@simple-auth-kit/cli 1.5.0 → 1.6.1

package/registry/combos/express-drizzle/variants/workspaces/src/openapi-workspace.ts

@@ -6,7 +6,7 @@ import {
   missingPermission,
   requiresPermission,
   type OpenApiFragment,
-} from "./openapi-fragment.js";
+} from "./openapi/openapi-fragment.js";
 import { WORKSPACE_HEADER } from "./middleware/authz.middleware.js";
 
 /** Every route that acts *inside* a workspace names it with this header, never a path segment. */

package/registry/combos/express-drizzle/variants/workspaces/src/rbac.defaults.ts

@@ -29,7 +29,7 @@
 // same transaction that creates it, so its creator is never locked out of a workspace they just
 // made).
 import { and, eq, inArray } from "drizzle-orm";
-import type { Database } from "./db.js";
+import type { Database } from "./config/db.js";
 import { permissionRole, permissions, roles } from "./schema.js";
 
 /** The display metadata a seeded permission carries. `group`/`order` exist so an admin console can render a stable matrix. */
@@ -55,11 +55,22 @@ export interface PermissionSeed {
  * evaluate.
  */
 export const PERMISSION_CATALOG = {
-  "users:read": { displayName: "List members", description: "GET /auth/admin/users", group: "Users", order: 1 },
-  "users:block": { displayName: "Block and unblock members", description: "POST /auth/admin/users/:userId/block, .../unblock", group: "Users", order: 2 },
+  "users:read": {
+    displayName: "List members",
+    description: "GET /auth/admin/users",
+    group: "Users",
+    order: 1,
+  },
+  "users:block": {
+    displayName: "Block and unblock members",
+    description: "POST /auth/admin/users/:userId/block, .../unblock",
+    group: "Users",
+    order: 2,
+  },
   "users:manage": {
     displayName: "Edit and delete members",
-    description: "Edit a member's profile or delete their account — PATCH /auth/admin/users/:userId, DELETE /auth/admin/users/:userId",
+    description:
+      "Edit a member's profile or delete their account — PATCH /auth/admin/users/:userId, DELETE /auth/admin/users/:userId",
     group: "Users",
     order: 3,
   },
@@ -72,30 +83,44 @@ export const PERMISSION_CATALOG = {
   },
   "roles:assign": {
     displayName: "Assign roles",
-    description: "Assign and revoke a member's roles — POST /auth/admin/users/:userId/roles, .../roles/:roleSlug/revoke, PUT /workspaces/members/:memberId/roles",
+    description:
+      "Assign and revoke a member's roles — POST /auth/admin/users/:userId/roles, .../roles/:roleSlug/revoke, PUT /workspaces/members/:memberId/roles",
     group: "Roles",
     order: 2,
   },
-  "permissions:read": { displayName: "Read the permission catalog", description: "GET /auth/admin/permissions", group: "Permissions", order: 1 },
+  "permissions:read": {
+    displayName: "Read the permission catalog",
+    description: "GET /auth/admin/permissions",
+    group: "Permissions",
+    order: 1,
+  },
   "permissions:define": {
     displayName: "Define permissions",
-    description: "Create a permission, rename it, or deactivate it — POST /auth/admin/permissions. The authority that defines all the others.",
+    description:
+      "Create a permission, rename it, or deactivate it — POST /auth/admin/permissions. The authority that defines all the others.",
     group: "Permissions",
     order: 2,
   },
   "permissions:grant": {
     displayName: "Grant permissions directly",
-    description: "Grant and revoke a permission straight to a member, bypassing roles — POST /auth/admin/users/:userId/permissions, .../permissions/:slug/revoke",
+    description:
+      "Grant and revoke a permission straight to a member, bypassing roles — POST /auth/admin/users/:userId/permissions, .../permissions/:slug/revoke",
     group: "Permissions",
     order: 3,
   },
   "members:manage": {
     displayName: "Add and remove members",
-    description: "POST /workspaces/members, DELETE /workspaces/members/:memberId",
+    description:
+      "POST /workspaces/members, DELETE /workspaces/members/:memberId",
     group: "Members",
     order: 1,
   },
-  "audit-log:read": { displayName: "Read the audit log", description: "GET /auth/admin/audit-log", group: "Audit", order: 1 },
+  "audit-log:read": {
+    displayName: "Read the audit log",
+    description: "GET /auth/admin/audit-log",
+    group: "Audit",
+    order: 1,
+  },
 } as const satisfies Record<string, PermissionSeed>;
 
 /**
@@ -107,10 +132,14 @@ export const PERMISSION_CATALOG = {
  */
 export type PermissionSlug = keyof typeof PERMISSION_CATALOG;
 
-export const PERMISSION_SLUGS = Object.keys(PERMISSION_CATALOG) as PermissionSlug[];
+export const PERMISSION_SLUGS = Object.keys(
+  PERMISSION_CATALOG,
+) as PermissionSlug[];
 
 /** Groups, in the order an admin console should render them. Derived from the catalog so it cannot drift from it. */
-export const PERMISSION_GROUP_ORDER: string[] = [...new Set(PERMISSION_SLUGS.map((slug) => PERMISSION_CATALOG[slug].group))];
+export const PERMISSION_GROUP_ORDER: string[] = [
+  ...new Set(PERMISSION_SLUGS.map((slug) => PERMISSION_CATALOG[slug].group)),
+];
 
 /** The display metadata a seeded role carries, plus what it starts out granting. */
 export interface RoleSeed {
@@ -146,7 +175,8 @@ export const DEFAULT_ROLES: readonly RoleSeed[] = [
   {
     slug: "superadmin",
     displayName: "Super Admin",
-    description: "Carries every permission in the catalog — same authority as admin, held by the seeded super_admin account's membership (see SEED_SUPERADMIN_* in seed.ts).",
+    description:
+      "Carries every permission in the catalog — same authority as admin, held by the seeded super_admin account's membership (see SEED_SUPERADMIN_* in seed.ts).",
     isDefault: false,
     order: 1,
     permissions: PERMISSION_SLUGS,
@@ -154,7 +184,8 @@ export const DEFAULT_ROLES: readonly RoleSeed[] = [
   {
     slug: "member",
     displayName: "Member",
-    description: "The default for a new membership. Carries no administrative permission.",
+    description:
+      "The default for a new membership. Carries no administrative permission.",
     isDefault: true,
     order: 2,
     permissions: [],
@@ -191,7 +222,10 @@ export type RbacWriter = Pick<Database, "insert" | "select">;
  */
 // Takes bigint directly: both callers (`WorkspaceRepository.create`, `seed.ts`) already have the
 // workspace row's id in hand from their own database call.
-export async function provisionDefaultRoles(db: RbacWriter, workspaceId: bigint): Promise<void> {
+export async function provisionDefaultRoles(
+  db: RbacWriter,
+  workspaceId: bigint,
+): Promise<void> {
   // Insert-then-read rather than `.returning()`: ON CONFLICT DO NOTHING returns no row for the
   // slugs that already existed, and the ids of *those* are exactly the ones a re-run needs.
   await db
@@ -203,12 +237,17 @@ export async function provisionDefaultRoles(db: RbacWriter, workspaceId: bigint)
         displayName: PERMISSION_CATALOG[slug].displayName,
         description: PERMISSION_CATALOG[slug].description,
         group: PERMISSION_CATALOG[slug].group,
-        groupOrder: PERMISSION_GROUP_ORDER.indexOf(PERMISSION_CATALOG[slug].group),
+        groupOrder: PERMISSION_GROUP_ORDER.indexOf(
+          PERMISSION_CATALOG[slug].group,
+        ),
         order: PERMISSION_CATALOG[slug].order,
       })),
     )
     .onConflictDoNothing({ target: permissions.slug });
-  const permissionRows = await db.select({ id: permissions.id, slug: permissions.slug }).from(permissions).where(inArray(permissions.slug, PERMISSION_SLUGS));
+  const permissionRows = await db
+    .select({ id: permissions.id, slug: permissions.slug })
+    .from(permissions)
+    .where(inArray(permissions.slug, PERMISSION_SLUGS));
   const permissionId = new Map(permissionRows.map((p) => [p.slug, p.id]));
 
   await db
@@ -240,9 +279,17 @@ export async function provisionDefaultRoles(db: RbacWriter, workspaceId: bigint)
   const seedBySlug = new Map(DEFAULT_ROLES.map((role) => [role.slug, role]));
 
   const pairs = roleRows.flatMap((role) =>
-    (seedBySlug.get(role.slug)?.permissions ?? []).map((slug) => ({ roleId: role.id, permissionId: permissionId.get(slug)! })),
+    (seedBySlug.get(role.slug)?.permissions ?? []).map((slug) => ({
+      roleId: role.id,
+      permissionId: permissionId.get(slug)!,
+    })),
   );
   if (pairs.length) {
-    await db.insert(permissionRole).values(pairs).onConflictDoNothing({ target: [permissionRole.permissionId, permissionRole.roleId] });
+    await db
+      .insert(permissionRole)
+      .values(pairs)
+      .onConflictDoNothing({
+        target: [permissionRole.permissionId, permissionRole.roleId],
+      });
   }
 }

package/registry/combos/express-drizzle/variants/workspaces/src/repositories/audit-log.repository.ts

@@ -6,9 +6,9 @@ import {
   normalizeLimit,
   normalizePage,
   type Paginated,
-} from "../pagination.js";
+} from "../helpers/pagination.js";
 import * as schema from "../schema.js";
-import { toIdOrNull, toIdOrUndefined } from "../id.helper.js";
+import { toIdOrNull, toIdOrUndefined } from "../helpers/id.helper.js";
 
 export interface AuditLogEntry {
   id: string;

package/registry/combos/express-drizzle/variants/workspaces/src/repositories/rbac.repository.ts

@@ -10,14 +10,14 @@ import {
 } from "drizzle-orm";
 import { resolvePermissions } from "@/lib/auth/core/rbac.js";
 import type { AuthzContext } from "../middleware/authz.middleware.js";
-import type { Database } from "../db.js";
+import type { Database } from "../config/db.js";
 import {
   buildPageMeta,
   normalizeLimit,
   normalizePage,
   type Paginated,
-} from "../pagination.js";
-import { PermissionCache } from "../permission-cache.js";
+} from "../helpers/pagination.js";
+import { PermissionCache } from "../cache/permission-cache.js";
 import {
   permissionMember,
   permissionRole,
@@ -27,8 +27,8 @@ import {
   users,
   workspaceMembers,
 } from "../schema.js";
-import { HttpError } from "../http-error.js";
-import { toId, toIdOrNull } from "../id.helper.js";
+import { HttpError } from "../errors/http-error.js";
+import { toId, toIdOrNull } from "../helpers/id.helper.js";
 
 /**
  * Every column the `users` table has (plus the membership's own `memberId`/`createdAt`), except

package/registry/combos/express-drizzle/variants/workspaces/src/repositories/workspace.repository.ts

@@ -1,5 +1,5 @@
 import { and, asc, eq, inArray } from "drizzle-orm";
-import type { Database } from "../db.js";
+import type { Database } from "../config/db.js";
 import {
   provisionDefaultRoles,
   WORKSPACE_CREATOR_ROLES,
@@ -12,8 +12,8 @@ import {
   workspaceMembers,
   workspaces,
 } from "../schema.js";
-import { HttpError } from "../http-error.js";
-import { toId } from "../id.helper.js";
+import { HttpError } from "../errors/http-error.js";
+import { toId } from "../helpers/id.helper.js";
 
 export interface WorkspaceSummary {
   id: string;
@@ -71,14 +71,12 @@ export class WorkspaceRepository {
         .values({ workspaceId: created.id, userId: userIdBig })
         .returning({ id: workspaceMembers.id });
       if (creatorRoles.length) {
-        await tx
-          .insert(roleMember)
-          .values(
-            creatorRoles.map((role) => ({
-              memberId: member.id,
-              roleId: role.id,
-            })),
-          );
+        await tx.insert(roleMember).values(
+          creatorRoles.map((role) => ({
+            memberId: member.id,
+            roleId: role.id,
+          })),
+        );
       }
       return created;
     });

package/registry/combos/express-drizzle/variants/workspaces/src/routers/admin.router.ts

@@ -1,7 +1,7 @@
 import type { NextFunction, Request, RequestHandler, Response } from "express";
 import { hashPassword } from "@/lib/auth/core/crypto.js";
 import { AuthService } from "../services/auth.service.js";
-import { HttpError } from "../http-error.js";
+import { HttpError } from "../errors/http-error.js";
 import { ability, createTieredRouter } from "../route-tiers.js";
 import { WorkspaceRepository } from "../repositories/workspace.repository.js";
 import "../request-context.js";
@@ -65,15 +65,13 @@ export function createAdminRouter(deps: AdminRouterDeps): RequestHandler {
           string,
           string | undefined
         >;
-        res
-          .status(200)
-          .json(
-            await auth.listUsers(req.authz!, {
-              search,
-              page: page ? Number(page) : undefined,
-              limit: limit ? Number(limit) : undefined,
-            }),
-          );
+        res.status(200).json(
+          await auth.listUsers(req.authz!, {
+            search,
+            page: page ? Number(page) : undefined,
+            limit: limit ? Number(limit) : undefined,
+          }),
+        );
       } catch (err) {
         next(err);
       }
@@ -200,18 +198,16 @@ export function createAdminRouter(deps: AdminRouterDeps): RequestHandler {
       try {
         const { userId, action, since, until, page, limit } =
           req.query as Record<string, string | undefined>;
-        res
-          .status(200)
-          .json(
-            await auth.listAuditLog(req.authz!, {
-              userId,
-              action,
-              since,
-              until,
-              page: page ? Number(page) : undefined,
-              limit: limit ? Number(limit) : undefined,
-            }),
-          );
+        res.status(200).json(
+          await auth.listAuditLog(req.authz!, {
+            userId,
+            action,
+            since,
+            until,
+            page: page ? Number(page) : undefined,
+            limit: limit ? Number(limit) : undefined,
+          }),
+        );
       } catch (err) {
         next(err);
       }

package/registry/combos/express-drizzle/variants/workspaces/src/routers/workspace.router.ts

@@ -1,6 +1,6 @@
 import { Router } from "express";
 import type { NextFunction, Request, RequestHandler, Response } from "express";
-import { HttpError } from "../http-error.js";
+import { HttpError } from "../errors/http-error.js";
 import { RbacRepository } from "../repositories/rbac.repository.js";
 import { ability, authenticated, createTieredRouter } from "../route-tiers.js";
 import { WorkspaceRepository } from "../repositories/workspace.repository.js";

package/registry/combos/express-drizzle/variants/workspaces/src/seed.ts

@@ -31,23 +31,46 @@ import { and, asc, eq, inArray, notInArray } from "drizzle-orm";
 import { drizzle } from "drizzle-orm/node-postgres";
 import { Pool } from "pg";
 import { hashPassword } from "@/lib/auth/core/crypto.js";
-import type { Database } from "./db.js";
-import { DEFAULT_ROLES, PERMISSION_SLUGS, SEED_SUPERADMIN_ROLES, WORKSPACE_CREATOR_ROLES, provisionDefaultRoles } from "./rbac.defaults.js";
+import type { Database } from "./config/db.js";
+import {
+  DEFAULT_ROLES,
+  PERMISSION_SLUGS,
+  SEED_SUPERADMIN_ROLES,
+  WORKSPACE_CREATOR_ROLES,
+  provisionDefaultRoles,
+} from "./rbac.defaults.js";
 import * as schema from "./schema.js";
-import { permissions, roleMember, roles, users, workspaceMembers, workspaces } from "./schema.js";
+import {
+  permissions,
+  roleMember,
+  roles,
+  users,
+  workspaceMembers,
+  workspaces,
+} from "./schema.js";
 
 const DEFAULT_WORKSPACE_NAME = "Default workspace";
 
 function requireEnv(name: string): string {
   const value = process.env[name];
-  if (!value) throw new Error(`${name} is not set — the seeder cannot reach the database without it`);
+  if (!value)
+    throw new Error(
+      `${name} is not set — the seeder cannot reach the database without it`,
+    );
   return value;
 }
 
 /** Workspace names are not unique in the schema, so re-running adopts the one it made last time rather than making another. */
-async function seedWorkspace(db: Database): Promise<{ id: bigint; name: string }> {
+async function seedWorkspace(
+  db: Database,
+): Promise<{ id: bigint; name: string }> {
   const name = process.env["SEED_WORKSPACE_NAME"] || DEFAULT_WORKSPACE_NAME;
-  const [existing] = await db.select().from(workspaces).where(eq(workspaces.name, name)).orderBy(asc(workspaces.createdAt)).limit(1);
+  const [existing] = await db
+    .select()
+    .from(workspaces)
+    .where(eq(workspaces.name, name))
+    .orderBy(asc(workspaces.createdAt))
+    .limit(1);
   if (existing) {
     console.log(`workspace: "${name}" already exists (${existing.id})`);
     return existing;
@@ -58,91 +81,201 @@ async function seedWorkspace(db: Database): Promise<{ id: bigint; name: string }
 }
 
 /** The catalog and this workspace's roles come from rbac.defaults.ts; this only reports what it wrote. */
-async function seedRbacDefaults(db: Database, workspaceId: bigint): Promise<void> {
+async function seedRbacDefaults(
+  db: Database,
+  workspaceId: bigint,
+): Promise<void> {
   await provisionDefaultRoles(db, workspaceId);
   console.log(`permissions: ${PERMISSION_SLUGS.length} slug(s) in the catalog`);
-  for (const role of DEFAULT_ROLES) console.log(`role "${role.slug}": ${role.permissions.length} permission(s)${role.isDefault ? " (new-member default)" : ""}`);
+  for (const role of DEFAULT_ROLES)
+    console.log(
+      `role "${role.slug}": ${role.permissions.length} permission(s)${role.isDefault ? " (new-member default)" : ""}`,
+    );
 
   // Slugs that exist in the database but not in this build's catalog. They are not an error —
   // `POST /auth/admin/permissions` exists so a deployment can define its own, and a grant can
   // create one — but a slug no route names grants nothing, so a typo would otherwise be a
   // permission that mysteriously never works. Printing them is what makes it visible.
-  const unknown = await db.select({ slug: permissions.slug }).from(permissions).where(notInArray(permissions.slug, PERMISSION_SLUGS));
-  if (unknown.length) console.log(`permissions: ${unknown.length} slug(s) outside this build's catalog (no route names them): ${unknown.map((r) => r.slug).join(", ")}`);
-  const inactive = await db.select({ slug: permissions.slug }).from(permissions).where(eq(permissions.isActive, false));
-  if (inactive.length) console.log(`permissions: ${inactive.length} deactivated, granting nothing: ${inactive.map((r) => r.slug).join(", ")}`);
+  const unknown = await db
+    .select({ slug: permissions.slug })
+    .from(permissions)
+    .where(notInArray(permissions.slug, PERMISSION_SLUGS));
+  if (unknown.length)
+    console.log(
+      `permissions: ${unknown.length} slug(s) outside this build's catalog (no route names them): ${unknown.map((r) => r.slug).join(", ")}`,
+    );
+  const inactive = await db
+    .select({ slug: permissions.slug })
+    .from(permissions)
+    .where(eq(permissions.isActive, false));
+  if (inactive.length)
+    console.log(
+      `permissions: ${inactive.length} deactivated, granting nothing: ${inactive.map((r) => r.slug).join(", ")}`,
+    );
 }
 
 /** The user is the authentication principal; the membership below is the authorization one. */
-async function seedAdminUser(db: Database, workspace: { id: bigint; name: string }): Promise<void> {
+async function seedAdminUser(
+  db: Database,
+  workspace: { id: bigint; name: string },
+): Promise<void> {
   const email = process.env["SEED_ADMIN_EMAIL"];
   const password = process.env["SEED_ADMIN_PASSWORD"];
   if (!email || !password) {
-    console.log(`admin: skipped — set SEED_ADMIN_EMAIL and SEED_ADMIN_PASSWORD to create one (there is no default password)`);
-    console.log(`admin: "${workspace.name}" has no members until you re-run with them set`);
+    console.log(
+      `admin: skipped — set SEED_ADMIN_EMAIL and SEED_ADMIN_PASSWORD to create one (there is no default password)`,
+    );
+    console.log(
+      `admin: "${workspace.name}" has no members until you re-run with them set`,
+    );
     return;
   }
 
   // Their password may have been changed since; rewriting it here would silently reset it.
-  const [existing] = await db.select({ id: users.id }).from(users).where(eq(users.email, email)).limit(1);
-  const user = existing ?? (await db.insert(users).values({ email, passwordHash: await hashPassword(password) }).returning({ id: users.id }))[0];
-  console.log(existing ? `admin: ${email} already exists — password left unchanged` : `admin: created ${email}`);
+  const [existing] = await db
+    .select({ id: users.id })
+    .from(users)
+    .where(eq(users.email, email))
+    .limit(1);
+  const user =
+    existing ??
+    (
+      await db
+        .insert(users)
+        .values({ email, passwordHash: await hashPassword(password) })
+        .returning({ id: users.id })
+    )[0];
+  console.log(
+    existing
+      ? `admin: ${email} already exists — password left unchanged`
+      : `admin: created ${email}`,
+  );
 
   const [existingMembership] = await db
     .select({ id: workspaceMembers.id })
     .from(workspaceMembers)
-    .where(and(eq(workspaceMembers.userId, user.id), eq(workspaceMembers.workspaceId, workspace.id)))
+    .where(
+      and(
+        eq(workspaceMembers.userId, user.id),
+        eq(workspaceMembers.workspaceId, workspace.id),
+      ),
+    )
     .limit(1);
   const membership =
-    existingMembership ?? (await db.insert(workspaceMembers).values({ userId: user.id, workspaceId: workspace.id }).returning({ id: workspaceMembers.id }))[0];
+    existingMembership ??
+    (
+      await db
+        .insert(workspaceMembers)
+        .values({ userId: user.id, workspaceId: workspace.id })
+        .returning({ id: workspaceMembers.id })
+    )[0];
 
   const adminRoles = await db
     .select({ id: roles.id, slug: roles.slug })
     .from(roles)
-    .where(and(eq(roles.workspaceId, workspace.id), inArray(roles.slug, WORKSPACE_CREATOR_ROLES)));
+    .where(
+      and(
+        eq(roles.workspaceId, workspace.id),
+        inArray(roles.slug, WORKSPACE_CREATOR_ROLES),
+      ),
+    );
   if (adminRoles.length) {
     await db
       .insert(roleMember)
-      .values(adminRoles.map((role) => ({ memberId: membership.id, roleId: role.id })))
-      .onConflictDoNothing({ target: [roleMember.memberId, roleMember.roleId] });
+      .values(
+        adminRoles.map((role) => ({
+          memberId: membership.id,
+          roleId: role.id,
+        })),
+      )
+      .onConflictDoNothing({
+        target: [roleMember.memberId, roleMember.roleId],
+      });
   }
-  console.log(`admin: member of "${workspace.name}" with roles ${adminRoles.map((r) => r.slug).join(", ")}`);
+  console.log(
+    `admin: member of "${workspace.name}" with roles ${adminRoles.map((r) => r.slug).join(", ")}`,
+  );
 }
 
 /** Same shape as seedAdminUser, for the seeded super_admin account — a distinct account and membership holding the "superadmin" role. */
-async function seedSuperAdminUser(db: Database, workspace: { id: bigint; name: string }): Promise<void> {
+async function seedSuperAdminUser(
+  db: Database,
+  workspace: { id: bigint; name: string },
+): Promise<void> {
   const email = process.env["SEED_SUPERADMIN_EMAIL"];
   const password = process.env["SEED_SUPERADMIN_PASSWORD"];
   if (!email || !password) {
-    console.log(`super admin: skipped — set SEED_SUPERADMIN_EMAIL and SEED_SUPERADMIN_PASSWORD to create one (there is no default password)`);
+    console.log(
+      `super admin: skipped — set SEED_SUPERADMIN_EMAIL and SEED_SUPERADMIN_PASSWORD to create one (there is no default password)`,
+    );
     return;
   }
   const username = process.env["SEED_SUPERADMIN_USERNAME"] || undefined;
 
   // Their password may have been changed since; rewriting it here would silently reset it.
-  const [existing] = await db.select({ id: users.id }).from(users).where(eq(users.email, email)).limit(1);
-  const user = existing ?? (await db.insert(users).values({ email, username, passwordHash: await hashPassword(password) }).returning({ id: users.id }))[0];
-  console.log(existing ? `super admin: ${email} already exists — password left unchanged` : `super admin: created ${email}${username ? ` (username ${username})` : ""}`);
+  const [existing] = await db
+    .select({ id: users.id })
+    .from(users)
+    .where(eq(users.email, email))
+    .limit(1);
+  const user =
+    existing ??
+    (
+      await db
+        .insert(users)
+        .values({ email, username, passwordHash: await hashPassword(password) })
+        .returning({ id: users.id })
+    )[0];
+  console.log(
+    existing
+      ? `super admin: ${email} already exists — password left unchanged`
+      : `super admin: created ${email}${username ? ` (username ${username})` : ""}`,
+  );
 
   const [existingMembership] = await db
     .select({ id: workspaceMembers.id })
     .from(workspaceMembers)
-    .where(and(eq(workspaceMembers.userId, user.id), eq(workspaceMembers.workspaceId, workspace.id)))
+    .where(
+      and(
+        eq(workspaceMembers.userId, user.id),
+        eq(workspaceMembers.workspaceId, workspace.id),
+      ),
+    )
     .limit(1);
   const membership =
-    existingMembership ?? (await db.insert(workspaceMembers).values({ userId: user.id, workspaceId: workspace.id }).returning({ id: workspaceMembers.id }))[0];
+    existingMembership ??
+    (
+      await db
+        .insert(workspaceMembers)
+        .values({ userId: user.id, workspaceId: workspace.id })
+        .returning({ id: workspaceMembers.id })
+    )[0];
 
   const superAdminRoles = await db
     .select({ id: roles.id, slug: roles.slug })
     .from(roles)
-    .where(and(eq(roles.workspaceId, workspace.id), inArray(roles.slug, SEED_SUPERADMIN_ROLES)));
+    .where(
+      and(
+        eq(roles.workspaceId, workspace.id),
+        inArray(roles.slug, SEED_SUPERADMIN_ROLES),
+      ),
+    );
   if (superAdminRoles.length) {
     await db
       .insert(roleMember)
-      .values(superAdminRoles.map((role) => ({ memberId: membership.id, roleId: role.id })))
-      .onConflictDoNothing({ target: [roleMember.memberId, roleMember.roleId] });
+      .values(
+        superAdminRoles.map((role) => ({
+          memberId: membership.id,
+          roleId: role.id,
+        })),
+      )
+      .onConflictDoNothing({
+        target: [roleMember.memberId, roleMember.roleId],
+      });
   }
-  console.log(`super admin: member of "${workspace.name}" with roles ${superAdminRoles.map((r) => r.slug).join(", ")}`);
+  console.log(
+    `super admin: member of "${workspace.name}" with roles ${superAdminRoles.map((r) => r.slug).join(", ")}`,
+  );
 }
 
 async function main(): Promise<void> {

package/registry/combos/express-drizzle/variants/workspaces/src/services/auth.service.ts

@@ -42,17 +42,17 @@ import {
   generateTotpSecret,
   verifyTotpCode,
 } from "@/lib/auth/core/two-factor.js";
-import type { AuthConfig } from "../auth.config.js";
-import { HttpError } from "../http-error.js";
+import type { AuthConfig } from "../config/auth.config.js";
+import { HttpError } from "../errors/http-error.js";
 import {
   AuditLogEntry,
   AuditLogListFilter,
   AuditLogRepository,
   toAuditLogEntry,
 } from "../repositories/audit-log.repository.js";
-import type { Paginated } from "../pagination.js";
-import type { Database } from "../db.js";
-import { KeyProviderService } from "../key-provider.js";
+import type { Paginated } from "../helpers/pagination.js";
+import type { Database } from "../config/db.js";
+import { KeyProviderService } from "../config/key-provider.js";
 import { OAuthRepository } from "../repositories/oauth.repository.js";
 import { PasswordResetRepository } from "../repositories/password-reset.repository.js";
 import type { Revoker } from "@/lib/auth/core/types.js";
@@ -70,7 +70,7 @@ import {
 import { sessions, users } from "../schema.js";
 import { SessionRepository } from "../repositories/session.repository.js";
 import { TwoFactorRepository } from "../repositories/two-factor.repository.js";
-import { toId, toIdOrNull } from "../id.helper.js";
+import { toId, toIdOrNull } from "../helpers/id.helper.js";
 
 export interface AuthTokens {
   accessToken: string;
@@ -470,9 +470,7 @@ export class AuthService {
     return { twoFactorEnabled: user.twoFactorEnabled };
   }
 
-  async listActiveSessions(
-    userId: string,
-  ): Promise<
+  async listActiveSessions(userId: string): Promise<
     Array<{
       id: string;
       createdAt: string;