@voltro/plugin-auth 0.86.0 → 0.88.0

package/dist/subjectGuard.js

@@ -1,5 +1,5 @@
 import { Effect as e } from "effect";
-//#region src/subjectGuard.ts
+// src/subjectGuard.ts
 var t = { ok: !0 }, n = (n, r) => e.gen(function* () {
 	for (let e of n) {
 		let t = yield* e(r);
@@ -7,5 +7,4 @@ var t = { ok: !0 }, n = (n, r) => e.gen(function* () {
 	}
 	return t;
 });
-//#endregion
 export { n as runSubjectGuards };

package/dist/tokens.js

@@ -1,5 +1,5 @@
 import { createHash as e, randomBytes as t } from "node:crypto";
-//#region src/tokens.ts
+// src/tokens.ts
 var n = 900, r = 3600, i = 86400, a = 300, o = 300, s = {
 	"magic-link": 900,
 	"password-reset": r,
@@ -17,5 +17,4 @@ var n = 900, r = 3600, i = 86400, a = 300, o = 300, s = {
 	...u(t ?? s[e]),
 	purpose: e
 });
-//#endregion
 export { i as EMAIL_VERIFY_TTL_S, n as MAGIC_LINK_TTL_S, a as MFA_PENDING_TTL_S, o as NATIVE_CODE_TTL_S, r as PASSWORD_RESET_TTL_S, l as hashToken, u as mintSecret, d as mintToken };

package/dist/totp.js

@@ -1,6 +1,6 @@
 import { createHmac as e, randomBytes as t, timingSafeEqual as n } from "node:crypto";
 import { Data as r, Effect as i } from "effect";
-//#region src/totp.ts
+// src/totp.ts
 var a = 30, o = 6, s = 20, c = "sha1", l = 1, u = class extends r.TaggedError("TotpVerifyError") {}, d = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567", f = (e) => {
 	let t = 0, n = 0, r = "";
 	for (let i of e) for (n = n << 8 | i, t += 8; t >= 5;) r += d[n >>> t - 5 & 31], t -= 5;
@@ -51,5 +51,4 @@ var a = 30, o = 6, s = 20, c = "sha1", l = 1, u = class extends r.TaggedError("T
 	}
 	return n;
 };
-//#endregion
 export { u as TotpVerifyError, b as generateRecoveryCodes, v as generateTotpCode, g as generateTotpSecret, _ as otpauthUrl, y as verifyTotpCode };

package/dist/userStore.js

@@ -1,71 +1,75 @@
-import { Data as e, Effect as t } from "effect";
-import { generateId as n } from "@voltro/database";
-//#region src/userStore.ts
-var r = class extends e.TaggedError("UserAlreadyExistsError") {}, i = class extends e.TaggedError("UserNotFoundError") {}, a = (e) => n({
+import { hasOwnedSessionFamily as e, indexSessionFamilies as t, sessionFamilyId as n } from "./sessionFamily.js";
+import { Data as r, Effect as i } from "effect";
+import { generateId as a } from "@voltro/database";
+// src/userStore.ts
+var o = class extends r.TaggedError("UserAlreadyExistsError") {}, s = class extends r.TaggedError("UserNotFoundError") {}, c = (e) => a({
 	kind: "typeid",
 	prefix: e
-}, e), o = (e = []) => {
-	let n = /* @__PURE__ */ new Map(), o = /* @__PURE__ */ new Map(), s = [], c = [], l = [], u = [], d = [], f = [], p = [], m = /* @__PURE__ */ new Map();
-	for (let t of e) n.set(t.id, t), o.set(t.email.toLowerCase(), t);
-	let h = (e, r) => t.gen(function* () {
-		let a = n.get(e);
-		if (!a) return yield* t.fail(new i({ userId: e }));
-		let s = r(a);
-		return n.set(e, s), o.set(s.email.toLowerCase(), s), s;
+}, e), l = (r = []) => {
+	let a = /* @__PURE__ */ new Map(), l = /* @__PURE__ */ new Map(), u = [], d = [], f = [], p = [], m = [], h = [], g = [], _ = /* @__PURE__ */ new Map();
+	for (let e of r) a.set(e.id, e), e.email !== null && l.set(e.email.toLowerCase(), e);
+	let v = (e, t) => i.gen(function* () {
+		let n = a.get(e);
+		if (!n) return yield* i.fail(new s({ userId: e }));
+		let r = t(n);
+		return a.set(e, r), r.email !== null && l.set(r.email.toLowerCase(), r), r;
 	});
 	return {
-		findByEmail: (e) => t.sync(() => o.get(e.toLowerCase()) ?? null),
-		findById: (e) => t.sync(() => n.get(e) ?? null),
-		insert: (e) => t.gen(function* () {
-			let i = e.email.toLowerCase();
-			if (o.has(i)) return yield* t.fail(new r({ email: i }));
-			let a = {
+		findByEmail: (e) => i.sync(() => l.get(e.toLowerCase()) ?? null),
+		findById: (e) => i.sync(() => a.get(e) ?? null),
+		insert: (e) => i.gen(function* () {
+			let t = e.email === null ? null : e.email.toLowerCase();
+			if (t !== null && l.has(t)) return yield* i.fail(new o({ email: t }));
+			let n = {
 				...e,
-				email: i,
+				email: t,
 				createdAt: /* @__PURE__ */ new Date()
 			};
-			return n.set(a.id, a), o.set(i, a), a;
+			return a.set(n.id, n), t !== null && l.set(t, n), n;
 		}),
-		updatePassword: (e, t) => h(e, (e) => ({
+		updatePassword: (e, t) => v(e, (e) => ({
 			...e,
 			passwordHash: t
 		})),
-		setMfaSecret: (e, t) => h(e, (e) => ({
+		setMfaSecret: (e, t) => v(e, (e) => ({
 			...e,
 			mfaSecret: t,
 			mfaEnrolledAt: null
 		})),
-		markMfaEnrolled: (e) => h(e, (e) => ({
+		markMfaEnrolled: (e) => v(e, (e) => ({
 			...e,
 			mfaEnrolledAt: /* @__PURE__ */ new Date()
 		})),
-		clearMfa: (e) => h(e, (e) => ({
+		clearMfa: (e) => v(e, (e) => ({
 			...e,
 			mfaSecret: null,
 			mfaEnrolledAt: null
 		})),
-		markEmailVerified: (e) => h(e, (e) => e.emailVerifiedAt ? e : {
+		markEmailVerified: (e) => v(e, (e) => e.emailVerifiedAt ? e : {
 			...e,
 			emailVerifiedAt: /* @__PURE__ */ new Date()
 		}),
-		listMemberships: (e) => t.sync(() => s.filter((t) => t.userId === e)),
-		addMembership: (e) => t.sync(() => {
-			let t = s.findIndex((t) => t.userId === e.userId && t.tenantId === e.tenantId), n = {
+		listMemberships: (e) => i.sync(() => u.filter((t) => t.userId === e)),
+		addMembership: (e) => i.sync(() => {
+			let t = u.findIndex((t) => t.userId === e.userId && t.tenantId === e.tenantId), n = {
 				...e,
 				joinedAt: /* @__PURE__ */ new Date()
 			};
 			if (t >= 0) {
-				let e = s[t], r = {
+				let e = u[t], r = {
 					...n,
 					joinedAt: e.joinedAt
 				};
-				return s[t] = r, r;
+				return u[t] = r, r;
 			}
-			return s.push(n), n;
+			return u.push(n), n;
+		}),
+		membershipRole: (e, t) => i.sync(() => u.find((n) => n.userId === e && n.tenantId === t)?.role ?? null),
+		listSessions: (r) => i.sync(() => {
+			let i = t(d);
+			return d.filter((t) => t.userId === r && t.rotatedAt == null && i.get(t.id) === t && e(t, i.get(n(t) ?? ""))).map((e) => structuredClone(e)).sort((e, t) => t.createdAt.getTime() - e.createdAt.getTime());
 		}),
-		membershipRole: (e, n) => t.sync(() => s.find((t) => t.userId === e && t.tenantId === n)?.role ?? null),
-		listSessions: (e) => t.sync(() => c.filter((t) => t.userId === e && t.rotatedAt == null).sort((e, t) => t.createdAt.getTime() - e.createdAt.getTime())),
-		insertSession: (e) => t.sync(() => {
+		insertSession: (e) => i.sync(() => {
 			let t = /* @__PURE__ */ new Date(), n = {
 				...e,
 				familyId: e.familyId ?? e.id,
@@ -73,73 +77,76 @@ var r = class extends e.TaggedError("UserAlreadyExistsError") {}, i = class exte
 				createdAt: t,
 				lastSeenAt: t
 			};
-			return c.push(n), n;
+			return d.push(structuredClone(n)), structuredClone(n);
 		}),
-		findSession: (e) => t.sync(() => c.find((t) => t.id === e && t.rotatedAt == null) ?? null),
-		touchSession: (e, n) => t.sync(() => {
-			let t = c.findIndex((t) => t.id === e);
-			if (t >= 0 && c[t].rotatedAt == null) {
-				c[t] = {
-					...c[t],
-					expiresAt: n,
+		findSession: (r) => i.sync(() => {
+			let i = t(d), a = i.get(r);
+			return a && a.rotatedAt == null && e(a, i.get(n(a) ?? "")) ? structuredClone(a) : null;
+		}),
+		touchSession: (e, t) => i.sync(() => {
+			let n = d.findIndex((t) => t.id === e);
+			if (n >= 0 && d[n].rotatedAt == null) {
+				d[n] = {
+					...d[n],
+					expiresAt: t,
 					lastSeenAt: /* @__PURE__ */ new Date()
 				};
-				let r = c[t].familyId ?? e, i = c.findIndex((e) => e.id === r);
-				i >= 0 && c[i].expiresAt < n && (c[i] = {
-					...c[i],
-					expiresAt: n
+				let r = d[n].familyId ?? e, i = d.findIndex((e) => e.id === r);
+				i >= 0 && d[i].expiresAt < t && (d[i] = {
+					...d[i],
+					expiresAt: t
 				});
 			}
 		}),
-		revokeSession: (e, n) => t.sync(() => {
-			let t = c.find((t) => t.id === n && t.userId === e);
-			if (!t) return !1;
-			let r = t.familyId ?? t.id, i = !1;
-			for (let t = c.length - 1; t >= 0; t--) {
-				let n = c[t];
-				n.userId === e && (n.familyId ?? n.id) === r && (c.splice(t, 1), i = !0);
+		revokeSession: (e, t) => i.sync(() => {
+			let n = d.find((n) => n.id === t && n.userId === e);
+			if (!n) return !1;
+			let r = n.familyId ?? n.id, i = !1;
+			for (let t = d.length - 1; t >= 0; t--) {
+				let n = d[t];
+				n.userId === e && (n.familyId ?? n.id) === r && (d.splice(t, 1), i = !0);
 			}
 			return i;
 		}),
-		revokeAllOtherSessions: (e, n) => t.sync(() => {
-			let t = c.find((t) => t.id === n && t.userId === e), r = t ? t.familyId ?? t.id : void 0, i = 0;
-			for (let t = c.length - 1; t >= 0; t--) {
-				let n = c[t];
-				n.userId === e && (n.familyId ?? n.id) !== r && (c.splice(t, 1), n.rotatedAt ?? (i += 1));
+		revokeAllOtherSessions: (e, t) => i.sync(() => {
+			let n = d.find((n) => n.id === t && n.userId === e), r = n ? n.familyId ?? n.id : void 0, i = 0;
+			for (let t = d.length - 1; t >= 0; t--) {
+				let n = d[t];
+				n.userId === e && (n.familyId ?? n.id) !== r && (d.splice(t, 1), n.rotatedAt ?? (i += 1));
 			}
 			return i;
 		}),
-		revokeAllSessions: (e) => t.sync(() => {
+		revokeAllSessions: (e) => i.sync(() => {
 			let t = 0;
-			for (let n = c.length - 1; n >= 0; n--) if (c[n].userId === e) {
-				let e = c[n];
-				c.splice(n, 1), e.rotatedAt ?? t++;
+			for (let n = d.length - 1; n >= 0; n--) if (d[n].userId === e) {
+				let e = d[n];
+				d.splice(n, 1), e.rotatedAt ?? t++;
 			}
 			return t;
 		}),
-		insertToken: (e) => t.sync(() => {
+		insertToken: (e) => i.sync(() => {
 			let t = {
 				...e,
 				consumedAt: null,
 				createdAt: /* @__PURE__ */ new Date()
 			};
-			return l.push(t), t;
+			return f.push(t), t;
 		}),
-		consumeToken: (e, n) => t.sync(() => {
-			let t = Date.now(), r = l.find((r) => r.tokenHash === e && r.purpose === n && r.consumedAt === null && r.expiresAt.getTime() > t);
+		consumeToken: (e, t) => i.sync(() => {
+			let n = Date.now(), r = f.find((r) => r.tokenHash === e && r.purpose === t && r.consumedAt === null && r.expiresAt.getTime() > n);
 			if (!r) return null;
 			let i = {
 				...r,
 				consumedAt: /* @__PURE__ */ new Date()
-			}, a = l.indexOf(r);
-			return l[a] = i, i;
+			}, a = f.indexOf(r);
+			return f[a] = i, i;
 		}),
-		latestToken: (e, n) => t.sync(() => {
-			let t = null;
-			for (let r of l) r.userId === e && r.purpose === n && (t === null || r.createdAt.getTime() > t.createdAt.getTime()) && (t = r);
-			return t;
+		latestToken: (e, t) => i.sync(() => {
+			let n = null;
+			for (let r of f) r.userId === e && r.purpose === t && (n === null || r.createdAt.getTime() > n.createdAt.getTime()) && (n = r);
+			return n;
 		}),
-		insertInvitation: (e) => t.sync(() => {
+		insertInvitation: (e) => i.sync(() => {
 			let t = {
 				...e,
 				email: e.email.toLowerCase(),
@@ -149,119 +156,119 @@ var r = class extends e.TaggedError("UserAlreadyExistsError") {}, i = class exte
 				revokedByUserId: null,
 				createdAt: /* @__PURE__ */ new Date()
 			};
-			return f.push(t), t;
+			return h.push(t), t;
 		}),
-		findInvitationByHash: (e) => t.sync(() => f.find((t) => t.tokenHash === e) ?? null),
-		acceptInvitation: (e, n, r) => t.sync(() => {
-			let t = f.findIndex((t) => t.tokenHash === e && t.acceptedAt === null && t.revokedAt === null && t.expiresAt.getTime() > r.getTime());
-			if (t < 0) return null;
+		findInvitationByHash: (e) => i.sync(() => h.find((t) => t.tokenHash === e) ?? null),
+		acceptInvitation: (e, t, n) => i.sync(() => {
+			let r = h.findIndex((t) => t.tokenHash === e && t.acceptedAt === null && t.revokedAt === null && t.expiresAt.getTime() > n.getTime());
+			if (r < 0) return null;
 			let i = {
-				...f[t],
-				acceptedAt: r,
-				acceptedByUserId: n
+				...h[r],
+				acceptedAt: n,
+				acceptedByUserId: t
 			};
-			return f[t] = i, i;
+			return h[r] = i, i;
 		}),
-		revokeInvitation: (e, n, r, i) => t.sync(() => {
-			let t = f.findIndex((t) => t.id === e && t.tenantId === n && t.acceptedAt === null && t.revokedAt === null);
-			return t < 0 ? !1 : (f[t] = {
-				...f[t],
-				revokedAt: i,
-				revokedByUserId: r
+		revokeInvitation: (e, t, n, r) => i.sync(() => {
+			let i = h.findIndex((n) => n.id === e && n.tenantId === t && n.acceptedAt === null && n.revokedAt === null);
+			return i < 0 ? !1 : (h[i] = {
+				...h[i],
+				revokedAt: r,
+				revokedByUserId: n
 			}, !0);
 		}),
-		listInvitations: (e) => t.sync(() => f.filter((t) => t.tenantId === e).sort((e, t) => t.createdAt.getTime() - e.createdAt.getTime())),
-		countPendingInvitations: (e, n) => t.sync(() => f.filter((t) => t.tenantId === e && t.acceptedAt === null && t.revokedAt === null && t.expiresAt.getTime() > n.getTime()).length),
-		supersedePendingInvitations: (e, n, r, i) => t.sync(() => {
-			let t = n.toLowerCase(), a = 0;
-			for (let n = 0; n < f.length; n++) {
-				let o = f[n];
-				o.tenantId === e && o.email === t && o.acceptedAt === null && o.revokedAt === null && (f[n] = {
+		listInvitations: (e) => i.sync(() => h.filter((t) => t.tenantId === e).sort((e, t) => t.createdAt.getTime() - e.createdAt.getTime())),
+		countPendingInvitations: (e, t) => i.sync(() => h.filter((n) => n.tenantId === e && n.acceptedAt === null && n.revokedAt === null && n.expiresAt.getTime() > t.getTime()).length),
+		supersedePendingInvitations: (e, t, n, r) => i.sync(() => {
+			let i = t.toLowerCase(), a = 0;
+			for (let t = 0; t < h.length; t++) {
+				let o = h[t];
+				o.tenantId === e && o.email === i && o.acceptedAt === null && o.revokedAt === null && (h[t] = {
 					...o,
-					revokedAt: i,
-					revokedByUserId: r
+					revokedAt: r,
+					revokedByUserId: n
 				}, a++);
 			}
 			return a;
 		}),
-		insertImpersonationGrant: (e) => t.sync(() => {
+		insertImpersonationGrant: (e) => i.sync(() => {
 			let t = {
 				...e,
 				startedAt: /* @__PURE__ */ new Date(),
 				endedAt: null,
 				endedReason: null
 			};
-			return p.push(t), t;
+			return g.push(t), t;
 		}),
-		findImpersonationGrantBySession: (e) => t.sync(() => p.find((t) => t.sessionId === e) ?? null),
-		endImpersonationGrant: (e, n, r) => t.sync(() => {
-			let t = p.findIndex((t) => t.sessionId === e && t.endedAt === null);
-			return t < 0 ? !1 : (p[t] = {
-				...p[t],
-				endedAt: r,
-				endedReason: n
+		findImpersonationGrantBySession: (e) => i.sync(() => g.find((t) => t.sessionId === e) ?? null),
+		endImpersonationGrant: (e, t, n) => i.sync(() => {
+			let r = g.findIndex((t) => t.sessionId === e && t.endedAt === null);
+			return r < 0 ? !1 : (g[r] = {
+				...g[r],
+				endedAt: n,
+				endedReason: t
 			}, !0);
 		}),
-		replaceRecoveryCodes: (e, n) => t.sync(() => {
-			for (let t = d.length - 1; t >= 0; t--) d[t].userId === e && d.splice(t, 1);
-			let t = /* @__PURE__ */ new Date();
-			for (let r of n) d.push({
-				id: a("rc"),
+		replaceRecoveryCodes: (e, t) => i.sync(() => {
+			for (let t = m.length - 1; t >= 0; t--) m[t].userId === e && m.splice(t, 1);
+			let n = /* @__PURE__ */ new Date();
+			for (let r of t) m.push({
+				id: c("rc"),
 				userId: e,
 				codeHash: r,
 				consumedAt: null,
-				createdAt: t
+				createdAt: n
 			});
 		}),
-		consumeRecoveryCode: (e, n) => t.sync(() => {
-			let t = d.findIndex((t) => t.userId === e && t.codeHash === n && t.consumedAt === null);
-			return t < 0 ? !1 : (d[t] = {
-				...d[t],
+		consumeRecoveryCode: (e, t) => i.sync(() => {
+			let n = m.findIndex((n) => n.userId === e && n.codeHash === t && n.consumedAt === null);
+			return n < 0 ? !1 : (m[n] = {
+				...m[n],
 				consumedAt: /* @__PURE__ */ new Date()
 			}, !0);
 		}),
-		countRecoveryCodes: (e) => t.sync(() => d.filter((t) => t.userId === e && t.consumedAt === null).length),
-		listPasskeys: (e) => t.sync(() => u.filter((t) => t.userId === e)),
-		findPasskey: (e) => t.sync(() => u.find((t) => t.credentialId === e) ?? null),
-		insertPasskey: (e) => t.sync(() => {
+		countRecoveryCodes: (e) => i.sync(() => m.filter((t) => t.userId === e && t.consumedAt === null).length),
+		listPasskeys: (e) => i.sync(() => p.filter((t) => t.userId === e)),
+		findPasskey: (e) => i.sync(() => p.find((t) => t.credentialId === e) ?? null),
+		insertPasskey: (e) => i.sync(() => {
 			let t = /* @__PURE__ */ new Date(), n = {
 				...e,
 				createdAt: t,
 				lastUsedAt: null
 			};
-			return u.push(n), n;
+			return p.push(n), n;
 		}),
-		advancePasskeyCounter: (e, n) => t.sync(() => {
-			let t = u.findIndex((t) => t.credentialId === e);
-			return t < 0 || n <= u[t].counter ? !1 : (u[t] = {
-				...u[t],
-				counter: n,
+		advancePasskeyCounter: (e, t) => i.sync(() => {
+			let n = p.findIndex((t) => t.credentialId === e);
+			return n < 0 || t <= p[n].counter ? !1 : (p[n] = {
+				...p[n],
+				counter: t,
 				lastUsedAt: /* @__PURE__ */ new Date()
 			}, !0);
 		}),
-		isLockedOut: (e, n) => t.sync(() => {
-			let t = m.get(e.toLowerCase());
-			return t?.lockedUntil != null && n < t.lockedUntil ? {
+		isLockedOut: (e, t) => i.sync(() => {
+			let n = _.get(e.toLowerCase());
+			return n?.lockedUntil != null && t < n.lockedUntil ? {
 				locked: !0,
-				retryAfterSeconds: Math.ceil((t.lockedUntil - n) / 1e3)
+				retryAfterSeconds: Math.ceil((n.lockedUntil - t) / 1e3)
 			} : {
 				locked: !1,
 				retryAfterSeconds: 0
 			};
 		}),
-		recordLoginFailure: (e, n, r) => t.sync(() => {
-			let t = e.toLowerCase(), i = m.get(t), a = i?.windowStartedAt == null || n - i.windowStartedAt >= r.windowMs, o = i?.lockedUntil != null && n >= i.lockedUntil, s = !i || a || o, c = s ? 1 : i.failedCount + 1, l = s ? n : i.windowStartedAt, u = c >= r.maxAttempts ? n + r.lockMs : null;
-			m.set(t, {
+		recordLoginFailure: (e, t, n) => i.sync(() => {
+			let r = e.toLowerCase(), i = _.get(r), a = i?.windowStartedAt == null || t - i.windowStartedAt >= n.windowMs, o = i?.lockedUntil != null && t >= i.lockedUntil, s = !i || a || o, c = s ? 1 : i.failedCount + 1, l = s ? t : i.windowStartedAt, u = c >= n.maxAttempts ? t + n.lockMs : null;
+			_.set(r, {
 				failedCount: c,
 				windowStartedAt: l,
 				lockedUntil: u
 			});
 		}),
-		clearLoginFailures: (e) => t.sync(() => {
-			m.delete(e.toLowerCase());
+		clearLoginFailures: (e) => i.sync(() => {
+			_.delete(e.toLowerCase());
 		})
 	};
-}, s = (e, t = {}) => {
+}, u = (e, t = {}) => {
 	let n = { ...t.metadata };
 	return t.memberships && (n.memberships = t.memberships.map((e) => ({
 		tenantId: e.tenantId,
@@ -272,14 +279,13 @@ var r = class extends e.TaggedError("UserAlreadyExistsError") {}, i = class exte
 		tenantId: t.tenantId ?? e.tenantId,
 		...Object.keys(n).length > 0 ? { metadata: n } : {}
 	};
-}, c = (e) => {
+}, d = (e) => {
 	if (e.type !== "user") return null;
 	let t = e.metadata?.sessionId;
 	return typeof t == "string" && t.length > 0 ? t : null;
-}, l = (e) => {
+}, f = (e) => {
 	if (e.type !== "user") return [];
 	let t = e.metadata?.memberships;
 	return Array.isArray(t) ? t.filter((e) => typeof e == "object" && !!e && typeof e.tenantId == "string" && typeof e.role == "string") : [];
 };
-//#endregion
-export { r as UserAlreadyExistsError, i as UserNotFoundError, o as memoryUserStore, a as newAuthId, c as sessionIdOfSubject, s as subjectFromUser, l as subjectMemberships };
+export { o as UserAlreadyExistsError, s as UserNotFoundError, l as memoryUserStore, c as newAuthId, d as sessionIdOfSubject, u as subjectFromUser, f as subjectMemberships };

package/dist/web/guestStorage.js

@@ -0,0 +1,46 @@
+// src/web/guestStorage.ts
+var e = (e) => {
+	if (!e.trim()) throw Error("Guest storage requires an app namespace");
+	let t = (t, n) => new Promise((r, i) => {
+		let a = !1, o = globalThis.indexedDB.open("voltro:guest:" + e, 1);
+		o.onupgradeneeded = () => {
+			o.result.createObjectStore("credentials");
+		}, o.onerror = () => i(/* @__PURE__ */ Error("Guest IndexedDB unavailable")), o.onblocked = () => {
+			a = !0, i(/* @__PURE__ */ Error("Guest IndexedDB blocked"));
+		}, o.onsuccess = () => {
+			let e = o.result;
+			if (a) {
+				e.close();
+				return;
+			}
+			let s, c;
+			try {
+				s = e.transaction("credentials", t), c = n(s.objectStore("credentials"));
+			} catch {
+				e.close(), i(/* @__PURE__ */ Error("Guest IndexedDB transaction unavailable"));
+				return;
+			}
+			s.oncomplete = () => {
+				e.close(), r(c.result);
+			}, s.onerror = s.onabort = () => {
+				e.close(), i(/* @__PURE__ */ Error("Guest IndexedDB transaction failed"));
+			};
+		};
+	});
+	return {
+		exclusive: (t) => globalThis.navigator?.locks ? globalThis.navigator.locks.request("voltro:guest:" + e, t) : Promise.reject(/* @__PURE__ */ Error("Guest cross-tab locking unavailable")),
+		read: async () => {
+			let e = await t("readonly", (e) => e.get("device"));
+			if (e === void 0) return null;
+			if (typeof e != "string" || !e) throw Error("Guest IndexedDB credential invalid");
+			return e;
+		},
+		write: async (e) => {
+			await t("readwrite", (t) => t.put(e, "device"));
+		},
+		remove: async () => {
+			await t("readwrite", (e) => e.delete("device"));
+		}
+	};
+};
+export { e as indexedDbGuestStore };

package/dist/web/passkeyClient.js

@@ -1,4 +1,4 @@
-//#region src/web/passkeyClient.ts
+// src/web/passkeyClient.ts
 var e = (e) => {
 	let t = new Uint8Array(e), n = "";
 	for (let e of t) n += String.fromCharCode(e);
@@ -74,5 +74,4 @@ var e = (e) => {
 	if (!p.ok) throw Error(`passkey sign-in failed: ${String(p.error)}`);
 	return { subject: p.subject };
 };
-//#endregion
 export { n as isPasskeySupported, i as registerPasskey, a as signInWithPasskey };

package/dist/web/requireAuth.js

@@ -1,9 +1,8 @@
 import { useOptionalSubject as e } from "./subjectContext.js";
 import { Fragment as t, jsx as n } from "react/jsx-runtime";
-//#region src/web/requireAuth.tsx
+// src/web/requireAuth.tsx
 var r = ({ children: r, fallback: i }) => {
 	let a = e();
 	return a ? typeof r == "function" ? /* @__PURE__ */ n(t, { children: r(a) }) : /* @__PURE__ */ n(t, { children: r }) : /* @__PURE__ */ n(t, { children: i });
 };
-//#endregion
 export { r as RequireAuth };

package/dist/web/subjectContext.js

@@ -1,6 +1,6 @@
 import { createContext as e, useContext as t } from "react";
 import { jsx as n } from "react/jsx-runtime";
-//#region src/web/subjectContext.tsx
+// src/web/subjectContext.tsx
 var r = e(null), i = ({ subject: e, children: t }) => /* @__PURE__ */ n(r.Provider, {
 	value: e,
 	children: t
@@ -9,5 +9,4 @@ var r = e(null), i = ({ subject: e, children: t }) => /* @__PURE__ */ n(r.Provid
 	if (!e) throw Error("useSubject() called without a signed-in user. Use useOptionalSubject() or wrap the consumer in <RequireAuth>.");
 	return e;
 }, o = () => t(r);
-//#endregion
 export { i as SubjectProvider, o as useOptionalSubject, a as useSubject };