@voltro/plugin-auth 0.71.1 → 0.73.0

package/dist/index.js

@@ -1,83 +1,136 @@
 import { PasswordEmptyError as e, PasswordHashError as t, hashPassword as n, needsRehash as r, parseScryptParams as i, verifyPassword as a, verifyPasswordWithRehash as o } from "./password.js";
 import { SESSION_COOKIE_NAME as s, clearSessionCookie as c, issueSession as l, readSession as u, readSessionKeyed as d, resolveSessionSecret as f, resolveSessionSecrets as p, sessionSecretsOf as m } from "./session.js";
 import { a as h, c as g, i as _, l as v, n as y, o as b, r as x, s as S, t as C } from "./strategy-MP_KxNuA.js";
-import { $ as w, A as T, B as E, C as D, D as O, E as k, F as A, G as j, H as M, I as N, J as P, K as F, L as I, M as L, N as R, O as z, P as B, Q as V, R as H, S as ee, T as te, U as ne, V as U, W, X as G, Y as K, Z as q, _ as J, a as Y, at as X, b as Z, c as re, ct as ie, d as ae, et as oe, f as se, g as ce, h as le, i as ue, it as de, j as fe, k as pe, l as me, lt as he, m as ge, n as _e, nt as ve, o as ye, ot as be, p as xe, q as Se, r as Ce, rt as we, s as Te, st as Ee, t as De, tt as Oe, u as ke, ut as Ae, v as je, w as Me, x as Ne, y as Pe, z as Fe } from "./plugin-CPcpSSf9.js";
-import { EMAIL_VERIFY_TTL_S as Ie, MAGIC_LINK_TTL_S as Le, MFA_PENDING_TTL_S as Re, PASSWORD_RESET_TTL_S as ze, hashToken as Be, mintSecret as Ve, mintToken as He } from "./tokens.js";
-import { CSRF_COOKIE_NAME as Q, CSRF_HEADER_NAME as Ue, isCsrfTokenWellFormed as We, issueCsrfToken as Ge, verifyCsrf as Ke } from "./csrf.js";
+import { $ as w, A as T, B as E, C as D, D as O, E as k, F as A, G as j, H as M, I as N, J as P, K as F, L as I, M as L, N as R, O as z, P as B, Q as V, R as H, S as U, T as W, U as G, V as K, W as q, X as J, Y, Z as X, _ as Z, a as Q, at as ee, b as te, c as ne, ct as re, d as ie, et as ae, f as oe, g as se, h as ce, i as le, it as ue, j as de, k as fe, l as pe, lt as me, m as he, n as ge, nt as _e, o as ve, ot as ye, p as be, q as xe, r as Se, rt as Ce, s as we, st as Te, t as Ee, tt as De, u as Oe, ut as ke, v as Ae, w as je, x as Me, y as Ne, z as Pe } from "./plugin-DFQ8N52Q.js";
+import { EMAIL_VERIFY_TTL_S as Fe, MAGIC_LINK_TTL_S as Ie, MFA_PENDING_TTL_S as Le, PASSWORD_RESET_TTL_S as Re, hashToken as ze, mintSecret as Be, mintToken as Ve } from "./tokens.js";
+import { CSRF_COOKIE_NAME as He, CSRF_HEADER_NAME as Ue, isCsrfTokenWellFormed as We, issueCsrfToken as Ge, verifyCsrf as Ke } from "./csrf.js";
 import { generateChallenge as qe, verifyAssertion as Je, verifyRegistration as Ye } from "./webauthn.js";
 import { Effect as $ } from "effect";
-//#region src/postgresUserStore.ts
-var Xe = (e) => {
+//#region src/memberships.ts
+var Xe = (e) => async (t) => t.type === "user" ? (await $.runPromise(e.listMemberships(t.id))).map((e) => ({
+	tenantId: e.tenantId,
+	role: e.role
+})) : [], Ze = (e) => {
 	let t = e?.code;
 	if (typeof t == "string") return t;
 	let n = e?.cause?.code;
 	return typeof n == "string" ? n : void 0;
-}, Ze = (e) => {
-	let t = (t) => $.gen(function* () {
-		return (yield* e`
-        SELECT id, email, "passwordHash", "tenantId", "createdAt", "mfaSecret", "mfaEnrolledAt", "emailVerifiedAt"
-        FROM users
-        WHERE email = ${t.toLowerCase()}
+}, Qe = (e) => {
+	let t = e?.columns ?? {};
+	return {
+		table: e?.table ?? "users",
+		col: {
+			id: t.id ?? "id",
+			email: t.email ?? "email",
+			tenantId: t.tenantId ?? "tenantId",
+			createdAt: t.createdAt ?? "createdAt",
+			passwordHash: t.passwordHash ?? "passwordHash",
+			updatedAt: t.updatedAt ?? "updatedAt",
+			mfaSecret: t.mfaSecret ?? "mfaSecret",
+			mfaEnrolledAt: t.mfaEnrolledAt ?? "mfaEnrolledAt",
+			emailVerifiedAt: t.emailVerifiedAt ?? "emailVerifiedAt",
+			deactivatedAt: t.deactivatedAt ?? !1
+		}
+	};
+}, $e = (e, t = {}) => {
+	let n = Qe(t.identity), { col: r } = n, i = (t) => e`${e(r[t])}`, a = [
+		"id",
+		"email",
+		"passwordHash",
+		"tenantId",
+		"createdAt",
+		"mfaSecret",
+		"mfaEnrolledAt",
+		"emailVerifiedAt",
+		"deactivatedAt"
+	], o, s = () => o ??= {
+		usersTable: e.join(".", !1)(n.table.split(".").map((t) => e`${e(t)}`)),
+		selectList: e.csv(a.map((t) => r[t] === !1 ? e`NULL AS ${e(t)}` : e`${i(t)} AS ${e(t)}`))
+	}, c = (e, t) => /* @__PURE__ */ Error(`postgresUserStore: ${t} needs the "${e}" column, and identity.columns.${e} is false — this table has none`), l = (t) => r.updatedAt === !1 ? e`` : e`, ${i("updatedAt")} = ${t}`, u = (e) => ({
+		id: e.id,
+		email: e.email,
+		passwordHash: e.passwordHash,
+		tenantId: e.tenantId,
+		createdAt: e.createdAt,
+		mfaSecret: e.mfaSecret,
+		mfaEnrolledAt: e.mfaEnrolledAt,
+		emailVerifiedAt: e.emailVerifiedAt,
+		...r.deactivatedAt === !1 ? {} : { deactivatedAt: e.deactivatedAt ?? null }
+	}), d = (t) => $.gen(function* () {
+		let n = yield* e`
+        SELECT ${s().selectList} FROM ${s().usersTable}
+        WHERE ${i("email")} = ${t.toLowerCase()}
         LIMIT 1
-      `)[0] ?? null;
-	}).pipe($.orElseSucceed(() => null)), n = (t) => $.gen(function* () {
-		return (yield* e`
-        SELECT id, email, "passwordHash", "tenantId", "createdAt", "mfaSecret", "mfaEnrolledAt", "emailVerifiedAt"
-        FROM users
-        WHERE id = ${t}
+      `;
+		return n[0] ? u(n[0]) : null;
+	}).pipe($.orElseSucceed(() => null)), f = (t) => $.gen(function* () {
+		let n = yield* e`
+        SELECT ${s().selectList} FROM ${s().usersTable}
+        WHERE ${i("id")} = ${t}
         LIMIT 1
-      `)[0] ?? null;
-	}).pipe($.orElseSucceed(() => null)), r = (t) => $.gen(function* () {
-		let n = t.email.toLowerCase(), r = /* @__PURE__ */ new Date();
-		return yield* e`
-        INSERT INTO users (id, email, "passwordHash", "tenantId", "createdAt", "updatedAt")
-        VALUES (${t.id}, ${n}, ${t.passwordHash ?? null}, ${t.tenantId}, ${r}, ${r})
+      `;
+		return n[0] ? u(n[0]) : null;
+	}).pipe($.orElseSucceed(() => null)), p = (t) => $.gen(function* () {
+		let n = t.email.toLowerCase(), a = /* @__PURE__ */ new Date(), o = [
+			i("id"),
+			i("email"),
+			i("tenantId"),
+			i("createdAt")
+		], c = [
+			t.id,
+			n,
+			t.tenantId,
+			a
+		];
+		return r.passwordHash !== !1 && (o.push(i("passwordHash")), c.push(t.passwordHash ?? null)), r.updatedAt !== !1 && (o.push(i("updatedAt")), c.push(a)), yield* e`
+        INSERT INTO ${s().usersTable} (${e.csv(o)})
+        VALUES ${e.in(c)}
       `.pipe($.map(() => ({
 			...t,
 			email: n,
-			createdAt: r
-		})), $.catchAll((e) => Xe(e) === "23505" ? $.fail(new y({ email: n })) : $.die(e)));
-	}), i = (t) => $.gen(function* () {
-		return (yield* e`
-        SELECT id, email, "passwordHash", "tenantId", "createdAt", "mfaSecret", "mfaEnrolledAt", "emailVerifiedAt"
-        FROM users WHERE id = ${t} LIMIT 1
-      `)[0] || (yield* $.fail(new x({ userId: t })));
-	}).pipe($.catchTag("SqlError", (e) => $.die(e))), a = (t, n) => $.gen(function* () {
-		return yield* e`
-        UPDATE users SET "passwordHash" = ${n}, "updatedAt" = ${/* @__PURE__ */ new Date()}
-         WHERE id = ${t}
-      `.pipe($.catchTag("SqlError", (e) => $.die(e))), yield* i(t);
-	}), o = (t, n) => $.gen(function* () {
-		return yield* e`
-        UPDATE users
-           SET "mfaSecret" = ${n}, "mfaEnrolledAt" = ${null}
-         WHERE id = ${t}
-      `.pipe($.catchTag("SqlError", (e) => $.die(e))), yield* i(t);
-	}), s = (t) => $.gen(function* () {
-		return yield* e`
-        UPDATE users
-           SET "mfaEnrolledAt" = ${/* @__PURE__ */ new Date()}
-         WHERE id = ${t}
-      `.pipe($.catchTag("SqlError", (e) => $.die(e))), yield* i(t);
-	}), c = (t) => $.gen(function* () {
-		return yield* e`
-        UPDATE users
-           SET "mfaSecret" = ${null}, "mfaEnrolledAt" = ${null}
-         WHERE id = ${t}
-      `.pipe($.catchTag("SqlError", (e) => $.die(e))), yield* i(t);
-	}), l = (t) => $.gen(function* () {
-		return yield* e`
-        UPDATE users
-           SET "emailVerifiedAt" = ${/* @__PURE__ */ new Date()}, "updatedAt" = ${/* @__PURE__ */ new Date()}
-         WHERE id = ${t} AND "emailVerifiedAt" IS NULL
-      `.pipe($.catchTag("SqlError", (e) => $.die(e))), yield* i(t);
-	}), u = (t) => $.gen(function* () {
+			createdAt: a
+		})), $.catchAll((e) => Ze(e) === "23505" ? $.fail(new y({ email: n })) : $.die(e)));
+	}), m = (t) => $.gen(function* () {
+		let n = (yield* e`
+        SELECT ${s().selectList} FROM ${s().usersTable} WHERE ${i("id")} = ${t} LIMIT 1
+      `)[0];
+		return n ? u(n) : yield* $.fail(new x({ userId: t }));
+	}).pipe($.catchTag("SqlError", (e) => $.die(e))), g = (t, n) => $.gen(function* () {
+		return r.passwordHash === !1 ? yield* $.die(c("passwordHash", "updatePassword")) : (yield* e`
+        UPDATE ${s().usersTable} SET ${i("passwordHash")} = ${n}${l(/* @__PURE__ */ new Date())}
+         WHERE ${i("id")} = ${t}
+      `.pipe($.catchTag("SqlError", (e) => $.die(e))), yield* m(t));
+	}), _ = (t, n) => $.gen(function* () {
+		return r.mfaSecret === !1 ? yield* $.die(c("mfaSecret", "setMfaSecret")) : r.mfaEnrolledAt === !1 ? yield* $.die(c("mfaEnrolledAt", "setMfaSecret")) : (yield* e`
+        UPDATE ${s().usersTable}
+           SET ${i("mfaSecret")} = ${n}, ${i("mfaEnrolledAt")} = ${null}
+         WHERE ${i("id")} = ${t}
+      `.pipe($.catchTag("SqlError", (e) => $.die(e))), yield* m(t));
+	}), v = (t) => $.gen(function* () {
+		return r.mfaEnrolledAt === !1 ? yield* $.die(c("mfaEnrolledAt", "markMfaEnrolled")) : (yield* e`
+        UPDATE ${s().usersTable}
+           SET ${i("mfaEnrolledAt")} = ${/* @__PURE__ */ new Date()}
+         WHERE ${i("id")} = ${t}
+      `.pipe($.catchTag("SqlError", (e) => $.die(e))), yield* m(t));
+	}), b = (t) => $.gen(function* () {
+		return r.mfaSecret === !1 ? yield* $.die(c("mfaSecret", "clearMfa")) : r.mfaEnrolledAt === !1 ? yield* $.die(c("mfaEnrolledAt", "clearMfa")) : (yield* e`
+        UPDATE ${s().usersTable}
+           SET ${i("mfaSecret")} = ${null}, ${i("mfaEnrolledAt")} = ${null}
+         WHERE ${i("id")} = ${t}
+      `.pipe($.catchTag("SqlError", (e) => $.die(e))), yield* m(t));
+	}), S = (t) => $.gen(function* () {
+		return r.emailVerifiedAt === !1 ? yield* $.die(c("emailVerifiedAt", "markEmailVerified")) : (yield* e`
+        UPDATE ${s().usersTable}
+           SET ${i("emailVerifiedAt")} = ${/* @__PURE__ */ new Date()}${l(/* @__PURE__ */ new Date())}
+         WHERE ${i("id")} = ${t} AND ${i("emailVerifiedAt")} IS NULL
+      `.pipe($.catchTag("SqlError", (e) => $.die(e))), yield* m(t));
+	}), C = (t) => $.gen(function* () {
 		return (yield* e`
         SELECT "userId", "tenantId", role, "joinedAt"
           FROM memberships WHERE "userId" = ${t}
           ORDER BY "joinedAt" ASC
       `).map((e) => ({ ...e }));
-	}).pipe($.orElseSucceed(() => [])), d = (t) => $.gen(function* () {
+	}).pipe($.orElseSucceed(() => [])), w = (t) => $.gen(function* () {
 		let n = /* @__PURE__ */ new Date();
 		yield* e`
         UPDATE memberships SET role = ${t.role}
@@ -99,18 +152,18 @@ var Xe = (e) => {
 	}).pipe($.catchAll(() => $.succeed({
 		...t,
 		joinedAt: /* @__PURE__ */ new Date()
-	}))), f = (t, n) => $.gen(function* () {
+	}))), T = (t, n) => $.gen(function* () {
 		return (yield* e`
         SELECT role FROM memberships
          WHERE "userId" = ${t} AND "tenantId" = ${n} LIMIT 1
       `)[0]?.role ?? null;
-	}).pipe($.orElseSucceed(() => null)), p = (t) => $.gen(function* () {
+	}).pipe($.orElseSucceed(() => null)), E = (t) => $.gen(function* () {
 		return (yield* e`
         SELECT id, "userId", "tenantId", "expiresAt", "ipAddress", "userAgent", "createdAt", "lastSeenAt"
           FROM sessions WHERE "userId" = ${t}
           ORDER BY "createdAt" DESC
       `).map((e) => ({ ...e }));
-	}).pipe($.orElseSucceed(() => [])), m = (t) => $.gen(function* () {
+	}).pipe($.orElseSucceed(() => [])), D = (t) => $.gen(function* () {
 		let n = /* @__PURE__ */ new Date();
 		return yield* e`
         INSERT INTO sessions (id, "userId", "tenantId", "expiresAt", "ipAddress", "userAgent", "createdAt", "lastSeenAt")
@@ -127,28 +180,28 @@ var Xe = (e) => {
 		...t,
 		createdAt: /* @__PURE__ */ new Date(),
 		lastSeenAt: /* @__PURE__ */ new Date()
-	}))), g = (t) => $.gen(function* () {
+	}))), O = (t) => $.gen(function* () {
 		let n = yield* e`
         SELECT id, "userId", "tenantId", "expiresAt", "ipAddress", "userAgent", "createdAt", "lastSeenAt"
           FROM sessions WHERE id = ${t} LIMIT 1
       `;
 		return n[0] ? { ...n[0] } : null;
-	}).pipe($.orElseSucceed(() => null)), _ = (t, n) => $.gen(function* () {
+	}).pipe($.orElseSucceed(() => null)), k = (t, n) => $.gen(function* () {
 		yield* e`
         UPDATE sessions SET "expiresAt" = ${n}, "lastSeenAt" = ${/* @__PURE__ */ new Date()}
          WHERE id = ${t}
       `;
-	}).pipe($.asVoid, $.orElseSucceed(() => void 0)), v = (t, n) => $.gen(function* () {
+	}).pipe($.asVoid, $.orElseSucceed(() => void 0)), A = (t, n) => $.gen(function* () {
 		return (yield* e`
         DELETE FROM sessions WHERE id = ${n} AND "userId" = ${t}
         RETURNING id
       `).length > 0;
-	}).pipe($.orElseSucceed(() => !1)), b = (t, n) => $.gen(function* () {
+	}).pipe($.orElseSucceed(() => !1)), j = (t, n) => $.gen(function* () {
 		return (yield* e`
         DELETE FROM sessions WHERE "userId" = ${t} AND id <> ${n}
         RETURNING id
       `).length;
-	}).pipe($.orElseSucceed(() => 0)), S = (t) => $.gen(function* () {
+	}).pipe($.orElseSucceed(() => 0)), M = (t) => $.gen(function* () {
 		let n = /* @__PURE__ */ new Date();
 		return yield* e`
         INSERT INTO "authTokens" (id, "tokenHash", "userId", purpose, "expiresAt", "consumedAt", "createdAt")
@@ -162,7 +215,7 @@ var Xe = (e) => {
 		...t,
 		consumedAt: null,
 		createdAt: /* @__PURE__ */ new Date()
-	}))), C = (t, n) => $.gen(function* () {
+	}))), N = (t, n) => $.gen(function* () {
 		let r = yield* e`
         UPDATE "authTokens"
            SET "consumedAt" = ${/* @__PURE__ */ new Date()}
@@ -173,7 +226,7 @@ var Xe = (e) => {
         RETURNING id, "tokenHash", "userId", purpose, "expiresAt", "consumedAt", "createdAt"
       `;
 		return r[0] ? { ...r[0] } : null;
-	}).pipe($.orElseSucceed(() => null)), w = (t, n) => $.gen(function* () {
+	}).pipe($.orElseSucceed(() => null)), P = (t, n) => $.gen(function* () {
 		let r = yield* e`
         SELECT id, "tokenHash", "userId", purpose, "expiresAt", "consumedAt", "createdAt"
           FROM "authTokens"
@@ -182,7 +235,7 @@ var Xe = (e) => {
          LIMIT 1
       `;
 		return r[0] ? { ...r[0] } : null;
-	}).pipe($.orElseSucceed(() => null)), T = (t) => $.gen(function* () {
+	}).pipe($.orElseSucceed(() => null)), F = (t) => $.gen(function* () {
 		let n = /* @__PURE__ */ new Date(), r = t.email.toLowerCase();
 		return yield* e`
         INSERT INTO invitations (
@@ -202,14 +255,14 @@ var Xe = (e) => {
 			revokedByUserId: null,
 			createdAt: n
 		};
-	}).pipe($.catchAll((e) => $.die(e))), E = (t) => $.gen(function* () {
+	}).pipe($.catchAll((e) => $.die(e))), I = (t) => $.gen(function* () {
 		let n = yield* e`
         SELECT id, "tokenHash", email, "tenantId", role, "invitedByUserId", "expiresAt",
                "acceptedAt", "acceptedByUserId", "revokedAt", "revokedByUserId", "createdAt"
           FROM invitations WHERE "tokenHash" = ${t} LIMIT 1
       `;
 		return n[0] ? { ...n[0] } : null;
-	}).pipe($.orElseSucceed(() => null)), D = (t, n, r) => $.gen(function* () {
+	}).pipe($.orElseSucceed(() => null)), L = (t, n, r) => $.gen(function* () {
 		let i = yield* e`
         UPDATE invitations
            SET "acceptedAt" = ${r}, "acceptedByUserId" = ${n}
@@ -221,7 +274,7 @@ var Xe = (e) => {
                   "acceptedAt", "acceptedByUserId", "revokedAt", "revokedByUserId", "createdAt"
       `;
 		return i[0] ? { ...i[0] } : null;
-	}).pipe($.catchAll((e) => $.die(e))), O = (t, n, r, i) => $.gen(function* () {
+	}).pipe($.catchAll((e) => $.die(e))), R = (t, n, r, i) => $.gen(function* () {
 		return (yield* e`
         UPDATE invitations
            SET "revokedAt" = ${i}, "revokedByUserId" = ${r}
@@ -231,20 +284,20 @@ var Xe = (e) => {
            AND "revokedAt" IS NULL
         RETURNING id
       `).length > 0;
-	}).pipe($.catchAll((e) => $.die(e))), k = (t) => $.gen(function* () {
+	}).pipe($.catchAll((e) => $.die(e))), z = (t) => $.gen(function* () {
 		return (yield* e`
         SELECT id, "tokenHash", email, "tenantId", role, "invitedByUserId", "expiresAt",
                "acceptedAt", "acceptedByUserId", "revokedAt", "revokedByUserId", "createdAt"
           FROM invitations WHERE "tenantId" = ${t}
           ORDER BY "createdAt" DESC
       `).map((e) => ({ ...e }));
-	}).pipe($.orElseSucceed(() => [])), A = (t, n) => $.gen(function* () {
+	}).pipe($.orElseSucceed(() => [])), B = (t, n) => $.gen(function* () {
 		return (yield* e`
         SELECT COUNT(*)::int AS n FROM invitations
          WHERE "tenantId" = ${t}
            AND "acceptedAt" IS NULL AND "revokedAt" IS NULL AND "expiresAt" > ${n}
       `)[0]?.n ?? 0;
-	}).pipe($.catchAll((e) => $.die(e))), j = (t, n, r, i) => $.gen(function* () {
+	}).pipe($.catchAll((e) => $.die(e))), V = (t, n, r, i) => $.gen(function* () {
 		return (yield* e`
         UPDATE invitations
            SET "revokedAt" = ${i}, "revokedByUserId" = ${r}
@@ -254,7 +307,7 @@ var Xe = (e) => {
            AND "revokedAt" IS NULL
         RETURNING id
       `).length;
-	}).pipe($.catchAll((e) => $.die(e))), M = (t) => $.gen(function* () {
+	}).pipe($.catchAll((e) => $.die(e))), H = (t) => $.gen(function* () {
 		let n = /* @__PURE__ */ new Date();
 		return yield* e`
         INSERT INTO "impersonationGrants" (
@@ -271,32 +324,32 @@ var Xe = (e) => {
 			endedAt: null,
 			endedReason: null
 		};
-	}).pipe($.catchAll((e) => $.die(e))), N = (t) => $.gen(function* () {
+	}).pipe($.catchAll((e) => $.die(e))), U = (t) => $.gen(function* () {
 		let n = yield* e`
         SELECT id, "sessionId", "actorUserId", "actorSessionId", "targetUserId", "tenantId",
                reason, "startedAt", "expiresAt", "endedAt", "endedReason", "ipAddress", "userAgent"
           FROM "impersonationGrants" WHERE "sessionId" = ${t} LIMIT 1
       `;
 		return n[0] ? { ...n[0] } : null;
-	}).pipe($.orElseSucceed(() => null)), P = (t, n, r) => $.gen(function* () {
+	}).pipe($.orElseSucceed(() => null)), W = (t, n, r) => $.gen(function* () {
 		return (yield* e`
         UPDATE "impersonationGrants"
            SET "endedAt" = ${r}, "endedReason" = ${n}
          WHERE "sessionId" = ${t} AND "endedAt" IS NULL
         RETURNING id
       `).length > 0;
-	}).pipe($.catchAll((e) => $.die(e))), F = (t) => $.gen(function* () {
+	}).pipe($.catchAll((e) => $.die(e))), G = (t) => $.gen(function* () {
 		return (yield* e`
         SELECT id, "credentialId", "userId", "publicKey", counter, transports, "createdAt", "lastUsedAt"
           FROM passkeys WHERE "userId" = ${t}
       `).map((e) => ({ ...e }));
-	}).pipe($.orElseSucceed(() => [])), I = (t) => $.gen(function* () {
+	}).pipe($.orElseSucceed(() => [])), K = (t) => $.gen(function* () {
 		let n = yield* e`
         SELECT id, "credentialId", "userId", "publicKey", counter, transports, "createdAt", "lastUsedAt"
           FROM passkeys WHERE "credentialId" = ${t} LIMIT 1
       `;
 		return n[0] ? { ...n[0] } : null;
-	}).pipe($.orElseSucceed(() => null)), L = (t) => $.gen(function* () {
+	}).pipe($.orElseSucceed(() => null)), q = (t) => $.gen(function* () {
 		let n = /* @__PURE__ */ new Date();
 		return yield* e`
         INSERT INTO passkeys (id, "credentialId", "userId", "publicKey", counter, transports, "createdAt", "lastUsedAt")
@@ -313,7 +366,7 @@ var Xe = (e) => {
 		...t,
 		createdAt: /* @__PURE__ */ new Date(),
 		lastUsedAt: null
-	}))), R = (t, n) => $.gen(function* () {
+	}))), J = (t, n) => $.gen(function* () {
 		return (yield* e`
         UPDATE passkeys
            SET counter = ${n}, "lastUsedAt" = ${/* @__PURE__ */ new Date()}
@@ -321,14 +374,14 @@ var Xe = (e) => {
            AND counter < ${n}
         RETURNING id
       `).length > 0;
-	}).pipe($.orElseSucceed(() => !1)), z = (t, n) => $.gen(function* () {
+	}).pipe($.orElseSucceed(() => !1)), Y = (t, n) => $.gen(function* () {
 		let r = /* @__PURE__ */ new Date();
 		yield* e`DELETE FROM "recoveryCodes" WHERE "userId" = ${t}`;
 		for (let i of n) yield* e`
           INSERT INTO "recoveryCodes" (id, "userId", "codeHash", "consumedAt", "createdAt")
           VALUES (${h("rc")}, ${t}, ${i}, ${null}, ${r})
         `;
-	}).pipe($.asVoid, $.orElseSucceed(() => void 0)), B = (t, n) => $.gen(function* () {
+	}).pipe($.asVoid, $.orElseSucceed(() => void 0)), X = (t, n) => $.gen(function* () {
 		return (yield* e`
         UPDATE "recoveryCodes"
            SET "consumedAt" = ${/* @__PURE__ */ new Date()}
@@ -337,50 +390,50 @@ var Xe = (e) => {
            AND "consumedAt" IS NULL
         RETURNING id
       `).length > 0;
-	}).pipe($.orElseSucceed(() => !1)), V = (t) => $.gen(function* () {
+	}).pipe($.orElseSucceed(() => !1)), Z = (t) => $.gen(function* () {
 		return (yield* e`
         SELECT COUNT(*)::int AS n FROM "recoveryCodes"
          WHERE "userId" = ${t} AND "consumedAt" IS NULL
       `)[0]?.n ?? 0;
-	}).pipe($.orElseSucceed(() => 0)), H = (e, t) => $.catchAll((n) => $.logWarning(`[auth] lockout ${e} failed — brute-force protection is not counting`).pipe($.annotateLogs("cause", String(n)), $.as(t)));
+	}).pipe($.orElseSucceed(() => 0)), Q = (e, t) => $.catchAll((n) => $.logWarning(`[auth] lockout ${e} failed — brute-force protection is not counting`).pipe($.annotateLogs("cause", String(n)), $.as(t)));
 	return {
-		findByEmail: t,
-		findById: n,
-		insert: r,
-		updatePassword: a,
-		setMfaSecret: o,
-		markMfaEnrolled: s,
-		clearMfa: c,
-		markEmailVerified: l,
-		listMemberships: u,
-		addMembership: d,
-		membershipRole: f,
-		listSessions: p,
-		insertSession: m,
-		findSession: g,
-		touchSession: _,
-		revokeSession: v,
-		revokeAllOtherSessions: b,
-		insertToken: S,
-		consumeToken: C,
-		latestToken: w,
-		insertInvitation: T,
-		findInvitationByHash: E,
-		acceptInvitation: D,
-		revokeInvitation: O,
-		listInvitations: k,
-		countPendingInvitations: A,
-		supersedePendingInvitations: j,
-		insertImpersonationGrant: M,
-		findImpersonationGrantBySession: N,
-		endImpersonationGrant: P,
-		replaceRecoveryCodes: z,
-		consumeRecoveryCode: B,
-		countRecoveryCodes: V,
-		listPasskeys: F,
-		findPasskey: I,
-		insertPasskey: L,
-		advancePasskeyCounter: R,
+		findByEmail: d,
+		findById: f,
+		insert: p,
+		updatePassword: g,
+		setMfaSecret: _,
+		markMfaEnrolled: v,
+		clearMfa: b,
+		markEmailVerified: S,
+		listMemberships: C,
+		addMembership: w,
+		membershipRole: T,
+		listSessions: E,
+		insertSession: D,
+		findSession: O,
+		touchSession: k,
+		revokeSession: A,
+		revokeAllOtherSessions: j,
+		insertToken: M,
+		consumeToken: N,
+		latestToken: P,
+		insertInvitation: F,
+		findInvitationByHash: I,
+		acceptInvitation: L,
+		revokeInvitation: R,
+		listInvitations: z,
+		countPendingInvitations: B,
+		supersedePendingInvitations: V,
+		insertImpersonationGrant: H,
+		findImpersonationGrantBySession: U,
+		endImpersonationGrant: W,
+		replaceRecoveryCodes: Y,
+		consumeRecoveryCode: X,
+		countRecoveryCodes: Z,
+		listPasskeys: G,
+		findPasskey: K,
+		insertPasskey: q,
+		advancePasskeyCounter: J,
 		isLockedOut: (t, n) => $.gen(function* () {
 			let r = (yield* e`
         SELECT "lockedUntil" FROM "loginAttempts"
@@ -393,7 +446,7 @@ var Xe = (e) => {
 				locked: !1,
 				retryAfterSeconds: 0
 			};
-		}).pipe(H("read", {
+		}).pipe(Q("read", {
 			locked: !1,
 			retryAfterSeconds: 0
 		})),
@@ -411,16 +464,16 @@ var Xe = (e) => {
           "lockedUntil" = ${f},
           "updatedAt" = ${p}
       `;
-		}).pipe($.asVoid, H("record", void 0)),
+		}).pipe($.asVoid, Q("record", void 0)),
 		clearLoginFailures: (t) => $.gen(function* () {
 			yield* e`DELETE FROM "loginAttempts" WHERE email = ${t.toLowerCase()}`;
-		}).pipe($.asVoid, H("clear", void 0))
+		}).pipe($.asVoid, Q("clear", void 0))
 	};
-}, Qe = (e) => (t) => $.runPromise(e.send({
+}, et = (e) => (t) => $.runPromise(e.send({
 	to: t.to,
 	subject: t.subject,
 	html: t.html,
 	text: t.text
 }).pipe($.asVoid, $.orElseSucceed(() => void 0)));
 //#endregion
-export { Q as CSRF_COOKIE_NAME, Ue as CSRF_HEADER_NAME, ke as DEFAULT_INVITER_ROLES, ae as DEFAULT_ROLE_RANK, P as EMAIL_NOT_VERIFIED_CODE, K as EMAIL_VERIFIED_METADATA_KEY, G as EMAIL_VERIFY_RESEND_COOLDOWN_S, Ie as EMAIL_VERIFY_TTL_S, Ce as IMPERSONATION_DEFAULT_DURATION_S, ue as IMPERSONATION_FORBIDDEN_SUBPATHS, se as INVITATION_MAX_PENDING, xe as INVITATION_TTL_S, Le as MAGIC_LINK_TTL_S, Re as MFA_PENDING_TTL_S, ze as PASSWORD_RESET_TTL_S, e as PasswordEmptyError, t as PasswordHashError, s as SESSION_COOKIE_NAME, de as TotpVerifyError, y as UserAlreadyExistsError, x as UserNotFoundError, De as authRoutesPlugin, c as clearSessionCookie, O as configSessionSecrets, Ne as dataStoreChallengeStore, ge as defaultCanGrantRole, q as emailVerificationActive, V as emailVerificationGuard, qe as generateChallenge, X as generateRecoveryCodes, be as generateTotpCode, Ee as generateTotpSecret, _e as getAuthSessionStrategy, z as guardSubject, le as handleAcceptInvitation, ce as handleAcceptInvitationWithSignUp, J as handleCreateInvitation, pe as handleCsrf, w as handleEmailVerifyConfirm, oe as handleEmailVerifyRequest, Y as handleImpersonationStart, ye as handleImpersonationStop, je as handleListInvitations, T as handleListMemberships, fe as handleListSessions, L as handleMagicLinkConsume, R as handleMagicLinkRequest, B as handleMfaEnrollStart, A as handleMfaEnrollVerify, N as handleMfaRegenerateRecoveryCodes, I as handleMfaUnenroll, H as handleMfaVerify, ee as handlePasskeyAssertOptions, D as handlePasskeyAssertVerify, Me as handlePasskeyRegisterOptions, te as handlePasskeyRegisterVerify, Fe as handlePasswordResetConfirm, E as handlePasswordResetRequest, Pe as handlePreviewInvitation, U as handleRevokeAllOtherSessions, Z as handleRevokeInvitation, M as handleRevokeSession, ne as handleSignIn, W as handleSignOut, j as handleSignUp, F as handleSwitchTenant, n as hashPassword, Be as hashToken, Te as impersonationAuditRedactor, re as impersonationOf, We as isCsrfTokenWellFormed, Oe as isEmailVerified, me as isImpersonated, Ge as issueCsrfToken, l as issueSession, Se as issueUserSession, Qe as mailSender, v as makeSessionRevocationChecker, k as memoryChallengeStore, _ as memoryUserStore, Ve as mintSecret, He as mintToken, r as needsRehash, h as newAuthId, ie as otpauthUrl, i as parseScryptParams, Ze as postgresUserStore, u as readSession, d as readSessionKeyed, f as resolveSessionSecret, p as resolveSessionSecrets, Ae as runSubjectGuards, ve as sendEmailVerification, b as sessionIdOfSubject, m as sessionSecretsOf, S as subjectFromUser, g as subjectMemberships, we as userEmailVerified, Je as verifyAssertion, Ke as verifyCsrf, a as verifyPassword, o as verifyPasswordWithRehash, Ye as verifyRegistration, he as verifyTotpCode, C as voltroPasswordStrategy };
+export { He as CSRF_COOKIE_NAME, Ue as CSRF_HEADER_NAME, Oe as DEFAULT_INVITER_ROLES, ie as DEFAULT_ROLE_RANK, P as EMAIL_NOT_VERIFIED_CODE, Y as EMAIL_VERIFIED_METADATA_KEY, J as EMAIL_VERIFY_RESEND_COOLDOWN_S, Fe as EMAIL_VERIFY_TTL_S, Se as IMPERSONATION_DEFAULT_DURATION_S, le as IMPERSONATION_FORBIDDEN_SUBPATHS, oe as INVITATION_MAX_PENDING, be as INVITATION_TTL_S, Ie as MAGIC_LINK_TTL_S, Le as MFA_PENDING_TTL_S, Re as PASSWORD_RESET_TTL_S, e as PasswordEmptyError, t as PasswordHashError, s as SESSION_COOKIE_NAME, ue as TotpVerifyError, y as UserAlreadyExistsError, x as UserNotFoundError, Xe as authMemberships, Ee as authRoutesPlugin, c as clearSessionCookie, O as configSessionSecrets, Me as dataStoreChallengeStore, he as defaultCanGrantRole, X as emailVerificationActive, V as emailVerificationGuard, qe as generateChallenge, ee as generateRecoveryCodes, ye as generateTotpCode, Te as generateTotpSecret, ge as getAuthSessionStrategy, z as guardSubject, ce as handleAcceptInvitation, se as handleAcceptInvitationWithSignUp, Z as handleCreateInvitation, fe as handleCsrf, w as handleEmailVerifyConfirm, ae as handleEmailVerifyRequest, Q as handleImpersonationStart, ve as handleImpersonationStop, Ae as handleListInvitations, T as handleListMemberships, de as handleListSessions, L as handleMagicLinkConsume, R as handleMagicLinkRequest, B as handleMfaEnrollStart, A as handleMfaEnrollVerify, N as handleMfaRegenerateRecoveryCodes, I as handleMfaUnenroll, H as handleMfaVerify, U as handlePasskeyAssertOptions, D as handlePasskeyAssertVerify, je as handlePasskeyRegisterOptions, W as handlePasskeyRegisterVerify, Pe as handlePasswordResetConfirm, E as handlePasswordResetRequest, Ne as handlePreviewInvitation, K as handleRevokeAllOtherSessions, te as handleRevokeInvitation, M as handleRevokeSession, G as handleSignIn, q as handleSignOut, j as handleSignUp, F as handleSwitchTenant, n as hashPassword, ze as hashToken, we as impersonationAuditRedactor, ne as impersonationOf, We as isCsrfTokenWellFormed, De as isEmailVerified, pe as isImpersonated, Ge as issueCsrfToken, l as issueSession, xe as issueUserSession, et as mailSender, v as makeSessionRevocationChecker, k as memoryChallengeStore, _ as memoryUserStore, Be as mintSecret, Ve as mintToken, r as needsRehash, h as newAuthId, re as otpauthUrl, i as parseScryptParams, $e as postgresUserStore, u as readSession, d as readSessionKeyed, f as resolveSessionSecret, p as resolveSessionSecrets, ke as runSubjectGuards, _e as sendEmailVerification, b as sessionIdOfSubject, m as sessionSecretsOf, S as subjectFromUser, g as subjectMemberships, Ce as userEmailVerified, Je as verifyAssertion, Ke as verifyCsrf, a as verifyPassword, o as verifyPasswordWithRehash, Ye as verifyRegistration, me as verifyTotpCode, C as voltroPasswordStrategy };