@voltro/plugin-auth 0.81.0 → 0.82.0

package/dist/plugin-CNW-X70p.js

@@ -0,0 +1,2015 @@
+import { hashPassword as e, verifyPassword as t, verifyPasswordWithRehash as n } from "./password.js";
+import { SESSION_COOKIE_NAME as r, clearSessionCookie as i, issueSession as a, readSessionFromHeaders as o, resolveSessionSecret as s, resolveSessionSecrets as c, sessionSecretsOf as l } from "./session.js";
+import { a as u, i as d, l as f, n as p, o as m, r as h, s as g, t as _ } from "./strategy-XaGjSicX.js";
+import { hashToken as v, mintSecret as y, mintToken as b } from "./tokens.js";
+import { CSRF_COOKIE_NAME as ee, CSRF_HEADER_NAME as te, issueCsrfToken as x, verifyCsrf as ne } from "./csrf.js";
+import { generateChallenge as S, verifyAssertion as re, verifyRegistration as C } from "./webauthn.js";
+import { createHash as w, createHmac as T, randomBytes as E, timingSafeEqual as ie } from "node:crypto";
+import { Data as ae, Effect as D } from "effect";
+import { SESSION_HEADER_NAME as oe, buildSetCookie as O, readCookie as se } from "@voltro/protocol/session";
+import { registerRetention as ce, retentionTtlMsFromEnv as le, writeTenantSelection as ue } from "@voltro/database";
+import { IMPERSONATION_METADATA_KEY as k, definePlugin as de, rawImpersonationMark as fe, selectSubjectTenant as pe } from "@voltro/protocol";
+//#region src/postgresUserStore.ts
+var me = (e) => {
+	let t = e?.code;
+	if (typeof t == "string") return t;
+	let n = e?.cause?.code;
+	return typeof n == "string" ? n : void 0;
+}, he = (e) => {
+	let t = e?.columns ?? {};
+	return {
+		table: e?.table ?? "users",
+		col: {
+			id: t.id ?? "id",
+			email: t.email ?? "email",
+			tenantId: t.tenantId ?? "tenantId",
+			createdAt: t.createdAt ?? "createdAt",
+			passwordHash: t.passwordHash ?? "passwordHash",
+			updatedAt: t.updatedAt ?? "updatedAt",
+			mfaSecret: t.mfaSecret ?? "mfaSecret",
+			mfaEnrolledAt: t.mfaEnrolledAt ?? "mfaEnrolledAt",
+			emailVerifiedAt: t.emailVerifiedAt ?? "emailVerifiedAt",
+			deactivatedAt: t.deactivatedAt ?? !1
+		}
+	};
+}, ge = (e, t = {}) => {
+	let n = he(t.identity), { col: r } = n, i = (t) => e`${e(r[t])}`, a = [
+		"id",
+		"email",
+		"passwordHash",
+		"tenantId",
+		"createdAt",
+		"mfaSecret",
+		"mfaEnrolledAt",
+		"emailVerifiedAt",
+		"deactivatedAt"
+	], o, s = () => o ??= {
+		usersTable: e.join(".", !1)(n.table.split(".").map((t) => e`${e(t)}`)),
+		selectList: e.csv(a.map((t) => r[t] === !1 ? e`NULL AS ${e(t)}` : e`${i(t)} AS ${e(t)}`))
+	}, c = (e, t) => /* @__PURE__ */ Error(`postgresUserStore: ${t} needs the "${e}" column, and identity.columns.${e} is false — this table has none`), l = (t) => r.updatedAt === !1 ? e`` : e`, ${i("updatedAt")} = ${t}`, d = (e) => ({
+		id: e.id,
+		email: e.email,
+		passwordHash: e.passwordHash,
+		tenantId: e.tenantId,
+		createdAt: e.createdAt,
+		mfaSecret: e.mfaSecret,
+		mfaEnrolledAt: e.mfaEnrolledAt,
+		emailVerifiedAt: e.emailVerifiedAt,
+		...r.deactivatedAt === !1 ? {} : { deactivatedAt: e.deactivatedAt ?? null }
+	}), f = (t) => D.gen(function* () {
+		let n = yield* e`
+        SELECT ${s().selectList} FROM ${s().usersTable}
+        WHERE ${i("email")} = ${t.toLowerCase()}
+        LIMIT 1
+      `;
+		return n[0] ? d(n[0]) : null;
+	}).pipe(D.orElseSucceed(() => null)), m = (t) => D.gen(function* () {
+		let n = yield* e`
+        SELECT ${s().selectList} FROM ${s().usersTable}
+        WHERE ${i("id")} = ${t}
+        LIMIT 1
+      `;
+		return n[0] ? d(n[0]) : null;
+	}).pipe(D.orElseSucceed(() => null)), g = (t) => D.gen(function* () {
+		let n = t.email.toLowerCase(), a = /* @__PURE__ */ new Date(), o = [
+			i("id"),
+			i("email"),
+			i("tenantId"),
+			i("createdAt")
+		], c = [
+			t.id,
+			n,
+			t.tenantId,
+			a
+		];
+		return r.passwordHash !== !1 && (o.push(i("passwordHash")), c.push(t.passwordHash ?? null)), r.updatedAt !== !1 && (o.push(i("updatedAt")), c.push(a)), yield* e`
+        INSERT INTO ${s().usersTable} (${e.csv(o)})
+        VALUES ${e.in(c)}
+      `.pipe(D.map(() => ({
+			...t,
+			email: n,
+			createdAt: a
+		})), D.catchAll((e) => me(e) === "23505" ? D.fail(new p({ email: n })) : D.die(e)));
+	}), _ = (t) => D.gen(function* () {
+		let n = (yield* e`
+        SELECT ${s().selectList} FROM ${s().usersTable} WHERE ${i("id")} = ${t} LIMIT 1
+      `)[0];
+		return n ? d(n) : yield* D.fail(new h({ userId: t }));
+	}).pipe(D.catchTag("SqlError", (e) => D.die(e))), v = (t, n) => D.gen(function* () {
+		return r.passwordHash === !1 ? yield* D.die(c("passwordHash", "updatePassword")) : (yield* e`
+        UPDATE ${s().usersTable} SET ${i("passwordHash")} = ${n}${l(/* @__PURE__ */ new Date())}
+         WHERE ${i("id")} = ${t}
+      `.pipe(D.catchTag("SqlError", (e) => D.die(e))), yield* _(t));
+	}), y = (t, n) => D.gen(function* () {
+		return r.mfaSecret === !1 ? yield* D.die(c("mfaSecret", "setMfaSecret")) : r.mfaEnrolledAt === !1 ? yield* D.die(c("mfaEnrolledAt", "setMfaSecret")) : (yield* e`
+        UPDATE ${s().usersTable}
+           SET ${i("mfaSecret")} = ${n}, ${i("mfaEnrolledAt")} = ${null}
+         WHERE ${i("id")} = ${t}
+      `.pipe(D.catchTag("SqlError", (e) => D.die(e))), yield* _(t));
+	}), b = (t) => D.gen(function* () {
+		return r.mfaEnrolledAt === !1 ? yield* D.die(c("mfaEnrolledAt", "markMfaEnrolled")) : (yield* e`
+        UPDATE ${s().usersTable}
+           SET ${i("mfaEnrolledAt")} = ${/* @__PURE__ */ new Date()}
+         WHERE ${i("id")} = ${t}
+      `.pipe(D.catchTag("SqlError", (e) => D.die(e))), yield* _(t));
+	}), ee = (t) => D.gen(function* () {
+		return r.mfaSecret === !1 ? yield* D.die(c("mfaSecret", "clearMfa")) : r.mfaEnrolledAt === !1 ? yield* D.die(c("mfaEnrolledAt", "clearMfa")) : (yield* e`
+        UPDATE ${s().usersTable}
+           SET ${i("mfaSecret")} = ${null}, ${i("mfaEnrolledAt")} = ${null}
+         WHERE ${i("id")} = ${t}
+      `.pipe(D.catchTag("SqlError", (e) => D.die(e))), yield* _(t));
+	}), te = (t) => D.gen(function* () {
+		return r.emailVerifiedAt === !1 ? yield* D.die(c("emailVerifiedAt", "markEmailVerified")) : (yield* e`
+        UPDATE ${s().usersTable}
+           SET ${i("emailVerifiedAt")} = ${/* @__PURE__ */ new Date()}${l(/* @__PURE__ */ new Date())}
+         WHERE ${i("id")} = ${t} AND ${i("emailVerifiedAt")} IS NULL
+      `.pipe(D.catchTag("SqlError", (e) => D.die(e))), yield* _(t));
+	}), x = (t) => D.gen(function* () {
+		return (yield* e`
+        SELECT "userId", "tenantId", role, "joinedAt"
+          FROM memberships WHERE "userId" = ${t}
+          ORDER BY "joinedAt" ASC
+      `).map((e) => ({ ...e }));
+	}).pipe(D.orElseSucceed(() => [])), ne = (t) => D.gen(function* () {
+		let n = /* @__PURE__ */ new Date();
+		yield* e`
+        UPDATE memberships SET role = ${t.role}
+         WHERE "userId" = ${t.userId} AND "tenantId" = ${t.tenantId}
+      `;
+		let r = yield* e`
+        SELECT "userId", "tenantId", role, "joinedAt"
+          FROM memberships
+         WHERE "userId" = ${t.userId} AND "tenantId" = ${t.tenantId}
+         LIMIT 1
+      `;
+		return r[0] ? { ...r[0] } : (yield* e`
+        INSERT INTO memberships (id, "userId", "tenantId", role, "joinedAt")
+        VALUES (${u("mem")}, ${t.userId}, ${t.tenantId}, ${t.role}, ${n})
+      `, {
+			...t,
+			joinedAt: n
+		});
+	}).pipe(D.catchAll(() => D.succeed({
+		...t,
+		joinedAt: /* @__PURE__ */ new Date()
+	}))), S = (t, n) => D.gen(function* () {
+		return (yield* e`
+        SELECT role FROM memberships
+         WHERE "userId" = ${t} AND "tenantId" = ${n} LIMIT 1
+      `)[0]?.role ?? null;
+	}).pipe(D.orElseSucceed(() => null)), re = (t) => D.gen(function* () {
+		return (yield* e`
+        SELECT id, "userId", "tenantId", "expiresAt", "ipAddress", "userAgent", "createdAt", "lastSeenAt"
+          FROM sessions WHERE "userId" = ${t}
+          ORDER BY "createdAt" DESC
+      `).map((e) => ({ ...e }));
+	}).pipe(D.orElseSucceed(() => [])), C = (t) => D.gen(function* () {
+		let n = /* @__PURE__ */ new Date();
+		return yield* e`
+        INSERT INTO sessions (id, "userId", "tenantId", "expiresAt", "ipAddress", "userAgent", "createdAt", "lastSeenAt")
+        VALUES (
+          ${t.id}, ${t.userId}, ${t.tenantId}, ${t.expiresAt},
+          ${t.ipAddress ?? null}, ${t.userAgent ?? null}, ${n}, ${n}
+        )
+      `, {
+			...t,
+			createdAt: n,
+			lastSeenAt: n
+		};
+	}).pipe(D.catchAll(() => D.succeed({
+		...t,
+		createdAt: /* @__PURE__ */ new Date(),
+		lastSeenAt: /* @__PURE__ */ new Date()
+	}))), w = (t) => D.gen(function* () {
+		let n = yield* e`
+        SELECT id, "userId", "tenantId", "expiresAt", "ipAddress", "userAgent", "createdAt", "lastSeenAt"
+          FROM sessions WHERE id = ${t} LIMIT 1
+      `;
+		return n[0] ? { ...n[0] } : null;
+	}).pipe(D.orElseSucceed(() => null)), T = (t, n) => D.gen(function* () {
+		yield* e`
+        UPDATE sessions SET "expiresAt" = ${n}, "lastSeenAt" = ${/* @__PURE__ */ new Date()}
+         WHERE id = ${t}
+      `;
+	}).pipe(D.asVoid, D.orElseSucceed(() => void 0)), E = (t, n) => D.gen(function* () {
+		return (yield* e`
+        DELETE FROM sessions WHERE id = ${n} AND "userId" = ${t}
+        RETURNING id
+      `).length > 0;
+	}).pipe(D.orElseSucceed(() => !1)), ie = (t, n) => D.gen(function* () {
+		return (yield* e`
+        DELETE FROM sessions WHERE "userId" = ${t} AND id <> ${n}
+        RETURNING id
+      `).length;
+	}).pipe(D.orElseSucceed(() => 0)), ae = (t) => D.gen(function* () {
+		return (yield* e`
+        DELETE FROM sessions WHERE "userId" = ${t}
+        RETURNING id
+      `).length;
+	}).pipe(D.orElseSucceed(() => 0)), oe = (t) => D.gen(function* () {
+		let n = /* @__PURE__ */ new Date();
+		return yield* e`
+        INSERT INTO "authTokens" (id, "tokenHash", "userId", purpose, "expiresAt", "consumedAt", "createdAt")
+        VALUES (${t.id}, ${t.tokenHash}, ${t.userId}, ${t.purpose}, ${t.expiresAt}, ${null}, ${n})
+      `, {
+			...t,
+			consumedAt: null,
+			createdAt: n
+		};
+	}).pipe(D.catchAll(() => D.succeed({
+		...t,
+		consumedAt: null,
+		createdAt: /* @__PURE__ */ new Date()
+	}))), O = (t, n) => D.gen(function* () {
+		let r = yield* e`
+        UPDATE "authTokens"
+           SET "consumedAt" = ${/* @__PURE__ */ new Date()}
+         WHERE "tokenHash" = ${t}
+           AND purpose = ${n}
+           AND "consumedAt" IS NULL
+           AND "expiresAt" > ${/* @__PURE__ */ new Date()}
+        RETURNING id, "tokenHash", "userId", purpose, "expiresAt", "consumedAt", "createdAt"
+      `;
+		return r[0] ? { ...r[0] } : null;
+	}).pipe(D.orElseSucceed(() => null)), se = (t, n) => D.gen(function* () {
+		let r = yield* e`
+        SELECT id, "tokenHash", "userId", purpose, "expiresAt", "consumedAt", "createdAt"
+          FROM "authTokens"
+         WHERE "userId" = ${t} AND purpose = ${n}
+         ORDER BY "createdAt" DESC
+         LIMIT 1
+      `;
+		return r[0] ? { ...r[0] } : null;
+	}).pipe(D.orElseSucceed(() => null)), ce = (t) => D.gen(function* () {
+		let n = /* @__PURE__ */ new Date(), r = t.email.toLowerCase();
+		return yield* e`
+        INSERT INTO invitations (
+          id, "tokenHash", email, "tenantId", role, "invitedByUserId",
+          "expiresAt", "acceptedAt", "acceptedByUserId", "revokedAt", "revokedByUserId", "createdAt"
+        ) VALUES (
+          ${t.id}, ${t.tokenHash}, ${r}, ${t.tenantId},
+          ${t.role}, ${t.invitedByUserId}, ${t.expiresAt},
+          ${null}, ${null}, ${null}, ${null}, ${n}
+        )
+      `, {
+			...t,
+			email: r,
+			acceptedAt: null,
+			acceptedByUserId: null,
+			revokedAt: null,
+			revokedByUserId: null,
+			createdAt: n
+		};
+	}).pipe(D.catchAll((e) => D.die(e))), le = (t) => D.gen(function* () {
+		let n = yield* e`
+        SELECT id, "tokenHash", email, "tenantId", role, "invitedByUserId", "expiresAt",
+               "acceptedAt", "acceptedByUserId", "revokedAt", "revokedByUserId", "createdAt"
+          FROM invitations WHERE "tokenHash" = ${t} LIMIT 1
+      `;
+		return n[0] ? { ...n[0] } : null;
+	}).pipe(D.orElseSucceed(() => null)), ue = (t, n, r) => D.gen(function* () {
+		let i = yield* e`
+        UPDATE invitations
+           SET "acceptedAt" = ${r}, "acceptedByUserId" = ${n}
+         WHERE "tokenHash" = ${t}
+           AND "acceptedAt" IS NULL
+           AND "revokedAt" IS NULL
+           AND "expiresAt" > ${r}
+        RETURNING id, "tokenHash", email, "tenantId", role, "invitedByUserId", "expiresAt",
+                  "acceptedAt", "acceptedByUserId", "revokedAt", "revokedByUserId", "createdAt"
+      `;
+		return i[0] ? { ...i[0] } : null;
+	}).pipe(D.catchAll((e) => D.die(e))), k = (t, n, r, i) => D.gen(function* () {
+		return (yield* e`
+        UPDATE invitations
+           SET "revokedAt" = ${i}, "revokedByUserId" = ${r}
+         WHERE id = ${t}
+           AND "tenantId" = ${n}
+           AND "acceptedAt" IS NULL
+           AND "revokedAt" IS NULL
+        RETURNING id
+      `).length > 0;
+	}).pipe(D.catchAll((e) => D.die(e))), de = (t) => D.gen(function* () {
+		return (yield* e`
+        SELECT id, "tokenHash", email, "tenantId", role, "invitedByUserId", "expiresAt",
+               "acceptedAt", "acceptedByUserId", "revokedAt", "revokedByUserId", "createdAt"
+          FROM invitations WHERE "tenantId" = ${t}
+          ORDER BY "createdAt" DESC
+      `).map((e) => ({ ...e }));
+	}).pipe(D.orElseSucceed(() => [])), fe = (t, n) => D.gen(function* () {
+		return (yield* e`
+        SELECT COUNT(*)::int AS n FROM invitations
+         WHERE "tenantId" = ${t}
+           AND "acceptedAt" IS NULL AND "revokedAt" IS NULL AND "expiresAt" > ${n}
+      `)[0]?.n ?? 0;
+	}).pipe(D.catchAll((e) => D.die(e))), pe = (t, n, r, i) => D.gen(function* () {
+		return (yield* e`
+        UPDATE invitations
+           SET "revokedAt" = ${i}, "revokedByUserId" = ${r}
+         WHERE "tenantId" = ${t}
+           AND email = ${n.toLowerCase()}
+           AND "acceptedAt" IS NULL
+           AND "revokedAt" IS NULL
+        RETURNING id
+      `).length;
+	}).pipe(D.catchAll((e) => D.die(e))), ge = (t) => D.gen(function* () {
+		let n = /* @__PURE__ */ new Date();
+		return yield* e`
+        INSERT INTO "impersonationGrants" (
+          id, "sessionId", "actorUserId", "actorSessionId", "targetUserId", "tenantId",
+          reason, "startedAt", "expiresAt", "endedAt", "endedReason", "ipAddress", "userAgent"
+        ) VALUES (
+          ${t.id}, ${t.sessionId}, ${t.actorUserId}, ${t.actorSessionId},
+          ${t.targetUserId}, ${t.tenantId}, ${t.reason ?? null}, ${n},
+          ${t.expiresAt}, ${null}, ${null}, ${t.ipAddress ?? null}, ${t.userAgent ?? null}
+        )
+      `, {
+			...t,
+			startedAt: n,
+			endedAt: null,
+			endedReason: null
+		};
+	}).pipe(D.catchAll((e) => D.die(e))), _e = (t) => D.gen(function* () {
+		let n = yield* e`
+        SELECT id, "sessionId", "actorUserId", "actorSessionId", "targetUserId", "tenantId",
+               reason, "startedAt", "expiresAt", "endedAt", "endedReason", "ipAddress", "userAgent"
+          FROM "impersonationGrants" WHERE "sessionId" = ${t} LIMIT 1
+      `;
+		return n[0] ? { ...n[0] } : null;
+	}).pipe(D.orElseSucceed(() => null)), ve = (t, n, r) => D.gen(function* () {
+		return (yield* e`
+        UPDATE "impersonationGrants"
+           SET "endedAt" = ${r}, "endedReason" = ${n}
+         WHERE "sessionId" = ${t} AND "endedAt" IS NULL
+        RETURNING id
+      `).length > 0;
+	}).pipe(D.catchAll((e) => D.die(e))), ye = (t) => D.gen(function* () {
+		return (yield* e`
+        SELECT id, "credentialId", "userId", "publicKey", counter, transports, "createdAt", "lastUsedAt"
+          FROM passkeys WHERE "userId" = ${t}
+      `).map((e) => ({ ...e }));
+	}).pipe(D.orElseSucceed(() => [])), be = (t) => D.gen(function* () {
+		let n = yield* e`
+        SELECT id, "credentialId", "userId", "publicKey", counter, transports, "createdAt", "lastUsedAt"
+          FROM passkeys WHERE "credentialId" = ${t} LIMIT 1
+      `;
+		return n[0] ? { ...n[0] } : null;
+	}).pipe(D.orElseSucceed(() => null)), A = (t) => D.gen(function* () {
+		let n = /* @__PURE__ */ new Date();
+		return yield* e`
+        INSERT INTO passkeys (id, "credentialId", "userId", "publicKey", counter, transports, "createdAt", "lastUsedAt")
+        VALUES (
+          ${t.id}, ${t.credentialId}, ${t.userId}, ${t.publicKey},
+          ${t.counter}, ${t.transports ?? null}, ${n}, ${null}
+        )
+      `, {
+			...t,
+			createdAt: n,
+			lastUsedAt: null
+		};
+	}).pipe(D.catchAll(() => D.succeed({
+		...t,
+		createdAt: /* @__PURE__ */ new Date(),
+		lastUsedAt: null
+	}))), j = (t, n) => D.gen(function* () {
+		return (yield* e`
+        UPDATE passkeys
+           SET counter = ${n}, "lastUsedAt" = ${/* @__PURE__ */ new Date()}
+         WHERE "credentialId" = ${t}
+           AND counter < ${n}
+        RETURNING id
+      `).length > 0;
+	}).pipe(D.orElseSucceed(() => !1)), xe = (t, n) => D.gen(function* () {
+		let r = /* @__PURE__ */ new Date();
+		yield* e`DELETE FROM "recoveryCodes" WHERE "userId" = ${t}`;
+		for (let i of n) yield* e`
+          INSERT INTO "recoveryCodes" (id, "userId", "codeHash", "consumedAt", "createdAt")
+          VALUES (${u("rc")}, ${t}, ${i}, ${null}, ${r})
+        `;
+	}).pipe(D.asVoid, D.orElseSucceed(() => void 0)), Se = (t, n) => D.gen(function* () {
+		return (yield* e`
+        UPDATE "recoveryCodes"
+           SET "consumedAt" = ${/* @__PURE__ */ new Date()}
+         WHERE "userId" = ${t}
+           AND "codeHash" = ${n}
+           AND "consumedAt" IS NULL
+        RETURNING id
+      `).length > 0;
+	}).pipe(D.orElseSucceed(() => !1)), Ce = (t) => D.gen(function* () {
+		return (yield* e`
+        SELECT COUNT(*)::int AS n FROM "recoveryCodes"
+         WHERE "userId" = ${t} AND "consumedAt" IS NULL
+      `)[0]?.n ?? 0;
+	}).pipe(D.orElseSucceed(() => 0)), M = (e, t) => D.catchAll((n) => D.logWarning(`[auth] lockout ${e} failed — brute-force protection is not counting`).pipe(D.annotateLogs("cause", String(n)), D.as(t)));
+	return {
+		findByEmail: f,
+		findById: m,
+		insert: g,
+		updatePassword: v,
+		setMfaSecret: y,
+		markMfaEnrolled: b,
+		clearMfa: ee,
+		markEmailVerified: te,
+		listMemberships: x,
+		addMembership: ne,
+		membershipRole: S,
+		listSessions: re,
+		insertSession: C,
+		findSession: w,
+		touchSession: T,
+		revokeSession: E,
+		revokeAllOtherSessions: ie,
+		revokeAllSessions: ae,
+		insertToken: oe,
+		consumeToken: O,
+		latestToken: se,
+		insertInvitation: ce,
+		findInvitationByHash: le,
+		acceptInvitation: ue,
+		revokeInvitation: k,
+		listInvitations: de,
+		countPendingInvitations: fe,
+		supersedePendingInvitations: pe,
+		insertImpersonationGrant: ge,
+		findImpersonationGrantBySession: _e,
+		endImpersonationGrant: ve,
+		replaceRecoveryCodes: xe,
+		consumeRecoveryCode: Se,
+		countRecoveryCodes: Ce,
+		listPasskeys: ye,
+		findPasskey: be,
+		insertPasskey: A,
+		advancePasskeyCounter: j,
+		isLockedOut: (t, n) => D.gen(function* () {
+			let r = (yield* e`
+        SELECT "lockedUntil" FROM "loginAttempts"
+         WHERE email = ${t.toLowerCase()} LIMIT 1
+      `)[0]?.lockedUntil ?? null;
+			return r != null && n < r.getTime() ? {
+				locked: !0,
+				retryAfterSeconds: Math.ceil((r.getTime() - n) / 1e3)
+			} : {
+				locked: !1,
+				retryAfterSeconds: 0
+			};
+		}).pipe(M("read", {
+			locked: !1,
+			retryAfterSeconds: 0
+		})),
+		recordLoginFailure: (t, n, r) => D.gen(function* () {
+			let i = t.toLowerCase(), a = (yield* e`
+        SELECT "failedCount", "windowStartedAt", "lockedUntil"
+          FROM "loginAttempts" WHERE email = ${i} LIMIT 1
+      `)[0], o = a?.windowStartedAt?.getTime() ?? null, s = a?.lockedUntil?.getTime() ?? null, c = o == null || n - o >= r.windowMs, l = !a || c || s != null && n >= s, d = l ? 1 : a.failedCount + 1, f = l ? new Date(n) : new Date(o), p = d >= r.maxAttempts ? new Date(n + r.lockMs) : null, m = new Date(n);
+			yield* e`
+        INSERT INTO "loginAttempts" (id, email, "failedCount", "windowStartedAt", "lockedUntil", "createdAt", "updatedAt")
+        VALUES (${u("la")}, ${i}, ${d}, ${f}, ${p}, ${m}, ${m})
+        ON CONFLICT (email) DO UPDATE SET
+          "failedCount" = ${d},
+          "windowStartedAt" = ${f},
+          "lockedUntil" = ${p},
+          "updatedAt" = ${m}
+      `;
+		}).pipe(D.asVoid, M("record", void 0)),
+		clearLoginFailures: (t) => D.gen(function* () {
+			yield* e`DELETE FROM "loginAttempts" WHERE email = ${t.toLowerCase()}`;
+		}).pipe(D.asVoid, M("clear", void 0))
+	};
+}, _e = (e = {}) => ({ sql: t }) => t === void 0 ? d() : t.onDialectOrElse({
+	pg: () => ge(t, e),
+	orElse: () => {
+		throw Error("appUserStore(): the app database is not postgres, and @voltro/plugin-auth ships a SQL user store for postgres only. Pass your own `UserStore` to authRoutesPlugin({ store }).");
+	}
+}), ve = (e) => new Proxy({}, { get: (t, n) => {
+	if (typeof n == "string" && n !== "then") return (...t) => {
+		let r = e();
+		if (r === void 0) throw Error(`authRoutesPlugin: user store method '${n}' was called before the framework bound the app database. A resolver-backed store is available once boot has finished.`);
+		let i = r[n];
+		if (typeof i != "function") throw Error(`authRoutesPlugin: the resolved user store has no method '${n}'.`);
+		return i.apply(r, [...t]);
+	};
+} }), ye = { ok: !0 }, be = (e, t) => D.gen(function* () {
+	for (let n of e) {
+		let e = yield* n(t);
+		if (!e.ok) return e;
+	}
+	return ye;
+}), A = 30, j = 6, xe = 20, Se = "sha1", Ce = 1, M = class extends ae.TaggedError("TotpVerifyError") {}, we = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567", Te = (e) => {
+	let t = 0, n = 0, r = "";
+	for (let i of e) for (n = n << 8 | i, t += 8; t >= 5;) r += we[n >>> t - 5 & 31], t -= 5;
+	return t > 0 && (r += we[n << 5 - t & 31]), r;
+}, Ee = (e) => {
+	let t = e.toUpperCase().replace(/[\s=]+/g, "");
+	if (!/^[A-Z2-7]+$/.test(t)) return null;
+	let n = new Uint8Array(Math.floor(t.length * 5 / 8)), r = 0, i = 0, a = 0;
+	for (let e of t) {
+		let t = we.indexOf(e);
+		if (t === -1) return null;
+		i = i << 5 | t, r += 5, r >= 8 && (n[a++] = i >>> r - 8 & 255, r -= 8);
+	}
+	return n.subarray(0, a);
+}, De = (e) => {
+	let t = Buffer.alloc(8);
+	return t.writeBigUInt64BE(BigInt(e), 0), t;
+}, Oe = (e, t) => {
+	let n = T(Se, Buffer.from(e));
+	n.update(De(t));
+	let r = n.digest(), i = r[r.length - 1] & 15, a = (r[i] & 127) << 24 | (r[i + 1] & 255) << 16 | (r[i + 2] & 255) << 8 | r[i + 3] & 255;
+	return String(a % 10 ** j).padStart(j, "0");
+}, ke = () => Te(E(xe)), Ae = (e) => `otpauth://totp/${encodeURIComponent(`${e.issuer}:${e.accountName}`)}?${new URLSearchParams({
+	secret: e.secret,
+	issuer: e.issuer,
+	algorithm: "SHA1",
+	digits: String(j),
+	period: String(A)
+}).toString()}`, je = (e, t = Date.now()) => {
+	let n = Ee(e);
+	return n ? Oe(n, Math.floor(t / 1e3 / A)) : "000000";
+}, N = (e, t, n = Date.now()) => D.gen(function* () {
+	let r = Ee(e);
+	if (!r) return yield* D.fail(new M({ reason: "malformedSecret" }));
+	let i = t.replace(/\s+/g, "");
+	if (!/^[0-9]{6}$/.test(i)) return yield* D.fail(new M({ reason: "invalidCode" }));
+	let a = Math.floor(n / 1e3 / A), o = Buffer.from(i);
+	for (let e = -1; e <= Ce; e++) {
+		let t = Oe(r, a + e), n = Buffer.from(t);
+		if (n.length === o.length && ie(n, o)) return !0;
+	}
+	return yield* D.fail(new M({ reason: "invalidCode" }));
+}), Me = (e = 10) => {
+	let t = [];
+	for (let n = 0; n < e; n++) {
+		let e = Te(E(16)).slice(0, 25).match(/.{1,5}/g) ?? [];
+		t.push(e.join("-"));
+	}
+	return t;
+}, P = (e, t, n = { store: void 0 }) => {
+	if (e === void 0) return D.succeed(null);
+	let r = e(t, n);
+	return D.isEffect(r) ? r : D.promise(() => r);
+}, Ne = 60, Pe = "email_not_verified", Fe = "emailVerified", Ie = (e) => e?.policy ?? "off", F = (e) => Ie(e) !== "off", I = (e, t) => {
+	if (e.emailVerifiedAt != null) return !0;
+	let n = t?.exemptAccountsCreatedBefore;
+	return n !== void 0 && e.createdAt.getTime() < n.getTime();
+}, Le = (e) => {
+	if (e.type !== "user") return null;
+	let t = e.metadata?.[Fe];
+	return typeof t == "boolean" ? t : null;
+}, Re = (e) => {
+	let t = Ie(e) === "strict";
+	return (n) => D.succeed(!t || I(n, e) ? { ok: !0 } : {
+		ok: !1,
+		code: Pe,
+		message: "This account's email address has not been confirmed yet. Request a new confirmation link and follow it, then sign in again."
+	});
+}, L = (e, t) => ({
+	status: e,
+	body: JSON.stringify(t),
+	contentType: "application/json; charset=utf-8"
+}), ze = (e, t, n) => `${e}${t}${t.includes("?") ? "&" : "?"}token=${encodeURIComponent(n)}`, Be = (e, t, n) => D.gen(function* () {
+	let r = n.emailVerification, i = (n.now ?? Date.now)(), a = (r?.resendCooldownSeconds ?? 60) * 1e3;
+	if (a > 0) {
+		let n = yield* t.latestToken(e.id, "email-verify");
+		if (n && i - n.createdAt.getTime() < a) return !1;
+	}
+	let o = b("email-verify", r?.ttlSeconds ?? 86400);
+	if (yield* t.insertToken({
+		id: u("tok"),
+		tokenHash: o.tokenHash,
+		userId: e.id,
+		purpose: "email-verify",
+		expiresAt: o.expiresAt
+	}).pipe(D.ignore), !n.sendEmail) return !1;
+	let s = ze(n.appBaseUrl ?? "", r?.callbackPath ?? "/auth/verify-email/callback", o.token);
+	return yield* D.tryPromise(() => n.sendEmail({
+		to: e.email,
+		kind: "email-verify",
+		actionUrl: s,
+		subject: "Confirm your email address",
+		text: `Confirm your email address: ${s}`,
+		html: `<p><a href="${s}">Confirm your email address</a> — this link expires in 24 hours.</p>`
+	})).pipe(D.ignore), !0;
+}), Ve = (e, t, n) => D.gen(function* () {
+	if (!e.email && !e.userId) return L(400, { error: "email or userId required" });
+	let r = e.userId ? yield* t.findById(e.userId) : yield* t.findByEmail(e.email);
+	return r && !I(r, n.emailVerification) && (yield* Be(r, t, n)), L(202, { ok: !0 });
+}), He = (e, t) => D.gen(function* () {
+	if (!e.token) return L(400, { error: "token required" });
+	let n = yield* t.consumeToken(v(e.token), "email-verify");
+	if (!n) return L(401, { error: "invalid or expired token" });
+	let r = yield* t.findById(n.userId);
+	return r ? (yield* t.markEmailVerified(r.id).pipe(D.ignore), L(200, {
+		ok: !0,
+		verified: !0
+	})) : L(401, { error: "invalid or expired token" });
+}), Ue = 5, We = 900, Ge = 900, Ke = (e) => ({
+	maxAttempts: e.lockout?.maxAttempts ?? Ue,
+	windowMs: (e.lockout?.windowSeconds ?? We) * 1e3,
+	lockMs: (e.lockout?.lockSeconds ?? Ge) * 1e3
+}), R = (e) => e.secrets ?? (e.secret === void 0 ? c() : l(e.secret)), z = (e) => e.secret ?? s(), B = (e, t, n = {}) => ({
+	status: e,
+	body: JSON.stringify(t),
+	contentType: "application/json; charset=utf-8",
+	...n
+}), V = (e, t = {}) => ({
+	status: 302,
+	body: "",
+	contentType: "text/plain",
+	location: e,
+	...t
+}), qe = 604800, Je = (e, t) => e.type === "user" ? {
+	...e,
+	metadata: {
+		...e.metadata ?? {},
+		sessionId: t
+	}
+} : e, H = (e, t, n, r = {}) => D.gen(function* () {
+	r.clearLoginFailures !== !1 && (yield* t.clearLoginFailures(e.email)), n.ensureActor && (yield* n.ensureActor(e));
+	let i = yield* t.listMemberships(e.id), o = r.sessionId ?? u("sess"), s = r.ttlSeconds ?? qe;
+	r.sessionRow !== "existing" && (yield* t.insertSession({
+		id: o,
+		userId: e.id,
+		tenantId: e.tenantId,
+		expiresAt: new Date(Date.now() + s * 1e3),
+		ipAddress: r.ipAddress ?? null,
+		userAgent: r.userAgent ?? null
+	}).pipe(D.ignore));
+	let c = { ...r.metadata };
+	F(n.emailVerification) && (c[Fe] = I(e, n.emailVerification));
+	let l = Je(g(e, {
+		memberships: i,
+		...Object.keys(c).length > 0 ? { metadata: c } : {}
+	}), o), d = a(l, R(n), {
+		ttlSeconds: s,
+		...n.cookieDomain ? { domain: n.cookieDomain } : {},
+		secure: n.cookieSecure ?? !0
+	});
+	return {
+		setCookie: d.setCookie,
+		value: d.value,
+		expiresAt: Math.floor(Date.now() / 1e3) + s,
+		subject: l
+	};
+}), U = (e, t) => D.gen(function* () {
+	let n = t.subjectGuards ?? [];
+	if (n.length === 0) return null;
+	let r = yield* be(n, e);
+	return r.ok ? null : B(403, {
+		error: r.code,
+		message: r.message
+	});
+}), Ye = (r, i, a) => D.gen(function* () {
+	if (!r.email || !r.password) return B(400, { error: "email and password required" });
+	let o = yield* i.findByEmail(r.email), s = (a.now ?? Date.now)(), c = yield* i.isLockedOut(r.email, s);
+	if (c.locked) return B(429, {
+		error: "account_locked",
+		retryAfterSeconds: c.retryAfterSeconds
+	});
+	let l = o?.passwordHash, d = typeof l == "string" && l.length > 0 ? yield* n(r.password, l) : yield* D.gen(function* () {
+		let n = yield* e("decoy-not-a-real-password").pipe(D.orElseSucceed(() => ""));
+		return yield* t(r.password, n), { valid: !1 };
+	});
+	if (!o || !d.valid) return yield* i.recordLoginFailure(r.email, s, Ke(a)), B(401, { error: "invalid credentials" });
+	let f = yield* U(o, a);
+	if (f) return f;
+	if (d.rehash && (yield* i.updatePassword(o.id, d.rehash).pipe(D.ignore)), o.mfaEnrolledAt) {
+		let e = b("mfa-pending", 300);
+		return yield* i.insertToken({
+			id: u("tok"),
+			tokenHash: e.tokenHash,
+			userId: o.id,
+			purpose: "mfa-pending",
+			expiresAt: e.expiresAt
+		}).pipe(D.ignore), B(200, {
+			ok: !0,
+			mfaRequired: !0,
+			pendingToken: e.token,
+			expiresInSeconds: 300
+		});
+	}
+	let { setCookie: p, subject: m } = yield* H(o, i, a, {
+		ipAddress: r.ipAddress ?? null,
+		userAgent: r.userAgent ?? null
+	});
+	return r.redirectAfter ? V(a.successRedirect ?? "/", { setCookie: p }) : B(200, {
+		ok: !0,
+		subject: m
+	}, { setCookie: p });
+}), Xe = (e, t, n) => D.gen(function* () {
+	if (!e.pendingToken) return B(400, { error: "pending token required" });
+	if (!e.code && !e.recoveryCode) return B(400, { error: "code or recoveryCode required" });
+	let r = yield* t.consumeToken(v(e.pendingToken), "mfa-pending");
+	if (!r) return B(401, { error: "invalid or expired challenge" });
+	let i = yield* t.findById(r.userId);
+	if (!i || !i.mfaEnrolledAt || !i.mfaSecret) return B(401, { error: "mfa not enrolled" });
+	let a = (n.now ?? Date.now)(), o = yield* t.isLockedOut(i.email, a);
+	if (o.locked) return B(429, {
+		error: "account_locked",
+		retryAfterSeconds: o.retryAfterSeconds
+	});
+	let s = yield* U(i, n);
+	if (s) return s;
+	if (!(e.recoveryCode ? yield* t.consumeRecoveryCode(i.id, v(e.recoveryCode.trim())) : yield* N(i.mfaSecret, e.code ?? "").pipe(D.map(() => !0), D.catchTag("TotpVerifyError", () => D.succeed(!1))))) return yield* t.recordLoginFailure(i.email, a, Ke(n)), B(401, { error: "invalid_code" });
+	let { setCookie: c, subject: l } = yield* H(i, t, n, {
+		ipAddress: e.ipAddress ?? null,
+		userAgent: e.userAgent ?? null
+	});
+	return e.redirectAfter ? V(n.successRedirect ?? "/", { setCookie: c }) : B(200, {
+		ok: !0,
+		subject: l
+	}, { setCookie: c });
+}), Ze = (t, n, r) => D.gen(function* () {
+	if (!t.email || !t.password) return B(400, { error: "email and password required" });
+	if (t.password.length < 8) return B(400, { error: "password must be at least 8 characters" });
+	if (yield* n.findByEmail(t.email)) return B(409, { error: "email already registered" });
+	let i = t.tenantId ?? r.defaultTenantId, a = yield* P(r.admit, {
+		email: t.email,
+		tenantId: i,
+		via: "sign-up"
+	});
+	if (a) return B(403, {
+		error: "not_admitted",
+		reason: a.reason,
+		message: a.message
+	});
+	let o = yield* e(t.password), s = yield* n.insert({
+		id: u("user"),
+		email: t.email,
+		passwordHash: o,
+		tenantId: i
+	});
+	yield* n.addMembership({
+		userId: s.id,
+		tenantId: i,
+		role: "owner"
+	}).pipe(D.ignore), F(r.emailVerification) && (r.emailVerification?.sendOnSignUp ?? !0) && (yield* Be(s, n, r).pipe(D.ignore));
+	let { setCookie: c, subject: l } = yield* H(s, n, r);
+	return t.redirectAfter ? V(r.successRedirect ?? "/", { setCookie: c }) : B(200, {
+		ok: !0,
+		subject: l
+	}, { setCookie: c });
+}).pipe(D.catchAll((e) => D.succeed(B(500, {
+	error: "signup_failed",
+	cause: String(e)
+})))), Qe = (e) => ({
+	status: 302,
+	body: "",
+	location: e.successRedirect ?? "/",
+	setCookie: i({
+		...e.cookieDomain ? { domain: e.cookieDomain } : {},
+		secure: e.cookieSecure ?? !0
+	})
+}), $e = (e, t) => D.gen(function* () {
+	let n = yield* t.findById(e.userId);
+	if (!n) return B(404, { error: "user_not_found" });
+	let r = ke();
+	return yield* t.setMfaSecret(n.id, r).pipe(D.catchAll(() => D.succeed(n))), B(200, {
+		ok: !0,
+		secret: r,
+		otpauthUrl: Ae({
+			issuer: e.issuer,
+			accountName: e.accountName,
+			secret: r
+		})
+	});
+}), et = (e, t) => D.gen(function* () {
+	let n = yield* t.findById(e.userId);
+	if (!n) return B(404, { error: "user_not_found" });
+	if (!n.mfaSecret) return B(400, { error: "no_enrollment_in_progress" });
+	if (n.mfaEnrolledAt) return B(409, { error: "already_enrolled" });
+	if (!(yield* N(n.mfaSecret, e.code).pipe(D.map(() => !0), D.catchTag("TotpVerifyError", () => D.succeed(!1))))) return B(401, { error: "invalid_code" });
+	yield* t.markMfaEnrolled(n.id).pipe(D.catchAll(() => D.succeed(n)));
+	let r = Me();
+	return yield* t.replaceRecoveryCodes(n.id, r.map((e) => v(e))).pipe(D.ignore), B(200, {
+		ok: !0,
+		enrolled: !0,
+		recoveryCodes: r
+	});
+}), tt = (e, t) => D.gen(function* () {
+	let n = yield* t.findById(e.userId);
+	if (!n) return B(404, { error: "user_not_found" });
+	if (!n.mfaEnrolledAt) return B(400, { error: "mfa_not_enrolled" });
+	let r = Me();
+	return yield* t.replaceRecoveryCodes(n.id, r.map((e) => v(e))).pipe(D.ignore), B(200, {
+		ok: !0,
+		recoveryCodes: r
+	});
+}), nt = (e, t) => D.gen(function* () {
+	let n = yield* t.findById(e.userId);
+	return n ? (yield* t.clearMfa(n.id).pipe(D.catchAll(() => D.succeed(n))), yield* t.replaceRecoveryCodes(n.id, []).pipe(D.ignore), B(200, {
+		ok: !0,
+		enrolled: !1
+	})) : B(404, { error: "user_not_found" });
+}), rt = (e) => {
+	let t = x(z(e)), n = O(ee, t, {
+		httpOnly: !1,
+		sameSite: "lax",
+		secure: e.cookieSecure ?? !0,
+		...e.cookieDomain ? { domain: e.cookieDomain } : {},
+		path: "/"
+	});
+	return B(200, { csrfToken: t }, { setCookie: n });
+}, it = (e, t, n) => `${e}${t}${t.includes("?") ? "&" : "?"}token=${encodeURIComponent(n)}`, at = (e, t, n) => D.gen(function* () {
+	if (!e.email) return B(400, { error: "email required" });
+	let r = yield* t.findByEmail(e.email);
+	if (r) {
+		let i = b("magic-link");
+		yield* t.insertToken({
+			id: u("tok"),
+			tokenHash: i.tokenHash,
+			userId: r.id,
+			purpose: "magic-link",
+			expiresAt: i.expiresAt
+		}).pipe(D.ignore);
+		let a = it(n.appBaseUrl ?? "", e.callbackPath ?? "/auth/magic-link/callback", i.token);
+		n.sendEmail && (yield* D.tryPromise(() => n.sendEmail({
+			to: r.email,
+			kind: "magic-link",
+			actionUrl: a,
+			subject: "Your sign-in link",
+			text: `Sign in: ${a}`,
+			html: `<p><a href="${a}">Sign in</a> — this link expires shortly.</p>`
+		})).pipe(D.ignore));
+	}
+	return B(202, { ok: !0 });
+}), ot = (e, t, n) => D.gen(function* () {
+	if (!e.token) return B(400, { error: "token required" });
+	let r = yield* t.consumeToken(v(e.token), "magic-link");
+	if (!r) return B(401, { error: "invalid or expired token" });
+	let i = yield* t.findById(r.userId);
+	if (!i) return B(401, { error: "invalid or expired token" });
+	let a = yield* t.markEmailVerified(i.id).pipe(D.orElseSucceed(() => i)), o = yield* U(a, n);
+	if (o) return o;
+	let { setCookie: s, subject: c } = yield* H(a, t, n);
+	return e.redirectAfter ? V(n.successRedirect ?? "/", { setCookie: s }) : B(200, {
+		ok: !0,
+		subject: c
+	}, { setCookie: s });
+}), st = (e, t, n) => D.gen(function* () {
+	if (!e.email) return B(400, { error: "email required" });
+	let r = yield* t.findByEmail(e.email);
+	if (r) {
+		let i = b("password-reset");
+		yield* t.insertToken({
+			id: u("tok"),
+			tokenHash: i.tokenHash,
+			userId: r.id,
+			purpose: "password-reset",
+			expiresAt: i.expiresAt
+		}).pipe(D.ignore);
+		let a = it(n.appBaseUrl ?? "", e.callbackPath ?? "/auth/password-reset/callback", i.token);
+		n.sendEmail && (yield* D.tryPromise(() => n.sendEmail({
+			to: r.email,
+			kind: "password-reset",
+			actionUrl: a,
+			subject: "Reset your password",
+			text: `Reset your password: ${a}`,
+			html: `<p><a href="${a}">Reset your password</a> — this link expires shortly.</p>`
+		})).pipe(D.ignore));
+	}
+	return B(202, { ok: !0 });
+}), ct = (t, n) => D.gen(function* () {
+	if (!t.token || !t.newPassword) return B(400, { error: "token and newPassword required" });
+	if (t.newPassword.length < 8) return B(400, { error: "password must be at least 8 characters" });
+	let r = yield* n.consumeToken(v(t.token), "password-reset");
+	if (!r) return B(401, { error: "invalid or expired token" });
+	let i = yield* e(t.newPassword).pipe(D.orElseSucceed(() => ""));
+	return i ? (yield* n.updatePassword(r.userId, i).pipe(D.ignore), yield* n.markEmailVerified(r.userId).pipe(D.ignore), yield* n.revokeAllSessions(r.userId).pipe(D.ignore), B(200, { ok: !0 })) : B(500, { error: "hash_failed" });
+}), lt = (e, t) => D.gen(function* () {
+	return B(200, { sessions: (yield* t.listSessions(e.userId)).map((e) => ({
+		id: e.id,
+		tenantId: e.tenantId,
+		ipAddress: e.ipAddress ?? null,
+		userAgent: e.userAgent ?? null,
+		createdAt: e.createdAt.toISOString(),
+		lastSeenAt: e.lastSeenAt.toISOString(),
+		expiresAt: e.expiresAt.toISOString()
+	})) });
+}), ut = (e, t) => D.gen(function* () {
+	return (yield* t.revokeSession(e.userId, e.sessionId)) ? B(200, {
+		ok: !0,
+		revoked: 1
+	}) : B(404, { error: "session_not_found" });
+}), dt = (e, t) => D.gen(function* () {
+	return B(200, {
+		ok: !0,
+		revoked: yield* t.revokeAllOtherSessions(e.userId, e.keepSessionId)
+	});
+}), ft = (e, t, n, i, o) => D.gen(function* () {
+	let s = yield* t.findById(e.userId);
+	if (!s) return B(404, { error: "user_not_found" });
+	let c = yield* t.listMemberships(s.id), l = c.find((t) => t.tenantId === e.targetTenantId)?.role ?? null;
+	if (l === null) return B(403, { error: "not a member of the target tenant" });
+	let u = e.metadata === void 0 ? void 0 : Object.fromEntries(Object.entries(e.metadata).filter(([e]) => e !== "memberships")), d = pe(g(s, { ...u === void 0 ? {} : { metadata: u } }), e.targetTenantId, c);
+	o !== void 0 && d.type === "user" && (yield* D.promise(() => ue(o, {
+		type: d.type,
+		id: d.id
+	}, e.targetTenantId)));
+	let f = e.sessionId ? Je(d, e.sessionId) : d, p = a(f, R(n), {
+		ttlSeconds: qe,
+		...n.cookieDomain ? { domain: n.cookieDomain } : {},
+		secure: n.cookieSecure ?? !0
+	});
+	return e.clientId !== void 0 && i && i(e.clientId, { cookies: { [r]: p.value } }), B(200, {
+		ok: !0,
+		tenantId: e.targetTenantId,
+		role: l,
+		subject: f
+	}, { setCookie: p.setCookie });
+}), pt = (e, t) => D.gen(function* () {
+	return B(200, { memberships: (yield* t.listMemberships(e.userId)).map((e) => ({
+		tenantId: e.tenantId,
+		role: e.role,
+		joinedAt: e.joinedAt.toISOString()
+	})) });
+}), W = (e, t, n = {}) => ({
+	status: e,
+	body: JSON.stringify(t),
+	contentType: "application/json; charset=utf-8",
+	...n
+}), mt = 604800, ht = () => {
+	let e = /* @__PURE__ */ new Map();
+	return {
+		put: (t, n, r) => D.sync(() => {
+			e.set(t, {
+				challenge: n,
+				expiresAt: Date.now() + r * 1e3
+			});
+		}),
+		take: (t) => D.sync(() => {
+			let n = e.get(t);
+			return e.delete(t), !n || n.expiresAt < Date.now() ? null : n.challenge;
+		})
+	};
+}, gt = (e) => ({
+	put: (t, n, r) => D.gen(function* () {
+		let i = /* @__PURE__ */ new Date(), a = new Date(i.getTime() + r * 1e3);
+		(yield* e`
+        UPDATE "passkeyChallenges"
+           SET challenge = ${n}, "expiresAt" = ${a}, "createdAt" = ${i}
+         WHERE key = ${t}
+        RETURNING key
+      `).length === 0 && (yield* e`
+          INSERT INTO "passkeyChallenges" (id, key, challenge, "expiresAt", "createdAt")
+          VALUES (${u("pkc")}, ${t}, ${n}, ${a}, ${i})
+        `);
+	}).pipe(D.asVoid, D.orElseSucceed(() => void 0)),
+	take: (t) => D.gen(function* () {
+		let n = (yield* e`
+        DELETE FROM "passkeyChallenges" WHERE key = ${t}
+        RETURNING challenge, "expiresAt"
+      `)[0];
+		return n && n.expiresAt.getTime() > Date.now() ? n.challenge : null;
+	}).pipe(D.orElseSucceed(() => null))
+}), G = 300, _t = (e, t, n, r) => D.gen(function* () {
+	if (!(yield* t.findById(e.userId))) return W(404, { error: "user_not_found" });
+	let i = S();
+	yield* n.put(`${e.userId}:register`, i, G);
+	let a = yield* t.listPasskeys(e.userId);
+	return W(200, {
+		challenge: i,
+		rp: {
+			id: r.rpId,
+			name: r.rpName
+		},
+		user: {
+			id: e.userId,
+			name: e.userName,
+			displayName: e.userName
+		},
+		pubKeyCredParams: [{
+			type: "public-key",
+			alg: -7
+		}, {
+			type: "public-key",
+			alg: -257
+		}],
+		excludeCredentials: a.map((e) => ({
+			type: "public-key",
+			id: e.credentialId
+		})),
+		authenticatorSelection: {
+			userVerification: "preferred",
+			residentKey: "preferred"
+		},
+		timeout: G * 1e3
+	});
+}), vt = (e, t, n, r) => D.gen(function* () {
+	if (!(yield* t.findById(e.userId))) return W(404, { error: "user_not_found" });
+	let i = yield* n.take(`${e.userId}:register`);
+	if (!i) return W(400, { error: "no_pending_challenge" });
+	let a = C({
+		clientDataJSON: e.clientDataJSON,
+		authenticatorData: e.authenticatorData,
+		expectedChallenge: i,
+		expectedOrigin: r.origin,
+		rpId: r.rpId
+	});
+	return a.ok ? (yield* t.insertPasskey({
+		id: u("pk"),
+		credentialId: a.result.credentialId,
+		userId: e.userId,
+		publicKey: a.result.publicKey,
+		counter: a.result.counter,
+		transports: e.transports ?? null
+	}).pipe(D.ignore), W(200, {
+		ok: !0,
+		credentialId: a.result.credentialId
+	})) : W(400, { error: a.error });
+}), yt = (e, t, n, r) => D.gen(function* () {
+	let i = S(), a = e.userId ? `${e.userId}:assert` : "*:assert";
+	yield* n.put(a, i, G);
+	let o = e.userId ? (yield* t.listPasskeys(e.userId)).map((e) => ({
+		type: "public-key",
+		id: e.credentialId
+	})) : [];
+	return W(200, {
+		challenge: i,
+		rpId: r.rpId,
+		allowCredentials: o,
+		userVerification: "preferred",
+		timeout: G * 1e3
+	});
+}), bt = (e, t, n, r, i) => D.gen(function* () {
+	let o = yield* t.findPasskey(e.credentialId);
+	if (!o) return W(401, { error: "unknown_credential" });
+	let s = e.userId ? `${e.userId}:assert` : "*:assert", c = yield* n.take(s);
+	if (!c) return W(400, { error: "no_pending_challenge" });
+	let l = re({
+		clientDataJSON: e.clientDataJSON,
+		authenticatorData: e.authenticatorData,
+		signature: e.signature,
+		expectedChallenge: c,
+		expectedOrigin: r.origin,
+		rpId: r.rpId,
+		storedPublicKey: o.publicKey,
+		storedCounter: o.counter
+	});
+	if (!l.ok) return W(401, { error: l.error });
+	if (!(yield* t.advancePasskeyCounter(e.credentialId, l.result.newCounter)) && l.result.newCounter !== 0) return W(401, { error: "counter_regressed" });
+	let d = yield* t.findById(o.userId);
+	if (!d) return W(401, { error: "unknown_credential" });
+	let f = yield* U(d, i);
+	if (f) return f;
+	let p = yield* t.listMemberships(d.id), m = u("sess");
+	yield* t.insertSession({
+		id: m,
+		userId: d.id,
+		tenantId: d.tenantId,
+		expiresAt: new Date(Date.now() + mt * 1e3),
+		ipAddress: null,
+		userAgent: null
+	}).pipe(D.ignore);
+	let h = g(d, { memberships: p }), _ = h.type === "user" ? {
+		...h,
+		metadata: {
+			...h.metadata ?? {},
+			sessionId: m
+		}
+	} : h, v = a(_, R(i), {
+		ttlSeconds: mt,
+		...i.cookieDomain ? { domain: i.cookieDomain } : {},
+		secure: i.cookieSecure ?? !0
+	});
+	return W(200, {
+		ok: !0,
+		subject: _
+	}, { setCookie: v.setCookie });
+}), xt = 604800, St = 500, Ct = [
+	"owner",
+	"admin",
+	"member",
+	"viewer"
+], wt = ["owner", "admin"], Tt = (e, t) => t.indexOf(e), Et = (e, t = Ct) => {
+	let n = Tt(e.inviterRole, t);
+	if (n < 0) return !1;
+	let r = Tt(e.requestedRole, t);
+	return r < 0 ? n === 0 : r >= n;
+}, Dt = (e) => {
+	let t = e?.roleRank ?? Ct;
+	return e?.canGrantRole ?? ((e) => Et(e, t));
+}, K = (e, t, n = {}) => ({
+	status: e,
+	body: JSON.stringify(t),
+	contentType: "application/json; charset=utf-8",
+	...n
+}), Ot = (e, t, n) => `${e}${t}${t.includes("?") ? "&" : "?"}token=${encodeURIComponent(n)}`, kt = (e) => ({
+	id: e.id,
+	email: e.email,
+	tenantId: e.tenantId,
+	role: e.role,
+	invitedByUserId: e.invitedByUserId,
+	expiresAt: e.expiresAt.toISOString(),
+	acceptedAt: e.acceptedAt?.toISOString() ?? null,
+	revokedAt: e.revokedAt?.toISOString() ?? null,
+	createdAt: e.createdAt.toISOString()
+}), At = (e, t, n, r) => D.gen(function* () {
+	let i = yield* n.membershipRole(e, t);
+	return i === null || !(r?.inviterRoles ?? wt).includes(i) ? K(403, { error: "not_permitted" }) : { role: i };
+}), jt = (e) => "status" in e, Mt = (e, t, n) => D.gen(function* () {
+	let r = e.email.trim().toLowerCase();
+	if (!r || !r.includes("@")) return K(400, { error: "a valid email is required" });
+	if (!e.tenantId) return K(400, { error: "tenantId required" });
+	if (!e.role) return K(400, { error: "role required" });
+	let i = n.invitations, a = yield* At(e.inviterUserId, e.tenantId, t, i);
+	if (jt(a)) return a;
+	if (!Dt(i)({
+		inviterRole: a.role,
+		requestedRole: e.role,
+		tenantId: e.tenantId
+	})) return K(403, {
+		error: "role_not_grantable",
+		message: `A '${a.role}' may not invite a '${e.role}'.`
+	});
+	let o = new Date((n.now ?? Date.now)());
+	if ((yield* t.countPendingInvitations(e.tenantId, o)) >= (i?.maxPending ?? 500)) return K(429, { error: "too_many_pending_invitations" });
+	yield* t.supersedePendingInvitations(e.tenantId, r, e.inviterUserId, o).pipe(D.ignore);
+	let s = i?.ttlSeconds ?? 604800, c = y(s), l = yield* t.insertInvitation({
+		id: u("inv"),
+		tokenHash: c.tokenHash,
+		email: r,
+		tenantId: e.tenantId,
+		role: e.role,
+		invitedByUserId: e.inviterUserId,
+		expiresAt: new Date(o.getTime() + s * 1e3)
+	});
+	if (n.sendEmail) {
+		let t = Ot(n.appBaseUrl ?? "", i?.callbackPath ?? "/auth/invitations/accept", c.token);
+		yield* D.tryPromise(() => n.sendEmail({
+			to: r,
+			kind: "invitation",
+			actionUrl: t,
+			subject: "You have been invited",
+			text: `You have been invited to join as ${e.role}: ${t}`,
+			html: `<p>You have been invited to join as <strong>${e.role}</strong>. <a href="${t}">Accept the invitation</a> — this link expires.</p>`
+		})).pipe(D.ignore);
+	}
+	return K(201, {
+		ok: !0,
+		invitation: kt(l)
+	});
+}), Nt = (e, t, n) => D.gen(function* () {
+	let r = yield* At(e.callerUserId, e.tenantId, t, n.invitations);
+	return jt(r) ? r : K(200, { invitations: (yield* t.listInvitations(e.tenantId)).map(kt) });
+}), Pt = (e, t, n) => D.gen(function* () {
+	if (!e.invitationId) return K(400, { error: "invitationId required" });
+	let r = yield* At(e.callerUserId, e.tenantId, t, n.invitations);
+	if (jt(r)) return r;
+	let i = new Date((n.now ?? Date.now)());
+	return (yield* t.revokeInvitation(e.invitationId, e.tenantId, e.callerUserId, i)) ? K(200, {
+		ok: !0,
+		revoked: 1
+	}) : K(404, { error: "invitation_not_found" });
+}), Ft = (e, t, n = {}) => D.gen(function* () {
+	if (!e.token) return K(400, { error: "token required" });
+	let r = yield* t.findInvitationByHash(v(e.token));
+	if (!r) return K(404, { error: "invalid_invitation" });
+	let i = new Date((n.now ?? Date.now)());
+	return K(200, {
+		ok: !0,
+		state: r.acceptedAt === null ? r.revokedAt === null ? r.expiresAt.getTime() <= i.getTime() ? "expired" : "pending" : "revoked" : "accepted",
+		email: r.email,
+		tenantId: r.tenantId,
+		role: r.role,
+		expiresAt: r.expiresAt.toISOString()
+	});
+}), It = (e, t, n = {}) => D.gen(function* () {
+	if (!e.token) return K(400, { error: "token required" });
+	let r = v(e.token), i = new Date((n.now ?? Date.now)()), a = yield* t.findInvitationByHash(r);
+	if (!a) return K(401, { error: "invalid_or_expired_invitation" });
+	if (!e.userId) return K(401, {
+		error: "authentication_required",
+		email: a.email
+	});
+	let o = yield* t.findById(e.userId);
+	if (!o) return K(401, {
+		error: "authentication_required",
+		email: a.email
+	});
+	if (o.email.toLowerCase() !== a.email.toLowerCase()) return K(403, {
+		error: "invitation_email_mismatch",
+		message: "This invitation was issued to a different email address. Sign in as that address to accept it."
+	});
+	let s = yield* P(n.admit, {
+		email: a.email,
+		tenantId: a.tenantId,
+		via: "invitation"
+	});
+	if (s) return K(403, {
+		error: "not_admitted",
+		reason: s.reason,
+		message: s.message
+	});
+	let c = yield* t.acceptInvitation(r, o.id, i);
+	if (!c) return K(401, { error: "invalid_or_expired_invitation" });
+	let l = yield* t.addMembership({
+		userId: o.id,
+		tenantId: c.tenantId,
+		role: c.role
+	});
+	return yield* t.markEmailVerified(o.id).pipe(D.ignore), K(200, {
+		ok: !0,
+		membership: {
+			tenantId: l.tenantId,
+			role: l.role,
+			joinedAt: l.joinedAt.toISOString()
+		}
+	});
+}), Lt = (e, t, n) => D.gen(function* () {
+	if (!e.token || !e.password) return K(400, { error: "token and password required" });
+	if (e.password.length < (n.minPasswordLength ?? 8)) return K(400, { error: "password must be at least 8 characters" });
+	let r = v(e.token), i = new Date((n.now ?? Date.now)()), a = yield* t.findInvitationByHash(r);
+	if (!a) return K(401, { error: "invalid_or_expired_invitation" });
+	if (yield* t.findByEmail(a.email)) return K(409, {
+		error: "account_exists",
+		message: "An account already exists for this address. Sign in, then accept the invitation."
+	});
+	let o = yield* n.hashPassword(e.password).pipe(D.orElseSucceed(() => ""));
+	if (!o) return K(500, { error: "hash_failed" });
+	let s = yield* P(n.admit, {
+		email: a.email,
+		tenantId: a.tenantId,
+		via: "invitation"
+	});
+	if (s) return K(403, {
+		error: "not_admitted",
+		reason: s.reason,
+		message: s.message
+	});
+	let c = u("user"), l = yield* t.acceptInvitation(r, c, i);
+	if (!l) return K(401, { error: "invalid_or_expired_invitation" });
+	let d = yield* t.insert({
+		id: c,
+		email: l.email,
+		passwordHash: o,
+		tenantId: l.tenantId
+	}).pipe(D.orElseSucceed(() => null));
+	return d ? (yield* t.addMembership({
+		userId: d.id,
+		tenantId: l.tenantId,
+		role: l.role
+	}), yield* t.markEmailVerified(d.id).pipe(D.ignore), K(201, {
+		ok: !0,
+		userId: d.id,
+		tenantId: l.tenantId,
+		role: l.role
+	})) : K(409, { error: "account_exists" });
+}), Rt = 900, zt = [
+	"/mfa/enroll/start",
+	"/mfa/enroll/verify",
+	"/mfa/unenroll",
+	"/mfa/recovery-codes/regenerate",
+	"/passkey/register/options",
+	"/passkey/register/verify",
+	"/sessions/revoke-others",
+	"/switch-tenant",
+	"/impersonate/start"
+], Bt = (e) => {
+	if (typeof e != "object" || !e) return null;
+	let t = e;
+	return typeof t.actorUserId != "string" || t.actorUserId.length === 0 || typeof t.grantId != "string" || typeof t.expiresAt != "string" || typeof t.actorSessionId != "string" || typeof t.startedAt != "string" ? null : {
+		actorUserId: t.actorUserId,
+		actorSessionId: t.actorSessionId,
+		grantId: t.grantId,
+		startedAt: t.startedAt,
+		expiresAt: t.expiresAt,
+		...typeof t.reason == "string" ? { reason: t.reason } : {}
+	};
+}, Vt = (e) => e.type === "user" ? Bt(fe(e)) : null, Ht = (e) => Vt(e) !== null, Ut = () => (e) => {
+	if (e.type !== "user" || e.metadata === void 0) return e;
+	let t = Bt(e.metadata[k]), { metadata: n, ...r } = e;
+	return {
+		...r,
+		metadata: t === null ? { __redacted: "all" } : {
+			__redacted: "all-except-impersonation",
+			[k]: t
+		}
+	};
+}, q = (e, t, n = {}) => ({
+	status: e,
+	body: JSON.stringify(t),
+	contentType: "application/json; charset=utf-8",
+	...n
+}), Wt = (e, t) => D.suspend(() => {
+	let n = e.audit(t);
+	return n === void 0 ? D.void : D.isEffect(n) ? n : D.tryPromise({
+		try: () => Promise.resolve(n),
+		catch: (e) => e
+	});
+}).pipe(D.catchAllCause(() => D.void)), Gt = (e, t, n) => D.gen(function* () {
+	let r = n.impersonation, i = (n.now ?? Date.now)(), a = new Date(i), o = e.actorSubject, s = (t, n, i = {}) => Wt(r, {
+		kind: "refused",
+		at: a,
+		actorUserId: i.actorUser?.id ?? (o.type === "user" ? o.id : null),
+		actorEmail: i.actorUser?.email ?? null,
+		targetUserId: i.target?.id ?? null,
+		targetEmail: i.target?.email ?? null,
+		tenantId: o.tenantId ?? null,
+		reason: e.reason ?? null,
+		refusal: n,
+		ipAddress: e.ipAddress ?? null,
+		userAgent: e.userAgent ?? null
+	}).pipe(D.as(q(t, {
+		error: n,
+		...i.message === void 0 ? {} : { message: i.message }
+	})));
+	if (o.type !== "user") return yield* s(401, "unauthenticated");
+	if (Ht(o)) return yield* s(403, "nested_impersonation", { message: "An impersonated session may not start another impersonation. Stop the current one first." });
+	if (!e.actorSessionId) return yield* s(400, "no_actor_session");
+	let c = yield* t.findById(o.id);
+	if (!c) return yield* s(401, "unauthenticated");
+	if (!e.targetUserId && !e.targetEmail) return yield* s(400, "target_required", { actorUser: c });
+	let l = e.targetUserId ? yield* t.findById(e.targetUserId) : yield* t.findByEmail(e.targetEmail);
+	if (!l) return yield* s(404, "target_not_found", { actorUser: c });
+	if (l.id === c.id) return yield* s(400, "self_impersonation", {
+		actorUser: c,
+		target: l
+	});
+	let d = e.reason?.trim() ?? "";
+	if ((r.requireReason ?? !0) && d.length === 0) return yield* s(400, "reason_required", {
+		actorUser: c,
+		target: l,
+		message: "A reason is required to impersonate a user."
+	});
+	if (!(yield* r.authority({
+		actor: o,
+		actorUser: c,
+		target: l
+	}).pipe(D.catchAllCause(() => D.succeed(!1))))) return yield* s(403, "not_permitted", {
+		actorUser: c,
+		target: l
+	});
+	if (yield* r.authority({
+		actor: g(l),
+		actorUser: l,
+		target: c
+	}).pipe(D.catchAllCause(() => D.succeed(!0)))) return yield* s(403, "target_may_impersonate", {
+		actorUser: c,
+		target: l,
+		message: "This user may themselves impersonate others and cannot be impersonated."
+	});
+	let f = r.maxDurationSeconds ?? 900, p = Math.max(1, Math.min(e.durationSeconds ?? f, f)), m = new Date(i + p * 1e3), h = u("sess"), _ = yield* t.insertImpersonationGrant({
+		id: u("imp"),
+		sessionId: h,
+		actorUserId: c.id,
+		actorSessionId: e.actorSessionId,
+		targetUserId: l.id,
+		tenantId: l.tenantId,
+		reason: d.length > 0 ? d : null,
+		expiresAt: m,
+		ipAddress: e.ipAddress ?? null,
+		userAgent: e.userAgent ?? null
+	}), v = {
+		actorUserId: c.id,
+		actorSessionId: e.actorSessionId,
+		grantId: _.id,
+		startedAt: _.startedAt.toISOString(),
+		expiresAt: m.toISOString(),
+		...d.length > 0 ? { reason: d } : {}
+	}, y = yield* n.issuer.issue(l, {
+		sessionId: h,
+		ttlSeconds: p,
+		metadata: { [k]: v },
+		ipAddress: e.ipAddress ?? null,
+		userAgent: e.userAgent ?? null
+	});
+	return yield* Wt(r, {
+		kind: "started",
+		at: a,
+		actorUserId: c.id,
+		actorEmail: c.email,
+		targetUserId: l.id,
+		targetEmail: l.email,
+		tenantId: l.tenantId,
+		sessionId: h,
+		grantId: _.id,
+		reason: d.length > 0 ? d : null,
+		expiresAt: m,
+		ipAddress: e.ipAddress ?? null,
+		userAgent: e.userAgent ?? null
+	}), q(200, {
+		ok: !0,
+		impersonation: v,
+		subject: y.subject
+	}, { setCookie: y.setCookie });
+}), Kt = (e, t, n) => D.gen(function* () {
+	let r = n.impersonation, i = (n.now ?? Date.now)(), a = new Date(i), o = Vt(e.subject);
+	if (!o || !e.sessionId) return q(400, { error: "not_impersonating" });
+	let s = yield* t.findImpersonationGrantBySession(e.sessionId);
+	yield* t.endImpersonationGrant(e.sessionId, "stopped", a).pipe(D.ignore), e.subject.type === "user" && (yield* t.revokeSession(e.subject.id, e.sessionId).pipe(D.ignore)), n.invalidateSession?.(e.sessionId);
+	let c = yield* t.findById(o.actorUserId), l = yield* t.findSession(o.actorSessionId), u = l ? Math.floor((l.expiresAt.getTime() - i) / 1e3) : 0;
+	if (yield* Wt(r, {
+		kind: "stopped",
+		at: a,
+		actorUserId: o.actorUserId,
+		actorEmail: c?.email ?? null,
+		targetUserId: e.subject.type === "user" ? e.subject.id : null,
+		targetEmail: null,
+		tenantId: s?.tenantId ?? e.subject.tenantId ?? null,
+		sessionId: e.sessionId,
+		...s ? { grantId: s.id } : {},
+		reason: s?.reason ?? null
+	}), !c || !l || u <= 0) return q(200, {
+		ok: !0,
+		restored: !1
+	}, { setCookie: n.issuer.clear() });
+	let d = yield* n.issuer.reissue(c, {
+		sessionId: o.actorSessionId,
+		ttlSeconds: u
+	});
+	return q(200, {
+		ok: !0,
+		restored: !0,
+		subject: d.subject
+	}, { setCookie: d.setCookie });
+}), qt = "voltro:native", Jt = 600, Yt = "/login", J = (e) => e.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, ""), Xt = (e) => Buffer.from(e.replace(/-/g, "+").replace(/_/g, "/") + "=".repeat((4 - e.length % 4) % 4), "base64"), Zt = (e) => J(w("sha256").update(e, "ascii").digest()), Qt = (e, t) => {
+	let n = J(Buffer.from(JSON.stringify(e), "utf8"));
+	return `${n}.${J(T("sha256", t).update(n).digest())}`;
+}, $t = (e, t, n = Date.now) => {
+	if (!e) return null;
+	let r = e.indexOf(".");
+	if (r <= 0 || r === e.length - 1) return null;
+	let i = e.slice(0, r), a = Xt(e.slice(r + 1)), o = T("sha256", t).update(i).digest();
+	if (a.length !== o.length || !ie(a, o)) return null;
+	try {
+		let e = JSON.parse(Xt(i).toString("utf8"));
+		return typeof e.exp != "number" || e.exp * 1e3 < n() ? null : e;
+	} catch {
+		return null;
+	}
+}, en = (e, t) => t.includes(e), tn = (e, t) => {
+	let n = new URLSearchParams(t).toString();
+	return `${e}${e.includes("?") ? "&" : "?"}${n}`;
+}, Y = (e, t) => ({
+	status: e,
+	body: JSON.stringify(t),
+	contentType: "application/json; charset=utf-8"
+}), X = (e, t) => ({
+	status: 302,
+	body: "",
+	location: e,
+	...t === void 0 ? {} : { setCookie: t }
+}), nn = (e) => {
+	if (!e) return null;
+	let { ch: t, r: n, s: r, exp: i } = e;
+	return typeof t != "string" || typeof n != "string" || typeof r != "string" || typeof i != "number" ? null : {
+		ch: t,
+		r: n,
+		s: r,
+		exp: i
+	};
+}, rn = (e, t, n) => O(e.native.pendingCookieName ?? "voltro:native", t, {
+	maxAgeSeconds: n,
+	httpOnly: !0,
+	sameSite: "lax",
+	secure: e.config.cookieSecure ?? !0,
+	path: `${e.prefix}/native`
+}), an = (e) => `${e.native.loginPath ?? Yt}?next=${encodeURIComponent(`${e.prefix}/native/complete`)}`, on = (e, t, n, r) => D.gen(function* () {
+	let i = e.get("redirect_uri") ?? "", a = e.get("code_challenge") ?? "", o = e.get("code_challenge_method") ?? "S256", s = e.get("state") ?? "";
+	if (!en(i, r.native.redirectUris)) return Y(400, { error: "redirect_uri_not_allowed" });
+	if (o !== "S256" || a.length < 43 || a.length > 128) return X(tn(i, {
+		error: "invalid_request",
+		state: s
+	}));
+	if (s.length === 0) return X(tn(i, { error: "invalid_request" }));
+	let c = r.now ?? Date.now, l = r.native.pendingTtlSeconds ?? Jt, u = {
+		ch: a,
+		r: i,
+		s,
+		exp: Math.floor(c() / 1e3) + l
+	}, d = rn(r, Qt({ ...u }, z(r.config)), l);
+	return t && t.subject.type === "user" && t.sessionId ? {
+		...yield* sn(u, {
+			userId: t.subject.id,
+			sessionId: t.sessionId
+		}, n, r),
+		setCookie: rn(r, "", 0)
+	} : X(an(r), d);
+}), sn = (e, t, n, r) => D.gen(function* () {
+	let i = b("native-code", 300);
+	yield* n.insertToken({
+		id: `tok_${J(E(12))}`,
+		tokenHash: i.tokenHash,
+		userId: t.userId,
+		purpose: "native-code",
+		expiresAt: i.expiresAt
+	});
+	let a = Qt({
+		sid: t.sessionId,
+		uid: t.userId,
+		ch: e.ch,
+		exp: Math.floor(i.expiresAt.getTime() / 1e3)
+	}, z(r.config));
+	return X(tn(e.r, {
+		code: `${i.token}.${a}`,
+		state: e.s
+	}));
+}), cn = (e, t, n, r) => D.gen(function* () {
+	let i = nn($t(se(e, r.native.pendingCookieName ?? "voltro:native"), z(r.config), r.now));
+	return i ? !t || t.subject.type !== "user" || !t.sessionId ? X(an(r)) : {
+		...yield* sn(i, {
+			userId: t.subject.id,
+			sessionId: t.sessionId
+		}, n, r),
+		setCookie: rn(r, "", 0)
+	} : Y(400, { error: "no_pending_native_login" });
+}), ln = (e, t, n) => D.gen(function* () {
+	let r = e.code.indexOf(".");
+	if (r <= 0) return Y(400, { error: "invalid_code" });
+	let i = e.code.slice(0, r), a = $t(e.code.slice(r + 1), z(n.config), n.now), o = a?.sid, s = a?.uid, c = a?.ch;
+	if (typeof o != "string" || typeof s != "string" || typeof c != "string") return Y(400, { error: "invalid_code" });
+	let l = yield* t.consumeToken(v(i), "native-code");
+	if (!l || l.userId !== s || e.codeVerifier.length < 43 || Zt(e.codeVerifier) !== c) return Y(400, { error: "invalid_code" });
+	let u = yield* t.findById(s);
+	if (!u) return Y(400, { error: "invalid_code" });
+	let d = yield* H(u, t, n.config, {
+		sessionId: o,
+		sessionRow: "existing",
+		clearLoginFailures: !1
+	});
+	return Y(200, {
+		ok: !0,
+		session: d.value,
+		expiresAt: d.expiresAt,
+		subject: d.subject
+	});
+}), un = (e) => {
+	for (let t of e) if (dn(t)) return t.auth.sessionStrategy;
+	return null;
+}, dn = (e) => typeof e.auth == "object" && e.auth !== null && typeof e.auth.sessionStrategy == "object", fn = "/auth", pn = (e) => {
+	let t = Buffer.from(e.rawBody).toString("utf8");
+	if (!t) return {};
+	if ((e.headers["content-type"] ?? "").includes("application/x-www-form-urlencoded")) {
+		let e = new URLSearchParams(t), n = {};
+		for (let [t, r] of e) n[t] = r;
+		return n;
+	}
+	try {
+		let e = JSON.parse(t);
+		return typeof e == "object" && e ? e : {};
+	} catch {
+		return {};
+	}
+}, mn = (e) => ({
+	status: e.status,
+	...e.body === void 0 ? {} : { body: e.body },
+	...e.contentType === void 0 ? {} : { contentType: e.contentType },
+	headers: {
+		...e.setCookie === void 0 ? {} : { "set-cookie": e.setCookie },
+		...e.location === void 0 ? {} : { location: e.location }
+	}
+}), hn = "actors", Z = (e, t) => ({
+	status: e,
+	body: JSON.stringify(t),
+	contentType: "application/json; charset=utf-8"
+}), Q = (e) => typeof e == "string" ? e : void 0, $ = (e, t) => typeof t == "string" && t.length > 0 ? { [e]: t } : {}, gn = (t) => {
+	let n = t.prefix ?? fn, r = { current: typeof t.store == "function" ? void 0 : t.store }, s = typeof t.store == "function" ? ve(() => r.current) : t.store, c = t.challengeStore ?? ht(), l = { current: void 0 }, u = t.admit === void 0 ? void 0 : (e, n) => t.admit(e, { store: n.store ?? l.current }), d = {
+		...t.secret === void 0 ? {} : { secret: t.secret },
+		...t.secrets === void 0 ? {} : { secrets: t.secrets },
+		defaultTenantId: t.defaultTenantId,
+		...t.cookieDomain === void 0 ? {} : { cookieDomain: t.cookieDomain },
+		...t.cookieSecure === void 0 ? {} : { cookieSecure: t.cookieSecure },
+		...t.successRedirect === void 0 ? {} : { successRedirect: t.successRedirect },
+		...t.signUpTenants === void 0 ? {} : { signUpTenants: t.signUpTenants },
+		...t.sendEmail === void 0 ? {} : { sendEmail: t.sendEmail },
+		...t.appBaseUrl === void 0 ? {} : { appBaseUrl: t.appBaseUrl },
+		subjectGuards: [...t.subjectGuards ?? [], ...F(t.emailVerification) ? [Re(t.emailVerification)] : []],
+		...t.lockout === void 0 ? {} : { lockout: t.lockout },
+		...t.now === void 0 ? {} : { now: t.now },
+		...u === void 0 ? {} : { admit: u },
+		ensureActor: t.ensureActor ?? ((e) => {
+			let t = l.current;
+			return t === void 0 ? D.void : D.promise(() => t.insertIgnore(hn, {
+				id: e.id,
+				kind: "user",
+				displayName: null
+			}, { conflictColumns: ["id"] }));
+		}),
+		...t.emailVerification === void 0 ? {} : { emailVerification: t.emailVerification }
+	}, p = {
+		...t.appBaseUrl === void 0 ? {} : { appBaseUrl: t.appBaseUrl },
+		...t.sendEmail === void 0 ? {} : { sendEmail: t.sendEmail },
+		...t.invitations === void 0 ? {} : { invitations: t.invitations },
+		...t.now === void 0 ? {} : { now: t.now },
+		...u === void 0 ? {} : { admit: u }
+	};
+	t.invitations !== void 0 && ce({
+		source: "plugin",
+		table: "invitations",
+		timeColumn: "createdAt",
+		ttlMs: le(process.env.VOLTRO_INVITATIONS_TTL_HOURS, 2160),
+		envVar: "VOLTRO_INVITATIONS_TTL_HOURS"
+	}), t.impersonation !== void 0 && ce({
+		source: "plugin",
+		table: "impersonationGrants",
+		timeColumn: "startedAt",
+		ttlMs: le(process.env.VOLTRO_IMPERSONATION_GRANTS_TTL_HOURS, 8760),
+		envVar: "VOLTRO_IMPERSONATION_GRANTS_TTL_HOURS"
+	});
+	let h = f(s, t.sessionRevocation ?? {}), g = async (e) => {
+		let t = R(d), n = o(e.headers, t);
+		if (!n) return null;
+		let r = e.headers[oe] ? "header" : "cookie", i = m(n.subject);
+		if (i && !await D.runPromise(h.isLive(i))) return null;
+		if (n.renew || n.kid !== t.current.kid) {
+			let e = Math.max(n.exp - n.iat, 60), o = a(n.subject, t, {
+				ttlSeconds: e,
+				...d.cookieDomain ? { domain: d.cookieDomain } : {},
+				secure: d.cookieSecure ?? !0
+			});
+			return i && await D.runPromise(s.touchSession(i, new Date(Date.now() + e * 1e3))), {
+				subject: n.subject,
+				sessionId: i,
+				renewSetCookie: o.setCookie,
+				renewValue: o.value,
+				via: r,
+				expiresAt: Math.floor(Date.now() / 1e3) + e
+			};
+		}
+		return {
+			subject: n.subject,
+			sessionId: i,
+			via: r,
+			expiresAt: n.exp
+		};
+	}, v = (e, t) => {
+		if (!t) return e;
+		let n = e.headers ?? {};
+		return n["set-cookie"] ? e : {
+			...e,
+			headers: {
+				...n,
+				"set-cookie": t
+			}
+		};
+	}, y = (e) => {
+		let n = e.headers[te], r = se(e.headers.cookie, ee);
+		return ne(n, r, z(t));
+	}, b = (e, t) => e.path === `${n}${t}`, x = (e) => D.runPromise(e).then(mn), S = {
+		issue: (e, t) => H(e, s, d, {
+			sessionId: t.sessionId,
+			ttlSeconds: t.ttlSeconds,
+			metadata: t.metadata,
+			ipAddress: t.ipAddress ?? null,
+			userAgent: t.userAgent ?? null,
+			clearLoginFailures: !1
+		}),
+		reissue: (e, t) => H(e, s, d, {
+			sessionId: t.sessionId,
+			ttlSeconds: t.ttlSeconds,
+			sessionRow: "existing",
+			clearLoginFailures: !1
+		}),
+		clear: () => i({
+			...d.cookieDomain ? { domain: d.cookieDomain } : {},
+			secure: d.cookieSecure ?? !0
+		})
+	}, re = {
+		method: "*",
+		path: n,
+		handle: async (r) => {
+			let i = r.method === "GET" ? {} : pn(r);
+			if (t.native !== void 0) {
+				let e = {
+					prefix: n,
+					config: d,
+					native: t.native,
+					...t.now === void 0 ? {} : { now: t.now }
+				};
+				if (r.method === "GET" && b(r, "/native/authorize")) {
+					let t = await g(r);
+					return x(on(new URLSearchParams(r.query), t, s, e));
+				}
+				if (r.method === "GET" && b(r, "/native/complete")) {
+					let t = await g(r);
+					return x(cn(r.headers.cookie, t, s, e));
+				}
+				if (r.method === "POST" && b(r, "/native/exchange")) return x(ln({
+					code: Q(i.code) ?? "",
+					codeVerifier: Q(i.codeVerifier) ?? ""
+				}, s, e));
+			} else if (r.path.startsWith(`${n}/native/`)) return Z(501, { error: "native_login_not_configured" });
+			if (r.method === "GET" && b(r, "/csrf")) return mn(rt(d));
+			if (r.method === "POST" && b(r, "/sign-in")) return x(Ye({
+				email: Q(i.email) ?? "",
+				password: Q(i.password) ?? "",
+				...i.redirectAfter === void 0 ? {} : { redirectAfter: !!i.redirectAfter },
+				...r.remoteAddr ? { ipAddress: r.remoteAddr } : {},
+				...r.headers["user-agent"] ? { userAgent: r.headers["user-agent"] } : {}
+			}, s, d));
+			if (r.method === "POST" && b(r, "/sign-up")) {
+				let e = Q(i.tenantId);
+				return e !== void 0 && e !== d.defaultTenantId && !(d.signUpTenants ?? []).includes(e) ? {
+					status: 400,
+					headers: { "content-type": "application/json" },
+					body: JSON.stringify({ error: "tenant_not_open" })
+				} : x(Ze({
+					email: Q(i.email) ?? "",
+					password: Q(i.password) ?? "",
+					...$("tenantId", e),
+					...i.redirectAfter === void 0 ? {} : { redirectAfter: !!i.redirectAfter }
+				}, s, d));
+			}
+			if (r.method === "POST" && b(r, "/sign-out")) {
+				let e = await g(r);
+				return e && e.subject.type === "user" && e.sessionId && (await D.runPromise(s.revokeSession(e.subject.id, e.sessionId)), h.invalidate(e.sessionId)), mn(Qe(d));
+			}
+			if (r.method === "POST" && b(r, "/magic-link")) return x(at({
+				email: Q(i.email) ?? "",
+				...$("callbackPath", i.callbackPath)
+			}, s, d));
+			if (r.method === "POST" && b(r, "/magic-link/callback")) return x(ot({
+				token: Q(i.token) ?? "",
+				...i.redirectAfter === void 0 ? {} : { redirectAfter: !!i.redirectAfter }
+			}, s, d));
+			if (r.method === "POST" && b(r, "/password-reset")) return x(st({
+				email: Q(i.email) ?? "",
+				...$("callbackPath", i.callbackPath)
+			}, s, d));
+			if (r.method === "POST" && b(r, "/password-reset/confirm")) return x(ct({
+				token: Q(i.token) ?? "",
+				newPassword: Q(i.newPassword) ?? ""
+			}, s));
+			if (r.method === "POST" && b(r, "/verify-email")) {
+				let e = Q(i.email);
+				if (e) return x(Ve({ email: e }, s, d));
+				let t = await g(r);
+				return !t || t.subject.type !== "user" ? Z(400, { error: "email required" }) : x(Ve({ userId: t.subject.id }, s, d));
+			}
+			if (r.method === "POST" && b(r, "/verify-email/callback")) return x(He({ token: Q(i.token) ?? "" }, s));
+			if (t.invitations && r.method === "POST" && b(r, "/invitations/preview")) return x(Ft({ token: Q(i.token) ?? "" }, s, p));
+			if (t.invitations && r.method === "POST" && b(r, "/invitations/sign-up")) return x(Lt({
+				token: Q(i.token) ?? "",
+				password: Q(i.password) ?? ""
+			}, s, {
+				...p,
+				hashPassword: e
+			}));
+			if (r.method === "POST" && b(r, "/mfa/verify")) return x(Xe({
+				pendingToken: Q(i.pendingToken) ?? "",
+				...$("code", i.code),
+				...$("recoveryCode", i.recoveryCode),
+				...i.redirectAfter === void 0 ? {} : { redirectAfter: !!i.redirectAfter },
+				...r.remoteAddr ? { ipAddress: r.remoteAddr } : {},
+				...r.headers["user-agent"] ? { userAgent: r.headers["user-agent"] } : {}
+			}, s, d));
+			if (t.passkey && r.method === "POST" && b(r, "/passkey/assert/options")) return x(yt({ ...$("userId", i.userId) }, s, c, t.passkey));
+			if (t.passkey && r.method === "POST" && b(r, "/passkey/assert/verify")) return x(bt({
+				credentialId: Q(i.credentialId) ?? "",
+				clientDataJSON: Q(i.clientDataJSON) ?? "",
+				authenticatorData: Q(i.authenticatorData) ?? "",
+				signature: Q(i.signature) ?? "",
+				...$("userId", i.userId)
+			}, s, c, t.passkey, d));
+			let a = await g(r), o = a?.subject ?? null, u = () => !o || o.type !== "user" ? Z(401, { error: "unauthenticated" }) : { userId: o.id }, f = () => y(r) ? null : Z(403, { error: "csrf" }), m = (e) => x(e).then((e) => v(e, a?.renewSetCookie));
+			if (o && Ht(o)) {
+				let e = r.path.startsWith(n) ? r.path.slice(n.length) : "";
+				if (zt.includes(e)) return Z(403, {
+					error: "forbidden_while_impersonating",
+					message: "This action changes account credentials or session scope and is refused while impersonating. Stop the impersonation first."
+				});
+			}
+			if (r.method === "GET" && b(r, "/session")) {
+				let e = u();
+				return "status" in e ? e : v(Z(200, {
+					ok: !0,
+					subject: o,
+					renewed: a?.renewSetCookie !== void 0,
+					expiresAt: a?.expiresAt,
+					...a?.via === "header" && a.renewValue !== void 0 ? { session: a.renewValue } : {}
+				}), a?.renewSetCookie);
+			}
+			if (r.method === "GET" && b(r, "/sessions")) {
+				let e = u();
+				return "status" in e ? e : m(lt({ userId: e.userId }, s));
+			}
+			if (r.method === "GET" && b(r, "/memberships")) {
+				let e = u();
+				return "status" in e ? e : m(pt({ userId: e.userId }, s));
+			}
+			if (r.method === "POST" && b(r, "/sessions/revoke")) {
+				let e = u();
+				if ("status" in e) return e;
+				let t = f();
+				if (t) return t;
+				let n = Q(i.sessionId) ?? "";
+				return m(ut({
+					userId: e.userId,
+					sessionId: n
+				}, s)).then((e) => (n && h.invalidate(n), e));
+			}
+			if (r.method === "POST" && b(r, "/sessions/revoke-others")) {
+				let e = u();
+				return "status" in e ? e : f() || m(dt({
+					userId: e.userId,
+					keepSessionId: a?.sessionId ?? "__none__"
+				}, s));
+			}
+			if (t.invitations && r.method === "POST" && b(r, "/invitations")) {
+				let e = u();
+				return "status" in e ? e : f() || m(Mt({
+					inviterUserId: e.userId,
+					tenantId: Q(i.tenantId) ?? o?.tenantId ?? "",
+					email: Q(i.email) ?? "",
+					role: Q(i.role) ?? ""
+				}, s, p));
+			}
+			if (t.invitations && r.method === "GET" && r.path === `${n}/invitations`) {
+				let e = u();
+				return "status" in e ? e : m(Nt({
+					callerUserId: e.userId,
+					tenantId: o?.tenantId ?? ""
+				}, s, p));
+			}
+			if (t.invitations && r.method === "POST" && b(r, "/invitations/revoke")) {
+				let e = u();
+				return "status" in e ? e : f() || m(Pt({
+					callerUserId: e.userId,
+					tenantId: Q(i.tenantId) ?? o?.tenantId ?? "",
+					invitationId: Q(i.invitationId) ?? ""
+				}, s, p));
+			}
+			if (t.invitations && r.method === "POST" && b(r, "/invitations/accept")) {
+				let e = u();
+				if (!("status" in e)) {
+					let e = f();
+					if (e) return e;
+				}
+				return m(It({
+					token: Q(i.token) ?? "",
+					..."status" in e ? {} : { userId: e.userId }
+				}, s, p));
+			}
+			if (t.impersonation && r.method === "POST" && b(r, "/impersonate/start")) {
+				let e = u();
+				return "status" in e ? e : f() || x(Gt({
+					actorSubject: o,
+					actorSessionId: a?.sessionId ?? "",
+					...$("targetUserId", i.userId),
+					...$("targetEmail", i.email),
+					...$("reason", i.reason),
+					...typeof i.durationSeconds == "number" ? { durationSeconds: i.durationSeconds } : {},
+					ipAddress: r.remoteAddr ?? null,
+					userAgent: r.headers["user-agent"] ?? null
+				}, s, {
+					impersonation: t.impersonation,
+					issuer: S,
+					...t.now === void 0 ? {} : { now: t.now },
+					invalidateSession: (e) => h.invalidate(e)
+				}));
+			}
+			if (t.impersonation && r.method === "POST" && b(r, "/impersonate/stop")) {
+				let e = u();
+				return "status" in e ? e : f() || x(Kt({
+					subject: o,
+					sessionId: a?.sessionId ?? ""
+				}, s, {
+					impersonation: t.impersonation,
+					issuer: S,
+					...t.now === void 0 ? {} : { now: t.now },
+					invalidateSession: (e) => h.invalidate(e)
+				}));
+			}
+			if (r.method === "POST" && b(r, "/switch-tenant")) {
+				let e = u();
+				return "status" in e ? e : f() || x(ft({
+					userId: e.userId,
+					targetTenantId: Q(i.targetTenantId) ?? "",
+					...typeof i.clientId == "number" ? { clientId: i.clientId } : {},
+					...a?.sessionId ? { sessionId: a.sessionId } : {},
+					...o?.type === "user" && o.metadata ? { metadata: o.metadata } : {}
+				}, s, d, t.rebind, l.current));
+			}
+			if (t.mfa && r.method === "POST" && b(r, "/mfa/enroll/start")) {
+				let e = u();
+				if ("status" in e) return e;
+				let n = f();
+				if (n) return n;
+				let r = await D.runPromise(s.findById(e.userId));
+				return m($e({
+					userId: e.userId,
+					issuer: t.mfa.issuer,
+					accountName: r?.email ?? e.userId
+				}, s));
+			}
+			if (t.mfa && r.method === "POST" && b(r, "/mfa/enroll/verify")) {
+				let e = u();
+				return "status" in e ? e : f() || m(et({
+					userId: e.userId,
+					code: Q(i.code) ?? ""
+				}, s));
+			}
+			if (t.mfa && r.method === "POST" && b(r, "/mfa/unenroll")) {
+				let e = u();
+				return "status" in e ? e : f() || m(nt({ userId: e.userId }, s));
+			}
+			if (t.mfa && r.method === "POST" && b(r, "/mfa/recovery-codes/regenerate")) {
+				let e = u();
+				return "status" in e ? e : f() || m(tt({ userId: e.userId }, s));
+			}
+			if (t.passkey && r.method === "POST" && b(r, "/passkey/register/options")) {
+				let e = u();
+				return "status" in e ? e : f() || m(_t({
+					userId: e.userId,
+					userName: Q(i.userName) ?? e.userId
+				}, s, c, t.passkey));
+			}
+			if (t.passkey && r.method === "POST" && b(r, "/passkey/register/verify")) {
+				let e = u();
+				return "status" in e ? e : f() || m(vt({
+					userId: e.userId,
+					credentialId: Q(i.credentialId) ?? "",
+					clientDataJSON: Q(i.clientDataJSON) ?? "",
+					authenticatorData: Q(i.authenticatorData) ?? "",
+					...$("transports", i.transports)
+				}, s, c, t.passkey));
+			}
+			return !t.passkey && r.path.startsWith(`${n}/passkey/`) ? Z(501, { error: "passkey_not_configured" }) : Z(404, { error: "not_found" });
+		}
+	}, C = de({
+		name: t.name ? `@voltro/plugin-auth#${t.name}` : "@voltro/plugin-auth",
+		description: "Auth routes — mounts the full auth surface (password, magic-link, password-reset, CSRF, session probe/list/revoke, memberships, switch-tenant, passkey ceremonies) under /auth on the framework listener, with keyed secret rotation + request-time revocation.",
+		permissions: [],
+		declaredEnv: vn,
+		privacy: _n,
+		httpRoutes: [re],
+		bindDataStore: (e, n) => {
+			l.current = e, typeof t.store == "function" && (r.current = t.store(n?.sql === void 0 ? {} : { sql: n.sql }));
+		},
+		onActivate: (e) => D.sync(() => {
+			e.logger.info("auth routes active", {
+				prefix: n,
+				passkey: t.passkey ? t.passkey.rpId : "disabled",
+				email: t.sendEmail ? "wired" : "unwired",
+				revocationWindowMs: h.ttlMs,
+				emailVerification: t.emailVerification?.policy ?? "off",
+				invitations: t.invitations ? "enabled" : "disabled",
+				impersonation: t.impersonation ? `enabled(max ${t.impersonation.maxDurationSeconds ?? 900}s)` : "disabled"
+			});
+		}),
+		onDeactivate: () => D.void
+	}), w = t.secrets ?? t.secret;
+	return {
+		...C,
+		auth: { sessionStrategy: _({
+			...w === void 0 ? {} : { secret: w },
+			store: s,
+			revocation: h
+		}) }
+	};
+}, _n = { collects: [{
+	category: "identifiers",
+	linked: !0,
+	tracking: !1,
+	purposes: ["app-functionality"]
+}, {
+	category: "email",
+	linked: !0,
+	tracking: !1,
+	purposes: ["app-functionality"]
+}] }, vn = [
+	{
+		name: "VOLTRO_SESSION_SECRET_PREVIOUS",
+		required: !1,
+		secret: !0,
+		description: "The session secret being rotated AWAY from. While set, cookies signed with it still verify (and get re-issued under the current secret on the next authenticated /auth response). Set the new secret as VOLTRO_SESSION_SECRET, move the old one here for one session lifetime, then drop it.",
+		example: "the-previous-signing-secret"
+	},
+	{
+		name: "VOLTRO_SESSION_KID",
+		required: !1,
+		secret: !1,
+		description: "Non-secret key-id label stamped into cookies signed with the current secret (default 'k0').",
+		example: "2026-07"
+	},
+	{
+		name: "VOLTRO_SESSION_KID_PREVIOUS",
+		required: !1,
+		secret: !1,
+		description: "Non-secret key-id label for the previous secret (default 'k-previous').",
+		example: "2026-01"
+	},
+	{
+		name: "VOLTRO_INVITATIONS_TTL_HOURS",
+		required: !1,
+		secret: !1,
+		description: "How long an `invitations` row is kept before the retention sweep DELETES it. Default 2160 (90 days). Only armed when `invitations` is configured. Every invitation is dead long before this — the lifetime that decides redeemability is `invitations.ttlSeconds` (7 days by default) — so this bounds the history, not the grant.",
+		example: "2160"
+	},
+	{
+		name: "VOLTRO_IMPERSONATION_GRANTS_TTL_HOURS",
+		required: !1,
+		secret: !1,
+		description: "How long an `impersonationGrants` row is kept before the retention sweep DELETES it. Default 8760 (365 days), matching the audit log — this table answers \"who was acting as whom, when\", which is compliance evidence rather than operational state. Only armed when `impersonation` is configured. Raise it to your audit-retention obligation; lowering it shortens how far back an impersonation can be traced.",
+		example: "8760"
+	},
+	{
+		name: "VOLTRO_AUTH_SCOPE_CACHE_TTL_MS",
+		required: !1,
+		secret: !1,
+		description: "How long a resolved authority (auth.resolveScopes) stays cached, in milliseconds. Default 30000 — the same window as the session-revocation check, so the two per-request store reads expire together. This is the staleness window for a role change: remove a permission and every live session observes it within this long. Set it to 0 to resolve on every request (staleness zero, one store read per request). An explicit ttlMs in code wins over this variable.",
+		example: "30000"
+	}
+];
+//#endregion
+export { H as $, _t as A, $e as B, Mt as C, gt as D, Pt as E, rt as F, ct as G, tt as H, pt as I, ut as J, st as K, lt as L, ht as M, R as N, yt as O, U as P, ft as Q, ot as R, Lt as S, Ft as T, nt as U, et as V, Xe as W, Qe as X, Ye as Y, Ze as Z, Ct as _, _e as _t, cn as a, He as at, Et as b, an as c, Be as ct, Gt as d, Me as dt, Pe as et, Kt as f, je as ft, wt as g, be as gt, Ht as h, N as ht, on as i, Re as it, vt as j, bt as k, Rt as l, I as lt, Vt as m, Ae as mt, un as n, Ne as nt, ln as o, Ve as ot, Ut as p, ke as pt, dt as q, qt as r, F as rt, en as s, Le as st, gn as t, Fe as tt, zt as u, M as ut, St as v, ge as vt, Nt as w, It as x, xt as y, at as z };