@voltro/plugin-auth 0.86.0 → 0.87.0

package/dist/authExtensions.js

@@ -0,0 +1,9 @@
+import { guestAuthPlugin as e } from "./guestPlugin.js";
+import { overlayAuthPlugin as t } from "./overlayPlugin.js";
+//#region src/authExtensions.ts
+var n = {
+	guest: e,
+	overlay: t
+};
+//#endregion
+export { n as auth };

package/dist/emailVerification.js

@@ -22,27 +22,29 @@ var i = 60, a = "email_not_verified", o = "emailVerified", s = (e) => e?.policy
 	body: JSON.stringify(t),
 	contentType: "application/json; charset=utf-8"
 }), p = (e, t, n) => `${e}${t}${t.includes("?") ? "&" : "?"}token=${encodeURIComponent(n)}`, m = (t, i, a) => r.gen(function* () {
-	let o = a.emailVerification, s = (a.now ?? Date.now)(), c = (o?.resendCooldownSeconds ?? 60) * 1e3;
-	if (c > 0) {
+	let o = t.email;
+	if (o === null) return !1;
+	let s = a.emailVerification, c = (a.now ?? Date.now)(), l = (s?.resendCooldownSeconds ?? 60) * 1e3;
+	if (l > 0) {
 		let e = yield* i.latestToken(t.id, "email-verify");
-		if (e && s - e.createdAt.getTime() < c) return !1;
+		if (e && c - e.createdAt.getTime() < l) return !1;
 	}
-	let l = n("email-verify", o?.ttlSeconds ?? 86400);
+	let u = n("email-verify", s?.ttlSeconds ?? 86400);
 	if (yield* i.insertToken({
 		id: e("tok"),
-		tokenHash: l.tokenHash,
+		tokenHash: u.tokenHash,
 		userId: t.id,
 		purpose: "email-verify",
-		expiresAt: l.expiresAt
+		expiresAt: u.expiresAt
 	}).pipe(r.ignore), !a.sendEmail) return !1;
-	let u = p(a.appBaseUrl ?? "", o?.callbackPath ?? "/auth/verify-email/callback", l.token);
+	let d = p(a.appBaseUrl ?? "", s?.callbackPath ?? "/auth/verify-email/callback", u.token);
 	return yield* r.tryPromise(() => a.sendEmail({
-		to: t.email,
+		to: o,
 		kind: "email-verify",
-		actionUrl: u,
+		actionUrl: d,
 		subject: "Confirm your email address",
-		text: `Confirm your email address: ${u}`,
-		html: `<p><a href="${u}">Confirm your email address</a> — this link expires in 24 hours.</p>`
+		text: `Confirm your email address: ${d}`,
+		html: `<p><a href="${d}">Confirm your email address</a> — this link expires in 24 hours.</p>`
 	})).pipe(r.ignore), !0;
 }), h = (e, t, n) => r.gen(function* () {
 	if (!e.email && !e.userId) return f(400, { error: "email or userId required" });

package/dist/guest.d.ts

@@ -0,0 +1,99 @@
+import { SubjectIdentity } from '@voltro/protocol';
+
+/** Serializes operations in one client. A rejected existing credential never
+ * creates a replacement identity. Storage failures never enable memory fallback. */
+export declare const createGuestClient: (options: GuestClientOptions) => {
+    connect: () => Promise<GuestClientSession>;
+    /** Prepare without replacing the active proof, persist both proofs, then
+     * commit. A later connect recovers the same identity after a lost response. */
+    rotate: () => Promise<GuestClientSession>;
+    /** Revoke on the server first. Keep the durable proof on transport failure
+     * so the caller can retry; erase locally only after confirmed revocation. */
+    revoke: () => Promise<void>;
+    /** Turn this guest into an email/password account under the same subject ID
+     * (`authRoutesPlugin({ guestUpgrade })`). The device proof is erased only after the
+     * server confirmed the account; on any refusal or transport failure it stays. */
+    upgrade: (input: {
+        readonly email: string;
+        readonly password: string;
+    }) => Promise<{
+        readonly subject: unknown;
+    }>;
+    /** The registered account signed in on this device (cookie clients), or null. */
+    account: () => Promise<GuestClientAccount | null>;
+    /** The signed-in account if there is one, else this device's guest (resumed or created once).
+     * The usual entry for a game that offers accounts: a reload after `upgrade` or `signIn` stays the account. */
+    start: () => Promise<GuestClientPlayer>;
+    /** Sign in to an existing account with email and password (`authRoutesPlugin`), e.g. on a second
+     * device. This device's guest proof stays: after `signOut`, `start` resumes that guest. */
+    signIn: (input: {
+        readonly email: string;
+        readonly password: string;
+    }) => Promise<GuestClientAccount>;
+    /** End the account session on the server and clear its cookie. */
+    signOut: () => Promise<void>;
+};
+
+/** A registered account signed in on this device (by upgrade or sign-in), through the session cookie. */
+declare interface GuestClientAccount {
+    readonly subject: Extract<SubjectIdentity, {
+        readonly type: 'user';
+    }>;
+}
+
+export declare class GuestClientError extends Error {
+    readonly code: 'storage_unavailable' | 'credential_rejected' | 'upgrade_conflict' | 'account_signed_in' | 'transport_failed' | 'invalid_response';
+    readonly status?: number | undefined;
+    constructor(code: 'storage_unavailable' | 'credential_rejected' | 'upgrade_conflict' | 'account_signed_in' | 'transport_failed' | 'invalid_response', status?: number | undefined);
+}
+
+export declare interface GuestClientOptions {
+    readonly apiBaseUrl: string;
+    readonly storage: GuestCredentialStore;
+    readonly prefix?: string;
+    readonly fetch?: typeof globalThis.fetch;
+    /** Web clients include cookies and obtain a signed CSRF token for each post. */
+    readonly cookies?: boolean;
+    /** Prefix of the app's auth routes, for `upgrade`, `account`, `signIn` and `signOut` (default `/auth`). */
+    readonly accountPrefix?: string;
+}
+
+/** What `start` found: the signed-in account, else this device's guest. */
+declare type GuestClientPlayer = {
+    readonly kind: 'account';
+    readonly subject: GuestClientAccount['subject'];
+} | {
+    readonly kind: 'guest';
+    readonly subject: GuestClientSession['subject'];
+    readonly session: string;
+};
+
+export declare interface GuestClientSession {
+    readonly subject: Extract<SubjectIdentity, {
+        readonly type: 'user';
+    }> & {
+        readonly kind: 'guest';
+    };
+    readonly session: string;
+}
+
+/** Platform-backed durable secret storage. Native implementations use the
+ * operating system's secure store; writes resolve only after persistence. */
+export declare interface GuestCredentialStore {
+    /** Serialize the whole read/create/write operation across users of this
+     * namespace, including other browser tabs or native client instances. */
+    readonly exclusive: <A>(work: () => Promise<A>) => Promise<A>;
+    readonly read: () => Promise<string | null>;
+    /** Persist the opaque value, including an in-progress rotation journal. */
+    readonly write: (value: string) => Promise<void>;
+    readonly remove: () => Promise<void>;
+}
+
+/** Browser-safe shape only. Possession is verified against SQL on the server. */
+export declare const parseGuestCredential: (credential: string) => {
+    readonly guestId: string;
+    readonly deviceId: string;
+    readonly secret: string;
+} | null;
+
+export { }

package/dist/guest.js

@@ -0,0 +1,3 @@
+import { parseGuestCredential as e } from "./guestCredential.js";
+import { GuestClientError as t, createGuestClient as n } from "./guestClient.js";
+export { t as GuestClientError, n as createGuestClient, e as parseGuestCredential };

package/dist/guestClient.js

@@ -0,0 +1,237 @@
+import { parseGuestCredential as e } from "./guestCredential.js";
+//#region src/guestClient.ts
+var t = class extends Error {
+	code;
+	status;
+	constructor(e, t) {
+		super("Guest authentication: " + e), this.code = e, this.status = t, this.name = "GuestClientError";
+	}
+}, n = (e) => {
+	if (typeof e != "object" || !e) throw new t("invalid_response");
+	let n = e, r = n.subject;
+	if (typeof n.session != "string" || !n.session || !r || r.type !== "user" || r.kind !== "guest" || typeof r.id != "string" || !r.id.trim() || typeof r.tenantId != "string" || !r.tenantId.trim()) throw new t("invalid_response");
+	return {
+		session: n.session,
+		subject: r
+	};
+}, r = (r, i) => {
+	let a = n(r), o = e(i);
+	if (!o || a.subject.id !== o.guestId) throw new t("invalid_response");
+	return a;
+}, i = (t, n) => {
+	let r = e(t), i = e(n);
+	return r !== null && i !== null && r.guestId === i.guestId && r.deviceId === i.deviceId && r.secret !== i.secret;
+}, a = (e) => {
+	if (e === null || !e.startsWith("{")) return e;
+	let n;
+	try {
+		n = JSON.parse(e);
+	} catch {
+		throw new t("storage_unavailable");
+	}
+	if (!n || typeof n != "object" || Array.isArray(n)) throw new t("storage_unavailable");
+	let r = n;
+	if (r.kind !== "guest-rotation" || typeof r.current != "string" || typeof r.next != "string" || Object.keys(r).sort().join(",") !== "current,kind,next" || !i(r.current, r.next)) throw new t("storage_unavailable");
+	return {
+		kind: "guest-rotation",
+		current: r.current,
+		next: r.next
+	};
+}, o = (e) => {
+	let n = e.fetch ?? globalThis.fetch, o = e.apiBaseUrl.replace(/\/+$/, "") + (e.prefix ?? "/auth/guest"), s = Promise.resolve(), c = (n) => {
+		let r = async () => {
+			try {
+				return await e.storage.exclusive(n);
+			} catch (e) {
+				throw e instanceof t ? e : new t("storage_unavailable");
+			}
+		}, i = s.then(r, r);
+		return s = i.then(() => void 0, () => void 0), i;
+	}, l = async (e) => {
+		try {
+			return await e();
+		} catch {
+			throw new t("storage_unavailable");
+		}
+	}, u = async (r, i) => {
+		let a = { "content-type": "application/json" }, s = e.cookies ? "include" : "omit";
+		try {
+			if (e.cookies) {
+				let e = await n(o + "/csrf", {
+					credentials: s,
+					cache: "no-store"
+				});
+				if (!e.ok) throw new t("transport_failed", e.status);
+				let r = await e.json();
+				if (!r || typeof r != "object" || !("token" in r) || typeof r.token != "string") throw new t("invalid_response");
+				a["x-csrf-token"] = r.token;
+			}
+			let c = await n(o + r, {
+				method: "POST",
+				credentials: s,
+				headers: a,
+				body: JSON.stringify(i),
+				cache: "no-store"
+			});
+			if (!c.ok) throw new t(c.status === 401 ? "credential_rejected" : "transport_failed", c.status);
+			let l = await c.json();
+			if (!l || typeof l != "object" || Array.isArray(l)) throw new t("invalid_response");
+			return l;
+		} catch (e) {
+			throw e instanceof t ? e : new t("transport_failed");
+		}
+	}, d = e.apiBaseUrl.replace(/\/+$/, "") + (e.accountPrefix ?? "/auth"), f = async (e, r, i, a = "json") => {
+		try {
+			let o = await n(d + "/csrf", {
+				credentials: "include",
+				cache: "no-store"
+			});
+			if (!o.ok) throw new t("transport_failed", o.status);
+			let s = await o.json();
+			if (!s || typeof s != "object" || !("csrfToken" in s) || typeof s.csrfToken != "string") throw new t("invalid_response");
+			let c = await n(d + e, {
+				method: "POST",
+				credentials: "include",
+				cache: "no-store",
+				...a === "redirect" ? { redirect: "manual" } : {},
+				headers: {
+					"content-type": "application/json",
+					"x-csrf-token": s.csrfToken
+				},
+				body: JSON.stringify(r)
+			});
+			if (a === "redirect" && (c.type === "opaqueredirect" || c.status >= 200 && c.status < 400)) return {};
+			if (!c.ok) throw new t(i(c.status), c.status);
+			let l = await c.json();
+			if (!l || typeof l != "object" || Array.isArray(l)) throw new t("invalid_response");
+			return l;
+		} catch (e) {
+			throw e instanceof t ? e : new t("transport_failed");
+		}
+	}, p = async () => {
+		if (!e.cookies) return null;
+		let r;
+		try {
+			r = await n(d + "/session", {
+				credentials: "include",
+				cache: "no-store"
+			});
+		} catch {
+			throw new t("transport_failed");
+		}
+		if (r.status === 401 || r.status === 404) return null;
+		if (!r.ok) throw new t("transport_failed", r.status);
+		let i;
+		try {
+			i = await r.json();
+		} catch {
+			throw new t("invalid_response");
+		}
+		let a = i && typeof i == "object" ? i.subject : void 0;
+		if (!a || a.type !== "user" || typeof a.id != "string" || !a.id.trim() || typeof a.tenantId != "string") throw new t("invalid_response");
+		return a.kind === "guest" ? null : { subject: a };
+	}, m = async (n, i) => {
+		let a = r(n, i.current);
+		if (n.deviceCredential !== void 0 && n.deviceCredential !== i.next) throw new t("invalid_response");
+		return await l(() => e.storage.write(i.next)), a;
+	}, h = async (e) => {
+		let n;
+		try {
+			n = await u("/resume", { credential: e.next });
+		} catch (r) {
+			if (!(r instanceof t) || r.code !== "credential_rejected") throw r;
+			n = await u("/rotate", {
+				credential: e.current,
+				nextCredential: e.next
+			});
+		}
+		return m(n, e);
+	}, g = () => c(async () => {
+		let n = a(await l(() => e.storage.read()));
+		if (typeof n == "object" && n) return h(n);
+		if (n !== null) return r(await u("/resume", { credential: n }), n);
+		if (await p()) throw new t("account_signed_in");
+		let i = await u("/create", {});
+		if (typeof i.deviceCredential != "string" || !i.deviceCredential) throw new t("invalid_response");
+		let o = r(i, i.deviceCredential);
+		try {
+			await l(() => e.storage.write(String(i.deviceCredential)));
+		} catch (e) {
+			try {
+				await u("/revoke", { credential: i.deviceCredential });
+			} catch {}
+			throw e;
+		}
+		return o;
+	});
+	return {
+		connect: g,
+		rotate: () => c(async () => {
+			let n = a(await l(() => e.storage.read()));
+			if (n === null) throw new t("credential_rejected");
+			if (typeof n == "object") return h(n);
+			let r = await u("/prepare-rotation", { credential: n });
+			if (typeof r.deviceCredential != "string" || !i(n, r.deviceCredential)) throw new t("invalid_response");
+			let o = {
+				kind: "guest-rotation",
+				current: n,
+				next: r.deviceCredential
+			};
+			return await l(() => e.storage.write(JSON.stringify(o))), m(await u("/rotate", {
+				credential: n,
+				nextCredential: o.next
+			}), o);
+		}),
+		revoke: () => c(async () => {
+			let n = a(await l(() => e.storage.read()));
+			if (n !== null) {
+				for (let e of typeof n == "string" ? [n] : [n.next, n.current]) try {
+					await u("/revoke", { credential: e });
+					break;
+				} catch (e) {
+					if (!(e instanceof t) || e.code !== "credential_rejected") throw e;
+				}
+				await l(() => e.storage.remove());
+			}
+		}),
+		upgrade: (n) => c(async () => {
+			let r = a(await l(() => e.storage.read()));
+			if (typeof r != "string") throw new t("credential_rejected");
+			let i = await f("/upgrade-guest", {
+				credential: r,
+				email: n.email,
+				password: n.password
+			}, (e) => e === 401 ? "credential_rejected" : e === 409 ? "upgrade_conflict" : "transport_failed");
+			if (i.ok !== !0) throw new t("invalid_response");
+			return await l(() => e.storage.remove()), { subject: i.subject };
+		}),
+		account: () => p(),
+		start: async () => {
+			let e = await p();
+			if (e) return {
+				kind: "account",
+				subject: e.subject
+			};
+			let t = await g();
+			return {
+				kind: "guest",
+				subject: t.subject,
+				session: t.session
+			};
+		},
+		signIn: async (e) => {
+			await f("/sign-in", {
+				email: e.email,
+				password: e.password
+			}, (e) => e === 400 || e === 401 || e === 429 ? "credential_rejected" : "transport_failed");
+			let n = await p();
+			if (!n) throw new t("credential_rejected");
+			return n;
+		},
+		signOut: async () => {
+			await f("/sign-out", {}, () => "transport_failed", "redirect");
+		}
+	};
+};
+//#endregion
+export { t as GuestClientError, o as createGuestClient };

package/dist/guestCredential.js

@@ -0,0 +1,12 @@
+//#region src/guestCredential.ts
+var e = (e) => {
+	if (typeof e != "string" || e.length > 512) return null;
+	let [t, n, r, i] = e.split(".");
+	return !t || !/^guest_[a-zA-Z0-9_-]+$/.test(t) || !n || !/^gdev_[a-zA-Z0-9_-]+$/.test(n) || !r || !/^[a-zA-Z0-9_-]{43}$/.test(r) || i !== void 0 ? null : {
+		guestId: t,
+		deviceId: n,
+		secret: r
+	};
+};
+//#endregion
+export { e as parseGuestCredential };

package/dist/guestPasswordUpgrade.js

@@ -0,0 +1,85 @@
+import { hashPassword as e } from "./password.js";
+import { newAuthId as t } from "./userStore.js";
+import { dataStoreSessionRegistry as n } from "./sessionRegistry.js";
+import { GuestAuthError as r } from "./guestService.js";
+import { decideAdmission as i } from "./admission.js";
+import { runSubjectGuards as a } from "./subjectGuard.js";
+import { issueUserSession as o } from "./handlers.js";
+import { Effect as s } from "effect";
+import { and as c, eq as l } from "@voltro/database";
+//#region src/guestPasswordUpgrade.ts
+var u = (e, t, n) => ({
+	table: e,
+	predicate: l(t, n),
+	order: [],
+	take: void 0,
+	skip: void 0,
+	projection: void 0
+}), d = (e, t, n) => ({
+	kind: "refused",
+	status: e,
+	code: t,
+	message: n
+}), f = (f) => s.gen(function* () {
+	let { email: p, password: m, config: h } = f;
+	if (!p || !m) return d(400, "invalid", "email and password required");
+	if (m.length < 8) return d(400, "invalid", "password must be at least 8 characters");
+	if (yield* f.users.findByEmail(p)) return d(409, "email_taken", "email already registered");
+	let g = h.defaultTenantId, _ = yield* i(h.admit, {
+		email: p,
+		tenantId: g,
+		via: "sign-up"
+	});
+	if (_) return d(403, "not_admitted", _.message ?? _.reason);
+	let v = yield* e(m);
+	return yield* f.service.upgrade(f.credential, async (e) => {
+		let i = e.store;
+		if (e.tenantId !== g) throw new r({ code: "credential_rejected" });
+		if ((await i.query(u("users", "email", p))).length !== 0) throw new r({ code: "upgrade_conflict" });
+		let d = {
+			id: e.subjectId,
+			tenantId: g,
+			email: p,
+			passwordHash: v,
+			createdAt: e.createdAt,
+			mfaSecret: null,
+			mfaEnrolledAt: null,
+			emailVerifiedAt: null
+		};
+		if (!(await s.runPromise(a(h.subjectGuards ?? [], d))).ok) throw new r({ code: "credential_rejected" });
+		await i.insert("users", {
+			...d,
+			updatedAt: /* @__PURE__ */ new Date()
+		}), await i.insert("memberships", {
+			id: t("mem"),
+			userId: d.id,
+			tenantId: g,
+			role: "owner",
+			joinedAt: /* @__PURE__ */ new Date()
+		});
+		let m = {
+			...n(i),
+			listMemberships: (e) => s.promise(async () => (await i.query({
+				...u("memberships", "userId", e),
+				predicate: c(l("userId", e), l("tenantId", g))
+			})).map((t) => ({
+				userId: e,
+				tenantId: g,
+				role: String(t.role),
+				joinedAt: t.joinedAt instanceof Date ? t.joinedAt : new Date(String(t.joinedAt))
+			})))
+		}, _ = new Proxy(f.users, { get: (e, t) => typeof t == "string" && t in m ? m[t] : Reflect.get(e, t) }), y = await s.runPromise(o(d, _, h, {
+			clearLoginFailures: !1,
+			ipAddress: f.ipAddress ?? null,
+			userAgent: f.userAgent ?? null
+		}));
+		return {
+			kind: "ok",
+			userId: d.id,
+			subject: y.subject,
+			setCookie: y.setCookie
+		};
+	}).pipe(s.catch((e) => s.succeed(e.code === "upgrade_conflict" ? d(409, "email_taken", "email already registered") : e.code === "credential_rejected" ? d(401, "guest_rejected", "guest credential rejected") : d(503, "unavailable", "upgrade unavailable"))));
+}).pipe(s.catch(() => s.succeed(d(500, "upgrade_failed", "upgrade failed"))));
+//#endregion
+export { f as completeGuestPasswordUpgrade };

package/dist/guestPlugin.js

@@ -0,0 +1,166 @@
+import { clearSessionCookie as e, resolveSessionSecret as t, sessionSecretsOf as n } from "./session.js";
+import { CSRF_COOKIE_NAME as r, issueCsrfToken as i, verifyCsrf as a } from "./csrf.js";
+import { validateGuestSecrets as o } from "./guestSecrets.js";
+import { GuestAuthError as s, dataStoreGuestAuth as c } from "./guestService.js";
+import { guestTables as l } from "./guestSchema.js";
+import { sessionsTable as u } from "./schema.js";
+import { Duration as d, Effect as f, Result as p } from "effect";
+import { buildSetCookie as m, noteSigningLifetime as h, readCookie as g, readSessionValue as _, verifySessionKeyed as v } from "@voltro/protocol/session";
+import { definePlugin as y } from "@voltro/protocol";
+//#region src/guestPlugin.ts
+var b = (e, t, n = {}) => ({
+	status: e,
+	body: JSON.stringify(t),
+	contentType: "application/json",
+	headers: {
+		"cache-control": "no-store",
+		...n
+	}
+}), x = (x) => {
+	let S = x.prefix ?? "/auth/guest";
+	if (!/^\/[a-zA-Z0-9/_-]+$/.test(S) || S.endsWith("/")) throw Error("Guest route prefix must be an absolute path without a trailing slash");
+	if (!x.tenantId.trim()) throw Error("Guest authentication requires a server-owned tenant");
+	let C = d.toSeconds(x.ttl ?? "365 days"), w = d.toSeconds(x.sessionTtl ?? "7 days");
+	if (![C, w].every((e) => Number.isSafeInteger(e) && e > 0 && e <= 31536e4)) throw Error("Guest authentication lifetimes must be positive bounded whole seconds");
+	h("session", w * 1e3);
+	let T = () => o(x.secret ?? t()), E, D = /* @__PURE__ */ new WeakMap(), O = (e) => {
+		let t = D.get(e);
+		if (t) return t;
+		let n = x.service?.(e) ?? c(e, {
+			tenantId: x.tenantId,
+			secret: T,
+			ttlSeconds: C,
+			sessionTtlSeconds: w,
+			upgradeable: x.upgradeable ?? !0,
+			...x.secure === void 0 ? {} : { secure: x.secure }
+		});
+		return D.set(e, n), n;
+	}, k = (e) => f.gen(function* () {
+		return e.tenantId !== x.tenantId || e.kind !== "guest" ? yield* f.fail(new s({ code: "credential_rejected" })) : E ? O(E) : yield* f.fail(new s({ code: "store_unavailable" }));
+	}), A = async (t) => {
+		let n = T(), o = typeof n == "string" ? n : n.current.secret;
+		if (t.method === "GET" && t.path === S + "/csrf") {
+			let e = i(o);
+			return b(200, { token: e }, { "set-cookie": m(r, e, {
+				path: "/",
+				sameSite: "lax",
+				secure: x.secure ?? !0,
+				httpOnly: !1,
+				maxAgeSeconds: 3600
+			}) });
+		}
+		if (![
+			"/create",
+			"/resume",
+			"/prepare-rotation",
+			"/rotate",
+			"/revoke"
+		].some((e) => t.path === S + e)) return b(404, { error: "not_found" });
+		if (t.method !== "POST") return b(405, { error: "method_not_allowed" }, { allow: "POST" });
+		if ((t.headers["content-type"] ?? "").split(";")[0]?.trim() !== "application/json") return b(415, { error: "json_required" });
+		if (t.rawBody.byteLength > 2048) return b(413, { error: "body_too_large" });
+		if (t.headers.cookie && !a(t.headers["x-csrf-token"], g(t.headers.cookie, "voltro:csrf"), o)) return b(403, { error: "csrf_rejected" });
+		let s = t.store ?? E;
+		if (!s) return b(503, { error: "store_unavailable" });
+		let c;
+		try {
+			c = JSON.parse(new TextDecoder().decode(t.rawBody));
+		} catch {
+			return b(400, { error: "invalid_input" });
+		}
+		if (typeof c != "object" || !c || Array.isArray(c)) return b(400, { error: "invalid_input" });
+		let l = c, u = t.path === S + "/create", d = t.path === S + "/rotate";
+		if (Object.keys(l).some((e) => u || e !== "credential" && !(d && e === "nextCredential")) || !u && typeof l.credential != "string" || d && typeof l.nextCredential != "string") return b(400, { error: "invalid_input" });
+		let h = O(s);
+		if (u && _(t.headers)) return b(409, { error: "session_already_present" });
+		let v = typeof l.credential == "string" ? l.credential : "";
+		if (t.path === S + "/prepare-rotation") {
+			let e = await f.runPromise(f.result(h.prepareRotation(v)));
+			return p.isFailure(e) ? b(e.failure.code === "credential_rejected" ? 401 : 503, { error: e.failure.code }) : b(200, e.success);
+		}
+		let y = await f.runPromise(f.result(u ? h.create() : t.path === S + "/resume" ? h.resume(v) : d ? h.rotate(v, String(l.nextCredential)) : h.revoke(v).pipe(f.as(null))));
+		if (p.isFailure(y)) return b(y.failure.code === "credential_rejected" ? 401 : 503, { error: y.failure.code });
+		if (y.success === null) return b(200, { revoked: !0 }, { "set-cookie": e({ secure: x.secure ?? !0 }) });
+		let { subject: C, value: w, setCookie: D, deviceCredential: k } = y.success;
+		return b(200, {
+			subject: C,
+			session: w,
+			...k === void 0 ? {} : { deviceCredential: k }
+		}, { "set-cookie": D });
+	};
+	return {
+		...y({
+			name: "@voltro/plugin-auth#guest",
+			baseName: "@voltro/plugin-auth",
+			permissions: ["store:write"],
+			extendSchema: { tables: [...l, u] },
+			declaredEnv: x.secret === void 0 ? [{
+				name: "VOLTRO_SESSION_SECRET",
+				required: !0,
+				secret: !0,
+				generate: "base64url",
+				description: "Signs this project's ordinary and guest sessions"
+			}] : [],
+			privacy: { collects: [{
+				category: "identifiers",
+				linked: !0,
+				tracking: !1,
+				purposes: ["app-functionality"]
+			}] },
+			subjectPrivacy: {
+				tables: [...l, u].map((e) => e.tableName),
+				kinds: ["guest"],
+				erasePhase: "identity"
+			},
+			onErase: (e, t) => k(t).pipe(f.flatMap((t) => t.erase(e)), f.asVoid),
+			onExport: (e, t) => k(t).pipe(f.flatMap((t) => t.export(e))),
+			httpRoutes: [{
+				method: "*",
+				path: S,
+				handle: A
+			}],
+			bindDataStore: (e) => {
+				E = e;
+			},
+			onActivate: () => f.sync(() => {
+				T();
+			}),
+			onDeactivate: () => f.sync(() => {
+				E = void 0;
+			})
+		}),
+		guest: { service: () => {
+			if (!E) throw Error("Guest lifecycle requires the bound app DataStore");
+			return O(E);
+		} },
+		auth: { sessionStrategy: {
+			id: "voltro-guest",
+			resolve: async (e) => {
+				let t = _(e.headers);
+				if (!t) return { kind: "skip" };
+				let r = v(t, n(T()));
+				if (!r) return {
+					kind: "failed",
+					reason: "voltro session cookie failed verification"
+				};
+				if (r.subject.type !== "user" || r.subject.kind !== "guest") return { kind: "skip" };
+				let i = e.store ?? E;
+				if (!i) return {
+					kind: "failed",
+					reason: "guest session registry unavailable"
+				};
+				let a = await f.runPromise(f.result(O(i).isLive(r.subject)));
+				return p.isSuccess(a) && a.success ? {
+					kind: "matched",
+					subject: r.subject,
+					credentialExpiresAt: r.exp * 1e3
+				} : {
+					kind: "failed",
+					reason: "guest session revoked or expired"
+				};
+			}
+		} }
+	};
+};
+//#endregion
+export { x as guestAuthPlugin };

package/dist/guestSchema.js

@@ -0,0 +1,20 @@
+import { boolean as e, id as t, integer as n, table as r, text as i, timestamp as a } from "@voltro/database";
+//#region src/guestSchema.ts
+var o = r("authGuests", {
+	id: t(),
+	tenantId: i(),
+	upgradeable: e(),
+	expiresAt: a(),
+	createdAt: a(),
+	lastSeenAt: a()
+}).index(["tenantId"]), s = r("authGuestDevices", {
+	id: t(),
+	guestId: i(),
+	tenantId: i(),
+	secretHash: i().serverOnly(),
+	generation: n(),
+	expiresAt: a(),
+	createdAt: a()
+}).index(["guestId"]).index(["tenantId"]), c = [o, s];
+//#endregion
+export { s as authGuestDevicesTable, o as authGuestsTable, c as guestTables };