenantId: ColumnBuilder<string, "text", boolean>;
+    readonly secretHash: ColumnBuilder<string, "text", boolean>;
+    readonly generation: ColumnBuilder<number, "integer", boolean>;
+    readonly expiresAt: ColumnBuilder<Date, "timestamp", boolean>;
+    readonly createdAt: ColumnBuilder<Date, "timestamp", boolean>;
+}>, true, never>];
+
 /**
  * Impersonation grants — one row per "support agent A is acting as user B",
  * written when the impersonated session is minted and closed when it ends.