@intelligo-dev/auth 1.0.0-beta.1

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "{}"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2026 Intelligo
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/dist/client.js

@@ -0,0 +1,25 @@
+/**
+ * Better-Auth Client
+ *
+ * Client-side authentication utilities for React components.
+ * This module uses "better-auth/react" which is a client-side module.
+ *
+ * IMPORTANT: Only import this in "use client" components.
+ * For server-side auth, use @intelligo-dev/auth (server.ts)
+ */
+import { createAuthClient } from "better-auth/react";
+import { organizationClient } from "better-auth/client/plugins";
+// No `baseURL`: the client and the Better-Auth server always live on the
+// same origin (this app's own `/api/auth/*` routes), so Better-Auth's
+// client defaults to `window.location.origin` and every request is
+// same-origin. Do not reintroduce an absolute `NEXT_PUBLIC_APP_URL`
+// baseURL here — the dev port has drifted before (3000 -> 3001 -> 4000)
+// and an absolute cross-origin URL is blocked by the app's CSP
+// (`connect-src 'self'`) whenever it doesn't match the port the app is
+// actually served on.
+export const authClient = createAuthClient({
+    plugins: [organizationClient()],
+});
+// Export commonly used hooks and methods for convenience
+export const { useSession, signIn, signUp, signOut } = authClient;
+//# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAEhE,yEAAyE;AACzE,sEAAsE;AACtE,mEAAmE;AACnE,oEAAoE;AACpE,wEAAwE;AACxE,+DAA+D;AAC/D,uEAAuE;AACvE,sBAAsB;AACtB,MAAM,CAAC,MAAM,UAAU,GAAG,gBAAgB,CAAC;IACzC,OAAO,EAAE,CAAC,kBAAkB,EAAE,CAAC;CAChC,CAAC,CAAC;AAEH,yDAAyD;AACzD,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,UAAU,CAAC"}

package/dist/edge.js

@@ -0,0 +1,39 @@
+/**
+ * Edge-safe session presence check.
+ *
+ * Middleware runs in the Edge Runtime, where no TCP Postgres driver is
+ * available. The previous version of this module solved that by
+ * instantiating Better-Auth against the Neon HTTP driver — which made
+ * middleware silently Neon-only. Against any other Postgres the session
+ * query failed with `TypeError: fetch failed`, Better-Auth turned that
+ * into `APIError: Failed to get session`, and the middleware threw: every
+ * request to the app returned HTTP 500. The old code hid this behind a
+ * `NODE_ENV === "development"` bypass that skipped auth entirely, so the
+ * failure only appeared in a production build on a non-Neon database.
+ *
+ * The fix is to stop querying the database from the edge at all.
+ * Middleware performs an OPTIMISTIC check: it reads the session cookie
+ * and decides where to send the request. It never asserts that the
+ * session is valid.
+ *
+ * The authoritative check stays server-side, where it always was —
+ * `requireAuth`/`requireWorkspace`/`requireRole` and the authenticated
+ * layout's own `getAuthSession()` redirect. A forged or expired cookie
+ * gets past middleware and is then rejected by the page or action that
+ * actually reads data. This is the pattern Better-Auth documents for
+ * Next.js middleware, and it is what makes the guard work on any
+ * Postgres, in any runtime, with one code path in every environment.
+ */
+import { getSessionCookie } from "better-auth/cookies";
+/**
+ * True when the request carries a Better-Auth session cookie.
+ *
+ * Presence only — the cookie's signature is NOT verified and no
+ * database read happens. Never use this to authorize access to data;
+ * use it to choose a redirect. Authorization belongs to `requireAuth`
+ * and friends, which run in the Node runtime against the real session.
+ */
+export function hasSessionCookie(request) {
+    return getSessionCookie(request) !== null;
+}
+//# sourceMappingURL=edge.js.map

package/dist/edge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"edge.js","sourceRoot":"","sources":["../src/edge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAEvD;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAgB;IAC/C,OAAO,gBAAgB,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC;AAC5C,CAAC"}

package/dist/helpers.js

@@ -0,0 +1,248 @@
+/**
+ * Server-Side Auth Helpers
+ *
+ * Utilities for server components and server actions to check authentication.
+ * These helpers use Better-Auth's session API with Next.js headers.
+ *
+ * Usage in server actions (TECH-10 pattern):
+ * ```typescript
+ * export async function myServerAction() {
+ *   const { user } = await requireAuth();
+ *   // ... proceed with authenticated user
+ * }
+ * ```
+ */
+import { headers } from "next/headers";
+import { auth } from "./server";
+import { createLogger } from "@intelligo-dev/core/logger";
+import { db } from "@intelligo-dev/core/db";
+import { users } from "@intelligo-dev/core/db/schema";
+import { eq } from "drizzle-orm";
+import { PLATFORM_ADMIN_ROLE } from "./roles";
+const log = createLogger("Auth");
+/**
+ * Get current auth session from request headers.
+ *
+ * Returns session and user if authenticated, null otherwise.
+ * Use this in server components that handle both authenticated and unauthenticated states.
+ */
+export async function getAuthSession() {
+    const session = await auth.api.getSession({
+        headers: await headers(),
+    });
+    if (!session?.user) {
+        return null;
+    }
+    return {
+        session: session.session,
+        user: session.user,
+    };
+}
+/**
+ * Require authentication.
+ *
+ * Throws "Unauthorized" error if no valid session.
+ * Use this in server actions to enforce authentication (TECH-10 pattern).
+ *
+ * @throws Error with "Unauthorized" message if not authenticated
+ */
+export async function requireAuth() {
+    const result = await getAuthSession();
+    if (!result) {
+        throw new Error("Unauthorized");
+    }
+    return result;
+}
+/**
+ * Get workspace context by organization ID.
+ * Use this when you know the org ID (e.g., just after creating/activating a workspace).
+ *
+ * @param organizationId - The organization ID to get context for
+ */
+export async function getWorkspaceContextById(organizationId) {
+    const authResult = await getAuthSession();
+    if (!authResult) {
+        log.debug("getWorkspaceContextById: no auth session");
+        return null;
+    }
+    log.debug("getWorkspaceContextById: fetching org");
+    // Get organization by ID directly (not from session)
+    const org = await auth.api.getFullOrganization({
+        headers: await headers(),
+        query: { organizationId },
+    });
+    if (!org) {
+        log.debug("getWorkspaceContextById: org not found");
+        return null;
+    }
+    // Find user's membership
+    const membership = org.members?.find((m) => m.userId === authResult.user.id);
+    if (!membership) {
+        log.debug("getWorkspaceContextById: user not a member");
+        return null;
+    }
+    return {
+        session: authResult.session,
+        user: authResult.user,
+        workspace: {
+            id: org.id,
+            name: org.name,
+            slug: org.slug,
+            logo: org.logo,
+        },
+        membership: {
+            id: membership.id,
+            role: membership.role,
+        },
+    };
+}
+/**
+ * Get workspace context from the active organization in session.
+ * Returns null if no active organization set.
+ *
+ * Use this in server components that need workspace context but can handle
+ * the absence of an active workspace (e.g., workspace switcher UI).
+ */
+export async function getWorkspaceContext() {
+    const authResult = await getAuthSession();
+    if (!authResult) {
+        log.debug("getWorkspaceContext: no auth session");
+        return null;
+    }
+    log.debug("getWorkspaceContext: session found");
+    // Get active organization from session
+    let activeOrg = await auth.api.getFullOrganization({
+        headers: await headers(),
+    });
+    log.debug("getWorkspaceContext: active org", { hasOrg: !!activeOrg });
+    // Fallback: If no active org in session, auto-select first available workspace
+    if (!activeOrg) {
+        log.debug("getWorkspaceContext: no active org, checking workspaces");
+        const orgs = await auth.api.listOrganizations({
+            headers: await headers(),
+        });
+        if (orgs && orgs.length > 0) {
+            log.debug("getWorkspaceContext: found workspaces", {
+                count: String(orgs.length),
+            });
+            // Fetch full organization details for the first workspace
+            activeOrg = await auth.api.getFullOrganization({
+                headers: await headers(),
+                query: { organizationId: orgs[0].id },
+            });
+        }
+    }
+    if (!activeOrg) {
+        log.debug("getWorkspaceContext: no workspaces found");
+        return null;
+    }
+    // Find user's membership in the active org
+    const activeMember = activeOrg.members.find((m) => m.userId === authResult.user.id);
+    log.debug("getWorkspaceContext: membership check", {
+        hasMembership: !!activeMember,
+    });
+    if (!activeMember) {
+        log.debug("getWorkspaceContext: user not a member of active org");
+        return null;
+    }
+    return {
+        session: authResult.session,
+        user: authResult.user,
+        workspace: {
+            id: activeOrg.id,
+            name: activeOrg.name,
+            slug: activeOrg.slug,
+            logo: activeOrg.logo,
+        },
+        membership: {
+            id: activeMember.id,
+            role: activeMember.role,
+        },
+    };
+}
+/**
+ * Require workspace context. Use in server actions that need workspace scope (TECH-10).
+ * Throws if not authenticated OR no active workspace selected.
+ *
+ * Use this in server actions that operate on workspace-scoped resources
+ * (conversations, knowledge bases, usage logs, etc.).
+ *
+ * @throws Error with "No active workspace" message if no workspace selected
+ */
+export async function requireWorkspace() {
+    const context = await getWorkspaceContext();
+    if (!context) {
+        throw new Error("No active workspace");
+    }
+    return context;
+}
+/**
+ * Require specific role in active workspace.
+ * Use for admin/owner-only server actions (TEAM-08).
+ *
+ * Example: requireRole(["owner", "admin"]) for workspace settings actions.
+ *
+ * @param allowedRoles - Array of role names that are permitted
+ * @throws Error with "Insufficient permissions" message if user lacks required role
+ */
+export async function requireRole(allowedRoles) {
+    const context = await requireWorkspace();
+    if (!allowedRoles.includes(context.membership.role)) {
+        throw new Error("Insufficient permissions");
+    }
+    return context;
+}
+/**
+ * Require PLATFORM admin — distinct from workspace roles.
+ *
+ * Workspace `owner` is a per-tenant role: any user who creates a
+ * workspace owns it. Platform-level surfaces (cross-workspace
+ * analytics, the operational console, impersonation) must never be
+ * gated on it.
+ *
+ * The authority is `users.role`. PLATFORM_ADMIN_EMAILS is the
+ * bootstrap: an allowlisted user is promoted into the column the first
+ * time they pass through here, so a fresh deployment has a way in and
+ * every later check — including Better-Auth's admin plugin, which can
+ * only read the row — agrees with this one. Two gates that can
+ * disagree is how the cross-tenant analytics leak happened in the
+ * first place.
+ *
+ * Closed by default: no allowlist and no role means no admin.
+ *
+ * @throws Error("Insufficient permissions") when the user is not a
+ *   platform admin.
+ */
+export async function requirePlatformAdmin() {
+    const { session, user } = await requireAuth();
+    const allowlist = (process.env.PLATFORM_ADMIN_EMAILS ?? "")
+        .split(",")
+        .map((e) => e.trim().toLowerCase())
+        .filter(Boolean);
+    const email = user.email?.toLowerCase();
+    const allowlisted = !!email && allowlist.includes(email);
+    const roles = (user.role ?? "")
+        .split(",")
+        .map((r) => r.trim());
+    const hasRole = roles.includes(PLATFORM_ADMIN_ROLE);
+    if (!allowlisted && !hasRole) {
+        throw new Error("Insufficient permissions");
+    }
+    // Promote on first use so the row, not the environment, is what
+    // every other check reads. A failure here must not lock an admin out
+    // mid-incident — they are already authorized by the allowlist.
+    if (allowlisted && !hasRole) {
+        const next = [...roles.filter(Boolean), PLATFORM_ADMIN_ROLE].join(",");
+        try {
+            await db.update(users).set({ role: next }).where(eq(users.id, user.id));
+        }
+        catch (error) {
+            log.error("Failed to promote allowlisted platform admin", {
+                userId: user.id,
+                error: error instanceof Error ? error.message : String(error),
+            });
+        }
+    }
+    return { session, user };
+}
+//# sourceMappingURL=helpers.js.map

package/dist/helpers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"helpers.js","sourceRoot":"","sources":["../src/helpers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAE,EAAE,EAAE,MAAM,wBAAwB,CAAC;AAC5C,OAAO,EAAE,KAAK,EAAE,MAAM,+BAA+B,CAAC;AACtD,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAEjC,OAAO,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC;AAK9C,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;AAEjC;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc;IAIlC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;QACxC,OAAO,EAAE,MAAM,OAAO,EAAE;KACzB,CAAC,CAAC;IAEH,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,IAAI,EAAE,OAAO,CAAC,IAAI;KACnB,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW;IAI/B,MAAM,MAAM,GAAG,MAAM,cAAc,EAAE,CAAC;IAEtC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC;IAClC,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,cAAsB;IAMlE,MAAM,UAAU,GAAG,MAAM,cAAc,EAAE,CAAC;IAC1C,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,GAAG,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAC;QACtD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,GAAG,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAEnD,qDAAqD;IACrD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAC;QAC7C,OAAO,EAAE,MAAM,OAAO,EAAE;QACxB,KAAK,EAAE,EAAE,cAAc,EAAE;KAC1B,CAAC,CAAC;IAEH,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,GAAG,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;QACpD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,yBAAyB;IACzB,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,EAAE,IAAI,CAClC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,IAAI,CAAC,EAAE,CAC5C,CAAC;IAEF,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,GAAG,CAAC,KAAK,CAAC,4CAA4C,CAAC,CAAC;QACxD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,IAAI,EAAE,UAAU,CAAC,IAAI;QACrB,SAAS,EAAE;YACT,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,IAAI,EAAE,GAAG,CAAC,IAAI;SACf;QACD,UAAU,EAAE;YACV,EAAE,EAAE,UAAU,CAAC,EAAE;YACjB,IAAI,EAAE,UAAU,CAAC,IAAI;SACtB;KACF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB;IAMvC,MAAM,UAAU,GAAG,MAAM,cAAc,EAAE,CAAC;IAC1C,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,GAAG,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAClD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,GAAG,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;IAEhD,uCAAuC;IACvC,IAAI,SAAS,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAC;QACjD,OAAO,EAAE,MAAM,OAAO,EAAE;KACzB,CAAC,CAAC;IAEH,GAAG,CAAC,KAAK,CAAC,iCAAiC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;IAEtE,+EAA+E;IAC/E,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,GAAG,CAAC,KAAK,CAAC,yDAAyD,CAAC,CAAC;QACrE,MAAM,IAAI,GAAQ,MAAM,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC;YACjD,OAAO,EAAE,MAAM,OAAO,EAAE;SACzB,CAAC,CAAC;QAEH,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,GAAG,CAAC,KAAK,CAAC,uCAAuC,EAAE;gBACjD,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;aAC3B,CAAC,CAAC;YACH,0DAA0D;YAC1D,SAAS,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAC;gBAC7C,OAAO,EAAE,MAAM,OAAO,EAAE;gBACxB,KAAK,EAAE,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE;aACtC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,GAAG,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAC;QACtD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,2CAA2C;IAC3C,MAAM,YAAY,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CACzC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,IAAI,CAAC,EAAE,CAC5C,CAAC;IAEF,GAAG,CAAC,KAAK,CAAC,uCAAuC,EAAE;QACjD,aAAa,EAAE,CAAC,CAAC,YAAY;KAC9B,CAAC,CAAC;IAEH,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,GAAG,CAAC,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAClE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,IAAI,EAAE,UAAU,CAAC,IAAI;QACrB,SAAS,EAAE;YACT,EAAE,EAAE,SAAS,CAAC,EAAE;YAChB,IAAI,EAAE,SAAS,CAAC,IAAI;YACpB,IAAI,EAAE,SAAS,CAAC,IAAI;YACpB,IAAI,EAAE,SAAS,CAAC,IAAI;SACrB;QACD,UAAU,EAAE;YACV,EAAE,EAAE,YAAY,CAAC,EAAE;YACnB,IAAI,EAAE,YAAY,CAAC,IAAI;SACxB;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB;IAMpC,MAAM,OAAO,GAAG,MAAM,mBAAmB,EAAE,CAAC;IAC5C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,YAA6B;IAM7D,MAAM,OAAO,GAAG,MAAM,gBAAgB,EAAE,CAAC;IACzC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB;IAIxC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,MAAM,WAAW,EAAE,CAAC;IAE9C,MAAM,SAAS,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,EAAE,CAAC;SACxD,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;SAClC,MAAM,CAAC,OAAO,CAAC,CAAC;IAEnB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC;IACxC,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,IAAI,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACzD,MAAM,KAAK,GAAG,CAAE,IAAiC,CAAC,IAAI,IAAI,EAAE,CAAC;SAC1D,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACxB,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;IAEpD,IAAI,CAAC,WAAW,IAAI,CAAC,OAAO,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC9C,CAAC;IAED,gEAAgE;IAChE,qEAAqE;IACrE,+DAA+D;IAC/D,IAAI,WAAW,IAAI,CAAC,OAAO,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,mBAAmB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACvE,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,GAAG,CAAC,KAAK,CAAC,8CAA8C,EAAE;gBACxD,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC"}

package/dist/impersonation.js

@@ -0,0 +1,42 @@
+import "server-only";
+/**
+ * Session-level impersonation.
+ *
+ * This module owns only the session mechanics, because that is what
+ * @intelligo-dev/auth owns: it holds the Better-Auth instance and the
+ * request headers. The *policy* — who may do it, that it is audited or
+ * refused, that a reason is mandatory — lives in @intelligo-dev/admin, and
+ * these functions must not be called without going through it.
+ *
+ * Nothing here re-checks authorization. Splitting the check from the
+ * act would give two places that can disagree about who is an admin,
+ * which is the mistake that put cross-tenant analytics behind a
+ * workspace role.
+ */
+import { headers } from "next/headers";
+import { auth } from "./server";
+/** Default matching `impersonationSessionDuration` in server.ts. */
+const FALLBACK_DURATION_MS = 30 * 60000;
+/**
+ * Swap the caller's session cookie for one belonging to `targetUserId`.
+ *
+ * Better-Auth refuses if the target is themselves a platform admin.
+ */
+export async function impersonateUser(targetUserId) {
+    const result = (await auth.api.impersonateUser({
+        body: { userId: targetUserId },
+        headers: await headers(),
+    }));
+    const expiresAt = result.session?.expiresAt;
+    return {
+        targetUserId,
+        expiresAt: expiresAt
+            ? new Date(expiresAt)
+            : new Date(Date.now() + FALLBACK_DURATION_MS),
+    };
+}
+/** Restore the admin's own session. */
+export async function stopImpersonating() {
+    await auth.api.stopImpersonating({ headers: await headers() });
+}
+//# sourceMappingURL=impersonation.js.map

package/dist/impersonation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"impersonation.js","sourceRoot":"","sources":["../src/impersonation.ts"],"names":[],"mappings":"AAAA,OAAO,aAAa,CAAC;AAErB;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEvC,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAQhC,oEAAoE;AACpE,MAAM,oBAAoB,GAAG,EAAE,GAAG,KAAM,CAAC;AAEzC;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,YAAoB;IAEpB,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC;QAC7C,IAAI,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE;QAC9B,OAAO,EAAE,MAAM,OAAO,EAAE;KACzB,CAAC,CAAgD,CAAC;IAEnD,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC;IAE5C,OAAO;QACL,YAAY;QACZ,SAAS,EAAE,SAAS;YAClB,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC;YACrB,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,oBAAoB,CAAC;KAChD,CAAC;AACJ,CAAC;AAED,uCAAuC;AACvC,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,MAAM,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,OAAO,EAAE,MAAM,OAAO,EAAE,EAAE,CAAC,CAAC;AACjE,CAAC"}

package/dist/index.js

@@ -0,0 +1,30 @@
+/**
+ * Better-Auth Server Exports
+ *
+ * Server-side authentication utilities.
+ * For client-side auth, use @intelligo-dev/auth/client
+ */
+export { auth } from "./server";
+export { getAuthSession, requireAuth, getWorkspaceContext, getWorkspaceContextById, requireWorkspace, requireRole, requirePlatformAdmin, } from "./helpers";
+export { ensureUserWorkspace } from "./workspace-init";
+export { PLATFORM_ADMIN_ROLE } from "./roles";
+export { impersonateUser, stopImpersonating, } from "./impersonation";
+// Typed Better-Auth organization plugin wrapper
+export { orgApi, } from "./org-api";
+// Team management service (page/registry migration, section C1)
+export { createTeamService, } from "./team/service";
+export { TeamServiceError, isTeamServiceError, } from "./team/errors";
+export { inviteMemberSchema, updateRoleSchema, } from "./team/schemas";
+// Workspace management service (page/registry migration, workspace-settings family)
+export { createWorkspaceService, } from "./workspace/service";
+export { WorkspaceServiceError, isWorkspaceServiceError, } from "./workspace/errors";
+export { createWorkspaceSchema, updateWorkspaceSchema, } from "./workspace/schemas";
+// Profile management service (page/registry migration, profile-settings family)
+export { createProfileService, } from "./profile/service";
+export { ProfileServiceError, isProfileServiceError, } from "./profile/errors";
+export { updateProfileSchema, } from "./profile/schemas";
+// Onboarding service (page/registry migration, `onboarding` family)
+export { createOnboardingService, } from "./onboarding/service";
+export { OnboardingServiceError, isOnboardingServiceError, } from "./onboarding/errors";
+export { setStepSchema } from "./onboarding/schemas";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAChC,OAAO,EACL,cAAc,EACd,WAAW,EACX,mBAAmB,EACnB,uBAAuB,EACvB,gBAAgB,EAChB,WAAW,EACX,oBAAoB,GACrB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAEvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC;AAC9C,OAAO,EACL,eAAe,EACf,iBAAiB,GAElB,MAAM,iBAAiB,CAAC;AAKzB,gDAAgD;AAChD,OAAO,EACL,MAAM,GAOP,MAAM,WAAW,CAAC;AAEnB,gEAAgE;AAChE,OAAO,EACL,iBAAiB,GAGlB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,gBAAgB,EAChB,kBAAkB,GAGnB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,kBAAkB,EAClB,gBAAgB,GAGjB,MAAM,gBAAgB,CAAC;AAExB,oFAAoF;AACpF,OAAO,EACL,sBAAsB,GAIvB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,qBAAqB,EACrB,uBAAuB,GAGxB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,qBAAqB,EACrB,qBAAqB,GAGtB,MAAM,qBAAqB,CAAC;AAE7B,gFAAgF;AAChF,OAAO,EACL,oBAAoB,GAIrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,mBAAmB,EACnB,qBAAqB,GAGtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,mBAAmB,GAEpB,MAAM,mBAAmB,CAAC;AAE3B,oEAAoE;AACpE,OAAO,EACL,uBAAuB,GAGxB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,sBAAsB,EACtB,wBAAwB,GAEzB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAqB,MAAM,sBAAsB,CAAC"}

package/dist/onboarding/errors.js

@@ -0,0 +1,31 @@
+/**
+ * Onboarding service error type.
+ *
+ * Mirrors `../team/errors.ts` and `../workspace/errors.ts`: the
+ * onboarding service (./service.ts) throws this for every failure it
+ * recognizes rather than returning an ad-hoc `{ success, error }`
+ * envelope — that shaping is a transport concern (a Server Action, a
+ * route handler) and belongs one layer up, alongside
+ * revalidatePath/Sentry/toast/i18n, none of which this package may
+ * depend on.
+ */
+export class OnboardingServiceError extends Error {
+    constructor(code, message, options) {
+        super(message);
+        this.name = "OnboardingServiceError";
+        this.code = code;
+        if (options?.cause !== undefined) {
+            // ES2020 target predates the standard `cause` constructor option;
+            // assign it directly so `instanceof Error` consumers (and Node's
+            // own error inspection) still see it.
+            this.cause = options.cause;
+        }
+        // Restore prototype chain (extending built-ins across some
+        // transpilation targets loses `instanceof`).
+        Object.setPrototypeOf(this, OnboardingServiceError.prototype);
+    }
+}
+export function isOnboardingServiceError(error) {
+    return error instanceof OnboardingServiceError;
+}
+//# sourceMappingURL=errors.js.map

package/dist/onboarding/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/onboarding/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAaH,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAG/C,YACE,IAAgC,EAChC,OAAe,EACf,OAA6B;QAE7B,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;QACrC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,OAAO,EAAE,KAAK,KAAK,SAAS,EAAE,CAAC;YACjC,kEAAkE;YAClE,iEAAiE;YACjE,sCAAsC;YACrC,IAA4B,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QACtD,CAAC;QAED,2DAA2D;QAC3D,6CAA6C;QAC7C,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,sBAAsB,CAAC,SAAS,CAAC,CAAC;IAChE,CAAC;CACF;AAED,MAAM,UAAU,wBAAwB,CACtC,KAAc;IAEd,OAAO,KAAK,YAAY,sBAAsB,CAAC;AACjD,CAAC"}