npm - @voyant-travel/auth - Versions diffs - 0.128.3 → 0.130.0 - Mend

@voyant-travel/auth 0.128.3 → 0.130.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (42) hide show

package/README.md +14 -0
package/dist/cloud-broker/members.d.ts +9 -0
package/dist/cloud-broker/members.js +10 -0
package/dist/cloud-broker/members.js.map +1 -1
package/dist/cloud-broker.d.ts +1 -1
package/dist/cloud-broker.js +1 -1
package/dist/cloud-broker.js.map +1 -1
package/dist/identity-access-graph-runtime.js +2 -1
package/dist/identity-access-graph-runtime.js.map +1 -1
package/dist/invitations-routes.js +4 -0
package/dist/invitations-routes.js.map +1 -1
package/dist/local-member-access.d.ts +15 -0
package/dist/local-member-access.js +119 -0
package/dist/local-member-access.js.map +1 -0
package/dist/node-runtime.d.ts +1 -0
package/dist/node-runtime.js +2 -7
package/dist/node-runtime.js.map +1 -1
package/dist/runtime-contributor.js +23 -2
package/dist/runtime-contributor.js.map +1 -1
package/dist/server.d.ts +10 -6
package/dist/server.js +6 -3
package/dist/server.js.map +1 -1
package/dist/team-management-cloud-adapter.d.ts +7 -0
package/dist/team-management-cloud-adapter.js +146 -0
package/dist/team-management-cloud-adapter.js.map +1 -0
package/dist/team-management-local-adapter.d.ts +8 -0
package/dist/team-management-local-adapter.js +285 -0
package/dist/team-management-local-adapter.js.map +1 -0
package/dist/team-management-policy.d.ts +27 -0
package/dist/team-management-policy.js +109 -0
package/dist/team-management-policy.js.map +1 -0
package/dist/team-management-runtime-port.d.ts +60 -0
package/dist/team-management-runtime-port.js +25 -0
package/dist/team-management-runtime-port.js.map +1 -0
package/dist/team-routes.d.ts +3 -3
package/dist/team-routes.js +89 -138
package/dist/team-routes.js.map +1 -1
package/dist/voyant.js +67 -3
package/dist/voyant.js.map +1 -1
package/openapi/admin/team.json +42 -74
package/package.json +10 -5
package/dist/tsconfig.typecheck.tsbuildinfo +0 -1

package/dist/node-runtime.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"node-runtime.js","sourceRoot":"","sources":["../src/node-runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAwB,gBAAgB,EAAE,MAAM,2BAA2B,CAAA;AAClF,OAAO,EACL,QAAQ,EACR,kBAAkB,EAElB,iBAAiB,GAClB,MAAM,8BAA8B,CAAA;AAErC,OAAO,EACL,cAAc,EACd,eAAe,EACf,SAAS,GACV,MAAM,+CAA+C,CAAA;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAA;AAEhE,OAAO,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAA;AACjE,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAA;AACrC,OAAO,EAAgB,IAAI,EAAE,MAAM,MAAM,CAAA;AACzC,OAAO,EACL,gCAAgC,EAChC,qCAAqC,EACrC,kCAAkC,GACnC,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,mCAAmC,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAA;AAClG,OAAO,EAEL,gBAAgB,EAChB,+BAA+B,EAC/B,gCAAgC,GACjC,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAA;AAmDzD,mFAAmF;AACnF,MAAM,UAAU,oCAAoC,CAClD,GAAoD;IAIpD,MAAM,MAAM,GAAG,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,CAAA;IAC7C,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAA;IAE7B,OAAO;QACL,qBAAqB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE;QAChD,uBAAuB,EAAE,EAAE,MAAM,EAAE;KACpC,CAAA;AACH,CAAC;AAuBD,MAAM,UAAU,6BAA6B,CAC3C,cAAyD;IAIzD,MAAM,YAAY,GAChB,cAAc,CAAC,YAAY;QAC3B,CAAC,CAAC,GAAQ,EAAE,EAAE;YACZ,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAA;YACtC,OAAO,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAc,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAA;QACnE,CAAC,CAAC,CAAA;IAEJ,MAAM,IAAI,GAAG,IAAI,IAAI,EAAe,CAAA;IACpC,iEAAiE;IACjE,+EAA+E;IAC/E,+EAA+E;IAC/E,oEAAoE;IACpE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;IACxB,oEAAoE;IACpE,4EAA4E;IAC5E,2EAA2E;IAC3E,4EAA4E;IAC5E,wEAAwE;IACxE,8EAA8E;IAC9E,yEAAyE;IACzE,kEAAkE;IAClE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QAC9B,MAAM,IAAI,EAAE,CAAA;QACZ,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;YACxB,eAAe,CAAC,cAAc,CAAC,QAAQ,EAAE,CAAC,EAAE;gBAC1C,SAAS,EAAE,YAAY,EAAE,IAAI,EAAE;gBAC/B,GAAG,EAAE,cAAc,CAAC,OAAO;gBAC3B,KAAK,EAAE,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;gBAC9D,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE;aAC3F,CAAC,CAAA;QACJ,CAAC;IACH,CAAC,CAAC,CAAA;IACF,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CACtB,cAAc,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,QAAQ,EAAE,cAAc,CAAC,QAAQ,EAAE,OAAO,EAAE,cAAc,CAAC,OAAO,EAAE,CAAC,CAC/F,CAAA;IAED,MAAM,eAAe,GAAG,uBAAuB,CAAA;IAC/C,MAAM,2BAA2B,GAAG,IAAI,GAAG,CAAC;QAC1C,mBAAmB;QACnB,YAAY;QACZ,eAAe;QACf,gBAAgB;QAChB,aAAa;KACd,CAAC,CAAA;IAEF,SAAS,uBAAuB,CAAC,GAAQ;QACvC,MAAM,IAAI,GAAG,GAAG,CAAC,sBAAsB,EAAE,IAAI,EAAE,IAAI,OAAO,CAAA;QAE1D,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;YAChD,OAAO,IAAI,CAAA;QACb,CAAC;QAED,OAAO,CAAC,KAAK,CACX,0CAA0C,IAAI,oCAAoC,CACnF,CAAA;QACD,OAAO,cAAc,CAAA;IACvB,CAAC;IAED,SAAS,qBAAqB,CAAC,GAAQ;QACrC,OAAO,uBAAuB,CAAC,GAAG,CAAC,KAAK,cAAc,CAAA;IACxD,CAAC;IAED,SAAS,6BAA6B,CAAC,OAAgB;QACrD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAChC,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,GAAG,CAAA;QACxD,OAAO,2BAA2B,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IAClD,CAAC;IAED,SAAS,yBAAyB,CAAC,CAAuB;QACxD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0DAA0D,EAAE,EAAE,GAAG,CAAC,CAAA;IAC3F,CAAC;IAED,SAAS,8BAA8B,CAAC,CAAuB;QAC7D,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gDAAgD,EAAE,EAAE,GAAG,CAAC,CAAA;IACjF,CAAC;IAED,SAAS,YAAY,CAAC,GAAW;QAC/B,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IACtC,CAAC;IAED,SAAS,SAAS,CAAC,GAAQ;QACzB,MAAM,UAAU,GAAG;YACjB,GAAG,CAAC,OAAO;YACX,GAAG,CAAC,aAAa;YACjB,GAAG,CAAC,cAAc,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACjC,eAAe;SAChB,CAAA;QAED,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACjE,OAAO,YAAY,CAAC,SAAS,CAAC,CAAA;YAChC,CAAC;QACH,CAAC;QAED,OAAO,eAAe,CAAA;IACxB,CAAC;IAED,SAAS,iBAAiB,CAAC,GAAQ;QACjC,OAAO,KAAK,CAAC,IAAI,CACf,IAAI,GAAG,CACL,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,aAAa,EAAE,GAAG,CAAC,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;aACvE,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC;aAC7B,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CACtD,CACF,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;IACrB,CAAC;IAED,SAAS,cAAc,CAAC,GAAQ;QAC9B,yEAAyE;QACzE,0EAA0E;QAC1E,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAA;QAC7B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAA;YAC9B,OAAO,GAAG,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,IAAI,EAAE,CAAA;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,MAAM,CAAA;QACf,CAAC;IACH,CAAC;IAED,SAAS,mBAAmB,CAAC,GAAQ;QACnC,MAAM,SAAS,GAAG,GAAG,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAA;QAC5F,MAAM,UAAU,GAAG,YAAY,CAAC,SAAS,CAAC,CAAA;QAE1C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAA;YAClC,IAAI,MAAM,CAAC,QAAQ,KAAK,GAAG,IAAI,MAAM,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;gBACtD,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAA;gBACxB,OAAO,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAA;YACxC,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,UAAU,CAAA;QACnB,CAAC;QAED,OAAO,UAAU,CAAA;IACnB,CAAC;IAED,SAAS,uBAAuB,CAAC,GAAQ;QACvC,MAAM,YAAY,GAAG,GAAG,CAAC,0BAA0B,EAAE,IAAI,EAAE,CAAA;QAC3D,MAAM,iBAAiB,GAAG,GAAG,CAAC,iCAAiC,EAAE,IAAI,EAAE,CAAA;QACvE,IAAI,CAAC,YAAY,IAAI,CAAC,iBAAiB;YAAE,OAAO,IAAI,CAAA;QAEpD,OAAO;YACL,iBAAiB;YACjB,YAAY;YACZ,gBAAgB,EAAE,GAAG,mBAAmB,CAAC,GAAG,CAAC,sBAAsB;YACnE,YAAY,EAAE,GAAG,CAAC,qBAAqB;YACvC,KAAK,EAAE,GAAG,CAAC,mBAAmB,EAAE,IAAI,EAAE,IAAI,SAAS;YACnD,WAAW,EAAE,GAAG,CAAC,wBAAwB,EAAE,IAAI,EAAE,IAAI,SAAS;SAC/D,CAAA;IACH,CAAC;IAED,SAAS,0BAA0B,CAAC,GAAQ;QAC1C,MAAM,YAAY,GAAG,GAAG,CAAC,0BAA0B,EAAE,IAAI,EAAE,CAAA;QAC3D,MAAM,WAAW,GAAG,GAAG,CAAC,oCAAoC,EAAE,IAAI,EAAE,CAAA;QACpE,MAAM,gBAAgB,GAAG,GAAG,CAAC,gCAAgC,EAAE,IAAI,EAAE,CAAA;QACrE,MAAM,WAAW,GAAG,GAAG,CAAC,oCAAoC,EAAE,IAAI,EAAE,CAAA;QACpE,IAAI,CAAC,YAAY,IAAI,CAAC,WAAW,IAAI,CAAC,gBAAgB,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,CAAA;QAEnF,OAAO;YACL,WAAW;YACX,YAAY;YACZ,WAAW;YACX,gBAAgB;YAChB,iBAAiB,EAAE,GAAG,CAAC,gCAAgC,EAAE,IAAI,EAAE,IAAI,YAAY;SAChF,CAAA;IACH,CAAC;IAED,SAAS,4BAA4B,CAAC,GAAQ;QAC5C,MAAM,YAAY,GAAG,GAAG,CAAC,0BAA0B,EAAE,IAAI,EAAE,CAAA;QAC3D,MAAM,aAAa,GAAG,GAAG,CAAC,sCAAsC,EAAE,IAAI,EAAE,CAAA;QACxE,MAAM,WAAW,GAAG,GAAG,CAAC,oCAAoC,EAAE,IAAI,EAAE,CAAA;QACpE,IAAI,CAAC,YAAY,IAAI,CAAC,aAAa,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,CAAA;QAEhE,OAAO;YACL,aAAa;YACb,YAAY;YACZ,WAAW;SACZ,CAAA;IACH,CAAC;IAED,SAAS,cAAc,CAAC,OAAgB;QACtC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAA;QAC9C,OAAO,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,WAAW,CAAA;IAC7D,CAAC;IAED,SAAS,oCAAoC,CAAC,GAAQ,EAAE,OAAgB;QACtE,OAAO,GAAG,CAAC,gCAAgC,KAAK,GAAG,IAAI,cAAc,CAAC,OAAO,CAAC,CAAA;IAChF,CAAC;IAED,SAAS,sBAAsB,CAAC,GAAQ;QACtC,OAAO,GAAG,CAAC,gCAAgC,KAAK,GAAG,CAAA;IACrD,CAAC;IAgBD,SAAS,eAAe,CAAC,GAAQ,EAAE,EAAY,EAAE,UAAkC,EAAE;QACnF,MAAM,WAAW,GAAG,cAAc,CAAC,kBAAkB,EAAE,CAAC,GAAG,CAAC,CAAA;QAC5D,MAAM,iBAAiB,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,0BAA0B,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QAC7F,MAAM,MAAM,GAAG,EAA+D,CAAA;QAC9E,MAAM,WAAW,GAAG,EAAkE,CAAA;QAEtF,OAAO,gBAAgB,CAAC;YACtB,4DAA4D;YAC5D,+DAA+D;YAC/D,4DAA4D;YAC5D,gEAAgE;YAChE,+DAA+D;YAC/D,iDAAiD;YACjD,EAAE,EAAE,MAAM;YACV,MAAM,EAAE,GAAG,CAAC,kBAAkB;YAC9B,OAAO,EAAE,cAAc,CAAC,GAAG,CAAC;YAC5B,QAAQ,EAAE,OAAO;YACjB,cAAc,EAAE,iBAAiB,CAAC,GAAG,CAAC;YACtC,QAAQ,EAAE,CAAC,cAAc,CAAC,cAAc,IAAI,oCAAoC,CAAC,CAAC,GAAG,CAAC;YACtF,sBAAsB,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS;YACzE,OAAO,EAAE,iBAAiB;gBACxB,CAAC,CAAC;oBACE,gCAAgC,CAAC;wBAC/B,EAAE,EAAE,WAAW;wBACf,YAAY,EAAE,GAAG,CAAC,qBAAqB;wBACvC,QAAQ,EAAE,iBAAiB;qBAC5B,CAAC;iBACH;gBACH,CAAC,CAAC,SAAS;YACb,iBAAiB,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE;gBACzC,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjB,wEAAwE;oBACxE,iEAAiE;oBACjE,mEAAmE;oBACnE,IAAI,sBAAsB,CAAC,GAAG,CAAC,EAAE,CAAC;wBAChC,OAAO,CAAC,IAAI,CAAC,6CAA6C,IAAI,CAAC,KAAK,KAAK,GAAG,EAAE,CAAC,CAAA;wBAC/E,OAAM;oBACR,CAAC;oBACD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAA;gBACpE,CAAC;gBACD,MAAM,WAAW,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAA;YACpD,CAAC;YACD,mBAAmB,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE;gBAClD,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjB,wEAAwE;oBACxE,gEAAgE;oBAChE,mEAAmE;oBACnE,IAAI,sBAAsB,CAAC,GAAG,CAAC,EAAE,CAAC;wBAChC,OAAO,CAAC,IAAI,CAAC,6CAA6C,IAAI,QAAQ,KAAK,KAAK,GAAG,EAAE,CAAC,CAAA;wBACtF,OAAM;oBACR,CAAC;oBACD,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAA;gBACtE,CAAC;gBACD,MAAM,WAAW,CAAC,mBAAmB,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAA;YAC7D,CAAC;SACF,CAAC,CAAA;IACJ,CAAC;IAED,SAAS,0BAA0B,CAAC,OAAgB;QAClD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAChC,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAA;QAC9D,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;IAClC,CAAC;IAED,MAAM,kBAAkB,GAAG,CAAC,GAAG,CAAC,CAAA;IAEhC,SAAS,qBAAqB,CAAC,IAA+B;QAC5D,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,CAAA;QAChC,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAA;QACtB,MAAM,cAAc,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;QACxD,MAAM,QAAQ,GACZ,cAAc,KAAK,QAAQ;YACzB,CAAC,CAAC,QAAQ;YACV,CAAC,CAAC,cAAc,KAAK,OAAO;gBAC1B,CAAC,CAAC,QAAQ;gBACV,CAAC,CAAC,cAAc,CAAA;QACtB,MAAM,QAAQ,GAAG,cAAc,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,CACxD,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,MAAM,CAAC,EAAE,KAAK,QAAQ,CAC9D,CAAA;QACD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IACpE,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,UAAU,mBAAmB,CAAC,EAAY,EAAE,GAAQ,EAAE,MAAc;QACvE,IAAI,qBAAqB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/B,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE;iBACpB,MAAM,CAAC,EAAE,MAAM,EAAE,kBAAkB,CAAC,MAAM,EAAE,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,EAAE,CAAC;iBACpF,IAAI,CAAC,kBAAkB,CAAC;iBACxB,KAAK,CAAC,EAAE,CAAC,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;iBAC5C,KAAK,CAAC,CAAC,CAAC,CAAA;YACX,OAAO,IAAI,EAAE,MAAM,IAAI,qBAAqB,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,kBAAkB,CAAA;QACpF,CAAC;QAED,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;aACvB,MAAM,CAAC,EAAE,WAAW,EAAE,iBAAiB,CAAC,WAAW,EAAE,CAAC;aACtD,IAAI,CAAC,iBAAiB,CAAC;aACvB,KAAK,CAAC,EAAE,CAAC,iBAAiB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;aACvC,KAAK,CAAC,CAAC,CAAC,CAAA;QACX,OAAO,OAAO,EAAE,WAAW,IAAI,kBAAkB,CAAA;IACnD,CAAC;IAED,KAAK,UAAU,kBAAkB,CAC/B,OAAgB,EAChB,GAAQ;QAER,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAA;QACzC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;YACrC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAA;YAEvE,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,IAAI,CAAA;YACb,CAAC;YAED,IAAI,qBAAqB,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC/B,MAAM,gBAAgB,GAAG,4BAA4B,CAAC,GAAG,CAAC,CAAA;gBAC1D,IAAI,CAAC,gBAAgB,EAAE,CAAC;oBACtB,OAAO,IAAI,CAAA;gBACb,CAAC;gBAED,IAAI,CAAC;oBACH,MAAM,YAAY,GAAG,MAAM,qCAAqC,CAAC;wBAC/D,EAAE,EAAE,EAAuE;wBAC3E,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE;wBAC7B,MAAM,EAAE,gBAAgB;qBACzB,CAAC,CAAA;oBAEF,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;wBACrB,OAAO,IAAI,CAAA;oBACb,CAAC;gBACH,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,OAAO,CAAC,KAAK,CAAC,2CAA2C,EAAE,KAAK,CAAC,CAAA;oBACjE,OAAO,IAAI,CAAA;gBACb,CAAC;YACH,CAAC;YAED,OAAO;gBACL,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;gBACvB,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE;gBAC7B,cAAc,EAAE,IAAI;gBACpB,UAAU,EAAE,SAAS;gBACrB,KAAK,EAAE,OAAO;gBACd,yEAAyE;gBACzE,uEAAuE;gBACvE,gEAAgE;gBAChE,sEAAsE;gBACtE,MAAM,EAAE,MAAM,mBAAmB,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC3D,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI;aAClC,CAAA;QACH,CAAC;gBAAS,CAAC;YACT,gEAAgE;YAChE,kEAAkE;YAClE,0BAA0B;YAC1B,MAAM,OAAO,EAAE,CAAA;QACjB,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,UAAU,iBAAiB,CAAC,OAAgB,EAAE,GAAQ;QACzD,MAAM,IAAI,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;QACnD,OAAO,IAAI,KAAK,IAAI,CAAA;IACtB,CAAC;IAED,MAAM,wBAAyB,SAAQ,KAAK;QAC1C;YACE,KAAK,CAAC,gBAAgB,CAAC,CAAA;YACvB,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAA;QACxC,CAAC;KACF;IAED,KAAK,UAAU,wBAAwB,CACrC,OAAgB,EAChB,GAAQ;QAER,IAAI,oCAAoC,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,CAAC;YACvD,OAAO,IAAI,CAAA;QACb,CAAC;QAED,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAA;QACzC,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,eAAe,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;YAC3C,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAA;YAC7E,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,IAAI,CAAA;YACb,CAAC;YAED,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;iBACnB,MAAM,CAAC;gBACN,EAAE,EAAE,QAAQ,CAAC,EAAE;gBACf,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,SAAS,EAAE,QAAQ,CAAC,SAAS;gBAC7B,SAAS,EAAE,iBAAiB,CAAC,SAAS;gBACtC,QAAQ,EAAE,iBAAiB,CAAC,QAAQ;gBACpC,MAAM,EAAE,iBAAiB,CAAC,MAAM;gBAChC,QAAQ,EAAE,iBAAiB,CAAC,QAAQ;gBACpC,OAAO,EAAE,iBAAiB,CAAC,OAAO;gBAClC,SAAS,EAAE,iBAAiB,CAAC,SAAS;gBACtC,YAAY,EAAE,iBAAiB,CAAC,YAAY;gBAC5C,aAAa,EAAE,iBAAiB,CAAC,aAAa;aAC/C,CAAC;iBACD,IAAI,CAAC,QAAQ,CAAC;iBACd,QAAQ,CAAC,iBAAiB,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;iBAClE,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;iBACvC,KAAK,CAAC,CAAC,CAAC,CAAA;YAEX,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,MAAM,IAAI,wBAAwB,EAAE,CAAA;YACtC,CAAC;YAED,OAAO;gBACL,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;gBAC5C,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,IAAI;gBAChC,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,IAAI;gBAC9B,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,IAAI;gBAC1B,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,IAAI;gBAC9B,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,IAAI;gBAC5B,YAAY,EAAE,GAAG,CAAC,YAAY,IAAI,KAAK;gBACvC,aAAa,EAAE,GAAG,CAAC,aAAa,IAAI,KAAK;gBACzC,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,WAAW,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACnE,iBAAiB,EAAE,GAAG,CAAC,SAAS,IAAI,IAAI;aACzC,CAAA;QACH,CAAC;gBAAS,CAAC;YACT,MAAM,OAAO,EAAE,CAAA;QACjB,CAAC;IACH,CAAC;IAED,KAAK,UAAU,4BAA4B,CACzC,OAAgB,EAChB,GAAQ;QAER,IAAI,oCAAoC,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,CAAC;YACvD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAA;QAC3B,CAAC;QAED,IAAI,qBAAqB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/B,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAA;QACrD,CAAC;QAED,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAA;QACzC,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,GAAG,CAAQ,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YACnF,OAAO,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAA;QAC/D,CAAC;gBAAS,CAAC;YACT,MAAM,OAAO,EAAE,CAAA;QACjB,CAAC;IACH,CAAC;IAED,KAAK,UAAU,sBAAsB,CACnC,GAAQ,EACR,EAAY,EACZ,MAAoB;QAEpB,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAA;QAE5C,MAAM,gBAAgB,GAAG,4BAA4B,CAAC,GAAG,CAAC,CAAA;QAC1D,IAAI,CAAC,gBAAgB;YAAE,OAAO,KAAK,CAAA;QAEnC,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,MAAM,kCAAkC,CAAC;gBAC5D,EAAE,EAAE,EAAoE;gBACxE,MAAM,EAAE,MAAM,CAAC,WAAW;gBAC1B,MAAM,EAAE,gBAAgB;aACzB,CAAC,CAAA;YACF,OAAO,YAAY,CAAC,EAAE,CAAA;QACxB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,6CAA6C,EAAE,KAAK,CAAC,CAAA;YACnE,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC/B,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,MAAM,wBAAwB,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAA;YACpE,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAA;YAC/C,CAAC;YACD,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QAC5B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,wBAAwB,EAAE,CAAC;gBAC9C,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,GAAG,CAAC,CAAA;YACjD,CAAC;YACD,MAAM,KAAK,CAAA;QACb,CAAC;IACH,CAAC,CAAC,CAAA;IAEF;;;;;OAKG;IACH,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACnC,mEAAmE;QACnE,oCAAoC;QACpC,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;QAC3C,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,eAAe,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;YAC7C,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;YAC/E,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAA;YAC5D,CAAC;YAED,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,EAAE,CAAA;YAE9B,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAC3C,EAAoD,EACpD,MAAM,CACP,CAAA;YACD,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;gBAC/C,OAAO,CAAC,KAAK,CAAC,sBAAsB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAA;gBACpD,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;YAC5B,CAAC;YAED,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACvB,CAAC;gBAAS,CAAC;YACT,CAAC,CAAC,YAAY,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAA;QACrC,CAAC;IACH,CAAC,CAAC,CAAA;IAEF;;;;OAIG;IACH,IAAI,CAAC,GAAG,CAAC,wBAAwB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC7C,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,4BAA4B,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;IACrE,CAAC,CAAC,CAAA;IAEF,KAAK,UAAU,qBAAqB,CAAC,CAAuB;QAC1D,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;QAC3C,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,eAAe,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;YAC7C,MAAM,WAAW,GAAG,EAAuE,CAAA;YAE3F,IAAI,qBAAqB,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;gBACjC,MAAM,gBAAgB,GAAG,4BAA4B,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;gBAC5D,IAAI,CAAC,gBAAgB,EAAE,CAAC;oBACtB,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,kEAAkE,EAAE,EAC7E,GAAG,CACJ,CAAA;gBACH,CAAC;gBAED,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;gBAC/E,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAA;gBAC/C,CAAC;gBAED,IAAI,CAAC;oBACH,MAAM,YAAY,GAAG,MAAM,qCAAqC,CAAC;wBAC/D,EAAE,EAAE,WAAW;wBACf,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE;wBAC7B,MAAM,EAAE,gBAAgB;qBACzB,CAAC,CAAA;oBAEF,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;wBACrB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,EAAE,GAAG,CAAC,CAAA;oBAC9D,CAAC;gBACH,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,OAAO,CAAC,KAAK,CAAC,8CAA8C,EAAE,KAAK,CAAC,CAAA;oBACpE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8CAA8C,EAAE,EAAE,GAAG,CAAC,CAAA;gBAC/E,CAAC;YACH,CAAC;YAED,OAAO,CACL,CAAC,MAAM,+BAA+B,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,EAAE;gBAC5D,EAAE;gBACF,aAAa,EAAE,cAAc,CAAC,aAAa;aAC5C,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAC3C,CAAA;QACH,CAAC;gBAAS,CAAC;YACT,CAAC,CAAC,YAAY,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAA;QACrC,CAAC;IACH,CAAC;IAED,KAAK,UAAU,+BAA+B,CAAC,CAAuB;QACpE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;QAC3C,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,eAAe,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;YAC7C,MAAM,WAAW,GAAG,EAAuE,CAAA;YAE3F,IAAI,qBAAqB,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;gBACjC,MAAM,gBAAgB,GAAG,4BAA4B,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;gBAC5D,IAAI,CAAC,gBAAgB,EAAE,CAAC;oBACtB,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,wEAAwE,EAAE,EACnF,GAAG,CACJ,CAAA;gBACH,CAAC;gBAED,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;gBAC/E,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAA;gBAC/C,CAAC;gBAED,IAAI,CAAC;oBACH,MAAM,YAAY,GAAG,MAAM,qCAAqC,CAAC;wBAC/D,EAAE,EAAE,WAAW;wBACf,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE;wBAC7B,MAAM,EAAE,gBAAgB;qBACzB,CAAC,CAAA;oBAEF,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;wBACrB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,EAAE,GAAG,CAAC,CAAA;oBAC9D,CAAC;gBACH,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,OAAO,CAAC,KAAK,CAAC,wDAAwD,EAAE,KAAK,CAAC,CAAA;oBAC9E,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8CAA8C,EAAE,EAAE,GAAG,CAAC,CAAA;gBAC/E,CAAC;YACH,CAAC;YAED,MAAM,qBAAqB,GAAG,EAEpB,CAAA;YACV,OAAO,CACL,CAAC,MAAM,gCAAgC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,EAAE;gBAC7D,EAAE,EAAE,qBAAqB;aAC1B,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAC3C,CAAA;QACH,CAAC;gBAAS,CAAC;YACT,CAAC,CAAC,YAAY,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAA;QACrC,CAAC;IACH,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,mBAAmB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACxC,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;YAClC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAA;QAC5C,CAAC;QAED,MAAM,MAAM,GAAG,uBAAuB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;QAC7C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,8BAA8B,CAAC,CAAC,CAAC,CAAA;QAC1C,CAAC;QAED,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,yBAAyB,CAAC;gBAC5C,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG;gBACrB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC;gBACzB,MAAM;aACP,CAAC,CAAA;YACF,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;gBACxB,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE;oBACP,QAAQ,EAAE,KAAK,CAAC,WAAW;oBAC3B,YAAY,EAAE,KAAK,CAAC,SAAS;iBAC9B;aACF,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,2BAA2B,EAAE,KAAK,CAAC,CAAA;YACjD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2CAA2C,EAAE,EAAE,GAAG,CAAC,CAAA;QAC5E,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,IAAI,CAAC,GAAG,CAAC,sBAAsB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC3C,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;YAClC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAA;QAC5C,CAAC;QAED,MAAM,cAAc,GAAG,0BAA0B,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;QACxD,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAC9B,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kDAAkD,EAAE,EAAE,GAAG,EAAE;gBAChF,YAAY,EAAE,mCAAmC,CAC/C,GAAG,CAAC,QAAQ,KAAK,QAAQ,EACzB,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,IAAI,aAAa,CACzD;aACF,CAAC,CAAA;QACJ,CAAC;QAED,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;QAC3C,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,eAAe,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;YAC7C,OAAO,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC5C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,8BAA8B,EAAE,KAAK,CAAC,CAAA;YACpD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mCAAmC,EAAE,EAAE,GAAG,CAAC,CAAA;QACpE,CAAC;gBAAS,CAAC;YACT,CAAC,CAAC,YAAY,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAA;QACrC,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,IAAI,CAAC,GAAG,CAAC,kBAAkB,EAAE,qBAAqB,CAAC,CAAA;IACnD,IAAI,CAAC,GAAG,CAAC,yBAAyB,EAAE,qBAAqB,CAAC,CAAA;IAC1D,IAAI,CAAC,GAAG,CAAC,gCAAgC,EAAE,qBAAqB,CAAC,CAAA;IACjE,IAAI,CAAC,GAAG,CAAC,iCAAiC,EAAE,+BAA+B,CAAC,CAAA;IAE5E,IAAI,CAAC,GAAG,CAAC,uBAAuB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC5C,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;QAC3C,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,eAAe,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAA;YACvE,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;YAC/E,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QACpD,CAAC;gBAAS,CAAC;YACT,CAAC,CAAC,YAAY,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAA;QACrC,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,IAAI,CAAC,GAAG,CAAC,kBAAkB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACvC,IACE,qBAAqB,CAAC,CAAC,CAAC,GAAG,CAAC;YAC5B,CAAC,6BAA6B,CAAC,0BAA0B,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EACrE,CAAC;YACD,OAAO,yBAAyB,CAAC,CAAC,CAAC,CAAA;QACrC,CAAC;QAED,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;QAC3C,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,eAAe,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAA;YACvE,OAAO,MAAM,UAAU,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAA;QACxE,CAAC;gBAAS,CAAC;YACT,CAAC,CAAC,YAAY,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAA;QACrC,CAAC;IACH,CAAC,CAAC,CAAA;IAEF;;;;;;OAMG;IACH,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC9B,IAAI,qBAAqB,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9E,OAAO,yBAAyB,CAAC,CAAC,CAAC,CAAA;QACrC,CAAC;QAED,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;QAC3C,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,eAAe,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;YAC7C,OAAO,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC5C,CAAC;gBAAS,CAAC;YACT,CAAC,CAAC,YAAY,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAA;QACrC,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,OAAO;QACL,OAAO,EAAE,IAAI;QACb,4BAA4B;QAC5B,wBAAwB;QACxB,iBAAiB;QACjB,kBAAkB;QAClB,sBAAsB;KACvB,CAAA;AACH,CAAC","sourcesContent":["/*\n Better Auth Node runtime for Hono.\n \n agent-quality: file-size exception -- Auth handler keeps local and Voyant Cloud auth flows co-located until the route surface is split by auth mode.\n \n Mounts Better Auth at /auth/* for authentication operations.\n * Same-origin — no CORS needed. Session cookies work naturally.\n \n Also provides /auth/status (user provisioning) and /auth/me (user info).\n /\n\nimport { type NodeDatabaseEnv, openNodeDatabase } from \"@voyant-travel/db/runtime\"\nimport {\n authUser,\n cloudAuthUserLinks,\n type SelectApikey,\n userProfilesTable,\n} from \"@voyant-travel/db/schema/iam\"\nimport type { Reporter, VoyantDb, VoyantRequestAuthContext } from \"@voyant-travel/hono\"\nimport {\n handleApiError,\n reportException,\n requestId,\n} from \"@voyant-travel/hono/middleware/error-boundary\"\nimport { getRequestId } from \"@voyant-travel/hono/observability\"\nimport type { AccessCatalog } from \"@voyant-travel/types/api-keys\"\nimport { scopesForRole } from \"@voyant-travel/types/member-roles\"\nimport { eq, sql } from \"drizzle-orm\"\nimport { type Context, Hono } from \"hono\"\nimport {\n createVoyantCloudAdminAuthPlugin,\n revalidateVoyantCloudAdminAuthSession,\n revalidateVoyantCloudAdminAuthUser,\n} from \"./cloud-admin-session.js\"\nimport { buildClearCloudAdminAuthStateCookie, createCloudAdminAuthStart } from \"./cloud-broker.js\"\nimport {\n type CreateBetterAuthOptions,\n createBetterAuth,\n handleApiTokenManagementRequest,\n handleOrganizationMembersRequest,\n} from \"./server.js\"\nimport { ensureCurrentUserProfile } from \"./workspace.js\"\n\n// Type ctx so that `c.get(\"db\")` resolves to the parent app's middleware-\n// set `VoyantDb` from the deployment's database lifecycle adapter. Without\n// this, the sub-app sees `unknown` for context vars.\ntype OperatorAuthMode = \"local\" \| \"voyant-cloud\"\n\nexport interface OperatorAuthNodeEnv extends NodeDatabaseEnv {\n API_BASE_URL?: string\n APP_URL?: string\n AUTH_COOKIE_DOMAIN?: string\n BETTER_AUTH_SECRET: string\n CORS_ALLOWLIST?: string\n DASH_BASE_URL?: string\n EMAIL_FROM?: string\n SESSION_CLAIMS_SECRET: string\n VOYANT_ADMIN_AUTH_MODE?: string\n VOYANT_AUTH_LOG_SECRET_FALLBACKS?: string\n VOYANT_CLOUD_ADMIN_AUTH_AUDIENCE?: string\n VOYANT_CLOUD_ADMIN_AUTH_CLIENT_TOKEN?: string\n VOYANT_CLOUD_ADMIN_AUTH_EXCHANGE_URL?: string\n VOYANT_CLOUD_ADMIN_AUTH_JWKS_URL?: string\n VOYANT_CLOUD_ADMIN_AUTH_REVALIDATE_URL?: string\n VOYANT_CLOUD_ADMIN_AUTH_START_URL?: string\n VOYANT_CLOUD_APP_ID?: string\n VOYANT_CLOUD_DEPLOYMENT_ID?: string\n VOYANT_CLOUD_ENVIRONMENT?: string\n VOYANT_OPERATOR_BROWSER_EVIDENCE?: string\n}\n\nexport interface OperatorCurrentUser {\n id: string\n email: string\n firstName: string \| null\n lastName: string \| null\n locale: string\n timezone: string \| null\n uiPrefs: unknown\n isSuperAdmin: boolean\n isSupportUser: boolean\n createdAt: string\n profilePictureUrl: string \| null\n}\n\nexport type OperatorAuthBootstrapStatus = {\n hasUsers: boolean\n authMode?: OperatorAuthMode\n}\n\ntype BetterAuthAdvancedOptions = NonNullable<CreateBetterAuthOptions[\"advanced\"]>\n\n/* Resolve Better Auth's standard cross-subdomain cookie policy for Node hosts. /\nexport function buildBetterAuthCookieAdvancedOptions(\n env: Pick<OperatorAuthNodeEnv, \"AUTH_COOKIE_DOMAIN\">,\n):\n \| Pick<BetterAuthAdvancedOptions, \"crossSubDomainCookies\" \| \"defaultCookieAttributes\">\n \| undefined {\n const domain = env.AUTH_COOKIE_DOMAIN?.trim()\n if (!domain) return undefined\n\n return {\n crossSubDomainCookies: { enabled: true, domain },\n defaultCookieAttributes: { domain },\n }\n}\n\nexport interface OperatorAuthEmailSender {\n sendResetPassword: (input: {\n user: { email: string; name: string }\n url: string\n }) => Promise<void>\n sendVerificationOtp: (input: { email: string; otp: string; type: string }) => Promise<void>\n}\n\nexport interface CreateOperatorAuthNodeRuntimeOptions<Env extends OperatorAuthNodeEnv> {\n accessCatalog: AccessCatalog\n appName: string\n reporter: Reporter\n openDatabase?: (env: Env) => { db: VoyantDb; dispose: () => Promise<void> }\n cookieAdvanced?: (\n env: Env,\n ) =>\n \| Pick<BetterAuthAdvancedOptions, \"crossSubDomainCookies\" \| \"defaultCookieAttributes\">\n \| undefined\n resolveEmailSender?: (env: Env) => OperatorAuthEmailSender \| null\n}\n\nexport function createOperatorAuthNodeRuntime<Env extends OperatorAuthNodeEnv>(\n runtimeOptions: CreateOperatorAuthNodeRuntimeOptions<Env>,\n) {\n type AuthHonoEnv = { Bindings: Env; Variables: { db: VoyantDb } }\n\n const openDatabase =\n runtimeOptions.openDatabase ??\n ((env: Env) => {\n const resource = openNodeDatabase(env)\n return { db: resource.db as VoyantDb, dispose: resource.dispose }\n })\n\n const auth = new Hono<AuthHonoEnv>()\n // This lean auth app is dispatched around `createVoyantApp` (see\n // hono-api-dispatch.ts), so it must mint/propagate the correlation id and wire\n // the reporter itself — otherwise auth 5xx are an observability blind spot and\n // the user-facing requestId wouldn't be findable (RFC voyant#1553).\n auth.use(\"\", requestId)\n // `onError` only fires on THROWN exceptions. Several handlers (e.g.\n // /auth/status, the cloud token/revalidate/callback paths) instead RETURN a\n // 5xx via `c.json(..., 50x)`; those bypass `onError`, and this lean app is\n // dispatched around `createVoyantApp` so the framework's auth status-bridge\n // (`mountAuthForwarding`) never runs either. Bridge returned 5xx to the\n // reporter here so they aren't an observability blind spot (RFC voyant#1553).\n // Thrown errors skip this middleware's post-`next()` code (the rejection\n // propagates straight to `onError`), so there's no double report.\n auth.use(\"\", async (c, next) => {\n await next()\n if (c.res.status >= 500) {\n reportException(runtimeOptions.reporter, c, {\n requestId: getRequestId() ?? \"\",\n app: runtimeOptions.appName,\n error: new Error(`auth handler returned HTTP ${c.res.status}`),\n context: { path: c.req.path, method: c.req.method, status: c.res.status, surface: \"auth\" },\n })\n }\n })\n auth.onError((err, c) =>\n handleApiError(err, c, { reporter: runtimeOptions.reporter, appName: runtimeOptions.appName }),\n )\n\n const DEFAULT_APP_URL = \"http://localhost:3300\"\n const CLOUD_BETTER_AUTH_ALLOWLIST = new Set([\n \"/auth/get-session\",\n \"/auth/jwks\",\n \"/auth/session\",\n \"/auth/sign-out\",\n \"/auth/token\",\n ])\n\n function resolveOperatorAuthMode(env: Env): OperatorAuthMode {\n const mode = env.VOYANT_ADMIN_AUTH_MODE?.trim() \|\| \"local\"\n\n if (mode === \"local\" \|\| mode === \"voyant-cloud\") {\n return mode\n }\n\n console.error(\n `[auth] Invalid VOYANT_ADMIN_AUTH_MODE=\"${mode}\". Failing closed as voyant-cloud.`,\n )\n return \"voyant-cloud\"\n }\n\n function isVoyantCloudAuthMode(env: Env): boolean {\n return resolveOperatorAuthMode(env) === \"voyant-cloud\"\n }\n\n function isCloudAllowedBetterAuthRoute(request: Request): boolean {\n const url = new URL(request.url)\n const pathname = url.pathname.replace(/\\/+$/, \"\") \|\| \"/\"\n return CLOUD_BETTER_AUTH_ALLOWLIST.has(pathname)\n }\n\n function localAuthDisabledResponse(c: Context<AuthHonoEnv>) {\n return c.json({ error: \"Local auth routes are disabled in Voyant Cloud auth mode\" }, 404)\n }\n\n function cloudAuthNotConfiguredResponse(c: Context<AuthHonoEnv>) {\n return c.json({ error: \"Voyant Cloud auth broker is not configured yet\" }, 501)\n }\n\n function normalizeUrl(url: string): string {\n return url.trim().replace(/\\/$/, \"\")\n }\n\n function getAppUrl(env: Env): string {\n const candidates = [\n env.APP_URL,\n env.DASH_BASE_URL,\n env.CORS_ALLOWLIST?.split(\",\")[0],\n DEFAULT_APP_URL,\n ]\n\n for (const candidate of candidates) {\n if (typeof candidate === \"string\" && candidate.trim().length > 0) {\n return normalizeUrl(candidate)\n }\n }\n\n return DEFAULT_APP_URL\n }\n\n function getTrustedOrigins(env: Env): string[] {\n return Array.from(\n new Set(\n [env.APP_URL, env.DASH_BASE_URL, ...(env.CORS_ALLOWLIST ?? \"\").split(\",\")]\n .map((value) => value?.trim())\n .filter((value): value is string => Boolean(value)),\n ),\n ).map(normalizeUrl)\n }\n\n function getAuthBaseUrl(env: Env): string {\n // entry.ts strips /api before delegating to the Hono app, so Better Auth\n // sees paths like /auth/. Its baseURL must be the origin only (no /api).\n const appUrl = getAppUrl(env)\n try {\n const parsed = new URL(appUrl)\n return `${parsed.protocol}//${parsed.host}`\n } catch {\n return appUrl\n }\n }\n\n function getPublicApiBaseUrl(env: Env): string {\n const candidate = env.API_BASE_URL?.trim() \|\| env.APP_URL?.trim() \|\| `${getAppUrl(env)}/api`\n const normalized = normalizeUrl(candidate)\n\n try {\n const parsed = new URL(normalized)\n if (parsed.pathname === \"/\" \|\| parsed.pathname === \"\") {\n parsed.pathname = \"/api\"\n return normalizeUrl(parsed.toString())\n }\n } catch {\n return normalized\n }\n\n return normalized\n }\n\n function getCloudAuthStartConfig(env: Env) {\n const deploymentId = env.VOYANT_CLOUD_DEPLOYMENT_ID?.trim()\n const cloudAuthStartUrl = env.VOYANT_CLOUD_ADMIN_AUTH_START_URL?.trim()\n if (!deploymentId \|\| !cloudAuthStartUrl) return null\n\n return {\n cloudAuthStartUrl,\n deploymentId,\n adminCallbackUrl: `${getPublicApiBaseUrl(env)}/auth/cloud/callback`,\n cookieSecret: env.SESSION_CLAIMS_SECRET,\n appId: env.VOYANT_CLOUD_APP_ID?.trim() \|\| undefined,\n environment: env.VOYANT_CLOUD_ENVIRONMENT?.trim() \|\| undefined,\n }\n }\n\n function getCloudAuthExchangeConfig(env: Env) {\n const deploymentId = env.VOYANT_CLOUD_DEPLOYMENT_ID?.trim()\n const exchangeUrl = env.VOYANT_CLOUD_ADMIN_AUTH_EXCHANGE_URL?.trim()\n const assertionJwksUrl = env.VOYANT_CLOUD_ADMIN_AUTH_JWKS_URL?.trim()\n const clientToken = env.VOYANT_CLOUD_ADMIN_AUTH_CLIENT_TOKEN?.trim()\n if (!deploymentId \|\| !exchangeUrl \|\| !assertionJwksUrl \|\| !clientToken) return null\n\n return {\n exchangeUrl,\n deploymentId,\n clientToken,\n assertionJwksUrl,\n assertionAudience: env.VOYANT_CLOUD_ADMIN_AUTH_AUDIENCE?.trim() \|\| deploymentId,\n }\n }\n\n function getCloudAuthRevalidateConfig(env: Env) {\n const deploymentId = env.VOYANT_CLOUD_DEPLOYMENT_ID?.trim()\n const revalidateUrl = env.VOYANT_CLOUD_ADMIN_AUTH_REVALIDATE_URL?.trim()\n const clientToken = env.VOYANT_CLOUD_ADMIN_AUTH_CLIENT_TOKEN?.trim()\n if (!deploymentId \|\| !revalidateUrl \|\| !clientToken) return null\n\n return {\n revalidateUrl,\n deploymentId,\n clientToken,\n }\n }\n\n function isLocalRequest(request: Request): boolean {\n const hostname = new URL(request.url).hostname\n return hostname === \"127.0.0.1\" \|\| hostname === \"localhost\"\n }\n\n function shouldUseBrowserEvidenceAuthFallback(env: Env, request: Request): boolean {\n return env.VOYANT_OPERATOR_BROWSER_EVIDENCE === \"1\" && isLocalRequest(request)\n }\n\n function allowAuthSecretLogging(env: Env): boolean {\n return env.VOYANT_AUTH_LOG_SECRET_FALLBACKS === \"1\"\n }\n\n /*\n Build a Better Auth instance backed by a caller-provided drizzle\n * client. The caller owns the Pool lifecycle (open before, dispose\n * after) so the same Pool can serve both the auth lookup and any\n * subsequent queries the route does — without spinning up a second\n * connection per request.\n \n The deployment decides whether this is a request-scoped or resident Node\n * pool. The Better Auth instance is not cached independently of that owner.\n /\n interface BuildBetterAuthOptions {\n customerSignup?: boolean\n }\n\n function buildBetterAuth(env: Env, db: VoyantDb, options: BuildBetterAuthOptions = {}) {\n const emailSender = runtimeOptions.resolveEmailSender?.(env)\n const cloudAuthExchange = isVoyantCloudAuthMode(env) ? getCloudAuthExchangeConfig(env) : null\n const authDb = db as NonNullable<Parameters<typeof createBetterAuth>[0]>[\"db\"]\n const cloudAuthDb = db as Parameters<typeof createVoyantCloudAdminAuthPlugin>[0][\"db\"]\n\n return createBetterAuth({\n // `db` is a `NeonDatabase` (neon-serverless WebSocket); the\n // `CreateBetterAuthOptions.db` type still references the older\n // `getDb` return union (postgres-js + neon-http). Drizzle's\n // PgDatabase surface is identical across flavors at runtime, so\n // the cast is structurally safe — better-auth's drizzleAdapter\n // works on any PgDatabase. See #500 for context.\n db: authDb,\n secret: env.BETTER_AUTH_SECRET,\n baseURL: getAuthBaseUrl(env),\n basePath: \"/auth\",\n trustedOrigins: getTrustedOrigins(env),\n advanced: (runtimeOptions.cookieAdvanced ?? buildBetterAuthCookieAdvancedOptions)(env),\n customerSignupSurfaces: options.customerSignup ? [\"customer\"] : undefined,\n plugins: cloudAuthExchange\n ? [\n createVoyantCloudAdminAuthPlugin({\n db: cloudAuthDb,\n cookieSecret: env.SESSION_CLAIMS_SECRET,\n exchange: cloudAuthExchange,\n }),\n ]\n : undefined,\n sendResetPassword: async ({ user, url }) => {\n if (!emailSender) {\n // No email provider (e.g. local dev without a sending domain): with the\n // debug flag on, log the link to the console instead of sending;\n // otherwise fail loudly. Never bypasses a configured cloud sender.\n if (allowAuthSecretLogging(env)) {\n console.info(`[auth] reset-password (debug fallback) -> ${user.email}: ${url}`)\n return\n }\n throw new Error(\"Password reset email provider is not configured\")\n }\n await emailSender.sendResetPassword({ user, url })\n },\n sendVerificationOTP: async ({ email, otp, type }) => {\n if (!emailSender) {\n // No email provider (e.g. local dev without a sending domain): with the\n // debug flag on, log the OTP to the console instead of sending;\n // otherwise fail loudly. Never bypasses a configured cloud sender.\n if (allowAuthSecretLogging(env)) {\n console.info(`[auth] verification-otp (debug fallback) [${type}] -> ${email}: ${otp}`)\n return\n }\n throw new Error(\"Verification OTP email provider is not configured\")\n }\n await emailSender.sendVerificationOtp({ email, otp, type })\n },\n })\n }\n\n function rewriteCustomerAuthRequest(request: Request): Request {\n const url = new URL(request.url)\n url.pathname = url.pathname.replace(\"/auth/customer\", \"/auth\")\n return new Request(url, request)\n }\n\n const FULL_ACCESS_SCOPES = [\"\"]\n\n function scopesForOperatorRole(role: string \| null \| undefined): string[] \| null {\n const base = scopesForRole(role)\n if (!base) return null\n const normalizedRole = (role ?? \"\").trim().toLowerCase()\n const presetId =\n normalizedRole === \"member\"\n ? \"editor\"\n : normalizedRole === \"guest\"\n ? \"viewer\"\n : normalizedRole\n const selected = runtimeOptions.accessCatalog.presets.find(\n (preset) => preset.kind === \"staff\" && preset.id === presetId,\n )\n return [...new Set([...base, ...(selected?.grants ?? [])])].sort()\n }\n\n /*\n Resolve a member's RBAC scope set for the request (`resource:action` strings,\n * shared with API keys — see @voyant-travel/types/member-roles, RFC voyant#2085).\n \n Phase 1: storage + seam are wired but default to full access, so behavior is\n * unchanged until an admin assigns permissions (Phase 2) and routes gate on them\n * (Phase 3).\n * - voyant-cloud: assertion-mirrored `cloud_auth_user_links.scopes` if the\n * platform sent them, else the role bundle for `roleSlug`, else full access.\n * - local: the member's `user_profiles.permissions` if assigned, else full\n * access (no local role concept yet).\n /\n async function resolveMemberScopes(db: VoyantDb, env: Env, userId: string): Promise<string[]> {\n if (isVoyantCloudAuthMode(env)) {\n const [link] = await db\n .select({ scopes: cloudAuthUserLinks.scopes, roleSlug: cloudAuthUserLinks.roleSlug })\n .from(cloudAuthUserLinks)\n .where(eq(cloudAuthUserLinks.userId, userId))\n .limit(1)\n return link?.scopes ?? scopesForOperatorRole(link?.roleSlug) ?? FULL_ACCESS_SCOPES\n }\n\n const [profile] = await db\n .select({ permissions: userProfilesTable.permissions })\n .from(userProfilesTable)\n .where(eq(userProfilesTable.id, userId))\n .limit(1)\n return profile?.permissions ?? FULL_ACCESS_SCOPES\n }\n\n async function resolveAuthRequest(\n request: Request,\n env: Env,\n ): Promise<VoyantRequestAuthContext \| null> {\n const { db, dispose } = openDatabase(env)\n try {\n const auth = buildBetterAuth(env, db)\n const session = await auth.api.getSession({ headers: request.headers })\n\n if (!session) {\n return null\n }\n\n if (isVoyantCloudAuthMode(env)) {\n const revalidateConfig = getCloudAuthRevalidateConfig(env)\n if (!revalidateConfig) {\n return null\n }\n\n try {\n const revalidation = await revalidateVoyantCloudAdminAuthSession({\n db: db as Parameters<typeof revalidateVoyantCloudAdminAuthSession>[0][\"db\"],\n sessionId: session.session.id,\n config: revalidateConfig,\n })\n\n if (!revalidation.ok) {\n return null\n }\n } catch (error) {\n console.error(\"[auth/session] Cloud revalidation failed:\", error)\n return null\n }\n }\n\n return {\n userId: session.user.id,\n sessionId: session.session.id,\n organizationId: null,\n callerType: \"session\",\n actor: \"staff\",\n // Member RBAC scope set (RFC voyant#2085). Defaults to full access until\n // an admin assigns permissions, so existing deployments are unchanged.\n // `actor: \"staff\"` is retained, so actor-gated paths (incl. the\n // bookings-pii reveal, which short-circuits on staff) are unaffected.\n scopes: await resolveMemberScopes(db, env, session.user.id),\n email: session.user.email ?? null,\n }\n } finally {\n // No `executionCtx` reachable here (called from middleware that\n // doesn't pass one through). Await inline so the WebSocket closes\n // before this fn returns.\n await dispose()\n }\n }\n\n /\n Single-tenant: every authenticated session is a staff user with full access.\n * When `resolveAuthRequest` has already granted a session, permissions are\n * implicitly allowed. If you need granular RBAC later, switch on\n * `user_profiles.isSuperAdmin` / `isSupportUser` here.\n /\n async function hasAuthPermission(request: Request, env: Env): Promise<boolean> {\n const auth = await resolveAuthRequest(request, env)\n return auth !== null\n }\n\n class CurrentUserNotFoundError extends Error {\n constructor() {\n super(\"User not found\")\n this.name = \"CurrentUserNotFoundError\"\n }\n }\n\n async function getCurrentUserForRequest(\n request: Request,\n env: Env,\n ): Promise<OperatorCurrentUser \| null> {\n if (shouldUseBrowserEvidenceAuthFallback(env, request)) {\n return null\n }\n\n const { db, dispose } = openDatabase(env)\n try {\n const betterAuth = buildBetterAuth(env, db)\n const session = await betterAuth.api.getSession({ headers: request.headers })\n if (!session) {\n return null\n }\n\n const [row] = await db\n .select({\n id: authUser.id,\n email: authUser.email,\n createdAt: authUser.createdAt,\n firstName: userProfilesTable.firstName,\n lastName: userProfilesTable.lastName,\n locale: userProfilesTable.locale,\n timezone: userProfilesTable.timezone,\n uiPrefs: userProfilesTable.uiPrefs,\n avatarUrl: userProfilesTable.avatarUrl,\n isSuperAdmin: userProfilesTable.isSuperAdmin,\n isSupportUser: userProfilesTable.isSupportUser,\n })\n .from(authUser)\n .leftJoin(userProfilesTable, eq(userProfilesTable.id, authUser.id))\n .where(eq(authUser.id, session.user.id))\n .limit(1)\n\n if (!row) {\n throw new CurrentUserNotFoundError()\n }\n\n return {\n id: row.id,\n email: row.email ?? session.user.email ?? \"\",\n firstName: row.firstName ?? null,\n lastName: row.lastName ?? null,\n locale: row.locale ?? \"en\",\n timezone: row.timezone ?? null,\n uiPrefs: row.uiPrefs ?? null,\n isSuperAdmin: row.isSuperAdmin ?? false,\n isSupportUser: row.isSupportUser ?? false,\n createdAt: row.createdAt?.toISOString() ?? new Date().toISOString(),\n profilePictureUrl: row.avatarUrl ?? null,\n }\n } finally {\n await dispose()\n }\n }\n\n async function getBootstrapStatusForRequest(\n request: Request,\n env: Env,\n ): Promise<OperatorAuthBootstrapStatus> {\n if (shouldUseBrowserEvidenceAuthFallback(env, request)) {\n return { hasUsers: true }\n }\n\n if (isVoyantCloudAuthMode(env)) {\n return { hasUsers: true, authMode: \"voyant-cloud\" }\n }\n\n const { db, dispose } = openDatabase(env)\n try {\n const [row] = await db.select({ count: sql<number>`count()::int` }).from(authUser)\n return { hasUsers: (row?.count ?? 0) > 0, authMode: \"local\" }\n } finally {\n await dispose()\n }\n }\n\n async function validateApiTokenAccess(\n env: Env,\n db: VoyantDb,\n apiKey: SelectApikey,\n ): Promise<boolean> {\n if (!isVoyantCloudAuthMode(env)) return true\n\n const revalidateConfig = getCloudAuthRevalidateConfig(env)\n if (!revalidateConfig) return false\n\n try {\n const revalidation = await revalidateVoyantCloudAdminAuthUser({\n db: db as Parameters<typeof revalidateVoyantCloudAdminAuthUser>[0][\"db\"],\n userId: apiKey.referenceId,\n config: revalidateConfig,\n })\n return revalidation.ok\n } catch (error) {\n console.error(\"[auth/api-token] Cloud revalidation failed:\", error)\n return false\n }\n }\n\n /*\n GET /auth/me\n * Returns the current authenticated user's profile.\n * Validates the session cookie directly (no Bearer token needed).\n /\n auth.get(\"/auth/me\", async (c) => {\n try {\n const currentUser = await getCurrentUserForRequest(c.req.raw, c.env)\n if (!currentUser) {\n return c.json({ error: \"Unauthorized\" }, 401)\n }\n return c.json(currentUser)\n } catch (error) {\n if (error instanceof CurrentUserNotFoundError) {\n return c.json({ error: \"User not found\" }, 404)\n }\n throw error\n }\n })\n\n /\n GET /auth/status\n * Ensures the authenticated user has a user_profiles row.\n * Profile is normally created by the BA databaseHook on sign-up,\n * but this route serves as an idempotent fallback.\n /\n auth.get(\"/auth/status\", async (c) => {\n // See `/auth/me` above — auth sub-app runs before the request `db`\n // middleware, so own the Pool here.\n const { db, dispose } = openDatabase(c.env)\n try {\n const betterAuth = buildBetterAuth(c.env, db)\n const session = await betterAuth.api.getSession({ headers: c.req.raw.headers })\n if (!session) {\n return c.json({ userExists: false, authenticated: false })\n }\n\n const userId = session.user.id\n\n const status = await ensureCurrentUserProfile(\n db as Parameters<typeof ensureCurrentUserProfile>[0],\n userId,\n )\n if (!status.userExists && status.authenticated) {\n console.error(\"[auth/status] Error:\", status.reason)\n return c.json(status, 500)\n }\n\n return c.json(status)\n } finally {\n c.executionCtx.waitUntil(dispose())\n }\n })\n\n /\n GET /auth/bootstrap-status\n * Public endpoint — reveals whether any user exists. Used by the sign-in /\n * sign-up route loaders to pick the right flow.\n /\n auth.get(\"/auth/bootstrap-status\", async (c) => {\n return c.json(await getBootstrapStatusForRequest(c.req.raw, c.env))\n })\n\n async function handleApiTokensFacade(c: Context<AuthHonoEnv>) {\n const { db, dispose } = openDatabase(c.env)\n try {\n const betterAuth = buildBetterAuth(c.env, db)\n const cloudAuthDb = db as Parameters<typeof revalidateVoyantCloudAdminAuthSession>[0][\"db\"]\n\n if (isVoyantCloudAuthMode(c.env)) {\n const revalidateConfig = getCloudAuthRevalidateConfig(c.env)\n if (!revalidateConfig) {\n return c.json(\n { error: \"Cloud-mode API token management requires membership revalidation\" },\n 501,\n )\n }\n\n const session = await betterAuth.api.getSession({ headers: c.req.raw.headers })\n if (!session) {\n return c.json({ error: \"Unauthorized\" }, 401)\n }\n\n try {\n const revalidation = await revalidateVoyantCloudAdminAuthSession({\n db: cloudAuthDb,\n sessionId: session.session.id,\n config: revalidateConfig,\n })\n\n if (!revalidation.ok) {\n return c.json({ error: \"Voyant Cloud access revoked\" }, 403)\n }\n } catch (error) {\n console.error(\"[auth/api-tokens] Cloud revalidation failed:\", error)\n return c.json({ error: \"Voyant Cloud access could not be revalidated\" }, 503)\n }\n }\n\n return (\n (await handleApiTokenManagementRequest(c.req.raw, betterAuth, {\n db,\n accessCatalog: runtimeOptions.accessCatalog,\n })) ?? c.json({ error: \"Not found\" }, 404)\n )\n } finally {\n c.executionCtx.waitUntil(dispose())\n }\n }\n\n async function handleOrganizationMembersFacade(c: Context<AuthHonoEnv>) {\n const { db, dispose } = openDatabase(c.env)\n try {\n const betterAuth = buildBetterAuth(c.env, db)\n const cloudAuthDb = db as Parameters<typeof revalidateVoyantCloudAdminAuthSession>[0][\"db\"]\n\n if (isVoyantCloudAuthMode(c.env)) {\n const revalidateConfig = getCloudAuthRevalidateConfig(c.env)\n if (!revalidateConfig) {\n return c.json(\n { error: \"Cloud-mode organization member lookup requires membership revalidation\" },\n 501,\n )\n }\n\n const session = await betterAuth.api.getSession({ headers: c.req.raw.headers })\n if (!session) {\n return c.json({ error: \"Unauthorized\" }, 401)\n }\n\n try {\n const revalidation = await revalidateVoyantCloudAdminAuthSession({\n db: cloudAuthDb,\n sessionId: session.session.id,\n config: revalidateConfig,\n })\n\n if (!revalidation.ok) {\n return c.json({ error: \"Voyant Cloud access revoked\" }, 403)\n }\n } catch (error) {\n console.error(\"[auth/organization-members] Cloud revalidation failed:\", error)\n return c.json({ error: \"Voyant Cloud access could not be revalidated\" }, 503)\n }\n }\n\n const organizationMembersDb = db as Parameters<\n typeof handleOrganizationMembersRequest\n >[2][\"db\"]\n return (\n (await handleOrganizationMembersRequest(c.req.raw, betterAuth, {\n db: organizationMembersDb,\n })) ?? c.json({ error: \"Not found\" }, 404)\n )\n } finally {\n c.executionCtx.waitUntil(dispose())\n }\n }\n\n auth.get(\"/auth/cloud/start\", async (c) => {\n if (!isVoyantCloudAuthMode(c.env)) {\n return c.json({ error: \"Not found\" }, 404)\n }\n\n const config = getCloudAuthStartConfig(c.env)\n if (!config) {\n return cloudAuthNotConfiguredResponse(c)\n }\n\n try {\n const start = await createCloudAdminAuthStart({\n requestUrl: c.req.url,\n next: c.req.query(\"next\"),\n config,\n })\n return new Response(null, {\n status: 302,\n headers: {\n Location: start.redirectUrl,\n \"Set-Cookie\": start.setCookie,\n },\n })\n } catch (error) {\n console.error(\"[auth/cloud/start] Error:\", error)\n return c.json({ error: \"Voyant Cloud auth broker is misconfigured\" }, 500)\n }\n })\n\n auth.get(\"/auth/cloud/callback\", async (c) => {\n if (!isVoyantCloudAuthMode(c.env)) {\n return c.json({ error: \"Not found\" }, 404)\n }\n\n const exchangeConfig = getCloudAuthExchangeConfig(c.env)\n if (!exchangeConfig) {\n const url = new URL(c.req.url)\n return c.json({ error: \"Voyant Cloud auth exchange is not configured yet\" }, 501, {\n \"Set-Cookie\": buildClearCloudAdminAuthStateCookie(\n url.protocol === \"https:\",\n url.pathname.replace(/\\/callback$/, \"\") \|\| \"/auth/cloud\",\n ),\n })\n }\n\n const { db, dispose } = openDatabase(c.env)\n try {\n const betterAuth = buildBetterAuth(c.env, db)\n return await betterAuth.handler(c.req.raw)\n } catch (error) {\n console.error(\"[auth/cloud/callback] Error:\", error)\n return c.json({ error: \"Voyant Cloud auth callback failed\" }, 500)\n } finally {\n c.executionCtx.waitUntil(dispose())\n }\n })\n\n auth.all(\"/auth/api-tokens\", handleApiTokensFacade)\n auth.all(\"/auth/api-tokens/:keyId\", handleApiTokensFacade)\n auth.all(\"/auth/api-tokens/:keyId/rotate\", handleApiTokensFacade)\n auth.get(\"/auth/organization/list-members\", handleOrganizationMembersFacade)\n\n auth.get(\"/auth/customer/status\", async (c) => {\n const { db, dispose } = openDatabase(c.env)\n try {\n const betterAuth = buildBetterAuth(c.env, db, { customerSignup: true })\n const session = await betterAuth.api.getSession({ headers: c.req.raw.headers })\n return c.json({ authenticated: Boolean(session) })\n } finally {\n c.executionCtx.waitUntil(dispose())\n }\n })\n\n auth.all(\"/auth/customer/\", async (c) => {\n if (\n isVoyantCloudAuthMode(c.env) &&\n !isCloudAllowedBetterAuthRoute(rewriteCustomerAuthRequest(c.req.raw))\n ) {\n return localAuthDisabledResponse(c)\n }\n\n const { db, dispose } = openDatabase(c.env)\n try {\n const betterAuth = buildBetterAuth(c.env, db, { customerSignup: true })\n return await betterAuth.handler(rewriteCustomerAuthRequest(c.req.raw))\n } finally {\n c.executionCtx.waitUntil(dispose())\n }\n })\n\n /*\n Catch-all: delegate to Better Auth handler.\n * Handles sign-in, sign-up, sign-out, password reset, OAuth callbacks, etc.\n \n Sign-up is gated by a `user.create.before` hook in @voyant-travel/auth — once a\n * user exists, the hook throws and BA returns an error to the client.\n /\n auth.all(\"/auth/\", async (c) => {\n if (isVoyantCloudAuthMode(c.env) && !isCloudAllowedBetterAuthRoute(c.req.raw)) {\n return localAuthDisabledResponse(c)\n }\n\n const { db, dispose } = openDatabase(c.env)\n try {\n const betterAuth = buildBetterAuth(c.env, db)\n return await betterAuth.handler(c.req.raw)\n } finally {\n c.executionCtx.waitUntil(dispose())\n }\n })\n\n return {\n handler: auth,\n getBootstrapStatusForRequest,\n getCurrentUserForRequest,\n hasAuthPermission,\n resolveAuthRequest,\n validateApiTokenAccess,\n }\n}\n"]}
1	+ {"version":3,"file":"node-runtime.js","sourceRoot":"","sources":["../src/node-runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAwB,gBAAgB,EAAE,MAAM,2BAA2B,CAAA;AAClF,OAAO,EACL,QAAQ,EACR,kBAAkB,EAElB,iBAAiB,GAClB,MAAM,8BAA8B,CAAA;AAErC,OAAO,EACL,cAAc,EACd,eAAe,EACf,SAAS,GACV,MAAM,+CAA+C,CAAA;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAA;AAEhE,OAAO,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAA;AACjE,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAA;AACrC,OAAO,EAAgB,IAAI,EAAE,MAAM,MAAM,CAAA;AACzC,OAAO,EACL,gCAAgC,EAChC,qCAAqC,EACrC,kCAAkC,GACnC,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,mCAAmC,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAA;AAClG,OAAO,EAEL,gBAAgB,EAChB,+BAA+B,EAC/B,gCAAgC,GACjC,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAA;AAmDzD,mFAAmF;AACnF,MAAM,UAAU,oCAAoC,CAClD,GAAoD;IAIpD,MAAM,MAAM,GAAG,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,CAAA;IAC7C,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAA;IAE7B,OAAO;QACL,qBAAqB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE;QAChD,uBAAuB,EAAE,EAAE,MAAM,EAAE;KACpC,CAAA;AACH,CAAC;AAwBD,MAAM,UAAU,6BAA6B,CAC3C,cAAyD;IAIzD,MAAM,YAAY,GAChB,cAAc,CAAC,YAAY;QAC3B,CAAC,CAAC,GAAQ,EAAE,EAAE;YACZ,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAA;YACtC,OAAO,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAc,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAA;QACnE,CAAC,CAAC,CAAA;IAEJ,MAAM,IAAI,GAAG,IAAI,IAAI,EAAe,CAAA;IACpC,iEAAiE;IACjE,+EAA+E;IAC/E,+EAA+E;IAC/E,oEAAoE;IACpE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;IACxB,oEAAoE;IACpE,4EAA4E;IAC5E,2EAA2E;IAC3E,4EAA4E;IAC5E,wEAAwE;IACxE,8EAA8E;IAC9E,yEAAyE;IACzE,kEAAkE;IAClE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QAC9B,MAAM,IAAI,EAAE,CAAA;QACZ,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;YACxB,eAAe,CAAC,cAAc,CAAC,QAAQ,EAAE,CAAC,EAAE;gBAC1C,SAAS,EAAE,YAAY,EAAE,IAAI,EAAE;gBAC/B,GAAG,EAAE,cAAc,CAAC,OAAO;gBAC3B,KAAK,EAAE,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;gBAC9D,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE;aAC3F,CAAC,CAAA;QACJ,CAAC;IACH,CAAC,CAAC,CAAA;IACF,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CACtB,cAAc,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,QAAQ,EAAE,cAAc,CAAC,QAAQ,EAAE,OAAO,EAAE,cAAc,CAAC,OAAO,EAAE,CAAC,CAC/F,CAAA;IAED,MAAM,eAAe,GAAG,uBAAuB,CAAA;IAC/C,MAAM,2BAA2B,GAAG,IAAI,GAAG,CAAC;QAC1C,mBAAmB;QACnB,YAAY;QACZ,eAAe;QACf,gBAAgB;QAChB,aAAa;KACd,CAAC,CAAA;IAEF,SAAS,uBAAuB,CAAC,IAAS;QACxC,OAAO,cAAc,CAAC,QAAQ,CAAA;IAChC,CAAC;IAED,SAAS,qBAAqB,CAAC,GAAQ;QACrC,OAAO,uBAAuB,CAAC,GAAG,CAAC,KAAK,cAAc,CAAA;IACxD,CAAC;IAED,SAAS,6BAA6B,CAAC,OAAgB;QACrD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAChC,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,GAAG,CAAA;QACxD,OAAO,2BAA2B,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IAClD,CAAC;IAED,SAAS,yBAAyB,CAAC,CAAuB;QACxD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0DAA0D,EAAE,EAAE,GAAG,CAAC,CAAA;IAC3F,CAAC;IAED,SAAS,8BAA8B,CAAC,CAAuB;QAC7D,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gDAAgD,EAAE,EAAE,GAAG,CAAC,CAAA;IACjF,CAAC;IAED,SAAS,YAAY,CAAC,GAAW;QAC/B,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IACtC,CAAC;IAED,SAAS,SAAS,CAAC,GAAQ;QACzB,MAAM,UAAU,GAAG;YACjB,GAAG,CAAC,OAAO;YACX,GAAG,CAAC,aAAa;YACjB,GAAG,CAAC,cAAc,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACjC,eAAe;SAChB,CAAA;QAED,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACjE,OAAO,YAAY,CAAC,SAAS,CAAC,CAAA;YAChC,CAAC;QACH,CAAC;QAED,OAAO,eAAe,CAAA;IACxB,CAAC;IAED,SAAS,iBAAiB,CAAC,GAAQ;QACjC,OAAO,KAAK,CAAC,IAAI,CACf,IAAI,GAAG,CACL,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,aAAa,EAAE,GAAG,CAAC,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;aACvE,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC;aAC7B,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CACtD,CACF,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;IACrB,CAAC;IAED,SAAS,cAAc,CAAC,GAAQ;QAC9B,yEAAyE;QACzE,0EAA0E;QAC1E,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAA;QAC7B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAA;YAC9B,OAAO,GAAG,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,IAAI,EAAE,CAAA;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,MAAM,CAAA;QACf,CAAC;IACH,CAAC;IAED,SAAS,mBAAmB,CAAC,GAAQ;QACnC,MAAM,SAAS,GAAG,GAAG,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAA;QAC5F,MAAM,UAAU,GAAG,YAAY,CAAC,SAAS,CAAC,CAAA;QAE1C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAA;YAClC,IAAI,MAAM,CAAC,QAAQ,KAAK,GAAG,IAAI,MAAM,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;gBACtD,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAA;gBACxB,OAAO,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAA;YACxC,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,UAAU,CAAA;QACnB,CAAC;QAED,OAAO,UAAU,CAAA;IACnB,CAAC;IAED,SAAS,uBAAuB,CAAC,GAAQ;QACvC,MAAM,YAAY,GAAG,GAAG,CAAC,0BAA0B,EAAE,IAAI,EAAE,CAAA;QAC3D,MAAM,iBAAiB,GAAG,GAAG,CAAC,iCAAiC,EAAE,IAAI,EAAE,CAAA;QACvE,IAAI,CAAC,YAAY,IAAI,CAAC,iBAAiB;YAAE,OAAO,IAAI,CAAA;QAEpD,OAAO;YACL,iBAAiB;YACjB,YAAY;YACZ,gBAAgB,EAAE,GAAG,mBAAmB,CAAC,GAAG,CAAC,sBAAsB;YACnE,YAAY,EAAE,GAAG,CAAC,qBAAqB;YACvC,KAAK,EAAE,GAAG,CAAC,mBAAmB,EAAE,IAAI,EAAE,IAAI,SAAS;YACnD,WAAW,EAAE,GAAG,CAAC,wBAAwB,EAAE,IAAI,EAAE,IAAI,SAAS;SAC/D,CAAA;IACH,CAAC;IAED,SAAS,0BAA0B,CAAC,GAAQ;QAC1C,MAAM,YAAY,GAAG,GAAG,CAAC,0BAA0B,EAAE,IAAI,EAAE,CAAA;QAC3D,MAAM,WAAW,GAAG,GAAG,CAAC,oCAAoC,EAAE,IAAI,EAAE,CAAA;QACpE,MAAM,gBAAgB,GAAG,GAAG,CAAC,gCAAgC,EAAE,IAAI,EAAE,CAAA;QACrE,MAAM,WAAW,GAAG,GAAG,CAAC,oCAAoC,EAAE,IAAI,EAAE,CAAA;QACpE,IAAI,CAAC,YAAY,IAAI,CAAC,WAAW,IAAI,CAAC,gBAAgB,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,CAAA;QAEnF,OAAO;YACL,WAAW;YACX,YAAY;YACZ,WAAW;YACX,gBAAgB;YAChB,iBAAiB,EAAE,GAAG,CAAC,gCAAgC,EAAE,IAAI,EAAE,IAAI,YAAY;SAChF,CAAA;IACH,CAAC;IAED,SAAS,4BAA4B,CAAC,GAAQ;QAC5C,MAAM,YAAY,GAAG,GAAG,CAAC,0BAA0B,EAAE,IAAI,EAAE,CAAA;QAC3D,MAAM,aAAa,GAAG,GAAG,CAAC,sCAAsC,EAAE,IAAI,EAAE,CAAA;QACxE,MAAM,WAAW,GAAG,GAAG,CAAC,oCAAoC,EAAE,IAAI,EAAE,CAAA;QACpE,IAAI,CAAC,YAAY,IAAI,CAAC,aAAa,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,CAAA;QAEhE,OAAO;YACL,aAAa;YACb,YAAY;YACZ,WAAW;SACZ,CAAA;IACH,CAAC;IAED,SAAS,cAAc,CAAC,OAAgB;QACtC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAA;QAC9C,OAAO,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,WAAW,CAAA;IAC7D,CAAC;IAED,SAAS,oCAAoC,CAAC,GAAQ,EAAE,OAAgB;QACtE,OAAO,GAAG,CAAC,gCAAgC,KAAK,GAAG,IAAI,cAAc,CAAC,OAAO,CAAC,CAAA;IAChF,CAAC;IAED,SAAS,sBAAsB,CAAC,GAAQ;QACtC,OAAO,GAAG,CAAC,gCAAgC,KAAK,GAAG,CAAA;IACrD,CAAC;IAgBD,SAAS,eAAe,CAAC,GAAQ,EAAE,EAAY,EAAE,UAAkC,EAAE;QACnF,MAAM,WAAW,GAAG,cAAc,CAAC,kBAAkB,EAAE,CAAC,GAAG,CAAC,CAAA;QAC5D,MAAM,iBAAiB,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,0BAA0B,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QAC7F,MAAM,MAAM,GAAG,EAA+D,CAAA;QAC9E,MAAM,WAAW,GAAG,EAAkE,CAAA;QAEtF,OAAO,gBAAgB,CAAC;YACtB,4DAA4D;YAC5D,+DAA+D;YAC/D,4DAA4D;YAC5D,gEAAgE;YAChE,+DAA+D;YAC/D,iDAAiD;YACjD,EAAE,EAAE,MAAM;YACV,MAAM,EAAE,GAAG,CAAC,kBAAkB;YAC9B,OAAO,EAAE,cAAc,CAAC,GAAG,CAAC;YAC5B,QAAQ,EAAE,OAAO;YACjB,cAAc,EAAE,iBAAiB,CAAC,GAAG,CAAC;YACtC,QAAQ,EAAE,CAAC,cAAc,CAAC,cAAc,IAAI,oCAAoC,CAAC,CAAC,GAAG,CAAC;YACtF,sBAAsB,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS;YACzE,OAAO,EAAE,iBAAiB;gBACxB,CAAC,CAAC;oBACE,gCAAgC,CAAC;wBAC/B,EAAE,EAAE,WAAW;wBACf,YAAY,EAAE,GAAG,CAAC,qBAAqB;wBACvC,QAAQ,EAAE,iBAAiB;qBAC5B,CAAC;iBACH;gBACH,CAAC,CAAC,SAAS;YACb,iBAAiB,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE;gBACzC,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjB,wEAAwE;oBACxE,iEAAiE;oBACjE,mEAAmE;oBACnE,IAAI,sBAAsB,CAAC,GAAG,CAAC,EAAE,CAAC;wBAChC,OAAO,CAAC,IAAI,CAAC,6CAA6C,IAAI,CAAC,KAAK,KAAK,GAAG,EAAE,CAAC,CAAA;wBAC/E,OAAM;oBACR,CAAC;oBACD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAA;gBACpE,CAAC;gBACD,MAAM,WAAW,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAA;YACpD,CAAC;YACD,mBAAmB,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE;gBAClD,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjB,wEAAwE;oBACxE,gEAAgE;oBAChE,mEAAmE;oBACnE,IAAI,sBAAsB,CAAC,GAAG,CAAC,EAAE,CAAC;wBAChC,OAAO,CAAC,IAAI,CAAC,6CAA6C,IAAI,QAAQ,KAAK,KAAK,GAAG,EAAE,CAAC,CAAA;wBACtF,OAAM;oBACR,CAAC;oBACD,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAA;gBACtE,CAAC;gBACD,MAAM,WAAW,CAAC,mBAAmB,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAA;YAC7D,CAAC;SACF,CAAC,CAAA;IACJ,CAAC;IAED,SAAS,0BAA0B,CAAC,OAAgB;QAClD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAChC,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAA;QAC9D,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;IAClC,CAAC;IAED,MAAM,kBAAkB,GAAG,CAAC,GAAG,CAAC,CAAA;IAEhC,SAAS,qBAAqB,CAAC,IAA+B;QAC5D,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,CAAA;QAChC,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAA;QACtB,MAAM,cAAc,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;QACxD,MAAM,QAAQ,GACZ,cAAc,KAAK,QAAQ;YACzB,CAAC,CAAC,QAAQ;YACV,CAAC,CAAC,cAAc,KAAK,OAAO;gBAC1B,CAAC,CAAC,QAAQ;gBACV,CAAC,CAAC,cAAc,CAAA;QACtB,MAAM,QAAQ,GAAG,cAAc,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,CACxD,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,MAAM,CAAC,EAAE,KAAK,QAAQ,CAC9D,CAAA;QACD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IACpE,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,UAAU,mBAAmB,CAAC,EAAY,EAAE,GAAQ,EAAE,MAAc;QACvE,IAAI,qBAAqB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/B,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE;iBACpB,MAAM,CAAC,EAAE,MAAM,EAAE,kBAAkB,CAAC,MAAM,EAAE,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,EAAE,CAAC;iBACpF,IAAI,CAAC,kBAAkB,CAAC;iBACxB,KAAK,CAAC,EAAE,CAAC,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;iBAC5C,KAAK,CAAC,CAAC,CAAC,CAAA;YACX,OAAO,IAAI,EAAE,MAAM,IAAI,qBAAqB,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,kBAAkB,CAAA;QACpF,CAAC;QAED,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;aACvB,MAAM,CAAC,EAAE,WAAW,EAAE,iBAAiB,CAAC,WAAW,EAAE,CAAC;aACtD,IAAI,CAAC,iBAAiB,CAAC;aACvB,KAAK,CAAC,EAAE,CAAC,iBAAiB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;aACvC,KAAK,CAAC,CAAC,CAAC,CAAA;QACX,OAAO,OAAO,EAAE,WAAW,IAAI,kBAAkB,CAAA;IACnD,CAAC;IAED,KAAK,UAAU,kBAAkB,CAC/B,OAAgB,EAChB,GAAQ;QAER,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAA;QACzC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;YACrC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAA;YAEvE,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,IAAI,CAAA;YACb,CAAC;YAED,IAAI,qBAAqB,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC/B,MAAM,gBAAgB,GAAG,4BAA4B,CAAC,GAAG,CAAC,CAAA;gBAC1D,IAAI,CAAC,gBAAgB,EAAE,CAAC;oBACtB,OAAO,IAAI,CAAA;gBACb,CAAC;gBAED,IAAI,CAAC;oBACH,MAAM,YAAY,GAAG,MAAM,qCAAqC,CAAC;wBAC/D,EAAE,EAAE,EAAuE;wBAC3E,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE;wBAC7B,MAAM,EAAE,gBAAgB;qBACzB,CAAC,CAAA;oBAEF,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;wBACrB,OAAO,IAAI,CAAA;oBACb,CAAC;gBACH,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,OAAO,CAAC,KAAK,CAAC,2CAA2C,EAAE,KAAK,CAAC,CAAA;oBACjE,OAAO,IAAI,CAAA;gBACb,CAAC;YACH,CAAC;YAED,OAAO;gBACL,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;gBACvB,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE;gBAC7B,cAAc,EAAE,IAAI;gBACpB,UAAU,EAAE,SAAS;gBACrB,KAAK,EAAE,OAAO;gBACd,yEAAyE;gBACzE,uEAAuE;gBACvE,gEAAgE;gBAChE,sEAAsE;gBACtE,MAAM,EAAE,MAAM,mBAAmB,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC3D,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI;aAClC,CAAA;QACH,CAAC;gBAAS,CAAC;YACT,gEAAgE;YAChE,kEAAkE;YAClE,0BAA0B;YAC1B,MAAM,OAAO,EAAE,CAAA;QACjB,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,UAAU,iBAAiB,CAAC,OAAgB,EAAE,GAAQ;QACzD,MAAM,IAAI,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;QACnD,OAAO,IAAI,KAAK,IAAI,CAAA;IACtB,CAAC;IAED,MAAM,wBAAyB,SAAQ,KAAK;QAC1C;YACE,KAAK,CAAC,gBAAgB,CAAC,CAAA;YACvB,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAA;QACxC,CAAC;KACF;IAED,KAAK,UAAU,wBAAwB,CACrC,OAAgB,EAChB,GAAQ;QAER,IAAI,oCAAoC,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,CAAC;YACvD,OAAO,IAAI,CAAA;QACb,CAAC;QAED,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAA;QACzC,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,eAAe,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;YAC3C,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAA;YAC7E,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,IAAI,CAAA;YACb,CAAC;YAED,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;iBACnB,MAAM,CAAC;gBACN,EAAE,EAAE,QAAQ,CAAC,EAAE;gBACf,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,SAAS,EAAE,QAAQ,CAAC,SAAS;gBAC7B,SAAS,EAAE,iBAAiB,CAAC,SAAS;gBACtC,QAAQ,EAAE,iBAAiB,CAAC,QAAQ;gBACpC,MAAM,EAAE,iBAAiB,CAAC,MAAM;gBAChC,QAAQ,EAAE,iBAAiB,CAAC,QAAQ;gBACpC,OAAO,EAAE,iBAAiB,CAAC,OAAO;gBAClC,SAAS,EAAE,iBAAiB,CAAC,SAAS;gBACtC,YAAY,EAAE,iBAAiB,CAAC,YAAY;gBAC5C,aAAa,EAAE,iBAAiB,CAAC,aAAa;aAC/C,CAAC;iBACD,IAAI,CAAC,QAAQ,CAAC;iBACd,QAAQ,CAAC,iBAAiB,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;iBAClE,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;iBACvC,KAAK,CAAC,CAAC,CAAC,CAAA;YAEX,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,MAAM,IAAI,wBAAwB,EAAE,CAAA;YACtC,CAAC;YAED,OAAO;gBACL,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;gBAC5C,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,IAAI;gBAChC,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,IAAI;gBAC9B,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,IAAI;gBAC1B,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,IAAI;gBAC9B,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,IAAI;gBAC5B,YAAY,EAAE,GAAG,CAAC,YAAY,IAAI,KAAK;gBACvC,aAAa,EAAE,GAAG,CAAC,aAAa,IAAI,KAAK;gBACzC,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,WAAW,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACnE,iBAAiB,EAAE,GAAG,CAAC,SAAS,IAAI,IAAI;aACzC,CAAA;QACH,CAAC;gBAAS,CAAC;YACT,MAAM,OAAO,EAAE,CAAA;QACjB,CAAC;IACH,CAAC;IAED,KAAK,UAAU,4BAA4B,CACzC,OAAgB,EAChB,GAAQ;QAER,IAAI,oCAAoC,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,CAAC;YACvD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAA;QAC3B,CAAC;QAED,IAAI,qBAAqB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/B,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAA;QACrD,CAAC;QAED,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAA;QACzC,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,GAAG,CAAQ,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YACnF,OAAO,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAA;QAC/D,CAAC;gBAAS,CAAC;YACT,MAAM,OAAO,EAAE,CAAA;QACjB,CAAC;IACH,CAAC;IAED,KAAK,UAAU,sBAAsB,CACnC,GAAQ,EACR,EAAY,EACZ,MAAoB;QAEpB,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAA;QAE5C,MAAM,gBAAgB,GAAG,4BAA4B,CAAC,GAAG,CAAC,CAAA;QAC1D,IAAI,CAAC,gBAAgB;YAAE,OAAO,KAAK,CAAA;QAEnC,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,MAAM,kCAAkC,CAAC;gBAC5D,EAAE,EAAE,EAAoE;gBACxE,MAAM,EAAE,MAAM,CAAC,WAAW;gBAC1B,MAAM,EAAE,gBAAgB;aACzB,CAAC,CAAA;YACF,OAAO,YAAY,CAAC,EAAE,CAAA;QACxB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,6CAA6C,EAAE,KAAK,CAAC,CAAA;YACnE,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC/B,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,MAAM,wBAAwB,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAA;YACpE,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAA;YAC/C,CAAC;YACD,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QAC5B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,wBAAwB,EAAE,CAAC;gBAC9C,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,GAAG,CAAC,CAAA;YACjD,CAAC;YACD,MAAM,KAAK,CAAA;QACb,CAAC;IACH,CAAC,CAAC,CAAA;IAEF;;;;;OAKG;IACH,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACnC,mEAAmE;QACnE,oCAAoC;QACpC,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;QAC3C,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,eAAe,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;YAC7C,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;YAC/E,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAA;YAC5D,CAAC;YAED,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,EAAE,CAAA;YAE9B,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAC3C,EAAoD,EACpD,MAAM,CACP,CAAA;YACD,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;gBAC/C,OAAO,CAAC,KAAK,CAAC,sBAAsB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAA;gBACpD,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;YAC5B,CAAC;YAED,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACvB,CAAC;gBAAS,CAAC;YACT,CAAC,CAAC,YAAY,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAA;QACrC,CAAC;IACH,CAAC,CAAC,CAAA;IAEF;;;;OAIG;IACH,IAAI,CAAC,GAAG,CAAC,wBAAwB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC7C,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,4BAA4B,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;IACrE,CAAC,CAAC,CAAA;IAEF,KAAK,UAAU,qBAAqB,CAAC,CAAuB;QAC1D,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;QAC3C,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,eAAe,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;YAC7C,MAAM,WAAW,GAAG,EAAuE,CAAA;YAE3F,IAAI,qBAAqB,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;gBACjC,MAAM,gBAAgB,GAAG,4BAA4B,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;gBAC5D,IAAI,CAAC,gBAAgB,EAAE,CAAC;oBACtB,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,kEAAkE,EAAE,EAC7E,GAAG,CACJ,CAAA;gBACH,CAAC;gBAED,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;gBAC/E,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAA;gBAC/C,CAAC;gBAED,IAAI,CAAC;oBACH,MAAM,YAAY,GAAG,MAAM,qCAAqC,CAAC;wBAC/D,EAAE,EAAE,WAAW;wBACf,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE;wBAC7B,MAAM,EAAE,gBAAgB;qBACzB,CAAC,CAAA;oBAEF,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;wBACrB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,EAAE,GAAG,CAAC,CAAA;oBAC9D,CAAC;gBACH,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,OAAO,CAAC,KAAK,CAAC,8CAA8C,EAAE,KAAK,CAAC,CAAA;oBACpE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8CAA8C,EAAE,EAAE,GAAG,CAAC,CAAA;gBAC/E,CAAC;YACH,CAAC;YAED,OAAO,CACL,CAAC,MAAM,+BAA+B,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,EAAE;gBAC5D,EAAE;gBACF,aAAa,EAAE,cAAc,CAAC,aAAa;aAC5C,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAC3C,CAAA;QACH,CAAC;gBAAS,CAAC;YACT,CAAC,CAAC,YAAY,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAA;QACrC,CAAC;IACH,CAAC;IAED,KAAK,UAAU,+BAA+B,CAAC,CAAuB;QACpE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;QAC3C,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,eAAe,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;YAC7C,MAAM,WAAW,GAAG,EAAuE,CAAA;YAE3F,IAAI,qBAAqB,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;gBACjC,MAAM,gBAAgB,GAAG,4BAA4B,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;gBAC5D,IAAI,CAAC,gBAAgB,EAAE,CAAC;oBACtB,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,wEAAwE,EAAE,EACnF,GAAG,CACJ,CAAA;gBACH,CAAC;gBAED,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;gBAC/E,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAA;gBAC/C,CAAC;gBAED,IAAI,CAAC;oBACH,MAAM,YAAY,GAAG,MAAM,qCAAqC,CAAC;wBAC/D,EAAE,EAAE,WAAW;wBACf,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE;wBAC7B,MAAM,EAAE,gBAAgB;qBACzB,CAAC,CAAA;oBAEF,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;wBACrB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,EAAE,GAAG,CAAC,CAAA;oBAC9D,CAAC;gBACH,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,OAAO,CAAC,KAAK,CAAC,wDAAwD,EAAE,KAAK,CAAC,CAAA;oBAC9E,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8CAA8C,EAAE,EAAE,GAAG,CAAC,CAAA;gBAC/E,CAAC;YACH,CAAC;YAED,MAAM,qBAAqB,GAAG,EAEpB,CAAA;YACV,OAAO,CACL,CAAC,MAAM,gCAAgC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,EAAE;gBAC7D,EAAE,EAAE,qBAAqB;aAC1B,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAC3C,CAAA;QACH,CAAC;gBAAS,CAAC;YACT,CAAC,CAAC,YAAY,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAA;QACrC,CAAC;IACH,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,mBAAmB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACxC,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;YAClC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAA;QAC5C,CAAC;QAED,MAAM,MAAM,GAAG,uBAAuB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;QAC7C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,8BAA8B,CAAC,CAAC,CAAC,CAAA;QAC1C,CAAC;QAED,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,yBAAyB,CAAC;gBAC5C,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG;gBACrB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC;gBACzB,MAAM;aACP,CAAC,CAAA;YACF,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;gBACxB,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE;oBACP,QAAQ,EAAE,KAAK,CAAC,WAAW;oBAC3B,YAAY,EAAE,KAAK,CAAC,SAAS;iBAC9B;aACF,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,2BAA2B,EAAE,KAAK,CAAC,CAAA;YACjD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2CAA2C,EAAE,EAAE,GAAG,CAAC,CAAA;QAC5E,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,IAAI,CAAC,GAAG,CAAC,sBAAsB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC3C,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;YAClC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAA;QAC5C,CAAC;QAED,MAAM,cAAc,GAAG,0BAA0B,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;QACxD,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAC9B,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kDAAkD,EAAE,EAAE,GAAG,EAAE;gBAChF,YAAY,EAAE,mCAAmC,CAC/C,GAAG,CAAC,QAAQ,KAAK,QAAQ,EACzB,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,IAAI,aAAa,CACzD;aACF,CAAC,CAAA;QACJ,CAAC;QAED,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;QAC3C,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,eAAe,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;YAC7C,OAAO,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC5C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,8BAA8B,EAAE,KAAK,CAAC,CAAA;YACpD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mCAAmC,EAAE,EAAE,GAAG,CAAC,CAAA;QACpE,CAAC;gBAAS,CAAC;YACT,CAAC,CAAC,YAAY,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAA;QACrC,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,IAAI,CAAC,GAAG,CAAC,kBAAkB,EAAE,qBAAqB,CAAC,CAAA;IACnD,IAAI,CAAC,GAAG,CAAC,yBAAyB,EAAE,qBAAqB,CAAC,CAAA;IAC1D,IAAI,CAAC,GAAG,CAAC,gCAAgC,EAAE,qBAAqB,CAAC,CAAA;IACjE,IAAI,CAAC,GAAG,CAAC,iCAAiC,EAAE,+BAA+B,CAAC,CAAA;IAE5E,IAAI,CAAC,GAAG,CAAC,uBAAuB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC5C,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;QAC3C,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,eAAe,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAA;YACvE,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;YAC/E,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QACpD,CAAC;gBAAS,CAAC;YACT,CAAC,CAAC,YAAY,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAA;QACrC,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,IAAI,CAAC,GAAG,CAAC,kBAAkB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACvC,IACE,qBAAqB,CAAC,CAAC,CAAC,GAAG,CAAC;YAC5B,CAAC,6BAA6B,CAAC,0BAA0B,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EACrE,CAAC;YACD,OAAO,yBAAyB,CAAC,CAAC,CAAC,CAAA;QACrC,CAAC;QAED,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;QAC3C,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,eAAe,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAA;YACvE,OAAO,MAAM,UAAU,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAA;QACxE,CAAC;gBAAS,CAAC;YACT,CAAC,CAAC,YAAY,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAA;QACrC,CAAC;IACH,CAAC,CAAC,CAAA;IAEF;;;;;;OAMG;IACH,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC9B,IAAI,qBAAqB,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9E,OAAO,yBAAyB,CAAC,CAAC,CAAC,CAAA;QACrC,CAAC;QAED,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;QAC3C,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,eAAe,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;YAC7C,OAAO,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC5C,CAAC;gBAAS,CAAC;YACT,CAAC,CAAC,YAAY,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAA;QACrC,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,OAAO;QACL,OAAO,EAAE,IAAI;QACb,4BAA4B;QAC5B,wBAAwB;QACxB,iBAAiB;QACjB,kBAAkB;QAClB,sBAAsB;KACvB,CAAA;AACH,CAAC","sourcesContent":["/*\n Better Auth Node runtime for Hono.\n \n agent-quality: file-size exception -- Auth handler keeps local and Voyant Cloud auth flows co-located until the route surface is split by auth mode.\n \n Mounts Better Auth at /auth/* for authentication operations.\n * Same-origin — no CORS needed. Session cookies work naturally.\n \n Also provides /auth/status (user provisioning) and /auth/me (user info).\n /\n\nimport { type NodeDatabaseEnv, openNodeDatabase } from \"@voyant-travel/db/runtime\"\nimport {\n authUser,\n cloudAuthUserLinks,\n type SelectApikey,\n userProfilesTable,\n} from \"@voyant-travel/db/schema/iam\"\nimport type { Reporter, VoyantDb, VoyantRequestAuthContext } from \"@voyant-travel/hono\"\nimport {\n handleApiError,\n reportException,\n requestId,\n} from \"@voyant-travel/hono/middleware/error-boundary\"\nimport { getRequestId } from \"@voyant-travel/hono/observability\"\nimport type { AccessCatalog } from \"@voyant-travel/types/api-keys\"\nimport { scopesForRole } from \"@voyant-travel/types/member-roles\"\nimport { eq, sql } from \"drizzle-orm\"\nimport { type Context, Hono } from \"hono\"\nimport {\n createVoyantCloudAdminAuthPlugin,\n revalidateVoyantCloudAdminAuthSession,\n revalidateVoyantCloudAdminAuthUser,\n} from \"./cloud-admin-session.js\"\nimport { buildClearCloudAdminAuthStateCookie, createCloudAdminAuthStart } from \"./cloud-broker.js\"\nimport {\n type CreateBetterAuthOptions,\n createBetterAuth,\n handleApiTokenManagementRequest,\n handleOrganizationMembersRequest,\n} from \"./server.js\"\nimport { ensureCurrentUserProfile } from \"./workspace.js\"\n\n// Type ctx so that `c.get(\"db\")` resolves to the parent app's middleware-\n// set `VoyantDb` from the deployment's database lifecycle adapter. Without\n// this, the sub-app sees `unknown` for context vars.\ntype OperatorAuthMode = \"local\" \| \"voyant-cloud\"\n\nexport interface OperatorAuthNodeEnv extends NodeDatabaseEnv {\n API_BASE_URL?: string\n APP_URL?: string\n AUTH_COOKIE_DOMAIN?: string\n BETTER_AUTH_SECRET: string\n CORS_ALLOWLIST?: string\n DASH_BASE_URL?: string\n EMAIL_FROM?: string\n SESSION_CLAIMS_SECRET: string\n VOYANT_ADMIN_AUTH_MODE?: string\n VOYANT_AUTH_LOG_SECRET_FALLBACKS?: string\n VOYANT_CLOUD_ADMIN_AUTH_AUDIENCE?: string\n VOYANT_CLOUD_ADMIN_AUTH_CLIENT_TOKEN?: string\n VOYANT_CLOUD_ADMIN_AUTH_EXCHANGE_URL?: string\n VOYANT_CLOUD_ADMIN_AUTH_JWKS_URL?: string\n VOYANT_CLOUD_ADMIN_AUTH_REVALIDATE_URL?: string\n VOYANT_CLOUD_ADMIN_AUTH_START_URL?: string\n VOYANT_CLOUD_APP_ID?: string\n VOYANT_CLOUD_DEPLOYMENT_ID?: string\n VOYANT_CLOUD_ENVIRONMENT?: string\n VOYANT_OPERATOR_BROWSER_EVIDENCE?: string\n}\n\nexport interface OperatorCurrentUser {\n id: string\n email: string\n firstName: string \| null\n lastName: string \| null\n locale: string\n timezone: string \| null\n uiPrefs: unknown\n isSuperAdmin: boolean\n isSupportUser: boolean\n createdAt: string\n profilePictureUrl: string \| null\n}\n\nexport type OperatorAuthBootstrapStatus = {\n hasUsers: boolean\n authMode?: OperatorAuthMode\n}\n\ntype BetterAuthAdvancedOptions = NonNullable<CreateBetterAuthOptions[\"advanced\"]>\n\n/* Resolve Better Auth's standard cross-subdomain cookie policy for Node hosts. /\nexport function buildBetterAuthCookieAdvancedOptions(\n env: Pick<OperatorAuthNodeEnv, \"AUTH_COOKIE_DOMAIN\">,\n):\n \| Pick<BetterAuthAdvancedOptions, \"crossSubDomainCookies\" \| \"defaultCookieAttributes\">\n \| undefined {\n const domain = env.AUTH_COOKIE_DOMAIN?.trim()\n if (!domain) return undefined\n\n return {\n crossSubDomainCookies: { enabled: true, domain },\n defaultCookieAttributes: { domain },\n }\n}\n\nexport interface OperatorAuthEmailSender {\n sendResetPassword: (input: {\n user: { email: string; name: string }\n url: string\n }) => Promise<void>\n sendVerificationOtp: (input: { email: string; otp: string; type: string }) => Promise<void>\n}\n\nexport interface CreateOperatorAuthNodeRuntimeOptions<Env extends OperatorAuthNodeEnv> {\n accessCatalog: AccessCatalog\n appName: string\n authMode: OperatorAuthMode\n reporter: Reporter\n openDatabase?: (env: Env) => { db: VoyantDb; dispose: () => Promise<void> }\n cookieAdvanced?: (\n env: Env,\n ) =>\n \| Pick<BetterAuthAdvancedOptions, \"crossSubDomainCookies\" \| \"defaultCookieAttributes\">\n \| undefined\n resolveEmailSender?: (env: Env) => OperatorAuthEmailSender \| null\n}\n\nexport function createOperatorAuthNodeRuntime<Env extends OperatorAuthNodeEnv>(\n runtimeOptions: CreateOperatorAuthNodeRuntimeOptions<Env>,\n) {\n type AuthHonoEnv = { Bindings: Env; Variables: { db: VoyantDb } }\n\n const openDatabase =\n runtimeOptions.openDatabase ??\n ((env: Env) => {\n const resource = openNodeDatabase(env)\n return { db: resource.db as VoyantDb, dispose: resource.dispose }\n })\n\n const auth = new Hono<AuthHonoEnv>()\n // This lean auth app is dispatched around `createVoyantApp` (see\n // hono-api-dispatch.ts), so it must mint/propagate the correlation id and wire\n // the reporter itself — otherwise auth 5xx are an observability blind spot and\n // the user-facing requestId wouldn't be findable (RFC voyant#1553).\n auth.use(\"\", requestId)\n // `onError` only fires on THROWN exceptions. Several handlers (e.g.\n // /auth/status, the cloud token/revalidate/callback paths) instead RETURN a\n // 5xx via `c.json(..., 50x)`; those bypass `onError`, and this lean app is\n // dispatched around `createVoyantApp` so the framework's auth status-bridge\n // (`mountAuthForwarding`) never runs either. Bridge returned 5xx to the\n // reporter here so they aren't an observability blind spot (RFC voyant#1553).\n // Thrown errors skip this middleware's post-`next()` code (the rejection\n // propagates straight to `onError`), so there's no double report.\n auth.use(\"\", async (c, next) => {\n await next()\n if (c.res.status >= 500) {\n reportException(runtimeOptions.reporter, c, {\n requestId: getRequestId() ?? \"\",\n app: runtimeOptions.appName,\n error: new Error(`auth handler returned HTTP ${c.res.status}`),\n context: { path: c.req.path, method: c.req.method, status: c.res.status, surface: \"auth\" },\n })\n }\n })\n auth.onError((err, c) =>\n handleApiError(err, c, { reporter: runtimeOptions.reporter, appName: runtimeOptions.appName }),\n )\n\n const DEFAULT_APP_URL = \"http://localhost:3300\"\n const CLOUD_BETTER_AUTH_ALLOWLIST = new Set([\n \"/auth/get-session\",\n \"/auth/jwks\",\n \"/auth/session\",\n \"/auth/sign-out\",\n \"/auth/token\",\n ])\n\n function resolveOperatorAuthMode(_env: Env): OperatorAuthMode {\n return runtimeOptions.authMode\n }\n\n function isVoyantCloudAuthMode(env: Env): boolean {\n return resolveOperatorAuthMode(env) === \"voyant-cloud\"\n }\n\n function isCloudAllowedBetterAuthRoute(request: Request): boolean {\n const url = new URL(request.url)\n const pathname = url.pathname.replace(/\\/+$/, \"\") \|\| \"/\"\n return CLOUD_BETTER_AUTH_ALLOWLIST.has(pathname)\n }\n\n function localAuthDisabledResponse(c: Context<AuthHonoEnv>) {\n return c.json({ error: \"Local auth routes are disabled in Voyant Cloud auth mode\" }, 404)\n }\n\n function cloudAuthNotConfiguredResponse(c: Context<AuthHonoEnv>) {\n return c.json({ error: \"Voyant Cloud auth broker is not configured yet\" }, 501)\n }\n\n function normalizeUrl(url: string): string {\n return url.trim().replace(/\\/$/, \"\")\n }\n\n function getAppUrl(env: Env): string {\n const candidates = [\n env.APP_URL,\n env.DASH_BASE_URL,\n env.CORS_ALLOWLIST?.split(\",\")[0],\n DEFAULT_APP_URL,\n ]\n\n for (const candidate of candidates) {\n if (typeof candidate === \"string\" && candidate.trim().length > 0) {\n return normalizeUrl(candidate)\n }\n }\n\n return DEFAULT_APP_URL\n }\n\n function getTrustedOrigins(env: Env): string[] {\n return Array.from(\n new Set(\n [env.APP_URL, env.DASH_BASE_URL, ...(env.CORS_ALLOWLIST ?? \"\").split(\",\")]\n .map((value) => value?.trim())\n .filter((value): value is string => Boolean(value)),\n ),\n ).map(normalizeUrl)\n }\n\n function getAuthBaseUrl(env: Env): string {\n // entry.ts strips /api before delegating to the Hono app, so Better Auth\n // sees paths like /auth/. Its baseURL must be the origin only (no /api).\n const appUrl = getAppUrl(env)\n try {\n const parsed = new URL(appUrl)\n return `${parsed.protocol}//${parsed.host}`\n } catch {\n return appUrl\n }\n }\n\n function getPublicApiBaseUrl(env: Env): string {\n const candidate = env.API_BASE_URL?.trim() \|\| env.APP_URL?.trim() \|\| `${getAppUrl(env)}/api`\n const normalized = normalizeUrl(candidate)\n\n try {\n const parsed = new URL(normalized)\n if (parsed.pathname === \"/\" \|\| parsed.pathname === \"\") {\n parsed.pathname = \"/api\"\n return normalizeUrl(parsed.toString())\n }\n } catch {\n return normalized\n }\n\n return normalized\n }\n\n function getCloudAuthStartConfig(env: Env) {\n const deploymentId = env.VOYANT_CLOUD_DEPLOYMENT_ID?.trim()\n const cloudAuthStartUrl = env.VOYANT_CLOUD_ADMIN_AUTH_START_URL?.trim()\n if (!deploymentId \|\| !cloudAuthStartUrl) return null\n\n return {\n cloudAuthStartUrl,\n deploymentId,\n adminCallbackUrl: `${getPublicApiBaseUrl(env)}/auth/cloud/callback`,\n cookieSecret: env.SESSION_CLAIMS_SECRET,\n appId: env.VOYANT_CLOUD_APP_ID?.trim() \|\| undefined,\n environment: env.VOYANT_CLOUD_ENVIRONMENT?.trim() \|\| undefined,\n }\n }\n\n function getCloudAuthExchangeConfig(env: Env) {\n const deploymentId = env.VOYANT_CLOUD_DEPLOYMENT_ID?.trim()\n const exchangeUrl = env.VOYANT_CLOUD_ADMIN_AUTH_EXCHANGE_URL?.trim()\n const assertionJwksUrl = env.VOYANT_CLOUD_ADMIN_AUTH_JWKS_URL?.trim()\n const clientToken = env.VOYANT_CLOUD_ADMIN_AUTH_CLIENT_TOKEN?.trim()\n if (!deploymentId \|\| !exchangeUrl \|\| !assertionJwksUrl \|\| !clientToken) return null\n\n return {\n exchangeUrl,\n deploymentId,\n clientToken,\n assertionJwksUrl,\n assertionAudience: env.VOYANT_CLOUD_ADMIN_AUTH_AUDIENCE?.trim() \|\| deploymentId,\n }\n }\n\n function getCloudAuthRevalidateConfig(env: Env) {\n const deploymentId = env.VOYANT_CLOUD_DEPLOYMENT_ID?.trim()\n const revalidateUrl = env.VOYANT_CLOUD_ADMIN_AUTH_REVALIDATE_URL?.trim()\n const clientToken = env.VOYANT_CLOUD_ADMIN_AUTH_CLIENT_TOKEN?.trim()\n if (!deploymentId \|\| !revalidateUrl \|\| !clientToken) return null\n\n return {\n revalidateUrl,\n deploymentId,\n clientToken,\n }\n }\n\n function isLocalRequest(request: Request): boolean {\n const hostname = new URL(request.url).hostname\n return hostname === \"127.0.0.1\" \|\| hostname === \"localhost\"\n }\n\n function shouldUseBrowserEvidenceAuthFallback(env: Env, request: Request): boolean {\n return env.VOYANT_OPERATOR_BROWSER_EVIDENCE === \"1\" && isLocalRequest(request)\n }\n\n function allowAuthSecretLogging(env: Env): boolean {\n return env.VOYANT_AUTH_LOG_SECRET_FALLBACKS === \"1\"\n }\n\n /*\n Build a Better Auth instance backed by a caller-provided drizzle\n * client. The caller owns the Pool lifecycle (open before, dispose\n * after) so the same Pool can serve both the auth lookup and any\n * subsequent queries the route does — without spinning up a second\n * connection per request.\n \n The deployment decides whether this is a request-scoped or resident Node\n * pool. The Better Auth instance is not cached independently of that owner.\n /\n interface BuildBetterAuthOptions {\n customerSignup?: boolean\n }\n\n function buildBetterAuth(env: Env, db: VoyantDb, options: BuildBetterAuthOptions = {}) {\n const emailSender = runtimeOptions.resolveEmailSender?.(env)\n const cloudAuthExchange = isVoyantCloudAuthMode(env) ? getCloudAuthExchangeConfig(env) : null\n const authDb = db as NonNullable<Parameters<typeof createBetterAuth>[0]>[\"db\"]\n const cloudAuthDb = db as Parameters<typeof createVoyantCloudAdminAuthPlugin>[0][\"db\"]\n\n return createBetterAuth({\n // `db` is a `NeonDatabase` (neon-serverless WebSocket); the\n // `CreateBetterAuthOptions.db` type still references the older\n // `getDb` return union (postgres-js + neon-http). Drizzle's\n // PgDatabase surface is identical across flavors at runtime, so\n // the cast is structurally safe — better-auth's drizzleAdapter\n // works on any PgDatabase. See #500 for context.\n db: authDb,\n secret: env.BETTER_AUTH_SECRET,\n baseURL: getAuthBaseUrl(env),\n basePath: \"/auth\",\n trustedOrigins: getTrustedOrigins(env),\n advanced: (runtimeOptions.cookieAdvanced ?? buildBetterAuthCookieAdvancedOptions)(env),\n customerSignupSurfaces: options.customerSignup ? [\"customer\"] : undefined,\n plugins: cloudAuthExchange\n ? [\n createVoyantCloudAdminAuthPlugin({\n db: cloudAuthDb,\n cookieSecret: env.SESSION_CLAIMS_SECRET,\n exchange: cloudAuthExchange,\n }),\n ]\n : undefined,\n sendResetPassword: async ({ user, url }) => {\n if (!emailSender) {\n // No email provider (e.g. local dev without a sending domain): with the\n // debug flag on, log the link to the console instead of sending;\n // otherwise fail loudly. Never bypasses a configured cloud sender.\n if (allowAuthSecretLogging(env)) {\n console.info(`[auth] reset-password (debug fallback) -> ${user.email}: ${url}`)\n return\n }\n throw new Error(\"Password reset email provider is not configured\")\n }\n await emailSender.sendResetPassword({ user, url })\n },\n sendVerificationOTP: async ({ email, otp, type }) => {\n if (!emailSender) {\n // No email provider (e.g. local dev without a sending domain): with the\n // debug flag on, log the OTP to the console instead of sending;\n // otherwise fail loudly. Never bypasses a configured cloud sender.\n if (allowAuthSecretLogging(env)) {\n console.info(`[auth] verification-otp (debug fallback) [${type}] -> ${email}: ${otp}`)\n return\n }\n throw new Error(\"Verification OTP email provider is not configured\")\n }\n await emailSender.sendVerificationOtp({ email, otp, type })\n },\n })\n }\n\n function rewriteCustomerAuthRequest(request: Request): Request {\n const url = new URL(request.url)\n url.pathname = url.pathname.replace(\"/auth/customer\", \"/auth\")\n return new Request(url, request)\n }\n\n const FULL_ACCESS_SCOPES = [\"\"]\n\n function scopesForOperatorRole(role: string \| null \| undefined): string[] \| null {\n const base = scopesForRole(role)\n if (!base) return null\n const normalizedRole = (role ?? \"\").trim().toLowerCase()\n const presetId =\n normalizedRole === \"member\"\n ? \"editor\"\n : normalizedRole === \"guest\"\n ? \"viewer\"\n : normalizedRole\n const selected = runtimeOptions.accessCatalog.presets.find(\n (preset) => preset.kind === \"staff\" && preset.id === presetId,\n )\n return [...new Set([...base, ...(selected?.grants ?? [])])].sort()\n }\n\n /*\n Resolve a member's RBAC scope set for the request (`resource:action` strings,\n * shared with API keys — see @voyant-travel/types/member-roles, RFC voyant#2085).\n \n Phase 1: storage + seam are wired but default to full access, so behavior is\n * unchanged until an admin assigns permissions (Phase 2) and routes gate on them\n * (Phase 3).\n * - voyant-cloud: assertion-mirrored `cloud_auth_user_links.scopes` if the\n * platform sent them, else the role bundle for `roleSlug`, else full access.\n * - local: the member's `user_profiles.permissions` if assigned, else full\n * access (no local role concept yet).\n /\n async function resolveMemberScopes(db: VoyantDb, env: Env, userId: string): Promise<string[]> {\n if (isVoyantCloudAuthMode(env)) {\n const [link] = await db\n .select({ scopes: cloudAuthUserLinks.scopes, roleSlug: cloudAuthUserLinks.roleSlug })\n .from(cloudAuthUserLinks)\n .where(eq(cloudAuthUserLinks.userId, userId))\n .limit(1)\n return link?.scopes ?? scopesForOperatorRole(link?.roleSlug) ?? FULL_ACCESS_SCOPES\n }\n\n const [profile] = await db\n .select({ permissions: userProfilesTable.permissions })\n .from(userProfilesTable)\n .where(eq(userProfilesTable.id, userId))\n .limit(1)\n return profile?.permissions ?? FULL_ACCESS_SCOPES\n }\n\n async function resolveAuthRequest(\n request: Request,\n env: Env,\n ): Promise<VoyantRequestAuthContext \| null> {\n const { db, dispose } = openDatabase(env)\n try {\n const auth = buildBetterAuth(env, db)\n const session = await auth.api.getSession({ headers: request.headers })\n\n if (!session) {\n return null\n }\n\n if (isVoyantCloudAuthMode(env)) {\n const revalidateConfig = getCloudAuthRevalidateConfig(env)\n if (!revalidateConfig) {\n return null\n }\n\n try {\n const revalidation = await revalidateVoyantCloudAdminAuthSession({\n db: db as Parameters<typeof revalidateVoyantCloudAdminAuthSession>[0][\"db\"],\n sessionId: session.session.id,\n config: revalidateConfig,\n })\n\n if (!revalidation.ok) {\n return null\n }\n } catch (error) {\n console.error(\"[auth/session] Cloud revalidation failed:\", error)\n return null\n }\n }\n\n return {\n userId: session.user.id,\n sessionId: session.session.id,\n organizationId: null,\n callerType: \"session\",\n actor: \"staff\",\n // Member RBAC scope set (RFC voyant#2085). Defaults to full access until\n // an admin assigns permissions, so existing deployments are unchanged.\n // `actor: \"staff\"` is retained, so actor-gated paths (incl. the\n // bookings-pii reveal, which short-circuits on staff) are unaffected.\n scopes: await resolveMemberScopes(db, env, session.user.id),\n email: session.user.email ?? null,\n }\n } finally {\n // No `executionCtx` reachable here (called from middleware that\n // doesn't pass one through). Await inline so the WebSocket closes\n // before this fn returns.\n await dispose()\n }\n }\n\n /\n Single-tenant: every authenticated session is a staff user with full access.\n * When `resolveAuthRequest` has already granted a session, permissions are\n * implicitly allowed. If you need granular RBAC later, switch on\n * `user_profiles.isSuperAdmin` / `isSupportUser` here.\n /\n async function hasAuthPermission(request: Request, env: Env): Promise<boolean> {\n const auth = await resolveAuthRequest(request, env)\n return auth !== null\n }\n\n class CurrentUserNotFoundError extends Error {\n constructor() {\n super(\"User not found\")\n this.name = \"CurrentUserNotFoundError\"\n }\n }\n\n async function getCurrentUserForRequest(\n request: Request,\n env: Env,\n ): Promise<OperatorCurrentUser \| null> {\n if (shouldUseBrowserEvidenceAuthFallback(env, request)) {\n return null\n }\n\n const { db, dispose } = openDatabase(env)\n try {\n const betterAuth = buildBetterAuth(env, db)\n const session = await betterAuth.api.getSession({ headers: request.headers })\n if (!session) {\n return null\n }\n\n const [row] = await db\n .select({\n id: authUser.id,\n email: authUser.email,\n createdAt: authUser.createdAt,\n firstName: userProfilesTable.firstName,\n lastName: userProfilesTable.lastName,\n locale: userProfilesTable.locale,\n timezone: userProfilesTable.timezone,\n uiPrefs: userProfilesTable.uiPrefs,\n avatarUrl: userProfilesTable.avatarUrl,\n isSuperAdmin: userProfilesTable.isSuperAdmin,\n isSupportUser: userProfilesTable.isSupportUser,\n })\n .from(authUser)\n .leftJoin(userProfilesTable, eq(userProfilesTable.id, authUser.id))\n .where(eq(authUser.id, session.user.id))\n .limit(1)\n\n if (!row) {\n throw new CurrentUserNotFoundError()\n }\n\n return {\n id: row.id,\n email: row.email ?? session.user.email ?? \"\",\n firstName: row.firstName ?? null,\n lastName: row.lastName ?? null,\n locale: row.locale ?? \"en\",\n timezone: row.timezone ?? null,\n uiPrefs: row.uiPrefs ?? null,\n isSuperAdmin: row.isSuperAdmin ?? false,\n isSupportUser: row.isSupportUser ?? false,\n createdAt: row.createdAt?.toISOString() ?? new Date().toISOString(),\n profilePictureUrl: row.avatarUrl ?? null,\n }\n } finally {\n await dispose()\n }\n }\n\n async function getBootstrapStatusForRequest(\n request: Request,\n env: Env,\n ): Promise<OperatorAuthBootstrapStatus> {\n if (shouldUseBrowserEvidenceAuthFallback(env, request)) {\n return { hasUsers: true }\n }\n\n if (isVoyantCloudAuthMode(env)) {\n return { hasUsers: true, authMode: \"voyant-cloud\" }\n }\n\n const { db, dispose } = openDatabase(env)\n try {\n const [row] = await db.select({ count: sql<number>`count()::int` }).from(authUser)\n return { hasUsers: (row?.count ?? 0) > 0, authMode: \"local\" }\n } finally {\n await dispose()\n }\n }\n\n async function validateApiTokenAccess(\n env: Env,\n db: VoyantDb,\n apiKey: SelectApikey,\n ): Promise<boolean> {\n if (!isVoyantCloudAuthMode(env)) return true\n\n const revalidateConfig = getCloudAuthRevalidateConfig(env)\n if (!revalidateConfig) return false\n\n try {\n const revalidation = await revalidateVoyantCloudAdminAuthUser({\n db: db as Parameters<typeof revalidateVoyantCloudAdminAuthUser>[0][\"db\"],\n userId: apiKey.referenceId,\n config: revalidateConfig,\n })\n return revalidation.ok\n } catch (error) {\n console.error(\"[auth/api-token] Cloud revalidation failed:\", error)\n return false\n }\n }\n\n /*\n GET /auth/me\n * Returns the current authenticated user's profile.\n * Validates the session cookie directly (no Bearer token needed).\n /\n auth.get(\"/auth/me\", async (c) => {\n try {\n const currentUser = await getCurrentUserForRequest(c.req.raw, c.env)\n if (!currentUser) {\n return c.json({ error: \"Unauthorized\" }, 401)\n }\n return c.json(currentUser)\n } catch (error) {\n if (error instanceof CurrentUserNotFoundError) {\n return c.json({ error: \"User not found\" }, 404)\n }\n throw error\n }\n })\n\n /\n GET /auth/status\n * Ensures the authenticated user has a user_profiles row.\n * Profile is normally created by the BA databaseHook on sign-up,\n * but this route serves as an idempotent fallback.\n /\n auth.get(\"/auth/status\", async (c) => {\n // See `/auth/me` above — auth sub-app runs before the request `db`\n // middleware, so own the Pool here.\n const { db, dispose } = openDatabase(c.env)\n try {\n const betterAuth = buildBetterAuth(c.env, db)\n const session = await betterAuth.api.getSession({ headers: c.req.raw.headers })\n if (!session) {\n return c.json({ userExists: false, authenticated: false })\n }\n\n const userId = session.user.id\n\n const status = await ensureCurrentUserProfile(\n db as Parameters<typeof ensureCurrentUserProfile>[0],\n userId,\n )\n if (!status.userExists && status.authenticated) {\n console.error(\"[auth/status] Error:\", status.reason)\n return c.json(status, 500)\n }\n\n return c.json(status)\n } finally {\n c.executionCtx.waitUntil(dispose())\n }\n })\n\n /\n GET /auth/bootstrap-status\n * Public endpoint — reveals whether any user exists. Used by the sign-in /\n * sign-up route loaders to pick the right flow.\n /\n auth.get(\"/auth/bootstrap-status\", async (c) => {\n return c.json(await getBootstrapStatusForRequest(c.req.raw, c.env))\n })\n\n async function handleApiTokensFacade(c: Context<AuthHonoEnv>) {\n const { db, dispose } = openDatabase(c.env)\n try {\n const betterAuth = buildBetterAuth(c.env, db)\n const cloudAuthDb = db as Parameters<typeof revalidateVoyantCloudAdminAuthSession>[0][\"db\"]\n\n if (isVoyantCloudAuthMode(c.env)) {\n const revalidateConfig = getCloudAuthRevalidateConfig(c.env)\n if (!revalidateConfig) {\n return c.json(\n { error: \"Cloud-mode API token management requires membership revalidation\" },\n 501,\n )\n }\n\n const session = await betterAuth.api.getSession({ headers: c.req.raw.headers })\n if (!session) {\n return c.json({ error: \"Unauthorized\" }, 401)\n }\n\n try {\n const revalidation = await revalidateVoyantCloudAdminAuthSession({\n db: cloudAuthDb,\n sessionId: session.session.id,\n config: revalidateConfig,\n })\n\n if (!revalidation.ok) {\n return c.json({ error: \"Voyant Cloud access revoked\" }, 403)\n }\n } catch (error) {\n console.error(\"[auth/api-tokens] Cloud revalidation failed:\", error)\n return c.json({ error: \"Voyant Cloud access could not be revalidated\" }, 503)\n }\n }\n\n return (\n (await handleApiTokenManagementRequest(c.req.raw, betterAuth, {\n db,\n accessCatalog: runtimeOptions.accessCatalog,\n })) ?? c.json({ error: \"Not found\" }, 404)\n )\n } finally {\n c.executionCtx.waitUntil(dispose())\n }\n }\n\n async function handleOrganizationMembersFacade(c: Context<AuthHonoEnv>) {\n const { db, dispose } = openDatabase(c.env)\n try {\n const betterAuth = buildBetterAuth(c.env, db)\n const cloudAuthDb = db as Parameters<typeof revalidateVoyantCloudAdminAuthSession>[0][\"db\"]\n\n if (isVoyantCloudAuthMode(c.env)) {\n const revalidateConfig = getCloudAuthRevalidateConfig(c.env)\n if (!revalidateConfig) {\n return c.json(\n { error: \"Cloud-mode organization member lookup requires membership revalidation\" },\n 501,\n )\n }\n\n const session = await betterAuth.api.getSession({ headers: c.req.raw.headers })\n if (!session) {\n return c.json({ error: \"Unauthorized\" }, 401)\n }\n\n try {\n const revalidation = await revalidateVoyantCloudAdminAuthSession({\n db: cloudAuthDb,\n sessionId: session.session.id,\n config: revalidateConfig,\n })\n\n if (!revalidation.ok) {\n return c.json({ error: \"Voyant Cloud access revoked\" }, 403)\n }\n } catch (error) {\n console.error(\"[auth/organization-members] Cloud revalidation failed:\", error)\n return c.json({ error: \"Voyant Cloud access could not be revalidated\" }, 503)\n }\n }\n\n const organizationMembersDb = db as Parameters<\n typeof handleOrganizationMembersRequest\n >[2][\"db\"]\n return (\n (await handleOrganizationMembersRequest(c.req.raw, betterAuth, {\n db: organizationMembersDb,\n })) ?? c.json({ error: \"Not found\" }, 404)\n )\n } finally {\n c.executionCtx.waitUntil(dispose())\n }\n }\n\n auth.get(\"/auth/cloud/start\", async (c) => {\n if (!isVoyantCloudAuthMode(c.env)) {\n return c.json({ error: \"Not found\" }, 404)\n }\n\n const config = getCloudAuthStartConfig(c.env)\n if (!config) {\n return cloudAuthNotConfiguredResponse(c)\n }\n\n try {\n const start = await createCloudAdminAuthStart({\n requestUrl: c.req.url,\n next: c.req.query(\"next\"),\n config,\n })\n return new Response(null, {\n status: 302,\n headers: {\n Location: start.redirectUrl,\n \"Set-Cookie\": start.setCookie,\n },\n })\n } catch (error) {\n console.error(\"[auth/cloud/start] Error:\", error)\n return c.json({ error: \"Voyant Cloud auth broker is misconfigured\" }, 500)\n }\n })\n\n auth.get(\"/auth/cloud/callback\", async (c) => {\n if (!isVoyantCloudAuthMode(c.env)) {\n return c.json({ error: \"Not found\" }, 404)\n }\n\n const exchangeConfig = getCloudAuthExchangeConfig(c.env)\n if (!exchangeConfig) {\n const url = new URL(c.req.url)\n return c.json({ error: \"Voyant Cloud auth exchange is not configured yet\" }, 501, {\n \"Set-Cookie\": buildClearCloudAdminAuthStateCookie(\n url.protocol === \"https:\",\n url.pathname.replace(/\\/callback$/, \"\") \|\| \"/auth/cloud\",\n ),\n })\n }\n\n const { db, dispose } = openDatabase(c.env)\n try {\n const betterAuth = buildBetterAuth(c.env, db)\n return await betterAuth.handler(c.req.raw)\n } catch (error) {\n console.error(\"[auth/cloud/callback] Error:\", error)\n return c.json({ error: \"Voyant Cloud auth callback failed\" }, 500)\n } finally {\n c.executionCtx.waitUntil(dispose())\n }\n })\n\n auth.all(\"/auth/api-tokens\", handleApiTokensFacade)\n auth.all(\"/auth/api-tokens/:keyId\", handleApiTokensFacade)\n auth.all(\"/auth/api-tokens/:keyId/rotate\", handleApiTokensFacade)\n auth.get(\"/auth/organization/list-members\", handleOrganizationMembersFacade)\n\n auth.get(\"/auth/customer/status\", async (c) => {\n const { db, dispose } = openDatabase(c.env)\n try {\n const betterAuth = buildBetterAuth(c.env, db, { customerSignup: true })\n const session = await betterAuth.api.getSession({ headers: c.req.raw.headers })\n return c.json({ authenticated: Boolean(session) })\n } finally {\n c.executionCtx.waitUntil(dispose())\n }\n })\n\n auth.all(\"/auth/customer/\", async (c) => {\n if (\n isVoyantCloudAuthMode(c.env) &&\n !isCloudAllowedBetterAuthRoute(rewriteCustomerAuthRequest(c.req.raw))\n ) {\n return localAuthDisabledResponse(c)\n }\n\n const { db, dispose } = openDatabase(c.env)\n try {\n const betterAuth = buildBetterAuth(c.env, db, { customerSignup: true })\n return await betterAuth.handler(rewriteCustomerAuthRequest(c.req.raw))\n } finally {\n c.executionCtx.waitUntil(dispose())\n }\n })\n\n /*\n Catch-all: delegate to Better Auth handler.\n * Handles sign-in, sign-up, sign-out, password reset, OAuth callbacks, etc.\n \n Sign-up is gated by a `user.create.before` hook in @voyant-travel/auth — once a\n * user exists, the hook throws and BA returns an error to the client.\n /\n auth.all(\"/auth/\", async (c) => {\n if (isVoyantCloudAuthMode(c.env) && !isCloudAllowedBetterAuthRoute(c.req.raw)) {\n return localAuthDisabledResponse(c)\n }\n\n const { db, dispose } = openDatabase(c.env)\n try {\n const betterAuth = buildBetterAuth(c.env, db)\n return await betterAuth.handler(c.req.raw)\n } finally {\n c.executionCtx.waitUntil(dispose())\n }\n })\n\n return {\n handler: auth,\n getBootstrapStatusForRequest,\n getCurrentUserForRequest,\n hasAuthPermission,\n resolveAuthRequest,\n validateApiTokenAccess,\n }\n}\n"]}

package/dist/runtime-contributor.js CHANGED Viewed

@@ -1,10 +1,18 @@
 import { cloudAdminMembersConfigFromRevalidate } from "./cloud-broker.js";
 import { identityAccessRuntimePort, } from "./identity-access-runtime-port.js";
+import { createCloudTeamManagementAdapter } from "./team-management-cloud-adapter.js";
+import { createLocalTeamManagementAdapter } from "./team-management-local-adapter.js";
+import { createGuardedTeamManagementProvider } from "./team-management-policy.js";
+import { teamManagementRuntimePort } from "./team-management-runtime-port.js";
 /** Package-owned registration map for Auth deployment adapters. */
 export function createAuthRuntimePortContribution(host) {
     const identityAccess = {
         resolveDeployment(bindings) {
             const env = bindings;
+            const selectedAuthProvider = host.primitives.config.read(bindings, "deployment.providers.auth");
+            if (selectedAuthProvider !== "better-auth" && selectedAuthProvider !== "voyant-cloud") {
+                throw new Error("Auth runtime requires deployment.providers.auth to select better-auth or voyant-cloud.");
+            }
             const appUrl = (env.APP_URL || env.DASH_BASE_URL || "http://localhost:3300")
                 .trim()
                 .replace(/\/$/, "");
@@ -13,7 +21,7 @@ export function createAuthRuntimePortContribution(host) {
             const clientToken = env.VOYANT_CLOUD_ADMIN_AUTH_CLIENT_TOKEN?.trim();
             return {
                 appUrl,
-                authMode: env.VOYANT_ADMIN_AUTH_MODE?.trim() === "voyant-cloud" ? "voyant-cloud" : "local",
+                authMode: selectedAuthProvider === "voyant-cloud" ? "voyant-cloud" : "local",
                 cloudAdminMembers: deploymentId && revalidateUrl && clientToken
                     ? cloudAdminMembersConfigFromRevalidate({ revalidateUrl, deploymentId, clientToken })
                     : null,
@@ -43,6 +51,19 @@ export function createAuthRuntimePortContribution(host) {
             }
         },
     };
-    return { [identityAccessRuntimePort.id]: identityAccess };
+    const localTeamManagement = createLocalTeamManagementAdapter(identityAccess);
+    const cloudTeamManagement = createCloudTeamManagementAdapter(identityAccess);
+    const teamManagement = createGuardedTeamManagementProvider((context) => {
+        const selectedAuthProvider = host.primitives.config.read(context.bindings, "deployment.providers.auth");
+        if (selectedAuthProvider === "better-auth")
+            return localTeamManagement;
+        if (selectedAuthProvider === "voyant-cloud")
+            return cloudTeamManagement;
+        throw new Error("Team management requires deployment.providers.auth to select better-auth or voyant-cloud.");
+    });
+    return {
+        [identityAccessRuntimePort.id]: identityAccess,
+        [teamManagementRuntimePort.id]: teamManagement,
+    };
 }
 //# sourceMappingURL=runtime-contributor.js.map

package/dist/runtime-contributor.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"runtime-contributor.js","sourceRoot":"","sources":["../src/runtime-contributor.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,qCAAqC,EAAE,MAAM,mBAAmB,CAAA;AACzE,OAAO,EAEL,yBAAyB,GAC1B,MAAM,mCAAmC,CAAA;~~AAiB1C~~,mEAAmE;AACnE,MAAM,UAAU,iCAAiC,CAC/C,IAAgC;IAEhC,MAAM,cAAc,GAAkC;QACpD,iBAAiB,CAAC,QAAQ;YACxB,MAAM,GAAG,GAAG,QAA8C,CAAA;YAC1D,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,aAAa,IAAI,uBAAuB,CAAC;iBACzE,IAAI,EAAE;iBACN,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;YACrB,MAAM,YAAY,GAAG,GAAG,CAAC,0BAA0B,EAAE,IAAI,EAAE,CAAA;YAC3D,MAAM,aAAa,GAAG,GAAG,CAAC,sCAAsC,EAAE,IAAI,EAAE,CAAA;YACxE,MAAM,WAAW,GAAG,GAAG,CAAC,oCAAoC,EAAE,IAAI,EAAE,CAAA;YACpE,OAAO;gBACL,MAAM;gBACN,QAAQ,EAAE,~~GAAG~~,~~CAAC,sBAAsB,EAAE,IAAI,EAAE,~~KAAK,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO;~~gBAC1F~~,iBAAiB,EACf,YAAY,IAAI,aAAa,IAAI,WAAW;oBAC1C,CAAC,CAAC,qCAAqC,CAAC,EAAE,aAAa,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC;oBACrF,CAAC,CAAC,IAAI;aACX,CAAA;QACH,CAAC;QACD,KAAK,CAAC,mBAAmB,CAAC,QAAQ,EAAE,OAAO;YACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,uBAAuB,CAAC,CAAA;YAC/E,MAAM,SAAS,GACb,OAAO,QAAQ,KAAK,UAAU;gBAC5B,CAAC,CAAE,QAAQ,CACP,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CACoB;gBACrD,CAAC,CAAC,EAAE,CAAA;YACR,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAA;YACpF,IAAI,CAAC,QAAQ;gBAAE,OAAO,KAAK,CAAA;YAC3B,IAAI,CAAC;gBACH,MAAM,QAAQ,CAAC,IAAI,CAAC;oBAClB,OAAO,EAAE,OAAO;oBAChB,EAAE,EAAE,OAAO,CAAC,EAAE;oBACd,QAAQ,EAAE,iBAAiB;oBAC3B,OAAO,EAAE,+BAA+B;oBACxC,IAAI,EAAE,qEAAqE,OAAO,CAAC,SAAS,qDAAqD,OAAO,CAAC,cAAc,aAAa;iBACrL,CAAC,CAAA;gBACF,OAAO,IAAI,CAAA;YACb,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,KAAK,CAAC,kCAAkC,EAAE,KAAK,CAAC,CAAA;gBACxD,OAAO,KAAK,CAAA;YACd,CAAC;QACH,CAAC;KACF,CAAA;IAED,OAAO,EAAE,CAAC,yBAAyB,CAAC,EAAE,CAAC,EAAE,cAAc,EAAE,CAAA;~~AAC3D~~,CAAC","sourcesContent":["import type { VoyantRuntimeHostPrimitives } from \"@voyant-travel/core\"\nimport { cloudAdminMembersConfigFromRevalidate } from \"./cloud-broker.js\"\nimport {\n type IdentityAccessRuntimeProvider,\n identityAccessRuntimePort,\n} from \"./identity-access-runtime-port.js\"\n\ninterface InvitationNotificationProvider {\n readonly channels: ReadonlyArray<string>\n send(payload: {\n channel: \"email\"\n to: string\n template: string\n subject: string\n html: string\n }): Promise<unknown>\n}\n\nexport interface AuthRuntimeContributorHost {\n primitives: VoyantRuntimeHostPrimitives\n}\n\n/** Package-owned registration map for Auth deployment adapters. */\nexport function createAuthRuntimePortContribution(\n host: AuthRuntimeContributorHost,\n): Readonly<Record<string, unknown>> {\n const identityAccess: IdentityAccessRuntimeProvider = {\n resolveDeployment(bindings) {\n const env = bindings as Record<string, string \| undefined>\n const appUrl = (env.APP_URL \|\| env.DASH_BASE_URL \|\| \"http://localhost:3300\")\n .trim()\n .replace(/\\/$/, \"\")\n const deploymentId = env.VOYANT_CLOUD_DEPLOYMENT_ID?.trim()\n const revalidateUrl = env.VOYANT_CLOUD_ADMIN_AUTH_REVALIDATE_URL?.trim()\n const clientToken = env.VOYANT_CLOUD_ADMIN_AUTH_CLIENT_TOKEN?.trim()\n return {\n appUrl,\n authMode: ~~env.VOYANT_ADMIN_AUTH_MODE?.trim()~~ === \"voyant-cloud\" ? \"voyant-cloud\" : \"local\",\n cloudAdminMembers:\n deploymentId && revalidateUrl && clientToken\n ? cloudAdminMembersConfigFromRevalidate({ revalidateUrl, deploymentId, clientToken })\n : null,\n }\n },\n async sendInvitationEmail(bindings, message) {\n const resolver = host.primitives.config.read(bindings, \"notificationProviders\")\n const providers =\n typeof resolver === \"function\"\n ? (resolver(\n host.primitives.env(bindings),\n ) as ReadonlyArray<InvitationNotificationProvider>)\n : []\n const provider = providers.find((candidate) => candidate.channels.includes(\"email\"))\n if (!provider) return false\n try {\n await provider.send({\n channel: \"email\",\n to: message.to,\n template: \"auth.invitation\",\n subject: \"You've been invited to Voyant\",\n html: `<p>You've been invited to join a Voyant workspace.</p><p><a href=\"${message.acceptUrl}\">Accept invitation</a></p><p>The link expires in ${message.expiresInHours} hours.</p>`,\n })\n return true\n } catch (error) {\n console.error(\"[invitations] email send failed:\", error)\n return false\n }\n },\n }\n\n return { [identityAccessRuntimePort.id]: identityAccess }\n}\n"]}
1	+ {"version":3,"file":"runtime-contributor.js","sourceRoot":"","sources":["../src/runtime-contributor.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,qCAAqC,EAAE,MAAM,mBAAmB,CAAA;AACzE,OAAO,EAEL,yBAAyB,GAC1B,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EAAE,gCAAgC,EAAE,MAAM,oCAAoC,CAAA;AACrF,OAAO,EAAE,gCAAgC,EAAE,MAAM,oCAAoC,CAAA;AACrF,OAAO,EAAE,mCAAmC,EAAE,MAAM,6BAA6B,CAAA;AACjF,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAA;AAiB7E,mEAAmE;AACnE,MAAM,UAAU,iCAAiC,CAC/C,IAAgC;IAEhC,MAAM,cAAc,GAAkC;QACpD,iBAAiB,CAAC,QAAQ;YACxB,MAAM,GAAG,GAAG,QAA8C,CAAA;YAC1D,MAAM,oBAAoB,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CACtD,QAAQ,EACR,2BAA2B,CAC5B,CAAA;YACD,IAAI,oBAAoB,KAAK,aAAa,IAAI,oBAAoB,KAAK,cAAc,EAAE,CAAC;gBACtF,MAAM,IAAI,KAAK,CACb,wFAAwF,CACzF,CAAA;YACH,CAAC;YACD,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,aAAa,IAAI,uBAAuB,CAAC;iBACzE,IAAI,EAAE;iBACN,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;YACrB,MAAM,YAAY,GAAG,GAAG,CAAC,0BAA0B,EAAE,IAAI,EAAE,CAAA;YAC3D,MAAM,aAAa,GAAG,GAAG,CAAC,sCAAsC,EAAE,IAAI,EAAE,CAAA;YACxE,MAAM,WAAW,GAAG,GAAG,CAAC,oCAAoC,EAAE,IAAI,EAAE,CAAA;YACpE,OAAO;gBACL,MAAM;gBACN,QAAQ,EAAE,oBAAoB,KAAK,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO;gBAC5E,iBAAiB,EACf,YAAY,IAAI,aAAa,IAAI,WAAW;oBAC1C,CAAC,CAAC,qCAAqC,CAAC,EAAE,aAAa,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC;oBACrF,CAAC,CAAC,IAAI;aACX,CAAA;QACH,CAAC;QACD,KAAK,CAAC,mBAAmB,CAAC,QAAQ,EAAE,OAAO;YACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,uBAAuB,CAAC,CAAA;YAC/E,MAAM,SAAS,GACb,OAAO,QAAQ,KAAK,UAAU;gBAC5B,CAAC,CAAE,QAAQ,CACP,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CACoB;gBACrD,CAAC,CAAC,EAAE,CAAA;YACR,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAA;YACpF,IAAI,CAAC,QAAQ;gBAAE,OAAO,KAAK,CAAA;YAC3B,IAAI,CAAC;gBACH,MAAM,QAAQ,CAAC,IAAI,CAAC;oBAClB,OAAO,EAAE,OAAO;oBAChB,EAAE,EAAE,OAAO,CAAC,EAAE;oBACd,QAAQ,EAAE,iBAAiB;oBAC3B,OAAO,EAAE,+BAA+B;oBACxC,IAAI,EAAE,qEAAqE,OAAO,CAAC,SAAS,qDAAqD,OAAO,CAAC,cAAc,aAAa;iBACrL,CAAC,CAAA;gBACF,OAAO,IAAI,CAAA;YACb,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,KAAK,CAAC,kCAAkC,EAAE,KAAK,CAAC,CAAA;gBACxD,OAAO,KAAK,CAAA;YACd,CAAC;QACH,CAAC;KACF,CAAA;IAED,MAAM,mBAAmB,GAAG,gCAAgC,CAAC,cAAc,CAAC,CAAA;IAC5E,MAAM,mBAAmB,GAAG,gCAAgC,CAAC,cAAc,CAAC,CAAA;IAC5E,MAAM,cAAc,GAAG,mCAAmC,CAAC,CAAC,OAAO,EAAE,EAAE;QACrE,MAAM,oBAAoB,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CACtD,OAAO,CAAC,QAAQ,EAChB,2BAA2B,CAC5B,CAAA;QACD,IAAI,oBAAoB,KAAK,aAAa;YAAE,OAAO,mBAAmB,CAAA;QACtE,IAAI,oBAAoB,KAAK,cAAc;YAAE,OAAO,mBAAmB,CAAA;QACvE,MAAM,IAAI,KAAK,CACb,2FAA2F,CAC5F,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,OAAO;QACL,CAAC,yBAAyB,CAAC,EAAE,CAAC,EAAE,cAAc;QAC9C,CAAC,yBAAyB,CAAC,EAAE,CAAC,EAAE,cAAc;KAC/C,CAAA;AACH,CAAC","sourcesContent":["import type { VoyantRuntimeHostPrimitives } from \"@voyant-travel/core\"\nimport { cloudAdminMembersConfigFromRevalidate } from \"./cloud-broker.js\"\nimport {\n type IdentityAccessRuntimeProvider,\n identityAccessRuntimePort,\n} from \"./identity-access-runtime-port.js\"\nimport { createCloudTeamManagementAdapter } from \"./team-management-cloud-adapter.js\"\nimport { createLocalTeamManagementAdapter } from \"./team-management-local-adapter.js\"\nimport { createGuardedTeamManagementProvider } from \"./team-management-policy.js\"\nimport { teamManagementRuntimePort } from \"./team-management-runtime-port.js\"\n\ninterface InvitationNotificationProvider {\n readonly channels: ReadonlyArray<string>\n send(payload: {\n channel: \"email\"\n to: string\n template: string\n subject: string\n html: string\n }): Promise<unknown>\n}\n\nexport interface AuthRuntimeContributorHost {\n primitives: VoyantRuntimeHostPrimitives\n}\n\n/** Package-owned registration map for Auth deployment adapters. */\nexport function createAuthRuntimePortContribution(\n host: AuthRuntimeContributorHost,\n): Readonly<Record<string, unknown>> {\n const identityAccess: IdentityAccessRuntimeProvider = {\n resolveDeployment(bindings) {\n const env = bindings as Record<string, string \| undefined>\n const selectedAuthProvider = host.primitives.config.read(\n bindings,\n \"deployment.providers.auth\",\n )\n if (selectedAuthProvider !== \"better-auth\" && selectedAuthProvider !== \"voyant-cloud\") {\n throw new Error(\n \"Auth runtime requires deployment.providers.auth to select better-auth or voyant-cloud.\",\n )\n }\n const appUrl = (env.APP_URL \|\| env.DASH_BASE_URL \|\| \"http://localhost:3300\")\n .trim()\n .replace(/\\/$/, \"\")\n const deploymentId = env.VOYANT_CLOUD_DEPLOYMENT_ID?.trim()\n const revalidateUrl = env.VOYANT_CLOUD_ADMIN_AUTH_REVALIDATE_URL?.trim()\n const clientToken = env.VOYANT_CLOUD_ADMIN_AUTH_CLIENT_TOKEN?.trim()\n return {\n appUrl,\n authMode: selectedAuthProvider === \"voyant-cloud\" ? \"voyant-cloud\" : \"local\",\n cloudAdminMembers:\n deploymentId && revalidateUrl && clientToken\n ? cloudAdminMembersConfigFromRevalidate({ revalidateUrl, deploymentId, clientToken })\n : null,\n }\n },\n async sendInvitationEmail(bindings, message) {\n const resolver = host.primitives.config.read(bindings, \"notificationProviders\")\n const providers =\n typeof resolver === \"function\"\n ? (resolver(\n host.primitives.env(bindings),\n ) as ReadonlyArray<InvitationNotificationProvider>)\n : []\n const provider = providers.find((candidate) => candidate.channels.includes(\"email\"))\n if (!provider) return false\n try {\n await provider.send({\n channel: \"email\",\n to: message.to,\n template: \"auth.invitation\",\n subject: \"You've been invited to Voyant\",\n html: `<p>You've been invited to join a Voyant workspace.</p><p><a href=\"${message.acceptUrl}\">Accept invitation</a></p><p>The link expires in ${message.expiresInHours} hours.</p>`,\n })\n return true\n } catch (error) {\n console.error(\"[invitations] email send failed:\", error)\n return false\n }\n },\n }\n\n const localTeamManagement = createLocalTeamManagementAdapter(identityAccess)\n const cloudTeamManagement = createCloudTeamManagementAdapter(identityAccess)\n const teamManagement = createGuardedTeamManagementProvider((context) => {\n const selectedAuthProvider = host.primitives.config.read(\n context.bindings,\n \"deployment.providers.auth\",\n )\n if (selectedAuthProvider === \"better-auth\") return localTeamManagement\n if (selectedAuthProvider === \"voyant-cloud\") return cloudTeamManagement\n throw new Error(\n \"Team management requires deployment.providers.auth to select better-auth or voyant-cloud.\",\n )\n })\n\n return {\n [identityAccessRuntimePort.id]: identityAccess,\n [teamManagementRuntimePort.id]: teamManagement,\n }\n}\n"]}

package/dist/server.d.ts CHANGED Viewed

@@ -4,6 +4,7 @@ import { type BetterAuthOptions } from "better-auth";
 import { emailOTP } from "better-auth/plugins";
 import type { BetterAuthPlugin } from "better-auth/types";
 import type { AnyPgTable } from "drizzle-orm/pg-core";
+import { createLocalMemberAccessPlugin } from "./local-member-access.js";
 export declare function getAuthSecret(): string;
 export type { AccountProfileUpdateHandler, ApiTokenRotationStore, BetterAuthApiTokenManagement, HandleAccountProfileRequestOptions, HandleApiTokenManagementRequestOptions, HandleOrganizationMembersRequestOptions, OrganizationMemberRecord, OrganizationMembersListHandler, OrganizationMembersListInput, } from "./auth-facades.js";
 export { handleAccountProfileRequest, handleApiTokenManagementRequest, handleOrganizationMembersRequest, } from "./auth-facades.js";
@@ -22,7 +23,11 @@ type ResolvedBetterAuthChangeEmail<UserOptions extends BetterAuthOptions["user"]
 type ResolvedBetterAuthUserOptions<UserOptions extends BetterAuthOptions["user"]> = Omit<DefinedBetterAuthUserOptions<UserOptions>, "changeEmail"> & {
     changeEmail: ResolvedBetterAuthChangeEmail<UserOptions>;
 };
-type VoyantBetterAuthPlugins = [ReturnType<typeof apiKey>, ReturnType<typeof emailOTP>];
+type VoyantBetterAuthPlugins = [
+    ReturnType<typeof apiKey>,
+    ReturnType<typeof emailOTP>,
+    ReturnType<typeof createLocalMemberAccessPlugin>
+];
 type ResolvedBetterAuthPlugins<Plugins extends BetterAuthPlugin[] | undefined> = Plugins extends BetterAuthPlugin[] ? [...VoyantBetterAuthPlugins, ...Plugins] : VoyantBetterAuthPlugins;
 export interface DisableSignupWhenUsersExistOptions {
     /**
@@ -85,11 +90,10 @@ export interface CreateBetterAuthOptions<UserOptions extends BetterAuthOptions["
     }) => Promise<void>;
     /**
      * Better Auth session cookie cache: session data rides in a short-lived
-     * signed cookie so `getSession` skips the Postgres lookup on most
-     * requests. Enabled by default with a 5-minute TTL — the trade-off is
-     * that a revoked/expired session can stay usable for up to `maxAge`
-     * seconds. Pass `false` for revocation-sensitive deployments, or tune
-     * `maxAge` (seconds).
+     * signed cookie. Enabled by default with a 5-minute TTL. Voyant still
+     * validates local membership and session existence against Postgres so a
+     * deleted session cannot be revived from the cookie cache. Pass `false` to
+     * disable payload caching, or tune `maxAge` (seconds).
      */
     sessionCookieCache?: false | {
         maxAge?: number;

package/dist/server.js CHANGED Viewed

@@ -5,6 +5,7 @@ import { betterAuth } from "better-auth";
 import { drizzleAdapter } from "better-auth/adapters/drizzle";
 import { emailOTP } from "better-auth/plugins";
 import { sql } from "drizzle-orm";
+import { createLocalMemberAccessPlugin, isLocalMemberDeactivated, isLocalMemberEmailDeactivated, isLocalMemberSessionActive, } from "./local-member-access.js";
 import { expandTrustedOrigins, getTrustedOrigins } from "./trusted-origins.js";
 import { isFirstAuthUser, provisionCurrentUserProfile } from "./workspace.js";
 export function getAuthSecret() {
@@ -122,9 +123,6 @@ export function createBetterAuth(options = {}) {
                 session: {
                     cookieCache: {
                         enabled: true,
-                        // Caps how long a revoked session stays usable from the
-                        // cookie alone; within the window getSession answers from
-                        // the signed cookie with zero DB roundtrips.
                         maxAge: options.sessionCookieCache?.maxAge ?? 300,
                     },
                 },
@@ -182,6 +180,11 @@ export function createBetterAuth(options = {}) {
                     enabled: true,
                 },
             }),
+            createLocalMemberAccessPlugin({
+                isEmailDeactivated: (email) => isLocalMemberEmailDeactivated(db, email),
+                isSessionActive: (sessionId, userId) => isLocalMemberSessionActive(db, sessionId, userId),
+                isUserDeactivated: (userId) => isLocalMemberDeactivated(db, userId),
+            }),
             ...extraPlugins,
         ],
         databaseHooks: {

package/dist/server.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAC7C,OAAO,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAA;AACzC,OAAO,EACL,WAAW,EACX,WAAW,EACX,WAAW,EACX,QAAQ,EACR,gBAAgB,GACjB,MAAM,8BAA8B,CAAA;AACrC,OAAO,EAA0B,UAAU,EAAE,MAAM,aAAa,CAAA;AAChE,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAC7D,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAA;AAE9C,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAA;AAGjC,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AAC9E,OAAO,EAAE,eAAe,EAAE,2BAA2B,EAAE,MAAM,gBAAgB,CAAA;AAE7E,MAAM,UAAU,aAAa;IAC3B,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,EAAE,CAAA;IAEnD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAA;IAC3E,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAaD,OAAO,EACL,2BAA2B,EAC3B,+BAA+B,EAC/B,gCAAgC,GACjC,MAAM,mBAAmB,CAAA;AA0B1B,MAAM,6BAA6B,GAAG,CAAC,OAAO,CAAU,CAAA;AACxD,MAAM,iCAAiC,GAAG;IACxC,gBAAgB;IAChB,sBAAsB;IACtB,oBAAoB;CACZ,CAAA;AAmCV,SAAS,4BAA4B,CACnC,OAAuD;IAEvD,OAAO,OAAO,EAAE,QAAQ,IAAI,6BAA6B,CAAA;AAC3D,CAAC;AAED,SAAS,oBAAoB,CAAC,OAAuD;IACnF,OAAO,OAAO,EAAE,OAAO,KAAK,KAAK,CAAA;AACnC,CAAC;AAED,SAAS,oBAAoB,CAAC,QAAuC;IACnE,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,CAAA;IAExB,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAA;IACpC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAA;QAC9B,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACzB,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;AAC/B,CAAC;AAED,SAAS,wBAAwB,CAC/B,IAAwC,EACxC,eAAkC;IAElC,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IAE9C,MAAM,QAAQ,GAAG,IAAI,EAAE,QAAQ,CAAA;IAC/B,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,MAAM,gBAAgB,GAAG,QAAQ,CAAC,MAAM,CACtC,CAAC,OAAO,EAAqB,EAAE,CAAC,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CACzF,CAAA;QACD,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChC,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;QACrF,CAAC;IACH,CAAC;IAED,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/D,OAAO,eAAe,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAA;IAClD,CAAC;IAED,OAAO,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;AAC1C,CAAC;AAED,SAAS,sBAAsB,CAAC,OAAiD;IAC/E,MAAM,IAAI,GAAG,OAAO,EAAE,IAAI,CAAA;IAC1B,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAA;IAEvB,OAAO,iCAAiC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;AAClF,CAAC;AAED,SAAS,2BAA2B,CAClC,IAAwC,EACxC,OAAiD,EACjD,QAA2B;IAE3B,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9D,OAAO,IAAI,CAAA;IACb,CAAC;IAED,OAAO;QACL,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;QACf,QAAQ;KACT,CAAA;AACH,CAAC;AAkED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAG9B,UAAyD,EAAE;IAC3D,MAAM,EAAE,GAAG,OAAO,CAAC,EAAE,IAAI,KAAK,CAAC,MAAM,CAAC,CAAA;IACtC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,aAAa,EAAE,CAAA;IAChD,MAAM,OAAO,GACX,OAAO,CAAC,OAAO;QACf,OAAO,CAAC,GAAG,CAAC,eAAe;QAC3B,OAAO,CAAC,GAAG,CAAC,OAAO;QACnB,OAAO,CAAC,GAAG,CAAC,mBAAmB;QAC/B,uBAAuB,CAAA;IACzB,MAAM,cAAc,GAAG,oBAAoB,CACzC,OAAO,CAAC,cAAc,IAAI,iBAAiB,EAAE,EAC7C,OAAO,CACR,CAAA;IACD,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAA;IAC1C,MAAM,mBAAmB,GAAG,4BAA4B,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAA;IAC7F,MAAM,kBAAkB,GAAG,oBAAoB,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAA;IACpF,MAAM,sBAAsB,GAAG,oBAAoB,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAA;IACnF,MAAM,MAAM,GAAG;QACb,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,WAAW;QACpB,OAAO,EAAE,WAAW;QACpB,YAAY,EAAE,gBAAgB;QAC9B,MAAM,EAAE,WAAW;QACnB,GAAG,CAAC,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC;KACG,CAAA;IACnC,MAAM,SAAS,GACb,OAAO,CAAC,SAAS;QACjB,CAAC,OAAO,CAAC,gBAAgB;YACvB,CAAC,CAAE;gBACC,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,EAAE;gBACV,GAAG,EAAE,GAAG;gBACR,OAAO,EAAE,mBAAmB;aACM;YACtC,CAAC,CAAC,SAAS,CAAC,CAAA;IAEhB,MAAM,WAAW,GAAG;QAClB,OAAO,EAAE,QAAQ;QACjB,OAAO;QACP,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,MAAM;QACN,QAAQ,EAAE,cAAc,CAAC,EAAE,EAAE;YAC3B,QAAQ,EAAE,IAAI;YACd,MAAM;SACP,CAAC;QACF,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnF,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,GAAG,CAAC,OAAO,CAAC,kBAAkB,KAAK,KAAK;YACtC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE,OAAO,EAAE;oBACP,WAAW,EAAE;wBACX,OAAO,EAAE,IAAI;wBACb,wDAAwD;wBACxD,0DAA0D;wBAC1D,6CAA6C;wBAC7C,MAAM,EAAE,OAAO,CAAC,kBAAkB,EAAE,MAAM,IAAI,GAAG;qBAClD;iBACF;aACF,CAAC;QACN,gBAAgB,EAAE;YAChB,OAAO,EAAE,IAAI;YACb,iBAAiB,EAAE,CAAC;YACpB,iBAAiB,EAAE,GAAG;YACtB,wBAAwB,EAAE,IAAI;YAC9B,6BAA6B,EAAE,IAAI;YACnC,uIAAuI;YACvI,iBAAiB,EACf,OAAO,CAAC,iBAAiB;gBACzB,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE;oBACvB,OAAO,CAAC,IAAI,CACV,4DAA4D,IAAI,CAAC,KAAK,KAAK,GAAG,EAAE,CACjF,CAAA;gBACH,CAAC,CAAC;SACL;QACD,iBAAiB,EAAE;YACjB,YAAY,EAAE,KAAK,EAAE,0BAA0B;YAC/C,2BAA2B,EAAE,IAAI;SAClC;QACD,IAAI,EAAE;YACJ,GAAG,OAAO,CAAC,IAAI;YACf,WAAW,EAAE;gBACX,OAAO,EAAE,IAAI;gBACb,GAAG,OAAO,CAAC,IAAI,EAAE,WAAW;aAC7B;SAC4C;QAC/C,eAAe,EAAE;YACf,MAAM,EAAE;gBACN,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,EAAE;gBAC5C,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,EAAE;gBACpD,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;aACnF;SACF;QACD,cAAc;QACd,OAAO,EAAE;YACP,MAAM,CAAC;gBACL,aAAa,EAAE,MAAM;gBACrB,aAAa,EAAE,CAAC,eAAe,CAAC;gBAChC,WAAW,EAAE,IAAI;gBACjB,aAAa,EAAE;oBACb,gBAAgB,EAAE,IAAI;iBACvB;aACF,CAAC;YACF,QAAQ,CAAC;gBACP,uIAAuI;gBACvI,mBAAmB,EACjB,OAAO,CAAC,mBAAmB;oBAC3B,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE;wBAC9B,OAAO,CAAC,IAAI,CAAC,kBAAkB,KAAK,KAAK,GAAG,KAAK,IAAI,GAAG,CAAC,CAAA;oBAC3D,CAAC,CAAC;gBACJ,SAAS,EAAE,CAAC;gBACZ,SAAS,EAAE,GAAG;gBACd,wBAAwB,EAAE,IAAI;gBAC9B,WAAW,EAAE;oBACX,OAAO,EAAE,IAAI;iBACd;aACF,CAAC;YACF,GAAG,YAAY;SACsB;QACvC,aAAa,EAAE;YACb,IAAI,EAAE;gBACJ,MAAM,EAAE;oBACN,mEAAmE;oBACnE,iEAAiE;oBACjE,kEAAkE;oBAClE,qEAAqE;oBACrE,kEAAkE;oBAClE,wBAAwB;oBACxB,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAyC,EAAE;wBACrE,MAAM,cAAc,GAAG,2BAA2B,CAChD,IAA8B,EAC9B,OAAuC,EACvC,sBAAsB,CACvB,CAAA;wBAED,IACE,CAAC,kBAAkB;4BACnB,CAAC,wBAAwB,CAAC,cAAc,EAAE,mBAAmB,CAAC,EAC9D,CAAC;4BACD,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;gCAC5B,OAAM;4BACR,CAAC;4BACD,OAAO,EAAE,IAAI,EAAE,cAAyC,EAAE,CAAA;wBAC5D,CAAC;wBAED,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,GAAG,CAAQ,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;wBACnF,IAAI,CAAC,GAAG,EAAE,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;4BAC1B,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAA;wBACrE,CAAC;wBAED,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;4BAC5B,OAAO,EAAE,IAAI,EAAE,cAAyC,EAAE,CAAA;wBAC5D,CAAC;oBACH,CAAC;oBACD,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE;wBAC7B,IACE,sBAAsB,CAAC,MAAM,GAAG,CAAC;4BACjC,sBAAsB,CAAC,OAAuC,CAAC,EAC/D,CAAC;4BACD,OAAM;wBACR,CAAC;wBAED,mEAAmE;wBACnE,2DAA2D;wBAC3D,4DAA4D;wBAC5D,MAAM,2BAA2B,CAAC,EAAE,EAAE;4BACpC,MAAM,EAAE,IAAI,CAAC,EAAE;4BACf,IAAI,EAAE,IAAI,CAAC,IAAI;4BACf,KAAK,EAAE,IAAI,CAAC,KAAK;4BACjB,YAAY,EAAE,MAAM,eAAe,CAAC,EAAE,CAAC;yBACxC,CAAC,CAAA;oBACJ,CAAC;iBACF;aACF;SACF;QACD,QAAQ,EAAE;YACR,GAAG,OAAO,CAAC,QAAQ;YACnB,gBAAgB,EACd,OAAO,CAAC,QAAQ,EAAE,gBAAgB,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,aAAa;SAC/E;KACuD,CAAA;IAE1D,OAAO,UAAU,CAAwD,WAAW,CAAC,CAAA;AACvF,CAAC","sourcesContent":["import { apiKey } from \"@better-auth/api-key\"\nimport { getDb } from \"@voyant-travel/db\"\nimport {\n apikeyTable,\n authAccount,\n authSession,\n authUser,\n authVerification,\n} from \"@voyant-travel/db/schema/iam\"\nimport { type BetterAuthOptions, betterAuth } from \"better-auth\"\nimport { drizzleAdapter } from \"better-auth/adapters/drizzle\"\nimport { emailOTP } from \"better-auth/plugins\"\nimport type { BetterAuthPlugin } from \"better-auth/types\"\nimport { sql } from \"drizzle-orm\"\nimport type { AnyPgTable } from \"drizzle-orm/pg-core\"\n\nimport { expandTrustedOrigins, getTrustedOrigins } from \"./trusted-origins.js\"\nimport { isFirstAuthUser, provisionCurrentUserProfile } from \"./workspace.js\"\n\nexport function getAuthSecret(): string {\n const secret = process.env.BETTER_AUTH_SECRET \|\| \"\"\n\n if (!secret \|\| secret.length < 32) {\n throw new Error(\"Missing BETTER_AUTH_SECRET with at least 32 characters\")\n }\n\n return secret\n}\n\nexport type {\n AccountProfileUpdateHandler,\n ApiTokenRotationStore,\n BetterAuthApiTokenManagement,\n HandleAccountProfileRequestOptions,\n HandleApiTokenManagementRequestOptions,\n HandleOrganizationMembersRequestOptions,\n OrganizationMemberRecord,\n OrganizationMembersListHandler,\n OrganizationMembersListInput,\n} from \"./auth-facades.js\"\nexport {\n handleAccountProfileRequest,\n handleApiTokenManagementRequest,\n handleOrganizationMembersRequest,\n} from \"./auth-facades.js\"\n\ntype DefinedBetterAuthUserOptions<UserOptions extends BetterAuthOptions[\"user\"]> =\n UserOptions extends undefined ? Record<PropertyKey, never> : NonNullable<UserOptions>\n\ntype ResolvedBetterAuthChangeEmail<UserOptions extends BetterAuthOptions[\"user\"]> =\n DefinedBetterAuthUserOptions<UserOptions> extends { changeEmail?: infer ChangeEmail }\n ? ChangeEmail extends { enabled: infer Enabled }\n ? Omit<ChangeEmail, \"enabled\"> & { enabled: Enabled }\n : NonNullable<ChangeEmail> & { enabled: true }\n : { enabled: true }\n\ntype ResolvedBetterAuthUserOptions<UserOptions extends BetterAuthOptions[\"user\"]> = Omit<\n DefinedBetterAuthUserOptions<UserOptions>,\n \"changeEmail\"\n> & {\n changeEmail: ResolvedBetterAuthChangeEmail<UserOptions>\n}\n\ntype VoyantBetterAuthPlugins = [ReturnType<typeof apiKey>, ReturnType<typeof emailOTP>]\n\ntype ResolvedBetterAuthPlugins<Plugins extends BetterAuthPlugin[] \| undefined> =\n Plugins extends BetterAuthPlugin[]\n ? [...VoyantBetterAuthPlugins, ...Plugins]\n : VoyantBetterAuthPlugins\n\nconst DEFAULT_SIGNUP_BLOCK_SURFACES = [\"admin\"] as const\nconst CUSTOMER_SIGNUP_ENDPOINT_SUFFIXES = [\n \"/sign-up/email\",\n \"/phone-number/verify\",\n \"/sign-in/email-otp\",\n] as const\n\nexport interface DisableSignupWhenUsersExistOptions {\n /*\n Set to false when the consuming app owns all signup admission checks.\n \n Defaults to true.\n /\n enabled?: boolean\n /\n User surfaces that should keep the single-tenant signup guard. New users\n * with only other explicit surfaces can still be created by customer-facing\n * auth plugins such as phone OTP.\n \n Defaults to [\"admin\"]. Users without an explicit surfaces array are\n * treated as admin users for backward compatibility.\n /\n surfaces?: readonly string[]\n}\n\ntype BetterAuthCreateBeforeResult =\n \| boolean\n \| undefined\n \| {\n data: Record<string, unknown>\n }\n\ntype SignupBlockUserPayload = {\n surfaces?: unknown\n}\n\ntype BetterAuthHookContext = {\n path?: string\n}\n\nfunction normalizeSignupBlockSurfaces(\n options: DisableSignupWhenUsersExistOptions \| undefined,\n): readonly string[] {\n return options?.surfaces ?? DEFAULT_SIGNUP_BLOCK_SURFACES\n}\n\nfunction isSignupBlockEnabled(options: DisableSignupWhenUsersExistOptions \| undefined): boolean {\n return options?.enabled !== false\n}\n\nfunction normalizeSurfaceList(surfaces: readonly string[] \| undefined): readonly string[] {\n if (!surfaces) return []\n\n const normalized = new Set<string>()\n for (const surface of surfaces) {\n const trimmed = surface.trim()\n if (trimmed.length > 0) {\n normalized.add(trimmed)\n }\n }\n return Array.from(normalized)\n}\n\nfunction signupBlockAppliesToUser(\n user: SignupBlockUserPayload \| undefined,\n blockedSurfaces: readonly string[],\n): boolean {\n if (blockedSurfaces.length === 0) return false\n\n const surfaces = user?.surfaces\n if (Array.isArray(surfaces)) {\n const explicitSurfaces = surfaces.filter(\n (surface): surface is string => typeof surface === \"string\" && surface.trim().length > 0,\n )\n if (explicitSurfaces.length > 0) {\n return explicitSurfaces.some((surface) => blockedSurfaces.includes(surface.trim()))\n }\n }\n\n if (typeof surfaces === \"string\" && surfaces.trim().length > 0) {\n return blockedSurfaces.includes(surfaces.trim())\n }\n\n return blockedSurfaces.includes(\"admin\")\n}\n\nfunction isCustomerSignupCreate(context: BetterAuthHookContext \| null \| undefined): boolean {\n const path = context?.path\n if (!path) return false\n\n return CUSTOMER_SIGNUP_ENDPOINT_SUFFIXES.some((suffix) => path.endsWith(suffix))\n}\n\nfunction stampCustomerSignupSurfaces(\n user: SignupBlockUserPayload \| undefined,\n context: BetterAuthHookContext \| null \| undefined,\n surfaces: readonly string[],\n): SignupBlockUserPayload \| undefined {\n if (surfaces.length === 0 \|\| !isCustomerSignupCreate(context)) {\n return user\n }\n\n return {\n ...(user ?? {}),\n surfaces,\n }\n}\n\ntype ResolvedCreateBetterAuthOptions<\n UserOptions extends BetterAuthOptions[\"user\"],\n Plugins extends BetterAuthPlugin[] \| undefined,\n> = Omit<BetterAuthOptions, \"plugins\" \| \"user\"> & {\n plugins: ResolvedBetterAuthPlugins<Plugins>\n user: ResolvedBetterAuthUserOptions<UserOptions>\n}\n\nexport type BetterAuthDrizzleSchema = Record<string, AnyPgTable>\n\nexport interface CreateBetterAuthOptions<\n UserOptions extends BetterAuthOptions[\"user\"] = BetterAuthOptions[\"user\"],\n Plugins extends BetterAuthPlugin[] \| undefined = BetterAuthPlugin[] \| undefined,\n> {\n db?: ReturnType<typeof getDb>\n secret?: string\n baseURL?: string\n basePath?: string\n trustedOrigins?: string[]\n /\n Additional Drizzle tables for Better Auth plugins. The consuming app owns\n * matching migrations for every table passed here.\n /\n extraSchema?: BetterAuthDrizzleSchema\n plugins?: Plugins\n user?: UserOptions\n /\n Surfaces stamped on Better Auth customer self-signups before the bundled\n * single-tenant signup guard evaluates the new user. Applies to Better\n * Auth OTP signup endpoints that create a user as part of verification.\n \n Leave undefined to preserve Better Auth's raw user payload.\n /\n customerSignupSurfaces?: readonly string[]\n disableSignupWhenUsersExist?: DisableSignupWhenUsersExistOptions\n /* Called when a user requests a password reset. If not provided, logs to console. /\n sendResetPassword?: (data: {\n user: { email: string; name: string }\n url: string\n token: string\n }) => Promise<void>\n /* Called to send a verification OTP. If not provided, logs to console. /\n sendVerificationOTP?: (data: { email: string; otp: string; type: string }) => Promise<void>\n /\n Better Auth session cookie cache: session data rides in a short-lived\n * signed cookie so `getSession` skips the Postgres lookup on most\n * requests. Enabled by default with a 5-minute TTL — the trade-off is\n * that a revoked/expired session can stay usable for up to `maxAge`\n * seconds. Pass `false` for revocation-sensitive deployments, or tune\n * `maxAge` (seconds).\n /\n sessionCookieCache?: false \| { maxAge?: number }\n /* Better Auth secondary storage, typically Redis/KV, used for distributed rate limits. /\n secondaryStorage?: BetterAuthOptions[\"secondaryStorage\"]\n /* Better Auth rate-limit config. Defaults to secondary storage when present. /\n rateLimit?: BetterAuthOptions[\"rateLimit\"]\n /\n Additional Better Auth advanced options. Voyant supplies secure cookies\n * by default except in explicit local development. Set\n * `advanced.useSecureCookies` to override that default.\n /\n advanced?: BetterAuthOptions[\"advanced\"]\n}\n\n/\n Framework-agnostic Better Auth factory.\n \n Accepts optional overrides for db, secret, baseURL, trustedOrigins.\n * Does NOT depend on Next.js — safe to use in Hono workers, TanStack Start, etc.\n /\nexport function createBetterAuth<\n const UserOptions extends BetterAuthOptions[\"user\"] = undefined,\n const Plugins extends BetterAuthPlugin[] \| undefined = undefined,\n>(options: CreateBetterAuthOptions<UserOptions, Plugins> = {}) {\n const db = options.db ?? getDb(\"edge\")\n const secret = options.secret ?? getAuthSecret()\n const baseURL =\n options.baseURL ??\n process.env.BETTER_AUTH_URL ??\n process.env.APP_URL ??\n process.env.NEXT_PUBLIC_APP_URL ??\n \"http://localhost:3000\"\n const trustedOrigins = expandTrustedOrigins(\n options.trustedOrigins ?? getTrustedOrigins(),\n baseURL,\n )\n const extraPlugins = options.plugins ?? []\n const signupBlockSurfaces = normalizeSignupBlockSurfaces(options.disableSignupWhenUsersExist)\n const signupBlockEnabled = isSignupBlockEnabled(options.disableSignupWhenUsersExist)\n const customerSignupSurfaces = normalizeSurfaceList(options.customerSignupSurfaces)\n const schema = {\n user: authUser,\n session: authSession,\n account: authAccount,\n verification: authVerification,\n apikey: apikeyTable,\n ...(options.extraSchema ?? {}),\n } satisfies BetterAuthDrizzleSchema\n const rateLimit =\n options.rateLimit ??\n (options.secondaryStorage\n ? ({\n enabled: true,\n window: 60,\n max: 100,\n storage: \"secondary-storage\",\n } as BetterAuthOptions[\"rateLimit\"])\n : undefined)\n\n const authOptions = {\n appName: \"Voyant\",\n baseURL,\n ...(options.basePath ? { basePath: options.basePath } : {}),\n secret,\n database: drizzleAdapter(db, {\n provider: \"pg\",\n schema,\n }),\n ...(options.secondaryStorage ? { secondaryStorage: options.secondaryStorage } : {}),\n ...(rateLimit ? { rateLimit } : {}),\n ...(options.sessionCookieCache === false\n ? {}\n : {\n session: {\n cookieCache: {\n enabled: true,\n // Caps how long a revoked session stays usable from the\n // cookie alone; within the window getSession answers from\n // the signed cookie with zero DB roundtrips.\n maxAge: options.sessionCookieCache?.maxAge ?? 300,\n },\n },\n }),\n emailAndPassword: {\n enabled: true,\n minPasswordLength: 8,\n maxPasswordLength: 128,\n requireEmailVerification: true,\n revokeSessionsOnPasswordReset: true,\n // eslint-disable-next-line @typescript-eslint/require-await -- owner: auth; existing suppression is intentional pending typed cleanup.\n sendResetPassword:\n options.sendResetPassword ??\n (async ({ user, url }) => {\n console.warn(\n `[Auth] No email provider configured — password reset for ${user.email}: ${url}`,\n )\n }),\n },\n emailVerification: {\n sendOnSignUp: false, // OTP plugin handles this\n autoSignInAfterVerification: true,\n },\n user: {\n ...options.user,\n changeEmail: {\n enabled: true,\n ...options.user?.changeEmail,\n },\n } as ResolvedBetterAuthUserOptions<UserOptions>,\n socialProviders: {\n google: {\n clientId: process.env.GOOGLE_CLIENT_ID \|\| \"\",\n clientSecret: process.env.GOOGLE_CLIENT_SECRET \|\| \"\",\n enabled: Boolean(process.env.GOOGLE_CLIENT_ID && process.env.GOOGLE_CLIENT_SECRET),\n },\n },\n trustedOrigins,\n plugins: [\n apiKey({\n defaultPrefix: \"voy_\",\n apiKeyHeaders: [\"authorization\"],\n requireName: true,\n keyExpiration: {\n defaultExpiresIn: null,\n },\n }),\n emailOTP({\n // eslint-disable-next-line @typescript-eslint/require-await -- owner: auth; existing suppression is intentional pending typed cleanup.\n sendVerificationOTP:\n options.sendVerificationOTP ??\n (async ({ email, otp, type }) => {\n console.warn(`[Auth] OTP for ${email}: ${otp} (${type})`)\n }),\n otpLength: 6,\n expiresIn: 600,\n sendVerificationOnSignUp: true,\n changeEmail: {\n enabled: true,\n },\n }),\n ...extraPlugins,\n ] as ResolvedBetterAuthPlugins<Plugins>,\n databaseHooks: {\n user: {\n create: {\n // Single-tenant: once a user exists, reject any new-user creation.\n // Covers email sign-up AND social-provider sign-up (Google would\n // otherwise auto-create a user on first OAuth callback). Existing\n // social sign-ins still work because this hook only fires on CREATE.\n // Seed scripts do raw drizzle inserts, so they bypass this hook —\n // which is intentional.\n before: async (user, context): Promise<BetterAuthCreateBeforeResult> => {\n const normalizedUser = stampCustomerSignupSurfaces(\n user as SignupBlockUserPayload,\n context as BetterAuthHookContext \| null,\n customerSignupSurfaces,\n )\n\n if (\n !signupBlockEnabled \|\|\n !signupBlockAppliesToUser(normalizedUser, signupBlockSurfaces)\n ) {\n if (normalizedUser === user) {\n return\n }\n return { data: normalizedUser as Record<string, unknown> }\n }\n\n const [row] = await db.select({ count: sql<number>`count()::int` }).from(authUser)\n if ((row?.count ?? 0) > 0) {\n throw new Error(\"Sign-up is disabled. Ask an admin to invite you.\")\n }\n\n if (normalizedUser !== user) {\n return { data: normalizedUser as Record<string, unknown> }\n }\n },\n after: async (user, context) => {\n if (\n customerSignupSurfaces.length > 0 &&\n isCustomerSignupCreate(context as BetterAuthHookContext \| null)\n ) {\n return\n }\n\n // Single-tenant bootstrap: the very first user to register becomes\n // the super-admin. Runs atomically after the `user` row is\n // inserted, so a simple COUNT(*) = 1 check identifies them.\n await provisionCurrentUserProfile(db, {\n userId: user.id,\n name: user.name,\n image: user.image,\n isSuperAdmin: await isFirstAuthUser(db),\n })\n },\n },\n },\n },\n advanced: {\n ...options.advanced,\n useSecureCookies:\n options.advanced?.useSecureCookies ?? process.env.NODE_ENV !== \"development\",\n },\n } as ResolvedCreateBetterAuthOptions<UserOptions, Plugins>\n\n return betterAuth<ResolvedCreateBetterAuthOptions<UserOptions, Plugins>>(authOptions)\n}\n"]}
1	+ {"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAC7C,OAAO,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAA;AACzC,OAAO,EACL,WAAW,EACX,WAAW,EACX,WAAW,EACX,QAAQ,EACR,gBAAgB,GACjB,MAAM,8BAA8B,CAAA;AACrC,OAAO,EAA0B,UAAU,EAAE,MAAM,aAAa,CAAA;AAChE,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAC7D,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAA;AAE9C,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAA;AAGjC,OAAO,EACL,6BAA6B,EAC7B,wBAAwB,EACxB,6BAA6B,EAC7B,0BAA0B,GAC3B,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AAC9E,OAAO,EAAE,eAAe,EAAE,2BAA2B,EAAE,MAAM,gBAAgB,CAAA;AAE7E,MAAM,UAAU,aAAa;IAC3B,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,EAAE,CAAA;IAEnD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAA;IAC3E,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAaD,OAAO,EACL,2BAA2B,EAC3B,+BAA+B,EAC/B,gCAAgC,GACjC,MAAM,mBAAmB,CAAA;AA8B1B,MAAM,6BAA6B,GAAG,CAAC,OAAO,CAAU,CAAA;AACxD,MAAM,iCAAiC,GAAG;IACxC,gBAAgB;IAChB,sBAAsB;IACtB,oBAAoB;CACZ,CAAA;AAmCV,SAAS,4BAA4B,CACnC,OAAuD;IAEvD,OAAO,OAAO,EAAE,QAAQ,IAAI,6BAA6B,CAAA;AAC3D,CAAC;AAED,SAAS,oBAAoB,CAAC,OAAuD;IACnF,OAAO,OAAO,EAAE,OAAO,KAAK,KAAK,CAAA;AACnC,CAAC;AAED,SAAS,oBAAoB,CAAC,QAAuC;IACnE,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,CAAA;IAExB,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAA;IACpC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAA;QAC9B,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACzB,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;AAC/B,CAAC;AAED,SAAS,wBAAwB,CAC/B,IAAwC,EACxC,eAAkC;IAElC,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IAE9C,MAAM,QAAQ,GAAG,IAAI,EAAE,QAAQ,CAAA;IAC/B,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,MAAM,gBAAgB,GAAG,QAAQ,CAAC,MAAM,CACtC,CAAC,OAAO,EAAqB,EAAE,CAAC,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CACzF,CAAA;QACD,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChC,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;QACrF,CAAC;IACH,CAAC;IAED,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/D,OAAO,eAAe,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAA;IAClD,CAAC;IAED,OAAO,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;AAC1C,CAAC;AAED,SAAS,sBAAsB,CAAC,OAAiD;IAC/E,MAAM,IAAI,GAAG,OAAO,EAAE,IAAI,CAAA;IAC1B,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAA;IAEvB,OAAO,iCAAiC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;AAClF,CAAC;AAED,SAAS,2BAA2B,CAClC,IAAwC,EACxC,OAAiD,EACjD,QAA2B;IAE3B,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9D,OAAO,IAAI,CAAA;IACb,CAAC;IAED,OAAO;QACL,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;QACf,QAAQ;KACT,CAAA;AACH,CAAC;AAiED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAG9B,UAAyD,EAAE;IAC3D,MAAM,EAAE,GAAG,OAAO,CAAC,EAAE,IAAI,KAAK,CAAC,MAAM,CAAC,CAAA;IACtC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,aAAa,EAAE,CAAA;IAChD,MAAM,OAAO,GACX,OAAO,CAAC,OAAO;QACf,OAAO,CAAC,GAAG,CAAC,eAAe;QAC3B,OAAO,CAAC,GAAG,CAAC,OAAO;QACnB,OAAO,CAAC,GAAG,CAAC,mBAAmB;QAC/B,uBAAuB,CAAA;IACzB,MAAM,cAAc,GAAG,oBAAoB,CACzC,OAAO,CAAC,cAAc,IAAI,iBAAiB,EAAE,EAC7C,OAAO,CACR,CAAA;IACD,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAA;IAC1C,MAAM,mBAAmB,GAAG,4BAA4B,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAA;IAC7F,MAAM,kBAAkB,GAAG,oBAAoB,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAA;IACpF,MAAM,sBAAsB,GAAG,oBAAoB,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAA;IACnF,MAAM,MAAM,GAAG;QACb,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,WAAW;QACpB,OAAO,EAAE,WAAW;QACpB,YAAY,EAAE,gBAAgB;QAC9B,MAAM,EAAE,WAAW;QACnB,GAAG,CAAC,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC;KACG,CAAA;IACnC,MAAM,SAAS,GACb,OAAO,CAAC,SAAS;QACjB,CAAC,OAAO,CAAC,gBAAgB;YACvB,CAAC,CAAE;gBACC,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,EAAE;gBACV,GAAG,EAAE,GAAG;gBACR,OAAO,EAAE,mBAAmB;aACM;YACtC,CAAC,CAAC,SAAS,CAAC,CAAA;IAEhB,MAAM,WAAW,GAAG;QAClB,OAAO,EAAE,QAAQ;QACjB,OAAO;QACP,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,MAAM;QACN,QAAQ,EAAE,cAAc,CAAC,EAAE,EAAE;YAC3B,QAAQ,EAAE,IAAI;YACd,MAAM;SACP,CAAC;QACF,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnF,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,GAAG,CAAC,OAAO,CAAC,kBAAkB,KAAK,KAAK;YACtC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE,OAAO,EAAE;oBACP,WAAW,EAAE;wBACX,OAAO,EAAE,IAAI;wBACb,MAAM,EAAE,OAAO,CAAC,kBAAkB,EAAE,MAAM,IAAI,GAAG;qBAClD;iBACF;aACF,CAAC;QACN,gBAAgB,EAAE;YAChB,OAAO,EAAE,IAAI;YACb,iBAAiB,EAAE,CAAC;YACpB,iBAAiB,EAAE,GAAG;YACtB,wBAAwB,EAAE,IAAI;YAC9B,6BAA6B,EAAE,IAAI;YACnC,uIAAuI;YACvI,iBAAiB,EACf,OAAO,CAAC,iBAAiB;gBACzB,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE;oBACvB,OAAO,CAAC,IAAI,CACV,4DAA4D,IAAI,CAAC,KAAK,KAAK,GAAG,EAAE,CACjF,CAAA;gBACH,CAAC,CAAC;SACL;QACD,iBAAiB,EAAE;YACjB,YAAY,EAAE,KAAK,EAAE,0BAA0B;YAC/C,2BAA2B,EAAE,IAAI;SAClC;QACD,IAAI,EAAE;YACJ,GAAG,OAAO,CAAC,IAAI;YACf,WAAW,EAAE;gBACX,OAAO,EAAE,IAAI;gBACb,GAAG,OAAO,CAAC,IAAI,EAAE,WAAW;aAC7B;SAC4C;QAC/C,eAAe,EAAE;YACf,MAAM,EAAE;gBACN,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,EAAE;gBAC5C,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,EAAE;gBACpD,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;aACnF;SACF;QACD,cAAc;QACd,OAAO,EAAE;YACP,MAAM,CAAC;gBACL,aAAa,EAAE,MAAM;gBACrB,aAAa,EAAE,CAAC,eAAe,CAAC;gBAChC,WAAW,EAAE,IAAI;gBACjB,aAAa,EAAE;oBACb,gBAAgB,EAAE,IAAI;iBACvB;aACF,CAAC;YACF,QAAQ,CAAC;gBACP,uIAAuI;gBACvI,mBAAmB,EACjB,OAAO,CAAC,mBAAmB;oBAC3B,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE;wBAC9B,OAAO,CAAC,IAAI,CAAC,kBAAkB,KAAK,KAAK,GAAG,KAAK,IAAI,GAAG,CAAC,CAAA;oBAC3D,CAAC,CAAC;gBACJ,SAAS,EAAE,CAAC;gBACZ,SAAS,EAAE,GAAG;gBACd,wBAAwB,EAAE,IAAI;gBAC9B,WAAW,EAAE;oBACX,OAAO,EAAE,IAAI;iBACd;aACF,CAAC;YACF,6BAA6B,CAAC;gBAC5B,kBAAkB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,6BAA6B,CAAC,EAAE,EAAE,KAAK,CAAC;gBACvE,eAAe,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC,0BAA0B,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC;gBACzF,iBAAiB,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,wBAAwB,CAAC,EAAE,EAAE,MAAM,CAAC;aACpE,CAAC;YACF,GAAG,YAAY;SACsB;QACvC,aAAa,EAAE;YACb,IAAI,EAAE;gBACJ,MAAM,EAAE;oBACN,mEAAmE;oBACnE,iEAAiE;oBACjE,kEAAkE;oBAClE,qEAAqE;oBACrE,kEAAkE;oBAClE,wBAAwB;oBACxB,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAyC,EAAE;wBACrE,MAAM,cAAc,GAAG,2BAA2B,CAChD,IAA8B,EAC9B,OAAuC,EACvC,sBAAsB,CACvB,CAAA;wBAED,IACE,CAAC,kBAAkB;4BACnB,CAAC,wBAAwB,CAAC,cAAc,EAAE,mBAAmB,CAAC,EAC9D,CAAC;4BACD,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;gCAC5B,OAAM;4BACR,CAAC;4BACD,OAAO,EAAE,IAAI,EAAE,cAAyC,EAAE,CAAA;wBAC5D,CAAC;wBAED,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,GAAG,CAAQ,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;wBACnF,IAAI,CAAC,GAAG,EAAE,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;4BAC1B,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAA;wBACrE,CAAC;wBAED,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;4BAC5B,OAAO,EAAE,IAAI,EAAE,cAAyC,EAAE,CAAA;wBAC5D,CAAC;oBACH,CAAC;oBACD,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE;wBAC7B,IACE,sBAAsB,CAAC,MAAM,GAAG,CAAC;4BACjC,sBAAsB,CAAC,OAAuC,CAAC,EAC/D,CAAC;4BACD,OAAM;wBACR,CAAC;wBAED,mEAAmE;wBACnE,2DAA2D;wBAC3D,4DAA4D;wBAC5D,MAAM,2BAA2B,CAAC,EAAE,EAAE;4BACpC,MAAM,EAAE,IAAI,CAAC,EAAE;4BACf,IAAI,EAAE,IAAI,CAAC,IAAI;4BACf,KAAK,EAAE,IAAI,CAAC,KAAK;4BACjB,YAAY,EAAE,MAAM,eAAe,CAAC,EAAE,CAAC;yBACxC,CAAC,CAAA;oBACJ,CAAC;iBACF;aACF;SACF;QACD,QAAQ,EAAE;YACR,GAAG,OAAO,CAAC,QAAQ;YACnB,gBAAgB,EACd,OAAO,CAAC,QAAQ,EAAE,gBAAgB,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,aAAa;SAC/E;KACuD,CAAA;IAE1D,OAAO,UAAU,CAAwD,WAAW,CAAC,CAAA;AACvF,CAAC","sourcesContent":["import { apiKey } from \"@better-auth/api-key\"\nimport { getDb } from \"@voyant-travel/db\"\nimport {\n apikeyTable,\n authAccount,\n authSession,\n authUser,\n authVerification,\n} from \"@voyant-travel/db/schema/iam\"\nimport { type BetterAuthOptions, betterAuth } from \"better-auth\"\nimport { drizzleAdapter } from \"better-auth/adapters/drizzle\"\nimport { emailOTP } from \"better-auth/plugins\"\nimport type { BetterAuthPlugin } from \"better-auth/types\"\nimport { sql } from \"drizzle-orm\"\nimport type { AnyPgTable } from \"drizzle-orm/pg-core\"\n\nimport {\n createLocalMemberAccessPlugin,\n isLocalMemberDeactivated,\n isLocalMemberEmailDeactivated,\n isLocalMemberSessionActive,\n} from \"./local-member-access.js\"\nimport { expandTrustedOrigins, getTrustedOrigins } from \"./trusted-origins.js\"\nimport { isFirstAuthUser, provisionCurrentUserProfile } from \"./workspace.js\"\n\nexport function getAuthSecret(): string {\n const secret = process.env.BETTER_AUTH_SECRET \|\| \"\"\n\n if (!secret \|\| secret.length < 32) {\n throw new Error(\"Missing BETTER_AUTH_SECRET with at least 32 characters\")\n }\n\n return secret\n}\n\nexport type {\n AccountProfileUpdateHandler,\n ApiTokenRotationStore,\n BetterAuthApiTokenManagement,\n HandleAccountProfileRequestOptions,\n HandleApiTokenManagementRequestOptions,\n HandleOrganizationMembersRequestOptions,\n OrganizationMemberRecord,\n OrganizationMembersListHandler,\n OrganizationMembersListInput,\n} from \"./auth-facades.js\"\nexport {\n handleAccountProfileRequest,\n handleApiTokenManagementRequest,\n handleOrganizationMembersRequest,\n} from \"./auth-facades.js\"\n\ntype DefinedBetterAuthUserOptions<UserOptions extends BetterAuthOptions[\"user\"]> =\n UserOptions extends undefined ? Record<PropertyKey, never> : NonNullable<UserOptions>\n\ntype ResolvedBetterAuthChangeEmail<UserOptions extends BetterAuthOptions[\"user\"]> =\n DefinedBetterAuthUserOptions<UserOptions> extends { changeEmail?: infer ChangeEmail }\n ? ChangeEmail extends { enabled: infer Enabled }\n ? Omit<ChangeEmail, \"enabled\"> & { enabled: Enabled }\n : NonNullable<ChangeEmail> & { enabled: true }\n : { enabled: true }\n\ntype ResolvedBetterAuthUserOptions<UserOptions extends BetterAuthOptions[\"user\"]> = Omit<\n DefinedBetterAuthUserOptions<UserOptions>,\n \"changeEmail\"\n> & {\n changeEmail: ResolvedBetterAuthChangeEmail<UserOptions>\n}\n\ntype VoyantBetterAuthPlugins = [\n ReturnType<typeof apiKey>,\n ReturnType<typeof emailOTP>,\n ReturnType<typeof createLocalMemberAccessPlugin>,\n]\n\ntype ResolvedBetterAuthPlugins<Plugins extends BetterAuthPlugin[] \| undefined> =\n Plugins extends BetterAuthPlugin[]\n ? [...VoyantBetterAuthPlugins, ...Plugins]\n : VoyantBetterAuthPlugins\n\nconst DEFAULT_SIGNUP_BLOCK_SURFACES = [\"admin\"] as const\nconst CUSTOMER_SIGNUP_ENDPOINT_SUFFIXES = [\n \"/sign-up/email\",\n \"/phone-number/verify\",\n \"/sign-in/email-otp\",\n] as const\n\nexport interface DisableSignupWhenUsersExistOptions {\n /*\n Set to false when the consuming app owns all signup admission checks.\n \n Defaults to true.\n /\n enabled?: boolean\n /\n User surfaces that should keep the single-tenant signup guard. New users\n * with only other explicit surfaces can still be created by customer-facing\n * auth plugins such as phone OTP.\n \n Defaults to [\"admin\"]. Users without an explicit surfaces array are\n * treated as admin users for backward compatibility.\n /\n surfaces?: readonly string[]\n}\n\ntype BetterAuthCreateBeforeResult =\n \| boolean\n \| undefined\n \| {\n data: Record<string, unknown>\n }\n\ntype SignupBlockUserPayload = {\n surfaces?: unknown\n}\n\ntype BetterAuthHookContext = {\n path?: string\n}\n\nfunction normalizeSignupBlockSurfaces(\n options: DisableSignupWhenUsersExistOptions \| undefined,\n): readonly string[] {\n return options?.surfaces ?? DEFAULT_SIGNUP_BLOCK_SURFACES\n}\n\nfunction isSignupBlockEnabled(options: DisableSignupWhenUsersExistOptions \| undefined): boolean {\n return options?.enabled !== false\n}\n\nfunction normalizeSurfaceList(surfaces: readonly string[] \| undefined): readonly string[] {\n if (!surfaces) return []\n\n const normalized = new Set<string>()\n for (const surface of surfaces) {\n const trimmed = surface.trim()\n if (trimmed.length > 0) {\n normalized.add(trimmed)\n }\n }\n return Array.from(normalized)\n}\n\nfunction signupBlockAppliesToUser(\n user: SignupBlockUserPayload \| undefined,\n blockedSurfaces: readonly string[],\n): boolean {\n if (blockedSurfaces.length === 0) return false\n\n const surfaces = user?.surfaces\n if (Array.isArray(surfaces)) {\n const explicitSurfaces = surfaces.filter(\n (surface): surface is string => typeof surface === \"string\" && surface.trim().length > 0,\n )\n if (explicitSurfaces.length > 0) {\n return explicitSurfaces.some((surface) => blockedSurfaces.includes(surface.trim()))\n }\n }\n\n if (typeof surfaces === \"string\" && surfaces.trim().length > 0) {\n return blockedSurfaces.includes(surfaces.trim())\n }\n\n return blockedSurfaces.includes(\"admin\")\n}\n\nfunction isCustomerSignupCreate(context: BetterAuthHookContext \| null \| undefined): boolean {\n const path = context?.path\n if (!path) return false\n\n return CUSTOMER_SIGNUP_ENDPOINT_SUFFIXES.some((suffix) => path.endsWith(suffix))\n}\n\nfunction stampCustomerSignupSurfaces(\n user: SignupBlockUserPayload \| undefined,\n context: BetterAuthHookContext \| null \| undefined,\n surfaces: readonly string[],\n): SignupBlockUserPayload \| undefined {\n if (surfaces.length === 0 \|\| !isCustomerSignupCreate(context)) {\n return user\n }\n\n return {\n ...(user ?? {}),\n surfaces,\n }\n}\n\ntype ResolvedCreateBetterAuthOptions<\n UserOptions extends BetterAuthOptions[\"user\"],\n Plugins extends BetterAuthPlugin[] \| undefined,\n> = Omit<BetterAuthOptions, \"plugins\" \| \"user\"> & {\n plugins: ResolvedBetterAuthPlugins<Plugins>\n user: ResolvedBetterAuthUserOptions<UserOptions>\n}\n\nexport type BetterAuthDrizzleSchema = Record<string, AnyPgTable>\n\nexport interface CreateBetterAuthOptions<\n UserOptions extends BetterAuthOptions[\"user\"] = BetterAuthOptions[\"user\"],\n Plugins extends BetterAuthPlugin[] \| undefined = BetterAuthPlugin[] \| undefined,\n> {\n db?: ReturnType<typeof getDb>\n secret?: string\n baseURL?: string\n basePath?: string\n trustedOrigins?: string[]\n /\n Additional Drizzle tables for Better Auth plugins. The consuming app owns\n * matching migrations for every table passed here.\n /\n extraSchema?: BetterAuthDrizzleSchema\n plugins?: Plugins\n user?: UserOptions\n /\n Surfaces stamped on Better Auth customer self-signups before the bundled\n * single-tenant signup guard evaluates the new user. Applies to Better\n * Auth OTP signup endpoints that create a user as part of verification.\n \n Leave undefined to preserve Better Auth's raw user payload.\n /\n customerSignupSurfaces?: readonly string[]\n disableSignupWhenUsersExist?: DisableSignupWhenUsersExistOptions\n /* Called when a user requests a password reset. If not provided, logs to console. /\n sendResetPassword?: (data: {\n user: { email: string; name: string }\n url: string\n token: string\n }) => Promise<void>\n /* Called to send a verification OTP. If not provided, logs to console. /\n sendVerificationOTP?: (data: { email: string; otp: string; type: string }) => Promise<void>\n /\n Better Auth session cookie cache: session data rides in a short-lived\n * signed cookie. Enabled by default with a 5-minute TTL. Voyant still\n * validates local membership and session existence against Postgres so a\n * deleted session cannot be revived from the cookie cache. Pass `false` to\n * disable payload caching, or tune `maxAge` (seconds).\n /\n sessionCookieCache?: false \| { maxAge?: number }\n /* Better Auth secondary storage, typically Redis/KV, used for distributed rate limits. /\n secondaryStorage?: BetterAuthOptions[\"secondaryStorage\"]\n /* Better Auth rate-limit config. Defaults to secondary storage when present. /\n rateLimit?: BetterAuthOptions[\"rateLimit\"]\n /\n Additional Better Auth advanced options. Voyant supplies secure cookies\n * by default except in explicit local development. Set\n * `advanced.useSecureCookies` to override that default.\n /\n advanced?: BetterAuthOptions[\"advanced\"]\n}\n\n/\n Framework-agnostic Better Auth factory.\n \n Accepts optional overrides for db, secret, baseURL, trustedOrigins.\n * Does NOT depend on Next.js — safe to use in Hono workers, TanStack Start, etc.\n /\nexport function createBetterAuth<\n const UserOptions extends BetterAuthOptions[\"user\"] = undefined,\n const Plugins extends BetterAuthPlugin[] \| undefined = undefined,\n>(options: CreateBetterAuthOptions<UserOptions, Plugins> = {}) {\n const db = options.db ?? getDb(\"edge\")\n const secret = options.secret ?? getAuthSecret()\n const baseURL =\n options.baseURL ??\n process.env.BETTER_AUTH_URL ??\n process.env.APP_URL ??\n process.env.NEXT_PUBLIC_APP_URL ??\n \"http://localhost:3000\"\n const trustedOrigins = expandTrustedOrigins(\n options.trustedOrigins ?? getTrustedOrigins(),\n baseURL,\n )\n const extraPlugins = options.plugins ?? []\n const signupBlockSurfaces = normalizeSignupBlockSurfaces(options.disableSignupWhenUsersExist)\n const signupBlockEnabled = isSignupBlockEnabled(options.disableSignupWhenUsersExist)\n const customerSignupSurfaces = normalizeSurfaceList(options.customerSignupSurfaces)\n const schema = {\n user: authUser,\n session: authSession,\n account: authAccount,\n verification: authVerification,\n apikey: apikeyTable,\n ...(options.extraSchema ?? {}),\n } satisfies BetterAuthDrizzleSchema\n const rateLimit =\n options.rateLimit ??\n (options.secondaryStorage\n ? ({\n enabled: true,\n window: 60,\n max: 100,\n storage: \"secondary-storage\",\n } as BetterAuthOptions[\"rateLimit\"])\n : undefined)\n\n const authOptions = {\n appName: \"Voyant\",\n baseURL,\n ...(options.basePath ? { basePath: options.basePath } : {}),\n secret,\n database: drizzleAdapter(db, {\n provider: \"pg\",\n schema,\n }),\n ...(options.secondaryStorage ? { secondaryStorage: options.secondaryStorage } : {}),\n ...(rateLimit ? { rateLimit } : {}),\n ...(options.sessionCookieCache === false\n ? {}\n : {\n session: {\n cookieCache: {\n enabled: true,\n maxAge: options.sessionCookieCache?.maxAge ?? 300,\n },\n },\n }),\n emailAndPassword: {\n enabled: true,\n minPasswordLength: 8,\n maxPasswordLength: 128,\n requireEmailVerification: true,\n revokeSessionsOnPasswordReset: true,\n // eslint-disable-next-line @typescript-eslint/require-await -- owner: auth; existing suppression is intentional pending typed cleanup.\n sendResetPassword:\n options.sendResetPassword ??\n (async ({ user, url }) => {\n console.warn(\n `[Auth] No email provider configured — password reset for ${user.email}: ${url}`,\n )\n }),\n },\n emailVerification: {\n sendOnSignUp: false, // OTP plugin handles this\n autoSignInAfterVerification: true,\n },\n user: {\n ...options.user,\n changeEmail: {\n enabled: true,\n ...options.user?.changeEmail,\n },\n } as ResolvedBetterAuthUserOptions<UserOptions>,\n socialProviders: {\n google: {\n clientId: process.env.GOOGLE_CLIENT_ID \|\| \"\",\n clientSecret: process.env.GOOGLE_CLIENT_SECRET \|\| \"\",\n enabled: Boolean(process.env.GOOGLE_CLIENT_ID && process.env.GOOGLE_CLIENT_SECRET),\n },\n },\n trustedOrigins,\n plugins: [\n apiKey({\n defaultPrefix: \"voy_\",\n apiKeyHeaders: [\"authorization\"],\n requireName: true,\n keyExpiration: {\n defaultExpiresIn: null,\n },\n }),\n emailOTP({\n // eslint-disable-next-line @typescript-eslint/require-await -- owner: auth; existing suppression is intentional pending typed cleanup.\n sendVerificationOTP:\n options.sendVerificationOTP ??\n (async ({ email, otp, type }) => {\n console.warn(`[Auth] OTP for ${email}: ${otp} (${type})`)\n }),\n otpLength: 6,\n expiresIn: 600,\n sendVerificationOnSignUp: true,\n changeEmail: {\n enabled: true,\n },\n }),\n createLocalMemberAccessPlugin({\n isEmailDeactivated: (email) => isLocalMemberEmailDeactivated(db, email),\n isSessionActive: (sessionId, userId) => isLocalMemberSessionActive(db, sessionId, userId),\n isUserDeactivated: (userId) => isLocalMemberDeactivated(db, userId),\n }),\n ...extraPlugins,\n ] as ResolvedBetterAuthPlugins<Plugins>,\n databaseHooks: {\n user: {\n create: {\n // Single-tenant: once a user exists, reject any new-user creation.\n // Covers email sign-up AND social-provider sign-up (Google would\n // otherwise auto-create a user on first OAuth callback). Existing\n // social sign-ins still work because this hook only fires on CREATE.\n // Seed scripts do raw drizzle inserts, so they bypass this hook —\n // which is intentional.\n before: async (user, context): Promise<BetterAuthCreateBeforeResult> => {\n const normalizedUser = stampCustomerSignupSurfaces(\n user as SignupBlockUserPayload,\n context as BetterAuthHookContext \| null,\n customerSignupSurfaces,\n )\n\n if (\n !signupBlockEnabled \|\|\n !signupBlockAppliesToUser(normalizedUser, signupBlockSurfaces)\n ) {\n if (normalizedUser === user) {\n return\n }\n return { data: normalizedUser as Record<string, unknown> }\n }\n\n const [row] = await db.select({ count: sql<number>`count()::int` }).from(authUser)\n if ((row?.count ?? 0) > 0) {\n throw new Error(\"Sign-up is disabled. Ask an admin to invite you.\")\n }\n\n if (normalizedUser !== user) {\n return { data: normalizedUser as Record<string, unknown> }\n }\n },\n after: async (user, context) => {\n if (\n customerSignupSurfaces.length > 0 &&\n isCustomerSignupCreate(context as BetterAuthHookContext \| null)\n ) {\n return\n }\n\n // Single-tenant bootstrap: the very first user to register becomes\n // the super-admin. Runs atomically after the `user` row is\n // inserted, so a simple COUNT(*) = 1 check identifies them.\n await provisionCurrentUserProfile(db, {\n userId: user.id,\n name: user.name,\n image: user.image,\n isSuperAdmin: await isFirstAuthUser(db),\n })\n },\n },\n },\n },\n advanced: {\n ...options.advanced,\n useSecureCookies:\n options.advanced?.useSecureCookies ?? process.env.NODE_ENV !== \"development\",\n },\n } as ResolvedCreateBetterAuthOptions<UserOptions, Plugins>\n\n return betterAuth<ResolvedCreateBetterAuthOptions<UserOptions, Plugins>>(authOptions)\n}\n"]}

package/dist/team-management-cloud-adapter.d.ts ADDED Viewed

@@ -0,0 +1,7 @@
+import { type CloudAdminInvitation, type CloudAdminMember } from "./cloud-broker.js";
+import type { IdentityAccessRuntimeProvider } from "./identity-access-runtime-port.js";
+import { type TeamManagementAdapter } from "./team-management-policy.js";
+import type { TeamInvitationDto, TeamMemberDto } from "./team-management-runtime-port.js";
+export declare function cloudTeamMemberDto(member: CloudAdminMember): TeamMemberDto;
+export declare function cloudTeamInvitationDto(invitation: CloudAdminInvitation): TeamInvitationDto;
+export declare function createCloudTeamManagementAdapter(identityAccess: IdentityAccessRuntimeProvider): TeamManagementAdapter;