@voltro/plugin-auth 0.87.0 → 0.88.0

package/dist/admission.js

@@ -1,9 +1,8 @@
 import { Effect as e } from "effect";
-//#region src/admission.ts
+// src/admission.ts
 var t = (t, n, r = { store: void 0 }) => {
 	if (t === void 0) return e.succeed(null);
 	let i = t(n, r);
 	return e.isEffect(i) ? i : e.promise(() => i);
 };
-//#endregion
 export { t as decideAdmission };

package/dist/appUserStore.js

@@ -1,6 +1,6 @@
 import { memoryUserStore as e } from "./userStore.js";
 import { postgresUserStore as t } from "./postgresUserStore.js";
-//#region src/appUserStore.ts
+// src/appUserStore.ts
 var n = (n = {}) => ({ sql: r }) => r === void 0 ? e() : r.onDialectOrElse({
 	pg: () => t(r, n),
 	orElse: () => {
@@ -15,5 +15,4 @@ var n = (n = {}) => ({ sql: r }) => r === void 0 ? e() : r.onDialectOrElse({
 		return i.apply(r, [...t]);
 	};
 } });
-//#endregion
 export { n as appUserStore, r as deferredUserStore };

package/dist/authExtensions.js

@@ -1,9 +1,8 @@
 import { guestAuthPlugin as e } from "./guestPlugin.js";
 import { overlayAuthPlugin as t } from "./overlayPlugin.js";
-//#region src/authExtensions.ts
+// src/authExtensions.ts
 var n = {
 	guest: e,
 	overlay: t
 };
-//#endregion
 export { n as auth };

package/dist/csrf.js

@@ -1,5 +1,5 @@
 import { createHmac as e, randomBytes as t, timingSafeEqual as n } from "node:crypto";
-//#region src/csrf.ts
+// src/csrf.ts
 var r = "voltro:csrf", i = "x-csrf-token", a = (e) => e.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, ""), o = (e) => {
 	let t = e.replace(/-/g, "+").replace(/_/g, "/") + "=".repeat((4 - e.length % 4) % 4);
 	return Buffer.from(t, "base64");
@@ -18,5 +18,4 @@ var r = "voltro:csrf", i = "x-csrf-token", a = (e) => e.toString("base64").repla
 	let i = Buffer.from(e), a = Buffer.from(t);
 	return i.length !== a.length || !n(i, a) ? !1 : l(e, r);
 };
-//#endregion
 export { r as CSRF_COOKIE_NAME, i as CSRF_HEADER_NAME, l as isCsrfTokenWellFormed, c as issueCsrfToken, u as verifyCsrf };

package/dist/emailVerification.js

@@ -1,7 +1,7 @@
 import { newAuthId as e } from "./userStore.js";
 import { hashToken as t, mintToken as n } from "./tokens.js";
 import { Effect as r } from "effect";
-//#region src/emailVerification.ts
+// src/emailVerification.ts
 var i = 60, a = "email_not_verified", o = "emailVerified", s = (e) => e?.policy ?? "off", c = (e) => s(e) !== "off", l = (e, t) => {
 	if (e.emailVerifiedAt != null) return !0;
 	let n = t?.exemptAccountsCreatedBefore;
@@ -60,5 +60,4 @@ var i = 60, a = "email_not_verified", o = "emailVerified", s = (e) => e?.policy
 		verified: !0
 	})) : f(401, { error: "invalid or expired token" });
 });
-//#endregion
 export { a as EMAIL_NOT_VERIFIED_CODE, o as EMAIL_VERIFIED_METADATA_KEY, i as EMAIL_VERIFY_RESEND_COOLDOWN_S, c as emailVerificationActive, d as emailVerificationGuard, g as handleEmailVerifyConfirm, h as handleEmailVerifyRequest, u as isEmailVerified, m as sendEmailVerification, l as userEmailVerified };

package/dist/guestClient.js

@@ -1,5 +1,5 @@
 import { parseGuestCredential as e } from "./guestCredential.js";
-//#region src/guestClient.ts
+// src/guestClient.ts
 var t = class extends Error {
 	code;
 	status;
@@ -233,5 +233,4 @@ var t = class extends Error {
 		}
 	};
 };
-//#endregion
 export { t as GuestClientError, o as createGuestClient };

package/dist/guestCredential.js

@@ -1,4 +1,4 @@
-//#region src/guestCredential.ts
+// src/guestCredential.ts
 var e = (e) => {
 	if (typeof e != "string" || e.length > 512) return null;
 	let [t, n, r, i] = e.split(".");
@@ -8,5 +8,4 @@ var e = (e) => {
 		secret: r
 	};
 };
-//#endregion
 export { e as parseGuestCredential };

package/dist/guestPasswordUpgrade.js

@@ -7,7 +7,7 @@ import { runSubjectGuards as a } from "./subjectGuard.js";
 import { issueUserSession as o } from "./handlers.js";
 import { Effect as s } from "effect";
 import { and as c, eq as l } from "@voltro/database";
-//#region src/guestPasswordUpgrade.ts
+// src/guestPasswordUpgrade.ts
 var u = (e, t, n) => ({
 	table: e,
 	predicate: l(t, n),
@@ -81,5 +81,4 @@ var u = (e, t, n) => ({
 		};
 	}).pipe(s.catch((e) => s.succeed(e.code === "upgrade_conflict" ? d(409, "email_taken", "email already registered") : e.code === "credential_rejected" ? d(401, "guest_rejected", "guest credential rejected") : d(503, "unavailable", "upgrade unavailable"))));
 }).pipe(s.catch(() => s.succeed(d(500, "upgrade_failed", "upgrade failed"))));
-//#endregion
 export { f as completeGuestPasswordUpgrade };

package/dist/guestPlugin.js

@@ -7,7 +7,7 @@ import { sessionsTable as u } from "./schema.js";
 import { Duration as d, Effect as f, Result as p } from "effect";
 import { buildSetCookie as m, noteSigningLifetime as h, readCookie as g, readSessionValue as _, verifySessionKeyed as v } from "@voltro/protocol/session";
 import { definePlugin as y } from "@voltro/protocol";
-//#region src/guestPlugin.ts
+// src/guestPlugin.ts
 var b = (e, t, n = {}) => ({
 	status: e,
 	body: JSON.stringify(t),
@@ -162,5 +162,4 @@ var b = (e, t, n = {}) => ({
 		} }
 	};
 };
-//#endregion
 export { x as guestAuthPlugin };

package/dist/guestSchema.js

@@ -1,5 +1,5 @@
 import { boolean as e, id as t, integer as n, table as r, text as i, timestamp as a } from "@voltro/database";
-//#region src/guestSchema.ts
+// src/guestSchema.ts
 var o = r("authGuests", {
 	id: t(),
 	tenantId: i(),
@@ -16,5 +16,4 @@ var o = r("authGuests", {
 	expiresAt: a(),
 	createdAt: a()
 }).index(["guestId"]).index(["tenantId"]), c = [o, s];
-//#endregion
 export { s as authGuestDevicesTable, o as authGuestsTable, c as guestTables };

package/dist/guestSecrets.js

@@ -1,10 +1,9 @@
 import { sessionSecretsOf as e } from "./session.js";
 import { assertProductionSessionSecret as t } from "@voltro/protocol/session";
-//#region src/guestSecrets.ts
+// src/guestSecrets.ts
 var n = (n) => {
 	let r = e(n);
 	for (let e of [r.current, ...r.previous ? [r.previous] : []]) t({ VOLTRO_SESSION_SECRET: e.secret });
 	return n;
 };
-//#endregion
 export { n as validateGuestSecrets };

package/dist/guestService.js

@@ -6,7 +6,7 @@ import { createHash as a, randomBytes as o, timingSafeEqual as s } from "node:cr
 import { Data as c, Effect as l } from "effect";
 import { noteSigningLifetime as u } from "@voltro/protocol/session";
 import { and as d, eq as f } from "@voltro/database";
-//#region src/guestService.ts
+// src/guestService.ts
 var p = class extends c.TaggedError("GuestAuthError") {}, m = "authGuests", h = "authGuestDevices", g = 86400, _ = () => new p({ code: "credential_rejected" }), v = (e) => a("sha256").update(e).digest("hex"), y = (e) => e instanceof Date ? e.getTime() : typeof e == "string" ? Date.parse(e) : NaN, b = (e, t) => ({
 	table: e,
 	predicate: t,
@@ -220,5 +220,4 @@ var p = class extends c.TaggedError("GuestAuthError") {}, m = "authGuests", h =
 		})
 	};
 };
-//#endregion
 export { p as GuestAuthError, T as dataStoreGuestAuth };

package/dist/handlers.js

@@ -11,7 +11,7 @@ import { Effect as E } from "effect";
 import { buildSetCookie as D } from "@voltro/protocol/session";
 import { writeTenantSelection as O } from "@voltro/database";
 import { selectSubjectTenant as k } from "@voltro/protocol";
-//#region src/handlers.ts
+// src/handlers.ts
 var A = 5, j = 900, M = 900, N = (e) => e.email ?? `user:${e.id}`, P = (e) => ({
 	maxAttempts: e.lockout?.maxAttempts ?? A,
 	windowMs: (e.lockout?.windowSeconds ?? j) * 1e3,
@@ -333,5 +333,4 @@ var A = 5, j = 900, M = 900, N = (e) => e.email ?? `user:${e.id}`, P = (e) => ({
 		joinedAt: e.joinedAt.toISOString()
 	})) });
 });
-//#endregion
 export { v as MFA_PENDING_TTL_S, F as configSessionSecrets, I as configSigningKey, H as guardSubject, Z as handleCsrf, se as handleListMemberships, re as handleListSessions, ee as handleMagicLinkConsume, $ as handleMagicLinkRequest, q as handleMfaEnrollStart, J as handleMfaEnrollVerify, Y as handleMfaRegenerateRecoveryCodes, X as handleMfaUnenroll, W as handleMfaVerify, ne as handlePasswordResetConfirm, te as handlePasswordResetRequest, ae as handleRevokeAllOtherSessions, ie as handleRevokeSession, U as handleSignIn, K as handleSignOut, G as handleSignUp, oe as handleSwitchTenant, V as issueUserSession };

package/dist/impersonation.js

@@ -2,7 +2,7 @@ import { isSessionCredentialLiveFor as e } from "./sessionFamily.js";
 import { newAuthId as t, subjectFromUser as n } from "./userStore.js";
 import { Effect as r } from "effect";
 import { IMPERSONATION_METADATA_KEY as i, rawImpersonationMark as a } from "@voltro/protocol";
-//#region src/impersonation.ts
+// src/impersonation.ts
 var o = 900, s = [
 	"/mfa/enroll/start",
 	"/mfa/enroll/verify",
@@ -172,5 +172,4 @@ var o = 900, s = [
 		subject: g.subject
 	}, { setCookie: g.setCookie });
 });
-//#endregion
 export { o as IMPERSONATION_DEFAULT_DURATION_S, s as IMPERSONATION_FORBIDDEN_SUBPATHS, m as handleImpersonationStart, h as handleImpersonationStop, d as impersonationAuditRedactor, l as impersonationOf, u as isImpersonated };

package/dist/invitations.js

@@ -2,7 +2,7 @@ import { newAuthId as e } from "./userStore.js";
 import { decideAdmission as t } from "./admission.js";
 import { hashToken as n, mintSecret as r } from "./tokens.js";
 import { Effect as i } from "effect";
-//#region src/invitations.ts
+// src/invitations.ts
 var a = 604800, o = 500, s = [
 	"owner",
 	"admin",
@@ -183,5 +183,4 @@ var a = 604800, o = 500, s = [
 		role: m.role
 	})) : f(409, { error: "account_exists" });
 });
-//#endregion
 export { c as DEFAULT_INVITER_ROLES, s as DEFAULT_ROLE_RANK, o as INVITATION_MAX_PENDING, a as INVITATION_TTL_S, u as defaultCanGrantRole, x as handleAcceptInvitation, S as handleAcceptInvitationWithSignUp, _ as handleCreateInvitation, v as handleListInvitations, b as handlePreviewInvitation, y as handleRevokeInvitation };

package/dist/mail.js

@@ -1,10 +1,9 @@
 import { Effect as e } from "effect";
-//#region src/mail.ts
+// src/mail.ts
 var t = (t) => (n) => e.runPromise(t.send({
 	to: n.to,
 	subject: n.subject,
 	html: n.html,
 	text: n.text
 }).pipe(e.asVoid, e.orElseSucceed(() => void 0)));
-//#endregion
 export { t as mailSender };

package/dist/memberships.js

@@ -1,8 +1,7 @@
 import { Effect as e } from "effect";
-//#region src/memberships.ts
+// src/memberships.ts
 var t = (t) => async (n) => n.type === "user" ? (await e.runPromise(t.listMemberships(n.id))).map((e) => ({
 	tenantId: e.tenantId,
 	role: e.role
 })) : [];
-//#endregion
 export { t as authMemberships };

package/dist/native/guestStorage.js

@@ -1,5 +1,5 @@
 import { GuestClientError as e } from "../guestClient.js";
-//#region src/native/guestStorage.ts
+// src/native/guestStorage.ts
 var t = /* @__PURE__ */ new Set([
 	"keychain",
 	"keystore",
@@ -37,5 +37,4 @@ var t = /* @__PURE__ */ new Set([
 		remove: () => a(() => r.store.delete(i))
 	};
 };
-//#endregion
 export { r as nativeGuestStore };

package/dist/native.js

@@ -1,7 +1,7 @@
 import { GuestClientError as e, createGuestClient as t } from "./guestClient.js";
 import { nativeGuestStore as n } from "./native/guestStorage.js";
 import { SESSION_HEADER_NAME as r } from "@voltro/protocol";
-//#region src/native/index.ts
+// src/native/index.ts
 var i = (e) => {
 	let t = "";
 	for (let n of e) t += String.fromCharCode(n);
@@ -91,5 +91,4 @@ var i = (e) => {
 		...e.fetch === void 0 ? {} : { fetch: e.fetch }
 	});
 };
-//#endregion
 export { e as GuestClientError, u as NativeExchangeError, c as beginNativeLogin, t as createGuestClient, d as exchangeNativeCode, s as nativeCodeChallenge, n as nativeGuestStore, l as parseNativeCallback, p as probeNativeSession, m as runNativeLogin, f as sessionHeaders };

package/dist/nativeRoutes.js

@@ -4,7 +4,7 @@ import { signAuthClaims as i, verifyAuthClaims as a } from "./signedClaims.js";
 import { createHash as o, randomBytes as s } from "node:crypto";
 import { Effect as c } from "effect";
 import { buildSetCookie as l, readCookie as u } from "@voltro/protocol/session";
-//#region src/nativeRoutes.ts
+// src/nativeRoutes.ts
 var d = "voltro:native", f = 600, p = "/login", m = (e) => e.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, ""), h = (e) => m(o("sha256").update(e, "ascii").digest()), g = (e, t) => t.includes(e), _ = (e, t) => {
 	let n = new URLSearchParams(t).toString();
 	return `${e}${e.includes("?") ? "&" : "?"}${n}`;
@@ -105,5 +105,4 @@ var d = "voltro:native", f = 600, p = "/login", m = (e) => e.toString("base64").
 		subject: p.subject
 	});
 });
-//#endregion
 export { d as NATIVE_PENDING_COOKIE, w as handleNativeAuthorize, E as handleNativeComplete, D as handleNativeExchange, g as isAllowedRedirectUri, C as nativeLoginRedirect, h as s256 };

package/dist/overlayPlugin.js

@@ -7,7 +7,7 @@ import { createCipheriv as o, createDecipheriv as s, createHash as c, hkdfSync a
 import { Duration as d, Effect as f } from "effect";
 import { SESSION_COOKIE_NAME as p, SESSION_HEADER_NAME as m, buildSetCookie as h, resolveSessionSecrets as g, verifySessionKeyed as _ } from "@voltro/protocol/session";
 import { definePlugin as v } from "@voltro/protocol";
-//#region src/overlayPlugin.ts
+// src/overlayPlugin.ts
 var y = "overlay-code", b = "authTokens", x = 60, S = 300, C = (e, t) => ({
 	status: e,
 	body: JSON.stringify(t),
@@ -163,5 +163,4 @@ var y = "overlay-code", b = "authTokens", x = 60, S = 300, C = (e, t) => ({
 		})
 	});
 };
-//#endregion
 export { y as OVERLAY_TOKEN_PURPOSE, k as allowedOverlayPage, j as overlayAuthPlugin };

package/dist/passkeyHandlers.js

@@ -3,7 +3,7 @@ import { newAuthId as t, subjectFromUser as n } from "./userStore.js";
 import { configSessionSecrets as r, guardSubject as i } from "./handlers.js";
 import { generateChallenge as a, verifyAssertion as o, verifyRegistration as s } from "./webauthn.js";
 import { Effect as c } from "effect";
-//#region src/passkeyHandlers.ts
+// src/passkeyHandlers.ts
 var l = (e, t, n = {}) => ({
 	status: e,
 	body: JSON.stringify(t),
@@ -158,5 +158,4 @@ var l = (e, t, n = {}) => ({
 		subject: C
 	}, { setCookie: w.setCookie });
 });
-//#endregion
 export { f as dataStoreChallengeStore, g as handlePasskeyAssertOptions, _ as handlePasskeyAssertVerify, m as handlePasskeyRegisterOptions, h as handlePasskeyRegisterVerify, d as memoryChallengeStore };

package/dist/password.js

@@ -1,6 +1,6 @@
 import { randomBytes as e, scrypt as t, timingSafeEqual as n } from "node:crypto";
 import { Data as r, Effect as i } from "effect";
-//#region src/password.ts
+// src/password.ts
 var a = 32768, o = 8, s = 1, c = 32, l = 16, u = (e, t) => 128 * e * t * 2, d = 268435456, f = class extends r.TaggedError("PasswordEmptyError") {}, p = class extends r.TaggedError("PasswordHashError") {}, m = (e, n, r, a) => i.callback((o) => {
 	t(e, n, r, {
 		...a,
@@ -71,5 +71,4 @@ var a = 32768, o = 8, s = 1, c = 32, l = 16, u = (e, t) => 128 * e * t * 2, d =
 		rehash: n
 	} : { valid: !0 };
 });
-//#endregion
 export { f as PasswordEmptyError, p as PasswordHashError, h as hashPassword, y as needsRehash, v as parseScryptParams, g as verifyPassword, b as verifyPasswordWithRehash };

package/dist/plugin.js

@@ -16,7 +16,7 @@ import { Effect as j } from "effect";
 import { SESSION_HEADER_NAME as we, readCookie as Te } from "@voltro/protocol/session";
 import { registerRetention as M, retentionTtlMsFromEnv as N } from "@voltro/database";
 import { definePlugin as Ee } from "@voltro/protocol";
-//#region src/plugin.ts
+// src/plugin.ts
 var P = (e) => e.filter(F).map((e) => e.auth.sessionStrategy), F = (e) => typeof e.auth == "object" && e.auth !== null && typeof e.auth.sessionStrategy == "object", De = "/auth", Oe = (e) => {
 	let t = Buffer.from(e.rawBody).toString("utf8");
 	if (!t) return {};
@@ -515,5 +515,4 @@ var P = (e) => e.filter(F).map((e) => e.auth.sessionStrategy), F = (e) => typeof
 		example: "30000"
 	}
 ];
-//#endregion
 export { B as authRoutesPlugin, P as getAuthSessionStrategies };

package/dist/postgresUserStore.js

@@ -1,6 +1,6 @@
 import { UserAlreadyExistsError as e, UserNotFoundError as t, newAuthId as n } from "./userStore.js";
 import { Effect as r } from "effect";
-//#region src/postgresUserStore.ts
+// src/postgresUserStore.ts
 var i = (e) => {
 	let t = e;
 	for (let e = 0; typeof t == "object" && t && e < 6; e++) {
@@ -471,5 +471,4 @@ var i = (e) => {
 		}).pipe(r.asVoid, $("clear", void 0))
 	};
 };
-//#endregion
 export { o as postgresUserStore };

package/dist/revocation.js

@@ -1,6 +1,6 @@
 import { isSessionCredentialLiveFor as e } from "./sessionFamily.js";
 import { Effect as t } from "effect";
-//#region src/revocation.ts
+// src/revocation.ts
 var n = 3e4, r = 1e4, i = (e) => {
 	if (typeof e != "object" || !e) throw TypeError("Session revocation options must be an object.");
 	if ("isLive" in e || "isLiveFor" in e || "invalidate" in e || Reflect.ownKeys(e).some((e) => typeof e != "string" || ![
@@ -46,5 +46,4 @@ var n = 3e4, r = 1e4, i = (e) => {
 		})
 	};
 };
-//#endregion
 export { a as makeSessionRevocationChecker, i as validateSessionRevocationOptions };

package/dist/schema.js

@@ -1,6 +1,6 @@
 import { authGuestDevicesTable as e, authGuestsTable as t, guestTables as n } from "./guestSchema.js";
 import { id as r, integer as i, table as a, text as o, timestamp as s } from "@voltro/database";
-//#region src/schema/index.ts
+// src/schema/index.ts
 var c = a("users", {
 	id: r(),
 	email: o().nullable(),
@@ -104,5 +104,4 @@ var c = a("users", {
 	g,
 	_
 ];
-//#endregion
 export { e as authGuestDevicesTable, t as authGuestsTable, v as authTables, d as authTokensTable, n as guestTables, _ as impersonationGrantsTable, g as invitationsTable, h as loginAttemptsTable, u as membershipsTable, m as passkeyChallengesTable, f as passkeysTable, p as recoveryCodesTable, l as sessionsTable, c as usersTable };

package/dist/session.js

@@ -1,5 +1,5 @@
 import { DEFAULT_SESSION_KID as e, buildSetCookie as t, readCookie as n, readSessionValue as r, resolveOptionalSessionSecrets as i, resolveSessionSecret as a, resolveSessionSecrets as o, signSession as s, timingSafeStringEqual as c, verifySessionKeyed as l } from "@voltro/protocol/session";
-//#region src/session.ts
+// src/session.ts
 var u = "voltro:session", d = 604800, f = a, p = o, m = (e) => typeof e == "string" ? e : e.current, h = (t) => {
 	if (typeof t != "string") return t;
 	let n = i(), r = {
@@ -40,5 +40,4 @@ var u = "voltro:session", d = 604800, f = a, p = o, m = (e) => typeof e == "stri
 	...e.domain ? { domain: e.domain } : {},
 	path: "/"
 });
-//#endregion
 export { u as SESSION_COOKIE_NAME, b as clearSessionCookie, g as issueSession, _ as readSession, y as readSessionFromHeaders, v as readSessionKeyed, f as resolveSessionSecret, p as resolveSessionSecrets, h as sessionSecretsOf };

package/dist/sessionFamily.js

@@ -1,4 +1,4 @@
-//#region src/sessionFamily.ts
+// src/sessionFamily.ts
 var e = (e) => {
 	if (typeof e.id != "string" || e.id.length === 0 || typeof e.userId != "string" || e.userId.length === 0) return null;
 	let t = e.familyId ?? e.id;
@@ -11,5 +11,4 @@ var e = (e) => {
 	for (let n of e) typeof n.id == "string" && n.id.length !== 0 && t.set(n.id, t.has(n.id) ? null : n);
 	return t;
 }, r = (e, t, n, r) => e !== null && typeof t == "string" && t.length > 0 && typeof n == "string" && n.length > 0 && Number.isFinite(r) && e.id === t && e.userId === n && e.rotatedAt == null && e.expiresAt instanceof Date && Number.isFinite(e.expiresAt.getTime()) && e.expiresAt.getTime() > r;
-//#endregion
 export { t as hasOwnedSessionFamily, n as indexSessionFamilies, r as isSessionCredentialLiveFor, e as sessionFamilyId };

package/dist/sessionRegistry.js

@@ -3,7 +3,7 @@ import { hasOwnedSessionFamily as t, indexSessionFamilies as n, sessionFamilyId
 import { newAuthId as i } from "./userStore.js";
 import { Effect as a } from "effect";
 import { and as o, columnRef as s, eq as c, isNull as l, or as u } from "@voltro/database";
-//#region src/sessionRegistry.ts
+// src/sessionRegistry.ts
 var d = "sessions", f = 604800, p = (e) => ({
 	...e,
 	expiresAt: new Date(e.expiresAt),
@@ -129,5 +129,4 @@ var d = "sessions", f = 604800, p = (e) => ({
 	let { transaction: c, ...l } = i;
 	return T(C(e, { transaction: "existing" }), t, r, l, a.root.id);
 }) : null;
-//#endregion
 export { C as dataStoreSessionRegistry, E as issueRegisteredSession, y as lockRegisteredSession, D as rotateRegisteredSession, w as withSessionId };

package/dist/signedClaims.js

@@ -1,5 +1,5 @@
 import { createHmac as e, timingSafeEqual as t } from "node:crypto";
-//#region src/signedClaims.ts
+// src/signedClaims.ts
 var n = (t, n, r) => e("sha256", n).update(`${r}:${t}`).digest(), r = (e, t, r) => {
 	if (t.length < 32 || typeof e.exp != "number" || !Number.isSafeInteger(e.exp)) throw Error("Auth handoff requires a project signing key and whole-second expiry");
 	let i = Buffer.from(JSON.stringify(e), "utf8").toString("base64url");
@@ -20,5 +20,4 @@ var n = (t, n, r) => e("sha256", n).update(`${r}:${t}`).digest(), r = (e, t, r)
 		return null;
 	}
 };
-//#endregion
 export { r as signAuthClaims, i as verifyAuthClaims };

package/dist/strategy.js

@@ -3,7 +3,7 @@ import { makeSessionRevocationChecker as t, validateSessionRevocationOptions as
 import { sessionIdOfSubject as r } from "./userStore.js";
 import { Effect as i } from "effect";
 import { readSessionValue as a, resolveSessionSecret as o, verifySessionKeyed as s } from "@voltro/protocol/session";
-//#region src/strategy.ts
+// src/strategy.ts
 var c = (e) => typeof e == "object" && !!e && "isLiveFor" in e && typeof e.isLiveFor == "function" && "invalidate" in e && typeof e.invalidate == "function" && typeof e.ttlMs == "number" && Number.isFinite(e.ttlMs) && e.ttlMs >= 0, l = (e) => e.revocation && c(e.revocation) ? e.revocation : (e.revocation !== void 0 && n(e.revocation), e.store ? t(e.store, e.revocation ?? {}) : null), u = (n = {}) => {
 	let u = n.cookieName ?? "voltro:session", f = l(n), p = n.revocation && !c(n.revocation) ? n.revocation : {}, m = /* @__PURE__ */ new WeakMap(), h = (e) => {
 		if (f) return f;
@@ -65,5 +65,4 @@ var c = (e) => typeof e == "object" && !!e && "isLiveFor" in e && typeof e.isLiv
 		}
 	};
 };
-//#endregion
 export { u as voltroPasswordStrategy };

package/dist/subjectGuard.js

@@ -1,5 +1,5 @@
 import { Effect as e } from "effect";
-//#region src/subjectGuard.ts
+// src/subjectGuard.ts
 var t = { ok: !0 }, n = (n, r) => e.gen(function* () {
 	for (let e of n) {
 		let t = yield* e(r);
@@ -7,5 +7,4 @@ var t = { ok: !0 }, n = (n, r) => e.gen(function* () {
 	}
 	return t;
 });
-//#endregion
 export { n as runSubjectGuards };

package/dist/tokens.js

@@ -1,5 +1,5 @@
 import { createHash as e, randomBytes as t } from "node:crypto";
-//#region src/tokens.ts
+// src/tokens.ts
 var n = 900, r = 3600, i = 86400, a = 300, o = 300, s = {
 	"magic-link": 900,
 	"password-reset": r,
@@ -17,5 +17,4 @@ var n = 900, r = 3600, i = 86400, a = 300, o = 300, s = {
 	...u(t ?? s[e]),
 	purpose: e
 });
-//#endregion
 export { i as EMAIL_VERIFY_TTL_S, n as MAGIC_LINK_TTL_S, a as MFA_PENDING_TTL_S, o as NATIVE_CODE_TTL_S, r as PASSWORD_RESET_TTL_S, l as hashToken, u as mintSecret, d as mintToken };

package/dist/totp.js

@@ -1,6 +1,6 @@
 import { createHmac as e, randomBytes as t, timingSafeEqual as n } from "node:crypto";
 import { Data as r, Effect as i } from "effect";
-//#region src/totp.ts
+// src/totp.ts
 var a = 30, o = 6, s = 20, c = "sha1", l = 1, u = class extends r.TaggedError("TotpVerifyError") {}, d = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567", f = (e) => {
 	let t = 0, n = 0, r = "";
 	for (let i of e) for (n = n << 8 | i, t += 8; t >= 5;) r += d[n >>> t - 5 & 31], t -= 5;
@@ -51,5 +51,4 @@ var a = 30, o = 6, s = 20, c = "sha1", l = 1, u = class extends r.TaggedError("T
 	}
 	return n;
 };
-//#endregion
 export { u as TotpVerifyError, b as generateRecoveryCodes, v as generateTotpCode, g as generateTotpSecret, _ as otpauthUrl, y as verifyTotpCode };

package/dist/userStore.js

@@ -1,7 +1,7 @@
 import { hasOwnedSessionFamily as e, indexSessionFamilies as t, sessionFamilyId as n } from "./sessionFamily.js";
 import { Data as r, Effect as i } from "effect";
 import { generateId as a } from "@voltro/database";
-//#region src/userStore.ts
+// src/userStore.ts
 var o = class extends r.TaggedError("UserAlreadyExistsError") {}, s = class extends r.TaggedError("UserNotFoundError") {}, c = (e) => a({
 	kind: "typeid",
 	prefix: e
@@ -288,5 +288,4 @@ var o = class extends r.TaggedError("UserAlreadyExistsError") {}, s = class exte
 	let t = e.metadata?.memberships;
 	return Array.isArray(t) ? t.filter((e) => typeof e == "object" && !!e && typeof e.tenantId == "string" && typeof e.role == "string") : [];
 };
-//#endregion
 export { o as UserAlreadyExistsError, s as UserNotFoundError, l as memoryUserStore, c as newAuthId, d as sessionIdOfSubject, u as subjectFromUser, f as subjectMemberships };

package/dist/web/guestStorage.js

@@ -1,4 +1,4 @@
-//#region src/web/guestStorage.ts
+// src/web/guestStorage.ts
 var e = (e) => {
 	if (!e.trim()) throw Error("Guest storage requires an app namespace");
 	let t = (t, n) => new Promise((r, i) => {
@@ -43,5 +43,4 @@ var e = (e) => {
 		}
 	};
 };
-//#endregion
 export { e as indexedDbGuestStore };

package/dist/web/passkeyClient.js

@@ -1,4 +1,4 @@
-//#region src/web/passkeyClient.ts
+// src/web/passkeyClient.ts
 var e = (e) => {
 	let t = new Uint8Array(e), n = "";
 	for (let e of t) n += String.fromCharCode(e);
@@ -74,5 +74,4 @@ var e = (e) => {
 	if (!p.ok) throw Error(`passkey sign-in failed: ${String(p.error)}`);
 	return { subject: p.subject };
 };
-//#endregion
 export { n as isPasskeySupported, i as registerPasskey, a as signInWithPasskey };

package/dist/web/requireAuth.js

@@ -1,9 +1,8 @@
 import { useOptionalSubject as e } from "./subjectContext.js";
 import { Fragment as t, jsx as n } from "react/jsx-runtime";
-//#region src/web/requireAuth.tsx
+// src/web/requireAuth.tsx
 var r = ({ children: r, fallback: i }) => {
 	let a = e();
 	return a ? typeof r == "function" ? /* @__PURE__ */ n(t, { children: r(a) }) : /* @__PURE__ */ n(t, { children: r }) : /* @__PURE__ */ n(t, { children: i });
 };
-//#endregion
 export { r as RequireAuth };

package/dist/web/subjectContext.js

@@ -1,6 +1,6 @@
 import { createContext as e, useContext as t } from "react";
 import { jsx as n } from "react/jsx-runtime";
-//#region src/web/subjectContext.tsx
+// src/web/subjectContext.tsx
 var r = e(null), i = ({ subject: e, children: t }) => /* @__PURE__ */ n(r.Provider, {
 	value: e,
 	children: t
@@ -9,5 +9,4 @@ var r = e(null), i = ({ subject: e, children: t }) => /* @__PURE__ */ n(r.Provid
 	if (!e) throw Error("useSubject() called without a signed-in user. Use useOptionalSubject() or wrap the consumer in <RequireAuth>.");
 	return e;
 }, o = () => t(r);
-//#endregion
 export { i as SubjectProvider, o as useOptionalSubject, a as useSubject };

package/dist/webauthn.js

@@ -1,5 +1,5 @@
 import { createHash as e, createPublicKey as t, createVerify as n, randomBytes as r, timingSafeEqual as i, verify as a } from "node:crypto";
-//#region src/webauthn.ts
+// src/webauthn.ts
 var o = (e) => {
 	let t = e.replace(/-/g, "+").replace(/_/g, "/") + "=".repeat((4 - e.length % 4) % 4);
 	return Buffer.from(t, "base64");
@@ -314,5 +314,4 @@ var o = (e) => {
 	let n = Buffer.from(e), r = Buffer.from(t);
 	return n.length === r.length && i(n, r);
 }, D = () => s(r(32));
-//#endregion
 export { D as generateChallenge, w as verifyAssertion, C as verifyRegistration };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voltro/plugin-auth",
-  "version": "0.87.0",
+  "version": "0.88.0",
   "description": "Authentication primitives: password hashing, session creation, schema mixin + tables. Pairs with the `auth` app template for the UI; both independently usable. Server-side only (uses node:crypto).",
   "keywords": [
     "voltro",
@@ -88,11 +88,11 @@
     "node": ">=24.0.0"
   },
   "dependencies": {
-    "@voltro/database": "0.87.0",
-    "@voltro/protocol": "0.87.0"
+    "@voltro/database": "0.88.0",
+    "@voltro/protocol": "0.88.0"
   },
   "peerDependencies": {
-    "effect": "4.0.1",
+    "effect": "4.1.0",
     "react": "^19.0.0"
   },
   "peerDependenciesMeta": {