@intelligo-dev/auth 1.0.0-beta.1 → 1.0.0-beta.13

package/NOTICE

@@ -0,0 +1,6 @@
+Intelligo
+Copyright 2026 Turtuvshin Byambaa and the Intelligo contributors
+
+This product is licensed under the Apache License, Version 2.0 (see
+LICENSE). The Intelligo name and logo are trademarks; see TRADEMARK.md
+in the source repository, https://github.com/intelligo-dev/intelligo.

package/README.md

@@ -0,0 +1,59 @@
+# @intelligo-dev/auth
+
+Multi-tenant authentication on Better-Auth: sign-up, workspaces, invitations and role-based access control.
+
+Part of [Intelligo](https://intelligo.dev), an application framework and
+operational platform for vertical AI SaaS products. Every `@intelligo-dev/*`
+package is released at one version and shares one database schema;
+`pnpm dlx @intelligo-dev/cli@beta create my-app` installs the set an
+application needs. Documentation:
+[intelligo.dev/docs/packages/auth](https://intelligo.dev/docs/packages/auth).
+
+## Install
+
+```bash
+pnpm add @intelligo-dev/auth@beta better-auth drizzle-orm zod
+```
+
+`better-auth`, `drizzle-orm` and `zod` are peers: the guards read the
+Better-Auth instance and the database client the application already has.
+
+## What it owns
+
+Sessions and accounts, organizations as workspaces, membership roles
+(`owner` / `admin` / `member`), invitations, platform-admin impersonation, and
+the guards every transport starts with: `requireAuth`, `requireWorkspace`,
+`requireRole`, `requirePlatformAdmin`.
+
+The team, workspace, profile and onboarding services live here too, behind
+ports the composition root binds — auth never imports billing.
+
+## Use
+
+```ts
+import { requireWorkspace } from "@intelligo-dev/auth";
+
+const { user, workspace, membership } = await requireWorkspace();
+```
+
+A guard that refuses throws an `AuthGuardError`; `isAuthGuardError(error)`
+narrows it and `error.code` picks the status: `unauthenticated` (no session,
+401), `no_workspace` (signed in, member of no workspace) or `forbidden`
+(lacking the role, 403).
+
+`impersonateUser` checks that the caller is a platform admin and that the
+target is not one before it swaps the session. Products call
+`startImpersonation` from `@intelligo-dev/admin`, which adds the audit event
+and the mandatory reason.
+
+`hasSessionCookie(request)` from `@intelligo-dev/auth/edge` is for an optional
+optimistic redirect in a consumer's `proxy.ts`. It reads cookie presence only
+and is never authorization; the scaffold does not use it.
+
+Platform admin is a row (`users.role`), not an environment variable. The
+allowlist in `PLATFORM_ADMIN_EMAILS` is promoted into that column on first use,
+so the plugin and the guard cannot disagree.
+
+## Licence
+
+Apache-2.0

package/dist/client.js

@@ -1,25 +1,15 @@
 /**
- * Better-Auth Client
- *
- * Client-side authentication utilities for React components.
- * This module uses "better-auth/react" which is a client-side module.
- *
- * IMPORTANT: Only import this in "use client" components.
- * For server-side auth, use @intelligo-dev/auth (server.ts)
+ * The Better-Auth React client. Import only from "use client" components;
+ * server code uses `@intelligo-dev/auth`.
  */
 import { createAuthClient } from "better-auth/react";
 import { organizationClient } from "better-auth/client/plugins";
-// No `baseURL`: the client and the Better-Auth server always live on the
-// same origin (this app's own `/api/auth/*` routes), so Better-Auth's
-// client defaults to `window.location.origin` and every request is
-// same-origin. Do not reintroduce an absolute `NEXT_PUBLIC_APP_URL`
-// baseURL here — the dev port has drifted before (3000 -> 3001 -> 4000)
-// and an absolute cross-origin URL is blocked by the app's CSP
-// (`connect-src 'self'`) whenever it doesn't match the port the app is
-// actually served on.
+// No `baseURL`: the client and server share an origin (`/api/auth/*`), so
+// Better-Auth defaults to `window.location.origin`. An absolute URL is
+// blocked by the app's CSP (`connect-src 'self'`) whenever its port differs
+// from the one the app is served on.
 export const authClient = createAuthClient({
     plugins: [organizationClient()],
 });
-// Export commonly used hooks and methods for convenience
 export const { useSession, signIn, signUp, signOut } = authClient;
 //# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAEhE,yEAAyE;AACzE,sEAAsE;AACtE,mEAAmE;AACnE,oEAAoE;AACpE,wEAAwE;AACxE,+DAA+D;AAC/D,uEAAuE;AACvE,sBAAsB;AACtB,MAAM,CAAC,MAAM,UAAU,GAAG,gBAAgB,CAAC;IACzC,OAAO,EAAE,CAAC,kBAAkB,EAAE,CAAC;CAChC,CAAC,CAAC;AAEH,yDAAyD;AACzD,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,UAAU,CAAC"}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAEhE,0EAA0E;AAC1E,uEAAuE;AACvE,4EAA4E;AAC5E,qCAAqC;AACrC,MAAM,CAAC,MAAM,UAAU,GAAG,gBAAgB,CAAC;IACzC,OAAO,EAAE,CAAC,kBAAkB,EAAE,CAAC;CAChC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,UAAU,CAAC"}

package/dist/edge.js

@@ -1,37 +1,31 @@
 /**
- * Edge-safe session presence check.
- *
- * Middleware runs in the Edge Runtime, where no TCP Postgres driver is
- * available. The previous version of this module solved that by
- * instantiating Better-Auth against the Neon HTTP driver — which made
- * middleware silently Neon-only. Against any other Postgres the session
- * query failed with `TypeError: fetch failed`, Better-Auth turned that
- * into `APIError: Failed to get session`, and the middleware threw: every
- * request to the app returned HTTP 500. The old code hid this behind a
- * `NODE_ENV === "development"` bypass that skipped auth entirely, so the
- * failure only appeared in a production build on a non-Neon database.
- *
- * The fix is to stop querying the database from the edge at all.
- * Middleware performs an OPTIMISTIC check: it reads the session cookie
- * and decides where to send the request. It never asserts that the
- * session is valid.
- *
- * The authoritative check stays server-side, where it always was —
- * `requireAuth`/`requireWorkspace`/`requireRole` and the authenticated
- * layout's own `getAuthSession()` redirect. A forged or expired cookie
- * gets past middleware and is then rejected by the page or action that
- * actually reads data. This is the pattern Better-Auth documents for
- * Next.js middleware, and it is what makes the guard work on any
- * Postgres, in any runtime, with one code path in every environment.
+ * Edge-safe session presence check. Middleware runs where no TCP Postgres
+ * driver exists, so it never queries the database: it reads the cookie and
+ * picks a redirect. A forged or expired cookie gets past it and is rejected
+ * server-side by `requireAuth`/`requireWorkspace`/`requireRole`.
  */
 import { getSessionCookie } from "better-auth/cookies";
 /**
  * True when the request carries a Better-Auth session cookie.
  *
- * Presence only — the cookie's signature is NOT verified and no
- * database read happens. Never use this to authorize access to data;
- * use it to choose a redirect. Authorization belongs to `requireAuth`
- * and friends, which run in the Node runtime against the real session.
+ * For one thing only: an optional optimistic redirect in a consumer's
+ * `proxy.ts` / `middleware.ts`, sending a visitor with no cookie to the
+ * login page before the page renders. The scaffold does not use it; its
+ * session redirect runs server-side in the `(app)` layout.
+ *
+ * Presence only — the cookie's signature is NOT verified and no database
+ * read happens, so this is never authorization. A forged or expired cookie
+ * passes it and is rejected by `requireAuth` and friends, which every
+ * layout, action and route handler still calls.
+ *
+ * @example
+ * const intl = createIntlMiddleware(routing);
+ * export default function proxy(request: NextRequest) {
+ *   const isApp = /^\/(?:[a-z]{2}\/)?dashboard(?:\/|$)/.test(request.nextUrl.pathname);
+ *   if (isApp && !hasSessionCookie(request))
+ *     return NextResponse.redirect(new URL("/login", request.url));
+ *   return intl(request);
+ * }
  */
 export function hasSessionCookie(request) {
     return getSessionCookie(request) !== null;

package/dist/edge.js.map

@@ -1 +1 @@
-{"version":3,"file":"edge.js","sourceRoot":"","sources":["../src/edge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAEvD;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAgB;IAC/C,OAAO,gBAAgB,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC;AAC5C,CAAC"}
+{"version":3,"file":"edge.js","sourceRoot":"","sources":["../src/edge.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAEvD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAgB;IAC/C,OAAO,gBAAgB,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC;AAC5C,CAAC"}

package/dist/guard-error.js

@@ -0,0 +1,23 @@
+/**
+ * Thrown by `requireAuth`, `requireWorkspace`, `requireRole` and
+ * `requirePlatformAdmin`. A transport picks its status from `code`; the
+ * message is for logs and never reaches a user.
+ */
+const MESSAGES = {
+    unauthenticated: "Unauthorized",
+    no_workspace: "No active workspace",
+    forbidden: "Insufficient permissions",
+};
+export class AuthGuardError extends Error {
+    constructor(code, message = MESSAGES[code]) {
+        super(message);
+        this.name = "AuthGuardError";
+        this.code = code;
+        // Extending built-ins loses `instanceof` on some transpilation targets.
+        Object.setPrototypeOf(this, AuthGuardError.prototype);
+    }
+}
+export function isAuthGuardError(error) {
+    return error instanceof AuthGuardError;
+}
+//# sourceMappingURL=guard-error.js.map

package/dist/guard-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard-error.js","sourceRoot":"","sources":["../src/guard-error.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAUH,MAAM,QAAQ,GAAuC;IACnD,eAAe,EAAE,cAAc;IAC/B,YAAY,EAAE,qBAAqB;IACnC,SAAS,EAAE,0BAA0B;CACtC,CAAC;AAEF,MAAM,OAAO,cAAe,SAAQ,KAAK;IAGvC,YAAY,IAAwB,EAAE,UAAkB,QAAQ,CAAC,IAAI,CAAC;QACpE,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;QAC7B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QAEjB,wEAAwE;QACxE,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,cAAc,CAAC,SAAS,CAAC,CAAC;IACxD,CAAC;CACF;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,OAAO,KAAK,YAAY,cAAc,CAAC;AACzC,CAAC"}

package/dist/helpers.js

@@ -1,34 +1,22 @@
 /**
- * Server-Side Auth Helpers
- *
- * Utilities for server components and server actions to check authentication.
- * These helpers use Better-Auth's session API with Next.js headers.
- *
- * Usage in server actions (TECH-10 pattern):
- * ```typescript
- * export async function myServerAction() {
- *   const { user } = await requireAuth();
- *   // ... proceed with authenticated user
- * }
- * ```
+ * Session and workspace guards for server components, Server Actions and
+ * route handlers. Headers come from `@intelligo-dev/core/request-context`.
  */
-import { headers } from "next/headers";
-import { auth } from "./server";
+import { getRequestHeaders } from "@intelligo-dev/core/request-context";
+import { auth } from "./server.js";
 import { createLogger } from "@intelligo-dev/core/logger";
 import { db } from "@intelligo-dev/core/db";
 import { users } from "@intelligo-dev/core/db/schema";
 import { eq } from "drizzle-orm";
-import { PLATFORM_ADMIN_ROLE } from "./roles";
+import { AuthGuardError } from "./guard-error.js";
+import { PLATFORM_ADMIN_ROLE, platformAdminStanding } from "./roles.js";
 const log = createLogger("Auth");
 /**
- * Get current auth session from request headers.
- *
- * Returns session and user if authenticated, null otherwise.
- * Use this in server components that handle both authenticated and unauthenticated states.
+ * The current session and user, or null when unauthenticated.
  */
 export async function getAuthSession() {
     const session = await auth.api.getSession({
-        headers: await headers(),
+        headers: await getRequestHeaders(),
     });
     if (!session?.user) {
         return null;
@@ -39,25 +27,21 @@ export async function getAuthSession() {
     };
 }
 /**
- * Require authentication.
+ * The current session and user.
  *
- * Throws "Unauthorized" error if no valid session.
- * Use this in server actions to enforce authentication (TECH-10 pattern).
- *
- * @throws Error with "Unauthorized" message if not authenticated
+ * @throws AuthGuardError `unauthenticated` ("Unauthorized") when there is
+ *   no valid session.
  */
 export async function requireAuth() {
     const result = await getAuthSession();
     if (!result) {
-        throw new Error("Unauthorized");
+        throw new AuthGuardError("unauthenticated");
     }
     return result;
 }
 /**
- * Get workspace context by organization ID.
- * Use this when you know the org ID (e.g., just after creating/activating a workspace).
- *
- * @param organizationId - The organization ID to get context for
+ * Workspace context for a given organization id, e.g. just after creating
+ * or activating one. Null when unauthenticated or not a member.
  */
 export async function getWorkspaceContextById(organizationId) {
     const authResult = await getAuthSession();
@@ -66,16 +50,14 @@ export async function getWorkspaceContextById(organizationId) {
         return null;
     }
     log.debug("getWorkspaceContextById: fetching org");
-    // Get organization by ID directly (not from session)
     const org = await auth.api.getFullOrganization({
-        headers: await headers(),
+        headers: await getRequestHeaders(),
         query: { organizationId },
     });
     if (!org) {
         log.debug("getWorkspaceContextById: org not found");
         return null;
     }
-    // Find user's membership
     const membership = org.members?.find((m) => m.userId === authResult.user.id);
     if (!membership) {
         log.debug("getWorkspaceContextById: user not a member");
@@ -97,37 +79,39 @@ export async function getWorkspaceContextById(organizationId) {
     };
 }
 /**
- * Get workspace context from the active organization in session.
- * Returns null if no active organization set.
- *
- * Use this in server components that need workspace context but can handle
- * the absence of an active workspace (e.g., workspace switcher UI).
+ * The workspace a session acts in: its active organization, read by explicit
+ * id, falling back to the user's first workspace. Null when the user has none.
  */
-export async function getWorkspaceContext() {
-    const authResult = await getAuthSession();
-    if (!authResult) {
-        log.debug("getWorkspaceContext: no auth session");
-        return null;
-    }
-    log.debug("getWorkspaceContext: session found");
-    // Get active organization from session
-    let activeOrg = await auth.api.getFullOrganization({
-        headers: await headers(),
-    });
+async function resolveWorkspaceContext(authResult) {
+    const activeOrganizationId = authResult.session.activeOrganizationId;
+    // Better-Auth throws FORBIDDEN when the active organization no longer
+    // admits this user (removed member); treat that as "no active workspace"
+    // so the fallback below runs.
+    let activeOrg = activeOrganizationId
+        ? await auth.api
+            .getFullOrganization({
+            headers: await getRequestHeaders(),
+            query: { organizationId: activeOrganizationId },
+        })
+            .catch((error) => {
+            log.debug("getWorkspaceContext: active org not readable", {
+                error: error instanceof Error ? error.message : String(error),
+            });
+            return null;
+        })
+        : null;
     log.debug("getWorkspaceContext: active org", { hasOrg: !!activeOrg });
-    // Fallback: If no active org in session, auto-select first available workspace
     if (!activeOrg) {
         log.debug("getWorkspaceContext: no active org, checking workspaces");
         const orgs = await auth.api.listOrganizations({
-            headers: await headers(),
+            headers: await getRequestHeaders(),
         });
         if (orgs && orgs.length > 0) {
             log.debug("getWorkspaceContext: found workspaces", {
                 count: String(orgs.length),
             });
-            // Fetch full organization details for the first workspace
             activeOrg = await auth.api.getFullOrganization({
-                headers: await headers(),
+                headers: await getRequestHeaders(),
                 query: { organizationId: orgs[0].id },
             });
         }
@@ -136,7 +120,6 @@ export async function getWorkspaceContext() {
         log.debug("getWorkspaceContext: no workspaces found");
         return null;
     }
-    // Find user's membership in the active org
     const activeMember = activeOrg.members.find((m) => m.userId === authResult.user.id);
     log.debug("getWorkspaceContext: membership check", {
         hasMembership: !!activeMember,
@@ -161,78 +144,75 @@ export async function getWorkspaceContext() {
     };
 }
 /**
- * Require workspace context. Use in server actions that need workspace scope (TECH-10).
- * Throws if not authenticated OR no active workspace selected.
- *
- * Use this in server actions that operate on workspace-scoped resources
- * (conversations, knowledge bases, usage logs, etc.).
+ * Workspace context from the session's active organization, falling back to
+ * the user's first workspace. Null when unauthenticated or when the user has
+ * none.
+ */
+export async function getWorkspaceContext() {
+    const authResult = await getAuthSession();
+    if (!authResult) {
+        log.debug("getWorkspaceContext: no auth session");
+        return null;
+    }
+    return resolveWorkspaceContext(authResult);
+}
+/**
+ * Workspace context for workspace-scoped operations.
  *
- * @throws Error with "No active workspace" message if no workspace selected
+ * @throws AuthGuardError `unauthenticated` ("Unauthorized") when there is
+ *   no valid session, `no_workspace` ("No active workspace") when the user
+ *   has none.
  */
 export async function requireWorkspace() {
-    const context = await getWorkspaceContext();
+    const context = await resolveWorkspaceContext(await requireAuth());
     if (!context) {
-        throw new Error("No active workspace");
+        throw new AuthGuardError("no_workspace");
     }
     return context;
 }
 /**
- * Require specific role in active workspace.
- * Use for admin/owner-only server actions (TEAM-08).
+ * Workspace context when the member holds one of `allowedRoles`, e.g.
+ * `requireRole(["owner", "admin"])`.
  *
- * Example: requireRole(["owner", "admin"]) for workspace settings actions.
- *
- * @param allowedRoles - Array of role names that are permitted
- * @throws Error with "Insufficient permissions" message if user lacks required role
+ * @throws AuthGuardError `forbidden` ("Insufficient permissions") when the
+ *   member lacks the role, and whatever `requireWorkspace` throws.
  */
 export async function requireRole(allowedRoles) {
     const context = await requireWorkspace();
-    if (!allowedRoles.includes(context.membership.role)) {
-        throw new Error("Insufficient permissions");
+    // Better-Auth stores roles as a comma-separated string, so a member
+    // may hold more than one; any of them may satisfy the check.
+    const held = String(context.membership.role)
+        .split(",")
+        .map((r) => r.trim());
+    if (!held.some((r) => allowedRoles.includes(r))) {
+        throw new AuthGuardError("forbidden");
     }
     return context;
 }
 /**
- * Require PLATFORM admin — distinct from workspace roles.
- *
- * Workspace `owner` is a per-tenant role: any user who creates a
- * workspace owns it. Platform-level surfaces (cross-workspace
- * analytics, the operational console, impersonation) must never be
- * gated on it.
- *
- * The authority is `users.role`. PLATFORM_ADMIN_EMAILS is the
- * bootstrap: an allowlisted user is promoted into the column the first
- * time they pass through here, so a fresh deployment has a way in and
- * every later check — including Better-Auth's admin plugin, which can
- * only read the row — agrees with this one. Two gates that can
- * disagree is how the cross-tenant analytics leak happened in the
- * first place.
+ * Require a PLATFORM admin, distinct from workspace roles: workspace
+ * `owner` is per-tenant, so platform surfaces must never be gated on it.
  *
+ * The authority is `users.role`. PLATFORM_ADMIN_EMAILS is the bootstrap:
+ * an allowlisted user is promoted into the column on first use, so every
+ * later check, Better-Auth's admin plugin included, reads the same row.
  * Closed by default: no allowlist and no role means no admin.
  *
- * @throws Error("Insufficient permissions") when the user is not a
+ * @throws AuthGuardError `unauthenticated` when there is no session,
+ *   `forbidden` ("Insufficient permissions") when the user is not a
  *   platform admin.
  */
 export async function requirePlatformAdmin() {
     const { session, user } = await requireAuth();
-    const allowlist = (process.env.PLATFORM_ADMIN_EMAILS ?? "")
-        .split(",")
-        .map((e) => e.trim().toLowerCase())
-        .filter(Boolean);
-    const email = user.email?.toLowerCase();
-    const allowlisted = !!email && allowlist.includes(email);
-    const roles = (user.role ?? "")
-        .split(",")
-        .map((r) => r.trim());
-    const hasRole = roles.includes(PLATFORM_ADMIN_ROLE);
+    const { allowlisted, hasRole, roles } = platformAdminStanding(user);
     if (!allowlisted && !hasRole) {
-        throw new Error("Insufficient permissions");
+        throw new AuthGuardError("forbidden");
     }
     // Promote on first use so the row, not the environment, is what
     // every other check reads. A failure here must not lock an admin out
     // mid-incident — they are already authorized by the allowlist.
     if (allowlisted && !hasRole) {
-        const next = [...roles.filter(Boolean), PLATFORM_ADMIN_ROLE].join(",");
+        const next = [...roles, PLATFORM_ADMIN_ROLE].join(",");
         try {
             await db.update(users).set({ role: next }).where(eq(users.id, user.id));
         }

package/dist/helpers.js.map

@@ -1 +1 @@
-{"version":3,"file":"helpers.js","sourceRoot":"","sources":["../src/helpers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAE,EAAE,EAAE,MAAM,wBAAwB,CAAC;AAC5C,OAAO,EAAE,KAAK,EAAE,MAAM,+BAA+B,CAAC;AACtD,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAEjC,OAAO,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC;AAK9C,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;AAEjC;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc;IAIlC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;QACxC,OAAO,EAAE,MAAM,OAAO,EAAE;KACzB,CAAC,CAAC;IAEH,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,IAAI,EAAE,OAAO,CAAC,IAAI;KACnB,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW;IAI/B,MAAM,MAAM,GAAG,MAAM,cAAc,EAAE,CAAC;IAEtC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC;IAClC,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,cAAsB;IAMlE,MAAM,UAAU,GAAG,MAAM,cAAc,EAAE,CAAC;IAC1C,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,GAAG,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAC;QACtD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,GAAG,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAEnD,qDAAqD;IACrD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAC;QAC7C,OAAO,EAAE,MAAM,OAAO,EAAE;QACxB,KAAK,EAAE,EAAE,cAAc,EAAE;KAC1B,CAAC,CAAC;IAEH,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,GAAG,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;QACpD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,yBAAyB;IACzB,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,EAAE,IAAI,CAClC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,IAAI,CAAC,EAAE,CAC5C,CAAC;IAEF,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,GAAG,CAAC,KAAK,CAAC,4CAA4C,CAAC,CAAC;QACxD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,IAAI,EAAE,UAAU,CAAC,IAAI;QACrB,SAAS,EAAE;YACT,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,IAAI,EAAE,GAAG,CAAC,IAAI;SACf;QACD,UAAU,EAAE;YACV,EAAE,EAAE,UAAU,CAAC,EAAE;YACjB,IAAI,EAAE,UAAU,CAAC,IAAI;SACtB;KACF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB;IAMvC,MAAM,UAAU,GAAG,MAAM,cAAc,EAAE,CAAC;IAC1C,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,GAAG,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAClD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,GAAG,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;IAEhD,uCAAuC;IACvC,IAAI,SAAS,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAC;QACjD,OAAO,EAAE,MAAM,OAAO,EAAE;KACzB,CAAC,CAAC;IAEH,GAAG,CAAC,KAAK,CAAC,iCAAiC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;IAEtE,+EAA+E;IAC/E,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,GAAG,CAAC,KAAK,CAAC,yDAAyD,CAAC,CAAC;QACrE,MAAM,IAAI,GAAQ,MAAM,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC;YACjD,OAAO,EAAE,MAAM,OAAO,EAAE;SACzB,CAAC,CAAC;QAEH,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,GAAG,CAAC,KAAK,CAAC,uCAAuC,EAAE;gBACjD,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;aAC3B,CAAC,CAAC;YACH,0DAA0D;YAC1D,SAAS,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAC;gBAC7C,OAAO,EAAE,MAAM,OAAO,EAAE;gBACxB,KAAK,EAAE,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE;aACtC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,GAAG,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAC;QACtD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,2CAA2C;IAC3C,MAAM,YAAY,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CACzC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,IAAI,CAAC,EAAE,CAC5C,CAAC;IAEF,GAAG,CAAC,KAAK,CAAC,uCAAuC,EAAE;QACjD,aAAa,EAAE,CAAC,CAAC,YAAY;KAC9B,CAAC,CAAC;IAEH,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,GAAG,CAAC,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAClE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,IAAI,EAAE,UAAU,CAAC,IAAI;QACrB,SAAS,EAAE;YACT,EAAE,EAAE,SAAS,CAAC,EAAE;YAChB,IAAI,EAAE,SAAS,CAAC,IAAI;YACpB,IAAI,EAAE,SAAS,CAAC,IAAI;YACpB,IAAI,EAAE,SAAS,CAAC,IAAI;SACrB;QACD,UAAU,EAAE;YACV,EAAE,EAAE,YAAY,CAAC,EAAE;YACnB,IAAI,EAAE,YAAY,CAAC,IAAI;SACxB;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB;IAMpC,MAAM,OAAO,GAAG,MAAM,mBAAmB,EAAE,CAAC;IAC5C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,YAA6B;IAM7D,MAAM,OAAO,GAAG,MAAM,gBAAgB,EAAE,CAAC;IACzC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB;IAIxC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,MAAM,WAAW,EAAE,CAAC;IAE9C,MAAM,SAAS,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,EAAE,CAAC;SACxD,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;SAClC,MAAM,CAAC,OAAO,CAAC,CAAC;IAEnB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC;IACxC,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,IAAI,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACzD,MAAM,KAAK,GAAG,CAAE,IAAiC,CAAC,IAAI,IAAI,EAAE,CAAC;SAC1D,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACxB,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;IAEpD,IAAI,CAAC,WAAW,IAAI,CAAC,OAAO,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC9C,CAAC;IAED,gEAAgE;IAChE,qEAAqE;IACrE,+DAA+D;IAC/D,IAAI,WAAW,IAAI,CAAC,OAAO,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,mBAAmB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACvE,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,GAAG,CAAC,KAAK,CAAC,8CAA8C,EAAE;gBACxD,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC"}
+{"version":3,"file":"helpers.js","sourceRoot":"","sources":["../src/helpers.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AACxE,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAE,EAAE,EAAE,MAAM,wBAAwB,CAAC;AAC5C,OAAO,EAAE,KAAK,EAAE,MAAM,+BAA+B,CAAC;AACtD,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAEjC,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAC;AAKrE,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;AAEjC;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc;IAIlC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;QACxC,OAAO,EAAE,MAAM,iBAAiB,EAAE;KACnC,CAAC,CAAC;IAEH,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,IAAI,EAAE,OAAO,CAAC,IAAI;KACnB,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW;IAI/B,MAAM,MAAM,GAAG,MAAM,cAAc,EAAE,CAAC;IAEtC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,cAAc,CAAC,iBAAiB,CAAC,CAAC;IAC9C,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,cAAsB;IAMlE,MAAM,UAAU,GAAG,MAAM,cAAc,EAAE,CAAC;IAC1C,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,GAAG,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAC;QACtD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,GAAG,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAEnD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAC;QAC7C,OAAO,EAAE,MAAM,iBAAiB,EAAE;QAClC,KAAK,EAAE,EAAE,cAAc,EAAE;KAC1B,CAAC,CAAC;IAEH,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,GAAG,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;QACpD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,EAAE,IAAI,CAClC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,IAAI,CAAC,EAAE,CAC5C,CAAC;IAEF,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,GAAG,CAAC,KAAK,CAAC,4CAA4C,CAAC,CAAC;QACxD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,IAAI,EAAE,UAAU,CAAC,IAAI;QACrB,SAAS,EAAE;YACT,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,IAAI,EAAE,GAAG,CAAC,IAAI;SACf;QACD,UAAU,EAAE;YACV,EAAE,EAAE,UAAU,CAAC,EAAE;YACjB,IAAI,EAAE,UAAU,CAAC,IAAI;SACtB;KACF,CAAC;AACJ,CAAC;AASD;;;GAGG;AACH,KAAK,UAAU,uBAAuB,CAAC,UAGtC;IACC,MAAM,oBAAoB,GACxB,UAAU,CAAC,OACZ,CAAC,oBAAoB,CAAC;IAEvB,sEAAsE;IACtE,yEAAyE;IACzE,8BAA8B;IAC9B,IAAI,SAAS,GAAG,oBAAoB;QAClC,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG;aACX,mBAAmB,CAAC;YACnB,OAAO,EAAE,MAAM,iBAAiB,EAAE;YAClC,KAAK,EAAE,EAAE,cAAc,EAAE,oBAAoB,EAAE;SAChD,CAAC;aACD,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACxB,GAAG,CAAC,KAAK,CAAC,8CAA8C,EAAE;gBACxD,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC,CAAC;QACN,CAAC,CAAC,IAAI,CAAC;IAET,GAAG,CAAC,KAAK,CAAC,iCAAiC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;IAEtE,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,GAAG,CAAC,KAAK,CAAC,yDAAyD,CAAC,CAAC;QACrE,MAAM,IAAI,GAAQ,MAAM,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC;YACjD,OAAO,EAAE,MAAM,iBAAiB,EAAE;SACnC,CAAC,CAAC;QAEH,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,GAAG,CAAC,KAAK,CAAC,uCAAuC,EAAE;gBACjD,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;aAC3B,CAAC,CAAC;YACH,SAAS,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAC;gBAC7C,OAAO,EAAE,MAAM,iBAAiB,EAAE;gBAClC,KAAK,EAAE,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE;aACtC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,GAAG,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAC;QACtD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,YAAY,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CACzC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,IAAI,CAAC,EAAE,CAC5C,CAAC;IAEF,GAAG,CAAC,KAAK,CAAC,uCAAuC,EAAE;QACjD,aAAa,EAAE,CAAC,CAAC,YAAY;KAC9B,CAAC,CAAC;IAEH,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,GAAG,CAAC,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAClE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,IAAI,EAAE,UAAU,CAAC,IAAI;QACrB,SAAS,EAAE;YACT,EAAE,EAAE,SAAS,CAAC,EAAE;YAChB,IAAI,EAAE,SAAS,CAAC,IAAI;YACpB,IAAI,EAAE,SAAS,CAAC,IAAI;YACpB,IAAI,EAAE,SAAS,CAAC,IAAI;SACrB;QACD,UAAU,EAAE;YACV,EAAE,EAAE,YAAY,CAAC,EAAE;YACnB,IAAI,EAAE,YAAY,CAAC,IAAI;SACxB;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB;IACvC,MAAM,UAAU,GAAG,MAAM,cAAc,EAAE,CAAC;IAC1C,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,GAAG,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAClD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,uBAAuB,CAAC,UAAU,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB;IACpC,MAAM,OAAO,GAAG,MAAM,uBAAuB,CAAC,MAAM,WAAW,EAAE,CAAC,CAAC;IACnE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,cAAc,CAAC,cAAc,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,YAA6B;IAE7B,MAAM,OAAO,GAAG,MAAM,gBAAgB,EAAE,CAAC;IACzC,oEAAoE;IACpE,6DAA6D;IAC7D,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;SACzC,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAoB,CAAC;IAC3C,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,cAAc,CAAC,WAAW,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB;IAIxC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,MAAM,WAAW,EAAE,CAAC;IAE9C,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,qBAAqB,CAC3D,IAIC,CACF,CAAC;IAEF,IAAI,CAAC,WAAW,IAAI,CAAC,OAAO,EAAE,CAAC;QAC7B,MAAM,IAAI,cAAc,CAAC,WAAW,CAAC,CAAC;IACxC,CAAC;IAED,gEAAgE;IAChE,qEAAqE;IACrE,+DAA+D;IAC/D,IAAI,WAAW,IAAI,CAAC,OAAO,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,CAAC,GAAG,KAAK,EAAE,mBAAmB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACvD,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,GAAG,CAAC,KAAK,CAAC,8CAA8C,EAAE;gBACxD,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC"}

package/dist/impersonation.js

@@ -1,31 +1,52 @@
 import "server-only";
 /**
- * Session-level impersonation.
- *
- * This module owns only the session mechanics, because that is what
- * @intelligo-dev/auth owns: it holds the Better-Auth instance and the
- * request headers. The *policy* — who may do it, that it is audited or
- * refused, that a reason is mandatory — lives in @intelligo-dev/admin, and
- * these functions must not be called without going through it.
- *
- * Nothing here re-checks authorization. Splitting the check from the
- * act would give two places that can disagree about who is an admin,
- * which is the mistake that put cross-tenant analytics behind a
- * workspace role.
+ * Impersonation's session mechanics, gated on the platform admin role. The
+ * rest of the policy (an audit event that must be durable first, a mandatory
+ * reason) lives in `@intelligo-dev/admin`; a product calls
+ * `startImpersonation` / `stopImpersonation` there, never these directly.
  */
-import { headers } from "next/headers";
-import { auth } from "./server";
+import { eq } from "drizzle-orm";
+import { db } from "@intelligo-dev/core/db";
+import { users } from "@intelligo-dev/core/db/schema";
+import { getRequestHeaders } from "@intelligo-dev/core/request-context";
+import { AuthGuardError } from "./guard-error.js";
+import { requirePlatformAdmin } from "./helpers.js";
+import { platformAdminStanding } from "./roles.js";
+import { auth } from "./server.js";
 /** Default matching `impersonationSessionDuration` in server.ts. */
 const FALLBACK_DURATION_MS = 30 * 60000;
 /**
  * Swap the caller's session cookie for one belonging to `targetUserId`.
  *
- * Better-Auth refuses if the target is themselves a platform admin.
+ * The caller must be a platform admin and the target must not be one, by
+ * role or by the PLATFORM_ADMIN_EMAILS allowlist: both are checked here,
+ * before Better-Auth's own checks, so no import path reaches the session
+ * swap without them.
+ *
+ * @throws AuthGuardError `unauthenticated` with no session, `forbidden` when
+ *   the caller is not a platform admin or the target is one.
  */
 export async function impersonateUser(targetUserId) {
+    await requirePlatformAdmin();
+    const [target] = await db
+        .select({ email: users.email, role: users.role })
+        .from(users)
+        .where(eq(users.id, targetUserId))
+        .limit(1);
+    if (target) {
+        // Protective here, so the allowlist counts whether or not the
+        // target has verified the address yet.
+        const { allowlisted, hasRole } = platformAdminStanding({
+            ...target,
+            emailVerified: true,
+        });
+        if (allowlisted || hasRole) {
+            throw new AuthGuardError("forbidden", "A platform admin cannot be impersonated");
+        }
+    }
     const result = (await auth.api.impersonateUser({
         body: { userId: targetUserId },
-        headers: await headers(),
+        headers: await getRequestHeaders(),
     }));
     const expiresAt = result.session?.expiresAt;
     return {
@@ -35,8 +56,15 @@ export async function impersonateUser(targetUserId) {
             : new Date(Date.now() + FALLBACK_DURATION_MS),
     };
 }
-/** Restore the admin's own session. */
+/**
+ * Restore the admin's own session.
+ *
+ * Not gated on the platform admin role: while impersonating, the caller's
+ * session is the target's. Better-Auth refuses a session that carries no
+ * `impersonatedBy`, and restores only the admin session its signed cookie
+ * names.
+ */
 export async function stopImpersonating() {
-    await auth.api.stopImpersonating({ headers: await headers() });
+    await auth.api.stopImpersonating({ headers: await getRequestHeaders() });
 }
 //# sourceMappingURL=impersonation.js.map

package/dist/impersonation.js.map

@@ -1 +1 @@
-{"version":3,"file":"impersonation.js","sourceRoot":"","sources":["../src/impersonation.ts"],"names":[],"mappings":"AAAA,OAAO,aAAa,CAAC;AAErB;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEvC,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAQhC,oEAAoE;AACpE,MAAM,oBAAoB,GAAG,EAAE,GAAG,KAAM,CAAC;AAEzC;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,YAAoB;IAEpB,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC;QAC7C,IAAI,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE;QAC9B,OAAO,EAAE,MAAM,OAAO,EAAE;KACzB,CAAC,CAAgD,CAAC;IAEnD,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC;IAE5C,OAAO;QACL,YAAY;QACZ,SAAS,EAAE,SAAS;YAClB,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC;YACrB,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,oBAAoB,CAAC;KAChD,CAAC;AACJ,CAAC;AAED,uCAAuC;AACvC,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,MAAM,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,OAAO,EAAE,MAAM,OAAO,EAAE,EAAE,CAAC,CAAC;AACjE,CAAC"}
+{"version":3,"file":"impersonation.js","sourceRoot":"","sources":["../src/impersonation.ts"],"names":[],"mappings":"AAAA,OAAO,aAAa,CAAC;AAErB;;;;;GAKG;AAEH,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAEjC,OAAO,EAAE,EAAE,EAAE,MAAM,wBAAwB,CAAC;AAC5C,OAAO,EAAE,KAAK,EAAE,MAAM,+BAA+B,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAExE,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAC;AAChD,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAQhC,oEAAoE;AACpE,MAAM,oBAAoB,GAAG,EAAE,GAAG,KAAM,CAAC;AAEzC;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,YAAoB;IAEpB,MAAM,oBAAoB,EAAE,CAAC;IAE7B,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;SACtB,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;SAChD,IAAI,CAAC,KAAK,CAAC;SACX,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;SACjC,KAAK,CAAC,CAAC,CAAC,CAAC;IAEZ,IAAI,MAAM,EAAE,CAAC;QACX,8DAA8D;QAC9D,uCAAuC;QACvC,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,qBAAqB,CAAC;YACrD,GAAG,MAAM;YACT,aAAa,EAAE,IAAI;SACpB,CAAC,CAAC;QACH,IAAI,WAAW,IAAI,OAAO,EAAE,CAAC;YAC3B,MAAM,IAAI,cAAc,CACtB,WAAW,EACX,yCAAyC,CAC1C,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC;QAC7C,IAAI,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE;QAC9B,OAAO,EAAE,MAAM,iBAAiB,EAAE;KACnC,CAAC,CAAgD,CAAC;IAEnD,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC;IAE5C,OAAO;QACL,YAAY;QACZ,SAAS,EAAE,SAAS;YAClB,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC;YACrB,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,oBAAoB,CAAC;KAChD,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,MAAM,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,OAAO,EAAE,MAAM,iBAAiB,EAAE,EAAE,CAAC,CAAC;AAC3E,CAAC"}