@voltro/plugin-auth 0.86.0 → 0.88.0

package/dist/guestService.js

@@ -0,0 +1,223 @@
+import { newAuthId as e } from "./userStore.js";
+import { dataStoreSessionRegistry as t, issueRegisteredSession as n } from "./sessionRegistry.js";
+import { validateGuestSecrets as r } from "./guestSecrets.js";
+import { parseGuestCredential as i } from "./guestCredential.js";
+import { createHash as a, randomBytes as o, timingSafeEqual as s } from "node:crypto";
+import { Data as c, Effect as l } from "effect";
+import { noteSigningLifetime as u } from "@voltro/protocol/session";
+import { and as d, eq as f } from "@voltro/database";
+// src/guestService.ts
+var p = class extends c.TaggedError("GuestAuthError") {}, m = "authGuests", h = "authGuestDevices", g = 86400, _ = () => new p({ code: "credential_rejected" }), v = (e) => a("sha256").update(e).digest("hex"), y = (e) => e instanceof Date ? e.getTime() : typeof e == "string" ? Date.parse(e) : NaN, b = (e, t) => ({
+	table: e,
+	predicate: t,
+	order: [],
+	take: void 0,
+	skip: void 0,
+	projection: void 0
+}), x = (e, t, n) => d(f(e, t), f("tenantId", n)), S = (e, t) => typeof e != "string" || !/^[a-f0-9]{64}$/.test(e) ? !1 : s(Buffer.from(e, "hex"), Buffer.from(v(t), "hex")), C = (e) => {
+	let t = i(e);
+	if (!t) throw _();
+	return t;
+}, w = (e) => l.tryPromise({
+	try: e,
+	catch: (e) => e instanceof p ? e : new p({ code: "store_unavailable" })
+}), T = (i, a) => {
+	if (!a.tenantId.trim()) throw Error("Guest authentication requires a server-owned tenant");
+	let s = a.ttlSeconds ?? 365 * g, c = a.sessionTtlSeconds ?? 7 * g;
+	if (![s, c].every((e) => Number.isSafeInteger(e) && e > 0 && e <= 3650 * g)) throw Error("Guest authentication lifetimes must be positive bounded whole seconds");
+	u("session", c * 1e3);
+	let l = a.now ?? Date.now, d = (e, t, n, r) => e.query(b(t, x(n, r, a.tenantId))), f = async (e, t, n) => {
+		let r = await e.update(m, t, { lastSeenAt: new Date(n) });
+		if (!r || r.tenantId !== a.tenantId) throw _();
+		return r;
+	}, T = async (e, t, n) => {
+		let r = C(t), i = await f(e, r.guestId, n), a = (await d(e, h, "id", r.deviceId))[0];
+		if (!a || a.guestId !== r.guestId || !S(a.secretHash, r.secret) || !(y(i.expiresAt) > n) || !(y(a.expiresAt) > n) || !Number.isSafeInteger(a.generation) || Number(a.generation) < 0) throw _();
+		return {
+			guest: i,
+			device: a,
+			parsed: r
+		};
+	}, E = async (e, i, o, s) => {
+		let l = Math.floor((Math.min(y(i.expiresAt), y(o.expiresAt)) - s) / 1e3);
+		if (l < 1) throw _();
+		let u = {
+			type: "user",
+			kind: "guest",
+			id: String(i.id),
+			tenantId: a.tenantId,
+			metadata: {
+				guestDeviceId: o.id,
+				guestDeviceGeneration: o.generation
+			}
+		}, d = await n(t(e), u, r(typeof a.secret == "function" ? a.secret() : a.secret), {
+			ttlSeconds: Math.min(c, l),
+			now: () => s,
+			...a.secure === void 0 ? {} : { secure: a.secure }
+		});
+		return {
+			...d,
+			subject: {
+				...u,
+				metadata: {
+					...u.metadata,
+					sessionId: d.sessionId
+				}
+			}
+		};
+	}, D = async (e, t) => {
+		for (let n of await d(e, "sessions", "userId", t)) await e.delete("sessions", String(n.id));
+	};
+	return {
+		create: () => w(async () => {
+			let t = l(), n = e("guest"), r = e("gdev"), c = o(32).toString("base64url"), u = {
+				id: n,
+				tenantId: a.tenantId,
+				upgradeable: a.upgradeable ?? !0,
+				expiresAt: new Date(t + s * 1e3),
+				createdAt: new Date(t),
+				lastSeenAt: new Date(t)
+			}, d = {
+				id: r,
+				guestId: n,
+				tenantId: a.tenantId,
+				secretHash: v(c),
+				generation: 0,
+				expiresAt: u.expiresAt,
+				createdAt: new Date(t)
+			};
+			return i.transactional(async (e) => (await e.insert(m, u), await e.insert(h, d), {
+				...await E(e, u, d, t),
+				deviceCredential: `${n}.${r}.${c}`
+			}));
+		}),
+		resume: (e) => w(async () => {
+			let t = l();
+			return i.transactional(async (n) => {
+				let { guest: r, device: i } = await T(n, e, t);
+				return E(n, r, i, t);
+			});
+		}),
+		prepareRotation: (e) => w(async () => {
+			r(typeof a.secret == "function" ? a.secret() : a.secret);
+			let t = l(), n = o(32).toString("base64url");
+			return i.transactional(async (r) => {
+				let { parsed: i } = await T(r, e, t);
+				return { deviceCredential: `${i.guestId}.${i.deviceId}.${n}` };
+			});
+		}),
+		rotate: (e, t) => w(async () => {
+			let n = l(), r = C(t);
+			return i.transactional(async (i) => {
+				let { guest: a, device: o, parsed: s } = await T(i, e, n);
+				if (r.guestId !== s.guestId || r.deviceId !== s.deviceId || r.secret === s.secret) throw _();
+				let c = Number(o.generation) + 1;
+				if (!Number.isSafeInteger(c)) throw _();
+				let l = await i.update(h, s.deviceId, {
+					secretHash: v(r.secret),
+					generation: c
+				});
+				if (!l) throw _();
+				return await D(i, s.guestId), {
+					...await E(i, a, l, n),
+					deviceCredential: t
+				};
+			});
+		}),
+		revoke: (e) => w(async () => {
+			let t = l();
+			await i.transactional(async (n) => {
+				let { parsed: r } = await T(n, e, t);
+				await n.delete(h, r.deviceId), await D(n, r.guestId);
+			});
+		}),
+		upgrade: (e, t) => w(async () => {
+			r(typeof a.secret == "function" ? a.secret() : a.secret);
+			let n = l();
+			return i.transactional(async (r) => {
+				let { guest: i, parsed: o } = await T(r, e, n);
+				if (i.upgradeable !== !0 && i.upgradeable !== 1) throw _();
+				if ((await d(r, "users", "id", o.guestId)).length !== 0) throw new p({ code: "upgrade_conflict" });
+				await D(r, o.guestId);
+				let s = await t({
+					store: r,
+					subjectId: o.guestId,
+					tenantId: a.tenantId,
+					createdAt: new Date(y(i.createdAt))
+				}), c = (await d(r, "users", "id", o.guestId))[0];
+				if (!c || c.id !== o.guestId || c.tenantId !== a.tenantId) throw new p({ code: "upgrade_conflict" });
+				for (let e of await d(r, h, "guestId", o.guestId)) await r.delete(h, String(e.id));
+				if (!await r.delete(m, o.guestId)) throw _();
+				return s;
+			});
+		}),
+		erase: (e) => w(async () => i.transactional(async (t) => {
+			let n = await t.update(m, e, { lastSeenAt: new Date(l()) });
+			if (!n) return !1;
+			if (n.tenantId !== a.tenantId) throw _();
+			for (let n of await d(t, h, "guestId", e)) await t.delete(h, String(n.id));
+			return await D(t, e), t.delete(m, e);
+		})),
+		mergeInto: (e, t, n) => w(async () => {
+			r(typeof a.secret == "function" ? a.secret() : a.secret);
+			let o = l();
+			if (typeof t != "string" || !t.trim()) throw _();
+			return i.transactional(async (r) => {
+				let { guest: i, parsed: s } = await T(r, e, o);
+				if (i.upgradeable !== !0 && i.upgradeable !== 1) throw _();
+				if (t === s.guestId) throw new p({ code: "upgrade_conflict" });
+				let c = await r.update("users", t, { updatedAt: new Date(o) });
+				if (!c || c.id !== t || c.tenantId !== a.tenantId || c.deactivatedAt !== null && c.deactivatedAt !== void 0 || (await d(r, m, "id", t)).length !== 0 || (await d(r, "users", "id", s.guestId)).length !== 0) throw _();
+				await D(r, s.guestId);
+				let l = await n({
+					store: r,
+					subjectId: s.guestId,
+					targetId: t,
+					tenantId: a.tenantId,
+					createdAt: new Date(y(i.createdAt))
+				}), u = (await d(r, "users", "id", t))[0];
+				if (!u || u.id !== t || u.tenantId !== a.tenantId || (await d(r, "users", "id", s.guestId)).length !== 0) throw new p({ code: "upgrade_conflict" });
+				for (let e of await d(r, h, "guestId", s.guestId)) await r.delete(h, String(e.id));
+				if (!await r.delete(m, s.guestId)) throw _();
+				return l;
+			});
+		}),
+		export: (e) => w(async () => {
+			let t = (await d(i, m, "id", e))[0];
+			if (!t) return null;
+			let n = await d(i, h, "guestId", e), r = await d(i, "sessions", "userId", e);
+			return {
+				subject: {
+					id: e,
+					tenantId: a.tenantId,
+					kind: "guest",
+					upgradeable: t.upgradeable === !0 || t.upgradeable === 1,
+					createdAt: y(t.createdAt),
+					expiresAt: y(t.expiresAt)
+				},
+				devices: n.map((e) => ({
+					id: String(e.id),
+					generation: Number(e.generation),
+					createdAt: y(e.createdAt),
+					expiresAt: y(e.expiresAt)
+				})),
+				sessions: r.map((e) => ({
+					id: String(e.id),
+					expiresAt: y(e.expiresAt)
+				}))
+			};
+		}),
+		isLive: (e) => w(async () => {
+			if (e.type !== "user" || e.kind !== "guest" || e.tenantId !== a.tenantId) return !1;
+			let t = e.metadata?.sessionId, n = e.metadata?.guestDeviceId, r = e.metadata?.guestDeviceGeneration;
+			if (typeof t != "string" || typeof n != "string" || !Number.isSafeInteger(r)) return !1;
+			let o = l(), s = (await d(i, m, "id", e.id))[0];
+			if (!s || !(y(s.expiresAt) > o)) return !1;
+			let c = (await d(i, h, "id", n))[0];
+			if (!c || c.guestId !== e.id || c.generation !== r || !(y(c.expiresAt) > o)) return !1;
+			let u = (await d(i, "sessions", "id", t))[0];
+			return u?.userId === e.id && y(u.expiresAt) > o;
+		})
+	};
+};
+export { p as GuestAuthError, T as dataStoreGuestAuth };

package/dist/handlers.js

@@ -1,41 +1,41 @@
 import { hashPassword as e, verifyPassword as t, verifyPasswordWithRehash as n } from "./password.js";
 import { SESSION_COOKIE_NAME as r, clearSessionCookie as i, issueSession as a, resolveSessionSecret as o, resolveSessionSecrets as s, sessionSecretsOf as c } from "./session.js";
 import { newAuthId as l, subjectFromUser as u } from "./userStore.js";
-import { runSubjectGuards as d } from "./subjectGuard.js";
-import { generateRecoveryCodes as f, generateTotpSecret as p, otpauthUrl as m, verifyTotpCode as h } from "./totp.js";
-import { MFA_PENDING_TTL_S as g, hashToken as _, mintToken as v } from "./tokens.js";
-import { CSRF_COOKIE_NAME as y, issueCsrfToken as b } from "./csrf.js";
-import { decideAdmission as x } from "./admission.js";
+import { CSRF_COOKIE_NAME as d, issueCsrfToken as f } from "./csrf.js";
+import { decideAdmission as p } from "./admission.js";
+import { generateRecoveryCodes as m, generateTotpSecret as h, otpauthUrl as g, verifyTotpCode as _ } from "./totp.js";
+import { MFA_PENDING_TTL_S as v, hashToken as y, mintToken as b } from "./tokens.js";
+import { runSubjectGuards as x } from "./subjectGuard.js";
 import { EMAIL_VERIFIED_METADATA_KEY as S, emailVerificationActive as C, sendEmailVerification as w, userEmailVerified as T } from "./emailVerification.js";
 import { Effect as E } from "effect";
 import { buildSetCookie as D } from "@voltro/protocol/session";
 import { writeTenantSelection as O } from "@voltro/database";
 import { selectSubjectTenant as k } from "@voltro/protocol";
-//#region src/handlers.ts
-var A = 5, j = 900, M = 900, N = (e) => ({
+// src/handlers.ts
+var A = 5, j = 900, M = 900, N = (e) => e.email ?? `user:${e.id}`, P = (e) => ({
 	maxAttempts: e.lockout?.maxAttempts ?? A,
 	windowMs: (e.lockout?.windowSeconds ?? j) * 1e3,
 	lockMs: (e.lockout?.lockSeconds ?? M) * 1e3
-}), P = (e) => e.secrets ?? (e.secret === void 0 ? s() : c(e.secret)), F = (e) => e.secret ?? o(), I = (e, t, n = {}) => ({
+}), F = (e) => e.secrets ?? (e.secret === void 0 ? s() : c(e.secret)), I = (e) => e.secret ?? o(), L = (e, t, n = {}) => ({
 	status: e,
 	body: JSON.stringify(t),
 	contentType: "application/json; charset=utf-8",
 	...n
-}), L = (e, t = {}) => ({
+}), R = (e, t = {}) => ({
 	status: 302,
 	body: "",
 	contentType: "text/plain",
 	location: e,
 	...t
-}), R = 604800, z = (e, t) => e.type === "user" ? {
+}), z = 604800, B = (e, t) => e.type === "user" ? {
 	...e,
 	metadata: {
 		...e.metadata ?? {},
 		sessionId: t
 	}
-} : e, B = (e, t, n, r = {}) => E.gen(function* () {
-	r.clearLoginFailures !== !1 && (yield* t.clearLoginFailures(e.email)), n.ensureActor && (yield* n.ensureActor(e));
-	let i = yield* t.listMemberships(e.id), o = r.sessionId ?? l("sess"), s = r.ttlSeconds ?? R;
+} : e, V = (e, t, n, r = {}) => E.gen(function* () {
+	r.clearLoginFailures !== !1 && (yield* t.clearLoginFailures(N(e))), n.ensureActor && (yield* n.ensureActor(e));
+	let i = yield* t.listMemberships(e.id), o = r.sessionId ?? l("sess"), s = r.ttlSeconds ?? z;
 	r.sessionRow !== "existing" && (yield* t.insertSession({
 		id: o,
 		userId: e.id,
@@ -46,10 +46,10 @@ var A = 5, j = 900, M = 900, N = (e) => ({
 	}).pipe(E.ignore));
 	let c = { ...r.metadata };
 	C(n.emailVerification) && (c[S] = T(e, n.emailVerification));
-	let d = z(u(e, {
+	let d = B(u(e, {
 		memberships: i,
 		...Object.keys(c).length > 0 ? { metadata: c } : {}
-	}), o), f = a(d, P(n), {
+	}), o), f = a(d, F(n), {
 		ttlSeconds: s,
 		...n.cookieDomain ? { domain: n.cookieDomain } : {},
 		secure: n.cookieSecure ?? !0
@@ -60,18 +60,18 @@ var A = 5, j = 900, M = 900, N = (e) => ({
 		expiresAt: Math.floor(Date.now() / 1e3) + s,
 		subject: d
 	};
-}), V = (e, t) => E.gen(function* () {
+}), H = (e, t) => E.gen(function* () {
 	let n = t.subjectGuards ?? [];
 	if (n.length === 0) return null;
-	let r = yield* d(n, e);
-	return r.ok ? null : I(403, {
+	let r = yield* x(n, e);
+	return r.ok ? null : L(403, {
 		error: r.code,
 		message: r.message
 	});
-}), H = (r, i, a) => E.gen(function* () {
-	if (!r.email || !r.password) return I(400, { error: "email and password required" });
+}), U = (r, i, a) => E.gen(function* () {
+	if (!r.email || !r.password) return L(400, { error: "email and password required" });
 	let o = yield* i.findByEmail(r.email), s = (a.now ?? Date.now)(), c = yield* i.isLockedOut(r.email, s);
-	if (c.locked) return I(429, {
+	if (c.locked) return L(429, {
 		error: "account_locked",
 		retryAfterSeconds: c.retryAfterSeconds
 	});
@@ -79,65 +79,65 @@ var A = 5, j = 900, M = 900, N = (e) => ({
 		let n = yield* e("decoy-not-a-real-password").pipe(E.orElseSucceed(() => ""));
 		return yield* t(r.password, n), { valid: !1 };
 	});
-	if (!o || !d.valid) return yield* i.recordLoginFailure(r.email, s, N(a)), I(401, { error: "invalid credentials" });
-	let f = yield* V(o, a);
+	if (!o || !d.valid) return yield* i.recordLoginFailure(r.email, s, P(a)), L(401, { error: "invalid credentials" });
+	let f = yield* H(o, a);
 	if (f) return f;
 	if (d.rehash && (yield* i.updatePassword(o.id, d.rehash).pipe(E.ignore)), o.mfaEnrolledAt) {
-		let e = v("mfa-pending", 300);
+		let e = b("mfa-pending", 300);
 		return yield* i.insertToken({
 			id: l("tok"),
 			tokenHash: e.tokenHash,
 			userId: o.id,
 			purpose: "mfa-pending",
 			expiresAt: e.expiresAt
-		}).pipe(E.ignore), I(200, {
+		}).pipe(E.ignore), L(200, {
 			ok: !0,
 			mfaRequired: !0,
 			pendingToken: e.token,
 			expiresInSeconds: 300
 		});
 	}
-	let { setCookie: p, subject: m } = yield* B(o, i, a, {
+	let { setCookie: p, subject: m } = yield* V(o, i, a, {
 		ipAddress: r.ipAddress ?? null,
 		userAgent: r.userAgent ?? null
 	});
-	return r.redirectAfter ? L(a.successRedirect ?? "/", { setCookie: p }) : I(200, {
+	return r.redirectAfter ? R(a.successRedirect ?? "/", { setCookie: p }) : L(200, {
 		ok: !0,
 		subject: m
 	}, { setCookie: p });
-}), U = (e, t, n) => E.gen(function* () {
-	if (!e.pendingToken) return I(400, { error: "pending token required" });
-	if (!e.code && !e.recoveryCode) return I(400, { error: "code or recoveryCode required" });
-	let r = yield* t.consumeToken(_(e.pendingToken), "mfa-pending");
-	if (!r) return I(401, { error: "invalid or expired challenge" });
+}), W = (e, t, n) => E.gen(function* () {
+	if (!e.pendingToken) return L(400, { error: "pending token required" });
+	if (!e.code && !e.recoveryCode) return L(400, { error: "code or recoveryCode required" });
+	let r = yield* t.consumeToken(y(e.pendingToken), "mfa-pending");
+	if (!r) return L(401, { error: "invalid or expired challenge" });
 	let i = yield* t.findById(r.userId);
-	if (!i || !i.mfaEnrolledAt || !i.mfaSecret) return I(401, { error: "mfa not enrolled" });
-	let a = (n.now ?? Date.now)(), o = yield* t.isLockedOut(i.email, a);
-	if (o.locked) return I(429, {
+	if (!i || !i.mfaEnrolledAt || !i.mfaSecret) return L(401, { error: "mfa not enrolled" });
+	let a = (n.now ?? Date.now)(), o = yield* t.isLockedOut(N(i), a);
+	if (o.locked) return L(429, {
 		error: "account_locked",
 		retryAfterSeconds: o.retryAfterSeconds
 	});
-	let s = yield* V(i, n);
+	let s = yield* H(i, n);
 	if (s) return s;
-	if (!(e.recoveryCode ? yield* t.consumeRecoveryCode(i.id, _(e.recoveryCode.trim())) : yield* h(i.mfaSecret, e.code ?? "").pipe(E.map(() => !0), E.catchTag("TotpVerifyError", () => E.succeed(!1))))) return yield* t.recordLoginFailure(i.email, a, N(n)), I(401, { error: "invalid_code" });
-	let { setCookie: c, subject: l } = yield* B(i, t, n, {
+	if (!(e.recoveryCode ? yield* t.consumeRecoveryCode(i.id, y(e.recoveryCode.trim())) : yield* _(i.mfaSecret, e.code ?? "").pipe(E.map(() => !0), E.catchTag("TotpVerifyError", () => E.succeed(!1))))) return yield* t.recordLoginFailure(N(i), a, P(n)), L(401, { error: "invalid_code" });
+	let { setCookie: c, subject: l } = yield* V(i, t, n, {
 		ipAddress: e.ipAddress ?? null,
 		userAgent: e.userAgent ?? null
 	});
-	return e.redirectAfter ? L(n.successRedirect ?? "/", { setCookie: c }) : I(200, {
+	return e.redirectAfter ? R(n.successRedirect ?? "/", { setCookie: c }) : L(200, {
 		ok: !0,
 		subject: l
 	}, { setCookie: c });
-}), W = (t, n, r) => E.gen(function* () {
-	if (!t.email || !t.password) return I(400, { error: "email and password required" });
-	if (t.password.length < 8) return I(400, { error: "password must be at least 8 characters" });
-	if (yield* n.findByEmail(t.email)) return I(409, { error: "email already registered" });
-	let i = t.tenantId ?? r.defaultTenantId, a = yield* x(r.admit, {
+}), G = (t, n, r) => E.gen(function* () {
+	if (!t.email || !t.password) return L(400, { error: "email and password required" });
+	if (t.password.length < 8) return L(400, { error: "password must be at least 8 characters" });
+	if (yield* n.findByEmail(t.email)) return L(409, { error: "email already registered" });
+	let i = t.tenantId ?? r.defaultTenantId, a = yield* p(r.admit, {
 		email: t.email,
 		tenantId: i,
 		via: "sign-up"
 	});
-	if (a) return I(403, {
+	if (a) return L(403, {
 		error: "not_admitted",
 		reason: a.reason,
 		message: a.message
@@ -153,15 +153,15 @@ var A = 5, j = 900, M = 900, N = (e) => ({
 		tenantId: i,
 		role: "owner"
 	}).pipe(E.ignore), C(r.emailVerification) && (r.emailVerification?.sendOnSignUp ?? !0) && (yield* w(s, n, r).pipe(E.ignore));
-	let { setCookie: c, subject: u } = yield* B(s, n, r);
-	return t.redirectAfter ? L(r.successRedirect ?? "/", { setCookie: c }) : I(200, {
+	let { setCookie: c, subject: u } = yield* V(s, n, r);
+	return t.redirectAfter ? R(r.successRedirect ?? "/", { setCookie: c }) : L(200, {
 		ok: !0,
 		subject: u
 	}, { setCookie: c });
-}).pipe(E.catch((e) => E.succeed(I(500, {
+}).pipe(E.catch((e) => E.succeed(L(500, {
 	error: "signup_failed",
 	cause: String(e)
-})))), G = (e) => ({
+})))), K = (e) => ({
 	status: 302,
 	body: "",
 	location: e.successRedirect ?? "/",
@@ -169,61 +169,61 @@ var A = 5, j = 900, M = 900, N = (e) => ({
 		...e.cookieDomain ? { domain: e.cookieDomain } : {},
 		secure: e.cookieSecure ?? !0
 	})
-}), K = (e, t) => E.gen(function* () {
+}), q = (e, t) => E.gen(function* () {
 	let n = yield* t.findById(e.userId);
-	if (!n) return I(404, { error: "user_not_found" });
-	let r = p();
-	return yield* t.setMfaSecret(n.id, r).pipe(E.catch(() => E.succeed(n))), I(200, {
+	if (!n) return L(404, { error: "user_not_found" });
+	let r = h();
+	return yield* t.setMfaSecret(n.id, r).pipe(E.catch(() => E.succeed(n))), L(200, {
 		ok: !0,
 		secret: r,
-		otpauthUrl: m({
+		otpauthUrl: g({
 			issuer: e.issuer,
 			accountName: e.accountName,
 			secret: r
 		})
 	});
-}), q = (e, t) => E.gen(function* () {
+}), J = (e, t) => E.gen(function* () {
 	let n = yield* t.findById(e.userId);
-	if (!n) return I(404, { error: "user_not_found" });
-	if (!n.mfaSecret) return I(400, { error: "no_enrollment_in_progress" });
-	if (n.mfaEnrolledAt) return I(409, { error: "already_enrolled" });
-	if (!(yield* h(n.mfaSecret, e.code).pipe(E.map(() => !0), E.catchTag("TotpVerifyError", () => E.succeed(!1))))) return I(401, { error: "invalid_code" });
+	if (!n) return L(404, { error: "user_not_found" });
+	if (!n.mfaSecret) return L(400, { error: "no_enrollment_in_progress" });
+	if (n.mfaEnrolledAt) return L(409, { error: "already_enrolled" });
+	if (!(yield* _(n.mfaSecret, e.code).pipe(E.map(() => !0), E.catchTag("TotpVerifyError", () => E.succeed(!1))))) return L(401, { error: "invalid_code" });
 	yield* t.markMfaEnrolled(n.id).pipe(E.catch(() => E.succeed(n)));
-	let r = f();
-	return yield* t.replaceRecoveryCodes(n.id, r.map((e) => _(e))).pipe(E.ignore), I(200, {
+	let r = m();
+	return yield* t.replaceRecoveryCodes(n.id, r.map((e) => y(e))).pipe(E.ignore), L(200, {
 		ok: !0,
 		enrolled: !0,
 		recoveryCodes: r
 	});
-}), J = (e, t) => E.gen(function* () {
+}), Y = (e, t) => E.gen(function* () {
 	let n = yield* t.findById(e.userId);
-	if (!n) return I(404, { error: "user_not_found" });
-	if (!n.mfaEnrolledAt) return I(400, { error: "mfa_not_enrolled" });
-	let r = f();
-	return yield* t.replaceRecoveryCodes(n.id, r.map((e) => _(e))).pipe(E.ignore), I(200, {
+	if (!n) return L(404, { error: "user_not_found" });
+	if (!n.mfaEnrolledAt) return L(400, { error: "mfa_not_enrolled" });
+	let r = m();
+	return yield* t.replaceRecoveryCodes(n.id, r.map((e) => y(e))).pipe(E.ignore), L(200, {
 		ok: !0,
 		recoveryCodes: r
 	});
-}), Y = (e, t) => E.gen(function* () {
+}), X = (e, t) => E.gen(function* () {
 	let n = yield* t.findById(e.userId);
-	return n ? (yield* t.clearMfa(n.id).pipe(E.catch(() => E.succeed(n))), yield* t.replaceRecoveryCodes(n.id, []).pipe(E.ignore), I(200, {
+	return n ? (yield* t.clearMfa(n.id).pipe(E.catch(() => E.succeed(n))), yield* t.replaceRecoveryCodes(n.id, []).pipe(E.ignore), L(200, {
 		ok: !0,
 		enrolled: !1
-	})) : I(404, { error: "user_not_found" });
-}), X = (e) => {
-	let t = b(F(e)), n = D(y, t, {
+	})) : L(404, { error: "user_not_found" });
+}), Z = (e) => {
+	let t = f(I(e)), n = D(d, t, {
 		httpOnly: !1,
 		sameSite: "lax",
 		secure: e.cookieSecure ?? !0,
 		...e.cookieDomain ? { domain: e.cookieDomain } : {},
 		path: "/"
 	});
-	return I(200, { csrfToken: t }, { setCookie: n });
-}, Z = (e, t, n) => `${e}${t}${t.includes("?") ? "&" : "?"}token=${encodeURIComponent(n)}`, Q = (e, t, n) => E.gen(function* () {
-	if (!e.email) return I(400, { error: "email required" });
+	return L(200, { csrfToken: t }, { setCookie: n });
+}, Q = (e, t, n) => `${e}${t}${t.includes("?") ? "&" : "?"}token=${encodeURIComponent(n)}`, $ = (e, t, n) => E.gen(function* () {
+	if (!e.email) return L(400, { error: "email required" });
 	let r = yield* t.findByEmail(e.email);
 	if (r) {
-		let i = v("magic-link");
+		let i = b("magic-link");
 		yield* t.insertToken({
 			id: l("tok"),
 			tokenHash: i.tokenHash,
@@ -231,9 +231,9 @@ var A = 5, j = 900, M = 900, N = (e) => ({
 			purpose: "magic-link",
 			expiresAt: i.expiresAt
 		}).pipe(E.ignore);
-		let a = Z(n.appBaseUrl ?? "", e.callbackPath ?? "/auth/magic-link/callback", i.token);
+		let a = Q(n.appBaseUrl ?? "", e.callbackPath ?? "/auth/magic-link/callback", i.token);
 		n.sendEmail && (yield* E.tryPromise(() => n.sendEmail({
-			to: r.email,
+			to: r.email ?? e.email,
 			kind: "magic-link",
 			actionUrl: a,
 			subject: "Your sign-in link",
@@ -241,25 +241,25 @@ var A = 5, j = 900, M = 900, N = (e) => ({
 			html: `<p><a href="${a}">Sign in</a> — this link expires shortly.</p>`
 		})).pipe(E.ignore));
 	}
-	return I(202, { ok: !0 });
-}), $ = (e, t, n) => E.gen(function* () {
-	if (!e.token) return I(400, { error: "token required" });
-	let r = yield* t.consumeToken(_(e.token), "magic-link");
-	if (!r) return I(401, { error: "invalid or expired token" });
+	return L(202, { ok: !0 });
+}), ee = (e, t, n) => E.gen(function* () {
+	if (!e.token) return L(400, { error: "token required" });
+	let r = yield* t.consumeToken(y(e.token), "magic-link");
+	if (!r) return L(401, { error: "invalid or expired token" });
 	let i = yield* t.findById(r.userId);
-	if (!i) return I(401, { error: "invalid or expired token" });
-	let a = yield* t.markEmailVerified(i.id).pipe(E.orElseSucceed(() => i)), o = yield* V(a, n);
+	if (!i) return L(401, { error: "invalid or expired token" });
+	let a = yield* t.markEmailVerified(i.id).pipe(E.orElseSucceed(() => i)), o = yield* H(a, n);
 	if (o) return o;
-	let { setCookie: s, subject: c } = yield* B(a, t, n);
-	return e.redirectAfter ? L(n.successRedirect ?? "/", { setCookie: s }) : I(200, {
+	let { setCookie: s, subject: c } = yield* V(a, t, n);
+	return e.redirectAfter ? R(n.successRedirect ?? "/", { setCookie: s }) : L(200, {
 		ok: !0,
 		subject: c
 	}, { setCookie: s });
-}), ee = (e, t, n) => E.gen(function* () {
-	if (!e.email) return I(400, { error: "email required" });
+}), te = (e, t, n) => E.gen(function* () {
+	if (!e.email) return L(400, { error: "email required" });
 	let r = yield* t.findByEmail(e.email);
 	if (r) {
-		let i = v("password-reset");
+		let i = b("password-reset");
 		yield* t.insertToken({
 			id: l("tok"),
 			tokenHash: i.tokenHash,
@@ -267,9 +267,9 @@ var A = 5, j = 900, M = 900, N = (e) => ({
 			purpose: "password-reset",
 			expiresAt: i.expiresAt
 		}).pipe(E.ignore);
-		let a = Z(n.appBaseUrl ?? "", e.callbackPath ?? "/auth/password-reset/callback", i.token);
+		let a = Q(n.appBaseUrl ?? "", e.callbackPath ?? "/auth/password-reset/callback", i.token);
 		n.sendEmail && (yield* E.tryPromise(() => n.sendEmail({
-			to: r.email,
+			to: r.email ?? e.email,
 			kind: "password-reset",
 			actionUrl: a,
 			subject: "Reset your password",
@@ -277,16 +277,16 @@ var A = 5, j = 900, M = 900, N = (e) => ({
 			html: `<p><a href="${a}">Reset your password</a> — this link expires shortly.</p>`
 		})).pipe(E.ignore));
 	}
-	return I(202, { ok: !0 });
-}), te = (t, n) => E.gen(function* () {
-	if (!t.token || !t.newPassword) return I(400, { error: "token and newPassword required" });
-	if (t.newPassword.length < 8) return I(400, { error: "password must be at least 8 characters" });
-	let r = yield* n.consumeToken(_(t.token), "password-reset");
-	if (!r) return I(401, { error: "invalid or expired token" });
+	return L(202, { ok: !0 });
+}), ne = (t, n) => E.gen(function* () {
+	if (!t.token || !t.newPassword) return L(400, { error: "token and newPassword required" });
+	if (t.newPassword.length < 8) return L(400, { error: "password must be at least 8 characters" });
+	let r = yield* n.consumeToken(y(t.token), "password-reset");
+	if (!r) return L(401, { error: "invalid or expired token" });
 	let i = yield* e(t.newPassword).pipe(E.orElseSucceed(() => ""));
-	return i ? (yield* n.updatePassword(r.userId, i).pipe(E.ignore), yield* n.markEmailVerified(r.userId).pipe(E.ignore), yield* n.revokeAllSessions(r.userId).pipe(E.ignore), I(200, { ok: !0 })) : I(500, { error: "hash_failed" });
-}), ne = (e, t) => E.gen(function* () {
-	return I(200, { sessions: (yield* t.listSessions(e.userId)).map((e) => ({
+	return i ? (yield* n.updatePassword(r.userId, i).pipe(E.ignore), yield* n.markEmailVerified(r.userId).pipe(E.ignore), yield* n.revokeAllSessions(r.userId).pipe(E.ignore), L(200, { ok: !0 })) : L(500, { error: "hash_failed" });
+}), re = (e, t) => E.gen(function* () {
+	return L(200, { sessions: (yield* t.listSessions(e.userId)).map((e) => ({
 		id: e.id,
 		tenantId: e.tenantId,
 		ipAddress: e.ipAddress ?? null,
@@ -295,43 +295,42 @@ var A = 5, j = 900, M = 900, N = (e) => ({
 		lastSeenAt: e.lastSeenAt.toISOString(),
 		expiresAt: e.expiresAt.toISOString()
 	})) });
-}), re = (e, t) => E.gen(function* () {
-	return (yield* t.revokeSession(e.userId, e.sessionId)) ? I(200, {
+}), ie = (e, t) => E.gen(function* () {
+	return (yield* t.revokeSession(e.userId, e.sessionId)) ? L(200, {
 		ok: !0,
 		revoked: 1
-	}) : I(404, { error: "session_not_found" });
-}), ie = (e, t) => E.gen(function* () {
-	return I(200, {
+	}) : L(404, { error: "session_not_found" });
+}), ae = (e, t) => E.gen(function* () {
+	return L(200, {
 		ok: !0,
 		revoked: yield* t.revokeAllOtherSessions(e.userId, e.keepSessionId)
 	});
-}), ae = (e, t, n, i, o) => E.gen(function* () {
+}), oe = (e, t, n, i, o) => E.gen(function* () {
 	let s = yield* t.findById(e.userId);
-	if (!s) return I(404, { error: "user_not_found" });
+	if (!s) return L(404, { error: "user_not_found" });
 	let c = yield* t.listMemberships(s.id), l = c.find((t) => t.tenantId === e.targetTenantId)?.role ?? null;
-	if (l === null) return I(403, { error: "not a member of the target tenant" });
+	if (l === null) return L(403, { error: "not a member of the target tenant" });
 	let d = e.metadata === void 0 ? void 0 : Object.fromEntries(Object.entries(e.metadata).filter(([e]) => e !== "memberships")), f = k(u(s, { ...d === void 0 ? {} : { metadata: d } }), e.targetTenantId, c);
 	o !== void 0 && f.type === "user" && (yield* E.promise(() => O(o, {
 		type: f.type,
 		id: f.id
 	}, e.targetTenantId)));
-	let p = e.sessionId ? z(f, e.sessionId) : f, m = a(p, P(n), {
-		ttlSeconds: R,
+	let p = e.sessionId ? B(f, e.sessionId) : f, m = a(p, F(n), {
+		ttlSeconds: z,
 		...n.cookieDomain ? { domain: n.cookieDomain } : {},
 		secure: n.cookieSecure ?? !0
 	});
-	return e.clientId !== void 0 && i && i(e.clientId, { cookies: { [r]: m.value } }), I(200, {
+	return e.clientId !== void 0 && i && i(e.clientId, { cookies: { [r]: m.value } }), L(200, {
 		ok: !0,
 		tenantId: e.targetTenantId,
 		role: l,
 		subject: p
 	}, { setCookie: m.setCookie });
-}), oe = (e, t) => E.gen(function* () {
-	return I(200, { memberships: (yield* t.listMemberships(e.userId)).map((e) => ({
+}), se = (e, t) => E.gen(function* () {
+	return L(200, { memberships: (yield* t.listMemberships(e.userId)).map((e) => ({
 		tenantId: e.tenantId,
 		role: e.role,
 		joinedAt: e.joinedAt.toISOString()
 	})) });
 });
-//#endregion
-export { g as MFA_PENDING_TTL_S, P as configSessionSecrets, F as configSigningKey, V as guardSubject, X as handleCsrf, oe as handleListMemberships, ne as handleListSessions, $ as handleMagicLinkConsume, Q as handleMagicLinkRequest, K as handleMfaEnrollStart, q as handleMfaEnrollVerify, J as handleMfaRegenerateRecoveryCodes, Y as handleMfaUnenroll, U as handleMfaVerify, te as handlePasswordResetConfirm, ee as handlePasswordResetRequest, ie as handleRevokeAllOtherSessions, re as handleRevokeSession, H as handleSignIn, G as handleSignOut, W as handleSignUp, ae as handleSwitchTenant, B as issueUserSession };
+export { v as MFA_PENDING_TTL_S, F as configSessionSecrets, I as configSigningKey, H as guardSubject, Z as handleCsrf, se as handleListMemberships, re as handleListSessions, ee as handleMagicLinkConsume, $ as handleMagicLinkRequest, q as handleMfaEnrollStart, J as handleMfaEnrollVerify, Y as handleMfaRegenerateRecoveryCodes, X as handleMfaUnenroll, W as handleMfaVerify, ne as handlePasswordResetConfirm, te as handlePasswordResetRequest, ae as handleRevokeAllOtherSessions, ie as handleRevokeSession, U as handleSignIn, K as handleSignOut, G as handleSignUp, oe as handleSwitchTenant, V as issueUserSession };