@voyant-travel/auth 0.135.1 → 0.136.0

package/dist/auth-realms.d.ts

@@ -11,10 +11,40 @@ export interface AdminPrincipal extends PrincipalBase {
     actor: "staff";
     scopes: readonly string[];
 }
-export interface CustomerPrincipal extends PrincipalBase {
+interface CustomerPrincipalBase extends PrincipalBase {
     realm: "customer";
     actor: "customer";
+    buyerAccountId: string;
 }
+export interface CustomerIdentityPrincipal extends PrincipalBase {
+    realm: "customer";
+    actor: "customer";
+    buyerAccountId: null;
+    buyerAccountKind: null;
+    authOrganizationId: null;
+    relationshipOrganizationId: null;
+    relationshipPersonId: string | null;
+    membershipId: null;
+    membershipRole: null;
+}
+export interface PersonalCustomerPrincipal extends CustomerPrincipalBase {
+    buyerAccountKind: "personal";
+    authOrganizationId: null;
+    relationshipOrganizationId: null;
+    relationshipPersonId: string | null;
+    membershipId: null;
+    membershipRole: null;
+}
+export interface BusinessCustomerPrincipal extends CustomerPrincipalBase {
+    buyerAccountKind: "business";
+    authOrganizationId: string;
+    relationshipOrganizationId: string;
+    /** Identity Person remains independent from the selected business buyer. */
+    relationshipPersonId: string | null;
+    membershipId: string;
+    membershipRole: string;
+}
+export type CustomerPrincipal = CustomerIdentityPrincipal | PersonalCustomerPrincipal | BusinessCustomerPrincipal;
 export type AuthPrincipal = AdminPrincipal | CustomerPrincipal;
 /** Complete session replacement seam for advanced self-host integrations. */
 export interface AuthRealmSessionPort<Context = unknown> {

package/dist/auth-realms.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-realms.js","sourceRoot":"","sources":["../src/auth-realms.ts"],"names":[],"mappings":"AAsDA,MAAM,UAAU,oCAAoC,CAClD,eAAwD,EACxD,gBAAmD;IAEnD,OAAO;QACL,EAAE,EAAE,eAAe,CAAC,EAAE;QACtB,KAAK,CAAC,YAAY,CAAC,KAAY,EAAE,OAAgB;YAC/C,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;YAC9D,IAAI,eAAe,CAAC,UAAU,IAAI,CAAC,CAAC,MAAM,eAAe,CAAC,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;gBACzF,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sCAAsC,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;YAC1F,CAAC;YACD,OAAO,gBAAgB,CAAC,aAAa,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;QAC1D,CAAC;KACF,CAAA;AACH,CAAC","sourcesContent":["/** Provider-neutral identities crossing the auth/runtime boundary. */\nexport type AuthRealm = \"admin\" | \"customer\"\n\ninterface PrincipalBase {\n  realm: AuthRealm\n  userId: string\n  sessionId: string\n  email: string | null\n}\n\nexport interface AdminPrincipal extends PrincipalBase {\n  realm: \"admin\"\n  actor: \"staff\"\n  scopes: readonly string[]\n}\n\nexport interface CustomerPrincipal extends PrincipalBase {\n  realm: \"customer\"\n  actor: \"customer\"\n}\n\nexport type AuthPrincipal = AdminPrincipal | CustomerPrincipal\n\n/** Complete session replacement seam for advanced self-host integrations. */\nexport interface AuthRealmSessionPort<Context = unknown> {\n  readonly realm: AuthRealm\n  resolve(request: Request, context: Context): Promise<AuthPrincipal | null>\n  signOut(request: Request, context: Context): Promise<Response>\n  revokeUserSessions(userId: string, context: Context): Promise<void>\n}\n\nexport interface ExternalIdentity {\n  providerId: string\n  providerAccountId: string\n  email: string | null\n  emailVerified: boolean\n  name: string | null\n  image: string | null\n}\n\n/**\n * Preferred external-IdP seam. Auth0, Clerk, WorkOS, or generic OIDC adapters\n * verify their assertion here; Better Auth remains the local session issuer.\n */\nexport interface ExternalIdentityAdapter<Input, Context = unknown> {\n  readonly id: string\n  resolve(input: Input, context: Context): Promise<ExternalIdentity>\n  revalidate?(identity: ExternalIdentity, context: Context): Promise<boolean>\n}\n\nexport interface BetterAuthIdentityBridge<Context = unknown> {\n  createSession(identity: ExternalIdentity, context: Context): Promise<Response>\n}\n\nexport function createExternalIdentitySessionAdapter<Input, Context = unknown>(\n  identityAdapter: ExternalIdentityAdapter<Input, Context>,\n  betterAuthBridge: BetterAuthIdentityBridge<Context>,\n) {\n  return {\n    id: identityAdapter.id,\n    async authenticate(input: Input, context: Context): Promise<Response> {\n      const identity = await identityAdapter.resolve(input, context)\n      if (identityAdapter.revalidate && !(await identityAdapter.revalidate(identity, context))) {\n        return Response.json({ error: \"External identity access was revoked\" }, { status: 403 })\n      }\n      return betterAuthBridge.createSession(identity, context)\n    },\n  }\n}\n"]}
+{"version":3,"file":"auth-realms.js","sourceRoot":"","sources":["../src/auth-realms.ts"],"names":[],"mappings":"AA2FA,MAAM,UAAU,oCAAoC,CAClD,eAAwD,EACxD,gBAAmD;IAEnD,OAAO;QACL,EAAE,EAAE,eAAe,CAAC,EAAE;QACtB,KAAK,CAAC,YAAY,CAAC,KAAY,EAAE,OAAgB;YAC/C,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;YAC9D,IAAI,eAAe,CAAC,UAAU,IAAI,CAAC,CAAC,MAAM,eAAe,CAAC,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;gBACzF,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sCAAsC,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;YAC1F,CAAC;YACD,OAAO,gBAAgB,CAAC,aAAa,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;QAC1D,CAAC;KACF,CAAA;AACH,CAAC","sourcesContent":["/** Provider-neutral identities crossing the auth/runtime boundary. */\nexport type AuthRealm = \"admin\" | \"customer\"\n\ninterface PrincipalBase {\n  realm: AuthRealm\n  userId: string\n  sessionId: string\n  email: string | null\n}\n\nexport interface AdminPrincipal extends PrincipalBase {\n  realm: \"admin\"\n  actor: \"staff\"\n  scopes: readonly string[]\n}\n\ninterface CustomerPrincipalBase extends PrincipalBase {\n  realm: \"customer\"\n  actor: \"customer\"\n  buyerAccountId: string\n}\n\nexport interface CustomerIdentityPrincipal extends PrincipalBase {\n  realm: \"customer\"\n  actor: \"customer\"\n  buyerAccountId: null\n  buyerAccountKind: null\n  authOrganizationId: null\n  relationshipOrganizationId: null\n  relationshipPersonId: string | null\n  membershipId: null\n  membershipRole: null\n}\n\nexport interface PersonalCustomerPrincipal extends CustomerPrincipalBase {\n  buyerAccountKind: \"personal\"\n  authOrganizationId: null\n  relationshipOrganizationId: null\n  relationshipPersonId: string | null\n  membershipId: null\n  membershipRole: null\n}\n\nexport interface BusinessCustomerPrincipal extends CustomerPrincipalBase {\n  buyerAccountKind: \"business\"\n  authOrganizationId: string\n  relationshipOrganizationId: string\n  /** Identity Person remains independent from the selected business buyer. */\n  relationshipPersonId: string | null\n  membershipId: string\n  membershipRole: string\n}\n\nexport type CustomerPrincipal =\n  | CustomerIdentityPrincipal\n  | PersonalCustomerPrincipal\n  | BusinessCustomerPrincipal\n\nexport type AuthPrincipal = AdminPrincipal | CustomerPrincipal\n\n/** Complete session replacement seam for advanced self-host integrations. */\nexport interface AuthRealmSessionPort<Context = unknown> {\n  readonly realm: AuthRealm\n  resolve(request: Request, context: Context): Promise<AuthPrincipal | null>\n  signOut(request: Request, context: Context): Promise<Response>\n  revokeUserSessions(userId: string, context: Context): Promise<void>\n}\n\nexport interface ExternalIdentity {\n  providerId: string\n  providerAccountId: string\n  email: string | null\n  emailVerified: boolean\n  name: string | null\n  image: string | null\n}\n\n/**\n * Preferred external-IdP seam. Auth0, Clerk, WorkOS, or generic OIDC adapters\n * verify their assertion here; Better Auth remains the local session issuer.\n */\nexport interface ExternalIdentityAdapter<Input, Context = unknown> {\n  readonly id: string\n  resolve(input: Input, context: Context): Promise<ExternalIdentity>\n  revalidate?(identity: ExternalIdentity, context: Context): Promise<boolean>\n}\n\nexport interface BetterAuthIdentityBridge<Context = unknown> {\n  createSession(identity: ExternalIdentity, context: Context): Promise<Response>\n}\n\nexport function createExternalIdentitySessionAdapter<Input, Context = unknown>(\n  identityAdapter: ExternalIdentityAdapter<Input, Context>,\n  betterAuthBridge: BetterAuthIdentityBridge<Context>,\n) {\n  return {\n    id: identityAdapter.id,\n    async authenticate(input: Input, context: Context): Promise<Response> {\n      const identity = await identityAdapter.resolve(input, context)\n      if (identityAdapter.revalidate && !(await identityAdapter.revalidate(identity, context))) {\n        return Response.json({ error: \"External identity access was revoked\" }, { status: 403 })\n      }\n      return betterAuthBridge.createSession(identity, context)\n    },\n  }\n}\n"]}

package/dist/customer-buyer-accounts.d.ts

@@ -0,0 +1,134 @@
+import type { VoyantDb } from "@voyant-travel/hono";
+import { z } from "zod";
+export declare const customerBuyerAccountKinds: readonly ["personal", "business"];
+export type CustomerBuyerAccountKind = (typeof customerBuyerAccountKinds)[number];
+export type CustomerPersonalSignup = "open" | "disabled";
+export type CustomerBusinessOnboarding = "disabled" | "open" | "request" | "invite-only";
+export interface CustomerBuyerAccountPolicy {
+    allowedKinds: readonly CustomerBuyerAccountKind[];
+    personalSignup: CustomerPersonalSignup;
+    businessOnboarding: CustomerBusinessOnboarding;
+}
+export declare const defaultCustomerBuyerAccountPolicy: {
+    readonly allowedKinds: readonly ["personal"];
+    readonly personalSignup: "open";
+    readonly businessOnboarding: "disabled";
+};
+export declare const customerBuyerAccountPolicySchema: z.ZodObject<{
+    allowedKinds: z.ZodArray<z.ZodEnum<{
+        personal: "personal";
+        business: "business";
+    }>>;
+    personalSignup: z.ZodEnum<{
+        open: "open";
+        disabled: "disabled";
+    }>;
+    businessOnboarding: z.ZodEnum<{
+        open: "open";
+        disabled: "disabled";
+        request: "request";
+        "invite-only": "invite-only";
+    }>;
+}, z.core.$strict>;
+export declare function normalizeCustomerBuyerAccountPolicy(input?: unknown): CustomerBuyerAccountPolicy;
+export declare function personalBuyerAccountId(userId: string): string;
+export declare function businessBuyerAccountId(authOrganizationId: string): string;
+export interface CustomerIdentitySummary {
+    userId: string;
+    name: string | null;
+    email: string | null;
+}
+export interface CustomerBusinessMembership {
+    id: string;
+    authOrganizationId: string;
+    relationshipOrganizationId: string | null;
+    name: string;
+    role: string;
+}
+export interface CustomerBuyerAccountStore {
+    hasActivePersonalAccount(userId: string): Promise<boolean>;
+    getRelationshipPersonId(userId: string): Promise<string | null>;
+    listBusinessMemberships(userId: string): Promise<CustomerBusinessMembership[]>;
+}
+interface CustomerBuyerAccountBase {
+    id: string;
+    name: string;
+}
+export interface PersonalCustomerBuyerAccount extends CustomerBuyerAccountBase {
+    kind: "personal";
+    authOrganizationId: null;
+    relationshipOrganizationId: null;
+    relationshipPersonId: string | null;
+    membershipId: null;
+    membershipRole: null;
+}
+export interface BusinessCustomerBuyerAccount extends CustomerBuyerAccountBase {
+    kind: "business";
+    authOrganizationId: string;
+    relationshipOrganizationId: string;
+    relationshipPersonId: null;
+    membershipId: string;
+    membershipRole: string;
+}
+export type CustomerBuyerAccount = PersonalCustomerBuyerAccount | BusinessCustomerBuyerAccount;
+export type ActiveCustomerBuyerContext = CustomerBuyerAccount & {
+    userId: string;
+};
+export interface CustomerBuyerAccountList {
+    accounts: CustomerBuyerAccount[];
+    activeAccount: CustomerBuyerAccount | null;
+    policy: CustomerBuyerAccountPolicy;
+    requiresSelection: boolean;
+}
+/**
+ * Lists only usable buyer contexts. An unmapped Better Auth organization is
+ * intentionally omitted because it is not a canonical business buyer.
+ */
+export declare function listCustomerBuyerAccounts(input: {
+    identity: CustomerIdentitySummary;
+    activeAuthOrganizationId: string | null;
+    policy?: Partial<CustomerBuyerAccountPolicy> | null;
+    store: CustomerBuyerAccountStore;
+}): Promise<CustomerBuyerAccountList>;
+/** Revalidates the active Better Auth organization against live membership. */
+export declare function resolveActiveCustomerBuyerContext(input: {
+    identity: CustomerIdentitySummary;
+    activeAuthOrganizationId: string | null;
+    policy?: Partial<CustomerBuyerAccountPolicy> | null;
+    store: CustomerBuyerAccountStore;
+}): Promise<ActiveCustomerBuyerContext | null>;
+/** Validates a requested account without trusting a client-supplied organization id. */
+export declare function selectCustomerBuyerAccount(input: {
+    accountId: string;
+    identity: CustomerIdentitySummary;
+    activeAuthOrganizationId: string | null;
+    policy?: Partial<CustomerBuyerAccountPolicy> | null;
+    store: CustomerBuyerAccountStore;
+}): Promise<CustomerBuyerAccount | null>;
+export declare function createDrizzleCustomerBuyerAccountStore(db: VoyantDb): CustomerBuyerAccountStore;
+/**
+ * Lazily and idempotently materializes the entitlement from the immutable
+ * eligibility stamp. Current policy changes cannot grant an entitlement
+ * retroactively, and revoked rows are never revived.
+ */
+export declare function repairCustomerPersonalBuyerAccountEntitlement(db: VoyantDb, userId: string): Promise<boolean>;
+/**
+ * Deployment-owned seam for open/request business onboarding. Implementations
+ * must create or select the canonical Relationships Organization before they
+ * create the Better Auth membership container and return both ids.
+ */
+export interface CustomerBusinessAccountOnboardingPort<Context = unknown> {
+    create(input: {
+        userId: string;
+        name: string;
+        context: Context;
+    }): Promise<BusinessCustomerBuyerAccount>;
+    request?(input: {
+        userId: string;
+        name: string;
+        context: Context;
+    }): Promise<{
+        id: string;
+    }>;
+}
+export {};

package/dist/customer-buyer-accounts.js

@@ -0,0 +1,177 @@
+import { customerAuthMember, customerAuthOrganization, customerAuthPersonalBuyerAccount, customerAuthUser, } from "@voyant-travel/db/schema/iam";
+import { asc, eq } from "drizzle-orm";
+import { z } from "zod";
+export const customerBuyerAccountKinds = ["personal", "business"];
+export const defaultCustomerBuyerAccountPolicy = {
+    allowedKinds: ["personal"],
+    personalSignup: "open",
+    businessOnboarding: "disabled",
+};
+export const customerBuyerAccountPolicySchema = z
+    .object({
+    allowedKinds: z.array(z.enum(customerBuyerAccountKinds)).min(1).max(2),
+    personalSignup: z.enum(["open", "disabled"]),
+    businessOnboarding: z.enum(["disabled", "open", "request", "invite-only"]),
+})
+    .strict()
+    .superRefine((policy, ctx) => {
+    if (new Set(policy.allowedKinds).size !== policy.allowedKinds.length) {
+        ctx.addIssue({
+            code: "custom",
+            path: ["allowedKinds"],
+            message: "allowedKinds must be unique",
+        });
+    }
+    if (!policy.allowedKinds.includes("personal") && policy.personalSignup !== "disabled") {
+        ctx.addIssue({
+            code: "custom",
+            path: ["personalSignup"],
+            message: "personalSignup must be disabled when personal accounts are not allowed",
+        });
+    }
+    if (policy.allowedKinds.includes("business") === (policy.businessOnboarding === "disabled")) {
+        ctx.addIssue({
+            code: "custom",
+            path: ["businessOnboarding"],
+            message: "businessOnboarding must be disabled exactly when business accounts are not allowed",
+        });
+    }
+});
+export function normalizeCustomerBuyerAccountPolicy(input) {
+    if (input === undefined || input === null) {
+        return { ...defaultCustomerBuyerAccountPolicy };
+    }
+    const parsed = customerBuyerAccountPolicySchema.parse(input);
+    return {
+        ...parsed,
+        allowedKinds: customerBuyerAccountKinds.filter((kind) => parsed.allowedKinds.includes(kind)),
+    };
+}
+export function personalBuyerAccountId(userId) {
+    return `personal:${userId}`;
+}
+export function businessBuyerAccountId(authOrganizationId) {
+    return `business:${authOrganizationId}`;
+}
+function personalAccount(identity, relationshipPersonId) {
+    return {
+        id: personalBuyerAccountId(identity.userId),
+        kind: "personal",
+        name: identity.name?.trim() || identity.email?.trim() || "Personal account",
+        authOrganizationId: null,
+        relationshipOrganizationId: null,
+        relationshipPersonId,
+        membershipId: null,
+        membershipRole: null,
+    };
+}
+function businessAccount(membership) {
+    return {
+        id: businessBuyerAccountId(membership.authOrganizationId),
+        kind: "business",
+        name: membership.name,
+        authOrganizationId: membership.authOrganizationId,
+        relationshipOrganizationId: membership.relationshipOrganizationId,
+        relationshipPersonId: null,
+        membershipId: membership.id,
+        membershipRole: membership.role,
+    };
+}
+function businessAccountsEnabled(policy) {
+    return policy.allowedKinds.includes("business");
+}
+function hasRelationshipOrganization(membership) {
+    return Boolean(membership.relationshipOrganizationId);
+}
+/**
+ * Lists only usable buyer contexts. An unmapped Better Auth organization is
+ * intentionally omitted because it is not a canonical business buyer.
+ */
+export async function listCustomerBuyerAccounts(input) {
+    const policy = normalizeCustomerBuyerAccountPolicy(input.policy);
+    const accounts = [];
+    if (policy.allowedKinds.includes("personal")) {
+        if (await input.store.hasActivePersonalAccount(input.identity.userId)) {
+            accounts.push(personalAccount(input.identity, await input.store.getRelationshipPersonId(input.identity.userId)));
+        }
+    }
+    if (businessAccountsEnabled(policy)) {
+        const memberships = await input.store.listBusinessMemberships(input.identity.userId);
+        accounts.push(...memberships.filter(hasRelationshipOrganization).map(businessAccount));
+    }
+    const activeAccount = input.activeAuthOrganizationId
+        ? (accounts.find((account) => account.authOrganizationId === input.activeAuthOrganizationId) ??
+            null)
+        : (accounts.find((account) => account.kind === "personal") ?? null);
+    return {
+        accounts,
+        activeAccount,
+        policy,
+        requiresSelection: activeAccount === null,
+    };
+}
+/** Revalidates the active Better Auth organization against live membership. */
+export async function resolveActiveCustomerBuyerContext(input) {
+    const listed = await listCustomerBuyerAccounts(input);
+    return listed.activeAccount ? { ...listed.activeAccount, userId: input.identity.userId } : null;
+}
+/** Validates a requested account without trusting a client-supplied organization id. */
+export async function selectCustomerBuyerAccount(input) {
+    const listed = await listCustomerBuyerAccounts(input);
+    return listed.accounts.find((account) => account.id === input.accountId) ?? null;
+}
+export function createDrizzleCustomerBuyerAccountStore(db) {
+    return {
+        async hasActivePersonalAccount(userId) {
+            const [row] = await db
+                .select({ revokedAt: customerAuthPersonalBuyerAccount.revokedAt })
+                .from(customerAuthPersonalBuyerAccount)
+                .where(eq(customerAuthPersonalBuyerAccount.userId, userId))
+                .limit(1);
+            return row?.revokedAt === null;
+        },
+        async getRelationshipPersonId(userId) {
+            const [row] = await db
+                .select({ relationshipPersonId: customerAuthUser.relationshipPersonId })
+                .from(customerAuthUser)
+                .where(eq(customerAuthUser.id, userId))
+                .limit(1);
+            return row?.relationshipPersonId ?? null;
+        },
+        async listBusinessMemberships(userId) {
+            return db
+                .select({
+                id: customerAuthMember.id,
+                authOrganizationId: customerAuthMember.organizationId,
+                relationshipOrganizationId: customerAuthOrganization.relationshipOrganizationId,
+                name: customerAuthOrganization.name,
+                role: customerAuthMember.role,
+            })
+                .from(customerAuthMember)
+                .innerJoin(customerAuthOrganization, eq(customerAuthOrganization.id, customerAuthMember.organizationId))
+                .where(eq(customerAuthMember.userId, userId))
+                .orderBy(asc(customerAuthOrganization.name), asc(customerAuthMember.createdAt));
+        },
+    };
+}
+/**
+ * Lazily and idempotently materializes the entitlement from the immutable
+ * eligibility stamp. Current policy changes cannot grant an entitlement
+ * retroactively, and revoked rows are never revived.
+ */
+export async function repairCustomerPersonalBuyerAccountEntitlement(db, userId) {
+    const [candidate] = await db
+        .select({
+        eligible: customerAuthUser.personalBuyerEntitlementEligible,
+        entitlementUserId: customerAuthPersonalBuyerAccount.userId,
+    })
+        .from(customerAuthUser)
+        .leftJoin(customerAuthPersonalBuyerAccount, eq(customerAuthPersonalBuyerAccount.userId, customerAuthUser.id))
+        .where(eq(customerAuthUser.id, userId))
+        .limit(1);
+    if (!candidate?.eligible || candidate.entitlementUserId)
+        return false;
+    await db.insert(customerAuthPersonalBuyerAccount).values({ userId }).onConflictDoNothing();
+    return true;
+}
+//# sourceMappingURL=customer-buyer-accounts.js.map

package/dist/customer-buyer-accounts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"customer-buyer-accounts.js","sourceRoot":"","sources":["../src/customer-buyer-accounts.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,wBAAwB,EACxB,gCAAgC,EAChC,gBAAgB,GACjB,MAAM,8BAA8B,CAAA;AAErC,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAA;AACrC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,UAAU,EAAE,UAAU,CAAU,CAAA;AAW1E,MAAM,CAAC,MAAM,iCAAiC,GAAG;IAC/C,YAAY,EAAE,CAAC,UAAU,CAAC;IAC1B,cAAc,EAAE,MAAM;IACtB,kBAAkB,EAAE,UAAU;CACe,CAAA;AAE/C,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC;KAC9C,MAAM,CAAC;IACN,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACtE,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAC5C,kBAAkB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;CAC3E,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;IAC3B,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC;QACrE,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,cAAc,CAAC;YACtB,OAAO,EAAE,6BAA6B;SACvC,CAAC,CAAA;IACJ,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC,cAAc,KAAK,UAAU,EAAE,CAAC;QACtF,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,gBAAgB,CAAC;YACxB,OAAO,EAAE,wEAAwE;SAClF,CAAC,CAAA;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,kBAAkB,KAAK,UAAU,CAAC,EAAE,CAAC;QAC5F,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,oBAAoB,CAAC;YAC5B,OAAO,EACL,oFAAoF;SACvF,CAAC,CAAA;IACJ,CAAC;AACH,CAAC,CAAC,CAAA;AAEJ,MAAM,UAAU,mCAAmC,CAAC,KAAe;IACjE,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAC1C,OAAO,EAAE,GAAG,iCAAiC,EAAE,CAAA;IACjD,CAAC;IACD,MAAM,MAAM,GAAG,gCAAgC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IAC5D,OAAO;QACL,GAAG,MAAM;QACT,YAAY,EAAE,yBAAyB,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;KAC7F,CAAA;AACH,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,MAAc;IACnD,OAAO,YAAY,MAAM,EAAE,CAAA;AAC7B,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,kBAA0B;IAC/D,OAAO,YAAY,kBAAkB,EAAE,CAAA;AACzC,CAAC;AAwDD,SAAS,eAAe,CACtB,QAAiC,EACjC,oBAAmC;IAEnC,OAAO;QACL,EAAE,EAAE,sBAAsB,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC3C,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,kBAAkB;QAC3E,kBAAkB,EAAE,IAAI;QACxB,0BAA0B,EAAE,IAAI;QAChC,oBAAoB;QACpB,YAAY,EAAE,IAAI;QAClB,cAAc,EAAE,IAAI;KACrB,CAAA;AACH,CAAC;AAED,SAAS,eAAe,CACtB,UAA+E;IAE/E,OAAO;QACL,EAAE,EAAE,sBAAsB,CAAC,UAAU,CAAC,kBAAkB,CAAC;QACzD,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,UAAU,CAAC,IAAI;QACrB,kBAAkB,EAAE,UAAU,CAAC,kBAAkB;QACjD,0BAA0B,EAAE,UAAU,CAAC,0BAA0B;QACjE,oBAAoB,EAAE,IAAI;QAC1B,YAAY,EAAE,UAAU,CAAC,EAAE;QAC3B,cAAc,EAAE,UAAU,CAAC,IAAI;KAChC,CAAA;AACH,CAAC;AAED,SAAS,uBAAuB,CAAC,MAAkC;IACjE,OAAO,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAA;AACjD,CAAC;AAED,SAAS,2BAA2B,CAClC,UAAsC;IAEtC,OAAO,OAAO,CAAC,UAAU,CAAC,0BAA0B,CAAC,CAAA;AACvD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,KAK/C;IACC,MAAM,MAAM,GAAG,mCAAmC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IAChE,MAAM,QAAQ,GAA2B,EAAE,CAAA;IAE3C,IAAI,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7C,IAAI,MAAM,KAAK,CAAC,KAAK,CAAC,wBAAwB,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACtE,QAAQ,CAAC,IAAI,CACX,eAAe,CACb,KAAK,CAAC,QAAQ,EACd,MAAM,KAAK,CAAC,KAAK,CAAC,uBAAuB,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CACjE,CACF,CAAA;QACH,CAAC;IACH,CAAC;IAED,IAAI,uBAAuB,CAAC,MAAM,CAAC,EAAE,CAAC;QACpC,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,uBAAuB,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;QACpF,QAAQ,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,MAAM,CAAC,2BAA2B,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAA;IACxF,CAAC;IAED,MAAM,aAAa,GAAG,KAAK,CAAC,wBAAwB;QAClD,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,kBAAkB,KAAK,KAAK,CAAC,wBAAwB,CAAC;YAC1F,IAAI,CAAC;QACP,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,UAAU,CAAC,IAAI,IAAI,CAAC,CAAA;IAErE,OAAO;QACL,QAAQ;QACR,aAAa;QACb,MAAM;QACN,iBAAiB,EAAE,aAAa,KAAK,IAAI;KAC1C,CAAA;AACH,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,iCAAiC,CAAC,KAKvD;IACC,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAAC,KAAK,CAAC,CAAA;IACrD,OAAO,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,CAAC,aAAa,EAAE,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;AACjG,CAAC;AAED,wFAAwF;AACxF,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,KAMhD;IACC,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAAC,KAAK,CAAC,CAAA;IACrD,OAAO,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,KAAK,CAAC,SAAS,CAAC,IAAI,IAAI,CAAA;AAClF,CAAC;AAED,MAAM,UAAU,sCAAsC,CAAC,EAAY;IACjE,OAAO;QACL,KAAK,CAAC,wBAAwB,CAAC,MAAM;YACnC,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;iBACnB,MAAM,CAAC,EAAE,SAAS,EAAE,gCAAgC,CAAC,SAAS,EAAE,CAAC;iBACjE,IAAI,CAAC,gCAAgC,CAAC;iBACtC,KAAK,CAAC,EAAE,CAAC,gCAAgC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;iBAC1D,KAAK,CAAC,CAAC,CAAC,CAAA;YACX,OAAO,GAAG,EAAE,SAAS,KAAK,IAAI,CAAA;QAChC,CAAC;QACD,KAAK,CAAC,uBAAuB,CAAC,MAAM;YAClC,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;iBACnB,MAAM,CAAC,EAAE,oBAAoB,EAAE,gBAAgB,CAAC,oBAAoB,EAAE,CAAC;iBACvE,IAAI,CAAC,gBAAgB,CAAC;iBACtB,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;iBACtC,KAAK,CAAC,CAAC,CAAC,CAAA;YACX,OAAO,GAAG,EAAE,oBAAoB,IAAI,IAAI,CAAA;QAC1C,CAAC;QACD,KAAK,CAAC,uBAAuB,CAAC,MAAM;YAClC,OAAO,EAAE;iBACN,MAAM,CAAC;gBACN,EAAE,EAAE,kBAAkB,CAAC,EAAE;gBACzB,kBAAkB,EAAE,kBAAkB,CAAC,cAAc;gBACrD,0BAA0B,EAAE,wBAAwB,CAAC,0BAA0B;gBAC/E,IAAI,EAAE,wBAAwB,CAAC,IAAI;gBACnC,IAAI,EAAE,kBAAkB,CAAC,IAAI;aAC9B,CAAC;iBACD,IAAI,CAAC,kBAAkB,CAAC;iBACxB,SAAS,CACR,wBAAwB,EACxB,EAAE,CAAC,wBAAwB,CAAC,EAAE,EAAE,kBAAkB,CAAC,cAAc,CAAC,CACnE;iBACA,KAAK,CAAC,EAAE,CAAC,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;iBAC5C,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAA;QACnF,CAAC;KACF,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,6CAA6C,CACjE,EAAY,EACZ,MAAc;IAEd,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,EAAE;SACzB,MAAM,CAAC;QACN,QAAQ,EAAE,gBAAgB,CAAC,gCAAgC;QAC3D,iBAAiB,EAAE,gCAAgC,CAAC,MAAM;KAC3D,CAAC;SACD,IAAI,CAAC,gBAAgB,CAAC;SACtB,QAAQ,CACP,gCAAgC,EAChC,EAAE,CAAC,gCAAgC,CAAC,MAAM,EAAE,gBAAgB,CAAC,EAAE,CAAC,CACjE;SACA,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;SACtC,KAAK,CAAC,CAAC,CAAC,CAAA;IAEX,IAAI,CAAC,SAAS,EAAE,QAAQ,IAAI,SAAS,CAAC,iBAAiB;QAAE,OAAO,KAAK,CAAA;IAErE,MAAM,EAAE,CAAC,MAAM,CAAC,gCAAgC,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,mBAAmB,EAAE,CAAA;IAC1F,OAAO,IAAI,CAAA;AACb,CAAC","sourcesContent":["import {\n  customerAuthMember,\n  customerAuthOrganization,\n  customerAuthPersonalBuyerAccount,\n  customerAuthUser,\n} from \"@voyant-travel/db/schema/iam\"\nimport type { VoyantDb } from \"@voyant-travel/hono\"\nimport { asc, eq } from \"drizzle-orm\"\nimport { z } from \"zod\"\n\nexport const customerBuyerAccountKinds = [\"personal\", \"business\"] as const\nexport type CustomerBuyerAccountKind = (typeof customerBuyerAccountKinds)[number]\nexport type CustomerPersonalSignup = \"open\" | \"disabled\"\nexport type CustomerBusinessOnboarding = \"disabled\" | \"open\" | \"request\" | \"invite-only\"\n\nexport interface CustomerBuyerAccountPolicy {\n  allowedKinds: readonly CustomerBuyerAccountKind[]\n  personalSignup: CustomerPersonalSignup\n  businessOnboarding: CustomerBusinessOnboarding\n}\n\nexport const defaultCustomerBuyerAccountPolicy = {\n  allowedKinds: [\"personal\"],\n  personalSignup: \"open\",\n  businessOnboarding: \"disabled\",\n} as const satisfies CustomerBuyerAccountPolicy\n\nexport const customerBuyerAccountPolicySchema = z\n  .object({\n    allowedKinds: z.array(z.enum(customerBuyerAccountKinds)).min(1).max(2),\n    personalSignup: z.enum([\"open\", \"disabled\"]),\n    businessOnboarding: z.enum([\"disabled\", \"open\", \"request\", \"invite-only\"]),\n  })\n  .strict()\n  .superRefine((policy, ctx) => {\n    if (new Set(policy.allowedKinds).size !== policy.allowedKinds.length) {\n      ctx.addIssue({\n        code: \"custom\",\n        path: [\"allowedKinds\"],\n        message: \"allowedKinds must be unique\",\n      })\n    }\n    if (!policy.allowedKinds.includes(\"personal\") && policy.personalSignup !== \"disabled\") {\n      ctx.addIssue({\n        code: \"custom\",\n        path: [\"personalSignup\"],\n        message: \"personalSignup must be disabled when personal accounts are not allowed\",\n      })\n    }\n    if (policy.allowedKinds.includes(\"business\") === (policy.businessOnboarding === \"disabled\")) {\n      ctx.addIssue({\n        code: \"custom\",\n        path: [\"businessOnboarding\"],\n        message:\n          \"businessOnboarding must be disabled exactly when business accounts are not allowed\",\n      })\n    }\n  })\n\nexport function normalizeCustomerBuyerAccountPolicy(input?: unknown): CustomerBuyerAccountPolicy {\n  if (input === undefined || input === null) {\n    return { ...defaultCustomerBuyerAccountPolicy }\n  }\n  const parsed = customerBuyerAccountPolicySchema.parse(input)\n  return {\n    ...parsed,\n    allowedKinds: customerBuyerAccountKinds.filter((kind) => parsed.allowedKinds.includes(kind)),\n  }\n}\n\nexport function personalBuyerAccountId(userId: string): string {\n  return `personal:${userId}`\n}\n\nexport function businessBuyerAccountId(authOrganizationId: string): string {\n  return `business:${authOrganizationId}`\n}\n\nexport interface CustomerIdentitySummary {\n  userId: string\n  name: string | null\n  email: string | null\n}\n\nexport interface CustomerBusinessMembership {\n  id: string\n  authOrganizationId: string\n  relationshipOrganizationId: string | null\n  name: string\n  role: string\n}\n\nexport interface CustomerBuyerAccountStore {\n  hasActivePersonalAccount(userId: string): Promise<boolean>\n  getRelationshipPersonId(userId: string): Promise<string | null>\n  listBusinessMemberships(userId: string): Promise<CustomerBusinessMembership[]>\n}\n\ninterface CustomerBuyerAccountBase {\n  id: string\n  name: string\n}\n\nexport interface PersonalCustomerBuyerAccount extends CustomerBuyerAccountBase {\n  kind: \"personal\"\n  authOrganizationId: null\n  relationshipOrganizationId: null\n  relationshipPersonId: string | null\n  membershipId: null\n  membershipRole: null\n}\n\nexport interface BusinessCustomerBuyerAccount extends CustomerBuyerAccountBase {\n  kind: \"business\"\n  authOrganizationId: string\n  relationshipOrganizationId: string\n  relationshipPersonId: null\n  membershipId: string\n  membershipRole: string\n}\n\nexport type CustomerBuyerAccount = PersonalCustomerBuyerAccount | BusinessCustomerBuyerAccount\n\nexport type ActiveCustomerBuyerContext = CustomerBuyerAccount & { userId: string }\n\nexport interface CustomerBuyerAccountList {\n  accounts: CustomerBuyerAccount[]\n  activeAccount: CustomerBuyerAccount | null\n  policy: CustomerBuyerAccountPolicy\n  requiresSelection: boolean\n}\n\nfunction personalAccount(\n  identity: CustomerIdentitySummary,\n  relationshipPersonId: string | null,\n): PersonalCustomerBuyerAccount {\n  return {\n    id: personalBuyerAccountId(identity.userId),\n    kind: \"personal\",\n    name: identity.name?.trim() || identity.email?.trim() || \"Personal account\",\n    authOrganizationId: null,\n    relationshipOrganizationId: null,\n    relationshipPersonId,\n    membershipId: null,\n    membershipRole: null,\n  }\n}\n\nfunction businessAccount(\n  membership: CustomerBusinessMembership & { relationshipOrganizationId: string },\n): BusinessCustomerBuyerAccount {\n  return {\n    id: businessBuyerAccountId(membership.authOrganizationId),\n    kind: \"business\",\n    name: membership.name,\n    authOrganizationId: membership.authOrganizationId,\n    relationshipOrganizationId: membership.relationshipOrganizationId,\n    relationshipPersonId: null,\n    membershipId: membership.id,\n    membershipRole: membership.role,\n  }\n}\n\nfunction businessAccountsEnabled(policy: CustomerBuyerAccountPolicy): boolean {\n  return policy.allowedKinds.includes(\"business\")\n}\n\nfunction hasRelationshipOrganization(\n  membership: CustomerBusinessMembership,\n): membership is CustomerBusinessMembership & { relationshipOrganizationId: string } {\n  return Boolean(membership.relationshipOrganizationId)\n}\n\n/**\n * Lists only usable buyer contexts. An unmapped Better Auth organization is\n * intentionally omitted because it is not a canonical business buyer.\n */\nexport async function listCustomerBuyerAccounts(input: {\n  identity: CustomerIdentitySummary\n  activeAuthOrganizationId: string | null\n  policy?: Partial<CustomerBuyerAccountPolicy> | null\n  store: CustomerBuyerAccountStore\n}): Promise<CustomerBuyerAccountList> {\n  const policy = normalizeCustomerBuyerAccountPolicy(input.policy)\n  const accounts: CustomerBuyerAccount[] = []\n\n  if (policy.allowedKinds.includes(\"personal\")) {\n    if (await input.store.hasActivePersonalAccount(input.identity.userId)) {\n      accounts.push(\n        personalAccount(\n          input.identity,\n          await input.store.getRelationshipPersonId(input.identity.userId),\n        ),\n      )\n    }\n  }\n\n  if (businessAccountsEnabled(policy)) {\n    const memberships = await input.store.listBusinessMemberships(input.identity.userId)\n    accounts.push(...memberships.filter(hasRelationshipOrganization).map(businessAccount))\n  }\n\n  const activeAccount = input.activeAuthOrganizationId\n    ? (accounts.find((account) => account.authOrganizationId === input.activeAuthOrganizationId) ??\n      null)\n    : (accounts.find((account) => account.kind === \"personal\") ?? null)\n\n  return {\n    accounts,\n    activeAccount,\n    policy,\n    requiresSelection: activeAccount === null,\n  }\n}\n\n/** Revalidates the active Better Auth organization against live membership. */\nexport async function resolveActiveCustomerBuyerContext(input: {\n  identity: CustomerIdentitySummary\n  activeAuthOrganizationId: string | null\n  policy?: Partial<CustomerBuyerAccountPolicy> | null\n  store: CustomerBuyerAccountStore\n}): Promise<ActiveCustomerBuyerContext | null> {\n  const listed = await listCustomerBuyerAccounts(input)\n  return listed.activeAccount ? { ...listed.activeAccount, userId: input.identity.userId } : null\n}\n\n/** Validates a requested account without trusting a client-supplied organization id. */\nexport async function selectCustomerBuyerAccount(input: {\n  accountId: string\n  identity: CustomerIdentitySummary\n  activeAuthOrganizationId: string | null\n  policy?: Partial<CustomerBuyerAccountPolicy> | null\n  store: CustomerBuyerAccountStore\n}): Promise<CustomerBuyerAccount | null> {\n  const listed = await listCustomerBuyerAccounts(input)\n  return listed.accounts.find((account) => account.id === input.accountId) ?? null\n}\n\nexport function createDrizzleCustomerBuyerAccountStore(db: VoyantDb): CustomerBuyerAccountStore {\n  return {\n    async hasActivePersonalAccount(userId) {\n      const [row] = await db\n        .select({ revokedAt: customerAuthPersonalBuyerAccount.revokedAt })\n        .from(customerAuthPersonalBuyerAccount)\n        .where(eq(customerAuthPersonalBuyerAccount.userId, userId))\n        .limit(1)\n      return row?.revokedAt === null\n    },\n    async getRelationshipPersonId(userId) {\n      const [row] = await db\n        .select({ relationshipPersonId: customerAuthUser.relationshipPersonId })\n        .from(customerAuthUser)\n        .where(eq(customerAuthUser.id, userId))\n        .limit(1)\n      return row?.relationshipPersonId ?? null\n    },\n    async listBusinessMemberships(userId) {\n      return db\n        .select({\n          id: customerAuthMember.id,\n          authOrganizationId: customerAuthMember.organizationId,\n          relationshipOrganizationId: customerAuthOrganization.relationshipOrganizationId,\n          name: customerAuthOrganization.name,\n          role: customerAuthMember.role,\n        })\n        .from(customerAuthMember)\n        .innerJoin(\n          customerAuthOrganization,\n          eq(customerAuthOrganization.id, customerAuthMember.organizationId),\n        )\n        .where(eq(customerAuthMember.userId, userId))\n        .orderBy(asc(customerAuthOrganization.name), asc(customerAuthMember.createdAt))\n    },\n  }\n}\n\n/**\n * Lazily and idempotently materializes the entitlement from the immutable\n * eligibility stamp. Current policy changes cannot grant an entitlement\n * retroactively, and revoked rows are never revived.\n */\nexport async function repairCustomerPersonalBuyerAccountEntitlement(\n  db: VoyantDb,\n  userId: string,\n): Promise<boolean> {\n  const [candidate] = await db\n    .select({\n      eligible: customerAuthUser.personalBuyerEntitlementEligible,\n      entitlementUserId: customerAuthPersonalBuyerAccount.userId,\n    })\n    .from(customerAuthUser)\n    .leftJoin(\n      customerAuthPersonalBuyerAccount,\n      eq(customerAuthPersonalBuyerAccount.userId, customerAuthUser.id),\n    )\n    .where(eq(customerAuthUser.id, userId))\n    .limit(1)\n\n  if (!candidate?.eligible || candidate.entitlementUserId) return false\n\n  await db.insert(customerAuthPersonalBuyerAccount).values({ userId }).onConflictDoNothing()\n  return true\n}\n\n/**\n * Deployment-owned seam for open/request business onboarding. Implementations\n * must create or select the canonical Relationships Organization before they\n * create the Better Auth membership container and return both ids.\n */\nexport interface CustomerBusinessAccountOnboardingPort<Context = unknown> {\n  create(input: {\n    userId: string\n    name: string\n    context: Context\n  }): Promise<BusinessCustomerBuyerAccount>\n  request?(input: { userId: string; name: string; context: Context }): Promise<{ id: string }>\n}\n"]}

package/dist/local-member-access.d.ts

@@ -7,6 +7,8 @@ export declare function isDeactivatedProviderId(providerId: string): boolean;
 export declare function isLocalMemberDeactivated(db: VoyantDb, userId: string): Promise<boolean>;
 export declare function isLocalMemberEmailDeactivated(db: VoyantDb, email: string): Promise<boolean>;
 export declare function isLocalMemberSessionActive(db: VoyantDb, sessionId: string, userId: string): Promise<boolean>;
+/** Customer-realm session liveness check used to defeat stale cookie-cache grants. */
+export declare function isCustomerSessionActive(db: VoyantDb, sessionId: string, userId: string): Promise<boolean>;
 export interface LocalMemberAccessResolver {
     isEmailDeactivated(email: string): Promise<boolean>;
     isSessionActive(sessionId: string, userId: string): Promise<boolean>;

package/dist/local-member-access.js

@@ -1,7 +1,7 @@
-import { authAccount, authSession, authUser } from "@voyant-travel/db/schema/iam";
+import { authAccount, authSession, authUser, customerAuthSession, } from "@voyant-travel/db/schema/iam";
 import { APIError, createAuthMiddleware, getSessionFromCtx } from "better-auth/api";
 import { deleteSessionCookie } from "better-auth/cookies";
-import { and, eq } from "drizzle-orm";
+import { and, eq, gt } from "drizzle-orm";
 export const DEACTIVATED_PROVIDER_PREFIX = "voyant-deactivated:";
 export function localProviderIdForStatus(providerId, status) {
     if (status === "deactivated") {
@@ -43,6 +43,15 @@ export async function isLocalMemberSessionActive(db, sessionId, userId) {
         .limit(1);
     return sessions.length > 0;
 }
+/** Customer-realm session liveness check used to defeat stale cookie-cache grants. */
+export async function isCustomerSessionActive(db, sessionId, userId) {
+    const sessions = await db
+        .select({ id: customerAuthSession.id })
+        .from(customerAuthSession)
+        .where(and(eq(customerAuthSession.id, sessionId), eq(customerAuthSession.userId, userId), gt(customerAuthSession.expiresAt, new Date())))
+        .limit(1);
+    return sessions.length > 0;
+}
 const ACCESS_DENIED_MESSAGE = "This account is deactivated.";
 function requestEmail(context) {
     const path = context.path ?? "";

package/dist/local-member-access.js.map

@@ -1 +1 @@
-{"version":3,"file":"local-member-access.js","sourceRoot":"","sources":["../src/local-member-access.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAA;AAEjF,OAAO,EAAE,QAAQ,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AACnF,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AAEzD,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAA;AAIrC,MAAM,CAAC,MAAM,2BAA2B,GAAG,qBAAqB,CAAA;AAEhE,MAAM,UAAU,wBAAwB,CAAC,UAAkB,EAAE,MAAwB;IACnF,IAAI,MAAM,KAAK,aAAa,EAAE,CAAC;QAC7B,OAAO,UAAU,CAAC,UAAU,CAAC,2BAA2B,CAAC;YACvD,CAAC,CAAC,UAAU;YACZ,CAAC,CAAC,GAAG,2BAA2B,GAAG,UAAU,EAAE,CAAA;IACnD,CAAC;IACD,OAAO,UAAU,CAAC,UAAU,CAAC,2BAA2B,CAAC;QACvD,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,2BAA2B,CAAC,MAAM,CAAC;QACtD,CAAC,CAAC,UAAU,CAAA;AAChB,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,UAAkB;IACxD,OAAO,UAAU,CAAC,UAAU,CAAC,2BAA2B,CAAC,CAAA;AAC3D,CAAC;AAED,KAAK,UAAU,uBAAuB,CAAC,EAAY,EAAE,MAAc;IACjE,MAAM,QAAQ,GAAG,MAAM,EAAE;SACtB,MAAM,CAAC,EAAE,UAAU,EAAE,WAAW,CAAC,UAAU,EAAE,CAAC;SAC9C,IAAI,CAAC,WAAW,CAAC;SACjB,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IACxC,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;AACtD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,EAAY,EAAE,MAAc;IACzE,MAAM,WAAW,GAAG,MAAM,uBAAuB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;IAC7D,OAAO,WAAW,CAAC,MAAM,GAAG,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAA;AAC7E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,EAAY,EAAE,KAAa;IAC7E,MAAM,QAAQ,GAAG,MAAM,EAAE;SACtB,MAAM,CAAC,EAAE,UAAU,EAAE,WAAW,CAAC,UAAU,EAAE,CAAC;SAC9C,IAAI,CAAC,WAAW,CAAC;SACjB,SAAS,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;SACxD,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IAClG,OAAO,CACL,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,uBAAuB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAChG,CAAA;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,EAAY,EACZ,SAAiB,EACjB,MAAc;IAEd,MAAM,QAAQ,GAAG,MAAM,EAAE;SACtB,MAAM,CAAC,EAAE,EAAE,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC;SAC9B,IAAI,CAAC,WAAW,CAAC;SACjB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;SACzE,KAAK,CAAC,CAAC,CAAC,CAAA;IACX,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAA;AAC5B,CAAC;AAQD,MAAM,qBAAqB,GAAG,8BAA8B,CAAA;AAE5D,SAAS,YAAY,CAAC,OAA2D;IAC/E,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,EAAE,CAAA;IAC/B,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QACzF,OAAO,IAAI,CAAA;IACb,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAClD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,SAAQ;QACjD,MAAM,KAAK,GAAI,KAAiC,CAAC,KAAK,CAAA;QACtD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzD,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;QACnC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,UAAU;IACjB,MAAM,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC,CAAA;AACrE,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,QAAmC;IAEnC,OAAO;QACL,EAAE,EAAE,4BAA4B;QAChC,IAAI;YACF,OAAO;gBACL,OAAO,EAAE;oBACP,aAAa,EAAE;wBACb,OAAO,EAAE;4BACP,MAAM,EAAE;gCACN,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;oCACxB,IAAI,MAAM,QAAQ,CAAC,iBAAiB,CAAC,OAAO,CAAC,MAAM,CAAC;wCAAE,UAAU,EAAE,CAAA;gCACpE,CAAC;6BACF;yBACF;wBACD,OAAO,EAAE;4BACP,MAAM,EAAE;gCACN,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;oCACxB,IAAI,MAAM,QAAQ,CAAC,iBAAiB,CAAC,OAAO,CAAC,MAAM,CAAC;wCAAE,UAAU,EAAE,CAAA;gCACpE,CAAC;6BACF;yBACF;qBACF;iBACF;aACF,CAAA;QACH,CAAC;QACD,KAAK,EAAE;YACL,MAAM,EAAE;gBACN;oBACE,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI;oBACnB,OAAO,EAAE,oBAAoB,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;wBAC9C,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,CAAA;wBAChD,IAAI,OAAO,EAAE,CAAC;4BACZ,MAAM,CAAC,aAAa,EAAE,eAAe,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gCACzD,QAAQ,CAAC,iBAAiB,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gCAC3C,QAAQ,CAAC,eAAe,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;6BAC9D,CAAC,CAAA;4BACF,IAAI,aAAa,IAAI,CAAC,eAAe,EAAE,CAAC;gCACtC,mBAAmB,CAAC,OAAO,CAAC,CAAA;gCAC5B,IAAI,OAAO,CAAC,IAAI,KAAK,cAAc;oCAAE,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gCAC9D,UAAU,EAAE,CAAA;4BACd,CAAC;wBACH,CAAC;wBAED,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,CAAA;wBACnC,IAAI,KAAK,IAAI,CAAC,MAAM,QAAQ,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;4BAAE,UAAU,EAAE,CAAA;oBACvE,CAAC,CAAC;iBACH;aACF;SACF;KACF,CAAA;AACH,CAAC","sourcesContent":["import { authAccount, authSession, authUser } from \"@voyant-travel/db/schema/iam\"\nimport type { VoyantDb } from \"@voyant-travel/hono\"\nimport { APIError, createAuthMiddleware, getSessionFromCtx } from \"better-auth/api\"\nimport { deleteSessionCookie } from \"better-auth/cookies\"\nimport type { BetterAuthPlugin } from \"better-auth/types\"\nimport { and, eq } from \"drizzle-orm\"\n\nimport type { TeamMemberStatus } from \"./team-management-runtime-port.js\"\n\nexport const DEACTIVATED_PROVIDER_PREFIX = \"voyant-deactivated:\"\n\nexport function localProviderIdForStatus(providerId: string, status: TeamMemberStatus): string {\n  if (status === \"deactivated\") {\n    return providerId.startsWith(DEACTIVATED_PROVIDER_PREFIX)\n      ? providerId\n      : `${DEACTIVATED_PROVIDER_PREFIX}${providerId}`\n  }\n  return providerId.startsWith(DEACTIVATED_PROVIDER_PREFIX)\n    ? providerId.slice(DEACTIVATED_PROVIDER_PREFIX.length)\n    : providerId\n}\n\nexport function isDeactivatedProviderId(providerId: string): boolean {\n  return providerId.startsWith(DEACTIVATED_PROVIDER_PREFIX)\n}\n\nasync function accountProvidersForUser(db: VoyantDb, userId: string): Promise<string[]> {\n  const accounts = await db\n    .select({ providerId: authAccount.providerId })\n    .from(authAccount)\n    .where(eq(authAccount.userId, userId))\n  return accounts.map((account) => account.providerId)\n}\n\nexport async function isLocalMemberDeactivated(db: VoyantDb, userId: string): Promise<boolean> {\n  const providerIds = await accountProvidersForUser(db, userId)\n  return providerIds.length > 0 && providerIds.every(isDeactivatedProviderId)\n}\n\nexport async function isLocalMemberEmailDeactivated(db: VoyantDb, email: string): Promise<boolean> {\n  const accounts = await db\n    .select({ providerId: authAccount.providerId })\n    .from(authAccount)\n    .innerJoin(authUser, eq(authUser.id, authAccount.userId))\n    .where(and(eq(authUser.email, email.trim().toLowerCase()), eq(authAccount.userId, authUser.id)))\n  return (\n    accounts.length > 0 && accounts.every((account) => isDeactivatedProviderId(account.providerId))\n  )\n}\n\nexport async function isLocalMemberSessionActive(\n  db: VoyantDb,\n  sessionId: string,\n  userId: string,\n): Promise<boolean> {\n  const sessions = await db\n    .select({ id: authSession.id })\n    .from(authSession)\n    .where(and(eq(authSession.id, sessionId), eq(authSession.userId, userId)))\n    .limit(1)\n  return sessions.length > 0\n}\n\nexport interface LocalMemberAccessResolver {\n  isEmailDeactivated(email: string): Promise<boolean>\n  isSessionActive(sessionId: string, userId: string): Promise<boolean>\n  isUserDeactivated(userId: string): Promise<boolean>\n}\n\nconst ACCESS_DENIED_MESSAGE = \"This account is deactivated.\"\n\nfunction requestEmail(context: { path?: string; body?: unknown; query?: unknown }): string | null {\n  const path = context.path ?? \"\"\n  if (!path.includes(\"email-otp\") && !path.includes(\"email\") && !path.includes(\"password\")) {\n    return null\n  }\n\n  for (const input of [context.body, context.query]) {\n    if (!input || typeof input !== \"object\") continue\n    const email = (input as Record<string, unknown>).email\n    if (typeof email === \"string\" && email.trim().length > 0) {\n      return email.trim().toLowerCase()\n    }\n  }\n  return null\n}\n\nfunction denyAccess(): never {\n  throw new APIError(\"FORBIDDEN\", { message: ACCESS_DENIED_MESSAGE })\n}\n\nexport function createLocalMemberAccessPlugin(\n  resolver: LocalMemberAccessResolver,\n): BetterAuthPlugin {\n  return {\n    id: \"voyant-local-member-access\",\n    init() {\n      return {\n        options: {\n          databaseHooks: {\n            account: {\n              create: {\n                before: async (account) => {\n                  if (await resolver.isUserDeactivated(account.userId)) denyAccess()\n                },\n              },\n            },\n            session: {\n              create: {\n                before: async (session) => {\n                  if (await resolver.isUserDeactivated(session.userId)) denyAccess()\n                },\n              },\n            },\n          },\n        },\n      }\n    },\n    hooks: {\n      before: [\n        {\n          matcher: () => true,\n          handler: createAuthMiddleware(async (context) => {\n            const session = await getSessionFromCtx(context)\n            if (session) {\n              const [isDeactivated, isSessionActive] = await Promise.all([\n                resolver.isUserDeactivated(session.user.id),\n                resolver.isSessionActive(session.session.id, session.user.id),\n              ])\n              if (isDeactivated || !isSessionActive) {\n                deleteSessionCookie(context)\n                if (context.path === \"/get-session\") return context.json(null)\n                denyAccess()\n              }\n            }\n\n            const email = requestEmail(context)\n            if (email && (await resolver.isEmailDeactivated(email))) denyAccess()\n          }),\n        },\n      ],\n    },\n  }\n}\n"]}
+{"version":3,"file":"local-member-access.js","sourceRoot":"","sources":["../src/local-member-access.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,WAAW,EACX,QAAQ,EACR,mBAAmB,GACpB,MAAM,8BAA8B,CAAA;AAErC,OAAO,EAAE,QAAQ,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AACnF,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AAEzD,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,aAAa,CAAA;AAIzC,MAAM,CAAC,MAAM,2BAA2B,GAAG,qBAAqB,CAAA;AAEhE,MAAM,UAAU,wBAAwB,CAAC,UAAkB,EAAE,MAAwB;IACnF,IAAI,MAAM,KAAK,aAAa,EAAE,CAAC;QAC7B,OAAO,UAAU,CAAC,UAAU,CAAC,2BAA2B,CAAC;YACvD,CAAC,CAAC,UAAU;YACZ,CAAC,CAAC,GAAG,2BAA2B,GAAG,UAAU,EAAE,CAAA;IACnD,CAAC;IACD,OAAO,UAAU,CAAC,UAAU,CAAC,2BAA2B,CAAC;QACvD,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,2BAA2B,CAAC,MAAM,CAAC;QACtD,CAAC,CAAC,UAAU,CAAA;AAChB,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,UAAkB;IACxD,OAAO,UAAU,CAAC,UAAU,CAAC,2BAA2B,CAAC,CAAA;AAC3D,CAAC;AAED,KAAK,UAAU,uBAAuB,CAAC,EAAY,EAAE,MAAc;IACjE,MAAM,QAAQ,GAAG,MAAM,EAAE;SACtB,MAAM,CAAC,EAAE,UAAU,EAAE,WAAW,CAAC,UAAU,EAAE,CAAC;SAC9C,IAAI,CAAC,WAAW,CAAC;SACjB,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IACxC,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;AACtD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,EAAY,EAAE,MAAc;IACzE,MAAM,WAAW,GAAG,MAAM,uBAAuB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;IAC7D,OAAO,WAAW,CAAC,MAAM,GAAG,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAA;AAC7E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,EAAY,EAAE,KAAa;IAC7E,MAAM,QAAQ,GAAG,MAAM,EAAE;SACtB,MAAM,CAAC,EAAE,UAAU,EAAE,WAAW,CAAC,UAAU,EAAE,CAAC;SAC9C,IAAI,CAAC,WAAW,CAAC;SACjB,SAAS,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;SACxD,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IAClG,OAAO,CACL,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,uBAAuB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAChG,CAAA;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,EAAY,EACZ,SAAiB,EACjB,MAAc;IAEd,MAAM,QAAQ,GAAG,MAAM,EAAE;SACtB,MAAM,CAAC,EAAE,EAAE,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC;SAC9B,IAAI,CAAC,WAAW,CAAC;SACjB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;SACzE,KAAK,CAAC,CAAC,CAAC,CAAA;IACX,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAA;AAC5B,CAAC;AAED,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,EAAY,EACZ,SAAiB,EACjB,MAAc;IAEd,MAAM,QAAQ,GAAG,MAAM,EAAE;SACtB,MAAM,CAAC,EAAE,EAAE,EAAE,mBAAmB,CAAC,EAAE,EAAE,CAAC;SACtC,IAAI,CAAC,mBAAmB,CAAC;SACzB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,mBAAmB,CAAC,EAAE,EAAE,SAAS,CAAC,EACrC,EAAE,CAAC,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,EACtC,EAAE,CAAC,mBAAmB,CAAC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,CAC9C,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAA;IACX,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAA;AAC5B,CAAC;AAQD,MAAM,qBAAqB,GAAG,8BAA8B,CAAA;AAE5D,SAAS,YAAY,CAAC,OAA2D;IAC/E,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,EAAE,CAAA;IAC/B,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QACzF,OAAO,IAAI,CAAA;IACb,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAClD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,SAAQ;QACjD,MAAM,KAAK,GAAI,KAAiC,CAAC,KAAK,CAAA;QACtD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzD,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;QACnC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,UAAU;IACjB,MAAM,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC,CAAA;AACrE,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,QAAmC;IAEnC,OAAO;QACL,EAAE,EAAE,4BAA4B;QAChC,IAAI;YACF,OAAO;gBACL,OAAO,EAAE;oBACP,aAAa,EAAE;wBACb,OAAO,EAAE;4BACP,MAAM,EAAE;gCACN,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;oCACxB,IAAI,MAAM,QAAQ,CAAC,iBAAiB,CAAC,OAAO,CAAC,MAAM,CAAC;wCAAE,UAAU,EAAE,CAAA;gCACpE,CAAC;6BACF;yBACF;wBACD,OAAO,EAAE;4BACP,MAAM,EAAE;gCACN,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;oCACxB,IAAI,MAAM,QAAQ,CAAC,iBAAiB,CAAC,OAAO,CAAC,MAAM,CAAC;wCAAE,UAAU,EAAE,CAAA;gCACpE,CAAC;6BACF;yBACF;qBACF;iBACF;aACF,CAAA;QACH,CAAC;QACD,KAAK,EAAE;YACL,MAAM,EAAE;gBACN;oBACE,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI;oBACnB,OAAO,EAAE,oBAAoB,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;wBAC9C,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,CAAA;wBAChD,IAAI,OAAO,EAAE,CAAC;4BACZ,MAAM,CAAC,aAAa,EAAE,eAAe,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gCACzD,QAAQ,CAAC,iBAAiB,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gCAC3C,QAAQ,CAAC,eAAe,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;6BAC9D,CAAC,CAAA;4BACF,IAAI,aAAa,IAAI,CAAC,eAAe,EAAE,CAAC;gCACtC,mBAAmB,CAAC,OAAO,CAAC,CAAA;gCAC5B,IAAI,OAAO,CAAC,IAAI,KAAK,cAAc;oCAAE,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gCAC9D,UAAU,EAAE,CAAA;4BACd,CAAC;wBACH,CAAC;wBAED,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,CAAA;wBACnC,IAAI,KAAK,IAAI,CAAC,MAAM,QAAQ,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;4BAAE,UAAU,EAAE,CAAA;oBACvE,CAAC,CAAC;iBACH;aACF;SACF;KACF,CAAA;AACH,CAAC","sourcesContent":["import {\n  authAccount,\n  authSession,\n  authUser,\n  customerAuthSession,\n} from \"@voyant-travel/db/schema/iam\"\nimport type { VoyantDb } from \"@voyant-travel/hono\"\nimport { APIError, createAuthMiddleware, getSessionFromCtx } from \"better-auth/api\"\nimport { deleteSessionCookie } from \"better-auth/cookies\"\nimport type { BetterAuthPlugin } from \"better-auth/types\"\nimport { and, eq, gt } from \"drizzle-orm\"\n\nimport type { TeamMemberStatus } from \"./team-management-runtime-port.js\"\n\nexport const DEACTIVATED_PROVIDER_PREFIX = \"voyant-deactivated:\"\n\nexport function localProviderIdForStatus(providerId: string, status: TeamMemberStatus): string {\n  if (status === \"deactivated\") {\n    return providerId.startsWith(DEACTIVATED_PROVIDER_PREFIX)\n      ? providerId\n      : `${DEACTIVATED_PROVIDER_PREFIX}${providerId}`\n  }\n  return providerId.startsWith(DEACTIVATED_PROVIDER_PREFIX)\n    ? providerId.slice(DEACTIVATED_PROVIDER_PREFIX.length)\n    : providerId\n}\n\nexport function isDeactivatedProviderId(providerId: string): boolean {\n  return providerId.startsWith(DEACTIVATED_PROVIDER_PREFIX)\n}\n\nasync function accountProvidersForUser(db: VoyantDb, userId: string): Promise<string[]> {\n  const accounts = await db\n    .select({ providerId: authAccount.providerId })\n    .from(authAccount)\n    .where(eq(authAccount.userId, userId))\n  return accounts.map((account) => account.providerId)\n}\n\nexport async function isLocalMemberDeactivated(db: VoyantDb, userId: string): Promise<boolean> {\n  const providerIds = await accountProvidersForUser(db, userId)\n  return providerIds.length > 0 && providerIds.every(isDeactivatedProviderId)\n}\n\nexport async function isLocalMemberEmailDeactivated(db: VoyantDb, email: string): Promise<boolean> {\n  const accounts = await db\n    .select({ providerId: authAccount.providerId })\n    .from(authAccount)\n    .innerJoin(authUser, eq(authUser.id, authAccount.userId))\n    .where(and(eq(authUser.email, email.trim().toLowerCase()), eq(authAccount.userId, authUser.id)))\n  return (\n    accounts.length > 0 && accounts.every((account) => isDeactivatedProviderId(account.providerId))\n  )\n}\n\nexport async function isLocalMemberSessionActive(\n  db: VoyantDb,\n  sessionId: string,\n  userId: string,\n): Promise<boolean> {\n  const sessions = await db\n    .select({ id: authSession.id })\n    .from(authSession)\n    .where(and(eq(authSession.id, sessionId), eq(authSession.userId, userId)))\n    .limit(1)\n  return sessions.length > 0\n}\n\n/** Customer-realm session liveness check used to defeat stale cookie-cache grants. */\nexport async function isCustomerSessionActive(\n  db: VoyantDb,\n  sessionId: string,\n  userId: string,\n): Promise<boolean> {\n  const sessions = await db\n    .select({ id: customerAuthSession.id })\n    .from(customerAuthSession)\n    .where(\n      and(\n        eq(customerAuthSession.id, sessionId),\n        eq(customerAuthSession.userId, userId),\n        gt(customerAuthSession.expiresAt, new Date()),\n      ),\n    )\n    .limit(1)\n  return sessions.length > 0\n}\n\nexport interface LocalMemberAccessResolver {\n  isEmailDeactivated(email: string): Promise<boolean>\n  isSessionActive(sessionId: string, userId: string): Promise<boolean>\n  isUserDeactivated(userId: string): Promise<boolean>\n}\n\nconst ACCESS_DENIED_MESSAGE = \"This account is deactivated.\"\n\nfunction requestEmail(context: { path?: string; body?: unknown; query?: unknown }): string | null {\n  const path = context.path ?? \"\"\n  if (!path.includes(\"email-otp\") && !path.includes(\"email\") && !path.includes(\"password\")) {\n    return null\n  }\n\n  for (const input of [context.body, context.query]) {\n    if (!input || typeof input !== \"object\") continue\n    const email = (input as Record<string, unknown>).email\n    if (typeof email === \"string\" && email.trim().length > 0) {\n      return email.trim().toLowerCase()\n    }\n  }\n  return null\n}\n\nfunction denyAccess(): never {\n  throw new APIError(\"FORBIDDEN\", { message: ACCESS_DENIED_MESSAGE })\n}\n\nexport function createLocalMemberAccessPlugin(\n  resolver: LocalMemberAccessResolver,\n): BetterAuthPlugin {\n  return {\n    id: \"voyant-local-member-access\",\n    init() {\n      return {\n        options: {\n          databaseHooks: {\n            account: {\n              create: {\n                before: async (account) => {\n                  if (await resolver.isUserDeactivated(account.userId)) denyAccess()\n                },\n              },\n            },\n            session: {\n              create: {\n                before: async (session) => {\n                  if (await resolver.isUserDeactivated(session.userId)) denyAccess()\n                },\n              },\n            },\n          },\n        },\n      }\n    },\n    hooks: {\n      before: [\n        {\n          matcher: () => true,\n          handler: createAuthMiddleware(async (context) => {\n            const session = await getSessionFromCtx(context)\n            if (session) {\n              const [isDeactivated, isSessionActive] = await Promise.all([\n                resolver.isUserDeactivated(session.user.id),\n                resolver.isSessionActive(session.session.id, session.user.id),\n              ])\n              if (isDeactivated || !isSessionActive) {\n                deleteSessionCookie(context)\n                if (context.path === \"/get-session\") return context.json(null)\n                denyAccess()\n              }\n            }\n\n            const email = requestEmail(context)\n            if (email && (await resolver.isEmailDeactivated(email))) denyAccess()\n          }),\n        },\n      ],\n    },\n  }\n}\n"]}

package/dist/node-runtime.d.ts

@@ -10,9 +10,10 @@
  */
 import { type NodeDatabaseEnv } from "@voyant-travel/db/runtime";
 import { type SelectApikey } from "@voyant-travel/db/schema/iam";
-import type { Reporter, VoyantDb, VoyantResolvedSessionAuthContext } from "@voyant-travel/hono";
+import { type Reporter, type VoyantDb, type VoyantResolvedSessionAuthContext } from "@voyant-travel/hono";
 import type { AccessCatalog } from "@voyant-travel/types/api-keys";
 import { Hono } from "hono";
+import { type CustomerBuyerAccountPolicy } from "./customer-buyer-accounts.js";
 import { type CreateBetterAuthOptions, type CustomerAuthMethods } from "./server.js";
 type OperatorAuthMode = "local" | "voyant-cloud";
 export interface OperatorAuthNodeEnv extends NodeDatabaseEnv {
@@ -111,6 +112,8 @@ export interface CustomerAuthRuntimeContext {
     baseURL: string;
     trustedOrigins: string[];
     methods: CustomerAuthMethods;
+    /** Buyer capabilities are independent from identity sign-up methods. */
+    accountPolicy?: CustomerBuyerAccountPolicy | null;
 }
 export interface CustomerAuthSocialPolicy {
     enabled: boolean;
@@ -124,6 +127,7 @@ export interface CustomerAuthPolicy {
         facebook: CustomerAuthSocialPolicy;
         apple: CustomerAuthSocialPolicy;
     };
+    accountPolicy: CustomerBuyerAccountPolicy;
 }
 /**
  * Better Auth is dispatched internally without the hosting `/api` prefix, but