@voyant-travel/auth 0.129.0 → 0.130.0

package/dist/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAC7C,OAAO,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAA;AACzC,OAAO,EACL,WAAW,EACX,WAAW,EACX,WAAW,EACX,QAAQ,EACR,gBAAgB,GACjB,MAAM,8BAA8B,CAAA;AACrC,OAAO,EAA0B,UAAU,EAAE,MAAM,aAAa,CAAA;AAChE,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAC7D,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAA;AAE9C,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAA;AAGjC,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AAC9E,OAAO,EAAE,eAAe,EAAE,2BAA2B,EAAE,MAAM,gBAAgB,CAAA;AAE7E,MAAM,UAAU,aAAa;IAC3B,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,EAAE,CAAA;IAEnD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAA;IAC3E,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAaD,OAAO,EACL,2BAA2B,EAC3B,+BAA+B,EAC/B,gCAAgC,GACjC,MAAM,mBAAmB,CAAA;AA0B1B,MAAM,6BAA6B,GAAG,CAAC,OAAO,CAAU,CAAA;AACxD,MAAM,iCAAiC,GAAG;IACxC,gBAAgB;IAChB,sBAAsB;IACtB,oBAAoB;CACZ,CAAA;AAmCV,SAAS,4BAA4B,CACnC,OAAuD;IAEvD,OAAO,OAAO,EAAE,QAAQ,IAAI,6BAA6B,CAAA;AAC3D,CAAC;AAED,SAAS,oBAAoB,CAAC,OAAuD;IACnF,OAAO,OAAO,EAAE,OAAO,KAAK,KAAK,CAAA;AACnC,CAAC;AAED,SAAS,oBAAoB,CAAC,QAAuC;IACnE,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,CAAA;IAExB,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAA;IACpC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAA;QAC9B,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACzB,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;AAC/B,CAAC;AAED,SAAS,wBAAwB,CAC/B,IAAwC,EACxC,eAAkC;IAElC,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IAE9C,MAAM,QAAQ,GAAG,IAAI,EAAE,QAAQ,CAAA;IAC/B,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,MAAM,gBAAgB,GAAG,QAAQ,CAAC,MAAM,CACtC,CAAC,OAAO,EAAqB,EAAE,CAAC,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CACzF,CAAA;QACD,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChC,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;QACrF,CAAC;IACH,CAAC;IAED,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/D,OAAO,eAAe,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAA;IAClD,CAAC;IAED,OAAO,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;AAC1C,CAAC;AAED,SAAS,sBAAsB,CAAC,OAAiD;IAC/E,MAAM,IAAI,GAAG,OAAO,EAAE,IAAI,CAAA;IAC1B,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAA;IAEvB,OAAO,iCAAiC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;AAClF,CAAC;AAED,SAAS,2BAA2B,CAClC,IAAwC,EACxC,OAAiD,EACjD,QAA2B;IAE3B,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9D,OAAO,IAAI,CAAA;IACb,CAAC;IAED,OAAO;QACL,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;QACf,QAAQ;KACT,CAAA;AACH,CAAC;AAkED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAG9B,UAAyD,EAAE;IAC3D,MAAM,EAAE,GAAG,OAAO,CAAC,EAAE,IAAI,KAAK,CAAC,MAAM,CAAC,CAAA;IACtC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,aAAa,EAAE,CAAA;IAChD,MAAM,OAAO,GACX,OAAO,CAAC,OAAO;QACf,OAAO,CAAC,GAAG,CAAC,eAAe;QAC3B,OAAO,CAAC,GAAG,CAAC,OAAO;QACnB,OAAO,CAAC,GAAG,CAAC,mBAAmB;QAC/B,uBAAuB,CAAA;IACzB,MAAM,cAAc,GAAG,oBAAoB,CACzC,OAAO,CAAC,cAAc,IAAI,iBAAiB,EAAE,EAC7C,OAAO,CACR,CAAA;IACD,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAA;IAC1C,MAAM,mBAAmB,GAAG,4BAA4B,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAA;IAC7F,MAAM,kBAAkB,GAAG,oBAAoB,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAA;IACpF,MAAM,sBAAsB,GAAG,oBAAoB,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAA;IACnF,MAAM,MAAM,GAAG;QACb,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,WAAW;QACpB,OAAO,EAAE,WAAW;QACpB,YAAY,EAAE,gBAAgB;QAC9B,MAAM,EAAE,WAAW;QACnB,GAAG,CAAC,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC;KACG,CAAA;IACnC,MAAM,SAAS,GACb,OAAO,CAAC,SAAS;QACjB,CAAC,OAAO,CAAC,gBAAgB;YACvB,CAAC,CAAE;gBACC,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,EAAE;gBACV,GAAG,EAAE,GAAG;gBACR,OAAO,EAAE,mBAAmB;aACM;YACtC,CAAC,CAAC,SAAS,CAAC,CAAA;IAEhB,MAAM,WAAW,GAAG;QAClB,OAAO,EAAE,QAAQ;QACjB,OAAO;QACP,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,MAAM;QACN,QAAQ,EAAE,cAAc,CAAC,EAAE,EAAE;YAC3B,QAAQ,EAAE,IAAI;YACd,MAAM;SACP,CAAC;QACF,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnF,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,GAAG,CAAC,OAAO,CAAC,kBAAkB,KAAK,KAAK;YACtC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE,OAAO,EAAE;oBACP,WAAW,EAAE;wBACX,OAAO,EAAE,IAAI;wBACb,wDAAwD;wBACxD,0DAA0D;wBAC1D,6CAA6C;wBAC7C,MAAM,EAAE,OAAO,CAAC,kBAAkB,EAAE,MAAM,IAAI,GAAG;qBAClD;iBACF;aACF,CAAC;QACN,gBAAgB,EAAE;YAChB,OAAO,EAAE,IAAI;YACb,iBAAiB,EAAE,CAAC;YACpB,iBAAiB,EAAE,GAAG;YACtB,wBAAwB,EAAE,IAAI;YAC9B,6BAA6B,EAAE,IAAI;YACnC,uIAAuI;YACvI,iBAAiB,EACf,OAAO,CAAC,iBAAiB;gBACzB,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE;oBACvB,OAAO,CAAC,IAAI,CACV,4DAA4D,IAAI,CAAC,KAAK,KAAK,GAAG,EAAE,CACjF,CAAA;gBACH,CAAC,CAAC;SACL;QACD,iBAAiB,EAAE;YACjB,YAAY,EAAE,KAAK,EAAE,0BAA0B;YAC/C,2BAA2B,EAAE,IAAI;SAClC;QACD,IAAI,EAAE;YACJ,GAAG,OAAO,CAAC,IAAI;YACf,WAAW,EAAE;gBACX,OAAO,EAAE,IAAI;gBACb,GAAG,OAAO,CAAC,IAAI,EAAE,WAAW;aAC7B;SAC4C;QAC/C,eAAe,EAAE;YACf,MAAM,EAAE;gBACN,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,EAAE;gBAC5C,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,EAAE;gBACpD,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;aACnF;SACF;QACD,cAAc;QACd,OAAO,EAAE;YACP,MAAM,CAAC;gBACL,aAAa,EAAE,MAAM;gBACrB,aAAa,EAAE,CAAC,eAAe,CAAC;gBAChC,WAAW,EAAE,IAAI;gBACjB,aAAa,EAAE;oBACb,gBAAgB,EAAE,IAAI;iBACvB;aACF,CAAC;YACF,QAAQ,CAAC;gBACP,uIAAuI;gBACvI,mBAAmB,EACjB,OAAO,CAAC,mBAAmB;oBAC3B,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE;wBAC9B,OAAO,CAAC,IAAI,CAAC,kBAAkB,KAAK,KAAK,GAAG,KAAK,IAAI,GAAG,CAAC,CAAA;oBAC3D,CAAC,CAAC;gBACJ,SAAS,EAAE,CAAC;gBACZ,SAAS,EAAE,GAAG;gBACd,wBAAwB,EAAE,IAAI;gBAC9B,WAAW,EAAE;oBACX,OAAO,EAAE,IAAI;iBACd;aACF,CAAC;YACF,GAAG,YAAY;SACsB;QACvC,aAAa,EAAE;YACb,IAAI,EAAE;gBACJ,MAAM,EAAE;oBACN,mEAAmE;oBACnE,iEAAiE;oBACjE,kEAAkE;oBAClE,qEAAqE;oBACrE,kEAAkE;oBAClE,wBAAwB;oBACxB,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAyC,EAAE;wBACrE,MAAM,cAAc,GAAG,2BAA2B,CAChD,IAA8B,EAC9B,OAAuC,EACvC,sBAAsB,CACvB,CAAA;wBAED,IACE,CAAC,kBAAkB;4BACnB,CAAC,wBAAwB,CAAC,cAAc,EAAE,mBAAmB,CAAC,EAC9D,CAAC;4BACD,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;gCAC5B,OAAM;4BACR,CAAC;4BACD,OAAO,EAAE,IAAI,EAAE,cAAyC,EAAE,CAAA;wBAC5D,CAAC;wBAED,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,GAAG,CAAQ,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;wBACnF,IAAI,CAAC,GAAG,EAAE,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;4BAC1B,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAA;wBACrE,CAAC;wBAED,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;4BAC5B,OAAO,EAAE,IAAI,EAAE,cAAyC,EAAE,CAAA;wBAC5D,CAAC;oBACH,CAAC;oBACD,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE;wBAC7B,IACE,sBAAsB,CAAC,MAAM,GAAG,CAAC;4BACjC,sBAAsB,CAAC,OAAuC,CAAC,EAC/D,CAAC;4BACD,OAAM;wBACR,CAAC;wBAED,mEAAmE;wBACnE,2DAA2D;wBAC3D,4DAA4D;wBAC5D,MAAM,2BAA2B,CAAC,EAAE,EAAE;4BACpC,MAAM,EAAE,IAAI,CAAC,EAAE;4BACf,IAAI,EAAE,IAAI,CAAC,IAAI;4BACf,KAAK,EAAE,IAAI,CAAC,KAAK;4BACjB,YAAY,EAAE,MAAM,eAAe,CAAC,EAAE,CAAC;yBACxC,CAAC,CAAA;oBACJ,CAAC;iBACF;aACF;SACF;QACD,QAAQ,EAAE;YACR,GAAG,OAAO,CAAC,QAAQ;YACnB,gBAAgB,EACd,OAAO,CAAC,QAAQ,EAAE,gBAAgB,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,aAAa;SAC/E;KACuD,CAAA;IAE1D,OAAO,UAAU,CAAwD,WAAW,CAAC,CAAA;AACvF,CAAC","sourcesContent":["import { apiKey } from \"@better-auth/api-key\"\nimport { getDb } from \"@voyant-travel/db\"\nimport {\n  apikeyTable,\n  authAccount,\n  authSession,\n  authUser,\n  authVerification,\n} from \"@voyant-travel/db/schema/iam\"\nimport { type BetterAuthOptions, betterAuth } from \"better-auth\"\nimport { drizzleAdapter } from \"better-auth/adapters/drizzle\"\nimport { emailOTP } from \"better-auth/plugins\"\nimport type { BetterAuthPlugin } from \"better-auth/types\"\nimport { sql } from \"drizzle-orm\"\nimport type { AnyPgTable } from \"drizzle-orm/pg-core\"\n\nimport { expandTrustedOrigins, getTrustedOrigins } from \"./trusted-origins.js\"\nimport { isFirstAuthUser, provisionCurrentUserProfile } from \"./workspace.js\"\n\nexport function getAuthSecret(): string {\n  const secret = process.env.BETTER_AUTH_SECRET || \"\"\n\n  if (!secret || secret.length < 32) {\n    throw new Error(\"Missing BETTER_AUTH_SECRET with at least 32 characters\")\n  }\n\n  return secret\n}\n\nexport type {\n  AccountProfileUpdateHandler,\n  ApiTokenRotationStore,\n  BetterAuthApiTokenManagement,\n  HandleAccountProfileRequestOptions,\n  HandleApiTokenManagementRequestOptions,\n  HandleOrganizationMembersRequestOptions,\n  OrganizationMemberRecord,\n  OrganizationMembersListHandler,\n  OrganizationMembersListInput,\n} from \"./auth-facades.js\"\nexport {\n  handleAccountProfileRequest,\n  handleApiTokenManagementRequest,\n  handleOrganizationMembersRequest,\n} from \"./auth-facades.js\"\n\ntype DefinedBetterAuthUserOptions<UserOptions extends BetterAuthOptions[\"user\"]> =\n  UserOptions extends undefined ? Record<PropertyKey, never> : NonNullable<UserOptions>\n\ntype ResolvedBetterAuthChangeEmail<UserOptions extends BetterAuthOptions[\"user\"]> =\n  DefinedBetterAuthUserOptions<UserOptions> extends { changeEmail?: infer ChangeEmail }\n    ? ChangeEmail extends { enabled: infer Enabled }\n      ? Omit<ChangeEmail, \"enabled\"> & { enabled: Enabled }\n      : NonNullable<ChangeEmail> & { enabled: true }\n    : { enabled: true }\n\ntype ResolvedBetterAuthUserOptions<UserOptions extends BetterAuthOptions[\"user\"]> = Omit<\n  DefinedBetterAuthUserOptions<UserOptions>,\n  \"changeEmail\"\n> & {\n  changeEmail: ResolvedBetterAuthChangeEmail<UserOptions>\n}\n\ntype VoyantBetterAuthPlugins = [ReturnType<typeof apiKey>, ReturnType<typeof emailOTP>]\n\ntype ResolvedBetterAuthPlugins<Plugins extends BetterAuthPlugin[] | undefined> =\n  Plugins extends BetterAuthPlugin[]\n    ? [...VoyantBetterAuthPlugins, ...Plugins]\n    : VoyantBetterAuthPlugins\n\nconst DEFAULT_SIGNUP_BLOCK_SURFACES = [\"admin\"] as const\nconst CUSTOMER_SIGNUP_ENDPOINT_SUFFIXES = [\n  \"/sign-up/email\",\n  \"/phone-number/verify\",\n  \"/sign-in/email-otp\",\n] as const\n\nexport interface DisableSignupWhenUsersExistOptions {\n  /**\n   * Set to false when the consuming app owns all signup admission checks.\n   *\n   * Defaults to true.\n   */\n  enabled?: boolean\n  /**\n   * User surfaces that should keep the single-tenant signup guard. New users\n   * with only other explicit surfaces can still be created by customer-facing\n   * auth plugins such as phone OTP.\n   *\n   * Defaults to [\"admin\"]. Users without an explicit surfaces array are\n   * treated as admin users for backward compatibility.\n   */\n  surfaces?: readonly string[]\n}\n\ntype BetterAuthCreateBeforeResult =\n  | boolean\n  | undefined\n  | {\n      data: Record<string, unknown>\n    }\n\ntype SignupBlockUserPayload = {\n  surfaces?: unknown\n}\n\ntype BetterAuthHookContext = {\n  path?: string\n}\n\nfunction normalizeSignupBlockSurfaces(\n  options: DisableSignupWhenUsersExistOptions | undefined,\n): readonly string[] {\n  return options?.surfaces ?? DEFAULT_SIGNUP_BLOCK_SURFACES\n}\n\nfunction isSignupBlockEnabled(options: DisableSignupWhenUsersExistOptions | undefined): boolean {\n  return options?.enabled !== false\n}\n\nfunction normalizeSurfaceList(surfaces: readonly string[] | undefined): readonly string[] {\n  if (!surfaces) return []\n\n  const normalized = new Set<string>()\n  for (const surface of surfaces) {\n    const trimmed = surface.trim()\n    if (trimmed.length > 0) {\n      normalized.add(trimmed)\n    }\n  }\n  return Array.from(normalized)\n}\n\nfunction signupBlockAppliesToUser(\n  user: SignupBlockUserPayload | undefined,\n  blockedSurfaces: readonly string[],\n): boolean {\n  if (blockedSurfaces.length === 0) return false\n\n  const surfaces = user?.surfaces\n  if (Array.isArray(surfaces)) {\n    const explicitSurfaces = surfaces.filter(\n      (surface): surface is string => typeof surface === \"string\" && surface.trim().length > 0,\n    )\n    if (explicitSurfaces.length > 0) {\n      return explicitSurfaces.some((surface) => blockedSurfaces.includes(surface.trim()))\n    }\n  }\n\n  if (typeof surfaces === \"string\" && surfaces.trim().length > 0) {\n    return blockedSurfaces.includes(surfaces.trim())\n  }\n\n  return blockedSurfaces.includes(\"admin\")\n}\n\nfunction isCustomerSignupCreate(context: BetterAuthHookContext | null | undefined): boolean {\n  const path = context?.path\n  if (!path) return false\n\n  return CUSTOMER_SIGNUP_ENDPOINT_SUFFIXES.some((suffix) => path.endsWith(suffix))\n}\n\nfunction stampCustomerSignupSurfaces(\n  user: SignupBlockUserPayload | undefined,\n  context: BetterAuthHookContext | null | undefined,\n  surfaces: readonly string[],\n): SignupBlockUserPayload | undefined {\n  if (surfaces.length === 0 || !isCustomerSignupCreate(context)) {\n    return user\n  }\n\n  return {\n    ...(user ?? {}),\n    surfaces,\n  }\n}\n\ntype ResolvedCreateBetterAuthOptions<\n  UserOptions extends BetterAuthOptions[\"user\"],\n  Plugins extends BetterAuthPlugin[] | undefined,\n> = Omit<BetterAuthOptions, \"plugins\" | \"user\"> & {\n  plugins: ResolvedBetterAuthPlugins<Plugins>\n  user: ResolvedBetterAuthUserOptions<UserOptions>\n}\n\nexport type BetterAuthDrizzleSchema = Record<string, AnyPgTable>\n\nexport interface CreateBetterAuthOptions<\n  UserOptions extends BetterAuthOptions[\"user\"] = BetterAuthOptions[\"user\"],\n  Plugins extends BetterAuthPlugin[] | undefined = BetterAuthPlugin[] | undefined,\n> {\n  db?: ReturnType<typeof getDb>\n  secret?: string\n  baseURL?: string\n  basePath?: string\n  trustedOrigins?: string[]\n  /**\n   * Additional Drizzle tables for Better Auth plugins. The consuming app owns\n   * matching migrations for every table passed here.\n   */\n  extraSchema?: BetterAuthDrizzleSchema\n  plugins?: Plugins\n  user?: UserOptions\n  /**\n   * Surfaces stamped on Better Auth customer self-signups before the bundled\n   * single-tenant signup guard evaluates the new user. Applies to Better\n   * Auth OTP signup endpoints that create a user as part of verification.\n   *\n   * Leave undefined to preserve Better Auth's raw user payload.\n   */\n  customerSignupSurfaces?: readonly string[]\n  disableSignupWhenUsersExist?: DisableSignupWhenUsersExistOptions\n  /** Called when a user requests a password reset. If not provided, logs to console. */\n  sendResetPassword?: (data: {\n    user: { email: string; name: string }\n    url: string\n    token: string\n  }) => Promise<void>\n  /** Called to send a verification OTP. If not provided, logs to console. */\n  sendVerificationOTP?: (data: { email: string; otp: string; type: string }) => Promise<void>\n  /**\n   * Better Auth session cookie cache: session data rides in a short-lived\n   * signed cookie so `getSession` skips the Postgres lookup on most\n   * requests. Enabled by default with a 5-minute TTL — the trade-off is\n   * that a revoked/expired session can stay usable for up to `maxAge`\n   * seconds. Pass `false` for revocation-sensitive deployments, or tune\n   * `maxAge` (seconds).\n   */\n  sessionCookieCache?: false | { maxAge?: number }\n  /** Better Auth secondary storage, typically Redis/KV, used for distributed rate limits. */\n  secondaryStorage?: BetterAuthOptions[\"secondaryStorage\"]\n  /** Better Auth rate-limit config. Defaults to secondary storage when present. */\n  rateLimit?: BetterAuthOptions[\"rateLimit\"]\n  /**\n   * Additional Better Auth advanced options. Voyant supplies secure cookies\n   * by default except in explicit local development. Set\n   * `advanced.useSecureCookies` to override that default.\n   */\n  advanced?: BetterAuthOptions[\"advanced\"]\n}\n\n/**\n * Framework-agnostic Better Auth factory.\n *\n * Accepts optional overrides for db, secret, baseURL, trustedOrigins.\n * Does NOT depend on Next.js — safe to use in Hono workers, TanStack Start, etc.\n */\nexport function createBetterAuth<\n  const UserOptions extends BetterAuthOptions[\"user\"] = undefined,\n  const Plugins extends BetterAuthPlugin[] | undefined = undefined,\n>(options: CreateBetterAuthOptions<UserOptions, Plugins> = {}) {\n  const db = options.db ?? getDb(\"edge\")\n  const secret = options.secret ?? getAuthSecret()\n  const baseURL =\n    options.baseURL ??\n    process.env.BETTER_AUTH_URL ??\n    process.env.APP_URL ??\n    process.env.NEXT_PUBLIC_APP_URL ??\n    \"http://localhost:3000\"\n  const trustedOrigins = expandTrustedOrigins(\n    options.trustedOrigins ?? getTrustedOrigins(),\n    baseURL,\n  )\n  const extraPlugins = options.plugins ?? []\n  const signupBlockSurfaces = normalizeSignupBlockSurfaces(options.disableSignupWhenUsersExist)\n  const signupBlockEnabled = isSignupBlockEnabled(options.disableSignupWhenUsersExist)\n  const customerSignupSurfaces = normalizeSurfaceList(options.customerSignupSurfaces)\n  const schema = {\n    user: authUser,\n    session: authSession,\n    account: authAccount,\n    verification: authVerification,\n    apikey: apikeyTable,\n    ...(options.extraSchema ?? {}),\n  } satisfies BetterAuthDrizzleSchema\n  const rateLimit =\n    options.rateLimit ??\n    (options.secondaryStorage\n      ? ({\n          enabled: true,\n          window: 60,\n          max: 100,\n          storage: \"secondary-storage\",\n        } as BetterAuthOptions[\"rateLimit\"])\n      : undefined)\n\n  const authOptions = {\n    appName: \"Voyant\",\n    baseURL,\n    ...(options.basePath ? { basePath: options.basePath } : {}),\n    secret,\n    database: drizzleAdapter(db, {\n      provider: \"pg\",\n      schema,\n    }),\n    ...(options.secondaryStorage ? { secondaryStorage: options.secondaryStorage } : {}),\n    ...(rateLimit ? { rateLimit } : {}),\n    ...(options.sessionCookieCache === false\n      ? {}\n      : {\n          session: {\n            cookieCache: {\n              enabled: true,\n              // Caps how long a revoked session stays usable from the\n              // cookie alone; within the window getSession answers from\n              // the signed cookie with zero DB roundtrips.\n              maxAge: options.sessionCookieCache?.maxAge ?? 300,\n            },\n          },\n        }),\n    emailAndPassword: {\n      enabled: true,\n      minPasswordLength: 8,\n      maxPasswordLength: 128,\n      requireEmailVerification: true,\n      revokeSessionsOnPasswordReset: true,\n      // eslint-disable-next-line @typescript-eslint/require-await -- owner: auth; existing suppression is intentional pending typed cleanup.\n      sendResetPassword:\n        options.sendResetPassword ??\n        (async ({ user, url }) => {\n          console.warn(\n            `[Auth] No email provider configured — password reset for ${user.email}: ${url}`,\n          )\n        }),\n    },\n    emailVerification: {\n      sendOnSignUp: false, // OTP plugin handles this\n      autoSignInAfterVerification: true,\n    },\n    user: {\n      ...options.user,\n      changeEmail: {\n        enabled: true,\n        ...options.user?.changeEmail,\n      },\n    } as ResolvedBetterAuthUserOptions<UserOptions>,\n    socialProviders: {\n      google: {\n        clientId: process.env.GOOGLE_CLIENT_ID || \"\",\n        clientSecret: process.env.GOOGLE_CLIENT_SECRET || \"\",\n        enabled: Boolean(process.env.GOOGLE_CLIENT_ID && process.env.GOOGLE_CLIENT_SECRET),\n      },\n    },\n    trustedOrigins,\n    plugins: [\n      apiKey({\n        defaultPrefix: \"voy_\",\n        apiKeyHeaders: [\"authorization\"],\n        requireName: true,\n        keyExpiration: {\n          defaultExpiresIn: null,\n        },\n      }),\n      emailOTP({\n        // eslint-disable-next-line @typescript-eslint/require-await -- owner: auth; existing suppression is intentional pending typed cleanup.\n        sendVerificationOTP:\n          options.sendVerificationOTP ??\n          (async ({ email, otp, type }) => {\n            console.warn(`[Auth] OTP for ${email}: ${otp} (${type})`)\n          }),\n        otpLength: 6,\n        expiresIn: 600,\n        sendVerificationOnSignUp: true,\n        changeEmail: {\n          enabled: true,\n        },\n      }),\n      ...extraPlugins,\n    ] as ResolvedBetterAuthPlugins<Plugins>,\n    databaseHooks: {\n      user: {\n        create: {\n          // Single-tenant: once a user exists, reject any new-user creation.\n          // Covers email sign-up AND social-provider sign-up (Google would\n          // otherwise auto-create a user on first OAuth callback). Existing\n          // social sign-ins still work because this hook only fires on CREATE.\n          // Seed scripts do raw drizzle inserts, so they bypass this hook —\n          // which is intentional.\n          before: async (user, context): Promise<BetterAuthCreateBeforeResult> => {\n            const normalizedUser = stampCustomerSignupSurfaces(\n              user as SignupBlockUserPayload,\n              context as BetterAuthHookContext | null,\n              customerSignupSurfaces,\n            )\n\n            if (\n              !signupBlockEnabled ||\n              !signupBlockAppliesToUser(normalizedUser, signupBlockSurfaces)\n            ) {\n              if (normalizedUser === user) {\n                return\n              }\n              return { data: normalizedUser as Record<string, unknown> }\n            }\n\n            const [row] = await db.select({ count: sql<number>`count(*)::int` }).from(authUser)\n            if ((row?.count ?? 0) > 0) {\n              throw new Error(\"Sign-up is disabled. Ask an admin to invite you.\")\n            }\n\n            if (normalizedUser !== user) {\n              return { data: normalizedUser as Record<string, unknown> }\n            }\n          },\n          after: async (user, context) => {\n            if (\n              customerSignupSurfaces.length > 0 &&\n              isCustomerSignupCreate(context as BetterAuthHookContext | null)\n            ) {\n              return\n            }\n\n            // Single-tenant bootstrap: the very first user to register becomes\n            // the super-admin. Runs atomically after the `user` row is\n            // inserted, so a simple COUNT(*) = 1 check identifies them.\n            await provisionCurrentUserProfile(db, {\n              userId: user.id,\n              name: user.name,\n              image: user.image,\n              isSuperAdmin: await isFirstAuthUser(db),\n            })\n          },\n        },\n      },\n    },\n    advanced: {\n      ...options.advanced,\n      useSecureCookies:\n        options.advanced?.useSecureCookies ?? process.env.NODE_ENV !== \"development\",\n    },\n  } as ResolvedCreateBetterAuthOptions<UserOptions, Plugins>\n\n  return betterAuth<ResolvedCreateBetterAuthOptions<UserOptions, Plugins>>(authOptions)\n}\n"]}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAC7C,OAAO,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAA;AACzC,OAAO,EACL,WAAW,EACX,WAAW,EACX,WAAW,EACX,QAAQ,EACR,gBAAgB,GACjB,MAAM,8BAA8B,CAAA;AACrC,OAAO,EAA0B,UAAU,EAAE,MAAM,aAAa,CAAA;AAChE,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAC7D,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAA;AAE9C,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAA;AAGjC,OAAO,EACL,6BAA6B,EAC7B,wBAAwB,EACxB,6BAA6B,EAC7B,0BAA0B,GAC3B,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AAC9E,OAAO,EAAE,eAAe,EAAE,2BAA2B,EAAE,MAAM,gBAAgB,CAAA;AAE7E,MAAM,UAAU,aAAa;IAC3B,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,EAAE,CAAA;IAEnD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAA;IAC3E,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAaD,OAAO,EACL,2BAA2B,EAC3B,+BAA+B,EAC/B,gCAAgC,GACjC,MAAM,mBAAmB,CAAA;AA8B1B,MAAM,6BAA6B,GAAG,CAAC,OAAO,CAAU,CAAA;AACxD,MAAM,iCAAiC,GAAG;IACxC,gBAAgB;IAChB,sBAAsB;IACtB,oBAAoB;CACZ,CAAA;AAmCV,SAAS,4BAA4B,CACnC,OAAuD;IAEvD,OAAO,OAAO,EAAE,QAAQ,IAAI,6BAA6B,CAAA;AAC3D,CAAC;AAED,SAAS,oBAAoB,CAAC,OAAuD;IACnF,OAAO,OAAO,EAAE,OAAO,KAAK,KAAK,CAAA;AACnC,CAAC;AAED,SAAS,oBAAoB,CAAC,QAAuC;IACnE,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,CAAA;IAExB,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAA;IACpC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAA;QAC9B,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACzB,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;AAC/B,CAAC;AAED,SAAS,wBAAwB,CAC/B,IAAwC,EACxC,eAAkC;IAElC,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IAE9C,MAAM,QAAQ,GAAG,IAAI,EAAE,QAAQ,CAAA;IAC/B,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,MAAM,gBAAgB,GAAG,QAAQ,CAAC,MAAM,CACtC,CAAC,OAAO,EAAqB,EAAE,CAAC,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CACzF,CAAA;QACD,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChC,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;QACrF,CAAC;IACH,CAAC;IAED,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/D,OAAO,eAAe,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAA;IAClD,CAAC;IAED,OAAO,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;AAC1C,CAAC;AAED,SAAS,sBAAsB,CAAC,OAAiD;IAC/E,MAAM,IAAI,GAAG,OAAO,EAAE,IAAI,CAAA;IAC1B,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAA;IAEvB,OAAO,iCAAiC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;AAClF,CAAC;AAED,SAAS,2BAA2B,CAClC,IAAwC,EACxC,OAAiD,EACjD,QAA2B;IAE3B,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9D,OAAO,IAAI,CAAA;IACb,CAAC;IAED,OAAO;QACL,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;QACf,QAAQ;KACT,CAAA;AACH,CAAC;AAiED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAG9B,UAAyD,EAAE;IAC3D,MAAM,EAAE,GAAG,OAAO,CAAC,EAAE,IAAI,KAAK,CAAC,MAAM,CAAC,CAAA;IACtC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,aAAa,EAAE,CAAA;IAChD,MAAM,OAAO,GACX,OAAO,CAAC,OAAO;QACf,OAAO,CAAC,GAAG,CAAC,eAAe;QAC3B,OAAO,CAAC,GAAG,CAAC,OAAO;QACnB,OAAO,CAAC,GAAG,CAAC,mBAAmB;QAC/B,uBAAuB,CAAA;IACzB,MAAM,cAAc,GAAG,oBAAoB,CACzC,OAAO,CAAC,cAAc,IAAI,iBAAiB,EAAE,EAC7C,OAAO,CACR,CAAA;IACD,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAA;IAC1C,MAAM,mBAAmB,GAAG,4BAA4B,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAA;IAC7F,MAAM,kBAAkB,GAAG,oBAAoB,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAA;IACpF,MAAM,sBAAsB,GAAG,oBAAoB,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAA;IACnF,MAAM,MAAM,GAAG;QACb,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,WAAW;QACpB,OAAO,EAAE,WAAW;QACpB,YAAY,EAAE,gBAAgB;QAC9B,MAAM,EAAE,WAAW;QACnB,GAAG,CAAC,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC;KACG,CAAA;IACnC,MAAM,SAAS,GACb,OAAO,CAAC,SAAS;QACjB,CAAC,OAAO,CAAC,gBAAgB;YACvB,CAAC,CAAE;gBACC,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,EAAE;gBACV,GAAG,EAAE,GAAG;gBACR,OAAO,EAAE,mBAAmB;aACM;YACtC,CAAC,CAAC,SAAS,CAAC,CAAA;IAEhB,MAAM,WAAW,GAAG;QAClB,OAAO,EAAE,QAAQ;QACjB,OAAO;QACP,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,MAAM;QACN,QAAQ,EAAE,cAAc,CAAC,EAAE,EAAE;YAC3B,QAAQ,EAAE,IAAI;YACd,MAAM;SACP,CAAC;QACF,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnF,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,GAAG,CAAC,OAAO,CAAC,kBAAkB,KAAK,KAAK;YACtC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE,OAAO,EAAE;oBACP,WAAW,EAAE;wBACX,OAAO,EAAE,IAAI;wBACb,MAAM,EAAE,OAAO,CAAC,kBAAkB,EAAE,MAAM,IAAI,GAAG;qBAClD;iBACF;aACF,CAAC;QACN,gBAAgB,EAAE;YAChB,OAAO,EAAE,IAAI;YACb,iBAAiB,EAAE,CAAC;YACpB,iBAAiB,EAAE,GAAG;YACtB,wBAAwB,EAAE,IAAI;YAC9B,6BAA6B,EAAE,IAAI;YACnC,uIAAuI;YACvI,iBAAiB,EACf,OAAO,CAAC,iBAAiB;gBACzB,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE;oBACvB,OAAO,CAAC,IAAI,CACV,4DAA4D,IAAI,CAAC,KAAK,KAAK,GAAG,EAAE,CACjF,CAAA;gBACH,CAAC,CAAC;SACL;QACD,iBAAiB,EAAE;YACjB,YAAY,EAAE,KAAK,EAAE,0BAA0B;YAC/C,2BAA2B,EAAE,IAAI;SAClC;QACD,IAAI,EAAE;YACJ,GAAG,OAAO,CAAC,IAAI;YACf,WAAW,EAAE;gBACX,OAAO,EAAE,IAAI;gBACb,GAAG,OAAO,CAAC,IAAI,EAAE,WAAW;aAC7B;SAC4C;QAC/C,eAAe,EAAE;YACf,MAAM,EAAE;gBACN,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,EAAE;gBAC5C,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,EAAE;gBACpD,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;aACnF;SACF;QACD,cAAc;QACd,OAAO,EAAE;YACP,MAAM,CAAC;gBACL,aAAa,EAAE,MAAM;gBACrB,aAAa,EAAE,CAAC,eAAe,CAAC;gBAChC,WAAW,EAAE,IAAI;gBACjB,aAAa,EAAE;oBACb,gBAAgB,EAAE,IAAI;iBACvB;aACF,CAAC;YACF,QAAQ,CAAC;gBACP,uIAAuI;gBACvI,mBAAmB,EACjB,OAAO,CAAC,mBAAmB;oBAC3B,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE;wBAC9B,OAAO,CAAC,IAAI,CAAC,kBAAkB,KAAK,KAAK,GAAG,KAAK,IAAI,GAAG,CAAC,CAAA;oBAC3D,CAAC,CAAC;gBACJ,SAAS,EAAE,CAAC;gBACZ,SAAS,EAAE,GAAG;gBACd,wBAAwB,EAAE,IAAI;gBAC9B,WAAW,EAAE;oBACX,OAAO,EAAE,IAAI;iBACd;aACF,CAAC;YACF,6BAA6B,CAAC;gBAC5B,kBAAkB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,6BAA6B,CAAC,EAAE,EAAE,KAAK,CAAC;gBACvE,eAAe,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC,0BAA0B,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC;gBACzF,iBAAiB,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,wBAAwB,CAAC,EAAE,EAAE,MAAM,CAAC;aACpE,CAAC;YACF,GAAG,YAAY;SACsB;QACvC,aAAa,EAAE;YACb,IAAI,EAAE;gBACJ,MAAM,EAAE;oBACN,mEAAmE;oBACnE,iEAAiE;oBACjE,kEAAkE;oBAClE,qEAAqE;oBACrE,kEAAkE;oBAClE,wBAAwB;oBACxB,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAyC,EAAE;wBACrE,MAAM,cAAc,GAAG,2BAA2B,CAChD,IAA8B,EAC9B,OAAuC,EACvC,sBAAsB,CACvB,CAAA;wBAED,IACE,CAAC,kBAAkB;4BACnB,CAAC,wBAAwB,CAAC,cAAc,EAAE,mBAAmB,CAAC,EAC9D,CAAC;4BACD,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;gCAC5B,OAAM;4BACR,CAAC;4BACD,OAAO,EAAE,IAAI,EAAE,cAAyC,EAAE,CAAA;wBAC5D,CAAC;wBAED,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,GAAG,CAAQ,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;wBACnF,IAAI,CAAC,GAAG,EAAE,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;4BAC1B,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAA;wBACrE,CAAC;wBAED,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;4BAC5B,OAAO,EAAE,IAAI,EAAE,cAAyC,EAAE,CAAA;wBAC5D,CAAC;oBACH,CAAC;oBACD,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE;wBAC7B,IACE,sBAAsB,CAAC,MAAM,GAAG,CAAC;4BACjC,sBAAsB,CAAC,OAAuC,CAAC,EAC/D,CAAC;4BACD,OAAM;wBACR,CAAC;wBAED,mEAAmE;wBACnE,2DAA2D;wBAC3D,4DAA4D;wBAC5D,MAAM,2BAA2B,CAAC,EAAE,EAAE;4BACpC,MAAM,EAAE,IAAI,CAAC,EAAE;4BACf,IAAI,EAAE,IAAI,CAAC,IAAI;4BACf,KAAK,EAAE,IAAI,CAAC,KAAK;4BACjB,YAAY,EAAE,MAAM,eAAe,CAAC,EAAE,CAAC;yBACxC,CAAC,CAAA;oBACJ,CAAC;iBACF;aACF;SACF;QACD,QAAQ,EAAE;YACR,GAAG,OAAO,CAAC,QAAQ;YACnB,gBAAgB,EACd,OAAO,CAAC,QAAQ,EAAE,gBAAgB,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,aAAa;SAC/E;KACuD,CAAA;IAE1D,OAAO,UAAU,CAAwD,WAAW,CAAC,CAAA;AACvF,CAAC","sourcesContent":["import { apiKey } from \"@better-auth/api-key\"\nimport { getDb } from \"@voyant-travel/db\"\nimport {\n  apikeyTable,\n  authAccount,\n  authSession,\n  authUser,\n  authVerification,\n} from \"@voyant-travel/db/schema/iam\"\nimport { type BetterAuthOptions, betterAuth } from \"better-auth\"\nimport { drizzleAdapter } from \"better-auth/adapters/drizzle\"\nimport { emailOTP } from \"better-auth/plugins\"\nimport type { BetterAuthPlugin } from \"better-auth/types\"\nimport { sql } from \"drizzle-orm\"\nimport type { AnyPgTable } from \"drizzle-orm/pg-core\"\n\nimport {\n  createLocalMemberAccessPlugin,\n  isLocalMemberDeactivated,\n  isLocalMemberEmailDeactivated,\n  isLocalMemberSessionActive,\n} from \"./local-member-access.js\"\nimport { expandTrustedOrigins, getTrustedOrigins } from \"./trusted-origins.js\"\nimport { isFirstAuthUser, provisionCurrentUserProfile } from \"./workspace.js\"\n\nexport function getAuthSecret(): string {\n  const secret = process.env.BETTER_AUTH_SECRET || \"\"\n\n  if (!secret || secret.length < 32) {\n    throw new Error(\"Missing BETTER_AUTH_SECRET with at least 32 characters\")\n  }\n\n  return secret\n}\n\nexport type {\n  AccountProfileUpdateHandler,\n  ApiTokenRotationStore,\n  BetterAuthApiTokenManagement,\n  HandleAccountProfileRequestOptions,\n  HandleApiTokenManagementRequestOptions,\n  HandleOrganizationMembersRequestOptions,\n  OrganizationMemberRecord,\n  OrganizationMembersListHandler,\n  OrganizationMembersListInput,\n} from \"./auth-facades.js\"\nexport {\n  handleAccountProfileRequest,\n  handleApiTokenManagementRequest,\n  handleOrganizationMembersRequest,\n} from \"./auth-facades.js\"\n\ntype DefinedBetterAuthUserOptions<UserOptions extends BetterAuthOptions[\"user\"]> =\n  UserOptions extends undefined ? Record<PropertyKey, never> : NonNullable<UserOptions>\n\ntype ResolvedBetterAuthChangeEmail<UserOptions extends BetterAuthOptions[\"user\"]> =\n  DefinedBetterAuthUserOptions<UserOptions> extends { changeEmail?: infer ChangeEmail }\n    ? ChangeEmail extends { enabled: infer Enabled }\n      ? Omit<ChangeEmail, \"enabled\"> & { enabled: Enabled }\n      : NonNullable<ChangeEmail> & { enabled: true }\n    : { enabled: true }\n\ntype ResolvedBetterAuthUserOptions<UserOptions extends BetterAuthOptions[\"user\"]> = Omit<\n  DefinedBetterAuthUserOptions<UserOptions>,\n  \"changeEmail\"\n> & {\n  changeEmail: ResolvedBetterAuthChangeEmail<UserOptions>\n}\n\ntype VoyantBetterAuthPlugins = [\n  ReturnType<typeof apiKey>,\n  ReturnType<typeof emailOTP>,\n  ReturnType<typeof createLocalMemberAccessPlugin>,\n]\n\ntype ResolvedBetterAuthPlugins<Plugins extends BetterAuthPlugin[] | undefined> =\n  Plugins extends BetterAuthPlugin[]\n    ? [...VoyantBetterAuthPlugins, ...Plugins]\n    : VoyantBetterAuthPlugins\n\nconst DEFAULT_SIGNUP_BLOCK_SURFACES = [\"admin\"] as const\nconst CUSTOMER_SIGNUP_ENDPOINT_SUFFIXES = [\n  \"/sign-up/email\",\n  \"/phone-number/verify\",\n  \"/sign-in/email-otp\",\n] as const\n\nexport interface DisableSignupWhenUsersExistOptions {\n  /**\n   * Set to false when the consuming app owns all signup admission checks.\n   *\n   * Defaults to true.\n   */\n  enabled?: boolean\n  /**\n   * User surfaces that should keep the single-tenant signup guard. New users\n   * with only other explicit surfaces can still be created by customer-facing\n   * auth plugins such as phone OTP.\n   *\n   * Defaults to [\"admin\"]. Users without an explicit surfaces array are\n   * treated as admin users for backward compatibility.\n   */\n  surfaces?: readonly string[]\n}\n\ntype BetterAuthCreateBeforeResult =\n  | boolean\n  | undefined\n  | {\n      data: Record<string, unknown>\n    }\n\ntype SignupBlockUserPayload = {\n  surfaces?: unknown\n}\n\ntype BetterAuthHookContext = {\n  path?: string\n}\n\nfunction normalizeSignupBlockSurfaces(\n  options: DisableSignupWhenUsersExistOptions | undefined,\n): readonly string[] {\n  return options?.surfaces ?? DEFAULT_SIGNUP_BLOCK_SURFACES\n}\n\nfunction isSignupBlockEnabled(options: DisableSignupWhenUsersExistOptions | undefined): boolean {\n  return options?.enabled !== false\n}\n\nfunction normalizeSurfaceList(surfaces: readonly string[] | undefined): readonly string[] {\n  if (!surfaces) return []\n\n  const normalized = new Set<string>()\n  for (const surface of surfaces) {\n    const trimmed = surface.trim()\n    if (trimmed.length > 0) {\n      normalized.add(trimmed)\n    }\n  }\n  return Array.from(normalized)\n}\n\nfunction signupBlockAppliesToUser(\n  user: SignupBlockUserPayload | undefined,\n  blockedSurfaces: readonly string[],\n): boolean {\n  if (blockedSurfaces.length === 0) return false\n\n  const surfaces = user?.surfaces\n  if (Array.isArray(surfaces)) {\n    const explicitSurfaces = surfaces.filter(\n      (surface): surface is string => typeof surface === \"string\" && surface.trim().length > 0,\n    )\n    if (explicitSurfaces.length > 0) {\n      return explicitSurfaces.some((surface) => blockedSurfaces.includes(surface.trim()))\n    }\n  }\n\n  if (typeof surfaces === \"string\" && surfaces.trim().length > 0) {\n    return blockedSurfaces.includes(surfaces.trim())\n  }\n\n  return blockedSurfaces.includes(\"admin\")\n}\n\nfunction isCustomerSignupCreate(context: BetterAuthHookContext | null | undefined): boolean {\n  const path = context?.path\n  if (!path) return false\n\n  return CUSTOMER_SIGNUP_ENDPOINT_SUFFIXES.some((suffix) => path.endsWith(suffix))\n}\n\nfunction stampCustomerSignupSurfaces(\n  user: SignupBlockUserPayload | undefined,\n  context: BetterAuthHookContext | null | undefined,\n  surfaces: readonly string[],\n): SignupBlockUserPayload | undefined {\n  if (surfaces.length === 0 || !isCustomerSignupCreate(context)) {\n    return user\n  }\n\n  return {\n    ...(user ?? {}),\n    surfaces,\n  }\n}\n\ntype ResolvedCreateBetterAuthOptions<\n  UserOptions extends BetterAuthOptions[\"user\"],\n  Plugins extends BetterAuthPlugin[] | undefined,\n> = Omit<BetterAuthOptions, \"plugins\" | \"user\"> & {\n  plugins: ResolvedBetterAuthPlugins<Plugins>\n  user: ResolvedBetterAuthUserOptions<UserOptions>\n}\n\nexport type BetterAuthDrizzleSchema = Record<string, AnyPgTable>\n\nexport interface CreateBetterAuthOptions<\n  UserOptions extends BetterAuthOptions[\"user\"] = BetterAuthOptions[\"user\"],\n  Plugins extends BetterAuthPlugin[] | undefined = BetterAuthPlugin[] | undefined,\n> {\n  db?: ReturnType<typeof getDb>\n  secret?: string\n  baseURL?: string\n  basePath?: string\n  trustedOrigins?: string[]\n  /**\n   * Additional Drizzle tables for Better Auth plugins. The consuming app owns\n   * matching migrations for every table passed here.\n   */\n  extraSchema?: BetterAuthDrizzleSchema\n  plugins?: Plugins\n  user?: UserOptions\n  /**\n   * Surfaces stamped on Better Auth customer self-signups before the bundled\n   * single-tenant signup guard evaluates the new user. Applies to Better\n   * Auth OTP signup endpoints that create a user as part of verification.\n   *\n   * Leave undefined to preserve Better Auth's raw user payload.\n   */\n  customerSignupSurfaces?: readonly string[]\n  disableSignupWhenUsersExist?: DisableSignupWhenUsersExistOptions\n  /** Called when a user requests a password reset. If not provided, logs to console. */\n  sendResetPassword?: (data: {\n    user: { email: string; name: string }\n    url: string\n    token: string\n  }) => Promise<void>\n  /** Called to send a verification OTP. If not provided, logs to console. */\n  sendVerificationOTP?: (data: { email: string; otp: string; type: string }) => Promise<void>\n  /**\n   * Better Auth session cookie cache: session data rides in a short-lived\n   * signed cookie. Enabled by default with a 5-minute TTL. Voyant still\n   * validates local membership and session existence against Postgres so a\n   * deleted session cannot be revived from the cookie cache. Pass `false` to\n   * disable payload caching, or tune `maxAge` (seconds).\n   */\n  sessionCookieCache?: false | { maxAge?: number }\n  /** Better Auth secondary storage, typically Redis/KV, used for distributed rate limits. */\n  secondaryStorage?: BetterAuthOptions[\"secondaryStorage\"]\n  /** Better Auth rate-limit config. Defaults to secondary storage when present. */\n  rateLimit?: BetterAuthOptions[\"rateLimit\"]\n  /**\n   * Additional Better Auth advanced options. Voyant supplies secure cookies\n   * by default except in explicit local development. Set\n   * `advanced.useSecureCookies` to override that default.\n   */\n  advanced?: BetterAuthOptions[\"advanced\"]\n}\n\n/**\n * Framework-agnostic Better Auth factory.\n *\n * Accepts optional overrides for db, secret, baseURL, trustedOrigins.\n * Does NOT depend on Next.js — safe to use in Hono workers, TanStack Start, etc.\n */\nexport function createBetterAuth<\n  const UserOptions extends BetterAuthOptions[\"user\"] = undefined,\n  const Plugins extends BetterAuthPlugin[] | undefined = undefined,\n>(options: CreateBetterAuthOptions<UserOptions, Plugins> = {}) {\n  const db = options.db ?? getDb(\"edge\")\n  const secret = options.secret ?? getAuthSecret()\n  const baseURL =\n    options.baseURL ??\n    process.env.BETTER_AUTH_URL ??\n    process.env.APP_URL ??\n    process.env.NEXT_PUBLIC_APP_URL ??\n    \"http://localhost:3000\"\n  const trustedOrigins = expandTrustedOrigins(\n    options.trustedOrigins ?? getTrustedOrigins(),\n    baseURL,\n  )\n  const extraPlugins = options.plugins ?? []\n  const signupBlockSurfaces = normalizeSignupBlockSurfaces(options.disableSignupWhenUsersExist)\n  const signupBlockEnabled = isSignupBlockEnabled(options.disableSignupWhenUsersExist)\n  const customerSignupSurfaces = normalizeSurfaceList(options.customerSignupSurfaces)\n  const schema = {\n    user: authUser,\n    session: authSession,\n    account: authAccount,\n    verification: authVerification,\n    apikey: apikeyTable,\n    ...(options.extraSchema ?? {}),\n  } satisfies BetterAuthDrizzleSchema\n  const rateLimit =\n    options.rateLimit ??\n    (options.secondaryStorage\n      ? ({\n          enabled: true,\n          window: 60,\n          max: 100,\n          storage: \"secondary-storage\",\n        } as BetterAuthOptions[\"rateLimit\"])\n      : undefined)\n\n  const authOptions = {\n    appName: \"Voyant\",\n    baseURL,\n    ...(options.basePath ? { basePath: options.basePath } : {}),\n    secret,\n    database: drizzleAdapter(db, {\n      provider: \"pg\",\n      schema,\n    }),\n    ...(options.secondaryStorage ? { secondaryStorage: options.secondaryStorage } : {}),\n    ...(rateLimit ? { rateLimit } : {}),\n    ...(options.sessionCookieCache === false\n      ? {}\n      : {\n          session: {\n            cookieCache: {\n              enabled: true,\n              maxAge: options.sessionCookieCache?.maxAge ?? 300,\n            },\n          },\n        }),\n    emailAndPassword: {\n      enabled: true,\n      minPasswordLength: 8,\n      maxPasswordLength: 128,\n      requireEmailVerification: true,\n      revokeSessionsOnPasswordReset: true,\n      // eslint-disable-next-line @typescript-eslint/require-await -- owner: auth; existing suppression is intentional pending typed cleanup.\n      sendResetPassword:\n        options.sendResetPassword ??\n        (async ({ user, url }) => {\n          console.warn(\n            `[Auth] No email provider configured — password reset for ${user.email}: ${url}`,\n          )\n        }),\n    },\n    emailVerification: {\n      sendOnSignUp: false, // OTP plugin handles this\n      autoSignInAfterVerification: true,\n    },\n    user: {\n      ...options.user,\n      changeEmail: {\n        enabled: true,\n        ...options.user?.changeEmail,\n      },\n    } as ResolvedBetterAuthUserOptions<UserOptions>,\n    socialProviders: {\n      google: {\n        clientId: process.env.GOOGLE_CLIENT_ID || \"\",\n        clientSecret: process.env.GOOGLE_CLIENT_SECRET || \"\",\n        enabled: Boolean(process.env.GOOGLE_CLIENT_ID && process.env.GOOGLE_CLIENT_SECRET),\n      },\n    },\n    trustedOrigins,\n    plugins: [\n      apiKey({\n        defaultPrefix: \"voy_\",\n        apiKeyHeaders: [\"authorization\"],\n        requireName: true,\n        keyExpiration: {\n          defaultExpiresIn: null,\n        },\n      }),\n      emailOTP({\n        // eslint-disable-next-line @typescript-eslint/require-await -- owner: auth; existing suppression is intentional pending typed cleanup.\n        sendVerificationOTP:\n          options.sendVerificationOTP ??\n          (async ({ email, otp, type }) => {\n            console.warn(`[Auth] OTP for ${email}: ${otp} (${type})`)\n          }),\n        otpLength: 6,\n        expiresIn: 600,\n        sendVerificationOnSignUp: true,\n        changeEmail: {\n          enabled: true,\n        },\n      }),\n      createLocalMemberAccessPlugin({\n        isEmailDeactivated: (email) => isLocalMemberEmailDeactivated(db, email),\n        isSessionActive: (sessionId, userId) => isLocalMemberSessionActive(db, sessionId, userId),\n        isUserDeactivated: (userId) => isLocalMemberDeactivated(db, userId),\n      }),\n      ...extraPlugins,\n    ] as ResolvedBetterAuthPlugins<Plugins>,\n    databaseHooks: {\n      user: {\n        create: {\n          // Single-tenant: once a user exists, reject any new-user creation.\n          // Covers email sign-up AND social-provider sign-up (Google would\n          // otherwise auto-create a user on first OAuth callback). Existing\n          // social sign-ins still work because this hook only fires on CREATE.\n          // Seed scripts do raw drizzle inserts, so they bypass this hook —\n          // which is intentional.\n          before: async (user, context): Promise<BetterAuthCreateBeforeResult> => {\n            const normalizedUser = stampCustomerSignupSurfaces(\n              user as SignupBlockUserPayload,\n              context as BetterAuthHookContext | null,\n              customerSignupSurfaces,\n            )\n\n            if (\n              !signupBlockEnabled ||\n              !signupBlockAppliesToUser(normalizedUser, signupBlockSurfaces)\n            ) {\n              if (normalizedUser === user) {\n                return\n              }\n              return { data: normalizedUser as Record<string, unknown> }\n            }\n\n            const [row] = await db.select({ count: sql<number>`count(*)::int` }).from(authUser)\n            if ((row?.count ?? 0) > 0) {\n              throw new Error(\"Sign-up is disabled. Ask an admin to invite you.\")\n            }\n\n            if (normalizedUser !== user) {\n              return { data: normalizedUser as Record<string, unknown> }\n            }\n          },\n          after: async (user, context) => {\n            if (\n              customerSignupSurfaces.length > 0 &&\n              isCustomerSignupCreate(context as BetterAuthHookContext | null)\n            ) {\n              return\n            }\n\n            // Single-tenant bootstrap: the very first user to register becomes\n            // the super-admin. Runs atomically after the `user` row is\n            // inserted, so a simple COUNT(*) = 1 check identifies them.\n            await provisionCurrentUserProfile(db, {\n              userId: user.id,\n              name: user.name,\n              image: user.image,\n              isSuperAdmin: await isFirstAuthUser(db),\n            })\n          },\n        },\n      },\n    },\n    advanced: {\n      ...options.advanced,\n      useSecureCookies:\n        options.advanced?.useSecureCookies ?? process.env.NODE_ENV !== \"development\",\n    },\n  } as ResolvedCreateBetterAuthOptions<UserOptions, Plugins>\n\n  return betterAuth<ResolvedCreateBetterAuthOptions<UserOptions, Plugins>>(authOptions)\n}\n"]}

package/dist/team-management-cloud-adapter.d.ts

@@ -0,0 +1,7 @@
+import { type CloudAdminInvitation, type CloudAdminMember } from "./cloud-broker.js";
+import type { IdentityAccessRuntimeProvider } from "./identity-access-runtime-port.js";
+import { type TeamManagementAdapter } from "./team-management-policy.js";
+import type { TeamInvitationDto, TeamMemberDto } from "./team-management-runtime-port.js";
+export declare function cloudTeamMemberDto(member: CloudAdminMember): TeamMemberDto;
+export declare function cloudTeamInvitationDto(invitation: CloudAdminInvitation): TeamInvitationDto;
+export declare function createCloudTeamManagementAdapter(identityAccess: IdentityAccessRuntimeProvider): TeamManagementAdapter;

package/dist/team-management-cloud-adapter.js

@@ -0,0 +1,146 @@
+import { cloudAuthUserLinks } from "@voyant-travel/db/schema/iam";
+import { eq } from "drizzle-orm";
+import { inviteCloudAdminMember, listCloudAdminInvitations, listCloudAdminMemberRoles, listCloudAdminMembers, revokeCloudAdminInvitation, setCloudAdminMemberAccess, setCloudAdminMemberRole, } from "./cloud-broker.js";
+import { TeamManagementError } from "./team-management-policy.js";
+function roleLevel(roleId) {
+    switch (roleId.trim().toLowerCase()) {
+        case "owner":
+            return 40;
+        case "admin":
+            return 30;
+        case "editor":
+        case "member":
+            return 20;
+        case "viewer":
+        case "guest":
+            return 10;
+        default:
+            return 0;
+    }
+}
+export function cloudTeamMemberDto(member) {
+    const roleId = member.roleSlug ?? "member";
+    return {
+        id: member.membershipId,
+        email: member.email,
+        name: member.name ?? null,
+        roleId,
+        roleName: member.roleName ?? roleId,
+        status: member.hasDeploymentAccess && member.status.toLowerCase() === "active"
+            ? "active"
+            : "deactivated",
+        joinedAt: member.createdAt ?? null,
+        lastActivityAt: member.lastActivityAt ?? null,
+    };
+}
+export function cloudTeamInvitationDto(invitation) {
+    const roleId = invitation.roleSlug ?? "member";
+    return {
+        id: invitation.id,
+        email: invitation.email,
+        roleId,
+        roleName: invitation.roleName ?? roleId,
+        status: invitation.state,
+        createdAt: invitation.createdAt,
+        expiresAt: invitation.expiresAt,
+    };
+}
+function createdInvitationDto(invitation) {
+    return {
+        ...cloudTeamInvitationDto(invitation),
+        acceptUrl: invitation.acceptInvitationUrl || null,
+    };
+}
+async function resolveCloudRequest(identityAccess, context) {
+    const deployment = identityAccess.resolveDeployment(context.bindings);
+    if (!deployment.cloudAdminMembers) {
+        throw new TeamManagementError("not_configured", "Voyant Cloud team management is not configured.", 501);
+    }
+    const [link] = await context.db
+        .select({ providerAccountId: cloudAuthUserLinks.providerAccountId })
+        .from(cloudAuthUserLinks)
+        .where(eq(cloudAuthUserLinks.userId, context.userId))
+        .limit(1);
+    if (!link?.providerAccountId) {
+        throw new TeamManagementError("forbidden", "No Cloud identity is linked to this session.");
+    }
+    return {
+        config: deployment.cloudAdminMembers,
+        actingWorkosUserId: link.providerAccountId,
+        actingExternalUserId: link.providerAccountId,
+    };
+}
+export function createCloudTeamManagementAdapter(identityAccess) {
+    return {
+        async getActor(context) {
+            const request = await resolveCloudRequest(identityAccess, context);
+            const actor = (await listCloudAdminMembers(request)).find((member) => member.externalUserId === request.actingExternalUserId);
+            if (!actor?.hasDeploymentAccess) {
+                throw new TeamManagementError("forbidden", "The current user cannot manage this team.");
+            }
+            return { memberId: actor.membershipId, roleId: actor.roleSlug ?? "member" };
+        },
+        async getCapabilities(_context, actor) {
+            const canManage = actor.roleId === "owner" || actor.roleId === "admin";
+            return {
+                viewRoster: true,
+                inviteMembers: canManage,
+                manageRoles: canManage,
+                activateMembers: canManage,
+                deactivateMembers: canManage,
+                revokeInvitations: canManage,
+            };
+        },
+        async listMembers(context) {
+            return (await listCloudAdminMembers(await resolveCloudRequest(identityAccess, context))).map(cloudTeamMemberDto);
+        },
+        async listRoles(context) {
+            return (await listCloudAdminMemberRoles(await resolveCloudRequest(identityAccess, context))).map((role) => ({ id: role.slug, name: role.name, description: role.description }));
+        },
+        async listInvitations(context) {
+            return (await listCloudAdminInvitations(await resolveCloudRequest(identityAccess, context))).map(cloudTeamInvitationDto);
+        },
+        async inviteMember(context, input) {
+            return createdInvitationDto(await inviteCloudAdminMember({
+                ...(await resolveCloudRequest(identityAccess, context)),
+                input: {
+                    email: input.email,
+                    roleSlug: input.roleId,
+                    expiresInDays: input.expiresInDays,
+                },
+            }));
+        },
+        async revokeInvitation(context, invitationId) {
+            await revokeCloudAdminInvitation({
+                ...(await resolveCloudRequest(identityAccess, context)),
+                invitationId,
+            });
+        },
+        async updateMemberRole(context, memberId, roleId) {
+            return cloudTeamMemberDto(await setCloudAdminMemberRole({
+                ...(await resolveCloudRequest(identityAccess, context)),
+                membershipId: memberId,
+                roleSlug: roleId,
+            }));
+        },
+        async deactivateMember(context, memberId) {
+            return cloudTeamMemberDto(await setCloudAdminMemberAccess({
+                ...(await resolveCloudRequest(identityAccess, context)),
+                membershipId: memberId,
+                hasAccess: false,
+            }));
+        },
+        async activateMember(context, memberId) {
+            return cloudTeamMemberDto(await setCloudAdminMemberAccess({
+                ...(await resolveCloudRequest(identityAccess, context)),
+                membershipId: memberId,
+                hasAccess: true,
+            }));
+        },
+        roleLevel,
+        isOwnerRole(roleId) {
+            return roleId === "owner";
+        },
+    };
+}
+//# sourceMappingURL=team-management-cloud-adapter.js.map

package/dist/team-management-cloud-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"team-management-cloud-adapter.js","sourceRoot":"","sources":["../src/team-management-cloud-adapter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAA;AACjE,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAA;AAEhC,OAAO,EAIL,sBAAsB,EACtB,yBAAyB,EACzB,yBAAyB,EACzB,qBAAqB,EACrB,0BAA0B,EAC1B,yBAAyB,EACzB,uBAAuB,GACxB,MAAM,mBAAmB,CAAA;AAE1B,OAAO,EAA8B,mBAAmB,EAAE,MAAM,6BAA6B,CAAA;AAS7F,SAAS,SAAS,CAAC,MAAc;IAC/B,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;QACpC,KAAK,OAAO;YACV,OAAO,EAAE,CAAA;QACX,KAAK,OAAO;YACV,OAAO,EAAE,CAAA;QACX,KAAK,QAAQ,CAAC;QACd,KAAK,QAAQ;YACX,OAAO,EAAE,CAAA;QACX,KAAK,QAAQ,CAAC;QACd,KAAK,OAAO;YACV,OAAO,EAAE,CAAA;QACX;YACE,OAAO,CAAC,CAAA;IACZ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,MAAwB;IACzD,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,IAAI,QAAQ,CAAA;IAC1C,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,YAAY;QACvB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,IAAI;QACzB,MAAM;QACN,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,MAAM;QACnC,MAAM,EACJ,MAAM,CAAC,mBAAmB,IAAI,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,QAAQ;YACpE,CAAC,CAAC,QAAQ;YACV,CAAC,CAAC,aAAa;QACnB,QAAQ,EAAE,MAAM,CAAC,SAAS,IAAI,IAAI;QAClC,cAAc,EAAE,MAAM,CAAC,cAAc,IAAI,IAAI;KAC9C,CAAA;AACH,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,UAAgC;IACrE,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,IAAI,QAAQ,CAAA;IAC9C,OAAO;QACL,EAAE,EAAE,UAAU,CAAC,EAAE;QACjB,KAAK,EAAE,UAAU,CAAC,KAAK;QACvB,MAAM;QACN,QAAQ,EAAE,UAAU,CAAC,QAAQ,IAAI,MAAM;QACvC,MAAM,EAAE,UAAU,CAAC,KAAK;QACxB,SAAS,EAAE,UAAU,CAAC,SAAS;QAC/B,SAAS,EAAE,UAAU,CAAC,SAAS;KAChC,CAAA;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,UAAgC;IAC5D,OAAO;QACL,GAAG,sBAAsB,CAAC,UAAU,CAAC;QACrC,SAAS,EAAE,UAAU,CAAC,mBAAmB,IAAI,IAAI;KAClD,CAAA;AACH,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,cAA6C,EAC7C,OAAqC;IAErC,MAAM,UAAU,GAAG,cAAc,CAAC,iBAAiB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;IACrE,IAAI,CAAC,UAAU,CAAC,iBAAiB,EAAE,CAAC;QAClC,MAAM,IAAI,mBAAmB,CAC3B,gBAAgB,EAChB,iDAAiD,EACjD,GAAG,CACJ,CAAA;IACH,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,OAAO,CAAC,EAAE;SAC5B,MAAM,CAAC,EAAE,iBAAiB,EAAE,kBAAkB,CAAC,iBAAiB,EAAE,CAAC;SACnE,IAAI,CAAC,kBAAkB,CAAC;SACxB,KAAK,CAAC,EAAE,CAAC,kBAAkB,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;SACpD,KAAK,CAAC,CAAC,CAAC,CAAA;IACX,IAAI,CAAC,IAAI,EAAE,iBAAiB,EAAE,CAAC;QAC7B,MAAM,IAAI,mBAAmB,CAAC,WAAW,EAAE,8CAA8C,CAAC,CAAA;IAC5F,CAAC;IACD,OAAO;QACL,MAAM,EAAE,UAAU,CAAC,iBAAiB;QACpC,kBAAkB,EAAE,IAAI,CAAC,iBAAiB;QAC1C,oBAAoB,EAAE,IAAI,CAAC,iBAAiB;KAC7C,CAAA;AACH,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,cAA6C;IAE7C,OAAO;QACL,KAAK,CAAC,QAAQ,CAAC,OAAO;YACpB,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,cAAc,EAAE,OAAO,CAAC,CAAA;YAClE,MAAM,KAAK,GAAG,CAAC,MAAM,qBAAqB,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CACvD,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,cAAc,KAAK,OAAO,CAAC,oBAAoB,CACnE,CAAA;YACD,IAAI,CAAC,KAAK,EAAE,mBAAmB,EAAE,CAAC;gBAChC,MAAM,IAAI,mBAAmB,CAAC,WAAW,EAAE,2CAA2C,CAAC,CAAA;YACzF,CAAC;YACD,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,CAAC,QAAQ,IAAI,QAAQ,EAAE,CAAA;QAC7E,CAAC;QACD,KAAK,CAAC,eAAe,CAAC,QAAQ,EAAE,KAAK;YACnC,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,KAAK,OAAO,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO,CAAA;YACtE,OAAO;gBACL,UAAU,EAAE,IAAI;gBAChB,aAAa,EAAE,SAAS;gBACxB,WAAW,EAAE,SAAS;gBACtB,eAAe,EAAE,SAAS;gBAC1B,iBAAiB,EAAE,SAAS;gBAC5B,iBAAiB,EAAE,SAAS;aAC7B,CAAA;QACH,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,OAAO;YACvB,OAAO,CAAC,MAAM,qBAAqB,CAAC,MAAM,mBAAmB,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAC1F,kBAAkB,CACnB,CAAA;QACH,CAAC;QACD,KAAK,CAAC,SAAS,CAAC,OAAO;YACrB,OAAO,CACL,MAAM,yBAAyB,CAAC,MAAM,mBAAmB,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC,CACpF,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAA;QACtF,CAAC;QACD,KAAK,CAAC,eAAe,CAAC,OAAO;YAC3B,OAAO,CACL,MAAM,yBAAyB,CAAC,MAAM,mBAAmB,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC,CACpF,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAA;QAC/B,CAAC;QACD,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK;YAC/B,OAAO,oBAAoB,CACzB,MAAM,sBAAsB,CAAC;gBAC3B,GAAG,CAAC,MAAM,mBAAmB,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;gBACvD,KAAK,EAAE;oBACL,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,QAAQ,EAAE,KAAK,CAAC,MAAM;oBACtB,aAAa,EAAE,KAAK,CAAC,aAAa;iBACnC;aACF,CAAC,CACH,CAAA;QACH,CAAC;QACD,KAAK,CAAC,gBAAgB,CAAC,OAAO,EAAE,YAAY;YAC1C,MAAM,0BAA0B,CAAC;gBAC/B,GAAG,CAAC,MAAM,mBAAmB,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;gBACvD,YAAY;aACb,CAAC,CAAA;QACJ,CAAC;QACD,KAAK,CAAC,gBAAgB,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM;YAC9C,OAAO,kBAAkB,CACvB,MAAM,uBAAuB,CAAC;gBAC5B,GAAG,CAAC,MAAM,mBAAmB,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;gBACvD,YAAY,EAAE,QAAQ;gBACtB,QAAQ,EAAE,MAAM;aACjB,CAAC,CACH,CAAA;QACH,CAAC;QACD,KAAK,CAAC,gBAAgB,CAAC,OAAO,EAAE,QAAQ;YACtC,OAAO,kBAAkB,CACvB,MAAM,yBAAyB,CAAC;gBAC9B,GAAG,CAAC,MAAM,mBAAmB,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;gBACvD,YAAY,EAAE,QAAQ;gBACtB,SAAS,EAAE,KAAK;aACjB,CAAC,CACH,CAAA;QACH,CAAC;QACD,KAAK,CAAC,cAAc,CAAC,OAAO,EAAE,QAAQ;YACpC,OAAO,kBAAkB,CACvB,MAAM,yBAAyB,CAAC;gBAC9B,GAAG,CAAC,MAAM,mBAAmB,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;gBACvD,YAAY,EAAE,QAAQ;gBACtB,SAAS,EAAE,IAAI;aAChB,CAAC,CACH,CAAA;QACH,CAAC;QACD,SAAS;QACT,WAAW,CAAC,MAAM;YAChB,OAAO,MAAM,KAAK,OAAO,CAAA;QAC3B,CAAC;KACF,CAAA;AACH,CAAC","sourcesContent":["import { cloudAuthUserLinks } from \"@voyant-travel/db/schema/iam\"\nimport { eq } from \"drizzle-orm\"\n\nimport {\n  type CloudAdminInvitation,\n  type CloudAdminMember,\n  type CloudAdminMembersRequest,\n  inviteCloudAdminMember,\n  listCloudAdminInvitations,\n  listCloudAdminMemberRoles,\n  listCloudAdminMembers,\n  revokeCloudAdminInvitation,\n  setCloudAdminMemberAccess,\n  setCloudAdminMemberRole,\n} from \"./cloud-broker.js\"\nimport type { IdentityAccessRuntimeProvider } from \"./identity-access-runtime-port.js\"\nimport { type TeamManagementAdapter, TeamManagementError } from \"./team-management-policy.js\"\nimport type {\n  CreatedTeamInvitationDto,\n  TeamInvitationDto,\n  TeamManagementCapabilitiesDto,\n  TeamManagementRequestContext,\n  TeamMemberDto,\n} from \"./team-management-runtime-port.js\"\n\nfunction roleLevel(roleId: string): number {\n  switch (roleId.trim().toLowerCase()) {\n    case \"owner\":\n      return 40\n    case \"admin\":\n      return 30\n    case \"editor\":\n    case \"member\":\n      return 20\n    case \"viewer\":\n    case \"guest\":\n      return 10\n    default:\n      return 0\n  }\n}\n\nexport function cloudTeamMemberDto(member: CloudAdminMember): TeamMemberDto {\n  const roleId = member.roleSlug ?? \"member\"\n  return {\n    id: member.membershipId,\n    email: member.email,\n    name: member.name ?? null,\n    roleId,\n    roleName: member.roleName ?? roleId,\n    status:\n      member.hasDeploymentAccess && member.status.toLowerCase() === \"active\"\n        ? \"active\"\n        : \"deactivated\",\n    joinedAt: member.createdAt ?? null,\n    lastActivityAt: member.lastActivityAt ?? null,\n  }\n}\n\nexport function cloudTeamInvitationDto(invitation: CloudAdminInvitation): TeamInvitationDto {\n  const roleId = invitation.roleSlug ?? \"member\"\n  return {\n    id: invitation.id,\n    email: invitation.email,\n    roleId,\n    roleName: invitation.roleName ?? roleId,\n    status: invitation.state,\n    createdAt: invitation.createdAt,\n    expiresAt: invitation.expiresAt,\n  }\n}\n\nfunction createdInvitationDto(invitation: CloudAdminInvitation): CreatedTeamInvitationDto {\n  return {\n    ...cloudTeamInvitationDto(invitation),\n    acceptUrl: invitation.acceptInvitationUrl || null,\n  }\n}\n\nasync function resolveCloudRequest(\n  identityAccess: IdentityAccessRuntimeProvider,\n  context: TeamManagementRequestContext,\n): Promise<CloudAdminMembersRequest & { actingExternalUserId: string }> {\n  const deployment = identityAccess.resolveDeployment(context.bindings)\n  if (!deployment.cloudAdminMembers) {\n    throw new TeamManagementError(\n      \"not_configured\",\n      \"Voyant Cloud team management is not configured.\",\n      501,\n    )\n  }\n  const [link] = await context.db\n    .select({ providerAccountId: cloudAuthUserLinks.providerAccountId })\n    .from(cloudAuthUserLinks)\n    .where(eq(cloudAuthUserLinks.userId, context.userId))\n    .limit(1)\n  if (!link?.providerAccountId) {\n    throw new TeamManagementError(\"forbidden\", \"No Cloud identity is linked to this session.\")\n  }\n  return {\n    config: deployment.cloudAdminMembers,\n    actingWorkosUserId: link.providerAccountId,\n    actingExternalUserId: link.providerAccountId,\n  }\n}\n\nexport function createCloudTeamManagementAdapter(\n  identityAccess: IdentityAccessRuntimeProvider,\n): TeamManagementAdapter {\n  return {\n    async getActor(context) {\n      const request = await resolveCloudRequest(identityAccess, context)\n      const actor = (await listCloudAdminMembers(request)).find(\n        (member) => member.externalUserId === request.actingExternalUserId,\n      )\n      if (!actor?.hasDeploymentAccess) {\n        throw new TeamManagementError(\"forbidden\", \"The current user cannot manage this team.\")\n      }\n      return { memberId: actor.membershipId, roleId: actor.roleSlug ?? \"member\" }\n    },\n    async getCapabilities(_context, actor): Promise<TeamManagementCapabilitiesDto> {\n      const canManage = actor.roleId === \"owner\" || actor.roleId === \"admin\"\n      return {\n        viewRoster: true,\n        inviteMembers: canManage,\n        manageRoles: canManage,\n        activateMembers: canManage,\n        deactivateMembers: canManage,\n        revokeInvitations: canManage,\n      }\n    },\n    async listMembers(context) {\n      return (await listCloudAdminMembers(await resolveCloudRequest(identityAccess, context))).map(\n        cloudTeamMemberDto,\n      )\n    },\n    async listRoles(context) {\n      return (\n        await listCloudAdminMemberRoles(await resolveCloudRequest(identityAccess, context))\n      ).map((role) => ({ id: role.slug, name: role.name, description: role.description }))\n    },\n    async listInvitations(context) {\n      return (\n        await listCloudAdminInvitations(await resolveCloudRequest(identityAccess, context))\n      ).map(cloudTeamInvitationDto)\n    },\n    async inviteMember(context, input) {\n      return createdInvitationDto(\n        await inviteCloudAdminMember({\n          ...(await resolveCloudRequest(identityAccess, context)),\n          input: {\n            email: input.email,\n            roleSlug: input.roleId,\n            expiresInDays: input.expiresInDays,\n          },\n        }),\n      )\n    },\n    async revokeInvitation(context, invitationId) {\n      await revokeCloudAdminInvitation({\n        ...(await resolveCloudRequest(identityAccess, context)),\n        invitationId,\n      })\n    },\n    async updateMemberRole(context, memberId, roleId) {\n      return cloudTeamMemberDto(\n        await setCloudAdminMemberRole({\n          ...(await resolveCloudRequest(identityAccess, context)),\n          membershipId: memberId,\n          roleSlug: roleId,\n        }),\n      )\n    },\n    async deactivateMember(context, memberId) {\n      return cloudTeamMemberDto(\n        await setCloudAdminMemberAccess({\n          ...(await resolveCloudRequest(identityAccess, context)),\n          membershipId: memberId,\n          hasAccess: false,\n        }),\n      )\n    },\n    async activateMember(context, memberId) {\n      return cloudTeamMemberDto(\n        await setCloudAdminMemberAccess({\n          ...(await resolveCloudRequest(identityAccess, context)),\n          membershipId: memberId,\n          hasAccess: true,\n        }),\n      )\n    },\n    roleLevel,\n    isOwnerRole(roleId) {\n      return roleId === \"owner\"\n    },\n  }\n}\n"]}

package/dist/team-management-local-adapter.d.ts

@@ -0,0 +1,8 @@
+import type { IdentityAccessRuntimeProvider } from "./identity-access-runtime-port.js";
+import { type TeamManagementAdapter } from "./team-management-policy.js";
+export { localProviderIdForStatus } from "./local-member-access.js";
+export declare function createLocalTeamManagementAdapter(identityAccess: IdentityAccessRuntimeProvider): TeamManagementAdapter;
+export declare function localRoleForRedeemedInvitation(metadata: Record<string, unknown> | null): {
+    isSuperAdmin: boolean;
+    permissions: string[];
+};

package/dist/team-management-local-adapter.js

@@ -0,0 +1,285 @@
+import { newId } from "@voyant-travel/db/lib/typeid";
+import { apikeyTable, authAccount, authSession, authUser, userInvitationsTable, userProfilesTable, } from "@voyant-travel/db/schema/iam";
+import { scopesForRole } from "@voyant-travel/types/member-roles";
+import { desc, eq, sql } from "drizzle-orm";
+import { isDeactivatedProviderId, localProviderIdForStatus } from "./local-member-access.js";
+import { TeamManagementError } from "./team-management-policy.js";
+const LOCAL_ROLES = [
+    { id: "owner", name: "Owner", description: "Full access, including ownership changes." },
+    { id: "admin", name: "Admin", description: "Full access to team and operator settings." },
+    { id: "editor", name: "Editor", description: "Can manage day-to-day operator data." },
+    { id: "viewer", name: "Viewer", description: "Read-only operator access." },
+];
+const ROLE_LEVELS = { owner: 40, admin: 30, editor: 20, viewer: 10 };
+export { localProviderIdForStatus } from "./local-member-access.js";
+function roleName(roleId) {
+    return LOCAL_ROLES.find((role) => role.id === roleId)?.name ?? roleId;
+}
+function sameScopes(left, right) {
+    return [...left].sort().join("\0") === [...right].sort().join("\0");
+}
+function resolveLocalRole(isSuperAdmin, permissions) {
+    if (isSuperAdmin)
+        return "owner";
+    if (permissions === null || permissions.includes("*"))
+        return "admin";
+    if (sameScopes(permissions, scopesForRole("editor") ?? []))
+        return "editor";
+    if (sameScopes(permissions, scopesForRole("viewer") ?? []))
+        return "viewer";
+    return "custom";
+}
+function permissionsForRole(roleId) {
+    const scopes = scopesForRole(roleId);
+    if (!scopes)
+        throw new TeamManagementError("role_not_found", "Team role not found.", 404);
+    return [...scopes];
+}
+function invitationRole(metadata) {
+    const roleId = metadata?.roleId;
+    return typeof roleId === "string" && ROLE_LEVELS[roleId] !== undefined ? roleId : "editor";
+}
+function invitationStatus(input) {
+    if (input.redeemedAt)
+        return "accepted";
+    if (input.expiresAt.getTime() <= Date.now())
+        return "expired";
+    return "pending";
+}
+function randomTokenBase64Url(bytes) {
+    const buffer = new Uint8Array(bytes);
+    crypto.getRandomValues(buffer);
+    let binary = "";
+    for (const byte of buffer)
+        binary += String.fromCharCode(byte);
+    return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+async function sha256Hex(input) {
+    const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(input));
+    return Array.from(new Uint8Array(digest))
+        .map((byte) => byte.toString(16).padStart(2, "0"))
+        .join("");
+}
+async function listLocalMembers(context) {
+    const [rows, accounts] = await Promise.all([
+        context.db
+            .select({
+            id: authUser.id,
+            email: authUser.email,
+            authName: authUser.name,
+            createdAt: authUser.createdAt,
+            firstName: userProfilesTable.firstName,
+            lastName: userProfilesTable.lastName,
+            isSuperAdmin: userProfilesTable.isSuperAdmin,
+            permissions: userProfilesTable.permissions,
+            lastActiveAt: userProfilesTable.lastActiveAt,
+        })
+            .from(authUser)
+            .leftJoin(userProfilesTable, eq(userProfilesTable.id, authUser.id)),
+        context.db
+            .select({ userId: authAccount.userId, providerId: authAccount.providerId })
+            .from(authAccount),
+    ]);
+    const activeUserIds = new Set(accounts
+        .filter((account) => !isDeactivatedProviderId(account.providerId))
+        .map((account) => account.userId));
+    return rows.map((row) => {
+        const roleId = resolveLocalRole(row.isSuperAdmin ?? false, row.permissions ?? null);
+        const profileName = [row.firstName, row.lastName].filter(Boolean).join(" ").trim();
+        return {
+            id: row.id,
+            email: row.email,
+            name: profileName || row.authName || null,
+            roleId,
+            roleName: roleName(roleId),
+            status: activeUserIds.has(row.id) ? "active" : "deactivated",
+            joinedAt: row.createdAt?.toISOString() ?? null,
+            lastActivityAt: row.lastActiveAt?.toISOString() ?? null,
+        };
+    });
+}
+function memberOrThrow(members, memberId) {
+    const member = members.find((candidate) => candidate.id === memberId);
+    if (!member)
+        throw new TeamManagementError("member_not_found", "Team member not found.", 404);
+    return member;
+}
+function assertActiveOwnerRemains(members, target) {
+    if (target.status !== "active" || target.roleId !== "owner")
+        return;
+    const activeOwnerCount = members.filter((member) => member.status === "active" && member.roleId === "owner").length;
+    if (activeOwnerCount <= 1) {
+        throw new TeamManagementError("last_owner", "The last active owner cannot be demoted or deactivated.", 409);
+    }
+}
+async function withLockedLocalTeam(context, operation) {
+    return context.db.transaction(async (transaction) => {
+        // agent-quality: raw-sql reviewed -- owner: auth; table identifiers are static Drizzle schema objects.
+        await transaction.execute(sql `SELECT ${authUser.id} FROM ${authUser} ORDER BY ${authUser.id} FOR UPDATE`);
+        return operation({ ...context, db: transaction });
+    });
+}
+export function createLocalTeamManagementAdapter(identityAccess) {
+    return {
+        async getActor(context) {
+            const actor = (await listLocalMembers(context)).find((member) => member.id === context.userId);
+            if (actor?.status !== "active") {
+                throw new TeamManagementError("forbidden", "The current user cannot manage this team.");
+            }
+            return { memberId: actor.id, roleId: actor.roleId };
+        },
+        async getCapabilities(_context, actor) {
+            const canManage = actor.roleId === "owner" || actor.roleId === "admin";
+            return {
+                viewRoster: true,
+                inviteMembers: canManage,
+                manageRoles: canManage,
+                activateMembers: canManage,
+                deactivateMembers: canManage,
+                revokeInvitations: canManage,
+            };
+        },
+        listMembers: listLocalMembers,
+        async listRoles() {
+            return LOCAL_ROLES;
+        },
+        async listInvitations(context) {
+            const rows = await context.db
+                .select({
+                id: userInvitationsTable.id,
+                email: userInvitationsTable.email,
+                metadata: userInvitationsTable.metadata,
+                expiresAt: userInvitationsTable.expiresAt,
+                redeemedAt: userInvitationsTable.redeemedAt,
+                createdAt: userInvitationsTable.createdAt,
+            })
+                .from(userInvitationsTable)
+                .orderBy(desc(userInvitationsTable.createdAt))
+                .limit(100);
+            return rows.map((row) => {
+                const roleId = invitationRole(row.metadata);
+                return {
+                    id: row.id,
+                    email: row.email,
+                    roleId,
+                    roleName: roleName(roleId),
+                    status: invitationStatus(row),
+                    createdAt: row.createdAt.toISOString(),
+                    expiresAt: row.expiresAt.toISOString(),
+                };
+            });
+        },
+        async inviteMember(context, input) {
+            const email = input.email.trim().toLowerCase();
+            const [existingUser] = await context.db
+                .select({ id: authUser.id })
+                .from(authUser)
+                .where(eq(authUser.email, email))
+                .limit(1);
+            if (existingUser) {
+                throw new TeamManagementError("forbidden", "A team member with this email already exists.", 409);
+            }
+            const rawToken = randomTokenBase64Url(32);
+            const expiresInDays = input.expiresInDays ?? 3;
+            const expiresAt = new Date(Date.now() + expiresInDays * 86_400_000);
+            const now = new Date();
+            const id = newId("user_invitations");
+            await context.db.insert(userInvitationsTable).values({
+                id,
+                email,
+                tokenHash: await sha256Hex(rawToken),
+                expiresAt,
+                createdBy: context.userId,
+                metadata: { roleId: input.roleId },
+                createdAt: now,
+            });
+            const { appUrl } = identityAccess.resolveDeployment(context.bindings);
+            const acceptUrl = `${appUrl}/accept-invite?token=${encodeURIComponent(rawToken)}`;
+            await identityAccess.sendInvitationEmail(context.bindings, {
+                acceptUrl,
+                expiresInHours: expiresInDays * 24,
+                to: email,
+            });
+            return {
+                id,
+                email,
+                roleId: input.roleId,
+                roleName: roleName(input.roleId),
+                status: "pending",
+                createdAt: now.toISOString(),
+                expiresAt: expiresAt.toISOString(),
+                acceptUrl,
+            };
+        },
+        async revokeInvitation(context, invitationId) {
+            await context.db.delete(userInvitationsTable).where(eq(userInvitationsTable.id, invitationId));
+        },
+        async updateMemberRole(context, memberId, roleId) {
+            return withLockedLocalTeam(context, async (transactionContext) => {
+                const members = await listLocalMembers(transactionContext);
+                const target = memberOrThrow(members, memberId);
+                if (roleId !== "owner")
+                    assertActiveOwnerRemains(members, target);
+                await transactionContext.db
+                    .update(userProfilesTable)
+                    .set({
+                    isSuperAdmin: roleId === "owner",
+                    permissions: permissionsForRole(roleId),
+                    updatedAt: new Date(),
+                })
+                    .where(eq(userProfilesTable.id, memberId));
+                return memberOrThrow(await listLocalMembers(transactionContext), memberId);
+            });
+        },
+        async deactivateMember(context, memberId) {
+            return withLockedLocalTeam(context, async (transactionContext) => {
+                const members = await listLocalMembers(transactionContext);
+                assertActiveOwnerRemains(members, memberOrThrow(members, memberId));
+                await transactionContext.db.delete(authSession).where(eq(authSession.userId, memberId));
+                await transactionContext.db.delete(apikeyTable).where(eq(apikeyTable.referenceId, memberId));
+                const accounts = await transactionContext.db
+                    .select({ id: authAccount.id, providerId: authAccount.providerId })
+                    .from(authAccount)
+                    .where(eq(authAccount.userId, memberId));
+                for (const account of accounts) {
+                    await transactionContext.db
+                        .update(authAccount)
+                        .set({ providerId: localProviderIdForStatus(account.providerId, "deactivated") })
+                        .where(eq(authAccount.id, account.id));
+                }
+                return memberOrThrow(await listLocalMembers(transactionContext), memberId);
+            });
+        },
+        async activateMember(context, memberId) {
+            return withLockedLocalTeam(context, async (transactionContext) => {
+                memberOrThrow(await listLocalMembers(transactionContext), memberId);
+                const accounts = await transactionContext.db
+                    .select({ id: authAccount.id, providerId: authAccount.providerId })
+                    .from(authAccount)
+                    .where(eq(authAccount.userId, memberId));
+                for (const account of accounts) {
+                    await transactionContext.db
+                        .update(authAccount)
+                        .set({ providerId: localProviderIdForStatus(account.providerId, "active") })
+                        .where(eq(authAccount.id, account.id));
+                }
+                const member = memberOrThrow(await listLocalMembers(transactionContext), memberId);
+                if (member.status !== "active") {
+                    throw new TeamManagementError("activation_unavailable", "This local member has no sign-in account to reactivate.", 409);
+                }
+                return member;
+            });
+        },
+        roleLevel(roleId) {
+            return ROLE_LEVELS[roleId] ?? 0;
+        },
+        isOwnerRole(roleId) {
+            return roleId === "owner";
+        },
+    };
+}
+export function localRoleForRedeemedInvitation(metadata) {
+    const roleId = invitationRole(metadata);
+    return { isSuperAdmin: roleId === "owner", permissions: permissionsForRole(roleId) };
+}
+//# sourceMappingURL=team-management-local-adapter.js.map