@murumets-ee/auth 0.1.4 → 0.2.0

package/dist/admin/{index.d.ts → index.d.mts}

@@ -1,3 +1,4 @@
+//#region src/admin/routes.d.ts
 /**
  * Permission management admin routes for the centralized admin API handler.
  *
@@ -25,38 +26,38 @@
  */
 /** Fire-and-forget audit log function — structurally matches AuditLogFn from @murumets-ee/core */
 type AuditLogFn = (entry: {
-    action: string;
-    entityType?: string;
-    entityId?: string;
-    userId?: string;
-    userName?: string;
-    changes?: Record<string, unknown>;
-    metadata?: Record<string, unknown>;
+  action: string;
+  entityType?: string;
+  entityId?: string;
+  userId?: string;
+  userName?: string;
+  changes?: Record<string, unknown>;
+  metadata?: Record<string, unknown>;
 }) => void;
 interface AdminRoute {
-    prefix: string;
-    resource?: string;
-    actions?: readonly string[];
-    handlers: Partial<Record<string, (req: Request, ctx: {
-        segments: string[];
-        user: {
-            id: string;
-            role?: string;
-            name?: string;
-        };
-        audit?: AuditLogFn;
-        checkPermission: (resource: string, action: string) => boolean;
-    }) => Promise<Response>>>;
+  prefix: string;
+  resource?: string;
+  actions?: readonly string[];
+  handlers: Partial<Record<string, (req: Request, ctx: {
+    segments: string[];
+    user: {
+      id: string;
+      role?: string;
+      name?: string;
+    };
+    audit?: AuditLogFn;
+    checkPermission: (resource: string, action: string) => boolean;
+  }) => Promise<Response>>>;
 }
 interface PermissionRoutesConfig {
-    /** Returns the resource catalog: resource → available actions */
-    getStatements: () => Record<string, readonly string[]>;
-    /** Load saved role definitions from settings (null if first run) */
-    loadRoles: () => Promise<Record<string, Record<string, string[]>> | null>;
-    /** Save role definitions to settings */
-    saveRoles: (roles: Record<string, Record<string, string[]>>) => Promise<void>;
-    /** Called after save to invalidate cached permission checker */
-    onSave?: () => void;
+  /** Returns the resource catalog: resource → available actions */
+  getStatements: () => Record<string, readonly string[]>;
+  /** Load saved role definitions from settings (null if first run) */
+  loadRoles: () => Promise<Record<string, Record<string, string[]>> | null>;
+  /** Save role definitions to settings */
+  saveRoles: (roles: Record<string, Record<string, string[]>>) => Promise<void>;
+  /** Called after save to invalidate cached permission checker */
+  onSave?: () => void;
 }
 /**
  * Create admin API routes for permission management.
@@ -68,5 +69,6 @@ interface PermissionRoutesConfig {
  * - `DELETE /permissions/roles/:name`  — Delete a custom role
  */
 declare function permissionRoutes(config: PermissionRoutesConfig): AdminRoute;
-
+//#endregion
 export { permissionRoutes };
+//# sourceMappingURL=index.d.mts.map

package/dist/admin/index.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.mts","names":[],"sources":["../../src/admin/routes.ts"],"mappings":";;;;;;;;;;;;;;;;;;AA0CC;;;;;;;;;KARI,UAAA,IAAc,KAAA;EACjB,MAAA;EACA,UAAA;EACA,QAAA;EACA,MAAA;EACA,QAAA;EACA,OAAA,GAAU,MAAA;EACV,QAAA,GAAW,MAAA;AAAA;AAAA,UAGH,UAAA;EACR,MAAA;EACA,QAAA;EACA,OAAA;EACA,QAAA,EAAU,OAAA,CACR,MAAA,UAGI,GAAA,EAAK,OAAA,EACL,GAAA;IACE,QAAA;IACA,IAAA;MAAQ,EAAA;MAAY,IAAA;MAAe,IAAA;IAAA;IACnC,KAAA,GAAQ,UAAA;IACR,eAAA,GAAkB,QAAA,UAAkB,MAAA;EAAA,MAEnC,OAAA,CAAQ,QAAA;AAAA;AAAA,UA8BF,sBAAA;EAAA;EAEf,aAAA,QAAqB,MAAA;;EAErB,SAAA,QAAiB,OAAA,CAAQ,MAAA,SAAe,MAAA;EAAA;EAExC,SAAA,GAAY,KAAA,EAAO,MAAA,SAAe,MAAA,wBAA8B,OAAA;EAF/C;EAIjB,MAAA;AAAA;;;;;;;;;;iBAYc,gBAAA,CAAiB,MAAA,EAAQ,sBAAA,GAAyB,UAAA"}

package/dist/admin/index.mjs

@@ -0,0 +1,2 @@
+import{r as e}from"../permissions-DREmJByu.mjs";const t=/^[a-z][a-z0-9-]{0,49}$/;function n(e,t=200){return new Response(JSON.stringify(e),{status:t,headers:{"Content-Type":`application/json`}})}function r(e,t){return n({error:e},t)}function i(i){let{getStatements:a,loadRoles:o,saveRoles:s,onSave:c}=i;return{prefix:`permissions`,resource:`permissions`,actions:[`view`,`create`,`update`,`delete`],handlers:{GET:async(t,{segments:r})=>{let i=a(),s=await o()??{};return r.length===1&&r[0]===`roles`?n({roles:Object.keys(s),builtInRoles:[...e]}):n({statements:i,roles:s,builtInRoles:[...e]})},PATCH:async(e,{user:t,audit:i})=>{let{roles:l}=await e.json();if(!l||typeof l!=`object`)return r(`Body must contain "roles" object`,400);if(`admin`in l)return r(`Cannot modify admin role permissions (admin always has full access)`,400);if(t.role&&t.role!==`admin`&&t.role in l)return r(`Cannot modify permissions for your own role`,403);let u=await o()??{};for(let e of Object.keys(l))if(!(e in u))return r(`Role '${e}' does not exist. Create it first via POST /permissions/roles`,400);let d=a();for(let[e,t]of Object.entries(l)){if(typeof e!=`string`||!e)return r(`Role names must be non-empty strings`,400);if(typeof t!=`object`||!t||Array.isArray(t))return r(`Permissions for role '${e}' must be an object`,400);for(let[n,i]of Object.entries(t)){if(!Array.isArray(i)||!i.every(e=>typeof e==`string`))return r(`Actions for '${n}' in role '${e}' must be a string array`,400);let t=d[n];if(!t)return r(`Unknown resource: ${n}`,400);for(let e of i)if(!t.includes(e))return r(`Invalid action '${e}' for resource '${n}'. Valid: ${t.join(`, `)}`,400)}}let f={...u};for(let[e,t]of Object.entries(l))f[e]=t;return await s(f),c?.(),i?.({action:`permissions.update`,entityType:`permissions`,userId:t.id,userName:t.name,changes:{roles:l},metadata:{rolesModified:Object.keys(l)}}),n({ok:!0})},POST:async(i,{segments:a,user:l,audit:u})=>{if(a.length!==1||a[0]!==`roles`)return r(`POST only supported at /permissions/roles`,400);let{name:d}=await i.json();if(!d||typeof d!=`string`)return r(`Body must contain "name" string`,400);if(!t.test(d))return r(`Role name must be lowercase alphanumeric with hyphens, start with a letter, max 50 chars`,400);if(e.includes(d))return r(`Cannot create role with built-in name: ${d}`,400);let f=await o()??{};return d in f?r(`Role already exists: ${d}`,409):(f[d]={},await s(f),c?.(),u?.({action:`permissions.role.create`,entityType:`permissions`,userId:l.id,userName:l.name,changes:{roleName:d}}),n({name:d,permissions:{}},201))},DELETE:async(t,{segments:i,user:a,audit:l})=>{if(i.length!==2||i[0]!==`roles`)return r(`DELETE only supported at /permissions/roles/:name`,400);let u=i[1];if(e.includes(u))return r(`Cannot delete built-in role: ${u}`,400);let d=await o()??{};if(!(u in d))return r(`Role not found: ${u}`,404);let f=d[u];return delete d[u],await s(d),c?.(),l?.({action:`permissions.role.delete`,entityType:`permissions`,userId:a.id,userName:a.name,changes:{roleName:u,permissions:f}}),n({deleted:u})}}}}export{i as permissionRoutes};
+//# sourceMappingURL=index.mjs.map

package/dist/admin/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":[],"sources":["../../src/admin/routes.ts"],"sourcesContent":["/**\n * Permission management admin routes for the centralized admin API handler.\n *\n * Provides CRUD for role definitions and permission assignments.\n * Admin-only by default (resource: 'permissions', only admin has access).\n *\n * @example\n * ```typescript\n * import { createAdminApiHandler } from '@murumets-ee/admin-ui/server'\n * import { permissionRoutes } from '@murumets-ee/auth/admin'\n *\n * const handler = createAdminApiHandler({\n *   authenticate: async (req) => { ... },\n *   entities: [...],\n *   routes: [\n *     permissionRoutes({\n *       getStatements: () => catalog,\n *       loadRoles: () => client.get('roles'),\n *       saveRoles: (roles) => client.set('roles', roles),\n *       onSave: () => { cachedChecker = null },\n *     }),\n *   ],\n * })\n * ```\n */\n\nimport { BUILT_IN_ROLES } from '../permissions.js'\n\n// ---------------------------------------------------------------------------\n// Local route type — avoids circular build dep: auth → admin-ui → core → auth.\n// Structurally compatible with AdminRoute from @murumets-ee/core.\n// ---------------------------------------------------------------------------\n\n/** Fire-and-forget audit log function — structurally matches AuditLogFn from @murumets-ee/core */\ntype AuditLogFn = (entry: {\n  action: string\n  entityType?: string\n  entityId?: string\n  userId?: string\n  userName?: string\n  changes?: Record<string, unknown>\n  metadata?: Record<string, unknown>\n}) => void\n\ninterface AdminRoute {\n  prefix: string\n  resource?: string\n  actions?: readonly string[]\n  handlers: Partial<\n    Record<\n      string,\n      (\n        req: Request,\n        ctx: {\n          segments: string[]\n          user: { id: string; role?: string; name?: string }\n          audit?: AuditLogFn\n          checkPermission: (resource: string, action: string) => boolean\n        },\n      ) => Promise<Response>\n    >\n  >\n}\n\n// ---------------------------------------------------------------------------\n// Validation\n// ---------------------------------------------------------------------------\n\nconst ROLE_NAME_REGEX = /^[a-z][a-z0-9-]{0,49}$/\n\n// ---------------------------------------------------------------------------\n// Response helpers\n// ---------------------------------------------------------------------------\n\nfunction json(data: unknown, status = 200): Response {\n  return new Response(JSON.stringify(data), {\n    status,\n    headers: { 'Content-Type': 'application/json' },\n  })\n}\n\nfunction errorJson(message: string, status: number): Response {\n  return json({ error: message }, status)\n}\n\n// ---------------------------------------------------------------------------\n// Route factory\n// ---------------------------------------------------------------------------\n\nexport interface PermissionRoutesConfig {\n  /** Returns the resource catalog: resource → available actions */\n  getStatements: () => Record<string, readonly string[]>\n  /** Load saved role definitions from settings (null if first run) */\n  loadRoles: () => Promise<Record<string, Record<string, string[]>> | null>\n  /** Save role definitions to settings */\n  saveRoles: (roles: Record<string, Record<string, string[]>>) => Promise<void>\n  /** Called after save to invalidate cached permission checker */\n  onSave?: () => void\n}\n\n/**\n * Create admin API routes for permission management.\n *\n * Routes (all prefixed with `/api/admin/permissions`):\n * - `GET    /permissions`              — Get statements + roles + builtInRoles\n * - `PATCH  /permissions`              — Update role permissions\n * - `POST   /permissions/roles`        — Create a custom role\n * - `DELETE /permissions/roles/:name`  — Delete a custom role\n */\nexport function permissionRoutes(config: PermissionRoutesConfig): AdminRoute {\n  const { getStatements, loadRoles, saveRoles, onSave } = config\n\n  return {\n    prefix: 'permissions',\n    resource: 'permissions',\n    actions: ['view', 'create', 'update', 'delete'],\n    handlers: {\n      // GET /permissions — full permission data for the editor\n      GET: async (_req, { segments }) => {\n        const statements = getStatements()\n        const roles = (await loadRoles()) ?? {}\n\n        // GET /permissions/roles — just role names\n        if (segments.length === 1 && segments[0] === 'roles') {\n          return json({\n            roles: Object.keys(roles),\n            builtInRoles: [...BUILT_IN_ROLES],\n          })\n        }\n\n        return json({\n          statements,\n          roles,\n          builtInRoles: [...BUILT_IN_ROLES],\n        })\n      },\n\n      // PATCH /permissions — update role permissions\n      PATCH: async (req, { user, audit }) => {\n        const body = await req.json()\n        const { roles } = body as { roles?: Record<string, Record<string, string[]>> }\n\n        if (!roles || typeof roles !== 'object') {\n          return errorJson('Body must contain \"roles\" object', 400)\n        }\n\n        // Validate: admin cannot be modified\n        if ('admin' in roles) {\n          return errorJson(\n            'Cannot modify admin role permissions (admin always has full access)',\n            400,\n          )\n        }\n\n        // Prevent self-escalation: non-admin users cannot modify their own role\n        if (user.role && user.role !== 'admin' && user.role in roles) {\n          return errorJson('Cannot modify permissions for your own role', 403)\n        }\n\n        // Validate: only existing roles can be modified (use POST /roles to create)\n        const existing = (await loadRoles()) ?? {}\n        for (const roleName of Object.keys(roles)) {\n          if (!(roleName in existing)) {\n            return errorJson(\n              `Role '${roleName}' does not exist. Create it first via POST /permissions/roles`,\n              400,\n            )\n          }\n        }\n\n        // Validate: actions must be in statements\n        const statements = getStatements()\n        for (const [roleName, resources] of Object.entries(roles)) {\n          if (typeof roleName !== 'string' || !roleName) {\n            return errorJson('Role names must be non-empty strings', 400)\n          }\n          if (typeof resources !== 'object' || resources === null || Array.isArray(resources)) {\n            return errorJson(`Permissions for role '${roleName}' must be an object`, 400)\n          }\n          for (const [resource, actions] of Object.entries(resources)) {\n            if (!Array.isArray(actions) || !actions.every((a) => typeof a === 'string')) {\n              return errorJson(\n                `Actions for '${resource}' in role '${roleName}' must be a string array`,\n                400,\n              )\n            }\n            const validActions = statements[resource]\n            if (!validActions) {\n              return errorJson(`Unknown resource: ${resource}`, 400)\n            }\n            for (const action of actions) {\n              if (!validActions.includes(action)) {\n                return errorJson(\n                  `Invalid action '${action}' for resource '${resource}'. Valid: ${validActions.join(', ')}`,\n                  400,\n                )\n              }\n            }\n          }\n        }\n\n        // Merge into existing roles (don't drop roles not in the payload)\n        const merged = { ...existing }\n        for (const [roleName, resources] of Object.entries(roles)) {\n          merged[roleName] = resources\n        }\n\n        await saveRoles(merged)\n        onSave?.()\n\n        audit?.({\n          action: 'permissions.update',\n          entityType: 'permissions',\n          userId: user.id,\n          userName: user.name,\n          changes: { roles },\n          metadata: { rolesModified: Object.keys(roles) },\n        })\n\n        return json({ ok: true })\n      },\n\n      // POST /permissions/roles — create a new custom role\n      POST: async (req, { segments, user, audit }) => {\n        if (segments.length !== 1 || segments[0] !== 'roles') {\n          return errorJson('POST only supported at /permissions/roles', 400)\n        }\n\n        const body = await req.json()\n        const { name } = body as { name?: string }\n\n        if (!name || typeof name !== 'string') {\n          return errorJson('Body must contain \"name\" string', 400)\n        }\n\n        if (!ROLE_NAME_REGEX.test(name)) {\n          return errorJson(\n            'Role name must be lowercase alphanumeric with hyphens, start with a letter, max 50 chars',\n            400,\n          )\n        }\n\n        if ((BUILT_IN_ROLES as readonly string[]).includes(name)) {\n          return errorJson(`Cannot create role with built-in name: ${name}`, 400)\n        }\n\n        const existing = (await loadRoles()) ?? {}\n\n        if (name in existing) {\n          return errorJson(`Role already exists: ${name}`, 409)\n        }\n\n        // New role starts with zero permissions\n        existing[name] = {}\n        await saveRoles(existing)\n        onSave?.()\n\n        audit?.({\n          action: 'permissions.role.create',\n          entityType: 'permissions',\n          userId: user.id,\n          userName: user.name,\n          changes: { roleName: name },\n        })\n\n        return json({ name, permissions: {} }, 201)\n      },\n\n      // DELETE /permissions/roles/:name — delete a custom role\n      DELETE: async (_req, { segments, user, audit }) => {\n        if (segments.length !== 2 || segments[0] !== 'roles') {\n          return errorJson('DELETE only supported at /permissions/roles/:name', 400)\n        }\n\n        const name = segments[1]\n\n        if ((BUILT_IN_ROLES as readonly string[]).includes(name)) {\n          return errorJson(`Cannot delete built-in role: ${name}`, 400)\n        }\n\n        const existing = (await loadRoles()) ?? {}\n\n        if (!(name in existing)) {\n          return errorJson(`Role not found: ${name}`, 404)\n        }\n\n        const deletedPermissions = existing[name]\n        delete existing[name]\n        await saveRoles(existing)\n        onSave?.()\n\n        audit?.({\n          action: 'permissions.role.delete',\n          entityType: 'permissions',\n          userId: user.id,\n          userName: user.name,\n          changes: { roleName: name, permissions: deletedPermissions },\n        })\n\n        return json({ deleted: name })\n      },\n    },\n  }\n}\n"],"mappings":"gDAoEA,MAAM,EAAkB,yBAMxB,SAAS,EAAK,EAAe,EAAS,IAAe,CACnD,OAAO,IAAI,SAAS,KAAK,UAAU,EAAK,CAAE,CACxC,SACA,QAAS,CAAE,eAAgB,mBAAoB,CAChD,CAAC,CAGJ,SAAS,EAAU,EAAiB,EAA0B,CAC5D,OAAO,EAAK,CAAE,MAAO,EAAS,CAAE,EAAO,CA2BzC,SAAgB,EAAiB,EAA4C,CAC3E,GAAM,CAAE,gBAAe,YAAW,YAAW,UAAW,EAExD,MAAO,CACL,OAAQ,cACR,SAAU,cACV,QAAS,CAAC,OAAQ,SAAU,SAAU,SAAS,CAC/C,SAAU,CAER,IAAK,MAAO,EAAM,CAAE,cAAe,CACjC,IAAM,EAAa,GAAe,CAC5B,EAAS,MAAM,GAAW,EAAK,EAAE,CAUvC,OAPI,EAAS,SAAW,GAAK,EAAS,KAAO,QACpC,EAAK,CACV,MAAO,OAAO,KAAK,EAAM,CACzB,aAAc,CAAC,GAAG,EAAe,CAClC,CAAC,CAGG,EAAK,CACV,aACA,QACA,aAAc,CAAC,GAAG,EAAe,CAClC,CAAC,EAIJ,MAAO,MAAO,EAAK,CAAE,OAAM,WAAY,CAErC,GAAM,CAAE,SADK,MAAM,EAAI,MAAM,CAG7B,GAAI,CAAC,GAAS,OAAO,GAAU,SAC7B,OAAO,EAAU,mCAAoC,IAAI,CAI3D,GAAI,UAAW,EACb,OAAO,EACL,sEACA,IACD,CAIH,GAAI,EAAK,MAAQ,EAAK,OAAS,SAAW,EAAK,QAAQ,EACrD,OAAO,EAAU,8CAA+C,IAAI,CAItE,IAAM,EAAY,MAAM,GAAW,EAAK,EAAE,CAC1C,IAAK,IAAM,KAAY,OAAO,KAAK,EAAM,CACvC,GAAI,EAAE,KAAY,GAChB,OAAO,EACL,SAAS,EAAS,+DAClB,IACD,CAKL,IAAM,EAAa,GAAe,CAClC,IAAK,GAAM,CAAC,EAAU,KAAc,OAAO,QAAQ,EAAM,CAAE,CACzD,GAAI,OAAO,GAAa,UAAY,CAAC,EACnC,OAAO,EAAU,uCAAwC,IAAI,CAE/D,GAAI,OAAO,GAAc,WAAY,GAAsB,MAAM,QAAQ,EAAU,CACjF,OAAO,EAAU,yBAAyB,EAAS,qBAAsB,IAAI,CAE/E,IAAK,GAAM,CAAC,EAAU,KAAY,OAAO,QAAQ,EAAU,CAAE,CAC3D,GAAI,CAAC,MAAM,QAAQ,EAAQ,EAAI,CAAC,EAAQ,MAAO,GAAM,OAAO,GAAM,SAAS,CACzE,OAAO,EACL,gBAAgB,EAAS,aAAa,EAAS,0BAC/C,IACD,CAEH,IAAM,EAAe,EAAW,GAChC,GAAI,CAAC,EACH,OAAO,EAAU,qBAAqB,IAAY,IAAI,CAExD,IAAK,IAAM,KAAU,EACnB,GAAI,CAAC,EAAa,SAAS,EAAO,CAChC,OAAO,EACL,mBAAmB,EAAO,kBAAkB,EAAS,YAAY,EAAa,KAAK,KAAK,GACxF,IACD,EAOT,IAAM,EAAS,CAAE,GAAG,EAAU,CAC9B,IAAK,GAAM,CAAC,EAAU,KAAc,OAAO,QAAQ,EAAM,CACvD,EAAO,GAAY,EAerB,OAZA,MAAM,EAAU,EAAO,CACvB,KAAU,CAEV,IAAQ,CACN,OAAQ,qBACR,WAAY,cACZ,OAAQ,EAAK,GACb,SAAU,EAAK,KACf,QAAS,CAAE,QAAO,CAClB,SAAU,CAAE,cAAe,OAAO,KAAK,EAAM,CAAE,CAChD,CAAC,CAEK,EAAK,CAAE,GAAI,GAAM,CAAC,EAI3B,KAAM,MAAO,EAAK,CAAE,WAAU,OAAM,WAAY,CAC9C,GAAI,EAAS,SAAW,GAAK,EAAS,KAAO,QAC3C,OAAO,EAAU,4CAA6C,IAAI,CAIpE,GAAM,CAAE,QADK,MAAM,EAAI,MAAM,CAG7B,GAAI,CAAC,GAAQ,OAAO,GAAS,SAC3B,OAAO,EAAU,kCAAmC,IAAI,CAG1D,GAAI,CAAC,EAAgB,KAAK,EAAK,CAC7B,OAAO,EACL,2FACA,IACD,CAGH,GAAK,EAAqC,SAAS,EAAK,CACtD,OAAO,EAAU,0CAA0C,IAAQ,IAAI,CAGzE,IAAM,EAAY,MAAM,GAAW,EAAK,EAAE,CAmB1C,OAjBI,KAAQ,EACH,EAAU,wBAAwB,IAAQ,IAAI,EAIvD,EAAS,GAAQ,EAAE,CACnB,MAAM,EAAU,EAAS,CACzB,KAAU,CAEV,IAAQ,CACN,OAAQ,0BACR,WAAY,cACZ,OAAQ,EAAK,GACb,SAAU,EAAK,KACf,QAAS,CAAE,SAAU,EAAM,CAC5B,CAAC,CAEK,EAAK,CAAE,OAAM,YAAa,EAAE,CAAE,CAAE,IAAI,GAI7C,OAAQ,MAAO,EAAM,CAAE,WAAU,OAAM,WAAY,CACjD,GAAI,EAAS,SAAW,GAAK,EAAS,KAAO,QAC3C,OAAO,EAAU,oDAAqD,IAAI,CAG5E,IAAM,EAAO,EAAS,GAEtB,GAAK,EAAqC,SAAS,EAAK,CACtD,OAAO,EAAU,gCAAgC,IAAQ,IAAI,CAG/D,IAAM,EAAY,MAAM,GAAW,EAAK,EAAE,CAE1C,GAAI,EAAE,KAAQ,GACZ,OAAO,EAAU,mBAAmB,IAAQ,IAAI,CAGlD,IAAM,EAAqB,EAAS,GAapC,OAZA,OAAO,EAAS,GAChB,MAAM,EAAU,EAAS,CACzB,KAAU,CAEV,IAAQ,CACN,OAAQ,0BACR,WAAY,cACZ,OAAQ,EAAK,GACb,SAAU,EAAK,KACf,QAAS,CAAE,SAAU,EAAM,YAAa,EAAoB,CAC7D,CAAC,CAEK,EAAK,CAAE,QAAS,EAAM,CAAC,EAEjC,CACF"}

package/dist/client.d.mts

@@ -0,0 +1,100 @@
+import { createAuthClient } from "better-auth/react";
+
+//#region src/client.d.ts
+interface AuthClientOptions {
+  /** Base URL of the auth API. Defaults to window.location.origin. */
+  baseURL?: string;
+  /** Enable organization client plugin (must match server config) */
+  organizations?: boolean;
+}
+/**
+ * Create a typed auth client for use in React components.
+ *
+ * The explicit `ReturnType<typeof createAuthClient>` annotation is required
+ * because better-auth 1.6's client return type references internal modules
+ * (`client/path-to-object`, `client/query`) and zod@4 types that tsdown's
+ * dts generator cannot name portably across pnpm's symlink paths (TS2742).
+ *
+ * Widening to the base `createAuthClient` return type loses the plugin-
+ * specific client fields (`client.admin.listUsers`, etc.) at type level.
+ * Consumers who need typed access to admin endpoints should use
+ * `createUsersApi(client)` which bridges to a stable `UsersApi` interface
+ * the `@murumets-ee/admin-ui/users` package expects.
+ *
+ * @example
+ * ```typescript
+ * // lib/auth-client.ts
+ * import { createClient } from '@murumets-ee/auth/client'
+ *
+ * export const authClient = createClient()
+ *
+ * // In a component:
+ * const { data: session } = authClient.useSession()
+ * ```
+ */
+declare function createClient(options?: AuthClientOptions): ReturnType<typeof createAuthClient>;
+type AuthClient = any;
+interface UsersListQuery {
+  limit: number;
+  offset: number;
+  sortBy?: string;
+  sortDirection?: 'asc' | 'desc';
+  searchValue?: string;
+  searchField?: 'email' | 'name';
+  searchOperator?: 'contains' | 'starts_with' | 'ends_with';
+}
+interface NormalizedUser {
+  id: string;
+  name: string;
+  email: string;
+  emailVerified: boolean;
+  image: string | null;
+  createdAt: string;
+  updatedAt: string;
+  role: string | null;
+  banned: boolean | null;
+  banReason: string | null;
+  banExpires: string | null;
+}
+/**
+ * Create a users API adapter from a better-auth client that includes the
+ * `adminClient()` plugin. The returned object is structurally compatible
+ * with the `UsersApi` interface from `@murumets-ee/admin-ui/users`.
+ *
+ * @example
+ * ```tsx
+ * import { createClient, createUsersApi } from '@murumets-ee/auth/client'
+ * import { UsersManagement } from '@murumets-ee/admin-ui/users'
+ *
+ * const authClient = createClient()
+ * const usersApi = createUsersApi(authClient)
+ *
+ * <UsersManagement api={usersApi} currentUserId={session.user.id} />
+ * ```
+ */
+declare function createUsersApi(client: AuthClient): {
+  list(query: UsersListQuery): Promise<{
+    users: NormalizedUser[];
+    total: number;
+  }>;
+  create(data: {
+    name: string;
+    email: string;
+    password: string;
+    role: string;
+  }): Promise<void>;
+  update(userId: string, data: {
+    name?: string;
+  }): Promise<void>;
+  remove(userId: string): Promise<void>;
+  setRole(userId: string, role: string): Promise<void>;
+  ban(userId: string, options?: {
+    reason?: string;
+    expiresIn?: number;
+  }): Promise<void>;
+  unban(userId: string): Promise<void>;
+  revokeSessions(userId: string): Promise<void>;
+};
+//#endregion
+export { AuthClientOptions, createClient, createUsersApi };
+//# sourceMappingURL=client.d.mts.map

package/dist/client.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.mts","names":[],"sources":["../src/client.ts"],"mappings":";;;UAUiB,iBAAA;EAgCD;EA9Bd,OAAA;;EAEA,aAAA;AAAA;;;;;;;;;;AAiCD;;;;;AASc;;;;;;;;;;;iBAdC,YAAA,CAAa,OAAA,GAAU,iBAAA,GAAoB,UAAA,QAAkB,gBAAA;AAAA,KAcxE,UAAA;AAAA,UAEK,cAAA;EACR,KAAA;EACA,MAAA;EACA,MAAA;EACA,aAAA;EACA,WAAA;EACA,WAAA;EACA,cAAA;AAAA;AAAA,UAGQ,cAAA;EACR,EAAA;EACA,IAAA;EACA,KAAA;EACA,aAAA;EACA,KAAA;EACA,SAAA;EACA,SAAA;EACA,IAAA;EACA,MAAA;EACA,SAAA;EACA,UAAA;AAAA;;;;;;;;;;;;;;;;;iBAmBc,cAAA,CAAe,MAAA,EAAQ,UAAA;cAYjB,cAAA,GAAiB,OAAA;IAAU,KAAA,EAAO,cAAA;IAAkB,KAAA;EAAA;;IAuBjD,IAAA;IAAc,KAAA;IAAe,QAAA;IAAkB,IAAA;EAAA,IAAc,OAAA;yBAavD,IAAA;IAAU,IAAA;EAAA,IAAe,OAAA;0BAMzB,OAAA;0BAMC,IAAA,WAAc,OAAA;sBASlB,OAAA;IAAc,MAAA;IAAiB,SAAA;EAAA,IAAoB,OAAA;yBAUjD,OAAA;kCAMS,OAAA;AAAA"}

package/dist/client.mjs

@@ -0,0 +1,2 @@
+import{adminClient as e,organizationClient as t}from"better-auth/client/plugins";import{createAuthClient as n}from"better-auth/react";function r(r){return n({baseURL:r?.baseURL,plugins:[e(),...r?.organizations?[t()]:[]]})}function i(e){function t(e){if(e.error)throw Error(e.error.message??`Unknown error`);return e.data}return{async list(n){let r=t(await e.admin.listUsers({query:{limit:n.limit,offset:n.offset,...n.sortBy?{sortBy:n.sortBy,sortDirection:n.sortDirection}:{},...n.searchValue?{searchValue:n.searchValue,searchField:n.searchField??`email`,searchOperator:n.searchOperator??`contains`}:{}}}));return{users:(r.users??[]).map(a),total:r.total??0}},async create(n){t(await e.admin.createUser({name:n.name,email:n.email,password:n.password,role:n.role}))},async update(n,r){t(await e.admin.updateUser({userId:n,data:r}))},async remove(n){t(await e.admin.removeUser({userId:n}))},async setRole(n,r){t(await e.admin.setRole({userId:n,role:r}))},async ban(n,r){t(await e.admin.banUser({userId:n,...r?.reason?{banReason:r.reason}:{},...r?.expiresIn?{banExpiresIn:r.expiresIn}:{}}))},async unban(n){t(await e.admin.unbanUser({userId:n}))},async revokeSessions(n){t(await e.admin.revokeUserSessions({userId:n}))}}}function a(e){let t=e;return{id:t.id,name:t.name??``,email:t.email,emailVerified:t.emailVerified??!1,image:t.image??null,createdAt:String(t.createdAt??``),updatedAt:String(t.updatedAt??``),role:t.role??null,banned:t.banned??null,banReason:t.banReason??null,banExpires:t.banExpires?String(t.banExpires):null}}export{r as createClient,i as createUsersApi};
+//# sourceMappingURL=client.mjs.map

package/dist/client.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.mjs","names":[],"sources":["../src/client.ts"],"sourcesContent":["/**\n * Browser-safe auth client factory.\n *\n * This module has NO server-only imports and is safe to use in React components.\n * Import from '@murumets-ee/auth/client'.\n */\n\nimport { adminClient, organizationClient } from 'better-auth/client/plugins'\nimport { createAuthClient } from 'better-auth/react'\n\nexport interface AuthClientOptions {\n  /** Base URL of the auth API. Defaults to window.location.origin. */\n  baseURL?: string\n  /** Enable organization client plugin (must match server config) */\n  organizations?: boolean\n}\n\n/**\n * Create a typed auth client for use in React components.\n *\n * The explicit `ReturnType<typeof createAuthClient>` annotation is required\n * because better-auth 1.6's client return type references internal modules\n * (`client/path-to-object`, `client/query`) and zod@4 types that tsdown's\n * dts generator cannot name portably across pnpm's symlink paths (TS2742).\n *\n * Widening to the base `createAuthClient` return type loses the plugin-\n * specific client fields (`client.admin.listUsers`, etc.) at type level.\n * Consumers who need typed access to admin endpoints should use\n * `createUsersApi(client)` which bridges to a stable `UsersApi` interface\n * the `@murumets-ee/admin-ui/users` package expects.\n *\n * @example\n * ```typescript\n * // lib/auth-client.ts\n * import { createClient } from '@murumets-ee/auth/client'\n *\n * export const authClient = createClient()\n *\n * // In a component:\n * const { data: session } = authClient.useSession()\n * ```\n */\nexport function createClient(options?: AuthClientOptions): ReturnType<typeof createAuthClient> {\n  return createAuthClient({\n    baseURL: options?.baseURL,\n    plugins: [adminClient(), ...(options?.organizations ? [organizationClient()] : [])],\n  })\n}\n\n// ---------------------------------------------------------------------------\n// UsersApi adapter — bridges better-auth admin client → @murumets-ee/admin-ui/users\n// ---------------------------------------------------------------------------\n\n// biome-ignore lint/suspicious/noExplicitAny: client.admin.* methods live on a\n// plugin-extended type that our explicit annotation on `createClient` loses.\n// `createUsersApi` casts through `any` and validates the shape at call sites.\ntype AuthClient = any\n\ninterface UsersListQuery {\n  limit: number\n  offset: number\n  sortBy?: string\n  sortDirection?: 'asc' | 'desc'\n  searchValue?: string\n  searchField?: 'email' | 'name'\n  searchOperator?: 'contains' | 'starts_with' | 'ends_with'\n}\n\ninterface NormalizedUser {\n  id: string\n  name: string\n  email: string\n  emailVerified: boolean\n  image: string | null\n  createdAt: string\n  updatedAt: string\n  role: string | null\n  banned: boolean | null\n  banReason: string | null\n  banExpires: string | null\n}\n\n/**\n * Create a users API adapter from a better-auth client that includes the\n * `adminClient()` plugin. The returned object is structurally compatible\n * with the `UsersApi` interface from `@murumets-ee/admin-ui/users`.\n *\n * @example\n * ```tsx\n * import { createClient, createUsersApi } from '@murumets-ee/auth/client'\n * import { UsersManagement } from '@murumets-ee/admin-ui/users'\n *\n * const authClient = createClient()\n * const usersApi = createUsersApi(authClient)\n *\n * <UsersManagement api={usersApi} currentUserId={session.user.id} />\n * ```\n */\nexport function createUsersApi(client: AuthClient) {\n  /**\n   * Unwrap better-auth's discriminated union response.\n   * On error branch, `error` exists with optional `message`.\n   * On success branch, `data` exists.\n   */\n  function unwrap<T>(res: { data?: T; error?: { message?: string } }): T {\n    if (res.error) throw new Error(res.error.message ?? 'Unknown error')\n    return res.data as T\n  }\n\n  return {\n    async list(query: UsersListQuery): Promise<{ users: NormalizedUser[]; total: number }> {\n      const res = await client.admin.listUsers({\n        query: {\n          limit: query.limit,\n          offset: query.offset,\n          ...(query.sortBy ? { sortBy: query.sortBy, sortDirection: query.sortDirection } : {}),\n          ...(query.searchValue\n            ? {\n                searchValue: query.searchValue,\n                searchField: query.searchField ?? 'email',\n                searchOperator: query.searchOperator ?? 'contains',\n              }\n            : {}),\n        },\n      })\n      // biome-ignore lint/suspicious/noExplicitAny: better-auth's union return type doesn't match a simple generic pattern\n      const data = unwrap<{ users: unknown[]; total: number }>(res as any)\n      return {\n        users: (data.users ?? []).map(mapUser),\n        total: data.total ?? 0,\n      }\n    },\n\n    async create(data: { name: string; email: string; password: string; role: string }) {\n      const res = await client.admin.createUser({\n        name: data.name,\n        email: data.email,\n        password: data.password,\n        // better-auth admin plugin types role as a narrow union; cast is safe\n        // because server validates the role against configured access control\n        role: data.role as 'admin',\n      })\n      // biome-ignore lint/suspicious/noExplicitAny: better-auth union return type\n      unwrap(res as any)\n    },\n\n    async update(userId: string, data: { name?: string }) {\n      const res = await client.admin.updateUser({ userId, data })\n      // biome-ignore lint/suspicious/noExplicitAny: better-auth union return type\n      unwrap(res as any)\n    },\n\n    async remove(userId: string) {\n      const res = await client.admin.removeUser({ userId })\n      // biome-ignore lint/suspicious/noExplicitAny: better-auth union return type\n      unwrap(res as any)\n    },\n\n    async setRole(userId: string, role: string) {\n      const res = await client.admin.setRole({\n        userId,\n        role: role as 'admin',\n      })\n      // biome-ignore lint/suspicious/noExplicitAny: better-auth union return type\n      unwrap(res as any)\n    },\n\n    async ban(userId: string, options?: { reason?: string; expiresIn?: number }) {\n      const res = await client.admin.banUser({\n        userId,\n        ...(options?.reason ? { banReason: options.reason } : {}),\n        ...(options?.expiresIn ? { banExpiresIn: options.expiresIn } : {}),\n      })\n      // biome-ignore lint/suspicious/noExplicitAny: better-auth union return type\n      unwrap(res as any)\n    },\n\n    async unban(userId: string) {\n      const res = await client.admin.unbanUser({ userId })\n      // biome-ignore lint/suspicious/noExplicitAny: better-auth union return type\n      unwrap(res as any)\n    },\n\n    async revokeSessions(userId: string) {\n      const res = await client.admin.revokeUserSessions({ userId })\n      // biome-ignore lint/suspicious/noExplicitAny: better-auth union return type\n      unwrap(res as any)\n    },\n  }\n}\n\n/** Normalize a better-auth user record to a consistent shape. */\nfunction mapUser(u: unknown): NormalizedUser {\n  const r = u as Record<string, unknown>\n  return {\n    id: r.id as string,\n    name: (r.name as string) ?? '',\n    email: r.email as string,\n    emailVerified: (r.emailVerified as boolean) ?? false,\n    image: (r.image as string) ?? null,\n    createdAt: String(r.createdAt ?? ''),\n    updatedAt: String(r.updatedAt ?? ''),\n    role: (r.role as string) ?? null,\n    banned: (r.banned as boolean) ?? null,\n    banReason: (r.banReason as string) ?? null,\n    banExpires: r.banExpires ? String(r.banExpires) : null,\n  }\n}\n"],"mappings":"sIA0CA,SAAgB,EAAa,EAAkE,CAC7F,OAAO,EAAiB,CACtB,QAAS,GAAS,QAClB,QAAS,CAAC,GAAa,CAAE,GAAI,GAAS,cAAgB,CAAC,GAAoB,CAAC,CAAG,EAAE,CAAE,CACpF,CAAC,CAoDJ,SAAgB,EAAe,EAAoB,CAMjD,SAAS,EAAU,EAAoD,CACrE,GAAI,EAAI,MAAO,MAAU,MAAM,EAAI,MAAM,SAAW,gBAAgB,CACpE,OAAO,EAAI,KAGb,MAAO,CACL,MAAM,KAAK,EAA4E,CAgBrF,IAAM,EAAO,EAfD,MAAM,EAAO,MAAM,UAAU,CACvC,MAAO,CACL,MAAO,EAAM,MACb,OAAQ,EAAM,OACd,GAAI,EAAM,OAAS,CAAE,OAAQ,EAAM,OAAQ,cAAe,EAAM,cAAe,CAAG,EAAE,CACpF,GAAI,EAAM,YACN,CACE,YAAa,EAAM,YACnB,YAAa,EAAM,aAAe,QAClC,eAAgB,EAAM,gBAAkB,WACzC,CACD,EAAE,CACP,CACF,CAAC,CAEkE,CACpE,MAAO,CACL,OAAQ,EAAK,OAAS,EAAE,EAAE,IAAI,EAAQ,CACtC,MAAO,EAAK,OAAS,EACtB,EAGH,MAAM,OAAO,EAAuE,CAUlF,EATY,MAAM,EAAO,MAAM,WAAW,CACxC,KAAM,EAAK,KACX,MAAO,EAAK,MACZ,SAAU,EAAK,SAGf,KAAM,EAAK,KACZ,CAAC,CAEgB,EAGpB,MAAM,OAAO,EAAgB,EAAyB,CAGpD,EAFY,MAAM,EAAO,MAAM,WAAW,CAAE,SAAQ,OAAM,CAAC,CAEzC,EAGpB,MAAM,OAAO,EAAgB,CAG3B,EAFY,MAAM,EAAO,MAAM,WAAW,CAAE,SAAQ,CAAC,CAEnC,EAGpB,MAAM,QAAQ,EAAgB,EAAc,CAM1C,EALY,MAAM,EAAO,MAAM,QAAQ,CACrC,SACM,OACP,CAAC,CAEgB,EAGpB,MAAM,IAAI,EAAgB,EAAmD,CAO3E,EANY,MAAM,EAAO,MAAM,QAAQ,CACrC,SACA,GAAI,GAAS,OAAS,CAAE,UAAW,EAAQ,OAAQ,CAAG,EAAE,CACxD,GAAI,GAAS,UAAY,CAAE,aAAc,EAAQ,UAAW,CAAG,EAAE,CAClE,CAAC,CAEgB,EAGpB,MAAM,MAAM,EAAgB,CAG1B,EAFY,MAAM,EAAO,MAAM,UAAU,CAAE,SAAQ,CAAC,CAElC,EAGpB,MAAM,eAAe,EAAgB,CAGnC,EAFY,MAAM,EAAO,MAAM,mBAAmB,CAAE,SAAQ,CAAC,CAE3C,EAErB,CAIH,SAAS,EAAQ,EAA4B,CAC3C,IAAM,EAAI,EACV,MAAO,CACL,GAAI,EAAE,GACN,KAAO,EAAE,MAAmB,GAC5B,MAAO,EAAE,MACT,cAAgB,EAAE,eAA6B,GAC/C,MAAQ,EAAE,OAAoB,KAC9B,UAAW,OAAO,EAAE,WAAa,GAAG,CACpC,UAAW,OAAO,EAAE,WAAa,GAAG,CACpC,KAAO,EAAE,MAAmB,KAC5B,OAAS,EAAE,QAAsB,KACjC,UAAY,EAAE,WAAwB,KACtC,WAAY,EAAE,WAAa,OAAO,EAAE,WAAW,CAAG,KACnD"}

package/dist/{index.d.ts → index.d.mts}

@@ -1,21 +1,10 @@
-import { RequestContext, PermissionChecker } from '@murumets-ee/core';
-import { A as Auth } from './plugin-C-MA3A5U.js';
-export { a as AuthConfig, b as auth, g as getAuth } from './plugin-C-MA3A5U.js';
-import * as better_auth_plugins from 'better-auth/plugins';
-import { Entity } from '@murumets-ee/entity';
-import { createAccessControl } from 'better-auth/plugins/access';
-export { createAccessControl } from 'better-auth/plugins/access';
-import 'better-auth';
-import '@murumets-ee/logging';
-
-/**
- * Bridge between better-auth sessions and the toolkit's RequestContext.
- *
- * This is the critical integration point: it resolves a better-auth session
- * from request headers and returns a toolkit RequestContext that the entity
- * system's AdminClient, QueryClient, and auditable behavior can read.
- */
+import { i as AuthConfig, n as getAuth, r as Auth, t as auth } from "./plugin-BS-ho4BN.mjs";
+import { createAccessControl } from "better-auth/plugins/access";
+import * as _$better_auth_plugins0 from "better-auth/plugins";
+import { PermissionChecker, RequestContext } from "@murumets-ee/core";
+import { Entity } from "@murumets-ee/entity";
 
+//#region src/context.d.ts
 /**
  * Resolve a better-auth session into a toolkit RequestContext.
  *
@@ -36,10 +25,10 @@ import '@murumets-ee/logging';
  * ```
  */
 declare function resolveAuthContext(auth: Auth, headers: Headers): Promise<RequestContext>;
-
+//#endregion
+//#region src/permissions.d.ts
 declare const ACTIONS: readonly ["view", "create", "update", "delete"];
 declare const ACTIONS_WITH_PUBLISH: readonly ["view", "create", "update", "delete", "publish"];
-
 /** Built-in role names — cannot be deleted via the roles editor. */
 declare const BUILT_IN_ROLES: readonly ["admin", "public", "authenticated"];
 /** Maps HTTP methods to permission action names. */
@@ -72,13 +61,13 @@ declare function buildPermissionChecker(roleDefinitions: Record<string, Record<s
  * Routes with `resource` and `actions` are added if not already present.
  */
 declare function buildResourceCatalog(entities: {
+  name: string;
+  behaviors?: {
     name: string;
-    behaviors?: {
-        name: string;
-    }[];
+  }[];
 }[], routes?: {
-    resource?: string;
-    actions?: readonly string[];
+  resource?: string;
+  actions?: readonly string[];
 }[]): Record<string, string[]>;
 /**
  * Build a permission statement object from all registered entities,
@@ -95,20 +84,21 @@ declare function buildStatements(entities: Entity[]): Record<string, readonly st
  * - **authenticated**: view only (better-auth's `defaultRole`)
  */
 declare function buildDefaultRoles(ac: ReturnType<typeof createAccessControl>, entities: Entity[]): {
-    admin: {
-        authorize<K_1 extends string>(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins.Subset<string, better_auth_plugins.Statements>[key] | {
-            actions: better_auth_plugins.Subset<string, better_auth_plugins.Statements>[key];
-            connector: "OR" | "AND";
-        } | undefined; } : never, connector?: "OR" | "AND"): better_auth_plugins.AuthorizeResponse;
-        statements: better_auth_plugins.Subset<string, better_auth_plugins.Statements>;
-    };
-    authenticated: {
-        authorize<K_1 extends string>(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins.Subset<string, better_auth_plugins.Statements>[key] | {
-            actions: better_auth_plugins.Subset<string, better_auth_plugins.Statements>[key];
-            connector: "OR" | "AND";
-        } | undefined; } : never, connector?: "OR" | "AND"): better_auth_plugins.AuthorizeResponse;
-        statements: better_auth_plugins.Subset<string, better_auth_plugins.Statements>;
-    };
+  admin: {
+    authorize<K_1 extends string>(request: K_1 extends infer T extends K ? { [key in T]?: _$better_auth_plugins0.Subset<string, _$better_auth_plugins0.Statements>[key] | {
+      actions: _$better_auth_plugins0.Subset<string, _$better_auth_plugins0.Statements>[key];
+      connector: "OR" | "AND";
+    } | undefined } : never, connector?: "OR" | "AND"): _$better_auth_plugins0.AuthorizeResponse;
+    statements: _$better_auth_plugins0.Subset<string, _$better_auth_plugins0.Statements>;
+  };
+  authenticated: {
+    authorize<K_1 extends string>(request: K_1 extends infer T extends K ? { [key in T]?: _$better_auth_plugins0.Subset<string, _$better_auth_plugins0.Statements>[key] | {
+      actions: _$better_auth_plugins0.Subset<string, _$better_auth_plugins0.Statements>[key];
+      connector: "OR" | "AND";
+    } | undefined } : never, connector?: "OR" | "AND"): _$better_auth_plugins0.AuthorizeResponse;
+    statements: _$better_auth_plugins0.Subset<string, _$better_auth_plugins0.Statements>;
+  };
 };
-
-export { ACTIONS, ACTIONS_WITH_PUBLISH, Auth, BUILT_IN_ROLES, METHOD_TO_ACTION, buildDefaultRoles, buildInitialRoleDefinitions, buildPermissionChecker, buildResourceCatalog, buildStatements, resolveAuthContext };
+//#endregion
+export { ACTIONS, ACTIONS_WITH_PUBLISH, type Auth, type AuthConfig, BUILT_IN_ROLES, METHOD_TO_ACTION, auth, buildDefaultRoles, buildInitialRoleDefinitions, buildPermissionChecker, buildResourceCatalog, buildStatements, createAccessControl, getAuth, resolveAuthContext };
+//# sourceMappingURL=index.d.mts.map

package/dist/index.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.mts","names":[],"sources":["../src/context.ts","../src/permissions.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;iBA8BsB,kBAAA,CAAmB,IAAA,EAAM,IAAA,EAAM,OAAA,EAAS,OAAA,GAAU,OAAA,CAAQ,cAAA;;;cCf1E,OAAA;AAAA,cACA,oBAAA;;cASO,cAAA;;cAGA,gBAAA,EAAkB,MAAA;;;;;;;iBAiBf,2BAAA,CAAA,GAA+B,MAAA,SAAe,MAAA;;AAhCE;;;;;AAED;;iBA6C/C,sBAAA,CACd,eAAA,EAAiB,MAAA,SAAe,MAAA,sBAC/B,iBAAA;;;AArCH;;;;;AAGA;;;;iBAwEgB,oBAAA,CACd,QAAA;EAAY,IAAA;EAAc,SAAA;IAAc,IAAA;EAAA;AAAA,KACxC,MAAA;EAAW,QAAA;EAAmB,OAAA;AAAA,MAC7B,MAAA;;;;;;;;iBA+Ca,eAAA,CAAgB,QAAA,EAAU,MAAA,KAAQ,MAAA;;;;AAlDlD;;;iBAkEgB,iBAAA,CAAkB,EAAA,EAAI,UAAA,QAAkB,mBAAA,GAAsB,QAAA,EAAU,MAAA"}

package/dist/index.mjs

@@ -0,0 +1,2 @@
+import{a as e,c as t,i as n,l as r,n as i,o as a,r as o,s,t as c,u as l}from"./permissions-DREmJByu.mjs";import{auth as u,getAuth as d}from"./plugin.mjs";import"server-only";async function f(e,t){let n=await e.api.getSession({headers:t});return n?{user:{id:n.user.id,groups:[n.user.role??`viewer`],name:n.user.name??void 0,email:n.user.email??void 0},requestId:crypto.randomUUID()}:{requestId:crypto.randomUUID()}}export{c as ACTIONS,i as ACTIONS_WITH_PUBLISH,o as BUILT_IN_ROLES,n as METHOD_TO_ACTION,u as auth,e as buildDefaultRoles,a as buildInitialRoleDefinitions,s as buildPermissionChecker,t as buildResourceCatalog,r as buildStatements,l as createAccessControl,d as getAuth,f as resolveAuthContext};
+//# sourceMappingURL=index.mjs.map

package/dist/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":[],"sources":["../src/context.ts"],"sourcesContent":["/**\n * Bridge between better-auth sessions and the toolkit's RequestContext.\n *\n * This is the critical integration point: it resolves a better-auth session\n * from request headers and returns a toolkit RequestContext that the entity\n * system's AdminClient, QueryClient, and auditable behavior can read.\n */\n\nimport type { RequestContext } from '@murumets-ee/core'\nimport type { Auth } from './server.js'\n\n/**\n * Resolve a better-auth session into a toolkit RequestContext.\n *\n * Call this from your Next.js middleware or server component to populate\n * the toolkit's AsyncLocalStorage context.\n *\n * @example\n * ```typescript\n * // middleware.ts (user writes this — documented copy-paste)\n * import { getAuth, resolveAuthContext } from '@murumets-ee/auth'\n * import { runWithContext } from '@murumets-ee/core'\n *\n * export async function middleware(request: NextRequest) {\n *   const auth = getAuth()\n *   const ctx = await resolveAuthContext(auth, request.headers)\n *   return runWithContext(ctx, () => NextResponse.next())\n * }\n * ```\n */\nexport async function resolveAuthContext(auth: Auth, headers: Headers): Promise<RequestContext> {\n  const session = await auth.api.getSession({ headers })\n\n  if (!session) {\n    return { requestId: crypto.randomUUID() }\n  }\n\n  return {\n    user: {\n      id: session.user.id,\n      // The admin plugin stores role on the user object\n      groups: [((session.user as Record<string, unknown>).role as string) ?? 'viewer'],\n      name: session.user.name ?? undefined,\n      email: session.user.email ?? undefined,\n    },\n    requestId: crypto.randomUUID(),\n  }\n}\n"],"mappings":"8KA8BA,eAAsB,EAAmB,EAAY,EAA2C,CAC9F,IAAM,EAAU,MAAM,EAAK,IAAI,WAAW,CAAE,UAAS,CAAC,CAMtD,OAJK,EAIE,CACL,KAAM,CACJ,GAAI,EAAQ,KAAK,GAEjB,OAAQ,CAAG,EAAQ,KAAiC,MAAmB,SAAS,CAChF,KAAM,EAAQ,KAAK,MAAQ,IAAA,GAC3B,MAAO,EAAQ,KAAK,OAAS,IAAA,GAC9B,CACD,UAAW,OAAO,YAAY,CAC/B,CAZQ,CAAE,UAAW,OAAO,YAAY,CAAE"}

package/dist/permissions-DREmJByu.mjs

@@ -0,0 +1,2 @@
+import{createAccessControl as e}from"better-auth/plugins/access";const t=[`view`,`create`,`update`,`delete`],n=[`view`,`create`,`update`,`delete`,`publish`],r=[`admin`,`public`,`authenticated`],i={GET:`view`,POST:`create`,PATCH:`update`,DELETE:`delete`};function a(){return{public:{},authenticated:{}}}function o(e){let t=new Map;for(let[n,r]of Object.entries(e)){let e=new Map;for(let[t,n]of Object.entries(r))e.set(t,new Set(n));t.set(n,e)}return(e,n,r)=>e===`admin`?!0:t.get(e)?.get(n)?.has(r)??!1}function s(e){return e.behaviors?.some(e=>e.name===`publishable`)??!1}function c(e,t){let n={};for(let t of e)n[t.name]=s(t)?[`view`,`create`,`update`,`delete`,`publish`]:[`view`,`create`,`update`,`delete`];if(t)for(let e of t)e.resource&&e.actions&&!(e.resource in n)&&(n[e.resource]=[...e.actions]);return n}const l={user:[`create`,`list`,`set-role`,`ban`,`impersonate`,`delete`,`set-password`,`get`,`update`],session:[`list`,`revoke`,`delete`]};function u(e){let r={...l};for(let i of e)r[i.name]=s(i)?n:t;return r}function d(e,t){let n={},r={};n.user=[...l.user],n.session=[...l.session],r.user=[],r.session=[];for(let e of t)n[e.name]=s(e)?[`view`,`create`,`update`,`delete`,`publish`]:[`view`,`create`,`update`,`delete`],r[e.name]=[`view`];return{admin:e.newRole(n),authenticated:e.newRole(r)}}export{d as a,c,i,u as l,n,a as o,r,o as s,t,e as u};
+//# sourceMappingURL=permissions-DREmJByu.mjs.map

package/dist/permissions-DREmJByu.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions-DREmJByu.mjs","names":[],"sources":["../src/permissions.ts"],"sourcesContent":["/**\n * Permission system — bridges entity access definitions to better-auth's access control,\n * and provides the configurable permission checker for the admin API.\n *\n * Two layers:\n * 1. **better-auth integration**: `buildStatements` / `buildDefaultRoles` — feeds into\n *    better-auth's `createAccessControl` for its internal permission system.\n * 2. **Admin API enforcement**: `buildPermissionChecker` / `buildInitialRoleDefinitions` —\n *    the toolkit's own firewall-model permission system, persisted in settings.\n */\n\nimport type { PermissionChecker } from '@murumets-ee/core'\nimport type { Entity } from '@murumets-ee/entity'\nimport { createAccessControl } from 'better-auth/plugins/access'\n\nconst ACTIONS = ['view', 'create', 'update', 'delete'] as const\nconst ACTIONS_WITH_PUBLISH = ['view', 'create', 'update', 'delete', 'publish'] as const\n\nexport { ACTIONS, ACTIONS_WITH_PUBLISH }\n\n// ---------------------------------------------------------------------------\n// Built-in roles & constants\n// ---------------------------------------------------------------------------\n\n/** Built-in role names — cannot be deleted via the roles editor. */\nexport const BUILT_IN_ROLES = ['admin', 'public', 'authenticated'] as const\n\n/** Maps HTTP methods to permission action names. */\nexport const METHOD_TO_ACTION: Record<string, string> = {\n  GET: 'view',\n  POST: 'create',\n  PATCH: 'update',\n  DELETE: 'delete',\n}\n\n// ---------------------------------------------------------------------------\n// Admin API permission system (firewall model)\n// ---------------------------------------------------------------------------\n\n/**\n * Build initial role definitions for first run (no settings saved yet).\n *\n * All built-in non-admin roles start with ZERO permissions.\n * Admin is never stored — it's hardcoded in the checker.\n */\nexport function buildInitialRoleDefinitions(): Record<string, Record<string, string[]>> {\n  return {\n    public: {},\n    authenticated: {},\n  }\n}\n\n/**\n * Build a synchronous permission checker from role definitions.\n *\n * Rules:\n * - `admin` role: ALWAYS returns `true` (hardcoded safety net, ignores settings)\n * - All other roles: exact match from `roleDefinitions` (deny-by-default)\n * - Unknown role / unknown resource / unknown action → `false`\n */\nexport function buildPermissionChecker(\n  roleDefinitions: Record<string, Record<string, string[]>>,\n): PermissionChecker {\n  // Pre-build lookup maps for O(1) checks\n  const perms = new Map<string, Map<string, Set<string>>>()\n\n  for (const [role, resources] of Object.entries(roleDefinitions)) {\n    const resourceMap = new Map<string, Set<string>>()\n    for (const [resource, actions] of Object.entries(resources)) {\n      resourceMap.set(resource, new Set(actions))\n    }\n    perms.set(role, resourceMap)\n  }\n\n  return (role: string, resource: string, action: string): boolean => {\n    if (role === 'admin') return true // Safety net — admin always passes\n    return perms.get(role)?.get(resource)?.has(action) ?? false\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Resource catalog builder\n// ---------------------------------------------------------------------------\n\n/** Check if an entity has the publishable behavior. */\nfunction isPublishable(entity: { behaviors?: { name: string }[] }): boolean {\n  return entity.behaviors?.some((b) => b.name === 'publishable') ?? false\n}\n\n/**\n * Build a complete resource catalog from entities and admin routes.\n *\n * Used by:\n * - `permissionRoutes()` config (`getStatements` callback)\n * - Server-side permission page data loaders\n *\n * Entities automatically get CRUD actions. Publishable entities also get\n * the `publish` action, which gates who can set status to 'published'.\n * Routes with `resource` and `actions` are added if not already present.\n */\nexport function buildResourceCatalog(\n  entities: { name: string; behaviors?: { name: string }[] }[],\n  routes?: { resource?: string; actions?: readonly string[] }[],\n): Record<string, string[]> {\n  const catalog: Record<string, string[]> = {}\n\n  for (const entity of entities) {\n    catalog[entity.name] = isPublishable(entity)\n      ? ['view', 'create', 'update', 'delete', 'publish']\n      : ['view', 'create', 'update', 'delete']\n  }\n\n  if (routes) {\n    for (const route of routes) {\n      if (route.resource && route.actions && !(route.resource in catalog)) {\n        catalog[route.resource] = [...route.actions]\n      }\n    }\n  }\n\n  return catalog\n}\n\n// ---------------------------------------------------------------------------\n// better-auth integration (unchanged, used by createAuthServer)\n// ---------------------------------------------------------------------------\n\n/** Admin plugin's built-in resources — must be included for listUsers, ban, etc. */\nconst ADMIN_STATEMENTS = {\n  user: [\n    'create',\n    'list',\n    'set-role',\n    'ban',\n    'impersonate',\n    'delete',\n    'set-password',\n    'get',\n    'update',\n  ] as const,\n  session: ['list', 'revoke', 'delete'] as const,\n}\n\n/**\n * Build a permission statement object from all registered entities,\n * plus the admin plugin's built-in user/session resources.\n *\n * Publishable entities get the additional `publish` action.\n * Result shape: `{ user: [...], session: [...], article: ['view', ...], category: [...] }`\n */\nexport function buildStatements(entities: Entity[]) {\n  const statement: Record<string, readonly string[]> = {\n    ...ADMIN_STATEMENTS,\n  }\n  for (const entity of entities) {\n    statement[entity.name] = isPublishable(entity) ? ACTIONS_WITH_PUBLISH : ACTIONS\n  }\n  return statement\n}\n\n/**\n * Build the default toolkit roles for better-auth's access control.\n *\n * - **admin**: full CRUD on all entities + user/session management\n * - **authenticated**: view only (better-auth's `defaultRole`)\n */\nexport function buildDefaultRoles(ac: ReturnType<typeof createAccessControl>, entities: Entity[]) {\n  const adminPerms: Record<string, string[]> = {}\n  const authenticatedPerms: Record<string, string[]> = {}\n\n  // Admin gets full control of user/session management\n  adminPerms.user = [...ADMIN_STATEMENTS.user]\n  adminPerms.session = [...ADMIN_STATEMENTS.session]\n  // Authenticated gets no user/session management\n  authenticatedPerms.user = []\n  authenticatedPerms.session = []\n\n  for (const entity of entities) {\n    adminPerms[entity.name] = isPublishable(entity)\n      ? ['view', 'create', 'update', 'delete', 'publish']\n      : ['view', 'create', 'update', 'delete']\n    authenticatedPerms[entity.name] = ['view']\n  }\n\n  return {\n    admin: ac.newRole(adminPerms),\n    authenticated: ac.newRole(authenticatedPerms),\n  }\n}\n\nexport { createAccessControl }\n"],"mappings":"iEAeA,MAAM,EAAU,CAAC,OAAQ,SAAU,SAAU,SAAS,CAChD,EAAuB,CAAC,OAAQ,SAAU,SAAU,SAAU,UAAU,CASjE,EAAiB,CAAC,QAAS,SAAU,gBAAgB,CAGrD,EAA2C,CACtD,IAAK,OACL,KAAM,SACN,MAAO,SACP,OAAQ,SACT,CAYD,SAAgB,GAAwE,CACtF,MAAO,CACL,OAAQ,EAAE,CACV,cAAe,EAAE,CAClB,CAWH,SAAgB,EACd,EACmB,CAEnB,IAAM,EAAQ,IAAI,IAElB,IAAK,GAAM,CAAC,EAAM,KAAc,OAAO,QAAQ,EAAgB,CAAE,CAC/D,IAAM,EAAc,IAAI,IACxB,IAAK,GAAM,CAAC,EAAU,KAAY,OAAO,QAAQ,EAAU,CACzD,EAAY,IAAI,EAAU,IAAI,IAAI,EAAQ,CAAC,CAE7C,EAAM,IAAI,EAAM,EAAY,CAG9B,OAAQ,EAAc,EAAkB,IAClC,IAAS,QAAgB,GACtB,EAAM,IAAI,EAAK,EAAE,IAAI,EAAS,EAAE,IAAI,EAAO,EAAI,GAS1D,SAAS,EAAc,EAAqD,CAC1E,OAAO,EAAO,WAAW,KAAM,GAAM,EAAE,OAAS,cAAc,EAAI,GAcpE,SAAgB,EACd,EACA,EAC0B,CAC1B,IAAM,EAAoC,EAAE,CAE5C,IAAK,IAAM,KAAU,EACnB,EAAQ,EAAO,MAAQ,EAAc,EAAO,CACxC,CAAC,OAAQ,SAAU,SAAU,SAAU,UAAU,CACjD,CAAC,OAAQ,SAAU,SAAU,SAAS,CAG5C,GAAI,MACG,IAAM,KAAS,EACd,EAAM,UAAY,EAAM,SAAW,EAAE,EAAM,YAAY,KACzD,EAAQ,EAAM,UAAY,CAAC,GAAG,EAAM,QAAQ,EAKlD,OAAO,EAQT,MAAM,EAAmB,CACvB,KAAM,CACJ,SACA,OACA,WACA,MACA,cACA,SACA,eACA,MACA,SACD,CACD,QAAS,CAAC,OAAQ,SAAU,SAAS,CACtC,CASD,SAAgB,EAAgB,EAAoB,CAClD,IAAM,EAA+C,CACnD,GAAG,EACJ,CACD,IAAK,IAAM,KAAU,EACnB,EAAU,EAAO,MAAQ,EAAc,EAAO,CAAG,EAAuB,EAE1E,OAAO,EAST,SAAgB,EAAkB,EAA4C,EAAoB,CAChG,IAAM,EAAuC,EAAE,CACzC,EAA+C,EAAE,CAGvD,EAAW,KAAO,CAAC,GAAG,EAAiB,KAAK,CAC5C,EAAW,QAAU,CAAC,GAAG,EAAiB,QAAQ,CAElD,EAAmB,KAAO,EAAE,CAC5B,EAAmB,QAAU,EAAE,CAE/B,IAAK,IAAM,KAAU,EACnB,EAAW,EAAO,MAAQ,EAAc,EAAO,CAC3C,CAAC,OAAQ,SAAU,SAAU,SAAU,UAAU,CACjD,CAAC,OAAQ,SAAU,SAAU,SAAS,CAC1C,EAAmB,EAAO,MAAQ,CAAC,OAAO,CAG5C,MAAO,CACL,MAAO,EAAG,QAAQ,EAAW,CAC7B,cAAe,EAAG,QAAQ,EAAmB,CAC9C"}

package/dist/plugin-BS-ho4BN.d.mts

@@ -0,0 +1,90 @@
+import { Auth, BetterAuthPlugin } from "better-auth";
+import { Plugin } from "@murumets-ee/core";
+//#region src/types.d.ts
+/**
+ * Auth plugin configuration
+ */
+interface AuthConfig {
+  /** Auth providers to enable. Default: ['email'] */
+  providers?: ('email' | 'google' | 'github')[];
+  /** OAuth credentials (required when using social providers) */
+  social?: {
+    google?: {
+      clientId: string;
+      clientSecret: string;
+    };
+    github?: {
+      clientId: string;
+      clientSecret: string;
+    };
+  };
+  /** Session configuration */
+  session?: {
+    /** Session lifetime in seconds. Default: 7200 (2 hours) */expiresIn?: number; /** How often to refresh the session in seconds. Default: 3600 (1 hour) */
+    updateAge?: number;
+  };
+  /** Enable organization/multi-tenant support (maps to entity scope: 'team') */
+  organizations?: boolean;
+  /**
+   * Drizzle schema objects for the auth tables.
+   *
+   * Defaults to the canonical schema pre-baked in
+   * `@murumets-ee/auth/schema`. Override only if you're extending
+   * better-auth with custom plugins that add their own tables.
+   */
+  schema?: Record<string, unknown>;
+  /**
+   * Additional better-auth plugins to include.
+   * Use this for plugins not managed by the toolkit (e.g., twoFactor, magicLink).
+   */
+  betterAuthPlugins?: BetterAuthPlugin[];
+  /**
+   * Audit logging for auth events (login, signup, user update, ban, etc.).
+   * Enabled by default — writes to the toolkit_audit_logs table.
+   * Set to `false` to disable.
+   */
+  audit?: false;
+}
+//#endregion
+//#region src/server.d.ts
+/** Type of the auth server instance. Aliased from better-auth's generic
+ *  `Auth` because the explicit annotation on `createAuthServer` means
+ *  `ReturnType<typeof createAuthServer>` is already `BetterAuthBase`. */
+type Auth$1 = Auth;
+//#endregion
+//#region src/plugin.d.ts
+/**
+ * Get the auth server instance.
+ * Throws if the auth plugin hasn't been initialized yet.
+ *
+ * @example
+ * ```typescript
+ * // app/api/auth/[...all]/route.ts (user writes this)
+ * import { toNextJsHandler } from 'better-auth/next-js'
+ * import { getAuth } from '@murumets-ee/auth'
+ *
+ * export const { GET, POST } = toNextJsHandler(getAuth())
+ * ```
+ */
+declare function getAuth(): Auth$1;
+/**
+ * Create the auth toolkit plugin.
+ *
+ * @example
+ * ```typescript
+ * import { defineConfig } from '@murumets-ee/core'
+ * import { auth } from '@murumets-ee/auth'
+ *
+ * export default defineConfig({
+ *   db: { url: process.env.DATABASE_URL! },
+ *   entities: [Article, Category],
+ *   plugins: [
+ *     auth({ providers: ['email'] }),
+ *   ],
+ * })
+ * ```
+ */
+declare function auth(config?: AuthConfig): Plugin;
+//#endregion
+export { AuthConfig as i, getAuth as n, Auth$1 as r, auth as t };
+//# sourceMappingURL=plugin-BS-ho4BN.d.mts.map

package/dist/plugin-BS-ho4BN.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-BS-ho4BN.d.mts","names":[],"sources":["../src/types.ts","../src/server.ts","../src/plugin.ts"],"mappings":";;;;;;UAKiB,UAAA;EAAA;EAEf,SAAA;;EAGA,MAAA;IACE,MAAA;MAAW,QAAA;MAAkB,YAAA;IAAA;IAC7B,MAAA;MAAW,QAAA;MAAkB,YAAA;IAAA;EAAA;EAM7B;EAFF,OAAA;IAQA,2DANE,SAAA,WAeO;IAbP,SAAA;EAAA;EA0BF;EAtBA,aAAA;EAsBK;;;;AC4UP;;;EDzVE,MAAA,GAAS,MAAA;ECyVsB;;;;EDnV/B,iBAAA,GAAoB,gBAAA;EEFC;;;;AAwBvB;EFfE,KAAA;AAAA;;;AC4UF;;;AAAA,KAAY,MAAA,GAAO,IAAA;;;;;;;;;;;;;;;;iBCrVH,OAAA,CAAA,GAAW,MAAA;;;;;;;;;ADqV3B;;;;;;;;ACrVA;iBAwBgB,IAAA,CAAK,MAAA,GAAQ,UAAA,GAAkB,MAAA"}

package/dist/plugin.d.mts

@@ -0,0 +1,2 @@
+import { n as getAuth, t as auth } from "./plugin-BS-ho4BN.mjs";
+export { auth, getAuth };

package/dist/plugin.mjs

@@ -0,0 +1,2 @@
+import{a as e,f as t,m as n,r,s as i,t as a,u as o}from"./schema-Je6e5yt2.mjs";let s=null;function c(){if(!s)throw Error(`@murumets-ee/auth not initialized. Add auth() to your toolkit config plugins.`);return s}function l(c={}){return{name:`@murumets-ee/auth`,tables:{user:t,session:o,account:a,verification:n,organization:i,member:e,invitation:r},init:async e=>{let{createAuthServer:t}=await import(`./server-B7Gdv2He.mjs`),n;if(c.audit!==!1){let{createAuditLogger:t,createAuditDbWriter:r,createLogger:i}=await import(`@murumets-ee/logging`);n=t({logger:i({name:`auth-audit`}),dbWriter:r(e.db.readWrite)})}s=t(c,e,n),e.logger.info(`Auth plugin initialized`)}}}export{l as auth,c as getAuth};
+//# sourceMappingURL=plugin.mjs.map

package/dist/plugin.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.mjs","names":[],"sources":["../src/plugin.ts"],"sourcesContent":["/**\n * Toolkit plugin implementation for @murumets-ee/auth.\n *\n * Implements the Plugin interface from @murumets-ee/core.\n * Creates and stores the better-auth server instance during init.\n */\n\nimport type { Plugin } from '@murumets-ee/core'\nimport type { AuditLogger } from '@murumets-ee/logging'\nimport {\n  account,\n  invitation,\n  member,\n  organization,\n  session,\n  user,\n  verification,\n} from './schema.js'\nimport type { Auth } from './server.js'\nimport type { AuthConfig } from './types.js'\n\n/** The initialized auth server instance (set during plugin init) */\nlet _auth: Auth | null = null\n\n/**\n * Get the auth server instance.\n * Throws if the auth plugin hasn't been initialized yet.\n *\n * @example\n * ```typescript\n * // app/api/auth/[...all]/route.ts (user writes this)\n * import { toNextJsHandler } from 'better-auth/next-js'\n * import { getAuth } from '@murumets-ee/auth'\n *\n * export const { GET, POST } = toNextJsHandler(getAuth())\n * ```\n */\nexport function getAuth(): Auth {\n  if (!_auth) {\n    throw new Error('@murumets-ee/auth not initialized. Add auth() to your toolkit config plugins.')\n  }\n  return _auth\n}\n\n/**\n * Create the auth toolkit plugin.\n *\n * @example\n * ```typescript\n * import { defineConfig } from '@murumets-ee/core'\n * import { auth } from '@murumets-ee/auth'\n *\n * export default defineConfig({\n *   db: { url: process.env.DATABASE_URL! },\n *   entities: [Article, Category],\n *   plugins: [\n *     auth({ providers: ['email'] }),\n *   ],\n * })\n * ```\n */\nexport function auth(config: AuthConfig = {}): Plugin {\n  return {\n    name: '@murumets-ee/auth',\n    // Expose better-auth's Drizzle tables so `lumi migrate` picks them up\n    // automatically. The canonical schema lives in\n    // `@murumets-ee/auth/schema` — committed, not codegen-generated.\n    tables: { user, session, account, verification, organization, member, invitation },\n    init: async (app) => {\n      const { createAuthServer } = await import('./server.js')\n\n      // Create audit logger for auth events (login, signup, ban, etc.)\n      // unless explicitly disabled via `audit: false`\n      let auditLogger: AuditLogger | undefined\n      if (config.audit !== false) {\n        const { createAuditLogger, createAuditDbWriter, createLogger } = await import(\n          '@murumets-ee/logging'\n        )\n        auditLogger = createAuditLogger({\n          logger: createLogger({ name: 'auth-audit' }),\n          dbWriter: createAuditDbWriter(app.db.readWrite),\n        })\n      }\n\n      _auth = createAuthServer(config, app, auditLogger)\n      app.logger.info('Auth plugin initialized')\n    },\n  }\n}\n"],"mappings":"+EAsBA,IAAI,EAAqB,KAezB,SAAgB,GAAgB,CAC9B,GAAI,CAAC,EACH,MAAU,MAAM,gFAAgF,CAElG,OAAO,EAoBT,SAAgB,EAAK,EAAqB,EAAE,CAAU,CACpD,MAAO,CACL,KAAM,oBAIN,OAAQ,CAAE,OAAM,UAAS,UAAS,eAAc,eAAc,SAAQ,aAAY,CAClF,KAAM,KAAO,IAAQ,CACnB,GAAM,CAAE,oBAAqB,MAAM,OAAO,yBAItC,EACJ,GAAI,EAAO,QAAU,GAAO,CAC1B,GAAM,CAAE,oBAAmB,sBAAqB,gBAAiB,MAAM,OACrE,wBAEF,EAAc,EAAkB,CAC9B,OAAQ,EAAa,CAAE,KAAM,aAAc,CAAC,CAC5C,SAAU,EAAoB,EAAI,GAAG,UAAU,CAChD,CAAC,CAGJ,EAAQ,EAAiB,EAAQ,EAAK,EAAY,CAClD,EAAI,OAAO,KAAK,0BAA0B,EAE7C"}

package/dist/schema-Je6e5yt2.mjs

@@ -0,0 +1,2 @@
+import{relations as e}from"drizzle-orm";import{boolean as t,index as n,pgTable as r,text as i,timestamp as a,uniqueIndex as o}from"drizzle-orm/pg-core";var s=Object.defineProperty,c=((e,t)=>{let n={};for(var r in e)s(n,r,{get:e[r],enumerable:!0});return t||s(n,Symbol.toStringTag,{value:`Module`}),n})({account:()=>d,accountRelations:()=>v,invitation:()=>h,invitationRelations:()=>x,member:()=>m,memberRelations:()=>b,organization:()=>p,organizationRelations:()=>y,session:()=>u,sessionRelations:()=>_,user:()=>l,userRelations:()=>g,verification:()=>f});const l=r(`user`,{id:i(`id`).primaryKey(),name:i(`name`).notNull(),email:i(`email`).notNull().unique(),emailVerified:t(`email_verified`).default(!1).notNull(),image:i(`image`),createdAt:a(`created_at`).defaultNow().notNull(),updatedAt:a(`updated_at`).defaultNow().$onUpdate(()=>new Date).notNull(),role:i(`role`),banned:t(`banned`).default(!1),banReason:i(`ban_reason`),banExpires:a(`ban_expires`)}),u=r(`session`,{id:i(`id`).primaryKey(),expiresAt:a(`expires_at`).notNull(),token:i(`token`).notNull().unique(),createdAt:a(`created_at`).defaultNow().notNull(),updatedAt:a(`updated_at`).$onUpdate(()=>new Date).notNull(),ipAddress:i(`ip_address`),userAgent:i(`user_agent`),userId:i(`user_id`).notNull().references(()=>l.id,{onDelete:`cascade`}),impersonatedBy:i(`impersonated_by`),activeOrganizationId:i(`active_organization_id`)},e=>[n(`session_userId_idx`).on(e.userId)]),d=r(`account`,{id:i(`id`).primaryKey(),accountId:i(`account_id`).notNull(),providerId:i(`provider_id`).notNull(),userId:i(`user_id`).notNull().references(()=>l.id,{onDelete:`cascade`}),accessToken:i(`access_token`),refreshToken:i(`refresh_token`),idToken:i(`id_token`),accessTokenExpiresAt:a(`access_token_expires_at`),refreshTokenExpiresAt:a(`refresh_token_expires_at`),scope:i(`scope`),password:i(`password`),createdAt:a(`created_at`).defaultNow().notNull(),updatedAt:a(`updated_at`).$onUpdate(()=>new Date).notNull()},e=>[n(`account_userId_idx`).on(e.userId)]),f=r(`verification`,{id:i(`id`).primaryKey(),identifier:i(`identifier`).notNull(),value:i(`value`).notNull(),expiresAt:a(`expires_at`).notNull(),createdAt:a(`created_at`).defaultNow().notNull(),updatedAt:a(`updated_at`).defaultNow().$onUpdate(()=>new Date).notNull()},e=>[n(`verification_identifier_idx`).on(e.identifier)]),p=r(`organization`,{id:i(`id`).primaryKey(),name:i(`name`).notNull(),slug:i(`slug`).notNull().unique(),logo:i(`logo`),createdAt:a(`created_at`).notNull(),metadata:i(`metadata`)},e=>[o(`organization_slug_uidx`).on(e.slug)]),m=r(`member`,{id:i(`id`).primaryKey(),organizationId:i(`organization_id`).notNull().references(()=>p.id,{onDelete:`cascade`}),userId:i(`user_id`).notNull().references(()=>l.id,{onDelete:`cascade`}),role:i(`role`).default(`member`).notNull(),createdAt:a(`created_at`).notNull()},e=>[n(`member_organizationId_idx`).on(e.organizationId),n(`member_userId_idx`).on(e.userId)]),h=r(`invitation`,{id:i(`id`).primaryKey(),organizationId:i(`organization_id`).notNull().references(()=>p.id,{onDelete:`cascade`}),email:i(`email`).notNull(),role:i(`role`),status:i(`status`).default(`pending`).notNull(),expiresAt:a(`expires_at`).notNull(),createdAt:a(`created_at`).defaultNow().notNull(),inviterId:i(`inviter_id`).notNull().references(()=>l.id,{onDelete:`cascade`})},e=>[n(`invitation_organizationId_idx`).on(e.organizationId),n(`invitation_email_idx`).on(e.email)]),g=e(l,({many:e})=>({sessions:e(u),accounts:e(d),members:e(m),invitations:e(h)})),_=e(u,({one:e})=>({user:e(l,{fields:[u.userId],references:[l.id]})})),v=e(d,({one:e})=>({user:e(l,{fields:[d.userId],references:[l.id]})})),y=e(p,({many:e})=>({members:e(m),invitations:e(h)})),b=e(m,({one:e})=>({organization:e(p,{fields:[m.organizationId],references:[p.id]}),user:e(l,{fields:[m.userId],references:[l.id]})})),x=e(h,({one:e})=>({organization:e(p,{fields:[h.organizationId],references:[p.id]}),user:e(l,{fields:[h.inviterId],references:[l.id]})}));export{m as a,y as c,_ as d,l as f,x as i,c as l,f as m,v as n,b as o,g as p,h as r,p as s,d as t,u};
+//# sourceMappingURL=schema-Je6e5yt2.mjs.map

package/dist/schema-Je6e5yt2.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-Je6e5yt2.mjs","names":[],"sources":["../src/schema.ts"],"sourcesContent":["/**\n * Pre-generated Drizzle schema for better-auth tables.\n *\n * This file is the canonical snapshot of every table better-auth's\n * `admin` and `organization` plugins create when configured with the\n * toolkit's default server. It is committed source — NOT generated at\n * `lumi setup` time — so scaffolded projects don't need to invoke\n * `@better-auth/cli generate`, don't need a separate `auth.config.ts`,\n * and don't carry a `generated/auth-schema.ts` file in their repo.\n *\n * Regenerating this file:\n *\n *   1. Only when bumping better-auth or changing the plugin list in\n *      `packages/auth/src/server.ts`.\n *   2. Run `pnpm --filter @murumets-ee/auth gen:schema` (which runs\n *      `@better-auth/cli generate` against `scripts/schema-source.ts`)\n *      and review the diff.\n *   3. Commit.\n *\n * Consumers: `import * as authSchema from '@murumets-ee/auth/schema'`\n * and pass it directly to drizzle-kit/api's `generateDrizzleJson`.\n */\n\nimport { relations } from 'drizzle-orm'\nimport { boolean, index, pgTable, text, timestamp, uniqueIndex } from 'drizzle-orm/pg-core'\n\nexport const user = pgTable('user', {\n  id: text('id').primaryKey(),\n  name: text('name').notNull(),\n  email: text('email').notNull().unique(),\n  emailVerified: boolean('email_verified').default(false).notNull(),\n  image: text('image'),\n  createdAt: timestamp('created_at').defaultNow().notNull(),\n  updatedAt: timestamp('updated_at')\n    .defaultNow()\n    .$onUpdate(() => /* @__PURE__ */ new Date())\n    .notNull(),\n  role: text('role'),\n  banned: boolean('banned').default(false),\n  banReason: text('ban_reason'),\n  banExpires: timestamp('ban_expires'),\n})\n\nexport const session = pgTable(\n  'session',\n  {\n    id: text('id').primaryKey(),\n    expiresAt: timestamp('expires_at').notNull(),\n    token: text('token').notNull().unique(),\n    createdAt: timestamp('created_at').defaultNow().notNull(),\n    updatedAt: timestamp('updated_at')\n      .$onUpdate(() => /* @__PURE__ */ new Date())\n      .notNull(),\n    ipAddress: text('ip_address'),\n    userAgent: text('user_agent'),\n    userId: text('user_id')\n      .notNull()\n      .references(() => user.id, { onDelete: 'cascade' }),\n    impersonatedBy: text('impersonated_by'),\n    activeOrganizationId: text('active_organization_id'),\n  },\n  (table) => [index('session_userId_idx').on(table.userId)],\n)\n\nexport const account = pgTable(\n  'account',\n  {\n    id: text('id').primaryKey(),\n    accountId: text('account_id').notNull(),\n    providerId: text('provider_id').notNull(),\n    userId: text('user_id')\n      .notNull()\n      .references(() => user.id, { onDelete: 'cascade' }),\n    accessToken: text('access_token'),\n    refreshToken: text('refresh_token'),\n    idToken: text('id_token'),\n    accessTokenExpiresAt: timestamp('access_token_expires_at'),\n    refreshTokenExpiresAt: timestamp('refresh_token_expires_at'),\n    scope: text('scope'),\n    password: text('password'),\n    createdAt: timestamp('created_at').defaultNow().notNull(),\n    updatedAt: timestamp('updated_at')\n      .$onUpdate(() => /* @__PURE__ */ new Date())\n      .notNull(),\n  },\n  (table) => [index('account_userId_idx').on(table.userId)],\n)\n\nexport const verification = pgTable(\n  'verification',\n  {\n    id: text('id').primaryKey(),\n    identifier: text('identifier').notNull(),\n    value: text('value').notNull(),\n    expiresAt: timestamp('expires_at').notNull(),\n    createdAt: timestamp('created_at').defaultNow().notNull(),\n    updatedAt: timestamp('updated_at')\n      .defaultNow()\n      .$onUpdate(() => /* @__PURE__ */ new Date())\n      .notNull(),\n  },\n  (table) => [index('verification_identifier_idx').on(table.identifier)],\n)\n\nexport const organization = pgTable(\n  'organization',\n  {\n    id: text('id').primaryKey(),\n    name: text('name').notNull(),\n    slug: text('slug').notNull().unique(),\n    logo: text('logo'),\n    createdAt: timestamp('created_at').notNull(),\n    metadata: text('metadata'),\n  },\n  (table) => [uniqueIndex('organization_slug_uidx').on(table.slug)],\n)\n\nexport const member = pgTable(\n  'member',\n  {\n    id: text('id').primaryKey(),\n    organizationId: text('organization_id')\n      .notNull()\n      .references(() => organization.id, { onDelete: 'cascade' }),\n    userId: text('user_id')\n      .notNull()\n      .references(() => user.id, { onDelete: 'cascade' }),\n    role: text('role').default('member').notNull(),\n    createdAt: timestamp('created_at').notNull(),\n  },\n  (table) => [\n    index('member_organizationId_idx').on(table.organizationId),\n    index('member_userId_idx').on(table.userId),\n  ],\n)\n\nexport const invitation = pgTable(\n  'invitation',\n  {\n    id: text('id').primaryKey(),\n    organizationId: text('organization_id')\n      .notNull()\n      .references(() => organization.id, { onDelete: 'cascade' }),\n    email: text('email').notNull(),\n    role: text('role'),\n    status: text('status').default('pending').notNull(),\n    expiresAt: timestamp('expires_at').notNull(),\n    createdAt: timestamp('created_at').defaultNow().notNull(),\n    inviterId: text('inviter_id')\n      .notNull()\n      .references(() => user.id, { onDelete: 'cascade' }),\n  },\n  (table) => [\n    index('invitation_organizationId_idx').on(table.organizationId),\n    index('invitation_email_idx').on(table.email),\n  ],\n)\n\nexport const userRelations = relations(user, ({ many }) => ({\n  sessions: many(session),\n  accounts: many(account),\n  members: many(member),\n  invitations: many(invitation),\n}))\n\nexport const sessionRelations = relations(session, ({ one }) => ({\n  user: one(user, {\n    fields: [session.userId],\n    references: [user.id],\n  }),\n}))\n\nexport const accountRelations = relations(account, ({ one }) => ({\n  user: one(user, {\n    fields: [account.userId],\n    references: [user.id],\n  }),\n}))\n\nexport const organizationRelations = relations(organization, ({ many }) => ({\n  members: many(member),\n  invitations: many(invitation),\n}))\n\nexport const memberRelations = relations(member, ({ one }) => ({\n  organization: one(organization, {\n    fields: [member.organizationId],\n    references: [organization.id],\n  }),\n  user: one(user, {\n    fields: [member.userId],\n    references: [user.id],\n  }),\n}))\n\nexport const invitationRelations = relations(invitation, ({ one }) => ({\n  organization: one(organization, {\n    fields: [invitation.organizationId],\n    references: [organization.id],\n  }),\n  user: one(user, {\n    fields: [invitation.inviterId],\n    references: [user.id],\n  }),\n}))\n"],"mappings":"0iBA0BA,MAAa,EAAO,EAAQ,OAAQ,CAClC,GAAI,EAAK,KAAK,CAAC,YAAY,CAC3B,KAAM,EAAK,OAAO,CAAC,SAAS,CAC5B,MAAO,EAAK,QAAQ,CAAC,SAAS,CAAC,QAAQ,CACvC,cAAe,EAAQ,iBAAiB,CAAC,QAAQ,GAAM,CAAC,SAAS,CACjE,MAAO,EAAK,QAAQ,CACpB,UAAW,EAAU,aAAa,CAAC,YAAY,CAAC,SAAS,CACzD,UAAW,EAAU,aAAa,CAC/B,YAAY,CACZ,cAAgC,IAAI,KAAO,CAC3C,SAAS,CACZ,KAAM,EAAK,OAAO,CAClB,OAAQ,EAAQ,SAAS,CAAC,QAAQ,GAAM,CACxC,UAAW,EAAK,aAAa,CAC7B,WAAY,EAAU,cAAc,CACrC,CAAC,CAEW,EAAU,EACrB,UACA,CACE,GAAI,EAAK,KAAK,CAAC,YAAY,CAC3B,UAAW,EAAU,aAAa,CAAC,SAAS,CAC5C,MAAO,EAAK,QAAQ,CAAC,SAAS,CAAC,QAAQ,CACvC,UAAW,EAAU,aAAa,CAAC,YAAY,CAAC,SAAS,CACzD,UAAW,EAAU,aAAa,CAC/B,cAAgC,IAAI,KAAO,CAC3C,SAAS,CACZ,UAAW,EAAK,aAAa,CAC7B,UAAW,EAAK,aAAa,CAC7B,OAAQ,EAAK,UAAU,CACpB,SAAS,CACT,eAAiB,EAAK,GAAI,CAAE,SAAU,UAAW,CAAC,CACrD,eAAgB,EAAK,kBAAkB,CACvC,qBAAsB,EAAK,yBAAyB,CACrD,CACA,GAAU,CAAC,EAAM,qBAAqB,CAAC,GAAG,EAAM,OAAO,CAAC,CAC1D,CAEY,EAAU,EACrB,UACA,CACE,GAAI,EAAK,KAAK,CAAC,YAAY,CAC3B,UAAW,EAAK,aAAa,CAAC,SAAS,CACvC,WAAY,EAAK,cAAc,CAAC,SAAS,CACzC,OAAQ,EAAK,UAAU,CACpB,SAAS,CACT,eAAiB,EAAK,GAAI,CAAE,SAAU,UAAW,CAAC,CACrD,YAAa,EAAK,eAAe,CACjC,aAAc,EAAK,gBAAgB,CACnC,QAAS,EAAK,WAAW,CACzB,qBAAsB,EAAU,0BAA0B,CAC1D,sBAAuB,EAAU,2BAA2B,CAC5D,MAAO,EAAK,QAAQ,CACpB,SAAU,EAAK,WAAW,CAC1B,UAAW,EAAU,aAAa,CAAC,YAAY,CAAC,SAAS,CACzD,UAAW,EAAU,aAAa,CAC/B,cAAgC,IAAI,KAAO,CAC3C,SAAS,CACb,CACA,GAAU,CAAC,EAAM,qBAAqB,CAAC,GAAG,EAAM,OAAO,CAAC,CAC1D,CAEY,EAAe,EAC1B,eACA,CACE,GAAI,EAAK,KAAK,CAAC,YAAY,CAC3B,WAAY,EAAK,aAAa,CAAC,SAAS,CACxC,MAAO,EAAK,QAAQ,CAAC,SAAS,CAC9B,UAAW,EAAU,aAAa,CAAC,SAAS,CAC5C,UAAW,EAAU,aAAa,CAAC,YAAY,CAAC,SAAS,CACzD,UAAW,EAAU,aAAa,CAC/B,YAAY,CACZ,cAAgC,IAAI,KAAO,CAC3C,SAAS,CACb,CACA,GAAU,CAAC,EAAM,8BAA8B,CAAC,GAAG,EAAM,WAAW,CAAC,CACvE,CAEY,EAAe,EAC1B,eACA,CACE,GAAI,EAAK,KAAK,CAAC,YAAY,CAC3B,KAAM,EAAK,OAAO,CAAC,SAAS,CAC5B,KAAM,EAAK,OAAO,CAAC,SAAS,CAAC,QAAQ,CACrC,KAAM,EAAK,OAAO,CAClB,UAAW,EAAU,aAAa,CAAC,SAAS,CAC5C,SAAU,EAAK,WAAW,CAC3B,CACA,GAAU,CAAC,EAAY,yBAAyB,CAAC,GAAG,EAAM,KAAK,CAAC,CAClE,CAEY,EAAS,EACpB,SACA,CACE,GAAI,EAAK,KAAK,CAAC,YAAY,CAC3B,eAAgB,EAAK,kBAAkB,CACpC,SAAS,CACT,eAAiB,EAAa,GAAI,CAAE,SAAU,UAAW,CAAC,CAC7D,OAAQ,EAAK,UAAU,CACpB,SAAS,CACT,eAAiB,EAAK,GAAI,CAAE,SAAU,UAAW,CAAC,CACrD,KAAM,EAAK,OAAO,CAAC,QAAQ,SAAS,CAAC,SAAS,CAC9C,UAAW,EAAU,aAAa,CAAC,SAAS,CAC7C,CACA,GAAU,CACT,EAAM,4BAA4B,CAAC,GAAG,EAAM,eAAe,CAC3D,EAAM,oBAAoB,CAAC,GAAG,EAAM,OAAO,CAC5C,CACF,CAEY,EAAa,EACxB,aACA,CACE,GAAI,EAAK,KAAK,CAAC,YAAY,CAC3B,eAAgB,EAAK,kBAAkB,CACpC,SAAS,CACT,eAAiB,EAAa,GAAI,CAAE,SAAU,UAAW,CAAC,CAC7D,MAAO,EAAK,QAAQ,CAAC,SAAS,CAC9B,KAAM,EAAK,OAAO,CAClB,OAAQ,EAAK,SAAS,CAAC,QAAQ,UAAU,CAAC,SAAS,CACnD,UAAW,EAAU,aAAa,CAAC,SAAS,CAC5C,UAAW,EAAU,aAAa,CAAC,YAAY,CAAC,SAAS,CACzD,UAAW,EAAK,aAAa,CAC1B,SAAS,CACT,eAAiB,EAAK,GAAI,CAAE,SAAU,UAAW,CAAC,CACtD,CACA,GAAU,CACT,EAAM,gCAAgC,CAAC,GAAG,EAAM,eAAe,CAC/D,EAAM,uBAAuB,CAAC,GAAG,EAAM,MAAM,CAC9C,CACF,CAEY,EAAgB,EAAU,GAAO,CAAE,WAAY,CAC1D,SAAU,EAAK,EAAQ,CACvB,SAAU,EAAK,EAAQ,CACvB,QAAS,EAAK,EAAO,CACrB,YAAa,EAAK,EAAW,CAC9B,EAAE,CAEU,EAAmB,EAAU,GAAU,CAAE,UAAW,CAC/D,KAAM,EAAI,EAAM,CACd,OAAQ,CAAC,EAAQ,OAAO,CACxB,WAAY,CAAC,EAAK,GAAG,CACtB,CAAC,CACH,EAAE,CAEU,EAAmB,EAAU,GAAU,CAAE,UAAW,CAC/D,KAAM,EAAI,EAAM,CACd,OAAQ,CAAC,EAAQ,OAAO,CACxB,WAAY,CAAC,EAAK,GAAG,CACtB,CAAC,CACH,EAAE,CAEU,EAAwB,EAAU,GAAe,CAAE,WAAY,CAC1E,QAAS,EAAK,EAAO,CACrB,YAAa,EAAK,EAAW,CAC9B,EAAE,CAEU,EAAkB,EAAU,GAAS,CAAE,UAAW,CAC7D,aAAc,EAAI,EAAc,CAC9B,OAAQ,CAAC,EAAO,eAAe,CAC/B,WAAY,CAAC,EAAa,GAAG,CAC9B,CAAC,CACF,KAAM,EAAI,EAAM,CACd,OAAQ,CAAC,EAAO,OAAO,CACvB,WAAY,CAAC,EAAK,GAAG,CACtB,CAAC,CACH,EAAE,CAEU,EAAsB,EAAU,GAAa,CAAE,UAAW,CACrE,aAAc,EAAI,EAAc,CAC9B,OAAQ,CAAC,EAAW,eAAe,CACnC,WAAY,CAAC,EAAa,GAAG,CAC9B,CAAC,CACF,KAAM,EAAI,EAAM,CACd,OAAQ,CAAC,EAAW,UAAU,CAC9B,WAAY,CAAC,EAAK,GAAG,CACtB,CAAC,CACH,EAAE"}