@voltro/plugin-auth 0.86.0 → 0.87.0

package/dist/userStore.js

@@ -1,71 +1,75 @@
-import { Data as e, Effect as t } from "effect";
-import { generateId as n } from "@voltro/database";
+import { hasOwnedSessionFamily as e, indexSessionFamilies as t, sessionFamilyId as n } from "./sessionFamily.js";
+import { Data as r, Effect as i } from "effect";
+import { generateId as a } from "@voltro/database";
 //#region src/userStore.ts
-var r = class extends e.TaggedError("UserAlreadyExistsError") {}, i = class extends e.TaggedError("UserNotFoundError") {}, a = (e) => n({
+var o = class extends r.TaggedError("UserAlreadyExistsError") {}, s = class extends r.TaggedError("UserNotFoundError") {}, c = (e) => a({
 	kind: "typeid",
 	prefix: e
-}, e), o = (e = []) => {
-	let n = /* @__PURE__ */ new Map(), o = /* @__PURE__ */ new Map(), s = [], c = [], l = [], u = [], d = [], f = [], p = [], m = /* @__PURE__ */ new Map();
-	for (let t of e) n.set(t.id, t), o.set(t.email.toLowerCase(), t);
-	let h = (e, r) => t.gen(function* () {
-		let a = n.get(e);
-		if (!a) return yield* t.fail(new i({ userId: e }));
-		let s = r(a);
-		return n.set(e, s), o.set(s.email.toLowerCase(), s), s;
+}, e), l = (r = []) => {
+	let a = /* @__PURE__ */ new Map(), l = /* @__PURE__ */ new Map(), u = [], d = [], f = [], p = [], m = [], h = [], g = [], _ = /* @__PURE__ */ new Map();
+	for (let e of r) a.set(e.id, e), e.email !== null && l.set(e.email.toLowerCase(), e);
+	let v = (e, t) => i.gen(function* () {
+		let n = a.get(e);
+		if (!n) return yield* i.fail(new s({ userId: e }));
+		let r = t(n);
+		return a.set(e, r), r.email !== null && l.set(r.email.toLowerCase(), r), r;
 	});
 	return {
-		findByEmail: (e) => t.sync(() => o.get(e.toLowerCase()) ?? null),
-		findById: (e) => t.sync(() => n.get(e) ?? null),
-		insert: (e) => t.gen(function* () {
-			let i = e.email.toLowerCase();
-			if (o.has(i)) return yield* t.fail(new r({ email: i }));
-			let a = {
+		findByEmail: (e) => i.sync(() => l.get(e.toLowerCase()) ?? null),
+		findById: (e) => i.sync(() => a.get(e) ?? null),
+		insert: (e) => i.gen(function* () {
+			let t = e.email === null ? null : e.email.toLowerCase();
+			if (t !== null && l.has(t)) return yield* i.fail(new o({ email: t }));
+			let n = {
 				...e,
-				email: i,
+				email: t,
 				createdAt: /* @__PURE__ */ new Date()
 			};
-			return n.set(a.id, a), o.set(i, a), a;
+			return a.set(n.id, n), t !== null && l.set(t, n), n;
 		}),
-		updatePassword: (e, t) => h(e, (e) => ({
+		updatePassword: (e, t) => v(e, (e) => ({
 			...e,
 			passwordHash: t
 		})),
-		setMfaSecret: (e, t) => h(e, (e) => ({
+		setMfaSecret: (e, t) => v(e, (e) => ({
 			...e,
 			mfaSecret: t,
 			mfaEnrolledAt: null
 		})),
-		markMfaEnrolled: (e) => h(e, (e) => ({
+		markMfaEnrolled: (e) => v(e, (e) => ({
 			...e,
 			mfaEnrolledAt: /* @__PURE__ */ new Date()
 		})),
-		clearMfa: (e) => h(e, (e) => ({
+		clearMfa: (e) => v(e, (e) => ({
 			...e,
 			mfaSecret: null,
 			mfaEnrolledAt: null
 		})),
-		markEmailVerified: (e) => h(e, (e) => e.emailVerifiedAt ? e : {
+		markEmailVerified: (e) => v(e, (e) => e.emailVerifiedAt ? e : {
 			...e,
 			emailVerifiedAt: /* @__PURE__ */ new Date()
 		}),
-		listMemberships: (e) => t.sync(() => s.filter((t) => t.userId === e)),
-		addMembership: (e) => t.sync(() => {
-			let t = s.findIndex((t) => t.userId === e.userId && t.tenantId === e.tenantId), n = {
+		listMemberships: (e) => i.sync(() => u.filter((t) => t.userId === e)),
+		addMembership: (e) => i.sync(() => {
+			let t = u.findIndex((t) => t.userId === e.userId && t.tenantId === e.tenantId), n = {
 				...e,
 				joinedAt: /* @__PURE__ */ new Date()
 			};
 			if (t >= 0) {
-				let e = s[t], r = {
+				let e = u[t], r = {
 					...n,
 					joinedAt: e.joinedAt
 				};
-				return s[t] = r, r;
+				return u[t] = r, r;
 			}
-			return s.push(n), n;
+			return u.push(n), n;
+		}),
+		membershipRole: (e, t) => i.sync(() => u.find((n) => n.userId === e && n.tenantId === t)?.role ?? null),
+		listSessions: (r) => i.sync(() => {
+			let i = t(d);
+			return d.filter((t) => t.userId === r && t.rotatedAt == null && i.get(t.id) === t && e(t, i.get(n(t) ?? ""))).map((e) => structuredClone(e)).sort((e, t) => t.createdAt.getTime() - e.createdAt.getTime());
 		}),
-		membershipRole: (e, n) => t.sync(() => s.find((t) => t.userId === e && t.tenantId === n)?.role ?? null),
-		listSessions: (e) => t.sync(() => c.filter((t) => t.userId === e && t.rotatedAt == null).sort((e, t) => t.createdAt.getTime() - e.createdAt.getTime())),
-		insertSession: (e) => t.sync(() => {
+		insertSession: (e) => i.sync(() => {
 			let t = /* @__PURE__ */ new Date(), n = {
 				...e,
 				familyId: e.familyId ?? e.id,
@@ -73,73 +77,76 @@ var r = class extends e.TaggedError("UserAlreadyExistsError") {}, i = class exte
 				createdAt: t,
 				lastSeenAt: t
 			};
-			return c.push(n), n;
+			return d.push(structuredClone(n)), structuredClone(n);
 		}),
-		findSession: (e) => t.sync(() => c.find((t) => t.id === e && t.rotatedAt == null) ?? null),
-		touchSession: (e, n) => t.sync(() => {
-			let t = c.findIndex((t) => t.id === e);
-			if (t >= 0 && c[t].rotatedAt == null) {
-				c[t] = {
-					...c[t],
-					expiresAt: n,
+		findSession: (r) => i.sync(() => {
+			let i = t(d), a = i.get(r);
+			return a && a.rotatedAt == null && e(a, i.get(n(a) ?? "")) ? structuredClone(a) : null;
+		}),
+		touchSession: (e, t) => i.sync(() => {
+			let n = d.findIndex((t) => t.id === e);
+			if (n >= 0 && d[n].rotatedAt == null) {
+				d[n] = {
+					...d[n],
+					expiresAt: t,
 					lastSeenAt: /* @__PURE__ */ new Date()
 				};
-				let r = c[t].familyId ?? e, i = c.findIndex((e) => e.id === r);
-				i >= 0 && c[i].expiresAt < n && (c[i] = {
-					...c[i],
-					expiresAt: n
+				let r = d[n].familyId ?? e, i = d.findIndex((e) => e.id === r);
+				i >= 0 && d[i].expiresAt < t && (d[i] = {
+					...d[i],
+					expiresAt: t
 				});
 			}
 		}),
-		revokeSession: (e, n) => t.sync(() => {
-			let t = c.find((t) => t.id === n && t.userId === e);
-			if (!t) return !1;
-			let r = t.familyId ?? t.id, i = !1;
-			for (let t = c.length - 1; t >= 0; t--) {
-				let n = c[t];
-				n.userId === e && (n.familyId ?? n.id) === r && (c.splice(t, 1), i = !0);
+		revokeSession: (e, t) => i.sync(() => {
+			let n = d.find((n) => n.id === t && n.userId === e);
+			if (!n) return !1;
+			let r = n.familyId ?? n.id, i = !1;
+			for (let t = d.length - 1; t >= 0; t--) {
+				let n = d[t];
+				n.userId === e && (n.familyId ?? n.id) === r && (d.splice(t, 1), i = !0);
 			}
 			return i;
 		}),
-		revokeAllOtherSessions: (e, n) => t.sync(() => {
-			let t = c.find((t) => t.id === n && t.userId === e), r = t ? t.familyId ?? t.id : void 0, i = 0;
-			for (let t = c.length - 1; t >= 0; t--) {
-				let n = c[t];
-				n.userId === e && (n.familyId ?? n.id) !== r && (c.splice(t, 1), n.rotatedAt ?? (i += 1));
+		revokeAllOtherSessions: (e, t) => i.sync(() => {
+			let n = d.find((n) => n.id === t && n.userId === e), r = n ? n.familyId ?? n.id : void 0, i = 0;
+			for (let t = d.length - 1; t >= 0; t--) {
+				let n = d[t];
+				n.userId === e && (n.familyId ?? n.id) !== r && (d.splice(t, 1), n.rotatedAt ?? (i += 1));
 			}
 			return i;
 		}),
-		revokeAllSessions: (e) => t.sync(() => {
+		revokeAllSessions: (e) => i.sync(() => {
 			let t = 0;
-			for (let n = c.length - 1; n >= 0; n--) if (c[n].userId === e) {
-				let e = c[n];
-				c.splice(n, 1), e.rotatedAt ?? t++;
+			for (let n = d.length - 1; n >= 0; n--) if (d[n].userId === e) {
+				let e = d[n];
+				d.splice(n, 1), e.rotatedAt ?? t++;
 			}
 			return t;
 		}),
-		insertToken: (e) => t.sync(() => {
+		insertToken: (e) => i.sync(() => {
 			let t = {
 				...e,
 				consumedAt: null,
 				createdAt: /* @__PURE__ */ new Date()
 			};
-			return l.push(t), t;
+			return f.push(t), t;
 		}),
-		consumeToken: (e, n) => t.sync(() => {
-			let t = Date.now(), r = l.find((r) => r.tokenHash === e && r.purpose === n && r.consumedAt === null && r.expiresAt.getTime() > t);
+		consumeToken: (e, t) => i.sync(() => {
+			let n = Date.now(), r = f.find((r) => r.tokenHash === e && r.purpose === t && r.consumedAt === null && r.expiresAt.getTime() > n);
 			if (!r) return null;
 			let i = {
 				...r,
 				consumedAt: /* @__PURE__ */ new Date()
-			}, a = l.indexOf(r);
-			return l[a] = i, i;
+			}, a = f.indexOf(r);
+			return f[a] = i, i;
 		}),
-		latestToken: (e, n) => t.sync(() => {
-			let t = null;
-			for (let r of l) r.userId === e && r.purpose === n && (t === null || r.createdAt.getTime() > t.createdAt.getTime()) && (t = r);
-			return t;
+		latestToken: (e, t) => i.sync(() => {
+			let n = null;
+			for (let r of f) r.userId === e && r.purpose === t && (n === null || r.createdAt.getTime() > n.createdAt.getTime()) && (n = r);
+			return n;
 		}),
-		insertInvitation: (e) => t.sync(() => {
+		insertInvitation: (e) => i.sync(() => {
 			let t = {
 				...e,
 				email: e.email.toLowerCase(),
@@ -149,119 +156,119 @@ var r = class extends e.TaggedError("UserAlreadyExistsError") {}, i = class exte
 				revokedByUserId: null,
 				createdAt: /* @__PURE__ */ new Date()
 			};
-			return f.push(t), t;
+			return h.push(t), t;
 		}),
-		findInvitationByHash: (e) => t.sync(() => f.find((t) => t.tokenHash === e) ?? null),
-		acceptInvitation: (e, n, r) => t.sync(() => {
-			let t = f.findIndex((t) => t.tokenHash === e && t.acceptedAt === null && t.revokedAt === null && t.expiresAt.getTime() > r.getTime());
-			if (t < 0) return null;
+		findInvitationByHash: (e) => i.sync(() => h.find((t) => t.tokenHash === e) ?? null),
+		acceptInvitation: (e, t, n) => i.sync(() => {
+			let r = h.findIndex((t) => t.tokenHash === e && t.acceptedAt === null && t.revokedAt === null && t.expiresAt.getTime() > n.getTime());
+			if (r < 0) return null;
 			let i = {
-				...f[t],
-				acceptedAt: r,
-				acceptedByUserId: n
+				...h[r],
+				acceptedAt: n,
+				acceptedByUserId: t
 			};
-			return f[t] = i, i;
+			return h[r] = i, i;
 		}),
-		revokeInvitation: (e, n, r, i) => t.sync(() => {
-			let t = f.findIndex((t) => t.id === e && t.tenantId === n && t.acceptedAt === null && t.revokedAt === null);
-			return t < 0 ? !1 : (f[t] = {
-				...f[t],
-				revokedAt: i,
-				revokedByUserId: r
+		revokeInvitation: (e, t, n, r) => i.sync(() => {
+			let i = h.findIndex((n) => n.id === e && n.tenantId === t && n.acceptedAt === null && n.revokedAt === null);
+			return i < 0 ? !1 : (h[i] = {
+				...h[i],
+				revokedAt: r,
+				revokedByUserId: n
 			}, !0);
 		}),
-		listInvitations: (e) => t.sync(() => f.filter((t) => t.tenantId === e).sort((e, t) => t.createdAt.getTime() - e.createdAt.getTime())),
-		countPendingInvitations: (e, n) => t.sync(() => f.filter((t) => t.tenantId === e && t.acceptedAt === null && t.revokedAt === null && t.expiresAt.getTime() > n.getTime()).length),
-		supersedePendingInvitations: (e, n, r, i) => t.sync(() => {
-			let t = n.toLowerCase(), a = 0;
-			for (let n = 0; n < f.length; n++) {
-				let o = f[n];
-				o.tenantId === e && o.email === t && o.acceptedAt === null && o.revokedAt === null && (f[n] = {
+		listInvitations: (e) => i.sync(() => h.filter((t) => t.tenantId === e).sort((e, t) => t.createdAt.getTime() - e.createdAt.getTime())),
+		countPendingInvitations: (e, t) => i.sync(() => h.filter((n) => n.tenantId === e && n.acceptedAt === null && n.revokedAt === null && n.expiresAt.getTime() > t.getTime()).length),
+		supersedePendingInvitations: (e, t, n, r) => i.sync(() => {
+			let i = t.toLowerCase(), a = 0;
+			for (let t = 0; t < h.length; t++) {
+				let o = h[t];
+				o.tenantId === e && o.email === i && o.acceptedAt === null && o.revokedAt === null && (h[t] = {
 					...o,
-					revokedAt: i,
-					revokedByUserId: r
+					revokedAt: r,
+					revokedByUserId: n
 				}, a++);
 			}
 			return a;
 		}),
-		insertImpersonationGrant: (e) => t.sync(() => {
+		insertImpersonationGrant: (e) => i.sync(() => {
 			let t = {
 				...e,
 				startedAt: /* @__PURE__ */ new Date(),
 				endedAt: null,
 				endedReason: null
 			};
-			return p.push(t), t;
+			return g.push(t), t;
 		}),
-		findImpersonationGrantBySession: (e) => t.sync(() => p.find((t) => t.sessionId === e) ?? null),
-		endImpersonationGrant: (e, n, r) => t.sync(() => {
-			let t = p.findIndex((t) => t.sessionId === e && t.endedAt === null);
-			return t < 0 ? !1 : (p[t] = {
-				...p[t],
-				endedAt: r,
-				endedReason: n
+		findImpersonationGrantBySession: (e) => i.sync(() => g.find((t) => t.sessionId === e) ?? null),
+		endImpersonationGrant: (e, t, n) => i.sync(() => {
+			let r = g.findIndex((t) => t.sessionId === e && t.endedAt === null);
+			return r < 0 ? !1 : (g[r] = {
+				...g[r],
+				endedAt: n,
+				endedReason: t
 			}, !0);
 		}),
-		replaceRecoveryCodes: (e, n) => t.sync(() => {
-			for (let t = d.length - 1; t >= 0; t--) d[t].userId === e && d.splice(t, 1);
-			let t = /* @__PURE__ */ new Date();
-			for (let r of n) d.push({
-				id: a("rc"),
+		replaceRecoveryCodes: (e, t) => i.sync(() => {
+			for (let t = m.length - 1; t >= 0; t--) m[t].userId === e && m.splice(t, 1);
+			let n = /* @__PURE__ */ new Date();
+			for (let r of t) m.push({
+				id: c("rc"),
 				userId: e,
 				codeHash: r,
 				consumedAt: null,
-				createdAt: t
+				createdAt: n
 			});
 		}),
-		consumeRecoveryCode: (e, n) => t.sync(() => {
-			let t = d.findIndex((t) => t.userId === e && t.codeHash === n && t.consumedAt === null);
-			return t < 0 ? !1 : (d[t] = {
-				...d[t],
+		consumeRecoveryCode: (e, t) => i.sync(() => {
+			let n = m.findIndex((n) => n.userId === e && n.codeHash === t && n.consumedAt === null);
+			return n < 0 ? !1 : (m[n] = {
+				...m[n],
 				consumedAt: /* @__PURE__ */ new Date()
 			}, !0);
 		}),
-		countRecoveryCodes: (e) => t.sync(() => d.filter((t) => t.userId === e && t.consumedAt === null).length),
-		listPasskeys: (e) => t.sync(() => u.filter((t) => t.userId === e)),
-		findPasskey: (e) => t.sync(() => u.find((t) => t.credentialId === e) ?? null),
-		insertPasskey: (e) => t.sync(() => {
+		countRecoveryCodes: (e) => i.sync(() => m.filter((t) => t.userId === e && t.consumedAt === null).length),
+		listPasskeys: (e) => i.sync(() => p.filter((t) => t.userId === e)),
+		findPasskey: (e) => i.sync(() => p.find((t) => t.credentialId === e) ?? null),
+		insertPasskey: (e) => i.sync(() => {
 			let t = /* @__PURE__ */ new Date(), n = {
 				...e,
 				createdAt: t,
 				lastUsedAt: null
 			};
-			return u.push(n), n;
+			return p.push(n), n;
 		}),
-		advancePasskeyCounter: (e, n) => t.sync(() => {
-			let t = u.findIndex((t) => t.credentialId === e);
-			return t < 0 || n <= u[t].counter ? !1 : (u[t] = {
-				...u[t],
-				counter: n,
+		advancePasskeyCounter: (e, t) => i.sync(() => {
+			let n = p.findIndex((t) => t.credentialId === e);
+			return n < 0 || t <= p[n].counter ? !1 : (p[n] = {
+				...p[n],
+				counter: t,
 				lastUsedAt: /* @__PURE__ */ new Date()
 			}, !0);
 		}),
-		isLockedOut: (e, n) => t.sync(() => {
-			let t = m.get(e.toLowerCase());
-			return t?.lockedUntil != null && n < t.lockedUntil ? {
+		isLockedOut: (e, t) => i.sync(() => {
+			let n = _.get(e.toLowerCase());
+			return n?.lockedUntil != null && t < n.lockedUntil ? {
 				locked: !0,
-				retryAfterSeconds: Math.ceil((t.lockedUntil - n) / 1e3)
+				retryAfterSeconds: Math.ceil((n.lockedUntil - t) / 1e3)
 			} : {
 				locked: !1,
 				retryAfterSeconds: 0
 			};
 		}),
-		recordLoginFailure: (e, n, r) => t.sync(() => {
-			let t = e.toLowerCase(), i = m.get(t), a = i?.windowStartedAt == null || n - i.windowStartedAt >= r.windowMs, o = i?.lockedUntil != null && n >= i.lockedUntil, s = !i || a || o, c = s ? 1 : i.failedCount + 1, l = s ? n : i.windowStartedAt, u = c >= r.maxAttempts ? n + r.lockMs : null;
-			m.set(t, {
+		recordLoginFailure: (e, t, n) => i.sync(() => {
+			let r = e.toLowerCase(), i = _.get(r), a = i?.windowStartedAt == null || t - i.windowStartedAt >= n.windowMs, o = i?.lockedUntil != null && t >= i.lockedUntil, s = !i || a || o, c = s ? 1 : i.failedCount + 1, l = s ? t : i.windowStartedAt, u = c >= n.maxAttempts ? t + n.lockMs : null;
+			_.set(r, {
 				failedCount: c,
 				windowStartedAt: l,
 				lockedUntil: u
 			});
 		}),
-		clearLoginFailures: (e) => t.sync(() => {
-			m.delete(e.toLowerCase());
+		clearLoginFailures: (e) => i.sync(() => {
+			_.delete(e.toLowerCase());
 		})
 	};
-}, s = (e, t = {}) => {
+}, u = (e, t = {}) => {
 	let n = { ...t.metadata };
 	return t.memberships && (n.memberships = t.memberships.map((e) => ({
 		tenantId: e.tenantId,
@@ -272,14 +279,14 @@ var r = class extends e.TaggedError("UserAlreadyExistsError") {}, i = class exte
 		tenantId: t.tenantId ?? e.tenantId,
 		...Object.keys(n).length > 0 ? { metadata: n } : {}
 	};
-}, c = (e) => {
+}, d = (e) => {
 	if (e.type !== "user") return null;
 	let t = e.metadata?.sessionId;
 	return typeof t == "string" && t.length > 0 ? t : null;
-}, l = (e) => {
+}, f = (e) => {
 	if (e.type !== "user") return [];
 	let t = e.metadata?.memberships;
 	return Array.isArray(t) ? t.filter((e) => typeof e == "object" && !!e && typeof e.tenantId == "string" && typeof e.role == "string") : [];
 };
 //#endregion
-export { r as UserAlreadyExistsError, i as UserNotFoundError, o as memoryUserStore, a as newAuthId, c as sessionIdOfSubject, s as subjectFromUser, l as subjectMemberships };
+export { o as UserAlreadyExistsError, s as UserNotFoundError, l as memoryUserStore, c as newAuthId, d as sessionIdOfSubject, u as subjectFromUser, f as subjectMemberships };

package/dist/web/guestStorage.js

@@ -0,0 +1,47 @@
+//#region src/web/guestStorage.ts
+var e = (e) => {
+	if (!e.trim()) throw Error("Guest storage requires an app namespace");
+	let t = (t, n) => new Promise((r, i) => {
+		let a = !1, o = globalThis.indexedDB.open("voltro:guest:" + e, 1);
+		o.onupgradeneeded = () => {
+			o.result.createObjectStore("credentials");
+		}, o.onerror = () => i(/* @__PURE__ */ Error("Guest IndexedDB unavailable")), o.onblocked = () => {
+			a = !0, i(/* @__PURE__ */ Error("Guest IndexedDB blocked"));
+		}, o.onsuccess = () => {
+			let e = o.result;
+			if (a) {
+				e.close();
+				return;
+			}
+			let s, c;
+			try {
+				s = e.transaction("credentials", t), c = n(s.objectStore("credentials"));
+			} catch {
+				e.close(), i(/* @__PURE__ */ Error("Guest IndexedDB transaction unavailable"));
+				return;
+			}
+			s.oncomplete = () => {
+				e.close(), r(c.result);
+			}, s.onerror = s.onabort = () => {
+				e.close(), i(/* @__PURE__ */ Error("Guest IndexedDB transaction failed"));
+			};
+		};
+	});
+	return {
+		exclusive: (t) => globalThis.navigator?.locks ? globalThis.navigator.locks.request("voltro:guest:" + e, t) : Promise.reject(/* @__PURE__ */ Error("Guest cross-tab locking unavailable")),
+		read: async () => {
+			let e = await t("readonly", (e) => e.get("device"));
+			if (e === void 0) return null;
+			if (typeof e != "string" || !e) throw Error("Guest IndexedDB credential invalid");
+			return e;
+		},
+		write: async (e) => {
+			await t("readwrite", (t) => t.put(e, "device"));
+		},
+		remove: async () => {
+			await t("readwrite", (e) => e.delete("device"));
+		}
+	};
+};
+//#endregion
+export { e as indexedDbGuestStore };

package/dist/web.d.ts

@@ -1,5 +1,99 @@
 import { ReactNode } from 'react';
 import { Subject } from '@voltro/protocol';
+import { SubjectIdentity } from '@voltro/protocol';
+
+/** Serializes operations in one client. A rejected existing credential never
+ * creates a replacement identity. Storage failures never enable memory fallback. */
+export declare const createGuestClient: (options: GuestClientOptions) => {
+    connect: () => Promise<GuestClientSession>;
+    /** Prepare without replacing the active proof, persist both proofs, then
+     * commit. A later connect recovers the same identity after a lost response. */
+    rotate: () => Promise<GuestClientSession>;
+    /** Revoke on the server first. Keep the durable proof on transport failure
+     * so the caller can retry; erase locally only after confirmed revocation. */
+    revoke: () => Promise<void>;
+    /** Turn this guest into an email/password account under the same subject ID
+     * (`authRoutesPlugin({ guestUpgrade })`). The device proof is erased only after the
+     * server confirmed the account; on any refusal or transport failure it stays. */
+    upgrade: (input: {
+        readonly email: string;
+        readonly password: string;
+    }) => Promise<{
+        readonly subject: unknown;
+    }>;
+    /** The registered account signed in on this device (cookie clients), or null. */
+    account: () => Promise<GuestClientAccount | null>;
+    /** The signed-in account if there is one, else this device's guest (resumed or created once).
+     * The usual entry for a game that offers accounts: a reload after `upgrade` or `signIn` stays the account. */
+    start: () => Promise<GuestClientPlayer>;
+    /** Sign in to an existing account with email and password (`authRoutesPlugin`), e.g. on a second
+     * device. This device's guest proof stays: after `signOut`, `start` resumes that guest. */
+    signIn: (input: {
+        readonly email: string;
+        readonly password: string;
+    }) => Promise<GuestClientAccount>;
+    /** End the account session on the server and clear its cookie. */
+    signOut: () => Promise<void>;
+};
+
+/** A registered account signed in on this device (by upgrade or sign-in), through the session cookie. */
+export declare interface GuestClientAccount {
+    readonly subject: Extract<SubjectIdentity, {
+        readonly type: 'user';
+    }>;
+}
+
+export declare class GuestClientError extends Error {
+    readonly code: 'storage_unavailable' | 'credential_rejected' | 'upgrade_conflict' | 'account_signed_in' | 'transport_failed' | 'invalid_response';
+    readonly status?: number | undefined;
+    constructor(code: 'storage_unavailable' | 'credential_rejected' | 'upgrade_conflict' | 'account_signed_in' | 'transport_failed' | 'invalid_response', status?: number | undefined);
+}
+
+export declare interface GuestClientOptions {
+    readonly apiBaseUrl: string;
+    readonly storage: GuestCredentialStore;
+    readonly prefix?: string;
+    readonly fetch?: typeof globalThis.fetch;
+    /** Web clients include cookies and obtain a signed CSRF token for each post. */
+    readonly cookies?: boolean;
+    /** Prefix of the app's auth routes, for `upgrade`, `account`, `signIn` and `signOut` (default `/auth`). */
+    readonly accountPrefix?: string;
+}
+
+/** What `start` found: the signed-in account, else this device's guest. */
+export declare type GuestClientPlayer = {
+    readonly kind: 'account';
+    readonly subject: GuestClientAccount['subject'];
+} | {
+    readonly kind: 'guest';
+    readonly subject: GuestClientSession['subject'];
+    readonly session: string;
+};
+
+export declare interface GuestClientSession {
+    readonly subject: Extract<SubjectIdentity, {
+        readonly type: 'user';
+    }> & {
+        readonly kind: 'guest';
+    };
+    readonly session: string;
+}
+
+/** Platform-backed durable secret storage. Native implementations use the
+ * operating system's secure store; writes resolve only after persistence. */
+export declare interface GuestCredentialStore {
+    /** Serialize the whole read/create/write operation across users of this
+     * namespace, including other browser tabs or native client instances. */
+    readonly exclusive: <A>(work: () => Promise<A>) => Promise<A>;
+    readonly read: () => Promise<string | null>;
+    /** Persist the opaque value, including an in-progress rotation journal. */
+    readonly write: (value: string) => Promise<void>;
+    readonly remove: () => Promise<void>;
+}
+
+/** IndexedDB is the web device-proof store. Missing/blocked storage rejects;
+ * there is deliberately no localStorage or volatile substitute. */
+export declare const indexedDbGuestStore: (namespace: string) => GuestCredentialStore;
 
 /** True when this browser can do WebAuthn at all. */
 export declare const isPasskeySupported: () => boolean;

package/dist/web.js

@@ -1,4 +1,6 @@
 import { SubjectProvider as e, useOptionalSubject as t, useSubject as n } from "./web/subjectContext.js";
 import { RequireAuth as r } from "./web/requireAuth.js";
-import { isPasskeySupported as i, registerPasskey as a, signInWithPasskey as o } from "./web/passkeyClient.js";
-export { r as RequireAuth, e as SubjectProvider, i as isPasskeySupported, a as registerPasskey, o as signInWithPasskey, t as useOptionalSubject, n as useSubject };
+import { GuestClientError as i, createGuestClient as a } from "./guestClient.js";
+import { indexedDbGuestStore as o } from "./web/guestStorage.js";
+import { isPasskeySupported as s, registerPasskey as c, signInWithPasskey as l } from "./web/passkeyClient.js";
+export { i as GuestClientError, r as RequireAuth, e as SubjectProvider, a as createGuestClient, o as indexedDbGuestStore, s as isPasskeySupported, c as registerPasskey, l as signInWithPasskey, t as useOptionalSubject, n as useSubject };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voltro/plugin-auth",
-  "version": "0.86.0",
+  "version": "0.87.0",
   "description": "Authentication primitives: password hashing, session creation, schema mixin + tables. Pairs with the `auth` app template for the UI; both independently usable. Server-side only (uses node:crypto).",
   "keywords": [
     "voltro",
@@ -73,6 +73,11 @@
       "import": "./dist/native.js",
       "default": "./dist/native.js"
     },
+    "./guest": {
+      "types": "./dist/guest.d.ts",
+      "import": "./dist/guest.js",
+      "default": "./dist/guest.js"
+    },
     "./package.json": "./package.json"
   },
   "main": "./dist/index.js",
@@ -83,8 +88,8 @@
     "node": ">=24.0.0"
   },
   "dependencies": {
-    "@voltro/database": "0.86.0",
-    "@voltro/protocol": "0.86.0"
+    "@voltro/database": "0.87.0",
+    "@voltro/protocol": "0.87.0"
   },
   "peerDependencies": {
     "effect": "4.0.1",