@openora/core 0.4.1-canary.9 → 0.4.1-canary.91

package/dist/server/auth/auth.js

@@ -1,11 +1,35 @@
 import { randomUUID } from 'node:crypto';
 import { betterAuth } from 'better-auth';
 import { drizzleAdapter } from 'better-auth/adapters/drizzle';
-import { organization, admin as adminPlugin, twoFactor } from 'better-auth/plugins';
+import { organization, admin as adminPlugin, twoFactor, emailOTP } from 'better-auth/plugins';
 import { ac, roles } from './permissions.js';
-// Explicit return type avoids TS2883 (Zod v4 $strip portability issue with admin plugin).
+import { OTP_CODE_LENGTH, OTP_EXPIRES_IN_SEC, DEFAULT_EMAIL_TEMPLATES, } from '@openora/core/contracts';
+// Used only by SessionResolver's createAuth() call, which never sends email (getSession
+// only) - keeps templateRenderer optional on AuthOptions without a server/auth -> pam
+// layering violation (the real DefaultEmailTemplateRenderer lives in pam/identity).
+// Delegates to the shared DEFAULT_EMAIL_TEMPLATES map (contracts/adapters/email-template.ts)
+// so this fallback copy can never drift from DefaultEmailTemplateRenderer's.
+const fallbackTemplateRenderer = {
+    render: (key, data) => DEFAULT_EMAIL_TEMPLATES[key](data),
+};
+/**
+ * Builds the one shared better-auth instance for the whole app - both the
+ * per-request session middleware and `AdminGuard` resolve sessions through it,
+ * never a second `createAuth()` over the same DB. Bundles the org, admin
+ * (role/permission), and two-factor plugins; `sendEmail` is a silent no-op
+ * when omitted (eg tests) rather than throwing. The explicit `BetterAuthType`
+ * return annotation is load-bearing, not stylistic - it dodges a TS2883 Zod v4
+ * `$strip` portability error the inferred type would otherwise surface.
+ *
+ * `cookieDomain` (or `AUTH_COOKIE_DOMAIN`) widens the session cookie to a parent
+ * domain, so a frontend on `app.example.com` still sends it to an API on
+ * `api.example.com`. Left unset the cookie stays host-only, which is correct when
+ * both run on one host and is the safer default everywhere else.
+ */
 export function createAuth(options) {
     const sendEmail = options.sendEmail ?? (() => { });
+    const templateRenderer = options.templateRenderer ?? fallbackTemplateRenderer;
+    const cookieDomain = options.cookieDomain ?? process.env['AUTH_COOKIE_DOMAIN'];
     return betterAuth({
         database: drizzleAdapter(options.db, {
             provider: 'pg',
@@ -15,6 +39,7 @@ export function createAuth(options) {
             database: {
                 generateId: () => randomUUID(),
             },
+            ...(cookieDomain ? { crossSubDomainCookies: { enabled: true, domain: cookieDomain } } : {}),
         },
         session: {
             expiresIn: 30 * 24 * 60 * 60,
@@ -26,33 +51,62 @@ export function createAuth(options) {
             // are validated at the route (theme against the enum, language against
             // PlatformConfig.supportedLanguages).
             additionalFields: {
+                username: { type: 'string', required: false, input: true },
                 theme: { type: 'string', required: false, input: true, defaultValue: 'system' },
                 language: { type: 'string', required: false, input: true, defaultValue: 'en' },
             },
         },
         emailAndPassword: {
             enabled: true,
-            rememberMeDuration: 30 * 24 * 60 * 60,
-            sendResetPassword: async ({ user, url, token }) => {
-                await sendEmail({
-                    to: user.email,
-                    subject: 'Reset your password',
-                    body: `Reset your password using this link: ${url}\n\nReset token: ${token}`,
-                });
-            },
+            autoSignIn: false,
+            requireEmailVerification: true,
+            revokeSessionsOnPasswordReset: true,
+            onExistingUserSignUp: options.onExistingUserSignUp
+                ? async ({ user }) => {
+                    await options.onExistingUserSignUp?.({ id: user.id, email: user.email });
+                }
+                : undefined,
+            onPasswordReset: options.onPasswordReset
+                ? async ({ user }) => {
+                    await options.onPasswordReset?.({ id: user.id, email: user.email });
+                }
+                : undefined,
         },
         emailVerification: {
+            sendOnSignUp: true,
+            expiresIn: 24 * 60 * 60,
             sendVerificationEmail: async ({ user, url, token }) => {
-                await sendEmail({
-                    to: user.email,
-                    subject: 'Verify your email',
-                    body: `Verify your email using this link: ${url}\n\nVerification token: ${token}`,
-                });
+                const locale = user.language ?? 'en';
+                const verificationUrl = options.registrationWebUrl
+                    ? new URL('/verify-email', options.registrationWebUrl)
+                    : undefined;
+                if (verificationUrl) {
+                    verificationUrl.searchParams.set('token', token);
+                    verificationUrl.searchParams.set('callbackURL', '/');
+                }
+                const { subject, body } = await templateRenderer.render('verifyEmail', { url: verificationUrl?.toString() ?? url, token }, locale);
+                await sendEmail({ to: user.email, subject, body });
             },
         },
         // Without this, better-auth's admin plugin defaults new signups to its own
         // 'user' role, which UserRoleSchema (player|admin) rejects everywhere downstream.
-        plugins: [organization(), adminPlugin({ ac, roles, defaultRole: 'player' }), twoFactor()],
+        plugins: [
+            organization(),
+            adminPlugin({ ac, roles, defaultRole: 'player' }),
+            twoFactor(),
+            emailOTP({
+                otpLength: OTP_CODE_LENGTH,
+                expiresIn: OTP_EXPIRES_IN_SEC,
+                async sendVerificationOTP({ email, otp, type }) {
+                    if (type !== 'forget-password') {
+                        return;
+                    }
+                    const locale = (await options.getUserLanguage?.(email)) ?? 'en';
+                    const { subject, body } = await templateRenderer.render('resetPasswordOtp', { otp, email }, locale);
+                    await sendEmail({ to: email, subject, body });
+                },
+            }),
+        ],
         // Library boundary: better-auth infers an options-specific instantiation that isn't
         // assignable to its own exported `Auth` alias. No way to narrow without matching the
         // full generic - the one sanctioned cast, see conventions.

package/dist/server/auth/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/server/auth/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,KAAK,IAAI,WAAW,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAEpF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAgB7C,0FAA0F;AAC1F,MAAM,UAAU,UAAU,CAAC,OAAoB;IAC7C,MAAM,SAAS,GAAc,OAAO,CAAC,SAAS,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAC7D,OAAO,UAAU,CAAC;QAChB,QAAQ,EAAE,cAAc,CAAC,OAAO,CAAC,EAAE,EAAE;YACnC,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,OAAO,CAAC,MAAM;SACvB,CAAC;QACF,QAAQ,EAAE;YACR,QAAQ,EAAE;gBACR,UAAU,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE;aAC/B;SACF;QACD,OAAO,EAAE;YACP,SAAS,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE;YAC5B,SAAS,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE;SACxB;QACD,IAAI,EAAE;YACJ,6EAA6E;YAC7E,6EAA6E;YAC7E,uEAAuE;YACvE,sCAAsC;YACtC,gBAAgB,EAAE;gBAChB,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE;gBAC/E,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE;aAC/E;SACF;QACD,gBAAgB,EAAE;YAChB,OAAO,EAAE,IAAI;YACb,kBAAkB,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE;YACrC,iBAAiB,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE;gBAChD,MAAM,SAAS,CAAC;oBACd,EAAE,EAAE,IAAI,CAAC,KAAK;oBACd,OAAO,EAAE,qBAAqB;oBAC9B,IAAI,EAAE,wCAAwC,GAAG,oBAAoB,KAAK,EAAE;iBAC7E,CAAC,CAAC;YACL,CAAC;SACF;QACD,iBAAiB,EAAE;YACjB,qBAAqB,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE;gBACpD,MAAM,SAAS,CAAC;oBACd,EAAE,EAAE,IAAI,CAAC,KAAK;oBACd,OAAO,EAAE,mBAAmB;oBAC5B,IAAI,EAAE,sCAAsC,GAAG,2BAA2B,KAAK,EAAE;iBAClF,CAAC,CAAC;YACL,CAAC;SACF;QACD,2EAA2E;QAC3E,kFAAkF;QAClF,OAAO,EAAE,CAAC,YAAY,EAAE,EAAE,WAAW,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC;QACzF,oFAAoF;QACpF,qFAAqF;QACrF,2DAA2D;KAC5D,CAA8B,CAAC;AAClC,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/server/auth/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,KAAK,IAAI,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAE9F,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,uBAAuB,GAExB,MAAM,yBAAyB,CAAC;AAsBjC,wFAAwF;AACxF,sFAAsF;AACtF,oFAAoF;AACpF,6FAA6F;AAC7F,6EAA6E;AAC7E,MAAM,wBAAwB,GAA0B;IACtD,MAAM,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;CAC1D,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,UAAU,CAAC,OAAoB;IAC7C,MAAM,SAAS,GAAc,OAAO,CAAC,SAAS,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAC7D,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,wBAAwB,CAAC;IAC9E,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAC/E,OAAO,UAAU,CAAC;QAChB,QAAQ,EAAE,cAAc,CAAC,OAAO,CAAC,EAAE,EAAE;YACnC,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,OAAO,CAAC,MAAM;SACvB,CAAC;QACF,QAAQ,EAAE;YACR,QAAQ,EAAE;gBACR,UAAU,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE;aAC/B;YACD,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5F;QACD,OAAO,EAAE;YACP,SAAS,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE;YAC5B,SAAS,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE;SACxB;QACD,IAAI,EAAE;YACJ,6EAA6E;YAC7E,6EAA6E;YAC7E,uEAAuE;YACvE,sCAAsC;YACtC,gBAAgB,EAAE;gBAChB,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE;gBAC1D,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE;gBAC/E,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE;aAC/E;SACF;QACD,gBAAgB,EAAE;YAChB,OAAO,EAAE,IAAI;YACb,UAAU,EAAE,KAAK;YACjB,wBAAwB,EAAE,IAAI;YAC9B,6BAA6B,EAAE,IAAI;YACnC,oBAAoB,EAAE,OAAO,CAAC,oBAAoB;gBAChD,CAAC,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;oBACjB,MAAM,OAAO,CAAC,oBAAoB,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;gBAC3E,CAAC;gBACH,CAAC,CAAC,SAAS;YACb,eAAe,EAAE,OAAO,CAAC,eAAe;gBACtC,CAAC,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;oBACjB,MAAM,OAAO,CAAC,eAAe,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;gBACtE,CAAC;gBACH,CAAC,CAAC,SAAS;SACd;QACD,iBAAiB,EAAE;YACjB,YAAY,EAAE,IAAI;YAClB,SAAS,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE;YACvB,qBAAqB,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE;gBACpD,MAAM,MAAM,GAAI,IAA8B,CAAC,QAAQ,IAAI,IAAI,CAAC;gBAChE,MAAM,eAAe,GAAG,OAAO,CAAC,kBAAkB;oBAChD,CAAC,CAAC,IAAI,GAAG,CAAC,eAAe,EAAE,OAAO,CAAC,kBAAkB,CAAC;oBACtD,CAAC,CAAC,SAAS,CAAC;gBACd,IAAI,eAAe,EAAE,CAAC;oBACpB,eAAe,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;oBACjD,eAAe,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;gBACvD,CAAC;gBACD,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,MAAM,gBAAgB,CAAC,MAAM,CACrD,aAAa,EACb,EAAE,GAAG,EAAE,eAAe,EAAE,QAAQ,EAAE,IAAI,GAAG,EAAE,KAAK,EAAE,EAClD,MAAM,CACP,CAAC;gBACF,MAAM,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACrD,CAAC;SACF;QACD,2EAA2E;QAC3E,kFAAkF;QAClF,OAAO,EAAE;YACP,YAAY,EAAE;YACd,WAAW,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;YACjD,SAAS,EAAE;YACX,QAAQ,CAAC;gBACP,SAAS,EAAE,eAAe;gBAC1B,SAAS,EAAE,kBAAkB;gBAC7B,KAAK,CAAC,mBAAmB,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE;oBAC5C,IAAI,IAAI,KAAK,iBAAiB,EAAE,CAAC;wBAC/B,OAAO;oBACT,CAAC;oBACD,MAAM,MAAM,GAAG,CAAC,MAAM,OAAO,CAAC,eAAe,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC;oBAChE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,MAAM,gBAAgB,CAAC,MAAM,CACrD,kBAAkB,EAClB,EAAE,GAAG,EAAE,KAAK,EAAE,EACd,MAAM,CACP,CAAC;oBACF,MAAM,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;gBAChD,CAAC;aACF,CAAC;SACH;QACD,oFAAoF;QACpF,qFAAqF;QACrF,2DAA2D;KAC5D,CAA8B,CAAC;AAClC,CAAC"}

package/dist/server/auth/index.d.ts

@@ -1,7 +1,9 @@
 export type { AuthOptions, Auth, SendEmail } from './auth.js';
 export { createAuth } from './auth.js';
 export { AdminGuard, ADMIN_GUARD } from './admin-guard.js';
+export type { AdminCaller } from './admin-guard.js';
 export { SessionResolver, AUTH_SESSION } from './session-resolver.js';
+export { signSessionCookie, type SessionCookieConfig } from './sign-session-cookie.js';
 export { ac, roles, statement } from './permissions.js';
 export type { RoleName, ResourceName, ActionOf } from './permissions.js';
 export { PERMISSION_LEVELS, SUPPORTED_LEVELS, readActions, levelRank, isLevelSufficient, levelToActions, actionsToLevel, } from './permission-levels.js';

package/dist/server/auth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/server/auth/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACxD,YAAY,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,WAAW,EACX,SAAS,EACT,iBAAiB,EACjB,cAAc,EACd,cAAc,GACf,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/server/auth/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC3D,YAAY,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,EAAE,iBAAiB,EAAE,KAAK,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AACvF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACxD,YAAY,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,WAAW,EACX,SAAS,EACT,iBAAiB,EACjB,cAAc,EACd,cAAc,GACf,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC"}

package/dist/server/auth/index.js

@@ -1,6 +1,7 @@
 export { createAuth } from './auth.js';
 export { AdminGuard, ADMIN_GUARD } from './admin-guard.js';
 export { SessionResolver, AUTH_SESSION } from './session-resolver.js';
+export { signSessionCookie } from './sign-session-cookie.js';
 export { ac, roles, statement } from './permissions.js';
 export { PERMISSION_LEVELS, SUPPORTED_LEVELS, readActions, levelRank, isLevelSufficient, levelToActions, actionsToLevel, } from './permission-levels.js';
 //# sourceMappingURL=index.js.map

package/dist/server/auth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/server/auth/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAExD,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,WAAW,EACX,SAAS,EACT,iBAAiB,EACjB,cAAc,EACd,cAAc,GACf,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/server/auth/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE3D,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,EAAE,iBAAiB,EAA4B,MAAM,0BAA0B,CAAC;AACvF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAExD,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,WAAW,EACX,SAAS,EACT,iBAAiB,EACjB,cAAc,EACd,cAAc,GACf,MAAM,wBAAwB,CAAC"}

package/dist/server/auth/permission-levels.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permission-levels.d.ts","sourceRoot":"","sources":["../../../src/server/auth/permission-levels.ts"],"names":[],"mappings":"AAAA,OAAO,EAAa,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChE,OAAO,EAAoB,KAAK,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAEjF,YAAY,EAAE,eAAe,EAAE,CAAC;AAGhC,eAAO,MAAM,iBAAiB,EAAE,SAAS,eAAe,EAAqB,CAAC;AAE9E,eAAO,MAAM,gBAAgB,EAAE,SAAS,eAAe,EAAsB,CAAC;AAE9E,wBAAgB,SAAS,CAAC,KAAK,EAAE,eAAe,GAAG,MAAM,CAExD;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,eAAe,GAAG,OAAO,CAE3F;AAID,eAAO,MAAM,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC,CAKpB,CAAC;AAEtD,mIAAmI;AACnI,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,GAAG,SAAS,MAAM,EAAE,CAM1F;AAED,0HAA0H;AAC1H,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,eAAe,CAQ5F"}
+{"version":3,"file":"permission-levels.d.ts","sourceRoot":"","sources":["../../../src/server/auth/permission-levels.ts"],"names":[],"mappings":"AAAA,OAAO,EAAa,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChE,OAAO,EAAoB,KAAK,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAEjF,YAAY,EAAE,eAAe,EAAE,CAAC;AAGhC,eAAO,MAAM,iBAAiB,EAAE,SAAS,eAAe,EAAqB,CAAC;AAE9E,eAAO,MAAM,gBAAgB,EAAE,SAAS,eAAe,EAAsB,CAAC;AAE9E,wBAAgB,SAAS,CAAC,KAAK,EAAE,eAAe,GAAG,MAAM,CAExD;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,eAAe,GAAG,OAAO,CAE3F;AAID,eAAO,MAAM,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC,CAKpB,CAAC;AAEtD,mIAAmI;AACnI,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,GAAG,SAAS,MAAM,EAAE,CAY1F;AAED,0HAA0H;AAC1H,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,eAAe,CAc5F"}

package/dist/server/auth/permission-levels.js

@@ -18,25 +18,31 @@ export const readActions = Object.fromEntries(Object.keys(statement).map((resour
 /** Expands a (resource, level) cell to the action set AdminGuard checks - levels are stored, actions derived at the authz edge. */
 export function levelToActions(resource, level) {
     const actions = statement[resource];
-    if (!actions)
+    if (!actions) {
         return [];
-    if (level === 'no_access')
+    }
+    if (level === 'no_access') {
         return [];
-    if (level === 'read_write')
+    }
+    if (level === 'read_write') {
         return actions;
+    }
     return readActions[resource] ?? (actions.includes('view') ? ['view'] : []);
 }
 /** Collapses a concrete action set to the closest level - used only for legacy/edge data; new writes are level-native. */
 export function actionsToLevel(resource, actions) {
     const all = statement[resource];
-    if (!all || all.length === 0)
+    if (!all || all.length === 0) {
         return 'no_access';
+    }
     const has = new Set(actions);
-    if (all.every((a) => has.has(a)))
+    if (all.every((a) => has.has(a))) {
         return 'read_write';
+    }
     const read = readActions[resource] ?? [];
-    if (read.length > 0 && read.every((a) => has.has(a)))
+    if (read.length > 0 && read.every((a) => has.has(a))) {
         return 'read';
+    }
     return 'no_access';
 }
 //# sourceMappingURL=permission-levels.js.map

package/dist/server/auth/permission-levels.js.map

@@ -1 +1 @@
-{"version":3,"file":"permission-levels.js","sourceRoot":"","sources":["../../../src/server/auth/permission-levels.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAqB,MAAM,kBAAkB,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAwB,MAAM,yBAAyB,CAAC;AAIjF,mFAAmF;AACnF,MAAM,CAAC,MAAM,iBAAiB,GAA+B,gBAAgB,CAAC;AAE9E,MAAM,CAAC,MAAM,gBAAgB,GAA+B,iBAAiB,CAAC;AAE9E,MAAM,UAAU,SAAS,CAAC,KAAsB;IAC9C,OAAO,iBAAiB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAqB,EAAE,QAAyB;IAChF,OAAO,SAAS,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,CAAC;AAChD,CAAC;AAED,oFAAoF;AACpF,oFAAoF;AACpF,MAAM,CAAC,MAAM,WAAW,GAAqD,MAAM,CAAC,WAAW,CAC5F,MAAM,CAAC,IAAI,CAAC,SAAS,CAAoB,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;IAC1D,MAAM,OAAO,GAAG,SAAS,CAAC,QAAQ,CAAsB,CAAC;IACzD,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAC9D,CAAC,CAAC,CACiD,CAAC;AAEtD,mIAAmI;AACnI,MAAM,UAAU,cAAc,CAAC,QAAgB,EAAE,KAAsB;IACrE,MAAM,OAAO,GAAG,SAAS,CAAC,QAAwB,CAAkC,CAAC;IACrF,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IACxB,IAAI,KAAK,KAAK,WAAW;QAAE,OAAO,EAAE,CAAC;IACrC,IAAI,KAAK,KAAK,YAAY;QAAE,OAAO,OAAO,CAAC;IAC3C,OAAO,WAAW,CAAC,QAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAC7F,CAAC;AAED,0HAA0H;AAC1H,MAAM,UAAU,cAAc,CAAC,QAAgB,EAAE,OAA0B;IACzE,MAAM,GAAG,GAAG,SAAS,CAAC,QAAwB,CAAkC,CAAC;IACjF,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,WAAW,CAAC;IACjD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IAC7B,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,YAAY,CAAC;IACtD,MAAM,IAAI,GAAG,WAAW,CAAC,QAAwB,CAAC,IAAI,EAAE,CAAC;IACzD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC;IACpE,OAAO,WAAW,CAAC;AACrB,CAAC"}
+{"version":3,"file":"permission-levels.js","sourceRoot":"","sources":["../../../src/server/auth/permission-levels.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAqB,MAAM,kBAAkB,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAwB,MAAM,yBAAyB,CAAC;AAIjF,mFAAmF;AACnF,MAAM,CAAC,MAAM,iBAAiB,GAA+B,gBAAgB,CAAC;AAE9E,MAAM,CAAC,MAAM,gBAAgB,GAA+B,iBAAiB,CAAC;AAE9E,MAAM,UAAU,SAAS,CAAC,KAAsB;IAC9C,OAAO,iBAAiB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAqB,EAAE,QAAyB;IAChF,OAAO,SAAS,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,CAAC;AAChD,CAAC;AAED,oFAAoF;AACpF,oFAAoF;AACpF,MAAM,CAAC,MAAM,WAAW,GAAqD,MAAM,CAAC,WAAW,CAC5F,MAAM,CAAC,IAAI,CAAC,SAAS,CAAoB,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;IAC1D,MAAM,OAAO,GAAG,SAAS,CAAC,QAAQ,CAAsB,CAAC;IACzD,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAC9D,CAAC,CAAC,CACiD,CAAC;AAEtD,mIAAmI;AACnI,MAAM,UAAU,cAAc,CAAC,QAAgB,EAAE,KAAsB;IACrE,MAAM,OAAO,GAAG,SAAS,CAAC,QAAwB,CAAkC,CAAC;IACrF,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,KAAK,KAAK,WAAW,EAAE,CAAC;QAC1B,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,KAAK,KAAK,YAAY,EAAE,CAAC;QAC3B,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,WAAW,CAAC,QAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAC7F,CAAC;AAED,0HAA0H;AAC1H,MAAM,UAAU,cAAc,CAAC,QAAgB,EAAE,OAA0B;IACzE,MAAM,GAAG,GAAG,SAAS,CAAC,QAAwB,CAAkC,CAAC;IACjF,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IAC7B,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,OAAO,YAAY,CAAC;IACtB,CAAC;IACD,MAAM,IAAI,GAAG,WAAW,CAAC,QAAwB,CAAC,IAAI,EAAE,CAAC;IACzD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC"}

package/dist/server/auth/permissions.d.ts

@@ -16,6 +16,11 @@ export declare const statement: {
     readonly sessions: readonly ["view", "revoke"];
     readonly 'player-note': readonly ["view", "create"];
     readonly 'tag-rule': readonly ["view", "update"];
+    readonly tag: readonly ["view", "create", "delete"];
+    readonly 'chat-room': readonly ["view", "create", "update", "delete"];
+    readonly 'auto-withdrawal-config': readonly ["view", "update"];
+    readonly 'chat-command': readonly ["view", "update"];
+    readonly 'chat-moderation': readonly ["view", "moderate"];
 };
 export declare const ac: {
     newRole<const TRoleStatements extends import("better-auth/plugins/access").Statements>(statements: import("better-auth/plugins/access").RoleInput<{
@@ -36,6 +41,11 @@ export declare const ac: {
         readonly sessions: readonly ["view", "revoke"];
         readonly 'player-note': readonly ["view", "create"];
         readonly 'tag-rule': readonly ["view", "update"];
+        readonly tag: readonly ["view", "create", "delete"];
+        readonly 'chat-room': readonly ["view", "create", "update", "delete"];
+        readonly 'auto-withdrawal-config': readonly ["view", "update"];
+        readonly 'chat-command': readonly ["view", "update"];
+        readonly 'chat-moderation': readonly ["view", "moderate"];
     }, TRoleStatements>): import("better-auth/plugins/access").Role<import("better-auth/plugins/access").ExactRoleStatements<TRoleStatements>, {
         readonly player: readonly ["view", "update", "ban", "adjust-balance"];
         readonly transaction: readonly ["view", "refund"];
@@ -54,6 +64,11 @@ export declare const ac: {
         readonly sessions: readonly ["view", "revoke"];
         readonly 'player-note': readonly ["view", "create"];
         readonly 'tag-rule': readonly ["view", "update"];
+        readonly tag: readonly ["view", "create", "delete"];
+        readonly 'chat-room': readonly ["view", "create", "update", "delete"];
+        readonly 'auto-withdrawal-config': readonly ["view", "update"];
+        readonly 'chat-command': readonly ["view", "update"];
+        readonly 'chat-moderation': readonly ["view", "moderate"];
     }>;
     statements: {
         readonly player: readonly ["view", "update", "ban", "adjust-balance"];
@@ -73,6 +88,11 @@ export declare const ac: {
         readonly sessions: readonly ["view", "revoke"];
         readonly 'player-note': readonly ["view", "create"];
         readonly 'tag-rule': readonly ["view", "update"];
+        readonly tag: readonly ["view", "create", "delete"];
+        readonly 'chat-room': readonly ["view", "create", "update", "delete"];
+        readonly 'auto-withdrawal-config': readonly ["view", "update"];
+        readonly 'chat-command': readonly ["view", "update"];
+        readonly 'chat-moderation': readonly ["view", "moderate"];
     };
 };
 export declare const adminRole: import("better-auth/plugins/access").Role<import("better-auth/plugins/access").ExactRoleStatements<{
@@ -93,6 +113,11 @@ export declare const adminRole: import("better-auth/plugins/access").Role<import
     readonly sessions: ["view", "revoke"];
     readonly 'player-note': ["view", "create"];
     readonly 'tag-rule': ["view", "update"];
+    readonly tag: ["view", "create", "delete"];
+    readonly 'chat-room': ["view", "create", "update", "delete"];
+    readonly 'auto-withdrawal-config': ["view", "update"];
+    readonly 'chat-command': ["view", "update"];
+    readonly 'chat-moderation': ["view", "moderate"];
 }>, {
     readonly player: readonly ["view", "update", "ban", "adjust-balance"];
     readonly transaction: readonly ["view", "refund"];
@@ -111,6 +136,11 @@ export declare const adminRole: import("better-auth/plugins/access").Role<import
     readonly sessions: readonly ["view", "revoke"];
     readonly 'player-note': readonly ["view", "create"];
     readonly 'tag-rule': readonly ["view", "update"];
+    readonly tag: readonly ["view", "create", "delete"];
+    readonly 'chat-room': readonly ["view", "create", "update", "delete"];
+    readonly 'auto-withdrawal-config': readonly ["view", "update"];
+    readonly 'chat-command': readonly ["view", "update"];
+    readonly 'chat-moderation': readonly ["view", "moderate"];
 }>;
 export declare const supportRole: import("better-auth/plugins/access").Role<import("better-auth/plugins/access").ExactRoleStatements<{
     readonly player: ["view", "update"];
@@ -136,6 +166,11 @@ export declare const supportRole: import("better-auth/plugins/access").Role<impo
     readonly sessions: readonly ["view", "revoke"];
     readonly 'player-note': readonly ["view", "create"];
     readonly 'tag-rule': readonly ["view", "update"];
+    readonly tag: readonly ["view", "create", "delete"];
+    readonly 'chat-room': readonly ["view", "create", "update", "delete"];
+    readonly 'auto-withdrawal-config': readonly ["view", "update"];
+    readonly 'chat-command': readonly ["view", "update"];
+    readonly 'chat-moderation': readonly ["view", "moderate"];
 }>;
 export declare const contentManagerRole: import("better-auth/plugins/access").Role<import("better-auth/plugins/access").ExactRoleStatements<{
     readonly content: ["create", "update", "delete", "publish"];
@@ -158,6 +193,11 @@ export declare const contentManagerRole: import("better-auth/plugins/access").Ro
     readonly sessions: readonly ["view", "revoke"];
     readonly 'player-note': readonly ["view", "create"];
     readonly 'tag-rule': readonly ["view", "update"];
+    readonly tag: readonly ["view", "create", "delete"];
+    readonly 'chat-room': readonly ["view", "create", "update", "delete"];
+    readonly 'auto-withdrawal-config': readonly ["view", "update"];
+    readonly 'chat-command': readonly ["view", "update"];
+    readonly 'chat-moderation': readonly ["view", "moderate"];
 }>;
 export declare const roles: {
     readonly admin: import("better-auth/plugins/access").Role<import("better-auth/plugins/access").ExactRoleStatements<{
@@ -178,6 +218,11 @@ export declare const roles: {
         readonly sessions: ["view", "revoke"];
         readonly 'player-note': ["view", "create"];
         readonly 'tag-rule': ["view", "update"];
+        readonly tag: ["view", "create", "delete"];
+        readonly 'chat-room': ["view", "create", "update", "delete"];
+        readonly 'auto-withdrawal-config': ["view", "update"];
+        readonly 'chat-command': ["view", "update"];
+        readonly 'chat-moderation': ["view", "moderate"];
     }>, {
         readonly player: readonly ["view", "update", "ban", "adjust-balance"];
         readonly transaction: readonly ["view", "refund"];
@@ -196,6 +241,11 @@ export declare const roles: {
         readonly sessions: readonly ["view", "revoke"];
         readonly 'player-note': readonly ["view", "create"];
         readonly 'tag-rule': readonly ["view", "update"];
+        readonly tag: readonly ["view", "create", "delete"];
+        readonly 'chat-room': readonly ["view", "create", "update", "delete"];
+        readonly 'auto-withdrawal-config': readonly ["view", "update"];
+        readonly 'chat-command': readonly ["view", "update"];
+        readonly 'chat-moderation': readonly ["view", "moderate"];
     }>;
     readonly support: import("better-auth/plugins/access").Role<import("better-auth/plugins/access").ExactRoleStatements<{
         readonly player: ["view", "update"];
@@ -221,6 +271,11 @@ export declare const roles: {
         readonly sessions: readonly ["view", "revoke"];
         readonly 'player-note': readonly ["view", "create"];
         readonly 'tag-rule': readonly ["view", "update"];
+        readonly tag: readonly ["view", "create", "delete"];
+        readonly 'chat-room': readonly ["view", "create", "update", "delete"];
+        readonly 'auto-withdrawal-config': readonly ["view", "update"];
+        readonly 'chat-command': readonly ["view", "update"];
+        readonly 'chat-moderation': readonly ["view", "moderate"];
     }>;
     readonly 'content-manager': import("better-auth/plugins/access").Role<import("better-auth/plugins/access").ExactRoleStatements<{
         readonly content: ["create", "update", "delete", "publish"];
@@ -243,6 +298,11 @@ export declare const roles: {
         readonly sessions: readonly ["view", "revoke"];
         readonly 'player-note': readonly ["view", "create"];
         readonly 'tag-rule': readonly ["view", "update"];
+        readonly tag: readonly ["view", "create", "delete"];
+        readonly 'chat-room': readonly ["view", "create", "update", "delete"];
+        readonly 'auto-withdrawal-config': readonly ["view", "update"];
+        readonly 'chat-command': readonly ["view", "update"];
+        readonly 'chat-moderation': readonly ["view", "moderate"];
     }>;
 };
 export type RoleName = keyof typeof roles;

package/dist/server/auth/permissions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../../../src/server/auth/permissions.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;CAkBZ,CAAC;AAEX,eAAO,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAAiC,CAAC;AAEjD,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAkBpB,CAAC;AAEH,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;EAMtB,CAAC;AAEH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;EAG7B,CAAC;AAEH,eAAO,MAAM,KAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAIR,CAAC;AAEX,MAAM,MAAM,QAAQ,GAAG,MAAM,OAAO,KAAK,CAAC;AAC1C,MAAM,MAAM,YAAY,GAAG,MAAM,OAAO,SAAS,CAAC;AAClD,MAAM,MAAM,QAAQ,CAAC,CAAC,SAAS,YAAY,IAAI,CAAC,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC"}
+{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../../../src/server/auth/permissions.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;CAuBZ,CAAC;AAEX,eAAO,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAAiC,CAAC;AAEjD,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAuBpB,CAAC;AAEH,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAMtB,CAAC;AAEH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;EAG7B,CAAC;AAEH,eAAO,MAAM,KAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAIR,CAAC;AAEX,MAAM,MAAM,QAAQ,GAAG,MAAM,OAAO,KAAK,CAAC;AAC1C,MAAM,MAAM,YAAY,GAAG,MAAM,OAAO,SAAS,CAAC;AAClD,MAAM,MAAM,QAAQ,CAAC,CAAC,SAAS,YAAY,IAAI,CAAC,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC"}

package/dist/server/auth/permissions.js

@@ -17,6 +17,11 @@ export const statement = {
     sessions: ['view', 'revoke'],
     'player-note': ['view', 'create'],
     'tag-rule': ['view', 'update'],
+    tag: ['view', 'create', 'delete'],
+    'chat-room': ['view', 'create', 'update', 'delete'],
+    'auto-withdrawal-config': ['view', 'update'],
+    'chat-command': ['view', 'update'],
+    'chat-moderation': ['view', 'moderate'],
 };
 export const ac = createAccessControl(statement);
 export const adminRole = ac.newRole({
@@ -37,6 +42,11 @@ export const adminRole = ac.newRole({
     sessions: ['view', 'revoke'],
     'player-note': ['view', 'create'],
     'tag-rule': ['view', 'update'],
+    tag: ['view', 'create', 'delete'],
+    'chat-room': ['view', 'create', 'update', 'delete'],
+    'auto-withdrawal-config': ['view', 'update'],
+    'chat-command': ['view', 'update'],
+    'chat-moderation': ['view', 'moderate'],
 });
 export const supportRole = ac.newRole({
     player: ['view', 'update'],

package/dist/server/auth/permissions.js.map

@@ -1 +1 @@
-{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../../../src/server/auth/permissions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAEjE,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,MAAM,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,gBAAgB,CAAU;IAC5D,WAAW,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAU;IACxC,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAU;IAC5C,OAAO,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAU;IAC3D,UAAU,EAAE,CAAC,MAAM,EAAE,gBAAgB,EAAE,WAAW,CAAU;IAC5D,MAAM,EAAE,CAAC,MAAM,CAAU;IACzB,UAAU,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAU;IACvE,KAAK,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAU;IAC/D,KAAK,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAU;IAClC,KAAK,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAU;IACjE,aAAa,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAU;IACtD,SAAS,EAAE,CAAC,MAAM,CAAU;IAC5B,UAAU,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,SAAS,CAAU;IACrD,SAAS,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAU;IACtC,QAAQ,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAU;IACrC,aAAa,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAU;IAC1C,UAAU,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAU;CAC/B,CAAC;AAEX,MAAM,CAAC,MAAM,EAAE,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;AAEjD,MAAM,CAAC,MAAM,SAAS,GAAG,EAAE,CAAC,OAAO,CAAC;IAClC,MAAM,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,gBAAgB,CAAC;IACnD,WAAW,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC/B,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC;IACnC,OAAO,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC;IAClD,UAAU,EAAE,CAAC,MAAM,EAAE,gBAAgB,EAAE,WAAW,CAAC;IACnD,MAAM,EAAE,CAAC,MAAM,CAAC;IAChB,UAAU,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC;IAC9D,KAAK,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC;IACtD,KAAK,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;IACzB,KAAK,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC;IACxD,aAAa,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAC;IAC7C,SAAS,EAAE,CAAC,MAAM,CAAC;IACnB,UAAU,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,SAAS,CAAC;IAC5C,SAAS,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC7B,QAAQ,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC5B,aAAa,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;IACjC,UAAU,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;CAC/B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,WAAW,GAAG,EAAE,CAAC,OAAO,CAAC;IACpC,MAAM,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC1B,WAAW,EAAE,CAAC,MAAM,CAAC;IACrB,UAAU,EAAE,CAAC,MAAM,CAAC;IACpB,MAAM,EAAE,CAAC,MAAM,CAAC;IAChB,SAAS,EAAE,CAAC,MAAM,CAAC;CACpB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,CAAC,OAAO,CAAC;IAC3C,OAAO,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC;IAClD,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC;CACpC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,KAAK,GAAG;IACnB,KAAK,EAAE,SAAS;IAChB,OAAO,EAAE,WAAW;IACpB,iBAAiB,EAAE,kBAAkB;CAC7B,CAAC"}
+{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../../../src/server/auth/permissions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAEjE,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,MAAM,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,gBAAgB,CAAU;IAC5D,WAAW,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAU;IACxC,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAU;IAC5C,OAAO,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAU;IAC3D,UAAU,EAAE,CAAC,MAAM,EAAE,gBAAgB,EAAE,WAAW,CAAU;IAC5D,MAAM,EAAE,CAAC,MAAM,CAAU;IACzB,UAAU,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAU;IACvE,KAAK,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAU;IAC/D,KAAK,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAU;IAClC,KAAK,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAU;IACjE,aAAa,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAU;IACtD,SAAS,EAAE,CAAC,MAAM,CAAU;IAC5B,UAAU,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,SAAS,CAAU;IACrD,SAAS,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAU;IACtC,QAAQ,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAU;IACrC,aAAa,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAU;IAC1C,UAAU,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAU;IACvC,GAAG,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAU;IAC1C,WAAW,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAU;IAC5D,wBAAwB,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAU;IACrD,cAAc,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAU;IAC3C,iBAAiB,EAAE,CAAC,MAAM,EAAE,UAAU,CAAU;CACxC,CAAC;AAEX,MAAM,CAAC,MAAM,EAAE,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;AAEjD,MAAM,CAAC,MAAM,SAAS,GAAG,EAAE,CAAC,OAAO,CAAC;IAClC,MAAM,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,gBAAgB,CAAC;IACnD,WAAW,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC/B,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC;IACnC,OAAO,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC;IAClD,UAAU,EAAE,CAAC,MAAM,EAAE,gBAAgB,EAAE,WAAW,CAAC;IACnD,MAAM,EAAE,CAAC,MAAM,CAAC;IAChB,UAAU,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC;IAC9D,KAAK,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC;IACtD,KAAK,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;IACzB,KAAK,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC;IACxD,aAAa,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAC;IAC7C,SAAS,EAAE,CAAC,MAAM,CAAC;IACnB,UAAU,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,SAAS,CAAC;IAC5C,SAAS,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC7B,QAAQ,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC5B,aAAa,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;IACjC,UAAU,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC9B,GAAG,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC;IACjC,WAAW,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC;IACnD,wBAAwB,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC5C,cAAc,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;IAClC,iBAAiB,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC;CACxC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,WAAW,GAAG,EAAE,CAAC,OAAO,CAAC;IACpC,MAAM,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC1B,WAAW,EAAE,CAAC,MAAM,CAAC;IACrB,UAAU,EAAE,CAAC,MAAM,CAAC;IACpB,MAAM,EAAE,CAAC,MAAM,CAAC;IAChB,SAAS,EAAE,CAAC,MAAM,CAAC;CACpB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,CAAC,OAAO,CAAC;IAC3C,OAAO,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC;IAClD,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC;CACpC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,KAAK,GAAG;IACnB,KAAK,EAAE,SAAS;IAChB,OAAO,EAAE,WAAW;IACpB,iBAAiB,EAAE,kBAAkB;CAC7B,CAAC"}

package/dist/server/auth/sign-session-cookie.d.ts

@@ -0,0 +1,18 @@
+export type SessionCookieConfig = {
+    name: string;
+    attributes: {
+        domain?: string;
+        httpOnly?: boolean;
+        maxAge?: number;
+        path?: string;
+        secure?: boolean;
+        sameSite?: 'strict' | 'lax' | 'none' | 'Strict' | 'Lax' | 'None';
+    };
+};
+export declare function signSessionCookie({ token, sessionCookie, secret, maxAgeSeconds, }: {
+    token: string;
+    sessionCookie: SessionCookieConfig;
+    secret: string;
+    maxAgeSeconds?: number;
+}): string;
+//# sourceMappingURL=sign-session-cookie.d.ts.map

package/dist/server/auth/sign-session-cookie.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign-session-cookie.d.ts","sourceRoot":"","sources":["../../../src/server/auth/sign-session-cookie.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,mBAAmB,GAAG;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE;QACV,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,QAAQ,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;KAClE,CAAC;CACH,CAAC;AAEF,wBAAgB,iBAAiB,CAAC,EAChC,KAAK,EACL,aAAa,EACb,MAAM,EACN,aAAa,GACd,EAAE;IACD,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,mBAAmB,CAAC;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,GAAG,MAAM,CAUT"}

package/dist/server/auth/sign-session-cookie.js

@@ -0,0 +1,15 @@
+import { createHmac } from 'node:crypto';
+import { serialize } from 'hono/utils/cookie';
+export function signSessionCookie({ token, sessionCookie, secret, maxAgeSeconds, }) {
+    const signature = createHmac('sha256', secret).update(token).digest('base64');
+    const signedValue = `${token}.${signature}`;
+    const attributes = { ...sessionCookie.attributes };
+    if (maxAgeSeconds === undefined) {
+        delete attributes.maxAge;
+    }
+    else {
+        attributes.maxAge = maxAgeSeconds;
+    }
+    return serialize(sessionCookie.name, signedValue, attributes);
+}
+//# sourceMappingURL=sign-session-cookie.js.map

package/dist/server/auth/sign-session-cookie.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign-session-cookie.js","sourceRoot":"","sources":["../../../src/server/auth/sign-session-cookie.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAc9C,MAAM,UAAU,iBAAiB,CAAC,EAChC,KAAK,EACL,aAAa,EACb,MAAM,EACN,aAAa,GAMd;IACC,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC9E,MAAM,WAAW,GAAG,GAAG,KAAK,IAAI,SAAS,EAAE,CAAC;IAC5C,MAAM,UAAU,GAAG,EAAE,GAAG,aAAa,CAAC,UAAU,EAAE,CAAC;IACnD,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,UAAU,CAAC,MAAM,CAAC;IAC3B,CAAC;SAAM,CAAC;QACN,UAAU,CAAC,MAAM,GAAG,aAAa,CAAC;IACpC,CAAC;IACD,OAAO,SAAS,CAAC,aAAa,CAAC,IAAI,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;AAChE,CAAC"}

package/dist/server/db/__tests__/migrate.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=migrate.test.d.ts.map

package/dist/server/db/__tests__/migrate.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrate.test.d.ts","sourceRoot":"","sources":["../../../../src/server/db/__tests__/migrate.test.ts"],"names":[],"mappings":""}

package/dist/server/db/__tests__/migrate.test.js

@@ -0,0 +1,127 @@
+import { describe, expect, it, vi, beforeEach } from 'vitest';
+const { calls, poolInstances, failOnSql, FakePool, readMigrationFilesMock } = vi.hoisted(() => {
+    const calls = [];
+    const poolInstances = [];
+    const failOnSql = { value: null };
+    class FakeClient {
+        query = vi.fn(async (sql) => {
+            if (failOnSql.value !== null && sql === failOnSql.value) {
+                throw new Error(`boom: ${sql}`);
+            }
+            calls.push(sql);
+            return { rows: [] };
+        });
+        release = vi.fn();
+    }
+    class FakePool {
+        opts;
+        query = vi.fn(async (sql) => {
+            if (failOnSql.value !== null && sql === failOnSql.value) {
+                throw new Error(`boom: ${sql}`);
+            }
+            calls.push(sql);
+            return { rows: [] };
+        });
+        connect = vi.fn(async () => new FakeClient());
+        end = vi.fn(async () => {
+            calls.push('end');
+        });
+        constructor(opts) {
+            this.opts = opts;
+            poolInstances.push(this);
+        }
+    }
+    const readMigrationFilesMock = vi.fn(() => []);
+    return { calls, poolInstances, failOnSql, FakePool, readMigrationFilesMock };
+});
+vi.mock('pg', () => ({ Pool: FakePool }));
+vi.mock('drizzle-orm/migrator', () => ({ readMigrationFiles: readMigrationFilesMock }));
+const { runMigrations, applyMigrationsIndividually, withMigrationAdvisoryLock } = await import('../migrate.js');
+describe('runMigrations', () => {
+    beforeEach(() => {
+        calls.length = 0;
+        poolInstances.length = 0;
+        failOnSql.value = null;
+        readMigrationFilesMock.mockClear();
+    });
+    it('runs extensions, then preSql, before reading pending migrations', async () => {
+        await runMigrations({
+            migrationsFolder: '/tmp/migrations',
+            databaseUrl: 'postgres://test',
+            extensions: ['pg_trgm'],
+            preSql: ['UPDATE foo SET bar = 1', 'UPDATE baz SET qux = 2'],
+        });
+        const presqlIndex = calls.indexOf('UPDATE foo SET bar = 1');
+        const readIndex = calls.indexOf('SELECT hash FROM "drizzle"."__drizzle_migrations"');
+        expect(calls).toContain('CREATE EXTENSION IF NOT EXISTS pg_trgm');
+        expect(calls).toEqual(expect.arrayContaining(['UPDATE foo SET bar = 1', 'UPDATE baz SET qux = 2']));
+        expect(presqlIndex).toBeLessThan(readIndex);
+        expect(calls).toContain('end');
+    });
+    it('is a no-op (beyond bookkeeping) when preSql is omitted', async () => {
+        await runMigrations({
+            migrationsFolder: '/tmp/migrations',
+            databaseUrl: 'postgres://test',
+        });
+        expect(calls).not.toContain(undefined);
+        expect(calls).toContain('end');
+    });
+    it('closes the pool even when a preSql statement throws, and never reads pending migrations', async () => {
+        failOnSql.value = 'THIS WILL FAIL';
+        await expect(runMigrations({
+            migrationsFolder: '/tmp/migrations',
+            databaseUrl: 'postgres://test',
+            preSql: ['THIS WILL FAIL'],
+        })).rejects.toThrow('boom: THIS WILL FAIL');
+        expect(readMigrationFilesMock).not.toHaveBeenCalled();
+        expect(calls).toContain('end');
+    });
+});
+const migrations = [
+    {
+        sql: ["ALTER TYPE room_category ADD VALUE 'private-chats';"],
+        folderMillis: 1,
+        hash: 'one',
+        bps: true,
+    },
+    {
+        sql: ["UPDATE chat_room SET category = 'private-chats';"],
+        folderMillis: 2,
+        hash: 'two',
+        bps: true,
+    },
+];
+describe('applyMigrationsIndividually', () => {
+    it('commits each migration file before applying the next one', async () => {
+        const apply = vi.fn(async () => undefined);
+        await applyMigrationsIndividually({ migrations, apply });
+        expect(apply).toHaveBeenCalledTimes(2);
+        expect(apply).toHaveBeenNthCalledWith(1, migrations[0]);
+        expect(apply).toHaveBeenNthCalledWith(2, migrations[1]);
+    });
+});
+describe('withMigrationAdvisoryLock', () => {
+    it('holds the journal lock until the migration work completes', async () => {
+        const query = vi.fn(async () => undefined);
+        const action = vi.fn(async () => undefined);
+        await withMigrationAdvisoryLock({ query }, 'drizzle.__drizzle_migrations_chat', action);
+        expect(query).toHaveBeenNthCalledWith(1, 'SELECT pg_advisory_lock(hashtext($1))', [
+            'drizzle.__drizzle_migrations_chat',
+        ]);
+        expect(action).toHaveBeenCalledOnce();
+        expect(query).toHaveBeenNthCalledWith(2, 'SELECT pg_advisory_unlock(hashtext($1))', [
+            'drizzle.__drizzle_migrations_chat',
+        ]);
+    });
+    it('releases the lock when migration work fails', async () => {
+        const query = vi.fn(async () => undefined);
+        const failure = new Error('migration failed');
+        await expect(withMigrationAdvisoryLock({ query }, 'drizzle.__drizzle_migrations_chat', async () => {
+            throw failure;
+        })).rejects.toThrow(failure);
+        expect(query).toHaveBeenNthCalledWith(2, 'SELECT pg_advisory_unlock(hashtext($1))', [
+            'drizzle.__drizzle_migrations_chat',
+        ]);
+    });
+});
+//# sourceMappingURL=migrate.test.js.map

package/dist/server/db/__tests__/migrate.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrate.test.js","sourceRoot":"","sources":["../../../../src/server/db/__tests__/migrate.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAG9D,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,QAAQ,EAAE,sBAAsB,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;IAC5F,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,aAAa,GAAc,EAAE,CAAC;IACpC,MAAM,SAAS,GAAG,EAAE,KAAK,EAAE,IAAqB,EAAE,CAAC;IAEnD,MAAM,UAAU;QACL,KAAK,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,GAAW,EAAE,EAAE;YAC3C,IAAI,SAAS,CAAC,KAAK,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS,CAAC,KAAK,EAAE,CAAC;gBACxD,MAAM,IAAI,KAAK,CAAC,SAAS,GAAG,EAAE,CAAC,CAAC;YAClC,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChB,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QACtB,CAAC,CAAC,CAAC;QACM,OAAO,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;KAC5B;IAED,MAAM,QAAQ;QAYS;QAXZ,KAAK,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,GAAW,EAAE,EAAE;YAC3C,IAAI,SAAS,CAAC,KAAK,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS,CAAC,KAAK,EAAE,CAAC;gBACxD,MAAM,IAAI,KAAK,CAAC,SAAS,GAAG,EAAE,CAAC,CAAC;YAClC,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChB,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QACtB,CAAC,CAAC,CAAC;QACM,OAAO,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,IAAI,UAAU,EAAE,CAAC,CAAC;QAC9C,GAAG,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE;YAC9B,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpB,CAAC,CAAC,CAAC;QACH,YAAqB,IAAkC;YAAlC,SAAI,GAAJ,IAAI,CAA8B;YACrD,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;KACF;IAED,MAAM,sBAAsB,GAAG,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,EAAqB,CAAC,CAAC;IAElE,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,QAAQ,EAAE,sBAAsB,EAAE,CAAC;AAC/E,CAAC,CAAC,CAAC;AAEH,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;AAC1C,EAAE,CAAC,IAAI,CAAC,sBAAsB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,CAAC,CAAC,CAAC;AAExF,MAAM,EAAE,aAAa,EAAE,2BAA2B,EAAE,yBAAyB,EAAE,GAC7E,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;AAEhC,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC7B,UAAU,CAAC,GAAG,EAAE;QACd,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;QACjB,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC;QACzB,SAAS,CAAC,KAAK,GAAG,IAAI,CAAC;QACvB,sBAAsB,CAAC,SAAS,EAAE,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;QAC/E,MAAM,aAAa,CAAC;YAClB,gBAAgB,EAAE,iBAAiB;YACnC,WAAW,EAAE,iBAAiB;YAC9B,UAAU,EAAE,CAAC,SAAS,CAAC;YACvB,MAAM,EAAE,CAAC,wBAAwB,EAAE,wBAAwB,CAAC;SAC7D,CAAC,CAAC;QAEH,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC;QAC5D,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,mDAAmD,CAAC,CAAC;QACrF,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,wCAAwC,CAAC,CAAC;QAClE,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CACnB,MAAM,CAAC,eAAe,CAAC,CAAC,wBAAwB,EAAE,wBAAwB,CAAC,CAAC,CAC7E,CAAC;QACF,MAAM,CAAC,WAAW,CAAC,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;QAC5C,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,MAAM,aAAa,CAAC;YAClB,gBAAgB,EAAE,iBAAiB;YACnC,WAAW,EAAE,iBAAiB;SAC/B,CAAC,CAAC;QAEH,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACvC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yFAAyF,EAAE,KAAK,IAAI,EAAE;QACvG,SAAS,CAAC,KAAK,GAAG,gBAAgB,CAAC;QAEnC,MAAM,MAAM,CACV,aAAa,CAAC;YACZ,gBAAgB,EAAE,iBAAiB;YACnC,WAAW,EAAE,iBAAiB;YAC9B,MAAM,EAAE,CAAC,gBAAgB,CAAC;SAC3B,CAAC,CACH,CAAC,OAAO,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;QAE1C,MAAM,CAAC,sBAAsB,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QACtD,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,MAAM,UAAU,GAAoB;IAClC;QACE,GAAG,EAAE,CAAC,qDAAqD,CAAC;QAC5D,YAAY,EAAE,CAAC;QACf,IAAI,EAAE,KAAK;QACX,GAAG,EAAE,IAAI;KACV;IACD;QACE,GAAG,EAAE,CAAC,kDAAkD,CAAC;QACzD,YAAY,EAAE,CAAC;QACf,IAAI,EAAE,KAAK;QACX,GAAG,EAAE,IAAI;KACV;CACF,CAAC;AAEF,QAAQ,CAAC,6BAA6B,EAAE,GAAG,EAAE;IAC3C,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,MAAM,KAAK,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,SAAS,CAAC,CAAC;QAE3C,MAAM,2BAA2B,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;QAEzD,MAAM,CAAC,KAAK,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QACvC,MAAM,CAAC,KAAK,CAAC,CAAC,uBAAuB,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QACxD,MAAM,CAAC,KAAK,CAAC,CAAC,uBAAuB,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE;IACzC,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,KAAK,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,SAAS,CAAC,CAAC;QAC3C,MAAM,MAAM,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,SAAS,CAAC,CAAC;QAE5C,MAAM,yBAAyB,CAAC,EAAE,KAAK,EAAE,EAAE,mCAAmC,EAAE,MAAM,CAAC,CAAC;QAExF,MAAM,CAAC,KAAK,CAAC,CAAC,uBAAuB,CAAC,CAAC,EAAE,uCAAuC,EAAE;YAChF,mCAAmC;SACpC,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,CAAC,oBAAoB,EAAE,CAAC;QACtC,MAAM,CAAC,KAAK,CAAC,CAAC,uBAAuB,CAAC,CAAC,EAAE,yCAAyC,EAAE;YAClF,mCAAmC;SACpC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;QAC3D,MAAM,KAAK,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,SAAS,CAAC,CAAC;QAC3C,MAAM,OAAO,GAAG,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;QAE9C,MAAM,MAAM,CACV,yBAAyB,CAAC,EAAE,KAAK,EAAE,EAAE,mCAAmC,EAAE,KAAK,IAAI,EAAE;YACnF,MAAM,OAAO,CAAC;QAChB,CAAC,CAAC,CACH,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAE3B,MAAM,CAAC,KAAK,CAAC,CAAC,uBAAuB,CAAC,CAAC,EAAE,yCAAyC,EAAE;YAClF,mCAAmC;SACpC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}