@openora/core 0.4.1-canary.11 → 0.4.1-canary.111

package/dist/server/auth/auth.js

@@ -1,8 +1,17 @@
 import { randomUUID } from 'node:crypto';
 import { betterAuth } from 'better-auth';
 import { drizzleAdapter } from 'better-auth/adapters/drizzle';
-import { organization, admin as adminPlugin, twoFactor } from 'better-auth/plugins';
+import { organization, admin as adminPlugin, twoFactor, emailOTP } from 'better-auth/plugins';
 import { ac, roles } from './permissions.js';
+import { OTP_CODE_LENGTH, OTP_EXPIRES_IN_SEC, DEFAULT_EMAIL_TEMPLATES, } from '@openora/core/contracts';
+// Used only by SessionResolver's createAuth() call, which never sends email (getSession
+// only) - keeps templateRenderer optional on AuthOptions without a server/auth -> pam
+// layering violation (the real DefaultEmailTemplateRenderer lives in pam/identity).
+// Delegates to the shared DEFAULT_EMAIL_TEMPLATES map (contracts/adapters/email-template.ts)
+// so this fallback copy can never drift from DefaultEmailTemplateRenderer's.
+const fallbackTemplateRenderer = {
+    render: (key, data) => DEFAULT_EMAIL_TEMPLATES[key](data),
+};
 /**
  * Builds the one shared better-auth instance for the whole app - both the
  * per-request session middleware and `AdminGuard` resolve sessions through it,
@@ -11,9 +20,16 @@ import { ac, roles } from './permissions.js';
  * when omitted (eg tests) rather than throwing. The explicit `BetterAuthType`
  * return annotation is load-bearing, not stylistic - it dodges a TS2883 Zod v4
  * `$strip` portability error the inferred type would otherwise surface.
+ *
+ * `cookieDomain` (or `AUTH_COOKIE_DOMAIN`) widens the session cookie to a parent
+ * domain, so a frontend on `app.example.com` still sends it to an API on
+ * `api.example.com`. Left unset the cookie stays host-only, which is correct when
+ * both run on one host and is the safer default everywhere else.
  */
 export function createAuth(options) {
     const sendEmail = options.sendEmail ?? (() => { });
+    const templateRenderer = options.templateRenderer ?? fallbackTemplateRenderer;
+    const cookieDomain = options.cookieDomain ?? process.env['AUTH_COOKIE_DOMAIN'];
     return betterAuth({
         database: drizzleAdapter(options.db, {
             provider: 'pg',
@@ -23,6 +39,7 @@ export function createAuth(options) {
             database: {
                 generateId: () => randomUUID(),
             },
+            ...(cookieDomain ? { crossSubDomainCookies: { enabled: true, domain: cookieDomain } } : {}),
         },
         session: {
             expiresIn: 30 * 24 * 60 * 60,
@@ -34,33 +51,65 @@ export function createAuth(options) {
             // are validated at the route (theme against the enum, language against
             // PlatformConfig.supportedLanguages).
             additionalFields: {
+                username: { type: 'string', required: false, input: true },
                 theme: { type: 'string', required: false, input: true, defaultValue: 'system' },
                 language: { type: 'string', required: false, input: true, defaultValue: 'en' },
             },
         },
         emailAndPassword: {
             enabled: true,
-            rememberMeDuration: 30 * 24 * 60 * 60,
-            sendResetPassword: async ({ user, url, token }) => {
-                await sendEmail({
-                    to: user.email,
-                    subject: 'Reset your password',
-                    body: `Reset your password using this link: ${url}\n\nReset token: ${token}`,
-                });
-            },
+            // Sign-up never mints a session: better-auth only returns the indistinguishable
+            // duplicate-email response when autoSignIn is off (or verification is required,
+            // which is now operator-configurable). The session is minted by the OTP
+            // verification step instead - see `autoSignInAfterVerification` below.
+            autoSignIn: false,
+            requireEmailVerification: options.requireEmailVerification ?? false,
+            revokeSessionsOnPasswordReset: true,
+            onExistingUserSignUp: options.onExistingUserSignUp
+                ? async ({ user }) => {
+                    await options.onExistingUserSignUp?.({ id: user.id, email: user.email });
+                }
+                : undefined,
+            onPasswordReset: options.onPasswordReset
+                ? async ({ user }) => {
+                    await options.onPasswordReset?.({ id: user.id, email: user.email });
+                }
+                : undefined,
         },
         emailVerification: {
-            sendVerificationEmail: async ({ user, url, token }) => {
-                await sendEmail({
-                    to: user.email,
-                    subject: 'Verify your email',
-                    body: `Verify your email using this link: ${url}\n\nVerification token: ${token}`,
-                });
-            },
+            // The verification OTP is sent by IdentityService.register(), never by better-auth:
+            // its sign-up hook fires on the synthetic duplicate-email response too, which would
+            // mail a valid code to an existing account's address (takeover).
+            sendOnSignUp: false,
+            autoSignInAfterVerification: true,
         },
         // Without this, better-auth's admin plugin defaults new signups to its own
         // 'user' role, which UserRoleSchema (player|admin) rejects everywhere downstream.
-        plugins: [organization(), adminPlugin({ ac, roles, defaultRole: 'player' }), twoFactor()],
+        plugins: [
+            organization(),
+            adminPlugin({ ac, roles, defaultRole: 'player' }),
+            twoFactor(),
+            emailOTP({
+                otpLength: OTP_CODE_LENGTH,
+                expiresIn: OTP_EXPIRES_IN_SEC,
+                async sendVerificationOTP({ email, otp, type }) {
+                    // Allow-list, not a fallback: an OTP type this app never issues (sign-in,
+                    // change-email) must send nothing rather than borrow another template's copy.
+                    if (type !== 'email-verification' && type !== 'forget-password') {
+                        return;
+                    }
+                    const locale = (await options.getUserLanguage?.(email)) ?? 'en';
+                    // Three explicit branches, not a computed key: `render` is generic over the key,
+                    // so a union of keys will not narrow the data argument to a single payload type.
+                    const { subject, body } = type === 'email-verification'
+                        ? await templateRenderer.render('verifyEmail', { otp }, locale)
+                        : options.isExistingAccountSignUp?.(email)
+                            ? await templateRenderer.render('existingAccountSignUp', { otp, email }, locale)
+                            : await templateRenderer.render('resetPasswordOtp', { otp, email }, locale);
+                    await sendEmail({ to: email, subject, body });
+                },
+            }),
+        ],
         // Library boundary: better-auth infers an options-specific instantiation that isn't
         // assignable to its own exported `Auth` alias. No way to narrow without matching the
         // full generic - the one sanctioned cast, see conventions.

package/dist/server/auth/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/server/auth/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,KAAK,IAAI,WAAW,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAEpF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAgB7C;;;;;;;;GAQG;AACH,MAAM,UAAU,UAAU,CAAC,OAAoB;IAC7C,MAAM,SAAS,GAAc,OAAO,CAAC,SAAS,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAC7D,OAAO,UAAU,CAAC;QAChB,QAAQ,EAAE,cAAc,CAAC,OAAO,CAAC,EAAE,EAAE;YACnC,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,OAAO,CAAC,MAAM;SACvB,CAAC;QACF,QAAQ,EAAE;YACR,QAAQ,EAAE;gBACR,UAAU,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE;aAC/B;SACF;QACD,OAAO,EAAE;YACP,SAAS,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE;YAC5B,SAAS,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE;SACxB;QACD,IAAI,EAAE;YACJ,6EAA6E;YAC7E,6EAA6E;YAC7E,uEAAuE;YACvE,sCAAsC;YACtC,gBAAgB,EAAE;gBAChB,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE;gBAC/E,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE;aAC/E;SACF;QACD,gBAAgB,EAAE;YAChB,OAAO,EAAE,IAAI;YACb,kBAAkB,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE;YACrC,iBAAiB,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE;gBAChD,MAAM,SAAS,CAAC;oBACd,EAAE,EAAE,IAAI,CAAC,KAAK;oBACd,OAAO,EAAE,qBAAqB;oBAC9B,IAAI,EAAE,wCAAwC,GAAG,oBAAoB,KAAK,EAAE;iBAC7E,CAAC,CAAC;YACL,CAAC;SACF;QACD,iBAAiB,EAAE;YACjB,qBAAqB,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE;gBACpD,MAAM,SAAS,CAAC;oBACd,EAAE,EAAE,IAAI,CAAC,KAAK;oBACd,OAAO,EAAE,mBAAmB;oBAC5B,IAAI,EAAE,sCAAsC,GAAG,2BAA2B,KAAK,EAAE;iBAClF,CAAC,CAAC;YACL,CAAC;SACF;QACD,2EAA2E;QAC3E,kFAAkF;QAClF,OAAO,EAAE,CAAC,YAAY,EAAE,EAAE,WAAW,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC;QACzF,oFAAoF;QACpF,qFAAqF;QACrF,2DAA2D;KAC5D,CAA8B,CAAC;AAClC,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/server/auth/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,KAAK,IAAI,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAE9F,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,uBAAuB,GAExB,MAAM,yBAAyB,CAAC;AAkCjC,wFAAwF;AACxF,sFAAsF;AACtF,oFAAoF;AACpF,6FAA6F;AAC7F,6EAA6E;AAC7E,MAAM,wBAAwB,GAA0B;IACtD,MAAM,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;CAC1D,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,UAAU,CAAC,OAAoB;IAC7C,MAAM,SAAS,GAAc,OAAO,CAAC,SAAS,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAC7D,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,wBAAwB,CAAC;IAC9E,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAC/E,OAAO,UAAU,CAAC;QAChB,QAAQ,EAAE,cAAc,CAAC,OAAO,CAAC,EAAE,EAAE;YACnC,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,OAAO,CAAC,MAAM;SACvB,CAAC;QACF,QAAQ,EAAE;YACR,QAAQ,EAAE;gBACR,UAAU,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE;aAC/B;YACD,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5F;QACD,OAAO,EAAE;YACP,SAAS,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE;YAC5B,SAAS,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE;SACxB;QACD,IAAI,EAAE;YACJ,6EAA6E;YAC7E,6EAA6E;YAC7E,uEAAuE;YACvE,sCAAsC;YACtC,gBAAgB,EAAE;gBAChB,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE;gBAC1D,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE;gBAC/E,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE;aAC/E;SACF;QACD,gBAAgB,EAAE;YAChB,OAAO,EAAE,IAAI;YACb,gFAAgF;YAChF,gFAAgF;YAChF,wEAAwE;YACxE,uEAAuE;YACvE,UAAU,EAAE,KAAK;YACjB,wBAAwB,EAAE,OAAO,CAAC,wBAAwB,IAAI,KAAK;YACnE,6BAA6B,EAAE,IAAI;YACnC,oBAAoB,EAAE,OAAO,CAAC,oBAAoB;gBAChD,CAAC,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;oBACjB,MAAM,OAAO,CAAC,oBAAoB,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;gBAC3E,CAAC;gBACH,CAAC,CAAC,SAAS;YACb,eAAe,EAAE,OAAO,CAAC,eAAe;gBACtC,CAAC,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;oBACjB,MAAM,OAAO,CAAC,eAAe,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;gBACtE,CAAC;gBACH,CAAC,CAAC,SAAS;SACd;QACD,iBAAiB,EAAE;YACjB,oFAAoF;YACpF,oFAAoF;YACpF,iEAAiE;YACjE,YAAY,EAAE,KAAK;YACnB,2BAA2B,EAAE,IAAI;SAClC;QACD,2EAA2E;QAC3E,kFAAkF;QAClF,OAAO,EAAE;YACP,YAAY,EAAE;YACd,WAAW,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;YACjD,SAAS,EAAE;YACX,QAAQ,CAAC;gBACP,SAAS,EAAE,eAAe;gBAC1B,SAAS,EAAE,kBAAkB;gBAC7B,KAAK,CAAC,mBAAmB,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE;oBAC5C,0EAA0E;oBAC1E,8EAA8E;oBAC9E,IAAI,IAAI,KAAK,oBAAoB,IAAI,IAAI,KAAK,iBAAiB,EAAE,CAAC;wBAChE,OAAO;oBACT,CAAC;oBACD,MAAM,MAAM,GAAG,CAAC,MAAM,OAAO,CAAC,eAAe,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC;oBAChE,iFAAiF;oBACjF,iFAAiF;oBACjF,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GACrB,IAAI,KAAK,oBAAoB;wBAC3B,CAAC,CAAC,MAAM,gBAAgB,CAAC,MAAM,CAAC,aAAa,EAAE,EAAE,GAAG,EAAE,EAAE,MAAM,CAAC;wBAC/D,CAAC,CAAC,OAAO,CAAC,uBAAuB,EAAE,CAAC,KAAK,CAAC;4BACxC,CAAC,CAAC,MAAM,gBAAgB,CAAC,MAAM,CAAC,uBAAuB,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,MAAM,CAAC;4BAChF,CAAC,CAAC,MAAM,gBAAgB,CAAC,MAAM,CAAC,kBAAkB,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,MAAM,CAAC,CAAC;oBAClF,MAAM,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;gBAChD,CAAC;aACF,CAAC;SACH;QACD,oFAAoF;QACpF,qFAAqF;QACrF,2DAA2D;KAC5D,CAA8B,CAAC;AAClC,CAAC"}

package/dist/server/auth/index.d.ts

@@ -1,7 +1,9 @@
 export type { AuthOptions, Auth, SendEmail } from './auth.js';
 export { createAuth } from './auth.js';
 export { AdminGuard, ADMIN_GUARD } from './admin-guard.js';
+export type { AdminCaller } from './admin-guard.js';
 export { SessionResolver, AUTH_SESSION } from './session-resolver.js';
+export { signSessionCookie, type SessionCookieConfig } from './sign-session-cookie.js';
 export { ac, roles, statement } from './permissions.js';
 export type { RoleName, ResourceName, ActionOf } from './permissions.js';
 export { PERMISSION_LEVELS, SUPPORTED_LEVELS, readActions, levelRank, isLevelSufficient, levelToActions, actionsToLevel, } from './permission-levels.js';

package/dist/server/auth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/server/auth/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACxD,YAAY,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,WAAW,EACX,SAAS,EACT,iBAAiB,EACjB,cAAc,EACd,cAAc,GACf,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/server/auth/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC3D,YAAY,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,EAAE,iBAAiB,EAAE,KAAK,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AACvF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACxD,YAAY,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,WAAW,EACX,SAAS,EACT,iBAAiB,EACjB,cAAc,EACd,cAAc,GACf,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC"}

package/dist/server/auth/index.js

@@ -1,6 +1,7 @@
 export { createAuth } from './auth.js';
 export { AdminGuard, ADMIN_GUARD } from './admin-guard.js';
 export { SessionResolver, AUTH_SESSION } from './session-resolver.js';
+export { signSessionCookie } from './sign-session-cookie.js';
 export { ac, roles, statement } from './permissions.js';
 export { PERMISSION_LEVELS, SUPPORTED_LEVELS, readActions, levelRank, isLevelSufficient, levelToActions, actionsToLevel, } from './permission-levels.js';
 //# sourceMappingURL=index.js.map

package/dist/server/auth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/server/auth/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAExD,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,WAAW,EACX,SAAS,EACT,iBAAiB,EACjB,cAAc,EACd,cAAc,GACf,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/server/auth/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE3D,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,EAAE,iBAAiB,EAA4B,MAAM,0BAA0B,CAAC;AACvF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAExD,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,WAAW,EACX,SAAS,EACT,iBAAiB,EACjB,cAAc,EACd,cAAc,GACf,MAAM,wBAAwB,CAAC"}

package/dist/server/auth/permissions.d.ts

@@ -1,5 +1,5 @@
 export declare const statement: {
-    readonly player: readonly ["view", "update", "ban", "adjust-balance"];
+    readonly player: readonly ["view", "update", "ban"];
     readonly transaction: readonly ["view", "refund"];
     readonly game: readonly ["view", "enable", "disable"];
     readonly content: readonly ["create", "update", "delete", "publish"];
@@ -16,10 +16,19 @@ export declare const statement: {
     readonly sessions: readonly ["view", "revoke"];
     readonly 'player-note': readonly ["view", "create"];
     readonly 'tag-rule': readonly ["view", "update"];
+    readonly tag: readonly ["view", "create", "delete"];
+    readonly 'chat-room': readonly ["view", "create", "update", "delete"];
+    readonly 'auto-withdrawal-config': readonly ["view", "update"];
+    readonly 'bonus-rollover-config': readonly ["view", "update"];
+    readonly 'wallet-asset': readonly ["view", "create", "update", "delete"];
+    readonly 'wallet-custody': readonly ["view", "run"];
+    readonly 'wallet-reconciliation': readonly ["view", "resolve", "run"];
+    readonly 'chat-command': readonly ["view", "update"];
+    readonly 'chat-moderation': readonly ["view", "moderate"];
 };
 export declare const ac: {
     newRole<const TRoleStatements extends import("better-auth/plugins/access").Statements>(statements: import("better-auth/plugins/access").RoleInput<{
-        readonly player: readonly ["view", "update", "ban", "adjust-balance"];
+        readonly player: readonly ["view", "update", "ban"];
         readonly transaction: readonly ["view", "refund"];
         readonly game: readonly ["view", "enable", "disable"];
         readonly content: readonly ["create", "update", "delete", "publish"];
@@ -36,8 +45,17 @@ export declare const ac: {
         readonly sessions: readonly ["view", "revoke"];
         readonly 'player-note': readonly ["view", "create"];
         readonly 'tag-rule': readonly ["view", "update"];
+        readonly tag: readonly ["view", "create", "delete"];
+        readonly 'chat-room': readonly ["view", "create", "update", "delete"];
+        readonly 'auto-withdrawal-config': readonly ["view", "update"];
+        readonly 'bonus-rollover-config': readonly ["view", "update"];
+        readonly 'wallet-asset': readonly ["view", "create", "update", "delete"];
+        readonly 'wallet-custody': readonly ["view", "run"];
+        readonly 'wallet-reconciliation': readonly ["view", "resolve", "run"];
+        readonly 'chat-command': readonly ["view", "update"];
+        readonly 'chat-moderation': readonly ["view", "moderate"];
     }, TRoleStatements>): import("better-auth/plugins/access").Role<import("better-auth/plugins/access").ExactRoleStatements<TRoleStatements>, {
-        readonly player: readonly ["view", "update", "ban", "adjust-balance"];
+        readonly player: readonly ["view", "update", "ban"];
         readonly transaction: readonly ["view", "refund"];
         readonly game: readonly ["view", "enable", "disable"];
         readonly content: readonly ["create", "update", "delete", "publish"];
@@ -54,9 +72,18 @@ export declare const ac: {
         readonly sessions: readonly ["view", "revoke"];
         readonly 'player-note': readonly ["view", "create"];
         readonly 'tag-rule': readonly ["view", "update"];
+        readonly tag: readonly ["view", "create", "delete"];
+        readonly 'chat-room': readonly ["view", "create", "update", "delete"];
+        readonly 'auto-withdrawal-config': readonly ["view", "update"];
+        readonly 'bonus-rollover-config': readonly ["view", "update"];
+        readonly 'wallet-asset': readonly ["view", "create", "update", "delete"];
+        readonly 'wallet-custody': readonly ["view", "run"];
+        readonly 'wallet-reconciliation': readonly ["view", "resolve", "run"];
+        readonly 'chat-command': readonly ["view", "update"];
+        readonly 'chat-moderation': readonly ["view", "moderate"];
     }>;
     statements: {
-        readonly player: readonly ["view", "update", "ban", "adjust-balance"];
+        readonly player: readonly ["view", "update", "ban"];
         readonly transaction: readonly ["view", "refund"];
         readonly game: readonly ["view", "enable", "disable"];
         readonly content: readonly ["create", "update", "delete", "publish"];
@@ -73,10 +100,19 @@ export declare const ac: {
         readonly sessions: readonly ["view", "revoke"];
         readonly 'player-note': readonly ["view", "create"];
         readonly 'tag-rule': readonly ["view", "update"];
+        readonly tag: readonly ["view", "create", "delete"];
+        readonly 'chat-room': readonly ["view", "create", "update", "delete"];
+        readonly 'auto-withdrawal-config': readonly ["view", "update"];
+        readonly 'bonus-rollover-config': readonly ["view", "update"];
+        readonly 'wallet-asset': readonly ["view", "create", "update", "delete"];
+        readonly 'wallet-custody': readonly ["view", "run"];
+        readonly 'wallet-reconciliation': readonly ["view", "resolve", "run"];
+        readonly 'chat-command': readonly ["view", "update"];
+        readonly 'chat-moderation': readonly ["view", "moderate"];
     };
 };
 export declare const adminRole: import("better-auth/plugins/access").Role<import("better-auth/plugins/access").ExactRoleStatements<{
-    readonly player: ["view", "update", "ban", "adjust-balance"];
+    readonly player: ["view", "update", "ban"];
     readonly transaction: ["view", "refund"];
     readonly game: ["view", "enable", "disable"];
     readonly content: ["create", "update", "delete", "publish"];
@@ -93,8 +129,17 @@ export declare const adminRole: import("better-auth/plugins/access").Role<import
     readonly sessions: ["view", "revoke"];
     readonly 'player-note': ["view", "create"];
     readonly 'tag-rule': ["view", "update"];
+    readonly tag: ["view", "create", "delete"];
+    readonly 'chat-room': ["view", "create", "update", "delete"];
+    readonly 'auto-withdrawal-config': ["view", "update"];
+    readonly 'bonus-rollover-config': ["view", "update"];
+    readonly 'wallet-asset': ["view", "create", "update", "delete"];
+    readonly 'wallet-custody': ["view", "run"];
+    readonly 'wallet-reconciliation': ["view", "resolve", "run"];
+    readonly 'chat-command': ["view", "update"];
+    readonly 'chat-moderation': ["view", "moderate"];
 }>, {
-    readonly player: readonly ["view", "update", "ban", "adjust-balance"];
+    readonly player: readonly ["view", "update", "ban"];
     readonly transaction: readonly ["view", "refund"];
     readonly game: readonly ["view", "enable", "disable"];
     readonly content: readonly ["create", "update", "delete", "publish"];
@@ -111,6 +156,15 @@ export declare const adminRole: import("better-auth/plugins/access").Role<import
     readonly sessions: readonly ["view", "revoke"];
     readonly 'player-note': readonly ["view", "create"];
     readonly 'tag-rule': readonly ["view", "update"];
+    readonly tag: readonly ["view", "create", "delete"];
+    readonly 'chat-room': readonly ["view", "create", "update", "delete"];
+    readonly 'auto-withdrawal-config': readonly ["view", "update"];
+    readonly 'bonus-rollover-config': readonly ["view", "update"];
+    readonly 'wallet-asset': readonly ["view", "create", "update", "delete"];
+    readonly 'wallet-custody': readonly ["view", "run"];
+    readonly 'wallet-reconciliation': readonly ["view", "resolve", "run"];
+    readonly 'chat-command': readonly ["view", "update"];
+    readonly 'chat-moderation': readonly ["view", "moderate"];
 }>;
 export declare const supportRole: import("better-auth/plugins/access").Role<import("better-auth/plugins/access").ExactRoleStatements<{
     readonly player: ["view", "update"];
@@ -119,7 +173,7 @@ export declare const supportRole: import("better-auth/plugins/access").Role<impo
     readonly report: ["view"];
     readonly analytics: ["view"];
 }>, {
-    readonly player: readonly ["view", "update", "ban", "adjust-balance"];
+    readonly player: readonly ["view", "update", "ban"];
     readonly transaction: readonly ["view", "refund"];
     readonly game: readonly ["view", "enable", "disable"];
     readonly content: readonly ["create", "update", "delete", "publish"];
@@ -136,12 +190,21 @@ export declare const supportRole: import("better-auth/plugins/access").Role<impo
     readonly sessions: readonly ["view", "revoke"];
     readonly 'player-note': readonly ["view", "create"];
     readonly 'tag-rule': readonly ["view", "update"];
+    readonly tag: readonly ["view", "create", "delete"];
+    readonly 'chat-room': readonly ["view", "create", "update", "delete"];
+    readonly 'auto-withdrawal-config': readonly ["view", "update"];
+    readonly 'bonus-rollover-config': readonly ["view", "update"];
+    readonly 'wallet-asset': readonly ["view", "create", "update", "delete"];
+    readonly 'wallet-custody': readonly ["view", "run"];
+    readonly 'wallet-reconciliation': readonly ["view", "resolve", "run"];
+    readonly 'chat-command': readonly ["view", "update"];
+    readonly 'chat-moderation': readonly ["view", "moderate"];
 }>;
 export declare const contentManagerRole: import("better-auth/plugins/access").Role<import("better-auth/plugins/access").ExactRoleStatements<{
     readonly content: ["create", "update", "delete", "publish"];
     readonly game: ["view", "enable", "disable"];
 }>, {
-    readonly player: readonly ["view", "update", "ban", "adjust-balance"];
+    readonly player: readonly ["view", "update", "ban"];
     readonly transaction: readonly ["view", "refund"];
     readonly game: readonly ["view", "enable", "disable"];
     readonly content: readonly ["create", "update", "delete", "publish"];
@@ -158,10 +221,19 @@ export declare const contentManagerRole: import("better-auth/plugins/access").Ro
     readonly sessions: readonly ["view", "revoke"];
     readonly 'player-note': readonly ["view", "create"];
     readonly 'tag-rule': readonly ["view", "update"];
+    readonly tag: readonly ["view", "create", "delete"];
+    readonly 'chat-room': readonly ["view", "create", "update", "delete"];
+    readonly 'auto-withdrawal-config': readonly ["view", "update"];
+    readonly 'bonus-rollover-config': readonly ["view", "update"];
+    readonly 'wallet-asset': readonly ["view", "create", "update", "delete"];
+    readonly 'wallet-custody': readonly ["view", "run"];
+    readonly 'wallet-reconciliation': readonly ["view", "resolve", "run"];
+    readonly 'chat-command': readonly ["view", "update"];
+    readonly 'chat-moderation': readonly ["view", "moderate"];
 }>;
 export declare const roles: {
     readonly admin: import("better-auth/plugins/access").Role<import("better-auth/plugins/access").ExactRoleStatements<{
-        readonly player: ["view", "update", "ban", "adjust-balance"];
+        readonly player: ["view", "update", "ban"];
         readonly transaction: ["view", "refund"];
         readonly game: ["view", "enable", "disable"];
         readonly content: ["create", "update", "delete", "publish"];
@@ -178,8 +250,17 @@ export declare const roles: {
         readonly sessions: ["view", "revoke"];
         readonly 'player-note': ["view", "create"];
         readonly 'tag-rule': ["view", "update"];
+        readonly tag: ["view", "create", "delete"];
+        readonly 'chat-room': ["view", "create", "update", "delete"];
+        readonly 'auto-withdrawal-config': ["view", "update"];
+        readonly 'bonus-rollover-config': ["view", "update"];
+        readonly 'wallet-asset': ["view", "create", "update", "delete"];
+        readonly 'wallet-custody': ["view", "run"];
+        readonly 'wallet-reconciliation': ["view", "resolve", "run"];
+        readonly 'chat-command': ["view", "update"];
+        readonly 'chat-moderation': ["view", "moderate"];
     }>, {
-        readonly player: readonly ["view", "update", "ban", "adjust-balance"];
+        readonly player: readonly ["view", "update", "ban"];
         readonly transaction: readonly ["view", "refund"];
         readonly game: readonly ["view", "enable", "disable"];
         readonly content: readonly ["create", "update", "delete", "publish"];
@@ -196,6 +277,15 @@ export declare const roles: {
         readonly sessions: readonly ["view", "revoke"];
         readonly 'player-note': readonly ["view", "create"];
         readonly 'tag-rule': readonly ["view", "update"];
+        readonly tag: readonly ["view", "create", "delete"];
+        readonly 'chat-room': readonly ["view", "create", "update", "delete"];
+        readonly 'auto-withdrawal-config': readonly ["view", "update"];
+        readonly 'bonus-rollover-config': readonly ["view", "update"];
+        readonly 'wallet-asset': readonly ["view", "create", "update", "delete"];
+        readonly 'wallet-custody': readonly ["view", "run"];
+        readonly 'wallet-reconciliation': readonly ["view", "resolve", "run"];
+        readonly 'chat-command': readonly ["view", "update"];
+        readonly 'chat-moderation': readonly ["view", "moderate"];
     }>;
     readonly support: import("better-auth/plugins/access").Role<import("better-auth/plugins/access").ExactRoleStatements<{
         readonly player: ["view", "update"];
@@ -204,7 +294,7 @@ export declare const roles: {
         readonly report: ["view"];
         readonly analytics: ["view"];
     }>, {
-        readonly player: readonly ["view", "update", "ban", "adjust-balance"];
+        readonly player: readonly ["view", "update", "ban"];
         readonly transaction: readonly ["view", "refund"];
         readonly game: readonly ["view", "enable", "disable"];
         readonly content: readonly ["create", "update", "delete", "publish"];
@@ -221,12 +311,21 @@ export declare const roles: {
         readonly sessions: readonly ["view", "revoke"];
         readonly 'player-note': readonly ["view", "create"];
         readonly 'tag-rule': readonly ["view", "update"];
+        readonly tag: readonly ["view", "create", "delete"];
+        readonly 'chat-room': readonly ["view", "create", "update", "delete"];
+        readonly 'auto-withdrawal-config': readonly ["view", "update"];
+        readonly 'bonus-rollover-config': readonly ["view", "update"];
+        readonly 'wallet-asset': readonly ["view", "create", "update", "delete"];
+        readonly 'wallet-custody': readonly ["view", "run"];
+        readonly 'wallet-reconciliation': readonly ["view", "resolve", "run"];
+        readonly 'chat-command': readonly ["view", "update"];
+        readonly 'chat-moderation': readonly ["view", "moderate"];
     }>;
     readonly 'content-manager': import("better-auth/plugins/access").Role<import("better-auth/plugins/access").ExactRoleStatements<{
         readonly content: ["create", "update", "delete", "publish"];
         readonly game: ["view", "enable", "disable"];
     }>, {
-        readonly player: readonly ["view", "update", "ban", "adjust-balance"];
+        readonly player: readonly ["view", "update", "ban"];
         readonly transaction: readonly ["view", "refund"];
         readonly game: readonly ["view", "enable", "disable"];
         readonly content: readonly ["create", "update", "delete", "publish"];
@@ -243,9 +342,17 @@ export declare const roles: {
         readonly sessions: readonly ["view", "revoke"];
         readonly 'player-note': readonly ["view", "create"];
         readonly 'tag-rule': readonly ["view", "update"];
+        readonly tag: readonly ["view", "create", "delete"];
+        readonly 'chat-room': readonly ["view", "create", "update", "delete"];
+        readonly 'auto-withdrawal-config': readonly ["view", "update"];
+        readonly 'bonus-rollover-config': readonly ["view", "update"];
+        readonly 'wallet-asset': readonly ["view", "create", "update", "delete"];
+        readonly 'wallet-custody': readonly ["view", "run"];
+        readonly 'wallet-reconciliation': readonly ["view", "resolve", "run"];
+        readonly 'chat-command': readonly ["view", "update"];
+        readonly 'chat-moderation': readonly ["view", "moderate"];
     }>;
 };
 export type RoleName = keyof typeof roles;
-export type ResourceName = keyof typeof statement;
-export type ActionOf<R extends ResourceName> = (typeof statement)[R][number];
+export type { AdminResource as ResourceName, AdminActionOf as ActionOf, } from '@openora/core/contracts';
 //# sourceMappingURL=permissions.d.ts.map

package/dist/server/auth/permissions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../../../src/server/auth/permissions.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;CAkBZ,CAAC;AAEX,eAAO,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAAiC,CAAC;AAEjD,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAkBpB,CAAC;AAEH,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;EAMtB,CAAC;AAEH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;EAG7B,CAAC;AAEH,eAAO,MAAM,KAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAIR,CAAC;AAEX,MAAM,MAAM,QAAQ,GAAG,MAAM,OAAO,KAAK,CAAC;AAC1C,MAAM,MAAM,YAAY,GAAG,MAAM,OAAO,SAAS,CAAC;AAClD,MAAM,MAAM,QAAQ,CAAC,CAAC,SAAS,YAAY,IAAI,CAAC,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC"}
+{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../../../src/server/auth/permissions.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;CAAiB,CAAC;AAExC,eAAO,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAAiC,CAAC;AAEjD,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA2BpB,CAAC;AAEH,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAMtB,CAAC;AAEH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAG7B,CAAC;AAEH,eAAO,MAAM,KAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAIR,CAAC;AAEX,MAAM,MAAM,QAAQ,GAAG,MAAM,OAAO,KAAK,CAAC;AAG1C,YAAY,EACV,aAAa,IAAI,YAAY,EAC7B,aAAa,IAAI,QAAQ,GAC1B,MAAM,yBAAyB,CAAC"}

package/dist/server/auth/permissions.js

@@ -1,26 +1,11 @@
 import { createAccessControl } from 'better-auth/plugins/access';
-export const statement = {
-    player: ['view', 'update', 'ban', 'adjust-balance'],
-    transaction: ['view', 'refund'],
-    game: ['view', 'enable', 'disable'],
-    content: ['create', 'update', 'delete', 'publish'],
-    compliance: ['view', 'override-limit', 'manage-rg'],
-    report: ['view'],
-    withdrawal: ['view', 'approve', 'reject', 'hold', 'auto-rule'],
-    bonus: ['view', 'create', 'update', 'pause', 'cancel'],
-    audit: ['view', 'export'],
-    admin: ['view', 'create', 'update', 'disable', 'delete'],
-    'game-config': ['view', 'update', 'schedule'],
-    analytics: ['view'],
-    sportsbook: ['view', 'configure', 'suspend'],
-    affiliate: ['view', 'manage'],
-    sessions: ['view', 'revoke'],
-    'player-note': ['view', 'create'],
-    'tag-rule': ['view', 'update'],
-};
+import { adminStatement } from '@openora/core/contracts';
+// The catalog itself lives in contracts so the browser can import it too; this
+// name stays because better-auth calls it a statement.
+export const statement = adminStatement;
 export const ac = createAccessControl(statement);
 export const adminRole = ac.newRole({
-    player: ['view', 'update', 'ban', 'adjust-balance'],
+    player: ['view', 'update', 'ban'],
     transaction: ['view', 'refund'],
     game: ['view', 'enable', 'disable'],
     content: ['create', 'update', 'delete', 'publish'],
@@ -37,6 +22,15 @@ export const adminRole = ac.newRole({
     sessions: ['view', 'revoke'],
     'player-note': ['view', 'create'],
     'tag-rule': ['view', 'update'],
+    tag: ['view', 'create', 'delete'],
+    'chat-room': ['view', 'create', 'update', 'delete'],
+    'auto-withdrawal-config': ['view', 'update'],
+    'bonus-rollover-config': ['view', 'update'],
+    'wallet-asset': ['view', 'create', 'update', 'delete'],
+    'wallet-custody': ['view', 'run'],
+    'wallet-reconciliation': ['view', 'resolve', 'run'],
+    'chat-command': ['view', 'update'],
+    'chat-moderation': ['view', 'moderate'],
 });
 export const supportRole = ac.newRole({
     player: ['view', 'update'],

package/dist/server/auth/permissions.js.map

@@ -1 +1 @@
-{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../../../src/server/auth/permissions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAEjE,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,MAAM,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,gBAAgB,CAAU;IAC5D,WAAW,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAU;IACxC,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAU;IAC5C,OAAO,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAU;IAC3D,UAAU,EAAE,CAAC,MAAM,EAAE,gBAAgB,EAAE,WAAW,CAAU;IAC5D,MAAM,EAAE,CAAC,MAAM,CAAU;IACzB,UAAU,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAU;IACvE,KAAK,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAU;IAC/D,KAAK,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAU;IAClC,KAAK,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAU;IACjE,aAAa,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAU;IACtD,SAAS,EAAE,CAAC,MAAM,CAAU;IAC5B,UAAU,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,SAAS,CAAU;IACrD,SAAS,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAU;IACtC,QAAQ,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAU;IACrC,aAAa,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAU;IAC1C,UAAU,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAU;CAC/B,CAAC;AAEX,MAAM,CAAC,MAAM,EAAE,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;AAEjD,MAAM,CAAC,MAAM,SAAS,GAAG,EAAE,CAAC,OAAO,CAAC;IAClC,MAAM,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,gBAAgB,CAAC;IACnD,WAAW,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC/B,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC;IACnC,OAAO,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC;IAClD,UAAU,EAAE,CAAC,MAAM,EAAE,gBAAgB,EAAE,WAAW,CAAC;IACnD,MAAM,EAAE,CAAC,MAAM,CAAC;IAChB,UAAU,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC;IAC9D,KAAK,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC;IACtD,KAAK,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;IACzB,KAAK,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC;IACxD,aAAa,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAC;IAC7C,SAAS,EAAE,CAAC,MAAM,CAAC;IACnB,UAAU,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,SAAS,CAAC;IAC5C,SAAS,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC7B,QAAQ,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC5B,aAAa,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;IACjC,UAAU,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;CAC/B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,WAAW,GAAG,EAAE,CAAC,OAAO,CAAC;IACpC,MAAM,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC1B,WAAW,EAAE,CAAC,MAAM,CAAC;IACrB,UAAU,EAAE,CAAC,MAAM,CAAC;IACpB,MAAM,EAAE,CAAC,MAAM,CAAC;IAChB,SAAS,EAAE,CAAC,MAAM,CAAC;CACpB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,CAAC,OAAO,CAAC;IAC3C,OAAO,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC;IAClD,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC;CACpC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,KAAK,GAAG;IACnB,KAAK,EAAE,SAAS;IAChB,OAAO,EAAE,WAAW;IACpB,iBAAiB,EAAE,kBAAkB;CAC7B,CAAC"}
+{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../../../src/server/auth/permissions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAEzD,+EAA+E;AAC/E,uDAAuD;AACvD,MAAM,CAAC,MAAM,SAAS,GAAG,cAAc,CAAC;AAExC,MAAM,CAAC,MAAM,EAAE,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;AAEjD,MAAM,CAAC,MAAM,SAAS,GAAG,EAAE,CAAC,OAAO,CAAC;IAClC,MAAM,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC;IACjC,WAAW,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC/B,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC;IACnC,OAAO,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC;IAClD,UAAU,EAAE,CAAC,MAAM,EAAE,gBAAgB,EAAE,WAAW,CAAC;IACnD,MAAM,EAAE,CAAC,MAAM,CAAC;IAChB,UAAU,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC;IAC9D,KAAK,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC;IACtD,KAAK,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;IACzB,KAAK,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC;IACxD,aAAa,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAC;IAC7C,SAAS,EAAE,CAAC,MAAM,CAAC;IACnB,UAAU,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,SAAS,CAAC;IAC5C,SAAS,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC7B,QAAQ,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC5B,aAAa,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;IACjC,UAAU,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC9B,GAAG,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC;IACjC,WAAW,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC;IACnD,wBAAwB,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC5C,uBAAuB,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC3C,cAAc,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC;IACtD,gBAAgB,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC;IACjC,uBAAuB,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC;IACnD,cAAc,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;IAClC,iBAAiB,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC;CACxC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,WAAW,GAAG,EAAE,CAAC,OAAO,CAAC;IACpC,MAAM,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC1B,WAAW,EAAE,CAAC,MAAM,CAAC;IACrB,UAAU,EAAE,CAAC,MAAM,CAAC;IACpB,MAAM,EAAE,CAAC,MAAM,CAAC;IAChB,SAAS,EAAE,CAAC,MAAM,CAAC;CACpB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,CAAC,OAAO,CAAC;IAC3C,OAAO,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC;IAClD,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC;CACpC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,KAAK,GAAG;IACnB,KAAK,EAAE,SAAS;IAChB,OAAO,EAAE,WAAW;IACpB,iBAAiB,EAAE,kBAAkB;CAC7B,CAAC"}

package/dist/server/auth/session-resolver.d.ts

@@ -6,5 +6,9 @@ export declare class SessionResolver {
     readonly auth: Auth;
     constructor(drizzle: DrizzleService, schema?: Record<string, unknown>);
     resolveUserId(headers: Headers): Promise<string | undefined>;
+    resolveSession(headers: Headers): Promise<{
+        userId: string;
+        sessionId?: string | undefined;
+    } | undefined>;
 }
 //# sourceMappingURL=session-resolver.d.ts.map

package/dist/server/auth/session-resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-resolver.d.ts","sourceRoot":"","sources":["../../../src/server/auth/session-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,yBAAyB,CAAC;AAClE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EAAc,KAAK,IAAI,EAAE,MAAM,WAAW,CAAC;AAQlD,eAAO,MAAM,YAAY,EAAE,KAAK,CAAC,eAAe,CAA+B,CAAC;AAEhF,qBAAa,eAAe;IAC1B,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;gBAKR,OAAO,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAI/D,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;CAInE"}
+{"version":3,"file":"session-resolver.d.ts","sourceRoot":"","sources":["../../../src/server/auth/session-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,yBAAyB,CAAC;AAClE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EAAc,KAAK,IAAI,EAAE,MAAM,WAAW,CAAC;AAQlD,eAAO,MAAM,YAAY,EAAE,KAAK,CAAC,eAAe,CAA+B,CAAC;AAEhF,qBAAa,eAAe;IAC1B,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;gBAKR,OAAO,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAI/D,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAO5D,cAAc,CAClB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,GAAG,SAAS,CAAC;CAK3E"}

package/dist/server/auth/session-resolver.js

@@ -16,8 +16,15 @@ export class SessionResolver {
         this.auth = createAuth({ db: drizzle.db, ...(schema ? { schema } : {}) });
     }
     async resolveUserId(headers) {
-        const session = await this.auth.api.getSession({ headers });
-        return session?.user?.id;
+        return (await this.resolveSession(headers))?.userId;
+    }
+    // sessionId identifies the session row itself, so a handler can tell the caller's
+    // own device apart from their others. Optional because a stubbed/partial getSession
+    // response still carries a usable userId.
+    async resolveSession(headers) {
+        const resolved = await this.auth.api.getSession({ headers });
+        const userId = resolved?.user?.id;
+        return userId ? { userId, sessionId: resolved?.session?.id } : undefined;
     }
 }
 //# sourceMappingURL=session-resolver.js.map

package/dist/server/auth/session-resolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"session-resolver.js","sourceRoot":"","sources":["../../../src/server/auth/session-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAc,MAAM,yBAAyB,CAAC;AAElE,OAAO,EAAE,UAAU,EAAa,MAAM,WAAW,CAAC;AAElD,iFAAiF;AACjF,8EAA8E;AAC9E,sFAAsF;AACtF,kFAAkF;AAClF,iFAAiF;AACjF,mEAAmE;AACnE,MAAM,CAAC,MAAM,YAAY,GAA2B,WAAW,CAAC,cAAc,CAAC,CAAC;AAEhF,MAAM,OAAO,eAAe;IACjB,IAAI,CAAO;IAEpB,qFAAqF;IACrF,qFAAqF;IACrF,8DAA8D;IAC9D,YAAY,OAAuB,EAAE,MAAgC;QACnE,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC5E,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,OAAgB;QAClC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QAC5D,OAAO,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC;IAC3B,CAAC;CACF"}
+{"version":3,"file":"session-resolver.js","sourceRoot":"","sources":["../../../src/server/auth/session-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAc,MAAM,yBAAyB,CAAC;AAElE,OAAO,EAAE,UAAU,EAAa,MAAM,WAAW,CAAC;AAElD,iFAAiF;AACjF,8EAA8E;AAC9E,sFAAsF;AACtF,kFAAkF;AAClF,iFAAiF;AACjF,mEAAmE;AACnE,MAAM,CAAC,MAAM,YAAY,GAA2B,WAAW,CAAC,cAAc,CAAC,CAAC;AAEhF,MAAM,OAAO,eAAe;IACjB,IAAI,CAAO;IAEpB,qFAAqF;IACrF,qFAAqF;IACrF,8DAA8D;IAC9D,YAAY,OAAuB,EAAE,MAAgC;QACnE,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC5E,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,OAAgB;QAClC,OAAO,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC;IACtD,CAAC;IAED,kFAAkF;IAClF,oFAAoF;IACpF,0CAA0C;IAC1C,KAAK,CAAC,cAAc,CAClB,OAAgB;QAEhB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QAC7D,MAAM,MAAM,GAAG,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC;QAClC,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3E,CAAC;CACF"}

package/dist/server/auth/sign-session-cookie.d.ts

@@ -0,0 +1,18 @@
+export type SessionCookieConfig = {
+    name: string;
+    attributes: {
+        domain?: string;
+        httpOnly?: boolean;
+        maxAge?: number;
+        path?: string;
+        secure?: boolean;
+        sameSite?: 'strict' | 'lax' | 'none' | 'Strict' | 'Lax' | 'None';
+    };
+};
+export declare function signSessionCookie({ token, sessionCookie, secret, maxAgeSeconds, }: {
+    token: string;
+    sessionCookie: SessionCookieConfig;
+    secret: string;
+    maxAgeSeconds?: number;
+}): string;
+//# sourceMappingURL=sign-session-cookie.d.ts.map

package/dist/server/auth/sign-session-cookie.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign-session-cookie.d.ts","sourceRoot":"","sources":["../../../src/server/auth/sign-session-cookie.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,mBAAmB,GAAG;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE;QACV,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,QAAQ,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;KAClE,CAAC;CACH,CAAC;AAEF,wBAAgB,iBAAiB,CAAC,EAChC,KAAK,EACL,aAAa,EACb,MAAM,EACN,aAAa,GACd,EAAE;IACD,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,mBAAmB,CAAC;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,GAAG,MAAM,CAUT"}

package/dist/server/auth/sign-session-cookie.js

@@ -0,0 +1,15 @@
+import { createHmac } from 'node:crypto';
+import { serialize } from 'hono/utils/cookie';
+export function signSessionCookie({ token, sessionCookie, secret, maxAgeSeconds, }) {
+    const signature = createHmac('sha256', secret).update(token).digest('base64');
+    const signedValue = `${token}.${signature}`;
+    const attributes = { ...sessionCookie.attributes };
+    if (maxAgeSeconds === undefined) {
+        delete attributes.maxAge;
+    }
+    else {
+        attributes.maxAge = maxAgeSeconds;
+    }
+    return serialize(sessionCookie.name, signedValue, attributes);
+}
+//# sourceMappingURL=sign-session-cookie.js.map

package/dist/server/auth/sign-session-cookie.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign-session-cookie.js","sourceRoot":"","sources":["../../../src/server/auth/sign-session-cookie.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAc9C,MAAM,UAAU,iBAAiB,CAAC,EAChC,KAAK,EACL,aAAa,EACb,MAAM,EACN,aAAa,GAMd;IACC,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC9E,MAAM,WAAW,GAAG,GAAG,KAAK,IAAI,SAAS,EAAE,CAAC;IAC5C,MAAM,UAAU,GAAG,EAAE,GAAG,aAAa,CAAC,UAAU,EAAE,CAAC;IACnD,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,UAAU,CAAC,MAAM,CAAC;IAC3B,CAAC;SAAM,CAAC;QACN,UAAU,CAAC,MAAM,GAAG,aAAa,CAAC;IACpC,CAAC;IACD,OAAO,SAAS,CAAC,aAAa,CAAC,IAAI,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;AAChE,CAAC"}

package/dist/server/db/__tests__/migrate.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=migrate.test.d.ts.map

package/dist/server/db/__tests__/migrate.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrate.test.d.ts","sourceRoot":"","sources":["../../../../src/server/db/__tests__/migrate.test.ts"],"names":[],"mappings":""}