@voltro/plugin-auth 0.81.0 → 0.82.0

package/dist/plugin-DFQ8N52Q.js

@@ -1,1334 +0,0 @@
-import { hashPassword as e, verifyPassword as t, verifyPasswordWithRehash as n } from "./password.js";
-import { SESSION_COOKIE_NAME as r, clearSessionCookie as i, issueSession as a, readSessionKeyed as o, resolveSessionSecret as s, resolveSessionSecrets as c, sessionSecretsOf as l } from "./session.js";
-import { a as u, l as d, o as f, s as p, t as m } from "./strategy-MP_KxNuA.js";
-import { hashToken as h, mintSecret as g, mintToken as _ } from "./tokens.js";
-import { CSRF_COOKIE_NAME as v, CSRF_HEADER_NAME as ee, issueCsrfToken as y, verifyCsrf as te } from "./csrf.js";
-import { generateChallenge as b, verifyAssertion as x, verifyRegistration as ne } from "./webauthn.js";
-import { createHmac as re, randomBytes as S, timingSafeEqual as ie } from "node:crypto";
-import { Data as ae, Effect as C } from "effect";
-import { buildSetCookie as oe, readCookie as se } from "@voltro/protocol/session";
-import { registerRetention as ce, retentionTtlMsFromEnv as le, writeTenantSelection as ue } from "@voltro/database";
-import { IMPERSONATION_METADATA_KEY as w, definePlugin as de, rawImpersonationMark as fe, selectSubjectTenant as pe } from "@voltro/protocol";
-//#region src/subjectGuard.ts
-var me = { ok: !0 }, he = (e, t) => C.gen(function* () {
-	for (let n of e) {
-		let e = yield* n(t);
-		if (!e.ok) return e;
-	}
-	return me;
-}), T = 30, ge = 6, _e = 20, ve = "sha1", ye = 1, E = class extends ae.TaggedError("TotpVerifyError") {}, be = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567", xe = (e) => {
-	let t = 0, n = 0, r = "";
-	for (let i of e) for (n = n << 8 | i, t += 8; t >= 5;) r += be[n >>> t - 5 & 31], t -= 5;
-	return t > 0 && (r += be[n << 5 - t & 31]), r;
-}, Se = (e) => {
-	let t = e.toUpperCase().replace(/[\s=]+/g, "");
-	if (!/^[A-Z2-7]+$/.test(t)) return null;
-	let n = new Uint8Array(Math.floor(t.length * 5 / 8)), r = 0, i = 0, a = 0;
-	for (let e of t) {
-		let t = be.indexOf(e);
-		if (t === -1) return null;
-		i = i << 5 | t, r += 5, r >= 8 && (n[a++] = i >>> r - 8 & 255, r -= 8);
-	}
-	return n.subarray(0, a);
-}, Ce = (e) => {
-	let t = Buffer.alloc(8);
-	return t.writeBigUInt64BE(BigInt(e), 0), t;
-}, we = (e, t) => {
-	let n = re(ve, Buffer.from(e));
-	n.update(Ce(t));
-	let r = n.digest(), i = r[r.length - 1] & 15, a = (r[i] & 127) << 24 | (r[i + 1] & 255) << 16 | (r[i + 2] & 255) << 8 | r[i + 3] & 255;
-	return String(a % 10 ** ge).padStart(ge, "0");
-}, Te = () => xe(S(_e)), Ee = (e) => `otpauth://totp/${encodeURIComponent(`${e.issuer}:${e.accountName}`)}?${new URLSearchParams({
-	secret: e.secret,
-	issuer: e.issuer,
-	algorithm: "SHA1",
-	digits: String(ge),
-	period: String(T)
-}).toString()}`, De = (e, t = Date.now()) => {
-	let n = Se(e);
-	return n ? we(n, Math.floor(t / 1e3 / T)) : "000000";
-}, D = (e, t, n = Date.now()) => C.gen(function* () {
-	let r = Se(e);
-	if (!r) return yield* C.fail(new E({ reason: "malformedSecret" }));
-	let i = t.replace(/\s+/g, "");
-	if (!/^[0-9]{6}$/.test(i)) return yield* C.fail(new E({ reason: "invalidCode" }));
-	let a = Math.floor(n / 1e3 / T), o = Buffer.from(i);
-	for (let e = -1; e <= ye; e++) {
-		let t = we(r, a + e), n = Buffer.from(t);
-		if (n.length === o.length && ie(n, o)) return !0;
-	}
-	return yield* C.fail(new E({ reason: "invalidCode" }));
-}), O = (e = 10) => {
-	let t = [];
-	for (let n = 0; n < e; n++) {
-		let e = xe(S(16)).slice(0, 25).match(/.{1,5}/g) ?? [];
-		t.push(e.join("-"));
-	}
-	return t;
-}, Oe = 60, ke = "email_not_verified", k = "emailVerified", Ae = (e) => e?.policy ?? "off", A = (e) => Ae(e) !== "off", j = (e, t) => {
-	if (e.emailVerifiedAt != null) return !0;
-	let n = t?.exemptAccountsCreatedBefore;
-	return n !== void 0 && e.createdAt.getTime() < n.getTime();
-}, je = (e) => {
-	if (e.type !== "user") return null;
-	let t = e.metadata?.[k];
-	return typeof t == "boolean" ? t : null;
-}, Me = (e) => {
-	let t = Ae(e) === "strict";
-	return (n) => C.succeed(!t || j(n, e) ? { ok: !0 } : {
-		ok: !1,
-		code: ke,
-		message: "This account's email address has not been confirmed yet. Request a new confirmation link and follow it, then sign in again."
-	});
-}, M = (e, t) => ({
-	status: e,
-	body: JSON.stringify(t),
-	contentType: "application/json; charset=utf-8"
-}), Ne = (e, t, n) => `${e}${t}${t.includes("?") ? "&" : "?"}token=${encodeURIComponent(n)}`, N = (e, t, n) => C.gen(function* () {
-	let r = n.emailVerification, i = (n.now ?? Date.now)(), a = (r?.resendCooldownSeconds ?? 60) * 1e3;
-	if (a > 0) {
-		let n = yield* t.latestToken(e.id, "email-verify");
-		if (n && i - n.createdAt.getTime() < a) return !1;
-	}
-	let o = _("email-verify", r?.ttlSeconds ?? 86400);
-	if (yield* t.insertToken({
-		id: u("tok"),
-		tokenHash: o.tokenHash,
-		userId: e.id,
-		purpose: "email-verify",
-		expiresAt: o.expiresAt
-	}).pipe(C.ignore), !n.sendEmail) return !1;
-	let s = Ne(n.appBaseUrl ?? "", r?.callbackPath ?? "/auth/verify-email/callback", o.token);
-	return yield* C.tryPromise(() => n.sendEmail({
-		to: e.email,
-		kind: "email-verify",
-		actionUrl: s,
-		subject: "Confirm your email address",
-		text: `Confirm your email address: ${s}`,
-		html: `<p><a href="${s}">Confirm your email address</a> — this link expires in 24 hours.</p>`
-	})).pipe(C.ignore), !0;
-}), P = (e, t, n) => C.gen(function* () {
-	if (!e.email && !e.userId) return M(400, { error: "email or userId required" });
-	let r = e.userId ? yield* t.findById(e.userId) : yield* t.findByEmail(e.email);
-	return r && !j(r, n.emailVerification) && (yield* N(r, t, n)), M(202, { ok: !0 });
-}), Pe = (e, t) => C.gen(function* () {
-	if (!e.token) return M(400, { error: "token required" });
-	let n = yield* t.consumeToken(h(e.token), "email-verify");
-	if (!n) return M(401, { error: "invalid or expired token" });
-	let r = yield* t.findById(n.userId);
-	return r ? (yield* t.markEmailVerified(r.id).pipe(C.ignore), M(200, {
-		ok: !0,
-		verified: !0
-	})) : M(401, { error: "invalid or expired token" });
-}), Fe = 5, Ie = 900, Le = 900, Re = (e) => ({
-	maxAttempts: e.lockout?.maxAttempts ?? Fe,
-	windowMs: (e.lockout?.windowSeconds ?? Ie) * 1e3,
-	lockMs: (e.lockout?.lockSeconds ?? Le) * 1e3
-}), F = (e) => e.secrets ?? (e.secret === void 0 ? c() : l(e.secret)), ze = (e) => e.secret ?? s(), I = (e, t, n = {}) => ({
-	status: e,
-	body: JSON.stringify(t),
-	contentType: "application/json; charset=utf-8",
-	...n
-}), L = (e, t = {}) => ({
-	status: 302,
-	body: "",
-	contentType: "text/plain",
-	location: e,
-	...t
-}), Be = 604800, Ve = (e, t) => e.type === "user" ? {
-	...e,
-	metadata: {
-		...e.metadata ?? {},
-		sessionId: t
-	}
-} : e, R = (e, t, n, r = {}) => C.gen(function* () {
-	r.clearLoginFailures !== !1 && (yield* t.clearLoginFailures(e.email));
-	let i = yield* t.listMemberships(e.id), o = r.sessionId ?? u("sess"), s = r.ttlSeconds ?? Be;
-	r.sessionRow !== "existing" && (yield* t.insertSession({
-		id: o,
-		userId: e.id,
-		tenantId: e.tenantId,
-		expiresAt: new Date(Date.now() + s * 1e3),
-		ipAddress: r.ipAddress ?? null,
-		userAgent: r.userAgent ?? null
-	}).pipe(C.ignore));
-	let c = { ...r.metadata };
-	A(n.emailVerification) && (c[k] = j(e, n.emailVerification));
-	let l = Ve(p(e, {
-		memberships: i,
-		...Object.keys(c).length > 0 ? { metadata: c } : {}
-	}), o);
-	return {
-		setCookie: a(l, F(n), {
-			ttlSeconds: s,
-			...n.cookieDomain ? { domain: n.cookieDomain } : {},
-			secure: n.cookieSecure ?? !0
-		}).setCookie,
-		subject: l
-	};
-}), z = (e, t) => C.gen(function* () {
-	let n = t.subjectGuards ?? [];
-	if (n.length === 0) return null;
-	let r = yield* he(n, e);
-	return r.ok ? null : I(403, {
-		error: r.code,
-		message: r.message
-	});
-}), He = (r, i, a) => C.gen(function* () {
-	if (!r.email || !r.password) return I(400, { error: "email and password required" });
-	let o = yield* i.findByEmail(r.email), s = (a.now ?? Date.now)(), c = yield* i.isLockedOut(r.email, s);
-	if (c.locked) return I(429, {
-		error: "account_locked",
-		retryAfterSeconds: c.retryAfterSeconds
-	});
-	let l = o?.passwordHash, d = typeof l == "string" && l.length > 0 ? yield* n(r.password, l) : yield* C.gen(function* () {
-		let n = yield* e("decoy-not-a-real-password").pipe(C.orElseSucceed(() => ""));
-		return yield* t(r.password, n), { valid: !1 };
-	});
-	if (!o || !d.valid) return yield* i.recordLoginFailure(r.email, s, Re(a)), I(401, { error: "invalid credentials" });
-	let f = yield* z(o, a);
-	if (f) return f;
-	if (d.rehash && (yield* i.updatePassword(o.id, d.rehash).pipe(C.ignore)), o.mfaEnrolledAt) {
-		let e = _("mfa-pending", 300);
-		return yield* i.insertToken({
-			id: u("tok"),
-			tokenHash: e.tokenHash,
-			userId: o.id,
-			purpose: "mfa-pending",
-			expiresAt: e.expiresAt
-		}).pipe(C.ignore), I(200, {
-			ok: !0,
-			mfaRequired: !0,
-			pendingToken: e.token,
-			expiresInSeconds: 300
-		});
-	}
-	let { setCookie: p, subject: m } = yield* R(o, i, a, {
-		ipAddress: r.ipAddress ?? null,
-		userAgent: r.userAgent ?? null
-	});
-	return r.redirectAfter ? L(a.successRedirect ?? "/", { setCookie: p }) : I(200, {
-		ok: !0,
-		subject: m
-	}, { setCookie: p });
-}), Ue = (e, t, n) => C.gen(function* () {
-	if (!e.pendingToken) return I(400, { error: "pending token required" });
-	if (!e.code && !e.recoveryCode) return I(400, { error: "code or recoveryCode required" });
-	let r = yield* t.consumeToken(h(e.pendingToken), "mfa-pending");
-	if (!r) return I(401, { error: "invalid or expired challenge" });
-	let i = yield* t.findById(r.userId);
-	if (!i || !i.mfaEnrolledAt || !i.mfaSecret) return I(401, { error: "mfa not enrolled" });
-	let a = (n.now ?? Date.now)(), o = yield* t.isLockedOut(i.email, a);
-	if (o.locked) return I(429, {
-		error: "account_locked",
-		retryAfterSeconds: o.retryAfterSeconds
-	});
-	let s = yield* z(i, n);
-	if (s) return s;
-	if (!(e.recoveryCode ? yield* t.consumeRecoveryCode(i.id, h(e.recoveryCode.trim())) : yield* D(i.mfaSecret, e.code ?? "").pipe(C.map(() => !0), C.catchTag("TotpVerifyError", () => C.succeed(!1))))) return yield* t.recordLoginFailure(i.email, a, Re(n)), I(401, { error: "invalid_code" });
-	let { setCookie: c, subject: l } = yield* R(i, t, n, {
-		ipAddress: e.ipAddress ?? null,
-		userAgent: e.userAgent ?? null
-	});
-	return e.redirectAfter ? L(n.successRedirect ?? "/", { setCookie: c }) : I(200, {
-		ok: !0,
-		subject: l
-	}, { setCookie: c });
-}), We = (t, n, r) => C.gen(function* () {
-	if (!t.email || !t.password) return I(400, { error: "email and password required" });
-	if (t.password.length < 8) return I(400, { error: "password must be at least 8 characters" });
-	if (yield* n.findByEmail(t.email)) return I(409, { error: "email already registered" });
-	let i = t.tenantId ?? r.defaultTenantId, a = yield* e(t.password), o = yield* n.insert({
-		id: u("user"),
-		email: t.email,
-		passwordHash: a,
-		tenantId: i
-	});
-	yield* n.addMembership({
-		userId: o.id,
-		tenantId: i,
-		role: "owner"
-	}).pipe(C.ignore), A(r.emailVerification) && (r.emailVerification?.sendOnSignUp ?? !0) && (yield* N(o, n, r).pipe(C.ignore));
-	let { setCookie: s, subject: c } = yield* R(o, n, r);
-	return t.redirectAfter ? L(r.successRedirect ?? "/", { setCookie: s }) : I(200, {
-		ok: !0,
-		subject: c
-	}, { setCookie: s });
-}).pipe(C.catchAll((e) => C.succeed(I(500, {
-	error: "signup_failed",
-	cause: String(e)
-})))), Ge = (e) => ({
-	status: 302,
-	body: "",
-	location: e.successRedirect ?? "/",
-	setCookie: i({
-		...e.cookieDomain ? { domain: e.cookieDomain } : {},
-		secure: e.cookieSecure ?? !0
-	})
-}), Ke = (e, t) => C.gen(function* () {
-	let n = yield* t.findById(e.userId);
-	if (!n) return I(404, { error: "user_not_found" });
-	let r = Te();
-	return yield* t.setMfaSecret(n.id, r).pipe(C.catchAll(() => C.succeed(n))), I(200, {
-		ok: !0,
-		secret: r,
-		otpauthUrl: Ee({
-			issuer: e.issuer,
-			accountName: e.accountName,
-			secret: r
-		})
-	});
-}), qe = (e, t) => C.gen(function* () {
-	let n = yield* t.findById(e.userId);
-	if (!n) return I(404, { error: "user_not_found" });
-	if (!n.mfaSecret) return I(400, { error: "no_enrollment_in_progress" });
-	if (n.mfaEnrolledAt) return I(409, { error: "already_enrolled" });
-	if (!(yield* D(n.mfaSecret, e.code).pipe(C.map(() => !0), C.catchTag("TotpVerifyError", () => C.succeed(!1))))) return I(401, { error: "invalid_code" });
-	yield* t.markMfaEnrolled(n.id).pipe(C.catchAll(() => C.succeed(n)));
-	let r = O();
-	return yield* t.replaceRecoveryCodes(n.id, r.map((e) => h(e))).pipe(C.ignore), I(200, {
-		ok: !0,
-		enrolled: !0,
-		recoveryCodes: r
-	});
-}), Je = (e, t) => C.gen(function* () {
-	let n = yield* t.findById(e.userId);
-	if (!n) return I(404, { error: "user_not_found" });
-	if (!n.mfaEnrolledAt) return I(400, { error: "mfa_not_enrolled" });
-	let r = O();
-	return yield* t.replaceRecoveryCodes(n.id, r.map((e) => h(e))).pipe(C.ignore), I(200, {
-		ok: !0,
-		recoveryCodes: r
-	});
-}), Ye = (e, t) => C.gen(function* () {
-	let n = yield* t.findById(e.userId);
-	return n ? (yield* t.clearMfa(n.id).pipe(C.catchAll(() => C.succeed(n))), yield* t.replaceRecoveryCodes(n.id, []).pipe(C.ignore), I(200, {
-		ok: !0,
-		enrolled: !1
-	})) : I(404, { error: "user_not_found" });
-}), Xe = (e) => {
-	let t = y(ze(e)), n = oe(v, t, {
-		httpOnly: !1,
-		sameSite: "lax",
-		secure: e.cookieSecure ?? !0,
-		...e.cookieDomain ? { domain: e.cookieDomain } : {},
-		path: "/"
-	});
-	return I(200, { csrfToken: t }, { setCookie: n });
-}, Ze = (e, t, n) => `${e}${t}${t.includes("?") ? "&" : "?"}token=${encodeURIComponent(n)}`, Qe = (e, t, n) => C.gen(function* () {
-	if (!e.email) return I(400, { error: "email required" });
-	let r = yield* t.findByEmail(e.email);
-	if (r) {
-		let i = _("magic-link");
-		yield* t.insertToken({
-			id: u("tok"),
-			tokenHash: i.tokenHash,
-			userId: r.id,
-			purpose: "magic-link",
-			expiresAt: i.expiresAt
-		}).pipe(C.ignore);
-		let a = Ze(n.appBaseUrl ?? "", e.callbackPath ?? "/auth/magic-link/callback", i.token);
-		n.sendEmail && (yield* C.tryPromise(() => n.sendEmail({
-			to: r.email,
-			kind: "magic-link",
-			actionUrl: a,
-			subject: "Your sign-in link",
-			text: `Sign in: ${a}`,
-			html: `<p><a href="${a}">Sign in</a> — this link expires shortly.</p>`
-		})).pipe(C.ignore));
-	}
-	return I(202, { ok: !0 });
-}), $e = (e, t, n) => C.gen(function* () {
-	if (!e.token) return I(400, { error: "token required" });
-	let r = yield* t.consumeToken(h(e.token), "magic-link");
-	if (!r) return I(401, { error: "invalid or expired token" });
-	let i = yield* t.findById(r.userId);
-	if (!i) return I(401, { error: "invalid or expired token" });
-	let a = yield* t.markEmailVerified(i.id).pipe(C.orElseSucceed(() => i)), o = yield* z(a, n);
-	if (o) return o;
-	let { setCookie: s, subject: c } = yield* R(a, t, n);
-	return e.redirectAfter ? L(n.successRedirect ?? "/", { setCookie: s }) : I(200, {
-		ok: !0,
-		subject: c
-	}, { setCookie: s });
-}), et = (e, t, n) => C.gen(function* () {
-	if (!e.email) return I(400, { error: "email required" });
-	let r = yield* t.findByEmail(e.email);
-	if (r) {
-		let i = _("password-reset");
-		yield* t.insertToken({
-			id: u("tok"),
-			tokenHash: i.tokenHash,
-			userId: r.id,
-			purpose: "password-reset",
-			expiresAt: i.expiresAt
-		}).pipe(C.ignore);
-		let a = Ze(n.appBaseUrl ?? "", e.callbackPath ?? "/auth/password-reset/callback", i.token);
-		n.sendEmail && (yield* C.tryPromise(() => n.sendEmail({
-			to: r.email,
-			kind: "password-reset",
-			actionUrl: a,
-			subject: "Reset your password",
-			text: `Reset your password: ${a}`,
-			html: `<p><a href="${a}">Reset your password</a> — this link expires shortly.</p>`
-		})).pipe(C.ignore));
-	}
-	return I(202, { ok: !0 });
-}), tt = (t, n) => C.gen(function* () {
-	if (!t.token || !t.newPassword) return I(400, { error: "token and newPassword required" });
-	if (t.newPassword.length < 8) return I(400, { error: "password must be at least 8 characters" });
-	let r = yield* n.consumeToken(h(t.token), "password-reset");
-	if (!r) return I(401, { error: "invalid or expired token" });
-	let i = yield* e(t.newPassword).pipe(C.orElseSucceed(() => ""));
-	return i ? (yield* n.updatePassword(r.userId, i).pipe(C.ignore), yield* n.markEmailVerified(r.userId).pipe(C.ignore), yield* n.revokeAllOtherSessions(r.userId, "__none__").pipe(C.ignore), I(200, { ok: !0 })) : I(500, { error: "hash_failed" });
-}), nt = (e, t) => C.gen(function* () {
-	return I(200, { sessions: (yield* t.listSessions(e.userId)).map((e) => ({
-		id: e.id,
-		tenantId: e.tenantId,
-		ipAddress: e.ipAddress ?? null,
-		userAgent: e.userAgent ?? null,
-		createdAt: e.createdAt.toISOString(),
-		lastSeenAt: e.lastSeenAt.toISOString(),
-		expiresAt: e.expiresAt.toISOString()
-	})) });
-}), rt = (e, t) => C.gen(function* () {
-	return (yield* t.revokeSession(e.userId, e.sessionId)) ? I(200, {
-		ok: !0,
-		revoked: 1
-	}) : I(404, { error: "session_not_found" });
-}), it = (e, t) => C.gen(function* () {
-	return I(200, {
-		ok: !0,
-		revoked: yield* t.revokeAllOtherSessions(e.userId, e.keepSessionId)
-	});
-}), at = (e, t, n, i, o) => C.gen(function* () {
-	let s = yield* t.findById(e.userId);
-	if (!s) return I(404, { error: "user_not_found" });
-	let c = yield* t.listMemberships(s.id), l = c.find((t) => t.tenantId === e.targetTenantId)?.role ?? null;
-	if (l === null) return I(403, { error: "not a member of the target tenant" });
-	let u = e.metadata === void 0 ? void 0 : Object.fromEntries(Object.entries(e.metadata).filter(([e]) => e !== "memberships")), d = pe(p(s, { ...u === void 0 ? {} : { metadata: u } }), e.targetTenantId, c);
-	o !== void 0 && d.type === "user" && (yield* C.promise(() => ue(o, {
-		type: d.type,
-		id: d.id
-	}, e.targetTenantId)));
-	let f = e.sessionId ? Ve(d, e.sessionId) : d, m = a(f, F(n), {
-		ttlSeconds: Be,
-		...n.cookieDomain ? { domain: n.cookieDomain } : {},
-		secure: n.cookieSecure ?? !0
-	});
-	return e.clientId !== void 0 && i && i(e.clientId, { cookies: { [r]: m.value } }), I(200, {
-		ok: !0,
-		tenantId: e.targetTenantId,
-		role: l,
-		subject: f
-	}, { setCookie: m.setCookie });
-}), ot = (e, t) => C.gen(function* () {
-	return I(200, { memberships: (yield* t.listMemberships(e.userId)).map((e) => ({
-		tenantId: e.tenantId,
-		role: e.role,
-		joinedAt: e.joinedAt.toISOString()
-	})) });
-}), B = (e, t, n = {}) => ({
-	status: e,
-	body: JSON.stringify(t),
-	contentType: "application/json; charset=utf-8",
-	...n
-}), st = 604800, ct = () => {
-	let e = /* @__PURE__ */ new Map();
-	return {
-		put: (t, n, r) => C.sync(() => {
-			e.set(t, {
-				challenge: n,
-				expiresAt: Date.now() + r * 1e3
-			});
-		}),
-		take: (t) => C.sync(() => {
-			let n = e.get(t);
-			return e.delete(t), !n || n.expiresAt < Date.now() ? null : n.challenge;
-		})
-	};
-}, lt = (e) => ({
-	put: (t, n, r) => C.gen(function* () {
-		let i = /* @__PURE__ */ new Date(), a = new Date(i.getTime() + r * 1e3);
-		(yield* e`
-        UPDATE "passkeyChallenges"
-           SET challenge = ${n}, "expiresAt" = ${a}, "createdAt" = ${i}
-         WHERE key = ${t}
-        RETURNING key
-      `).length === 0 && (yield* e`
-          INSERT INTO "passkeyChallenges" (id, key, challenge, "expiresAt", "createdAt")
-          VALUES (${u("pkc")}, ${t}, ${n}, ${a}, ${i})
-        `);
-	}).pipe(C.asVoid, C.orElseSucceed(() => void 0)),
-	take: (t) => C.gen(function* () {
-		let n = (yield* e`
-        DELETE FROM "passkeyChallenges" WHERE key = ${t}
-        RETURNING challenge, "expiresAt"
-      `)[0];
-		return n && n.expiresAt.getTime() > Date.now() ? n.challenge : null;
-	}).pipe(C.orElseSucceed(() => null))
-}), V = 300, ut = (e, t, n, r) => C.gen(function* () {
-	if (!(yield* t.findById(e.userId))) return B(404, { error: "user_not_found" });
-	let i = b();
-	yield* n.put(`${e.userId}:register`, i, V);
-	let a = yield* t.listPasskeys(e.userId);
-	return B(200, {
-		challenge: i,
-		rp: {
-			id: r.rpId,
-			name: r.rpName
-		},
-		user: {
-			id: e.userId,
-			name: e.userName,
-			displayName: e.userName
-		},
-		pubKeyCredParams: [{
-			type: "public-key",
-			alg: -7
-		}, {
-			type: "public-key",
-			alg: -257
-		}],
-		excludeCredentials: a.map((e) => ({
-			type: "public-key",
-			id: e.credentialId
-		})),
-		authenticatorSelection: {
-			userVerification: "preferred",
-			residentKey: "preferred"
-		},
-		timeout: V * 1e3
-	});
-}), dt = (e, t, n, r) => C.gen(function* () {
-	if (!(yield* t.findById(e.userId))) return B(404, { error: "user_not_found" });
-	let i = yield* n.take(`${e.userId}:register`);
-	if (!i) return B(400, { error: "no_pending_challenge" });
-	let a = ne({
-		clientDataJSON: e.clientDataJSON,
-		authenticatorData: e.authenticatorData,
-		expectedChallenge: i,
-		expectedOrigin: r.origin,
-		rpId: r.rpId
-	});
-	return a.ok ? (yield* t.insertPasskey({
-		id: u("pk"),
-		credentialId: a.result.credentialId,
-		userId: e.userId,
-		publicKey: a.result.publicKey,
-		counter: a.result.counter,
-		transports: e.transports ?? null
-	}).pipe(C.ignore), B(200, {
-		ok: !0,
-		credentialId: a.result.credentialId
-	})) : B(400, { error: a.error });
-}), ft = (e, t, n, r) => C.gen(function* () {
-	let i = b(), a = e.userId ? `${e.userId}:assert` : "*:assert";
-	yield* n.put(a, i, V);
-	let o = e.userId ? (yield* t.listPasskeys(e.userId)).map((e) => ({
-		type: "public-key",
-		id: e.credentialId
-	})) : [];
-	return B(200, {
-		challenge: i,
-		rpId: r.rpId,
-		allowCredentials: o,
-		userVerification: "preferred",
-		timeout: V * 1e3
-	});
-}), pt = (e, t, n, r, i) => C.gen(function* () {
-	let o = yield* t.findPasskey(e.credentialId);
-	if (!o) return B(401, { error: "unknown_credential" });
-	let s = e.userId ? `${e.userId}:assert` : "*:assert", c = yield* n.take(s);
-	if (!c) return B(400, { error: "no_pending_challenge" });
-	let l = x({
-		clientDataJSON: e.clientDataJSON,
-		authenticatorData: e.authenticatorData,
-		signature: e.signature,
-		expectedChallenge: c,
-		expectedOrigin: r.origin,
-		rpId: r.rpId,
-		storedPublicKey: o.publicKey,
-		storedCounter: o.counter
-	});
-	if (!l.ok) return B(401, { error: l.error });
-	if (!(yield* t.advancePasskeyCounter(e.credentialId, l.result.newCounter)) && l.result.newCounter !== 0) return B(401, { error: "counter_regressed" });
-	let d = yield* t.findById(o.userId);
-	if (!d) return B(401, { error: "unknown_credential" });
-	let f = yield* z(d, i);
-	if (f) return f;
-	let m = yield* t.listMemberships(d.id), h = u("sess");
-	yield* t.insertSession({
-		id: h,
-		userId: d.id,
-		tenantId: d.tenantId,
-		expiresAt: new Date(Date.now() + st * 1e3),
-		ipAddress: null,
-		userAgent: null
-	}).pipe(C.ignore);
-	let g = p(d, { memberships: m }), _ = g.type === "user" ? {
-		...g,
-		metadata: {
-			...g.metadata ?? {},
-			sessionId: h
-		}
-	} : g, v = a(_, F(i), {
-		ttlSeconds: st,
-		...i.cookieDomain ? { domain: i.cookieDomain } : {},
-		secure: i.cookieSecure ?? !0
-	});
-	return B(200, {
-		ok: !0,
-		subject: _
-	}, { setCookie: v.setCookie });
-}), mt = 604800, ht = 500, H = [
-	"owner",
-	"admin",
-	"member",
-	"viewer"
-], gt = ["owner", "admin"], _t = (e, t) => t.indexOf(e), vt = (e, t = H) => {
-	let n = _t(e.inviterRole, t);
-	if (n < 0) return !1;
-	let r = _t(e.requestedRole, t);
-	return r < 0 ? n === 0 : r >= n;
-}, yt = (e) => {
-	let t = e?.roleRank ?? H;
-	return e?.canGrantRole ?? ((e) => vt(e, t));
-}, U = (e, t, n = {}) => ({
-	status: e,
-	body: JSON.stringify(t),
-	contentType: "application/json; charset=utf-8",
-	...n
-}), bt = (e, t, n) => `${e}${t}${t.includes("?") ? "&" : "?"}token=${encodeURIComponent(n)}`, xt = (e) => ({
-	id: e.id,
-	email: e.email,
-	tenantId: e.tenantId,
-	role: e.role,
-	invitedByUserId: e.invitedByUserId,
-	expiresAt: e.expiresAt.toISOString(),
-	acceptedAt: e.acceptedAt?.toISOString() ?? null,
-	revokedAt: e.revokedAt?.toISOString() ?? null,
-	createdAt: e.createdAt.toISOString()
-}), W = (e, t, n, r) => C.gen(function* () {
-	let i = yield* n.membershipRole(e, t);
-	return i === null || !(r?.inviterRoles ?? gt).includes(i) ? U(403, { error: "not_permitted" }) : { role: i };
-}), G = (e) => "status" in e, St = (e, t, n) => C.gen(function* () {
-	let r = e.email.trim().toLowerCase();
-	if (!r || !r.includes("@")) return U(400, { error: "a valid email is required" });
-	if (!e.tenantId) return U(400, { error: "tenantId required" });
-	if (!e.role) return U(400, { error: "role required" });
-	let i = n.invitations, a = yield* W(e.inviterUserId, e.tenantId, t, i);
-	if (G(a)) return a;
-	if (!yt(i)({
-		inviterRole: a.role,
-		requestedRole: e.role,
-		tenantId: e.tenantId
-	})) return U(403, {
-		error: "role_not_grantable",
-		message: `A '${a.role}' may not invite a '${e.role}'.`
-	});
-	let o = new Date((n.now ?? Date.now)());
-	if ((yield* t.countPendingInvitations(e.tenantId, o)) >= (i?.maxPending ?? 500)) return U(429, { error: "too_many_pending_invitations" });
-	yield* t.supersedePendingInvitations(e.tenantId, r, e.inviterUserId, o).pipe(C.ignore);
-	let s = i?.ttlSeconds ?? 604800, c = g(s), l = yield* t.insertInvitation({
-		id: u("inv"),
-		tokenHash: c.tokenHash,
-		email: r,
-		tenantId: e.tenantId,
-		role: e.role,
-		invitedByUserId: e.inviterUserId,
-		expiresAt: new Date(o.getTime() + s * 1e3)
-	});
-	if (n.sendEmail) {
-		let t = bt(n.appBaseUrl ?? "", i?.callbackPath ?? "/auth/invitations/accept", c.token);
-		yield* C.tryPromise(() => n.sendEmail({
-			to: r,
-			kind: "invitation",
-			actionUrl: t,
-			subject: "You have been invited",
-			text: `You have been invited to join as ${e.role}: ${t}`,
-			html: `<p>You have been invited to join as <strong>${e.role}</strong>. <a href="${t}">Accept the invitation</a> — this link expires.</p>`
-		})).pipe(C.ignore);
-	}
-	return U(201, {
-		ok: !0,
-		invitation: xt(l)
-	});
-}), Ct = (e, t, n) => C.gen(function* () {
-	let r = yield* W(e.callerUserId, e.tenantId, t, n.invitations);
-	return G(r) ? r : U(200, { invitations: (yield* t.listInvitations(e.tenantId)).map(xt) });
-}), wt = (e, t, n) => C.gen(function* () {
-	if (!e.invitationId) return U(400, { error: "invitationId required" });
-	let r = yield* W(e.callerUserId, e.tenantId, t, n.invitations);
-	if (G(r)) return r;
-	let i = new Date((n.now ?? Date.now)());
-	return (yield* t.revokeInvitation(e.invitationId, e.tenantId, e.callerUserId, i)) ? U(200, {
-		ok: !0,
-		revoked: 1
-	}) : U(404, { error: "invitation_not_found" });
-}), Tt = (e, t, n = {}) => C.gen(function* () {
-	if (!e.token) return U(400, { error: "token required" });
-	let r = yield* t.findInvitationByHash(h(e.token));
-	if (!r) return U(404, { error: "invalid_invitation" });
-	let i = new Date((n.now ?? Date.now)());
-	return U(200, {
-		ok: !0,
-		state: r.acceptedAt === null ? r.revokedAt === null ? r.expiresAt.getTime() <= i.getTime() ? "expired" : "pending" : "revoked" : "accepted",
-		email: r.email,
-		tenantId: r.tenantId,
-		role: r.role,
-		expiresAt: r.expiresAt.toISOString()
-	});
-}), Et = (e, t, n = {}) => C.gen(function* () {
-	if (!e.token) return U(400, { error: "token required" });
-	let r = h(e.token), i = new Date((n.now ?? Date.now)()), a = yield* t.findInvitationByHash(r);
-	if (!a) return U(401, { error: "invalid_or_expired_invitation" });
-	if (!e.userId) return U(401, {
-		error: "authentication_required",
-		email: a.email
-	});
-	let o = yield* t.findById(e.userId);
-	if (!o) return U(401, {
-		error: "authentication_required",
-		email: a.email
-	});
-	if (o.email.toLowerCase() !== a.email.toLowerCase()) return U(403, {
-		error: "invitation_email_mismatch",
-		message: "This invitation was issued to a different email address. Sign in as that address to accept it."
-	});
-	let s = yield* t.acceptInvitation(r, o.id, i);
-	if (!s) return U(401, { error: "invalid_or_expired_invitation" });
-	let c = yield* t.addMembership({
-		userId: o.id,
-		tenantId: s.tenantId,
-		role: s.role
-	});
-	return yield* t.markEmailVerified(o.id).pipe(C.ignore), U(200, {
-		ok: !0,
-		membership: {
-			tenantId: c.tenantId,
-			role: c.role,
-			joinedAt: c.joinedAt.toISOString()
-		}
-	});
-}), Dt = (e, t, n) => C.gen(function* () {
-	if (!e.token || !e.password) return U(400, { error: "token and password required" });
-	if (e.password.length < (n.minPasswordLength ?? 8)) return U(400, { error: "password must be at least 8 characters" });
-	let r = h(e.token), i = new Date((n.now ?? Date.now)()), a = yield* t.findInvitationByHash(r);
-	if (!a) return U(401, { error: "invalid_or_expired_invitation" });
-	if (yield* t.findByEmail(a.email)) return U(409, {
-		error: "account_exists",
-		message: "An account already exists for this address. Sign in, then accept the invitation."
-	});
-	let o = yield* n.hashPassword(e.password).pipe(C.orElseSucceed(() => ""));
-	if (!o) return U(500, { error: "hash_failed" });
-	let s = u("user"), c = yield* t.acceptInvitation(r, s, i);
-	if (!c) return U(401, { error: "invalid_or_expired_invitation" });
-	let l = yield* t.insert({
-		id: s,
-		email: c.email,
-		passwordHash: o,
-		tenantId: c.tenantId
-	}).pipe(C.orElseSucceed(() => null));
-	return l ? (yield* t.addMembership({
-		userId: l.id,
-		tenantId: c.tenantId,
-		role: c.role
-	}), yield* t.markEmailVerified(l.id).pipe(C.ignore), U(201, {
-		ok: !0,
-		userId: l.id,
-		tenantId: c.tenantId,
-		role: c.role
-	})) : U(409, { error: "account_exists" });
-}), Ot = 900, kt = [
-	"/mfa/enroll/start",
-	"/mfa/enroll/verify",
-	"/mfa/unenroll",
-	"/mfa/recovery-codes/regenerate",
-	"/passkey/register/options",
-	"/passkey/register/verify",
-	"/sessions/revoke-others",
-	"/switch-tenant",
-	"/impersonate/start"
-], At = (e) => {
-	if (typeof e != "object" || !e) return null;
-	let t = e;
-	return typeof t.actorUserId != "string" || t.actorUserId.length === 0 || typeof t.grantId != "string" || typeof t.expiresAt != "string" || typeof t.actorSessionId != "string" || typeof t.startedAt != "string" ? null : {
-		actorUserId: t.actorUserId,
-		actorSessionId: t.actorSessionId,
-		grantId: t.grantId,
-		startedAt: t.startedAt,
-		expiresAt: t.expiresAt,
-		...typeof t.reason == "string" ? { reason: t.reason } : {}
-	};
-}, K = (e) => e.type === "user" ? At(fe(e)) : null, q = (e) => K(e) !== null, jt = () => (e) => {
-	if (e.type !== "user" || e.metadata === void 0) return e;
-	let t = At(e.metadata[w]), { metadata: n, ...r } = e;
-	return {
-		...r,
-		metadata: t === null ? { __redacted: "all" } : {
-			__redacted: "all-except-impersonation",
-			[w]: t
-		}
-	};
-}, J = (e, t, n = {}) => ({
-	status: e,
-	body: JSON.stringify(t),
-	contentType: "application/json; charset=utf-8",
-	...n
-}), Y = (e, t) => C.suspend(() => {
-	let n = e.audit(t);
-	return n === void 0 ? C.void : C.isEffect(n) ? n : C.tryPromise({
-		try: () => Promise.resolve(n),
-		catch: (e) => e
-	});
-}).pipe(C.catchAllCause(() => C.void)), Mt = (e, t, n) => C.gen(function* () {
-	let r = n.impersonation, i = (n.now ?? Date.now)(), a = new Date(i), o = e.actorSubject, s = (t, n, i = {}) => Y(r, {
-		kind: "refused",
-		at: a,
-		actorUserId: i.actorUser?.id ?? (o.type === "user" ? o.id : null),
-		actorEmail: i.actorUser?.email ?? null,
-		targetUserId: i.target?.id ?? null,
-		targetEmail: i.target?.email ?? null,
-		tenantId: o.tenantId ?? null,
-		reason: e.reason ?? null,
-		refusal: n,
-		ipAddress: e.ipAddress ?? null,
-		userAgent: e.userAgent ?? null
-	}).pipe(C.as(J(t, {
-		error: n,
-		...i.message === void 0 ? {} : { message: i.message }
-	})));
-	if (o.type !== "user") return yield* s(401, "unauthenticated");
-	if (q(o)) return yield* s(403, "nested_impersonation", { message: "An impersonated session may not start another impersonation. Stop the current one first." });
-	if (!e.actorSessionId) return yield* s(400, "no_actor_session");
-	let c = yield* t.findById(o.id);
-	if (!c) return yield* s(401, "unauthenticated");
-	if (!e.targetUserId && !e.targetEmail) return yield* s(400, "target_required", { actorUser: c });
-	let l = e.targetUserId ? yield* t.findById(e.targetUserId) : yield* t.findByEmail(e.targetEmail);
-	if (!l) return yield* s(404, "target_not_found", { actorUser: c });
-	if (l.id === c.id) return yield* s(400, "self_impersonation", {
-		actorUser: c,
-		target: l
-	});
-	let d = e.reason?.trim() ?? "";
-	if ((r.requireReason ?? !0) && d.length === 0) return yield* s(400, "reason_required", {
-		actorUser: c,
-		target: l,
-		message: "A reason is required to impersonate a user."
-	});
-	if (!(yield* r.authority({
-		actor: o,
-		actorUser: c,
-		target: l
-	}).pipe(C.catchAllCause(() => C.succeed(!1))))) return yield* s(403, "not_permitted", {
-		actorUser: c,
-		target: l
-	});
-	if (yield* r.authority({
-		actor: p(l),
-		actorUser: l,
-		target: c
-	}).pipe(C.catchAllCause(() => C.succeed(!0)))) return yield* s(403, "target_may_impersonate", {
-		actorUser: c,
-		target: l,
-		message: "This user may themselves impersonate others and cannot be impersonated."
-	});
-	let f = r.maxDurationSeconds ?? 900, m = Math.max(1, Math.min(e.durationSeconds ?? f, f)), h = new Date(i + m * 1e3), g = u("sess"), _ = yield* t.insertImpersonationGrant({
-		id: u("imp"),
-		sessionId: g,
-		actorUserId: c.id,
-		actorSessionId: e.actorSessionId,
-		targetUserId: l.id,
-		tenantId: l.tenantId,
-		reason: d.length > 0 ? d : null,
-		expiresAt: h,
-		ipAddress: e.ipAddress ?? null,
-		userAgent: e.userAgent ?? null
-	}), v = {
-		actorUserId: c.id,
-		actorSessionId: e.actorSessionId,
-		grantId: _.id,
-		startedAt: _.startedAt.toISOString(),
-		expiresAt: h.toISOString(),
-		...d.length > 0 ? { reason: d } : {}
-	}, ee = yield* n.issuer.issue(l, {
-		sessionId: g,
-		ttlSeconds: m,
-		metadata: { [w]: v },
-		ipAddress: e.ipAddress ?? null,
-		userAgent: e.userAgent ?? null
-	});
-	return yield* Y(r, {
-		kind: "started",
-		at: a,
-		actorUserId: c.id,
-		actorEmail: c.email,
-		targetUserId: l.id,
-		targetEmail: l.email,
-		tenantId: l.tenantId,
-		sessionId: g,
-		grantId: _.id,
-		reason: d.length > 0 ? d : null,
-		expiresAt: h,
-		ipAddress: e.ipAddress ?? null,
-		userAgent: e.userAgent ?? null
-	}), J(200, {
-		ok: !0,
-		impersonation: v,
-		subject: ee.subject
-	}, { setCookie: ee.setCookie });
-}), Nt = (e, t, n) => C.gen(function* () {
-	let r = n.impersonation, i = (n.now ?? Date.now)(), a = new Date(i), o = K(e.subject);
-	if (!o || !e.sessionId) return J(400, { error: "not_impersonating" });
-	let s = yield* t.findImpersonationGrantBySession(e.sessionId);
-	yield* t.endImpersonationGrant(e.sessionId, "stopped", a).pipe(C.ignore), e.subject.type === "user" && (yield* t.revokeSession(e.subject.id, e.sessionId).pipe(C.ignore)), n.invalidateSession?.(e.sessionId);
-	let c = yield* t.findById(o.actorUserId), l = yield* t.findSession(o.actorSessionId), u = l ? Math.floor((l.expiresAt.getTime() - i) / 1e3) : 0;
-	if (yield* Y(r, {
-		kind: "stopped",
-		at: a,
-		actorUserId: o.actorUserId,
-		actorEmail: c?.email ?? null,
-		targetUserId: e.subject.type === "user" ? e.subject.id : null,
-		targetEmail: null,
-		tenantId: s?.tenantId ?? e.subject.tenantId ?? null,
-		sessionId: e.sessionId,
-		...s ? { grantId: s.id } : {},
-		reason: s?.reason ?? null
-	}), !c || !l || u <= 0) return J(200, {
-		ok: !0,
-		restored: !1
-	}, { setCookie: n.issuer.clear() });
-	let d = yield* n.issuer.reissue(c, {
-		sessionId: o.actorSessionId,
-		ttlSeconds: u
-	});
-	return J(200, {
-		ok: !0,
-		restored: !0,
-		subject: d.subject
-	}, { setCookie: d.setCookie });
-}), Pt = (e) => {
-	for (let t of e) if (Ft(t)) return t.auth.sessionStrategy;
-	return null;
-}, Ft = (e) => typeof e.auth == "object" && e.auth !== null && typeof e.auth.sessionStrategy == "object", It = "/auth", Lt = (e) => {
-	let t = Buffer.from(e.rawBody).toString("utf8");
-	if (!t) return {};
-	if ((e.headers["content-type"] ?? "").includes("application/x-www-form-urlencoded")) {
-		let e = new URLSearchParams(t), n = {};
-		for (let [t, r] of e) n[t] = r;
-		return n;
-	}
-	try {
-		let e = JSON.parse(t);
-		return typeof e == "object" && e ? e : {};
-	} catch {
-		return {};
-	}
-}, X = (e) => ({
-	status: e.status,
-	...e.body === void 0 ? {} : { body: e.body },
-	...e.contentType === void 0 ? {} : { contentType: e.contentType },
-	headers: {
-		...e.setCookie === void 0 ? {} : { "set-cookie": e.setCookie },
-		...e.location === void 0 ? {} : { location: e.location }
-	}
-}), Z = (e, t) => ({
-	status: e,
-	body: JSON.stringify(t),
-	contentType: "application/json; charset=utf-8"
-}), Q = (e) => typeof e == "string" ? e : void 0, $ = (e, t) => typeof t == "string" && t.length > 0 ? { [e]: t } : {}, Rt = (t) => {
-	let n = t.prefix ?? It, r = t.store, s = t.challengeStore ?? ct(), c = { current: void 0 }, l = {
-		...t.secret === void 0 ? {} : { secret: t.secret },
-		...t.secrets === void 0 ? {} : { secrets: t.secrets },
-		defaultTenantId: t.defaultTenantId,
-		...t.cookieDomain === void 0 ? {} : { cookieDomain: t.cookieDomain },
-		...t.cookieSecure === void 0 ? {} : { cookieSecure: t.cookieSecure },
-		...t.successRedirect === void 0 ? {} : { successRedirect: t.successRedirect },
-		...t.sendEmail === void 0 ? {} : { sendEmail: t.sendEmail },
-		...t.appBaseUrl === void 0 ? {} : { appBaseUrl: t.appBaseUrl },
-		subjectGuards: [...t.subjectGuards ?? [], ...A(t.emailVerification) ? [Me(t.emailVerification)] : []],
-		...t.lockout === void 0 ? {} : { lockout: t.lockout },
-		...t.now === void 0 ? {} : { now: t.now },
-		...t.emailVerification === void 0 ? {} : { emailVerification: t.emailVerification }
-	}, u = {
-		...t.appBaseUrl === void 0 ? {} : { appBaseUrl: t.appBaseUrl },
-		...t.sendEmail === void 0 ? {} : { sendEmail: t.sendEmail },
-		...t.invitations === void 0 ? {} : { invitations: t.invitations },
-		...t.now === void 0 ? {} : { now: t.now }
-	};
-	t.invitations !== void 0 && ce({
-		source: "plugin",
-		table: "invitations",
-		timeColumn: "createdAt",
-		ttlMs: le(process.env.VOLTRO_INVITATIONS_TTL_HOURS, 2160),
-		envVar: "VOLTRO_INVITATIONS_TTL_HOURS"
-	}), t.impersonation !== void 0 && ce({
-		source: "plugin",
-		table: "impersonationGrants",
-		timeColumn: "startedAt",
-		ttlMs: le(process.env.VOLTRO_IMPERSONATION_GRANTS_TTL_HOURS, 8760),
-		envVar: "VOLTRO_IMPERSONATION_GRANTS_TTL_HOURS"
-	});
-	let p = d(r, t.sessionRevocation ?? {}), h = async (e) => {
-		let t = F(l), n = o(e.headers.cookie, t);
-		if (!n) return null;
-		let i = f(n.subject);
-		if (i && !await C.runPromise(p.isLive(i))) return null;
-		if (n.renew || n.kid !== t.current.kid) {
-			let e = Math.max(n.exp - n.iat, 60), o = a(n.subject, t, {
-				ttlSeconds: e,
-				...l.cookieDomain ? { domain: l.cookieDomain } : {},
-				secure: l.cookieSecure ?? !0
-			});
-			return i && await C.runPromise(r.touchSession(i, new Date(Date.now() + e * 1e3))), {
-				subject: n.subject,
-				sessionId: i,
-				renewSetCookie: o.setCookie
-			};
-		}
-		return {
-			subject: n.subject,
-			sessionId: i
-		};
-	}, g = (e, t) => {
-		if (!t) return e;
-		let n = e.headers ?? {};
-		return n["set-cookie"] ? e : {
-			...e,
-			headers: {
-				...n,
-				"set-cookie": t
-			}
-		};
-	}, _ = (e) => {
-		let n = e.headers[ee], r = se(e.headers.cookie, v);
-		return te(n, r, ze(t));
-	}, y = (e, t) => e.path === `${n}${t}`, b = (e) => C.runPromise(e).then(X), x = {
-		issue: (e, t) => R(e, r, l, {
-			sessionId: t.sessionId,
-			ttlSeconds: t.ttlSeconds,
-			metadata: t.metadata,
-			ipAddress: t.ipAddress ?? null,
-			userAgent: t.userAgent ?? null,
-			clearLoginFailures: !1
-		}),
-		reissue: (e, t) => R(e, r, l, {
-			sessionId: t.sessionId,
-			ttlSeconds: t.ttlSeconds,
-			sessionRow: "existing",
-			clearLoginFailures: !1
-		}),
-		clear: () => i({
-			...l.cookieDomain ? { domain: l.cookieDomain } : {},
-			secure: l.cookieSecure ?? !0
-		})
-	}, ne = {
-		method: "*",
-		path: n,
-		handle: async (i) => {
-			let a = i.method === "GET" ? {} : Lt(i);
-			if (i.method === "GET" && y(i, "/csrf")) return X(Xe(l));
-			if (i.method === "POST" && y(i, "/sign-in")) return b(He({
-				email: Q(a.email) ?? "",
-				password: Q(a.password) ?? "",
-				...a.redirectAfter === void 0 ? {} : { redirectAfter: !!a.redirectAfter },
-				...i.remoteAddr ? { ipAddress: i.remoteAddr } : {},
-				...i.headers["user-agent"] ? { userAgent: i.headers["user-agent"] } : {}
-			}, r, l));
-			if (i.method === "POST" && y(i, "/sign-up")) return b(We({
-				email: Q(a.email) ?? "",
-				password: Q(a.password) ?? "",
-				...$("tenantId", a.tenantId),
-				...a.redirectAfter === void 0 ? {} : { redirectAfter: !!a.redirectAfter }
-			}, r, l));
-			if (i.method === "POST" && y(i, "/sign-out")) {
-				let e = await h(i);
-				return e && e.subject.type === "user" && e.sessionId && (await C.runPromise(r.revokeSession(e.subject.id, e.sessionId)), p.invalidate(e.sessionId)), X(Ge(l));
-			}
-			if (i.method === "POST" && y(i, "/magic-link")) return b(Qe({
-				email: Q(a.email) ?? "",
-				...$("callbackPath", a.callbackPath)
-			}, r, l));
-			if (i.method === "POST" && y(i, "/magic-link/callback")) return b($e({
-				token: Q(a.token) ?? "",
-				...a.redirectAfter === void 0 ? {} : { redirectAfter: !!a.redirectAfter }
-			}, r, l));
-			if (i.method === "POST" && y(i, "/password-reset")) return b(et({
-				email: Q(a.email) ?? "",
-				...$("callbackPath", a.callbackPath)
-			}, r, l));
-			if (i.method === "POST" && y(i, "/password-reset/confirm")) return b(tt({
-				token: Q(a.token) ?? "",
-				newPassword: Q(a.newPassword) ?? ""
-			}, r));
-			if (i.method === "POST" && y(i, "/verify-email")) {
-				let e = Q(a.email);
-				if (e) return b(P({ email: e }, r, l));
-				let t = await h(i);
-				return !t || t.subject.type !== "user" ? Z(400, { error: "email required" }) : b(P({ userId: t.subject.id }, r, l));
-			}
-			if (i.method === "POST" && y(i, "/verify-email/callback")) return b(Pe({ token: Q(a.token) ?? "" }, r));
-			if (t.invitations && i.method === "POST" && y(i, "/invitations/preview")) return b(Tt({ token: Q(a.token) ?? "" }, r, u));
-			if (t.invitations && i.method === "POST" && y(i, "/invitations/sign-up")) return b(Dt({
-				token: Q(a.token) ?? "",
-				password: Q(a.password) ?? ""
-			}, r, {
-				...u,
-				hashPassword: e
-			}));
-			if (i.method === "POST" && y(i, "/mfa/verify")) return b(Ue({
-				pendingToken: Q(a.pendingToken) ?? "",
-				...$("code", a.code),
-				...$("recoveryCode", a.recoveryCode),
-				...a.redirectAfter === void 0 ? {} : { redirectAfter: !!a.redirectAfter },
-				...i.remoteAddr ? { ipAddress: i.remoteAddr } : {},
-				...i.headers["user-agent"] ? { userAgent: i.headers["user-agent"] } : {}
-			}, r, l));
-			if (t.passkey && i.method === "POST" && y(i, "/passkey/assert/options")) return b(ft({ ...$("userId", a.userId) }, r, s, t.passkey));
-			if (t.passkey && i.method === "POST" && y(i, "/passkey/assert/verify")) return b(pt({
-				credentialId: Q(a.credentialId) ?? "",
-				clientDataJSON: Q(a.clientDataJSON) ?? "",
-				authenticatorData: Q(a.authenticatorData) ?? "",
-				signature: Q(a.signature) ?? "",
-				...$("userId", a.userId)
-			}, r, s, t.passkey, l));
-			let o = await h(i), d = o?.subject ?? null, f = () => !d || d.type !== "user" ? Z(401, { error: "unauthenticated" }) : { userId: d.id }, m = () => _(i) ? null : Z(403, { error: "csrf" }), v = (e) => b(e).then((e) => g(e, o?.renewSetCookie));
-			if (d && q(d)) {
-				let e = i.path.startsWith(n) ? i.path.slice(n.length) : "";
-				if (kt.includes(e)) return Z(403, {
-					error: "forbidden_while_impersonating",
-					message: "This action changes account credentials or session scope and is refused while impersonating. Stop the impersonation first."
-				});
-			}
-			if (i.method === "GET" && y(i, "/session")) {
-				let e = f();
-				return "status" in e ? e : g(Z(200, {
-					ok: !0,
-					subject: d,
-					renewed: o?.renewSetCookie !== void 0
-				}), o?.renewSetCookie);
-			}
-			if (i.method === "GET" && y(i, "/sessions")) {
-				let e = f();
-				return "status" in e ? e : v(nt({ userId: e.userId }, r));
-			}
-			if (i.method === "GET" && y(i, "/memberships")) {
-				let e = f();
-				return "status" in e ? e : v(ot({ userId: e.userId }, r));
-			}
-			if (i.method === "POST" && y(i, "/sessions/revoke")) {
-				let e = f();
-				if ("status" in e) return e;
-				let t = m();
-				if (t) return t;
-				let n = Q(a.sessionId) ?? "";
-				return v(rt({
-					userId: e.userId,
-					sessionId: n
-				}, r)).then((e) => (n && p.invalidate(n), e));
-			}
-			if (i.method === "POST" && y(i, "/sessions/revoke-others")) {
-				let e = f();
-				return "status" in e ? e : m() || v(it({
-					userId: e.userId,
-					keepSessionId: o?.sessionId ?? "__none__"
-				}, r));
-			}
-			if (t.invitations && i.method === "POST" && y(i, "/invitations")) {
-				let e = f();
-				return "status" in e ? e : m() || v(St({
-					inviterUserId: e.userId,
-					tenantId: Q(a.tenantId) ?? d?.tenantId ?? "",
-					email: Q(a.email) ?? "",
-					role: Q(a.role) ?? ""
-				}, r, u));
-			}
-			if (t.invitations && i.method === "GET" && i.path === `${n}/invitations`) {
-				let e = f();
-				return "status" in e ? e : v(Ct({
-					callerUserId: e.userId,
-					tenantId: d?.tenantId ?? ""
-				}, r, u));
-			}
-			if (t.invitations && i.method === "POST" && y(i, "/invitations/revoke")) {
-				let e = f();
-				return "status" in e ? e : m() || v(wt({
-					callerUserId: e.userId,
-					tenantId: Q(a.tenantId) ?? d?.tenantId ?? "",
-					invitationId: Q(a.invitationId) ?? ""
-				}, r, u));
-			}
-			if (t.invitations && i.method === "POST" && y(i, "/invitations/accept")) {
-				let e = f();
-				if (!("status" in e)) {
-					let e = m();
-					if (e) return e;
-				}
-				return v(Et({
-					token: Q(a.token) ?? "",
-					..."status" in e ? {} : { userId: e.userId }
-				}, r, u));
-			}
-			if (t.impersonation && i.method === "POST" && y(i, "/impersonate/start")) {
-				let e = f();
-				return "status" in e ? e : m() || b(Mt({
-					actorSubject: d,
-					actorSessionId: o?.sessionId ?? "",
-					...$("targetUserId", a.userId),
-					...$("targetEmail", a.email),
-					...$("reason", a.reason),
-					...typeof a.durationSeconds == "number" ? { durationSeconds: a.durationSeconds } : {},
-					ipAddress: i.remoteAddr ?? null,
-					userAgent: i.headers["user-agent"] ?? null
-				}, r, {
-					impersonation: t.impersonation,
-					issuer: x,
-					...t.now === void 0 ? {} : { now: t.now },
-					invalidateSession: (e) => p.invalidate(e)
-				}));
-			}
-			if (t.impersonation && i.method === "POST" && y(i, "/impersonate/stop")) {
-				let e = f();
-				return "status" in e ? e : m() || b(Nt({
-					subject: d,
-					sessionId: o?.sessionId ?? ""
-				}, r, {
-					impersonation: t.impersonation,
-					issuer: x,
-					...t.now === void 0 ? {} : { now: t.now },
-					invalidateSession: (e) => p.invalidate(e)
-				}));
-			}
-			if (i.method === "POST" && y(i, "/switch-tenant")) {
-				let e = f();
-				return "status" in e ? e : m() || b(at({
-					userId: e.userId,
-					targetTenantId: Q(a.targetTenantId) ?? "",
-					...typeof a.clientId == "number" ? { clientId: a.clientId } : {},
-					...o?.sessionId ? { sessionId: o.sessionId } : {},
-					...d?.type === "user" && d.metadata ? { metadata: d.metadata } : {}
-				}, r, l, t.rebind, c.current));
-			}
-			if (t.mfa && i.method === "POST" && y(i, "/mfa/enroll/start")) {
-				let e = f();
-				if ("status" in e) return e;
-				let n = m();
-				if (n) return n;
-				let i = await C.runPromise(r.findById(e.userId));
-				return v(Ke({
-					userId: e.userId,
-					issuer: t.mfa.issuer,
-					accountName: i?.email ?? e.userId
-				}, r));
-			}
-			if (t.mfa && i.method === "POST" && y(i, "/mfa/enroll/verify")) {
-				let e = f();
-				return "status" in e ? e : m() || v(qe({
-					userId: e.userId,
-					code: Q(a.code) ?? ""
-				}, r));
-			}
-			if (t.mfa && i.method === "POST" && y(i, "/mfa/unenroll")) {
-				let e = f();
-				return "status" in e ? e : m() || v(Ye({ userId: e.userId }, r));
-			}
-			if (t.mfa && i.method === "POST" && y(i, "/mfa/recovery-codes/regenerate")) {
-				let e = f();
-				return "status" in e ? e : m() || v(Je({ userId: e.userId }, r));
-			}
-			if (t.passkey && i.method === "POST" && y(i, "/passkey/register/options")) {
-				let e = f();
-				return "status" in e ? e : m() || v(ut({
-					userId: e.userId,
-					userName: Q(a.userName) ?? e.userId
-				}, r, s, t.passkey));
-			}
-			if (t.passkey && i.method === "POST" && y(i, "/passkey/register/verify")) {
-				let e = f();
-				return "status" in e ? e : m() || v(dt({
-					userId: e.userId,
-					credentialId: Q(a.credentialId) ?? "",
-					clientDataJSON: Q(a.clientDataJSON) ?? "",
-					authenticatorData: Q(a.authenticatorData) ?? "",
-					...$("transports", a.transports)
-				}, r, s, t.passkey));
-			}
-			return !t.passkey && i.path.startsWith(`${n}/passkey/`) ? Z(501, { error: "passkey_not_configured" }) : Z(404, { error: "not_found" });
-		}
-	}, re = de({
-		name: t.name ? `@voltro/plugin-auth#${t.name}` : "@voltro/plugin-auth",
-		description: "Auth routes — mounts the full auth surface (password, magic-link, password-reset, CSRF, session probe/list/revoke, memberships, switch-tenant, passkey ceremonies) under /auth on the framework listener, with keyed secret rotation + request-time revocation.",
-		permissions: [],
-		declaredEnv: zt,
-		httpRoutes: [ne],
-		bindDataStore: (e) => {
-			c.current = e;
-		},
-		onActivate: (e) => C.sync(() => {
-			e.logger.info("auth routes active", {
-				prefix: n,
-				passkey: t.passkey ? t.passkey.rpId : "disabled",
-				email: t.sendEmail ? "wired" : "unwired",
-				revocationWindowMs: p.ttlMs,
-				emailVerification: t.emailVerification?.policy ?? "off",
-				invitations: t.invitations ? "enabled" : "disabled",
-				impersonation: t.impersonation ? `enabled(max ${t.impersonation.maxDurationSeconds ?? 900}s)` : "disabled"
-			});
-		}),
-		onDeactivate: () => C.void
-	}), S = t.secrets ?? t.secret;
-	return {
-		...re,
-		auth: { sessionStrategy: m({
-			...S === void 0 ? {} : { secret: S },
-			store: r,
-			revocation: p
-		}) }
-	};
-}, zt = [
-	{
-		name: "VOLTRO_SESSION_SECRET_PREVIOUS",
-		required: !1,
-		secret: !0,
-		description: "The session secret being rotated AWAY from. While set, cookies signed with it still verify (and get re-issued under the current secret on the next authenticated /auth response). Set the new secret as VOLTRO_SESSION_SECRET, move the old one here for one session lifetime, then drop it.",
-		example: "the-previous-signing-secret"
-	},
-	{
-		name: "VOLTRO_SESSION_KID",
-		required: !1,
-		secret: !1,
-		description: "Non-secret key-id label stamped into cookies signed with the current secret (default 'k0').",
-		example: "2026-07"
-	},
-	{
-		name: "VOLTRO_SESSION_KID_PREVIOUS",
-		required: !1,
-		secret: !1,
-		description: "Non-secret key-id label for the previous secret (default 'k-previous').",
-		example: "2026-01"
-	},
-	{
-		name: "VOLTRO_INVITATIONS_TTL_HOURS",
-		required: !1,
-		secret: !1,
-		description: "How long an `invitations` row is kept before the retention sweep DELETES it. Default 2160 (90 days). Only armed when `invitations` is configured. Every invitation is dead long before this — the lifetime that decides redeemability is `invitations.ttlSeconds` (7 days by default) — so this bounds the history, not the grant.",
-		example: "2160"
-	},
-	{
-		name: "VOLTRO_IMPERSONATION_GRANTS_TTL_HOURS",
-		required: !1,
-		secret: !1,
-		description: "How long an `impersonationGrants` row is kept before the retention sweep DELETES it. Default 8760 (365 days), matching the audit log — this table answers \"who was acting as whom, when\", which is compliance evidence rather than operational state. Only armed when `impersonation` is configured. Raise it to your audit-retention obligation; lowering it shortens how far back an impersonation can be traced.",
-		example: "8760"
-	},
-	{
-		name: "VOLTRO_AUTH_SCOPE_CACHE_TTL_MS",
-		required: !1,
-		secret: !1,
-		description: "How long a resolved authority (auth.resolveScopes) stays cached, in milliseconds. Default 30000 — the same window as the session-revocation check, so the two per-request store reads expire together. This is the staleness window for a role change: remove a permission and every live session observes it within this long. Set it to 0 to resolve on every request (staleness zero, one store read per request). An explicit ttlMs in code wins over this variable.",
-		example: "30000"
-	}
-];
-//#endregion
-export { Pe as $, ot as A, et as B, pt as C, F as D, ct as E, qe as F, We as G, rt as H, Je as I, ke as J, at as K, Ye as L, $e as M, Qe as N, z as O, Ke as P, Me as Q, Ue as R, ft as S, dt as T, He as U, it as V, Ge as W, Oe as X, k as Y, A as Z, St as _, Mt as a, O as at, wt as b, K as c, Ee as ct, H as d, P as et, ht as f, Dt as g, Et as h, kt as i, E as it, nt as j, Xe as k, q as l, D as lt, vt as m, Pt as n, N as nt, Nt as o, De as ot, mt as p, R as q, Ot as r, j as rt, jt as s, Te as st, Rt as t, je as tt, gt as u, he as ut, Ct as v, ut as w, lt as x, Tt as y, tt as z };