@voltro/plugin-auth 0.85.0 → 0.86.0

package/README.md

@@ -20,6 +20,16 @@ Installation, guides, the full API reference, and examples all live in the
 **[Voltro documentation](https://docs.voltro.dev/docs/intro/getting-started)** — the single source of truth. This README is
 deliberately short so there is nothing here to drift out of date.
 
+## Registered device sessions
+
+`rotateRegisteredSession` replaces a credential atomically and retains inactive
+aliases so revoking an earlier cookie's row also ends its successor. Registry
+writes own transactions; use `{ transaction: 'existing' }` inside a mutation or
+an explicit transaction. Apply the declared `sessions` schema before restarting
+upgraded auth replicas. See the bilingual
+[session guide](https://docs.voltro.dev/docs/authentication/sessions) for authority
+checks, device families and revocation cache limits.
+
 ## License
 
 Proprietary. © 2026 Voltro UG. Your use is governed by the

package/THIRD-PARTY-NOTICES.md

@@ -1,11 +1,11 @@
 # Third-Party Notices — @voltro/plugin-auth
 
-This package depends on the open-source software listed below. Each is the
+This package uses the open-source software listed below. Each is the
 property of its respective copyright holders and is used under the terms of
 its license. This file is provided for attribution; it grants no rights in
 @voltro/plugin-auth itself, which is proprietary (see LICENSE).
 
-Generated from the resolved runtime dependency closure (5 packages).
+Generated from the resolved runtime dependency closure (4 packages).
 
 ---
 
@@ -37,34 +37,6 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 ```
 
-## layerr@3.0.0
-
-License: MIT
-
-```
-MIT License
-
-Copyright (c) 2020 Perry Mitchell
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
-```
-
 ## typeid-js@1.2.0
 
 License: Apache-2.0
@@ -273,14 +245,14 @@ Apache License
    limitations under the License.
 ```
 
-## ulidx@2.4.1
+## ulid@3.0.2
 
 License: MIT
 
 ```
-MIT License
+The MIT License (MIT)
 
-Copyright (c) 2021 Perry Mitchell
+Copyright (c) 2017 Alizain Feerasta
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/dist/admission.js

@@ -0,0 +1,9 @@
+import { Effect as e } from "effect";
+//#region src/admission.ts
+var t = (t, n, r = { store: void 0 }) => {
+	if (t === void 0) return e.succeed(null);
+	let i = t(n, r);
+	return e.isEffect(i) ? i : e.promise(() => i);
+};
+//#endregion
+export { t as decideAdmission };

package/dist/appUserStore.js

@@ -0,0 +1,19 @@
+import { memoryUserStore as e } from "./userStore.js";
+import { postgresUserStore as t } from "./postgresUserStore.js";
+//#region src/appUserStore.ts
+var n = (n = {}) => ({ sql: r }) => r === void 0 ? e() : r.onDialectOrElse({
+	pg: () => t(r, n),
+	orElse: () => {
+		throw Error("appUserStore(): the app database is not postgres, and @voltro/plugin-auth ships a SQL user store for postgres only. Pass your own `UserStore` to authRoutesPlugin({ store }).");
+	}
+}), r = (e) => new Proxy({}, { get: (t, n) => {
+	if (typeof n == "string" && n !== "then") return (...t) => {
+		let r = e();
+		if (r === void 0) throw Error(`authRoutesPlugin: user store method '${n}' was called before the framework bound the app database. A resolver-backed store is available once boot has finished.`);
+		let i = r[n];
+		if (typeof i != "function") throw Error(`authRoutesPlugin: the resolved user store has no method '${n}'.`);
+		return i.apply(r, [...t]);
+	};
+} });
+//#endregion
+export { n as appUserStore, r as deferredUserStore };

package/dist/emailVerification.js

@@ -0,0 +1,62 @@
+import { newAuthId as e } from "./userStore.js";
+import { hashToken as t, mintToken as n } from "./tokens.js";
+import { Effect as r } from "effect";
+//#region src/emailVerification.ts
+var i = 60, a = "email_not_verified", o = "emailVerified", s = (e) => e?.policy ?? "off", c = (e) => s(e) !== "off", l = (e, t) => {
+	if (e.emailVerifiedAt != null) return !0;
+	let n = t?.exemptAccountsCreatedBefore;
+	return n !== void 0 && e.createdAt.getTime() < n.getTime();
+}, u = (e) => {
+	if (e.type !== "user") return null;
+	let t = e.metadata?.[o];
+	return typeof t == "boolean" ? t : null;
+}, d = (e) => {
+	let t = s(e) === "strict";
+	return (n) => r.succeed(!t || l(n, e) ? { ok: !0 } : {
+		ok: !1,
+		code: a,
+		message: "This account's email address has not been confirmed yet. Request a new confirmation link and follow it, then sign in again."
+	});
+}, f = (e, t) => ({
+	status: e,
+	body: JSON.stringify(t),
+	contentType: "application/json; charset=utf-8"
+}), p = (e, t, n) => `${e}${t}${t.includes("?") ? "&" : "?"}token=${encodeURIComponent(n)}`, m = (t, i, a) => r.gen(function* () {
+	let o = a.emailVerification, s = (a.now ?? Date.now)(), c = (o?.resendCooldownSeconds ?? 60) * 1e3;
+	if (c > 0) {
+		let e = yield* i.latestToken(t.id, "email-verify");
+		if (e && s - e.createdAt.getTime() < c) return !1;
+	}
+	let l = n("email-verify", o?.ttlSeconds ?? 86400);
+	if (yield* i.insertToken({
+		id: e("tok"),
+		tokenHash: l.tokenHash,
+		userId: t.id,
+		purpose: "email-verify",
+		expiresAt: l.expiresAt
+	}).pipe(r.ignore), !a.sendEmail) return !1;
+	let u = p(a.appBaseUrl ?? "", o?.callbackPath ?? "/auth/verify-email/callback", l.token);
+	return yield* r.tryPromise(() => a.sendEmail({
+		to: t.email,
+		kind: "email-verify",
+		actionUrl: u,
+		subject: "Confirm your email address",
+		text: `Confirm your email address: ${u}`,
+		html: `<p><a href="${u}">Confirm your email address</a> — this link expires in 24 hours.</p>`
+	})).pipe(r.ignore), !0;
+}), h = (e, t, n) => r.gen(function* () {
+	if (!e.email && !e.userId) return f(400, { error: "email or userId required" });
+	let r = e.userId ? yield* t.findById(e.userId) : yield* t.findByEmail(e.email);
+	return r && !l(r, n.emailVerification) && (yield* m(r, t, n)), f(202, { ok: !0 });
+}), g = (e, n) => r.gen(function* () {
+	if (!e.token) return f(400, { error: "token required" });
+	let i = yield* n.consumeToken(t(e.token), "email-verify");
+	if (!i) return f(401, { error: "invalid or expired token" });
+	let a = yield* n.findById(i.userId);
+	return a ? (yield* n.markEmailVerified(a.id).pipe(r.ignore), f(200, {
+		ok: !0,
+		verified: !0
+	})) : f(401, { error: "invalid or expired token" });
+});
+//#endregion
+export { a as EMAIL_NOT_VERIFIED_CODE, o as EMAIL_VERIFIED_METADATA_KEY, i as EMAIL_VERIFY_RESEND_COOLDOWN_S, c as emailVerificationActive, d as emailVerificationGuard, g as handleEmailVerifyConfirm, h as handleEmailVerifyRequest, u as isEmailVerified, m as sendEmailVerification, l as userEmailVerified };

package/dist/handlers.js

@@ -0,0 +1,337 @@
+import { hashPassword as e, verifyPassword as t, verifyPasswordWithRehash as n } from "./password.js";
+import { SESSION_COOKIE_NAME as r, clearSessionCookie as i, issueSession as a, resolveSessionSecret as o, resolveSessionSecrets as s, sessionSecretsOf as c } from "./session.js";
+import { newAuthId as l, subjectFromUser as u } from "./userStore.js";
+import { runSubjectGuards as d } from "./subjectGuard.js";
+import { generateRecoveryCodes as f, generateTotpSecret as p, otpauthUrl as m, verifyTotpCode as h } from "./totp.js";
+import { MFA_PENDING_TTL_S as g, hashToken as _, mintToken as v } from "./tokens.js";
+import { CSRF_COOKIE_NAME as y, issueCsrfToken as b } from "./csrf.js";
+import { decideAdmission as x } from "./admission.js";
+import { EMAIL_VERIFIED_METADATA_KEY as S, emailVerificationActive as C, sendEmailVerification as w, userEmailVerified as T } from "./emailVerification.js";
+import { Effect as E } from "effect";
+import { buildSetCookie as D } from "@voltro/protocol/session";
+import { writeTenantSelection as O } from "@voltro/database";
+import { selectSubjectTenant as k } from "@voltro/protocol";
+//#region src/handlers.ts
+var A = 5, j = 900, M = 900, N = (e) => ({
+	maxAttempts: e.lockout?.maxAttempts ?? A,
+	windowMs: (e.lockout?.windowSeconds ?? j) * 1e3,
+	lockMs: (e.lockout?.lockSeconds ?? M) * 1e3
+}), P = (e) => e.secrets ?? (e.secret === void 0 ? s() : c(e.secret)), F = (e) => e.secret ?? o(), I = (e, t, n = {}) => ({
+	status: e,
+	body: JSON.stringify(t),
+	contentType: "application/json; charset=utf-8",
+	...n
+}), L = (e, t = {}) => ({
+	status: 302,
+	body: "",
+	contentType: "text/plain",
+	location: e,
+	...t
+}), R = 604800, z = (e, t) => e.type === "user" ? {
+	...e,
+	metadata: {
+		...e.metadata ?? {},
+		sessionId: t
+	}
+} : e, B = (e, t, n, r = {}) => E.gen(function* () {
+	r.clearLoginFailures !== !1 && (yield* t.clearLoginFailures(e.email)), n.ensureActor && (yield* n.ensureActor(e));
+	let i = yield* t.listMemberships(e.id), o = r.sessionId ?? l("sess"), s = r.ttlSeconds ?? R;
+	r.sessionRow !== "existing" && (yield* t.insertSession({
+		id: o,
+		userId: e.id,
+		tenantId: e.tenantId,
+		expiresAt: new Date(Date.now() + s * 1e3),
+		ipAddress: r.ipAddress ?? null,
+		userAgent: r.userAgent ?? null
+	}).pipe(E.ignore));
+	let c = { ...r.metadata };
+	C(n.emailVerification) && (c[S] = T(e, n.emailVerification));
+	let d = z(u(e, {
+		memberships: i,
+		...Object.keys(c).length > 0 ? { metadata: c } : {}
+	}), o), f = a(d, P(n), {
+		ttlSeconds: s,
+		...n.cookieDomain ? { domain: n.cookieDomain } : {},
+		secure: n.cookieSecure ?? !0
+	});
+	return {
+		setCookie: f.setCookie,
+		value: f.value,
+		expiresAt: Math.floor(Date.now() / 1e3) + s,
+		subject: d
+	};
+}), V = (e, t) => E.gen(function* () {
+	let n = t.subjectGuards ?? [];
+	if (n.length === 0) return null;
+	let r = yield* d(n, e);
+	return r.ok ? null : I(403, {
+		error: r.code,
+		message: r.message
+	});
+}), H = (r, i, a) => E.gen(function* () {
+	if (!r.email || !r.password) return I(400, { error: "email and password required" });
+	let o = yield* i.findByEmail(r.email), s = (a.now ?? Date.now)(), c = yield* i.isLockedOut(r.email, s);
+	if (c.locked) return I(429, {
+		error: "account_locked",
+		retryAfterSeconds: c.retryAfterSeconds
+	});
+	let u = o?.passwordHash, d = typeof u == "string" && u.length > 0 ? yield* n(r.password, u) : yield* E.gen(function* () {
+		let n = yield* e("decoy-not-a-real-password").pipe(E.orElseSucceed(() => ""));
+		return yield* t(r.password, n), { valid: !1 };
+	});
+	if (!o || !d.valid) return yield* i.recordLoginFailure(r.email, s, N(a)), I(401, { error: "invalid credentials" });
+	let f = yield* V(o, a);
+	if (f) return f;
+	if (d.rehash && (yield* i.updatePassword(o.id, d.rehash).pipe(E.ignore)), o.mfaEnrolledAt) {
+		let e = v("mfa-pending", 300);
+		return yield* i.insertToken({
+			id: l("tok"),
+			tokenHash: e.tokenHash,
+			userId: o.id,
+			purpose: "mfa-pending",
+			expiresAt: e.expiresAt
+		}).pipe(E.ignore), I(200, {
+			ok: !0,
+			mfaRequired: !0,
+			pendingToken: e.token,
+			expiresInSeconds: 300
+		});
+	}
+	let { setCookie: p, subject: m } = yield* B(o, i, a, {
+		ipAddress: r.ipAddress ?? null,
+		userAgent: r.userAgent ?? null
+	});
+	return r.redirectAfter ? L(a.successRedirect ?? "/", { setCookie: p }) : I(200, {
+		ok: !0,
+		subject: m
+	}, { setCookie: p });
+}), U = (e, t, n) => E.gen(function* () {
+	if (!e.pendingToken) return I(400, { error: "pending token required" });
+	if (!e.code && !e.recoveryCode) return I(400, { error: "code or recoveryCode required" });
+	let r = yield* t.consumeToken(_(e.pendingToken), "mfa-pending");
+	if (!r) return I(401, { error: "invalid or expired challenge" });
+	let i = yield* t.findById(r.userId);
+	if (!i || !i.mfaEnrolledAt || !i.mfaSecret) return I(401, { error: "mfa not enrolled" });
+	let a = (n.now ?? Date.now)(), o = yield* t.isLockedOut(i.email, a);
+	if (o.locked) return I(429, {
+		error: "account_locked",
+		retryAfterSeconds: o.retryAfterSeconds
+	});
+	let s = yield* V(i, n);
+	if (s) return s;
+	if (!(e.recoveryCode ? yield* t.consumeRecoveryCode(i.id, _(e.recoveryCode.trim())) : yield* h(i.mfaSecret, e.code ?? "").pipe(E.map(() => !0), E.catchTag("TotpVerifyError", () => E.succeed(!1))))) return yield* t.recordLoginFailure(i.email, a, N(n)), I(401, { error: "invalid_code" });
+	let { setCookie: c, subject: l } = yield* B(i, t, n, {
+		ipAddress: e.ipAddress ?? null,
+		userAgent: e.userAgent ?? null
+	});
+	return e.redirectAfter ? L(n.successRedirect ?? "/", { setCookie: c }) : I(200, {
+		ok: !0,
+		subject: l
+	}, { setCookie: c });
+}), W = (t, n, r) => E.gen(function* () {
+	if (!t.email || !t.password) return I(400, { error: "email and password required" });
+	if (t.password.length < 8) return I(400, { error: "password must be at least 8 characters" });
+	if (yield* n.findByEmail(t.email)) return I(409, { error: "email already registered" });
+	let i = t.tenantId ?? r.defaultTenantId, a = yield* x(r.admit, {
+		email: t.email,
+		tenantId: i,
+		via: "sign-up"
+	});
+	if (a) return I(403, {
+		error: "not_admitted",
+		reason: a.reason,
+		message: a.message
+	});
+	let o = yield* e(t.password), s = yield* n.insert({
+		id: l("user"),
+		email: t.email,
+		passwordHash: o,
+		tenantId: i
+	});
+	yield* n.addMembership({
+		userId: s.id,
+		tenantId: i,
+		role: "owner"
+	}).pipe(E.ignore), C(r.emailVerification) && (r.emailVerification?.sendOnSignUp ?? !0) && (yield* w(s, n, r).pipe(E.ignore));
+	let { setCookie: c, subject: u } = yield* B(s, n, r);
+	return t.redirectAfter ? L(r.successRedirect ?? "/", { setCookie: c }) : I(200, {
+		ok: !0,
+		subject: u
+	}, { setCookie: c });
+}).pipe(E.catch((e) => E.succeed(I(500, {
+	error: "signup_failed",
+	cause: String(e)
+})))), G = (e) => ({
+	status: 302,
+	body: "",
+	location: e.successRedirect ?? "/",
+	setCookie: i({
+		...e.cookieDomain ? { domain: e.cookieDomain } : {},
+		secure: e.cookieSecure ?? !0
+	})
+}), K = (e, t) => E.gen(function* () {
+	let n = yield* t.findById(e.userId);
+	if (!n) return I(404, { error: "user_not_found" });
+	let r = p();
+	return yield* t.setMfaSecret(n.id, r).pipe(E.catch(() => E.succeed(n))), I(200, {
+		ok: !0,
+		secret: r,
+		otpauthUrl: m({
+			issuer: e.issuer,
+			accountName: e.accountName,
+			secret: r
+		})
+	});
+}), q = (e, t) => E.gen(function* () {
+	let n = yield* t.findById(e.userId);
+	if (!n) return I(404, { error: "user_not_found" });
+	if (!n.mfaSecret) return I(400, { error: "no_enrollment_in_progress" });
+	if (n.mfaEnrolledAt) return I(409, { error: "already_enrolled" });
+	if (!(yield* h(n.mfaSecret, e.code).pipe(E.map(() => !0), E.catchTag("TotpVerifyError", () => E.succeed(!1))))) return I(401, { error: "invalid_code" });
+	yield* t.markMfaEnrolled(n.id).pipe(E.catch(() => E.succeed(n)));
+	let r = f();
+	return yield* t.replaceRecoveryCodes(n.id, r.map((e) => _(e))).pipe(E.ignore), I(200, {
+		ok: !0,
+		enrolled: !0,
+		recoveryCodes: r
+	});
+}), J = (e, t) => E.gen(function* () {
+	let n = yield* t.findById(e.userId);
+	if (!n) return I(404, { error: "user_not_found" });
+	if (!n.mfaEnrolledAt) return I(400, { error: "mfa_not_enrolled" });
+	let r = f();
+	return yield* t.replaceRecoveryCodes(n.id, r.map((e) => _(e))).pipe(E.ignore), I(200, {
+		ok: !0,
+		recoveryCodes: r
+	});
+}), Y = (e, t) => E.gen(function* () {
+	let n = yield* t.findById(e.userId);
+	return n ? (yield* t.clearMfa(n.id).pipe(E.catch(() => E.succeed(n))), yield* t.replaceRecoveryCodes(n.id, []).pipe(E.ignore), I(200, {
+		ok: !0,
+		enrolled: !1
+	})) : I(404, { error: "user_not_found" });
+}), X = (e) => {
+	let t = b(F(e)), n = D(y, t, {
+		httpOnly: !1,
+		sameSite: "lax",
+		secure: e.cookieSecure ?? !0,
+		...e.cookieDomain ? { domain: e.cookieDomain } : {},
+		path: "/"
+	});
+	return I(200, { csrfToken: t }, { setCookie: n });
+}, Z = (e, t, n) => `${e}${t}${t.includes("?") ? "&" : "?"}token=${encodeURIComponent(n)}`, Q = (e, t, n) => E.gen(function* () {
+	if (!e.email) return I(400, { error: "email required" });
+	let r = yield* t.findByEmail(e.email);
+	if (r) {
+		let i = v("magic-link");
+		yield* t.insertToken({
+			id: l("tok"),
+			tokenHash: i.tokenHash,
+			userId: r.id,
+			purpose: "magic-link",
+			expiresAt: i.expiresAt
+		}).pipe(E.ignore);
+		let a = Z(n.appBaseUrl ?? "", e.callbackPath ?? "/auth/magic-link/callback", i.token);
+		n.sendEmail && (yield* E.tryPromise(() => n.sendEmail({
+			to: r.email,
+			kind: "magic-link",
+			actionUrl: a,
+			subject: "Your sign-in link",
+			text: `Sign in: ${a}`,
+			html: `<p><a href="${a}">Sign in</a> — this link expires shortly.</p>`
+		})).pipe(E.ignore));
+	}
+	return I(202, { ok: !0 });
+}), $ = (e, t, n) => E.gen(function* () {
+	if (!e.token) return I(400, { error: "token required" });
+	let r = yield* t.consumeToken(_(e.token), "magic-link");
+	if (!r) return I(401, { error: "invalid or expired token" });
+	let i = yield* t.findById(r.userId);
+	if (!i) return I(401, { error: "invalid or expired token" });
+	let a = yield* t.markEmailVerified(i.id).pipe(E.orElseSucceed(() => i)), o = yield* V(a, n);
+	if (o) return o;
+	let { setCookie: s, subject: c } = yield* B(a, t, n);
+	return e.redirectAfter ? L(n.successRedirect ?? "/", { setCookie: s }) : I(200, {
+		ok: !0,
+		subject: c
+	}, { setCookie: s });
+}), ee = (e, t, n) => E.gen(function* () {
+	if (!e.email) return I(400, { error: "email required" });
+	let r = yield* t.findByEmail(e.email);
+	if (r) {
+		let i = v("password-reset");
+		yield* t.insertToken({
+			id: l("tok"),
+			tokenHash: i.tokenHash,
+			userId: r.id,
+			purpose: "password-reset",
+			expiresAt: i.expiresAt
+		}).pipe(E.ignore);
+		let a = Z(n.appBaseUrl ?? "", e.callbackPath ?? "/auth/password-reset/callback", i.token);
+		n.sendEmail && (yield* E.tryPromise(() => n.sendEmail({
+			to: r.email,
+			kind: "password-reset",
+			actionUrl: a,
+			subject: "Reset your password",
+			text: `Reset your password: ${a}`,
+			html: `<p><a href="${a}">Reset your password</a> — this link expires shortly.</p>`
+		})).pipe(E.ignore));
+	}
+	return I(202, { ok: !0 });
+}), te = (t, n) => E.gen(function* () {
+	if (!t.token || !t.newPassword) return I(400, { error: "token and newPassword required" });
+	if (t.newPassword.length < 8) return I(400, { error: "password must be at least 8 characters" });
+	let r = yield* n.consumeToken(_(t.token), "password-reset");
+	if (!r) return I(401, { error: "invalid or expired token" });
+	let i = yield* e(t.newPassword).pipe(E.orElseSucceed(() => ""));
+	return i ? (yield* n.updatePassword(r.userId, i).pipe(E.ignore), yield* n.markEmailVerified(r.userId).pipe(E.ignore), yield* n.revokeAllSessions(r.userId).pipe(E.ignore), I(200, { ok: !0 })) : I(500, { error: "hash_failed" });
+}), ne = (e, t) => E.gen(function* () {
+	return I(200, { sessions: (yield* t.listSessions(e.userId)).map((e) => ({
+		id: e.id,
+		tenantId: e.tenantId,
+		ipAddress: e.ipAddress ?? null,
+		userAgent: e.userAgent ?? null,
+		createdAt: e.createdAt.toISOString(),
+		lastSeenAt: e.lastSeenAt.toISOString(),
+		expiresAt: e.expiresAt.toISOString()
+	})) });
+}), re = (e, t) => E.gen(function* () {
+	return (yield* t.revokeSession(e.userId, e.sessionId)) ? I(200, {
+		ok: !0,
+		revoked: 1
+	}) : I(404, { error: "session_not_found" });
+}), ie = (e, t) => E.gen(function* () {
+	return I(200, {
+		ok: !0,
+		revoked: yield* t.revokeAllOtherSessions(e.userId, e.keepSessionId)
+	});
+}), ae = (e, t, n, i, o) => E.gen(function* () {
+	let s = yield* t.findById(e.userId);
+	if (!s) return I(404, { error: "user_not_found" });
+	let c = yield* t.listMemberships(s.id), l = c.find((t) => t.tenantId === e.targetTenantId)?.role ?? null;
+	if (l === null) return I(403, { error: "not a member of the target tenant" });
+	let d = e.metadata === void 0 ? void 0 : Object.fromEntries(Object.entries(e.metadata).filter(([e]) => e !== "memberships")), f = k(u(s, { ...d === void 0 ? {} : { metadata: d } }), e.targetTenantId, c);
+	o !== void 0 && f.type === "user" && (yield* E.promise(() => O(o, {
+		type: f.type,
+		id: f.id
+	}, e.targetTenantId)));
+	let p = e.sessionId ? z(f, e.sessionId) : f, m = a(p, P(n), {
+		ttlSeconds: R,
+		...n.cookieDomain ? { domain: n.cookieDomain } : {},
+		secure: n.cookieSecure ?? !0
+	});
+	return e.clientId !== void 0 && i && i(e.clientId, { cookies: { [r]: m.value } }), I(200, {
+		ok: !0,
+		tenantId: e.targetTenantId,
+		role: l,
+		subject: p
+	}, { setCookie: m.setCookie });
+}), oe = (e, t) => E.gen(function* () {
+	return I(200, { memberships: (yield* t.listMemberships(e.userId)).map((e) => ({
+		tenantId: e.tenantId,
+		role: e.role,
+		joinedAt: e.joinedAt.toISOString()
+	})) });
+});
+//#endregion
+export { g as MFA_PENDING_TTL_S, P as configSessionSecrets, F as configSigningKey, V as guardSubject, X as handleCsrf, oe as handleListMemberships, ne as handleListSessions, $ as handleMagicLinkConsume, Q as handleMagicLinkRequest, K as handleMfaEnrollStart, q as handleMfaEnrollVerify, J as handleMfaRegenerateRecoveryCodes, Y as handleMfaUnenroll, U as handleMfaVerify, te as handlePasswordResetConfirm, ee as handlePasswordResetRequest, ie as handleRevokeAllOtherSessions, re as handleRevokeSession, H as handleSignIn, G as handleSignOut, W as handleSignUp, ae as handleSwitchTenant, B as issueUserSession };