@voltro/plugin-auth 0.86.0 → 0.88.0

package/dist/web.d.ts

@@ -1,5 +1,99 @@
 import { ReactNode } from 'react';
 import { Subject } from '@voltro/protocol';
+import { SubjectIdentity } from '@voltro/protocol';
+
+/** Serializes operations in one client. A rejected existing credential never
+ * creates a replacement identity. Storage failures never enable memory fallback. */
+export declare const createGuestClient: (options: GuestClientOptions) => {
+    connect: () => Promise<GuestClientSession>;
+    /** Prepare without replacing the active proof, persist both proofs, then
+     * commit. A later connect recovers the same identity after a lost response. */
+    rotate: () => Promise<GuestClientSession>;
+    /** Revoke on the server first. Keep the durable proof on transport failure
+     * so the caller can retry; erase locally only after confirmed revocation. */
+    revoke: () => Promise<void>;
+    /** Turn this guest into an email/password account under the same subject ID
+     * (`authRoutesPlugin({ guestUpgrade })`). The device proof is erased only after the
+     * server confirmed the account; on any refusal or transport failure it stays. */
+    upgrade: (input: {
+        readonly email: string;
+        readonly password: string;
+    }) => Promise<{
+        readonly subject: unknown;
+    }>;
+    /** The registered account signed in on this device (cookie clients), or null. */
+    account: () => Promise<GuestClientAccount | null>;
+    /** The signed-in account if there is one, else this device's guest (resumed or created once).
+     * The usual entry for a game that offers accounts: a reload after `upgrade` or `signIn` stays the account. */
+    start: () => Promise<GuestClientPlayer>;
+    /** Sign in to an existing account with email and password (`authRoutesPlugin`), e.g. on a second
+     * device. This device's guest proof stays: after `signOut`, `start` resumes that guest. */
+    signIn: (input: {
+        readonly email: string;
+        readonly password: string;
+    }) => Promise<GuestClientAccount>;
+    /** End the account session on the server and clear its cookie. */
+    signOut: () => Promise<void>;
+};
+
+/** A registered account signed in on this device (by upgrade or sign-in), through the session cookie. */
+export declare interface GuestClientAccount {
+    readonly subject: Extract<SubjectIdentity, {
+        readonly type: 'user';
+    }>;
+}
+
+export declare class GuestClientError extends Error {
+    readonly code: 'storage_unavailable' | 'credential_rejected' | 'upgrade_conflict' | 'account_signed_in' | 'transport_failed' | 'invalid_response';
+    readonly status?: number | undefined;
+    constructor(code: 'storage_unavailable' | 'credential_rejected' | 'upgrade_conflict' | 'account_signed_in' | 'transport_failed' | 'invalid_response', status?: number | undefined);
+}
+
+export declare interface GuestClientOptions {
+    readonly apiBaseUrl: string;
+    readonly storage: GuestCredentialStore;
+    readonly prefix?: string;
+    readonly fetch?: typeof globalThis.fetch;
+    /** Web clients include cookies and obtain a signed CSRF token for each post. */
+    readonly cookies?: boolean;
+    /** Prefix of the app's auth routes, for `upgrade`, `account`, `signIn` and `signOut` (default `/auth`). */
+    readonly accountPrefix?: string;
+}
+
+/** What `start` found: the signed-in account, else this device's guest. */
+export declare type GuestClientPlayer = {
+    readonly kind: 'account';
+    readonly subject: GuestClientAccount['subject'];
+} | {
+    readonly kind: 'guest';
+    readonly subject: GuestClientSession['subject'];
+    readonly session: string;
+};
+
+export declare interface GuestClientSession {
+    readonly subject: Extract<SubjectIdentity, {
+        readonly type: 'user';
+    }> & {
+        readonly kind: 'guest';
+    };
+    readonly session: string;
+}
+
+/** Platform-backed durable secret storage. Native implementations use the
+ * operating system's secure store; writes resolve only after persistence. */
+export declare interface GuestCredentialStore {
+    /** Serialize the whole read/create/write operation across users of this
+     * namespace, including other browser tabs or native client instances. */
+    readonly exclusive: <A>(work: () => Promise<A>) => Promise<A>;
+    readonly read: () => Promise<string | null>;
+    /** Persist the opaque value, including an in-progress rotation journal. */
+    readonly write: (value: string) => Promise<void>;
+    readonly remove: () => Promise<void>;
+}
+
+/** IndexedDB is the web device-proof store. Missing/blocked storage rejects;
+ * there is deliberately no localStorage or volatile substitute. */
+export declare const indexedDbGuestStore: (namespace: string) => GuestCredentialStore;
 
 /** True when this browser can do WebAuthn at all. */
 export declare const isPasskeySupported: () => boolean;

package/dist/web.js

@@ -1,4 +1,6 @@
 import { SubjectProvider as e, useOptionalSubject as t, useSubject as n } from "./web/subjectContext.js";
 import { RequireAuth as r } from "./web/requireAuth.js";
-import { isPasskeySupported as i, registerPasskey as a, signInWithPasskey as o } from "./web/passkeyClient.js";
-export { r as RequireAuth, e as SubjectProvider, i as isPasskeySupported, a as registerPasskey, o as signInWithPasskey, t as useOptionalSubject, n as useSubject };
+import { GuestClientError as i, createGuestClient as a } from "./guestClient.js";
+import { indexedDbGuestStore as o } from "./web/guestStorage.js";
+import { isPasskeySupported as s, registerPasskey as c, signInWithPasskey as l } from "./web/passkeyClient.js";
+export { i as GuestClientError, r as RequireAuth, e as SubjectProvider, a as createGuestClient, o as indexedDbGuestStore, s as isPasskeySupported, c as registerPasskey, l as signInWithPasskey, t as useOptionalSubject, n as useSubject };

package/dist/webauthn.js

@@ -1,5 +1,5 @@
 import { createHash as e, createPublicKey as t, createVerify as n, randomBytes as r, timingSafeEqual as i, verify as a } from "node:crypto";
-//#region src/webauthn.ts
+// src/webauthn.ts
 var o = (e) => {
 	let t = e.replace(/-/g, "+").replace(/_/g, "/") + "=".repeat((4 - e.length % 4) % 4);
 	return Buffer.from(t, "base64");
@@ -314,5 +314,4 @@ var o = (e) => {
 	let n = Buffer.from(e), r = Buffer.from(t);
 	return n.length === r.length && i(n, r);
 }, D = () => s(r(32));
-//#endregion
 export { D as generateChallenge, w as verifyAssertion, C as verifyRegistration };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voltro/plugin-auth",
-  "version": "0.86.0",
+  "version": "0.88.0",
   "description": "Authentication primitives: password hashing, session creation, schema mixin + tables. Pairs with the `auth` app template for the UI; both independently usable. Server-side only (uses node:crypto).",
   "keywords": [
     "voltro",
@@ -73,6 +73,11 @@
       "import": "./dist/native.js",
       "default": "./dist/native.js"
     },
+    "./guest": {
+      "types": "./dist/guest.d.ts",
+      "import": "./dist/guest.js",
+      "default": "./dist/guest.js"
+    },
     "./package.json": "./package.json"
   },
   "main": "./dist/index.js",
@@ -83,11 +88,11 @@
     "node": ">=24.0.0"
   },
   "dependencies": {
-    "@voltro/database": "0.86.0",
-    "@voltro/protocol": "0.86.0"
+    "@voltro/database": "0.88.0",
+    "@voltro/protocol": "0.88.0"
   },
   "peerDependencies": {
-    "effect": "4.0.1",
+    "effect": "4.1.0",
     "react": "^19.0.0"
   },
   "peerDependenciesMeta": {