@storyshelf/auth 0.5.3

package/dist/groups.mjs

@@ -0,0 +1,129 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { MemberModel, ProjectGroupMappingModel, ProjectModel, UserModel } from "@storyshelf/core/models";
+//#region src/groups.ts
+/** Default claim name when recipes leave `groups.claim` unset. */
+const DEFAULT_GROUP_CLAIM = "groups";
+/** Rank for top-match resolution (highest role wins). */
+const ROLE_RANK = {
+	viewer: 0,
+	developer: 1,
+	approver: 2,
+	admin: 3
+};
+/** Collect group names from one claim value. */
+function claimGroups(value, into) {
+	if (typeof value === "string" && value) into.push(value);
+	else if (Array.isArray(value)) {
+		for (const entry of value) if (typeof entry === "string" && entry) into.push(entry);
+	}
+}
+/**
+* Read group names from provider userInfo. Arrays pass through; a lone
+* string counts as exactly one group (never whitespace-split — real names
+* contain spaces). Non-string entries are ignored. First claim hit wins
+* across names; results de-duplicated.
+*/
+function extractGroups(userInfo, claim) {
+	const names = claim === void 0 ? [DEFAULT_GROUP_CLAIM] : Array.isArray(claim) ? claim : [claim];
+	for (const name of names) {
+		const found = [];
+		claimGroups(userInfo[name], found);
+		if (found.length > 0) return [...new Set(found)];
+	}
+	return [];
+}
+/**
+* Site role from admin-group intersection (full reconcile). Without
+* configured admins the current role passes through untouched.
+*/
+function resolveSiteRole(current, groups, admins = []) {
+	if (admins.length === 0) return current;
+	return groups.some((group) => admins.includes(group)) ? "admin" : "member";
+}
+/**
+* Build the plugin `provisionUser` hook bound to shelf providers.
+* Unknown provider ids are no-ops (defensive; the plugin resolves first).
+*/
+function provisionHook(db, providers) {
+	return async (data) => {
+		await syncSsoGroups(db, providers, {
+			userId: data.user.id,
+			email: data.user.email,
+			name: data.user.name,
+			userInfo: data.userInfo,
+			providerId: data.provider.providerId
+		});
+	};
+}
+/** Highest-ranked mapping matched by the groups, or null. */
+function topMatch(rows, groups) {
+	let top = null;
+	for (const row of rows) {
+		if (!groups.includes(row.groupName)) continue;
+		if (!top || ROLE_RANK[row.role] > ROLE_RANK[top.role]) top = {
+			groupName: row.groupName,
+			role: row.role
+		};
+	}
+	return top;
+}
+/** Reconcile one project's memberships against the groups. */
+async function syncProjectGroups(members, mappings, projectId, userId, groups) {
+	const rows = await mappings.list(projectId);
+	if (rows.length === 0) return;
+	if ((await members.get(projectId, userId))?.source === "manual") return;
+	await applyProjectTop(members, projectId, userId, topMatch(rows, groups));
+}
+/** Apply the top match (or revoke stale) for one project. */
+async function applyProjectTop(members, projectId, userId, top) {
+	if (!top) {
+		await revokeStale(members, projectId, userId);
+		return;
+	}
+	const current = await members.get(projectId, userId);
+	if (!current || current.role !== top.role || current.source !== `sso:${top.groupName}`) await members.set(projectId, userId, top.role, `sso:${top.groupName}`);
+}
+/** Remove a stale synced grant (manual grants already excluded by the caller). */
+async function revokeStale(members, projectId, userId) {
+	if (await members.get(projectId, userId)) await members.remove(projectId, userId);
+}
+/** Apply the reconciled site role (upsert first-timers, update on change). */
+async function syncSiteRole(db, input, role) {
+	const users = new UserModel(db);
+	const stored = await users.get(input.userId);
+	if (!stored) await users.upsert({
+		id: input.userId,
+		email: input.email,
+		name: input.name,
+		avatarUrl: null,
+		role
+	});
+	else if (stored.role !== role) await db.update(db.tables.users, stored.id, { role });
+}
+/** Reconcile project memberships across every project. */
+async function syncProjectRoles(db, userId, groups) {
+	const members = new MemberModel(db);
+	const mappings = new ProjectGroupMappingModel(db);
+	const projects = await new ProjectModel(db).list();
+	await Promise.all(projects.map(async (project) => {
+		await syncProjectGroups(members, mappings, project.id, userId, groups);
+	}));
+}
+/**
+* Sync IdP groups into shelf state: site role (full reconcile) plus project
+* memberships. No-op for providers without `groups` config. Creates the
+* shelf row on first SSO login when the mirror hook has not run yet.
+*/
+async function syncSsoGroups(db, providers, input) {
+	const sync = providers.find((entry) => entry.id === input.providerId)?.groups;
+	if (!sync) return;
+	const groups = extractGroups(input.userInfo, sync.claim);
+	await syncSiteRole(db, input, resolveSiteRole((await new UserModel(db).get(input.userId))?.role ?? "member", groups, sync.admins));
+	await syncProjectRoles(db, input.userId, groups);
+}
+//#endregion
+export { DEFAULT_GROUP_CLAIM, extractGroups, provisionHook, resolveSiteRole, syncSsoGroups };
+
+//# sourceMappingURL=groups.mjs.map

package/dist/groups.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"groups.mjs","names":[],"sources":["../src/groups.ts"],"sourcesContent":["/**\n * IdP group sync for SSO providers (site role + project memberships).\n *\n * The SSO plugin calls the hook with raw provider `userInfo` on every\n * sign-in (`provisionUserOnEveryLogin`); this module turns group claims into\n * shelf state. Semantics mirror the app-side login sync: exact group names\n * (no wildcards), highest-ranked project role wins recorded as `sso:<group>`,\n * stale non-manual grants revoked, manual grants never touched. Social and\n * generic-OAuth logins have no per-login hook and never sync groups.\n */\nimport type { DatabaseAdapter } from \"@storyshelf/core/adapter/database\";\nimport {\n  MemberModel,\n  ProjectGroupMappingModel,\n  ProjectModel,\n  UserModel,\n} from \"@storyshelf/core/models\";\nimport type { ProjectRole, SiteRole } from \"@storyshelf/core/types\";\nimport type { ShelfSSOProvider } from \"./engine.ts\";\n\n/** Default claim name when recipes leave `groups.claim` unset. */\nexport const DEFAULT_GROUP_CLAIM = \"groups\";\n\n/** Rank for top-match resolution (highest role wins). */\nconst ROLE_RANK: Record<ProjectRole, number> = { viewer: 0, developer: 1, approver: 2, admin: 3 };\n\n/** Collect group names from one claim value. */\nfunction claimGroups(value: unknown, into: string[]): void {\n  if (typeof value === \"string\" && value) {\n    into.push(value);\n  } else if (Array.isArray(value)) {\n    for (const entry of value) {\n      if (typeof entry === \"string\" && entry) {\n        into.push(entry);\n      }\n    }\n  }\n}\n\n/**\n * Read group names from provider userInfo. Arrays pass through; a lone\n * string counts as exactly one group (never whitespace-split — real names\n * contain spaces). Non-string entries are ignored. First claim hit wins\n * across names; results de-duplicated.\n */\nexport function extractGroups(\n  userInfo: Record<string, unknown>,\n  claim?: string | string[],\n): string[] {\n  const names =\n    claim === undefined ? [DEFAULT_GROUP_CLAIM] : Array.isArray(claim) ? claim : [claim];\n  for (const name of names) {\n    const found: string[] = [];\n    claimGroups(userInfo[name], found);\n    if (found.length > 0) {\n      return [...new Set(found)];\n    }\n  }\n  return [];\n}\n\n/**\n * Site role from admin-group intersection (full reconcile). Without\n * configured admins the current role passes through untouched.\n */\nexport function resolveSiteRole(\n  current: SiteRole,\n  groups: string[],\n  admins: string[] = [],\n): SiteRole {\n  if (admins.length === 0) {\n    return current;\n  }\n  return groups.some((group) => admins.includes(group)) ? \"admin\" : \"member\";\n}\n\n/** Input mapped from the SSO plugin's provisionUser payload. */\nexport interface GroupProvisionData {\n  user: { id: string; email: string; name: string };\n  userInfo: Record<string, unknown>;\n  provider: { providerId: string };\n}\n\n/** Normalized input for the sync (plugin payload flattened). */\nexport interface SsoGroupSyncInput {\n  userId: string;\n  email: string;\n  name: string;\n  userInfo: Record<string, unknown>;\n  providerId: string;\n}\n\n/**\n * Build the plugin `provisionUser` hook bound to shelf providers.\n * Unknown provider ids are no-ops (defensive; the plugin resolves first).\n */\nexport function provisionHook(\n  db: DatabaseAdapter,\n  providers: ShelfSSOProvider[],\n): (data: GroupProvisionData) => Promise<void> {\n  return async (data) => {\n    await syncSsoGroups(db, providers, {\n      userId: data.user.id,\n      email: data.user.email,\n      name: data.user.name,\n      userInfo: data.userInfo,\n      providerId: data.provider.providerId,\n    });\n  };\n}\n\n/** Highest-ranked mapping matched by the groups, or null. */\nfunction topMatch(\n  rows: { groupName: string; role: ProjectRole }[],\n  groups: string[],\n): { groupName: string; role: ProjectRole } | null {\n  let top: { groupName: string; role: ProjectRole } | null = null;\n  for (const row of rows) {\n    if (!groups.includes(row.groupName)) {\n      continue;\n    }\n    if (!top || ROLE_RANK[row.role] > ROLE_RANK[top.role]) {\n      top = { groupName: row.groupName, role: row.role };\n    }\n  }\n  return top;\n}\n\n/** Reconcile one project's memberships against the groups. */\nasync function syncProjectGroups(\n  members: MemberModel,\n  mappings: ProjectGroupMappingModel,\n  projectId: string,\n  userId: string,\n  groups: string[],\n): Promise<void> {\n  const rows = await mappings.list(projectId);\n  if (rows.length === 0) {\n    return;\n  }\n  const existing = await members.get(projectId, userId);\n  // Manual grants win over IdP mappings, always.\n  if (existing?.source === \"manual\") {\n    return;\n  }\n  await applyProjectTop(members, projectId, userId, topMatch(rows, groups));\n}\n\n/** Apply the top match (or revoke stale) for one project. */\nasync function applyProjectTop(\n  members: MemberModel,\n  projectId: string,\n  userId: string,\n  top: { groupName: string; role: ProjectRole } | null,\n): Promise<void> {\n  if (!top) {\n    await revokeStale(members, projectId, userId);\n    return;\n  }\n  const current = await members.get(projectId, userId);\n  if (!current || current.role !== top.role || current.source !== `sso:${top.groupName}`) {\n    await members.set(projectId, userId, top.role, `sso:${top.groupName}`);\n  }\n}\n\n/** Remove a stale synced grant (manual grants already excluded by the caller). */\nasync function revokeStale(members: MemberModel, projectId: string, userId: string): Promise<void> {\n  const existing = await members.get(projectId, userId);\n  if (existing) {\n    await members.remove(projectId, userId);\n  }\n}\n\n/** Apply the reconciled site role (upsert first-timers, update on change). */\nasync function syncSiteRole(\n  db: DatabaseAdapter,\n  input: SsoGroupSyncInput,\n  role: SiteRole,\n): Promise<void> {\n  const users = new UserModel(db);\n  const stored = await users.get(input.userId);\n  if (!stored) {\n    await users.upsert({\n      id: input.userId,\n      email: input.email,\n      name: input.name,\n      avatarUrl: null,\n      role,\n    });\n  } else if (stored.role !== role) {\n    await db.update(db.tables.users, stored.id, { role });\n  }\n}\n\n/** Reconcile project memberships across every project. */\nasync function syncProjectRoles(\n  db: DatabaseAdapter,\n  userId: string,\n  groups: string[],\n): Promise<void> {\n  const members = new MemberModel(db);\n  const mappings = new ProjectGroupMappingModel(db);\n  const projects = await new ProjectModel(db).list();\n  await Promise.all(\n    projects.map(async (project) => {\n      await syncProjectGroups(members, mappings, project.id, userId, groups);\n    }),\n  );\n}\n\n/**\n * Sync IdP groups into shelf state: site role (full reconcile) plus project\n * memberships. No-op for providers without `groups` config. Creates the\n * shelf row on first SSO login when the mirror hook has not run yet.\n */\nexport async function syncSsoGroups(\n  db: DatabaseAdapter,\n  providers: ShelfSSOProvider[],\n  input: SsoGroupSyncInput,\n): Promise<void> {\n  const provider = providers.find((entry) => entry.id === input.providerId);\n  const sync = provider?.groups;\n  if (!sync) {\n    return;\n  }\n  const groups = extractGroups(input.userInfo, sync.claim);\n  const stored = await new UserModel(db).get(input.userId);\n  const role = resolveSiteRole(stored?.role ?? \"member\", groups, sync.admins);\n  await syncSiteRole(db, input, role);\n  await syncProjectRoles(db, input.userId, groups);\n}\n"],"mappings":";;;;;;AAqBA,MAAa,sBAAsB;;AAGnC,MAAM,YAAyC;CAAE,QAAQ;CAAG,WAAW;CAAG,UAAU;CAAG,OAAO;AAAE;;AAGhG,SAAS,YAAY,OAAgB,MAAsB;CACzD,IAAI,OAAO,UAAU,YAAY,OAC/B,KAAK,KAAK,KAAK;MACV,IAAI,MAAM,QAAQ,KAAK,GACvB;OAAA,MAAM,SAAS,OAClB,IAAI,OAAO,UAAU,YAAY,OAC/B,KAAK,KAAK,KAAK;CAAA;AAIvB;;;;;;;AAQA,SAAgB,cACd,UACA,OACU;CACV,MAAM,QACJ,UAAU,KAAA,IAAY,CAAC,mBAAmB,IAAI,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC,KAAK;CACrF,KAAK,MAAM,QAAQ,OAAO;EACxB,MAAM,QAAkB,CAAC;EACzB,YAAY,SAAS,OAAO,KAAK;EACjC,IAAI,MAAM,SAAS,GACjB,OAAO,CAAC,GAAG,IAAI,IAAI,KAAK,CAAC;CAE7B;CACA,OAAO,CAAC;AACV;;;;;AAMA,SAAgB,gBACd,SACA,QACA,SAAmB,CAAC,GACV;CACV,IAAI,OAAO,WAAW,GACpB,OAAO;CAET,OAAO,OAAO,MAAM,UAAU,OAAO,SAAS,KAAK,CAAC,IAAI,UAAU;AACpE;;;;;AAsBA,SAAgB,cACd,IACA,WAC6C;CAC7C,OAAO,OAAO,SAAS;EACrB,MAAM,cAAc,IAAI,WAAW;GACjC,QAAQ,KAAK,KAAK;GAClB,OAAO,KAAK,KAAK;GACjB,MAAM,KAAK,KAAK;GAChB,UAAU,KAAK;GACf,YAAY,KAAK,SAAS;EAC5B,CAAC;CACH;AACF;;AAGA,SAAS,SACP,MACA,QACiD;CACjD,IAAI,MAAuD;CAC3D,KAAK,MAAM,OAAO,MAAM;EACtB,IAAI,CAAC,OAAO,SAAS,IAAI,SAAS,GAChC;EAEF,IAAI,CAAC,OAAO,UAAU,IAAI,QAAQ,UAAU,IAAI,OAC9C,MAAM;GAAE,WAAW,IAAI;GAAW,MAAM,IAAI;EAAK;CAErD;CACA,OAAO;AACT;;AAGA,eAAe,kBACb,SACA,UACA,WACA,QACA,QACe;CACf,MAAM,OAAO,MAAM,SAAS,KAAK,SAAS;CAC1C,IAAI,KAAK,WAAW,GAClB;CAIF,KAAI,MAFmB,QAAQ,IAAI,WAAW,MAAM,EAAA,EAEtC,WAAW,UACvB;CAEF,MAAM,gBAAgB,SAAS,WAAW,QAAQ,SAAS,MAAM,MAAM,CAAC;AAC1E;;AAGA,eAAe,gBACb,SACA,WACA,QACA,KACe;CACf,IAAI,CAAC,KAAK;EACR,MAAM,YAAY,SAAS,WAAW,MAAM;EAC5C;CACF;CACA,MAAM,UAAU,MAAM,QAAQ,IAAI,WAAW,MAAM;CACnD,IAAI,CAAC,WAAW,QAAQ,SAAS,IAAI,QAAQ,QAAQ,WAAW,OAAO,IAAI,aACzE,MAAM,QAAQ,IAAI,WAAW,QAAQ,IAAI,MAAM,OAAO,IAAI,WAAW;AAEzE;;AAGA,eAAe,YAAY,SAAsB,WAAmB,QAA+B;CAEjG,IAAI,MADmB,QAAQ,IAAI,WAAW,MAAM,GAElD,MAAM,QAAQ,OAAO,WAAW,MAAM;AAE1C;;AAGA,eAAe,aACb,IACA,OACA,MACe;CACf,MAAM,QAAQ,IAAI,UAAU,EAAE;CAC9B,MAAM,SAAS,MAAM,MAAM,IAAI,MAAM,MAAM;CAC3C,IAAI,CAAC,QACH,MAAM,MAAM,OAAO;EACjB,IAAI,MAAM;EACV,OAAO,MAAM;EACb,MAAM,MAAM;EACZ,WAAW;EACX;CACF,CAAC;MACI,IAAI,OAAO,SAAS,MACzB,MAAM,GAAG,OAAO,GAAG,OAAO,OAAO,OAAO,IAAI,EAAE,KAAK,CAAC;AAExD;;AAGA,eAAe,iBACb,IACA,QACA,QACe;CACf,MAAM,UAAU,IAAI,YAAY,EAAE;CAClC,MAAM,WAAW,IAAI,yBAAyB,EAAE;CAChD,MAAM,WAAW,MAAM,IAAI,aAAa,EAAE,CAAC,CAAC,KAAK;CACjD,MAAM,QAAQ,IACZ,SAAS,IAAI,OAAO,YAAY;EAC9B,MAAM,kBAAkB,SAAS,UAAU,QAAQ,IAAI,QAAQ,MAAM;CACvE,CAAC,CACH;AACF;;;;;;AAOA,eAAsB,cACpB,IACA,WACA,OACe;CAEf,MAAM,OADW,UAAU,MAAM,UAAU,MAAM,OAAO,MAAM,UAC1C,CAAC,EAAE;CACvB,IAAI,CAAC,MACH;CAEF,MAAM,SAAS,cAAc,MAAM,UAAU,KAAK,KAAK;CAGvD,MAAM,aAAa,IAAI,OADV,iBAAgB,MADR,IAAI,UAAU,EAAE,CAAC,CAAC,IAAI,MAAM,MAAM,EAAA,EAClB,QAAQ,UAAU,QAAQ,KAAK,MACnC,CAAC;CAClC,MAAM,iBAAiB,IAAI,MAAM,QAAQ,MAAM;AACjD"}

package/dist/index.d.mts

@@ -0,0 +1,18 @@
+import __tsdown_shims_path from 'node:path';
+import __tsdown_shims_url from 'node:url';
+import { baseAuthDateFields, baseAuthTables } from "./auth-tables.mjs";
+import { authAccountPg, authPasskeyPg, authSessionPg, authSsoProviderPg, authUserPg, authVerificationPg, baseAuthDateFieldsPg, baseAuthTablesPg } from "./auth-tables-pg.mjs";
+import { PasswordAdminInput, ensurePasswordAdmin } from "./bootstrap.mjs";
+import { ENGINE_PROVIDER_ID, EngineSessionUser, ShelfAuth, ShelfAuthInstance, ShelfAuthOptions, ShelfOAuthProvider, ShelfPasskeyOptions, ShelfSSOGroupSync, ShelfSSOOidc, ShelfSSOOptions, ShelfSSOProvider, ShelfSSOSaml, ShelfSocialProvider, createShelfAuth } from "./engine.mjs";
+import { RawShelfAuthOptions, ResolveSecrets, authOptionsSchema, parseEnvRef, resolveAuthOptions } from "./config.mjs";
+import { AuthBridgeSchema, createShelfDbBridge } from "./db-bridge.mjs";
+import { DEFAULT_GROUP_CLAIM, GroupProvisionData, SsoGroupSyncInput, extractGroups, provisionHook, resolveSiteRole, syncSsoGroups } from "./groups.mjs";
+import { AcceptInviteInput, InviteTokenInput, IssueInviteInput, MIN_PASSWORD_LENGTH, acceptInvite, issueInvite, verifyInvite } from "./invites.mjs";
+import { EnterpriseClientOptions, auth0Preset, keycloakPreset, oktaPreset } from "./presets/enterprise.mjs";
+import { SocialClientOptions, cognitoPreset, entraPreset, githubPreset, gitlabPreset, googlePreset } from "./presets/social.mjs";
+import "./presets/index.mjs";
+import { SAMLGroupOptions, SAMLIdPOptions, SSOClientOptions, samlPreset, ssoAuth0Preset, ssoCallbackUrls, ssoEntraPreset, ssoGooglePreset, ssoKeycloakPreset, ssoOktaPreset } from "./presets/sso.mjs";
+import { hasPasswordCredential, listUserPasskeys } from "./passkeys.mjs";
+import { listUserSessions, unsignedToken } from "./sessions.mjs";
+import { Auth, EngineLoginMethod, EngineLoginMethodKind, EnginePasskeyInfo, EngineSessionInfo } from "@storyshelf/core/auth";
+export { type AcceptInviteInput, type Auth, type AuthBridgeSchema, DEFAULT_GROUP_CLAIM, ENGINE_PROVIDER_ID, type EngineLoginMethod, type EngineLoginMethodKind, type EnginePasskeyInfo, type EngineSessionInfo, type EngineSessionUser, type EnterpriseClientOptions, type GroupProvisionData, type InviteTokenInput, type IssueInviteInput, MIN_PASSWORD_LENGTH, type PasswordAdminInput, type RawShelfAuthOptions, type ResolveSecrets, type SAMLGroupOptions, type SAMLIdPOptions, type SSOClientOptions, type ShelfAuth, type ShelfAuthInstance, type ShelfAuthOptions, type ShelfOAuthProvider, type ShelfPasskeyOptions, type ShelfSSOGroupSync, type ShelfSSOOidc, type ShelfSSOOptions, type ShelfSSOProvider, type ShelfSSOSaml, type ShelfSocialProvider, type SocialClientOptions, type SsoGroupSyncInput, acceptInvite, auth0Preset, authAccountPg, authOptionsSchema, authPasskeyPg, authSessionPg, authSsoProviderPg, authUserPg, authVerificationPg, baseAuthDateFields, baseAuthDateFieldsPg, baseAuthTables, baseAuthTablesPg, cognitoPreset, createShelfAuth, createShelfDbBridge, ensurePasswordAdmin, entraPreset, extractGroups, githubPreset, gitlabPreset, googlePreset, hasPasswordCredential, issueInvite, keycloakPreset, listUserPasskeys, listUserSessions, oktaPreset, parseEnvRef, provisionHook, resolveAuthOptions, resolveSiteRole, samlPreset, ssoAuth0Preset, ssoCallbackUrls, ssoEntraPreset, ssoGooglePreset, ssoKeycloakPreset, ssoOktaPreset, syncSsoGroups, unsignedToken, verifyInvite };

package/dist/index.mjs

@@ -0,0 +1,17 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { baseAuthDateFields, baseAuthTables } from "./auth-tables.mjs";
+import { authAccountPg, authPasskeyPg, authSessionPg, authSsoProviderPg, authUserPg, authVerificationPg, baseAuthDateFieldsPg, baseAuthTablesPg } from "./auth-tables-pg.mjs";
+import { MIN_PASSWORD_LENGTH, acceptInvite, issueInvite, verifyInvite } from "./invites.mjs";
+import { ensurePasswordAdmin } from "./bootstrap.mjs";
+import { authOptionsSchema, parseEnvRef, resolveAuthOptions } from "./config.mjs";
+import { createShelfDbBridge } from "./db-bridge.mjs";
+import { DEFAULT_GROUP_CLAIM, extractGroups, provisionHook, resolveSiteRole, syncSsoGroups } from "./groups.mjs";
+import { hasPasswordCredential, listUserPasskeys } from "./passkeys.mjs";
+import { listUserSessions, unsignedToken } from "./sessions.mjs";
+import { ENGINE_PROVIDER_ID, createShelfAuth } from "./engine.mjs";
+import { auth0Preset, keycloakPreset, oktaPreset } from "./presets/enterprise.mjs";
+import { cognitoPreset, entraPreset, githubPreset, gitlabPreset, googlePreset } from "./presets/social.mjs";
+import { samlPreset, ssoAuth0Preset, ssoCallbackUrls, ssoEntraPreset, ssoGooglePreset, ssoKeycloakPreset, ssoOktaPreset } from "./presets/sso.mjs";
+export { DEFAULT_GROUP_CLAIM, ENGINE_PROVIDER_ID, MIN_PASSWORD_LENGTH, acceptInvite, auth0Preset, authAccountPg, authOptionsSchema, authPasskeyPg, authSessionPg, authSsoProviderPg, authUserPg, authVerificationPg, baseAuthDateFields, baseAuthDateFieldsPg, baseAuthTables, baseAuthTablesPg, cognitoPreset, createShelfAuth, createShelfDbBridge, ensurePasswordAdmin, entraPreset, extractGroups, githubPreset, gitlabPreset, googlePreset, hasPasswordCredential, issueInvite, keycloakPreset, listUserPasskeys, listUserSessions, oktaPreset, parseEnvRef, provisionHook, resolveAuthOptions, resolveSiteRole, samlPreset, ssoAuth0Preset, ssoCallbackUrls, ssoEntraPreset, ssoGooglePreset, ssoKeycloakPreset, ssoOktaPreset, syncSsoGroups, unsignedToken, verifyInvite };

package/dist/invites.d.mts

@@ -0,0 +1,41 @@
+import __tsdown_shims_path from 'node:path';
+import __tsdown_shims_url from 'node:url';
+import { Table } from "drizzle-orm";
+import { AuthUser } from "@storyshelf/core/types";
+import { DatabaseAdapter } from "@storyshelf/core/adapter/database";
+//#region src/invites.d.ts
+/** Minimum password length for local accounts (matches legacy policy). */
+declare const MIN_PASSWORD_LENGTH = 12;
+/** Input for {@link issueInvite}. */
+interface IssueInviteInput {
+  email: string;
+  name: string;
+  role: AuthUser["role"];
+  /** Invite lifetime override. Defaults to 7 days. */
+  inviteExpiryMs?: number;
+}
+/** Input for {@link acceptInvite} and {@link verifyInvite}. */
+interface InviteTokenInput {
+  inviteId: string;
+  token: string;
+}
+/** Input for {@link acceptInvite}. */
+interface AcceptInviteInput extends InviteTokenInput {
+  password: string;
+}
+/** Stage a shelf user and mint a single-use invite token (returned once). */
+declare function issueInvite(db: DatabaseAdapter, input: IssueInviteInput): Promise<{
+  inviteId: string;
+  token: string;
+  expiresAt: string;
+}>;
+/** Check an invite token without consuming it (drives the accept page). */
+declare function verifyInvite(db: DatabaseAdapter, input: InviteTokenInput): Promise<{
+  email: string;
+  name: string;
+}>;
+/** Consume an invite: set the engine credential and return the shelf user. */
+declare function acceptInvite(db: DatabaseAdapter, input: AcceptInviteInput): Promise<AuthUser>;
+//#endregion
+export { AcceptInviteInput, InviteTokenInput, IssueInviteInput, MIN_PASSWORD_LENGTH, acceptInvite, issueInvite, verifyInvite };
+//# sourceMappingURL=invites.d.mts.map

package/dist/invites.mjs

@@ -0,0 +1,225 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { baseAuthTables } from "./auth-tables.mjs";
+import { randomToken, sha256, timingSafeEqualString, ulid } from "@storyshelf/core/utils";
+import { eq, getTableColumns, sql } from "drizzle-orm";
+import { hashPassword } from "better-auth/crypto";
+//#region src/invites.ts
+const DEFAULT_INVITE_MS = 6048e5;
+const MAX_INVITE_MS = 31536e6;
+/** Minimum password length for local accounts (matches legacy policy). */
+const MIN_PASSWORD_LENGTH = 12;
+/**
+* Run `fn` inside a transaction. Invites are consume-once state: without
+* driver transactions concurrent accepts race, so transact is required
+* (every production driver offers it) rather than silently sequential.
+*/
+async function withInviteTx(db, fn) {
+	if (!db.transact) throw new Error("Shelf invites require a database with transaction support");
+	return await db.transact(async (tx) => await fn({
+		...tx,
+		tables: db.tables
+	}));
+}
+function normalizeEmail(email) {
+	return email.trim().toLowerCase();
+}
+function isEmail(value) {
+	return /^[^\s@]+@[^\s@]+\.[^\s@]+$/u.test(value);
+}
+function inviteError() {
+	return /* @__PURE__ */ new Error("Invalid or expired invite");
+}
+/** Resolve a shelf/engine table column, failing fast on schema drift. */
+function tableColumn(table, name) {
+	const column = getTableColumns(table)[name];
+	if (!column) throw new Error(`Shelf table is missing column "${name}"`);
+	return column;
+}
+function assertPasswordPolicy(password) {
+	if (password.length < 12) throw new Error("Password must be at least 12 characters");
+}
+async function listShelfUsersByEmail(db, email) {
+	return await db.list(db.tables.users, {
+		where: eq(tableColumn(db.tables.users, "email"), normalizeEmail(email)),
+		limit: 1
+	});
+}
+async function findEngineUserByEmail(db, email) {
+	const column = tableColumn(baseAuthTables.user, "email");
+	return (await db.list(baseAuthTables.user, {
+		where: eq(sql`lower(${column})`, email.toLowerCase()),
+		limit: 1
+	}))[0] ?? null;
+}
+async function findCredentialAccount(db, userId) {
+	return (await db.list(baseAuthTables.account, { where: eq(tableColumn(baseAuthTables.account, "userId"), userId) })).find((row) => row["providerId"] === "credential") ?? null;
+}
+/** Load the invite row, or throw the generic invite error. */
+async function loadInvite(db, input) {
+	const invite = await db.get(db.tables.userInviteTokens, input.inviteId);
+	if (!invite || invite["usedAt"]) throw inviteError();
+	const expires = new Date(String(invite["expiresAt"])).getTime();
+	if (Number.isNaN(expires) || expires <= Date.now()) throw inviteError();
+	if (!timingSafeEqualString(sha256(input.token), String(invite["tokenHash"]))) throw inviteError();
+	return invite;
+}
+/** Load the invite plus its shelf user, or throw the generic invite error. */
+async function assertInviteValid(db, input) {
+	const invite = await loadInvite(db, input);
+	const shelfUser = await db.get(db.tables.users, String(invite["userId"]));
+	if (!shelfUser || shelfUser["disabled"]) throw inviteError();
+	return {
+		invite,
+		shelfUser
+	};
+}
+/** Create the credential account row, or refresh the existing password. */
+async function upsertCredentialAccount(db, userId, password, now) {
+	const hash = await hashPassword(password);
+	const account = await findCredentialAccount(db, userId);
+	if (account) {
+		await db.update(baseAuthTables.account, String(account["id"]), {
+			password: hash,
+			updatedAt: now
+		});
+		return;
+	}
+	await db.insert(baseAuthTables.account, {
+		id: ulid(),
+		userId,
+		accountId: userId,
+		providerId: "credential",
+		password: hash,
+		createdAt: now,
+		updatedAt: now
+	});
+}
+/** Create the engine identity rows (shared id), or refresh the credential. */
+async function ensureEngineIdentity(db, shelfUser, password) {
+	const userId = String(shelfUser["id"]);
+	const email = String(shelfUser["email"]);
+	const now = (/* @__PURE__ */ new Date()).toISOString();
+	const engineUser = await findEngineUserByEmail(db, email);
+	if (engineUser && engineUser["emailVerified"] !== true) throw new Error("Email is registered with an unverified SSO identity; sign in with SSO instead");
+	if (!engineUser) await db.insert(baseAuthTables.user, {
+		id: userId,
+		name: String(shelfUser["name"]),
+		email,
+		emailVerified: true,
+		image: null,
+		createdAt: now,
+		updatedAt: now
+	});
+	await upsertCredentialAccount(db, engineUser ? String(engineUser["id"]) : userId, password, now);
+}
+function toAuthUser(row) {
+	return {
+		id: String(row["id"]),
+		email: String(row["email"]),
+		name: String(row["name"]),
+		avatarUrl: row["avatarUrl"] ?? void 0,
+		role: row["role"]
+	};
+}
+function inviteLifetimeMs(expiryMs) {
+	const lifetime = expiryMs ?? DEFAULT_INVITE_MS;
+	if (!Number.isFinite(lifetime) || lifetime <= 0 || lifetime > MAX_INVITE_MS) throw new Error("Invite lifetime must be between 1ms and 365 days");
+	return lifetime;
+}
+/** Refresh name/role on the existing row (re-invite is admin intent). */
+async function refreshShelfUser(db, id, input) {
+	return await db.update(db.tables.users, id, {
+		name: input.name.trim(),
+		role: input.role
+	});
+}
+async function stageShelfUser(db, input) {
+	const email = normalizeEmail(input.email);
+	if (!isEmail(email)) throw new Error("Invalid email");
+	if (input.name.trim() === "") throw new Error("Name is required");
+	const existing = await listShelfUsersByEmail(db, email);
+	if (existing[0]) return await refreshShelfUser(db, String(existing[0]["id"]), input);
+	const now = (/* @__PURE__ */ new Date()).toISOString();
+	return await db.insert(db.tables.users, {
+		id: ulid(),
+		email,
+		name: input.name.trim(),
+		avatarUrl: null,
+		role: input.role,
+		lastLoginAt: null,
+		createdAt: now,
+		passwordHash: null,
+		displayNameOverride: null,
+		authProvider: "local",
+		disabled: false
+	});
+}
+async function removeUnusedInvite(db, row) {
+	await db.remove(db.tables.userInviteTokens, String(row["id"]));
+}
+async function supersedeUnusedInvites(db, userId) {
+	const existing = await db.list(db.tables.userInviteTokens, { where: eq(tableColumn(db.tables.userInviteTokens, "userId"), userId) });
+	await Promise.all(existing.filter((row) => !row["usedAt"]).map(async (row) => {
+		await removeUnusedInvite(db, row);
+	}));
+}
+/** Stage a shelf user and mint a single-use invite token (returned once). */
+async function issueInvite(db, input) {
+	return await withInviteTx(db, async (store) => {
+		const shelfUser = await stageShelfUser(store, input);
+		const userId = String(shelfUser["id"]);
+		await supersedeUnusedInvites(store, userId);
+		const now = (/* @__PURE__ */ new Date()).toISOString();
+		const expiresAt = new Date(Date.now() + inviteLifetimeMs(input.inviteExpiryMs)).toISOString();
+		const inviteId = ulid();
+		const token = randomToken("inv_").value;
+		await store.insert(store.tables.userInviteTokens, {
+			id: inviteId,
+			userId,
+			tokenHash: sha256(token),
+			expiresAt,
+			usedAt: null,
+			createdAt: now
+		});
+		return {
+			inviteId,
+			token,
+			expiresAt
+		};
+	});
+}
+/** Check an invite token without consuming it (drives the accept page). */
+async function verifyInvite(db, input) {
+	const { shelfUser } = await assertInviteValid(db, input);
+	return {
+		email: String(shelfUser["email"]),
+		name: String(shelfUser["name"])
+	};
+}
+/** Whether an invite row is already spent (busy-downgrade probe). */
+async function inviteSpent(db, inviteId) {
+	return !!(await db.get(db.tables.userInviteTokens, inviteId))?.["usedAt"];
+}
+/** Consume an invite: set the engine credential and return the shelf user. */
+async function acceptInvite(db, input) {
+	assertPasswordPolicy(input.password);
+	try {
+		return await withInviteTx(db, async (store) => {
+			const { invite, shelfUser } = await assertInviteValid(store, input);
+			await ensureEngineIdentity(store, shelfUser, input.password);
+			const now = (/* @__PURE__ */ new Date()).toISOString();
+			await store.update(store.tables.users, String(shelfUser["id"]), { lastLoginAt: now });
+			await store.update(store.tables.userInviteTokens, String(invite["id"]), { usedAt: now });
+			return toAuthUser(shelfUser);
+		});
+	} catch (error) {
+		if (await inviteSpent(db, input.inviteId)) throw inviteError();
+		throw error;
+	}
+}
+//#endregion
+export { MIN_PASSWORD_LENGTH, acceptInvite, ensureEngineIdentity, issueInvite, tableColumn, verifyInvite };
+
+//# sourceMappingURL=invites.mjs.map

package/dist/invites.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"invites.mjs","names":[],"sources":["../src/invites.ts"],"sourcesContent":["import type { DatabaseAdapter, TxStore } from \"@storyshelf/core/adapter/database\";\n/**\n * Invite-only local accounts on the engine: our tables own the invite,\n * Better Auth owns the credential.\n *\n * `issueInvite` stages a shelf `users` row plus a single-use token;\n * `acceptInvite` verifies the token, then writes the engine `user` row and\n * `credential` account row directly through the DatabaseAdapter. Direct\n * writes (instead of the admin `createUser` endpoint) because invite accept\n * is a pre-authentication flow and admin endpoints require a session by\n * design. Passwords use Better Auth's own hasher so engine sign-in verifies\n * them without format translation.\n */\nimport type { AuthUser } from \"@storyshelf/core/types\";\nimport { randomToken, sha256, timingSafeEqualString, ulid } from \"@storyshelf/core/utils\";\nimport { hashPassword } from \"better-auth/crypto\";\nimport { eq, getTableColumns, sql } from \"drizzle-orm\";\nimport type { SQL, Table } from \"drizzle-orm\";\nimport { baseAuthTables } from \"./auth-tables.ts\";\n\nconst DEFAULT_INVITE_MS = 7 * 24 * 60 * 60 * 1000;\nconst MAX_INVITE_MS = 365 * 24 * 60 * 60 * 1000;\n\n/** Minimum password length for local accounts (matches legacy policy). */\nexport const MIN_PASSWORD_LENGTH = 12;\n\n/** Input for {@link issueInvite}. */\nexport interface IssueInviteInput {\n  email: string;\n  name: string;\n  role: AuthUser[\"role\"];\n  /** Invite lifetime override. Defaults to 7 days. */\n  inviteExpiryMs?: number;\n}\n\n/** Input for {@link acceptInvite} and {@link verifyInvite}. */\nexport interface InviteTokenInput {\n  inviteId: string;\n  token: string;\n}\n\n/** Input for {@link acceptInvite}. */\nexport interface AcceptInviteInput extends InviteTokenInput {\n  password: string;\n}\n\ntype ShelfRow = Record<string, unknown>;\n\n/**\n * CRUD surface invites run on: the top-level adapter or a transaction store\n * (TxStore carries no table handles, so callers attach them). Both\n * DatabaseAdapter and TxStore satisfy this structurally.\n */\nexport type InviteStore = Pick<TxStore, \"insert\" | \"update\" | \"get\" | \"remove\" | \"list\"> & {\n  readonly tables: DatabaseAdapter[\"tables\"];\n};\n\n/**\n * Run `fn` inside a transaction. Invites are consume-once state: without\n * driver transactions concurrent accepts race, so transact is required\n * (every production driver offers it) rather than silently sequential.\n */\nasync function withInviteTx<R>(\n  db: DatabaseAdapter,\n  fn: (store: InviteStore) => Promise<R>,\n): Promise<R> {\n  if (!db.transact) {\n    throw new Error(\"Shelf invites require a database with transaction support\");\n  }\n  return await db.transact(async (tx) => await fn({ ...tx, tables: db.tables }));\n}\n\nfunction normalizeEmail(email: string): string {\n  return email.trim().toLowerCase();\n}\n\nfunction isEmail(value: string): boolean {\n  return /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/u.test(value);\n}\n\nfunction inviteError(): Error {\n  return new Error(\"Invalid or expired invite\");\n}\n\n/** Resolve a shelf/engine table column, failing fast on schema drift. */\nexport function tableColumn(table: Table, name: string): SQL {\n  const column = getTableColumns(table)[name] as SQL | undefined;\n  if (!column) {\n    throw new Error(`Shelf table is missing column \"${name}\"`);\n  }\n  return column;\n}\n\nfunction assertPasswordPolicy(password: string): void {\n  if (password.length < MIN_PASSWORD_LENGTH) {\n    throw new Error(\"Password must be at least 12 characters\");\n  }\n}\n\nasync function listShelfUsersByEmail(db: InviteStore, email: string): Promise<ShelfRow[]> {\n  return await db.list(db.tables.users, {\n    where: eq(tableColumn(db.tables.users, \"email\"), normalizeEmail(email)),\n    limit: 1,\n  });\n}\n\nasync function findEngineUserByEmail(db: InviteStore, email: string): Promise<ShelfRow | null> {\n  // Case-insensitive: engine rows may carry provider-given casing while the\n  // shelf normalizes (and UNIQUE(email) is case-sensitive, so an exact-only\n  // lookup would 500 on a case-variant insert).\n  const column = tableColumn(baseAuthTables.user, \"email\");\n  const rows = (await db.list(baseAuthTables.user, {\n    where: eq(sql`lower(${column})`, email.toLowerCase()),\n    limit: 1,\n  })) as ShelfRow[];\n  return rows[0] ?? null;\n}\n\nasync function findCredentialAccount(db: InviteStore, userId: string): Promise<ShelfRow | null> {\n  const rows = (await db.list(baseAuthTables.account, {\n    where: eq(tableColumn(baseAuthTables.account, \"userId\"), userId),\n  })) as ShelfRow[];\n  return rows.find((row) => row[\"providerId\"] === \"credential\") ?? null;\n}\n\n/** Load the invite row, or throw the generic invite error. */\nasync function loadInvite(db: InviteStore, input: InviteTokenInput): Promise<ShelfRow> {\n  const invite: ShelfRow | null = await db.get(db.tables.userInviteTokens, input.inviteId);\n  if (!invite || invite[\"usedAt\"]) {\n    throw inviteError();\n  }\n  // Fail closed: a corrupt expiresAt parses to NaN, and NaN comparisons\n  // are false — without this check the invite would never expire.\n  const expires = new Date(String(invite[\"expiresAt\"])).getTime();\n  if (Number.isNaN(expires) || expires <= Date.now()) {\n    throw inviteError();\n  }\n  if (!timingSafeEqualString(sha256(input.token), String(invite[\"tokenHash\"]))) {\n    throw inviteError();\n  }\n  return invite;\n}\n\n/** Load the invite plus its shelf user, or throw the generic invite error. */\nasync function assertInviteValid(\n  db: InviteStore,\n  input: InviteTokenInput,\n): Promise<{ invite: ShelfRow; shelfUser: ShelfRow }> {\n  const invite = await loadInvite(db, input);\n  const shelfUser: ShelfRow | null = await db.get(db.tables.users, String(invite[\"userId\"]));\n  if (!shelfUser || shelfUser[\"disabled\"]) {\n    throw inviteError();\n  }\n  return { invite, shelfUser };\n}\n\n/** Create the credential account row, or refresh the existing password. */\nasync function upsertCredentialAccount(\n  db: InviteStore,\n  userId: string,\n  password: string,\n  now: string,\n): Promise<void> {\n  const hash = await hashPassword(password);\n  const account = await findCredentialAccount(db, userId);\n  if (account) {\n    await db.update(baseAuthTables.account, String(account[\"id\"]), {\n      password: hash,\n      updatedAt: now,\n    });\n    return;\n  }\n  await db.insert(baseAuthTables.account, {\n    id: ulid(),\n    userId,\n    accountId: userId,\n    providerId: \"credential\",\n    password: hash,\n    createdAt: now,\n    updatedAt: now,\n  });\n}\n\n/** Create the engine identity rows (shared id), or refresh the credential. */\nexport async function ensureEngineIdentity(\n  db: InviteStore,\n  shelfUser: ShelfRow,\n  password: string,\n): Promise<void> {\n  const userId = String(shelfUser[\"id\"]);\n  const email = String(shelfUser[\"email\"]);\n  const now = new Date().toISOString();\n  // Verified-email linking only: an existing engine row takes the credential\n  // when its email is verified (same owner). An unverified row (e.g. an OIDC\n  // identity with an untrusted email claim) must stay separate — but engine\n  // emails are UNIQUE, so no second row can mint: reject and point at SSO.\n  const engineUser = await findEngineUserByEmail(db, email);\n  if (engineUser && engineUser[\"emailVerified\"] !== true) {\n    throw new Error(\n      \"Email is registered with an unverified SSO identity; sign in with SSO instead\",\n    );\n  }\n  if (!engineUser) {\n    await db.insert(baseAuthTables.user, {\n      id: userId,\n      name: String(shelfUser[\"name\"]),\n      email,\n      emailVerified: true,\n      image: null,\n      createdAt: now,\n      updatedAt: now,\n    });\n  }\n  const targetId = engineUser ? String(engineUser[\"id\"]) : userId;\n  await upsertCredentialAccount(db, targetId, password, now);\n}\n\nfunction toAuthUser(row: ShelfRow): AuthUser {\n  return {\n    id: String(row[\"id\"]),\n    email: String(row[\"email\"]),\n    name: String(row[\"name\"]),\n    avatarUrl: (row[\"avatarUrl\"] as string | null) ?? undefined,\n    role: row[\"role\"] as AuthUser[\"role\"],\n  };\n}\n\nfunction inviteLifetimeMs(expiryMs: number | undefined): number {\n  const lifetime = expiryMs ?? DEFAULT_INVITE_MS;\n  if (!Number.isFinite(lifetime) || lifetime <= 0 || lifetime > MAX_INVITE_MS) {\n    throw new Error(\"Invite lifetime must be between 1ms and 365 days\");\n  }\n  return lifetime;\n}\n\n/** Refresh name/role on the existing row (re-invite is admin intent). */\nasync function refreshShelfUser(\n  db: InviteStore,\n  id: string,\n  input: IssueInviteInput,\n): Promise<ShelfRow> {\n  const updated: ShelfRow = await db.update(db.tables.users, id, {\n    name: input.name.trim(),\n    role: input.role,\n  });\n  return updated;\n}\n\nasync function stageShelfUser(db: InviteStore, input: IssueInviteInput): Promise<ShelfRow> {\n  const email = normalizeEmail(input.email);\n  if (!isEmail(email)) {\n    throw new Error(\"Invalid email\");\n  }\n  if (input.name.trim() === \"\") {\n    throw new Error(\"Name is required\");\n  }\n  const existing = await listShelfUsersByEmail(db, email);\n  // Re-invite refreshes name and role: issuing is operator-only, so the\n  // latest invite is the current admin intent (and the password flow).\n  if (existing[0]) {\n    return await refreshShelfUser(db, String(existing[0][\"id\"]), input);\n  }\n  const now = new Date().toISOString();\n  return await db.insert(db.tables.users, {\n    id: ulid(),\n    email,\n    name: input.name.trim(),\n    avatarUrl: null,\n    role: input.role,\n    lastLoginAt: null,\n    createdAt: now,\n    passwordHash: null,\n    displayNameOverride: null,\n    authProvider: \"local\",\n    disabled: false,\n  });\n}\n\nasync function removeUnusedInvite(db: InviteStore, row: ShelfRow): Promise<void> {\n  await db.remove(db.tables.userInviteTokens, String(row[\"id\"]));\n}\n\nasync function supersedeUnusedInvites(db: InviteStore, userId: string): Promise<void> {\n  const existing = (await db.list(db.tables.userInviteTokens, {\n    where: eq(tableColumn(db.tables.userInviteTokens, \"userId\"), userId),\n  })) as ShelfRow[];\n  await Promise.all(\n    existing\n      .filter((row) => !row[\"usedAt\"])\n      .map(async (row) => {\n        await removeUnusedInvite(db, row);\n      }),\n  );\n}\n\n/** Stage a shelf user and mint a single-use invite token (returned once). */\nexport async function issueInvite(\n  db: DatabaseAdapter,\n  input: IssueInviteInput,\n): Promise<{ inviteId: string; token: string; expiresAt: string }> {\n  return await withInviteTx(db, async (store) => {\n    const shelfUser = await stageShelfUser(store, input);\n    const userId = String(shelfUser[\"id\"]);\n    await supersedeUnusedInvites(store, userId);\n    const now = new Date().toISOString();\n    const expiresAt = new Date(Date.now() + inviteLifetimeMs(input.inviteExpiryMs)).toISOString();\n    const inviteId = ulid();\n    const token = randomToken(\"inv_\").value;\n    await store.insert(store.tables.userInviteTokens, {\n      id: inviteId,\n      userId,\n      tokenHash: sha256(token),\n      expiresAt,\n      usedAt: null,\n      createdAt: now,\n    });\n    return { inviteId, token, expiresAt };\n  });\n}\n\n/** Check an invite token without consuming it (drives the accept page). */\nexport async function verifyInvite(\n  db: DatabaseAdapter,\n  input: InviteTokenInput,\n): Promise<{ email: string; name: string }> {\n  const { shelfUser } = await assertInviteValid(db, input);\n  return { email: String(shelfUser[\"email\"]), name: String(shelfUser[\"name\"]) };\n}\n\n/** Whether an invite row is already spent (busy-downgrade probe). */\nasync function inviteSpent(db: InviteStore, inviteId: string): Promise<boolean> {\n  const invite: ShelfRow | null = await db.get(db.tables.userInviteTokens, inviteId);\n  return !!invite?.[\"usedAt\"];\n}\n\n/** Consume an invite: set the engine credential and return the shelf user. */\nexport async function acceptInvite(\n  db: DatabaseAdapter,\n  input: AcceptInviteInput,\n): Promise<AuthUser> {\n  assertPasswordPolicy(input.password);\n  try {\n    return await withInviteTx(db, async (store) => {\n      const { invite, shelfUser } = await assertInviteValid(store, input);\n      await ensureEngineIdentity(store, shelfUser, input.password);\n      const now = new Date().toISOString();\n      await store.update(store.tables.users, String(shelfUser[\"id\"]), { lastLoginAt: now });\n      await store.update(store.tables.userInviteTokens, String(invite[\"id\"]), { usedAt: now });\n      return toAuthUser(shelfUser);\n    });\n  } catch (error) {\n    // A transaction loser (e.g. sqlite's busy connection) surfaces a driver\n    // error instead of the invite error; re-probe so callers see the stable\n    // \"Invalid or expired invite\" whenever the winner consumed the token.\n    if (await inviteSpent(db, input.inviteId)) {\n      throw inviteError();\n    }\n    throw error;\n  }\n}\n"],"mappings":";;;;;;;;AAoBA,MAAM,oBAAoB;AAC1B,MAAM,gBAAgB;;AAGtB,MAAa,sBAAsB;;;;;;AAsCnC,eAAe,aACb,IACA,IACY;CACZ,IAAI,CAAC,GAAG,UACN,MAAM,IAAI,MAAM,2DAA2D;CAE7E,OAAO,MAAM,GAAG,SAAS,OAAO,OAAO,MAAM,GAAG;EAAE,GAAG;EAAI,QAAQ,GAAG;CAAO,CAAC,CAAC;AAC/E;AAEA,SAAS,eAAe,OAAuB;CAC7C,OAAO,MAAM,KAAK,CAAC,CAAC,YAAY;AAClC;AAEA,SAAS,QAAQ,OAAwB;CACvC,OAAO,8BAA8B,KAAK,KAAK;AACjD;AAEA,SAAS,cAAqB;CAC5B,uBAAO,IAAI,MAAM,2BAA2B;AAC9C;;AAGA,SAAgB,YAAY,OAAc,MAAmB;CAC3D,MAAM,SAAS,gBAAgB,KAAK,CAAC,CAAC;CACtC,IAAI,CAAC,QACH,MAAM,IAAI,MAAM,kCAAkC,KAAK,EAAE;CAE3D,OAAO;AACT;AAEA,SAAS,qBAAqB,UAAwB;CACpD,IAAI,SAAS,SAAA,IACX,MAAM,IAAI,MAAM,yCAAyC;AAE7D;AAEA,eAAe,sBAAsB,IAAiB,OAAoC;CACxF,OAAO,MAAM,GAAG,KAAK,GAAG,OAAO,OAAO;EACpC,OAAO,GAAG,YAAY,GAAG,OAAO,OAAO,OAAO,GAAG,eAAe,KAAK,CAAC;EACtE,OAAO;CACT,CAAC;AACH;AAEA,eAAe,sBAAsB,IAAiB,OAAyC;CAI7F,MAAM,SAAS,YAAY,eAAe,MAAM,OAAO;CAKvD,QAAO,MAJa,GAAG,KAAK,eAAe,MAAM;EAC/C,OAAO,GAAG,GAAG,SAAS,OAAO,IAAI,MAAM,YAAY,CAAC;EACpD,OAAO;CACT,CAAC,EAAA,CACW,MAAM;AACpB;AAEA,eAAe,sBAAsB,IAAiB,QAA0C;CAI9F,QAAO,MAHa,GAAG,KAAK,eAAe,SAAS,EAClD,OAAO,GAAG,YAAY,eAAe,SAAS,QAAQ,GAAG,MAAM,EACjE,CAAC,EAAA,CACW,MAAM,QAAQ,IAAI,kBAAkB,YAAY,KAAK;AACnE;;AAGA,eAAe,WAAW,IAAiB,OAA4C;CACrF,MAAM,SAA0B,MAAM,GAAG,IAAI,GAAG,OAAO,kBAAkB,MAAM,QAAQ;CACvF,IAAI,CAAC,UAAU,OAAO,WACpB,MAAM,YAAY;CAIpB,MAAM,UAAU,IAAI,KAAK,OAAO,OAAO,YAAY,CAAC,CAAC,CAAC,QAAQ;CAC9D,IAAI,OAAO,MAAM,OAAO,KAAK,WAAW,KAAK,IAAI,GAC/C,MAAM,YAAY;CAEpB,IAAI,CAAC,sBAAsB,OAAO,MAAM,KAAK,GAAG,OAAO,OAAO,YAAY,CAAC,GACzE,MAAM,YAAY;CAEpB,OAAO;AACT;;AAGA,eAAe,kBACb,IACA,OACoD;CACpD,MAAM,SAAS,MAAM,WAAW,IAAI,KAAK;CACzC,MAAM,YAA6B,MAAM,GAAG,IAAI,GAAG,OAAO,OAAO,OAAO,OAAO,SAAS,CAAC;CACzF,IAAI,CAAC,aAAa,UAAU,aAC1B,MAAM,YAAY;CAEpB,OAAO;EAAE;EAAQ;CAAU;AAC7B;;AAGA,eAAe,wBACb,IACA,QACA,UACA,KACe;CACf,MAAM,OAAO,MAAM,aAAa,QAAQ;CACxC,MAAM,UAAU,MAAM,sBAAsB,IAAI,MAAM;CACtD,IAAI,SAAS;EACX,MAAM,GAAG,OAAO,eAAe,SAAS,OAAO,QAAQ,KAAK,GAAG;GAC7D,UAAU;GACV,WAAW;EACb,CAAC;EACD;CACF;CACA,MAAM,GAAG,OAAO,eAAe,SAAS;EACtC,IAAI,KAAK;EACT;EACA,WAAW;EACX,YAAY;EACZ,UAAU;EACV,WAAW;EACX,WAAW;CACb,CAAC;AACH;;AAGA,eAAsB,qBACpB,IACA,WACA,UACe;CACf,MAAM,SAAS,OAAO,UAAU,KAAK;CACrC,MAAM,QAAQ,OAAO,UAAU,QAAQ;CACvC,MAAM,uBAAM,IAAI,KAAK,EAAA,CAAE,YAAY;CAKnC,MAAM,aAAa,MAAM,sBAAsB,IAAI,KAAK;CACxD,IAAI,cAAc,WAAW,qBAAqB,MAChD,MAAM,IAAI,MACR,+EACF;CAEF,IAAI,CAAC,YACH,MAAM,GAAG,OAAO,eAAe,MAAM;EACnC,IAAI;EACJ,MAAM,OAAO,UAAU,OAAO;EAC9B;EACA,eAAe;EACf,OAAO;EACP,WAAW;EACX,WAAW;CACb,CAAC;CAGH,MAAM,wBAAwB,IADb,aAAa,OAAO,WAAW,KAAK,IAAI,QACb,UAAU,GAAG;AAC3D;AAEA,SAAS,WAAW,KAAyB;CAC3C,OAAO;EACL,IAAI,OAAO,IAAI,KAAK;EACpB,OAAO,OAAO,IAAI,QAAQ;EAC1B,MAAM,OAAO,IAAI,OAAO;EACxB,WAAY,IAAI,gBAAkC,KAAA;EAClD,MAAM,IAAI;CACZ;AACF;AAEA,SAAS,iBAAiB,UAAsC;CAC9D,MAAM,WAAW,YAAY;CAC7B,IAAI,CAAC,OAAO,SAAS,QAAQ,KAAK,YAAY,KAAK,WAAW,eAC5D,MAAM,IAAI,MAAM,kDAAkD;CAEpE,OAAO;AACT;;AAGA,eAAe,iBACb,IACA,IACA,OACmB;CAKnB,OAAO,MAJyB,GAAG,OAAO,GAAG,OAAO,OAAO,IAAI;EAC7D,MAAM,MAAM,KAAK,KAAK;EACtB,MAAM,MAAM;CACd,CAAC;AAEH;AAEA,eAAe,eAAe,IAAiB,OAA4C;CACzF,MAAM,QAAQ,eAAe,MAAM,KAAK;CACxC,IAAI,CAAC,QAAQ,KAAK,GAChB,MAAM,IAAI,MAAM,eAAe;CAEjC,IAAI,MAAM,KAAK,KAAK,MAAM,IACxB,MAAM,IAAI,MAAM,kBAAkB;CAEpC,MAAM,WAAW,MAAM,sBAAsB,IAAI,KAAK;CAGtD,IAAI,SAAS,IACX,OAAO,MAAM,iBAAiB,IAAI,OAAO,SAAS,EAAE,CAAC,KAAK,GAAG,KAAK;CAEpE,MAAM,uBAAM,IAAI,KAAK,EAAA,CAAE,YAAY;CACnC,OAAO,MAAM,GAAG,OAAO,GAAG,OAAO,OAAO;EACtC,IAAI,KAAK;EACT;EACA,MAAM,MAAM,KAAK,KAAK;EACtB,WAAW;EACX,MAAM,MAAM;EACZ,aAAa;EACb,WAAW;EACX,cAAc;EACd,qBAAqB;EACrB,cAAc;EACd,UAAU;CACZ,CAAC;AACH;AAEA,eAAe,mBAAmB,IAAiB,KAA8B;CAC/E,MAAM,GAAG,OAAO,GAAG,OAAO,kBAAkB,OAAO,IAAI,KAAK,CAAC;AAC/D;AAEA,eAAe,uBAAuB,IAAiB,QAA+B;CACpF,MAAM,WAAY,MAAM,GAAG,KAAK,GAAG,OAAO,kBAAkB,EAC1D,OAAO,GAAG,YAAY,GAAG,OAAO,kBAAkB,QAAQ,GAAG,MAAM,EACrE,CAAC;CACD,MAAM,QAAQ,IACZ,SACG,QAAQ,QAAQ,CAAC,IAAI,SAAS,CAAC,CAC/B,IAAI,OAAO,QAAQ;EAClB,MAAM,mBAAmB,IAAI,GAAG;CAClC,CAAC,CACL;AACF;;AAGA,eAAsB,YACpB,IACA,OACiE;CACjE,OAAO,MAAM,aAAa,IAAI,OAAO,UAAU;EAC7C,MAAM,YAAY,MAAM,eAAe,OAAO,KAAK;EACnD,MAAM,SAAS,OAAO,UAAU,KAAK;EACrC,MAAM,uBAAuB,OAAO,MAAM;EAC1C,MAAM,uBAAM,IAAI,KAAK,EAAA,CAAE,YAAY;EACnC,MAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,iBAAiB,MAAM,cAAc,CAAC,CAAC,CAAC,YAAY;EAC5F,MAAM,WAAW,KAAK;EACtB,MAAM,QAAQ,YAAY,MAAM,CAAC,CAAC;EAClC,MAAM,MAAM,OAAO,MAAM,OAAO,kBAAkB;GAChD,IAAI;GACJ;GACA,WAAW,OAAO,KAAK;GACvB;GACA,QAAQ;GACR,WAAW;EACb,CAAC;EACD,OAAO;GAAE;GAAU;GAAO;EAAU;CACtC,CAAC;AACH;;AAGA,eAAsB,aACpB,IACA,OAC0C;CAC1C,MAAM,EAAE,cAAc,MAAM,kBAAkB,IAAI,KAAK;CACvD,OAAO;EAAE,OAAO,OAAO,UAAU,QAAQ;EAAG,MAAM,OAAO,UAAU,OAAO;CAAE;AAC9E;;AAGA,eAAe,YAAY,IAAiB,UAAoC;CAE9E,OAAO,CAAC,EAAC,MAD6B,GAAG,IAAI,GAAG,OAAO,kBAAkB,QAAQ,EAAA,GAC/D;AACpB;;AAGA,eAAsB,aACpB,IACA,OACmB;CACnB,qBAAqB,MAAM,QAAQ;CACnC,IAAI;EACF,OAAO,MAAM,aAAa,IAAI,OAAO,UAAU;GAC7C,MAAM,EAAE,QAAQ,cAAc,MAAM,kBAAkB,OAAO,KAAK;GAClE,MAAM,qBAAqB,OAAO,WAAW,MAAM,QAAQ;GAC3D,MAAM,uBAAM,IAAI,KAAK,EAAA,CAAE,YAAY;GACnC,MAAM,MAAM,OAAO,MAAM,OAAO,OAAO,OAAO,UAAU,KAAK,GAAG,EAAE,aAAa,IAAI,CAAC;GACpF,MAAM,MAAM,OAAO,MAAM,OAAO,kBAAkB,OAAO,OAAO,KAAK,GAAG,EAAE,QAAQ,IAAI,CAAC;GACvF,OAAO,WAAW,SAAS;EAC7B,CAAC;CACH,SAAS,OAAO;EAId,IAAI,MAAM,YAAY,IAAI,MAAM,QAAQ,GACtC,MAAM,YAAY;EAEpB,MAAM;CACR;AACF"}

package/dist/passkeys.d.mts

@@ -0,0 +1,21 @@
+import __tsdown_shims_path from 'node:path';
+import __tsdown_shims_url from 'node:url';
+import { DatabaseAdapter } from "@storyshelf/core/adapter/database";
+//#region src/passkeys.d.ts
+/** One registered passkey for the profile page. */
+interface EnginePasskeyInfo {
+  id: string;
+  name: string | null;
+  deviceType: string;
+  backedUp: boolean;
+  transports: string | null;
+  aaguid: string | null;
+  createdAt: string;
+}
+/** Registered passkeys for a user, oldest first. */
+declare function listUserPasskeys(db: DatabaseAdapter, userId: string): Promise<EnginePasskeyInfo[]>;
+/** Whether the user can change a local password (has a credential account). */
+declare function hasPasswordCredential(db: DatabaseAdapter, userId: string): Promise<boolean>;
+//#endregion
+export { EnginePasskeyInfo, hasPasswordCredential, listUserPasskeys };
+//# sourceMappingURL=passkeys.d.mts.map

package/dist/passkeys.mjs

@@ -0,0 +1,27 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { baseAuthTables } from "./auth-tables.mjs";
+import { tableColumn } from "./invites.mjs";
+import { eq } from "drizzle-orm";
+//#region src/passkeys.ts
+/** Registered passkeys for a user, oldest first. */
+async function listUserPasskeys(db, userId) {
+	return (await db.list(baseAuthTables.passkey, { where: eq(tableColumn(baseAuthTables.passkey, "userId"), userId) })).map((row) => ({
+		id: String(row["id"]),
+		name: row["name"] ?? null,
+		deviceType: typeof row["deviceType"] === "string" ? row["deviceType"] : "unknown",
+		backedUp: row["backedUp"] === true,
+		transports: row["transports"] ?? null,
+		aaguid: row["aaguid"] ?? null,
+		createdAt: String(row["createdAt"])
+	})).toSorted((a, b) => a.createdAt < b.createdAt ? -1 : 1);
+}
+/** Whether the user can change a local password (has a credential account). */
+async function hasPasswordCredential(db, userId) {
+	return (await db.list(baseAuthTables.account, { where: eq(tableColumn(baseAuthTables.account, "userId"), userId) })).some((row) => row["providerId"] === "credential");
+}
+//#endregion
+export { hasPasswordCredential, listUserPasskeys };
+
+//# sourceMappingURL=passkeys.mjs.map

package/dist/passkeys.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkeys.mjs","names":[],"sources":["../src/passkeys.ts"],"sourcesContent":["/**\n * Shelf-side passkey inventory plus the local-credential flag.\n *\n * The profile page needs both to decide which security sections to render:\n * the key list (with the \"register a 2nd key\" nudge) and the password form\n * (only when a `credential` account exists — social-only users have none).\n * Registration and deletion go through the passkey plugin endpoints;\n * deletion is ownership-scoped server-side.\n */\nimport type { DatabaseAdapter } from \"@storyshelf/core/adapter/database\";\nimport { eq } from \"drizzle-orm\";\nimport { baseAuthTables } from \"./auth-tables.ts\";\nimport { tableColumn } from \"./invites.ts\";\n\n/** One registered passkey for the profile page. */\nexport interface EnginePasskeyInfo {\n  id: string;\n  name: string | null;\n  deviceType: string;\n  backedUp: boolean;\n  transports: string | null;\n  aaguid: string | null;\n  createdAt: string;\n}\n\n/** Registered passkeys for a user, oldest first. */\nexport async function listUserPasskeys(\n  db: DatabaseAdapter,\n  userId: string,\n): Promise<EnginePasskeyInfo[]> {\n  const rows = (await db.list(baseAuthTables.passkey, {\n    where: eq(tableColumn(baseAuthTables.passkey, \"userId\"), userId),\n  })) as Record<string, unknown>[];\n  return rows\n    .map((row) => ({\n      id: String(row[\"id\"]),\n      name: (row[\"name\"] as string | null) ?? null,\n      deviceType: typeof row[\"deviceType\"] === \"string\" ? row[\"deviceType\"] : \"unknown\",\n      backedUp: row[\"backedUp\"] === true,\n      transports: (row[\"transports\"] as string | null) ?? null,\n      aaguid: (row[\"aaguid\"] as string | null) ?? null,\n      createdAt: String(row[\"createdAt\"]),\n    }))\n    .toSorted((a, b) => (a.createdAt < b.createdAt ? -1 : 1));\n}\n\n/** Whether the user can change a local password (has a credential account). */\nexport async function hasPasswordCredential(db: DatabaseAdapter, userId: string): Promise<boolean> {\n  const rows = (await db.list(baseAuthTables.account, {\n    where: eq(tableColumn(baseAuthTables.account, \"userId\"), userId),\n  })) as Record<string, unknown>[];\n  return rows.some((row) => row[\"providerId\"] === \"credential\");\n}\n"],"mappings":";;;;;;;;AA0BA,eAAsB,iBACpB,IACA,QAC8B;CAI9B,QAAO,MAHa,GAAG,KAAK,eAAe,SAAS,EAClD,OAAO,GAAG,YAAY,eAAe,SAAS,QAAQ,GAAG,MAAM,EACjE,CAAC,EAAA,CAEE,KAAK,SAAS;EACb,IAAI,OAAO,IAAI,KAAK;EACpB,MAAO,IAAI,WAA6B;EACxC,YAAY,OAAO,IAAI,kBAAkB,WAAW,IAAI,gBAAgB;EACxE,UAAU,IAAI,gBAAgB;EAC9B,YAAa,IAAI,iBAAmC;EACpD,QAAS,IAAI,aAA+B;EAC5C,WAAW,OAAO,IAAI,YAAY;CACpC,EAAE,CAAC,CACF,UAAU,GAAG,MAAO,EAAE,YAAY,EAAE,YAAY,KAAK,CAAE;AAC5D;;AAGA,eAAsB,sBAAsB,IAAqB,QAAkC;CAIjG,QAAO,MAHa,GAAG,KAAK,eAAe,SAAS,EAClD,OAAO,GAAG,YAAY,eAAe,SAAS,QAAQ,GAAG,MAAM,EACjE,CAAC,EAAA,CACW,MAAM,QAAQ,IAAI,kBAAkB,YAAY;AAC9D"}

package/dist/presets/enterprise.d.mts

@@ -0,0 +1,24 @@
+import __tsdown_shims_path from 'node:path';
+import __tsdown_shims_url from 'node:url';
+import { ShelfOAuthProvider } from "../engine.mjs";
+//#region src/presets/enterprise.d.ts
+/** Client credentials shared by the enterprise presets. */
+interface EnterpriseClientOptions {
+  clientId: string;
+  clientSecret?: string;
+  label?: string;
+}
+/** Keycloak realm preset (discovery over the realm URL). */
+declare function keycloakPreset(realmUrl: string, options: EnterpriseClientOptions): ShelfOAuthProvider;
+/** Okta preset (custom authorization server, explicit endpoints). */
+declare function oktaPreset(options: EnterpriseClientOptions & {
+  domain: string;
+  authorizationServerId: string;
+}): ShelfOAuthProvider;
+/** Auth0 preset (explicit endpoints; groups need a tenant Action claim). */
+declare function auth0Preset(options: EnterpriseClientOptions & {
+  domain: string;
+}): ShelfOAuthProvider;
+//#endregion
+export { EnterpriseClientOptions, auth0Preset, keycloakPreset, oktaPreset };
+//# sourceMappingURL=enterprise.d.mts.map

package/dist/presets/enterprise.mjs

@@ -0,0 +1,44 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/presets/enterprise.ts
+/** Keycloak realm preset (discovery over the realm URL). */
+function keycloakPreset(realmUrl, options) {
+	return {
+		id: "keycloak",
+		label: options.label ?? "Keycloak",
+		clientId: options.clientId,
+		clientSecret: options.clientSecret,
+		discoveryUrl: `${realmUrl.replace(/\/+$/u, "")}/.well-known/openid-configuration`
+	};
+}
+/** Okta preset (custom authorization server, explicit endpoints). */
+function oktaPreset(options) {
+	const issuer = `https://${options.domain}/oauth2/${options.authorizationServerId}`;
+	return {
+		id: "okta",
+		label: options.label ?? "Okta",
+		clientId: options.clientId,
+		clientSecret: options.clientSecret,
+		authorizationUrl: `${issuer}/v1/authorize`,
+		tokenUrl: `${issuer}/v1/token`,
+		userInfoUrl: `${issuer}/v1/userinfo`
+	};
+}
+/** Auth0 preset (explicit endpoints; groups need a tenant Action claim). */
+function auth0Preset(options) {
+	const issuer = `https://${options.domain}/`;
+	return {
+		id: "auth0",
+		label: options.label ?? "Auth0",
+		clientId: options.clientId,
+		clientSecret: options.clientSecret,
+		authorizationUrl: `${issuer}authorize`,
+		tokenUrl: `${issuer}oauth/token`,
+		userInfoUrl: `${issuer}userinfo`
+	};
+}
+//#endregion
+export { auth0Preset, keycloakPreset, oktaPreset };
+
+//# sourceMappingURL=enterprise.mjs.map

package/dist/presets/enterprise.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"enterprise.mjs","names":[],"sources":["../../src/presets/enterprise.ts"],"sourcesContent":["/**\n * Enterprise OIDC recipes: generic-OAuth configs for providers without a\n * Better Auth native integration.\n *\n * Each preset returns a {@link ShelfOAuthProvider} for\n * `createShelfAuth({ oauth })`. Endpoint construction mirrors the retired\n * `auth-oauth` presets so existing issuer URLs keep working; Keycloak\n * prefers discovery, Okta/Auth0 pin explicit endpoints.\n */\nimport type { ShelfOAuthProvider } from \"../engine.ts\";\n\n/** Client credentials shared by the enterprise presets. */\nexport interface EnterpriseClientOptions {\n  clientId: string;\n  clientSecret?: string;\n  label?: string;\n}\n\n/** Keycloak realm preset (discovery over the realm URL). */\nexport function keycloakPreset(\n  realmUrl: string,\n  options: EnterpriseClientOptions,\n): ShelfOAuthProvider {\n  return {\n    id: \"keycloak\",\n    label: options.label ?? \"Keycloak\",\n    clientId: options.clientId,\n    clientSecret: options.clientSecret,\n    discoveryUrl: `${realmUrl.replace(/\\/+$/u, \"\")}/.well-known/openid-configuration`,\n  };\n}\n\n/** Okta preset (custom authorization server, explicit endpoints). */\nexport function oktaPreset(\n  options: EnterpriseClientOptions & { domain: string; authorizationServerId: string },\n): ShelfOAuthProvider {\n  const issuer = `https://${options.domain}/oauth2/${options.authorizationServerId}`;\n  return {\n    id: \"okta\",\n    label: options.label ?? \"Okta\",\n    clientId: options.clientId,\n    clientSecret: options.clientSecret,\n    authorizationUrl: `${issuer}/v1/authorize`,\n    tokenUrl: `${issuer}/v1/token`,\n    userInfoUrl: `${issuer}/v1/userinfo`,\n  };\n}\n\n/** Auth0 preset (explicit endpoints; groups need a tenant Action claim). */\nexport function auth0Preset(\n  options: EnterpriseClientOptions & { domain: string },\n): ShelfOAuthProvider {\n  const issuer = `https://${options.domain}/`;\n  return {\n    id: \"auth0\",\n    label: options.label ?? \"Auth0\",\n    clientId: options.clientId,\n    clientSecret: options.clientSecret,\n    authorizationUrl: `${issuer}authorize`,\n    tokenUrl: `${issuer}oauth/token`,\n    userInfoUrl: `${issuer}userinfo`,\n  };\n}\n"],"mappings":";;;;;AAmBA,SAAgB,eACd,UACA,SACoB;CACpB,OAAO;EACL,IAAI;EACJ,OAAO,QAAQ,SAAS;EACxB,UAAU,QAAQ;EAClB,cAAc,QAAQ;EACtB,cAAc,GAAG,SAAS,QAAQ,SAAS,EAAE,EAAE;CACjD;AACF;;AAGA,SAAgB,WACd,SACoB;CACpB,MAAM,SAAS,WAAW,QAAQ,OAAO,UAAU,QAAQ;CAC3D,OAAO;EACL,IAAI;EACJ,OAAO,QAAQ,SAAS;EACxB,UAAU,QAAQ;EAClB,cAAc,QAAQ;EACtB,kBAAkB,GAAG,OAAO;EAC5B,UAAU,GAAG,OAAO;EACpB,aAAa,GAAG,OAAO;CACzB;AACF;;AAGA,SAAgB,YACd,SACoB;CACpB,MAAM,SAAS,WAAW,QAAQ,OAAO;CACzC,OAAO;EACL,IAAI;EACJ,OAAO,QAAQ,SAAS;EACxB,UAAU,QAAQ;EAClB,cAAc,QAAQ;EACtB,kBAAkB,GAAG,OAAO;EAC5B,UAAU,GAAG,OAAO;EACpB,aAAa,GAAG,OAAO;CACzB;AACF"}

package/dist/presets/index.d.mts

@@ -0,0 +1,5 @@
+import __tsdown_shims_path from 'node:path';
+import __tsdown_shims_url from 'node:url';
+import { EnterpriseClientOptions, auth0Preset, keycloakPreset, oktaPreset } from "./enterprise.mjs";
+import { SocialClientOptions, cognitoPreset, entraPreset, githubPreset, gitlabPreset, googlePreset } from "./social.mjs";
+export { type EnterpriseClientOptions, type SocialClientOptions, auth0Preset, cognitoPreset, entraPreset, githubPreset, gitlabPreset, googlePreset, keycloakPreset, oktaPreset };