@realiizlabs/admin 0.9.0 → 0.10.0

package/dist/auth/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/auth/client.ts","../../src/auth/session.ts","../../src/auth/errors.ts","../../src/auth/types.ts","../../src/auth/roles.ts","../../src/auth/callback.ts","../../src/auth/signout.ts","../../src/auth/service.ts"],"names":[],"mappings":";;;;;AAuBO,SAAS,qBAAqB,GAAA,EAAsC;AACzE,EAAA,MAAM,QAAQ,GAAA,CAAI,OAAA;AAClB,EAAA,OAAO,kBAAA,CAAmB,GAAA,CAAI,GAAA,EAAK,GAAA,CAAI,OAAA,EAAS;AAAA,IAC9C,OAAA,EAAS;AAAA,MACP,MAAA,EAAQ,MAAM,KAAA,CAAM,MAAA,EAAO;AAAA,MAC3B,MAAA,EAAQ,CAAC,IAAA,KAAwB;AAI/B,QAAA,IAAI;AACF,UAAA,IAAI,OAAO,KAAA,CAAM,MAAA,KAAW,UAAA,EAAY;AACtC,YAAA,KAAK,KAAA,CAAM,OAAO,IAAI,CAAA;AAAA,UACxB,CAAA,MAAA,IAAW,OAAO,KAAA,CAAM,GAAA,KAAQ,UAAA,EAAY;AAC1C,YAAA,KAAA,MAAW,CAAA,IAAK,MAAM,KAAA,CAAM,GAAA,CAAI,EAAE,IAAA,EAAM,CAAA,CAAE,KAAA,EAAO,CAAA,CAAE,OAAO,CAAA;AAAA,UAC5D;AAAA,QACF,CAAA,CAAA,MAAQ;AAAA,QAER;AAAA,MACF;AAAA;AACF,GACD,CAAA;AACH;;;AClCA,eAAsB,eAAe,MAAA,EAAsD;AACzF,EAAA,MAAM,EAAE,IAAA,EAAM,KAAA,KAAU,MAAM,MAAA,CAAO,KAAK,OAAA,EAAQ;AAClD,EAAA,IAAI,KAAA,IAAS,CAAC,IAAA,CAAK,IAAA,EAAM,OAAO,IAAA;AAChC,EAAA,OAAO,EAAE,IAAI,IAAA,CAAK,IAAA,CAAK,IAAI,KAAA,EAAO,IAAA,CAAK,IAAA,CAAK,KAAA,IAAS,IAAA,EAAK;AAC5D;;;ACZO,IAAM,aAAA,GAAN,cAA4B,KAAA,CAAM;AAAA,EACvC,YAAY,OAAA,EAAiB;AAC3B,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,eAAA;AAAA,EACd;AACF;AAGO,IAAM,oBAAA,GAAN,cAAmC,aAAA,CAAc;AAAA,EACtD,WAAA,GAAc;AACZ,IAAA,KAAA,CAAM,eAAe,CAAA;AACrB,IAAA,IAAA,CAAK,IAAA,GAAO,sBAAA;AAAA,EACd;AACF;AAGO,IAAM,cAAA,GAAN,cAA6B,aAAA,CAAc;AAAA,EAKhD,WAAA,CAAY,MAAA,EAAgB,QAAA,EAAkB,MAAA,EAAuB;AACnE,IAAA,KAAA,CAAM,YAAY,QAAQ,CAAA,UAAA,EAAa,MAAM,CAAA,WAAA,EAAc,MAAA,IAAU,cAAc,CAAA,CAAA,CAAG,CAAA;AACtF,IAAA,IAAA,CAAK,IAAA,GAAO,gBAAA;AACZ,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,QAAA,GAAW,QAAA;AAChB,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AAAA,EAChB;AACF;;;ACCO,IAAM,YAAsC,EAAE,MAAA,EAAQ,GAAG,KAAA,EAAO,CAAA,EAAG,OAAO,CAAA;;;ACnBjF,eAAsB,WAAA,CAAY,MAAA,EAAwB,MAAA,EAAgB,MAAA,EAA2C;AACnH,EAAA,MAAM,GAAA,GAAM,MAAA,IAAA,CAAW,MAAM,cAAA,CAAe,MAAM,CAAA,GAAI,EAAA;AACtD,EAAA,IAAI,CAAC,KAAK,OAAO,IAAA;AAEjB,EAAA,MAAM,CAAC,KAAA,EAAO,MAAM,CAAA,GAAI,MAAM,QAAQ,GAAA,CAAI;AAAA,IACxC,MAAA,CAAO,IAAA,CAAK,OAAO,CAAA,CAAE,MAAA,CAAO,SAAS,CAAA,CAAE,EAAA,CAAG,SAAA,EAAW,GAAG,CAAA,CAAE,WAAA,EAAY;AAAA,IACtE,MAAA,CAAO,IAAA,CAAK,YAAY,CAAA,CAAE,OAAO,MAAM,CAAA,CAAE,EAAA,CAAG,SAAA,EAAW,GAAG,CAAA,CAAE,EAAA,CAAG,SAAA,EAAW,MAAM,EAAE,WAAA;AAAY,GAC/F,CAAA;AAED,EAAA,IAAI,KAAA,CAAM,KAAA,EAAO,MAAM,KAAA,CAAM,KAAA;AAC7B,EAAA,IAAI,MAAA,CAAO,KAAA,EAAO,MAAM,MAAA,CAAO,KAAA;AAE/B,EAAA,IAAI,KAAA,CAAM,MAAM,OAAO,OAAA;AACvB,EAAA,MAAM,IAAA,GAAQ,OAAO,IAAA,EAAmC,IAAA;AACxD,EAAA,OAAO,IAAA,KAAS,OAAA,IAAW,IAAA,KAAS,QAAA,GAAW,IAAA,GAAO,IAAA;AACxD;AAEO,SAAS,WAAA,CAAY,QAAyB,OAAA,EAA4B;AAC/E,EAAA,OAAO,WAAW,IAAA,IAAQ,SAAA,CAAU,MAAM,CAAA,IAAK,UAAU,OAAO,CAAA;AAClE;AAWA,eAAsB,eAAA,CACpB,MAAA,EACA,MAAA,EACA,IAAA,GAAuB,EAAC,EACyB;AACjD,EAAA,MAAM,IAAA,GAAO,MAAM,cAAA,CAAe,MAAM,CAAA;AACxC,EAAA,IAAI,CAAC,IAAA,EAAM,MAAM,IAAI,oBAAA,EAAqB;AAE1C,EAAA,MAAM,OAAA,GAAU,KAAK,WAAA,IAAe,QAAA;AACpC,EAAA,MAAM,OAAO,MAAM,WAAA,CAAY,MAAA,EAAQ,MAAA,EAAQ,KAAK,EAAE,CAAA;AACtD,EAAA,IAAI,CAAC,WAAA,CAAY,IAAA,EAAM,OAAO,CAAA,QAAS,IAAI,cAAA,CAAe,MAAA,EAAQ,OAAA,EAAS,IAAI,CAAA;AAE/E,EAAA,OAAO,EAAE,MAAM,IAAA,EAAuB;AACxC;;;AClCO,SAAS,YAAA,CAAa,MAAiC,QAAA,EAA0B;AACtF,EAAA,IAAI,CAAC,MAAM,OAAO,QAAA;AAElB,EAAA,IAAI,CAAC,cAAA,CAAe,IAAA,CAAK,IAAI,GAAG,OAAO,QAAA;AAEvC,EAAA,IAAI,QAAA,CAAS,KAAK,IAAI,CAAA,IAAK,iBAAiB,IAAA,CAAK,IAAI,GAAG,OAAO,QAAA;AAC/D,EAAA,OAAO,IAAA;AACT;AAEA,eAAsB,kBAAA,CACpB,MAAA,EACA,UAAA,EACA,IAAA,GAAwB,EAAC,EACA;AACzB,EAAA,MAAM,QAAA,GAAW,KAAK,YAAA,IAAgB,QAAA;AACtC,EAAA,MAAM,GAAA,GAAM,OAAO,UAAA,KAAe,QAAA,GAAW,IAAI,GAAA,CAAI,UAAA,EAAY,4BAA4B,CAAA,GAAI,UAAA;AACjG,EAAA,MAAM,IAAA,GAAO,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,MAAM,CAAA;AACxC,EAAA,IAAI,CAAC,IAAA,EAAM,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,QAAQ,cAAA,EAAe;AAEtD,EAAA,MAAM,EAAE,KAAA,EAAM,GAAI,MAAM,MAAA,CAAO,IAAA,CAAK,uBAAuB,IAAI,CAAA;AAC/D,EAAA,IAAI,KAAA,SAAc,EAAE,EAAA,EAAI,OAAO,MAAA,EAAQ,iBAAA,EAAmB,OAAA,EAAS,KAAA,CAAM,OAAA,EAAQ;AAEjF,EAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,UAAA,EAAY,YAAA,CAAa,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,MAAM,CAAA,EAAG,QAAQ,CAAA,EAAE;AACtF;;;ACxCA,eAAsB,QAAQ,MAAA,EAAuC;AACnE,EAAA,MAAM,EAAE,KAAA,EAAM,GAAI,MAAM,MAAA,CAAO,KAAK,OAAA,CAAQ,EAAE,KAAA,EAAO,OAAA,EAAS,CAAA;AAC9D,EAAA,IAAI,OAAO,MAAM,KAAA;AACnB;ACaO,SAAS,oBAAoB,GAAA,EAAoC;AACtE,EAAA,OAAO,YAAA,CAAa,GAAA,CAAI,GAAA,EAAK,GAAA,CAAI,cAAA,EAAgB;AAAA,IAC/C,IAAA,EAAM,EAAE,cAAA,EAAgB,KAAA,EAAO,kBAAkB,KAAA;AAAM,GACxD,CAAA;AACH;AAoBA,eAAe,gBAAA,CAAiB,GAAA,EAAoB,OAAA,EAAiB,MAAA,EAA0C;AAC7G,EAAA,MAAM,KAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,CAAK,OAAO,CAAA,CAAE,MAAA,CAAO,SAAS,CAAA,CAAE,EAAA,CAAG,SAAA,EAAW,OAAO,EAAE,WAAA,EAAY;AAC3F,EAAA,IAAI,KAAA,CAAM,KAAA,EAAO,MAAM,KAAA,CAAM,KAAA;AAC7B,EAAA,IAAI,KAAA,CAAM,MAAM,OAAO,OAAA;AACvB,EAAA,MAAM,IAAI,MAAM,GAAA,CAAI,IAAA,CAAK,YAAY,EAAE,MAAA,CAAO,MAAM,CAAA,CAAE,EAAA,CAAG,WAAW,OAAO,CAAA,CAAE,GAAG,SAAA,EAAW,MAAM,EAAE,WAAA,EAAY;AAC/G,EAAA,IAAI,CAAA,CAAE,KAAA,EAAO,MAAM,CAAA,CAAE,KAAA;AACrB,EAAA,MAAM,IAAA,GAAQ,EAAE,IAAA,EAAmC,IAAA;AACnD,EAAA,OAAO,IAAA,KAAS,OAAA,IAAW,IAAA,KAAS,QAAA,GAAW,IAAA,GAAO,IAAA;AACxD;AAEA,SAAS,cAAA,CAAe,SAAA,EAA4B,MAAA,EAAgB,QAAA,EAAoC;AACtG,EAAA,IAAI,cAAc,OAAA,EAAS;AAC3B,EAAA,IAAI,SAAA,KAAc,OAAA,IAAW,QAAA,KAAa,QAAA,EAAU;AACpD,EAAA,MAAM,IAAI,cAAA,CAAe,MAAA,EAAQ,aAAa,OAAA,GAAU,OAAA,GAAU,SAAS,SAAS,CAAA;AACtF;AAEA,eAAsB,UAAA,CAAW,KAAqB,KAAA,EAA2C;AAC/F,EAAA,MAAM,GAAA,GAAM,oBAAoB,GAAG,CAAA;AACnC,EAAA,MAAM,SAAA,GAAY,MAAM,gBAAA,CAAiB,GAAA,EAAK,MAAM,KAAA,CAAM,EAAA,EAAI,MAAM,MAAM,CAAA;AAC1E,EAAA,cAAA,CAAe,SAAA,EAAW,KAAA,CAAM,MAAA,EAAQ,KAAA,CAAM,IAAI,CAAA;AAElD,EAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,CAAM,IAAA,GAAO,WAAA,EAAY;AAC7C,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI,cAAA,GAAiB,KAAA;AAErB,EAAA,MAAM,SAAS,MAAM,GAAA,CAAI,IAAA,CAAK,KAAA,CAAM,kBAAkB,KAAA,EAAO;AAAA,IAC3D,YAAY,KAAA,CAAM,UAAA;AAAA,IAClB,MAAM,EAAE,OAAA,EAAS,MAAM,MAAA,EAAQ,IAAA,EAAM,MAAM,IAAA;AAAK,GACjD,CAAA;AAED,EAAA,IAAI,CAAC,OAAO,KAAA,EAAO;AACjB,IAAA,MAAA,GAAS,MAAA,CAAO,KAAK,IAAA,CAAK,EAAA;AAC1B,IAAA,cAAA,GAAiB,IAAA;AAAA,EACnB,WAAW,4BAAA,CAA6B,IAAA,CAAK,MAAA,CAAO,KAAA,CAAM,OAAO,CAAA,EAAG;AAElE,IAAA,MAAA,GAAS,MAAM,iBAAA,CAAkB,GAAA,EAAK,KAAK,CAAA;AAC3C,IAAA,IAAI,CAAC,MAAA,EAAQ,MAAM,IAAI,aAAA,CAAc,CAAA,6BAAA,EAAgC,KAAK,CAAA,CAAE,CAAA;AAAA,EAC9E,CAAA,MAAO;AACL,IAAA,MAAM,IAAI,aAAA,CAAc,CAAA,eAAA,EAAkB,MAAA,CAAO,KAAA,CAAM,OAAO,CAAA,CAAE,CAAA;AAAA,EAClE;AAEA,EAAA,MAAM,MAAA,GAAS,MAAM,GAAA,CAClB,IAAA,CAAK,YAAY,EACjB,MAAA,CAAO,EAAE,OAAA,EAAS,MAAA,EAAQ,OAAA,EAAS,KAAA,CAAM,QAAQ,IAAA,EAAM,KAAA,CAAM,IAAA,EAAM,UAAA,EAAY,KAAA,CAAM,KAAA,CAAM,IAAG,EAAG,EAAE,UAAA,EAAY,iBAAA,EAAmB,CAAA;AACrI,EAAA,IAAI,MAAA,CAAO,KAAA,EAAO,MAAM,MAAA,CAAO,KAAA;AAE/B,EAAA,OAAO,EAAE,QAAQ,MAAA,EAAQ,KAAA,CAAM,QAAQ,IAAA,EAAM,KAAA,CAAM,MAAM,cAAA,EAAe;AAC1E;AAEA,eAAe,iBAAA,CAAkB,KAAoB,KAAA,EAA4C;AAE/F,EAAA,KAAA,IAAS,IAAA,GAAO,CAAA,EAAG,IAAA,IAAQ,EAAA,EAAI,IAAA,EAAA,EAAQ;AACrC,IAAA,MAAM,EAAE,IAAA,EAAM,KAAA,EAAM,GAAI,MAAM,GAAA,CAAI,IAAA,CAAK,KAAA,CAAM,SAAA,CAAU,EAAE,IAAA,EAAM,OAAA,EAAS,KAAK,CAAA;AAC7E,IAAA,IAAI,OAAO,MAAM,KAAA;AACjB,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,CAAC,MAAM,CAAA,CAAE,KAAA,EAAO,WAAA,EAAY,KAAM,KAAK,CAAA;AACnE,IAAA,IAAI,GAAA,SAAY,GAAA,CAAI,EAAA;AACpB,IAAA,IAAI,IAAA,CAAK,KAAA,CAAM,MAAA,GAAS,GAAA,EAAK;AAAA,EAC/B;AACA,EAAA,OAAO,MAAA;AACT;AASA,eAAsB,cAAA,CAAe,KAAqB,KAAA,EAAmC;AAC3F,EAAA,MAAM,GAAA,GAAM,oBAAoB,GAAG,CAAA;AACnC,EAAA,MAAM,SAAA,GAAY,MAAM,gBAAA,CAAiB,GAAA,EAAK,MAAM,KAAA,CAAM,EAAA,EAAI,MAAM,MAAM,CAAA;AAE1E,EAAA,MAAM,SAAS,MAAM,GAAA,CAAI,KAAK,YAAY,CAAA,CAAE,OAAO,MAAM,CAAA,CAAE,GAAG,SAAA,EAAW,KAAA,CAAM,MAAM,CAAA,CAAE,EAAA,CAAG,WAAW,KAAA,CAAM,MAAM,EAAE,WAAA,EAAY;AAC/H,EAAA,IAAI,MAAA,CAAO,KAAA,EAAO,MAAM,MAAA,CAAO,KAAA;AAC/B,EAAA,MAAM,UAAA,GAAe,MAAA,CAAO,IAAA,EAAmC,IAAA,IAAQ,QAAA;AACvE,EAAA,cAAA,CAAe,SAAA,EAAW,KAAA,CAAM,MAAA,EAAQ,UAAU,CAAA;AAElD,EAAA,MAAM,MAAM,MAAM,GAAA,CAAI,IAAA,CAAK,YAAY,EAAE,MAAA,EAAO,CAAE,EAAA,CAAG,SAAA,EAAW,MAAM,MAAM,CAAA,CAAE,EAAA,CAAG,SAAA,EAAW,MAAM,MAAM,CAAA;AACxG,EAAA,IAAI,GAAA,CAAI,KAAA,EAAO,MAAM,GAAA,CAAI,KAAA;AAC3B","file":"index.js","sourcesContent":["/**\n * createIdentityClient — a Supabase client bound to the request's cookies.\n *\n * Built per request from arguments. A Next 16 route does:\n *\n *   const store = await cookies();\n *   const client = createIdentityClient({ url, anonKey, cookies: store });\n *\n * No `next` import here. The CookieStore interface accepts either shape a\n * host might hand us: @supabase/ssr's { getAll, setAll }, or Next's\n * cookies() store, which has { getAll, set } — the session cookies are\n * written through whichever exists. (Observed 2026-09-08: with only setAll\n * supported, Next's store silently wrote nothing and every sign-in bounced.)\n */\n\nimport { createServerClient } from \"@supabase/ssr\";\nimport type { SupabaseClient } from \"@supabase/supabase-js\";\nimport type { IdentityContext } from \"./types\";\n\nexport type IdentityClient = SupabaseClient;\n\ntype CookieToSet = { name: string; value: string; options?: Record<string, unknown> };\n\nexport function createIdentityClient(ctx: IdentityContext): IdentityClient {\n  const store = ctx.cookies;\n  return createServerClient(ctx.url, ctx.anonKey, {\n    cookies: {\n      getAll: () => store.getAll(),\n      setAll: (list: CookieToSet[]) => {\n        // Server Components can't set cookies; @supabase/ssr documents that\n        // swallowing the failure there is correct — middleware / route\n        // handlers refresh the session instead.\n        try {\n          if (typeof store.setAll === \"function\") {\n            void store.setAll(list);\n          } else if (typeof store.set === \"function\") {\n            for (const c of list) store.set(c.name, c.value, c.options);\n          }\n        } catch {\n          /* read-only cookie store */\n        }\n      },\n    },\n  });\n}\n","/**\n * getCurrentUser — who is signed in, verified against the auth server.\n *\n * `getUser()` round-trips to Supabase and validates the JWT; `getSession()`\n * only decodes the cookie and is not trustworthy on the server. Always this.\n */\n\nimport type { IdentityClient } from \"./client\";\nimport type { IdentityUser } from \"./types\";\n\nexport async function getCurrentUser(client: IdentityClient): Promise<IdentityUser | null> {\n  const { data, error } = await client.auth.getUser();\n  if (error || !data.user) return null;\n  return { id: data.user.id, email: data.user.email ?? null };\n}\n","/** Typed errors so a route can map them to 401 / 403 without string matching. */\n\nexport class IdentityError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"IdentityError\";\n  }\n}\n\n/** No session — send them to sign in. Maps to 401. */\nexport class UnauthenticatedError extends IdentityError {\n  constructor() {\n    super(\"Not signed in\");\n    this.name = \"UnauthenticatedError\";\n  }\n}\n\n/** Signed in, but not allowed to do this here. Maps to 403. */\nexport class ForbiddenError extends IdentityError {\n  readonly siteId: string;\n  readonly required: string;\n  readonly actual: string | null;\n\n  constructor(siteId: string, required: string, actual: string | null) {\n    super(`Requires ${required} on site \"${siteId}\" (you are ${actual ?? \"not a member\"})`);\n    this.name = \"ForbiddenError\";\n    this.siteId = siteId;\n    this.required = required;\n    this.actual = actual;\n  }\n}\n","/**\n * Types for the identity layer. All config arrives as arguments — never env.\n */\n\n/**\n * Either cookie-store shape a host can hand us:\n *  - @supabase/ssr's CookieMethodsServer: { getAll, setAll }\n *  - Next's `await cookies()` store:      { getAll, set }\n * `setAll` is preferred when present; otherwise each cookie goes through `set`.\n */\nexport interface CookieStore {\n  getAll(): { name: string; value: string }[] | Promise<{ name: string; value: string }[]>;\n  setAll?(cookies: { name: string; value: string; options?: Record<string, unknown> }[]): void | Promise<void>;\n  set?(name: string, value: string, options?: Record<string, unknown>): unknown;\n}\n\n/** Enough to read the signed-in user with the anon key + their cookies. */\nexport interface IdentityContext {\n  url: string;\n  anonKey: string;\n  cookies: CookieStore;\n}\n\n/** Server-only. The service-role key bypasses RLS; the module checks roles in code first. */\nexport interface ServiceContext {\n  url: string;\n  serviceRoleKey: string;\n}\n\nexport type SiteRole = \"staff\" | \"owner\" | \"editor\";\n\nexport const ROLE_RANK: Record<SiteRole, number> = { editor: 1, owner: 2, staff: 3 };\n\nexport interface IdentityUser {\n  id: string;\n  email: string | null;\n}\n\nexport interface SiteMembership {\n  userId: string;\n  siteId: string;\n  role: \"owner\" | \"editor\";\n}\n","/**\n * Role resolution and the request gate.\n *\n * Two selects on the caller's OWN rows — both permitted by RLS with the anon\n * key, so this never needs the service role. Staff wins over any site role.\n */\n\nimport type { IdentityClient } from \"./client\";\nimport { ForbiddenError, UnauthenticatedError } from \"./errors\";\nimport { getCurrentUser } from \"./session\";\nimport { ROLE_RANK, type IdentityUser, type SiteRole } from \"./types\";\n\nexport async function getSiteRole(client: IdentityClient, siteId: string, userId?: string): Promise<SiteRole | null> {\n  const uid = userId ?? (await getCurrentUser(client))?.id;\n  if (!uid) return null;\n\n  const [staff, member] = await Promise.all([\n    client.from(\"staff\").select(\"user_id\").eq(\"user_id\", uid).maybeSingle(),\n    client.from(\"site_users\").select(\"role\").eq(\"user_id\", uid).eq(\"site_id\", siteId).maybeSingle(),\n  ]);\n\n  if (staff.error) throw staff.error;\n  if (member.error) throw member.error;\n\n  if (staff.data) return \"staff\";\n  const role = (member.data as { role?: string } | null)?.role;\n  return role === \"owner\" || role === \"editor\" ? role : null;\n}\n\nexport function roleAtLeast(actual: SiteRole | null, minimum: SiteRole): boolean {\n  return actual !== null && ROLE_RANK[actual] >= ROLE_RANK[minimum];\n}\n\nexport interface RequireOptions {\n  /** Default \"editor\" — any member of the site. */\n  minimumRole?: SiteRole;\n}\n\n/**\n * The gate. Throws UnauthenticatedError (→ sign in) or ForbiddenError (→ 403);\n * otherwise returns the user and their effective role for this site.\n */\nexport async function requireSiteUser(\n  client: IdentityClient,\n  siteId: string,\n  opts: RequireOptions = {},\n): Promise<{ user: IdentityUser; role: SiteRole }> {\n  const user = await getCurrentUser(client);\n  if (!user) throw new UnauthenticatedError();\n\n  const minimum = opts.minimumRole ?? \"editor\";\n  const role = await getSiteRole(client, siteId, user.id);\n  if (!roleAtLeast(role, minimum)) throw new ForbiddenError(siteId, minimum, role);\n\n  return { user, role: role as SiteRole };\n}\n","/**\n * handleAuthCallback — the emailed magic link lands here with ?code=…&next=…\n *\n * Exchanges the PKCE code for a session (cookies are written through the\n * adapter the client was built with) and says where to send the user. The\n * `next` parameter is only honoured when it is a plain same-origin path —\n * \"//evil.example\" and \"https://…\" fall back, which closes the open-redirect\n * a naive startsWith(\"/\") check leaves open.\n */\n\nimport type { IdentityClient } from \"./client\";\n\nexport type CallbackResult =\n  | { ok: true; redirectTo: string }\n  | { ok: false; reason: \"missing_code\" | \"exchange_failed\"; message?: string };\n\nexport interface CallbackOptions {\n  /** Where to go when `next` is absent or unsafe. Default \"/admin\". */\n  fallbackPath?: string;\n}\n\nexport function safeNextPath(next: string | null | undefined, fallback: string): string {\n  if (!next) return fallback;\n  // Exactly one leading slash, then not another slash or backslash.\n  if (!/^\\/(?![/\\\\])/.test(next)) return fallback;\n  // No scheme smuggling or CR/LF.\n  if (/[\\r\\n]/.test(next) || /^\\/[^?#]*:\\/\\//.test(next)) return fallback;\n  return next;\n}\n\nexport async function handleAuthCallback(\n  client: IdentityClient,\n  requestUrl: string | URL,\n  opts: CallbackOptions = {},\n): Promise<CallbackResult> {\n  const fallback = opts.fallbackPath ?? \"/admin\";\n  const url = typeof requestUrl === \"string\" ? new URL(requestUrl, \"http://placeholder.invalid\") : requestUrl;\n  const code = url.searchParams.get(\"code\");\n  if (!code) return { ok: false, reason: \"missing_code\" };\n\n  const { error } = await client.auth.exchangeCodeForSession(code);\n  if (error) return { ok: false, reason: \"exchange_failed\", message: error.message };\n\n  return { ok: true, redirectTo: safeNextPath(url.searchParams.get(\"next\"), fallback) };\n}\n","/** signOut — clears this browser's session. The caller redirects afterwards. */\n\nimport type { IdentityClient } from \"./client\";\n\nexport async function signOut(client: IdentityClient): Promise<void> {\n  const { error } = await client.auth.signOut({ scope: \"local\" });\n  if (error) throw error;\n}\n","/**\n * The only file that touches the service-role key. Invite and remove.\n *\n * Authorization is checked HERE, in code, before the privileged client does\n * anything — RLS doesn't apply to the service role, so this is the guard:\n *   staff  → may grant owner or editor on any site\n *   owner  → may grant editor on their own site only\n *   editor → may not invite\n *\n * `actor` is the caller's already-resolved identity (from requireSiteUser on\n * the anon client). Its role is re-resolved with the service client so a\n * caller can't lie about it.\n */\n\nimport { createClient, type SupabaseClient } from \"@supabase/supabase-js\";\nimport { ForbiddenError, IdentityError } from \"./errors\";\nimport type { ServiceContext, SiteRole } from \"./types\";\n\nexport type ServiceClient = SupabaseClient;\n\nexport function createServiceClient(ctx: ServiceContext): ServiceClient {\n  return createClient(ctx.url, ctx.serviceRoleKey, {\n    auth: { persistSession: false, autoRefreshToken: false },\n  });\n}\n\nexport interface InviteInput {\n  email: string;\n  siteId: string;\n  role: \"owner\" | \"editor\";\n  /** The signed-in user performing the invite. */\n  actor: { id: string };\n  /** Where the invite email's link lands — the site's /admin/auth/callback. */\n  redirectTo: string;\n}\n\nexport interface InviteResult {\n  userId: string;\n  siteId: string;\n  role: \"owner\" | \"editor\";\n  /** false when the auth user already existed and only the membership was added. */\n  invitedByEmail: boolean;\n}\n\nasync function resolveActorRole(svc: ServiceClient, actorId: string, siteId: string): Promise<SiteRole | null> {\n  const staff = await svc.from(\"staff\").select(\"user_id\").eq(\"user_id\", actorId).maybeSingle();\n  if (staff.error) throw staff.error;\n  if (staff.data) return \"staff\";\n  const m = await svc.from(\"site_users\").select(\"role\").eq(\"user_id\", actorId).eq(\"site_id\", siteId).maybeSingle();\n  if (m.error) throw m.error;\n  const role = (m.data as { role?: string } | null)?.role;\n  return role === \"owner\" || role === \"editor\" ? role : null;\n}\n\nfunction assertMayGrant(actorRole: SiteRole | null, siteId: string, granting: \"owner\" | \"editor\"): void {\n  if (actorRole === \"staff\") return;\n  if (actorRole === \"owner\" && granting === \"editor\") return;\n  throw new ForbiddenError(siteId, granting === \"owner\" ? \"staff\" : \"owner\", actorRole);\n}\n\nexport async function inviteUser(ctx: ServiceContext, input: InviteInput): Promise<InviteResult> {\n  const svc = createServiceClient(ctx);\n  const actorRole = await resolveActorRole(svc, input.actor.id, input.siteId);\n  assertMayGrant(actorRole, input.siteId, input.role);\n\n  const email = input.email.trim().toLowerCase();\n  let userId: string | undefined;\n  let invitedByEmail = false;\n\n  const invite = await svc.auth.admin.inviteUserByEmail(email, {\n    redirectTo: input.redirectTo,\n    data: { site_id: input.siteId, role: input.role },\n  });\n\n  if (!invite.error) {\n    userId = invite.data.user.id;\n    invitedByEmail = true;\n  } else if (/already|exists|registered/i.test(invite.error.message)) {\n    // Existing auth user (works for another site, or is staff): just add the row.\n    userId = await findUserIdByEmail(svc, email);\n    if (!userId) throw new IdentityError(`Could not find existing user ${email}`);\n  } else {\n    throw new IdentityError(`Invite failed: ${invite.error.message}`);\n  }\n\n  const upsert = await svc\n    .from(\"site_users\")\n    .upsert({ user_id: userId, site_id: input.siteId, role: input.role, invited_by: input.actor.id }, { onConflict: \"user_id,site_id\" });\n  if (upsert.error) throw upsert.error;\n\n  return { userId, siteId: input.siteId, role: input.role, invitedByEmail };\n}\n\nasync function findUserIdByEmail(svc: ServiceClient, email: string): Promise<string | undefined> {\n  // listUsers is paged; identity holds tens of users, not thousands.\n  for (let page = 1; page <= 20; page++) {\n    const { data, error } = await svc.auth.admin.listUsers({ page, perPage: 200 });\n    if (error) throw error;\n    const hit = data.users.find((u) => u.email?.toLowerCase() === email);\n    if (hit) return hit.id;\n    if (data.users.length < 200) break;\n  }\n  return undefined;\n}\n\nexport interface RemoveInput {\n  userId: string;\n  siteId: string;\n  actor: { id: string };\n}\n\n/** Removes the membership only. The auth user survives (they may belong to other sites). */\nexport async function removeSiteUser(ctx: ServiceContext, input: RemoveInput): Promise<void> {\n  const svc = createServiceClient(ctx);\n  const actorRole = await resolveActorRole(svc, input.actor.id, input.siteId);\n\n  const target = await svc.from(\"site_users\").select(\"role\").eq(\"user_id\", input.userId).eq(\"site_id\", input.siteId).maybeSingle();\n  if (target.error) throw target.error;\n  const targetRole = ((target.data as { role?: string } | null)?.role ?? \"editor\") as \"owner\" | \"editor\";\n  assertMayGrant(actorRole, input.siteId, targetRole);\n\n  const del = await svc.from(\"site_users\").delete().eq(\"user_id\", input.userId).eq(\"site_id\", input.siteId);\n  if (del.error) throw del.error;\n}\n"]}
+{"version":3,"sources":["../../src/auth/client.ts","../../src/auth/session.ts","../../src/auth/errors.ts","../../src/auth/types.ts","../../src/auth/roles.ts","../../src/auth/callback.ts","../../src/auth/signout.ts","../../src/auth/service.ts","../../src/auth/branding.ts","../../src/auth/members.ts","../../src/auth/profile.ts"],"names":[],"mappings":";;;;;AAuBO,SAAS,qBAAqB,GAAA,EAAsC;AACzE,EAAA,MAAM,QAAQ,GAAA,CAAI,OAAA;AAClB,EAAA,OAAO,kBAAA,CAAmB,GAAA,CAAI,GAAA,EAAK,GAAA,CAAI,OAAA,EAAS;AAAA,IAC9C,OAAA,EAAS;AAAA,MACP,MAAA,EAAQ,MAAM,KAAA,CAAM,MAAA,EAAO;AAAA,MAC3B,MAAA,EAAQ,CAAC,IAAA,KAAwB;AAI/B,QAAA,IAAI;AACF,UAAA,IAAI,OAAO,KAAA,CAAM,MAAA,KAAW,UAAA,EAAY;AACtC,YAAA,KAAK,KAAA,CAAM,OAAO,IAAI,CAAA;AAAA,UACxB,CAAA,MAAA,IAAW,OAAO,KAAA,CAAM,GAAA,KAAQ,UAAA,EAAY;AAC1C,YAAA,KAAA,MAAW,CAAA,IAAK,MAAM,KAAA,CAAM,GAAA,CAAI,EAAE,IAAA,EAAM,CAAA,CAAE,KAAA,EAAO,CAAA,CAAE,OAAO,CAAA;AAAA,UAC5D;AAAA,QACF,CAAA,CAAA,MAAQ;AAAA,QAER;AAAA,MACF;AAAA;AACF,GACD,CAAA;AACH;;;AClCA,eAAsB,eAAe,MAAA,EAAsD;AACzF,EAAA,MAAM,EAAE,IAAA,EAAM,KAAA,KAAU,MAAM,MAAA,CAAO,KAAK,OAAA,EAAQ;AAClD,EAAA,IAAI,KAAA,IAAS,CAAC,IAAA,CAAK,IAAA,EAAM,OAAO,IAAA;AAChC,EAAA,OAAO,EAAE,IAAI,IAAA,CAAK,IAAA,CAAK,IAAI,KAAA,EAAO,IAAA,CAAK,IAAA,CAAK,KAAA,IAAS,IAAA,EAAK;AAC5D;;;ACZO,IAAM,aAAA,GAAN,cAA4B,KAAA,CAAM;AAAA,EACvC,YAAY,OAAA,EAAiB;AAC3B,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,eAAA;AAAA,EACd;AACF;AAGO,IAAM,oBAAA,GAAN,cAAmC,aAAA,CAAc;AAAA,EACtD,WAAA,GAAc;AACZ,IAAA,KAAA,CAAM,eAAe,CAAA;AACrB,IAAA,IAAA,CAAK,IAAA,GAAO,sBAAA;AAAA,EACd;AACF;AAGO,IAAM,cAAA,GAAN,cAA6B,aAAA,CAAc;AAAA,EAKhD,WAAA,CAAY,MAAA,EAAgB,QAAA,EAAkB,MAAA,EAAuB;AACnE,IAAA,KAAA,CAAM,YAAY,QAAQ,CAAA,UAAA,EAAa,MAAM,CAAA,WAAA,EAAc,MAAA,IAAU,cAAc,CAAA,CAAA,CAAG,CAAA;AACtF,IAAA,IAAA,CAAK,IAAA,GAAO,gBAAA;AACZ,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,QAAA,GAAW,QAAA;AAChB,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AAAA,EAChB;AACF;;;ACCO,IAAM,YAAsC,EAAE,MAAA,EAAQ,GAAG,KAAA,EAAO,CAAA,EAAG,OAAO,CAAA;;;ACnBjF,eAAsB,WAAA,CAAY,MAAA,EAAwB,MAAA,EAAgB,MAAA,EAA2C;AACnH,EAAA,MAAM,GAAA,GAAM,MAAA,IAAA,CAAW,MAAM,cAAA,CAAe,MAAM,CAAA,GAAI,EAAA;AACtD,EAAA,IAAI,CAAC,KAAK,OAAO,IAAA;AAEjB,EAAA,MAAM,CAAC,KAAA,EAAO,MAAM,CAAA,GAAI,MAAM,QAAQ,GAAA,CAAI;AAAA,IACxC,MAAA,CAAO,IAAA,CAAK,OAAO,CAAA,CAAE,MAAA,CAAO,SAAS,CAAA,CAAE,EAAA,CAAG,SAAA,EAAW,GAAG,CAAA,CAAE,WAAA,EAAY;AAAA,IACtE,MAAA,CAAO,IAAA,CAAK,YAAY,CAAA,CAAE,OAAO,MAAM,CAAA,CAAE,EAAA,CAAG,SAAA,EAAW,GAAG,CAAA,CAAE,EAAA,CAAG,SAAA,EAAW,MAAM,EAAE,WAAA;AAAY,GAC/F,CAAA;AAED,EAAA,IAAI,KAAA,CAAM,KAAA,EAAO,MAAM,KAAA,CAAM,KAAA;AAC7B,EAAA,IAAI,MAAA,CAAO,KAAA,EAAO,MAAM,MAAA,CAAO,KAAA;AAE/B,EAAA,IAAI,KAAA,CAAM,MAAM,OAAO,OAAA;AACvB,EAAA,MAAM,IAAA,GAAQ,OAAO,IAAA,EAAmC,IAAA;AACxD,EAAA,OAAO,IAAA,KAAS,OAAA,IAAW,IAAA,KAAS,QAAA,GAAW,IAAA,GAAO,IAAA;AACxD;AAEO,SAAS,WAAA,CAAY,QAAyB,OAAA,EAA4B;AAC/E,EAAA,OAAO,WAAW,IAAA,IAAQ,SAAA,CAAU,MAAM,CAAA,IAAK,UAAU,OAAO,CAAA;AAClE;AAWA,eAAsB,eAAA,CACpB,MAAA,EACA,MAAA,EACA,IAAA,GAAuB,EAAC,EACyB;AACjD,EAAA,MAAM,IAAA,GAAO,MAAM,cAAA,CAAe,MAAM,CAAA;AACxC,EAAA,IAAI,CAAC,IAAA,EAAM,MAAM,IAAI,oBAAA,EAAqB;AAE1C,EAAA,MAAM,OAAA,GAAU,KAAK,WAAA,IAAe,QAAA;AACpC,EAAA,MAAM,OAAO,MAAM,WAAA,CAAY,MAAA,EAAQ,MAAA,EAAQ,KAAK,EAAE,CAAA;AACtD,EAAA,IAAI,CAAC,WAAA,CAAY,IAAA,EAAM,OAAO,CAAA,QAAS,IAAI,cAAA,CAAe,MAAA,EAAQ,OAAA,EAAS,IAAI,CAAA;AAE/E,EAAA,OAAO,EAAE,MAAM,IAAA,EAAuB;AACxC;;;AClCO,SAAS,YAAA,CAAa,MAAiC,QAAA,EAA0B;AACtF,EAAA,IAAI,CAAC,MAAM,OAAO,QAAA;AAElB,EAAA,IAAI,CAAC,cAAA,CAAe,IAAA,CAAK,IAAI,GAAG,OAAO,QAAA;AAEvC,EAAA,IAAI,QAAA,CAAS,KAAK,IAAI,CAAA,IAAK,iBAAiB,IAAA,CAAK,IAAI,GAAG,OAAO,QAAA;AAC/D,EAAA,OAAO,IAAA;AACT;AAEA,eAAsB,kBAAA,CACpB,MAAA,EACA,UAAA,EACA,IAAA,GAAwB,EAAC,EACA;AACzB,EAAA,MAAM,QAAA,GAAW,KAAK,YAAA,IAAgB,QAAA;AACtC,EAAA,MAAM,GAAA,GAAM,OAAO,UAAA,KAAe,QAAA,GAAW,IAAI,GAAA,CAAI,UAAA,EAAY,4BAA4B,CAAA,GAAI,UAAA;AACjG,EAAA,MAAM,IAAA,GAAO,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,MAAM,CAAA;AACxC,EAAA,IAAI,CAAC,IAAA,EAAM,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,QAAQ,cAAA,EAAe;AAEtD,EAAA,MAAM,EAAE,KAAA,EAAM,GAAI,MAAM,MAAA,CAAO,IAAA,CAAK,uBAAuB,IAAI,CAAA;AAC/D,EAAA,IAAI,KAAA,SAAc,EAAE,EAAA,EAAI,OAAO,MAAA,EAAQ,iBAAA,EAAmB,OAAA,EAAS,KAAA,CAAM,OAAA,EAAQ;AAEjF,EAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,UAAA,EAAY,YAAA,CAAa,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,MAAM,CAAA,EAAG,QAAQ,CAAA,EAAE;AACtF;;;ACxCA,eAAsB,QAAQ,MAAA,EAAuC;AACnE,EAAA,MAAM,EAAE,KAAA,EAAM,GAAI,MAAM,MAAA,CAAO,KAAK,OAAA,CAAQ,EAAE,KAAA,EAAO,OAAA,EAAS,CAAA;AAC9D,EAAA,IAAI,OAAO,MAAM,KAAA;AACnB;ACaO,SAAS,oBAAoB,GAAA,EAAoC;AACtE,EAAA,OAAO,YAAA,CAAa,GAAA,CAAI,GAAA,EAAK,GAAA,CAAI,cAAA,EAAgB;AAAA,IAC/C,IAAA,EAAM,EAAE,cAAA,EAAgB,KAAA,EAAO,kBAAkB,KAAA;AAAM,GACxD,CAAA;AACH;AAoBA,eAAe,gBAAA,CAAiB,GAAA,EAAoB,OAAA,EAAiB,MAAA,EAA0C;AAC7G,EAAA,MAAM,KAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,CAAK,OAAO,CAAA,CAAE,MAAA,CAAO,SAAS,CAAA,CAAE,EAAA,CAAG,SAAA,EAAW,OAAO,EAAE,WAAA,EAAY;AAC3F,EAAA,IAAI,KAAA,CAAM,KAAA,EAAO,MAAM,KAAA,CAAM,KAAA;AAC7B,EAAA,IAAI,KAAA,CAAM,MAAM,OAAO,OAAA;AACvB,EAAA,MAAM,IAAI,MAAM,GAAA,CAAI,IAAA,CAAK,YAAY,EAAE,MAAA,CAAO,MAAM,CAAA,CAAE,EAAA,CAAG,WAAW,OAAO,CAAA,CAAE,GAAG,SAAA,EAAW,MAAM,EAAE,WAAA,EAAY;AAC/G,EAAA,IAAI,CAAA,CAAE,KAAA,EAAO,MAAM,CAAA,CAAE,KAAA;AACrB,EAAA,MAAM,IAAA,GAAQ,EAAE,IAAA,EAAmC,IAAA;AACnD,EAAA,OAAO,IAAA,KAAS,OAAA,IAAW,IAAA,KAAS,QAAA,GAAW,IAAA,GAAO,IAAA;AACxD;AAEA,SAAS,cAAA,CAAe,SAAA,EAA4B,MAAA,EAAgB,QAAA,EAAoC;AACtG,EAAA,IAAI,cAAc,OAAA,EAAS;AAC3B,EAAA,IAAI,SAAA,KAAc,OAAA,IAAW,QAAA,KAAa,QAAA,EAAU;AACpD,EAAA,MAAM,IAAI,cAAA,CAAe,MAAA,EAAQ,aAAa,OAAA,GAAU,OAAA,GAAU,SAAS,SAAS,CAAA;AACtF;AAEA,eAAsB,UAAA,CAAW,KAAqB,KAAA,EAA2C;AAC/F,EAAA,MAAM,GAAA,GAAM,oBAAoB,GAAG,CAAA;AACnC,EAAA,MAAM,SAAA,GAAY,MAAM,gBAAA,CAAiB,GAAA,EAAK,MAAM,KAAA,CAAM,EAAA,EAAI,MAAM,MAAM,CAAA;AAC1E,EAAA,cAAA,CAAe,SAAA,EAAW,KAAA,CAAM,MAAA,EAAQ,KAAA,CAAM,IAAI,CAAA;AAElD,EAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,CAAM,IAAA,GAAO,WAAA,EAAY;AAC7C,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI,cAAA,GAAiB,KAAA;AAErB,EAAA,MAAM,SAAS,MAAM,GAAA,CAAI,IAAA,CAAK,KAAA,CAAM,kBAAkB,KAAA,EAAO;AAAA,IAC3D,YAAY,KAAA,CAAM,UAAA;AAAA,IAClB,MAAM,EAAE,OAAA,EAAS,MAAM,MAAA,EAAQ,IAAA,EAAM,MAAM,IAAA;AAAK,GACjD,CAAA;AAED,EAAA,IAAI,CAAC,OAAO,KAAA,EAAO;AACjB,IAAA,MAAA,GAAS,MAAA,CAAO,KAAK,IAAA,CAAK,EAAA;AAC1B,IAAA,cAAA,GAAiB,IAAA;AAAA,EACnB,WAAW,4BAAA,CAA6B,IAAA,CAAK,MAAA,CAAO,KAAA,CAAM,OAAO,CAAA,EAAG;AAElE,IAAA,MAAA,GAAS,MAAM,iBAAA,CAAkB,GAAA,EAAK,KAAK,CAAA;AAC3C,IAAA,IAAI,CAAC,MAAA,EAAQ,MAAM,IAAI,aAAA,CAAc,CAAA,6BAAA,EAAgC,KAAK,CAAA,CAAE,CAAA;AAAA,EAC9E,CAAA,MAAO;AACL,IAAA,MAAM,IAAI,aAAA,CAAc,CAAA,eAAA,EAAkB,MAAA,CAAO,KAAA,CAAM,OAAO,CAAA,CAAE,CAAA;AAAA,EAClE;AAEA,EAAA,MAAM,MAAA,GAAS,MAAM,GAAA,CAClB,IAAA,CAAK,YAAY,EACjB,MAAA,CAAO,EAAE,OAAA,EAAS,MAAA,EAAQ,OAAA,EAAS,KAAA,CAAM,QAAQ,IAAA,EAAM,KAAA,CAAM,IAAA,EAAM,UAAA,EAAY,KAAA,CAAM,KAAA,CAAM,IAAG,EAAG,EAAE,UAAA,EAAY,iBAAA,EAAmB,CAAA;AACrI,EAAA,IAAI,MAAA,CAAO,KAAA,EAAO,MAAM,MAAA,CAAO,KAAA;AAE/B,EAAA,OAAO,EAAE,QAAQ,MAAA,EAAQ,KAAA,CAAM,QAAQ,IAAA,EAAM,KAAA,CAAM,MAAM,cAAA,EAAe;AAC1E;AAEA,eAAe,iBAAA,CAAkB,KAAoB,KAAA,EAA4C;AAE/F,EAAA,KAAA,IAAS,IAAA,GAAO,CAAA,EAAG,IAAA,IAAQ,EAAA,EAAI,IAAA,EAAA,EAAQ;AACrC,IAAA,MAAM,EAAE,IAAA,EAAM,KAAA,EAAM,GAAI,MAAM,GAAA,CAAI,IAAA,CAAK,KAAA,CAAM,SAAA,CAAU,EAAE,IAAA,EAAM,OAAA,EAAS,KAAK,CAAA;AAC7E,IAAA,IAAI,OAAO,MAAM,KAAA;AACjB,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,CAAC,MAAM,CAAA,CAAE,KAAA,EAAO,WAAA,EAAY,KAAM,KAAK,CAAA;AACnE,IAAA,IAAI,GAAA,SAAY,GAAA,CAAI,EAAA;AACpB,IAAA,IAAI,IAAA,CAAK,KAAA,CAAM,MAAA,GAAS,GAAA,EAAK;AAAA,EAC/B;AACA,EAAA,OAAO,MAAA;AACT;AASA,eAAsB,cAAA,CAAe,KAAqB,KAAA,EAAmC;AAC3F,EAAA,MAAM,GAAA,GAAM,oBAAoB,GAAG,CAAA;AACnC,EAAA,MAAM,SAAA,GAAY,MAAM,gBAAA,CAAiB,GAAA,EAAK,MAAM,KAAA,CAAM,EAAA,EAAI,MAAM,MAAM,CAAA;AAE1E,EAAA,MAAM,SAAS,MAAM,GAAA,CAAI,KAAK,YAAY,CAAA,CAAE,OAAO,MAAM,CAAA,CAAE,GAAG,SAAA,EAAW,KAAA,CAAM,MAAM,CAAA,CAAE,EAAA,CAAG,WAAW,KAAA,CAAM,MAAM,EAAE,WAAA,EAAY;AAC/H,EAAA,IAAI,MAAA,CAAO,KAAA,EAAO,MAAM,MAAA,CAAO,KAAA;AAC/B,EAAA,MAAM,UAAA,GAAe,MAAA,CAAO,IAAA,EAAmC,IAAA,IAAQ,QAAA;AACvE,EAAA,cAAA,CAAe,SAAA,EAAW,KAAA,CAAM,MAAA,EAAQ,UAAU,CAAA;AAClD,EAAA,IAAI,eAAe,OAAA,EAAS,MAAM,kBAAA,CAAmB,GAAA,EAAK,MAAM,MAAM,CAAA;AAEtE,EAAA,MAAM,MAAM,MAAM,GAAA,CAAI,IAAA,CAAK,YAAY,EAAE,MAAA,EAAO,CAAE,EAAA,CAAG,SAAA,EAAW,MAAM,MAAM,CAAA,CAAE,EAAA,CAAG,SAAA,EAAW,MAAM,MAAM,CAAA;AACxG,EAAA,IAAI,GAAA,CAAI,KAAA,EAAO,MAAM,GAAA,CAAI,KAAA;AAC3B;AAcA,eAAsB,cAAA,CAAe,KAAqB,KAAA,EAAiC;AACzF,EAAA,MAAM,GAAA,GAAM,oBAAoB,GAAG,CAAA;AACnC,EAAA,MAAM,SAAA,GAAY,MAAM,gBAAA,CAAiB,GAAA,EAAK,MAAM,KAAA,CAAM,EAAA,EAAI,MAAM,MAAM,CAAA;AAC1E,EAAA,cAAA,CAAe,SAAA,EAAW,KAAA,CAAM,MAAA,EAAQ,KAAA,CAAM,IAAI,CAAA;AAElD,EAAA,MAAM,SAAS,MAAM,GAAA,CAAI,KAAK,YAAY,CAAA,CAAE,OAAO,MAAM,CAAA,CAAE,GAAG,SAAA,EAAW,KAAA,CAAM,MAAM,CAAA,CAAE,EAAA,CAAG,WAAW,KAAA,CAAM,MAAM,EAAE,WAAA,EAAY;AAC/H,EAAA,IAAI,MAAA,CAAO,KAAA,EAAO,MAAM,MAAA,CAAO,KAAA;AAC/B,EAAA,MAAM,OAAA,GAAW,OAAO,IAAA,EAAmC,IAAA;AAC3D,EAAA,IAAI,CAAC,OAAA,EAAS,MAAM,IAAI,cAAc,0CAA0C,CAAA;AAEhF,EAAA,IAAI,YAAY,OAAA,EAAS,cAAA,CAAe,SAAA,EAAW,KAAA,CAAM,QAAQ,OAAO,CAAA;AACxE,EAAA,IAAI,OAAA,KAAY,WAAW,KAAA,CAAM,IAAA,KAAS,UAAU,MAAM,kBAAA,CAAmB,GAAA,EAAK,KAAA,CAAM,MAAM,CAAA;AAE9F,EAAA,MAAM,GAAA,GAAM,MAAM,GAAA,CAAI,IAAA,CAAK,YAAY,CAAA,CAAE,MAAA,CAAO,EAAE,IAAA,EAAM,KAAA,CAAM,MAAM,CAAA,CAAE,GAAG,SAAA,EAAW,KAAA,CAAM,MAAM,CAAA,CAAE,EAAA,CAAG,SAAA,EAAW,KAAA,CAAM,MAAM,CAAA;AAC5H,EAAA,IAAI,GAAA,CAAI,KAAA,EAAO,MAAM,GAAA,CAAI,KAAA;AAC3B;AAEA,eAAsB,kBAAA,CAAmB,KAAoB,MAAA,EAA+B;AAC1F,EAAA,MAAM,MAAA,GAAS,MAAM,GAAA,CAAI,IAAA,CAAK,YAAY,CAAA,CAAE,MAAA,CAAO,SAAS,CAAA,CAAE,GAAG,SAAA,EAAW,MAAM,CAAA,CAAE,EAAA,CAAG,QAAQ,OAAO,CAAA;AACtG,EAAA,IAAI,MAAA,CAAO,KAAA,EAAO,MAAM,MAAA,CAAO,KAAA;AAC/B,EAAA,IAAA,CAAK,MAAA,CAAO,QAAQ,EAAC,EAAG,UAAU,CAAA,EAAG,MAAM,IAAI,aAAA,CAAc,0EAAqE,CAAA;AACpI;AAUA,eAAsB,YAAA,CAAa,KAAqB,KAAA,EAAmE;AACzH,EAAA,MAAM,GAAA,GAAM,oBAAoB,GAAG,CAAA;AACnC,EAAA,MAAM,SAAA,GAAY,MAAM,gBAAA,CAAiB,GAAA,EAAK,MAAM,KAAA,CAAM,EAAA,EAAI,MAAM,MAAM,CAAA;AAC1E,EAAA,cAAA,CAAe,SAAA,EAAW,KAAA,CAAM,MAAA,EAAQ,QAAQ,CAAA;AAEhD,EAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,CAAM,IAAA,GAAO,WAAA,EAAY;AAC7C,EAAA,MAAM,QAAQ,MAAM,GAAA,CAAI,IAAA,CAAK,KAAA,CAAM,kBAAkB,KAAA,EAAO,EAAE,UAAA,EAAY,KAAA,CAAM,YAAY,IAAA,EAAM,EAAE,SAAS,KAAA,CAAM,MAAA,IAAU,CAAA;AAC7H,EAAA,IAAI,CAAC,KAAA,CAAM,KAAA,EAAO,OAAO,EAAE,QAAQ,IAAA,EAAM,OAAA,EAAS,CAAA,yBAAA,EAA4B,KAAK,CAAA,CAAA,CAAA,EAAI;AACvF,EAAA,IAAI,sCAAA,CAAuC,IAAA,CAAK,KAAA,CAAM,KAAA,CAAM,OAAO,CAAA,EAAG;AACpE,IAAA,OAAO,EAAE,MAAA,EAAQ,KAAA,EAAO,OAAA,EAAS,CAAA,EAAG,KAAK,CAAA,0EAAA,CAAA,EAAwE;AAAA,EACnH;AACA,EAAA,MAAM,IAAI,aAAA,CAAc,CAAA,eAAA,EAAkB,KAAA,CAAM,KAAA,CAAM,OAAO,CAAA,CAAE,CAAA;AACjE;;;AC3JA,eAAsB,eAAA,CAAgB,QAAwB,MAAA,EAA8C;AAC1G,EAAA,MAAM,EAAE,IAAA,EAAM,KAAA,EAAM,GAAI,MAAM,OAAO,IAAA,CAAK,OAAO,CAAA,CAAE,MAAA,CAAO,6DAA6D,CAAA,CAAE,EAAA,CAAG,SAAA,EAAW,MAAM,EAAE,WAAA,EAAY;AAC3J,EAAA,IAAI,OAAO,MAAM,KAAA;AACjB,EAAA,IAAI,CAAC,MAAM,OAAO,IAAA;AAClB,EAAA,MAAM,CAAA,GAAI,IAAA;AACV,EAAA,OAAO,EAAE,IAAA,EAAM,CAAA,CAAE,IAAA,EAAM,SAAS,CAAA,CAAE,QAAA,EAAU,UAAA,EAAY,CAAA,CAAE,aAAa,aAAA,EAAe,CAAA,CAAE,cAAA,EAAgB,aAAA,EAAe,EAAE,cAAA,EAAe;AAC1I;AAGA,eAAsB,kBAAA,CAAmB,MAAA,EAAwB,MAAA,EAAgB,KAAA,EAAqC;AACpH,EAAA,MAAM,GAAA,GAAM;AAAA,IACV,OAAA,EAAS,MAAA;AAAA,IACT,IAAA,EAAM,KAAA,CAAM,IAAA,CAAK,IAAA,EAAK;AAAA,IACtB,QAAA,EAAU,MAAM,OAAA,IAAW,IAAA;AAAA,IAC3B,WAAA,EAAa,MAAM,UAAA,IAAc,IAAA;AAAA,IACjC,cAAA,EAAgB,WAAA,CAAY,KAAA,CAAM,aAAa,CAAA;AAAA,IAC/C,cAAA,EAAgB,WAAA,CAAY,KAAA,CAAM,aAAa;AAAA,GACjD;AACA,EAAA,MAAM,EAAE,KAAA,EAAM,GAAI,MAAM,MAAA,CAAO,IAAA,CAAK,OAAO,CAAA,CAAE,MAAA,CAAO,GAAA,EAAK,EAAE,UAAA,EAAY,WAAW,CAAA;AAClF,EAAA,IAAI,OAAO,MAAM,KAAA;AACnB;AAEA,SAAS,YAAY,CAAA,EAA6C;AAChE,EAAA,MAAM,CAAA,GAAA,CAAK,CAAA,IAAK,EAAA,EAAI,IAAA,EAAK;AACzB,EAAA,OAAO,CAAA,KAAM,KAAK,IAAA,GAAO,CAAA;AAC3B;;;ACrBA,eAAsB,eAAA,CAAgB,QAAwB,MAAA,EAAuC;AACnG,EAAA,MAAM,EAAE,IAAA,EAAM,KAAA,EAAM,GAAI,MAAM,MAAA,CAAO,GAAA,CAAI,cAAA,EAAgB,EAAE,SAAA,EAAW,MAAA,EAAQ,CAAA;AAC9E,EAAA,IAAI,KAAA,EAAO;AACT,IAAA,IAAI,KAAA,CAAM,IAAA,KAAS,OAAA,IAAW,cAAA,CAAe,IAAA,CAAK,KAAA,CAAM,OAAO,CAAA,EAAG,MAAM,IAAI,cAAA,CAAe,MAAA,EAAQ,SAAS,IAAI,CAAA;AAChH,IAAA,MAAM,KAAA;AAAA,EACR;AACA,EAAA,OAAA,CAAS,IAAA,IAAQ,EAAC,EAAa,GAAA,CAAI,CAAC,CAAA,MAAO;AAAA,IACzC,QAAQ,CAAA,CAAE,OAAA;AAAA,IACV,OAAO,CAAA,CAAE,KAAA;AAAA,IACT,MAAM,CAAA,CAAE,IAAA;AAAA,IACR,WAAW,CAAA,CAAE,UAAA;AAAA,IACb,IAAA,EAAM,CAAA,CAAE,IAAA,KAAS,OAAA,GAAU,OAAA,GAAU,QAAA;AAAA,IACrC,MAAA,EAAQ,CAAA,CAAE,MAAA,KAAW,QAAA,GAAW,QAAA,GAAW,SAAA;AAAA,IAC3C,WAAW,CAAA,CAAE;AAAA,GACf,CAAE,CAAA;AACJ;;;ACnCO,IAAM,mBAAA,GAAsB;AAC5B,IAAM,kBAAA,GAAqB;AAY3B,SAAS,UAAU,IAAA,EAAsF;AAC9G,EAAA,MAAM,CAAA,GAAI,IAAA,EAAM,aAAA,IAAiB,EAAC;AAClC,EAAA,MAAM,IAAA,GAAO,OAAO,CAAA,CAAE,IAAA,KAAS,QAAA,IAAY,CAAA,CAAE,IAAA,CAAK,IAAA,EAAK,GAAI,CAAA,CAAE,IAAA,CAAK,IAAA,EAAK,GAAI,IAAA;AAC3E,EAAA,MAAM,SAAA,GAAY,OAAO,CAAA,CAAE,UAAA,KAAe,YAAY,CAAA,CAAE,UAAA,GAAa,EAAE,UAAA,GAAa,IAAA;AACpF,EAAA,OAAO,EAAE,MAAM,SAAA,EAAU;AAC3B;AAEA,eAAsB,aAAA,CAAc,QAAwB,KAAA,EAAuC;AACjG,EAAA,MAAM,OAAgC,EAAC;AACvC,EAAA,IAAI,KAAA,CAAM,IAAA,KAAS,MAAA,EAAW,IAAA,CAAK,IAAA,GAAA,CAAQ,KAAA,CAAM,IAAA,IAAQ,EAAA,EAAI,IAAA,EAAK,CAAE,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AAC/E,EAAA,IAAI,MAAM,SAAA,KAAc,MAAA,EAAW,IAAA,CAAK,UAAA,GAAa,MAAM,SAAA,IAAa,EAAA;AACxE,EAAA,MAAM,EAAE,IAAA,EAAM,GAAA,EAAK,KAAA,EAAM,GAAI,MAAM,MAAA,CAAO,IAAA,CAAK,UAAA,CAAW,EAAE,IAAA,EAAM,CAAA;AAClE,EAAA,IAAI,KAAA,EAAO,MAAM,IAAI,aAAA,CAAc,MAAM,OAAO,CAAA;AAChD,EAAA,OAAO,SAAA,CAAU,IAAI,IAAI,CAAA;AAC3B;AAGA,eAAsB,WAAA,CAAY,QAAwB,QAAA,EAAiC;AACzF,EAAA,IAAI,OAAO,aAAa,QAAA,IAAY,QAAA,CAAS,SAAS,mBAAA,EAAqB,MAAM,IAAI,aAAA,CAAc,kBAAkB,CAAA;AACrH,EAAA,MAAM,EAAE,OAAM,GAAI,MAAM,OAAO,IAAA,CAAK,UAAA,CAAW,EAAE,QAAA,EAAU,CAAA;AAC3D,EAAA,IAAI,KAAA,EAAO,MAAM,IAAI,aAAA,CAAc,MAAM,OAAO,CAAA;AAClD","file":"index.js","sourcesContent":["/**\n * createIdentityClient — a Supabase client bound to the request's cookies.\n *\n * Built per request from arguments. A Next 16 route does:\n *\n *   const store = await cookies();\n *   const client = createIdentityClient({ url, anonKey, cookies: store });\n *\n * No `next` import here. The CookieStore interface accepts either shape a\n * host might hand us: @supabase/ssr's { getAll, setAll }, or Next's\n * cookies() store, which has { getAll, set } — the session cookies are\n * written through whichever exists. (Observed 2026-09-08: with only setAll\n * supported, Next's store silently wrote nothing and every sign-in bounced.)\n */\n\nimport { createServerClient } from \"@supabase/ssr\";\nimport type { SupabaseClient } from \"@supabase/supabase-js\";\nimport type { IdentityContext } from \"./types\";\n\nexport type IdentityClient = SupabaseClient;\n\ntype CookieToSet = { name: string; value: string; options?: Record<string, unknown> };\n\nexport function createIdentityClient(ctx: IdentityContext): IdentityClient {\n  const store = ctx.cookies;\n  return createServerClient(ctx.url, ctx.anonKey, {\n    cookies: {\n      getAll: () => store.getAll(),\n      setAll: (list: CookieToSet[]) => {\n        // Server Components can't set cookies; @supabase/ssr documents that\n        // swallowing the failure there is correct — middleware / route\n        // handlers refresh the session instead.\n        try {\n          if (typeof store.setAll === \"function\") {\n            void store.setAll(list);\n          } else if (typeof store.set === \"function\") {\n            for (const c of list) store.set(c.name, c.value, c.options);\n          }\n        } catch {\n          /* read-only cookie store */\n        }\n      },\n    },\n  });\n}\n","/**\n * getCurrentUser — who is signed in, verified against the auth server.\n *\n * `getUser()` round-trips to Supabase and validates the JWT; `getSession()`\n * only decodes the cookie and is not trustworthy on the server. Always this.\n */\n\nimport type { IdentityClient } from \"./client\";\nimport type { IdentityUser } from \"./types\";\n\nexport async function getCurrentUser(client: IdentityClient): Promise<IdentityUser | null> {\n  const { data, error } = await client.auth.getUser();\n  if (error || !data.user) return null;\n  return { id: data.user.id, email: data.user.email ?? null };\n}\n","/** Typed errors so a route can map them to 401 / 403 without string matching. */\n\nexport class IdentityError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"IdentityError\";\n  }\n}\n\n/** No session — send them to sign in. Maps to 401. */\nexport class UnauthenticatedError extends IdentityError {\n  constructor() {\n    super(\"Not signed in\");\n    this.name = \"UnauthenticatedError\";\n  }\n}\n\n/** Signed in, but not allowed to do this here. Maps to 403. */\nexport class ForbiddenError extends IdentityError {\n  readonly siteId: string;\n  readonly required: string;\n  readonly actual: string | null;\n\n  constructor(siteId: string, required: string, actual: string | null) {\n    super(`Requires ${required} on site \"${siteId}\" (you are ${actual ?? \"not a member\"})`);\n    this.name = \"ForbiddenError\";\n    this.siteId = siteId;\n    this.required = required;\n    this.actual = actual;\n  }\n}\n","/**\n * Types for the identity layer. All config arrives as arguments — never env.\n */\n\n/**\n * Either cookie-store shape a host can hand us:\n *  - @supabase/ssr's CookieMethodsServer: { getAll, setAll }\n *  - Next's `await cookies()` store:      { getAll, set }\n * `setAll` is preferred when present; otherwise each cookie goes through `set`.\n */\nexport interface CookieStore {\n  getAll(): { name: string; value: string }[] | Promise<{ name: string; value: string }[]>;\n  setAll?(cookies: { name: string; value: string; options?: Record<string, unknown> }[]): void | Promise<void>;\n  set?(name: string, value: string, options?: Record<string, unknown>): unknown;\n}\n\n/** Enough to read the signed-in user with the anon key + their cookies. */\nexport interface IdentityContext {\n  url: string;\n  anonKey: string;\n  cookies: CookieStore;\n}\n\n/** Server-only. The service-role key bypasses RLS; the module checks roles in code first. */\nexport interface ServiceContext {\n  url: string;\n  serviceRoleKey: string;\n}\n\nexport type SiteRole = \"staff\" | \"owner\" | \"editor\";\n\nexport const ROLE_RANK: Record<SiteRole, number> = { editor: 1, owner: 2, staff: 3 };\n\nexport interface IdentityUser {\n  id: string;\n  email: string | null;\n}\n\nexport interface SiteMembership {\n  userId: string;\n  siteId: string;\n  role: \"owner\" | \"editor\";\n}\n","/**\n * Role resolution and the request gate.\n *\n * Two selects on the caller's OWN rows — both permitted by RLS with the anon\n * key, so this never needs the service role. Staff wins over any site role.\n */\n\nimport type { IdentityClient } from \"./client\";\nimport { ForbiddenError, UnauthenticatedError } from \"./errors\";\nimport { getCurrentUser } from \"./session\";\nimport { ROLE_RANK, type IdentityUser, type SiteRole } from \"./types\";\n\nexport async function getSiteRole(client: IdentityClient, siteId: string, userId?: string): Promise<SiteRole | null> {\n  const uid = userId ?? (await getCurrentUser(client))?.id;\n  if (!uid) return null;\n\n  const [staff, member] = await Promise.all([\n    client.from(\"staff\").select(\"user_id\").eq(\"user_id\", uid).maybeSingle(),\n    client.from(\"site_users\").select(\"role\").eq(\"user_id\", uid).eq(\"site_id\", siteId).maybeSingle(),\n  ]);\n\n  if (staff.error) throw staff.error;\n  if (member.error) throw member.error;\n\n  if (staff.data) return \"staff\";\n  const role = (member.data as { role?: string } | null)?.role;\n  return role === \"owner\" || role === \"editor\" ? role : null;\n}\n\nexport function roleAtLeast(actual: SiteRole | null, minimum: SiteRole): boolean {\n  return actual !== null && ROLE_RANK[actual] >= ROLE_RANK[minimum];\n}\n\nexport interface RequireOptions {\n  /** Default \"editor\" — any member of the site. */\n  minimumRole?: SiteRole;\n}\n\n/**\n * The gate. Throws UnauthenticatedError (→ sign in) or ForbiddenError (→ 403);\n * otherwise returns the user and their effective role for this site.\n */\nexport async function requireSiteUser(\n  client: IdentityClient,\n  siteId: string,\n  opts: RequireOptions = {},\n): Promise<{ user: IdentityUser; role: SiteRole }> {\n  const user = await getCurrentUser(client);\n  if (!user) throw new UnauthenticatedError();\n\n  const minimum = opts.minimumRole ?? \"editor\";\n  const role = await getSiteRole(client, siteId, user.id);\n  if (!roleAtLeast(role, minimum)) throw new ForbiddenError(siteId, minimum, role);\n\n  return { user, role: role as SiteRole };\n}\n","/**\n * handleAuthCallback — the emailed magic link lands here with ?code=…&next=…\n *\n * Exchanges the PKCE code for a session (cookies are written through the\n * adapter the client was built with) and says where to send the user. The\n * `next` parameter is only honoured when it is a plain same-origin path —\n * \"//evil.example\" and \"https://…\" fall back, which closes the open-redirect\n * a naive startsWith(\"/\") check leaves open.\n */\n\nimport type { IdentityClient } from \"./client\";\n\nexport type CallbackResult =\n  | { ok: true; redirectTo: string }\n  | { ok: false; reason: \"missing_code\" | \"exchange_failed\"; message?: string };\n\nexport interface CallbackOptions {\n  /** Where to go when `next` is absent or unsafe. Default \"/admin\". */\n  fallbackPath?: string;\n}\n\nexport function safeNextPath(next: string | null | undefined, fallback: string): string {\n  if (!next) return fallback;\n  // Exactly one leading slash, then not another slash or backslash.\n  if (!/^\\/(?![/\\\\])/.test(next)) return fallback;\n  // No scheme smuggling or CR/LF.\n  if (/[\\r\\n]/.test(next) || /^\\/[^?#]*:\\/\\//.test(next)) return fallback;\n  return next;\n}\n\nexport async function handleAuthCallback(\n  client: IdentityClient,\n  requestUrl: string | URL,\n  opts: CallbackOptions = {},\n): Promise<CallbackResult> {\n  const fallback = opts.fallbackPath ?? \"/admin\";\n  const url = typeof requestUrl === \"string\" ? new URL(requestUrl, \"http://placeholder.invalid\") : requestUrl;\n  const code = url.searchParams.get(\"code\");\n  if (!code) return { ok: false, reason: \"missing_code\" };\n\n  const { error } = await client.auth.exchangeCodeForSession(code);\n  if (error) return { ok: false, reason: \"exchange_failed\", message: error.message };\n\n  return { ok: true, redirectTo: safeNextPath(url.searchParams.get(\"next\"), fallback) };\n}\n","/** signOut — clears this browser's session. The caller redirects afterwards. */\n\nimport type { IdentityClient } from \"./client\";\n\nexport async function signOut(client: IdentityClient): Promise<void> {\n  const { error } = await client.auth.signOut({ scope: \"local\" });\n  if (error) throw error;\n}\n","/**\n * The only file that touches the service-role key. Invite and remove.\n *\n * Authorization is checked HERE, in code, before the privileged client does\n * anything — RLS doesn't apply to the service role, so this is the guard:\n *   staff  → may grant owner or editor on any site\n *   owner  → may grant editor on their own site only\n *   editor → may not invite\n *\n * `actor` is the caller's already-resolved identity (from requireSiteUser on\n * the anon client). Its role is re-resolved with the service client so a\n * caller can't lie about it.\n */\n\nimport { createClient, type SupabaseClient } from \"@supabase/supabase-js\";\nimport { ForbiddenError, IdentityError } from \"./errors\";\nimport type { ServiceContext, SiteRole } from \"./types\";\n\nexport type ServiceClient = SupabaseClient;\n\nexport function createServiceClient(ctx: ServiceContext): ServiceClient {\n  return createClient(ctx.url, ctx.serviceRoleKey, {\n    auth: { persistSession: false, autoRefreshToken: false },\n  });\n}\n\nexport interface InviteInput {\n  email: string;\n  siteId: string;\n  role: \"owner\" | \"editor\";\n  /** The signed-in user performing the invite. */\n  actor: { id: string };\n  /** Where the invite email's link lands — the site's /admin/auth/callback. */\n  redirectTo: string;\n}\n\nexport interface InviteResult {\n  userId: string;\n  siteId: string;\n  role: \"owner\" | \"editor\";\n  /** false when the auth user already existed and only the membership was added. */\n  invitedByEmail: boolean;\n}\n\nasync function resolveActorRole(svc: ServiceClient, actorId: string, siteId: string): Promise<SiteRole | null> {\n  const staff = await svc.from(\"staff\").select(\"user_id\").eq(\"user_id\", actorId).maybeSingle();\n  if (staff.error) throw staff.error;\n  if (staff.data) return \"staff\";\n  const m = await svc.from(\"site_users\").select(\"role\").eq(\"user_id\", actorId).eq(\"site_id\", siteId).maybeSingle();\n  if (m.error) throw m.error;\n  const role = (m.data as { role?: string } | null)?.role;\n  return role === \"owner\" || role === \"editor\" ? role : null;\n}\n\nfunction assertMayGrant(actorRole: SiteRole | null, siteId: string, granting: \"owner\" | \"editor\"): void {\n  if (actorRole === \"staff\") return;\n  if (actorRole === \"owner\" && granting === \"editor\") return;\n  throw new ForbiddenError(siteId, granting === \"owner\" ? \"staff\" : \"owner\", actorRole);\n}\n\nexport async function inviteUser(ctx: ServiceContext, input: InviteInput): Promise<InviteResult> {\n  const svc = createServiceClient(ctx);\n  const actorRole = await resolveActorRole(svc, input.actor.id, input.siteId);\n  assertMayGrant(actorRole, input.siteId, input.role);\n\n  const email = input.email.trim().toLowerCase();\n  let userId: string | undefined;\n  let invitedByEmail = false;\n\n  const invite = await svc.auth.admin.inviteUserByEmail(email, {\n    redirectTo: input.redirectTo,\n    data: { site_id: input.siteId, role: input.role },\n  });\n\n  if (!invite.error) {\n    userId = invite.data.user.id;\n    invitedByEmail = true;\n  } else if (/already|exists|registered/i.test(invite.error.message)) {\n    // Existing auth user (works for another site, or is staff): just add the row.\n    userId = await findUserIdByEmail(svc, email);\n    if (!userId) throw new IdentityError(`Could not find existing user ${email}`);\n  } else {\n    throw new IdentityError(`Invite failed: ${invite.error.message}`);\n  }\n\n  const upsert = await svc\n    .from(\"site_users\")\n    .upsert({ user_id: userId, site_id: input.siteId, role: input.role, invited_by: input.actor.id }, { onConflict: \"user_id,site_id\" });\n  if (upsert.error) throw upsert.error;\n\n  return { userId, siteId: input.siteId, role: input.role, invitedByEmail };\n}\n\nasync function findUserIdByEmail(svc: ServiceClient, email: string): Promise<string | undefined> {\n  // listUsers is paged; identity holds tens of users, not thousands.\n  for (let page = 1; page <= 20; page++) {\n    const { data, error } = await svc.auth.admin.listUsers({ page, perPage: 200 });\n    if (error) throw error;\n    const hit = data.users.find((u) => u.email?.toLowerCase() === email);\n    if (hit) return hit.id;\n    if (data.users.length < 200) break;\n  }\n  return undefined;\n}\n\nexport interface RemoveInput {\n  userId: string;\n  siteId: string;\n  actor: { id: string };\n}\n\n/** Removes the membership only. The auth user survives (they may belong to other sites). */\nexport async function removeSiteUser(ctx: ServiceContext, input: RemoveInput): Promise<void> {\n  const svc = createServiceClient(ctx);\n  const actorRole = await resolveActorRole(svc, input.actor.id, input.siteId);\n\n  const target = await svc.from(\"site_users\").select(\"role\").eq(\"user_id\", input.userId).eq(\"site_id\", input.siteId).maybeSingle();\n  if (target.error) throw target.error;\n  const targetRole = ((target.data as { role?: string } | null)?.role ?? \"editor\") as \"owner\" | \"editor\";\n  assertMayGrant(actorRole, input.siteId, targetRole);\n  if (targetRole === \"owner\") await assertNotLastOwner(svc, input.siteId);\n\n  const del = await svc.from(\"site_users\").delete().eq(\"user_id\", input.userId).eq(\"site_id\", input.siteId);\n  if (del.error) throw del.error;\n}\n\nexport interface RoleInput {\n  userId: string;\n  siteId: string;\n  role: \"owner\" | \"editor\";\n  actor: { id: string };\n}\n\n/**\n * Change a member's role. Same grant rules as invite (staff anything; an owner\n * may only make people editors on their own site), plus: the last owner of a\n * site can never be demoted, otherwise nobody could manage it.\n */\nexport async function updateSiteRole(ctx: ServiceContext, input: RoleInput): Promise<void> {\n  const svc = createServiceClient(ctx);\n  const actorRole = await resolveActorRole(svc, input.actor.id, input.siteId);\n  assertMayGrant(actorRole, input.siteId, input.role);\n\n  const target = await svc.from(\"site_users\").select(\"role\").eq(\"user_id\", input.userId).eq(\"site_id\", input.siteId).maybeSingle();\n  if (target.error) throw target.error;\n  const current = (target.data as { role?: string } | null)?.role;\n  if (!current) throw new IdentityError(\"That person isn't a member of this site.\");\n  // Demoting an owner is an owner-level act — an owner may not do it to a peer.\n  if (current === \"owner\") assertMayGrant(actorRole, input.siteId, \"owner\");\n  if (current === \"owner\" && input.role === \"editor\") await assertNotLastOwner(svc, input.siteId);\n\n  const upd = await svc.from(\"site_users\").update({ role: input.role }).eq(\"user_id\", input.userId).eq(\"site_id\", input.siteId);\n  if (upd.error) throw upd.error;\n}\n\nexport async function assertNotLastOwner(svc: ServiceClient, siteId: string): Promise<void> {\n  const owners = await svc.from(\"site_users\").select(\"user_id\").eq(\"site_id\", siteId).eq(\"role\", \"owner\");\n  if (owners.error) throw owners.error;\n  if ((owners.data ?? []).length <= 1) throw new IdentityError(\"A site needs at least one owner — make someone else an owner first.\");\n}\n\nexport interface ResendInput {\n  email: string;\n  siteId: string;\n  actor: { id: string };\n  redirectTo: string;\n}\n\n/** Send the invite email again. An already-active user gets no email — they can just sign in. */\nexport async function resendInvite(ctx: ServiceContext, input: ResendInput): Promise<{ resent: boolean; message: string }> {\n  const svc = createServiceClient(ctx);\n  const actorRole = await resolveActorRole(svc, input.actor.id, input.siteId);\n  assertMayGrant(actorRole, input.siteId, \"editor\");\n\n  const email = input.email.trim().toLowerCase();\n  const again = await svc.auth.admin.inviteUserByEmail(email, { redirectTo: input.redirectTo, data: { site_id: input.siteId } });\n  if (!again.error) return { resent: true, message: `Invitation sent again to ${email}.` };\n  if (/already|exists|registered|confirmed/i.test(again.error.message)) {\n    return { resent: false, message: `${email} has already accepted — they can sign in with an email link any time.` };\n  }\n  throw new IdentityError(`Resend failed: ${again.error.message}`);\n}\n","/**\n * Per-site branding — the Business tab. Reads and writes public.sites through\n * the signed-in user's client, so RLS decides who may (members read; owners\n * and staff write). Nothing here needs the service role.\n */\n\nimport type { IdentityClient } from \"./client\";\n\nexport interface SiteBranding {\n  name: string;\n  logoUrl: string | null;\n  faviconUrl: string | null;\n  businessEmail: string | null;\n  businessPhone: string | null;\n}\n\nexport type BrandingPatch = Partial<SiteBranding> & { name: string };\n\ninterface Row {\n  name: string;\n  logo_url: string | null;\n  favicon_url: string | null;\n  business_email: string | null;\n  business_phone: string | null;\n}\n\nexport async function getSiteBranding(client: IdentityClient, siteId: string): Promise<SiteBranding | null> {\n  const { data, error } = await client.from(\"sites\").select(\"name, logo_url, favicon_url, business_email, business_phone\").eq(\"site_id\", siteId).maybeSingle();\n  if (error) throw error;\n  if (!data) return null;\n  const r = data as Row;\n  return { name: r.name, logoUrl: r.logo_url, faviconUrl: r.favicon_url, businessEmail: r.business_email, businessPhone: r.business_phone };\n}\n\n/** Upsert the row. RLS refuses anyone but the site's owners or staff. */\nexport async function updateSiteBranding(client: IdentityClient, siteId: string, patch: BrandingPatch): Promise<void> {\n  const row = {\n    site_id: siteId,\n    name: patch.name.trim(),\n    logo_url: patch.logoUrl ?? null,\n    favicon_url: patch.faviconUrl ?? null,\n    business_email: emptyToNull(patch.businessEmail),\n    business_phone: emptyToNull(patch.businessPhone),\n  };\n  const { error } = await client.from(\"sites\").upsert(row, { onConflict: \"site_id\" });\n  if (error) throw error;\n}\n\nfunction emptyToNull(v: string | null | undefined): string | null {\n  const s = (v ?? \"\").trim();\n  return s === \"\" ? null : s;\n}\n","/**\n * The Team roster — public.site_members(site_id), a SECURITY DEFINER function\n * that returns rows only to that site's owners or staff (editors get a 42501).\n * Read with the signed-in user's client; writes are in service.ts.\n */\n\nimport type { IdentityClient } from \"./client\";\nimport { ForbiddenError } from \"./errors\";\n\nexport interface SiteMember {\n  userId: string;\n  email: string;\n  name: string | null;\n  avatarUrl: string | null;\n  role: \"owner\" | \"editor\";\n  /** \"invited\" until the person has signed in once. */\n  status: \"invited\" | \"active\";\n  invitedAt: string;\n}\n\ninterface Row {\n  user_id: string;\n  email: string;\n  name: string | null;\n  avatar_url: string | null;\n  role: string;\n  status: string;\n  invited_at: string;\n}\n\nexport async function listSiteMembers(client: IdentityClient, siteId: string): Promise<SiteMember[]> {\n  const { data, error } = await client.rpc(\"site_members\", { p_site_id: siteId });\n  if (error) {\n    if (error.code === \"42501\" || /not allowed/i.test(error.message)) throw new ForbiddenError(siteId, \"owner\", null);\n    throw error;\n  }\n  return ((data ?? []) as Row[]).map((r) => ({\n    userId: r.user_id,\n    email: r.email,\n    name: r.name,\n    avatarUrl: r.avatar_url,\n    role: r.role === \"owner\" ? \"owner\" : \"editor\",\n    status: r.status === \"active\" ? \"active\" : \"invited\",\n    invitedAt: r.invited_at,\n  }));\n}\n","/**\n * My Profile and Change Password — the signed-in user editing themselves,\n * through their own client (auth.updateUser). Name and photo live in user\n * metadata; the photo file itself is in the avatars bucket (uploaded by the\n * host, path avatars/{uid}/…).\n */\n\nimport type { IdentityClient } from \"./client\";\nimport { IdentityError } from \"./errors\";\n\nexport const MIN_PASSWORD_LENGTH = 10;\nexport const PASSWORD_TOO_SHORT = \"Use at least 10 characters.\";\n\nexport interface ProfilePatch {\n  name?: string | null;\n  avatarUrl?: string | null;\n}\n\nexport interface Profile {\n  name: string | null;\n  avatarUrl: string | null;\n}\n\nexport function profileOf(user: { user_metadata?: Record<string, unknown> | null } | null | undefined): Profile {\n  const m = user?.user_metadata ?? {};\n  const name = typeof m.name === \"string\" && m.name.trim() ? m.name.trim() : null;\n  const avatarUrl = typeof m.avatar_url === \"string\" && m.avatar_url ? m.avatar_url : null;\n  return { name, avatarUrl };\n}\n\nexport async function updateProfile(client: IdentityClient, patch: ProfilePatch): Promise<Profile> {\n  const data: Record<string, unknown> = {};\n  if (patch.name !== undefined) data.name = (patch.name ?? \"\").trim().slice(0, 80);\n  if (patch.avatarUrl !== undefined) data.avatar_url = patch.avatarUrl ?? \"\";\n  const { data: res, error } = await client.auth.updateUser({ data });\n  if (error) throw new IdentityError(error.message);\n  return profileOf(res.user);\n}\n\n/** Sets (or replaces) a password. Magic links keep working alongside it. */\nexport async function setPassword(client: IdentityClient, password: string): Promise<void> {\n  if (typeof password !== \"string\" || password.length < MIN_PASSWORD_LENGTH) throw new IdentityError(PASSWORD_TOO_SHORT);\n  const { error } = await client.auth.updateUser({ password });\n  if (error) throw new IdentityError(error.message);\n}\n"]}

package/dist/shell/index.cjs

@@ -51,8 +51,12 @@ function Icon({ name }) {
       ] });
     case "settings":
       return /* @__PURE__ */ jsxRuntime.jsxs("svg", { ...base, children: [
-        /* @__PURE__ */ jsxRuntime.jsx("circle", { cx: "12", cy: "12", r: "3" }),
-        /* @__PURE__ */ jsxRuntime.jsx("path", { d: "M19.4 15a1.7 1.7 0 0 0 .3 1.8l.1.1a2 2 0 1 1-2.8 2.8l-.1-.1a1.7 1.7 0 0 0-1.8-.3 1.7 1.7 0 0 0-1 1.5V21a2 2 0 1 1-4 0v-.1a1.7 1.7 0 0 0-1.1-1.5 1.7 1.7 0 0 0-1.8.3l-.1.1a2 2 0 1 1-2.8-2.8l.1-.1a1.7 1.7 0 0 0 .3-1.8 1.7 1.7 0 0 0-1.5-1H3a2 2 0 1 1 0-4h.1a1.7 1.7 0 0 0 1.5-1.1 1.7 1.7 0 0 0-.3-1.8l-.1-.1a2 2 0 1 1 2.8-2.8l.1.1a1.7 1.7 0 0 0 1.8.3H9a1.7 1.7 0 0 0 1-1.5V3a2 2 0 1 1 4 0v.1a1.7 1.7 0 0 0 1 1.5 1.7 1.7 0 0 0 1.8-.3l.1-.1a2 2 0 1 1 2.8 2.8l-.1.1a1.7 1.7 0 0 0-.3 1.8V9a1.7 1.7 0 0 0 1.5 1H21a2 2 0 1 1 0 4h-.1a1.7 1.7 0 0 0-1.5 1z" })
+        /* @__PURE__ */ jsxRuntime.jsx("path", { d: "M4 7h9" }),
+        /* @__PURE__ */ jsxRuntime.jsx("circle", { cx: "16", cy: "7", r: "2" }),
+        /* @__PURE__ */ jsxRuntime.jsx("path", { d: "M19 7h1" }),
+        /* @__PURE__ */ jsxRuntime.jsx("path", { d: "M4 17h9" }),
+        /* @__PURE__ */ jsxRuntime.jsx("circle", { cx: "16", cy: "17", r: "2" }),
+        /* @__PURE__ */ jsxRuntime.jsx("path", { d: "M19 17h1" })
       ] });
     default:
       return /* @__PURE__ */ jsxRuntime.jsxs("svg", { ...base, children: [
@@ -171,12 +175,21 @@ var SunIcon = () => /* @__PURE__ */ jsxRuntime.jsxs("svg", { ...ico, children: [
   /* @__PURE__ */ jsxRuntime.jsx("circle", { cx: "12", cy: "12", r: "4" }),
   /* @__PURE__ */ jsxRuntime.jsx("path", { d: "M12 2v2M12 20v2M4.9 4.9l1.4 1.4M17.7 17.7l1.4 1.4M2 12h2M20 12h2M4.9 19.1l1.4-1.4M17.7 6.3l1.4-1.4" })
 ] });
+var UserIcon = () => /* @__PURE__ */ jsxRuntime.jsxs("svg", { ...ico, children: [
+  /* @__PURE__ */ jsxRuntime.jsx("circle", { cx: "12", cy: "8", r: "4" }),
+  /* @__PURE__ */ jsxRuntime.jsx("path", { d: "M4 21a8 8 0 0 1 16 0" })
+] });
+var HelpIcon = () => /* @__PURE__ */ jsxRuntime.jsxs("svg", { ...ico, children: [
+  /* @__PURE__ */ jsxRuntime.jsx("circle", { cx: "12", cy: "12", r: "9" }),
+  /* @__PURE__ */ jsxRuntime.jsx("path", { d: "M9.5 9.5a2.5 2.5 0 1 1 3.5 2.3c-.7.3-1 .8-1 1.7" }),
+  /* @__PURE__ */ jsxRuntime.jsx("path", { d: "M12 17h.01" })
+] });
 var OutIcon = () => /* @__PURE__ */ jsxRuntime.jsxs("svg", { ...ico, children: [
   /* @__PURE__ */ jsxRuntime.jsx("path", { d: "M9 21H5a2 2 0 0 1-2-2V5a2 2 0 0 1 2-2h4" }),
   /* @__PURE__ */ jsxRuntime.jsx("path", { d: "M16 17l5-5-5-5" }),
   /* @__PURE__ */ jsxRuntime.jsx("path", { d: "M21 12H9" })
 ] });
-function AccountMenu({ user, role, theme, onTheme, signOutPath }) {
+function AccountMenu({ user, role, theme, onTheme, signOutPath, accountHref, helpHref }) {
   const [open, setOpen] = react.useState(false);
   const wrap = react.useRef(null);
   react.useEffect(() => {
@@ -195,12 +208,21 @@ function AccountMenu({ user, role, theme, onTheme, signOutPath }) {
     };
   }, [open]);
   return /* @__PURE__ */ jsxRuntime.jsxs("div", { ref: wrap, style: { position: "relative" }, children: [
-    /* @__PURE__ */ jsxRuntime.jsx("button", { type: "button", className: "rz-avatar", "aria-haspopup": "menu", "aria-expanded": open, "aria-label": "Account menu", onClick: () => setOpen((v) => !v), children: initialsOf(user) }),
+    /* @__PURE__ */ jsxRuntime.jsx("button", { type: "button", className: "rz-avatar", "aria-haspopup": "menu", "aria-expanded": open, "aria-label": "Account menu", onClick: () => setOpen((v) => !v), children: user.avatarUrl ? /* @__PURE__ */ jsxRuntime.jsx("img", { src: user.avatarUrl, alt: "", className: "rz-avatar__img" }) : initialsOf(user) }),
     open && /* @__PURE__ */ jsxRuntime.jsxs("div", { className: "rz-menu", role: "menu", children: [
       /* @__PURE__ */ jsxRuntime.jsxs("div", { className: "rz-menu__who", children: [
         /* @__PURE__ */ jsxRuntime.jsx("div", { className: "rz-menu__name", children: user.name?.trim() || user.email }),
         user.name?.trim() && /* @__PURE__ */ jsxRuntime.jsx("div", { className: "rz-menu__email", children: user.email })
       ] }),
+      accountHref && /* @__PURE__ */ jsxRuntime.jsxs("a", { href: accountHref, role: "menuitem", className: "rz-menu__item", children: [
+        /* @__PURE__ */ jsxRuntime.jsx(UserIcon, {}),
+        "Account"
+      ] }),
+      helpHref && /* @__PURE__ */ jsxRuntime.jsxs("a", { href: helpHref, role: "menuitem", className: "rz-menu__item", children: [
+        /* @__PURE__ */ jsxRuntime.jsx(HelpIcon, {}),
+        "Help"
+      ] }),
+      (accountHref || helpHref) && /* @__PURE__ */ jsxRuntime.jsx("div", { className: "rz-menu__sep" }),
       /* @__PURE__ */ jsxRuntime.jsxs("div", { className: "rz-menu__item rz-menu__item--static", role: "menuitem", "aria-disabled": "true", children: [
         /* @__PURE__ */ jsxRuntime.jsx(ShieldIcon, {}),
         /* @__PURE__ */ jsxRuntime.jsx("span", { children: "Role" }),
@@ -219,7 +241,7 @@ function AccountMenu({ user, role, theme, onTheme, signOutPath }) {
     ] })
   ] });
 }
-function TopBar({ siteName, productName, logoUrl, homeHref, user, role, theme, onTheme, signOutPath }) {
+function TopBar({ siteName, productName, logoUrl, homeHref, user, role, theme, onTheme, signOutPath, accountHref, helpHref }) {
   return /* @__PURE__ */ jsxRuntime.jsxs("header", { className: "rz-topbar", children: [
     /* @__PURE__ */ jsxRuntime.jsxs("a", { href: homeHref, className: "rz-topbar__brand", children: [
       logoUrl && /* @__PURE__ */ jsxRuntime.jsx("img", { src: logoUrl, alt: "", className: "rz-topbar__logo" }),
@@ -231,7 +253,7 @@ function TopBar({ siteName, productName, logoUrl, homeHref, user, role, theme, o
         "Welcome back, ",
         firstNameOf(user)
       ] }),
-      /* @__PURE__ */ jsxRuntime.jsx(AccountMenu, { user, role, theme, onTheme, signOutPath })
+      /* @__PURE__ */ jsxRuntime.jsx(AccountMenu, { user, role, theme, onTheme, signOutPath, accountHref, helpHref })
     ] })
   ] });
 }
@@ -391,7 +413,13 @@ var SHELL_CSS = `
 .rz-ok { border: 1px solid var(--status-up); color: var(--signal-dim); border-radius: var(--rz-radius); padding: 12px 14px; margin: 0 0 16px; }
 
 /* ---- account menu --------------------------------------------------- */
-.rz-avatar { width: 2rem; height: 2rem; border-radius: 50%; background: var(--surface-3); border: 1px solid var(--border); color: var(--text-primary); font-size: .6875rem; font-weight: 600; letter-spacing: .04em; display: flex; align-items: center; justify-content: center; cursor: pointer; font-family: inherit; padding: 0; }
+.rz-avatar__img { width: 100%; height: 100%; border-radius: 50%; object-fit: cover; display: block; }
+.rz-tabs { display: flex; gap: .25rem; border-bottom: 1px solid var(--border); margin: 0 0 1.5rem; flex-wrap: wrap; }
+.rz-tabs__tab { padding: .55rem .9rem; font: inherit; font-size: .88rem; color: var(--text-secondary); background: none; border: 0; border-bottom: 2px solid transparent; margin-bottom: -1px; cursor: pointer; }
+.rz-tabs__tab:hover { color: var(--text-primary); }
+.rz-tabs__tab[aria-selected="true"] { color: var(--text-primary); border-bottom-color: var(--signal); font-weight: 600; }
+.rz-tabs__tab:focus-visible { outline: 2px solid var(--signal); outline-offset: -2px; border-radius: 4px; }
+.rz-avatar { width: 2rem; height: 2rem; border-radius: 50%; background: var(--surface-3); border: 1px solid var(--border); color: var(--text-primary); font-size: .6875rem; font-weight: 600; letter-spacing: .04em; display: flex; align-items: center; justify-content: center; cursor: pointer; font-family: inherit; padding: 0; overflow: hidden; }
 .rz-menu { position: absolute; right: 0; top: calc(100% + 8px); min-width: 15rem; background: var(--surface-1); border: 1px solid var(--border); border-radius: 8px; box-shadow: 0 8px 24px rgba(14,23,38,.14); overflow: hidden; z-index: 50; }
 .rz-menu__who { padding: .75rem .9rem; border-bottom: 1px solid var(--border); margin-bottom: .3rem; }
 .rz-menu__name { font-weight: 600; font-size: .875rem; }
@@ -493,25 +521,32 @@ function AdminShell({
   activeHref,
   basePath = "/admin",
   signOutPath,
+  accountHref,
+  helpHref,
+  branding,
   defaultTheme = "light",
   children
 }) {
   const [theme, setTheme] = useTheme(defaultTheme);
   const showNav = Boolean(user && role);
+  const shownName = branding?.name?.trim() || siteName;
+  const shownLogo = branding?.logoUrl || logoUrl;
   return /* @__PURE__ */ jsxRuntime.jsxs("div", { className: "rz-admin", "data-theme": theme, children: [
     /* @__PURE__ */ jsxRuntime.jsx("style", { children: SHELL_CSS }),
     /* @__PURE__ */ jsxRuntime.jsx(
       TopBar,
       {
-        siteName,
+        siteName: shownName,
         productName,
-        logoUrl,
+        logoUrl: shownLogo,
         homeHref: basePath,
         user,
         role,
         theme,
         onTheme: setTheme,
-        signOutPath: signOutPath ?? `${basePath}/auth/signout`
+        signOutPath: signOutPath ?? `${basePath}/auth/signout`,
+        accountHref: accountHref === null ? void 0 : accountHref ?? `${basePath}/account`,
+        helpHref: helpHref === null ? void 0 : helpHref ?? `${basePath}/help`
       }
     ),
     /* @__PURE__ */ jsxRuntime.jsxs("div", { className: "rz-body", children: [
@@ -586,6 +621,44 @@ function Steps({ steps }) {
     ] })
   ] }, i)) });
 }
+function Tabs({ options, value, onChange, label = "Sections" }) {
+  const list = react.useRef(null);
+  const onKey = (e) => {
+    const i = options.findIndex((o) => o.value === value);
+    if (i < 0) return;
+    let next = i;
+    if (e.key === "ArrowRight") next = (i + 1) % options.length;
+    else if (e.key === "ArrowLeft") next = (i - 1 + options.length) % options.length;
+    else if (e.key === "Home") next = 0;
+    else if (e.key === "End") next = options.length - 1;
+    else return;
+    e.preventDefault();
+    onChange(options[next].value);
+    list.current?.children[next]?.focus();
+  };
+  return /* @__PURE__ */ jsxRuntime.jsx("div", { ref: list, className: "rz-tabs", role: "tablist", "aria-label": label, onKeyDown: onKey, children: options.map((o) => {
+    const active = o.value === value;
+    return /* @__PURE__ */ jsxRuntime.jsxs(
+      "button",
+      {
+        type: "button",
+        role: "tab",
+        className: "rz-tabs__tab",
+        "aria-selected": active,
+        tabIndex: active ? 0 : -1,
+        onClick: () => onChange(o.value),
+        children: [
+          o.label,
+          o.suffix && /* @__PURE__ */ jsxRuntime.jsxs("span", { className: "rz-muted", children: [
+            " ",
+            o.suffix
+          ] })
+        ]
+      },
+      o.value
+    );
+  }) });
+}
 
 exports.AccountMenu = AccountMenu;
 exports.AdminShell = AdminShell;
@@ -601,6 +674,7 @@ exports.SHELL_CSS = SHELL_CSS;
 exports.Sidebar = Sidebar;
 exports.StatusPill = StatusPill;
 exports.Steps = Steps;
+exports.Tabs = Tabs;
 exports.ThemeToggle = ThemeToggle;
 exports.TopBar = TopBar;
 exports.buttonClass = buttonClass;