@voltro/plugin-auth 0.86.0 → 0.87.0

package/dist/handlers.js

@@ -1,41 +1,41 @@
 import { hashPassword as e, verifyPassword as t, verifyPasswordWithRehash as n } from "./password.js";
 import { SESSION_COOKIE_NAME as r, clearSessionCookie as i, issueSession as a, resolveSessionSecret as o, resolveSessionSecrets as s, sessionSecretsOf as c } from "./session.js";
 import { newAuthId as l, subjectFromUser as u } from "./userStore.js";
-import { runSubjectGuards as d } from "./subjectGuard.js";
-import { generateRecoveryCodes as f, generateTotpSecret as p, otpauthUrl as m, verifyTotpCode as h } from "./totp.js";
-import { MFA_PENDING_TTL_S as g, hashToken as _, mintToken as v } from "./tokens.js";
-import { CSRF_COOKIE_NAME as y, issueCsrfToken as b } from "./csrf.js";
-import { decideAdmission as x } from "./admission.js";
+import { CSRF_COOKIE_NAME as d, issueCsrfToken as f } from "./csrf.js";
+import { decideAdmission as p } from "./admission.js";
+import { generateRecoveryCodes as m, generateTotpSecret as h, otpauthUrl as g, verifyTotpCode as _ } from "./totp.js";
+import { MFA_PENDING_TTL_S as v, hashToken as y, mintToken as b } from "./tokens.js";
+import { runSubjectGuards as x } from "./subjectGuard.js";
 import { EMAIL_VERIFIED_METADATA_KEY as S, emailVerificationActive as C, sendEmailVerification as w, userEmailVerified as T } from "./emailVerification.js";
 import { Effect as E } from "effect";
 import { buildSetCookie as D } from "@voltro/protocol/session";
 import { writeTenantSelection as O } from "@voltro/database";
 import { selectSubjectTenant as k } from "@voltro/protocol";
 //#region src/handlers.ts
-var A = 5, j = 900, M = 900, N = (e) => ({
+var A = 5, j = 900, M = 900, N = (e) => e.email ?? `user:${e.id}`, P = (e) => ({
 	maxAttempts: e.lockout?.maxAttempts ?? A,
 	windowMs: (e.lockout?.windowSeconds ?? j) * 1e3,
 	lockMs: (e.lockout?.lockSeconds ?? M) * 1e3
-}), P = (e) => e.secrets ?? (e.secret === void 0 ? s() : c(e.secret)), F = (e) => e.secret ?? o(), I = (e, t, n = {}) => ({
+}), F = (e) => e.secrets ?? (e.secret === void 0 ? s() : c(e.secret)), I = (e) => e.secret ?? o(), L = (e, t, n = {}) => ({
 	status: e,
 	body: JSON.stringify(t),
 	contentType: "application/json; charset=utf-8",
 	...n
-}), L = (e, t = {}) => ({
+}), R = (e, t = {}) => ({
 	status: 302,
 	body: "",
 	contentType: "text/plain",
 	location: e,
 	...t
-}), R = 604800, z = (e, t) => e.type === "user" ? {
+}), z = 604800, B = (e, t) => e.type === "user" ? {
 	...e,
 	metadata: {
 		...e.metadata ?? {},
 		sessionId: t
 	}
-} : e, B = (e, t, n, r = {}) => E.gen(function* () {
-	r.clearLoginFailures !== !1 && (yield* t.clearLoginFailures(e.email)), n.ensureActor && (yield* n.ensureActor(e));
-	let i = yield* t.listMemberships(e.id), o = r.sessionId ?? l("sess"), s = r.ttlSeconds ?? R;
+} : e, V = (e, t, n, r = {}) => E.gen(function* () {
+	r.clearLoginFailures !== !1 && (yield* t.clearLoginFailures(N(e))), n.ensureActor && (yield* n.ensureActor(e));
+	let i = yield* t.listMemberships(e.id), o = r.sessionId ?? l("sess"), s = r.ttlSeconds ?? z;
 	r.sessionRow !== "existing" && (yield* t.insertSession({
 		id: o,
 		userId: e.id,
@@ -46,10 +46,10 @@ var A = 5, j = 900, M = 900, N = (e) => ({
 	}).pipe(E.ignore));
 	let c = { ...r.metadata };
 	C(n.emailVerification) && (c[S] = T(e, n.emailVerification));
-	let d = z(u(e, {
+	let d = B(u(e, {
 		memberships: i,
 		...Object.keys(c).length > 0 ? { metadata: c } : {}
-	}), o), f = a(d, P(n), {
+	}), o), f = a(d, F(n), {
 		ttlSeconds: s,
 		...n.cookieDomain ? { domain: n.cookieDomain } : {},
 		secure: n.cookieSecure ?? !0
@@ -60,18 +60,18 @@ var A = 5, j = 900, M = 900, N = (e) => ({
 		expiresAt: Math.floor(Date.now() / 1e3) + s,
 		subject: d
 	};
-}), V = (e, t) => E.gen(function* () {
+}), H = (e, t) => E.gen(function* () {
 	let n = t.subjectGuards ?? [];
 	if (n.length === 0) return null;
-	let r = yield* d(n, e);
-	return r.ok ? null : I(403, {
+	let r = yield* x(n, e);
+	return r.ok ? null : L(403, {
 		error: r.code,
 		message: r.message
 	});
-}), H = (r, i, a) => E.gen(function* () {
-	if (!r.email || !r.password) return I(400, { error: "email and password required" });
+}), U = (r, i, a) => E.gen(function* () {
+	if (!r.email || !r.password) return L(400, { error: "email and password required" });
 	let o = yield* i.findByEmail(r.email), s = (a.now ?? Date.now)(), c = yield* i.isLockedOut(r.email, s);
-	if (c.locked) return I(429, {
+	if (c.locked) return L(429, {
 		error: "account_locked",
 		retryAfterSeconds: c.retryAfterSeconds
 	});
@@ -79,65 +79,65 @@ var A = 5, j = 900, M = 900, N = (e) => ({
 		let n = yield* e("decoy-not-a-real-password").pipe(E.orElseSucceed(() => ""));
 		return yield* t(r.password, n), { valid: !1 };
 	});
-	if (!o || !d.valid) return yield* i.recordLoginFailure(r.email, s, N(a)), I(401, { error: "invalid credentials" });
-	let f = yield* V(o, a);
+	if (!o || !d.valid) return yield* i.recordLoginFailure(r.email, s, P(a)), L(401, { error: "invalid credentials" });
+	let f = yield* H(o, a);
 	if (f) return f;
 	if (d.rehash && (yield* i.updatePassword(o.id, d.rehash).pipe(E.ignore)), o.mfaEnrolledAt) {
-		let e = v("mfa-pending", 300);
+		let e = b("mfa-pending", 300);
 		return yield* i.insertToken({
 			id: l("tok"),
 			tokenHash: e.tokenHash,
 			userId: o.id,
 			purpose: "mfa-pending",
 			expiresAt: e.expiresAt
-		}).pipe(E.ignore), I(200, {
+		}).pipe(E.ignore), L(200, {
 			ok: !0,
 			mfaRequired: !0,
 			pendingToken: e.token,
 			expiresInSeconds: 300
 		});
 	}
-	let { setCookie: p, subject: m } = yield* B(o, i, a, {
+	let { setCookie: p, subject: m } = yield* V(o, i, a, {
 		ipAddress: r.ipAddress ?? null,
 		userAgent: r.userAgent ?? null
 	});
-	return r.redirectAfter ? L(a.successRedirect ?? "/", { setCookie: p }) : I(200, {
+	return r.redirectAfter ? R(a.successRedirect ?? "/", { setCookie: p }) : L(200, {
 		ok: !0,
 		subject: m
 	}, { setCookie: p });
-}), U = (e, t, n) => E.gen(function* () {
-	if (!e.pendingToken) return I(400, { error: "pending token required" });
-	if (!e.code && !e.recoveryCode) return I(400, { error: "code or recoveryCode required" });
-	let r = yield* t.consumeToken(_(e.pendingToken), "mfa-pending");
-	if (!r) return I(401, { error: "invalid or expired challenge" });
+}), W = (e, t, n) => E.gen(function* () {
+	if (!e.pendingToken) return L(400, { error: "pending token required" });
+	if (!e.code && !e.recoveryCode) return L(400, { error: "code or recoveryCode required" });
+	let r = yield* t.consumeToken(y(e.pendingToken), "mfa-pending");
+	if (!r) return L(401, { error: "invalid or expired challenge" });
 	let i = yield* t.findById(r.userId);
-	if (!i || !i.mfaEnrolledAt || !i.mfaSecret) return I(401, { error: "mfa not enrolled" });
-	let a = (n.now ?? Date.now)(), o = yield* t.isLockedOut(i.email, a);
-	if (o.locked) return I(429, {
+	if (!i || !i.mfaEnrolledAt || !i.mfaSecret) return L(401, { error: "mfa not enrolled" });
+	let a = (n.now ?? Date.now)(), o = yield* t.isLockedOut(N(i), a);
+	if (o.locked) return L(429, {
 		error: "account_locked",
 		retryAfterSeconds: o.retryAfterSeconds
 	});
-	let s = yield* V(i, n);
+	let s = yield* H(i, n);
 	if (s) return s;
-	if (!(e.recoveryCode ? yield* t.consumeRecoveryCode(i.id, _(e.recoveryCode.trim())) : yield* h(i.mfaSecret, e.code ?? "").pipe(E.map(() => !0), E.catchTag("TotpVerifyError", () => E.succeed(!1))))) return yield* t.recordLoginFailure(i.email, a, N(n)), I(401, { error: "invalid_code" });
-	let { setCookie: c, subject: l } = yield* B(i, t, n, {
+	if (!(e.recoveryCode ? yield* t.consumeRecoveryCode(i.id, y(e.recoveryCode.trim())) : yield* _(i.mfaSecret, e.code ?? "").pipe(E.map(() => !0), E.catchTag("TotpVerifyError", () => E.succeed(!1))))) return yield* t.recordLoginFailure(N(i), a, P(n)), L(401, { error: "invalid_code" });
+	let { setCookie: c, subject: l } = yield* V(i, t, n, {
 		ipAddress: e.ipAddress ?? null,
 		userAgent: e.userAgent ?? null
 	});
-	return e.redirectAfter ? L(n.successRedirect ?? "/", { setCookie: c }) : I(200, {
+	return e.redirectAfter ? R(n.successRedirect ?? "/", { setCookie: c }) : L(200, {
 		ok: !0,
 		subject: l
 	}, { setCookie: c });
-}), W = (t, n, r) => E.gen(function* () {
-	if (!t.email || !t.password) return I(400, { error: "email and password required" });
-	if (t.password.length < 8) return I(400, { error: "password must be at least 8 characters" });
-	if (yield* n.findByEmail(t.email)) return I(409, { error: "email already registered" });
-	let i = t.tenantId ?? r.defaultTenantId, a = yield* x(r.admit, {
+}), G = (t, n, r) => E.gen(function* () {
+	if (!t.email || !t.password) return L(400, { error: "email and password required" });
+	if (t.password.length < 8) return L(400, { error: "password must be at least 8 characters" });
+	if (yield* n.findByEmail(t.email)) return L(409, { error: "email already registered" });
+	let i = t.tenantId ?? r.defaultTenantId, a = yield* p(r.admit, {
 		email: t.email,
 		tenantId: i,
 		via: "sign-up"
 	});
-	if (a) return I(403, {
+	if (a) return L(403, {
 		error: "not_admitted",
 		reason: a.reason,
 		message: a.message
@@ -153,15 +153,15 @@ var A = 5, j = 900, M = 900, N = (e) => ({
 		tenantId: i,
 		role: "owner"
 	}).pipe(E.ignore), C(r.emailVerification) && (r.emailVerification?.sendOnSignUp ?? !0) && (yield* w(s, n, r).pipe(E.ignore));
-	let { setCookie: c, subject: u } = yield* B(s, n, r);
-	return t.redirectAfter ? L(r.successRedirect ?? "/", { setCookie: c }) : I(200, {
+	let { setCookie: c, subject: u } = yield* V(s, n, r);
+	return t.redirectAfter ? R(r.successRedirect ?? "/", { setCookie: c }) : L(200, {
 		ok: !0,
 		subject: u
 	}, { setCookie: c });
-}).pipe(E.catch((e) => E.succeed(I(500, {
+}).pipe(E.catch((e) => E.succeed(L(500, {
 	error: "signup_failed",
 	cause: String(e)
-})))), G = (e) => ({
+})))), K = (e) => ({
 	status: 302,
 	body: "",
 	location: e.successRedirect ?? "/",
@@ -169,61 +169,61 @@ var A = 5, j = 900, M = 900, N = (e) => ({
 		...e.cookieDomain ? { domain: e.cookieDomain } : {},
 		secure: e.cookieSecure ?? !0
 	})
-}), K = (e, t) => E.gen(function* () {
+}), q = (e, t) => E.gen(function* () {
 	let n = yield* t.findById(e.userId);
-	if (!n) return I(404, { error: "user_not_found" });
-	let r = p();
-	return yield* t.setMfaSecret(n.id, r).pipe(E.catch(() => E.succeed(n))), I(200, {
+	if (!n) return L(404, { error: "user_not_found" });
+	let r = h();
+	return yield* t.setMfaSecret(n.id, r).pipe(E.catch(() => E.succeed(n))), L(200, {
 		ok: !0,
 		secret: r,
-		otpauthUrl: m({
+		otpauthUrl: g({
 			issuer: e.issuer,
 			accountName: e.accountName,
 			secret: r
 		})
 	});
-}), q = (e, t) => E.gen(function* () {
+}), J = (e, t) => E.gen(function* () {
 	let n = yield* t.findById(e.userId);
-	if (!n) return I(404, { error: "user_not_found" });
-	if (!n.mfaSecret) return I(400, { error: "no_enrollment_in_progress" });
-	if (n.mfaEnrolledAt) return I(409, { error: "already_enrolled" });
-	if (!(yield* h(n.mfaSecret, e.code).pipe(E.map(() => !0), E.catchTag("TotpVerifyError", () => E.succeed(!1))))) return I(401, { error: "invalid_code" });
+	if (!n) return L(404, { error: "user_not_found" });
+	if (!n.mfaSecret) return L(400, { error: "no_enrollment_in_progress" });
+	if (n.mfaEnrolledAt) return L(409, { error: "already_enrolled" });
+	if (!(yield* _(n.mfaSecret, e.code).pipe(E.map(() => !0), E.catchTag("TotpVerifyError", () => E.succeed(!1))))) return L(401, { error: "invalid_code" });
 	yield* t.markMfaEnrolled(n.id).pipe(E.catch(() => E.succeed(n)));
-	let r = f();
-	return yield* t.replaceRecoveryCodes(n.id, r.map((e) => _(e))).pipe(E.ignore), I(200, {
+	let r = m();
+	return yield* t.replaceRecoveryCodes(n.id, r.map((e) => y(e))).pipe(E.ignore), L(200, {
 		ok: !0,
 		enrolled: !0,
 		recoveryCodes: r
 	});
-}), J = (e, t) => E.gen(function* () {
+}), Y = (e, t) => E.gen(function* () {
 	let n = yield* t.findById(e.userId);
-	if (!n) return I(404, { error: "user_not_found" });
-	if (!n.mfaEnrolledAt) return I(400, { error: "mfa_not_enrolled" });
-	let r = f();
-	return yield* t.replaceRecoveryCodes(n.id, r.map((e) => _(e))).pipe(E.ignore), I(200, {
+	if (!n) return L(404, { error: "user_not_found" });
+	if (!n.mfaEnrolledAt) return L(400, { error: "mfa_not_enrolled" });
+	let r = m();
+	return yield* t.replaceRecoveryCodes(n.id, r.map((e) => y(e))).pipe(E.ignore), L(200, {
 		ok: !0,
 		recoveryCodes: r
 	});
-}), Y = (e, t) => E.gen(function* () {
+}), X = (e, t) => E.gen(function* () {
 	let n = yield* t.findById(e.userId);
-	return n ? (yield* t.clearMfa(n.id).pipe(E.catch(() => E.succeed(n))), yield* t.replaceRecoveryCodes(n.id, []).pipe(E.ignore), I(200, {
+	return n ? (yield* t.clearMfa(n.id).pipe(E.catch(() => E.succeed(n))), yield* t.replaceRecoveryCodes(n.id, []).pipe(E.ignore), L(200, {
 		ok: !0,
 		enrolled: !1
-	})) : I(404, { error: "user_not_found" });
-}), X = (e) => {
-	let t = b(F(e)), n = D(y, t, {
+	})) : L(404, { error: "user_not_found" });
+}), Z = (e) => {
+	let t = f(I(e)), n = D(d, t, {
 		httpOnly: !1,
 		sameSite: "lax",
 		secure: e.cookieSecure ?? !0,
 		...e.cookieDomain ? { domain: e.cookieDomain } : {},
 		path: "/"
 	});
-	return I(200, { csrfToken: t }, { setCookie: n });
-}, Z = (e, t, n) => `${e}${t}${t.includes("?") ? "&" : "?"}token=${encodeURIComponent(n)}`, Q = (e, t, n) => E.gen(function* () {
-	if (!e.email) return I(400, { error: "email required" });
+	return L(200, { csrfToken: t }, { setCookie: n });
+}, Q = (e, t, n) => `${e}${t}${t.includes("?") ? "&" : "?"}token=${encodeURIComponent(n)}`, $ = (e, t, n) => E.gen(function* () {
+	if (!e.email) return L(400, { error: "email required" });
 	let r = yield* t.findByEmail(e.email);
 	if (r) {
-		let i = v("magic-link");
+		let i = b("magic-link");
 		yield* t.insertToken({
 			id: l("tok"),
 			tokenHash: i.tokenHash,
@@ -231,9 +231,9 @@ var A = 5, j = 900, M = 900, N = (e) => ({
 			purpose: "magic-link",
 			expiresAt: i.expiresAt
 		}).pipe(E.ignore);
-		let a = Z(n.appBaseUrl ?? "", e.callbackPath ?? "/auth/magic-link/callback", i.token);
+		let a = Q(n.appBaseUrl ?? "", e.callbackPath ?? "/auth/magic-link/callback", i.token);
 		n.sendEmail && (yield* E.tryPromise(() => n.sendEmail({
-			to: r.email,
+			to: r.email ?? e.email,
 			kind: "magic-link",
 			actionUrl: a,
 			subject: "Your sign-in link",
@@ -241,25 +241,25 @@ var A = 5, j = 900, M = 900, N = (e) => ({
 			html: `<p><a href="${a}">Sign in</a> — this link expires shortly.</p>`
 		})).pipe(E.ignore));
 	}
-	return I(202, { ok: !0 });
-}), $ = (e, t, n) => E.gen(function* () {
-	if (!e.token) return I(400, { error: "token required" });
-	let r = yield* t.consumeToken(_(e.token), "magic-link");
-	if (!r) return I(401, { error: "invalid or expired token" });
+	return L(202, { ok: !0 });
+}), ee = (e, t, n) => E.gen(function* () {
+	if (!e.token) return L(400, { error: "token required" });
+	let r = yield* t.consumeToken(y(e.token), "magic-link");
+	if (!r) return L(401, { error: "invalid or expired token" });
 	let i = yield* t.findById(r.userId);
-	if (!i) return I(401, { error: "invalid or expired token" });
-	let a = yield* t.markEmailVerified(i.id).pipe(E.orElseSucceed(() => i)), o = yield* V(a, n);
+	if (!i) return L(401, { error: "invalid or expired token" });
+	let a = yield* t.markEmailVerified(i.id).pipe(E.orElseSucceed(() => i)), o = yield* H(a, n);
 	if (o) return o;
-	let { setCookie: s, subject: c } = yield* B(a, t, n);
-	return e.redirectAfter ? L(n.successRedirect ?? "/", { setCookie: s }) : I(200, {
+	let { setCookie: s, subject: c } = yield* V(a, t, n);
+	return e.redirectAfter ? R(n.successRedirect ?? "/", { setCookie: s }) : L(200, {
 		ok: !0,
 		subject: c
 	}, { setCookie: s });
-}), ee = (e, t, n) => E.gen(function* () {
-	if (!e.email) return I(400, { error: "email required" });
+}), te = (e, t, n) => E.gen(function* () {
+	if (!e.email) return L(400, { error: "email required" });
 	let r = yield* t.findByEmail(e.email);
 	if (r) {
-		let i = v("password-reset");
+		let i = b("password-reset");
 		yield* t.insertToken({
 			id: l("tok"),
 			tokenHash: i.tokenHash,
@@ -267,9 +267,9 @@ var A = 5, j = 900, M = 900, N = (e) => ({
 			purpose: "password-reset",
 			expiresAt: i.expiresAt
 		}).pipe(E.ignore);
-		let a = Z(n.appBaseUrl ?? "", e.callbackPath ?? "/auth/password-reset/callback", i.token);
+		let a = Q(n.appBaseUrl ?? "", e.callbackPath ?? "/auth/password-reset/callback", i.token);
 		n.sendEmail && (yield* E.tryPromise(() => n.sendEmail({
-			to: r.email,
+			to: r.email ?? e.email,
 			kind: "password-reset",
 			actionUrl: a,
 			subject: "Reset your password",
@@ -277,16 +277,16 @@ var A = 5, j = 900, M = 900, N = (e) => ({
 			html: `<p><a href="${a}">Reset your password</a> — this link expires shortly.</p>`
 		})).pipe(E.ignore));
 	}
-	return I(202, { ok: !0 });
-}), te = (t, n) => E.gen(function* () {
-	if (!t.token || !t.newPassword) return I(400, { error: "token and newPassword required" });
-	if (t.newPassword.length < 8) return I(400, { error: "password must be at least 8 characters" });
-	let r = yield* n.consumeToken(_(t.token), "password-reset");
-	if (!r) return I(401, { error: "invalid or expired token" });
+	return L(202, { ok: !0 });
+}), ne = (t, n) => E.gen(function* () {
+	if (!t.token || !t.newPassword) return L(400, { error: "token and newPassword required" });
+	if (t.newPassword.length < 8) return L(400, { error: "password must be at least 8 characters" });
+	let r = yield* n.consumeToken(y(t.token), "password-reset");
+	if (!r) return L(401, { error: "invalid or expired token" });
 	let i = yield* e(t.newPassword).pipe(E.orElseSucceed(() => ""));
-	return i ? (yield* n.updatePassword(r.userId, i).pipe(E.ignore), yield* n.markEmailVerified(r.userId).pipe(E.ignore), yield* n.revokeAllSessions(r.userId).pipe(E.ignore), I(200, { ok: !0 })) : I(500, { error: "hash_failed" });
-}), ne = (e, t) => E.gen(function* () {
-	return I(200, { sessions: (yield* t.listSessions(e.userId)).map((e) => ({
+	return i ? (yield* n.updatePassword(r.userId, i).pipe(E.ignore), yield* n.markEmailVerified(r.userId).pipe(E.ignore), yield* n.revokeAllSessions(r.userId).pipe(E.ignore), L(200, { ok: !0 })) : L(500, { error: "hash_failed" });
+}), re = (e, t) => E.gen(function* () {
+	return L(200, { sessions: (yield* t.listSessions(e.userId)).map((e) => ({
 		id: e.id,
 		tenantId: e.tenantId,
 		ipAddress: e.ipAddress ?? null,
@@ -295,43 +295,43 @@ var A = 5, j = 900, M = 900, N = (e) => ({
 		lastSeenAt: e.lastSeenAt.toISOString(),
 		expiresAt: e.expiresAt.toISOString()
 	})) });
-}), re = (e, t) => E.gen(function* () {
-	return (yield* t.revokeSession(e.userId, e.sessionId)) ? I(200, {
+}), ie = (e, t) => E.gen(function* () {
+	return (yield* t.revokeSession(e.userId, e.sessionId)) ? L(200, {
 		ok: !0,
 		revoked: 1
-	}) : I(404, { error: "session_not_found" });
-}), ie = (e, t) => E.gen(function* () {
-	return I(200, {
+	}) : L(404, { error: "session_not_found" });
+}), ae = (e, t) => E.gen(function* () {
+	return L(200, {
 		ok: !0,
 		revoked: yield* t.revokeAllOtherSessions(e.userId, e.keepSessionId)
 	});
-}), ae = (e, t, n, i, o) => E.gen(function* () {
+}), oe = (e, t, n, i, o) => E.gen(function* () {
 	let s = yield* t.findById(e.userId);
-	if (!s) return I(404, { error: "user_not_found" });
+	if (!s) return L(404, { error: "user_not_found" });
 	let c = yield* t.listMemberships(s.id), l = c.find((t) => t.tenantId === e.targetTenantId)?.role ?? null;
-	if (l === null) return I(403, { error: "not a member of the target tenant" });
+	if (l === null) return L(403, { error: "not a member of the target tenant" });
 	let d = e.metadata === void 0 ? void 0 : Object.fromEntries(Object.entries(e.metadata).filter(([e]) => e !== "memberships")), f = k(u(s, { ...d === void 0 ? {} : { metadata: d } }), e.targetTenantId, c);
 	o !== void 0 && f.type === "user" && (yield* E.promise(() => O(o, {
 		type: f.type,
 		id: f.id
 	}, e.targetTenantId)));
-	let p = e.sessionId ? z(f, e.sessionId) : f, m = a(p, P(n), {
-		ttlSeconds: R,
+	let p = e.sessionId ? B(f, e.sessionId) : f, m = a(p, F(n), {
+		ttlSeconds: z,
 		...n.cookieDomain ? { domain: n.cookieDomain } : {},
 		secure: n.cookieSecure ?? !0
 	});
-	return e.clientId !== void 0 && i && i(e.clientId, { cookies: { [r]: m.value } }), I(200, {
+	return e.clientId !== void 0 && i && i(e.clientId, { cookies: { [r]: m.value } }), L(200, {
 		ok: !0,
 		tenantId: e.targetTenantId,
 		role: l,
 		subject: p
 	}, { setCookie: m.setCookie });
-}), oe = (e, t) => E.gen(function* () {
-	return I(200, { memberships: (yield* t.listMemberships(e.userId)).map((e) => ({
+}), se = (e, t) => E.gen(function* () {
+	return L(200, { memberships: (yield* t.listMemberships(e.userId)).map((e) => ({
 		tenantId: e.tenantId,
 		role: e.role,
 		joinedAt: e.joinedAt.toISOString()
 	})) });
 });
 //#endregion
-export { g as MFA_PENDING_TTL_S, P as configSessionSecrets, F as configSigningKey, V as guardSubject, X as handleCsrf, oe as handleListMemberships, ne as handleListSessions, $ as handleMagicLinkConsume, Q as handleMagicLinkRequest, K as handleMfaEnrollStart, q as handleMfaEnrollVerify, J as handleMfaRegenerateRecoveryCodes, Y as handleMfaUnenroll, U as handleMfaVerify, te as handlePasswordResetConfirm, ee as handlePasswordResetRequest, ie as handleRevokeAllOtherSessions, re as handleRevokeSession, H as handleSignIn, G as handleSignOut, W as handleSignUp, ae as handleSwitchTenant, B as issueUserSession };
+export { v as MFA_PENDING_TTL_S, F as configSessionSecrets, I as configSigningKey, H as guardSubject, Z as handleCsrf, se as handleListMemberships, re as handleListSessions, ee as handleMagicLinkConsume, $ as handleMagicLinkRequest, q as handleMfaEnrollStart, J as handleMfaEnrollVerify, Y as handleMfaRegenerateRecoveryCodes, X as handleMfaUnenroll, W as handleMfaVerify, ne as handlePasswordResetConfirm, te as handlePasswordResetRequest, ae as handleRevokeAllOtherSessions, ie as handleRevokeSession, U as handleSignIn, K as handleSignOut, G as handleSignUp, oe as handleSwitchTenant, V as issueUserSession };