@nextsparkjs/core 0.1.0-beta.19 → 0.1.0-beta.190

package/dist/lib/config/types.d.ts

@@ -37,6 +37,12 @@ export interface TeamsConfig {
     mode: TeamsMode;
     /** Additional options */
     options?: TeamsConfigOptions;
+    /**
+     * Resolved team-role system (set, hierarchy, labels) for team_members.role.
+     * Themes declare the active set declaratively via `teams.roles` in app.config
+     * (REPLACE model); the merged value here is the fully resolved object.
+     */
+    roles?: TeamRolesConfig;
 }
 /**
  * Mobile Navigation Item
@@ -77,6 +83,13 @@ export interface MobileNavMoreItem {
     enabled: boolean;
     /** Whether this link opens in a new tab */
     external?: boolean;
+    /**
+     * Permission required to display this item.
+     * If set, the item is only shown to users who have this permission in the current team.
+     * If not set, the item is shown to all users (backward compatible).
+     * Example: 'schedules.list', 'analytics.list'
+     */
+    requiresPermission?: string;
 }
 /**
  * Mobile Navigation Configuration
@@ -123,46 +136,61 @@ export interface SettingsConfig {
 /**
  * Documentation Category Configuration
  *
- * Configuration for a single documentation category level (core, theme, or plugins).
+ * Settings for one documentation category.
+ *
+ * `DocsSidebar` reads `enabled` and `label` only when this object is
+ * `docs.public`. No component reads these settings when the object is
+ * `docs.superadmin`.
  */
 export interface DocsCategoryConfig {
-    /** Enable/disable this documentation level in the sidebar */
+    /**
+     * In `docs.public`, `false` prevents `DocsSidebar` from rendering. In
+     * `docs.superadmin`, this setting has no effect.
+     */
     enabled: boolean;
-    /** Whether this category should be expanded by default on page load */
-    open: boolean;
-    /** Custom label displayed in the sidebar for this category */
+    /** No component currently reads this setting. */
+    open?: boolean;
+    /**
+     * In `docs.public`, `DocsSidebar` renders this as its heading. In
+     * `docs.superadmin`, this setting has no effect.
+     */
     label: string;
 }
 /**
  * Documentation System Configuration
  *
- * Controls documentation system behavior including visibility,
- * search functionality, and category-specific settings.
+ * `publicAccess` controls whether the proxy serves `/docs` without a session.
+ * `public.enabled` and `public.label` configure `DocsSidebar`. The remaining
+ * settings are retained for configuration compatibility but have no effect.
+ *
+ * Structure:
+ * - public: User-facing documentation at /docs
+ * - superadmin: Admin documentation at /superadmin/docs
+ *
+ * NOTE: Plugin docs are NOT in the registry - they are for developer reference only (IDE/LLM).
  */
 export interface DocsConfig {
-    /** Enable/disable the entire documentation system */
-    enabled: boolean;
-    /** Make documentation publicly accessible (no auth required) */
-    public: boolean;
-    /** Enable search functionality in the sidebar */
-    searchEnabled: boolean;
-    /** Show breadcrumbs navigation in documentation pages */
-    breadcrumbs: boolean;
-    /** Theme documentation configuration */
-    theme?: DocsCategoryConfig;
-    /** Plugins documentation configuration */
-    plugins?: DocsCategoryConfig;
-    /** Core documentation configuration */
-    core?: DocsCategoryConfig;
+    /** No component, route, or proxy currently reads this setting. */
+    enabled?: boolean;
     /**
-     * Additional environment check for plugin docs in production
-     * Plugin docs will only show if BOTH conditions are met:
-     * 1. plugins.enabled is true
-     * 2. Either in development OR showPluginsDocsInProd is true
+     * The proxy serves `/docs` without a session unless this is `false`. A
+     * legacy boolean `public: false` also makes `/docs` require a session.
+     */
+    publicAccess?: boolean;
+    /** No component currently reads this setting. */
+    searchEnabled?: boolean;
+    /** No component currently reads this setting. */
+    breadcrumbs?: boolean;
+    /**
+     * Sidebar settings for `/docs`.
      *
-     * @deprecated Prefer using plugins.enabled for simpler control
+     * The boolean form is deprecated: it is the older way to say whether `/docs`
+     * needs a session. `public: false` still makes `/docs` require one; write
+     * `publicAccess` instead and keep `public` for the sidebar settings.
      */
-    showPluginsDocsInProd?: boolean;
+    public?: DocsCategoryConfig | boolean;
+    /** No component or route currently reads these `/superadmin/docs` settings. */
+    superadmin?: DocsCategoryConfig;
 }
 /**
  * DevKeyring User Configuration
@@ -263,6 +291,15 @@ export interface ScheduledActionsConfig {
     batchSize: number;
     /** Default timeout per action in milliseconds */
     defaultTimeout: number;
+    /**
+     * Maximum number of actions to execute in parallel.
+     * Actions are executed concurrently up to this limit.
+     * Default: 1 (sequential execution for backward compatibility)
+     *
+     * @example
+     * concurrencyLimit: 5 -> Up to 5 actions run simultaneously
+     */
+    concurrencyLimit?: number;
     /**
      * @deprecated Use webhooks.endpoints instead for multi-endpoint support
      * Legacy single webhook URL for backward compatibility
@@ -283,6 +320,300 @@ export interface ScheduledActionsConfig {
         windowSeconds: number;
     };
 }
+/**
+ * Media Library Configuration
+ *
+ * Controls file upload limits and accepted types for the media system.
+ * Themes can override these defaults in their app.config.ts.
+ */
+export interface MediaConfig {
+    /** Maximum upload file size in MB (general fallback) */
+    maxSizeMB: number;
+    /** Maximum image file size in MB (overrides maxSizeMB for images). Falls back to maxSizeMB if not set. */
+    maxSizeImageMB?: number;
+    /** Maximum video file size in MB (overrides maxSizeMB for videos). Falls back to maxSizeMB if not set. */
+    maxSizeVideoMB?: number;
+    /** Accepted MIME type patterns for the file input (e.g., ['image/*', 'video/*']) */
+    acceptedTypes: string[];
+    /** Specific MIME types allowed by the server-side upload endpoint */
+    allowedMimeTypes: string[];
+}
+/**
+ * Registration Mode
+ *
+ * Controls how new users can register in the application.
+ *
+ * - 'open': Anyone can register via email+password and Google OAuth (default)
+ * - 'domain-restricted': Only Google OAuth for specific email domains. No email+password signup.
+ *   Users with allowed domains are auto-created on first Google sign-in.
+ * - 'domain-open': Email+password AND Google OAuth, but restricted to specific email domains.
+ *   Both signup and login require an email from allowedDomains.
+ * - 'invitation-only': Registration only via invitation link. First user bootstraps the team;
+ *   subsequent users require an invite. Google OAuth is configurable.
+ */
+export type RegistrationMode = 'open' | 'domain-restricted' | 'domain-open' | 'invitation-only';
+/**
+ * Auth Registration Configuration
+ */
+export interface AuthRegistrationConfig {
+    /** Registration mode */
+    mode: RegistrationMode;
+    /**
+     * Allowed email domains for 'domain-restricted' mode.
+     * Only the domain part without @. e.g., ['nextspark.dev', 'mycompany.com']
+     * Ignored for other modes.
+     */
+    allowedDomains?: string[];
+}
+/**
+ * Auth Providers Configuration
+ */
+export interface AuthProvidersConfig {
+    google?: {
+        /**
+         * Whether Google OAuth button is shown in login/signup.
+         * Defaults to true when GOOGLE_CLIENT_ID env var is set.
+         */
+        enabled?: boolean;
+    };
+}
+/**
+ * Auth Configuration
+ *
+ * Controls authentication behavior including registration modes
+ * and provider visibility. Configured at theme level.
+ */
+/**
+ * Signup intent → initial team role mapping.
+ *
+ * When enabled, a signup request can carry an intent (the `x-signup-intent`
+ * header). After the user's team is auto-created, the intent is looked up in
+ * `roleMap`; if it names a configured team role, the user's membership in that
+ * team is set to that role. The mapping is app-controlled: only `roleMap` entries
+ * that name a configured team role take effect.
+ */
+export interface SignupIntentConfig {
+    /** Accept the `intent` field at signup and apply the role mapping. Default: false. */
+    enabled?: boolean;
+    /** intent value → initial team_member role (must be a configured team role). */
+    roleMap?: Record<string, string>;
+    /**
+     * When true, a signup whose intent maps (via `roleMap`) to a NON-owner team
+     * role creates NO auto-team at all: the account is intentionally team-less and
+     * operates as a plain authenticated user (e.g. a consumer who books but runs no
+     * team of their own). The resolved intent is recorded in `users_metas` under the
+     * `signup_intent` key so the application can distinguish a deliberately
+     * team-less account from a half-finished owner. Default: false — every signup
+     * gets a team and the non-owner role is applied to it (the prior behavior).
+     */
+    skipTeamForNonOwnerIntents?: boolean;
+}
+/**
+ * Built-in security email notifications (issue #75).
+ *
+ * Better Auth does not ship new-device / password-changed / email-changed
+ * emails. When enabled, the core auth route dispatches them best-effort after a
+ * successful sign-in / change-password / change-email. Themes brand or localize
+ * the emails via `registerSecurityEmailTemplate(type, locale, builder)` without
+ * forking core.
+ */
+export interface SecurityNotificationsConfig {
+    /** Master switch. When false the dispatcher is a complete no-op. */
+    enabled: boolean;
+    /** Per-event switches (all default on). */
+    events: {
+        /** Email on a sign-in from a never-seen device fingerprint. */
+        newDeviceLogin: boolean;
+        /** Email confirming a password change. */
+        passwordChanged: boolean;
+        /** Email to the OLD address when the account email is being changed. */
+        emailChanged: boolean;
+    };
+    /**
+     * How long a device fingerprint stays "known" before a re-login from it is
+     * treated as new again.
+     * - `null` (default): fingerprints never expire — one alert per device, ever.
+     * - a positive number of days: re-alert if the last matching login is older.
+     */
+    fingerprintTtlDays: number | null;
+}
+/**
+ * Session lifetime configuration (all values in seconds).
+ *
+ * Maps 1:1 to Better Auth's `session` options so a theme can tune session
+ * duration and renewal from its `app.config.ts` without patching the core:
+ *
+ * ```ts
+ * auth: {
+ *   session: {
+ *     expiresIn: 60 * 60 * 24 * 90, // 90 days — long-lived sessions for an installed PWA
+ *     updateAge: 60 * 60 * 24 * 7,  // extend the session (and re-issue the cookie) weekly
+ *   },
+ * }
+ * ```
+ *
+ * Invalid values (non-positive, NaN) fall back to the core defaults with a
+ * warning; `updateAge` is clamped to `expiresIn`. See
+ * `lib/auth/session-config.ts` for the resolution rules.
+ */
+export interface AuthSessionConfig {
+    /** Total session lifetime. Default: 7 days. */
+    expiresIn?: number;
+    /**
+     * How often a session that is actively used gets its expiration extended
+     * (rolling session). Default: 1 day, or `expiresIn / 2` when `expiresIn` is
+     * shorter than 2 days. Must be <= `expiresIn`.
+     */
+    updateAge?: number;
+    /**
+     * Cookie cache: serve the session from a short-lived signed cookie instead
+     * of hitting the database on every request.
+     */
+    cookieCache?: {
+        /** Default: true */
+        enabled?: boolean;
+        /** Cache lifetime. Default: 5 minutes. */
+        maxAge?: number;
+    };
+}
+/**
+ * Email OTP settings (`auth.otp`).
+ *
+ * Both values reach the client through `PUBLIC_AUTH_CONFIG.otp`: the login
+ * form counts the code down and sizes its input from them, so they stay a
+ * single source of truth rather than a literal repeated in the UI and in six
+ * translation files.
+ *
+ * Invalid values (non-positive, NaN, out-of-range length) fall back to the
+ * core defaults with a warning. See `lib/auth/otp-config.ts`.
+ */
+export interface AuthOtpConfig {
+    /** Lifetime of an emailed code, in seconds. Default: 300 (5 minutes). */
+    expiresIn?: number;
+    /** Digits per code, between 4 and 10. Default: 6. */
+    otpLength?: number;
+}
+/**
+ * Login methods an app can offer.
+ *
+ * - `'email-otp'`: passwordless — a 6-digit one-time code is emailed to the
+ *   user (Better Auth `emailOTP` plugin, sent through the configured email
+ *   provider — Resend in the default setup). A first sign-in creates the
+ *   account, so no separate signup form is needed.
+ * - `'google'`: Google OAuth (needs GOOGLE_CLIENT_ID / GOOGLE_CLIENT_SECRET;
+ *   also gated by `providers.google.enabled`).
+ * - `'email-password'`: classic email + password, with signup and
+ *   forgot/reset-password flows.
+ */
+export type AuthLoginMethod = 'email-otp' | 'google' | 'email-password';
+/**
+ * Named bundles of login methods (see `AUTH_PRESETS` in
+ * `lib/auth/auth-methods.ts`):
+ * - `'passwordless'`: `['email-otp', 'google']` — the DEFAULT. No password field.
+ * - `'classic'`: `['email-password', 'google']`.
+ */
+export type AuthPreset = 'passwordless' | 'classic';
+export interface AuthConfig {
+    /** Registration settings */
+    registration: AuthRegistrationConfig;
+    /**
+     * Login methods offered by the app, in priority order.
+     *
+     * Drives the login templates (web `LoginForm`, mobile login screen) and
+     * `PUBLIC_AUTH_CONFIG.methods`. The first email method in the list
+     * (`'email-otp'` or `'email-password'`) is the one the login form opens
+     * with; when both are listed the user can switch between them.
+     *
+     * Default: the passwordless preset `['email-otp', 'google']` — the login has
+     * no password field at all. Themes override it in their app.config.ts:
+     *
+     * ```ts
+     * auth: { methods: ['email-password', 'google'] }              // classic
+     * auth: { methods: ['email-otp', 'email-password', 'google'] } // both, OTP first
+     * ```
+     *
+     * This only shapes the UI and the signup page. Better Auth's password
+     * endpoints stay enabled unless `emailAndPassword.enabled` is set to false.
+     */
+    methods?: AuthLoginMethod[];
+    /**
+     * Server-side switch for Better Auth's email + password endpoints
+     * (`sign-in/email`, `sign-up/email`, forget/reset/change-password).
+     *
+     * Default: `true` — even under the passwordless preset — so existing
+     * password accounts, seeded test users and API-based logins keep working
+     * when a theme only changes the login UI. Set `{ enabled: false }` to
+     * hard-disable password auth for a strictly passwordless app.
+     */
+    emailAndPassword?: {
+        enabled?: boolean;
+    };
+    /**
+     * Session duration / renewal. Optional — every field falls back to the core
+     * defaults (7 days, renewed daily, 5-minute cookie cache).
+     */
+    session?: AuthSessionConfig;
+    /**
+     * Email OTP code lifetime / length. Optional — every field falls back to the
+     * core defaults (5 minutes, 6 digits).
+     */
+    otp?: AuthOtpConfig;
+    /** OAuth provider settings */
+    providers?: AuthProvidersConfig;
+    /** Built-in security email notifications (new-device / password / email changed). */
+    securityNotifications?: SecurityNotificationsConfig;
+    /**
+     * Whether Better Auth should automatically send the built-in
+     * verification email when a user signs up via `/api/auth/sign-up/email`.
+     *
+     * - `true` (default): preserves Better Auth's standard behavior — users
+     *   receive a "Verify Your Email Address" link email immediately on signup.
+     * - `false`: suppresses the automatic email. Use this when the project
+     *   verifies email ownership through other means (OTP code, invitation
+     *   token, claim-account flow, etc.) before or after signup.
+     *
+     * Note: this only controls the AUTOMATIC dispatch on signup.
+     * `requireEmailVerification: true` and the `sendVerificationEmail`
+     * function remain available regardless — projects can still trigger
+     * link-based verification explicitly when they need to.
+     */
+    sendVerificationEmailOnSignup?: boolean;
+    /** Map a signup `intent` to the initial team role of the user's auto-created team. */
+    signupIntent?: SignupIntentConfig;
+}
+/**
+ * Public Auth Config
+ *
+ * Subset of AuthConfig safe to expose to client components.
+ * Does NOT include allowedDomains (security: prevents domain enumeration).
+ */
+export interface PublicAuthConfig {
+    registration: {
+        mode: RegistrationMode;
+    };
+    providers: {
+        google: {
+            /** Google is offered: listed in `methods` AND not disabled in `providers`. */
+            enabled: boolean;
+        };
+    };
+    /** Resolved login methods, in priority order (see `AuthConfig.methods`). */
+    methods: AuthLoginMethod[];
+    /**
+     * Resolved email-OTP settings. The login form needs both: the deadline it
+     * counts down to, and the number of digits its input accepts.
+     *
+     * Optional because this is a published type: a config written against an
+     * earlier release still type-checks, and a reader without it falls back to
+     * DEFAULT_OTP_CONFIG.
+     */
+    otp?: {
+        /** Lifetime of an emailed code, in seconds. */
+        expiresIn: number;
+        /** Digits per code. */
+        otpLength: number;
+    };
+}
 /**
  * Complete Application Configuration
  *
@@ -299,9 +630,21 @@ export interface AppConfig {
     i18n: {
         supportedLocales: string[];
         defaultLocale: string;
+        /**
+         * Pick each request's locale from the locale cookie, the signed-in user's
+         * language and the Accept-Language header. Default: true. With `false`, or
+         * with a single supported locale, every page renders `defaultLocale` and
+         * nothing is read from the request, so pages can be prerendered.
+         */
+        localeDetection?: boolean;
         cookie: {
             name: string;
             maxAge: number;
+            /**
+             * Not applied: the locale cookie is always written readable, since client
+             * code rewrites it (a language switch, a sign-in, the account's language)
+             * and a script cannot replace a cookie written HttpOnly.
+             */
             httpOnly: boolean;
             secure: string | boolean;
             sameSite: 'lax' | 'strict' | 'none';
@@ -325,10 +668,12 @@ export interface AppConfig {
      * Use DEV_CONFIG from config-sync.ts instead.
      */
     devKeyring?: DevKeyringConfig;
-    /** Team roles configuration (for team_members.role) */
-    teamRoles?: TeamRolesConfig;
     /** Scheduled actions system configuration */
     scheduledActions?: ScheduledActionsConfig;
+    /** Media library configuration */
+    media?: MediaConfig;
+    /** Authentication and registration configuration */
+    auth?: AuthConfig;
     [key: string]: any;
 }
 /**

package/dist/lib/config/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/lib/config/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAE1C;;;;GAIG;AACH,MAAM,MAAM,SAAS,GACjB,aAAa,GACb,eAAe,GACf,cAAc,CAAA;AAElB;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,gDAAgD;IAChD,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,+BAA+B;IAC/B,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC,qCAAqC;IACrC,kBAAkB,CAAC,EAAE,OAAO,CAAA;IAC5B;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAA;CAC3B;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,iBAAiB;IACjB,IAAI,EAAE,SAAS,CAAA;IACf,yBAAyB;IACzB,OAAO,CAAC,EAAE,kBAAkB,CAAA;CAC7B;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,yCAAyC;IACzC,EAAE,EAAE,MAAM,CAAA;IAEV,oEAAoE;IACpE,QAAQ,EAAE,MAAM,CAAA;IAEhB,4DAA4D;IAC5D,IAAI,CAAC,EAAE,MAAM,CAAA;IAEb,kCAAkC;IAClC,IAAI,EAAE,QAAQ,CAAA;IAEd,2DAA2D;IAC3D,OAAO,EAAE,OAAO,CAAA;IAEhB,uEAAuE;IACvE,SAAS,CAAC,EAAE,OAAO,CAAA;IAEnB,8CAA8C;IAC9C,MAAM,CAAC,EAAE,aAAa,GAAG,WAAW,CAAA;CACrC;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,gDAAgD;IAChD,EAAE,EAAE,MAAM,CAAA;IAEV,oCAAoC;IACpC,QAAQ,EAAE,MAAM,CAAA;IAEhB,sBAAsB;IACtB,IAAI,EAAE,MAAM,CAAA;IAEZ,kCAAkC;IAClC,IAAI,EAAE,QAAQ,CAAA;IAEd,2DAA2D;IAC3D,OAAO,EAAE,OAAO,CAAA;IAEhB,2CAA2C;IAC3C,QAAQ,CAAC,EAAE,OAAO,CAAA;CACnB;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,kCAAkC;IAClC,KAAK,EAAE,aAAa,EAAE,CAAA;IAEtB,8CAA8C;IAC9C,cAAc,EAAE,iBAAiB,EAAE,CAAA;CACpC;AAED;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE;QACR,WAAW,EAAE,OAAO,CAAA;QACpB,MAAM,EAAE,OAAO,CAAA;QACf,aAAa,EAAE,OAAO,CAAA;QACtB,IAAI,EAAE,OAAO,CAAA;QACb,KAAK,EAAE,OAAO,CAAA;QACd,KAAK,EAAE,OAAO,CAAA;QACd,QAAQ,EAAE,OAAO,CAAA;KAClB,CAAA;CACF;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,OAAO,CAAA;IAChB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE;QACL,OAAO,EAAE,kBAAkB,CAAA;QAC3B,OAAO,EAAE,kBAAkB,CAAA;QAC3B,OAAO,EAAE,kBAAkB,CAAA;QAC3B,QAAQ,EAAE,kBAAkB,CAAA;KAC7B,CAAA;CACF;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,6DAA6D;IAC7D,OAAO,EAAE,OAAO,CAAA;IAEhB,uEAAuE;IACvE,IAAI,EAAE,OAAO,CAAA;IAEb,8DAA8D;IAC9D,KAAK,EAAE,MAAM,CAAA;CACd;AAED;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,qDAAqD;IACrD,OAAO,EAAE,OAAO,CAAA;IAEhB,gEAAgE;IAChE,MAAM,EAAE,OAAO,CAAA;IAEf,iDAAiD;IACjD,aAAa,EAAE,OAAO,CAAA;IAEtB,yDAAyD;IACzD,WAAW,EAAE,OAAO,CAAA;IAEpB,wCAAwC;IACxC,KAAK,CAAC,EAAE,kBAAkB,CAAA;IAE1B,0CAA0C;IAC1C,OAAO,CAAC,EAAE,kBAAkB,CAAA;IAE5B,uCAAuC;IACvC,IAAI,CAAC,EAAE,kBAAkB,CAAA;IAEzB;;;;;;;OAOG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAA;CAChC;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,qCAAqC;IACrC,EAAE,EAAE,MAAM,CAAA;IAEV,2BAA2B;IAC3B,KAAK,EAAE,MAAM,CAAA;IAEb,0BAA0B;IAC1B,IAAI,EAAE,MAAM,CAAA;IAEZ,sCAAsC;IACtC,QAAQ,EAAE,MAAM,CAAA;IAEhB,qEAAqE;IACrE,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,4CAA4C;IAC5C,OAAO,EAAE,OAAO,CAAA;IAEhB,mDAAmD;IACnD,KAAK,EAAE,cAAc,EAAE,CAAA;CACxB;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,eAAe;IAC9B,8DAA8D;IAC9D,aAAa,EAAE,SAAS,MAAM,EAAE,CAAA;IAEhC,wCAAwC;IACxC,eAAe,EAAE,MAAM,CAAA;IAEvB,+BAA+B;IAC/B,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAA;IAErC,6DAA6D;IAC7D,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAEjC,4CAA4C;IAC5C,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAEpC,wBAAwB;IACxB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACrC;AAED;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,4EAA4E;IAC5E,MAAM,EAAE,MAAM,CAAA;IAEd,4CAA4C;IAC5C,WAAW,CAAC,EAAE,MAAM,CAAA;IAEpB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;IAEnB,uCAAuC;IACvC,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAED;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,8BAA8B;IAC9B,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAA;IAEhD,gEAAgE;IAChE,eAAe,CAAC,EAAE,MAAM,CAAA;CACzB;AAED;;;;;GAKG;AACH,MAAM,WAAW,sBAAsB;IACrC,8CAA8C;IAC9C,OAAO,EAAE,OAAO,CAAA;IAEhB,4DAA4D;IAC5D,aAAa,EAAE,MAAM,CAAA;IAErB,8CAA8C;IAC9C,SAAS,EAAE,MAAM,CAAA;IAEjB,iDAAiD;IACjD,cAAc,EAAE,MAAM,CAAA;IAEtB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;IAEnB,2CAA2C;IAC3C,QAAQ,CAAC,EAAE,cAAc,CAAA;IAEzB;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE;QACd,qFAAqF;QACrF,aAAa,EAAE,MAAM,CAAA;KACtB,CAAA;CACF;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE;QACH,IAAI,EAAE,MAAM,CAAA;QACZ,OAAO,EAAE,MAAM,CAAA;KAChB,CAAA;IAED,IAAI,EAAE;QACJ,gBAAgB,EAAE,MAAM,EAAE,CAAA;QAC1B,aAAa,EAAE,MAAM,CAAA;QACrB,MAAM,EAAE;YACN,IAAI,EAAE,MAAM,CAAA;YACZ,MAAM,EAAE,MAAM,CAAA;YACd,QAAQ,EAAE,OAAO,CAAA;YACjB,MAAM,EAAE,MAAM,GAAG,OAAO,CAAA;YACxB,QAAQ,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAA;YACnC,IAAI,EAAE,MAAM,CAAA;SACb,CAAA;QACD,UAAU,EAAE,MAAM,EAAE,CAAA;QACpB,WAAW,EAAE;YACX,yBAAyB,EAAE,MAAM,EAAE,CAAA;SACpC,CAAA;KACF,CAAA;IAED,MAAM,EAAE,YAAY,CAAA;IAEpB,QAAQ,EAAE,cAAc,CAAA;IAExB,SAAS,EAAE,eAAe,CAAA;IAE1B,yCAAyC;IACzC,IAAI,CAAC,EAAE,UAAU,CAAA;IAEjB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,gBAAgB,CAAA;IAE7B,uDAAuD;IACvD,SAAS,CAAC,EAAE,eAAe,CAAA;IAE3B,6CAA6C;IAC7C,gBAAgB,CAAC,EAAE,sBAAsB,CAAA;IAGzC,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;CACnB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,SAAS;IACxB,8DAA8D;IAC9D,UAAU,CAAC,EAAE,gBAAgB,CAAA;CAM9B"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/lib/config/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAE1C;;;;GAIG;AACH,MAAM,MAAM,SAAS,GACjB,aAAa,GACb,eAAe,GACf,cAAc,CAAA;AAElB;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,gDAAgD;IAChD,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,+BAA+B;IAC/B,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC,qCAAqC;IACrC,kBAAkB,CAAC,EAAE,OAAO,CAAA;IAC5B;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAA;CAC3B;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,iBAAiB;IACjB,IAAI,EAAE,SAAS,CAAA;IACf,yBAAyB;IACzB,OAAO,CAAC,EAAE,kBAAkB,CAAA;IAC5B;;;;OAIG;IACH,KAAK,CAAC,EAAE,eAAe,CAAA;CACxB;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,yCAAyC;IACzC,EAAE,EAAE,MAAM,CAAA;IAEV,oEAAoE;IACpE,QAAQ,EAAE,MAAM,CAAA;IAEhB,4DAA4D;IAC5D,IAAI,CAAC,EAAE,MAAM,CAAA;IAEb,kCAAkC;IAClC,IAAI,EAAE,QAAQ,CAAA;IAEd,2DAA2D;IAC3D,OAAO,EAAE,OAAO,CAAA;IAEhB,uEAAuE;IACvE,SAAS,CAAC,EAAE,OAAO,CAAA;IAEnB,8CAA8C;IAC9C,MAAM,CAAC,EAAE,aAAa,GAAG,WAAW,CAAA;CACrC;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,gDAAgD;IAChD,EAAE,EAAE,MAAM,CAAA;IAEV,oCAAoC;IACpC,QAAQ,EAAE,MAAM,CAAA;IAEhB,sBAAsB;IACtB,IAAI,EAAE,MAAM,CAAA;IAEZ,kCAAkC;IAClC,IAAI,EAAE,QAAQ,CAAA;IAEd,2DAA2D;IAC3D,OAAO,EAAE,OAAO,CAAA;IAEhB,2CAA2C;IAC3C,QAAQ,CAAC,EAAE,OAAO,CAAA;IAElB;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAA;CAC5B;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,kCAAkC;IAClC,KAAK,EAAE,aAAa,EAAE,CAAA;IAEtB,8CAA8C;IAC9C,cAAc,EAAE,iBAAiB,EAAE,CAAA;CACpC;AAED;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE;QACR,WAAW,EAAE,OAAO,CAAA;QACpB,MAAM,EAAE,OAAO,CAAA;QACf,aAAa,EAAE,OAAO,CAAA;QACtB,IAAI,EAAE,OAAO,CAAA;QACb,KAAK,EAAE,OAAO,CAAA;QACd,KAAK,EAAE,OAAO,CAAA;QACd,QAAQ,EAAE,OAAO,CAAA;KAClB,CAAA;CACF;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,OAAO,CAAA;IAChB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE;QACL,OAAO,EAAE,kBAAkB,CAAA;QAC3B,OAAO,EAAE,kBAAkB,CAAA;QAC3B,OAAO,EAAE,kBAAkB,CAAA;QAC3B,QAAQ,EAAE,kBAAkB,CAAA;KAC7B,CAAA;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;OAGG;IACH,OAAO,EAAE,OAAO,CAAA;IAEhB,iDAAiD;IACjD,IAAI,CAAC,EAAE,OAAO,CAAA;IAEd;;;OAGG;IACH,KAAK,EAAE,MAAM,CAAA;CACd;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,UAAU;IACzB,kEAAkE;IAClE,OAAO,CAAC,EAAE,OAAO,CAAA;IAEjB;;;OAGG;IACH,YAAY,CAAC,EAAE,OAAO,CAAA;IAEtB,iDAAiD;IACjD,aAAa,CAAC,EAAE,OAAO,CAAA;IAEvB,iDAAiD;IACjD,WAAW,CAAC,EAAE,OAAO,CAAA;IAErB;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAA;IAErC,+EAA+E;IAC/E,UAAU,CAAC,EAAE,kBAAkB,CAAA;CAChC;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,qCAAqC;IACrC,EAAE,EAAE,MAAM,CAAA;IAEV,2BAA2B;IAC3B,KAAK,EAAE,MAAM,CAAA;IAEb,0BAA0B;IAC1B,IAAI,EAAE,MAAM,CAAA;IAEZ,sCAAsC;IACtC,QAAQ,EAAE,MAAM,CAAA;IAEhB,qEAAqE;IACrE,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,4CAA4C;IAC5C,OAAO,EAAE,OAAO,CAAA;IAEhB,mDAAmD;IACnD,KAAK,EAAE,cAAc,EAAE,CAAA;CACxB;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,eAAe;IAC9B,8DAA8D;IAC9D,aAAa,EAAE,SAAS,MAAM,EAAE,CAAA;IAEhC,wCAAwC;IACxC,eAAe,EAAE,MAAM,CAAA;IAEvB,+BAA+B;IAC/B,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAA;IAErC,6DAA6D;IAC7D,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAEjC,4CAA4C;IAC5C,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAEpC,wBAAwB;IACxB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACrC;AAED;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,4EAA4E;IAC5E,MAAM,EAAE,MAAM,CAAA;IAEd,4CAA4C;IAC5C,WAAW,CAAC,EAAE,MAAM,CAAA;IAEpB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;IAEnB,uCAAuC;IACvC,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAED;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,8BAA8B;IAC9B,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAA;IAEhD,gEAAgE;IAChE,eAAe,CAAC,EAAE,MAAM,CAAA;CACzB;AAED;;;;;GAKG;AACH,MAAM,WAAW,sBAAsB;IACrC,8CAA8C;IAC9C,OAAO,EAAE,OAAO,CAAA;IAEhB,4DAA4D;IAC5D,aAAa,EAAE,MAAM,CAAA;IAErB,8CAA8C;IAC9C,SAAS,EAAE,MAAM,CAAA;IAEjB,iDAAiD;IACjD,cAAc,EAAE,MAAM,CAAA;IAEtB;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAEzB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;IAEnB,2CAA2C;IAC3C,QAAQ,CAAC,EAAE,cAAc,CAAA;IAEzB;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE;QACd,qFAAqF;QACrF,aAAa,EAAE,MAAM,CAAA;KACtB,CAAA;CACF;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,wDAAwD;IACxD,SAAS,EAAE,MAAM,CAAA;IACjB,0GAA0G;IAC1G,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,0GAA0G;IAC1G,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,oFAAoF;IACpF,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,qEAAqE;IACrE,gBAAgB,EAAE,MAAM,EAAE,CAAA;CAC3B;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,mBAAmB,GAAG,aAAa,GAAG,iBAAiB,CAAA;AAE/F;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,wBAAwB;IACxB,IAAI,EAAE,gBAAgB,CAAA;IAEtB;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,MAAM,CAAC,EAAE;QACP;;;WAGG;QACH,OAAO,CAAC,EAAE,OAAO,CAAA;KAClB,CAAA;CACF;AAED;;;;;GAKG;AACH;;;;;;;;GAQG;AACH,MAAM,WAAW,kBAAkB;IACjC,sFAAsF;IACtF,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,gFAAgF;IAChF,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAChC;;;;;;;;OAQG;IACH,0BAA0B,CAAC,EAAE,OAAO,CAAA;CACrC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,2BAA2B;IAC1C,oEAAoE;IACpE,OAAO,EAAE,OAAO,CAAA;IAEhB,2CAA2C;IAC3C,MAAM,EAAE;QACN,+DAA+D;QAC/D,cAAc,EAAE,OAAO,CAAA;QACvB,0CAA0C;QAC1C,eAAe,EAAE,OAAO,CAAA;QACxB,wEAAwE;QACxE,YAAY,EAAE,OAAO,CAAA;KACtB,CAAA;IAED;;;;;OAKG;IACH,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAA;CAClC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,iBAAiB;IAChC,+CAA+C;IAC/C,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;OAGG;IACH,WAAW,CAAC,EAAE;QACZ,oBAAoB;QACpB,OAAO,CAAC,EAAE,OAAO,CAAA;QACjB,0CAA0C;QAC1C,MAAM,CAAC,EAAE,MAAM,CAAA;KAChB,CAAA;CACF;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,aAAa;IAC5B,yEAAyE;IACzE,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,qDAAqD;IACrD,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,eAAe,GAAG,WAAW,GAAG,QAAQ,GAAG,gBAAgB,CAAA;AAEvE;;;;;GAKG;AACH,MAAM,MAAM,UAAU,GAAG,cAAc,GAAG,SAAS,CAAA;AAEnD,MAAM,WAAW,UAAU;IACzB,4BAA4B;IAC5B,YAAY,EAAE,sBAAsB,CAAA;IAEpC;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,EAAE,eAAe,EAAE,CAAA;IAE3B;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE;QACjB,OAAO,CAAC,EAAE,OAAO,CAAA;KAClB,CAAA;IAED;;;OAGG;IACH,OAAO,CAAC,EAAE,iBAAiB,CAAA;IAE3B;;;OAGG;IACH,GAAG,CAAC,EAAE,aAAa,CAAA;IAEnB,8BAA8B;IAC9B,SAAS,CAAC,EAAE,mBAAmB,CAAA;IAE/B,qFAAqF;IACrF,qBAAqB,CAAC,EAAE,2BAA2B,CAAA;IAEnD;;;;;;;;;;;;;;OAcG;IACH,6BAA6B,CAAC,EAAE,OAAO,CAAA;IAEvC,sFAAsF;IACtF,YAAY,CAAC,EAAE,kBAAkB,CAAA;CAClC;AAED;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,YAAY,EAAE;QACZ,IAAI,EAAE,gBAAgB,CAAA;KACvB,CAAA;IACD,SAAS,EAAE;QACT,MAAM,EAAE;YACN,8EAA8E;YAC9E,OAAO,EAAE,OAAO,CAAA;SACjB,CAAA;KACF,CAAA;IACD,4EAA4E;IAC5E,OAAO,EAAE,eAAe,EAAE,CAAA;IAC1B;;;;;;;OAOG;IACH,GAAG,CAAC,EAAE;QACJ,+CAA+C;QAC/C,SAAS,EAAE,MAAM,CAAA;QACjB,uBAAuB;QACvB,SAAS,EAAE,MAAM,CAAA;KAClB,CAAA;CACF;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE;QACH,IAAI,EAAE,MAAM,CAAA;QACZ,OAAO,EAAE,MAAM,CAAA;KAChB,CAAA;IAED,IAAI,EAAE;QACJ,gBAAgB,EAAE,MAAM,EAAE,CAAA;QAC1B,aAAa,EAAE,MAAM,CAAA;QACrB;;;;;WAKG;QACH,eAAe,CAAC,EAAE,OAAO,CAAA;QACzB,MAAM,EAAE;YACN,IAAI,EAAE,MAAM,CAAA;YACZ,MAAM,EAAE,MAAM,CAAA;YACd;;;;eAIG;YACH,QAAQ,EAAE,OAAO,CAAA;YACjB,MAAM,EAAE,MAAM,GAAG,OAAO,CAAA;YACxB,QAAQ,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAA;YACnC,IAAI,EAAE,MAAM,CAAA;SACb,CAAA;QACD,UAAU,EAAE,MAAM,EAAE,CAAA;QACpB,WAAW,EAAE;YACX,yBAAyB,EAAE,MAAM,EAAE,CAAA;SACpC,CAAA;KACF,CAAA;IAED,MAAM,EAAE,YAAY,CAAA;IAEpB,QAAQ,EAAE,cAAc,CAAA;IAExB,SAAS,EAAE,eAAe,CAAA;IAE1B,yCAAyC;IACzC,IAAI,CAAC,EAAE,UAAU,CAAA;IAEjB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,gBAAgB,CAAA;IAE7B,6CAA6C;IAC7C,gBAAgB,CAAC,EAAE,sBAAsB,CAAA;IAEzC,kCAAkC;IAClC,KAAK,CAAC,EAAE,WAAW,CAAA;IAEnB,oDAAoD;IACpD,IAAI,CAAC,EAAE,UAAU,CAAA;IAGjB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;CACnB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,SAAS;IACxB,8DAA8D;IAC9D,UAAU,CAAC,EAAE,gBAAgB,CAAA;CAM9B"}

package/dist/lib/db.d.ts

@@ -1,5 +1,53 @@
 import { Pool } from 'pg';
+/**
+ * Strip SSL-related parameters from DATABASE_URL to prevent pg-connection-string
+ * from overriding our explicit ssl config.
+ *
+ * pg v8+ treats sslmode=require as verify-full internally, which breaks connections
+ * to providers like Supabase that use self-signed certs in the chain.
+ * By removing sslmode from the connection string and handling it via the explicit
+ * `ssl` Pool option, we maintain full control over SSL behavior.
+ */
+export declare function stripSSLParams(databaseUrl: string): string;
+/**
+ * Parse SSL mode from DATABASE_URL using proper URL parameter parsing
+ * Supports: disable, allow, prefer, require, verify-ca, verify-full
+ *
+ * Security behavior:
+ * - Production: Defaults to rejectUnauthorized: true (validates certificates)
+ * - Development: Defaults to no SSL (localhost doesn't need it)
+ * - Explicit sslmode in URL always takes precedence
+ */
+export declare function parseSSLConfig(databaseUrl: string): false | {
+    rejectUnauthorized: boolean;
+};
 declare const pool: Pool;
+declare const servicePool: Pool;
+/**
+ * Validate userId format to prevent SQL injection in SET LOCAL commands
+ *
+ * Security behavior:
+ * - Production: Requires valid UUID format (RFC 4122 compliant)
+ * - Development: Allows test IDs but validates against SQL injection
+ *
+ * Valid test ID patterns (development only):
+ * - Alphanumeric characters: a-z, A-Z, 0-9
+ * - Hyphens and underscores: -, _
+ * - Examples: "test-superadmin-001", "dev_user_123"
+ *
+ * Blocked in ALL environments:
+ * - SQL injection characters: ' " \ ;
+ * - Control characters: 0x00-0x1F
+ * - Values exceeding 255 characters
+ *
+ * @security SEC-003 - SQL injection prevention in SET LOCAL commands
+ * @internal Exported for testing only
+ */
+export declare function validateUserId(userId: string): void;
+export interface RLSOptions {
+    /** Force the service (RLS-bypass) pool even if a userId is provided. */
+    service?: boolean;
+}
 /**
  * Execute a query with RLS context
  * Sets the current user ID for Row Level Security policies via app.user_id
@@ -9,17 +57,17 @@ declare const pool: Pool;
  * @param userId - User ID for RLS context (optional - if not provided, runs without RLS context)
  * @returns Query result rows
  */
-export declare function queryWithRLS<T = unknown>(query: string, params?: unknown[], userId?: string | null): Promise<T[]>;
+export declare function queryWithRLS<T = unknown>(query: string, params?: unknown[], userId?: string | null, options?: RLSOptions): Promise<T[]>;
 /**
  * Execute a single query and return the first row
  * Useful for queries that return a single result
  */
-export declare function queryOneWithRLS<T = unknown>(query: string, params?: unknown[], userId?: string | null): Promise<T | null>;
+export declare function queryOneWithRLS<T = unknown>(query: string, params?: unknown[], userId?: string | null, options?: RLSOptions): Promise<T | null>;
 /**
  * Execute a mutation (INSERT, UPDATE, DELETE) with RLS context
  * Returns the affected rows
  */
-export declare function mutateWithRLS<T = unknown>(query: string, params?: unknown[], userId?: string | null): Promise<{
+export declare function mutateWithRLS<T = unknown>(query: string, params?: unknown[], userId?: string | null, options?: RLSOptions): Promise<{
     rows: T[];
     rowCount: number;
 }>;
@@ -38,7 +86,25 @@ export declare function mutateWithRLS<T = unknown>(query: string, params?: unkno
  *   throw error;
  * }
  */
-export declare function getTransactionClient(userId?: string | null): Promise<{
+export declare function getTransactionClient(userId?: string | null, options?: RLSOptions): Promise<{
+    query: <T = unknown>(query: string, params?: unknown[]) => Promise<T[]>;
+    queryOne: <T = unknown>(query: string, params?: unknown[]) => Promise<T>;
+    mutate: <T = unknown>(query: string, params?: unknown[]) => Promise<{
+        rows: T[];
+        rowCount: number;
+    }>;
+    commit: () => Promise<void>;
+    rollback: () => Promise<void>;
+}>;
+/**
+ * Get a transaction client on the SERVICE (RLS-bypass) pool.
+ *
+ * Use for privileged system bootstraps that carry a userId but must bypass RLS
+ * because they create the FIRST membership/subscription of a brand-new team
+ * (which no membership-based policy can satisfy). Authorization for these
+ * operations is enforced at the API/action layer, not by RLS.
+ */
+export declare function getServiceTransactionClient(): Promise<{
     query: <T = unknown>(query: string, params?: unknown[]) => Promise<T[]>;
     queryOne: <T = unknown>(query: string, params?: unknown[]) => Promise<T>;
     mutate: <T = unknown>(query: string, params?: unknown[]) => Promise<{
@@ -70,6 +136,39 @@ export declare function queryRows<T = unknown>(text: string, params?: unknown[])
  * Useful for queries that return a single result
  */
 export declare function queryOne<T = unknown>(text: string, params?: unknown[]): Promise<T | null>;
-export { pool };
+export { pool, servicePool };
+/**
+ * Get the shared database pool
+ * Use this instead of creating new Pool instances
+ *
+ * @throws Error if the pool is shutting down or has been closed
+ */
+export declare function getPool(): Pool;
+/**
+ * Check if the pool is healthy and accepting connections
+ *
+ * Checks:
+ * - Pool is not shutting down
+ * - Pool has available capacity (not at max with all busy)
+ * - No excessive waiting queue
+ */
+export declare function isPoolHealthy(): boolean;
+/**
+ * Get pool statistics for monitoring
+ */
+export declare function getPoolStats(): {
+    total: number;
+    idle: number;
+    waiting: number;
+    activeConnections: number;
+    isShuttingDown: boolean;
+};
+/**
+ * Gracefully shutdown the database pool
+ * Waits for all active connections to complete before closing
+ *
+ * @param timeoutMs Maximum time to wait for connections to finish (default: 30s)
+ */
+export declare function gracefulShutdown(timeoutMs?: number): Promise<void>;
 export declare function checkDatabaseConnection(): Promise<boolean>;
 //# sourceMappingURL=db.d.ts.map

package/dist/lib/db.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../../src/lib/db.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;AAG1B,QAAA,MAAM,IAAI,MAMR,CAAC;AAEH;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAAC,CAAC,GAAG,OAAO,EAC5C,KAAK,EAAE,MAAM,EACb,MAAM,GAAE,OAAO,EAAO,EACtB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,GACrB,OAAO,CAAC,CAAC,EAAE,CAAC,CA6Bd;AAED;;;GAGG;AACH,wBAAsB,eAAe,CAAC,CAAC,GAAG,OAAO,EAC/C,KAAK,EAAE,MAAM,EACb,MAAM,GAAE,OAAO,EAAO,EACtB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,GACrB,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAGnB;AAED;;;GAGG;AACH,wBAAsB,aAAa,CAAC,CAAC,GAAG,OAAO,EAC7C,KAAK,EAAE,MAAM,EACb,MAAM,GAAE,OAAO,EAAO,EACtB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,GACrB,OAAO,CAAC;IAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CA0B1C;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,oBAAoB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI;YAYrD,CAAC,mBAAmB,MAAM,WAAU,OAAO,EAAE;eAE1C,CAAC,mBAAmB,MAAM,WAAU,OAAO,EAAE;aAE/C,CAAC,mBAAmB,MAAM,WAAU,OAAO,EAAE;cACK,CAAC,EAAE;;;;;GAUjE;AAGD;;;;;;;GAOG;AACH,wBAAsB,KAAK,CAAC,CAAC,GAAG,OAAO,EACrC,IAAI,EAAE,MAAM,EACZ,MAAM,CAAC,EAAE,OAAO,EAAE,GACjB,OAAO,CAAC;IAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAM1C;AAED;;;GAGG;AACH,wBAAsB,SAAS,CAAC,CAAC,GAAG,OAAO,EACzC,IAAI,EAAE,MAAM,EACZ,MAAM,CAAC,EAAE,OAAO,EAAE,GACjB,OAAO,CAAC,CAAC,EAAE,CAAC,CAGd;AAED;;;GAGG;AACH,wBAAsB,QAAQ,CAAC,CAAC,GAAG,OAAO,EACxC,IAAI,EAAE,MAAM,EACZ,MAAM,CAAC,EAAE,OAAO,EAAE,GACjB,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAGnB;AAGD,OAAO,EAAE,IAAI,EAAE,CAAC;AAGhB,wBAAsB,uBAAuB,IAAI,OAAO,CAAC,OAAO,CAAC,CAUhE"}
+{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../../src/lib/db.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAmB,MAAM,IAAI,CAAC;AAQ3C;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAe1D;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,KAAK,GAAG;IAAE,kBAAkB,EAAE,OAAO,CAAA;CAAE,CAiD3F;AAQD,QAAA,MAAM,IAAI,MAMR,CAAC;AAoBH,QAAA,MAAM,WAAW,EAAE,IASX,CAAC;AAET;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAuBnD;AAgCD,MAAM,WAAW,UAAU;IACzB,wEAAwE;IACxE,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAWD;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAAC,CAAC,GAAG,OAAO,EAC5C,KAAK,EAAE,MAAM,EACb,MAAM,GAAE,OAAO,EAAO,EACtB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,EACtB,OAAO,CAAC,EAAE,UAAU,GACnB,OAAO,CAAC,CAAC,EAAE,CAAC,CAiCd;AAED;;;GAGG;AACH,wBAAsB,eAAe,CAAC,CAAC,GAAG,OAAO,EAC/C,KAAK,EAAE,MAAM,EACb,MAAM,GAAE,OAAO,EAAO,EACtB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,EACtB,OAAO,CAAC,EAAE,UAAU,GACnB,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAGnB;AAED;;;GAGG;AACH,wBAAsB,aAAa,CAAC,CAAC,GAAG,OAAO,EAC7C,KAAK,EAAE,MAAM,EACb,MAAM,GAAE,OAAO,EAAO,EACtB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,EACtB,OAAO,CAAC,EAAE,UAAU,GACnB,OAAO,CAAC;IAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CA6B1C;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,oBAAoB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,EAAE,OAAO,CAAC,EAAE,UAAU;YAsB3E,CAAC,mBAAmB,MAAM,WAAU,OAAO,EAAE;eAE1C,CAAC,mBAAmB,MAAM,WAAU,OAAO,EAAE;aAE/C,CAAC,mBAAmB,MAAM,WAAU,OAAO,EAAE;cACK,CAAC,EAAE;;;;;GAUjE;AAED;;;;;;;GAOG;AACH,wBAAgB,2BAA2B;YAzB/B,CAAC,mBAAmB,MAAM,WAAU,OAAO,EAAE;eAE1C,CAAC,mBAAmB,MAAM,WAAU,OAAO,EAAE;aAE/C,CAAC,mBAAmB,MAAM,WAAU,OAAO,EAAE;cACK,CAAC,EAAE;;;;;GAsBjE;AAGD;;;;;;;GAOG;AACH,wBAAsB,KAAK,CAAC,CAAC,GAAG,OAAO,EACrC,IAAI,EAAE,MAAM,EACZ,MAAM,CAAC,EAAE,OAAO,EAAE,GACjB,OAAO,CAAC;IAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAQ1C;AAED;;;GAGG;AACH,wBAAsB,SAAS,CAAC,CAAC,GAAG,OAAO,EACzC,IAAI,EAAE,MAAM,EACZ,MAAM,CAAC,EAAE,OAAO,EAAE,GACjB,OAAO,CAAC,CAAC,EAAE,CAAC,CAGd;AAED;;;GAGG;AACH,wBAAsB,QAAQ,CAAC,CAAC,GAAG,OAAO,EACxC,IAAI,EAAE,MAAM,EACZ,MAAM,CAAC,EAAE,OAAO,EAAE,GACjB,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAGnB;AAID,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;AAE7B;;;;;GAKG;AACH,wBAAgB,OAAO,IAAI,IAAI,CAK9B;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,IAAI,OAAO,CAuBvC;AAED;;GAEG;AACH,wBAAgB,YAAY;;;;;;EAQ3B;AAED;;;;;GAKG;AACH,wBAAsB,gBAAgB,CAAC,SAAS,GAAE,MAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAqD/E;AAmBD,wBAAsB,uBAAuB,IAAI,OAAO,CAAC,OAAO,CAAC,CAchE"}