@voltro/plugin-auth 0.81.0 → 0.83.0

package/dist/index.js

@@ -1,479 +1,89 @@
 import { PasswordEmptyError as e, PasswordHashError as t, hashPassword as n, needsRehash as r, parseScryptParams as i, verifyPassword as a, verifyPasswordWithRehash as o } from "./password.js";
-import { SESSION_COOKIE_NAME as s, clearSessionCookie as c, issueSession as l, readSession as u, readSessionKeyed as d, resolveSessionSecret as f, resolveSessionSecrets as p, sessionSecretsOf as m } from "./session.js";
-import { a as h, c as g, i as _, l as v, n as y, o as b, r as x, s as S, t as C } from "./strategy-MP_KxNuA.js";
-import { $ as w, A as T, B as E, C as D, D as O, E as k, F as A, G as j, H as M, I as N, J as P, K as F, L as I, M as L, N as R, O as z, P as B, Q as V, R as H, S as U, T as W, U as G, V as K, W as q, X as J, Y, Z as X, _ as Z, a as Q, at as ee, b as te, c as ne, ct as re, d as ie, et as ae, f as oe, g as se, h as ce, i as le, it as ue, j as de, k as fe, l as pe, lt as me, m as he, n as ge, nt as _e, o as ve, ot as ye, p as be, q as xe, r as Se, rt as Ce, s as we, st as Te, t as Ee, tt as De, u as Oe, ut as ke, v as Ae, w as je, x as Me, y as Ne, z as Pe } from "./plugin-DFQ8N52Q.js";
-import { EMAIL_VERIFY_TTL_S as Fe, MAGIC_LINK_TTL_S as Ie, MFA_PENDING_TTL_S as Le, PASSWORD_RESET_TTL_S as Re, hashToken as ze, mintSecret as Be, mintToken as Ve } from "./tokens.js";
-import { CSRF_COOKIE_NAME as He, CSRF_HEADER_NAME as Ue, isCsrfTokenWellFormed as We, issueCsrfToken as Ge, verifyCsrf as Ke } from "./csrf.js";
-import { generateChallenge as qe, verifyAssertion as Je, verifyRegistration as Ye } from "./webauthn.js";
-import { Effect as $ } from "effect";
-//#region src/memberships.ts
-var Xe = (e) => async (t) => t.type === "user" ? (await $.runPromise(e.listMemberships(t.id))).map((e) => ({
-	tenantId: e.tenantId,
-	role: e.role
-})) : [], Ze = (e) => {
-	let t = e?.code;
-	if (typeof t == "string") return t;
-	let n = e?.cause?.code;
-	return typeof n == "string" ? n : void 0;
-}, Qe = (e) => {
-	let t = e?.columns ?? {};
-	return {
-		table: e?.table ?? "users",
-		col: {
-			id: t.id ?? "id",
-			email: t.email ?? "email",
-			tenantId: t.tenantId ?? "tenantId",
-			createdAt: t.createdAt ?? "createdAt",
-			passwordHash: t.passwordHash ?? "passwordHash",
-			updatedAt: t.updatedAt ?? "updatedAt",
-			mfaSecret: t.mfaSecret ?? "mfaSecret",
-			mfaEnrolledAt: t.mfaEnrolledAt ?? "mfaEnrolledAt",
-			emailVerifiedAt: t.emailVerifiedAt ?? "emailVerifiedAt",
-			deactivatedAt: t.deactivatedAt ?? !1
-		}
-	};
-}, $e = (e, t = {}) => {
-	let n = Qe(t.identity), { col: r } = n, i = (t) => e`${e(r[t])}`, a = [
-		"id",
-		"email",
-		"passwordHash",
-		"tenantId",
-		"createdAt",
-		"mfaSecret",
-		"mfaEnrolledAt",
-		"emailVerifiedAt",
-		"deactivatedAt"
-	], o, s = () => o ??= {
-		usersTable: e.join(".", !1)(n.table.split(".").map((t) => e`${e(t)}`)),
-		selectList: e.csv(a.map((t) => r[t] === !1 ? e`NULL AS ${e(t)}` : e`${i(t)} AS ${e(t)}`))
-	}, c = (e, t) => /* @__PURE__ */ Error(`postgresUserStore: ${t} needs the "${e}" column, and identity.columns.${e} is false — this table has none`), l = (t) => r.updatedAt === !1 ? e`` : e`, ${i("updatedAt")} = ${t}`, u = (e) => ({
-		id: e.id,
-		email: e.email,
-		passwordHash: e.passwordHash,
-		tenantId: e.tenantId,
-		createdAt: e.createdAt,
-		mfaSecret: e.mfaSecret,
-		mfaEnrolledAt: e.mfaEnrolledAt,
-		emailVerifiedAt: e.emailVerifiedAt,
-		...r.deactivatedAt === !1 ? {} : { deactivatedAt: e.deactivatedAt ?? null }
-	}), d = (t) => $.gen(function* () {
-		let n = yield* e`
-        SELECT ${s().selectList} FROM ${s().usersTable}
-        WHERE ${i("email")} = ${t.toLowerCase()}
-        LIMIT 1
-      `;
-		return n[0] ? u(n[0]) : null;
-	}).pipe($.orElseSucceed(() => null)), f = (t) => $.gen(function* () {
-		let n = yield* e`
-        SELECT ${s().selectList} FROM ${s().usersTable}
-        WHERE ${i("id")} = ${t}
-        LIMIT 1
-      `;
-		return n[0] ? u(n[0]) : null;
-	}).pipe($.orElseSucceed(() => null)), p = (t) => $.gen(function* () {
-		let n = t.email.toLowerCase(), a = /* @__PURE__ */ new Date(), o = [
-			i("id"),
-			i("email"),
-			i("tenantId"),
-			i("createdAt")
-		], c = [
-			t.id,
-			n,
-			t.tenantId,
-			a
-		];
-		return r.passwordHash !== !1 && (o.push(i("passwordHash")), c.push(t.passwordHash ?? null)), r.updatedAt !== !1 && (o.push(i("updatedAt")), c.push(a)), yield* e`
-        INSERT INTO ${s().usersTable} (${e.csv(o)})
-        VALUES ${e.in(c)}
-      `.pipe($.map(() => ({
-			...t,
-			email: n,
-			createdAt: a
-		})), $.catchAll((e) => Ze(e) === "23505" ? $.fail(new y({ email: n })) : $.die(e)));
-	}), m = (t) => $.gen(function* () {
-		let n = (yield* e`
-        SELECT ${s().selectList} FROM ${s().usersTable} WHERE ${i("id")} = ${t} LIMIT 1
-      `)[0];
-		return n ? u(n) : yield* $.fail(new x({ userId: t }));
-	}).pipe($.catchTag("SqlError", (e) => $.die(e))), g = (t, n) => $.gen(function* () {
-		return r.passwordHash === !1 ? yield* $.die(c("passwordHash", "updatePassword")) : (yield* e`
-        UPDATE ${s().usersTable} SET ${i("passwordHash")} = ${n}${l(/* @__PURE__ */ new Date())}
-         WHERE ${i("id")} = ${t}
-      `.pipe($.catchTag("SqlError", (e) => $.die(e))), yield* m(t));
-	}), _ = (t, n) => $.gen(function* () {
-		return r.mfaSecret === !1 ? yield* $.die(c("mfaSecret", "setMfaSecret")) : r.mfaEnrolledAt === !1 ? yield* $.die(c("mfaEnrolledAt", "setMfaSecret")) : (yield* e`
-        UPDATE ${s().usersTable}
-           SET ${i("mfaSecret")} = ${n}, ${i("mfaEnrolledAt")} = ${null}
-         WHERE ${i("id")} = ${t}
-      `.pipe($.catchTag("SqlError", (e) => $.die(e))), yield* m(t));
-	}), v = (t) => $.gen(function* () {
-		return r.mfaEnrolledAt === !1 ? yield* $.die(c("mfaEnrolledAt", "markMfaEnrolled")) : (yield* e`
-        UPDATE ${s().usersTable}
-           SET ${i("mfaEnrolledAt")} = ${/* @__PURE__ */ new Date()}
-         WHERE ${i("id")} = ${t}
-      `.pipe($.catchTag("SqlError", (e) => $.die(e))), yield* m(t));
-	}), b = (t) => $.gen(function* () {
-		return r.mfaSecret === !1 ? yield* $.die(c("mfaSecret", "clearMfa")) : r.mfaEnrolledAt === !1 ? yield* $.die(c("mfaEnrolledAt", "clearMfa")) : (yield* e`
-        UPDATE ${s().usersTable}
-           SET ${i("mfaSecret")} = ${null}, ${i("mfaEnrolledAt")} = ${null}
-         WHERE ${i("id")} = ${t}
-      `.pipe($.catchTag("SqlError", (e) => $.die(e))), yield* m(t));
-	}), S = (t) => $.gen(function* () {
-		return r.emailVerifiedAt === !1 ? yield* $.die(c("emailVerifiedAt", "markEmailVerified")) : (yield* e`
-        UPDATE ${s().usersTable}
-           SET ${i("emailVerifiedAt")} = ${/* @__PURE__ */ new Date()}${l(/* @__PURE__ */ new Date())}
-         WHERE ${i("id")} = ${t} AND ${i("emailVerifiedAt")} IS NULL
-      `.pipe($.catchTag("SqlError", (e) => $.die(e))), yield* m(t));
-	}), C = (t) => $.gen(function* () {
-		return (yield* e`
-        SELECT "userId", "tenantId", role, "joinedAt"
-          FROM memberships WHERE "userId" = ${t}
-          ORDER BY "joinedAt" ASC
-      `).map((e) => ({ ...e }));
-	}).pipe($.orElseSucceed(() => [])), w = (t) => $.gen(function* () {
-		let n = /* @__PURE__ */ new Date();
-		yield* e`
-        UPDATE memberships SET role = ${t.role}
-         WHERE "userId" = ${t.userId} AND "tenantId" = ${t.tenantId}
-      `;
-		let r = yield* e`
-        SELECT "userId", "tenantId", role, "joinedAt"
-          FROM memberships
-         WHERE "userId" = ${t.userId} AND "tenantId" = ${t.tenantId}
-         LIMIT 1
-      `;
-		return r[0] ? { ...r[0] } : (yield* e`
-        INSERT INTO memberships (id, "userId", "tenantId", role, "joinedAt")
-        VALUES (${h("mem")}, ${t.userId}, ${t.tenantId}, ${t.role}, ${n})
-      `, {
-			...t,
-			joinedAt: n
-		});
-	}).pipe($.catchAll(() => $.succeed({
-		...t,
-		joinedAt: /* @__PURE__ */ new Date()
-	}))), T = (t, n) => $.gen(function* () {
-		return (yield* e`
-        SELECT role FROM memberships
-         WHERE "userId" = ${t} AND "tenantId" = ${n} LIMIT 1
-      `)[0]?.role ?? null;
-	}).pipe($.orElseSucceed(() => null)), E = (t) => $.gen(function* () {
-		return (yield* e`
-        SELECT id, "userId", "tenantId", "expiresAt", "ipAddress", "userAgent", "createdAt", "lastSeenAt"
-          FROM sessions WHERE "userId" = ${t}
-          ORDER BY "createdAt" DESC
-      `).map((e) => ({ ...e }));
-	}).pipe($.orElseSucceed(() => [])), D = (t) => $.gen(function* () {
-		let n = /* @__PURE__ */ new Date();
-		return yield* e`
-        INSERT INTO sessions (id, "userId", "tenantId", "expiresAt", "ipAddress", "userAgent", "createdAt", "lastSeenAt")
-        VALUES (
-          ${t.id}, ${t.userId}, ${t.tenantId}, ${t.expiresAt},
-          ${t.ipAddress ?? null}, ${t.userAgent ?? null}, ${n}, ${n}
-        )
-      `, {
+import { SESSION_COOKIE_NAME as ee, clearSessionCookie as te, issueSession as s, readSession as c, readSessionFromHeaders as ne, readSessionKeyed as re, resolveSessionSecret as ie, resolveSessionSecrets as ae, sessionSecretsOf as oe } from "./session.js";
+import { a as l, c as se, i as u, l as d, n as f, o as p, r as m, s as h, t as g } from "./strategy-XaGjSicX.js";
+import { $ as _, A as v, B as y, C as b, D as x, E as S, F as C, G as w, H as T, I as E, J as D, K as O, L as k, M as A, N as j, O as M, P as N, Q as P, R as F, S as I, T as L, U as R, V as z, W as B, X as V, Y as H, Z as U, _ as W, _t as G, a as K, at as ce, b as le, c as ue, ct as de, d as fe, dt as pe, et as me, f as he, ft as ge, g as _e, gt as ve, h as ye, ht as be, i as xe, it as Se, j as Ce, k as we, l as Te, lt as Ee, m as De, mt as Oe, n as ke, nt as Ae, o as je, ot as Me, p as Ne, pt as Pe, q as Fe, r as Ie, rt as Le, s as Re, st as ze, t as Be, tt as Ve, u as He, ut as Ue, v as We, vt as Ge, w as Ke, x as qe, y as Je, z as Ye } from "./plugin-CNW-X70p.js";
+import { EMAIL_VERIFY_TTL_S as Xe, MAGIC_LINK_TTL_S as Ze, MFA_PENDING_TTL_S as Qe, NATIVE_CODE_TTL_S as $e, PASSWORD_RESET_TTL_S as et, hashToken as tt, mintSecret as nt, mintToken as rt } from "./tokens.js";
+import { CSRF_COOKIE_NAME as it, CSRF_HEADER_NAME as at, isCsrfTokenWellFormed as ot, issueCsrfToken as st, verifyCsrf as q } from "./csrf.js";
+import { generateChallenge as ct, verifyAssertion as lt, verifyRegistration as ut } from "./webauthn.js";
+import { Effect as J } from "effect";
+import { eq as Y } from "@voltro/database";
+//#region src/sessionRegistry.ts
+var X = "sessions", dt = 604800, Z = (e) => ({
+	...e,
+	expiresAt: new Date(e.expiresAt),
+	createdAt: new Date(e.createdAt),
+	lastSeenAt: new Date(e.lastSeenAt)
+}), Q = async (e, t) => await e.query({
+	table: X,
+	predicate: t,
+	order: [],
+	take: void 0,
+	skip: void 0,
+	projection: void 0
+}), ft = (e) => ({
+	listSessions: (t) => J.promise(async () => (await Q(e, Y("userId", t))).map(Z).sort((e, t) => t.createdAt.getTime() - e.createdAt.getTime())),
+	insertSession: (t) => J.promise(async () => {
+		let n = /* @__PURE__ */ new Date(), r = {
 			...t,
 			createdAt: n,
 			lastSeenAt: n
 		};
-	}).pipe($.catchAll(() => $.succeed({
-		...t,
-		createdAt: /* @__PURE__ */ new Date(),
-		lastSeenAt: /* @__PURE__ */ new Date()
-	}))), O = (t) => $.gen(function* () {
-		let n = yield* e`
-        SELECT id, "userId", "tenantId", "expiresAt", "ipAddress", "userAgent", "createdAt", "lastSeenAt"
-          FROM sessions WHERE id = ${t} LIMIT 1
-      `;
-		return n[0] ? { ...n[0] } : null;
-	}).pipe($.orElseSucceed(() => null)), k = (t, n) => $.gen(function* () {
-		yield* e`
-        UPDATE sessions SET "expiresAt" = ${n}, "lastSeenAt" = ${/* @__PURE__ */ new Date()}
-         WHERE id = ${t}
-      `;
-	}).pipe($.asVoid, $.orElseSucceed(() => void 0)), A = (t, n) => $.gen(function* () {
-		return (yield* e`
-        DELETE FROM sessions WHERE id = ${n} AND "userId" = ${t}
-        RETURNING id
-      `).length > 0;
-	}).pipe($.orElseSucceed(() => !1)), j = (t, n) => $.gen(function* () {
-		return (yield* e`
-        DELETE FROM sessions WHERE "userId" = ${t} AND id <> ${n}
-        RETURNING id
-      `).length;
-	}).pipe($.orElseSucceed(() => 0)), M = (t) => $.gen(function* () {
-		let n = /* @__PURE__ */ new Date();
-		return yield* e`
-        INSERT INTO "authTokens" (id, "tokenHash", "userId", purpose, "expiresAt", "consumedAt", "createdAt")
-        VALUES (${t.id}, ${t.tokenHash}, ${t.userId}, ${t.purpose}, ${t.expiresAt}, ${null}, ${n})
-      `, {
-			...t,
-			consumedAt: null,
-			createdAt: n
-		};
-	}).pipe($.catchAll(() => $.succeed({
-		...t,
-		consumedAt: null,
-		createdAt: /* @__PURE__ */ new Date()
-	}))), N = (t, n) => $.gen(function* () {
-		let r = yield* e`
-        UPDATE "authTokens"
-           SET "consumedAt" = ${/* @__PURE__ */ new Date()}
-         WHERE "tokenHash" = ${t}
-           AND purpose = ${n}
-           AND "consumedAt" IS NULL
-           AND "expiresAt" > ${/* @__PURE__ */ new Date()}
-        RETURNING id, "tokenHash", "userId", purpose, "expiresAt", "consumedAt", "createdAt"
-      `;
-		return r[0] ? { ...r[0] } : null;
-	}).pipe($.orElseSucceed(() => null)), P = (t, n) => $.gen(function* () {
-		let r = yield* e`
-        SELECT id, "tokenHash", "userId", purpose, "expiresAt", "consumedAt", "createdAt"
-          FROM "authTokens"
-         WHERE "userId" = ${t} AND purpose = ${n}
-         ORDER BY "createdAt" DESC
-         LIMIT 1
-      `;
-		return r[0] ? { ...r[0] } : null;
-	}).pipe($.orElseSucceed(() => null)), F = (t) => $.gen(function* () {
-		let n = /* @__PURE__ */ new Date(), r = t.email.toLowerCase();
-		return yield* e`
-        INSERT INTO invitations (
-          id, "tokenHash", email, "tenantId", role, "invitedByUserId",
-          "expiresAt", "acceptedAt", "acceptedByUserId", "revokedAt", "revokedByUserId", "createdAt"
-        ) VALUES (
-          ${t.id}, ${t.tokenHash}, ${r}, ${t.tenantId},
-          ${t.role}, ${t.invitedByUserId}, ${t.expiresAt},
-          ${null}, ${null}, ${null}, ${null}, ${n}
-        )
-      `, {
-			...t,
-			email: r,
-			acceptedAt: null,
-			acceptedByUserId: null,
-			revokedAt: null,
-			revokedByUserId: null,
-			createdAt: n
-		};
-	}).pipe($.catchAll((e) => $.die(e))), I = (t) => $.gen(function* () {
-		let n = yield* e`
-        SELECT id, "tokenHash", email, "tenantId", role, "invitedByUserId", "expiresAt",
-               "acceptedAt", "acceptedByUserId", "revokedAt", "revokedByUserId", "createdAt"
-          FROM invitations WHERE "tokenHash" = ${t} LIMIT 1
-      `;
-		return n[0] ? { ...n[0] } : null;
-	}).pipe($.orElseSucceed(() => null)), L = (t, n, r) => $.gen(function* () {
-		let i = yield* e`
-        UPDATE invitations
-           SET "acceptedAt" = ${r}, "acceptedByUserId" = ${n}
-         WHERE "tokenHash" = ${t}
-           AND "acceptedAt" IS NULL
-           AND "revokedAt" IS NULL
-           AND "expiresAt" > ${r}
-        RETURNING id, "tokenHash", email, "tenantId", role, "invitedByUserId", "expiresAt",
-                  "acceptedAt", "acceptedByUserId", "revokedAt", "revokedByUserId", "createdAt"
-      `;
-		return i[0] ? { ...i[0] } : null;
-	}).pipe($.catchAll((e) => $.die(e))), R = (t, n, r, i) => $.gen(function* () {
-		return (yield* e`
-        UPDATE invitations
-           SET "revokedAt" = ${i}, "revokedByUserId" = ${r}
-         WHERE id = ${t}
-           AND "tenantId" = ${n}
-           AND "acceptedAt" IS NULL
-           AND "revokedAt" IS NULL
-        RETURNING id
-      `).length > 0;
-	}).pipe($.catchAll((e) => $.die(e))), z = (t) => $.gen(function* () {
-		return (yield* e`
-        SELECT id, "tokenHash", email, "tenantId", role, "invitedByUserId", "expiresAt",
-               "acceptedAt", "acceptedByUserId", "revokedAt", "revokedByUserId", "createdAt"
-          FROM invitations WHERE "tenantId" = ${t}
-          ORDER BY "createdAt" DESC
-      `).map((e) => ({ ...e }));
-	}).pipe($.orElseSucceed(() => [])), B = (t, n) => $.gen(function* () {
-		return (yield* e`
-        SELECT COUNT(*)::int AS n FROM invitations
-         WHERE "tenantId" = ${t}
-           AND "acceptedAt" IS NULL AND "revokedAt" IS NULL AND "expiresAt" > ${n}
-      `)[0]?.n ?? 0;
-	}).pipe($.catchAll((e) => $.die(e))), V = (t, n, r, i) => $.gen(function* () {
-		return (yield* e`
-        UPDATE invitations
-           SET "revokedAt" = ${i}, "revokedByUserId" = ${r}
-         WHERE "tenantId" = ${t}
-           AND email = ${n.toLowerCase()}
-           AND "acceptedAt" IS NULL
-           AND "revokedAt" IS NULL
-        RETURNING id
-      `).length;
-	}).pipe($.catchAll((e) => $.die(e))), H = (t) => $.gen(function* () {
-		let n = /* @__PURE__ */ new Date();
-		return yield* e`
-        INSERT INTO "impersonationGrants" (
-          id, "sessionId", "actorUserId", "actorSessionId", "targetUserId", "tenantId",
-          reason, "startedAt", "expiresAt", "endedAt", "endedReason", "ipAddress", "userAgent"
-        ) VALUES (
-          ${t.id}, ${t.sessionId}, ${t.actorUserId}, ${t.actorSessionId},
-          ${t.targetUserId}, ${t.tenantId}, ${t.reason ?? null}, ${n},
-          ${t.expiresAt}, ${null}, ${null}, ${t.ipAddress ?? null}, ${t.userAgent ?? null}
-        )
-      `, {
-			...t,
-			startedAt: n,
-			endedAt: null,
-			endedReason: null
-		};
-	}).pipe($.catchAll((e) => $.die(e))), U = (t) => $.gen(function* () {
-		let n = yield* e`
-        SELECT id, "sessionId", "actorUserId", "actorSessionId", "targetUserId", "tenantId",
-               reason, "startedAt", "expiresAt", "endedAt", "endedReason", "ipAddress", "userAgent"
-          FROM "impersonationGrants" WHERE "sessionId" = ${t} LIMIT 1
-      `;
-		return n[0] ? { ...n[0] } : null;
-	}).pipe($.orElseSucceed(() => null)), W = (t, n, r) => $.gen(function* () {
-		return (yield* e`
-        UPDATE "impersonationGrants"
-           SET "endedAt" = ${r}, "endedReason" = ${n}
-         WHERE "sessionId" = ${t} AND "endedAt" IS NULL
-        RETURNING id
-      `).length > 0;
-	}).pipe($.catchAll((e) => $.die(e))), G = (t) => $.gen(function* () {
-		return (yield* e`
-        SELECT id, "credentialId", "userId", "publicKey", counter, transports, "createdAt", "lastUsedAt"
-          FROM passkeys WHERE "userId" = ${t}
-      `).map((e) => ({ ...e }));
-	}).pipe($.orElseSucceed(() => [])), K = (t) => $.gen(function* () {
-		let n = yield* e`
-        SELECT id, "credentialId", "userId", "publicKey", counter, transports, "createdAt", "lastUsedAt"
-          FROM passkeys WHERE "credentialId" = ${t} LIMIT 1
-      `;
-		return n[0] ? { ...n[0] } : null;
-	}).pipe($.orElseSucceed(() => null)), q = (t) => $.gen(function* () {
-		let n = /* @__PURE__ */ new Date();
-		return yield* e`
-        INSERT INTO passkeys (id, "credentialId", "userId", "publicKey", counter, transports, "createdAt", "lastUsedAt")
-        VALUES (
-          ${t.id}, ${t.credentialId}, ${t.userId}, ${t.publicKey},
-          ${t.counter}, ${t.transports ?? null}, ${n}, ${null}
-        )
-      `, {
-			...t,
-			createdAt: n,
-			lastUsedAt: null
-		};
-	}).pipe($.catchAll(() => $.succeed({
-		...t,
-		createdAt: /* @__PURE__ */ new Date(),
-		lastUsedAt: null
-	}))), J = (t, n) => $.gen(function* () {
-		return (yield* e`
-        UPDATE passkeys
-           SET counter = ${n}, "lastUsedAt" = ${/* @__PURE__ */ new Date()}
-         WHERE "credentialId" = ${t}
-           AND counter < ${n}
-        RETURNING id
-      `).length > 0;
-	}).pipe($.orElseSucceed(() => !1)), Y = (t, n) => $.gen(function* () {
-		let r = /* @__PURE__ */ new Date();
-		yield* e`DELETE FROM "recoveryCodes" WHERE "userId" = ${t}`;
-		for (let i of n) yield* e`
-          INSERT INTO "recoveryCodes" (id, "userId", "codeHash", "consumedAt", "createdAt")
-          VALUES (${h("rc")}, ${t}, ${i}, ${null}, ${r})
-        `;
-	}).pipe($.asVoid, $.orElseSucceed(() => void 0)), X = (t, n) => $.gen(function* () {
-		return (yield* e`
-        UPDATE "recoveryCodes"
-           SET "consumedAt" = ${/* @__PURE__ */ new Date()}
-         WHERE "userId" = ${t}
-           AND "codeHash" = ${n}
-           AND "consumedAt" IS NULL
-        RETURNING id
-      `).length > 0;
-	}).pipe($.orElseSucceed(() => !1)), Z = (t) => $.gen(function* () {
-		return (yield* e`
-        SELECT COUNT(*)::int AS n FROM "recoveryCodes"
-         WHERE "userId" = ${t} AND "consumedAt" IS NULL
-      `)[0]?.n ?? 0;
-	}).pipe($.orElseSucceed(() => 0)), Q = (e, t) => $.catchAll((n) => $.logWarning(`[auth] lockout ${e} failed — brute-force protection is not counting`).pipe($.annotateLogs("cause", String(n)), $.as(t)));
+		return await e.insert(X, r), r;
+	}),
+	findSession: (t) => J.promise(async () => {
+		let n = (await Q(e, Y("id", t)))[0];
+		return n === void 0 ? null : Z(n);
+	}),
+	touchSession: (t, n) => J.promise(async () => {
+		await e.update(X, t, {
+			expiresAt: n,
+			lastSeenAt: /* @__PURE__ */ new Date()
+		});
+	}),
+	revokeSession: (t, n) => J.promise(async () => {
+		let r = (await Q(e, Y("id", n)))[0];
+		return r === void 0 || r.userId !== t ? !1 : e.delete(X, n);
+	}),
+	revokeAllOtherSessions: (t, n) => J.promise(async () => {
+		let r = 0;
+		for (let i of await Q(e, Y("userId", t))) i.id !== n && await e.delete(X, i.id) && (r += 1);
+		return r;
+	}),
+	revokeAllSessions: (t) => J.promise(async () => {
+		let n = 0;
+		for (let r of await Q(e, Y("userId", t))) await e.delete(X, r.id) && (n += 1);
+		return n;
+	})
+}), $ = (e, t) => e.type === "user" ? {
+	...e,
+	metadata: {
+		...e.metadata ?? {},
+		sessionId: t
+	}
+} : e, pt = async (e, t, n, r = {}) => {
+	if (t.type !== "user") throw Error("issueRegisteredSession: only a user subject has a session row");
+	let i = l("sess"), a = r.ttlSeconds ?? dt, o = (r.now ?? Date.now)();
+	await J.runPromise(e.insertSession({
+		id: i,
+		userId: t.id,
+		tenantId: t.tenantId ?? "",
+		expiresAt: new Date(o + a * 1e3),
+		ipAddress: r.ipAddress ?? null,
+		userAgent: r.userAgent ?? null
+	}));
+	let { ipAddress: ee, userAgent: te, ...c } = r;
 	return {
-		findByEmail: d,
-		findById: f,
-		insert: p,
-		updatePassword: g,
-		setMfaSecret: _,
-		markMfaEnrolled: v,
-		clearMfa: b,
-		markEmailVerified: S,
-		listMemberships: C,
-		addMembership: w,
-		membershipRole: T,
-		listSessions: E,
-		insertSession: D,
-		findSession: O,
-		touchSession: k,
-		revokeSession: A,
-		revokeAllOtherSessions: j,
-		insertToken: M,
-		consumeToken: N,
-		latestToken: P,
-		insertInvitation: F,
-		findInvitationByHash: I,
-		acceptInvitation: L,
-		revokeInvitation: R,
-		listInvitations: z,
-		countPendingInvitations: B,
-		supersedePendingInvitations: V,
-		insertImpersonationGrant: H,
-		findImpersonationGrantBySession: U,
-		endImpersonationGrant: W,
-		replaceRecoveryCodes: Y,
-		consumeRecoveryCode: X,
-		countRecoveryCodes: Z,
-		listPasskeys: G,
-		findPasskey: K,
-		insertPasskey: q,
-		advancePasskeyCounter: J,
-		isLockedOut: (t, n) => $.gen(function* () {
-			let r = (yield* e`
-        SELECT "lockedUntil" FROM "loginAttempts"
-         WHERE email = ${t.toLowerCase()} LIMIT 1
-      `)[0]?.lockedUntil ?? null;
-			return r != null && n < r.getTime() ? {
-				locked: !0,
-				retryAfterSeconds: Math.ceil((r.getTime() - n) / 1e3)
-			} : {
-				locked: !1,
-				retryAfterSeconds: 0
-			};
-		}).pipe(Q("read", {
-			locked: !1,
-			retryAfterSeconds: 0
-		})),
-		recordLoginFailure: (t, n, r) => $.gen(function* () {
-			let i = t.toLowerCase(), a = (yield* e`
-        SELECT "failedCount", "windowStartedAt", "lockedUntil"
-          FROM "loginAttempts" WHERE email = ${i} LIMIT 1
-      `)[0], o = a?.windowStartedAt?.getTime() ?? null, s = a?.lockedUntil?.getTime() ?? null, c = o == null || n - o >= r.windowMs, l = !a || c || s != null && n >= s, u = l ? 1 : a.failedCount + 1, d = l ? new Date(n) : new Date(o), f = u >= r.maxAttempts ? new Date(n + r.lockMs) : null, p = new Date(n);
-			yield* e`
-        INSERT INTO "loginAttempts" (id, email, "failedCount", "windowStartedAt", "lockedUntil", "createdAt", "updatedAt")
-        VALUES (${h("la")}, ${i}, ${u}, ${d}, ${f}, ${p}, ${p})
-        ON CONFLICT (email) DO UPDATE SET
-          "failedCount" = ${u},
-          "windowStartedAt" = ${d},
-          "lockedUntil" = ${f},
-          "updatedAt" = ${p}
-      `;
-		}).pipe($.asVoid, Q("record", void 0)),
-		clearLoginFailures: (t) => $.gen(function* () {
-			yield* e`DELETE FROM "loginAttempts" WHERE email = ${t.toLowerCase()}`;
-		}).pipe($.asVoid, Q("clear", void 0))
+		...s($(t, i), n, c),
+		sessionId: i
 	};
-}, et = (e) => (t) => $.runPromise(e.send({
+}, mt = (e) => async (t) => t.type === "user" ? (await J.runPromise(e.listMemberships(t.id))).map((e) => ({
+	tenantId: e.tenantId,
+	role: e.role
+})) : [], ht = (e) => (t) => J.runPromise(e.send({
 	to: t.to,
 	subject: t.subject,
 	html: t.html,
 	text: t.text
-}).pipe($.asVoid, $.orElseSucceed(() => void 0)));
+}).pipe(J.asVoid, J.orElseSucceed(() => void 0)));
 //#endregion
-export { He as CSRF_COOKIE_NAME, Ue as CSRF_HEADER_NAME, Oe as DEFAULT_INVITER_ROLES, ie as DEFAULT_ROLE_RANK, P as EMAIL_NOT_VERIFIED_CODE, Y as EMAIL_VERIFIED_METADATA_KEY, J as EMAIL_VERIFY_RESEND_COOLDOWN_S, Fe as EMAIL_VERIFY_TTL_S, Se as IMPERSONATION_DEFAULT_DURATION_S, le as IMPERSONATION_FORBIDDEN_SUBPATHS, oe as INVITATION_MAX_PENDING, be as INVITATION_TTL_S, Ie as MAGIC_LINK_TTL_S, Le as MFA_PENDING_TTL_S, Re as PASSWORD_RESET_TTL_S, e as PasswordEmptyError, t as PasswordHashError, s as SESSION_COOKIE_NAME, ue as TotpVerifyError, y as UserAlreadyExistsError, x as UserNotFoundError, Xe as authMemberships, Ee as authRoutesPlugin, c as clearSessionCookie, O as configSessionSecrets, Me as dataStoreChallengeStore, he as defaultCanGrantRole, X as emailVerificationActive, V as emailVerificationGuard, qe as generateChallenge, ee as generateRecoveryCodes, ye as generateTotpCode, Te as generateTotpSecret, ge as getAuthSessionStrategy, z as guardSubject, ce as handleAcceptInvitation, se as handleAcceptInvitationWithSignUp, Z as handleCreateInvitation, fe as handleCsrf, w as handleEmailVerifyConfirm, ae as handleEmailVerifyRequest, Q as handleImpersonationStart, ve as handleImpersonationStop, Ae as handleListInvitations, T as handleListMemberships, de as handleListSessions, L as handleMagicLinkConsume, R as handleMagicLinkRequest, B as handleMfaEnrollStart, A as handleMfaEnrollVerify, N as handleMfaRegenerateRecoveryCodes, I as handleMfaUnenroll, H as handleMfaVerify, U as handlePasskeyAssertOptions, D as handlePasskeyAssertVerify, je as handlePasskeyRegisterOptions, W as handlePasskeyRegisterVerify, Pe as handlePasswordResetConfirm, E as handlePasswordResetRequest, Ne as handlePreviewInvitation, K as handleRevokeAllOtherSessions, te as handleRevokeInvitation, M as handleRevokeSession, G as handleSignIn, q as handleSignOut, j as handleSignUp, F as handleSwitchTenant, n as hashPassword, ze as hashToken, we as impersonationAuditRedactor, ne as impersonationOf, We as isCsrfTokenWellFormed, De as isEmailVerified, pe as isImpersonated, Ge as issueCsrfToken, l as issueSession, xe as issueUserSession, et as mailSender, v as makeSessionRevocationChecker, k as memoryChallengeStore, _ as memoryUserStore, Be as mintSecret, Ve as mintToken, r as needsRehash, h as newAuthId, re as otpauthUrl, i as parseScryptParams, $e as postgresUserStore, u as readSession, d as readSessionKeyed, f as resolveSessionSecret, p as resolveSessionSecrets, ke as runSubjectGuards, _e as sendEmailVerification, b as sessionIdOfSubject, m as sessionSecretsOf, S as subjectFromUser, g as subjectMemberships, Ce as userEmailVerified, Je as verifyAssertion, Ke as verifyCsrf, a as verifyPassword, o as verifyPasswordWithRehash, Ye as verifyRegistration, me as verifyTotpCode, C as voltroPasswordStrategy };
+export { it as CSRF_COOKIE_NAME, at as CSRF_HEADER_NAME, _e as DEFAULT_INVITER_ROLES, W as DEFAULT_ROLE_RANK, me as EMAIL_NOT_VERIFIED_CODE, Ve as EMAIL_VERIFIED_METADATA_KEY, Ae as EMAIL_VERIFY_RESEND_COOLDOWN_S, Xe as EMAIL_VERIFY_TTL_S, Te as IMPERSONATION_DEFAULT_DURATION_S, He as IMPERSONATION_FORBIDDEN_SUBPATHS, We as INVITATION_MAX_PENDING, Je as INVITATION_TTL_S, Ze as MAGIC_LINK_TTL_S, Qe as MFA_PENDING_TTL_S, $e as NATIVE_CODE_TTL_S, Ie as NATIVE_PENDING_COOKIE, et as PASSWORD_RESET_TTL_S, e as PasswordEmptyError, t as PasswordHashError, ee as SESSION_COOKIE_NAME, Ue as TotpVerifyError, f as UserAlreadyExistsError, m as UserNotFoundError, G as appUserStore, mt as authMemberships, Be as authRoutesPlugin, te as clearSessionCookie, j as configSessionSecrets, x as dataStoreChallengeStore, ft as dataStoreSessionRegistry, le as defaultCanGrantRole, Le as emailVerificationActive, Se as emailVerificationGuard, ct as generateChallenge, pe as generateRecoveryCodes, ge as generateTotpCode, Pe as generateTotpSecret, ke as getAuthSessionStrategy, N as guardSubject, qe as handleAcceptInvitation, I as handleAcceptInvitationWithSignUp, b as handleCreateInvitation, C as handleCsrf, ce as handleEmailVerifyConfirm, Me as handleEmailVerifyRequest, fe as handleImpersonationStart, he as handleImpersonationStop, Ke as handleListInvitations, E as handleListMemberships, k as handleListSessions, F as handleMagicLinkConsume, Ye as handleMagicLinkRequest, y as handleMfaEnrollStart, z as handleMfaEnrollVerify, T as handleMfaRegenerateRecoveryCodes, R as handleMfaUnenroll, B as handleMfaVerify, xe as handleNativeAuthorize, K as handleNativeComplete, je as handleNativeExchange, M as handlePasskeyAssertOptions, we as handlePasskeyAssertVerify, v as handlePasskeyRegisterOptions, Ce as handlePasskeyRegisterVerify, w as handlePasswordResetConfirm, O as handlePasswordResetRequest, L as handlePreviewInvitation, Fe as handleRevokeAllOtherSessions, S as handleRevokeInvitation, D as handleRevokeSession, H as handleSignIn, V as handleSignOut, U as handleSignUp, P as handleSwitchTenant, n as hashPassword, tt as hashToken, Ne as impersonationAuditRedactor, De as impersonationOf, Re as isAllowedRedirectUri, ot as isCsrfTokenWellFormed, ze as isEmailVerified, ye as isImpersonated, st as issueCsrfToken, pt as issueRegisteredSession, s as issueSession, _ as issueUserSession, ht as mailSender, d as makeSessionRevocationChecker, A as memoryChallengeStore, u as memoryUserStore, nt as mintSecret, rt as mintToken, ue as nativeLoginRedirect, r as needsRehash, l as newAuthId, Oe as otpauthUrl, i as parseScryptParams, Ge as postgresUserStore, c as readSession, ne as readSessionFromHeaders, re as readSessionKeyed, ie as resolveSessionSecret, ae as resolveSessionSecrets, ve as runSubjectGuards, de as sendEmailVerification, p as sessionIdOfSubject, oe as sessionSecretsOf, h as subjectFromUser, se as subjectMemberships, Ee as userEmailVerified, lt as verifyAssertion, q as verifyCsrf, a as verifyPassword, o as verifyPasswordWithRehash, ut as verifyRegistration, be as verifyTotpCode, g as voltroPasswordStrategy, $ as withSessionId };