@voltro/plugin-auth 0.86.0 → 0.88.0

package/dist/schema.js

@@ -1,107 +1,107 @@
-import { id as e, integer as t, table as n, text as r, timestamp as i } from "@voltro/database";
-//#region src/schema/index.ts
-var a = n("users", {
-	id: e(),
-	email: r().unique(),
-	passwordHash: r().nullable(),
-	tenantId: r(),
-	mfaSecret: r().nullable(),
-	mfaEnrolledAt: i().nullable(),
-	emailVerifiedAt: i().nullable(),
-	createdAt: i().default("now"),
-	updatedAt: i().default("now").onUpdate("now")
-}).index(["tenantId"]), o = n("sessions", {
-	id: e(),
-	familyId: r().nullable(),
-	rotatedAt: i().nullable(),
-	userId: r(),
-	tenantId: r(),
-	expiresAt: i(),
-	ipAddress: r().nullable(),
-	userAgent: r().nullable(),
-	createdAt: i().default("now"),
-	lastSeenAt: i().default("now").onUpdate("now")
-}).index(["userId"]).index(["tenantId"]).index(["familyId"]), s = n("memberships", {
-	id: e(),
-	userId: r(),
-	tenantId: r(),
-	role: r(),
-	joinedAt: i().default("now")
-}).unique("byUserTenant", ["userId", "tenantId"]).index(["tenantId"]), c = n("authTokens", {
-	id: e(),
-	tokenHash: r().unique(),
-	userId: r(),
-	purpose: r(),
-	expiresAt: i(),
-	consumedAt: i().nullable(),
-	createdAt: i().default("now")
-}).index(["userId"]).index(["purpose"]), l = n("passkeys", {
-	id: e(),
-	credentialId: r().unique(),
-	userId: r(),
-	publicKey: r(),
-	counter: t().default(0),
-	transports: r().nullable(),
-	createdAt: i().default("now"),
-	lastUsedAt: i().nullable()
-}).index(["userId"]), u = n("recoveryCodes", {
-	id: e(),
-	userId: r(),
-	codeHash: r(),
-	consumedAt: i().nullable(),
-	createdAt: i().default("now")
-}).index(["userId"]), d = n("passkeyChallenges", {
-	id: e(),
-	key: r().unique(),
-	challenge: r(),
-	expiresAt: i(),
-	createdAt: i().default("now")
-}), f = n("loginAttempts", {
-	id: e(),
-	email: r().unique(),
-	failedCount: t().default(0),
-	windowStartedAt: i().nullable(),
-	lockedUntil: i().nullable(),
-	createdAt: i().default("now"),
-	updatedAt: i().default("now").onUpdate("now")
-}), p = n("invitations", {
-	id: e({ prefix: "inv" }),
-	tokenHash: r().unique(),
-	email: r(),
-	tenantId: r(),
-	role: r(),
-	invitedByUserId: r(),
-	expiresAt: i(),
-	acceptedAt: i().nullable(),
-	acceptedByUserId: r().nullable(),
-	revokedAt: i().nullable(),
-	revokedByUserId: r().nullable(),
-	createdAt: i().default("now")
-}).index(["tenantId"]).index(["email"]), m = n("impersonationGrants", {
-	id: e({ prefix: "imp" }),
-	sessionId: r().unique(),
-	actorUserId: r(),
-	actorSessionId: r(),
-	targetUserId: r(),
-	tenantId: r(),
-	reason: r().nullable(),
-	startedAt: i().default("now"),
-	expiresAt: i(),
-	endedAt: i().nullable(),
-	endedReason: r().nullable(),
-	ipAddress: r().nullable(),
-	userAgent: r().nullable()
-}).index(["actorUserId"]).index(["targetUserId"]), h = [
-	a,
-	o,
-	s,
+import { authGuestDevicesTable as e, authGuestsTable as t, guestTables as n } from "./guestSchema.js";
+import { id as r, integer as i, table as a, text as o, timestamp as s } from "@voltro/database";
+// src/schema/index.ts
+var c = a("users", {
+	id: r(),
+	email: o().nullable(),
+	passwordHash: o().nullable(),
+	tenantId: o(),
+	mfaSecret: o().nullable(),
+	mfaEnrolledAt: s().nullable(),
+	emailVerifiedAt: s().nullable(),
+	createdAt: s().default("now"),
+	updatedAt: s().default("now").onUpdate("now")
+}).index(["tenantId"]).uniqueActive("usersEmailUnique", ["email"], { where: "\"email\" IS NOT NULL" }), l = a("sessions", {
+	id: r(),
+	familyId: o().nullable(),
+	rotatedAt: s().nullable(),
+	userId: o(),
+	tenantId: o(),
+	expiresAt: s(),
+	ipAddress: o().nullable(),
+	userAgent: o().nullable(),
+	createdAt: s().default("now"),
+	lastSeenAt: s().default("now").onUpdate("now")
+}).index(["userId"]).index(["tenantId"]).index(["familyId"]), u = a("memberships", {
+	id: r(),
+	userId: o(),
+	tenantId: o(),
+	role: o(),
+	joinedAt: s().default("now")
+}).unique("byUserTenant", ["userId", "tenantId"]).index(["tenantId"]), d = a("authTokens", {
+	id: r(),
+	tokenHash: o().unique(),
+	userId: o(),
+	purpose: o(),
+	expiresAt: s(),
+	consumedAt: s().nullable(),
+	createdAt: s().default("now")
+}).index(["userId"]).index(["purpose"]), f = a("passkeys", {
+	id: r(),
+	credentialId: o().unique(),
+	userId: o(),
+	publicKey: o(),
+	counter: i().default(0),
+	transports: o().nullable(),
+	createdAt: s().default("now"),
+	lastUsedAt: s().nullable()
+}).index(["userId"]), p = a("recoveryCodes", {
+	id: r(),
+	userId: o(),
+	codeHash: o(),
+	consumedAt: s().nullable(),
+	createdAt: s().default("now")
+}).index(["userId"]), m = a("passkeyChallenges", {
+	id: r(),
+	key: o().unique(),
+	challenge: o(),
+	expiresAt: s(),
+	createdAt: s().default("now")
+}), h = a("loginAttempts", {
+	id: r(),
+	email: o().unique(),
+	failedCount: i().default(0),
+	windowStartedAt: s().nullable(),
+	lockedUntil: s().nullable(),
+	createdAt: s().default("now"),
+	updatedAt: s().default("now").onUpdate("now")
+}), g = a("invitations", {
+	id: r({ prefix: "inv" }),
+	tokenHash: o().unique(),
+	email: o(),
+	tenantId: o(),
+	role: o(),
+	invitedByUserId: o(),
+	expiresAt: s(),
+	acceptedAt: s().nullable(),
+	acceptedByUserId: o().nullable(),
+	revokedAt: s().nullable(),
+	revokedByUserId: o().nullable(),
+	createdAt: s().default("now")
+}).index(["tenantId"]).index(["email"]), _ = a("impersonationGrants", {
+	id: r({ prefix: "imp" }),
+	sessionId: o().unique(),
+	actorUserId: o(),
+	actorSessionId: o(),
+	targetUserId: o(),
+	tenantId: o(),
+	reason: o().nullable(),
+	startedAt: s().default("now"),
+	expiresAt: s(),
+	endedAt: s().nullable(),
+	endedReason: o().nullable(),
+	ipAddress: o().nullable(),
+	userAgent: o().nullable()
+}).index(["actorUserId"]).index(["targetUserId"]), v = [
 	c,
 	l,
 	u,
 	d,
 	f,
 	p,
-	m
+	m,
+	h,
+	g,
+	_
 ];
-//#endregion
-export { h as authTables, c as authTokensTable, m as impersonationGrantsTable, p as invitationsTable, f as loginAttemptsTable, s as membershipsTable, d as passkeyChallengesTable, l as passkeysTable, u as recoveryCodesTable, o as sessionsTable, a as usersTable };
+export { e as authGuestDevicesTable, t as authGuestsTable, v as authTables, d as authTokensTable, n as guestTables, _ as impersonationGrantsTable, g as invitationsTable, h as loginAttemptsTable, u as membershipsTable, m as passkeyChallengesTable, f as passkeysTable, p as recoveryCodesTable, l as sessionsTable, c as usersTable };

package/dist/session.js

@@ -1,5 +1,5 @@
 import { DEFAULT_SESSION_KID as e, buildSetCookie as t, readCookie as n, readSessionValue as r, resolveOptionalSessionSecrets as i, resolveSessionSecret as a, resolveSessionSecrets as o, signSession as s, timingSafeStringEqual as c, verifySessionKeyed as l } from "@voltro/protocol/session";
-//#region src/session.ts
+// src/session.ts
 var u = "voltro:session", d = 604800, f = a, p = o, m = (e) => typeof e == "string" ? e : e.current, h = (t) => {
 	if (typeof t != "string") return t;
 	let n = i(), r = {
@@ -40,5 +40,4 @@ var u = "voltro:session", d = 604800, f = a, p = o, m = (e) => typeof e == "stri
 	...e.domain ? { domain: e.domain } : {},
 	path: "/"
 });
-//#endregion
 export { u as SESSION_COOKIE_NAME, b as clearSessionCookie, g as issueSession, _ as readSession, y as readSessionFromHeaders, v as readSessionKeyed, f as resolveSessionSecret, p as resolveSessionSecrets, h as sessionSecretsOf };

package/dist/sessionFamily.js

@@ -0,0 +1,14 @@
+// src/sessionFamily.ts
+var e = (e) => {
+	if (typeof e.id != "string" || e.id.length === 0 || typeof e.userId != "string" || e.userId.length === 0) return null;
+	let t = e.familyId ?? e.id;
+	return typeof t == "string" && t.length > 0 ? t : null;
+}, t = (t, n) => {
+	let r = e(t);
+	return r !== null && n != null && n.id === r && n.userId === t.userId && e(n) === n.id;
+}, n = (e) => {
+	let t = /* @__PURE__ */ new Map();
+	for (let n of e) typeof n.id == "string" && n.id.length !== 0 && t.set(n.id, t.has(n.id) ? null : n);
+	return t;
+}, r = (e, t, n, r) => e !== null && typeof t == "string" && t.length > 0 && typeof n == "string" && n.length > 0 && Number.isFinite(r) && e.id === t && e.userId === n && e.rotatedAt == null && e.expiresAt instanceof Date && Number.isFinite(e.expiresAt.getTime()) && e.expiresAt.getTime() > r;
+export { t as hasOwnedSessionFamily, n as indexSessionFamilies, r as isSessionCredentialLiveFor, e as sessionFamilyId };

package/dist/sessionRegistry.js

@@ -1,48 +1,59 @@
 import { issueSession as e } from "./session.js";
-import { newAuthId as t } from "./userStore.js";
-import { Effect as n } from "effect";
-import { eq as r } from "@voltro/database";
-//#region src/sessionRegistry.ts
-var i = "sessions", a = 604800, o = (e) => ({
+import { hasOwnedSessionFamily as t, indexSessionFamilies as n, sessionFamilyId as r } from "./sessionFamily.js";
+import { newAuthId as i } from "./userStore.js";
+import { Effect as a } from "effect";
+import { and as o, columnRef as s, eq as c, isNull as l, or as u } from "@voltro/database";
+// src/sessionRegistry.ts
+var d = "sessions", f = 604800, p = (e) => ({
 	...e,
 	expiresAt: new Date(e.expiresAt),
 	createdAt: new Date(e.createdAt),
 	lastSeenAt: new Date(e.lastSeenAt),
 	rotatedAt: e.rotatedAt == null ? null : new Date(e.rotatedAt)
-}), s = async (e, t, n = !1) => await e.query({
-	table: i,
+}), m = async (e, t, n = !1) => await e.query({
+	table: d,
 	predicate: t,
-	order: [],
+	order: n ? [{
+		column: "id",
+		direction: "asc"
+	}] : [],
 	take: void 0,
 	skip: void 0,
 	projection: void 0,
 	...n ? { lock: "update" } : {}
-}), c = (e, t, n) => t.transaction === "existing" ? n(e) : e.transactional((e) => n(e)), l = (e) => e.familyId ?? e.id, u = (e) => e.rotatedAt == null, d = async (e, t, n) => {
-	let i = (await s(e, r("id", n)))[0];
-	if (!i || i.userId !== t) return null;
-	let a = l(i), o = (await s(e, r("id", a), !0))[0];
-	if (!o || o.userId !== t || l(o) !== a) return null;
-	let c = (await s(e, r("userId", t))).filter((e) => l(e) === a), u = c.find((e) => e.id === n);
-	return u ? {
-		root: o,
-		current: u,
-		rows: c
+}), h = (e, t, n) => t.transaction === "existing" ? n(e) : e.transactional((e) => n(e)), g = (e) => e.familyId ?? e.id, _ = (e) => e.rotatedAt == null, v = async (e, t, n) => {
+	let r = (await m(e, c("id", n)))[0];
+	if (!r || r.userId !== t) return null;
+	let i = g(r), a = (await m(e, c("id", i), !0))[0];
+	if (!a || a.userId !== t || g(a) !== i) return null;
+	let o = n === a.id ? a : (await m(e, c("id", n), !0))[0];
+	return o && o.userId === t && g(o) === i ? {
+		root: a,
+		current: o
 	} : null;
-}, f = async (e, t, n) => {
-	let r = await d(e, t, n);
-	if (!r) return {
-		removed: !1,
-		credentials: 0
-	};
-	let a = 0, o = !1;
-	for (let t of r.rows) await e.delete(i, t.id) && (o = !0, u(t) && (a += 1));
+}, y = async (e, t, n) => {
+	let r = await v(e, t, n);
+	return r && _(r.current) ? p(r.current) : null;
+}, b = async (e, t, n) => {
+	if (n.userId !== t || g(n) !== n.id) throw Error("The locked session family requires reconciliation.");
+	let r = await m(e, o(c("userId", t), u(c("id", n.id), c("familyId", n.id))), !0), i = 0, a = !1;
+	for (let t of r) await e.delete(d, t.id) && (a = !0, _(t) && (i += 1));
 	return {
-		removed: o,
-		credentials: a
+		removed: a,
+		credentials: i
 	};
-}, p = (e, t = {}) => ({
-	listSessions: (t) => n.promise(async () => (await s(e, r("userId", t))).filter(u).map(o).sort((e, t) => t.createdAt.getTime() - e.createdAt.getTime())),
-	insertSession: (t) => n.promise(async () => {
+}, x = async (e, t, n) => {
+	let r = await v(e, t, n);
+	return r === null ? {
+		removed: !1,
+		credentials: 0
+	} : b(e, t, r.root);
+}, S = (e, t) => m(e, o(c("userId", t), u(l("familyId"), c("familyId", s("id")))), !0), C = (e, i = {}) => ({
+	listSessions: (i) => a.promise(async () => {
+		let a = await m(e, c("userId", i)), o = n(a);
+		return a.filter((e) => e.userId === i && _(e) && o.get(e.id) === e && t(e, o.get(r(e) ?? ""))).map(p).sort((e, t) => t.createdAt.getTime() - e.createdAt.getTime());
+	}),
+	insertSession: (t) => a.promise(async () => {
 		let n = /* @__PURE__ */ new Date(), r = {
 			...t,
 			familyId: t.familyId ?? t.id,
@@ -50,69 +61,72 @@ var i = "sessions", a = 604800, o = (e) => ({
 			createdAt: n,
 			lastSeenAt: n
 		};
-		return await e.insert(i, r), r;
+		return await e.insert(d, r), r;
 	}),
-	findSession: (t) => n.promise(async () => {
-		let n = (await s(e, r("id", t)))[0];
-		return n && u(n) ? o(n) : null;
+	findSession: (n) => a.promise(async () => {
+		let i = await m(e, c("id", n)), a = i.length === 1 ? i[0] : void 0;
+		if (!a || a.id !== n || !_(a)) return null;
+		let o = r(a);
+		if (o === null) return null;
+		let s = o === a.id ? [a] : await m(e, c("id", o));
+		return s.length === 1 && t(a, s[0]) ? p(a) : null;
 	}),
-	touchSession: (a, o) => n.promise(() => c(e, t, async (e) => {
-		let t = (await s(e, r("id", a)))[0];
-		if (!t) return;
-		let n = await d(e, t.userId, a);
-		n && u(n.current) && (await e.update(i, a, {
-			expiresAt: o,
+	touchSession: (t, n) => a.promise(() => h(e, i, async (e) => {
+		let r = (await m(e, c("id", t)))[0];
+		if (!r) return;
+		let i = await v(e, r.userId, t);
+		i && _(i.current) && (await e.update(d, t, {
+			expiresAt: n,
 			lastSeenAt: /* @__PURE__ */ new Date()
-		}), n.root.id !== a && new Date(n.root.expiresAt) < o && await e.update(i, n.root.id, { expiresAt: o }));
+		}), i.root.id !== t && new Date(i.root.expiresAt) < n && await e.update(d, i.root.id, { expiresAt: n }));
 	})),
-	revokeSession: (r, i) => n.promise(() => c(e, t, async (e) => (await f(e, r, i)).removed)),
-	revokeAllOtherSessions: (i, a) => n.promise(() => c(e, t, async (e) => {
-		let t = await s(e, r("userId", i)), n = t.find((e) => e.id === a), o = n ? l(n) : void 0, c = [...new Set(t.map(l))].filter((e) => e !== o).sort(), u = 0;
-		for (let t of c) u += (await f(e, i, t)).credentials;
-		return u;
+	revokeSession: (t, n) => a.promise(() => h(e, i, async (e) => (await x(e, t, n)).removed)),
+	revokeAllOtherSessions: (t, n) => a.promise(() => h(e, i, async (e) => {
+		let r = await S(e, t), i = (await m(e, o(c("userId", t), c("id", n)), !0))[0], a = i && r.some((e) => e.id === g(i)) ? g(i) : void 0, s = 0;
+		for (let n of r) n.id !== a && (s += (await b(e, t, n)).credentials);
+		return s;
 	})),
-	revokeAllSessions: (i) => n.promise(() => c(e, t, async (e) => {
-		let t = [...new Set((await s(e, r("userId", i))).map(l))].sort(), n = 0;
-		for (let r of t) n += (await f(e, i, r)).credentials;
-		return n;
+	revokeAllSessions: (t) => a.promise(() => h(e, i, async (e) => {
+		let n = await S(e, t), r = 0;
+		for (let i of n) r += (await b(e, t, i)).credentials;
+		return r;
 	}))
-}), m = (e, t) => e.type === "user" ? {
+}), w = (e, t) => e.type === "user" ? {
 	...e,
 	metadata: {
 		...e.metadata ?? {},
 		sessionId: t
 	}
-} : e, h = async (r, i, o, s, c) => {
-	if (i.type !== "user") throw Error("issueRegisteredSession: only a user subject has a session row");
-	let l = t("sess"), u = s.ttlSeconds ?? a, d = (s.now ?? Date.now)();
-	await n.runPromise(r.insertSession({
-		id: l,
-		familyId: c ?? l,
+} : e, T = async (t, n, r, o, s) => {
+	if (n.type !== "user") throw Error("issueRegisteredSession: only a user subject has a session row");
+	let c = i("sess"), l = o.ttlSeconds ?? f, u = (o.now ?? Date.now)();
+	await a.runPromise(t.insertSession({
+		id: c,
+		familyId: s ?? c,
 		rotatedAt: null,
-		userId: i.id,
-		tenantId: i.tenantId ?? "",
-		expiresAt: new Date(d + u * 1e3),
-		ipAddress: s.ipAddress ?? null,
-		userAgent: s.userAgent ?? null
+		userId: n.id,
+		tenantId: n.tenantId ?? "",
+		expiresAt: new Date(u + l * 1e3),
+		ipAddress: o.ipAddress ?? null,
+		userAgent: o.userAgent ?? null
 	}));
-	let { ipAddress: f, userAgent: p, ...h } = s;
+	let { ipAddress: d, userAgent: p, ...m } = o;
 	return {
-		...e(m(i, l), o, h),
-		sessionId: l
+		...e(w(n, c), r, m),
+		sessionId: c
 	};
-}, g = async (e, t, n, r = {}) => h(e, t, n, r), _ = async (e, t, n, r, o = {}) => t.type === "user" ? c(e, o, async (e) => {
-	let s = await d(e, t.id, n), c = (o.now ?? Date.now)();
-	if (!s || !u(s.current) || new Date(s.current.expiresAt).getTime() <= c) return null;
-	let l = new Date(c + (o.ttlSeconds ?? a) * 1e3);
-	await e.update(i, s.current.id, {
-		familyId: s.root.id,
-		rotatedAt: new Date(c)
-	}), await e.update(i, s.root.id, {
-		familyId: s.root.id,
-		expiresAt: new Date(Math.max(new Date(s.root.expiresAt).getTime(), l.getTime()))
+}, E = async (e, t, n, r = {}) => T(e, t, n, r), D = async (e, t, n, r, i = {}) => t.type === "user" ? h(e, i, async (e) => {
+	let a = await v(e, t.id, n), o = (i.now ?? Date.now)();
+	if (!a || !_(a.current) || new Date(a.current.expiresAt).getTime() <= o) return null;
+	let s = new Date(o + (i.ttlSeconds ?? f) * 1e3);
+	await e.update(d, a.current.id, {
+		familyId: a.root.id,
+		rotatedAt: new Date(o)
+	}), await e.update(d, a.root.id, {
+		familyId: a.root.id,
+		expiresAt: new Date(Math.max(new Date(a.root.expiresAt).getTime(), s.getTime()))
 	});
-	let { transaction: f, ...m } = o;
-	return h(p(e, { transaction: "existing" }), t, r, m, s.root.id);
+	let { transaction: c, ...l } = i;
+	return T(C(e, { transaction: "existing" }), t, r, l, a.root.id);
 }) : null;
-//#endregion
-export { p as dataStoreSessionRegistry, g as issueRegisteredSession, _ as rotateRegisteredSession, m as withSessionId };
+export { C as dataStoreSessionRegistry, E as issueRegisteredSession, y as lockRegisteredSession, D as rotateRegisteredSession, w as withSessionId };

package/dist/signedClaims.js

@@ -0,0 +1,23 @@
+import { createHmac as e, timingSafeEqual as t } from "node:crypto";
+// src/signedClaims.ts
+var n = (t, n, r) => e("sha256", n).update(`${r}:${t}`).digest(), r = (e, t, r) => {
+	if (t.length < 32 || typeof e.exp != "number" || !Number.isSafeInteger(e.exp)) throw Error("Auth handoff requires a project signing key and whole-second expiry");
+	let i = Buffer.from(JSON.stringify(e), "utf8").toString("base64url");
+	if (i.length > 8192) throw Error("Auth handoff exceeds its payload budget");
+	return `${i}.${n(i, t, r).toString("base64url")}`;
+}, i = (e, r, i, a = Date.now) => {
+	if (!e || e.length > 8256 || r.length < 32) return null;
+	let o = e.split("."), [s, c] = o;
+	if (o.length !== 2 || !s || !c || !/^[A-Za-z0-9_-]+$/.test(s) || !/^[A-Za-z0-9_-]{43}$/.test(c)) return null;
+	let l = Buffer.from(c, "base64url"), u = n(s, r, i);
+	if (l.length !== u.length || !t(l, u)) return null;
+	try {
+		let e = JSON.parse(Buffer.from(s, "base64url").toString("utf8"));
+		if (typeof e != "object" || !e || Array.isArray(e)) return null;
+		let t = e, n = a();
+		return !Number.isFinite(n) || typeof t.exp != "number" || !Number.isSafeInteger(t.exp) || t.exp * 1e3 <= n ? null : t;
+	} catch {
+		return null;
+	}
+};
+export { r as signAuthClaims, i as verifyAuthClaims };

package/dist/strategy.d.ts

@@ -243,10 +243,10 @@ declare interface SessionRecord {
 declare type SessionRegistry = SessionStore;
 
 declare interface SessionRevocationChecker {
-    /** Is this session still live? `false` means the row was revoked (or
-     *  is past its `expiresAt`) — the caller rejects the cookie. Verdicts
-     *  are cached for `ttlMs`. */
-    readonly isLive: (sessionId: string) => Effect.Effect<boolean>;
+    /** Is this exact session credential live for the signed subject's user ID?
+     * Refuse a missing/rotated/expired row or a different stored owner. Cache
+     * verdicts retain native owner identity, never the requested owner. */
+    readonly isLiveFor: (sessionId: string, userId: string) => Effect.Effect<boolean>;
     /** Drop the cached verdict for one session — called inline by
      *  sign-out / revoke handlers so the kill is immediate on THIS
      *  process (other replicas converge within `ttlMs`). */
@@ -276,13 +276,14 @@ declare type SessionSecretInput = string | SessionSecrets;
 
 /** Server-side sessions — enumeration + revocation. */
 declare interface SessionStore {
-    /** Active sessions for a user (most recent first). */
+    /** Unrotated credentials with an existing canonical root owned by the same user, most recent first. */
     readonly listSessions: (userId: string) => Effect.Effect<ReadonlyArray<SessionRecord>>;
     /** Record a session on sign-in. */
     readonly insertSession: (session: Omit<SessionRecord, 'createdAt' | 'lastSeenAt'>) => Effect.Effect<SessionRecord>;
-    /** Look up one session row by id. The request-time revocation check
-     *  (`makeSessionRevocationChecker`) calls this — a missing row means
-     *  the session was revoked. */
+    /** Look up an unrotated credential only while its canonical family root
+     * exists and belongs to the same user. A rotated root remains an anchor;
+     * its tenant does not replace the credential tenant. Custom stores must
+     * enforce this before returning a row to request-time revocation checks. */
     readonly findSession: (sessionId: string) => Effect.Effect<SessionRecord | null>;
     /** Slide a session row forward: bump `expiresAt` + `lastSeenAt`. Called
      *  when the sliding-window renewal re-issues the cookie, so the row
@@ -356,7 +357,7 @@ declare const UserNotFoundError_base: new <A extends Record<string, any> = {}>(a
 
 declare interface UserRecord {
     readonly id: string;
-    readonly email: string;
+    readonly email: string | null;
     /**
      * The stored scrypt hash — OPTIONAL, because not every identity has a
      * password. An SSO-only, magic-link-only, passkey-only, or provider-PAT
@@ -445,6 +446,9 @@ export declare interface VoltroPasswordStrategyOptions {
      *  (stateless); with it, nothing but a registered session authenticates,
      *  and every session can be revoked. */
     readonly requireSessionId?: boolean;
+    /** Verified user identity kinds owned by this carrier. Other verified kinds
+     * skip to their own carrier; malformed, forged or expired values still fail. */
+    readonly userKinds?: ReadonlyArray<'registered' | 'guest'>;
 }
 
 export { }

package/dist/strategy.js

@@ -1,33 +1,34 @@
 import { sessionSecretsOf as e } from "./session.js";
-import { makeSessionRevocationChecker as t } from "./revocation.js";
-import { sessionIdOfSubject as n } from "./userStore.js";
-import { Effect as r } from "effect";
-import { readSessionValue as i, resolveSessionSecret as a, verifySessionKeyed as o } from "@voltro/protocol/session";
-//#region src/strategy.ts
-var s = (e) => typeof e.isLive == "function", c = (e) => e.revocation && s(e.revocation) ? e.revocation : e.store ? t(e.store, e.revocation ?? {}) : null, l = (l = {}) => {
-	let d = l.cookieName ?? "voltro:session", f = c(l), p = l.revocation && !s(l.revocation) ? l.revocation : {}, m = /* @__PURE__ */ new WeakMap(), h = (e) => {
+import { makeSessionRevocationChecker as t, validateSessionRevocationOptions as n } from "./revocation.js";
+import { sessionIdOfSubject as r } from "./userStore.js";
+import { Effect as i } from "effect";
+import { readSessionValue as a, resolveSessionSecret as o, verifySessionKeyed as s } from "@voltro/protocol/session";
+// src/strategy.ts
+var c = (e) => typeof e == "object" && !!e && "isLiveFor" in e && typeof e.isLiveFor == "function" && "invalidate" in e && typeof e.invalidate == "function" && typeof e.ttlMs == "number" && Number.isFinite(e.ttlMs) && e.ttlMs >= 0, l = (e) => e.revocation && c(e.revocation) ? e.revocation : (e.revocation !== void 0 && n(e.revocation), e.store ? t(e.store, e.revocation ?? {}) : null), u = (n = {}) => {
+	let u = n.cookieName ?? "voltro:session", f = l(n), p = n.revocation && !c(n.revocation) ? n.revocation : {}, m = /* @__PURE__ */ new WeakMap(), h = (e) => {
 		if (f) return f;
-		let n = l.sessionRegistry;
-		if (n === void 0) return null;
-		if (typeof n != "function") return t(n, p);
+		let r = n.sessionRegistry;
+		if (r === void 0) return null;
+		if (typeof r != "function") return t(r, p);
 		if (e === void 0) return null;
-		let r = m.get(e);
-		if (r) return r;
-		let i = t(n(e), p);
-		return m.set(e, i), i;
+		let i = m.get(e);
+		if (i) return i;
+		let a = t(r(e), p);
+		return m.set(e, a), a;
 	};
 	return {
 		id: "voltro-password",
 		resolve: (t) => {
-			let s = i(t.headers, d);
-			if (!s) return { kind: "skip" };
-			let c = e(l.secret ?? a()), f = o(s, c);
+			let c = a(t.headers, u);
+			if (!c) return { kind: "skip" };
+			let l = e(n.secret ?? o()), f = s(c, l);
 			if (!f) return {
 				kind: "failed",
 				reason: "voltro session cookie failed verification"
 			};
-			let p = u(f.subject, "voltro-password"), m = n(p);
-			if (!m) return l.requireSessionId === !0 ? {
+			if (f.subject.type === "user" && n.userKinds && !n.userKinds.includes(f.subject.kind === "guest" ? "guest" : "registered")) return { kind: "skip" };
+			let p = d(f.subject, "voltro-password"), m = r(p);
+			if (!m) return n.requireSessionId === !0 ? {
 				kind: "failed",
 				reason: "voltro session cookie carries no session id"
 			} : {
@@ -35,13 +36,16 @@ var s = (e) => typeof e.isLive == "function", c = (e) => e.revocation && s(e.rev
 				subject: p
 			};
 			let g = h(t.store);
-			return g ? r.runPromise(g.isLive(m)).then((e) => e ? {
+			return g ? p.type === "user" ? i.runPromise(g.isLiveFor(m, p.id)).then((e) => e ? {
 				kind: "matched",
 				subject: p
 			} : {
 				kind: "failed",
 				reason: "voltro session revoked"
-			}) : l.requireSessionId === !0 && l.sessionRegistry !== void 0 ? {
+			}) : {
+				kind: "failed",
+				reason: "registered session requires a user subject"
+			} : n.requireSessionId === !0 ? {
 				kind: "failed",
 				reason: "session registry not available yet"
 			} : {
@@ -50,7 +54,7 @@ var s = (e) => typeof e.isLive == "function", c = (e) => e.revocation && s(e.rev
 			};
 		}
 	};
-}, u = (e, t) => {
+}, d = (e, t) => {
 	if (e.type === "anonymous") return e;
 	let n = e.metadata ?? {};
 	return {
@@ -61,5 +65,4 @@ var s = (e) => typeof e.isLive == "function", c = (e) => e.revocation && s(e.rev
 		}
 	};
 };
-//#endregion
-export { l as voltroPasswordStrategy };
+export { u as voltroPasswordStrategy };