@voltro/plugin-auth 0.36.0 → 0.38.0

package/dist/{plugin-BZm5Semm.js → plugin-CFDw0Lks.js}

@@ -8,83 +8,83 @@ import { createHmac as S, randomBytes as re, timingSafeEqual as ie } from "node:
 import { Data as ae, Effect as C } from "effect";
 import { buildSetCookie as oe, readCookie as se } from "@voltro/protocol/session";
 import { registerRetention as ce, retentionTtlMsFromEnv as le } from "@voltro/database";
-import { definePlugin as ue } from "@voltro/protocol";
+import { IMPERSONATION_METADATA_KEY as w, definePlugin as ue, rawImpersonationMark as de } from "@voltro/protocol";
 //#region src/subjectGuard.ts
-var de = { ok: !0 }, fe = (e, t) => C.gen(function* () {
+var fe = { ok: !0 }, pe = (e, t) => C.gen(function* () {
 	for (let n of e) {
 		let e = yield* n(t);
 		if (!e.ok) return e;
 	}
-	return de;
-}), w = 30, T = 6, pe = 20, me = "sha1", he = 1, E = class extends ae.TaggedError("TotpVerifyError") {}, D = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567", ge = (e) => {
+	return fe;
+}), T = 30, E = 6, me = 20, he = "sha1", ge = 1, D = class extends ae.TaggedError("TotpVerifyError") {}, O = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567", _e = (e) => {
 	let t = 0, n = 0, r = "";
-	for (let i of e) for (n = n << 8 | i, t += 8; t >= 5;) r += D[n >>> t - 5 & 31], t -= 5;
-	return t > 0 && (r += D[n << 5 - t & 31]), r;
-}, _e = (e) => {
+	for (let i of e) for (n = n << 8 | i, t += 8; t >= 5;) r += O[n >>> t - 5 & 31], t -= 5;
+	return t > 0 && (r += O[n << 5 - t & 31]), r;
+}, ve = (e) => {
 	let t = e.toUpperCase().replace(/[\s=]+/g, "");
 	if (!/^[A-Z2-7]+$/.test(t)) return null;
 	let n = new Uint8Array(Math.floor(t.length * 5 / 8)), r = 0, i = 0, a = 0;
 	for (let e of t) {
-		let t = D.indexOf(e);
+		let t = O.indexOf(e);
 		if (t === -1) return null;
 		i = i << 5 | t, r += 5, r >= 8 && (n[a++] = i >>> r - 8 & 255, r -= 8);
 	}
 	return n.subarray(0, a);
-}, ve = (e) => {
+}, ye = (e) => {
 	let t = Buffer.alloc(8);
 	return t.writeBigUInt64BE(BigInt(e), 0), t;
-}, ye = (e, t) => {
-	let n = S(me, Buffer.from(e));
-	n.update(ve(t));
+}, be = (e, t) => {
+	let n = S(he, Buffer.from(e));
+	n.update(ye(t));
 	let r = n.digest(), i = r[r.length - 1] & 15, a = (r[i] & 127) << 24 | (r[i + 1] & 255) << 16 | (r[i + 2] & 255) << 8 | r[i + 3] & 255;
-	return String(a % 10 ** T).padStart(T, "0");
-}, be = () => ge(re(pe)), xe = (e) => `otpauth://totp/${encodeURIComponent(`${e.issuer}:${e.accountName}`)}?${new URLSearchParams({
+	return String(a % 10 ** E).padStart(E, "0");
+}, xe = () => _e(re(me)), Se = (e) => `otpauth://totp/${encodeURIComponent(`${e.issuer}:${e.accountName}`)}?${new URLSearchParams({
 	secret: e.secret,
 	issuer: e.issuer,
 	algorithm: "SHA1",
-	digits: String(T),
-	period: String(w)
-}).toString()}`, Se = (e, t = Date.now()) => {
-	let n = _e(e);
-	return n ? ye(n, Math.floor(t / 1e3 / w)) : "000000";
-}, O = (e, t, n = Date.now()) => C.gen(function* () {
-	let r = _e(e);
-	if (!r) return yield* C.fail(new E({ reason: "malformedSecret" }));
+	digits: String(E),
+	period: String(T)
+}).toString()}`, Ce = (e, t = Date.now()) => {
+	let n = ve(e);
+	return n ? be(n, Math.floor(t / 1e3 / T)) : "000000";
+}, we = (e, t, n = Date.now()) => C.gen(function* () {
+	let r = ve(e);
+	if (!r) return yield* C.fail(new D({ reason: "malformedSecret" }));
 	let i = t.replace(/\s+/g, "");
-	if (!/^[0-9]{6}$/.test(i)) return yield* C.fail(new E({ reason: "invalidCode" }));
-	let a = Math.floor(n / 1e3 / w), o = Buffer.from(i);
-	for (let e = -1; e <= he; e++) {
-		let t = ye(r, a + e), n = Buffer.from(t);
+	if (!/^[0-9]{6}$/.test(i)) return yield* C.fail(new D({ reason: "invalidCode" }));
+	let a = Math.floor(n / 1e3 / T), o = Buffer.from(i);
+	for (let e = -1; e <= ge; e++) {
+		let t = be(r, a + e), n = Buffer.from(t);
 		if (n.length === o.length && ie(n, o)) return !0;
 	}
-	return yield* C.fail(new E({ reason: "invalidCode" }));
-}), Ce = (e = 10) => {
+	return yield* C.fail(new D({ reason: "invalidCode" }));
+}), Te = (e = 10) => {
 	let t = [];
 	for (let n = 0; n < e; n++) {
-		let e = ge(re(16)).slice(0, 25).match(/.{1,5}/g) ?? [];
+		let e = _e(re(16)).slice(0, 25).match(/.{1,5}/g) ?? [];
 		t.push(e.join("-"));
 	}
 	return t;
-}, we = 60, Te = "email_not_verified", Ee = "emailVerified", De = (e) => e?.policy ?? "off", k = (e) => De(e) !== "off", A = (e, t) => {
+}, Ee = 60, De = "email_not_verified", k = "emailVerified", Oe = (e) => e?.policy ?? "off", A = (e) => Oe(e) !== "off", j = (e, t) => {
 	if (e.emailVerifiedAt != null) return !0;
 	let n = t?.exemptAccountsCreatedBefore;
 	return n !== void 0 && e.createdAt.getTime() < n.getTime();
-}, Oe = (e) => {
+}, ke = (e) => {
 	if (e.type !== "user") return null;
-	let t = e.metadata?.[Ee];
+	let t = e.metadata?.[k];
 	return typeof t == "boolean" ? t : null;
-}, ke = (e) => {
-	let t = De(e) === "strict";
-	return (n) => C.succeed(!t || A(n, e) ? { ok: !0 } : {
+}, Ae = (e) => {
+	let t = Oe(e) === "strict";
+	return (n) => C.succeed(!t || j(n, e) ? { ok: !0 } : {
 		ok: !1,
-		code: Te,
+		code: De,
 		message: "This account's email address has not been confirmed yet. Request a new confirmation link and follow it, then sign in again."
 	});
-}, j = (e, t) => ({
+}, M = (e, t) => ({
 	status: e,
 	body: JSON.stringify(t),
 	contentType: "application/json; charset=utf-8"
-}), Ae = (e, t, n) => `${e}${t}${t.includes("?") ? "&" : "?"}token=${encodeURIComponent(n)}`, M = (e, t, n) => C.gen(function* () {
+}), je = (e, t, n) => `${e}${t}${t.includes("?") ? "&" : "?"}token=${encodeURIComponent(n)}`, N = (e, t, n) => C.gen(function* () {
 	let r = n.emailVerification, i = (n.now ?? Date.now)(), a = (r?.resendCooldownSeconds ?? 60) * 1e3;
 	if (a > 0) {
 		let n = yield* t.latestToken(e.id, "email-verify");
@@ -98,7 +98,7 @@ var de = { ok: !0 }, fe = (e, t) => C.gen(function* () {
 		purpose: "email-verify",
 		expiresAt: o.expiresAt
 	}).pipe(C.ignore), !n.sendEmail) return !1;
-	let s = Ae(n.appBaseUrl ?? "", r?.callbackPath ?? "/auth/verify-email/callback", o.token);
+	let s = je(n.appBaseUrl ?? "", r?.callbackPath ?? "/auth/verify-email/callback", o.token);
 	return yield* C.tryPromise(() => n.sendEmail({
 		to: e.email,
 		kind: "email-verify",
@@ -107,43 +107,43 @@ var de = { ok: !0 }, fe = (e, t) => C.gen(function* () {
 		text: `Confirm your email address: ${s}`,
 		html: `<p><a href="${s}">Confirm your email address</a> — this link expires in 24 hours.</p>`
 	})).pipe(C.ignore), !0;
-}), N = (e, t, n) => C.gen(function* () {
-	if (!e.email && !e.userId) return j(400, { error: "email or userId required" });
+}), P = (e, t, n) => C.gen(function* () {
+	if (!e.email && !e.userId) return M(400, { error: "email or userId required" });
 	let r = e.userId ? yield* t.findById(e.userId) : yield* t.findByEmail(e.email);
-	return r && !A(r, n.emailVerification) && (yield* M(r, t, n)), j(202, { ok: !0 });
-}), je = (e, t) => C.gen(function* () {
-	if (!e.token) return j(400, { error: "token required" });
+	return r && !j(r, n.emailVerification) && (yield* N(r, t, n)), M(202, { ok: !0 });
+}), Me = (e, t) => C.gen(function* () {
+	if (!e.token) return M(400, { error: "token required" });
 	let n = yield* t.consumeToken(h(e.token), "email-verify");
-	if (!n) return j(401, { error: "invalid or expired token" });
+	if (!n) return M(401, { error: "invalid or expired token" });
 	let r = yield* t.findById(n.userId);
-	return r ? (yield* t.markEmailVerified(r.id).pipe(C.ignore), j(200, {
+	return r ? (yield* t.markEmailVerified(r.id).pipe(C.ignore), M(200, {
 		ok: !0,
 		verified: !0
-	})) : j(401, { error: "invalid or expired token" });
-}), Me = 5, Ne = 900, Pe = 900, Fe = (e) => ({
-	maxAttempts: e.lockout?.maxAttempts ?? Me,
-	windowMs: (e.lockout?.windowSeconds ?? Ne) * 1e3,
-	lockMs: (e.lockout?.lockSeconds ?? Pe) * 1e3
-}), P = (e) => e.secrets ?? (e.secret === void 0 ? c() : l(e.secret)), Ie = (e) => e.secret ?? s(), F = (e, t, n = {}) => ({
+	})) : M(401, { error: "invalid or expired token" });
+}), Ne = 5, Pe = 900, Fe = 900, Ie = (e) => ({
+	maxAttempts: e.lockout?.maxAttempts ?? Ne,
+	windowMs: (e.lockout?.windowSeconds ?? Pe) * 1e3,
+	lockMs: (e.lockout?.lockSeconds ?? Fe) * 1e3
+}), F = (e) => e.secrets ?? (e.secret === void 0 ? c() : l(e.secret)), Le = (e) => e.secret ?? s(), I = (e, t, n = {}) => ({
 	status: e,
 	body: JSON.stringify(t),
 	contentType: "application/json; charset=utf-8",
 	...n
-}), I = (e, t = {}) => ({
+}), L = (e, t = {}) => ({
 	status: 302,
 	body: "",
 	contentType: "text/plain",
 	location: e,
 	...t
-}), Le = 3600 * 24 * 7, Re = (e, t) => e.type === "user" ? {
+}), Re = 3600 * 24 * 7, ze = (e, t) => e.type === "user" ? {
 	...e,
 	metadata: {
 		...e.metadata ?? {},
 		sessionId: t
 	}
-} : e, L = (e, t, n, r = {}) => C.gen(function* () {
+} : e, R = (e, t, n, r = {}) => C.gen(function* () {
 	r.clearLoginFailures !== !1 && (yield* t.clearLoginFailures(e.email));
-	let i = yield* t.listMemberships(e.id), o = r.sessionId ?? u("sess"), s = r.ttlSeconds ?? Le;
+	let i = yield* t.listMemberships(e.id), o = r.sessionId ?? u("sess"), s = r.ttlSeconds ?? Re;
 	r.sessionRow !== "existing" && (yield* t.insertSession({
 		id: o,
 		userId: e.id,
@@ -153,31 +153,31 @@ var de = { ok: !0 }, fe = (e, t) => C.gen(function* () {
 		userAgent: r.userAgent ?? null
 	}).pipe(C.ignore));
 	let c = { ...r.metadata };
-	k(n.emailVerification) && (c[Ee] = A(e, n.emailVerification));
-	let l = Re(p(e, {
+	A(n.emailVerification) && (c[k] = j(e, n.emailVerification));
+	let l = ze(p(e, {
 		memberships: i,
 		...Object.keys(c).length > 0 ? { metadata: c } : {}
 	}), o);
 	return {
-		setCookie: a(l, P(n), {
+		setCookie: a(l, F(n), {
 			ttlSeconds: s,
 			...n.cookieDomain ? { domain: n.cookieDomain } : {},
 			secure: n.cookieSecure ?? !0
 		}).setCookie,
 		subject: l
 	};
-}), R = (e, t) => C.gen(function* () {
+}), z = (e, t) => C.gen(function* () {
 	let n = t.subjectGuards ?? [];
 	if (n.length === 0) return null;
-	let r = yield* fe(n, e);
-	return r.ok ? null : F(403, {
+	let r = yield* pe(n, e);
+	return r.ok ? null : I(403, {
 		error: r.code,
 		message: r.message
 	});
-}), ze = (r, i, a) => C.gen(function* () {
-	if (!r.email || !r.password) return F(400, { error: "email and password required" });
+}), Be = (r, i, a) => C.gen(function* () {
+	if (!r.email || !r.password) return I(400, { error: "email and password required" });
 	let o = yield* i.findByEmail(r.email), s = (a.now ?? Date.now)(), c = yield* i.isLockedOut(r.email, s);
-	if (c.locked) return F(429, {
+	if (c.locked) return I(429, {
 		error: "account_locked",
 		retryAfterSeconds: c.retryAfterSeconds
 	});
@@ -185,8 +185,8 @@ var de = { ok: !0 }, fe = (e, t) => C.gen(function* () {
 		let n = yield* e("decoy-not-a-real-password").pipe(C.orElseSucceed(() => ""));
 		return yield* t(r.password, n), { valid: !1 };
 	});
-	if (!o || !d.valid) return yield* i.recordLoginFailure(r.email, s, Fe(a)), F(401, { error: "invalid credentials" });
-	let f = yield* R(o, a);
+	if (!o || !d.valid) return yield* i.recordLoginFailure(r.email, s, Ie(a)), I(401, { error: "invalid credentials" });
+	let f = yield* z(o, a);
 	if (f) return f;
 	if (d.rehash && (yield* i.updatePassword(o.id, d.rehash).pipe(C.ignore)), o.mfaEnrolledAt) {
 		let e = _("mfa-pending", 300);
@@ -196,48 +196,48 @@ var de = { ok: !0 }, fe = (e, t) => C.gen(function* () {
 			userId: o.id,
 			purpose: "mfa-pending",
 			expiresAt: e.expiresAt
-		}).pipe(C.ignore), F(200, {
+		}).pipe(C.ignore), I(200, {
 			ok: !0,
 			mfaRequired: !0,
 			pendingToken: e.token,
 			expiresInSeconds: 300
 		});
 	}
-	let { setCookie: p, subject: m } = yield* L(o, i, a, {
+	let { setCookie: p, subject: m } = yield* R(o, i, a, {
 		ipAddress: r.ipAddress ?? null,
 		userAgent: r.userAgent ?? null
 	});
-	return r.redirectAfter ? I(a.successRedirect ?? "/", { setCookie: p }) : F(200, {
+	return r.redirectAfter ? L(a.successRedirect ?? "/", { setCookie: p }) : I(200, {
 		ok: !0,
 		subject: m
 	}, { setCookie: p });
-}), Be = (e, t, n) => C.gen(function* () {
-	if (!e.pendingToken) return F(400, { error: "pending token required" });
-	if (!e.code && !e.recoveryCode) return F(400, { error: "code or recoveryCode required" });
+}), Ve = (e, t, n) => C.gen(function* () {
+	if (!e.pendingToken) return I(400, { error: "pending token required" });
+	if (!e.code && !e.recoveryCode) return I(400, { error: "code or recoveryCode required" });
 	let r = yield* t.consumeToken(h(e.pendingToken), "mfa-pending");
-	if (!r) return F(401, { error: "invalid or expired challenge" });
+	if (!r) return I(401, { error: "invalid or expired challenge" });
 	let i = yield* t.findById(r.userId);
-	if (!i || !i.mfaEnrolledAt || !i.mfaSecret) return F(401, { error: "mfa not enrolled" });
+	if (!i || !i.mfaEnrolledAt || !i.mfaSecret) return I(401, { error: "mfa not enrolled" });
 	let a = (n.now ?? Date.now)(), o = yield* t.isLockedOut(i.email, a);
-	if (o.locked) return F(429, {
+	if (o.locked) return I(429, {
 		error: "account_locked",
 		retryAfterSeconds: o.retryAfterSeconds
 	});
-	let s = yield* R(i, n);
+	let s = yield* z(i, n);
 	if (s) return s;
-	if (!(e.recoveryCode ? yield* t.consumeRecoveryCode(i.id, h(e.recoveryCode.trim())) : yield* O(i.mfaSecret, e.code ?? "").pipe(C.map(() => !0), C.catchTag("TotpVerifyError", () => C.succeed(!1))))) return yield* t.recordLoginFailure(i.email, a, Fe(n)), F(401, { error: "invalid_code" });
-	let { setCookie: c, subject: l } = yield* L(i, t, n, {
+	if (!(e.recoveryCode ? yield* t.consumeRecoveryCode(i.id, h(e.recoveryCode.trim())) : yield* we(i.mfaSecret, e.code ?? "").pipe(C.map(() => !0), C.catchTag("TotpVerifyError", () => C.succeed(!1))))) return yield* t.recordLoginFailure(i.email, a, Ie(n)), I(401, { error: "invalid_code" });
+	let { setCookie: c, subject: l } = yield* R(i, t, n, {
 		ipAddress: e.ipAddress ?? null,
 		userAgent: e.userAgent ?? null
 	});
-	return e.redirectAfter ? I(n.successRedirect ?? "/", { setCookie: c }) : F(200, {
+	return e.redirectAfter ? L(n.successRedirect ?? "/", { setCookie: c }) : I(200, {
 		ok: !0,
 		subject: l
 	}, { setCookie: c });
-}), Ve = (t, n, r) => C.gen(function* () {
-	if (!t.email || !t.password) return F(400, { error: "email and password required" });
-	if (t.password.length < 8) return F(400, { error: "password must be at least 8 characters" });
-	if (yield* n.findByEmail(t.email)) return F(409, { error: "email already registered" });
+}), He = (t, n, r) => C.gen(function* () {
+	if (!t.email || !t.password) return I(400, { error: "email and password required" });
+	if (t.password.length < 8) return I(400, { error: "password must be at least 8 characters" });
+	if (yield* n.findByEmail(t.email)) return I(409, { error: "email already registered" });
 	let i = t.tenantId ?? r.defaultTenantId, a = yield* e(t.password), o = yield* n.insert({
 		id: u("user"),
 		email: t.email,
@@ -248,16 +248,16 @@ var de = { ok: !0 }, fe = (e, t) => C.gen(function* () {
 		userId: o.id,
 		tenantId: i,
 		role: "owner"
-	}).pipe(C.ignore), k(r.emailVerification) && (r.emailVerification?.sendOnSignUp ?? !0) && (yield* M(o, n, r).pipe(C.ignore));
-	let { setCookie: s, subject: c } = yield* L(o, n, r);
-	return t.redirectAfter ? I(r.successRedirect ?? "/", { setCookie: s }) : F(200, {
+	}).pipe(C.ignore), A(r.emailVerification) && (r.emailVerification?.sendOnSignUp ?? !0) && (yield* N(o, n, r).pipe(C.ignore));
+	let { setCookie: s, subject: c } = yield* R(o, n, r);
+	return t.redirectAfter ? L(r.successRedirect ?? "/", { setCookie: s }) : I(200, {
 		ok: !0,
 		subject: c
 	}, { setCookie: s });
-}).pipe(C.catchAll((e) => C.succeed(F(500, {
+}).pipe(C.catchAll((e) => C.succeed(I(500, {
 	error: "signup_failed",
 	cause: String(e)
-})))), He = (e) => ({
+})))), Ue = (e) => ({
 	status: 302,
 	body: "",
 	location: e.successRedirect ?? "/",
@@ -265,58 +265,58 @@ var de = { ok: !0 }, fe = (e, t) => C.gen(function* () {
 		...e.cookieDomain ? { domain: e.cookieDomain } : {},
 		secure: e.cookieSecure ?? !0
 	})
-}), Ue = (e, t) => C.gen(function* () {
+}), We = (e, t) => C.gen(function* () {
 	let n = yield* t.findById(e.userId);
-	if (!n) return F(404, { error: "user_not_found" });
-	let r = be();
-	return yield* t.setMfaSecret(n.id, r).pipe(C.catchAll(() => C.succeed(n))), F(200, {
+	if (!n) return I(404, { error: "user_not_found" });
+	let r = xe();
+	return yield* t.setMfaSecret(n.id, r).pipe(C.catchAll(() => C.succeed(n))), I(200, {
 		ok: !0,
 		secret: r,
-		otpauthUrl: xe({
+		otpauthUrl: Se({
 			issuer: e.issuer,
 			accountName: e.accountName,
 			secret: r
 		})
 	});
-}), We = (e, t) => C.gen(function* () {
+}), Ge = (e, t) => C.gen(function* () {
 	let n = yield* t.findById(e.userId);
-	if (!n) return F(404, { error: "user_not_found" });
-	if (!n.mfaSecret) return F(400, { error: "no_enrollment_in_progress" });
-	if (n.mfaEnrolledAt) return F(409, { error: "already_enrolled" });
-	if (!(yield* O(n.mfaSecret, e.code).pipe(C.map(() => !0), C.catchTag("TotpVerifyError", () => C.succeed(!1))))) return F(401, { error: "invalid_code" });
+	if (!n) return I(404, { error: "user_not_found" });
+	if (!n.mfaSecret) return I(400, { error: "no_enrollment_in_progress" });
+	if (n.mfaEnrolledAt) return I(409, { error: "already_enrolled" });
+	if (!(yield* we(n.mfaSecret, e.code).pipe(C.map(() => !0), C.catchTag("TotpVerifyError", () => C.succeed(!1))))) return I(401, { error: "invalid_code" });
 	yield* t.markMfaEnrolled(n.id).pipe(C.catchAll(() => C.succeed(n)));
-	let r = Ce();
-	return yield* t.replaceRecoveryCodes(n.id, r.map((e) => h(e))).pipe(C.ignore), F(200, {
+	let r = Te();
+	return yield* t.replaceRecoveryCodes(n.id, r.map((e) => h(e))).pipe(C.ignore), I(200, {
 		ok: !0,
 		enrolled: !0,
 		recoveryCodes: r
 	});
-}), Ge = (e, t) => C.gen(function* () {
+}), Ke = (e, t) => C.gen(function* () {
 	let n = yield* t.findById(e.userId);
-	if (!n) return F(404, { error: "user_not_found" });
-	if (!n.mfaEnrolledAt) return F(400, { error: "mfa_not_enrolled" });
-	let r = Ce();
-	return yield* t.replaceRecoveryCodes(n.id, r.map((e) => h(e))).pipe(C.ignore), F(200, {
+	if (!n) return I(404, { error: "user_not_found" });
+	if (!n.mfaEnrolledAt) return I(400, { error: "mfa_not_enrolled" });
+	let r = Te();
+	return yield* t.replaceRecoveryCodes(n.id, r.map((e) => h(e))).pipe(C.ignore), I(200, {
 		ok: !0,
 		recoveryCodes: r
 	});
-}), Ke = (e, t) => C.gen(function* () {
+}), qe = (e, t) => C.gen(function* () {
 	let n = yield* t.findById(e.userId);
-	return n ? (yield* t.clearMfa(n.id).pipe(C.catchAll(() => C.succeed(n))), yield* t.replaceRecoveryCodes(n.id, []).pipe(C.ignore), F(200, {
+	return n ? (yield* t.clearMfa(n.id).pipe(C.catchAll(() => C.succeed(n))), yield* t.replaceRecoveryCodes(n.id, []).pipe(C.ignore), I(200, {
 		ok: !0,
 		enrolled: !1
-	})) : F(404, { error: "user_not_found" });
-}), qe = (e) => {
-	let t = b(Ie(e)), n = oe(v, t, {
+	})) : I(404, { error: "user_not_found" });
+}), Je = (e) => {
+	let t = b(Le(e)), n = oe(v, t, {
 		httpOnly: !1,
 		sameSite: "lax",
 		secure: e.cookieSecure ?? !0,
 		...e.cookieDomain ? { domain: e.cookieDomain } : {},
 		path: "/"
 	});
-	return F(200, { csrfToken: t }, { setCookie: n });
-}, Je = (e, t, n) => `${e}${t}${t.includes("?") ? "&" : "?"}token=${encodeURIComponent(n)}`, Ye = (e, t, n) => C.gen(function* () {
-	if (!e.email) return F(400, { error: "email required" });
+	return I(200, { csrfToken: t }, { setCookie: n });
+}, Ye = (e, t, n) => `${e}${t}${t.includes("?") ? "&" : "?"}token=${encodeURIComponent(n)}`, Xe = (e, t, n) => C.gen(function* () {
+	if (!e.email) return I(400, { error: "email required" });
 	let r = yield* t.findByEmail(e.email);
 	if (r) {
 		let i = _("magic-link");
@@ -327,7 +327,7 @@ var de = { ok: !0 }, fe = (e, t) => C.gen(function* () {
 			purpose: "magic-link",
 			expiresAt: i.expiresAt
 		}).pipe(C.ignore);
-		let a = Je(n.appBaseUrl ?? "", e.callbackPath ?? "/auth/magic-link/callback", i.token);
+		let a = Ye(n.appBaseUrl ?? "", e.callbackPath ?? "/auth/magic-link/callback", i.token);
 		n.sendEmail && (yield* C.tryPromise(() => n.sendEmail({
 			to: r.email,
 			kind: "magic-link",
@@ -337,22 +337,22 @@ var de = { ok: !0 }, fe = (e, t) => C.gen(function* () {
 			html: `<p><a href="${a}">Sign in</a> — this link expires shortly.</p>`
 		})).pipe(C.ignore));
 	}
-	return F(202, { ok: !0 });
-}), Xe = (e, t, n) => C.gen(function* () {
-	if (!e.token) return F(400, { error: "token required" });
+	return I(202, { ok: !0 });
+}), Ze = (e, t, n) => C.gen(function* () {
+	if (!e.token) return I(400, { error: "token required" });
 	let r = yield* t.consumeToken(h(e.token), "magic-link");
-	if (!r) return F(401, { error: "invalid or expired token" });
+	if (!r) return I(401, { error: "invalid or expired token" });
 	let i = yield* t.findById(r.userId);
-	if (!i) return F(401, { error: "invalid or expired token" });
-	let a = yield* t.markEmailVerified(i.id).pipe(C.orElseSucceed(() => i)), o = yield* R(a, n);
+	if (!i) return I(401, { error: "invalid or expired token" });
+	let a = yield* t.markEmailVerified(i.id).pipe(C.orElseSucceed(() => i)), o = yield* z(a, n);
 	if (o) return o;
-	let { setCookie: s, subject: c } = yield* L(a, t, n);
-	return e.redirectAfter ? I(n.successRedirect ?? "/", { setCookie: s }) : F(200, {
+	let { setCookie: s, subject: c } = yield* R(a, t, n);
+	return e.redirectAfter ? L(n.successRedirect ?? "/", { setCookie: s }) : I(200, {
 		ok: !0,
 		subject: c
 	}, { setCookie: s });
-}), Ze = (e, t, n) => C.gen(function* () {
-	if (!e.email) return F(400, { error: "email required" });
+}), Qe = (e, t, n) => C.gen(function* () {
+	if (!e.email) return I(400, { error: "email required" });
 	let r = yield* t.findByEmail(e.email);
 	if (r) {
 		let i = _("password-reset");
@@ -363,7 +363,7 @@ var de = { ok: !0 }, fe = (e, t) => C.gen(function* () {
 			purpose: "password-reset",
 			expiresAt: i.expiresAt
 		}).pipe(C.ignore);
-		let a = Je(n.appBaseUrl ?? "", e.callbackPath ?? "/auth/password-reset/callback", i.token);
+		let a = Ye(n.appBaseUrl ?? "", e.callbackPath ?? "/auth/password-reset/callback", i.token);
 		n.sendEmail && (yield* C.tryPromise(() => n.sendEmail({
 			to: r.email,
 			kind: "password-reset",
@@ -373,16 +373,16 @@ var de = { ok: !0 }, fe = (e, t) => C.gen(function* () {
 			html: `<p><a href="${a}">Reset your password</a> — this link expires shortly.</p>`
 		})).pipe(C.ignore));
 	}
-	return F(202, { ok: !0 });
-}), Qe = (t, n) => C.gen(function* () {
-	if (!t.token || !t.newPassword) return F(400, { error: "token and newPassword required" });
-	if (t.newPassword.length < 8) return F(400, { error: "password must be at least 8 characters" });
+	return I(202, { ok: !0 });
+}), $e = (t, n) => C.gen(function* () {
+	if (!t.token || !t.newPassword) return I(400, { error: "token and newPassword required" });
+	if (t.newPassword.length < 8) return I(400, { error: "password must be at least 8 characters" });
 	let r = yield* n.consumeToken(h(t.token), "password-reset");
-	if (!r) return F(401, { error: "invalid or expired token" });
+	if (!r) return I(401, { error: "invalid or expired token" });
 	let i = yield* e(t.newPassword).pipe(C.orElseSucceed(() => ""));
-	return i ? (yield* n.updatePassword(r.userId, i).pipe(C.ignore), yield* n.markEmailVerified(r.userId).pipe(C.ignore), yield* n.revokeAllOtherSessions(r.userId, "__none__").pipe(C.ignore), F(200, { ok: !0 })) : F(500, { error: "hash_failed" });
-}), $e = (e, t) => C.gen(function* () {
-	return F(200, { sessions: (yield* t.listSessions(e.userId)).map((e) => ({
+	return i ? (yield* n.updatePassword(r.userId, i).pipe(C.ignore), yield* n.markEmailVerified(r.userId).pipe(C.ignore), yield* n.revokeAllOtherSessions(r.userId, "__none__").pipe(C.ignore), I(200, { ok: !0 })) : I(500, { error: "hash_failed" });
+}), et = (e, t) => C.gen(function* () {
+	return I(200, { sessions: (yield* t.listSessions(e.userId)).map((e) => ({
 		id: e.id,
 		tenantId: e.tenantId,
 		ipAddress: e.ipAddress ?? null,
@@ -391,48 +391,48 @@ var de = { ok: !0 }, fe = (e, t) => C.gen(function* () {
 		lastSeenAt: e.lastSeenAt.toISOString(),
 		expiresAt: e.expiresAt.toISOString()
 	})) });
-}), et = (e, t) => C.gen(function* () {
-	return (yield* t.revokeSession(e.userId, e.sessionId)) ? F(200, {
+}), tt = (e, t) => C.gen(function* () {
+	return (yield* t.revokeSession(e.userId, e.sessionId)) ? I(200, {
 		ok: !0,
 		revoked: 1
-	}) : F(404, { error: "session_not_found" });
-}), tt = (e, t) => C.gen(function* () {
-	return F(200, {
+	}) : I(404, { error: "session_not_found" });
+}), nt = (e, t) => C.gen(function* () {
+	return I(200, {
 		ok: !0,
 		revoked: yield* t.revokeAllOtherSessions(e.userId, e.keepSessionId)
 	});
-}), nt = (e, t, n, i) => C.gen(function* () {
+}), rt = (e, t, n, i) => C.gen(function* () {
 	let o = yield* t.findById(e.userId);
-	if (!o) return F(404, { error: "user_not_found" });
+	if (!o) return I(404, { error: "user_not_found" });
 	let s = yield* t.membershipRole(e.userId, e.targetTenantId);
-	if (s === null) return F(403, { error: "not a member of the target tenant" });
+	if (s === null) return I(403, { error: "not a member of the target tenant" });
 	let c = yield* t.listMemberships(o.id), l = e.metadata === void 0 ? void 0 : Object.fromEntries(Object.entries(e.metadata).filter(([e]) => e !== "memberships")), u = p(o, {
 		tenantId: e.targetTenantId,
 		memberships: c,
 		...l === void 0 ? {} : { metadata: l }
-	}), d = e.sessionId ? Re(u, e.sessionId) : u, f = a(d, P(n), {
-		ttlSeconds: Le,
+	}), d = e.sessionId ? ze(u, e.sessionId) : u, f = a(d, F(n), {
+		ttlSeconds: Re,
 		...n.cookieDomain ? { domain: n.cookieDomain } : {},
 		secure: n.cookieSecure ?? !0
 	});
-	return e.clientId !== void 0 && i && i(e.clientId, { cookies: { [r]: f.value } }), F(200, {
+	return e.clientId !== void 0 && i && i(e.clientId, { cookies: { [r]: f.value } }), I(200, {
 		ok: !0,
 		tenantId: e.targetTenantId,
 		role: s,
 		subject: d
 	}, { setCookie: f.setCookie });
-}), rt = (e, t) => C.gen(function* () {
-	return F(200, { memberships: (yield* t.listMemberships(e.userId)).map((e) => ({
+}), it = (e, t) => C.gen(function* () {
+	return I(200, { memberships: (yield* t.listMemberships(e.userId)).map((e) => ({
 		tenantId: e.tenantId,
 		role: e.role,
 		joinedAt: e.joinedAt.toISOString()
 	})) });
-}), z = (e, t, n = {}) => ({
+}), B = (e, t, n = {}) => ({
 	status: e,
 	body: JSON.stringify(t),
 	contentType: "application/json; charset=utf-8",
 	...n
-}), it = 3600 * 24 * 7, at = () => {
+}), at = 3600 * 24 * 7, ot = () => {
 	let e = /* @__PURE__ */ new Map();
 	return {
 		put: (t, n, r) => C.sync(() => {
@@ -446,7 +446,7 @@ var de = { ok: !0 }, fe = (e, t) => C.gen(function* () {
 			return e.delete(t), !n || n.expiresAt < Date.now() ? null : n.challenge;
 		})
 	};
-}, ot = (e) => ({
+}, st = (e) => ({
 	put: (t, n, r) => C.gen(function* () {
 		let i = /* @__PURE__ */ new Date(), a = new Date(i.getTime() + r * 1e3);
 		(yield* e`
@@ -466,12 +466,12 @@ var de = { ok: !0 }, fe = (e, t) => C.gen(function* () {
       `)[0];
 		return n && n.expiresAt.getTime() > Date.now() ? n.challenge : null;
 	}).pipe(C.orElseSucceed(() => null))
-}), B = 300, st = (e, t, n, r) => C.gen(function* () {
-	if (!(yield* t.findById(e.userId))) return z(404, { error: "user_not_found" });
+}), V = 300, ct = (e, t, n, r) => C.gen(function* () {
+	if (!(yield* t.findById(e.userId))) return B(404, { error: "user_not_found" });
 	let i = x();
-	yield* n.put(`${e.userId}:register`, i, B);
+	yield* n.put(`${e.userId}:register`, i, V);
 	let a = yield* t.listPasskeys(e.userId);
-	return z(200, {
+	return B(200, {
 		challenge: i,
 		rp: {
 			id: r.rpId,
@@ -497,12 +497,12 @@ var de = { ok: !0 }, fe = (e, t) => C.gen(function* () {
 			userVerification: "preferred",
 			residentKey: "preferred"
 		},
-		timeout: B * 1e3
+		timeout: V * 1e3
 	});
-}), ct = (e, t, n, r) => C.gen(function* () {
-	if (!(yield* t.findById(e.userId))) return z(404, { error: "user_not_found" });
+}), lt = (e, t, n, r) => C.gen(function* () {
+	if (!(yield* t.findById(e.userId))) return B(404, { error: "user_not_found" });
 	let i = yield* n.take(`${e.userId}:register`);
-	if (!i) return z(400, { error: "no_pending_challenge" });
+	if (!i) return B(400, { error: "no_pending_challenge" });
 	let a = ne({
 		clientDataJSON: e.clientDataJSON,
 		authenticatorData: e.authenticatorData,
@@ -517,29 +517,29 @@ var de = { ok: !0 }, fe = (e, t) => C.gen(function* () {
 		publicKey: a.result.publicKey,
 		counter: a.result.counter,
 		transports: e.transports ?? null
-	}).pipe(C.ignore), z(200, {
+	}).pipe(C.ignore), B(200, {
 		ok: !0,
 		credentialId: a.result.credentialId
-	})) : z(400, { error: a.error });
-}), lt = (e, t, n, r) => C.gen(function* () {
+	})) : B(400, { error: a.error });
+}), ut = (e, t, n, r) => C.gen(function* () {
 	let i = x(), a = e.userId ? `${e.userId}:assert` : "*:assert";
-	yield* n.put(a, i, B);
+	yield* n.put(a, i, V);
 	let o = e.userId ? (yield* t.listPasskeys(e.userId)).map((e) => ({
 		type: "public-key",
 		id: e.credentialId
 	})) : [];
-	return z(200, {
+	return B(200, {
 		challenge: i,
 		rpId: r.rpId,
 		allowCredentials: o,
 		userVerification: "preferred",
-		timeout: B * 1e3
+		timeout: V * 1e3
 	});
-}), ut = (e, t, n, r, i) => C.gen(function* () {
+}), dt = (e, t, n, r, i) => C.gen(function* () {
 	let o = yield* t.findPasskey(e.credentialId);
-	if (!o) return z(401, { error: "unknown_credential" });
+	if (!o) return B(401, { error: "unknown_credential" });
 	let s = e.userId ? `${e.userId}:assert` : "*:assert", c = yield* n.take(s);
-	if (!c) return z(400, { error: "no_pending_challenge" });
+	if (!c) return B(400, { error: "no_pending_challenge" });
 	let l = te({
 		clientDataJSON: e.clientDataJSON,
 		authenticatorData: e.authenticatorData,
@@ -550,18 +550,18 @@ var de = { ok: !0 }, fe = (e, t) => C.gen(function* () {
 		storedPublicKey: o.publicKey,
 		storedCounter: o.counter
 	});
-	if (!l.ok) return z(401, { error: l.error });
-	if (!(yield* t.advancePasskeyCounter(e.credentialId, l.result.newCounter)) && l.result.newCounter !== 0) return z(401, { error: "counter_regressed" });
+	if (!l.ok) return B(401, { error: l.error });
+	if (!(yield* t.advancePasskeyCounter(e.credentialId, l.result.newCounter)) && l.result.newCounter !== 0) return B(401, { error: "counter_regressed" });
 	let d = yield* t.findById(o.userId);
-	if (!d) return z(401, { error: "unknown_credential" });
-	let f = yield* R(d, i);
+	if (!d) return B(401, { error: "unknown_credential" });
+	let f = yield* z(d, i);
 	if (f) return f;
 	let m = yield* t.listMemberships(d.id), h = u("sess");
 	yield* t.insertSession({
 		id: h,
 		userId: d.id,
 		tenantId: d.tenantId,
-		expiresAt: new Date(Date.now() + it * 1e3),
+		expiresAt: new Date(Date.now() + at * 1e3),
 		ipAddress: null,
 		userAgent: null
 	}).pipe(C.ignore);
@@ -571,34 +571,34 @@ var de = { ok: !0 }, fe = (e, t) => C.gen(function* () {
 			...g.metadata ?? {},
 			sessionId: h
 		}
-	} : g, v = a(_, P(i), {
-		ttlSeconds: it,
+	} : g, v = a(_, F(i), {
+		ttlSeconds: at,
 		...i.cookieDomain ? { domain: i.cookieDomain } : {},
 		secure: i.cookieSecure ?? !0
 	});
-	return z(200, {
+	return B(200, {
 		ok: !0,
 		subject: _
 	}, { setCookie: v.setCookie });
-}), dt = 10080 * 60, ft = 500, V = [
+}), ft = 10080 * 60, pt = 500, H = [
 	"owner",
 	"admin",
 	"member",
 	"viewer"
-], pt = ["owner", "admin"], mt = (e, t) => t.indexOf(e), ht = (e, t = V) => {
-	let n = mt(e.inviterRole, t);
+], mt = ["owner", "admin"], ht = (e, t) => t.indexOf(e), gt = (e, t = H) => {
+	let n = ht(e.inviterRole, t);
 	if (n < 0) return !1;
-	let r = mt(e.requestedRole, t);
+	let r = ht(e.requestedRole, t);
 	return r < 0 ? n === 0 : r >= n;
-}, gt = (e) => {
-	let t = e?.roleRank ?? V;
-	return e?.canGrantRole ?? ((e) => ht(e, t));
-}, H = (e, t, n = {}) => ({
+}, _t = (e) => {
+	let t = e?.roleRank ?? H;
+	return e?.canGrantRole ?? ((e) => gt(e, t));
+}, U = (e, t, n = {}) => ({
 	status: e,
 	body: JSON.stringify(t),
 	contentType: "application/json; charset=utf-8",
 	...n
-}), _t = (e, t, n) => `${e}${t}${t.includes("?") ? "&" : "?"}token=${encodeURIComponent(n)}`, vt = (e) => ({
+}), vt = (e, t, n) => `${e}${t}${t.includes("?") ? "&" : "?"}token=${encodeURIComponent(n)}`, yt = (e) => ({
 	id: e.id,
 	email: e.email,
 	tenantId: e.tenantId,
@@ -608,26 +608,26 @@ var de = { ok: !0 }, fe = (e, t) => C.gen(function* () {
 	acceptedAt: e.acceptedAt?.toISOString() ?? null,
 	revokedAt: e.revokedAt?.toISOString() ?? null,
 	createdAt: e.createdAt.toISOString()
-}), U = (e, t, n, r) => C.gen(function* () {
+}), W = (e, t, n, r) => C.gen(function* () {
 	let i = yield* n.membershipRole(e, t);
-	return i === null || !(r?.inviterRoles ?? pt).includes(i) ? H(403, { error: "not_permitted" }) : { role: i };
-}), W = (e) => "status" in e, yt = (e, t, n) => C.gen(function* () {
+	return i === null || !(r?.inviterRoles ?? mt).includes(i) ? U(403, { error: "not_permitted" }) : { role: i };
+}), G = (e) => "status" in e, bt = (e, t, n) => C.gen(function* () {
 	let r = e.email.trim().toLowerCase();
-	if (!r || !r.includes("@")) return H(400, { error: "a valid email is required" });
-	if (!e.tenantId) return H(400, { error: "tenantId required" });
-	if (!e.role) return H(400, { error: "role required" });
-	let i = n.invitations, a = yield* U(e.inviterUserId, e.tenantId, t, i);
-	if (W(a)) return a;
-	if (!gt(i)({
+	if (!r || !r.includes("@")) return U(400, { error: "a valid email is required" });
+	if (!e.tenantId) return U(400, { error: "tenantId required" });
+	if (!e.role) return U(400, { error: "role required" });
+	let i = n.invitations, a = yield* W(e.inviterUserId, e.tenantId, t, i);
+	if (G(a)) return a;
+	if (!_t(i)({
 		inviterRole: a.role,
 		requestedRole: e.role,
 		tenantId: e.tenantId
-	})) return H(403, {
+	})) return U(403, {
 		error: "role_not_grantable",
 		message: `A '${a.role}' may not invite a '${e.role}'.`
 	});
 	let o = new Date((n.now ?? Date.now)());
-	if ((yield* t.countPendingInvitations(e.tenantId, o)) >= (i?.maxPending ?? 500)) return H(429, { error: "too_many_pending_invitations" });
+	if ((yield* t.countPendingInvitations(e.tenantId, o)) >= (i?.maxPending ?? 500)) return U(429, { error: "too_many_pending_invitations" });
 	yield* t.supersedePendingInvitations(e.tenantId, r, e.inviterUserId, o).pipe(C.ignore);
 	let s = i?.ttlSeconds ?? 604800, c = g(s), l = yield* t.insertInvitation({
 		id: u("inv"),
@@ -639,7 +639,7 @@ var de = { ok: !0 }, fe = (e, t) => C.gen(function* () {
 		expiresAt: new Date(o.getTime() + s * 1e3)
 	});
 	if (n.sendEmail) {
-		let t = _t(n.appBaseUrl ?? "", i?.callbackPath ?? "/auth/invitations/accept", c.token);
+		let t = vt(n.appBaseUrl ?? "", i?.callbackPath ?? "/auth/invitations/accept", c.token);
 		yield* C.tryPromise(() => n.sendEmail({
 			to: r,
 			kind: "invitation",
@@ -649,28 +649,28 @@ var de = { ok: !0 }, fe = (e, t) => C.gen(function* () {
 			html: `<p>You have been invited to join as <strong>${e.role}</strong>. <a href="${t}">Accept the invitation</a> — this link expires.</p>`
 		})).pipe(C.ignore);
 	}
-	return H(201, {
+	return U(201, {
 		ok: !0,
-		invitation: vt(l)
+		invitation: yt(l)
 	});
-}), bt = (e, t, n) => C.gen(function* () {
-	let r = yield* U(e.callerUserId, e.tenantId, t, n.invitations);
-	return W(r) ? r : H(200, { invitations: (yield* t.listInvitations(e.tenantId)).map(vt) });
 }), xt = (e, t, n) => C.gen(function* () {
-	if (!e.invitationId) return H(400, { error: "invitationId required" });
-	let r = yield* U(e.callerUserId, e.tenantId, t, n.invitations);
-	if (W(r)) return r;
+	let r = yield* W(e.callerUserId, e.tenantId, t, n.invitations);
+	return G(r) ? r : U(200, { invitations: (yield* t.listInvitations(e.tenantId)).map(yt) });
+}), St = (e, t, n) => C.gen(function* () {
+	if (!e.invitationId) return U(400, { error: "invitationId required" });
+	let r = yield* W(e.callerUserId, e.tenantId, t, n.invitations);
+	if (G(r)) return r;
 	let i = new Date((n.now ?? Date.now)());
-	return (yield* t.revokeInvitation(e.invitationId, e.tenantId, e.callerUserId, i)) ? H(200, {
+	return (yield* t.revokeInvitation(e.invitationId, e.tenantId, e.callerUserId, i)) ? U(200, {
 		ok: !0,
 		revoked: 1
-	}) : H(404, { error: "invitation_not_found" });
-}), St = (e, t, n = {}) => C.gen(function* () {
-	if (!e.token) return H(400, { error: "token required" });
+	}) : U(404, { error: "invitation_not_found" });
+}), Ct = (e, t, n = {}) => C.gen(function* () {
+	if (!e.token) return U(400, { error: "token required" });
 	let r = yield* t.findInvitationByHash(h(e.token));
-	if (!r) return H(404, { error: "invalid_invitation" });
+	if (!r) return U(404, { error: "invalid_invitation" });
 	let i = new Date((n.now ?? Date.now)());
-	return H(200, {
+	return U(200, {
 		ok: !0,
 		state: r.acceptedAt === null ? r.revokedAt === null ? r.expiresAt.getTime() <= i.getTime() ? "expired" : "pending" : "revoked" : "accepted",
 		email: r.email,
@@ -678,31 +678,31 @@ var de = { ok: !0 }, fe = (e, t) => C.gen(function* () {
 		role: r.role,
 		expiresAt: r.expiresAt.toISOString()
 	});
-}), Ct = (e, t, n = {}) => C.gen(function* () {
-	if (!e.token) return H(400, { error: "token required" });
+}), wt = (e, t, n = {}) => C.gen(function* () {
+	if (!e.token) return U(400, { error: "token required" });
 	let r = h(e.token), i = new Date((n.now ?? Date.now)()), a = yield* t.findInvitationByHash(r);
-	if (!a) return H(401, { error: "invalid_or_expired_invitation" });
-	if (!e.userId) return H(401, {
+	if (!a) return U(401, { error: "invalid_or_expired_invitation" });
+	if (!e.userId) return U(401, {
 		error: "authentication_required",
 		email: a.email
 	});
 	let o = yield* t.findById(e.userId);
-	if (!o) return H(401, {
+	if (!o) return U(401, {
 		error: "authentication_required",
 		email: a.email
 	});
-	if (o.email.toLowerCase() !== a.email.toLowerCase()) return H(403, {
+	if (o.email.toLowerCase() !== a.email.toLowerCase()) return U(403, {
 		error: "invitation_email_mismatch",
 		message: "This invitation was issued to a different email address. Sign in as that address to accept it."
 	});
 	let s = yield* t.acceptInvitation(r, o.id, i);
-	if (!s) return H(401, { error: "invalid_or_expired_invitation" });
+	if (!s) return U(401, { error: "invalid_or_expired_invitation" });
 	let c = yield* t.addMembership({
 		userId: o.id,
 		tenantId: s.tenantId,
 		role: s.role
 	});
-	return yield* t.markEmailVerified(o.id).pipe(C.ignore), H(200, {
+	return yield* t.markEmailVerified(o.id).pipe(C.ignore), U(200, {
 		ok: !0,
 		membership: {
 			tenantId: c.tenantId,
@@ -710,19 +710,19 @@ var de = { ok: !0 }, fe = (e, t) => C.gen(function* () {
 			joinedAt: c.joinedAt.toISOString()
 		}
 	});
-}), wt = (e, t, n) => C.gen(function* () {
-	if (!e.token || !e.password) return H(400, { error: "token and password required" });
-	if (e.password.length < (n.minPasswordLength ?? 8)) return H(400, { error: "password must be at least 8 characters" });
+}), Tt = (e, t, n) => C.gen(function* () {
+	if (!e.token || !e.password) return U(400, { error: "token and password required" });
+	if (e.password.length < (n.minPasswordLength ?? 8)) return U(400, { error: "password must be at least 8 characters" });
 	let r = h(e.token), i = new Date((n.now ?? Date.now)()), a = yield* t.findInvitationByHash(r);
-	if (!a) return H(401, { error: "invalid_or_expired_invitation" });
-	if (yield* t.findByEmail(a.email)) return H(409, {
+	if (!a) return U(401, { error: "invalid_or_expired_invitation" });
+	if (yield* t.findByEmail(a.email)) return U(409, {
 		error: "account_exists",
 		message: "An account already exists for this address. Sign in, then accept the invitation."
 	});
 	let o = yield* n.hashPassword(e.password).pipe(C.orElseSucceed(() => ""));
-	if (!o) return H(500, { error: "hash_failed" });
+	if (!o) return U(500, { error: "hash_failed" });
 	let s = u("user"), c = yield* t.acceptInvitation(r, s, i);
-	if (!c) return H(401, { error: "invalid_or_expired_invitation" });
+	if (!c) return U(401, { error: "invalid_or_expired_invitation" });
 	let l = yield* t.insert({
 		id: s,
 		email: c.email,
@@ -733,13 +733,13 @@ var de = { ok: !0 }, fe = (e, t) => C.gen(function* () {
 		userId: l.id,
 		tenantId: c.tenantId,
 		role: c.role
-	}), yield* t.markEmailVerified(l.id).pipe(C.ignore), H(201, {
+	}), yield* t.markEmailVerified(l.id).pipe(C.ignore), U(201, {
 		ok: !0,
 		userId: l.id,
 		tenantId: c.tenantId,
 		role: c.role
-	})) : H(409, { error: "account_exists" });
-}), Tt = 900, G = "impersonation", Et = [
+	})) : U(409, { error: "account_exists" });
+}), Et = 900, Dt = [
 	"/mfa/enroll/start",
 	"/mfa/enroll/verify",
 	"/mfa/unenroll",
@@ -749,7 +749,7 @@ var de = { ok: !0 }, fe = (e, t) => C.gen(function* () {
 	"/sessions/revoke-others",
 	"/switch-tenant",
 	"/impersonate/start"
-], Dt = (e) => {
+], Ot = (e) => {
 	if (typeof e != "object" || !e) return null;
 	let t = e;
 	return typeof t.actorUserId != "string" || t.actorUserId.length === 0 || typeof t.grantId != "string" || typeof t.expiresAt != "string" || typeof t.actorSessionId != "string" || typeof t.startedAt != "string" ? null : {
@@ -760,14 +760,14 @@ var de = { ok: !0 }, fe = (e, t) => C.gen(function* () {
 		expiresAt: t.expiresAt,
 		...typeof t.reason == "string" ? { reason: t.reason } : {}
 	};
-}, K = (e) => e.type === "user" ? Dt(e.metadata?.[G]) : null, q = (e) => K(e) !== null, Ot = () => (e) => {
+}, K = (e) => e.type === "user" ? Ot(de(e)) : null, q = (e) => K(e) !== null, kt = () => (e) => {
 	if (e.type !== "user" || e.metadata === void 0) return e;
-	let t = Dt(e.metadata[G]), { metadata: n, ...r } = e;
+	let t = Ot(e.metadata[w]), { metadata: n, ...r } = e;
 	return {
 		...r,
 		metadata: t === null ? { __redacted: "all" } : {
 			__redacted: "all-except-impersonation",
-			[G]: t
+			[w]: t
 		}
 	};
 }, J = (e, t, n = {}) => ({
@@ -781,7 +781,7 @@ var de = { ok: !0 }, fe = (e, t) => C.gen(function* () {
 		try: () => Promise.resolve(n),
 		catch: (e) => e
 	});
-}).pipe(C.catchAllCause(() => C.void)), kt = (e, t, n) => C.gen(function* () {
+}).pipe(C.catchAllCause(() => C.void)), At = (e, t, n) => C.gen(function* () {
 	let r = n.impersonation, i = (n.now ?? Date.now)(), a = new Date(i), o = e.actorSubject, s = (t, n, i = {}) => Y(r, {
 		kind: "refused",
 		at: a,
@@ -854,7 +854,7 @@ var de = { ok: !0 }, fe = (e, t) => C.gen(function* () {
 	}, y = yield* n.issuer.issue(l, {
 		sessionId: g,
 		ttlSeconds: m,
-		metadata: { [G]: v },
+		metadata: { [w]: v },
 		ipAddress: e.ipAddress ?? null,
 		userAgent: e.userAgent ?? null
 	});
@@ -877,7 +877,7 @@ var de = { ok: !0 }, fe = (e, t) => C.gen(function* () {
 		impersonation: v,
 		subject: y.subject
 	}, { setCookie: y.setCookie });
-}), At = (e, t, n) => C.gen(function* () {
+}), jt = (e, t, n) => C.gen(function* () {
 	let r = n.impersonation, i = (n.now ?? Date.now)(), a = new Date(i), o = K(e.subject);
 	if (!o || !e.sessionId) return J(400, { error: "not_impersonating" });
 	let s = yield* t.findImpersonationGrantBySession(e.sessionId);
@@ -907,10 +907,10 @@ var de = { ok: !0 }, fe = (e, t) => C.gen(function* () {
 		restored: !0,
 		subject: d.subject
 	}, { setCookie: d.setCookie });
-}), jt = (e) => {
-	for (let t of e) if (Mt(t)) return t.auth.sessionStrategy;
+}), Mt = (e) => {
+	for (let t of e) if (Nt(t)) return t.auth.sessionStrategy;
 	return null;
-}, Mt = (e) => typeof e.auth == "object" && e.auth !== null && typeof e.auth.sessionStrategy == "object", Nt = "/auth", Pt = (e) => {
+}, Nt = (e) => typeof e.auth == "object" && e.auth !== null && typeof e.auth.sessionStrategy == "object", Pt = "/auth", Ft = (e) => {
 	let t = Buffer.from(e.rawBody).toString("utf8");
 	if (!t) return {};
 	if ((e.headers["content-type"] ?? "").includes("application/x-www-form-urlencoded")) {
@@ -936,8 +936,8 @@ var de = { ok: !0 }, fe = (e, t) => C.gen(function* () {
 	status: e,
 	body: JSON.stringify(t),
 	contentType: "application/json; charset=utf-8"
-}), Q = (e) => typeof e == "string" ? e : void 0, $ = (e, t) => typeof t == "string" && t.length > 0 ? { [e]: t } : {}, Ft = (t) => {
-	let n = t.prefix ?? Nt, r = t.store, s = t.challengeStore ?? at(), c = {
+}), Q = (e) => typeof e == "string" ? e : void 0, $ = (e, t) => typeof t == "string" && t.length > 0 ? { [e]: t } : {}, It = (t) => {
+	let n = t.prefix ?? Pt, r = t.store, s = t.challengeStore ?? ot(), c = {
 		...t.secret === void 0 ? {} : { secret: t.secret },
 		...t.secrets === void 0 ? {} : { secrets: t.secrets },
 		defaultTenantId: t.defaultTenantId,
@@ -946,7 +946,7 @@ var de = { ok: !0 }, fe = (e, t) => C.gen(function* () {
 		...t.successRedirect === void 0 ? {} : { successRedirect: t.successRedirect },
 		...t.sendEmail === void 0 ? {} : { sendEmail: t.sendEmail },
 		...t.appBaseUrl === void 0 ? {} : { appBaseUrl: t.appBaseUrl },
-		subjectGuards: [...t.subjectGuards ?? [], ...k(t.emailVerification) ? [ke(t.emailVerification)] : []],
+		subjectGuards: [...t.subjectGuards ?? [], ...A(t.emailVerification) ? [Ae(t.emailVerification)] : []],
 		...t.lockout === void 0 ? {} : { lockout: t.lockout },
 		...t.now === void 0 ? {} : { now: t.now },
 		...t.emailVerification === void 0 ? {} : { emailVerification: t.emailVerification }
@@ -970,7 +970,7 @@ var de = { ok: !0 }, fe = (e, t) => C.gen(function* () {
 		envVar: "VOLTRO_IMPERSONATION_GRANTS_TTL_HOURS"
 	});
 	let u = d(r, t.sessionRevocation ?? {}), p = async (e) => {
-		let t = P(c), n = o(e.headers.cookie, t);
+		let t = F(c), n = o(e.headers.cookie, t);
 		if (!n) return null;
 		let i = f(n.subject);
 		if (i && !await C.runPromise(u.isLive(i))) return null;
@@ -1002,9 +1002,9 @@ var de = { ok: !0 }, fe = (e, t) => C.gen(function* () {
 		};
 	}, g = (e) => {
 		let n = e.headers[y];
-		return ee(n, se(e.headers.cookie, v), Ie(t));
+		return ee(n, se(e.headers.cookie, v), Le(t));
 	}, _ = (e, t) => e.path === `${n}${t}`, b = (e) => C.runPromise(e).then(X), x = {
-		issue: (e, t) => L(e, r, c, {
+		issue: (e, t) => R(e, r, c, {
 			sessionId: t.sessionId,
 			ttlSeconds: t.ttlSeconds,
 			metadata: t.metadata,
@@ -1012,7 +1012,7 @@ var de = { ok: !0 }, fe = (e, t) => C.gen(function* () {
 			userAgent: t.userAgent ?? null,
 			clearLoginFailures: !1
 		}),
-		reissue: (e, t) => L(e, r, c, {
+		reissue: (e, t) => R(e, r, c, {
 			sessionId: t.sessionId,
 			ttlSeconds: t.ttlSeconds,
 			sessionRow: "existing",
@@ -1026,16 +1026,16 @@ var de = { ok: !0 }, fe = (e, t) => C.gen(function* () {
 		method: "*",
 		path: n,
 		handle: async (i) => {
-			let a = i.method === "GET" ? {} : Pt(i);
-			if (i.method === "GET" && _(i, "/csrf")) return X(qe(c));
-			if (i.method === "POST" && _(i, "/sign-in")) return b(ze({
+			let a = i.method === "GET" ? {} : Ft(i);
+			if (i.method === "GET" && _(i, "/csrf")) return X(Je(c));
+			if (i.method === "POST" && _(i, "/sign-in")) return b(Be({
 				email: Q(a.email) ?? "",
 				password: Q(a.password) ?? "",
 				...a.redirectAfter === void 0 ? {} : { redirectAfter: !!a.redirectAfter },
 				...i.remoteAddr ? { ipAddress: i.remoteAddr } : {},
 				...i.headers["user-agent"] ? { userAgent: i.headers["user-agent"] } : {}
 			}, r, c));
-			if (i.method === "POST" && _(i, "/sign-up")) return b(Ve({
+			if (i.method === "POST" && _(i, "/sign-up")) return b(He({
 				email: Q(a.email) ?? "",
 				password: Q(a.password) ?? "",
 				...$("tenantId", a.tenantId),
@@ -1043,40 +1043,40 @@ var de = { ok: !0 }, fe = (e, t) => C.gen(function* () {
 			}, r, c));
 			if (i.method === "POST" && _(i, "/sign-out")) {
 				let e = await p(i);
-				return e && e.subject.type === "user" && e.sessionId && (await C.runPromise(r.revokeSession(e.subject.id, e.sessionId)), u.invalidate(e.sessionId)), X(He(c));
+				return e && e.subject.type === "user" && e.sessionId && (await C.runPromise(r.revokeSession(e.subject.id, e.sessionId)), u.invalidate(e.sessionId)), X(Ue(c));
 			}
-			if (i.method === "POST" && _(i, "/magic-link")) return b(Ye({
+			if (i.method === "POST" && _(i, "/magic-link")) return b(Xe({
 				email: Q(a.email) ?? "",
 				...$("callbackPath", a.callbackPath)
 			}, r, c));
-			if (i.method === "POST" && _(i, "/magic-link/callback")) return b(Xe({
+			if (i.method === "POST" && _(i, "/magic-link/callback")) return b(Ze({
 				token: Q(a.token) ?? "",
 				...a.redirectAfter === void 0 ? {} : { redirectAfter: !!a.redirectAfter }
 			}, r, c));
-			if (i.method === "POST" && _(i, "/password-reset")) return b(Ze({
+			if (i.method === "POST" && _(i, "/password-reset")) return b(Qe({
 				email: Q(a.email) ?? "",
 				...$("callbackPath", a.callbackPath)
 			}, r, c));
-			if (i.method === "POST" && _(i, "/password-reset/confirm")) return b(Qe({
+			if (i.method === "POST" && _(i, "/password-reset/confirm")) return b($e({
 				token: Q(a.token) ?? "",
 				newPassword: Q(a.newPassword) ?? ""
 			}, r));
 			if (i.method === "POST" && _(i, "/verify-email")) {
 				let e = Q(a.email);
-				if (e) return b(N({ email: e }, r, c));
+				if (e) return b(P({ email: e }, r, c));
 				let t = await p(i);
-				return !t || t.subject.type !== "user" ? Z(400, { error: "email required" }) : b(N({ userId: t.subject.id }, r, c));
+				return !t || t.subject.type !== "user" ? Z(400, { error: "email required" }) : b(P({ userId: t.subject.id }, r, c));
 			}
-			if (i.method === "POST" && _(i, "/verify-email/callback")) return b(je({ token: Q(a.token) ?? "" }, r));
-			if (t.invitations && i.method === "POST" && _(i, "/invitations/preview")) return b(St({ token: Q(a.token) ?? "" }, r, l));
-			if (t.invitations && i.method === "POST" && _(i, "/invitations/sign-up")) return b(wt({
+			if (i.method === "POST" && _(i, "/verify-email/callback")) return b(Me({ token: Q(a.token) ?? "" }, r));
+			if (t.invitations && i.method === "POST" && _(i, "/invitations/preview")) return b(Ct({ token: Q(a.token) ?? "" }, r, l));
+			if (t.invitations && i.method === "POST" && _(i, "/invitations/sign-up")) return b(Tt({
 				token: Q(a.token) ?? "",
 				password: Q(a.password) ?? ""
 			}, r, {
 				...l,
 				hashPassword: e
 			}));
-			if (i.method === "POST" && _(i, "/mfa/verify")) return b(Be({
+			if (i.method === "POST" && _(i, "/mfa/verify")) return b(Ve({
 				pendingToken: Q(a.pendingToken) ?? "",
 				...$("code", a.code),
 				...$("recoveryCode", a.recoveryCode),
@@ -1084,8 +1084,8 @@ var de = { ok: !0 }, fe = (e, t) => C.gen(function* () {
 				...i.remoteAddr ? { ipAddress: i.remoteAddr } : {},
 				...i.headers["user-agent"] ? { userAgent: i.headers["user-agent"] } : {}
 			}, r, c));
-			if (t.passkey && i.method === "POST" && _(i, "/passkey/assert/options")) return b(lt({ ...$("userId", a.userId) }, r, s, t.passkey));
-			if (t.passkey && i.method === "POST" && _(i, "/passkey/assert/verify")) return b(ut({
+			if (t.passkey && i.method === "POST" && _(i, "/passkey/assert/options")) return b(ut({ ...$("userId", a.userId) }, r, s, t.passkey));
+			if (t.passkey && i.method === "POST" && _(i, "/passkey/assert/verify")) return b(dt({
 				credentialId: Q(a.credentialId) ?? "",
 				clientDataJSON: Q(a.clientDataJSON) ?? "",
 				authenticatorData: Q(a.authenticatorData) ?? "",
@@ -1095,7 +1095,7 @@ var de = { ok: !0 }, fe = (e, t) => C.gen(function* () {
 			let o = await p(i), d = o?.subject ?? null, f = () => !d || d.type !== "user" ? Z(401, { error: "unauthenticated" }) : { userId: d.id }, m = () => g(i) ? null : Z(403, { error: "csrf" }), v = (e) => b(e).then((e) => h(e, o?.renewSetCookie));
 			if (d && q(d)) {
 				let e = i.path.startsWith(n) ? i.path.slice(n.length) : "";
-				if (Et.includes(e)) return Z(403, {
+				if (Dt.includes(e)) return Z(403, {
 					error: "forbidden_while_impersonating",
 					message: "This action changes account credentials or session scope and is refused while impersonating. Stop the impersonation first."
 				});
@@ -1110,11 +1110,11 @@ var de = { ok: !0 }, fe = (e, t) => C.gen(function* () {
 			}
 			if (i.method === "GET" && _(i, "/sessions")) {
 				let e = f();
-				return "status" in e ? e : v($e({ userId: e.userId }, r));
+				return "status" in e ? e : v(et({ userId: e.userId }, r));
 			}
 			if (i.method === "GET" && _(i, "/memberships")) {
 				let e = f();
-				return "status" in e ? e : v(rt({ userId: e.userId }, r));
+				return "status" in e ? e : v(it({ userId: e.userId }, r));
 			}
 			if (i.method === "POST" && _(i, "/sessions/revoke")) {
 				let e = f();
@@ -1122,21 +1122,21 @@ var de = { ok: !0 }, fe = (e, t) => C.gen(function* () {
 				let t = m();
 				if (t) return t;
 				let n = Q(a.sessionId) ?? "";
-				return v(et({
+				return v(tt({
 					userId: e.userId,
 					sessionId: n
 				}, r)).then((e) => (n && u.invalidate(n), e));
 			}
 			if (i.method === "POST" && _(i, "/sessions/revoke-others")) {
 				let e = f();
-				return "status" in e ? e : m() || v(tt({
+				return "status" in e ? e : m() || v(nt({
 					userId: e.userId,
 					keepSessionId: o?.sessionId ?? "__none__"
 				}, r));
 			}
 			if (t.invitations && i.method === "POST" && _(i, "/invitations")) {
 				let e = f();
-				return "status" in e ? e : m() || v(yt({
+				return "status" in e ? e : m() || v(bt({
 					inviterUserId: e.userId,
 					tenantId: Q(a.tenantId) ?? d?.tenantId ?? "",
 					email: Q(a.email) ?? "",
@@ -1145,14 +1145,14 @@ var de = { ok: !0 }, fe = (e, t) => C.gen(function* () {
 			}
 			if (t.invitations && i.method === "GET" && i.path === `${n}/invitations`) {
 				let e = f();
-				return "status" in e ? e : v(bt({
+				return "status" in e ? e : v(xt({
 					callerUserId: e.userId,
 					tenantId: d?.tenantId ?? ""
 				}, r, l));
 			}
 			if (t.invitations && i.method === "POST" && _(i, "/invitations/revoke")) {
 				let e = f();
-				return "status" in e ? e : m() || v(xt({
+				return "status" in e ? e : m() || v(St({
 					callerUserId: e.userId,
 					tenantId: Q(a.tenantId) ?? d?.tenantId ?? "",
 					invitationId: Q(a.invitationId) ?? ""
@@ -1164,14 +1164,14 @@ var de = { ok: !0 }, fe = (e, t) => C.gen(function* () {
 					let e = m();
 					if (e) return e;
 				}
-				return v(Ct({
+				return v(wt({
 					token: Q(a.token) ?? "",
 					..."status" in e ? {} : { userId: e.userId }
 				}, r, l));
 			}
 			if (t.impersonation && i.method === "POST" && _(i, "/impersonate/start")) {
 				let e = f();
-				return "status" in e ? e : m() || b(kt({
+				return "status" in e ? e : m() || b(At({
 					actorSubject: d,
 					actorSessionId: o?.sessionId ?? "",
 					...$("targetUserId", a.userId),
@@ -1189,7 +1189,7 @@ var de = { ok: !0 }, fe = (e, t) => C.gen(function* () {
 			}
 			if (t.impersonation && i.method === "POST" && _(i, "/impersonate/stop")) {
 				let e = f();
-				return "status" in e ? e : m() || b(At({
+				return "status" in e ? e : m() || b(jt({
 					subject: d,
 					sessionId: o?.sessionId ?? ""
 				}, r, {
@@ -1201,7 +1201,7 @@ var de = { ok: !0 }, fe = (e, t) => C.gen(function* () {
 			}
 			if (i.method === "POST" && _(i, "/switch-tenant")) {
 				let e = f();
-				return "status" in e ? e : m() || b(nt({
+				return "status" in e ? e : m() || b(rt({
 					userId: e.userId,
 					targetTenantId: Q(a.targetTenantId) ?? "",
 					...typeof a.clientId == "number" ? { clientId: a.clientId } : {},
@@ -1215,7 +1215,7 @@ var de = { ok: !0 }, fe = (e, t) => C.gen(function* () {
 				let n = m();
 				if (n) return n;
 				let i = await C.runPromise(r.findById(e.userId));
-				return v(Ue({
+				return v(We({
 					userId: e.userId,
 					issuer: t.mfa.issuer,
 					accountName: i?.email ?? e.userId
@@ -1223,29 +1223,29 @@ var de = { ok: !0 }, fe = (e, t) => C.gen(function* () {
 			}
 			if (t.mfa && i.method === "POST" && _(i, "/mfa/enroll/verify")) {
 				let e = f();
-				return "status" in e ? e : m() || v(We({
+				return "status" in e ? e : m() || v(Ge({
 					userId: e.userId,
 					code: Q(a.code) ?? ""
 				}, r));
 			}
 			if (t.mfa && i.method === "POST" && _(i, "/mfa/unenroll")) {
 				let e = f();
-				return "status" in e ? e : m() || v(Ke({ userId: e.userId }, r));
+				return "status" in e ? e : m() || v(qe({ userId: e.userId }, r));
 			}
 			if (t.mfa && i.method === "POST" && _(i, "/mfa/recovery-codes/regenerate")) {
 				let e = f();
-				return "status" in e ? e : m() || v(Ge({ userId: e.userId }, r));
+				return "status" in e ? e : m() || v(Ke({ userId: e.userId }, r));
 			}
 			if (t.passkey && i.method === "POST" && _(i, "/passkey/register/options")) {
 				let e = f();
-				return "status" in e ? e : m() || v(st({
+				return "status" in e ? e : m() || v(ct({
 					userId: e.userId,
 					userName: Q(a.userName) ?? e.userId
 				}, r, s, t.passkey));
 			}
 			if (t.passkey && i.method === "POST" && _(i, "/passkey/register/verify")) {
 				let e = f();
-				return "status" in e ? e : m() || v(ct({
+				return "status" in e ? e : m() || v(lt({
 					userId: e.userId,
 					credentialId: Q(a.credentialId) ?? "",
 					clientDataJSON: Q(a.clientDataJSON) ?? "",
@@ -1259,7 +1259,7 @@ var de = { ok: !0 }, fe = (e, t) => C.gen(function* () {
 		name: t.name ? `@voltro/plugin-auth#${t.name}` : "@voltro/plugin-auth",
 		description: "Auth routes — mounts the full auth surface (password, magic-link, password-reset, CSRF, session probe/list/revoke, memberships, switch-tenant, passkey ceremonies) under /auth on the framework listener, with keyed secret rotation + request-time revocation.",
 		permissions: [],
-		declaredEnv: It,
+		declaredEnv: Lt,
 		httpRoutes: [te],
 		onActivate: (e) => C.sync(() => {
 			e.logger.info("auth routes active", {
@@ -1282,7 +1282,7 @@ var de = { ok: !0 }, fe = (e, t) => C.gen(function* () {
 			revocation: u
 		}) }
 	};
-}, It = [
+}, Lt = [
 	{
 		name: "VOLTRO_SESSION_SECRET_PREVIOUS",
 		required: !1,
@@ -1327,4 +1327,4 @@ var de = { ok: !0 }, fe = (e, t) => C.gen(function* () {
 	}
 ];
 //#endregion
-export { ke as $, qe as A, Qe as B, lt as C, at as D, ct as E, Ue as F, He as G, tt as H, We as I, L as J, Ve as K, Ge as L, $e as M, Xe as N, P as O, Ye as P, k as Q, Ke as R, ot as S, st as T, et as U, Ze as V, ze as W, Ee as X, Te as Y, we as Z, wt as _, G as a, E as at, St as b, Ot as c, be as ct, pt as d, fe as dt, je as et, V as f, Ct as g, ht as h, Et as i, A as it, rt as j, R as k, K as l, xe as lt, dt as m, jt as n, Oe as nt, kt as o, Ce as ot, ft as p, nt as q, Tt as r, M as rt, At as s, Se as st, Ft as t, N as tt, q as u, O as ut, yt as v, ut as w, xt as x, bt as y, Be as z };
+export { Me as $, it as A, Qe as B, dt as C, F as D, ot as E, Ge as F, He as G, tt as H, Ke as I, De as J, rt as K, qe as L, Ze as M, Xe as N, z as O, We as P, Ae as Q, Ve as R, ut as S, lt as T, Be as U, nt as V, Ue as W, Ee as X, k as Y, A as Z, bt as _, At as a, Te as at, St as b, K as c, Se as ct, H as d, P as et, pt as f, Tt as g, wt as h, Dt as i, D as it, et as j, Je as k, q as l, we as lt, gt as m, Mt as n, N as nt, jt as o, Ce as ot, ft as p, R as q, Et as r, j as rt, kt as s, xe as st, It as t, ke as tt, mt as u, pe as ut, xt as v, ct as w, st as x, Ct as y, $e as z };