@wizeworks/lens-cloud 0.3.0-alpha.3 → 0.3.0-alpha.4

package/dist/auth/plugins.js

@@ -1,9 +1,13 @@
 import { passkey } from "@better-auth/passkey";
 import { haveIBeenPwned, organization, twoFactor } from "better-auth/plugins";
 import { inviteMail } from "../mail/templates.js";
+import { oauthPlugin } from "./oauth.js";
+import { grantPlugin } from "./oauth-grant.js";
 import { appLink } from "./deps.js";
 import { ac, authRoles } from "./roles.js";
 import { orgSchema, passkeySchema, twoFactorSchema } from "./schema-names.js";
+import { stripePlugin } from "../billing/stripe-plugin.js";
+import { scimPlugin } from "./scim.js";
 import { ssoPlugin } from "./sso.js";
 const DAY = 24 * 60 * 60;
 /** Only the cloud creates organizations and only our route deletes one; an invite opens only for its (verified, with mail) email. */
@@ -41,5 +45,15 @@ function passkeyPlugin(deps) {
     const url = new URL(deps.publicUrl);
     return passkey({ rpID: url.hostname, rpName: "WizeLens", origin: deps.trustedOrigins, schema: passkeySchema, authenticatorSelection: { residentKey: "preferred", userVerification: "required" } });
 }
-export const authPlugins = (deps) => [orgPlugin(deps), twoFactorPlugin(), passkeyPlugin(deps), ssoPlugin(deps), ...(deps.checkPwned ? [haveIBeenPwned()] : [])];
+export const authPlugins = (deps) => [
+    orgPlugin(deps),
+    twoFactorPlugin(),
+    passkeyPlugin(deps),
+    ssoPlugin(deps),
+    oauthPlugin(deps),
+    grantPlugin(deps.db),
+    scimPlugin(deps),
+    ...(deps.stripe ? [stripePlugin(deps, deps.stripe)] : []),
+    ...(deps.checkPwned ? [haveIBeenPwned()] : []),
+];
 //# sourceMappingURL=plugins.js.map

package/dist/auth/plugins.js.map

@@ -1 +1 @@
-{"version":3,"file":"plugins.js","sourceRoot":"","sources":["../../src/auth/plugins.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAE/C,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAC9E,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAiB,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAC9E,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAErC,MAAM,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAEzB,qIAAqI;AACrI,SAAS,SAAS,CAAC,IAAc;IAC/B,OAAO,YAAY,CAAC;QAClB,EAAE;QACF,KAAK,EAAE,SAAS;QAChB,WAAW,EAAE,OAAO;QACpB,6BAA6B,EAAE,KAAK;QACpC,iBAAiB,EAAE,EAAE;QACrB,eAAe,EAAE,IAAI;QACrB,mBAAmB,EAAE,CAAC,GAAG,GAAG;QAC5B,eAAe,EAAE,GAAG;QACpB,kCAAkC,EAAE,IAAI;QACxC,oCAAoC,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;QACtD,2BAA2B,EAAE,IAAI;QACjC,MAAM,EAAE,SAAS;QACjB,mBAAmB,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC;KAC5L,CAAC,CAAC;AACL,CAAC;AAED,6GAA6G;AAC7G,SAAS,eAAe;IACtB,OAAO,SAAS,CAAC;QACf,MAAM,EAAE,UAAU;QAClB,MAAM,EAAE,eAAe;QACvB,WAAW,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE;QACtC,iBAAiB,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,gBAAgB,EAAE,WAAW,EAAE;QAC5E,iBAAiB,EAAE,EAAE,GAAG,GAAG;QAC3B,qBAAqB,EAAE,CAAC,GAAG,EAAE;QAC7B,cAAc,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,EAAE,EAAE,eAAe,EAAE,EAAE,GAAG,EAAE,EAAE;KACnF,CAAC,CAAC;AACL,CAAC;AAED,8GAA8G;AAC9G,SAAS,aAAa,CAAC,IAAc;IACnC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACpC,OAAO,OAAO,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,MAAM,EAAE,aAAa,EAAE,sBAAsB,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,gBAAgB,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;AACrM,CAAC;AAED,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,IAAc,EAAsB,EAAE,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,eAAe,EAAE,EAAE,aAAa,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"plugins.js","sourceRoot":"","sources":["../../src/auth/plugins.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAE/C,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAC9E,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAiB,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAC9E,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAErC,MAAM,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAEzB,qIAAqI;AACrI,SAAS,SAAS,CAAC,IAAc;IAC/B,OAAO,YAAY,CAAC;QAClB,EAAE;QACF,KAAK,EAAE,SAAS;QAChB,WAAW,EAAE,OAAO;QACpB,6BAA6B,EAAE,KAAK;QACpC,iBAAiB,EAAE,EAAE;QACrB,eAAe,EAAE,IAAI;QACrB,mBAAmB,EAAE,CAAC,GAAG,GAAG;QAC5B,eAAe,EAAE,GAAG;QACpB,kCAAkC,EAAE,IAAI;QACxC,oCAAoC,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;QACtD,2BAA2B,EAAE,IAAI;QACjC,MAAM,EAAE,SAAS;QACjB,mBAAmB,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC;KAC5L,CAAC,CAAC;AACL,CAAC;AAED,6GAA6G;AAC7G,SAAS,eAAe;IACtB,OAAO,SAAS,CAAC;QACf,MAAM,EAAE,UAAU;QAClB,MAAM,EAAE,eAAe;QACvB,WAAW,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE;QACtC,iBAAiB,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,gBAAgB,EAAE,WAAW,EAAE;QAC5E,iBAAiB,EAAE,EAAE,GAAG,GAAG;QAC3B,qBAAqB,EAAE,CAAC,GAAG,EAAE;QAC7B,cAAc,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,EAAE,EAAE,eAAe,EAAE,EAAE,GAAG,EAAE,EAAE;KACnF,CAAC,CAAC;AACL,CAAC;AAED,8GAA8G;AAC9G,SAAS,aAAa,CAAC,IAAc;IACnC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACpC,OAAO,OAAO,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,MAAM,EAAE,aAAa,EAAE,sBAAsB,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,gBAAgB,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;AACrM,CAAC;AAED,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,IAAc,EAAsB,EAAE,CAAC;IACjE,SAAS,CAAC,IAAI,CAAC;IACf,eAAe,EAAE;IACjB,aAAa,CAAC,IAAI,CAAC;IACnB,SAAS,CAAC,IAAI,CAAC;IACf,WAAW,CAAC,IAAI,CAAC;IACjB,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;IACpB,UAAU,CAAC,IAAI,CAAC;IAChB,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACzD,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;CAC/C,CAAC"}

package/dist/auth/principal.d.ts

@@ -14,6 +14,15 @@ export type Principal = {
     };
 };
 /** The session of this request, read from the database each time (no cookie cache), so a revoked session stops at once. */
+/** A connected app (OAuth) on the MCP route: what its grant lets it read now. Never accepted anywhere else. */
+export interface AppPrincipal {
+    kind: "app";
+    grantId: string;
+    userId: string;
+    /** The app's name, for the audit log. */
+    app: string;
+    projectIds: string[];
+}
 export declare function sessionOf(ctx: Ctx): Promise<{
     user: User;
     sessionId: string;
@@ -31,7 +40,7 @@ export interface ProjectAccess {
     /** "user:<id>" or "key:<id>", for the audit log. */
     actor: string;
     role: Role;
-    principal: Principal;
+    principal: Principal | AppPrincipal;
 }
 /** Access to one project's data, for a person or a read key. */
 export declare function requireProject(ctx: Ctx, projectId: string, permission?: Permission): Promise<ProjectAccess>;

package/dist/auth/principal.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"principal.d.ts","sourceRoot":"","sources":["../../src/auth/principal.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAGrC,OAAO,EAAE,KAAK,MAAM,EAAc,KAAK,OAAO,EAAgB,MAAM,qBAAqB,CAAC;AAC1F,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAO,KAAK,UAAU,EAAE,KAAK,IAAI,EAAE,MAAM,YAAY,CAAC;AAE7D,yGAAyG;AACzG,MAAM,MAAM,SAAS,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,GAAG,EAAE,MAAM,GAAG;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC;AAE3H,2HAA2H;AAC3H,wBAAsB,SAAS,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAAC,CAKhG;AAED,wBAAsB,WAAW,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CAQ1E;AAED,2GAA2G;AAC3G,wBAAsB,WAAW,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAMzD;AAED,mHAAmH;AACnH,wBAAsB,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,IAAI,CAAA;CAAE,CAAC,CAMrH;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,OAAO,CAAC;IACjB,oDAAoD;IACpD,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,IAAI,CAAC;IACX,SAAS,EAAE,SAAS,CAAC;CACtB;AAED,gEAAgE;AAChE,wBAAsB,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,GAAE,UAAmB,GAAG,OAAO,CAAC,aAAa,CAAC,CAWzH"}
+{"version":3,"file":"principal.d.ts","sourceRoot":"","sources":["../../src/auth/principal.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAIrC,OAAO,EAAE,KAAK,MAAM,EAAyB,KAAK,OAAO,EAAgB,MAAM,qBAAqB,CAAC;AACrG,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAO,KAAK,UAAU,EAAE,KAAK,IAAI,EAAE,MAAM,YAAY,CAAC;AAE7D,yGAAyG;AACzG,MAAM,MAAM,SAAS,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,GAAG,EAAE,MAAM,GAAG;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC;AAE3H,2HAA2H;AAC3H,+GAA+G;AAC/G,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,KAAK,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,yCAAyC;IACzC,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,wBAAsB,SAAS,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAAC,CAKhG;AAED,wBAAsB,WAAW,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CAQ1E;AAED,2GAA2G;AAC3G,wBAAsB,WAAW,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAMzD;AAED,mHAAmH;AACnH,wBAAsB,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,IAAI,CAAA;CAAE,CAAC,CAMrH;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,OAAO,CAAC;IACjB,oDAAoD;IACpD,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,IAAI,CAAC;IACX,SAAS,EAAE,SAAS,GAAG,YAAY,CAAC;CACrC;AAED,gEAAgE;AAChE,wBAAsB,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,GAAE,UAAmB,GAAG,OAAO,CAAC,aAAa,CAAC,CAYzH"}

package/dist/auth/principal.js

@@ -1,9 +1,9 @@
 import { fromNodeHeaders } from "better-auth/node";
 import { bearerOf, fail, HttpError } from "../http/http.js";
 import { membership } from "../repo/orgs.js";
-import { keyByToken, projectInOrg } from "../repo/projects.js";
+import { effectiveRole, overridable, projectRoleOf } from "../repo/project-roles.js";
+import { keyAllows, keyByToken, projectInOrg } from "../repo/projects.js";
 import { can } from "./roles.js";
-/** The session of this request, read from the database each time (no cookie cache), so a revoked session stops at once. */
 export async function sessionOf(ctx) {
     const s = await ctx.app.auth.api.getSession({ headers: fromNodeHeaders(ctx.req.headers) });
     if (!s)
@@ -15,7 +15,7 @@ export async function principalOf(ctx) {
     const bearer = bearerOf(ctx.req);
     if (bearer?.startsWith("wl_rk_")) {
         const key = await keyByToken(ctx.app.db, bearer, ctx.app.config.now());
-        return key?.kind === "read" ? { kind: "key", key } : undefined;
+        return key?.kind === "read" && keyAllows(key, "api") ? { kind: "key", key } : undefined;
     }
     const s = await sessionOf(ctx);
     return s ? { kind: "user", ...s } : undefined;
@@ -50,13 +50,14 @@ export async function requireProject(ctx, projectId, permission = "read") {
     const [row] = await ctx.app.db.query("SELECT org_id FROM projects WHERE id = $1", [projectId]);
     const m = row ? await membership(ctx.app.db, p.user.id, row.org_id) : undefined;
     const project = m ? await projectInOrg(ctx.app.db, m.id, projectId) : undefined;
-    if (!m || !project)
+    const role = m && project ? effectiveRole(m.role, overridable(m.role) ? await projectRoleOf(ctx.app.db, projectId, p.user.id) : undefined) : null;
+    if (!role || !project)
         return fail(404, "Project not found.");
-    if (!can(m.role, permission))
-        fail(403, `Your role (${m.role}) cannot do this.`);
+    if (!can(role, permission))
+        fail(403, `Your role (${role}) cannot do this.`);
     if (permission !== "read")
         await requireUser(ctx);
-    return { project, actor: `user:${p.user.id}`, role: m.role, principal: p };
+    return { project, actor: `user:${p.user.id}`, role, principal: p };
 }
 async function keyAccess(ctx, p, projectId, permission) {
     if (permission !== "read")

package/dist/auth/principal.js.map

@@ -1 +1 @@
-{"version":3,"file":"principal.js","sourceRoot":"","sources":["../../src/auth/principal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAEnD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAe,UAAU,EAAgB,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAE1F,OAAO,EAAE,GAAG,EAA8B,MAAM,YAAY,CAAC;AAK7D,2HAA2H;AAC3H,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,GAAQ;IACtC,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC3F,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACzB,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC;IAClD,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;AAC5H,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAQ;IACxC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;QACvE,OAAO,GAAG,EAAE,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACjE,CAAC;IACD,MAAM,CAAC,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;IAC/B,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAChD,CAAC;AAED,2GAA2G;AAC3G,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAQ;IACxC,MAAM,CAAC,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,CAAC,EAAE,IAAI,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC;IACvC,IAAI,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,KAAK,WAAW;QAAE,IAAI,CAAC,GAAG,EAAE,uCAAuC,CAAC,CAAC;IACjI,OAAO,CAAC,CAAC,IAAI,CAAC;AAChB,CAAC;AAED,mHAAmH;AACnH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAQ,EAAE,KAAa,EAAE,UAAsB;IAC9E,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,CAAC,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IACvD,IAAI,CAAC,CAAC;QAAE,IAAI,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAC;IAC7C,IAAI,CAAC,GAAG,CAAC,CAAE,CAAC,IAAI,EAAE,UAAU,CAAC;QAAE,IAAI,CAAC,GAAG,EAAE,cAAc,CAAE,CAAC,IAAI,mBAAmB,CAAC,CAAC;IACnF,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAE,CAAC,IAAI,EAAE,CAAC;AACjC,CAAC;AAUD,gEAAgE;AAChE,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,GAAQ,EAAE,SAAiB,EAAE,UAAU,GAAe,MAAM;IAC/F,MAAM,CAAC,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC,GAAG,EAAE,8BAA8B,CAAC,CAAC;IACzD,IAAI,CAAC,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,SAAS,CAAC,GAAG,EAAE,CAAC,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;IACtE,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAqB,2CAA2C,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;IACnH,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAChF,MAAM,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAChF,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;IAC3D,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC;QAAE,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC,IAAI,mBAAmB,CAAC,CAAC;IACjF,IAAI,UAAU,KAAK,MAAM;QAAE,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;IAClD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;AAC7E,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,GAAQ,EAAE,CAA8B,EAAE,SAAiB,EAAE,UAAsB;IAC1G,IAAI,UAAU,KAAK,MAAM;QAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,0BAA0B,CAAC,CAAC;IAChF,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1H,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;IACrD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;AAC7E,CAAC"}
+{"version":3,"file":"principal.js","sourceRoot":"","sources":["../../src/auth/principal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAEnD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACrF,OAAO,EAAe,SAAS,EAAE,UAAU,EAAgB,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAErG,OAAO,EAAE,GAAG,EAA8B,MAAM,YAAY,CAAC;AAgB7D,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,GAAQ;IACtC,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC3F,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACzB,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC;IAClD,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;AAC5H,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAQ;IACxC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;QACvE,OAAO,GAAG,EAAE,IAAI,KAAK,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1F,CAAC;IACD,MAAM,CAAC,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;IAC/B,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAChD,CAAC;AAED,2GAA2G;AAC3G,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAQ;IACxC,MAAM,CAAC,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,CAAC,EAAE,IAAI,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC;IACvC,IAAI,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,KAAK,WAAW;QAAE,IAAI,CAAC,GAAG,EAAE,uCAAuC,CAAC,CAAC;IACjI,OAAO,CAAC,CAAC,IAAI,CAAC;AAChB,CAAC;AAED,mHAAmH;AACnH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAQ,EAAE,KAAa,EAAE,UAAsB;IAC9E,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,CAAC,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IACvD,IAAI,CAAC,CAAC;QAAE,IAAI,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAC;IAC7C,IAAI,CAAC,GAAG,CAAC,CAAE,CAAC,IAAI,EAAE,UAAU,CAAC;QAAE,IAAI,CAAC,GAAG,EAAE,cAAc,CAAE,CAAC,IAAI,mBAAmB,CAAC,CAAC;IACnF,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAE,CAAC,IAAI,EAAE,CAAC;AACjC,CAAC;AAUD,gEAAgE;AAChE,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,GAAQ,EAAE,SAAiB,EAAE,UAAU,GAAe,MAAM;IAC/F,MAAM,CAAC,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC,GAAG,EAAE,8BAA8B,CAAC,CAAC;IACzD,IAAI,CAAC,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,SAAS,CAAC,GAAG,EAAE,CAAC,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;IACtE,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAqB,2CAA2C,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;IACnH,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAChF,MAAM,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAChF,MAAM,IAAI,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAClJ,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;IAC9D,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC;QAAE,IAAI,CAAC,GAAG,EAAE,cAAc,IAAI,mBAAmB,CAAC,CAAC;IAC7E,IAAI,UAAU,KAAK,MAAM;QAAE,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;IAClD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;AACrE,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,GAAQ,EAAE,CAA8B,EAAE,SAAiB,EAAE,UAAsB;IAC1G,IAAI,UAAU,KAAK,MAAM;QAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,0BAA0B,CAAC,CAAC;IAChF,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1H,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;IACrD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;AAC7E,CAAC"}

package/dist/auth/roles.d.ts

@@ -16,6 +16,7 @@ export declare const ac: {
         readonly alert: readonly ["read", "create", "update", "delete"];
         readonly share: readonly ["create", "revoke"];
         readonly audit: readonly ["read"];
+        readonly tag: readonly ["create", "update", "delete"];
     }, TRoleStatements>): import("better-auth/plugins/access").Role<import("better-auth/plugins/access").ExactRoleStatements<TRoleStatements>, {
         readonly organization: readonly ["update", "delete"];
         readonly member: readonly ["create", "update", "delete"];
@@ -27,6 +28,7 @@ export declare const ac: {
         readonly alert: readonly ["read", "create", "update", "delete"];
         readonly share: readonly ["create", "revoke"];
         readonly audit: readonly ["read"];
+        readonly tag: readonly ["create", "update", "delete"];
     }>;
     statements: {
         readonly organization: readonly ["update", "delete"];
@@ -39,11 +41,12 @@ export declare const ac: {
         readonly alert: readonly ["read", "create", "update", "delete"];
         readonly share: readonly ["create", "revoke"];
         readonly audit: readonly ["read"];
+        readonly tag: readonly ["create", "update", "delete"];
     };
 };
 export declare const authRoles: Record<Role, ReturnType<typeof ac.newRole>>;
-/** What our own routes check. Read: data, members. Write: alerts, shares. Manage: projects, keys, settings. Own: delete the organization. */
-export type Permission = "read" | "write" | "manage" | "own";
+/** What our own routes check. Read: data, members. Write: alerts, shares. Tag: tag rules. Manage: projects, keys, settings. Own: delete the organization. */
+export type Permission = "read" | "write" | "tag" | "manage" | "own";
 export declare const can: (role: Role, permission: Permission) => boolean;
 /** An admin may not give a role above their own. */
 export declare const canGrant: (actor: Role, target: Role) => boolean;

package/dist/auth/roles.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"roles.d.ts","sourceRoot":"","sources":["../../src/auth/roles.ts"],"names":[],"mappings":"AAAA,OAAO,EAA6D,KAAK,OAAO,EAAsC,MAAM,sBAAsB,CAAC;AAGnJ,0DAA0D;AAC1D,eAAO,MAAM,KAAK,iDAAY,CAAC;AAC/B,MAAM,MAAM,IAAI,GAAG,OAAO,CAAC;AAC3B,eAAO,MAAM,MAAM,8BAAY,CAAC;AAEhC,mEAAmE;AACnE,eAAO,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAAyC,CAAC;AACzD,eAAO,MAAM,SAAS,EAAgH,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;AAElL,6IAA6I;AAC7I,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,OAAO,GAAG,QAAQ,GAAG,KAAK,CAAC;AAS7D,eAAO,MAAM,GAAG,SAAU,IAAI,cAAc,UAAU,KAAG,OAA8C,CAAC;AAExG,oDAAoD;AACpD,eAAO,MAAM,QAAQ,UAAW,IAAI,UAAU,IAAI,KAAG,OAAgD,CAAC"}
+{"version":3,"file":"roles.d.ts","sourceRoot":"","sources":["../../src/auth/roles.ts"],"names":[],"mappings":"AAAA,OAAO,EAA6D,KAAK,OAAO,EAAsC,MAAM,sBAAsB,CAAC;AAGnJ,0DAA0D;AAC1D,eAAO,MAAM,KAAK,iDAAY,CAAC;AAC/B,MAAM,MAAM,IAAI,GAAG,OAAO,CAAC;AAC3B,eAAO,MAAM,MAAM,8BAAY,CAAC;AAEhC,mEAAmE;AACnE,eAAO,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAAyC,CAAC;AACzD,eAAO,MAAM,SAAS,EAAgH,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;AAElL,6JAA6J;AAC7J,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,OAAO,GAAG,KAAK,GAAG,QAAQ,GAAG,KAAK,CAAC;AAUrE,eAAO,MAAM,GAAG,SAAU,IAAI,cAAc,UAAU,KAAG,OAA8C,CAAC;AAExG,oDAAoD;AACpD,eAAO,MAAM,QAAQ,UAAW,IAAI,UAAU,IAAI,KAAG,OAAgD,CAAC"}

package/dist/auth/roles.js

@@ -9,6 +9,7 @@ export const authRoles = Object.fromEntries(ROLES.map((r) => [r, ac.newRole(ROLE
 const NEEDS = {
     read: { project: ["read"] },
     write: { alert: ["create"], share: ["create"] },
+    tag: { tag: ["create", "update", "delete"] },
     manage: { project: ["create"], key: ["create"] },
     own: { organization: ["delete"] },
 };

package/dist/auth/roles.js.map

@@ -1 +1 @@
-{"version":3,"file":"roles.js","sourceRoot":"","sources":["../../src/auth/roles.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAoB,SAAS,EAAE,SAAS,EAAgB,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACnJ,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAEjE,0DAA0D;AAC1D,MAAM,CAAC,MAAM,KAAK,GAAG,SAAS,CAAC;AAE/B,MAAM,CAAC,MAAM,MAAM,GAAG,SAAS,CAAC;AAEhC,mEAAmE;AACnE,MAAM,CAAC,MAAM,EAAE,GAAG,mBAAmB,CAAC,iBAAiB,CAAC,CAAC;AACzD,MAAM,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAqC,CAAC,CAAC,CAAC,CAAgD,CAAC;AAKlL,MAAM,KAAK,GAAoC;IAC7C,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE;IAC3B,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,EAAE;IAC/C,MAAM,EAAE,EAAE,OAAO,EAAE,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE;IAChD,GAAG,EAAE,EAAE,YAAY,EAAE,CAAC,QAAQ,CAAC,EAAE;CAClC,CAAC;AAEF,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,IAAU,EAAE,UAAsB,EAAW,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;AAExG,oDAAoD;AACpD,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,KAAW,EAAE,MAAY,EAAW,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC"}
+{"version":3,"file":"roles.js","sourceRoot":"","sources":["../../src/auth/roles.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAoB,SAAS,EAAE,SAAS,EAAgB,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACnJ,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAEjE,0DAA0D;AAC1D,MAAM,CAAC,MAAM,KAAK,GAAG,SAAS,CAAC;AAE/B,MAAM,CAAC,MAAM,MAAM,GAAG,SAAS,CAAC;AAEhC,mEAAmE;AACnE,MAAM,CAAC,MAAM,EAAE,GAAG,mBAAmB,CAAC,iBAAiB,CAAC,CAAC;AACzD,MAAM,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAqC,CAAC,CAAC,CAAC,CAAgD,CAAC;AAKlL,MAAM,KAAK,GAAoC;IAC7C,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE;IAC3B,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,EAAE;IAC/C,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE;IAC5C,MAAM,EAAE,EAAE,OAAO,EAAE,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE;IAChD,GAAG,EAAE,EAAE,YAAY,EAAE,CAAC,QAAQ,CAAC,EAAE;CAClC,CAAC;AAEF,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,IAAU,EAAE,UAAsB,EAAW,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;AAExG,oDAAoD;AACpD,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,KAAW,EAAE,MAAY,EAAW,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC"}

package/dist/auth/schema-names.d.ts

@@ -114,6 +114,39 @@ export declare const passkeySchema: {
         };
     };
 };
+/** Better Auth's Stripe plugin: the organization is the Stripe customer and owns the subscription (billing/stripe-plugin.ts). */
+export declare const stripeSchema: {
+    user: {
+        modelName: string;
+        fields: {
+            stripeCustomerId: string;
+        };
+    };
+    organization: {
+        modelName: string;
+        fields: {
+            stripeCustomerId: string;
+        };
+    };
+    subscription: {
+        modelName: string;
+        fields: {
+            referenceId: string;
+            stripeCustomerId: string;
+            stripeSubscriptionId: string;
+            periodStart: string;
+            periodEnd: string;
+            trialStart: string;
+            trialEnd: string;
+            cancelAtPeriodEnd: string;
+            cancelAt: string;
+            canceledAt: string;
+            endedAt: string;
+            billingInterval: string;
+            stripeScheduleId: string;
+        };
+    };
+};
 export declare const ssoSchema: {
     ssoProvider: {
         modelName: string;

package/dist/auth/schema-names.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema-names.d.ts","sourceRoot":"","sources":["../../src/auth/schema-names.ts"],"names":[],"mappings":"AACA,eAAO,MAAM,SAAS;IAAK,SAAS;IAAW,MAAM;QAAI,aAAa;QAAoB,SAAS;QAAgB,SAAS;;CAAkB,CAAC;AAE/I,eAAO,MAAM,YAAY;IACvB,SAAS;IACT,MAAM;QAAI,SAAS;QAAgB,SAAS;QAAgB,SAAS;QAAgB,SAAS;QAAgB,SAAS;QAAgB,MAAM;;CAC9I,CAAC;AAEF,eAAO,MAAM,YAAY;IACvB,SAAS;IACT,MAAM;QACJ,SAAS;QACT,UAAU;QACV,MAAM;QACN,WAAW;QACX,YAAY;QACZ,OAAO;QACP,oBAAoB;QACpB,qBAAqB;QACrB,SAAS;QACT,SAAS;;CAEZ,CAAC;AAEF,eAAO,MAAM,iBAAiB;IAAK,SAAS;IAAmB,MAAM;QAAI,SAAS;QAAgB,SAAS;QAAgB,SAAS;;CAAkB,CAAC;AAEvJ,eAAO,MAAM,cAAc;IAAK,SAAS;IAAiB,MAAM;QAAI,WAAW;;CAAoB,CAAC;AAEpG,eAAO,MAAM,SAAS;aACpB,OAAO;iBAAI,MAAM;qBAAI,oBAAoB,EAAE,eAAe;;;aAC1D,YAAY;iBACV,SAAS,EAAE,MAAM;iBACjB,MAAM;qBAAI,SAAS,EAAE,YAAY;;iBACjC,gBAAgB;qBAAI,aAAa;yBAAI,IAAI,EAAE,QAAQ;yBAAE,QAAQ;yBAAQ,YAAY,EAAE,EAAE;yBAAE,KAAK;yBAAS,SAAS,EAAE,gBAAgB;;;;aAElI,MAAM;iBAAI,SAAS,EAAE,SAAS;iBAAE,MAAM;qBAAI,cAAc,EAAE,QAAQ;qBAAE,MAAM,EAAE,SAAS;qBAAE,SAAS,EAAE,YAAY;;;aAC9G,UAAU;iBAAI,SAAS,EAAE,SAAS;iBAAE,MAAM;qBAAI,cAAc,EAAE,QAAQ;qBAAE,SAAS,EAAE,YAAY;qBAAE,SAAS,EAAE,YAAY;qBAAE,SAAS,EAAE,YAAY;;;CACzI,CAAC;AAEX,eAAO,MAAM,eAAe;IAC1B,IAAI;QAAI,MAAM;YAAI,gBAAgB;;;IAClC,SAAS;QACP,SAAS;QACT,MAAM;YAAI,WAAW;YAAkB,MAAM;YAAa,uBAAuB;YAA+B,WAAW;;;CAE9H,CAAC;AAEF,eAAO,MAAM,aAAa;IACxB,OAAO;QACL,SAAS;QACT,MAAM;YAAI,SAAS;YAAgB,MAAM;YAAa,YAAY;YAAmB,UAAU;YAAiB,QAAQ;YAAe,SAAS;;;CAEnJ,CAAC;AAEF,eAAO,MAAM,SAAS;IACpB,WAAW;QACT,SAAS;QACT,MAAM;YAAI,UAAU;YAAiB,UAAU;YAAiB,UAAU;YAAiB,MAAM;YAAa,cAAc;YAAY,cAAc;;;CAEzJ,CAAC"}
+{"version":3,"file":"schema-names.d.ts","sourceRoot":"","sources":["../../src/auth/schema-names.ts"],"names":[],"mappings":"AACA,eAAO,MAAM,SAAS;IAAK,SAAS;IAAW,MAAM;QAAI,aAAa;QAAoB,SAAS;QAAgB,SAAS;;CAAkB,CAAC;AAE/I,eAAO,MAAM,YAAY;IACvB,SAAS;IACT,MAAM;QAAI,SAAS;QAAgB,SAAS;QAAgB,SAAS;QAAgB,SAAS;QAAgB,SAAS;QAAgB,MAAM;;CAC9I,CAAC;AAEF,eAAO,MAAM,YAAY;IACvB,SAAS;IACT,MAAM;QACJ,SAAS;QACT,UAAU;QACV,MAAM;QACN,WAAW;QACX,YAAY;QACZ,OAAO;QACP,oBAAoB;QACpB,qBAAqB;QACrB,SAAS;QACT,SAAS;;CAEZ,CAAC;AAEF,eAAO,MAAM,iBAAiB;IAAK,SAAS;IAAmB,MAAM;QAAI,SAAS;QAAgB,SAAS;QAAgB,SAAS;;CAAkB,CAAC;AAEvJ,eAAO,MAAM,cAAc;IAAK,SAAS;IAAiB,MAAM;QAAI,WAAW;;CAAoB,CAAC;AAEpG,eAAO,MAAM,SAAS;aACpB,OAAO;iBAAI,MAAM;qBAAI,oBAAoB,EAAE,eAAe;;;aAC1D,YAAY;iBACV,SAAS,EAAE,MAAM;iBACjB,MAAM;qBAAI,SAAS,EAAE,YAAY;;iBACjC,gBAAgB;qBAAI,aAAa;yBAAI,IAAI,EAAE,QAAQ;yBAAE,QAAQ;yBAAQ,YAAY,EAAE,EAAE;yBAAE,KAAK;yBAAS,SAAS,EAAE,gBAAgB;;;;aAElI,MAAM;iBAAI,SAAS,EAAE,SAAS;iBAAE,MAAM;qBAAI,cAAc,EAAE,QAAQ;qBAAE,MAAM,EAAE,SAAS;qBAAE,SAAS,EAAE,YAAY;;;aAC9G,UAAU;iBAAI,SAAS,EAAE,SAAS;iBAAE,MAAM;qBAAI,cAAc,EAAE,QAAQ;qBAAE,SAAS,EAAE,YAAY;qBAAE,SAAS,EAAE,YAAY;qBAAE,SAAS,EAAE,YAAY;;;CACzI,CAAC;AAEX,eAAO,MAAM,eAAe;IAC1B,IAAI;QAAI,MAAM;YAAI,gBAAgB;;;IAClC,SAAS;QACP,SAAS;QACT,MAAM;YAAI,WAAW;YAAkB,MAAM;YAAa,uBAAuB;YAA+B,WAAW;;;CAE9H,CAAC;AAEF,eAAO,MAAM,aAAa;IACxB,OAAO;QACL,SAAS;QACT,MAAM;YAAI,SAAS;YAAgB,MAAM;YAAa,YAAY;YAAmB,UAAU;YAAiB,QAAQ;YAAe,SAAS;;;CAEnJ,CAAC;AAEF,iIAAiI;AACjI,eAAO,MAAM,YAAY;IACvB,IAAI;QAAI,SAAS;QAAW,MAAM;YAAI,gBAAgB;;;IACtD,YAAY;QAAI,SAAS;QAAU,MAAM;YAAI,gBAAgB;;;IAC7D,YAAY;QACV,SAAS;QACT,MAAM;YACJ,WAAW;YACX,gBAAgB;YAChB,oBAAoB;YACpB,WAAW;YACX,SAAS;YACT,UAAU;YACV,QAAQ;YACR,iBAAiB;YACjB,QAAQ;YACR,UAAU;YACV,OAAO;YACP,eAAe;YACf,gBAAgB;;;CAGrB,CAAC;AAEF,eAAO,MAAM,SAAS;IACpB,WAAW;QACT,SAAS;QACT,MAAM;YAAI,UAAU;YAAiB,UAAU;YAAiB,UAAU;YAAiB,MAAM;YAAa,cAAc;YAAY,cAAc;;;CAEzJ,CAAC"}

package/dist/auth/schema-names.js

@@ -44,6 +44,29 @@ export const passkeySchema = {
         fields: { publicKey: "public_key", userId: "user_id", credentialID: "credential_id", deviceType: "device_type", backedUp: "backed_up", createdAt: "created_at" },
     },
 };
+/** Better Auth's Stripe plugin: the organization is the Stripe customer and owns the subscription (billing/stripe-plugin.ts). */
+export const stripeSchema = {
+    user: { modelName: "users", fields: { stripeCustomerId: "stripe_customer_id" } },
+    organization: { modelName: "orgs", fields: { stripeCustomerId: "stripe_customer_id" } },
+    subscription: {
+        modelName: "subscriptions",
+        fields: {
+            referenceId: "reference_id",
+            stripeCustomerId: "stripe_customer_id",
+            stripeSubscriptionId: "stripe_subscription_id",
+            periodStart: "period_start",
+            periodEnd: "period_end",
+            trialStart: "trial_start",
+            trialEnd: "trial_end",
+            cancelAtPeriodEnd: "cancel_at_period_end",
+            cancelAt: "cancel_at",
+            canceledAt: "canceled_at",
+            endedAt: "ended_at",
+            billingInterval: "billing_interval",
+            stripeScheduleId: "stripe_schedule_id",
+        },
+    },
+};
 export const ssoSchema = {
     ssoProvider: {
         modelName: "sso_providers",

package/dist/auth/schema-names.js.map

@@ -1 +1 @@
-{"version":3,"file":"schema-names.js","sourceRoot":"","sources":["../../src/auth/schema-names.ts"],"names":[],"mappings":"AAAA,iIAAiI;AACjI,MAAM,CAAC,MAAM,SAAS,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,aAAa,EAAE,gBAAgB,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,EAAE,CAAC;AAE/I,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,SAAS,EAAE,UAAU;IACrB,MAAM,EAAE,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE;CAC3J,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,SAAS,EAAE,UAAU;IACrB,MAAM,EAAE;QACN,SAAS,EAAE,YAAY;QACvB,UAAU,EAAE,aAAa;QACzB,MAAM,EAAE,SAAS;QACjB,WAAW,EAAE,cAAc;QAC3B,YAAY,EAAE,eAAe;QAC7B,OAAO,EAAE,UAAU;QACnB,oBAAoB,EAAE,yBAAyB;QAC/C,qBAAqB,EAAE,0BAA0B;QACjD,SAAS,EAAE,YAAY;QACvB,SAAS,EAAE,YAAY;KACxB;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,EAAE,CAAC;AAEvJ,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,cAAc,EAAE,EAAE,CAAC;AAEpG,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,oBAAoB,EAAE,eAAe,EAAE,EAAE;IAC9D,YAAY,EAAE;QACZ,SAAS,EAAE,MAAM;QACjB,MAAM,EAAE,EAAE,SAAS,EAAE,YAAY,EAAE;QACnC,gBAAgB,EAAE,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,gBAAgB,EAAE,EAAE;KACrI;IACD,MAAM,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,EAAE;IAClH,UAAU,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,cAAc,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,EAAE;CAC7I,CAAC;AAEX,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,EAAE;IAC5D,SAAS,EAAE;QACT,SAAS,EAAE,aAAa;QACxB,MAAM,EAAE,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,EAAE,SAAS,EAAE,uBAAuB,EAAE,2BAA2B,EAAE,WAAW,EAAE,cAAc,EAAE;KAC9I;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,OAAO,EAAE;QACP,SAAS,EAAE,UAAU;QACrB,MAAM,EAAE,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,eAAe,EAAE,UAAU,EAAE,aAAa,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,YAAY,EAAE;KACjK;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,WAAW,EAAE;QACX,SAAS,EAAE,eAAe;QAC1B,MAAM,EAAE,EAAE,UAAU,EAAE,aAAa,EAAE,UAAU,EAAE,aAAa,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,QAAQ,EAAE,cAAc,EAAE,iBAAiB,EAAE;KAC5K;CACF,CAAC"}
+{"version":3,"file":"schema-names.js","sourceRoot":"","sources":["../../src/auth/schema-names.ts"],"names":[],"mappings":"AAAA,iIAAiI;AACjI,MAAM,CAAC,MAAM,SAAS,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,aAAa,EAAE,gBAAgB,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,EAAE,CAAC;AAE/I,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,SAAS,EAAE,UAAU;IACrB,MAAM,EAAE,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE;CAC3J,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,SAAS,EAAE,UAAU;IACrB,MAAM,EAAE;QACN,SAAS,EAAE,YAAY;QACvB,UAAU,EAAE,aAAa;QACzB,MAAM,EAAE,SAAS;QACjB,WAAW,EAAE,cAAc;QAC3B,YAAY,EAAE,eAAe;QAC7B,OAAO,EAAE,UAAU;QACnB,oBAAoB,EAAE,yBAAyB;QAC/C,qBAAqB,EAAE,0BAA0B;QACjD,SAAS,EAAE,YAAY;QACvB,SAAS,EAAE,YAAY;KACxB;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,EAAE,CAAC;AAEvJ,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,cAAc,EAAE,EAAE,CAAC;AAEpG,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,oBAAoB,EAAE,eAAe,EAAE,EAAE;IAC9D,YAAY,EAAE;QACZ,SAAS,EAAE,MAAM;QACjB,MAAM,EAAE,EAAE,SAAS,EAAE,YAAY,EAAE;QACnC,gBAAgB,EAAE,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,gBAAgB,EAAE,EAAE;KACrI;IACD,MAAM,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,EAAE;IAClH,UAAU,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,cAAc,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,EAAE;CAC7I,CAAC;AAEX,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,EAAE;IAC5D,SAAS,EAAE;QACT,SAAS,EAAE,aAAa;QACxB,MAAM,EAAE,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,EAAE,SAAS,EAAE,uBAAuB,EAAE,2BAA2B,EAAE,WAAW,EAAE,cAAc,EAAE;KAC9I;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,OAAO,EAAE;QACP,SAAS,EAAE,UAAU;QACrB,MAAM,EAAE,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,eAAe,EAAE,UAAU,EAAE,aAAa,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,YAAY,EAAE;KACjK;CACF,CAAC;AAEF,iIAAiI;AACjI,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,IAAI,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,EAAE;IAChF,YAAY,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,EAAE;IACvF,YAAY,EAAE;QACZ,SAAS,EAAE,eAAe;QAC1B,MAAM,EAAE;YACN,WAAW,EAAE,cAAc;YAC3B,gBAAgB,EAAE,oBAAoB;YACtC,oBAAoB,EAAE,wBAAwB;YAC9C,WAAW,EAAE,cAAc;YAC3B,SAAS,EAAE,YAAY;YACvB,UAAU,EAAE,aAAa;YACzB,QAAQ,EAAE,WAAW;YACrB,iBAAiB,EAAE,sBAAsB;YACzC,QAAQ,EAAE,WAAW;YACrB,UAAU,EAAE,aAAa;YACzB,OAAO,EAAE,UAAU;YACnB,eAAe,EAAE,kBAAkB;YACnC,gBAAgB,EAAE,oBAAoB;SACvC;KACF;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,WAAW,EAAE;QACX,SAAS,EAAE,eAAe;QAC1B,MAAM,EAAE,EAAE,UAAU,EAAE,aAAa,EAAE,UAAU,EAAE,aAAa,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,QAAQ,EAAE,cAAc,EAAE,iBAAiB,EAAE;KAC5K;CACF,CAAC"}

package/dist/auth/scim.d.ts

@@ -0,0 +1,6 @@
+import type { BetterAuthPlugin } from "better-auth";
+import type { AuthDeps } from "./deps.js";
+export declare const scimConnectionId: (orgId: string) => string;
+/** SCIM tokens work only while the organization's plan has SCIM (Business and Enterprise, or any plan with billing off). */
+export declare function scimPlugin(deps: AuthDeps): BetterAuthPlugin;
+//# sourceMappingURL=scim.d.ts.map

package/dist/auth/scim.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scim.d.ts","sourceRoot":"","sources":["../../src/auth/scim.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAGpD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAK1C,eAAO,MAAM,gBAAgB,UAAW,MAAM,WAAmB,CAAC;AAwClE,4HAA4H;AAC5H,wBAAgB,UAAU,CAAC,IAAI,EAAE,QAAQ,GAAG,gBAAgB,CAc3D"}

package/dist/auth/scim.js

@@ -0,0 +1,56 @@
+import { scim } from "@better-auth/scim";
+import { orgHas } from "../repo/billing.js";
+import { scimTokenOf } from "../repo/scim-tokens.js";
+// SCIM 2.0 provisioning from an identity provider (Okta, Entra ID): one connection per organization, its tokens in scim_tokens.
+const SCOPES = ["scim.users.read", "scim.users.write", "scim.groups.read", "scim.groups.write"];
+export const scimConnectionId = (orgId) => `org-${orgId}`;
+/** An existing account joins only when its email is confirmed and it is already a member, or at the organization's proven SSO domain. */
+async function resolveUser(db, orgId, email) {
+    const user = await db.findOne({ model: "user", where: [{ field: "email", value: email.trim().toLowerCase() }] });
+    if (!user?.emailVerified)
+        return { action: "create" };
+    const member = await db.findOne({ model: "member", where: [{ field: "organizationId", value: orgId }, { field: "userId", value: user.id }] });
+    const at = email.trim().toLowerCase().split("@")[1] ?? "";
+    const providers = await db.findMany({ model: "ssoProvider", where: [{ field: "organizationId", value: orgId }] });
+    const proven = providers.some((p) => p.domainVerified === true && p.domain.toLowerCase().split(",").map((d) => d.trim()).includes(at));
+    return member || proven ? { action: "link", userId: user.id, profile: "preserve" } : { action: "create" };
+}
+/** Active people are members of the organization; deactivated ones leave it (owners stay, so it keeps one). */
+async function reconcile(state, { database }) {
+    const where = [{ field: "organizationId", value: state.provisioningDomainId }, { field: "userId", value: state.userId }];
+    const member = await database.findOne({ model: "member", where });
+    if (state.active && !member) {
+        await database.create({ model: "member", data: { organizationId: state.provisioningDomainId, userId: state.userId, role: "member", createdAt: new Date() } });
+    }
+    else if (!state.active && member && member.role !== "owner") {
+        await database.delete({ model: "member", where: [{ field: "id", value: member.id }] });
+    }
+}
+const snake = (s) => s.replace(/[A-Z]/g, (c) => `_${c.toLowerCase()}`);
+/** The plugin's tables and columns in our snake_case (db/schema-scim.ts): scimUser becomes scim_users, userId becomes user_id. */
+function snakeTables(plugin) {
+    for (const [model, table] of Object.entries(plugin.schema ?? {})) {
+        table.modelName = `${snake(model)}s`;
+        for (const [name, field] of Object.entries(table.fields))
+            field.fieldName = snake(name);
+    }
+    return plugin;
+}
+/** SCIM tokens work only while the organization's plan has SCIM (Business and Enterprise, or any plan with billing off). */
+export function scimPlugin(deps) {
+    const plugin = scim({
+        connections: [],
+        authentication: {
+            verifyBearerToken: async ({ token }) => {
+                const found = await scimTokenOf(deps.db, token, Date.now());
+                if (!found || !(await orgHas(deps.db, found.orgId, deps.billingOn, "scim")))
+                    return null;
+                return { connection: { id: scimConnectionId(found.orgId), provisioningDomainId: found.orgId }, credentialId: found.id, scopes: SCOPES };
+            },
+        },
+        identity: { resolveUser: ({ provisioningDomainId, resource }, { database }) => resolveUser(database, provisioningDomainId, resource.primaryEmail) },
+        projection: { reconcileUser: reconcile },
+    });
+    return snakeTables(plugin);
+}
+//# sourceMappingURL=scim.js.map

package/dist/auth/scim.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scim.js","sourceRoot":"","sources":["../../src/auth/scim.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAyG,MAAM,mBAAmB,CAAC;AAEhJ,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAGrD,gIAAgI;AAEhI,MAAM,MAAM,GAAyB,CAAC,iBAAiB,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,mBAAmB,CAAC,CAAC;AACtH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,OAAO,KAAK,EAAE,CAAC;AAOlE,yIAAyI;AACzI,KAAK,UAAU,WAAW,CAAC,EAAU,EAAE,KAAa,EAAE,KAAa;IACjE,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAAyC,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;IACzJ,IAAI,CAAC,IAAI,EAAE,aAAa;QAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IACtD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;IAC9I,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1D,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAsD,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;IACvK,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;IACvI,OAAO,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AAC5G,CAAC;AAED,+GAA+G;AAC/G,KAAK,UAAU,SAAS,CAAC,KAA6B,EAAE,EAAE,QAAQ,EAA0B;IAC1F,MAAM,KAAK,GAAG,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,KAAK,CAAC,oBAAoB,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACzH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAA+B,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;IAChG,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QAC5B,MAAM,QAAQ,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,cAAc,EAAE,KAAK,CAAC,oBAAoB,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IAChK,CAAC;SAAM,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC9D,MAAM,QAAQ,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;IACzF,CAAC;AACH,CAAC;AAED,MAAM,KAAK,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;AAE/E,kIAAkI;AAClI,SAAS,WAAW,CAAC,MAAwB;IAC3C,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;QAChE,KAAgC,CAAC,SAAS,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC;QACjE,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;YAAG,KAAgC,CAAC,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;IACtH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,4HAA4H;AAC5H,MAAM,UAAU,UAAU,CAAC,IAAc;IACvC,MAAM,MAAM,GAAG,IAAI,CAAC;QAClB,WAAW,EAAE,EAAE;QACf,cAAc,EAAE;YACd,iBAAiB,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;gBACrC,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;gBAC5D,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;oBAAE,OAAO,IAAI,CAAC;gBACzF,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,oBAAoB,EAAE,KAAK,CAAC,KAAK,EAAE,EAAE,YAAY,EAAE,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;YAC1I,CAAC;SACF;QACD,QAAQ,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,oBAAoB,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,WAAW,CAAC,QAA6B,EAAE,oBAAoB,EAAE,QAAQ,CAAC,YAAY,CAAC,EAAE;QACxK,UAAU,EAAE,EAAE,aAAa,EAAE,SAAS,EAAE;KACzC,CAAC,CAAC;IACH,OAAO,WAAW,CAAC,MAAqC,CAAC,CAAC;AAC5D,CAAC"}

package/dist/auth/signup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"signup.d.ts","sourceRoot":"","sources":["../../src/auth/signup.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,iBAAiB,EAAqB,MAAM,aAAa,CAAC;AACxE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAG1C,KAAK,WAAW,GAAG,WAAW,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC;AAC1D,KAAK,QAAQ,GAAG,WAAW,CAAC,WAAW,CAAC,kBAAkB,CAAC,CAAC,CAAC;AAG7D,eAAO,MAAM,YAAY,2BAA2B,CAAC;AACrD,eAAO,MAAM,aAAa,sBAAsB,CAAC;AAmBjD,kJAAkJ;AAClJ,wBAAgB,UAAU,CAAC,IAAI,EAAE,QAAQ,GAAG,QAAQ,CAcnD;AAKD,yGAAyG;AACzG,wBAAsB,eAAe,CAAC,CAAC,SAAS;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,OAAO,CAAA;CAAE,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,CAAC,CAAA;CAAE,GAAG,SAAS,CAAC,CAKnJ;AAED,oHAAoH;AACpH,wBAAgB,WAAW,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,UACnF;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,OAAO,OAAO,KAAG,OAAO,CAAC,IAAI,CAAC,CAW9F"}
+{"version":3,"file":"signup.d.ts","sourceRoot":"","sources":["../../src/auth/signup.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,iBAAiB,EAAqB,MAAM,aAAa,CAAC;AACxE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAG1C,KAAK,WAAW,GAAG,WAAW,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC;AAC1D,KAAK,QAAQ,GAAG,WAAW,CAAC,WAAW,CAAC,kBAAkB,CAAC,CAAC,CAAC;AAG7D,eAAO,MAAM,YAAY,2BAA2B,CAAC;AACrD,eAAO,MAAM,aAAa,sBAAsB,CAAC;AAmBjD,kJAAkJ;AAClJ,wBAAgB,UAAU,CAAC,IAAI,EAAE,QAAQ,GAAG,QAAQ,CAgBnD;AAKD,yGAAyG;AACzG,wBAAsB,eAAe,CAAC,CAAC,SAAS;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,OAAO,CAAA;CAAE,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,CAAC,CAAA;CAAE,GAAG,SAAS,CAAC,CAKnJ;AAED,oHAAoH;AACpH,wBAAgB,WAAW,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,UACnF;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,OAAO,OAAO,KAAG,OAAO,CAAC,IAAI,CAAC,CAW9F"}

package/dist/auth/signup.js

@@ -19,6 +19,9 @@ export function signupGate(deps) {
     return async ({ user, source }, ctx) => {
         if (source.action !== "create-user")
             return;
+        // SCIM creates people for the organization whose token it holds (auth/scim.ts), so the token is the invite.
+        if (source.method === "scim")
+            return;
         const db = await getCurrentAdapter(ctx.context.adapter);
         const viaSso = ssoProviderOf(source);
         if (viaSso)
@@ -34,8 +37,8 @@ export function signupGate(deps) {
         return { error: "signup_closed", errorDescription: "Sign-up needs an invite. Ask your team for one." };
     };
 }
-/** A new account from single sign-on: the provider's organization takes it in. */
-const bySso = (ctx) => String(ctx?.path ?? "").startsWith("/sso/");
+/** A new account from single sign-on or SCIM: the provider's organization takes it in, so it gets no organization of its own. */
+const bySso = (ctx) => /^\/(sso|scim)\//.test(String(ctx?.path ?? ""));
 /** The provider proved the domain and the gate checked the email, so an SSO account starts confirmed. */
 export async function confirmSsoEmail(user, ctx) {
     const providerId = ctx?.params?.providerId;

package/dist/auth/signup.js.map

@@ -1 +1 @@
-{"version":3,"file":"signup.js","sourceRoot":"","sources":["../../src/auth/signup.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAA0B,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAExE,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAMpD,MAAM,CAAC,MAAM,YAAY,GAAG,wBAAwB,CAAC;AACrD,MAAM,CAAC,MAAM,aAAa,GAAG,mBAAmB,CAAC;AAEjD,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAOhH,iIAAiI;AACjI,KAAK,UAAU,UAAU,CAAC,IAAc,EAAE,GAAQ,EAAE,KAAa;IAC/D,MAAM,EAAE,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAY,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;IACnK,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC9E,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7C,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;IACjD,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED,kJAAkJ;AAClJ,MAAM,UAAU,UAAU,CAAC,IAAc;IACvC,OAAO,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,EAAE;QACrC,IAAI,MAAM,CAAC,MAAM,KAAK,aAAa;YAAE,OAAO;QAC5C,MAAM,EAAE,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACxD,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,MAAM;YAAE,OAAO,CAAC,MAAM,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,yEAAyE,EAAE,CAAC;QAC9M,IAAI,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YAChC,IAAI,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC;gBAAE,OAAO;YACrE,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,wEAAwE,EAAE,CAAC;QAC9H,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,MAAM,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;YAAE,OAAO;QAC9F,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,iDAAiD,EAAE,CAAC;IACzG,CAAC,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,MAAM,KAAK,GAAG,CAAC,GAAY,EAAE,EAAE,CAAC,MAAM,CAAE,GAAiC,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;AAE3G,yGAAyG;AACzG,MAAM,CAAC,KAAK,UAAU,eAAe,CAAuD,IAAO,EAAE,GAAY;IAC/G,MAAM,UAAU,GAAI,GAAoD,EAAE,MAAM,EAAE,UAAU,CAAC;IAC7F,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,OAAO,UAAU,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACpE,MAAM,EAAE,GAAG,MAAM,iBAAiB,CAAE,GAAyE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/H,OAAO,CAAC,MAAM,SAAS,CAAC,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAChH,CAAC;AAED,oHAAoH;AACpH,MAAM,UAAU,WAAW,CAAC,IAAc,EAAE,SAA6D;IACvG,OAAO,KAAK,EAAE,IAAiD,EAAE,GAAY,EAAiB,EAAE;QAC9F,IAAI,CAAC,GAAG,IAAI,KAAK,CAAC,GAAG,CAAC;YAAE,OAAO;QAC/B,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CAAgB,sCAAsC,CAAC,CAAC;QAC3F,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CACnC,iHAAiH,EACjH,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAC3B,CAAC;QACF,MAAM,KAAK,GAAG,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC;QAC7B,IAAI,KAAK;YAAE,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC;YAAE,MAAM,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACrH,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"signup.js","sourceRoot":"","sources":["../../src/auth/signup.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAA0B,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAExE,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAMpD,MAAM,CAAC,MAAM,YAAY,GAAG,wBAAwB,CAAC;AACrD,MAAM,CAAC,MAAM,aAAa,GAAG,mBAAmB,CAAC;AAEjD,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAOhH,iIAAiI;AACjI,KAAK,UAAU,UAAU,CAAC,IAAc,EAAE,GAAQ,EAAE,KAAa;IAC/D,MAAM,EAAE,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAY,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;IACnK,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC9E,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7C,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;IACjD,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED,kJAAkJ;AAClJ,MAAM,UAAU,UAAU,CAAC,IAAc;IACvC,OAAO,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,EAAE;QACrC,IAAI,MAAM,CAAC,MAAM,KAAK,aAAa;YAAE,OAAO;QAC5C,4GAA4G;QAC5G,IAAK,MAA8B,CAAC,MAAM,KAAK,MAAM;YAAE,OAAO;QAC9D,MAAM,EAAE,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACxD,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,MAAM;YAAE,OAAO,CAAC,MAAM,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,yEAAyE,EAAE,CAAC;QAC9M,IAAI,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YAChC,IAAI,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC;gBAAE,OAAO;YACrE,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,wEAAwE,EAAE,CAAC;QAC9H,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,MAAM,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;YAAE,OAAO;QAC9F,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,iDAAiD,EAAE,CAAC;IACzG,CAAC,CAAC;AACJ,CAAC;AAED,iIAAiI;AACjI,MAAM,KAAK,GAAG,CAAC,GAAY,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAE,GAAiC,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;AAE/G,yGAAyG;AACzG,MAAM,CAAC,KAAK,UAAU,eAAe,CAAuD,IAAO,EAAE,GAAY;IAC/G,MAAM,UAAU,GAAI,GAAoD,EAAE,MAAM,EAAE,UAAU,CAAC;IAC7F,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,OAAO,UAAU,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACpE,MAAM,EAAE,GAAG,MAAM,iBAAiB,CAAE,GAAyE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/H,OAAO,CAAC,MAAM,SAAS,CAAC,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAChH,CAAC;AAED,oHAAoH;AACpH,MAAM,UAAU,WAAW,CAAC,IAAc,EAAE,SAA6D;IACvG,OAAO,KAAK,EAAE,IAAiD,EAAE,GAAY,EAAiB,EAAE;QAC9F,IAAI,CAAC,GAAG,IAAI,KAAK,CAAC,GAAG,CAAC;YAAE,OAAO;QAC/B,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CAAgB,sCAAsC,CAAC,CAAC;QAC3F,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CACnC,iHAAiH,EACjH,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAC3B,CAAC;QACF,MAAM,KAAK,GAAG,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC;QAC7B,IAAI,KAAK;YAAE,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC;YAAE,MAAM,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACrH,CAAC,CAAC;AACJ,CAAC"}

package/dist/auth/wire.d.ts

@@ -1,3 +1,4 @@
+import type { StripeDeps } from "../billing/stripe-plugin.js";
 import type { CloudConfig } from "../config.js";
 import type { Db } from "../db/db.js";
 import type { Mailer } from "../mail/mailer.js";
@@ -12,5 +13,5 @@ export interface AuthWiring {
     secrets: AuthSecret[];
 }
 /** Secrets, the setup gate, and the rest Better Auth needs; Better Auth itself starts once the address is known. */
-export declare function wireAuth(db: Db, config: CloudConfig, mailer: Mailer): Promise<AuthWiring>;
+export declare function wireAuth(db: Db, config: CloudConfig, mailer: Mailer, stripe?: StripeDeps): Promise<AuthWiring>;
 //# sourceMappingURL=wire.d.ts.map

package/dist/auth/wire.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"wire.d.ts","sourceRoot":"","sources":["../../src/auth/wire.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAEhD,OAAO,EAAc,KAAK,QAAQ,EAAE,MAAM,WAAW,CAAC;AAEtD,OAAO,EAAE,KAAK,UAAU,EAAgC,MAAM,aAAa,CAAC;AAE5E,MAAM,WAAW,UAAU;IACzB,8DAA8D;IAC9D,KAAK,CAAC,SAAS,EAAE,MAAM,GAAG,QAAQ,CAAC;IACnC,mEAAmE;IACnE,SAAS,IAAI,MAAM,GAAG,IAAI,CAAC;IAC3B,kFAAkF;IAClF,OAAO,EAAE,UAAU,EAAE,CAAC;CACvB;AAgBD,oHAAoH;AACpH,wBAAsB,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CA2B/F"}
+{"version":3,"file":"wire.d.ts","sourceRoot":"","sources":["../../src/auth/wire.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAEhD,OAAO,EAAc,KAAK,QAAQ,EAAE,MAAM,WAAW,CAAC;AAEtD,OAAO,EAAE,KAAK,UAAU,EAAgC,MAAM,aAAa,CAAC;AAE5E,MAAM,WAAW,UAAU;IACzB,8DAA8D;IAC9D,KAAK,CAAC,SAAS,EAAE,MAAM,GAAG,QAAQ,CAAC;IACnC,mEAAmE;IACnE,SAAS,IAAI,MAAM,GAAG,IAAI,CAAC;IAC3B,kFAAkF;IAClF,OAAO,EAAE,UAAU,EAAE,CAAC;CACvB;AAgBD,oHAAoH;AACpH,wBAAsB,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CA8BpH"}

package/dist/auth/wire.js

@@ -16,7 +16,7 @@ function originsOf(publicUrl, local) {
     return [origin, origin.includes("//localhost") ? origin.replace("//localhost", "//127.0.0.1") : origin.replace("//127.0.0.1", "//localhost")];
 }
 /** Secrets, the setup gate, and the rest Better Auth needs; Better Auth itself starts once the address is known. */
-export async function wireAuth(db, config, mailer) {
+export async function wireAuth(db, config, mailer, stripe) {
     clearAuthEnv();
     const [secrets, setup] = await Promise.all([resolveSecrets(db, config.authSecret), setupGate(db, config.setupToken)]);
     let base = config.publicUrl;
@@ -27,6 +27,7 @@ export async function wireAuth(db, config, mailer) {
             const deps = {
                 db,
                 publicUrl: new URL(base).origin,
+                mcpUrl: config.mcpUrl,
                 trustedOrigins: originsOf(base, !config.publicUrl),
                 ssoOrigins: config.ssoOrigins,
                 secrets,
@@ -35,6 +36,8 @@ export async function wireAuth(db, config, mailer) {
                 setup,
                 checkPwned: config.checkPwnedPasswords ?? db.kind === "postgres",
                 retentionDays: config.retentionDays,
+                billingOn: config.billing.on,
+                stripe,
             };
             return createAuth(deps);
         },

package/dist/auth/wire.js.map

@@ -1 +1 @@
-{"version":3,"file":"wire.js","sourceRoot":"","sources":["../../src/auth/wire.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAI1C,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAiB,MAAM,WAAW,CAAC;AAEtD,OAAO,EAAmB,YAAY,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAW5E,6FAA6F;AAC7F,KAAK,UAAU,SAAS,CAAC,EAAM,EAAE,UAA8B;IAC7D,IAAI,IAAI,GAAG,CAAC,MAAM,SAAS,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,UAAU,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAClE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC;AACjF,CAAC;AAED,6HAA6H;AAC7H,SAAS,SAAS,CAAC,SAAiB,EAAE,KAAc;IAClD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC;IACzC,IAAI,CAAC,KAAK;QAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5B,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC,CAAC;AAChJ,CAAC;AAED,oHAAoH;AACpH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,EAAM,EAAE,MAAmB,EAAE,MAAc;IACxE,YAAY,EAAE,CAAC;IACf,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC,EAAE,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,SAAS,CAAC,EAAE,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IACtH,IAAI,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC;IAC5B,OAAO;QACL,OAAO;QACP,KAAK,EAAE,CAAC,SAAS,EAAE,EAAE;YACnB,IAAI,GAAG,MAAM,CAAC,SAAS,IAAI,SAAS,CAAC,OAAO,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;YAC3E,MAAM,IAAI,GAAa;gBACrB,EAAE;gBACF,SAAS,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM;gBAC/B,cAAc,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC;gBAClD,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,OAAO;gBACP,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,MAAM;gBACN,KAAK;gBACL,UAAU,EAAE,MAAM,CAAC,mBAAmB,IAAI,EAAE,CAAC,IAAI,KAAK,UAAU;gBAChE,aAAa,EAAE,MAAM,CAAC,aAAa;aACpC,CAAC;YACF,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QACD,SAAS,EAAE,GAAG,EAAE;YACd,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC;YAC5B,OAAO,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,4BAA4B,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAC3E,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"wire.js","sourceRoot":"","sources":["../../src/auth/wire.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAK1C,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAiB,MAAM,WAAW,CAAC;AAEtD,OAAO,EAAmB,YAAY,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAW5E,6FAA6F;AAC7F,KAAK,UAAU,SAAS,CAAC,EAAM,EAAE,UAA8B;IAC7D,IAAI,IAAI,GAAG,CAAC,MAAM,SAAS,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,UAAU,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAClE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC;AACjF,CAAC;AAED,6HAA6H;AAC7H,SAAS,SAAS,CAAC,SAAiB,EAAE,KAAc;IAClD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC;IACzC,IAAI,CAAC,KAAK;QAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5B,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC,CAAC;AAChJ,CAAC;AAED,oHAAoH;AACpH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,EAAM,EAAE,MAAmB,EAAE,MAAc,EAAE,MAAmB;IAC7F,YAAY,EAAE,CAAC;IACf,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC,EAAE,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,SAAS,CAAC,EAAE,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IACtH,IAAI,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC;IAC5B,OAAO;QACL,OAAO;QACP,KAAK,EAAE,CAAC,SAAS,EAAE,EAAE;YACnB,IAAI,GAAG,MAAM,CAAC,SAAS,IAAI,SAAS,CAAC,OAAO,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;YAC3E,MAAM,IAAI,GAAa;gBACrB,EAAE;gBACF,SAAS,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM;gBAC/B,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,cAAc,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC;gBAClD,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,OAAO;gBACP,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,MAAM;gBACN,KAAK;gBACL,UAAU,EAAE,MAAM,CAAC,mBAAmB,IAAI,EAAE,CAAC,IAAI,KAAK,UAAU;gBAChE,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE;gBAC5B,MAAM;aACP,CAAC;YACF,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QACD,SAAS,EAAE,GAAG,EAAE;YACd,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC;YAC5B,OAAO,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,4BAA4B,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAC3E,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/billing/cli.d.ts

@@ -0,0 +1,6 @@
+import type { StripeClient } from "./options.js";
+/** `wizelens-cloud plan set <org> <plan> [--gb N] [--retention-days N]`: for Enterprise deals and support. */
+export declare function planMain(argv: string[], env: NodeJS.ProcessEnv, log?: (message?: any, ...optionalParams: any[]) => void): Promise<void>;
+/** `wizelens-cloud stripe-setup --stripe-secret-key sk_... [--public-url https://...]`: prints the options to deploy with. */
+export declare function stripeSetupMain(argv: string[], env: NodeJS.ProcessEnv, log?: (message?: any, ...optionalParams: any[]) => void, client?: StripeClient): Promise<void>;
+//# sourceMappingURL=cli.d.ts.map

package/dist/billing/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../../src/billing/cli.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAUjD,8GAA8G;AAC9G,wBAAsB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,GAAG,oDAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAiBxG;AAED,8HAA8H;AAC9H,wBAAsB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,GAAG,oDAAe,EAAE,MAAM,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAWtI"}

package/dist/billing/cli.js

@@ -0,0 +1,54 @@
+import { parseArgs } from "node:util";
+import { openDb } from "../db/db.js";
+import { migrate } from "../db/migrate.js";
+import { findOrg, setPlan } from "../repo/billing.js";
+import { isPlanId, PLAN_IDS, PLANS } from "./plans.js";
+import { stripeSetup, WEBHOOK_EVENTS } from "./stripe-setup.js";
+const positiveInt = (v, name, max) => {
+    if (v === undefined)
+        return undefined;
+    if (!/^\d+$/.test(v) || Number(v) < 1 || Number(v) > max)
+        throw new Error(`${name} must be a whole number from 1 to ${max}.`);
+    return Number(v);
+};
+/** `wizelens-cloud plan set <org> <plan> [--gb N] [--retention-days N]`: for Enterprise deals and support. */
+export async function planMain(argv, env, log = console.info) {
+    const { values: a, positionals: p } = parseArgs({ args: argv, allowPositionals: true, options: { database: { type: "string" }, gb: { type: "string" }, "retention-days": { type: "string" } } });
+    const [verb, orgRef, plan] = p;
+    if (verb !== "set" || !orgRef || !isPlanId(plan))
+        throw new Error(`Usage: wizelens-cloud plan set <org id or slug> <${PLAN_IDS.join("|")}> [--gb N] [--retention-days N]`);
+    const gb = positiveInt(a.gb, "--gb", 1_000_000);
+    const days = positiveInt(a["retention-days"], "--retention-days", 400);
+    if ((gb || days) && plan !== "enterprise")
+        throw new Error("--gb and --retention-days are for the enterprise plan; other plans use their own limits.");
+    const db = await openDb(a.database ?? env.DATABASE_URL ?? "pglite:./.wizelens-cloud");
+    try {
+        await migrate(db);
+        const org = await findOrg(db, orgRef);
+        if (!org)
+            throw new Error(`No organization "${orgRef}".`);
+        const changed = await db.tx((q) => setPlan(q, org.id, { plan, gb, retentionDays: days }, "cli", Date.now()));
+        log(changed ? `${org.name} is on ${PLANS[plan].name} now.` : `${org.name} was on ${PLANS[plan].name} already.`);
+    }
+    finally {
+        await db.close();
+    }
+}
+/** `wizelens-cloud stripe-setup --stripe-secret-key sk_... [--public-url https://...]`: prints the options to deploy with. */
+export async function stripeSetupMain(argv, env, log = console.info, client) {
+    const { values: a } = parseArgs({ args: argv, options: { "stripe-secret-key": { type: "string" }, "public-url": { type: "string" } } });
+    const key = a["stripe-secret-key"] ?? env.WIZELENS_CLOUD_STRIPE_SECRET_KEY;
+    if (!key && !client)
+        throw new Error("Usage: wizelens-cloud stripe-setup --stripe-secret-key sk_... [--public-url https://app.example.com]");
+    const { default: Stripe } = await import("stripe");
+    const r = await stripeSetup(client ?? new Stripe(key), a["public-url"] ?? env.WIZELENS_CLOUD_PUBLIC_URL);
+    log(r.made.length ? `Made: ${r.made.join(", ")}.` : "Everything existed already; nothing new was made.");
+    log(`\nDeploy the cloud with:\n  --stripe-secret-key <the key>\n  --stripe-prices '${JSON.stringify(r.prices)}'`);
+    if (r.webhookSecret)
+        log(`  --stripe-webhook-secret ${r.webhookSecret}   (Stripe shows it only now)`);
+    else if (r.webhookUrl)
+        log(`  --stripe-webhook-secret <the signing secret of the webhook at ${r.webhookUrl}>`);
+    else
+        log(`\nThen add a Stripe webhook to <public-url>/_wizelens/api/auth/stripe/webhook with: ${WEBHOOK_EVENTS.join(", ")}.`);
+}
+//# sourceMappingURL=cli.js.map

package/dist/billing/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../../src/billing/cli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC3C,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAEtD,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEhE,MAAM,WAAW,GAAG,CAAC,CAAqB,EAAE,IAAY,EAAE,GAAW,EAAsB,EAAE;IAC3F,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACtC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,GAAG,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,qCAAqC,GAAG,GAAG,CAAC,CAAC;IAC9H,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;AACnB,CAAC,CAAC;AAEF,8GAA8G;AAC9G,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,IAAc,EAAE,GAAsB,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI;IACvF,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,GAAG,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,gBAAgB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;IACjM,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,IAAI,KAAK,KAAK,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;IAC3K,MAAM,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;IAChD,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,gBAAgB,CAAC,EAAE,kBAAkB,EAAE,GAAG,CAAC,CAAC;IACvE,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,IAAI,IAAI,KAAK,YAAY;QAAE,MAAM,IAAI,KAAK,CAAC,0FAA0F,CAAC,CAAC;IACvJ,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,CAAC,CAAC,QAAQ,IAAI,GAAG,CAAC,YAAY,IAAI,0BAA0B,CAAC,CAAC;IACtF,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,EAAE,CAAC,CAAC;QAClB,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACtC,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,MAAM,IAAI,CAAC,CAAC;QAC1D,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAC7G,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,IAAI,UAAU,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,IAAI,WAAW,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,WAAW,CAAC,CAAC;IAClH,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC;AACH,CAAC;AAED,8HAA8H;AAC9H,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAc,EAAE,GAAsB,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,EAAE,MAAqB;IACrH,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,mBAAmB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;IACxI,MAAM,GAAG,GAAG,CAAC,CAAC,mBAAmB,CAAC,IAAI,GAAG,CAAC,gCAAgC,CAAC;IAC3E,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,sGAAsG,CAAC,CAAC;IAC7I,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;IACnD,MAAM,CAAC,GAAG,MAAM,WAAW,CAAC,MAAM,IAAI,IAAI,MAAM,CAAC,GAAI,CAAC,EAAE,CAAC,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,yBAAyB,CAAC,CAAC;IAC1G,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,mDAAmD,CAAC,CAAC;IACzG,GAAG,CAAC,iFAAiF,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAClH,IAAI,CAAC,CAAC,aAAa;QAAE,GAAG,CAAC,6BAA6B,CAAC,CAAC,aAAa,+BAA+B,CAAC,CAAC;SACjG,IAAI,CAAC,CAAC,UAAU;QAAE,GAAG,CAAC,mEAAmE,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC;;QAC1G,GAAG,CAAC,uFAAuF,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAChI,CAAC"}

package/dist/billing/gate.d.ts

@@ -0,0 +1,13 @@
+import type { CloudApp } from "../app.js";
+import { type Feature } from "./plans.js";
+export declare const FEATURE_NAME: Record<Feature, string>;
+/** What a 402 says: the feature, and the plan it needs. */
+export declare function planRequired(feature: Feature): {
+    message: string;
+    plan: string;
+};
+/** 402 with the plan it needs, unless the organization's plan has the feature (always, with billing off). */
+export declare function requireFeature(app: CloudApp, orgId: string, feature: Feature): Promise<void>;
+/** 402 when the retention is longer than the plan allows. */
+export declare function requireRetention(app: CloudApp, orgId: string, days: number): Promise<void>;
+//# sourceMappingURL=gate.d.ts.map

package/dist/billing/gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate.d.ts","sourceRoot":"","sources":["../../src/billing/gate.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAG1C,OAAO,EAAE,KAAK,OAAO,EAAkB,MAAM,YAAY,CAAC;AAE1D,eAAO,MAAM,YAAY,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAyF,CAAC;AAE3I,2DAA2D;AAC3D,wBAAgB,YAAY,CAAC,OAAO,EAAE,OAAO,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAGhF;AAED,6GAA6G;AAC7G,wBAAsB,cAAc,CAAC,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAIlG;AAKD,6DAA6D;AAC7D,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAKhG"}