@openora/core 0.4.0 → 0.4.1-canary.100

package/dist/server/auth/auth.js

@@ -1,11 +1,35 @@
 import { randomUUID } from 'node:crypto';
 import { betterAuth } from 'better-auth';
 import { drizzleAdapter } from 'better-auth/adapters/drizzle';
-import { organization, admin as adminPlugin, twoFactor } from 'better-auth/plugins';
+import { organization, admin as adminPlugin, twoFactor, emailOTP } from 'better-auth/plugins';
 import { ac, roles } from './permissions.js';
-// Explicit return type avoids TS2883 (Zod v4 $strip portability issue with admin plugin).
+import { OTP_CODE_LENGTH, OTP_EXPIRES_IN_SEC, DEFAULT_EMAIL_TEMPLATES, } from '@openora/core/contracts';
+// Used only by SessionResolver's createAuth() call, which never sends email (getSession
+// only) - keeps templateRenderer optional on AuthOptions without a server/auth -> pam
+// layering violation (the real DefaultEmailTemplateRenderer lives in pam/identity).
+// Delegates to the shared DEFAULT_EMAIL_TEMPLATES map (contracts/adapters/email-template.ts)
+// so this fallback copy can never drift from DefaultEmailTemplateRenderer's.
+const fallbackTemplateRenderer = {
+    render: (key, data) => DEFAULT_EMAIL_TEMPLATES[key](data),
+};
+/**
+ * Builds the one shared better-auth instance for the whole app - both the
+ * per-request session middleware and `AdminGuard` resolve sessions through it,
+ * never a second `createAuth()` over the same DB. Bundles the org, admin
+ * (role/permission), and two-factor plugins; `sendEmail` is a silent no-op
+ * when omitted (eg tests) rather than throwing. The explicit `BetterAuthType`
+ * return annotation is load-bearing, not stylistic - it dodges a TS2883 Zod v4
+ * `$strip` portability error the inferred type would otherwise surface.
+ *
+ * `cookieDomain` (or `AUTH_COOKIE_DOMAIN`) widens the session cookie to a parent
+ * domain, so a frontend on `app.example.com` still sends it to an API on
+ * `api.example.com`. Left unset the cookie stays host-only, which is correct when
+ * both run on one host and is the safer default everywhere else.
+ */
 export function createAuth(options) {
     const sendEmail = options.sendEmail ?? (() => { });
+    const templateRenderer = options.templateRenderer ?? fallbackTemplateRenderer;
+    const cookieDomain = options.cookieDomain ?? process.env['AUTH_COOKIE_DOMAIN'];
     return betterAuth({
         database: drizzleAdapter(options.db, {
             provider: 'pg',
@@ -15,6 +39,7 @@ export function createAuth(options) {
             database: {
                 generateId: () => randomUUID(),
             },
+            ...(cookieDomain ? { crossSubDomainCookies: { enabled: true, domain: cookieDomain } } : {}),
         },
         session: {
             expiresIn: 30 * 24 * 60 * 60,
@@ -26,33 +51,62 @@ export function createAuth(options) {
             // are validated at the route (theme against the enum, language against
             // PlatformConfig.supportedLanguages).
             additionalFields: {
+                username: { type: 'string', required: false, input: true },
                 theme: { type: 'string', required: false, input: true, defaultValue: 'system' },
                 language: { type: 'string', required: false, input: true, defaultValue: 'en' },
             },
         },
         emailAndPassword: {
             enabled: true,
-            rememberMeDuration: 30 * 24 * 60 * 60,
-            sendResetPassword: async ({ user, url, token }) => {
-                await sendEmail({
-                    to: user.email,
-                    subject: 'Reset your password',
-                    body: `Reset your password using this link: ${url}\n\nReset token: ${token}`,
-                });
-            },
+            autoSignIn: false,
+            requireEmailVerification: true,
+            revokeSessionsOnPasswordReset: true,
+            onExistingUserSignUp: options.onExistingUserSignUp
+                ? async ({ user }) => {
+                    await options.onExistingUserSignUp?.({ id: user.id, email: user.email });
+                }
+                : undefined,
+            onPasswordReset: options.onPasswordReset
+                ? async ({ user }) => {
+                    await options.onPasswordReset?.({ id: user.id, email: user.email });
+                }
+                : undefined,
         },
         emailVerification: {
+            sendOnSignUp: true,
+            expiresIn: 24 * 60 * 60,
             sendVerificationEmail: async ({ user, url, token }) => {
-                await sendEmail({
-                    to: user.email,
-                    subject: 'Verify your email',
-                    body: `Verify your email using this link: ${url}\n\nVerification token: ${token}`,
-                });
+                const locale = user.language ?? 'en';
+                const verificationUrl = options.registrationWebUrl
+                    ? new URL('/verify-email', options.registrationWebUrl)
+                    : undefined;
+                if (verificationUrl) {
+                    verificationUrl.searchParams.set('token', token);
+                    verificationUrl.searchParams.set('callbackURL', '/');
+                }
+                const { subject, body } = await templateRenderer.render('verifyEmail', { url: verificationUrl?.toString() ?? url, token }, locale);
+                await sendEmail({ to: user.email, subject, body });
             },
         },
         // Without this, better-auth's admin plugin defaults new signups to its own
         // 'user' role, which UserRoleSchema (player|admin) rejects everywhere downstream.
-        plugins: [organization(), adminPlugin({ ac, roles, defaultRole: 'player' }), twoFactor()],
+        plugins: [
+            organization(),
+            adminPlugin({ ac, roles, defaultRole: 'player' }),
+            twoFactor(),
+            emailOTP({
+                otpLength: OTP_CODE_LENGTH,
+                expiresIn: OTP_EXPIRES_IN_SEC,
+                async sendVerificationOTP({ email, otp, type }) {
+                    if (type !== 'forget-password') {
+                        return;
+                    }
+                    const locale = (await options.getUserLanguage?.(email)) ?? 'en';
+                    const { subject, body } = await templateRenderer.render('resetPasswordOtp', { otp, email }, locale);
+                    await sendEmail({ to: email, subject, body });
+                },
+            }),
+        ],
         // Library boundary: better-auth infers an options-specific instantiation that isn't
         // assignable to its own exported `Auth` alias. No way to narrow without matching the
         // full generic - the one sanctioned cast, see conventions.

package/dist/server/auth/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/server/auth/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,KAAK,IAAI,WAAW,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAEpF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAgB7C,0FAA0F;AAC1F,MAAM,UAAU,UAAU,CAAC,OAAoB;IAC7C,MAAM,SAAS,GAAc,OAAO,CAAC,SAAS,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAC7D,OAAO,UAAU,CAAC;QAChB,QAAQ,EAAE,cAAc,CAAC,OAAO,CAAC,EAAE,EAAE;YACnC,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,OAAO,CAAC,MAAM;SACvB,CAAC;QACF,QAAQ,EAAE;YACR,QAAQ,EAAE;gBACR,UAAU,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE;aAC/B;SACF;QACD,OAAO,EAAE;YACP,SAAS,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE;YAC5B,SAAS,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE;SACxB;QACD,IAAI,EAAE;YACJ,6EAA6E;YAC7E,6EAA6E;YAC7E,uEAAuE;YACvE,sCAAsC;YACtC,gBAAgB,EAAE;gBAChB,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE;gBAC/E,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE;aAC/E;SACF;QACD,gBAAgB,EAAE;YAChB,OAAO,EAAE,IAAI;YACb,kBAAkB,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE;YACrC,iBAAiB,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE;gBAChD,MAAM,SAAS,CAAC;oBACd,EAAE,EAAE,IAAI,CAAC,KAAK;oBACd,OAAO,EAAE,qBAAqB;oBAC9B,IAAI,EAAE,wCAAwC,GAAG,oBAAoB,KAAK,EAAE;iBAC7E,CAAC,CAAC;YACL,CAAC;SACF;QACD,iBAAiB,EAAE;YACjB,qBAAqB,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE;gBACpD,MAAM,SAAS,CAAC;oBACd,EAAE,EAAE,IAAI,CAAC,KAAK;oBACd,OAAO,EAAE,mBAAmB;oBAC5B,IAAI,EAAE,sCAAsC,GAAG,2BAA2B,KAAK,EAAE;iBAClF,CAAC,CAAC;YACL,CAAC;SACF;QACD,2EAA2E;QAC3E,kFAAkF;QAClF,OAAO,EAAE,CAAC,YAAY,EAAE,EAAE,WAAW,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC;QACzF,oFAAoF;QACpF,qFAAqF;QACrF,2DAA2D;KAC5D,CAA8B,CAAC;AAClC,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/server/auth/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,KAAK,IAAI,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAE9F,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,uBAAuB,GAExB,MAAM,yBAAyB,CAAC;AAsBjC,wFAAwF;AACxF,sFAAsF;AACtF,oFAAoF;AACpF,6FAA6F;AAC7F,6EAA6E;AAC7E,MAAM,wBAAwB,GAA0B;IACtD,MAAM,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;CAC1D,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,UAAU,CAAC,OAAoB;IAC7C,MAAM,SAAS,GAAc,OAAO,CAAC,SAAS,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAC7D,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,wBAAwB,CAAC;IAC9E,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAC/E,OAAO,UAAU,CAAC;QAChB,QAAQ,EAAE,cAAc,CAAC,OAAO,CAAC,EAAE,EAAE;YACnC,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,OAAO,CAAC,MAAM;SACvB,CAAC;QACF,QAAQ,EAAE;YACR,QAAQ,EAAE;gBACR,UAAU,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE;aAC/B;YACD,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5F;QACD,OAAO,EAAE;YACP,SAAS,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE;YAC5B,SAAS,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE;SACxB;QACD,IAAI,EAAE;YACJ,6EAA6E;YAC7E,6EAA6E;YAC7E,uEAAuE;YACvE,sCAAsC;YACtC,gBAAgB,EAAE;gBAChB,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE;gBAC1D,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE;gBAC/E,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE;aAC/E;SACF;QACD,gBAAgB,EAAE;YAChB,OAAO,EAAE,IAAI;YACb,UAAU,EAAE,KAAK;YACjB,wBAAwB,EAAE,IAAI;YAC9B,6BAA6B,EAAE,IAAI;YACnC,oBAAoB,EAAE,OAAO,CAAC,oBAAoB;gBAChD,CAAC,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;oBACjB,MAAM,OAAO,CAAC,oBAAoB,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;gBAC3E,CAAC;gBACH,CAAC,CAAC,SAAS;YACb,eAAe,EAAE,OAAO,CAAC,eAAe;gBACtC,CAAC,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;oBACjB,MAAM,OAAO,CAAC,eAAe,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;gBACtE,CAAC;gBACH,CAAC,CAAC,SAAS;SACd;QACD,iBAAiB,EAAE;YACjB,YAAY,EAAE,IAAI;YAClB,SAAS,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE;YACvB,qBAAqB,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE;gBACpD,MAAM,MAAM,GAAI,IAA8B,CAAC,QAAQ,IAAI,IAAI,CAAC;gBAChE,MAAM,eAAe,GAAG,OAAO,CAAC,kBAAkB;oBAChD,CAAC,CAAC,IAAI,GAAG,CAAC,eAAe,EAAE,OAAO,CAAC,kBAAkB,CAAC;oBACtD,CAAC,CAAC,SAAS,CAAC;gBACd,IAAI,eAAe,EAAE,CAAC;oBACpB,eAAe,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;oBACjD,eAAe,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;gBACvD,CAAC;gBACD,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,MAAM,gBAAgB,CAAC,MAAM,CACrD,aAAa,EACb,EAAE,GAAG,EAAE,eAAe,EAAE,QAAQ,EAAE,IAAI,GAAG,EAAE,KAAK,EAAE,EAClD,MAAM,CACP,CAAC;gBACF,MAAM,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACrD,CAAC;SACF;QACD,2EAA2E;QAC3E,kFAAkF;QAClF,OAAO,EAAE;YACP,YAAY,EAAE;YACd,WAAW,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;YACjD,SAAS,EAAE;YACX,QAAQ,CAAC;gBACP,SAAS,EAAE,eAAe;gBAC1B,SAAS,EAAE,kBAAkB;gBAC7B,KAAK,CAAC,mBAAmB,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE;oBAC5C,IAAI,IAAI,KAAK,iBAAiB,EAAE,CAAC;wBAC/B,OAAO;oBACT,CAAC;oBACD,MAAM,MAAM,GAAG,CAAC,MAAM,OAAO,CAAC,eAAe,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC;oBAChE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,MAAM,gBAAgB,CAAC,MAAM,CACrD,kBAAkB,EAClB,EAAE,GAAG,EAAE,KAAK,EAAE,EACd,MAAM,CACP,CAAC;oBACF,MAAM,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;gBAChD,CAAC;aACF,CAAC;SACH;QACD,oFAAoF;QACpF,qFAAqF;QACrF,2DAA2D;KAC5D,CAA8B,CAAC;AAClC,CAAC"}

package/dist/server/auth/index.d.ts

@@ -1,7 +1,9 @@
 export type { AuthOptions, Auth, SendEmail } from './auth.js';
 export { createAuth } from './auth.js';
 export { AdminGuard, ADMIN_GUARD } from './admin-guard.js';
+export type { AdminCaller } from './admin-guard.js';
 export { SessionResolver, AUTH_SESSION } from './session-resolver.js';
+export { signSessionCookie, type SessionCookieConfig } from './sign-session-cookie.js';
 export { ac, roles, statement } from './permissions.js';
 export type { RoleName, ResourceName, ActionOf } from './permissions.js';
 export { PERMISSION_LEVELS, SUPPORTED_LEVELS, readActions, levelRank, isLevelSufficient, levelToActions, actionsToLevel, } from './permission-levels.js';

package/dist/server/auth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/server/auth/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACxD,YAAY,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,WAAW,EACX,SAAS,EACT,iBAAiB,EACjB,cAAc,EACd,cAAc,GACf,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/server/auth/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC3D,YAAY,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,EAAE,iBAAiB,EAAE,KAAK,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AACvF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACxD,YAAY,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,WAAW,EACX,SAAS,EACT,iBAAiB,EACjB,cAAc,EACd,cAAc,GACf,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC"}

package/dist/server/auth/index.js

@@ -1,6 +1,7 @@
 export { createAuth } from './auth.js';
 export { AdminGuard, ADMIN_GUARD } from './admin-guard.js';
 export { SessionResolver, AUTH_SESSION } from './session-resolver.js';
+export { signSessionCookie } from './sign-session-cookie.js';
 export { ac, roles, statement } from './permissions.js';
 export { PERMISSION_LEVELS, SUPPORTED_LEVELS, readActions, levelRank, isLevelSufficient, levelToActions, actionsToLevel, } from './permission-levels.js';
 //# sourceMappingURL=index.js.map

package/dist/server/auth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/server/auth/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAExD,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,WAAW,EACX,SAAS,EACT,iBAAiB,EACjB,cAAc,EACd,cAAc,GACf,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/server/auth/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE3D,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,EAAE,iBAAiB,EAA4B,MAAM,0BAA0B,CAAC;AACvF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAExD,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,WAAW,EACX,SAAS,EACT,iBAAiB,EACjB,cAAc,EACd,cAAc,GACf,MAAM,wBAAwB,CAAC"}

package/dist/server/auth/permission-levels.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permission-levels.d.ts","sourceRoot":"","sources":["../../../src/server/auth/permission-levels.ts"],"names":[],"mappings":"AAAA,OAAO,EAAa,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChE,OAAO,EAAoB,KAAK,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAEjF,YAAY,EAAE,eAAe,EAAE,CAAC;AAGhC,eAAO,MAAM,iBAAiB,EAAE,SAAS,eAAe,EAAqB,CAAC;AAE9E,eAAO,MAAM,gBAAgB,EAAE,SAAS,eAAe,EAAsB,CAAC;AAE9E,wBAAgB,SAAS,CAAC,KAAK,EAAE,eAAe,GAAG,MAAM,CAExD;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,eAAe,GAAG,OAAO,CAE3F;AAID,eAAO,MAAM,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC,CAKpB,CAAC;AAEtD,mIAAmI;AACnI,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,GAAG,SAAS,MAAM,EAAE,CAM1F;AAED,0HAA0H;AAC1H,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,eAAe,CAQ5F"}
+{"version":3,"file":"permission-levels.d.ts","sourceRoot":"","sources":["../../../src/server/auth/permission-levels.ts"],"names":[],"mappings":"AAAA,OAAO,EAAa,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChE,OAAO,EAAoB,KAAK,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAEjF,YAAY,EAAE,eAAe,EAAE,CAAC;AAGhC,eAAO,MAAM,iBAAiB,EAAE,SAAS,eAAe,EAAqB,CAAC;AAE9E,eAAO,MAAM,gBAAgB,EAAE,SAAS,eAAe,EAAsB,CAAC;AAE9E,wBAAgB,SAAS,CAAC,KAAK,EAAE,eAAe,GAAG,MAAM,CAExD;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,eAAe,GAAG,OAAO,CAE3F;AAID,eAAO,MAAM,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC,CAKpB,CAAC;AAEtD,mIAAmI;AACnI,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,GAAG,SAAS,MAAM,EAAE,CAY1F;AAED,0HAA0H;AAC1H,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,eAAe,CAc5F"}

package/dist/server/auth/permission-levels.js

@@ -18,25 +18,31 @@ export const readActions = Object.fromEntries(Object.keys(statement).map((resour
 /** Expands a (resource, level) cell to the action set AdminGuard checks - levels are stored, actions derived at the authz edge. */
 export function levelToActions(resource, level) {
     const actions = statement[resource];
-    if (!actions)
+    if (!actions) {
         return [];
-    if (level === 'no_access')
+    }
+    if (level === 'no_access') {
         return [];
-    if (level === 'read_write')
+    }
+    if (level === 'read_write') {
         return actions;
+    }
     return readActions[resource] ?? (actions.includes('view') ? ['view'] : []);
 }
 /** Collapses a concrete action set to the closest level - used only for legacy/edge data; new writes are level-native. */
 export function actionsToLevel(resource, actions) {
     const all = statement[resource];
-    if (!all || all.length === 0)
+    if (!all || all.length === 0) {
         return 'no_access';
+    }
     const has = new Set(actions);
-    if (all.every((a) => has.has(a)))
+    if (all.every((a) => has.has(a))) {
         return 'read_write';
+    }
     const read = readActions[resource] ?? [];
-    if (read.length > 0 && read.every((a) => has.has(a)))
+    if (read.length > 0 && read.every((a) => has.has(a))) {
         return 'read';
+    }
     return 'no_access';
 }
 //# sourceMappingURL=permission-levels.js.map

package/dist/server/auth/permission-levels.js.map

@@ -1 +1 @@
-{"version":3,"file":"permission-levels.js","sourceRoot":"","sources":["../../../src/server/auth/permission-levels.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAqB,MAAM,kBAAkB,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAwB,MAAM,yBAAyB,CAAC;AAIjF,mFAAmF;AACnF,MAAM,CAAC,MAAM,iBAAiB,GAA+B,gBAAgB,CAAC;AAE9E,MAAM,CAAC,MAAM,gBAAgB,GAA+B,iBAAiB,CAAC;AAE9E,MAAM,UAAU,SAAS,CAAC,KAAsB;IAC9C,OAAO,iBAAiB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAqB,EAAE,QAAyB;IAChF,OAAO,SAAS,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,CAAC;AAChD,CAAC;AAED,oFAAoF;AACpF,oFAAoF;AACpF,MAAM,CAAC,MAAM,WAAW,GAAqD,MAAM,CAAC,WAAW,CAC5F,MAAM,CAAC,IAAI,CAAC,SAAS,CAAoB,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;IAC1D,MAAM,OAAO,GAAG,SAAS,CAAC,QAAQ,CAAsB,CAAC;IACzD,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAC9D,CAAC,CAAC,CACiD,CAAC;AAEtD,mIAAmI;AACnI,MAAM,UAAU,cAAc,CAAC,QAAgB,EAAE,KAAsB;IACrE,MAAM,OAAO,GAAG,SAAS,CAAC,QAAwB,CAAkC,CAAC;IACrF,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IACxB,IAAI,KAAK,KAAK,WAAW;QAAE,OAAO,EAAE,CAAC;IACrC,IAAI,KAAK,KAAK,YAAY;QAAE,OAAO,OAAO,CAAC;IAC3C,OAAO,WAAW,CAAC,QAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAC7F,CAAC;AAED,0HAA0H;AAC1H,MAAM,UAAU,cAAc,CAAC,QAAgB,EAAE,OAA0B;IACzE,MAAM,GAAG,GAAG,SAAS,CAAC,QAAwB,CAAkC,CAAC;IACjF,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,WAAW,CAAC;IACjD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IAC7B,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,YAAY,CAAC;IACtD,MAAM,IAAI,GAAG,WAAW,CAAC,QAAwB,CAAC,IAAI,EAAE,CAAC;IACzD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC;IACpE,OAAO,WAAW,CAAC;AACrB,CAAC"}
+{"version":3,"file":"permission-levels.js","sourceRoot":"","sources":["../../../src/server/auth/permission-levels.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAqB,MAAM,kBAAkB,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAwB,MAAM,yBAAyB,CAAC;AAIjF,mFAAmF;AACnF,MAAM,CAAC,MAAM,iBAAiB,GAA+B,gBAAgB,CAAC;AAE9E,MAAM,CAAC,MAAM,gBAAgB,GAA+B,iBAAiB,CAAC;AAE9E,MAAM,UAAU,SAAS,CAAC,KAAsB;IAC9C,OAAO,iBAAiB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAqB,EAAE,QAAyB;IAChF,OAAO,SAAS,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,CAAC;AAChD,CAAC;AAED,oFAAoF;AACpF,oFAAoF;AACpF,MAAM,CAAC,MAAM,WAAW,GAAqD,MAAM,CAAC,WAAW,CAC5F,MAAM,CAAC,IAAI,CAAC,SAAS,CAAoB,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;IAC1D,MAAM,OAAO,GAAG,SAAS,CAAC,QAAQ,CAAsB,CAAC;IACzD,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAC9D,CAAC,CAAC,CACiD,CAAC;AAEtD,mIAAmI;AACnI,MAAM,UAAU,cAAc,CAAC,QAAgB,EAAE,KAAsB;IACrE,MAAM,OAAO,GAAG,SAAS,CAAC,QAAwB,CAAkC,CAAC;IACrF,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,KAAK,KAAK,WAAW,EAAE,CAAC;QAC1B,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,KAAK,KAAK,YAAY,EAAE,CAAC;QAC3B,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,WAAW,CAAC,QAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAC7F,CAAC;AAED,0HAA0H;AAC1H,MAAM,UAAU,cAAc,CAAC,QAAgB,EAAE,OAA0B;IACzE,MAAM,GAAG,GAAG,SAAS,CAAC,QAAwB,CAAkC,CAAC;IACjF,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IAC7B,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,OAAO,YAAY,CAAC;IACtB,CAAC;IACD,MAAM,IAAI,GAAG,WAAW,CAAC,QAAwB,CAAC,IAAI,EAAE,CAAC;IACzD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC"}

package/dist/server/auth/permissions.d.ts

@@ -16,6 +16,15 @@ export declare const statement: {
     readonly sessions: readonly ["view", "revoke"];
     readonly 'player-note': readonly ["view", "create"];
     readonly 'tag-rule': readonly ["view", "update"];
+    readonly tag: readonly ["view", "create", "delete"];
+    readonly 'chat-room': readonly ["view", "create", "update", "delete"];
+    readonly 'auto-withdrawal-config': readonly ["view", "update"];
+    readonly 'bonus-rollover-config': readonly ["view", "update"];
+    readonly 'wallet-asset': readonly ["view", "create", "update", "delete"];
+    readonly 'wallet-custody': readonly ["view", "run"];
+    readonly 'wallet-reconciliation': readonly ["view", "resolve", "run"];
+    readonly 'chat-command': readonly ["view", "update"];
+    readonly 'chat-moderation': readonly ["view", "moderate"];
 };
 export declare const ac: {
     newRole<const TRoleStatements extends import("better-auth/plugins/access").Statements>(statements: import("better-auth/plugins/access").RoleInput<{
@@ -36,6 +45,15 @@ export declare const ac: {
         readonly sessions: readonly ["view", "revoke"];
         readonly 'player-note': readonly ["view", "create"];
         readonly 'tag-rule': readonly ["view", "update"];
+        readonly tag: readonly ["view", "create", "delete"];
+        readonly 'chat-room': readonly ["view", "create", "update", "delete"];
+        readonly 'auto-withdrawal-config': readonly ["view", "update"];
+        readonly 'bonus-rollover-config': readonly ["view", "update"];
+        readonly 'wallet-asset': readonly ["view", "create", "update", "delete"];
+        readonly 'wallet-custody': readonly ["view", "run"];
+        readonly 'wallet-reconciliation': readonly ["view", "resolve", "run"];
+        readonly 'chat-command': readonly ["view", "update"];
+        readonly 'chat-moderation': readonly ["view", "moderate"];
     }, TRoleStatements>): import("better-auth/plugins/access").Role<import("better-auth/plugins/access").ExactRoleStatements<TRoleStatements>, {
         readonly player: readonly ["view", "update", "ban", "adjust-balance"];
         readonly transaction: readonly ["view", "refund"];
@@ -54,6 +72,15 @@ export declare const ac: {
         readonly sessions: readonly ["view", "revoke"];
         readonly 'player-note': readonly ["view", "create"];
         readonly 'tag-rule': readonly ["view", "update"];
+        readonly tag: readonly ["view", "create", "delete"];
+        readonly 'chat-room': readonly ["view", "create", "update", "delete"];
+        readonly 'auto-withdrawal-config': readonly ["view", "update"];
+        readonly 'bonus-rollover-config': readonly ["view", "update"];
+        readonly 'wallet-asset': readonly ["view", "create", "update", "delete"];
+        readonly 'wallet-custody': readonly ["view", "run"];
+        readonly 'wallet-reconciliation': readonly ["view", "resolve", "run"];
+        readonly 'chat-command': readonly ["view", "update"];
+        readonly 'chat-moderation': readonly ["view", "moderate"];
     }>;
     statements: {
         readonly player: readonly ["view", "update", "ban", "adjust-balance"];
@@ -73,6 +100,15 @@ export declare const ac: {
         readonly sessions: readonly ["view", "revoke"];
         readonly 'player-note': readonly ["view", "create"];
         readonly 'tag-rule': readonly ["view", "update"];
+        readonly tag: readonly ["view", "create", "delete"];
+        readonly 'chat-room': readonly ["view", "create", "update", "delete"];
+        readonly 'auto-withdrawal-config': readonly ["view", "update"];
+        readonly 'bonus-rollover-config': readonly ["view", "update"];
+        readonly 'wallet-asset': readonly ["view", "create", "update", "delete"];
+        readonly 'wallet-custody': readonly ["view", "run"];
+        readonly 'wallet-reconciliation': readonly ["view", "resolve", "run"];
+        readonly 'chat-command': readonly ["view", "update"];
+        readonly 'chat-moderation': readonly ["view", "moderate"];
     };
 };
 export declare const adminRole: import("better-auth/plugins/access").Role<import("better-auth/plugins/access").ExactRoleStatements<{
@@ -93,6 +129,15 @@ export declare const adminRole: import("better-auth/plugins/access").Role<import
     readonly sessions: ["view", "revoke"];
     readonly 'player-note': ["view", "create"];
     readonly 'tag-rule': ["view", "update"];
+    readonly tag: ["view", "create", "delete"];
+    readonly 'chat-room': ["view", "create", "update", "delete"];
+    readonly 'auto-withdrawal-config': ["view", "update"];
+    readonly 'bonus-rollover-config': ["view", "update"];
+    readonly 'wallet-asset': ["view", "create", "update", "delete"];
+    readonly 'wallet-custody': ["view", "run"];
+    readonly 'wallet-reconciliation': ["view", "resolve", "run"];
+    readonly 'chat-command': ["view", "update"];
+    readonly 'chat-moderation': ["view", "moderate"];
 }>, {
     readonly player: readonly ["view", "update", "ban", "adjust-balance"];
     readonly transaction: readonly ["view", "refund"];
@@ -111,6 +156,15 @@ export declare const adminRole: import("better-auth/plugins/access").Role<import
     readonly sessions: readonly ["view", "revoke"];
     readonly 'player-note': readonly ["view", "create"];
     readonly 'tag-rule': readonly ["view", "update"];
+    readonly tag: readonly ["view", "create", "delete"];
+    readonly 'chat-room': readonly ["view", "create", "update", "delete"];
+    readonly 'auto-withdrawal-config': readonly ["view", "update"];
+    readonly 'bonus-rollover-config': readonly ["view", "update"];
+    readonly 'wallet-asset': readonly ["view", "create", "update", "delete"];
+    readonly 'wallet-custody': readonly ["view", "run"];
+    readonly 'wallet-reconciliation': readonly ["view", "resolve", "run"];
+    readonly 'chat-command': readonly ["view", "update"];
+    readonly 'chat-moderation': readonly ["view", "moderate"];
 }>;
 export declare const supportRole: import("better-auth/plugins/access").Role<import("better-auth/plugins/access").ExactRoleStatements<{
     readonly player: ["view", "update"];
@@ -136,6 +190,15 @@ export declare const supportRole: import("better-auth/plugins/access").Role<impo
     readonly sessions: readonly ["view", "revoke"];
     readonly 'player-note': readonly ["view", "create"];
     readonly 'tag-rule': readonly ["view", "update"];
+    readonly tag: readonly ["view", "create", "delete"];
+    readonly 'chat-room': readonly ["view", "create", "update", "delete"];
+    readonly 'auto-withdrawal-config': readonly ["view", "update"];
+    readonly 'bonus-rollover-config': readonly ["view", "update"];
+    readonly 'wallet-asset': readonly ["view", "create", "update", "delete"];
+    readonly 'wallet-custody': readonly ["view", "run"];
+    readonly 'wallet-reconciliation': readonly ["view", "resolve", "run"];
+    readonly 'chat-command': readonly ["view", "update"];
+    readonly 'chat-moderation': readonly ["view", "moderate"];
 }>;
 export declare const contentManagerRole: import("better-auth/plugins/access").Role<import("better-auth/plugins/access").ExactRoleStatements<{
     readonly content: ["create", "update", "delete", "publish"];
@@ -158,6 +221,15 @@ export declare const contentManagerRole: import("better-auth/plugins/access").Ro
     readonly sessions: readonly ["view", "revoke"];
     readonly 'player-note': readonly ["view", "create"];
     readonly 'tag-rule': readonly ["view", "update"];
+    readonly tag: readonly ["view", "create", "delete"];
+    readonly 'chat-room': readonly ["view", "create", "update", "delete"];
+    readonly 'auto-withdrawal-config': readonly ["view", "update"];
+    readonly 'bonus-rollover-config': readonly ["view", "update"];
+    readonly 'wallet-asset': readonly ["view", "create", "update", "delete"];
+    readonly 'wallet-custody': readonly ["view", "run"];
+    readonly 'wallet-reconciliation': readonly ["view", "resolve", "run"];
+    readonly 'chat-command': readonly ["view", "update"];
+    readonly 'chat-moderation': readonly ["view", "moderate"];
 }>;
 export declare const roles: {
     readonly admin: import("better-auth/plugins/access").Role<import("better-auth/plugins/access").ExactRoleStatements<{
@@ -178,6 +250,15 @@ export declare const roles: {
         readonly sessions: ["view", "revoke"];
         readonly 'player-note': ["view", "create"];
         readonly 'tag-rule': ["view", "update"];
+        readonly tag: ["view", "create", "delete"];
+        readonly 'chat-room': ["view", "create", "update", "delete"];
+        readonly 'auto-withdrawal-config': ["view", "update"];
+        readonly 'bonus-rollover-config': ["view", "update"];
+        readonly 'wallet-asset': ["view", "create", "update", "delete"];
+        readonly 'wallet-custody': ["view", "run"];
+        readonly 'wallet-reconciliation': ["view", "resolve", "run"];
+        readonly 'chat-command': ["view", "update"];
+        readonly 'chat-moderation': ["view", "moderate"];
     }>, {
         readonly player: readonly ["view", "update", "ban", "adjust-balance"];
         readonly transaction: readonly ["view", "refund"];
@@ -196,6 +277,15 @@ export declare const roles: {
         readonly sessions: readonly ["view", "revoke"];
         readonly 'player-note': readonly ["view", "create"];
         readonly 'tag-rule': readonly ["view", "update"];
+        readonly tag: readonly ["view", "create", "delete"];
+        readonly 'chat-room': readonly ["view", "create", "update", "delete"];
+        readonly 'auto-withdrawal-config': readonly ["view", "update"];
+        readonly 'bonus-rollover-config': readonly ["view", "update"];
+        readonly 'wallet-asset': readonly ["view", "create", "update", "delete"];
+        readonly 'wallet-custody': readonly ["view", "run"];
+        readonly 'wallet-reconciliation': readonly ["view", "resolve", "run"];
+        readonly 'chat-command': readonly ["view", "update"];
+        readonly 'chat-moderation': readonly ["view", "moderate"];
     }>;
     readonly support: import("better-auth/plugins/access").Role<import("better-auth/plugins/access").ExactRoleStatements<{
         readonly player: ["view", "update"];
@@ -221,6 +311,15 @@ export declare const roles: {
         readonly sessions: readonly ["view", "revoke"];
         readonly 'player-note': readonly ["view", "create"];
         readonly 'tag-rule': readonly ["view", "update"];
+        readonly tag: readonly ["view", "create", "delete"];
+        readonly 'chat-room': readonly ["view", "create", "update", "delete"];
+        readonly 'auto-withdrawal-config': readonly ["view", "update"];
+        readonly 'bonus-rollover-config': readonly ["view", "update"];
+        readonly 'wallet-asset': readonly ["view", "create", "update", "delete"];
+        readonly 'wallet-custody': readonly ["view", "run"];
+        readonly 'wallet-reconciliation': readonly ["view", "resolve", "run"];
+        readonly 'chat-command': readonly ["view", "update"];
+        readonly 'chat-moderation': readonly ["view", "moderate"];
     }>;
     readonly 'content-manager': import("better-auth/plugins/access").Role<import("better-auth/plugins/access").ExactRoleStatements<{
         readonly content: ["create", "update", "delete", "publish"];
@@ -243,6 +342,15 @@ export declare const roles: {
         readonly sessions: readonly ["view", "revoke"];
         readonly 'player-note': readonly ["view", "create"];
         readonly 'tag-rule': readonly ["view", "update"];
+        readonly tag: readonly ["view", "create", "delete"];
+        readonly 'chat-room': readonly ["view", "create", "update", "delete"];
+        readonly 'auto-withdrawal-config': readonly ["view", "update"];
+        readonly 'bonus-rollover-config': readonly ["view", "update"];
+        readonly 'wallet-asset': readonly ["view", "create", "update", "delete"];
+        readonly 'wallet-custody': readonly ["view", "run"];
+        readonly 'wallet-reconciliation': readonly ["view", "resolve", "run"];
+        readonly 'chat-command': readonly ["view", "update"];
+        readonly 'chat-moderation': readonly ["view", "moderate"];
     }>;
 };
 export type RoleName = keyof typeof roles;

package/dist/server/auth/permissions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../../../src/server/auth/permissions.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;CAkBZ,CAAC;AAEX,eAAO,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAAiC,CAAC;AAEjD,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAkBpB,CAAC;AAEH,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;EAMtB,CAAC;AAEH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;EAG7B,CAAC;AAEH,eAAO,MAAM,KAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAIR,CAAC;AAEX,MAAM,MAAM,QAAQ,GAAG,MAAM,OAAO,KAAK,CAAC;AAC1C,MAAM,MAAM,YAAY,GAAG,MAAM,OAAO,SAAS,CAAC;AAClD,MAAM,MAAM,QAAQ,CAAC,CAAC,SAAS,YAAY,IAAI,CAAC,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC"}
+{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../../../src/server/auth/permissions.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2BZ,CAAC;AAEX,eAAO,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAAiC,CAAC;AAEjD,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA2BpB,CAAC;AAEH,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAMtB,CAAC;AAEH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAG7B,CAAC;AAEH,eAAO,MAAM,KAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAIR,CAAC;AAEX,MAAM,MAAM,QAAQ,GAAG,MAAM,OAAO,KAAK,CAAC;AAC1C,MAAM,MAAM,YAAY,GAAG,MAAM,OAAO,SAAS,CAAC;AAClD,MAAM,MAAM,QAAQ,CAAC,CAAC,SAAS,YAAY,IAAI,CAAC,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC"}

package/dist/server/auth/permissions.js

@@ -17,6 +17,15 @@ export const statement = {
     sessions: ['view', 'revoke'],
     'player-note': ['view', 'create'],
     'tag-rule': ['view', 'update'],
+    tag: ['view', 'create', 'delete'],
+    'chat-room': ['view', 'create', 'update', 'delete'],
+    'auto-withdrawal-config': ['view', 'update'],
+    'bonus-rollover-config': ['view', 'update'],
+    'wallet-asset': ['view', 'create', 'update', 'delete'],
+    'wallet-custody': ['view', 'run'],
+    'wallet-reconciliation': ['view', 'resolve', 'run'],
+    'chat-command': ['view', 'update'],
+    'chat-moderation': ['view', 'moderate'],
 };
 export const ac = createAccessControl(statement);
 export const adminRole = ac.newRole({
@@ -37,6 +46,15 @@ export const adminRole = ac.newRole({
     sessions: ['view', 'revoke'],
     'player-note': ['view', 'create'],
     'tag-rule': ['view', 'update'],
+    tag: ['view', 'create', 'delete'],
+    'chat-room': ['view', 'create', 'update', 'delete'],
+    'auto-withdrawal-config': ['view', 'update'],
+    'bonus-rollover-config': ['view', 'update'],
+    'wallet-asset': ['view', 'create', 'update', 'delete'],
+    'wallet-custody': ['view', 'run'],
+    'wallet-reconciliation': ['view', 'resolve', 'run'],
+    'chat-command': ['view', 'update'],
+    'chat-moderation': ['view', 'moderate'],
 });
 export const supportRole = ac.newRole({
     player: ['view', 'update'],

package/dist/server/auth/permissions.js.map

@@ -1 +1 @@
-{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../../../src/server/auth/permissions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAEjE,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,MAAM,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,gBAAgB,CAAU;IAC5D,WAAW,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAU;IACxC,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAU;IAC5C,OAAO,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAU;IAC3D,UAAU,EAAE,CAAC,MAAM,EAAE,gBAAgB,EAAE,WAAW,CAAU;IAC5D,MAAM,EAAE,CAAC,MAAM,CAAU;IACzB,UAAU,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAU;IACvE,KAAK,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAU;IAC/D,KAAK,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAU;IAClC,KAAK,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAU;IACjE,aAAa,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAU;IACtD,SAAS,EAAE,CAAC,MAAM,CAAU;IAC5B,UAAU,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,SAAS,CAAU;IACrD,SAAS,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAU;IACtC,QAAQ,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAU;IACrC,aAAa,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAU;IAC1C,UAAU,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAU;CAC/B,CAAC;AAEX,MAAM,CAAC,MAAM,EAAE,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;AAEjD,MAAM,CAAC,MAAM,SAAS,GAAG,EAAE,CAAC,OAAO,CAAC;IAClC,MAAM,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,gBAAgB,CAAC;IACnD,WAAW,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC/B,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC;IACnC,OAAO,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC;IAClD,UAAU,EAAE,CAAC,MAAM,EAAE,gBAAgB,EAAE,WAAW,CAAC;IACnD,MAAM,EAAE,CAAC,MAAM,CAAC;IAChB,UAAU,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC;IAC9D,KAAK,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC;IACtD,KAAK,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;IACzB,KAAK,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC;IACxD,aAAa,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAC;IAC7C,SAAS,EAAE,CAAC,MAAM,CAAC;IACnB,UAAU,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,SAAS,CAAC;IAC5C,SAAS,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC7B,QAAQ,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC5B,aAAa,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;IACjC,UAAU,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;CAC/B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,WAAW,GAAG,EAAE,CAAC,OAAO,CAAC;IACpC,MAAM,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC1B,WAAW,EAAE,CAAC,MAAM,CAAC;IACrB,UAAU,EAAE,CAAC,MAAM,CAAC;IACpB,MAAM,EAAE,CAAC,MAAM,CAAC;IAChB,SAAS,EAAE,CAAC,MAAM,CAAC;CACpB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,CAAC,OAAO,CAAC;IAC3C,OAAO,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC;IAClD,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC;CACpC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,KAAK,GAAG;IACnB,KAAK,EAAE,SAAS;IAChB,OAAO,EAAE,WAAW;IACpB,iBAAiB,EAAE,kBAAkB;CAC7B,CAAC"}
+{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../../../src/server/auth/permissions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAEjE,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,MAAM,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,gBAAgB,CAAU;IAC5D,WAAW,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAU;IACxC,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAU;IAC5C,OAAO,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAU;IAC3D,UAAU,EAAE,CAAC,MAAM,EAAE,gBAAgB,EAAE,WAAW,CAAU;IAC5D,MAAM,EAAE,CAAC,MAAM,CAAU;IACzB,UAAU,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAU;IACvE,KAAK,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAU;IAC/D,KAAK,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAU;IAClC,KAAK,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAU;IACjE,aAAa,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAU;IACtD,SAAS,EAAE,CAAC,MAAM,CAAU;IAC5B,UAAU,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,SAAS,CAAU;IACrD,SAAS,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAU;IACtC,QAAQ,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAU;IACrC,aAAa,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAU;IAC1C,UAAU,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAU;IACvC,GAAG,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAU;IAC1C,WAAW,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAU;IAC5D,wBAAwB,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAU;IACrD,uBAAuB,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAU;IACpD,cAAc,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAU;IAC/D,gBAAgB,EAAE,CAAC,MAAM,EAAE,KAAK,CAAU;IAC1C,uBAAuB,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAU;IAC5D,cAAc,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAU;IAC3C,iBAAiB,EAAE,CAAC,MAAM,EAAE,UAAU,CAAU;CACxC,CAAC;AAEX,MAAM,CAAC,MAAM,EAAE,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;AAEjD,MAAM,CAAC,MAAM,SAAS,GAAG,EAAE,CAAC,OAAO,CAAC;IAClC,MAAM,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,gBAAgB,CAAC;IACnD,WAAW,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC/B,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC;IACnC,OAAO,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC;IAClD,UAAU,EAAE,CAAC,MAAM,EAAE,gBAAgB,EAAE,WAAW,CAAC;IACnD,MAAM,EAAE,CAAC,MAAM,CAAC;IAChB,UAAU,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC;IAC9D,KAAK,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC;IACtD,KAAK,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;IACzB,KAAK,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC;IACxD,aAAa,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAC;IAC7C,SAAS,EAAE,CAAC,MAAM,CAAC;IACnB,UAAU,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,SAAS,CAAC;IAC5C,SAAS,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC7B,QAAQ,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC5B,aAAa,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;IACjC,UAAU,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC9B,GAAG,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC;IACjC,WAAW,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC;IACnD,wBAAwB,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC5C,uBAAuB,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC3C,cAAc,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC;IACtD,gBAAgB,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC;IACjC,uBAAuB,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC;IACnD,cAAc,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;IAClC,iBAAiB,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC;CACxC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,WAAW,GAAG,EAAE,CAAC,OAAO,CAAC;IACpC,MAAM,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC1B,WAAW,EAAE,CAAC,MAAM,CAAC;IACrB,UAAU,EAAE,CAAC,MAAM,CAAC;IACpB,MAAM,EAAE,CAAC,MAAM,CAAC;IAChB,SAAS,EAAE,CAAC,MAAM,CAAC;CACpB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,CAAC,OAAO,CAAC;IAC3C,OAAO,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC;IAClD,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC;CACpC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,KAAK,GAAG;IACnB,KAAK,EAAE,SAAS;IAChB,OAAO,EAAE,WAAW;IACpB,iBAAiB,EAAE,kBAAkB;CAC7B,CAAC"}

package/dist/server/auth/session-resolver.d.ts

@@ -6,5 +6,9 @@ export declare class SessionResolver {
     readonly auth: Auth;
     constructor(drizzle: DrizzleService, schema?: Record<string, unknown>);
     resolveUserId(headers: Headers): Promise<string | undefined>;
+    resolveSession(headers: Headers): Promise<{
+        userId: string;
+        sessionId?: string | undefined;
+    } | undefined>;
 }
 //# sourceMappingURL=session-resolver.d.ts.map

package/dist/server/auth/session-resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-resolver.d.ts","sourceRoot":"","sources":["../../../src/server/auth/session-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,yBAAyB,CAAC;AAClE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EAAc,KAAK,IAAI,EAAE,MAAM,WAAW,CAAC;AAQlD,eAAO,MAAM,YAAY,EAAE,KAAK,CAAC,eAAe,CAA+B,CAAC;AAEhF,qBAAa,eAAe;IAC1B,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;gBAKR,OAAO,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAI/D,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;CAInE"}
+{"version":3,"file":"session-resolver.d.ts","sourceRoot":"","sources":["../../../src/server/auth/session-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,yBAAyB,CAAC;AAClE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EAAc,KAAK,IAAI,EAAE,MAAM,WAAW,CAAC;AAQlD,eAAO,MAAM,YAAY,EAAE,KAAK,CAAC,eAAe,CAA+B,CAAC;AAEhF,qBAAa,eAAe;IAC1B,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;gBAKR,OAAO,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAI/D,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAO5D,cAAc,CAClB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,GAAG,SAAS,CAAC;CAK3E"}

package/dist/server/auth/session-resolver.js

@@ -16,8 +16,15 @@ export class SessionResolver {
         this.auth = createAuth({ db: drizzle.db, ...(schema ? { schema } : {}) });
     }
     async resolveUserId(headers) {
-        const session = await this.auth.api.getSession({ headers });
-        return session?.user?.id;
+        return (await this.resolveSession(headers))?.userId;
+    }
+    // sessionId identifies the session row itself, so a handler can tell the caller's
+    // own device apart from their others. Optional because a stubbed/partial getSession
+    // response still carries a usable userId.
+    async resolveSession(headers) {
+        const resolved = await this.auth.api.getSession({ headers });
+        const userId = resolved?.user?.id;
+        return userId ? { userId, sessionId: resolved?.session?.id } : undefined;
     }
 }
 //# sourceMappingURL=session-resolver.js.map

package/dist/server/auth/session-resolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"session-resolver.js","sourceRoot":"","sources":["../../../src/server/auth/session-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAc,MAAM,yBAAyB,CAAC;AAElE,OAAO,EAAE,UAAU,EAAa,MAAM,WAAW,CAAC;AAElD,iFAAiF;AACjF,8EAA8E;AAC9E,sFAAsF;AACtF,kFAAkF;AAClF,iFAAiF;AACjF,mEAAmE;AACnE,MAAM,CAAC,MAAM,YAAY,GAA2B,WAAW,CAAC,cAAc,CAAC,CAAC;AAEhF,MAAM,OAAO,eAAe;IACjB,IAAI,CAAO;IAEpB,qFAAqF;IACrF,qFAAqF;IACrF,8DAA8D;IAC9D,YAAY,OAAuB,EAAE,MAAgC;QACnE,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC5E,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,OAAgB;QAClC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QAC5D,OAAO,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC;IAC3B,CAAC;CACF"}
+{"version":3,"file":"session-resolver.js","sourceRoot":"","sources":["../../../src/server/auth/session-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAc,MAAM,yBAAyB,CAAC;AAElE,OAAO,EAAE,UAAU,EAAa,MAAM,WAAW,CAAC;AAElD,iFAAiF;AACjF,8EAA8E;AAC9E,sFAAsF;AACtF,kFAAkF;AAClF,iFAAiF;AACjF,mEAAmE;AACnE,MAAM,CAAC,MAAM,YAAY,GAA2B,WAAW,CAAC,cAAc,CAAC,CAAC;AAEhF,MAAM,OAAO,eAAe;IACjB,IAAI,CAAO;IAEpB,qFAAqF;IACrF,qFAAqF;IACrF,8DAA8D;IAC9D,YAAY,OAAuB,EAAE,MAAgC;QACnE,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC5E,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,OAAgB;QAClC,OAAO,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC;IACtD,CAAC;IAED,kFAAkF;IAClF,oFAAoF;IACpF,0CAA0C;IAC1C,KAAK,CAAC,cAAc,CAClB,OAAgB;QAEhB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QAC7D,MAAM,MAAM,GAAG,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC;QAClC,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3E,CAAC;CACF"}

package/dist/server/auth/sign-session-cookie.d.ts

@@ -0,0 +1,18 @@
+export type SessionCookieConfig = {
+    name: string;
+    attributes: {
+        domain?: string;
+        httpOnly?: boolean;
+        maxAge?: number;
+        path?: string;
+        secure?: boolean;
+        sameSite?: 'strict' | 'lax' | 'none' | 'Strict' | 'Lax' | 'None';
+    };
+};
+export declare function signSessionCookie({ token, sessionCookie, secret, maxAgeSeconds, }: {
+    token: string;
+    sessionCookie: SessionCookieConfig;
+    secret: string;
+    maxAgeSeconds?: number;
+}): string;
+//# sourceMappingURL=sign-session-cookie.d.ts.map

package/dist/server/auth/sign-session-cookie.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign-session-cookie.d.ts","sourceRoot":"","sources":["../../../src/server/auth/sign-session-cookie.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,mBAAmB,GAAG;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE;QACV,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,QAAQ,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;KAClE,CAAC;CACH,CAAC;AAEF,wBAAgB,iBAAiB,CAAC,EAChC,KAAK,EACL,aAAa,EACb,MAAM,EACN,aAAa,GACd,EAAE;IACD,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,mBAAmB,CAAC;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,GAAG,MAAM,CAUT"}

package/dist/server/auth/sign-session-cookie.js

@@ -0,0 +1,15 @@
+import { createHmac } from 'node:crypto';
+import { serialize } from 'hono/utils/cookie';
+export function signSessionCookie({ token, sessionCookie, secret, maxAgeSeconds, }) {
+    const signature = createHmac('sha256', secret).update(token).digest('base64');
+    const signedValue = `${token}.${signature}`;
+    const attributes = { ...sessionCookie.attributes };
+    if (maxAgeSeconds === undefined) {
+        delete attributes.maxAge;
+    }
+    else {
+        attributes.maxAge = maxAgeSeconds;
+    }
+    return serialize(sessionCookie.name, signedValue, attributes);
+}
+//# sourceMappingURL=sign-session-cookie.js.map

package/dist/server/auth/sign-session-cookie.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign-session-cookie.js","sourceRoot":"","sources":["../../../src/server/auth/sign-session-cookie.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAc9C,MAAM,UAAU,iBAAiB,CAAC,EAChC,KAAK,EACL,aAAa,EACb,MAAM,EACN,aAAa,GAMd;IACC,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC9E,MAAM,WAAW,GAAG,GAAG,KAAK,IAAI,SAAS,EAAE,CAAC;IAC5C,MAAM,UAAU,GAAG,EAAE,GAAG,aAAa,CAAC,UAAU,EAAE,CAAC;IACnD,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,UAAU,CAAC,MAAM,CAAC;IAC3B,CAAC;SAAM,CAAC;QACN,UAAU,CAAC,MAAM,GAAG,aAAa,CAAC;IACpC,CAAC;IACD,OAAO,SAAS,CAAC,aAAa,CAAC,IAAI,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;AAChE,CAAC"}

package/dist/server/db/__tests__/migrate.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=migrate.test.d.ts.map

package/dist/server/db/__tests__/migrate.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrate.test.d.ts","sourceRoot":"","sources":["../../../../src/server/db/__tests__/migrate.test.ts"],"names":[],"mappings":""}