@voyant-travel/auth 0.113.3

package/dist/permissions.d.ts

@@ -0,0 +1,141 @@
+export declare const voyantStatements: {
+    readonly operator: readonly ["create", "read", "update", "delete"];
+    readonly connection: readonly ["create", "read", "update", "delete"];
+    readonly oauthClient: readonly ["create", "read", "revoke"];
+    readonly apiKey: readonly ["create", "read", "update", "delete"];
+    readonly operatorGrant: readonly ["create", "read", "update", "delete"];
+    readonly auditLog: readonly ["read"];
+    readonly settings: readonly ["read", "update"];
+    readonly organization: readonly ["update", "delete"];
+    readonly member: readonly ["create", "update", "delete"];
+    readonly invitation: readonly ["create", "cancel"];
+    readonly team: readonly ["create", "update", "delete"];
+    readonly ac: readonly ["create", "read", "update", "delete"];
+};
+export declare const ac: {
+    newRole<const TRoleStatements extends import("better-auth/plugins").Statements>(statements: import("better-auth/plugins").RoleInput<{
+        readonly operator: readonly ["create", "read", "update", "delete"];
+        readonly connection: readonly ["create", "read", "update", "delete"];
+        readonly oauthClient: readonly ["create", "read", "revoke"];
+        readonly apiKey: readonly ["create", "read", "update", "delete"];
+        readonly operatorGrant: readonly ["create", "read", "update", "delete"];
+        readonly auditLog: readonly ["read"];
+        readonly settings: readonly ["read", "update"];
+        readonly organization: readonly ["update", "delete"];
+        readonly member: readonly ["create", "update", "delete"];
+        readonly invitation: readonly ["create", "cancel"];
+        readonly team: readonly ["create", "update", "delete"];
+        readonly ac: readonly ["create", "read", "update", "delete"];
+    }, TRoleStatements>): import("better-auth/plugins").Role<import("better-auth/plugins").ExactRoleStatements<TRoleStatements>, {
+        readonly operator: readonly ["create", "read", "update", "delete"];
+        readonly connection: readonly ["create", "read", "update", "delete"];
+        readonly oauthClient: readonly ["create", "read", "revoke"];
+        readonly apiKey: readonly ["create", "read", "update", "delete"];
+        readonly operatorGrant: readonly ["create", "read", "update", "delete"];
+        readonly auditLog: readonly ["read"];
+        readonly settings: readonly ["read", "update"];
+        readonly organization: readonly ["update", "delete"];
+        readonly member: readonly ["create", "update", "delete"];
+        readonly invitation: readonly ["create", "cancel"];
+        readonly team: readonly ["create", "update", "delete"];
+        readonly ac: readonly ["create", "read", "update", "delete"];
+    }>;
+    statements: {
+        readonly operator: readonly ["create", "read", "update", "delete"];
+        readonly connection: readonly ["create", "read", "update", "delete"];
+        readonly oauthClient: readonly ["create", "read", "revoke"];
+        readonly apiKey: readonly ["create", "read", "update", "delete"];
+        readonly operatorGrant: readonly ["create", "read", "update", "delete"];
+        readonly auditLog: readonly ["read"];
+        readonly settings: readonly ["read", "update"];
+        readonly organization: readonly ["update", "delete"];
+        readonly member: readonly ["create", "update", "delete"];
+        readonly invitation: readonly ["create", "cancel"];
+        readonly team: readonly ["create", "update", "delete"];
+        readonly ac: readonly ["create", "read", "update", "delete"];
+    };
+};
+export declare const roles: {
+    owner: import("better-auth/plugins").Role<import("better-auth/plugins").ExactRoleStatements<{
+        readonly organization: readonly ["update", "delete"];
+        readonly member: readonly ["create", "update", "delete"];
+        readonly invitation: readonly ["create", "cancel"];
+        readonly team: readonly ["create", "update", "delete"];
+        readonly ac: readonly ["create", "read", "update", "delete"];
+        readonly operator: ["create", "read", "update", "delete"];
+        readonly connection: ["create", "read", "update", "delete"];
+        readonly oauthClient: ["create", "read", "revoke"];
+        readonly apiKey: ["create", "read", "update", "delete"];
+        readonly operatorGrant: ["create", "read", "update", "delete"];
+        readonly auditLog: ["read"];
+        readonly settings: ["read", "update"];
+    }>, {
+        readonly operator: readonly ["create", "read", "update", "delete"];
+        readonly connection: readonly ["create", "read", "update", "delete"];
+        readonly oauthClient: readonly ["create", "read", "revoke"];
+        readonly apiKey: readonly ["create", "read", "update", "delete"];
+        readonly operatorGrant: readonly ["create", "read", "update", "delete"];
+        readonly auditLog: readonly ["read"];
+        readonly settings: readonly ["read", "update"];
+        readonly organization: readonly ["update", "delete"];
+        readonly member: readonly ["create", "update", "delete"];
+        readonly invitation: readonly ["create", "cancel"];
+        readonly team: readonly ["create", "update", "delete"];
+        readonly ac: readonly ["create", "read", "update", "delete"];
+    }>;
+    admin: import("better-auth/plugins").Role<import("better-auth/plugins").ExactRoleStatements<{
+        readonly organization: readonly ["update"];
+        readonly invitation: readonly ["create", "cancel"];
+        readonly member: readonly ["create", "update", "delete"];
+        readonly team: readonly ["create", "update", "delete"];
+        readonly ac: readonly ["create", "read", "update", "delete"];
+        readonly operator: ["create", "read", "update"];
+        readonly connection: ["create", "read", "update", "delete"];
+        readonly oauthClient: ["create", "read", "revoke"];
+        readonly apiKey: ["create", "read", "update", "delete"];
+        readonly operatorGrant: ["create", "read", "update"];
+        readonly auditLog: ["read"];
+        readonly settings: ["read"];
+    }>, {
+        readonly operator: readonly ["create", "read", "update", "delete"];
+        readonly connection: readonly ["create", "read", "update", "delete"];
+        readonly oauthClient: readonly ["create", "read", "revoke"];
+        readonly apiKey: readonly ["create", "read", "update", "delete"];
+        readonly operatorGrant: readonly ["create", "read", "update", "delete"];
+        readonly auditLog: readonly ["read"];
+        readonly settings: readonly ["read", "update"];
+        readonly organization: readonly ["update", "delete"];
+        readonly member: readonly ["create", "update", "delete"];
+        readonly invitation: readonly ["create", "cancel"];
+        readonly team: readonly ["create", "update", "delete"];
+        readonly ac: readonly ["create", "read", "update", "delete"];
+    }>;
+    member: import("better-auth/plugins").Role<import("better-auth/plugins").ExactRoleStatements<{
+        readonly organization: readonly [];
+        readonly member: readonly [];
+        readonly invitation: readonly [];
+        readonly team: readonly [];
+        readonly ac: readonly ["read"];
+        readonly operator: ["read"];
+        readonly connection: ["read"];
+        readonly oauthClient: ["read"];
+        readonly apiKey: ["read"];
+        readonly operatorGrant: ["read"];
+        readonly auditLog: ["read"];
+        readonly settings: ["read"];
+    }>, {
+        readonly operator: readonly ["create", "read", "update", "delete"];
+        readonly connection: readonly ["create", "read", "update", "delete"];
+        readonly oauthClient: readonly ["create", "read", "revoke"];
+        readonly apiKey: readonly ["create", "read", "update", "delete"];
+        readonly operatorGrant: readonly ["create", "read", "update", "delete"];
+        readonly auditLog: readonly ["read"];
+        readonly settings: readonly ["read", "update"];
+        readonly organization: readonly ["update", "delete"];
+        readonly member: readonly ["create", "update", "delete"];
+        readonly invitation: readonly ["create", "cancel"];
+        readonly team: readonly ["create", "update", "delete"];
+        readonly ac: readonly ["create", "read", "update", "delete"];
+    }>;
+};
+//# sourceMappingURL=permissions.d.ts.map

package/dist/permissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../src/permissions.ts"],"names":[],"mappings":"AAQA,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;CASnB,CAAA;AAEV,eAAO,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAAwC,CAAA;AAEvD,eAAO,MAAM,KAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+BjB,CAAA"}

package/dist/permissions.js

@@ -0,0 +1,46 @@
+import { createAccessControl } from "better-auth/plugins/access";
+import { adminAc, defaultStatements, memberAc, ownerAc, } from "better-auth/plugins/organization/access";
+export const voyantStatements = {
+    ...defaultStatements,
+    operator: ["create", "read", "update", "delete"],
+    connection: ["create", "read", "update", "delete"],
+    oauthClient: ["create", "read", "revoke"],
+    apiKey: ["create", "read", "update", "delete"],
+    operatorGrant: ["create", "read", "update", "delete"],
+    auditLog: ["read"],
+    settings: ["read", "update"],
+};
+export const ac = createAccessControl(voyantStatements);
+export const roles = {
+    owner: ac.newRole({
+        operator: ["create", "read", "update", "delete"],
+        connection: ["create", "read", "update", "delete"],
+        oauthClient: ["create", "read", "revoke"],
+        apiKey: ["create", "read", "update", "delete"],
+        operatorGrant: ["create", "read", "update", "delete"],
+        auditLog: ["read"],
+        settings: ["read", "update"],
+        ...ownerAc.statements,
+    }),
+    admin: ac.newRole({
+        operator: ["create", "read", "update"],
+        connection: ["create", "read", "update", "delete"],
+        oauthClient: ["create", "read", "revoke"],
+        apiKey: ["create", "read", "update", "delete"],
+        operatorGrant: ["create", "read", "update"],
+        auditLog: ["read"],
+        settings: ["read"],
+        ...adminAc.statements,
+    }),
+    member: ac.newRole({
+        operator: ["read"],
+        connection: ["read"],
+        oauthClient: ["read"],
+        apiKey: ["read"],
+        operatorGrant: ["read"],
+        auditLog: ["read"],
+        settings: ["read"],
+        ...memberAc.statements,
+    }),
+};
+//# sourceMappingURL=permissions.js.map

package/dist/permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../src/permissions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAChE,OAAO,EACL,OAAO,EACP,iBAAiB,EACjB,QAAQ,EACR,OAAO,GACR,MAAM,yCAAyC,CAAA;AAEhD,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,GAAG,iBAAiB;IACpB,QAAQ,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC;IAChD,UAAU,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC;IAClD,WAAW,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;IACzC,MAAM,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC;IAC9C,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC;IACrD,QAAQ,EAAE,CAAC,MAAM,CAAC;IAClB,QAAQ,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;CACpB,CAAA;AAEV,MAAM,CAAC,MAAM,EAAE,GAAG,mBAAmB,CAAC,gBAAgB,CAAC,CAAA;AAEvD,MAAM,CAAC,MAAM,KAAK,GAAG;IACnB,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC;QAChB,QAAQ,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC;QAChD,UAAU,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC;QAClD,WAAW,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;QACzC,MAAM,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC;QAC9C,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC;QACrD,QAAQ,EAAE,CAAC,MAAM,CAAC;QAClB,QAAQ,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;QAC5B,GAAG,OAAO,CAAC,UAAU;KACtB,CAAC;IACF,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC;QAChB,QAAQ,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;QACtC,UAAU,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC;QAClD,WAAW,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;QACzC,MAAM,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC;QAC9C,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;QAC3C,QAAQ,EAAE,CAAC,MAAM,CAAC;QAClB,QAAQ,EAAE,CAAC,MAAM,CAAC;QAClB,GAAG,OAAO,CAAC,UAAU;KACtB,CAAC;IACF,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC;QACjB,QAAQ,EAAE,CAAC,MAAM,CAAC;QAClB,UAAU,EAAE,CAAC,MAAM,CAAC;QACpB,WAAW,EAAE,CAAC,MAAM,CAAC;QACrB,MAAM,EAAE,CAAC,MAAM,CAAC;QAChB,aAAa,EAAE,CAAC,MAAM,CAAC;QACvB,QAAQ,EAAE,CAAC,MAAM,CAAC;QAClB,QAAQ,EAAE,CAAC,MAAM,CAAC;QAClB,GAAG,QAAQ,CAAC,UAAU;KACvB,CAAC;CACH,CAAA"}

package/dist/server.d.ts

@@ -0,0 +1,106 @@
+import { apiKey } from "@better-auth/api-key";
+import { getDb } from "@voyant-travel/db";
+import { type BetterAuthOptions } from "better-auth";
+import { emailOTP } from "better-auth/plugins";
+import type { BetterAuthPlugin } from "better-auth/types";
+import type { AnyPgTable } from "drizzle-orm/pg-core";
+export declare function getAuthSecret(): string;
+export type { AccountProfileUpdateHandler, ApiTokenRotationStore, BetterAuthApiTokenManagement, HandleAccountProfileRequestOptions, HandleApiTokenManagementRequestOptions, } from "./auth-facades.js";
+export { handleAccountProfileRequest, handleApiTokenManagementRequest } from "./auth-facades.js";
+type DefinedBetterAuthUserOptions<UserOptions extends BetterAuthOptions["user"]> = UserOptions extends undefined ? Record<PropertyKey, never> : NonNullable<UserOptions>;
+type ResolvedBetterAuthChangeEmail<UserOptions extends BetterAuthOptions["user"]> = DefinedBetterAuthUserOptions<UserOptions> extends {
+    changeEmail?: infer ChangeEmail;
+} ? ChangeEmail extends {
+    enabled: infer Enabled;
+} ? Omit<ChangeEmail, "enabled"> & {
+    enabled: Enabled;
+} : NonNullable<ChangeEmail> & {
+    enabled: true;
+} : {
+    enabled: true;
+};
+type ResolvedBetterAuthUserOptions<UserOptions extends BetterAuthOptions["user"]> = Omit<DefinedBetterAuthUserOptions<UserOptions>, "changeEmail"> & {
+    changeEmail: ResolvedBetterAuthChangeEmail<UserOptions>;
+};
+type VoyantBetterAuthPlugins = [ReturnType<typeof apiKey>, ReturnType<typeof emailOTP>];
+type ResolvedBetterAuthPlugins<Plugins extends BetterAuthPlugin[] | undefined> = Plugins extends BetterAuthPlugin[] ? [...VoyantBetterAuthPlugins, ...Plugins] : VoyantBetterAuthPlugins;
+export interface DisableSignupWhenUsersExistOptions {
+    /**
+     * Set to false when the consuming app owns all signup admission checks.
+     *
+     * Defaults to true.
+     */
+    enabled?: boolean;
+    /**
+     * User surfaces that should keep the single-tenant signup guard. New users
+     * with only other explicit surfaces can still be created by customer-facing
+     * auth plugins such as phone OTP.
+     *
+     * Defaults to ["admin"]. Users without an explicit surfaces array are
+     * treated as admin users for backward compatibility.
+     */
+    surfaces?: readonly string[];
+}
+type ResolvedCreateBetterAuthOptions<UserOptions extends BetterAuthOptions["user"], Plugins extends BetterAuthPlugin[] | undefined> = Omit<BetterAuthOptions, "plugins" | "user"> & {
+    plugins: ResolvedBetterAuthPlugins<Plugins>;
+    user: ResolvedBetterAuthUserOptions<UserOptions>;
+};
+export type BetterAuthDrizzleSchema = Record<string, AnyPgTable>;
+export interface CreateBetterAuthOptions<UserOptions extends BetterAuthOptions["user"] = BetterAuthOptions["user"], Plugins extends BetterAuthPlugin[] | undefined = BetterAuthPlugin[] | undefined> {
+    db?: ReturnType<typeof getDb>;
+    secret?: string;
+    baseURL?: string;
+    basePath?: string;
+    trustedOrigins?: string[];
+    /**
+     * Additional Drizzle tables for Better Auth plugins. The consuming app owns
+     * matching migrations for every table passed here.
+     */
+    extraSchema?: BetterAuthDrizzleSchema;
+    plugins?: Plugins;
+    user?: UserOptions;
+    disableSignupWhenUsersExist?: DisableSignupWhenUsersExistOptions;
+    /** Called when a user requests a password reset. If not provided, logs to console. */
+    sendResetPassword?: (data: {
+        user: {
+            email: string;
+            name: string;
+        };
+        url: string;
+        token: string;
+    }) => Promise<void>;
+    /** Called to send a verification OTP. If not provided, logs to console. */
+    sendVerificationOTP?: (data: {
+        email: string;
+        otp: string;
+        type: string;
+    }) => Promise<void>;
+    /**
+     * Better Auth session cookie cache: session data rides in a short-lived
+     * signed cookie so `getSession` skips the Postgres lookup on most
+     * requests. Enabled by default with a 5-minute TTL — the trade-off is
+     * that a revoked/expired session can stay usable for up to `maxAge`
+     * seconds. Pass `false` for revocation-sensitive deployments, or tune
+     * `maxAge` (seconds).
+     */
+    sessionCookieCache?: false | {
+        maxAge?: number;
+    };
+    /** Better Auth secondary storage, typically Redis/KV, used for distributed rate limits. */
+    secondaryStorage?: BetterAuthOptions["secondaryStorage"];
+    /** Better Auth rate-limit config. Defaults to secondary storage when present. */
+    rateLimit?: BetterAuthOptions["rateLimit"];
+    /**
+     * Controls Better Auth's Secure cookie flag. Defaults to secure except in
+     * explicit local development (`NODE_ENV=development`).
+     */
+    useSecureCookies?: boolean;
+}
+/**
+ * Framework-agnostic Better Auth factory.
+ *
+ * Accepts optional overrides for db, secret, baseURL, trustedOrigins.
+ * Does NOT depend on Next.js — safe to use in Hono workers, TanStack Start, etc.
+ */
+export declare function createBetterAuth<const UserOptions extends BetterAuthOptions["user"] = undefined, const Plugins extends BetterAuthPlugin[] | undefined = undefined>(options?: CreateBetterAuthOptions<UserOptions, Plugins>): import("better-auth").Auth<ResolvedCreateBetterAuthOptions<UserOptions, Plugins>>;
+//# sourceMappingURL=server.d.ts.map

package/dist/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAC7C,OAAO,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAA;AAQzC,OAAO,EAAE,KAAK,iBAAiB,EAAc,MAAM,aAAa,CAAA;AAEhE,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAA;AAC9C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAEzD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAKrD,wBAAgB,aAAa,IAAI,MAAM,CAQtC;AAED,YAAY,EACV,2BAA2B,EAC3B,qBAAqB,EACrB,4BAA4B,EAC5B,kCAAkC,EAClC,sCAAsC,GACvC,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAAE,2BAA2B,EAAE,+BAA+B,EAAE,MAAM,mBAAmB,CAAA;AAEhG,KAAK,4BAA4B,CAAC,WAAW,SAAS,iBAAiB,CAAC,MAAM,CAAC,IAC7E,WAAW,SAAS,SAAS,GAAG,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,GAAG,WAAW,CAAC,WAAW,CAAC,CAAA;AAEvF,KAAK,6BAA6B,CAAC,WAAW,SAAS,iBAAiB,CAAC,MAAM,CAAC,IAC9E,4BAA4B,CAAC,WAAW,CAAC,SAAS;IAAE,WAAW,CAAC,EAAE,MAAM,WAAW,CAAA;CAAE,GACjF,WAAW,SAAS;IAAE,OAAO,EAAE,MAAM,OAAO,CAAA;CAAE,GAC5C,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,GAAG;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,GACnD,WAAW,CAAC,WAAW,CAAC,GAAG;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,GAC9C;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,CAAA;AAEvB,KAAK,6BAA6B,CAAC,WAAW,SAAS,iBAAiB,CAAC,MAAM,CAAC,IAAI,IAAI,CACtF,4BAA4B,CAAC,WAAW,CAAC,EACzC,aAAa,CACd,GAAG;IACF,WAAW,EAAE,6BAA6B,CAAC,WAAW,CAAC,CAAA;CACxD,CAAA;AAED,KAAK,uBAAuB,GAAG,CAAC,UAAU,CAAC,OAAO,MAAM,CAAC,EAAE,UAAU,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAA;AAEvF,KAAK,yBAAyB,CAAC,OAAO,SAAS,gBAAgB,EAAE,GAAG,SAAS,IAC3E,OAAO,SAAS,gBAAgB,EAAE,GAC9B,CAAC,GAAG,uBAAuB,EAAE,GAAG,OAAO,CAAC,GACxC,uBAAuB,CAAA;AAI7B,MAAM,WAAW,kCAAkC;IACjD;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAC7B;AAuCD,KAAK,+BAA+B,CAClC,WAAW,SAAS,iBAAiB,CAAC,MAAM,CAAC,EAC7C,OAAO,SAAS,gBAAgB,EAAE,GAAG,SAAS,IAC5C,IAAI,CAAC,iBAAiB,EAAE,SAAS,GAAG,MAAM,CAAC,GAAG;IAChD,OAAO,EAAE,yBAAyB,CAAC,OAAO,CAAC,CAAA;IAC3C,IAAI,EAAE,6BAA6B,CAAC,WAAW,CAAC,CAAA;CACjD,CAAA;AAED,MAAM,MAAM,uBAAuB,GAAG,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;AAEhE,MAAM,WAAW,uBAAuB,CACtC,WAAW,SAAS,iBAAiB,CAAC,MAAM,CAAC,GAAG,iBAAiB,CAAC,MAAM,CAAC,EACzE,OAAO,SAAS,gBAAgB,EAAE,GAAG,SAAS,GAAG,gBAAgB,EAAE,GAAG,SAAS;IAE/E,EAAE,CAAC,EAAE,UAAU,CAAC,OAAO,KAAK,CAAC,CAAA;IAC7B,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IACzB;;;OAGG;IACH,WAAW,CAAC,EAAE,uBAAuB,CAAA;IACrC,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,IAAI,CAAC,EAAE,WAAW,CAAA;IAClB,2BAA2B,CAAC,EAAE,kCAAkC,CAAA;IAChE,sFAAsF;IACtF,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE;QACzB,IAAI,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAA;QACrC,GAAG,EAAE,MAAM,CAAA;QACX,KAAK,EAAE,MAAM,CAAA;KACd,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB,2EAA2E;IAC3E,mBAAmB,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IAC3F;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,KAAK,GAAG;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IAChD,2FAA2F;IAC3F,gBAAgB,CAAC,EAAE,iBAAiB,CAAC,kBAAkB,CAAC,CAAA;IACxD,iFAAiF;IACjF,SAAS,CAAC,EAAE,iBAAiB,CAAC,WAAW,CAAC,CAAA;IAC1C;;;OAGG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAA;CAC3B;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,CAAC,WAAW,SAAS,iBAAiB,CAAC,MAAM,CAAC,GAAG,SAAS,EAC/D,KAAK,CAAC,OAAO,SAAS,gBAAgB,EAAE,GAAG,SAAS,GAAG,SAAS,EAChE,OAAO,GAAE,uBAAuB,CAAC,WAAW,EAAE,OAAO,CAAM,qFAgK5D"}

package/dist/server.js

@@ -0,0 +1,193 @@
+import { apiKey } from "@better-auth/api-key";
+import { getDb } from "@voyant-travel/db";
+import { apikeyTable, authAccount, authSession, authUser, authVerification, } from "@voyant-travel/db/schema/iam";
+import { betterAuth } from "better-auth";
+import { drizzleAdapter } from "better-auth/adapters/drizzle";
+import { emailOTP } from "better-auth/plugins";
+import { sql } from "drizzle-orm";
+import { expandTrustedOrigins, getTrustedOrigins } from "./trusted-origins.js";
+import { isFirstAuthUser, provisionCurrentUserProfile } from "./workspace.js";
+export function getAuthSecret() {
+    const secret = process.env.BETTER_AUTH_SECRET || "";
+    if (!secret || secret.length < 32) {
+        throw new Error("Missing BETTER_AUTH_SECRET with at least 32 characters");
+    }
+    return secret;
+}
+export { handleAccountProfileRequest, handleApiTokenManagementRequest } from "./auth-facades.js";
+const DEFAULT_SIGNUP_BLOCK_SURFACES = ["admin"];
+function normalizeSignupBlockSurfaces(options) {
+    return options?.surfaces ?? DEFAULT_SIGNUP_BLOCK_SURFACES;
+}
+function isSignupBlockEnabled(options) {
+    return options?.enabled !== false;
+}
+function signupBlockAppliesToUser(user, blockedSurfaces) {
+    if (blockedSurfaces.length === 0)
+        return false;
+    const surfaces = user?.surfaces;
+    if (Array.isArray(surfaces)) {
+        const explicitSurfaces = surfaces.filter((surface) => typeof surface === "string" && surface.trim().length > 0);
+        if (explicitSurfaces.length > 0) {
+            return explicitSurfaces.some((surface) => blockedSurfaces.includes(surface.trim()));
+        }
+    }
+    if (typeof surfaces === "string" && surfaces.trim().length > 0) {
+        return blockedSurfaces.includes(surfaces.trim());
+    }
+    return blockedSurfaces.includes("admin");
+}
+/**
+ * Framework-agnostic Better Auth factory.
+ *
+ * Accepts optional overrides for db, secret, baseURL, trustedOrigins.
+ * Does NOT depend on Next.js — safe to use in Hono workers, TanStack Start, etc.
+ */
+export function createBetterAuth(options = {}) {
+    const db = options.db ?? getDb("edge");
+    const secret = options.secret ?? getAuthSecret();
+    const baseURL = options.baseURL ??
+        process.env.BETTER_AUTH_URL ??
+        process.env.APP_URL ??
+        process.env.NEXT_PUBLIC_APP_URL ??
+        "http://localhost:3000";
+    const trustedOrigins = expandTrustedOrigins(options.trustedOrigins ?? getTrustedOrigins(), baseURL);
+    const extraPlugins = options.plugins ?? [];
+    const signupBlockSurfaces = normalizeSignupBlockSurfaces(options.disableSignupWhenUsersExist);
+    const signupBlockEnabled = isSignupBlockEnabled(options.disableSignupWhenUsersExist);
+    const schema = {
+        user: authUser,
+        session: authSession,
+        account: authAccount,
+        verification: authVerification,
+        apikey: apikeyTable,
+        ...(options.extraSchema ?? {}),
+    };
+    const rateLimit = options.rateLimit ??
+        (options.secondaryStorage
+            ? {
+                enabled: true,
+                window: 60,
+                max: 100,
+                storage: "secondary-storage",
+            }
+            : undefined);
+    const authOptions = {
+        appName: "Voyant",
+        baseURL,
+        ...(options.basePath ? { basePath: options.basePath } : {}),
+        secret,
+        database: drizzleAdapter(db, {
+            provider: "pg",
+            schema,
+        }),
+        ...(options.secondaryStorage ? { secondaryStorage: options.secondaryStorage } : {}),
+        ...(rateLimit ? { rateLimit } : {}),
+        ...(options.sessionCookieCache === false
+            ? {}
+            : {
+                session: {
+                    cookieCache: {
+                        enabled: true,
+                        // Caps how long a revoked session stays usable from the
+                        // cookie alone; within the window getSession answers from
+                        // the signed cookie with zero DB roundtrips.
+                        maxAge: options.sessionCookieCache?.maxAge ?? 300,
+                    },
+                },
+            }),
+        emailAndPassword: {
+            enabled: true,
+            minPasswordLength: 8,
+            maxPasswordLength: 128,
+            requireEmailVerification: true,
+            revokeSessionsOnPasswordReset: true,
+            // eslint-disable-next-line @typescript-eslint/require-await -- owner: auth; existing suppression is intentional pending typed cleanup.
+            sendResetPassword: options.sendResetPassword ??
+                (async ({ user, url }) => {
+                    console.warn(`[Auth] No email provider configured — password reset for ${user.email}: ${url}`);
+                }),
+        },
+        emailVerification: {
+            sendOnSignUp: false, // OTP plugin handles this
+            autoSignInAfterVerification: true,
+        },
+        user: {
+            ...options.user,
+            changeEmail: {
+                enabled: true,
+                ...options.user?.changeEmail,
+            },
+        },
+        socialProviders: {
+            google: {
+                clientId: process.env.GOOGLE_CLIENT_ID || "",
+                clientSecret: process.env.GOOGLE_CLIENT_SECRET || "",
+                enabled: Boolean(process.env.GOOGLE_CLIENT_ID && process.env.GOOGLE_CLIENT_SECRET),
+            },
+        },
+        trustedOrigins,
+        plugins: [
+            apiKey({
+                defaultPrefix: "voy_",
+                apiKeyHeaders: ["authorization"],
+                requireName: true,
+                keyExpiration: {
+                    defaultExpiresIn: null,
+                },
+            }),
+            emailOTP({
+                // eslint-disable-next-line @typescript-eslint/require-await -- owner: auth; existing suppression is intentional pending typed cleanup.
+                sendVerificationOTP: options.sendVerificationOTP ??
+                    (async ({ email, otp, type }) => {
+                        console.warn(`[Auth] OTP for ${email}: ${otp} (${type})`);
+                    }),
+                otpLength: 6,
+                expiresIn: 600,
+                sendVerificationOnSignUp: true,
+                changeEmail: {
+                    enabled: true,
+                },
+            }),
+            ...extraPlugins,
+        ],
+        databaseHooks: {
+            user: {
+                create: {
+                    // Single-tenant: once a user exists, reject any new-user creation.
+                    // Covers email sign-up AND social-provider sign-up (Google would
+                    // otherwise auto-create a user on first OAuth callback). Existing
+                    // social sign-ins still work because this hook only fires on CREATE.
+                    // Seed scripts do raw drizzle inserts, so they bypass this hook —
+                    // which is intentional.
+                    before: async (user) => {
+                        if (!signupBlockEnabled ||
+                            !signupBlockAppliesToUser(user, signupBlockSurfaces)) {
+                            return;
+                        }
+                        const [row] = await db.select({ count: sql `count(*)::int` }).from(authUser);
+                        if ((row?.count ?? 0) > 0) {
+                            throw new Error("Sign-up is disabled. Ask an admin to invite you.");
+                        }
+                    },
+                    after: async (user) => {
+                        // Single-tenant bootstrap: the very first user to register becomes
+                        // the super-admin. Runs atomically after the `user` row is
+                        // inserted, so a simple COUNT(*) = 1 check identifies them.
+                        await provisionCurrentUserProfile(db, {
+                            userId: user.id,
+                            name: user.name,
+                            image: user.image,
+                            isSuperAdmin: await isFirstAuthUser(db),
+                        });
+                    },
+                },
+            },
+        },
+        advanced: {
+            useSecureCookies: options.useSecureCookies ?? process.env.NODE_ENV !== "development",
+        },
+    };
+    return betterAuth(authOptions);
+}
+//# sourceMappingURL=server.js.map

package/dist/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAC7C,OAAO,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAA;AACzC,OAAO,EACL,WAAW,EACX,WAAW,EACX,WAAW,EACX,QAAQ,EACR,gBAAgB,GACjB,MAAM,8BAA8B,CAAA;AACrC,OAAO,EAA0B,UAAU,EAAE,MAAM,aAAa,CAAA;AAChE,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAC7D,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAA;AAE9C,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAA;AAGjC,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AAC9E,OAAO,EAAE,eAAe,EAAE,2BAA2B,EAAE,MAAM,gBAAgB,CAAA;AAE7E,MAAM,UAAU,aAAa;IAC3B,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,EAAE,CAAA;IAEnD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAA;IAC3E,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AASD,OAAO,EAAE,2BAA2B,EAAE,+BAA+B,EAAE,MAAM,mBAAmB,CAAA;AA0BhG,MAAM,6BAA6B,GAAG,CAAC,OAAO,CAAU,CAAA;AAwBxD,SAAS,4BAA4B,CACnC,OAAuD;IAEvD,OAAO,OAAO,EAAE,QAAQ,IAAI,6BAA6B,CAAA;AAC3D,CAAC;AAED,SAAS,oBAAoB,CAAC,OAAuD;IACnF,OAAO,OAAO,EAAE,OAAO,KAAK,KAAK,CAAA;AACnC,CAAC;AAED,SAAS,wBAAwB,CAC/B,IAAwC,EACxC,eAAkC;IAElC,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IAE9C,MAAM,QAAQ,GAAG,IAAI,EAAE,QAAQ,CAAA;IAC/B,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,MAAM,gBAAgB,GAAG,QAAQ,CAAC,MAAM,CACtC,CAAC,OAAO,EAAqB,EAAE,CAAC,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CACzF,CAAA;QACD,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChC,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;QACrF,CAAC;IACH,CAAC;IAED,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/D,OAAO,eAAe,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAA;IAClD,CAAC;IAED,OAAO,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;AAC1C,CAAC;AAyDD;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAG9B,UAAyD,EAAE;IAC3D,MAAM,EAAE,GAAG,OAAO,CAAC,EAAE,IAAI,KAAK,CAAC,MAAM,CAAC,CAAA;IACtC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,aAAa,EAAE,CAAA;IAChD,MAAM,OAAO,GACX,OAAO,CAAC,OAAO;QACf,OAAO,CAAC,GAAG,CAAC,eAAe;QAC3B,OAAO,CAAC,GAAG,CAAC,OAAO;QACnB,OAAO,CAAC,GAAG,CAAC,mBAAmB;QAC/B,uBAAuB,CAAA;IACzB,MAAM,cAAc,GAAG,oBAAoB,CACzC,OAAO,CAAC,cAAc,IAAI,iBAAiB,EAAE,EAC7C,OAAO,CACR,CAAA;IACD,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAA;IAC1C,MAAM,mBAAmB,GAAG,4BAA4B,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAA;IAC7F,MAAM,kBAAkB,GAAG,oBAAoB,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAA;IACpF,MAAM,MAAM,GAAG;QACb,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,WAAW;QACpB,OAAO,EAAE,WAAW;QACpB,YAAY,EAAE,gBAAgB;QAC9B,MAAM,EAAE,WAAW;QACnB,GAAG,CAAC,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC;KACG,CAAA;IACnC,MAAM,SAAS,GACb,OAAO,CAAC,SAAS;QACjB,CAAC,OAAO,CAAC,gBAAgB;YACvB,CAAC,CAAE;gBACC,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,EAAE;gBACV,GAAG,EAAE,GAAG;gBACR,OAAO,EAAE,mBAAmB;aACM;YACtC,CAAC,CAAC,SAAS,CAAC,CAAA;IAEhB,MAAM,WAAW,GAAG;QAClB,OAAO,EAAE,QAAQ;QACjB,OAAO;QACP,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,MAAM;QACN,QAAQ,EAAE,cAAc,CAAC,EAAE,EAAE;YAC3B,QAAQ,EAAE,IAAI;YACd,MAAM;SACP,CAAC;QACF,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnF,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,GAAG,CAAC,OAAO,CAAC,kBAAkB,KAAK,KAAK;YACtC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE,OAAO,EAAE;oBACP,WAAW,EAAE;wBACX,OAAO,EAAE,IAAI;wBACb,wDAAwD;wBACxD,0DAA0D;wBAC1D,6CAA6C;wBAC7C,MAAM,EAAE,OAAO,CAAC,kBAAkB,EAAE,MAAM,IAAI,GAAG;qBAClD;iBACF;aACF,CAAC;QACN,gBAAgB,EAAE;YAChB,OAAO,EAAE,IAAI;YACb,iBAAiB,EAAE,CAAC;YACpB,iBAAiB,EAAE,GAAG;YACtB,wBAAwB,EAAE,IAAI;YAC9B,6BAA6B,EAAE,IAAI;YACnC,uIAAuI;YACvI,iBAAiB,EACf,OAAO,CAAC,iBAAiB;gBACzB,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE;oBACvB,OAAO,CAAC,IAAI,CACV,4DAA4D,IAAI,CAAC,KAAK,KAAK,GAAG,EAAE,CACjF,CAAA;gBACH,CAAC,CAAC;SACL;QACD,iBAAiB,EAAE;YACjB,YAAY,EAAE,KAAK,EAAE,0BAA0B;YAC/C,2BAA2B,EAAE,IAAI;SAClC;QACD,IAAI,EAAE;YACJ,GAAG,OAAO,CAAC,IAAI;YACf,WAAW,EAAE;gBACX,OAAO,EAAE,IAAI;gBACb,GAAG,OAAO,CAAC,IAAI,EAAE,WAAW;aAC7B;SAC4C;QAC/C,eAAe,EAAE;YACf,MAAM,EAAE;gBACN,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,EAAE;gBAC5C,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,EAAE;gBACpD,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;aACnF;SACF;QACD,cAAc;QACd,OAAO,EAAE;YACP,MAAM,CAAC;gBACL,aAAa,EAAE,MAAM;gBACrB,aAAa,EAAE,CAAC,eAAe,CAAC;gBAChC,WAAW,EAAE,IAAI;gBACjB,aAAa,EAAE;oBACb,gBAAgB,EAAE,IAAI;iBACvB;aACF,CAAC;YACF,QAAQ,CAAC;gBACP,uIAAuI;gBACvI,mBAAmB,EACjB,OAAO,CAAC,mBAAmB;oBAC3B,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE;wBAC9B,OAAO,CAAC,IAAI,CAAC,kBAAkB,KAAK,KAAK,GAAG,KAAK,IAAI,GAAG,CAAC,CAAA;oBAC3D,CAAC,CAAC;gBACJ,SAAS,EAAE,CAAC;gBACZ,SAAS,EAAE,GAAG;gBACd,wBAAwB,EAAE,IAAI;gBAC9B,WAAW,EAAE;oBACX,OAAO,EAAE,IAAI;iBACd;aACF,CAAC;YACF,GAAG,YAAY;SACsB;QACvC,aAAa,EAAE;YACb,IAAI,EAAE;gBACJ,MAAM,EAAE;oBACN,mEAAmE;oBACnE,iEAAiE;oBACjE,kEAAkE;oBAClE,qEAAqE;oBACrE,kEAAkE;oBAClE,wBAAwB;oBACxB,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;wBACrB,IACE,CAAC,kBAAkB;4BACnB,CAAC,wBAAwB,CAAC,IAA8B,EAAE,mBAAmB,CAAC,EAC9E,CAAC;4BACD,OAAM;wBACR,CAAC;wBAED,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,GAAG,CAAQ,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;wBACnF,IAAI,CAAC,GAAG,EAAE,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;4BAC1B,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAA;wBACrE,CAAC;oBACH,CAAC;oBACD,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;wBACpB,mEAAmE;wBACnE,2DAA2D;wBAC3D,4DAA4D;wBAC5D,MAAM,2BAA2B,CAAC,EAAE,EAAE;4BACpC,MAAM,EAAE,IAAI,CAAC,EAAE;4BACf,IAAI,EAAE,IAAI,CAAC,IAAI;4BACf,KAAK,EAAE,IAAI,CAAC,KAAK;4BACjB,YAAY,EAAE,MAAM,eAAe,CAAC,EAAE,CAAC;yBACxC,CAAC,CAAA;oBACJ,CAAC;iBACF;aACF;SACF;QACD,QAAQ,EAAE;YACR,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,aAAa;SACrF;KACuD,CAAA;IAE1D,OAAO,UAAU,CAAwD,WAAW,CAAC,CAAA;AACvF,CAAC"}

package/dist/trusted-origins.d.ts

@@ -0,0 +1,9 @@
+export declare function getTrustedOrigins(): string[];
+/**
+ * If the app is running against a localhost baseURL (dev), allow any localhost
+ * origin/port so second dev servers (e.g. Vite on :3301 hitting API on :3200)
+ * aren't rejected by Better Auth's origin check. Production origins are
+ * unaffected - the wildcards are only added when we already see localhost.
+ */
+export declare function expandTrustedOrigins(origins: string[], baseURL: string): string[];
+//# sourceMappingURL=trusted-origins.d.ts.map

package/dist/trusted-origins.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trusted-origins.d.ts","sourceRoot":"","sources":["../src/trusted-origins.ts"],"names":[],"mappings":"AAAA,wBAAgB,iBAAiB,IAAI,MAAM,EAAE,CAW5C;AAqBD;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAGjF"}

package/dist/trusted-origins.js

@@ -0,0 +1,41 @@
+export function getTrustedOrigins() {
+    const values = [
+        process.env.BETTER_AUTH_URL,
+        process.env.APP_URL,
+        process.env.NEXT_PUBLIC_APP_URL,
+        process.env.VOYANT_DASHBOARD_URL,
+        process.env.NEXT_PUBLIC_SITE_URL,
+        process.env.ADMIN_URL,
+    ].filter((value) => typeof value === "string" && value.trim().length > 0);
+    return Array.from(new Set(values.map((value) => value.trim().replace(/\/$/, ""))));
+}
+const LOCAL_WILDCARDS = [
+    "http://localhost:*",
+    "http://127.0.0.1:*",
+    "https://localhost:*",
+    "https://127.0.0.1:*",
+];
+function hasLocalOrigin(origins, baseURL) {
+    const all = [...origins, baseURL];
+    return all.some((value) => {
+        try {
+            const { hostname } = new URL(value);
+            return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]";
+        }
+        catch {
+            return false;
+        }
+    });
+}
+/**
+ * If the app is running against a localhost baseURL (dev), allow any localhost
+ * origin/port so second dev servers (e.g. Vite on :3301 hitting API on :3200)
+ * aren't rejected by Better Auth's origin check. Production origins are
+ * unaffected - the wildcards are only added when we already see localhost.
+ */
+export function expandTrustedOrigins(origins, baseURL) {
+    if (!hasLocalOrigin(origins, baseURL))
+        return origins;
+    return Array.from(new Set([...origins, ...LOCAL_WILDCARDS]));
+}
+//# sourceMappingURL=trusted-origins.js.map

package/dist/trusted-origins.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trusted-origins.js","sourceRoot":"","sources":["../src/trusted-origins.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,iBAAiB;IAC/B,MAAM,MAAM,GAAG;QACb,OAAO,CAAC,GAAG,CAAC,eAAe;QAC3B,OAAO,CAAC,GAAG,CAAC,OAAO;QACnB,OAAO,CAAC,GAAG,CAAC,mBAAmB;QAC/B,OAAO,CAAC,GAAG,CAAC,oBAAoB;QAChC,OAAO,CAAC,GAAG,CAAC,oBAAoB;QAChC,OAAO,CAAC,GAAG,CAAC,SAAS;KACtB,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAE1F,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;AACpF,CAAC;AAED,MAAM,eAAe,GAAG;IACtB,oBAAoB;IACpB,oBAAoB;IACpB,qBAAqB;IACrB,qBAAqB;CACtB,CAAA;AAED,SAAS,cAAc,CAAC,OAAiB,EAAE,OAAe;IACxD,MAAM,GAAG,GAAG,CAAC,GAAG,OAAO,EAAE,OAAO,CAAC,CAAA;IACjC,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;QACxB,IAAI,CAAC;YACH,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAA;YACnC,OAAO,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,OAAO,CAAA;QACrF,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAiB,EAAE,OAAe;IACrE,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC;QAAE,OAAO,OAAO,CAAA;IACrD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,eAAe,CAAC,CAAC,CAAC,CAAA;AAC9D,CAAC"}