@zeyolabs/kit 2026.11.5 → 2026.11.7

package/README.md

@@ -2,8 +2,8 @@
 
 Shared server toolkit for SvelteKit 3 on Cloudflare Workers: remote-function wrappers
 (`Remote.Query/Cmd/Form`), errors and results, the per-request Cloudflare context
-(`runWithContext`, `workersEnv`), rate limiting, Turnstile, logging and monitoring, storage
-clients, utils, and the shared ESLint config.
+(`runWithContext`, `workersEnv`), passwordless auth, email (binding or SMTP), rate limiting, Turnstile, logging
+and monitoring, storage clients, utils, and the shared ESLint config.
 
 Published as source (TypeScript, no build step): the consuming SvelteKit app compiles it.
 
@@ -18,17 +18,80 @@ Peer dependencies: `@sveltejs/kit` 3, `drizzle-orm`, `zod`, `@sentry/sveltekit`;
 
 ## Versions
 
-Date versions: `YYYY.M.D` (the release day in London; semver forbids leading zeros, so
-`2026.11.5`). One release per day.
-
-```
-pnpm release                     # sets the version, commits, tags vYYYY.M.D
-git push origin HEAD vYYYY.M.D   # the tag publishes to npm (publish.yaml)
-```
+Every merge to `main` publishes a new version (`.github/workflows/publish.yaml`). There is no
+release step. Versions are `YYYY.M.N` in London time: `N` counts that month's releases and resets
+each month (`2026.11.7`, `2026.11.8`, then `2026.12.0`). CI sets the version and pushes the
+`vYYYY.M.N` tag; `package.json`'s version in the repo is not updated. Changes to only docs or CI
+don't publish.
 
 Publishing uses npm trusted publishing: the package's npmjs.com settings trust this repo's
 `publish.yaml`, so no npm token is stored anywhere.
 
+## Auth (`@zeyolabs/kit/auth/*`)
+
+`config`, `schema`, `users`, `emails` at the top; one folder per part: `sessions/` (cookie
+sessions, the auth handle, and the two ways in: `sessions/magic-link/` and `sessions/passkeys/`
+with its browser `client`),
+`accounts/` (accounts, invites, permissions, the account handle, remote functions), `sveltekit/`
+(the `/auth/*` routes, page loads, login helpers). Each file exports one library object, like
+`Crypto`: `Sessions`, `MagicLink`, `Passkeys`, `PasskeyClient`, `Users`, `Allowlist`, `Accounts`,
+`Invites`, `Permissions`, `AuthHandle`, `AccountHandle`, `AuthLoads`, `AuthEmails`, `Login`, and
+`Auth.configure` for the config.
+
+Passwordless sign-in: an emailed magic link or a passkey. No passwords anywhere. Sessions are
+`<id>.<secret>` cookies (sha256 at rest, 30 days, sliding); magic links are single-use and expire
+in 15 minutes; passkeys are verified server-side (ES256/RS256, user verification required).
+
+1. Tables: add `node_modules/@zeyolabs/kit/auth/schema.ts` to the app's drizzle-kit `schema` and
+   generate a migration (`users`, `sessions`, `auth_tokens`, `passkeys`).
+2. Config (`Auth.configure`), once at module scope (e.g. next to `secretNames`):
+   ```ts
+   Auth.configure({
+   	appName: 'My app',
+   	db: () => getDb(),
+   	email: () => (dev ? new DevEmailClient() : SmtpClient.fromEnv(smtpKeys, { from })),
+   	emailBrand: brand,
+   	isAllowed: (email) => Allowlist.includes(email, env().ALLOWED_EMAILS),
+   });
+   ```
+3. Hook, after the context handle: `AuthHandle.create({ access })` (pass `access` to also require
+   a matching Cloudflare Access JWT). Type `App.Locals` as `interface Locals extends AuthLocals`.
+4. Routes: `src/routes/auth/[...path]/+server.ts` is
+   `export { POST } from '@zeyolabs/kit/auth/sveltekit/routes';`, and the login page's `+page.server.ts` is
+   `export const load = AuthLoads.login;` (from `@zeyolabs/kit/auth/sveltekit/loads`).
+5. The login page (the app's own markup) posts `email` to `/auth/email`; with `?token=` it shows a
+   button posting `token` to `/auth/verify` (so mail scanners can't use the link); its passkey
+   button calls `PasskeyClient.signIn()` from `@zeyolabs/kit/auth/sessions/passkeys/client`. A settings page
+   uses `AuthLoads.passkeys` and `PasskeyClient.add(name)`, and posts `id` to `/auth/passkey/delete`.
+
+### Accounts and policies
+
+Accounts own resources; users reach them through a membership. Resource tables carry
+`account_id`, never `user_id`. Tables: `accounts`, `account_members`, `account_policies`,
+`account_invites` (same `schema.ts`).
+
+- **Policies.** Every member has one. Built in: `owner` (everything, can't be edited), `admin`
+  (all but `policies.manage`), `member` (the app's `memberPermissions`). An account can add its own
+  from permission keys (`resource.action`, or `resource.*`); the app lists its keys in
+  `Auth.configure({ accounts: { permissions, memberPermissions } })`. Only owners confer ownership,
+  and an account always keeps at least one owner.
+- **Which account.** `AccountHandle.create({ slug: AccountHandle.slugFromRoute('account') })` after the auth handle
+  sets `locals.account` and `locals.membership` (404 for non-members). Remote functions call
+  `AccountHandle.requirePermission(event, 'projects.edit')`, or `Accounts.can(membership, key)`.
+- **Invite only.** `isAllowed: (email) => Accounts.hasAccess(db, email)`; invites are emailed links
+  to the app's `/invite` page (`AuthLoads.invite`), accepted by posting to `/auth/invite/accept`.
+  `onSignIn` can bootstrap the first owners.
+- **Management.** `@zeyolabs/kit/auth/accounts/accounts.remote` has the queries and commands a members page
+  needs (members, invites, policies), each checking the caller's permissions.
+
+## Email clients
+
+`IEmailClient` (`deliver` throws, `send` logs and returns `false`) has two transports on
+`BaseEmailClient`: `EmailClient` (`cloudflare/email`, a Workers `send_email` binding) and
+`SmtpClient` (`cloudflare/email/smtp`, e.g. Amazon SES, any recipient; `SmtpClient.fromEnv(keys, sender)`
+reads the settings from the request context). `DevEmailClient` prints instead of sending and
+`FakeEmailClient` records messages for tests; both work in place of either transport.
+
 ## Developing against an app
 
 `pnpm link ../kit` in the app while working on both; publish, then pin the new version.

package/auth/accounts/accounts.remote.ts

@@ -0,0 +1,116 @@
+import { getRequestEvent } from '$app/server';
+import { z } from 'zod';
+
+import { Remote } from '../../server/remote-functions';
+import { FormResult } from '../../utils/form';
+import { Auth } from '../config';
+import { AuthEmails } from '../emails';
+import { AuthHandle } from '../sessions/handle';
+import { Accounts } from './accounts';
+import { AccountHandle } from './handle';
+import { Invites } from './invites';
+import { Permissions } from './permissions';
+import { AccountSchemas } from './schemas';
+
+// Account management for the app's pages, acting in the request's account (`AccountHandle.create`).
+// Each call checks the caller's permissions in `accounts.ts`; these only adapt them to the wire.
+
+/** The accounts the signed-in user belongs to, for an account switcher. */
+export const getMyAccounts = Remote.Query(async () => {
+	const { user } = AuthHandle.locals(getRequestEvent());
+	return user ? Accounts.listForUser(Auth.config().db(), user.id) : [];
+});
+
+/** Everything a members page needs, shaped by what the caller may do. */
+export const getAccountMembers = Remote.Query(async () => {
+	const event = getRequestEvent();
+	const { account, membership } = AccountHandle.require(event);
+	const db = Auth.config().db();
+	return {
+		account,
+		can: {
+			invite: Accounts.can(membership, 'members.invite'),
+			manage: Accounts.can(membership, 'members.manage'),
+			managePolicies: Accounts.can(membership, 'policies.manage'),
+		},
+		invites: await Invites.list(db, membership),
+		me: { policy: membership.policy.key, userId: membership.userId },
+		members: await Accounts.listMembers(db, membership),
+		permissions: [...Permissions.ACCOUNT, ...Auth.config().accounts.permissions],
+		policies: await Accounts.listPolicies(db, Auth.config().accounts, membership.accountId),
+	};
+});
+
+/** Invites someone by email; the link lands on the app's invite page. */
+export const inviteMemberForm = Remote.Form(AccountSchemas.Invite, async (input) => {
+	const event = getRequestEvent();
+	const membership = AccountHandle.requirePermission(event, 'members.invite');
+	const { account } = AccountHandle.require(event);
+	const token = await Invites.create(Auth.config().db(), Auth.config().accounts, membership, input);
+	const url = new URL(Auth.config().invitePath, event.url.origin);
+	url.searchParams.set('token', token);
+	const inviter = AuthHandle.locals(event).user?.email ?? 'Someone';
+	await Auth.config()
+		.email()
+		.deliver({
+			to: input.email,
+			...AuthEmails.invite(Auth.config().emailBrand, {
+				accountName: account.name,
+				inviter,
+				url: url.href,
+			}),
+		});
+	void getAccountMembers().refresh();
+	return FormResult.ok(`Invited ${input.email}`);
+});
+
+export const revokeInviteCmd = Remote.Cmd(z.object({ email: z.string() }), async ({ email }) => {
+	await Invites.revoke(
+		Auth.config().db(),
+		AccountHandle.require(getRequestEvent()).membership,
+		email
+	);
+	void getAccountMembers().refresh();
+});
+
+export const setMemberPolicyCmd = Remote.Cmd(
+	z.object({ policy: z.string().min(1).max(40), userId: z.number().int() }),
+	async ({ policy, userId }) => {
+		const { membership } = AccountHandle.require(getRequestEvent());
+		await Accounts.setMemberPolicy(
+			Auth.config().db(),
+			Auth.config().accounts,
+			membership,
+			userId,
+			policy
+		);
+		void getAccountMembers().refresh();
+	}
+);
+
+export const removeMemberCmd = Remote.Cmd(
+	z.object({ userId: z.number().int() }),
+	async ({ userId }) => {
+		await Accounts.removeMember(
+			Auth.config().db(),
+			AccountHandle.require(getRequestEvent()).membership,
+			userId
+		);
+		void getAccountMembers().refresh();
+	}
+);
+
+export const savePolicyCmd = Remote.Cmd(AccountSchemas.Policy, async (input) => {
+	const { membership } = AccountHandle.require(getRequestEvent());
+	await Accounts.savePolicy(Auth.config().db(), Auth.config().accounts, membership, input);
+	void getAccountMembers().refresh();
+});
+
+export const deletePolicyCmd = Remote.Cmd(z.object({ key: z.string() }), async ({ key }) => {
+	await Accounts.deletePolicy(
+		Auth.config().db(),
+		AccountHandle.require(getRequestEvent()).membership,
+		key
+	);
+	void getAccountMembers().refresh();
+});

package/auth/accounts/accounts.ts

@@ -0,0 +1,332 @@
+import { and, asc, eq, gt, isNull, ne, or, sql } from 'drizzle-orm';
+
+import type { AuthDb } from '../config';
+import type { PermissionCatalogue, Policy } from './permissions';
+
+import { Error400, Error403, Error404, Error409 } from '../../utils/errors';
+import { accountInvites, accountMembers, accountPolicies, accounts, users } from '../schema';
+import { Permissions } from './permissions';
+
+// Accounts own resources; users reach them through a membership whose policy says what they may
+// do. Framework-agnostic: every function takes the db (and the app's permission catalogue), so a
+// plain Worker can use it too. Mutations take the acting member and check its permissions; the
+// "at least one owner" rule is enforced inside the same SQL statement (D1 has no row locks).
+
+export type AccountSummary = { id: number; name: string; slug: string };
+export type Membership = { accountId: number; policy: Policy; userId: number };
+
+const OWNER = 'owner';
+
+function can(membership: Membership | null, permission: string): boolean {
+	return !!membership && Permissions.grants(membership.policy.permissions, permission);
+}
+
+/** Throws a 403 unless `membership` grants `permission`. */
+function assertCan(membership: Membership, permission: string): void {
+	if (!can(membership, permission)) throw Error403('You do not have permission to do that');
+}
+
+function isValidSlug(slug: string): boolean {
+	return /^[a-z0-9][a-z0-9-]{1,39}$/.test(slug);
+}
+
+/** Creates an account; with `ownerUserId`, that user becomes its owner. */
+async function createAccount(
+	db: AuthDb,
+	input: { name: string; slug: string },
+	ownerUserId?: number,
+	now = Date.now()
+): Promise<AccountSummary> {
+	if (!isValidSlug(input.slug)) throw Error400('Use 2-40 lowercase letters, digits and dashes');
+	const [account] = await db
+		.insert(accounts)
+		.values({ createdAt: now, name: input.name.trim(), slug: input.slug })
+		.onConflictDoNothing({ target: accounts.slug })
+		.returning({ id: accounts.id, name: accounts.name, slug: accounts.slug });
+	if (!account) throw Error409('That address is taken');
+	if (ownerUserId !== undefined) await addMember(db, account.id, ownerUserId, OWNER, now);
+	return account;
+}
+
+async function findAccountBySlug(db: AuthDb, slug: string): Promise<AccountSummary | null> {
+	const [account] = await db
+		.select({ id: accounts.id, name: accounts.name, slug: accounts.slug })
+		.from(accounts)
+		.where(eq(accounts.slug, slug))
+		.limit(1);
+	return account ?? null;
+}
+
+/** The accounts a user belongs to, with their policy key in each, oldest membership first. */
+async function listAccountsForUser(db: AuthDb, userId: number) {
+	return db
+		.select({
+			id: accounts.id,
+			name: accounts.name,
+			policy: accountMembers.policy,
+			slug: accounts.slug,
+		})
+		.from(accountMembers)
+		.innerJoin(accounts, eq(accounts.id, accountMembers.accountId))
+		.where(eq(accountMembers.userId, userId))
+		.orderBy(asc(accountMembers.createdAt));
+}
+
+/** The built-in policies plus the account's own. */
+async function listPolicies(
+	db: AuthDb,
+	catalogue: PermissionCatalogue,
+	accountId: number
+): Promise<Policy[]> {
+	const custom = await db
+		.select()
+		.from(accountPolicies)
+		.where(eq(accountPolicies.accountId, accountId))
+		.orderBy(asc(accountPolicies.name));
+	const builtIn = Permissions.builtIns(catalogue);
+	return [
+		builtIn.owner,
+		builtIn.admin,
+		builtIn.member,
+		...custom.map((p) => ({
+			builtIn: false,
+			key: p.key,
+			name: p.name,
+			permissions: p.permissions,
+		})),
+	];
+}
+
+/** A built-in or custom policy of the account by key, or `null`. */
+async function findPolicy(
+	db: AuthDb,
+	catalogue: PermissionCatalogue,
+	accountId: number,
+	key: string
+): Promise<null | Policy> {
+	if (Permissions.isBuiltIn(key)) return Permissions.builtIns(catalogue)[key];
+	const [row] = await db
+		.select()
+		.from(accountPolicies)
+		.where(and(eq(accountPolicies.accountId, accountId), eq(accountPolicies.key, key)))
+		.limit(1);
+	return row
+		? { builtIn: false, key: row.key, name: row.name, permissions: row.permissions }
+		: null;
+}
+
+/** The user's membership of the account with its resolved policy, or `null` if not a member. */
+async function resolveMembership(
+	db: AuthDb,
+	catalogue: PermissionCatalogue,
+	accountId: number,
+	userId: number
+): Promise<Membership | null> {
+	const [row] = await db
+		.select({ policy: accountMembers.policy })
+		.from(accountMembers)
+		.where(and(eq(accountMembers.accountId, accountId), eq(accountMembers.userId, userId)))
+		.limit(1);
+	if (!row) return null;
+	// A member whose custom policy was somehow removed keeps no permissions rather than failing.
+	const policy = (await findPolicy(db, catalogue, accountId, row.policy)) ?? {
+		builtIn: false,
+		key: row.policy,
+		name: row.policy,
+		permissions: [],
+	};
+	return { accountId, policy, userId };
+}
+
+/** Adds a member (no-op if already one). For bootstrapping and invites; no permission check. */
+async function addMember(
+	db: AuthDb,
+	accountId: number,
+	userId: number,
+	policy: string,
+	now = Date.now()
+): Promise<void> {
+	await db
+		.insert(accountMembers)
+		.values({ accountId, createdAt: now, policy, userId })
+		.onConflictDoNothing();
+}
+
+async function listMembers(db: AuthDb, actor: Membership) {
+	assertCan(actor, 'members.read');
+	return db
+		.select({
+			email: users.email,
+			joinedAt: accountMembers.createdAt,
+			name: users.name,
+			policy: accountMembers.policy,
+			userId: users.id,
+		})
+		.from(accountMembers)
+		.innerJoin(users, eq(users.id, accountMembers.userId))
+		.where(eq(accountMembers.accountId, actor.accountId))
+		.orderBy(asc(users.email));
+}
+
+/** SQL: another owner of the account remains besides `userId`. */
+const anotherOwner = (accountId: number, userId: number) =>
+	sql`exists (select 1 from ${accountMembers} where ${accountMembers.accountId} = ${accountId} and ${accountMembers.policy} = ${OWNER} and ${accountMembers.userId} != ${userId})`;
+
+async function currentPolicy(db: AuthDb, accountId: number, userId: number) {
+	const [row] = await db
+		.select({ policy: accountMembers.policy })
+		.from(accountMembers)
+		.where(and(eq(accountMembers.accountId, accountId), eq(accountMembers.userId, userId)))
+		.limit(1);
+	if (!row) throw Error404('Not a member of this account');
+	return row.policy;
+}
+
+/** Gives a member another policy. Only owners confer or take away ownership; nobody changes their
+ *  own policy; the last owner stays an owner. */
+async function setMemberPolicy(
+	db: AuthDb,
+	catalogue: PermissionCatalogue,
+	actor: Membership,
+	userId: number,
+	policy: string
+): Promise<void> {
+	assertCan(actor, 'members.manage');
+	if (userId === actor.userId) throw Error400('You cannot change your own policy');
+	if (!(await findPolicy(db, catalogue, actor.accountId, policy))) throw Error400('Unknown policy');
+	const previous = await currentPolicy(db, actor.accountId, userId);
+	if ((policy === OWNER || previous === OWNER) && actor.policy.key !== OWNER) {
+		throw Error403('Only an owner can change ownership');
+	}
+	const updated = await db
+		.update(accountMembers)
+		.set({ policy })
+		.where(
+			and(
+				eq(accountMembers.accountId, actor.accountId),
+				eq(accountMembers.userId, userId),
+				or(ne(accountMembers.policy, OWNER), anotherOwner(actor.accountId, userId))
+			)
+		)
+		.returning({ userId: accountMembers.userId });
+	if (!updated.length) throw Error409('An account needs at least one owner');
+}
+
+/** Removes a member, or lets a member leave. Only owners remove owners; the last owner can't go. */
+async function removeMember(db: AuthDb, actor: Membership, userId: number): Promise<void> {
+	if (userId !== actor.userId) assertCan(actor, 'members.manage');
+	const previous = await currentPolicy(db, actor.accountId, userId);
+	if (previous === OWNER && userId !== actor.userId && actor.policy.key !== OWNER) {
+		throw Error403('Only an owner can remove an owner');
+	}
+	const removed = await db
+		.delete(accountMembers)
+		.where(
+			and(
+				eq(accountMembers.accountId, actor.accountId),
+				eq(accountMembers.userId, userId),
+				or(ne(accountMembers.policy, OWNER), anotherOwner(actor.accountId, userId))
+			)
+		)
+		.returning({ userId: accountMembers.userId });
+	if (!removed.length) throw Error409('An account needs at least one owner');
+}
+
+/** Creates or updates one of the account's own policies. */
+async function savePolicy(
+	db: AuthDb,
+	catalogue: PermissionCatalogue,
+	actor: Membership,
+	input: { key: string; name: string; permissions: string[] },
+	now = Date.now()
+): Promise<void> {
+	assertCan(actor, 'policies.manage');
+	if (!Permissions.isValidKey(input.key))
+		throw Error400('Use 1-40 lowercase letters, digits and dashes');
+	const bad = input.permissions.filter((p) => !Permissions.isGrantable(catalogue, p));
+	if (bad.length) throw Error400(`Unknown permissions: ${bad.join(', ')}`);
+	const permissions = [...new Set(input.permissions)].sort();
+	await db
+		.insert(accountPolicies)
+		.values({
+			accountId: actor.accountId,
+			createdAt: now,
+			key: input.key,
+			name: input.name.trim(),
+			permissions,
+		})
+		.onConflictDoUpdate({
+			set: { name: input.name.trim(), permissions },
+			target: [accountPolicies.accountId, accountPolicies.key],
+		});
+}
+
+/** Deletes one of the account's own policies, unless a member or a pending invite still uses it. */
+async function deletePolicy(db: AuthDb, actor: Membership, key: string, now = Date.now()) {
+	assertCan(actor, 'policies.manage');
+	if (Permissions.isBuiltIn(key)) throw Error400('Built-in policies cannot be deleted');
+	const [used] = await db
+		.select({ userId: accountMembers.userId })
+		.from(accountMembers)
+		.where(and(eq(accountMembers.accountId, actor.accountId), eq(accountMembers.policy, key)))
+		.limit(1);
+	const [invited] = await db
+		.select({ email: accountInvites.email })
+		.from(accountInvites)
+		.where(
+			and(
+				eq(accountInvites.accountId, actor.accountId),
+				eq(accountInvites.policy, key),
+				isNull(accountInvites.acceptedAt),
+				gt(accountInvites.expiresAt, now)
+			)
+		)
+		.limit(1);
+	if (used || invited) throw Error409('Move its members and invites to another policy first');
+	await db
+		.delete(accountPolicies)
+		.where(and(eq(accountPolicies.accountId, actor.accountId), eq(accountPolicies.key, key)));
+}
+
+/** Whether `email` belongs to any account or holds a live invite: the invite-only sign-in rule. */
+async function hasAccountAccess(db: AuthDb, email: string, now = Date.now()) {
+	const normalized = email.trim().toLowerCase();
+	const [member] = await db
+		.select({ userId: accountMembers.userId })
+		.from(accountMembers)
+		.innerJoin(users, eq(users.id, accountMembers.userId))
+		.where(eq(users.email, normalized))
+		.limit(1);
+	if (member) return true;
+	const [invite] = await db
+		.select({ email: accountInvites.email })
+		.from(accountInvites)
+		.where(
+			and(
+				eq(accountInvites.email, normalized),
+				isNull(accountInvites.acceptedAt),
+				gt(accountInvites.expiresAt, now)
+			)
+		)
+		.limit(1);
+	return !!invite;
+}
+
+export const Accounts = {
+	addMember,
+	assertCan,
+	can,
+	create: createAccount,
+	deletePolicy,
+	findBySlug: findAccountBySlug,
+	findPolicy,
+	hasAccess: hasAccountAccess,
+	isValidSlug,
+	listForUser: listAccountsForUser,
+	listMembers,
+	listPolicies,
+	removeMember,
+	resolveMembership,
+	savePolicy,
+	setMemberPolicy,
+};

package/auth/accounts/handle.ts

@@ -0,0 +1,102 @@
+import type { RequestEvent } from '@sveltejs/kit';
+import type { Handle } from '@sveltejs/kit/hooks';
+
+import { error } from '@sveltejs/kit';
+
+import type { AccountSummary, Membership } from './accounts';
+
+import { Error403, Error404 } from '../../utils/errors';
+import { Auth } from '../config';
+import { AuthHandle } from '../sessions/handle';
+import { Accounts } from './accounts';
+
+// Which account a request acts in, and the signed-in user's membership of it. Runs after
+// `createAuthHandle`. The account comes from the request (a route param, a fixed slug, ...) and
+// never from the session, so switching accounts is just navigating.
+
+export type AccountLocals = {
+	/** The account this request acts in, or null where the route has none. */
+	account: AccountSummary | null;
+	/** The signed-in user's membership of `account`. */
+	membership: Membership | null;
+};
+
+function accountLocals(event: RequestEvent): AccountLocals {
+	return event.locals as unknown as AccountLocals;
+}
+
+/**
+ * The account slug from the route param `param` (e.g. `/[account]/...`). Remote-function calls
+ * have no route params, so for those it reads the same path segment of the calling page (the
+ * `Referer`), which SvelteKit always sends for same-origin fetches.
+ */
+function slugFromRoute(param = 'account', segment = 0) {
+	return (event: RequestEvent): null | string => {
+		const fromParam = event.params[param as keyof typeof event.params];
+		if (typeof fromParam === 'string') return fromParam;
+		if (!event.url.pathname.startsWith('/_app/remote')) return null;
+		const referer = event.request.headers.get('referer');
+		if (!referer) return null;
+		const page = new URL(referer);
+		if (page.origin !== event.url.origin) return null;
+		return page.pathname.split('/').filter(Boolean)[segment] ?? null;
+	};
+}
+
+/**
+ * Sets `locals.account` and `locals.membership`. A slug for an account that doesn't exist, or that
+ * the user doesn't belong to, is a 404 (the same answer, so slugs can't be probed).
+ */
+function createAccountHandle(options: {
+	/** The account slug for a request, or null when it isn't in an account. */
+	slug: (event: RequestEvent) => null | string;
+}): Handle {
+	return async ({ event, resolve }) => {
+		const locals = accountLocals(event);
+		locals.account = null;
+		locals.membership = null;
+		const { user } = AuthHandle.locals(event);
+		const slug = user ? options.slug(event) : null;
+		if (slug && user) {
+			const account = await Accounts.findBySlug(Auth.config().db(), slug);
+			const membership =
+				account &&
+				(await Accounts.resolveMembership(
+					Auth.config().db(),
+					Auth.config().accounts,
+					account.id,
+					user.id
+				));
+			if (!account || !membership) error(404, 'Not found');
+			locals.account = account;
+			locals.membership = membership;
+		}
+		return resolve(event);
+	};
+}
+
+/** The request's account and membership, or a 404 `ServiceError`. */
+function requireAccount(event: RequestEvent): {
+	account: AccountSummary;
+	membership: Membership;
+} {
+	const { account, membership } = accountLocals(event);
+	if (!account || !membership) throw Error404('Not found');
+	return { account, membership };
+}
+
+/** The request's membership if it grants `permission`, else a 403 `ServiceError`. */
+function requirePermission(event: RequestEvent, permission: string): Membership {
+	const { membership } = requireAccount(event);
+	if (!Accounts.can(membership, permission))
+		throw Error403('You do not have permission to do that');
+	return membership;
+}
+
+export const AccountHandle = {
+	create: createAccountHandle,
+	locals: accountLocals,
+	require: requireAccount,
+	requirePermission,
+	slugFromRoute,
+};