Stateful sessions
Opaque tokens, hashed at rest. Revocation is a row update; role/privilege changes apply on the next request. withSession resolves and validates in one indexed query folded into the RLS transaction.
@smplcty/auth
The library owns identity, sessions, roles/privileges, tenants, sign-in federation, and per-request context. Each app owns only its intra-tenant authorization scope (its RLS model). Stateful sessions, not JWT — because tracking activity, tenant-wide sign-off, and immediate role changes all need per-request server authority.
Identity GUC contract
Each request sets exactly app.actor_id / app.session_id / app.active_role / app.privileges, transaction-scoped so they can’t leak. current_user_id() reads the actor; your RLS keys on it.
App-owned scope
The library sets no tenant/scope GUC. Pass a scope hook (or the flat-tenant preset) so your RLS model — producer/region/plant, rep hierarchy, flat tenants — stays yours.
Pluggable sign-in
Tenant-centric discovery; OTP (Twilio + dev-OTP) via the router; OIDC via a dedicated oauth4webapi handler. Core pulls in neither oauth4webapi nor Twilio — they’re opt-in subpaths.