@megacorp-ai/auth 0.1.0

package/dist/index.js

@@ -0,0 +1,981 @@
+// src/index.ts
+import express from "express";
+import { betterAuth as betterAuth2 } from "better-auth";
+import { APIError, createAuthMiddleware } from "better-auth/api";
+import { fromNodeHeaders, toNodeHandler } from "better-auth/node";
+import { Pool } from "pg";
+
+// src/config.ts
+import { z } from "zod";
+
+// src/errors.ts
+var AuthConfigError = class extends Error {
+  code = "AUTH_CONFIG_ERROR";
+  constructor(message) {
+    super(message);
+    this.name = "AuthConfigError";
+  }
+};
+var SchemaError = class extends Error {
+  constructor(message, missing) {
+    super(message);
+    this.missing = missing;
+    this.name = "SchemaError";
+  }
+  missing;
+  code = "AUTH_SCHEMA_ERROR";
+};
+var HttpError = class extends Error {
+  constructor(status, code, message) {
+    super(message);
+    this.status = status;
+    this.code = code;
+    this.name = "HttpError";
+  }
+  status;
+  code;
+};
+
+// src/config.ts
+var bool = z.preprocess((v) => typeof v === "string" ? ["1", "true", "yes"].includes(v.toLowerCase()) : v, z.boolean());
+var emailList = z.preprocess(
+  (v) => typeof v === "string" ? v.split(",").map((s) => s.trim().toLowerCase()).filter(Boolean) : v ?? [],
+  z.array(z.email())
+);
+var envSchema = z.object({
+  NODE_ENV: z.enum(["development", "test", "production"]).default("development"),
+  DATABASE_URL: z.string().min(1, "DATABASE_URL is required"),
+  AUTH_SECRET: z.string().min(32, "AUTH_SECRET must be at least 32 characters"),
+  AUTH_BASE_URL: z.url(),
+  AUTH_FROM_EMAIL: z.email().optional(),
+  AUTH_BOOTSTRAP_ADMINS: emailList.default([]),
+  AUTH_EDGE: z.enum(["cloudflare", "none"]).default("none"),
+  AUTH_ALLOW_IMPERSONATION: bool.default(false),
+  AUTH_INVITE_MAX_PER_EMAIL: z.coerce.number().int().positive().default(5),
+  AUTH_LOG_LEVEL: z.enum(["debug", "info", "warn", "error"]).default("info"),
+  ACS_ENDPOINT: z.url().optional(),
+  APPLICATIONINSIGHTS_CONNECTION_STRING: z.string().optional()
+});
+var truthy = (v) => !!v && v !== "0" && v.toLowerCase() !== "false";
+function assertNoVendorTelemetry(env) {
+  if (truthy(env.BETTER_AUTH_TELEMETRY) || env.BETTER_AUTH_TELEMETRY_ENDPOINT) {
+    throw new AuthConfigError(
+      "Refusing to start: BETTER_AUTH_TELEMETRY / BETTER_AUTH_TELEMETRY_ENDPOINT is set. This package disables Better Auth vendor telemetry; unset these variables."
+    );
+  }
+}
+function loadConfig(env = process.env) {
+  const parsed = envSchema.safeParse(env);
+  if (!parsed.success) {
+    const issues = parsed.error.issues.map((i) => `${i.path.join(".") || "env"}: ${i.message}`).join("; ");
+    throw new AuthConfigError(`Invalid auth environment: ${issues}`);
+  }
+  const cfg = parsed.data;
+  if (cfg.NODE_ENV === "production" && !cfg.ACS_ENDPOINT) {
+    throw new AuthConfigError(
+      "Refusing to start: NODE_ENV=production but ACS_ENDPOINT is not set. The console mailer would print OTP codes to stdout. Set ACS_ENDPOINT (and AUTH_FROM_EMAIL) to use Azure Communication Services."
+    );
+  }
+  if (cfg.ACS_ENDPOINT && !cfg.AUTH_FROM_EMAIL) {
+    throw new AuthConfigError("AUTH_FROM_EMAIL is required when ACS_ENDPOINT is set");
+  }
+  assertNoVendorTelemetry(env);
+  return { ...cfg, isProduction: cfg.NODE_ENV === "production" };
+}
+
+// src/ip.ts
+import { isIPv4, isIPv6 } from "net";
+
+// src/cloudflare-ips.ts
+var CLOUDFLARE_IPV4 = [
+  "173.245.48.0/20",
+  "103.21.244.0/22",
+  "103.22.200.0/22",
+  "103.31.4.0/22",
+  "141.101.64.0/18",
+  "108.162.192.0/18",
+  "190.93.240.0/20",
+  "188.114.96.0/20",
+  "197.234.240.0/22",
+  "198.41.128.0/17",
+  "162.158.0.0/15",
+  "104.16.0.0/13",
+  "104.24.0.0/14",
+  "172.64.0.0/13",
+  "131.0.72.0/22"
+];
+var CLOUDFLARE_IPV6 = [
+  "2400:cb00::/32",
+  "2606:4700::/32",
+  "2803:f800::/32",
+  "2405:b500::/32",
+  "2405:8100::/32",
+  "2a06:98c0::/29",
+  "2c0f:f248::/32"
+];
+var CLOUDFLARE_IPS = [...CLOUDFLARE_IPV4, ...CLOUDFLARE_IPV6];
+
+// src/ip.ts
+function ipAddressHeaders(edge) {
+  return edge === "cloudflare" ? ["cf-connecting-ip"] : ["x-forwarded-for"];
+}
+function trustProxySetting(edge) {
+  return edge === "cloudflare" ? [...CLOUDFLARE_IPS] : 1;
+}
+function ipToBigInt(ip) {
+  if (isIPv4(ip)) {
+    return ip.split(".").reduce((acc, o) => (acc << 8n) + BigInt(Number(o)), 0n);
+  }
+  if (isIPv6(ip)) {
+    const clean = ip.replace(/^\[|\]$/g, "").split("%")[0];
+    if (clean.startsWith("::ffff:") && isIPv4(clean.slice(7))) return ipToBigInt(clean.slice(7));
+    const [head, tail = ""] = clean.split("::");
+    const h = head ? head.split(":") : [];
+    const t = tail ? tail.split(":") : [];
+    const parts = [...h, ...Array(8 - h.length - t.length).fill("0"), ...t];
+    return parts.reduce((acc, p) => (acc << 16n) + BigInt(parseInt(p || "0", 16)), 0n);
+  }
+  return null;
+}
+function ipInCidr(ip, cidr) {
+  const [range, bitsStr] = cidr.split("/");
+  const a = ipToBigInt(ip);
+  const r = ipToBigInt(range);
+  if (a === null || r === null) return false;
+  const v4 = isIPv4(range);
+  if (v4 !== isIPv4(ip.startsWith("::ffff:") ? ip.slice(7) : ip)) return false;
+  const total = v4 ? 32 : 128;
+  const bits = bitsStr ? Number(bitsStr) : total;
+  const shift = BigInt(total - bits);
+  return a >> shift === r >> shift;
+}
+function isCloudflareIp(ip) {
+  return CLOUDFLARE_IPS.some((c) => ipInCidr(ip, c));
+}
+function header(req, name) {
+  const v = req.headers[name];
+  return Array.isArray(v) ? v[0] : v;
+}
+function getClientIp(req, edge) {
+  const peer = req.socket?.remoteAddress;
+  if (edge === "cloudflare") {
+    const cf = header(req, "cf-connecting-ip")?.trim();
+    if (cf && peer && isCloudflareIp(peer)) return cf;
+    return peer;
+  }
+  const xff = header(req, "x-forwarded-for");
+  const first = xff?.split(",")[0]?.trim();
+  return first || peer;
+}
+
+// src/invite.ts
+import { z as z2 } from "zod";
+
+// src/roles.ts
+var ROLES = ["megacorp_admin", "customer_admin", "member"];
+var DEFAULT_ROLE = "member";
+var INVITE_MATRIX = {
+  megacorp_admin: ROLES,
+  customer_admin: ["customer_admin", "member"],
+  member: []
+};
+function isRole(v) {
+  return typeof v === "string" && ROLES.includes(v);
+}
+function parseRoles(role) {
+  if (!role) return [];
+  return role.split(",").map((r) => r.trim()).filter(isRole);
+}
+function hasRole(userRole, allowed) {
+  return parseRoles(userRole).some((r) => allowed.includes(r));
+}
+function canInvite(inviterRole, target) {
+  return parseRoles(inviterRole).some((r) => INVITE_MATRIX[r].includes(target));
+}
+
+// src/invite.ts
+var bodySchema = z2.object({ email: z2.email().transform((e) => e.toLowerCase()), role: z2.enum(ROLES) });
+function createInviteCounter(max, windowMs = 24 * 60 * 60 * 1e3) {
+  const sent = /* @__PURE__ */ new Map();
+  return {
+    take(email, now = Date.now()) {
+      const list = (sent.get(email) ?? []).filter((t) => now - t < windowMs);
+      if (list.length >= max) {
+        sent.set(email, list);
+        return false;
+      }
+      list.push(now);
+      sent.set(email, list);
+      return true;
+    }
+  };
+}
+function createInviteHandler(deps) {
+  const counter = createInviteCounter(deps.maxPerEmail);
+  return async (req, res) => {
+    try {
+      const inviter = await deps.getSession(req);
+      if (!inviter) throw new HttpError(401, "UNAUTHENTICATED", "Sign in required");
+      const parsed = bodySchema.safeParse(req.body);
+      if (!parsed.success) throw new HttpError(400, "INVALID_BODY", "Expected { email, role }");
+      const { email, role } = parsed.data;
+      if (!isRole(role) || !canInvite(inviter.user.role, role)) {
+        throw new HttpError(403, "FORBIDDEN", `Role ${inviter.user.role ?? "none"} may not invite ${role}`);
+      }
+      if (!counter.take(email)) throw new HttpError(429, "INVITE_CAP", "Too many invites for this address; try again later");
+      let user = await deps.findUserByEmail(email);
+      if (user?.banned) throw new HttpError(409, "USER_DISABLED", "User is disabled");
+      if (!user) user = { ...await deps.createUser(email, role), role, banned: false };
+      const link = new URL(deps.inviteLinkPath, deps.baseURL);
+      link.searchParams.set("email", email);
+      await deps.mailer.sendInvite({ to: email, link: link.toString(), appName: deps.appName, role, invitedBy: inviter.user.email });
+      deps.onInvite({ inviter, email, role, userId: user.id, req });
+      res.status(200).json({ ok: true, userId: user.id, existing: user.role !== null && user.role !== role ? true : void 0 });
+    } catch (err) {
+      if (err instanceof HttpError) return res.status(err.status).json({ error: err.code, message: err.message });
+      res.status(500).json({ error: "INTERNAL", message: "Invite failed" });
+      throw err;
+    }
+  };
+}
+
+// src/log.ts
+var order = { debug: 10, info: 20, warn: 30, error: 40 };
+function createLogger(base, minLevel = "info") {
+  const emit = (level, msg, fields) => {
+    if (order[level] < order[minLevel]) return;
+    const line = JSON.stringify({ ts: (/* @__PURE__ */ new Date()).toISOString(), level, msg, ...base, ...fields });
+    (level === "error" ? process.stderr : process.stdout).write(line + "\n");
+  };
+  return {
+    debug: (m, f) => emit("debug", m, f),
+    info: (m, f) => emit("info", m, f),
+    warn: (m, f) => emit("warn", m, f),
+    error: (m, f) => emit("error", m, f)
+  };
+}
+
+// src/mailer/console.ts
+function consoleMailer() {
+  return {
+    async sendOtp({ to, otp, appName, expiresInSeconds }) {
+      process.stdout.write(`
+[${appName}] Sign-in code for ${to}: ${otp} (valid ${expiresInSeconds}s)
+
+`);
+    },
+    async sendInvite({ to, link, appName, role }) {
+      process.stdout.write(`
+[${appName}] Invite for ${to} as ${role}: ${link}
+
+`);
+    }
+  };
+}
+
+// src/mailer/acs.ts
+import { EmailClient } from "@azure/communication-email";
+
+// src/azure-credential.ts
+import {
+  ChainedTokenCredential,
+  DefaultAzureCredential,
+  EnvironmentCredential,
+  ManagedIdentityCredential
+} from "@azure/identity";
+function azureCredential(production, { clientId, env = process.env } = {}) {
+  if (clientId) return new ManagedIdentityCredential({ clientId });
+  if (env.AZURE_TOKEN_CREDENTIALS) return new DefaultAzureCredential();
+  if (production) return new ChainedTokenCredential(new EnvironmentCredential(), new ManagedIdentityCredential());
+  return new DefaultAzureCredential();
+}
+
+// src/mailer/acs.ts
+function acsMailer({ endpoint, from, appName, credential, production = false }) {
+  const client = new EmailClient(endpoint, credential ?? azureCredential(production));
+  const send = async (to, subject, plainText, html) => {
+    const poller = await client.beginSend({
+      senderAddress: from,
+      recipients: { to: [{ address: to }] },
+      content: { subject, plainText, html },
+      headers: { "X-Megacorp-App": appName }
+    });
+    const result = await poller.pollUntilDone();
+    if (result.status !== "Succeeded") {
+      throw new Error(`ACS email send failed: ${result.status} ${result.error?.message ?? ""}`.trim());
+    }
+  };
+  return {
+    sendOtp: ({ to, otp, expiresInSeconds }) => send(
+      to,
+      `${appName}: your sign-in code is ${otp}`,
+      `Your ${appName} sign-in code is ${otp}. It expires in ${Math.round(expiresInSeconds / 60)} minutes. If you did not request this, ignore this email.`,
+      `<p>Your <strong>${esc(appName)}</strong> sign-in code is:</p><p style="font-size:28px;letter-spacing:6px"><strong>${otp}</strong></p><p>It expires in ${Math.round(expiresInSeconds / 60)} minutes. If you did not request this, ignore this email.</p>`
+    ),
+    sendInvite: ({ to, link, role }) => send(
+      to,
+      `You have been invited to ${appName}`,
+      `You have been invited to ${appName} as ${role}. Sign in here: ${link}`,
+      `<p>You have been invited to <strong>${esc(appName)}</strong> as <strong>${esc(role)}</strong>.</p><p><a href="${esc(link)}">Sign in</a> with this email address; a one-time code will be sent to you.</p>`
+    )
+  };
+}
+var esc = (s) => s.replace(/[&<>"']/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c]);
+
+// src/options.ts
+import "better-auth";
+import { admin, emailOTP } from "better-auth/plugins";
+
+// src/access.ts
+import { createAccessControl } from "better-auth/plugins/access";
+import { adminAc, defaultStatements, userAc } from "better-auth/plugins/admin/access";
+var ac = createAccessControl(defaultStatements);
+var accessRoles = {
+  megacorp_admin: ac.newRole({ ...adminAc.statements }),
+  customer_admin: ac.newRole({ ...userAc.statements }),
+  member: ac.newRole({ ...userAc.statements })
+};
+
+// src/schema-check.ts
+var TABLES = {
+  user: "auth_user",
+  session: "auth_session",
+  account: "auth_account",
+  verification: "auth_verification",
+  rateLimit: "auth_rate_limit"
+};
+var REQUIRED_COLUMNS = {
+  [TABLES.user]: ["id", "name", "email", "emailVerified", "image", "createdAt", "updatedAt", "role", "banned", "banReason", "banExpires"],
+  [TABLES.session]: ["id", "expiresAt", "token", "createdAt", "updatedAt", "ipAddress", "userAgent", "userId", "impersonatedBy"],
+  [TABLES.account]: ["id", "accountId", "providerId", "userId", "createdAt", "updatedAt"],
+  [TABLES.verification]: ["id", "identifier", "value", "expiresAt", "createdAt", "updatedAt"],
+  [TABLES.rateLimit]: ["id", "key", "count", "lastRequest"]
+};
+async function findMissingSchema(pool) {
+  const { rows } = await pool.query(
+    `select table_name, column_name from information_schema.columns
+     where table_schema = current_schema() and table_name = any($1)`,
+    [Object.keys(REQUIRED_COLUMNS)]
+  );
+  const have = new Set(rows.map((r) => `${r.table_name}.${r.column_name}`));
+  const tables = new Set(rows.map((r) => r.table_name));
+  const missing = [];
+  for (const [table, cols] of Object.entries(REQUIRED_COLUMNS)) {
+    if (!tables.has(table)) {
+      missing.push(table);
+      continue;
+    }
+    for (const c of cols) if (!have.has(`${table}.${c}`)) missing.push(`${table}.${c}`);
+  }
+  return missing;
+}
+async function assertSchema(pool) {
+  const missing = await findMissingSchema(pool);
+  if (missing.length) {
+    throw new SchemaError(`Auth schema is incomplete (missing: ${missing.join(", ")}). Run \`npx megacorp-auth migrate\`.`, missing);
+  }
+}
+
+// src/options.ts
+var OTP_EXPIRES_IN = 300;
+var SESSION_EXPIRES_IN = 60 * 60 * 24;
+var SESSION_UPDATE_AGE = 60 * 60;
+function buildBetterAuthOptions({ appName, config, pool, mailer }) {
+  return {
+    appName,
+    baseURL: config.AUTH_BASE_URL,
+    basePath: "/api/auth",
+    secret: config.AUTH_SECRET,
+    trustedOrigins: [config.AUTH_BASE_URL],
+    database: pool,
+    telemetry: { enabled: false },
+    // vendor usage reporting off; env override is rejected in loadConfig
+    emailAndPassword: { enabled: false },
+    user: {
+      modelName: TABLES.user,
+      changeEmail: { enabled: false },
+      deleteUser: { enabled: false }
+    },
+    session: {
+      modelName: TABLES.session,
+      expiresIn: SESSION_EXPIRES_IN,
+      updateAge: SESSION_UPDATE_AGE
+    },
+    account: { modelName: TABLES.account },
+    verification: { modelName: TABLES.verification },
+    rateLimit: {
+      enabled: true,
+      // all environments, not just production
+      storage: "database",
+      modelName: TABLES.rateLimit,
+      window: 60,
+      max: 60,
+      customRules: {
+        "/email-otp/send-verification-otp": { window: 600, max: 5 },
+        "/sign-in/email-otp": { window: 300, max: 10 },
+        "/get-session": { window: 60, max: 120 }
+      }
+    },
+    advanced: {
+      useSecureCookies: config.isProduction,
+      cookiePrefix: "mc_auth",
+      ipAddress: { ipAddressHeaders: ipAddressHeaders(config.AUTH_EDGE) },
+      database: { generateId: "uuid" }
+    },
+    plugins: [
+      emailOTP({
+        otpLength: 6,
+        expiresIn: OTP_EXPIRES_IN,
+        allowedAttempts: 3,
+        storeOTP: "hashed",
+        disableSignUp: true,
+        // users exist only via bootstrap, invite, or import
+        resendStrategy: "rotate",
+        async sendVerificationOTP({ email, otp, type }) {
+          if (type !== "sign-in") return;
+          await mailer.sendOtp({ to: email, otp, appName, expiresInSeconds: OTP_EXPIRES_IN });
+        }
+      }),
+      admin({
+        defaultRole: DEFAULT_ROLE,
+        ac,
+        roles: accessRoles,
+        adminRoles: ["megacorp_admin"],
+        impersonationSessionDuration: 60 * 60
+      })
+    ]
+  };
+}
+
+// src/telemetry/events.ts
+import { createHash } from "crypto";
+import { z as z3 } from "zod";
+var AUTH_EVENTS = [
+  "auth.boot",
+  "auth.otp.sent",
+  "auth.otp.verified",
+  "auth.otp.failed",
+  "auth.rate_limited",
+  "auth.session.created",
+  "auth.session.revoked",
+  "auth.invite.sent",
+  "auth.user.disabled",
+  "auth.admin.impersonate"
+];
+var authEventSchema = z3.object({
+  ts: z3.iso.datetime(),
+  app: z3.string().min(1),
+  pkgVersion: z3.string().min(1),
+  event: z3.enum(AUTH_EVENTS),
+  outcome: z3.enum(["success", "failure", "denied", "info"]),
+  userIdHash: z3.string().length(64).nullable(),
+  emailDomain: z3.string().nullable(),
+  ip: z3.string().nullable(),
+  ua: z3.string().nullable(),
+  durationMs: z3.number().nonnegative().nullable(),
+  role: z3.string().nullable().optional(),
+  reason: z3.string().nullable().optional(),
+  meta: z3.record(z3.string(), z3.union([z3.string(), z3.number(), z3.boolean(), z3.null()])).optional()
+});
+var hashUserId = (id) => id ? createHash("sha256").update(id).digest("hex") : null;
+var emailDomain = (email) => {
+  const at = email?.lastIndexOf("@") ?? -1;
+  return at > 0 ? email.slice(at + 1).toLowerCase() : null;
+};
+function buildEvent(base, input) {
+  return {
+    ts: (/* @__PURE__ */ new Date()).toISOString(),
+    app: base.app,
+    pkgVersion: base.pkgVersion,
+    event: input.event,
+    outcome: input.outcome ?? "info",
+    userIdHash: input.userIdHash ?? null,
+    emailDomain: input.emailDomain ?? null,
+    ip: input.ip ?? null,
+    ua: input.ua ?? null,
+    durationMs: input.durationMs ?? null,
+    ...input.role !== void 0 && { role: input.role },
+    ...input.reason !== void 0 && { reason: input.reason },
+    ...input.meta && { meta: input.meta }
+  };
+}
+
+// src/telemetry/appinsights.ts
+import { hostname } from "os";
+var DEFAULT_INGESTION = "https://dc.services.visualstudio.com";
+var DEFAULT_SCOPE = "https://monitor.azure.com/.default";
+var UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function parseConnectionString(cs) {
+  const fields = {};
+  for (const pair of cs.split(";")) {
+    if (!pair.trim()) continue;
+    const eq = pair.indexOf("=");
+    if (eq <= 0) throw new Error(`malformed segment "${pair}"`);
+    fields[pair.slice(0, eq).trim().toLowerCase()] = pair.slice(eq + 1).trim();
+  }
+  const instrumentationKey = fields.instrumentationkey;
+  if (!instrumentationKey || !UUID.test(instrumentationKey)) throw new Error("InstrumentationKey is missing or not a GUID");
+  let ingestionEndpoint = fields.ingestionendpoint;
+  if (!ingestionEndpoint && fields.endpointsuffix) ingestionEndpoint = `https://${fields.location ? `${fields.location}.` : ""}dc.${fields.endpointsuffix}`;
+  ingestionEndpoint = (ingestionEndpoint ?? DEFAULT_INGESTION).replace(/^http:\/\//, "https://").replace(/\/+$/, "");
+  let url;
+  try {
+    url = new URL(ingestionEndpoint);
+  } catch {
+    throw new Error(`IngestionEndpoint "${ingestionEndpoint}" is not a URL`);
+  }
+  if (url.protocol !== "https:") throw new Error("IngestionEndpoint must be https");
+  return { instrumentationKey, ingestionEndpoint, ...fields.aadaudience && { aadAudience: fields.aadaudience } };
+}
+var RETRIABLE = /* @__PURE__ */ new Set([206, 401, 403, 408, 429, 439, 500, 502, 503, 504]);
+var isRetriableStatus = (status) => RETRIABLE.has(status);
+function parseRetryAfter(header2, now = Date.now()) {
+  if (!header2) return void 0;
+  const secs = Number(header2);
+  if (Number.isFinite(secs)) return Math.max(0, secs * 1e3);
+  const date = Date.parse(header2);
+  return Number.isNaN(date) ? void 0 : Math.max(0, date - now);
+}
+var AppInsightsExporter = class {
+  constructor(o) {
+    this.o = o;
+    this.url = `${o.target.ingestionEndpoint}/v2.1/track`;
+    this.scope = o.target.aadAudience ?? DEFAULT_SCOPE;
+    this.tags = { "ai.cloud.role": o.app, "ai.cloud.roleInstance": hostname(), "ai.internal.sdkVersion": `node:megacorp-auth:${o.pkgVersion}` };
+    this.opts = {
+      batchSize: o.batchSize ?? 100,
+      flushIntervalMs: o.flushIntervalMs ?? 5e3,
+      maxRetries: o.maxRetries ?? 5,
+      maxQueue: o.maxQueue ?? 1e4,
+      requestTimeoutMs: o.requestTimeoutMs ?? 1e4
+    };
+  }
+  o;
+  queue = [];
+  timer = null;
+  retryAt = 0;
+  flushing = null;
+  token = null;
+  stopped = false;
+  tags;
+  url;
+  scope;
+  opts;
+  get pending() {
+    return this.queue.length;
+  }
+  track(e) {
+    if (this.stopped) return;
+    const { meta, ...rest } = e;
+    const properties = {};
+    for (const [k, v] of Object.entries({ ...rest, ...meta })) properties[k] = v === null || v === void 0 ? "" : String(v);
+    this.queue.push({
+      attempt: 0,
+      envelope: {
+        ver: 1,
+        name: "Microsoft.ApplicationInsights.Event",
+        time: e.ts,
+        sampleRate: 100,
+        iKey: this.o.target.instrumentationKey,
+        tags: this.tags,
+        data: { baseType: "EventData", baseData: { ver: 2, name: e.event, properties } }
+      }
+    });
+    if (this.queue.length > this.opts.maxQueue) {
+      this.queue.splice(0, this.queue.length - this.opts.maxQueue);
+      this.o.log.warn("app insights queue full; dropped oldest events", { maxQueue: this.opts.maxQueue });
+    }
+    if (this.queue.length >= this.opts.batchSize) void this.flush();
+    else this.schedule(this.opts.flushIntervalMs);
+  }
+  /** Send everything queued once. Retriable failures are re-queued for the timer; never throws. */
+  flush() {
+    if (this.flushing) return this.flushing;
+    this.flushing = this.drain().catch((err) => this.o.log.error("app insights flush failed", { error: String(err) })).finally(() => {
+      this.flushing = null;
+    });
+    return this.flushing;
+  }
+  /** Stop the timer and try to deliver what is queued, honoring backoff, within `timeoutMs`. */
+  async shutdown(timeoutMs = 1e4) {
+    this.stopped = true;
+    if (this.timer) {
+      clearTimeout(this.timer);
+      this.timer = null;
+    }
+    const deadline = Date.now() + timeoutMs;
+    while (this.queue.length && Date.now() < deadline) {
+      const wait = Math.min(this.retryAt - Date.now(), deadline - Date.now());
+      if (wait > 0) await new Promise((r) => setTimeout(r, wait));
+      await this.flush();
+    }
+    if (this.queue.length) this.o.log.warn("app insights shutdown: events not delivered", { count: this.queue.length });
+  }
+  schedule(delayMs) {
+    if (this.timer || this.stopped) return;
+    this.timer = setTimeout(() => {
+      this.timer = null;
+      void this.flush();
+    }, delayMs);
+    this.timer.unref();
+  }
+  async drain() {
+    while (this.queue.length) {
+      if (Date.now() < this.retryAt) {
+        this.schedule(this.retryAt - Date.now());
+        return;
+      }
+      const batch = this.queue.splice(0, this.opts.batchSize);
+      const { retry, delayMs } = await this.send(batch);
+      if (retry.length) {
+        const kept = retry.filter((q) => ++q.attempt <= this.opts.maxRetries);
+        if (kept.length < retry.length) this.o.log.error("app insights: dropped events after max retries", { dropped: retry.length - kept.length });
+        this.queue.unshift(...kept);
+        this.retryAt = Date.now() + (delayMs ?? Math.min(3e4, 1e3 * 2 ** Math.min(batch[0].attempt, 5)));
+        this.schedule(this.retryAt - Date.now());
+        return;
+      }
+    }
+  }
+  /** One request. Returns envelopes that should be retried, and an optional server-dictated delay. */
+  async send(batch) {
+    const headers = { "content-type": "application/json", accept: "application/json" };
+    if (this.o.credential) {
+      const token = await this.getToken();
+      if (!token) return { retry: batch, delayMs: 5e3 };
+      headers.authorization = `Bearer ${token}`;
+    }
+    let res;
+    try {
+      res = await (this.o.fetch ?? globalThis.fetch)(this.url, {
+        method: "POST",
+        headers,
+        body: JSON.stringify(batch.map((q) => q.envelope)),
+        signal: AbortSignal.timeout(this.opts.requestTimeoutMs)
+      });
+    } catch (err) {
+      this.o.log.warn("app insights request failed", { error: String(err) });
+      return { retry: batch };
+    }
+    const delayMs = parseRetryAfter(res.headers.get("retry-after"));
+    if (res.status === 200) return { retry: [] };
+    if (res.status === 206) {
+      const body = await res.json().catch(() => ({}));
+      const retry = [];
+      for (const e of body.errors ?? []) {
+        const q = batch[e.index];
+        if (!q) continue;
+        if (isRetriableStatus(e.statusCode)) retry.push(q);
+        else this.o.log.error("app insights rejected event", { status: e.statusCode, message: e.message ?? "" });
+      }
+      return { retry, delayMs };
+    }
+    if (res.status === 401 || res.status === 403) {
+      this.token = null;
+      if (!this.o.credential) {
+        this.o.log.error("app insights rejected instrumentation key auth; enable Entra auth (Authorization=AAD)", { status: res.status });
+        return { retry: [] };
+      }
+      this.o.log.warn("app insights auth rejected; refreshing token", { status: res.status });
+      return { retry: batch, delayMs: delayMs ?? 2e3 };
+    }
+    if (isRetriableStatus(res.status)) {
+      this.o.log.warn("app insights throttled or unavailable", { status: res.status, retryAfterMs: delayMs ?? null });
+      return { retry: batch, delayMs };
+    }
+    this.o.log.error("app insights rejected batch", { status: res.status, body: (await res.text().catch(() => "")).slice(0, 500) });
+    return { retry: [] };
+  }
+  async getToken() {
+    if (this.token && this.token.expiresAt - 12e4 > Date.now()) return this.token.value;
+    try {
+      const t = await this.o.credential.getToken(this.scope);
+      if (!t) return null;
+      this.token = { value: t.token, expiresAt: t.expiresOnTimestamp };
+      return t.token;
+    } catch (err) {
+      this.o.log.warn("app insights token acquisition failed", { error: String(err) });
+      return null;
+    }
+  }
+};
+
+// src/telemetry/sink.ts
+function parseAuthenticationString(value) {
+  if (!value) return null;
+  const fields = {};
+  for (const pair of value.split(";")) {
+    const [k, v] = pair.split("=");
+    if (k && v) fields[k.trim().toLowerCase()] = v.trim();
+  }
+  if (fields.authorization?.toLowerCase() !== "aad") return null;
+  return fields.clientid ? { clientId: fields.clientid } : {};
+}
+function stdoutSink() {
+  return {
+    emit: (e) => process.stdout.write(JSON.stringify({ type: "auth_event", ...e }) + "\n"),
+    flush: async () => {
+    },
+    shutdown: async () => {
+    }
+  };
+}
+function createSink(o) {
+  if (!o.connectionString) return stdoutSink();
+  let target;
+  try {
+    target = parseConnectionString(o.connectionString);
+  } catch (err) {
+    throw new AuthConfigError(`APPLICATIONINSIGHTS_CONNECTION_STRING is invalid: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  const env = o.env ?? process.env;
+  const aad = parseAuthenticationString(env.APPLICATIONINSIGHTS_AUTHENTICATION_STRING);
+  const credential = o.credential ?? (aad ? azureCredential(o.production, { clientId: aad.clientId, env }) : void 0);
+  const exporter = new AppInsightsExporter({ target, app: o.app, pkgVersion: o.pkgVersion, log: o.log, credential });
+  o.log.info("telemetry sink: application insights", { endpoint: target.ingestionEndpoint, auth: credential ? "entra" : "ikey" });
+  return { emit: (e) => exporter.track(e), flush: () => exporter.flush(), shutdown: (t) => exporter.shutdown(t) };
+}
+
+// src/version.ts
+import { createRequire } from "module";
+var require2 = createRequire(import.meta.url);
+var PKG_VERSION = require2("../package.json").version;
+
+// src/index.ts
+import { fromNodeHeaders as fromNodeHeaders2 } from "better-auth/node";
+function createAuthInstance({ appName, config, pool, mailer, emit }) {
+  const webMeta = (ctx) => {
+    const ipHeader = config.AUTH_EDGE === "cloudflare" ? "cf-connecting-ip" : "x-forwarded-for";
+    return { ip: ctx.headers?.get(ipHeader)?.split(",")[0]?.trim() ?? null, ua: ctx.headers?.get("user-agent") ?? null };
+  };
+  const str = (v) => typeof v === "string" ? v : null;
+  return betterAuth2({
+    ...buildBetterAuthOptions({ appName, config, pool, mailer }),
+    hooks: {
+      before: createAuthMiddleware(async (ctx) => {
+        if (ctx.path === "/admin/impersonate-user" && !config.AUTH_ALLOW_IMPERSONATION) {
+          emit({ event: "auth.admin.impersonate", outcome: "denied", reason: "AUTH_ALLOW_IMPERSONATION is not true", ...webMeta(ctx) });
+          throw new APIError("FORBIDDEN", { message: "Impersonation is disabled for this app" });
+        }
+      }),
+      after: createAuthMiddleware(async (ctx) => {
+        const returned = ctx.context.returned;
+        const failed = returned instanceof APIError;
+        const reason = failed ? returned.message : null;
+        const meta = webMeta(ctx);
+        const body = ctx.body ?? {};
+        const email = str(body.email);
+        const actor = () => hashUserId(ctx.context.session?.user.id);
+        switch (ctx.path) {
+          case "/email-otp/send-verification-otp": {
+            const known = !failed && email ? Boolean(await ctx.context.internalAdapter.findUserByEmail(email)) : true;
+            emit({
+              event: "auth.otp.sent",
+              outcome: failed ? "failure" : known ? "success" : "denied",
+              emailDomain: emailDomain(email),
+              reason: failed ? reason : known ? null : "unknown_email",
+              ...meta
+            });
+            break;
+          }
+          case "/sign-in/email-otp":
+            emit({
+              event: failed ? "auth.otp.failed" : "auth.otp.verified",
+              outcome: failed ? "failure" : "success",
+              emailDomain: emailDomain(email),
+              userIdHash: hashUserId(ctx.context.newSession?.user.id),
+              reason,
+              ...meta
+            });
+            break;
+          case "/sign-out":
+          case "/revoke-session":
+          case "/revoke-sessions":
+          case "/admin/revoke-user-session":
+          case "/admin/revoke-user-sessions":
+            if (!failed) emit({ event: "auth.session.revoked", outcome: "success", reason: ctx.path, userIdHash: hashUserId(str(body.userId) ?? ctx.context.session?.user.id), ...meta });
+            break;
+          case "/admin/ban-user":
+            if (!failed) emit({ event: "auth.user.disabled", outcome: "success", userIdHash: hashUserId(str(body.userId)), reason: str(body.banReason), meta: { actorUserIdHash: actor() ?? "" }, ...meta });
+            break;
+          case "/admin/impersonate-user":
+            emit({ event: "auth.admin.impersonate", outcome: failed ? "failure" : "success", userIdHash: hashUserId(str(body.userId)), reason, meta: { actorUserIdHash: actor() ?? "" }, ...meta });
+            break;
+        }
+      })
+    },
+    databaseHooks: {
+      session: {
+        create: {
+          after: async (session) => {
+            const impersonated = Boolean(session.impersonatedBy);
+            emit({ event: "auth.session.created", outcome: "success", userIdHash: hashUserId(session.userId), ip: session.ipAddress ?? null, ua: session.userAgent ?? null, meta: { impersonated } });
+          }
+        }
+      }
+    }
+  });
+}
+function createMegacorpAuth(opts) {
+  let config;
+  try {
+    config = loadConfig(opts.env ?? process.env);
+  } catch (err) {
+    if (err instanceof AuthConfigError) {
+      process.stderr.write(JSON.stringify({ level: "error", msg: err.message, code: err.code }) + "\n");
+      process.exit(1);
+    }
+    throw err;
+  }
+  const log = createLogger({ app: opts.appName, component: "auth" }, config.AUTH_LOG_LEVEL);
+  const mailer = opts.mailer ?? (config.ACS_ENDPOINT ? acsMailer({ endpoint: config.ACS_ENDPOINT, from: config.AUTH_FROM_EMAIL, appName: opts.appName, production: config.isProduction }) : consoleMailer());
+  const pool = opts.pool ?? new Pool({ connectionString: config.DATABASE_URL });
+  const base = { app: opts.appName, pkgVersion: PKG_VERSION };
+  let sink;
+  try {
+    sink = createSink({ connectionString: config.APPLICATIONINSIGHTS_CONNECTION_STRING, app: opts.appName, pkgVersion: PKG_VERSION, production: config.isProduction, log, credential: opts.telemetryCredential, env: opts.env ?? process.env });
+  } catch (err) {
+    if (!(err instanceof AuthConfigError)) throw err;
+    if (config.isProduction) {
+      process.stderr.write(JSON.stringify({ level: "error", msg: err.message, code: err.code }) + "\n");
+      process.exit(1);
+    }
+    log.warn(`${err.message}; falling back to stdout events`);
+    sink = stdoutSink();
+  }
+  const emit = (input) => {
+    const e = buildEvent(base, input);
+    opts.onEvent?.(e);
+    sink.emit(e);
+  };
+  process.once("beforeExit", () => {
+    void sink.shutdown();
+  });
+  const auth = createAuthInstance({ appName: opts.appName, config, pool, mailer, emit });
+  const adapter = async () => (await auth.$context).internalAdapter;
+  const newUser = (email, role) => ({ email, name: email.split("@")[0], emailVerified: true, role });
+  const getSession = async (req) => {
+    const s = await auth.api.getSession({ headers: fromNodeHeaders(req.headers) });
+    if (!s) return null;
+    const u = s.user;
+    if (u.banned) return null;
+    return {
+      user: { id: u.id, email: u.email, name: u.name, role: u.role ?? null, banned: u.banned ?? null },
+      session: { id: s.session.id, expiresAt: s.session.expiresAt, impersonatedBy: s.session.impersonatedBy ?? null }
+    };
+  };
+  const ready = (async () => {
+    const started = Date.now();
+    const missing = await findMissingSchema(pool);
+    if (missing.length) {
+      const msg = `Auth schema is incomplete (missing: ${missing.join(", ")}). Run \`npx megacorp-auth migrate\`.`;
+      if (config.isProduction) {
+        log.error(msg, { missing });
+        emit({ event: "auth.boot", outcome: "failure", reason: "schema_missing" });
+        await sink.shutdown();
+        process.exit(1);
+      }
+      log.warn(msg, { missing });
+      return;
+    }
+    const ia = await adapter();
+    for (const email of config.AUTH_BOOTSTRAP_ADMINS) {
+      const existing = await ia.findUserByEmail(email);
+      if (!existing) {
+        await ia.createUser(newUser(email, "megacorp_admin"), { method: "admin" });
+        log.info("bootstrap admin created", { emailDomain: emailDomain(email) });
+      } else if (existing.user.role !== "megacorp_admin") {
+        await ia.updateUser(existing.user.id, { role: "megacorp_admin" });
+        log.info("bootstrap admin role set", { emailDomain: emailDomain(email) });
+      }
+    }
+    emit({ event: "auth.boot", outcome: "success", durationMs: Date.now() - started, meta: { edge: config.AUTH_EDGE, mailer: config.ACS_ENDPOINT ? "acs" : "console", impersonation: config.AUTH_ALLOW_IMPERSONATION } });
+  })();
+  ready.catch((err) => log.error("auth startup failed", { error: String(err) }));
+  const requireSession = () => async (req, res, next) => {
+    try {
+      const s = await getSession(req);
+      if (!s) return res.status(401).json({ error: "UNAUTHENTICATED", message: "Sign in required" });
+      req.auth = s;
+      next();
+    } catch (err) {
+      next(err);
+    }
+  };
+  const requireRole = (...roles) => {
+    const sessionMw = requireSession();
+    return (req, res, next) => sessionMw(req, res, (err) => {
+      if (err) return next(err);
+      if (!hasRole(req.auth?.user.role, roles)) return res.status(403).json({ error: "FORBIDDEN", message: `Requires role: ${roles.join(" or ")}` });
+      next();
+    });
+  };
+  const inviteHandler = createInviteHandler({
+    appName: opts.appName,
+    baseURL: config.AUTH_BASE_URL,
+    inviteLinkPath: opts.inviteLinkPath ?? "/",
+    maxPerEmail: config.AUTH_INVITE_MAX_PER_EMAIL,
+    mailer,
+    getSession,
+    findUserByEmail: async (email) => {
+      const r = await (await adapter()).findUserByEmail(email);
+      if (!r) return null;
+      const u = r.user;
+      return { id: u.id, role: u.role ?? null, banned: u.banned ?? null };
+    },
+    createUser: async (email, role) => ({ id: (await (await adapter()).createUser(newUser(email, role), { method: "admin" })).id }),
+    onInvite: ({ inviter, email, role, userId, req }) => emit({ event: "auth.invite.sent", outcome: "success", userIdHash: hashUserId(userId), emailDomain: emailDomain(email), role, meta: { inviterUserIdHash: hashUserId(inviter.user.id) ?? "" }, ip: getClientIp(req, config.AUTH_EDGE) ?? null, ua: req.headers["user-agent"] ?? null })
+  });
+  const mount = (app) => {
+    app.set("trust proxy", trustProxySetting(config.AUTH_EDGE));
+    const gate = (_req, _res, next) => {
+      ready.then(() => next(), next);
+    };
+    app.post("/api/auth/invite", gate, express.json({ limit: "10kb" }), inviteHandler);
+    const handler = toNodeHandler(auth);
+    app.all("/api/auth/*splat", gate, (req, res) => {
+      res.once("finish", () => {
+        if (res.statusCode === 429) emit({ event: "auth.rate_limited", outcome: "denied", reason: req.path.replace(/^\/api\/auth/, ""), ip: getClientIp(req, config.AUTH_EDGE) ?? null, ua: req.headers["user-agent"] ?? null });
+      });
+      void handler(req, res);
+    });
+  };
+  return { auth, config, pool, ready, mount, requireSession, requireRole, getSession, events: { emit, flush: () => sink.flush(), shutdown: (t) => sink.shutdown(t) } };
+}
+export {
+  AUTH_EVENTS,
+  AppInsightsExporter,
+  AuthConfigError,
+  DEFAULT_ROLE,
+  HttpError,
+  REQUIRED_COLUMNS,
+  ROLES,
+  SchemaError,
+  TABLES,
+  acsMailer,
+  assertNoVendorTelemetry,
+  assertSchema,
+  authEventSchema,
+  azureCredential,
+  buildBetterAuthOptions,
+  buildEvent,
+  canInvite,
+  consoleMailer,
+  createMegacorpAuth,
+  emailDomain,
+  envSchema,
+  findMissingSchema,
+  fromNodeHeaders2 as fromNodeHeaders,
+  getClientIp,
+  hasRole,
+  hashUserId,
+  ipAddressHeaders,
+  ipInCidr,
+  isCloudflareIp,
+  isRole,
+  loadConfig,
+  parseConnectionString,
+  parseRoles,
+  trustProxySetting
+};
+//# sourceMappingURL=index.js.map