@archlast/server 0.0.1

package/dist/auth/system/schema.d.ts

@@ -0,0 +1,538 @@
+/**
+ * Built-in, platform-level auth schema for Archlast.
+ *
+ * IMPORTANT:
+ * - This is NOT app-defined and should be merged into the active schema at runtime.
+ * - All records are still stored as JSON documents in the single `documents` table.
+ * - These tables are "non-removable" infrastructure collections.
+ *
+ * Collection naming:
+ * - Better-Auth tables use the `system_auth_*` prefix for full isolation.
+ * - Archlast-specific tables use the `auth_*` prefix.
+ */
+export declare const AUTH_COLLECTIONS: {
+    readonly users: "system_auth_user";
+    readonly accounts: "system_auth_account";
+    readonly sessions: "system_auth_session";
+    readonly verification: "system_auth_verification";
+    readonly organization: "system_auth_organization";
+    readonly member: "system_auth_member";
+    readonly invitation: "system_auth_invitation";
+    readonly apiKey: "system_auth_api_key";
+    readonly tenants: "auth_tenants";
+    readonly memberships: "auth_memberships";
+    readonly invites: "auth_invites";
+    readonly adminApiKeys: "auth_admin_api_keys";
+    readonly auditLogs: "auth_audit_logs";
+    readonly securityEvents: "auth_security_events";
+    readonly emailVerificationTokens: "auth_email_verification_tokens";
+    readonly passwordResetTokens: "auth_password_reset_tokens";
+};
+export type AuthCollectionName = (typeof AUTH_COLLECTIONS)[keyof typeof AUTH_COLLECTIONS];
+export declare const authSchema: {
+    tables: {
+        /**
+         * system_auth_user
+         * Represents a user identity. Users can belong to multiple tenants via memberships.
+         * Better-Auth core user model with plugin extensions.
+         */
+        system_auth_user: import("../../schema/definition.js").TableDefinition<{
+            _id: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            email: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            emailVerified: import("../../schema/validators.js").FieldSchema<import("zod").ZodDefault<import("zod").ZodBoolean>>;
+            /**
+             * Minimal profile fields (optional).
+             * App-level profiles should live in app schema.
+             */
+            name: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodString>>;
+            image: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodString>>;
+            createdAt: import("../../schema/validators.js").FieldSchema<import("zod").ZodDate>;
+            updatedAt: import("../../schema/validators.js").FieldSchema<import("zod").ZodDate>;
+            role: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodString>>;
+            banned: import("../../schema/validators.js").FieldSchema<import("zod").ZodDefault<import("zod").ZodBoolean>>;
+            banReason: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodString>>;
+            banExpires: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodDate>>;
+            username: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodString>>;
+            displayUsername: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodString>>;
+            isAnonymous: import("../../schema/validators.js").FieldSchema<import("zod").ZodDefault<import("zod").ZodBoolean>>;
+        }>;
+        /**
+         * system_auth_account
+         * Represents authentication provider accounts linked to a user.
+         * Better-Auth stores credential passwords and OAuth tokens here.
+         */
+        system_auth_account: import("../../schema/definition.js").TableDefinition<{
+            _id: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            userId: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            /**
+             * Provider ID: "credential" for password auth, or OAuth provider name
+             * e.g. "credential" | "github" | "google" | "custom"
+             */
+            providerId: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            /**
+             * Account ID from the provider (for OAuth) or same as userId (for credential)
+             */
+            accountId: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            /**
+             * Hashed password (only for credential provider)
+             */
+            password: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodString>>;
+            /**
+             * OAuth tokens and metadata
+             */
+            accessToken: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodString>>;
+            refreshToken: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodString>>;
+            accessTokenExpiresAt: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodDate>>;
+            refreshTokenExpiresAt: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodDate>>;
+            scope: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodString>>;
+            idToken: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodString>>;
+            createdAt: import("../../schema/validators.js").FieldSchema<import("zod").ZodDate>;
+            updatedAt: import("../../schema/validators.js").FieldSchema<import("zod").ZodDate>;
+        }>;
+        /**
+         * auth_tenants
+         * Represents a multi-tenant workspace/organization.
+         */
+        auth_tenants: import("../../schema/definition.js").TableDefinition<{
+            _id: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            name: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            ownerId: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            createdAt: import("../../schema/validators.js").FieldSchema<import("zod").ZodNumber>;
+            updatedAt: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodNumber>>;
+        }>;
+        /**
+         * auth_memberships
+         * Relationship between a user and a tenant + tenant-scoped role and permissions.
+         */
+        auth_memberships: import("../../schema/definition.js").TableDefinition<{
+            _id: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            tenantId: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            userId: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            /**
+             * Default built-in roles: owner | admin | member
+             * Keep as string for extensibility.
+             */
+            role: import("../../schema/validators.js").FieldSchema<import("zod").ZodDefault<import("zod").ZodString>>;
+            /**
+             * Fine-grained permissions (strings like "tasks.read", "tenant.manage", "*", etc.).
+             */
+            permissions: import("../../schema/validators.js").FieldSchema<import("zod").ZodDefault<import("zod").ZodArray<import("zod").ZodString>>>;
+            createdAt: import("../../schema/validators.js").FieldSchema<import("zod").ZodNumber>;
+            updatedAt: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodNumber>>;
+        }>;
+        /**
+         * system_auth_session
+         * Better-Auth session model with Archlast extensions.
+         *
+         * Better-Auth stores sessions with a token for direct lookup.
+         * Archlast extends with tenant binding and token hashing for security.
+         */
+        system_auth_session: import("../../schema/definition.js").TableDefinition<{
+            _id: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            userId: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            token: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            expiresAt: import("../../schema/validators.js").FieldSchema<import("zod").ZodDate>;
+            createdAt: import("../../schema/validators.js").FieldSchema<import("zod").ZodDate>;
+            updatedAt: import("../../schema/validators.js").FieldSchema<import("zod").ZodDate>;
+            ipAddress: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodString>>;
+            userAgent: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodString>>;
+            impersonatedBy: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodString>>;
+            activeOrganizationId: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodString>>;
+            tenantId: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodString>>;
+            tokenHash: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodString>>;
+            lastActiveAt: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodDate>>;
+            revokedAt: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodDate>>;
+            rotatedFrom: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodString>>;
+        }>;
+        /**
+         * auth_invites
+         * Tenant scoped, email-based invites.
+         */
+        auth_invites: import("../../schema/definition.js").TableDefinition<{
+            _id: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            tenantId: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            email: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            role: import("../../schema/validators.js").FieldSchema<import("zod").ZodDefault<import("zod").ZodString>>;
+            permissions: import("../../schema/validators.js").FieldSchema<import("zod").ZodDefault<import("zod").ZodArray<import("zod").ZodString>>>;
+            /**
+             * A random invite token hash (do not store plaintext token).
+             * Optional: you can use `_id` as the token id and keep this nullable.
+             */
+            tokenHash: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodString>>;
+            expiresAt: import("../../schema/validators.js").FieldSchema<import("zod").ZodNumber>;
+            acceptedAt: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodNumber>>;
+            acceptedByUserId: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodString>>;
+            createdAt: import("../../schema/validators.js").FieldSchema<import("zod").ZodNumber>;
+            updatedAt: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodNumber>>;
+        }>;
+        /**
+         * better_auth_verification
+         * Better-Auth verification table for email verification and other verification codes.
+         */
+        system_auth_verification: import("../../schema/definition.js").TableDefinition<{
+            _id: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            identifier: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            value: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            expiresAt: import("../../schema/validators.js").FieldSchema<import("zod").ZodDate>;
+            createdAt: import("../../schema/validators.js").FieldSchema<import("zod").ZodDate>;
+            updatedAt: import("../../schema/validators.js").FieldSchema<import("zod").ZodDate>;
+        }>;
+        /**
+         * better_auth_organization
+         * Better-Auth organization table for multi-tenancy support.
+         */
+        system_auth_organization: import("../../schema/definition.js").TableDefinition<{
+            _id: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            name: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            slug: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            logo: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodString>>;
+            metadata: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodAny>>;
+            createdAt: import("../../schema/validators.js").FieldSchema<import("zod").ZodDate>;
+            updatedAt: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodDate>>;
+        }>;
+        /**
+         * better_auth_member
+         * Better-Auth member table linking users to organizations.
+         */
+        system_auth_member: import("../../schema/definition.js").TableDefinition<{
+            _id: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            organizationId: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            userId: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            role: import("../../schema/validators.js").FieldSchema<import("zod").ZodDefault<import("zod").ZodString>>;
+            createdAt: import("../../schema/validators.js").FieldSchema<import("zod").ZodDate>;
+        }>;
+        /**
+         * better_auth_invitation
+         * Better-Auth invitation table for organization invitations.
+         */
+        system_auth_invitation: import("../../schema/definition.js").TableDefinition<{
+            _id: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            organizationId: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            email: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            role: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            status: import("../../schema/validators.js").FieldSchema<import("zod").ZodDefault<import("zod").ZodString>>;
+            expiresAt: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodDate>>;
+            createdAt: import("../../schema/validators.js").FieldSchema<import("zod").ZodDate>;
+            inviterId: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+        }>;
+        /**
+         * apikey
+         * Better-Auth API key table for API key authentication and management.
+         */
+        system_auth_api_key: import("../../schema/definition.js").TableDefinition<{
+            _id: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            name: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodString>>;
+            start: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodString>>;
+            prefix: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodString>>;
+            key: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            userId: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            refillInterval: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodNumber>>;
+            refillAmount: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodNumber>>;
+            lastRefillAt: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodNumber>>;
+            enabled: import("../../schema/validators.js").FieldSchema<import("zod").ZodDefault<import("zod").ZodBoolean>>;
+            rateLimitEnabled: import("../../schema/validators.js").FieldSchema<import("zod").ZodDefault<import("zod").ZodBoolean>>;
+            rateLimitTimeWindow: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodNumber>>;
+            rateLimitMax: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodNumber>>;
+            requestCount: import("../../schema/validators.js").FieldSchema<import("zod").ZodDefault<import("zod").ZodNumber>>;
+            remaining: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodNumber>>;
+            lastRequest: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodNumber>>;
+            expiresAt: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodNumber>>;
+            createdAt: import("../../schema/validators.js").FieldSchema<import("zod").ZodNumber>;
+            updatedAt: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodNumber>>;
+            permissions: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodString>>;
+            metadata: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodAny>>;
+        }>;
+    };
+};
+/**
+ * Complete auth schema including extended collections
+ */
+export declare const completeAuthSchema: {
+    tables: {
+        auth_admin_api_keys: import("../../schema/definition.js").TableDefinition<{
+            _id: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            tenantId: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            name: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            description: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodString>>;
+            keyHash: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            keyPrefix: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            permissions: import("../../schema/validators.js").FieldSchema<import("zod").ZodArray<import("zod").ZodString>>;
+            scopes: import("../../schema/validators.js").FieldSchema<import("zod").ZodArray<import("zod").ZodString>>;
+            createdAt: import("../../schema/validators.js").FieldSchema<import("zod").ZodNumber>;
+            createdBy: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodString>>;
+            lastUsedAt: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodNumber>>;
+            expiresAt: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodNumber>>;
+            revokedAt: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodNumber>>;
+            revokedBy: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodString>>;
+            revokedReason: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodString>>;
+        }>;
+        auth_audit_logs: import("../../schema/definition.js").TableDefinition<{
+            _id: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            tenantId: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            userId: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodString>>;
+            apiKeyId: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodString>>;
+            actorType: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            action: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            resourceType: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            resourceId: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            status: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            errorMessage: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodString>>;
+            errorCode: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodString>>;
+            ipAddress: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodString>>;
+            userAgent: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodString>>;
+            timestamp: import("../../schema/validators.js").FieldSchema<import("zod").ZodNumber>;
+        }>;
+        auth_security_events: import("../../schema/definition.js").TableDefinition<{
+            _id: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            tenantId: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodString>>;
+            eventType: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            severity: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            userId: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodString>>;
+            email: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodString>>;
+            ipAddress: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            userAgent: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodString>>;
+            description: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            resolved: import("../../schema/validators.js").FieldSchema<import("zod").ZodDefault<import("zod").ZodBoolean>>;
+            resolvedAt: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodNumber>>;
+            resolvedBy: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodString>>;
+            resolution: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodString>>;
+            timestamp: import("../../schema/validators.js").FieldSchema<import("zod").ZodNumber>;
+        }>;
+        auth_email_verification_tokens: import("../../schema/definition.js").TableDefinition<{
+            _id: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            userId: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            tenantId: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            tokenHash: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            email: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            createdAt: import("../../schema/validators.js").FieldSchema<import("zod").ZodNumber>;
+            expiresAt: import("../../schema/validators.js").FieldSchema<import("zod").ZodNumber>;
+            consumedAt: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodNumber>>;
+            consumedBy: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodString>>;
+        }>;
+        auth_password_reset_tokens: import("../../schema/definition.js").TableDefinition<{
+            _id: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            userId: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            tenantId: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            tokenHash: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            email: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            createdAt: import("../../schema/validators.js").FieldSchema<import("zod").ZodNumber>;
+            expiresAt: import("../../schema/validators.js").FieldSchema<import("zod").ZodNumber>;
+            consumedAt: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodNumber>>;
+            consumedBy: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodString>>;
+        }>;
+        /**
+         * system_auth_user
+         * Represents a user identity. Users can belong to multiple tenants via memberships.
+         * Better-Auth core user model with plugin extensions.
+         */
+        system_auth_user: import("../../schema/definition.js").TableDefinition<{
+            _id: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            email: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            emailVerified: import("../../schema/validators.js").FieldSchema<import("zod").ZodDefault<import("zod").ZodBoolean>>;
+            /**
+             * Minimal profile fields (optional).
+             * App-level profiles should live in app schema.
+             */
+            name: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodString>>;
+            image: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodString>>;
+            createdAt: import("../../schema/validators.js").FieldSchema<import("zod").ZodDate>;
+            updatedAt: import("../../schema/validators.js").FieldSchema<import("zod").ZodDate>;
+            role: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodString>>;
+            banned: import("../../schema/validators.js").FieldSchema<import("zod").ZodDefault<import("zod").ZodBoolean>>;
+            banReason: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodString>>;
+            banExpires: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodDate>>;
+            username: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodString>>;
+            displayUsername: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodString>>;
+            isAnonymous: import("../../schema/validators.js").FieldSchema<import("zod").ZodDefault<import("zod").ZodBoolean>>;
+        }>;
+        /**
+         * system_auth_account
+         * Represents authentication provider accounts linked to a user.
+         * Better-Auth stores credential passwords and OAuth tokens here.
+         */
+        system_auth_account: import("../../schema/definition.js").TableDefinition<{
+            _id: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            userId: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            /**
+             * Provider ID: "credential" for password auth, or OAuth provider name
+             * e.g. "credential" | "github" | "google" | "custom"
+             */
+            providerId: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            /**
+             * Account ID from the provider (for OAuth) or same as userId (for credential)
+             */
+            accountId: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            /**
+             * Hashed password (only for credential provider)
+             */
+            password: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodString>>;
+            /**
+             * OAuth tokens and metadata
+             */
+            accessToken: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodString>>;
+            refreshToken: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodString>>;
+            accessTokenExpiresAt: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodDate>>;
+            refreshTokenExpiresAt: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodDate>>;
+            scope: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodString>>;
+            idToken: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodString>>;
+            createdAt: import("../../schema/validators.js").FieldSchema<import("zod").ZodDate>;
+            updatedAt: import("../../schema/validators.js").FieldSchema<import("zod").ZodDate>;
+        }>;
+        /**
+         * auth_tenants
+         * Represents a multi-tenant workspace/organization.
+         */
+        auth_tenants: import("../../schema/definition.js").TableDefinition<{
+            _id: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            name: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            ownerId: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            createdAt: import("../../schema/validators.js").FieldSchema<import("zod").ZodNumber>;
+            updatedAt: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodNumber>>;
+        }>;
+        /**
+         * auth_memberships
+         * Relationship between a user and a tenant + tenant-scoped role and permissions.
+         */
+        auth_memberships: import("../../schema/definition.js").TableDefinition<{
+            _id: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            tenantId: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            userId: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            /**
+             * Default built-in roles: owner | admin | member
+             * Keep as string for extensibility.
+             */
+            role: import("../../schema/validators.js").FieldSchema<import("zod").ZodDefault<import("zod").ZodString>>;
+            /**
+             * Fine-grained permissions (strings like "tasks.read", "tenant.manage", "*", etc.).
+             */
+            permissions: import("../../schema/validators.js").FieldSchema<import("zod").ZodDefault<import("zod").ZodArray<import("zod").ZodString>>>;
+            createdAt: import("../../schema/validators.js").FieldSchema<import("zod").ZodNumber>;
+            updatedAt: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodNumber>>;
+        }>;
+        /**
+         * system_auth_session
+         * Better-Auth session model with Archlast extensions.
+         *
+         * Better-Auth stores sessions with a token for direct lookup.
+         * Archlast extends with tenant binding and token hashing for security.
+         */
+        system_auth_session: import("../../schema/definition.js").TableDefinition<{
+            _id: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            userId: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            token: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            expiresAt: import("../../schema/validators.js").FieldSchema<import("zod").ZodDate>;
+            createdAt: import("../../schema/validators.js").FieldSchema<import("zod").ZodDate>;
+            updatedAt: import("../../schema/validators.js").FieldSchema<import("zod").ZodDate>;
+            ipAddress: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodString>>;
+            userAgent: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodString>>;
+            impersonatedBy: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodString>>;
+            activeOrganizationId: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodString>>;
+            tenantId: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodString>>;
+            tokenHash: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodString>>;
+            lastActiveAt: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodDate>>;
+            revokedAt: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodDate>>;
+            rotatedFrom: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodString>>;
+        }>;
+        /**
+         * auth_invites
+         * Tenant scoped, email-based invites.
+         */
+        auth_invites: import("../../schema/definition.js").TableDefinition<{
+            _id: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            tenantId: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            email: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            role: import("../../schema/validators.js").FieldSchema<import("zod").ZodDefault<import("zod").ZodString>>;
+            permissions: import("../../schema/validators.js").FieldSchema<import("zod").ZodDefault<import("zod").ZodArray<import("zod").ZodString>>>;
+            /**
+             * A random invite token hash (do not store plaintext token).
+             * Optional: you can use `_id` as the token id and keep this nullable.
+             */
+            tokenHash: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodString>>;
+            expiresAt: import("../../schema/validators.js").FieldSchema<import("zod").ZodNumber>;
+            acceptedAt: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodNumber>>;
+            acceptedByUserId: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodString>>;
+            createdAt: import("../../schema/validators.js").FieldSchema<import("zod").ZodNumber>;
+            updatedAt: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodNumber>>;
+        }>;
+        /**
+         * better_auth_verification
+         * Better-Auth verification table for email verification and other verification codes.
+         */
+        system_auth_verification: import("../../schema/definition.js").TableDefinition<{
+            _id: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            identifier: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            value: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            expiresAt: import("../../schema/validators.js").FieldSchema<import("zod").ZodDate>;
+            createdAt: import("../../schema/validators.js").FieldSchema<import("zod").ZodDate>;
+            updatedAt: import("../../schema/validators.js").FieldSchema<import("zod").ZodDate>;
+        }>;
+        /**
+         * better_auth_organization
+         * Better-Auth organization table for multi-tenancy support.
+         */
+        system_auth_organization: import("../../schema/definition.js").TableDefinition<{
+            _id: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            name: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            slug: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            logo: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodString>>;
+            metadata: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodAny>>;
+            createdAt: import("../../schema/validators.js").FieldSchema<import("zod").ZodDate>;
+            updatedAt: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodDate>>;
+        }>;
+        /**
+         * better_auth_member
+         * Better-Auth member table linking users to organizations.
+         */
+        system_auth_member: import("../../schema/definition.js").TableDefinition<{
+            _id: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            organizationId: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            userId: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            role: import("../../schema/validators.js").FieldSchema<import("zod").ZodDefault<import("zod").ZodString>>;
+            createdAt: import("../../schema/validators.js").FieldSchema<import("zod").ZodDate>;
+        }>;
+        /**
+         * better_auth_invitation
+         * Better-Auth invitation table for organization invitations.
+         */
+        system_auth_invitation: import("../../schema/definition.js").TableDefinition<{
+            _id: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            organizationId: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            email: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            role: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            status: import("../../schema/validators.js").FieldSchema<import("zod").ZodDefault<import("zod").ZodString>>;
+            expiresAt: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodDate>>;
+            createdAt: import("../../schema/validators.js").FieldSchema<import("zod").ZodDate>;
+            inviterId: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+        }>;
+        /**
+         * apikey
+         * Better-Auth API key table for API key authentication and management.
+         */
+        system_auth_api_key: import("../../schema/definition.js").TableDefinition<{
+            _id: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            name: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodString>>;
+            start: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodString>>;
+            prefix: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodString>>;
+            key: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            userId: import("../../schema/validators.js").FieldSchema<import("zod").ZodString>;
+            refillInterval: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodNumber>>;
+            refillAmount: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodNumber>>;
+            lastRefillAt: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodNumber>>;
+            enabled: import("../../schema/validators.js").FieldSchema<import("zod").ZodDefault<import("zod").ZodBoolean>>;
+            rateLimitEnabled: import("../../schema/validators.js").FieldSchema<import("zod").ZodDefault<import("zod").ZodBoolean>>;
+            rateLimitTimeWindow: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodNumber>>;
+            rateLimitMax: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodNumber>>;
+            requestCount: import("../../schema/validators.js").FieldSchema<import("zod").ZodDefault<import("zod").ZodNumber>>;
+            remaining: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodNumber>>;
+            lastRequest: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodNumber>>;
+            expiresAt: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodNumber>>;
+            createdAt: import("../../schema/validators.js").FieldSchema<import("zod").ZodNumber>;
+            updatedAt: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodNumber>>;
+            permissions: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodString>>;
+            metadata: import("../../schema/validators.js").FieldSchema<import("zod").ZodOptional<import("zod").ZodAny>>;
+        }>;
+    };
+};
+export type AuthSchema = typeof authSchema;
+export type CompleteAuthSchema = typeof completeAuthSchema;
+//# sourceMappingURL=schema.d.ts.map

package/dist/auth/system/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/auth/system/schema.ts"],"names":[],"mappings":"AAcA;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;CAmBnB,CAAC;AAEX,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,OAAO,gBAAgB,CAAC,CAAC;AAE1F,eAAO,MAAM,UAAU;;QACnB;;;;WAIG;;;;;YAQK;;;eAGG;;;;;;;;;;;;;QAoCX;;;;WAIG;;;;YAUK;;;eAGG;;YAGH;;eAEG;;YAGH;;eAEG;;YAGH;;eAEG;;;;;;;;;;QA0BX;;;WAGG;;;;;;;;QA4BH;;;WAGG;;;;;YAcK;;;eAGG;;YAGH;;eAEG;;;;;QAuBX;;;;;;WAMG;;;;;;;;;;;;;;;;;;QA8CH;;;WAGG;;;;;;;YAeK;;;eAGG;;;;;;;;QA2BX;;;WAGG;;;;;;;;;QAGH;;;WAGG;;;;;;;;;;QAGH;;;WAGG;;;;;;;;QAGH;;;WAGG;;;;;;;;;;;QAGH;;;WAGG;;;;;;;;;;;;;;;;;;;;;;;;;CAEL,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAlU3B;;;;WAIG;;;;;YAQK;;;eAGG;;;;;;;;;;;;;QAoCX;;;;WAIG;;;;YAUK;;;eAGG;;YAGH;;eAEG;;YAGH;;eAEG;;YAGH;;eAEG;;;;;;;;;;QA0BX;;;WAGG;;;;;;;;QA4BH;;;WAGG;;;;;YAcK;;;eAGG;;YAGH;;eAEG;;;;;QAuBX;;;;;;WAMG;;;;;;;;;;;;;;;;;;QA8CH;;;WAGG;;;;;;;YAeK;;;eAGG;;;;;;;;QA2BX;;;WAGG;;;;;;;;;QAGH;;;WAGG;;;;;;;;;;QAGH;;;WAGG;;;;;;;;QAGH;;;WAGG;;;;;;;;;;;QAGH;;;WAGG;;;;;;;;;;;;;;;;;;;;;;;;;CAUL,CAAC;AAEH,MAAM,MAAM,UAAU,GAAG,OAAO,UAAU,CAAC;AAC3C,MAAM,MAAM,kBAAkB,GAAG,OAAO,kBAAkB,CAAC"}