@wopr-network/platform-core 1.0.0 → 1.0.2

package/coverage/coverage-summary.json

@@ -0,0 +1,119 @@
+{"total": {"lines":{"total":2379,"covered":2080,"skipped":0,"pct":87.43},"statements":{"total":2523,"covered":2197,"skipped":0,"pct":87.07},"functions":{"total":580,"covered":517,"skipped":0,"pct":89.13},"branches":{"total":1460,"covered":1075,"skipped":0,"pct":73.63},"branchesTrue":{"total":0,"covered":0,"skipped":0,"pct":100}}
+,"/home/tsavo/platform-core/src/admin/admin-audit-log-repository.ts": {"lines":{"total":38,"covered":4,"skipped":0,"pct":10.52},"functions":{"total":7,"covered":2,"skipped":0,"pct":28.57},"statements":{"total":40,"covered":4,"skipped":0,"pct":10},"branches":{"total":28,"covered":0,"skipped":0,"pct":0}}
+,"/home/tsavo/platform-core/src/admin/audit-log.ts": {"lines":{"total":16,"covered":5,"skipped":0,"pct":31.25},"functions":{"total":6,"covered":2,"skipped":0,"pct":33.33},"statements":{"total":17,"covered":5,"skipped":0,"pct":29.41},"branches":{"total":24,"covered":10,"skipped":0,"pct":41.66}}
+,"/home/tsavo/platform-core/src/auth/index.ts": {"lines":{"total":143,"covered":57,"skipped":0,"pct":39.86},"functions":{"total":20,"covered":10,"skipped":0,"pct":50},"statements":{"total":156,"covered":64,"skipped":0,"pct":41.02},"branches":{"total":90,"covered":40,"skipped":0,"pct":44.44}}
+,"/home/tsavo/platform-core/src/auth/login-history-repository.ts": {"lines":{"total":3,"covered":3,"skipped":0,"pct":100},"functions":{"total":3,"covered":3,"skipped":0,"pct":100},"statements":{"total":4,"covered":4,"skipped":0,"pct":100},"branches":{"total":3,"covered":2,"skipped":0,"pct":66.66}}
+,"/home/tsavo/platform-core/src/auth/middleware.ts": {"lines":{"total":36,"covered":36,"skipped":0,"pct":100},"functions":{"total":4,"covered":4,"skipped":0,"pct":100},"statements":{"total":36,"covered":36,"skipped":0,"pct":100},"branches":{"total":18,"covered":16,"skipped":0,"pct":88.88}}
+,"/home/tsavo/platform-core/src/auth/user-creator.ts": {"lines":{"total":15,"covered":15,"skipped":0,"pct":100},"functions":{"total":6,"covered":6,"skipped":0,"pct":100},"statements":{"total":16,"covered":16,"skipped":0,"pct":100},"branches":{"total":2,"covered":2,"skipped":0,"pct":100}}
+,"/home/tsavo/platform-core/src/auth/user-role-repository.ts": {"lines":{"total":11,"covered":11,"skipped":0,"pct":100},"functions":{"total":7,"covered":7,"skipped":0,"pct":100},"statements":{"total":11,"covered":11,"skipped":0,"pct":100},"branches":{"total":4,"covered":4,"skipped":0,"pct":100}}
+,"/home/tsavo/platform-core/src/billing/drizzle-webhook-seen-repository.ts": {"lines":{"total":9,"covered":9,"skipped":0,"pct":100},"functions":{"total":4,"covered":4,"skipped":0,"pct":100},"statements":{"total":9,"covered":9,"skipped":0,"pct":100},"branches":{"total":0,"covered":0,"skipped":0,"pct":100}}
+,"/home/tsavo/platform-core/src/billing/payment-processor.ts": {"lines":{"total":3,"covered":3,"skipped":0,"pct":100},"functions":{"total":1,"covered":1,"skipped":0,"pct":100},"statements":{"total":3,"covered":3,"skipped":0,"pct":100},"branches":{"total":0,"covered":0,"skipped":0,"pct":100}}
+,"/home/tsavo/platform-core/src/billing/webhook-seen-repository.ts": {"lines":{"total":4,"covered":3,"skipped":0,"pct":75},"functions":{"total":3,"covered":2,"skipped":0,"pct":66.66},"statements":{"total":4,"covered":3,"skipped":0,"pct":75},"branches":{"total":0,"covered":0,"skipped":0,"pct":100}}
+,"/home/tsavo/platform-core/src/billing/payram/charge-store.ts": {"lines":{"total":9,"covered":9,"skipped":0,"pct":100},"functions":{"total":6,"covered":6,"skipped":0,"pct":100},"statements":{"total":10,"covered":10,"skipped":0,"pct":100},"branches":{"total":8,"covered":8,"skipped":0,"pct":100}}
+,"/home/tsavo/platform-core/src/billing/payram/checkout.ts": {"lines":{"total":6,"covered":6,"skipped":0,"pct":100},"functions":{"total":1,"covered":1,"skipped":0,"pct":100},"statements":{"total":6,"covered":6,"skipped":0,"pct":100},"branches":{"total":4,"covered":4,"skipped":0,"pct":100}}
+,"/home/tsavo/platform-core/src/billing/payram/client.ts": {"lines":{"total":5,"covered":5,"skipped":0,"pct":100},"functions":{"total":2,"covered":2,"skipped":0,"pct":100},"statements":{"total":6,"covered":6,"skipped":0,"pct":100},"branches":{"total":4,"covered":4,"skipped":0,"pct":100}}
+,"/home/tsavo/platform-core/src/billing/payram/webhook.ts": {"lines":{"total":21,"covered":21,"skipped":0,"pct":100},"functions":{"total":1,"covered":1,"skipped":0,"pct":100},"statements":{"total":22,"covered":22,"skipped":0,"pct":100},"branches":{"total":16,"covered":15,"skipped":0,"pct":93.75}}
+,"/home/tsavo/platform-core/src/billing/stripe/checkout.ts": {"lines":{"total":10,"covered":10,"skipped":0,"pct":100},"functions":{"total":2,"covered":2,"skipped":0,"pct":100},"statements":{"total":10,"covered":10,"skipped":0,"pct":100},"branches":{"total":4,"covered":4,"skipped":0,"pct":100}}
+,"/home/tsavo/platform-core/src/billing/stripe/client.ts": {"lines":{"total":7,"covered":7,"skipped":0,"pct":100},"functions":{"total":2,"covered":2,"skipped":0,"pct":100},"statements":{"total":7,"covered":7,"skipped":0,"pct":100},"branches":{"total":4,"covered":4,"skipped":0,"pct":100}}
+,"/home/tsavo/platform-core/src/billing/stripe/credit-prices.ts": {"lines":{"total":17,"covered":17,"skipped":0,"pct":100},"functions":{"total":5,"covered":5,"skipped":0,"pct":100},"statements":{"total":19,"covered":19,"skipped":0,"pct":100},"branches":{"total":8,"covered":8,"skipped":0,"pct":100}}
+,"/home/tsavo/platform-core/src/billing/stripe/payment-methods.ts": {"lines":{"total":21,"covered":21,"skipped":0,"pct":100},"functions":{"total":3,"covered":3,"skipped":0,"pct":100},"statements":{"total":23,"covered":23,"skipped":0,"pct":100},"branches":{"total":12,"covered":12,"skipped":0,"pct":100}}
+,"/home/tsavo/platform-core/src/billing/stripe/portal.ts": {"lines":{"total":4,"covered":4,"skipped":0,"pct":100},"functions":{"total":1,"covered":1,"skipped":0,"pct":100},"statements":{"total":4,"covered":4,"skipped":0,"pct":100},"branches":{"total":2,"covered":2,"skipped":0,"pct":100}}
+,"/home/tsavo/platform-core/src/billing/stripe/setup-intent.ts": {"lines":{"total":4,"covered":4,"skipped":0,"pct":100},"functions":{"total":1,"covered":1,"skipped":0,"pct":100},"statements":{"total":4,"covered":4,"skipped":0,"pct":100},"branches":{"total":2,"covered":2,"skipped":0,"pct":100}}
+,"/home/tsavo/platform-core/src/billing/stripe/stripe-payment-processor.ts": {"lines":{"total":66,"covered":63,"skipped":0,"pct":95.45},"functions":{"total":15,"covered":15,"skipped":0,"pct":100},"statements":{"total":68,"covered":65,"skipped":0,"pct":95.58},"branches":{"total":48,"covered":41,"skipped":0,"pct":85.41}}
+,"/home/tsavo/platform-core/src/billing/stripe/tenant-store.ts": {"lines":{"total":22,"covered":19,"skipped":0,"pct":86.36},"functions":{"total":12,"covered":10,"skipped":0,"pct":83.33},"statements":{"total":22,"covered":19,"skipped":0,"pct":86.36},"branches":{"total":12,"covered":9,"skipped":0,"pct":75}}
+,"/home/tsavo/platform-core/src/config/index.ts": {"lines":{"total":3,"covered":3,"skipped":0,"pct":100},"functions":{"total":0,"covered":0,"skipped":0,"pct":100},"statements":{"total":3,"covered":3,"skipped":0,"pct":100},"branches":{"total":0,"covered":0,"skipped":0,"pct":100}}
+,"/home/tsavo/platform-core/src/config/logger.ts": {"lines":{"total":1,"covered":1,"skipped":0,"pct":100},"functions":{"total":0,"covered":0,"skipped":0,"pct":100},"statements":{"total":1,"covered":1,"skipped":0,"pct":100},"branches":{"total":0,"covered":0,"skipped":0,"pct":100}}
+,"/home/tsavo/platform-core/src/config/provider-endpoints.ts": {"lines":{"total":1,"covered":1,"skipped":0,"pct":100},"functions":{"total":0,"covered":0,"skipped":0,"pct":100},"statements":{"total":1,"covered":1,"skipped":0,"pct":100},"branches":{"total":0,"covered":0,"skipped":0,"pct":100}}
+,"/home/tsavo/platform-core/src/credits/auto-topup-charge.ts": {"lines":{"total":54,"covered":44,"skipped":0,"pct":81.48},"functions":{"total":2,"covered":1,"skipped":0,"pct":50},"statements":{"total":54,"covered":44,"skipped":0,"pct":81.48},"branches":{"total":32,"covered":20,"skipped":0,"pct":62.5}}
+,"/home/tsavo/platform-core/src/credits/auto-topup-event-log-repository.ts": {"lines":{"total":2,"covered":2,"skipped":0,"pct":100},"functions":{"total":2,"covered":2,"skipped":0,"pct":100},"statements":{"total":2,"covered":2,"skipped":0,"pct":100},"branches":{"total":4,"covered":4,"skipped":0,"pct":100}}
+,"/home/tsavo/platform-core/src/credits/auto-topup-schedule.ts": {"lines":{"total":31,"covered":30,"skipped":0,"pct":96.77},"functions":{"total":1,"covered":1,"skipped":0,"pct":100},"statements":{"total":31,"covered":30,"skipped":0,"pct":96.77},"branches":{"total":12,"covered":9,"skipped":0,"pct":75}}
+,"/home/tsavo/platform-core/src/credits/auto-topup-settings-repository.ts": {"lines":{"total":69,"covered":57,"skipped":0,"pct":82.6},"functions":{"total":16,"covered":15,"skipped":0,"pct":93.75},"statements":{"total":71,"covered":57,"skipped":0,"pct":80.28},"branches":{"total":31,"covered":20,"skipped":0,"pct":64.51}}
+,"/home/tsavo/platform-core/src/credits/auto-topup-usage.ts": {"lines":{"total":22,"covered":21,"skipped":0,"pct":95.45},"functions":{"total":1,"covered":1,"skipped":0,"pct":100},"statements":{"total":26,"covered":25,"skipped":0,"pct":96.15},"branches":{"total":20,"covered":17,"skipped":0,"pct":85}}
+,"/home/tsavo/platform-core/src/credits/credit-expiry-cron.ts": {"lines":{"total":21,"covered":14,"skipped":0,"pct":66.66},"functions":{"total":1,"covered":1,"skipped":0,"pct":100},"statements":{"total":21,"covered":14,"skipped":0,"pct":66.66},"branches":{"total":12,"covered":6,"skipped":0,"pct":50}}
+,"/home/tsavo/platform-core/src/credits/credit-ledger.ts": {"lines":{"total":69,"covered":48,"skipped":0,"pct":69.56},"functions":{"total":17,"covered":12,"skipped":0,"pct":70.58},"statements":{"total":72,"covered":49,"skipped":0,"pct":68.05},"branches":{"total":67,"covered":55,"skipped":0,"pct":82.08}}
+,"/home/tsavo/platform-core/src/credits/credit-transaction-repository.ts": {"lines":{"total":7,"covered":7,"skipped":0,"pct":100},"functions":{"total":5,"covered":5,"skipped":0,"pct":100},"statements":{"total":8,"covered":8,"skipped":0,"pct":100},"branches":{"total":2,"covered":1,"skipped":0,"pct":50}}
+,"/home/tsavo/platform-core/src/credits/credit.ts": {"lines":{"total":39,"covered":35,"skipped":0,"pct":89.74},"functions":{"total":23,"covered":23,"skipped":0,"pct":100},"statements":{"total":39,"covered":35,"skipped":0,"pct":89.74},"branches":{"total":10,"covered":6,"skipped":0,"pct":60}}
+,"/home/tsavo/platform-core/src/credits/dividend-cron.ts": {"lines":{"total":35,"covered":30,"skipped":0,"pct":85.71},"functions":{"total":2,"covered":2,"skipped":0,"pct":100},"statements":{"total":35,"covered":30,"skipped":0,"pct":85.71},"branches":{"total":10,"covered":7,"skipped":0,"pct":70}}
+,"/home/tsavo/platform-core/src/credits/dividend-repository.ts": {"lines":{"total":32,"covered":32,"skipped":0,"pct":100},"functions":{"total":8,"covered":8,"skipped":0,"pct":100},"statements":{"total":34,"covered":34,"skipped":0,"pct":100},"branches":{"total":10,"covered":7,"skipped":0,"pct":70}}
+,"/home/tsavo/platform-core/src/credits/signup-grant.ts": {"lines":{"total":12,"covered":10,"skipped":0,"pct":83.33},"functions":{"total":2,"covered":2,"skipped":0,"pct":100},"statements":{"total":15,"covered":12,"skipped":0,"pct":80},"branches":{"total":10,"covered":5,"skipped":0,"pct":50}}
+,"/home/tsavo/platform-core/src/db/credit-column.ts": {"lines":{"total":4,"covered":4,"skipped":0,"pct":100},"functions":{"total":3,"covered":3,"skipped":0,"pct":100},"statements":{"total":4,"covered":4,"skipped":0,"pct":100},"branches":{"total":0,"covered":0,"skipped":0,"pct":100}}
+,"/home/tsavo/platform-core/src/db/schema/account-deletion-requests.ts": {"lines":{"total":2,"covered":2,"skipped":0,"pct":100},"functions":{"total":1,"covered":1,"skipped":0,"pct":100},"statements":{"total":2,"covered":2,"skipped":0,"pct":100},"branches":{"total":0,"covered":0,"skipped":0,"pct":100}}
+,"/home/tsavo/platform-core/src/db/schema/account-export-requests.ts": {"lines":{"total":2,"covered":2,"skipped":0,"pct":100},"functions":{"total":1,"covered":1,"skipped":0,"pct":100},"statements":{"total":2,"covered":2,"skipped":0,"pct":100},"branches":{"total":0,"covered":0,"skipped":0,"pct":100}}
+,"/home/tsavo/platform-core/src/db/schema/admin-audit.ts": {"lines":{"total":2,"covered":2,"skipped":0,"pct":100},"functions":{"total":1,"covered":1,"skipped":0,"pct":100},"statements":{"total":2,"covered":2,"skipped":0,"pct":100},"branches":{"total":0,"covered":0,"skipped":0,"pct":100}}
+,"/home/tsavo/platform-core/src/db/schema/admin-users.ts": {"lines":{"total":2,"covered":2,"skipped":0,"pct":100},"functions":{"total":1,"covered":1,"skipped":0,"pct":100},"statements":{"total":2,"covered":2,"skipped":0,"pct":100},"branches":{"total":0,"covered":0,"skipped":0,"pct":100}}
+,"/home/tsavo/platform-core/src/db/schema/affiliate-fraud.ts": {"lines":{"total":2,"covered":2,"skipped":0,"pct":100},"functions":{"total":1,"covered":1,"skipped":0,"pct":100},"statements":{"total":2,"covered":2,"skipped":0,"pct":100},"branches":{"total":0,"covered":0,"skipped":0,"pct":100}}
+,"/home/tsavo/platform-core/src/db/schema/affiliate.ts": {"lines":{"total":3,"covered":3,"skipped":0,"pct":100},"functions":{"total":1,"covered":1,"skipped":0,"pct":100},"statements":{"total":3,"covered":3,"skipped":0,"pct":100},"branches":{"total":0,"covered":0,"skipped":0,"pct":100}}
+,"/home/tsavo/platform-core/src/db/schema/coupon-codes.ts": {"lines":{"total":3,"covered":2,"skipped":0,"pct":66.66},"functions":{"total":2,"covered":1,"skipped":0,"pct":50},"statements":{"total":3,"covered":2,"skipped":0,"pct":66.66},"branches":{"total":0,"covered":0,"skipped":0,"pct":100}}
+,"/home/tsavo/platform-core/src/db/schema/credit-auto-topup-settings.ts": {"lines":{"total":2,"covered":2,"skipped":0,"pct":100},"functions":{"total":1,"covered":1,"skipped":0,"pct":100},"statements":{"total":2,"covered":2,"skipped":0,"pct":100},"branches":{"total":0,"covered":0,"skipped":0,"pct":100}}
+,"/home/tsavo/platform-core/src/db/schema/credit-auto-topup.ts": {"lines":{"total":2,"covered":2,"skipped":0,"pct":100},"functions":{"total":1,"covered":1,"skipped":0,"pct":100},"statements":{"total":2,"covered":2,"skipped":0,"pct":100},"branches":{"total":0,"covered":0,"skipped":0,"pct":100}}
+,"/home/tsavo/platform-core/src/db/schema/credits.ts": {"lines":{"total":3,"covered":3,"skipped":0,"pct":100},"functions":{"total":1,"covered":1,"skipped":0,"pct":100},"statements":{"total":3,"covered":3,"skipped":0,"pct":100},"branches":{"total":0,"covered":0,"skipped":0,"pct":100}}
+,"/home/tsavo/platform-core/src/db/schema/dividend-distributions.ts": {"lines":{"total":2,"covered":2,"skipped":0,"pct":100},"functions":{"total":1,"covered":1,"skipped":0,"pct":100},"statements":{"total":2,"covered":2,"skipped":0,"pct":100},"branches":{"total":0,"covered":0,"skipped":0,"pct":100}}
+,"/home/tsavo/platform-core/src/db/schema/email-notifications.ts": {"lines":{"total":2,"covered":2,"skipped":0,"pct":100},"functions":{"total":1,"covered":1,"skipped":0,"pct":100},"statements":{"total":2,"covered":2,"skipped":0,"pct":100},"branches":{"total":0,"covered":0,"skipped":0,"pct":100}}
+,"/home/tsavo/platform-core/src/db/schema/index.ts": {"lines":{"total":0,"covered":0,"skipped":0,"pct":100},"functions":{"total":0,"covered":0,"skipped":0,"pct":100},"statements":{"total":0,"covered":0,"skipped":0,"pct":100},"branches":{"total":0,"covered":0,"skipped":0,"pct":100}}
+,"/home/tsavo/platform-core/src/db/schema/meter-events.ts": {"lines":{"total":6,"covered":6,"skipped":0,"pct":100},"functions":{"total":3,"covered":3,"skipped":0,"pct":100},"statements":{"total":6,"covered":6,"skipped":0,"pct":100},"branches":{"total":0,"covered":0,"skipped":0,"pct":100}}
+,"/home/tsavo/platform-core/src/db/schema/notification-preferences.ts": {"lines":{"total":1,"covered":1,"skipped":0,"pct":100},"functions":{"total":0,"covered":0,"skipped":0,"pct":100},"statements":{"total":1,"covered":1,"skipped":0,"pct":100},"branches":{"total":0,"covered":0,"skipped":0,"pct":100}}
+,"/home/tsavo/platform-core/src/db/schema/notification-queue.ts": {"lines":{"total":2,"covered":2,"skipped":0,"pct":100},"functions":{"total":1,"covered":1,"skipped":0,"pct":100},"statements":{"total":2,"covered":2,"skipped":0,"pct":100},"branches":{"total":0,"covered":0,"skipped":0,"pct":100}}
+,"/home/tsavo/platform-core/src/db/schema/org-memberships.ts": {"lines":{"total":2,"covered":2,"skipped":0,"pct":100},"functions":{"total":1,"covered":1,"skipped":0,"pct":100},"statements":{"total":2,"covered":2,"skipped":0,"pct":100},"branches":{"total":0,"covered":0,"skipped":0,"pct":100}}
+,"/home/tsavo/platform-core/src/db/schema/organization-members.ts": {"lines":{"total":4,"covered":4,"skipped":0,"pct":100},"functions":{"total":2,"covered":2,"skipped":0,"pct":100},"statements":{"total":4,"covered":4,"skipped":0,"pct":100},"branches":{"total":0,"covered":0,"skipped":0,"pct":100}}
+,"/home/tsavo/platform-core/src/db/schema/payram.ts": {"lines":{"total":2,"covered":2,"skipped":0,"pct":100},"functions":{"total":1,"covered":1,"skipped":0,"pct":100},"statements":{"total":2,"covered":2,"skipped":0,"pct":100},"branches":{"total":0,"covered":0,"skipped":0,"pct":100}}
+,"/home/tsavo/platform-core/src/db/schema/platform-api-keys.ts": {"lines":{"total":2,"covered":2,"skipped":0,"pct":100},"functions":{"total":1,"covered":1,"skipped":0,"pct":100},"statements":{"total":2,"covered":2,"skipped":0,"pct":100},"branches":{"total":0,"covered":0,"skipped":0,"pct":100}}
+,"/home/tsavo/platform-core/src/db/schema/promotion-redemptions.ts": {"lines":{"total":4,"covered":2,"skipped":0,"pct":50},"functions":{"total":3,"covered":1,"skipped":0,"pct":33.33},"statements":{"total":4,"covered":2,"skipped":0,"pct":50},"branches":{"total":0,"covered":0,"skipped":0,"pct":100}}
+,"/home/tsavo/platform-core/src/db/schema/promotions.ts": {"lines":{"total":6,"covered":6,"skipped":0,"pct":100},"functions":{"total":1,"covered":1,"skipped":0,"pct":100},"statements":{"total":6,"covered":6,"skipped":0,"pct":100},"branches":{"total":0,"covered":0,"skipped":0,"pct":100}}
+,"/home/tsavo/platform-core/src/db/schema/provider-credentials.ts": {"lines":{"total":2,"covered":2,"skipped":0,"pct":100},"functions":{"total":1,"covered":1,"skipped":0,"pct":100},"statements":{"total":2,"covered":2,"skipped":0,"pct":100},"branches":{"total":0,"covered":0,"skipped":0,"pct":100}}
+,"/home/tsavo/platform-core/src/db/schema/rate-limit-entries.ts": {"lines":{"total":2,"covered":2,"skipped":0,"pct":100},"functions":{"total":1,"covered":1,"skipped":0,"pct":100},"statements":{"total":2,"covered":2,"skipped":0,"pct":100},"branches":{"total":0,"covered":0,"skipped":0,"pct":100}}
+,"/home/tsavo/platform-core/src/db/schema/secret-audit-log.ts": {"lines":{"total":2,"covered":2,"skipped":0,"pct":100},"functions":{"total":1,"covered":1,"skipped":0,"pct":100},"statements":{"total":2,"covered":2,"skipped":0,"pct":100},"branches":{"total":0,"covered":0,"skipped":0,"pct":100}}
+,"/home/tsavo/platform-core/src/db/schema/session-usage.ts": {"lines":{"total":2,"covered":2,"skipped":0,"pct":100},"functions":{"total":1,"covered":1,"skipped":0,"pct":100},"statements":{"total":2,"covered":2,"skipped":0,"pct":100},"branches":{"total":0,"covered":0,"skipped":0,"pct":100}}
+,"/home/tsavo/platform-core/src/db/schema/spending-limits.ts": {"lines":{"total":1,"covered":1,"skipped":0,"pct":100},"functions":{"total":0,"covered":0,"skipped":0,"pct":100},"statements":{"total":1,"covered":1,"skipped":0,"pct":100},"branches":{"total":0,"covered":0,"skipped":0,"pct":100}}
+,"/home/tsavo/platform-core/src/db/schema/tenant-addons.ts": {"lines":{"total":2,"covered":2,"skipped":0,"pct":100},"functions":{"total":1,"covered":1,"skipped":0,"pct":100},"statements":{"total":2,"covered":2,"skipped":0,"pct":100},"branches":{"total":0,"covered":0,"skipped":0,"pct":100}}
+,"/home/tsavo/platform-core/src/db/schema/tenant-api-keys.ts": {"lines":{"total":2,"covered":2,"skipped":0,"pct":100},"functions":{"total":1,"covered":1,"skipped":0,"pct":100},"statements":{"total":2,"covered":2,"skipped":0,"pct":100},"branches":{"total":0,"covered":0,"skipped":0,"pct":100}}
+,"/home/tsavo/platform-core/src/db/schema/tenant-capability-settings.ts": {"lines":{"total":2,"covered":2,"skipped":0,"pct":100},"functions":{"total":1,"covered":1,"skipped":0,"pct":100},"statements":{"total":2,"covered":2,"skipped":0,"pct":100},"branches":{"total":0,"covered":0,"skipped":0,"pct":100}}
+,"/home/tsavo/platform-core/src/db/schema/tenant-customers.ts": {"lines":{"total":4,"covered":4,"skipped":0,"pct":100},"functions":{"total":2,"covered":2,"skipped":0,"pct":100},"statements":{"total":4,"covered":4,"skipped":0,"pct":100},"branches":{"total":0,"covered":0,"skipped":0,"pct":100}}
+,"/home/tsavo/platform-core/src/db/schema/tenants.ts": {"lines":{"total":2,"covered":2,"skipped":0,"pct":100},"functions":{"total":1,"covered":1,"skipped":0,"pct":100},"statements":{"total":2,"covered":2,"skipped":0,"pct":100},"branches":{"total":0,"covered":0,"skipped":0,"pct":100}}
+,"/home/tsavo/platform-core/src/db/schema/user-roles.ts": {"lines":{"total":2,"covered":2,"skipped":0,"pct":100},"functions":{"total":1,"covered":1,"skipped":0,"pct":100},"statements":{"total":2,"covered":2,"skipped":0,"pct":100},"branches":{"total":0,"covered":0,"skipped":0,"pct":100}}
+,"/home/tsavo/platform-core/src/db/schema/webhook-seen-events.ts": {"lines":{"total":2,"covered":2,"skipped":0,"pct":100},"functions":{"total":1,"covered":1,"skipped":0,"pct":100},"statements":{"total":2,"covered":2,"skipped":0,"pct":100},"branches":{"total":0,"covered":0,"skipped":0,"pct":100}}
+,"/home/tsavo/platform-core/src/email/billing-emails.ts": {"lines":{"total":51,"covered":43,"skipped":0,"pct":84.31},"functions":{"total":9,"covered":9,"skipped":0,"pct":100},"statements":{"total":51,"covered":43,"skipped":0,"pct":84.31},"branches":{"total":22,"covered":12,"skipped":0,"pct":54.54}}
+,"/home/tsavo/platform-core/src/email/client.ts": {"lines":{"total":24,"covered":24,"skipped":0,"pct":100},"functions":{"total":6,"covered":6,"skipped":0,"pct":100},"statements":{"total":24,"covered":24,"skipped":0,"pct":100},"branches":{"total":14,"covered":14,"skipped":0,"pct":100}}
+,"/home/tsavo/platform-core/src/email/drizzle-billing-email-repository.ts": {"lines":{"total":6,"covered":6,"skipped":0,"pct":100},"functions":{"total":3,"covered":3,"skipped":0,"pct":100},"statements":{"total":6,"covered":6,"skipped":0,"pct":100},"branches":{"total":0,"covered":0,"skipped":0,"pct":100}}
+,"/home/tsavo/platform-core/src/email/notification-preferences-store.ts": {"lines":{"total":19,"covered":19,"skipped":0,"pct":100},"functions":{"total":3,"covered":3,"skipped":0,"pct":100},"statements":{"total":27,"covered":27,"skipped":0,"pct":100},"branches":{"total":18,"covered":18,"skipped":0,"pct":100}}
+,"/home/tsavo/platform-core/src/email/notification-queue-store.ts": {"lines":{"total":22,"covered":22,"skipped":0,"pct":100},"functions":{"total":8,"covered":8,"skipped":0,"pct":100},"statements":{"total":24,"covered":24,"skipped":0,"pct":100},"branches":{"total":26,"covered":25,"skipped":0,"pct":96.15}}
+,"/home/tsavo/platform-core/src/email/notification-service.ts": {"lines":{"total":32,"covered":17,"skipped":0,"pct":53.12},"functions":{"total":30,"covered":16,"skipped":0,"pct":53.33},"statements":{"total":32,"covered":17,"skipped":0,"pct":53.12},"branches":{"total":0,"covered":0,"skipped":0,"pct":100}}
+,"/home/tsavo/platform-core/src/email/notification-templates.ts": {"lines":{"total":165,"covered":132,"skipped":0,"pct":80},"functions":{"total":28,"covered":25,"skipped":0,"pct":89.28},"statements":{"total":176,"covered":140,"skipped":0,"pct":79.54},"branches":{"total":201,"covered":87,"skipped":0,"pct":43.28}}
+,"/home/tsavo/platform-core/src/email/notification-worker.ts": {"lines":{"total":34,"covered":34,"skipped":0,"pct":100},"functions":{"total":3,"covered":3,"skipped":0,"pct":100},"statements":{"total":35,"covered":34,"skipped":0,"pct":97.14},"branches":{"total":12,"covered":10,"skipped":0,"pct":83.33}}
+,"/home/tsavo/platform-core/src/email/resend-adapter.ts": {"lines":{"total":15,"covered":15,"skipped":0,"pct":100},"functions":{"total":5,"covered":5,"skipped":0,"pct":100},"statements":{"total":16,"covered":16,"skipped":0,"pct":100},"branches":{"total":13,"covered":11,"skipped":0,"pct":84.61}}
+,"/home/tsavo/platform-core/src/email/templates.ts": {"lines":{"total":83,"covered":77,"skipped":0,"pct":92.77},"functions":{"total":17,"covered":16,"skipped":0,"pct":94.11},"statements":{"total":90,"covered":84,"skipped":0,"pct":93.33},"branches":{"total":59,"covered":57,"skipped":0,"pct":96.61}}
+,"/home/tsavo/platform-core/src/email/verification.ts": {"lines":{"total":23,"covered":21,"skipped":0,"pct":91.3},"functions":{"total":7,"covered":5,"skipped":0,"pct":71.42},"statements":{"total":27,"covered":25,"skipped":0,"pct":92.59},"branches":{"total":12,"covered":12,"skipped":0,"pct":100}}
+,"/home/tsavo/platform-core/src/metering/aggregator.ts": {"lines":{"total":36,"covered":36,"skipped":0,"pct":100},"functions":{"total":8,"covered":7,"skipped":0,"pct":87.5},"statements":{"total":37,"covered":36,"skipped":0,"pct":97.29},"branches":{"total":21,"covered":19,"skipped":0,"pct":90.47}}
+,"/home/tsavo/platform-core/src/metering/dlq.ts": {"lines":{"total":30,"covered":28,"skipped":0,"pct":93.33},"functions":{"total":5,"covered":5,"skipped":0,"pct":100},"statements":{"total":33,"covered":31,"skipped":0,"pct":93.93},"branches":{"total":16,"covered":14,"skipped":0,"pct":87.5}}
+,"/home/tsavo/platform-core/src/metering/drizzle-usage-summary-repository.ts": {"lines":{"total":22,"covered":22,"skipped":0,"pct":100},"functions":{"total":10,"covered":10,"skipped":0,"pct":100},"statements":{"total":25,"covered":25,"skipped":0,"pct":100},"branches":{"total":19,"covered":16,"skipped":0,"pct":84.21}}
+,"/home/tsavo/platform-core/src/metering/emitter.ts": {"lines":{"total":71,"covered":70,"skipped":0,"pct":98.59},"functions":{"total":15,"covered":14,"skipped":0,"pct":93.33},"statements":{"total":79,"covered":77,"skipped":0,"pct":97.46},"branches":{"total":58,"covered":53,"skipped":0,"pct":91.37}}
+,"/home/tsavo/platform-core/src/metering/meter-event-repository.ts": {"lines":{"total":9,"covered":9,"skipped":0,"pct":100},"functions":{"total":6,"covered":6,"skipped":0,"pct":100},"statements":{"total":11,"covered":11,"skipped":0,"pct":100},"branches":{"total":2,"covered":2,"skipped":0,"pct":100}}
+,"/home/tsavo/platform-core/src/metering/reconciliation-cron.ts": {"lines":{"total":37,"covered":36,"skipped":0,"pct":97.29},"functions":{"total":1,"covered":1,"skipped":0,"pct":100},"statements":{"total":37,"covered":36,"skipped":0,"pct":97.29},"branches":{"total":22,"covered":18,"skipped":0,"pct":81.81}}
+,"/home/tsavo/platform-core/src/metering/reconciliation-repository.ts": {"lines":{"total":6,"covered":6,"skipped":0,"pct":100},"functions":{"total":6,"covered":6,"skipped":0,"pct":100},"statements":{"total":8,"covered":8,"skipped":0,"pct":100},"branches":{"total":0,"covered":0,"skipped":0,"pct":100}}
+,"/home/tsavo/platform-core/src/metering/wal.ts": {"lines":{"total":45,"covered":43,"skipped":0,"pct":95.55},"functions":{"total":15,"covered":15,"skipped":0,"pct":100},"statements":{"total":47,"covered":45,"skipped":0,"pct":95.74},"branches":{"total":18,"covered":15,"skipped":0,"pct":83.33}}
+,"/home/tsavo/platform-core/src/middleware/csrf.ts": {"lines":{"total":32,"covered":31,"skipped":0,"pct":96.87},"functions":{"total":4,"covered":4,"skipped":0,"pct":100},"statements":{"total":34,"covered":33,"skipped":0,"pct":97.05},"branches":{"total":22,"covered":20,"skipped":0,"pct":90.9}}
+,"/home/tsavo/platform-core/src/middleware/drizzle-rate-limit-repository.ts": {"lines":{"total":16,"covered":16,"skipped":0,"pct":100},"functions":{"total":4,"covered":4,"skipped":0,"pct":100},"statements":{"total":17,"covered":17,"skipped":0,"pct":100},"branches":{"total":6,"covered":6,"skipped":0,"pct":100}}
+,"/home/tsavo/platform-core/src/middleware/get-client-ip.ts": {"lines":{"total":16,"covered":16,"skipped":0,"pct":100},"functions":{"total":5,"covered":5,"skipped":0,"pct":100},"statements":{"total":19,"covered":19,"skipped":0,"pct":100},"branches":{"total":18,"covered":16,"skipped":0,"pct":88.88}}
+,"/home/tsavo/platform-core/src/middleware/rate-limit.ts": {"lines":{"total":54,"covered":54,"skipped":0,"pct":100},"functions":{"total":5,"covered":5,"skipped":0,"pct":100},"statements":{"total":55,"covered":54,"skipped":0,"pct":98.18},"branches":{"total":28,"covered":25,"skipped":0,"pct":89.28}}
+,"/home/tsavo/platform-core/src/security/encryption.ts": {"lines":{"total":21,"covered":21,"skipped":0,"pct":100},"functions":{"total":4,"covered":4,"skipped":0,"pct":100},"statements":{"total":21,"covered":21,"skipped":0,"pct":100},"branches":{"total":4,"covered":4,"skipped":0,"pct":100}}
+,"/home/tsavo/platform-core/src/security/host-validation.ts": {"lines":{"total":46,"covered":45,"skipped":0,"pct":97.82},"functions":{"total":5,"covered":5,"skipped":0,"pct":100},"statements":{"total":60,"covered":58,"skipped":0,"pct":96.66},"branches":{"total":67,"covered":63,"skipped":0,"pct":94.02}}
+,"/home/tsavo/platform-core/src/security/key-audit.ts": {"lines":{"total":10,"covered":10,"skipped":0,"pct":100},"functions":{"total":1,"covered":1,"skipped":0,"pct":100},"statements":{"total":11,"covered":11,"skipped":0,"pct":100},"branches":{"total":2,"covered":2,"skipped":0,"pct":100}}
+,"/home/tsavo/platform-core/src/security/key-injection.ts": {"lines":{"total":16,"covered":16,"skipped":0,"pct":100},"functions":{"total":3,"covered":2,"skipped":0,"pct":66.66},"statements":{"total":17,"covered":16,"skipped":0,"pct":94.11},"branches":{"total":4,"covered":4,"skipped":0,"pct":100}}
+,"/home/tsavo/platform-core/src/security/key-validation.ts": {"lines":{"total":19,"covered":16,"skipped":0,"pct":84.21},"functions":{"total":7,"covered":5,"skipped":0,"pct":71.42},"statements":{"total":19,"covered":16,"skipped":0,"pct":84.21},"branches":{"total":10,"covered":8,"skipped":0,"pct":80}}
+,"/home/tsavo/platform-core/src/security/redirect-allowlist.ts": {"lines":{"total":14,"covered":13,"skipped":0,"pct":92.85},"functions":{"total":3,"covered":3,"skipped":0,"pct":100},"statements":{"total":14,"covered":13,"skipped":0,"pct":92.85},"branches":{"total":12,"covered":10,"skipped":0,"pct":83.33}}
+,"/home/tsavo/platform-core/src/security/credential-vault/audit-repository.ts": {"lines":{"total":9,"covered":9,"skipped":0,"pct":100},"functions":{"total":5,"covered":5,"skipped":0,"pct":100},"statements":{"total":10,"covered":10,"skipped":0,"pct":100},"branches":{"total":2,"covered":1,"skipped":0,"pct":50}}
+,"/home/tsavo/platform-core/src/security/credential-vault/credential-repository.ts": {"lines":{"total":24,"covered":24,"skipped":0,"pct":100},"functions":{"total":16,"covered":16,"skipped":0,"pct":100},"statements":{"total":24,"covered":24,"skipped":0,"pct":100},"branches":{"total":6,"covered":6,"skipped":0,"pct":100}}
+,"/home/tsavo/platform-core/src/security/credential-vault/key-rotation.ts": {"lines":{"total":25,"covered":24,"skipped":0,"pct":96},"functions":{"total":2,"covered":2,"skipped":0,"pct":100},"statements":{"total":25,"covered":24,"skipped":0,"pct":96},"branches":{"total":4,"covered":1,"skipped":0,"pct":25}}
+,"/home/tsavo/platform-core/src/security/credential-vault/migrate-plaintext.ts": {"lines":{"total":36,"covered":35,"skipped":0,"pct":97.22},"functions":{"total":1,"covered":1,"skipped":0,"pct":100},"statements":{"total":37,"covered":35,"skipped":0,"pct":94.59},"branches":{"total":22,"covered":18,"skipped":0,"pct":81.81}}
+,"/home/tsavo/platform-core/src/security/credential-vault/migration-check.ts": {"lines":{"total":22,"covered":20,"skipped":0,"pct":90.9},"functions":{"total":1,"covered":1,"skipped":0,"pct":100},"statements":{"total":23,"covered":20,"skipped":0,"pct":86.95},"branches":{"total":26,"covered":13,"skipped":0,"pct":50}}
+,"/home/tsavo/platform-core/src/security/credential-vault/store.ts": {"lines":{"total":55,"covered":54,"skipped":0,"pct":98.18},"functions":{"total":16,"covered":15,"skipped":0,"pct":93.75},"statements":{"total":63,"covered":62,"skipped":0,"pct":98.41},"branches":{"total":26,"covered":23,"skipped":0,"pct":88.46}}
+,"/home/tsavo/platform-core/src/security/tenant-keys/capability-settings-store.ts": {"lines":{"total":6,"covered":6,"skipped":0,"pct":100},"functions":{"total":4,"covered":4,"skipped":0,"pct":100},"statements":{"total":7,"covered":7,"skipped":0,"pct":100},"branches":{"total":0,"covered":0,"skipped":0,"pct":100}}
+,"/home/tsavo/platform-core/src/security/tenant-keys/key-resolution-repository.ts": {"lines":{"total":3,"covered":3,"skipped":0,"pct":100},"functions":{"total":2,"covered":2,"skipped":0,"pct":100},"statements":{"total":3,"covered":3,"skipped":0,"pct":100},"branches":{"total":2,"covered":2,"skipped":0,"pct":100}}
+,"/home/tsavo/platform-core/src/security/tenant-keys/key-resolution.ts": {"lines":{"total":16,"covered":16,"skipped":0,"pct":100},"functions":{"total":2,"covered":2,"skipped":0,"pct":100},"statements":{"total":16,"covered":16,"skipped":0,"pct":100},"branches":{"total":7,"covered":7,"skipped":0,"pct":100}}
+,"/home/tsavo/platform-core/src/security/tenant-keys/org-key-resolution.ts": {"lines":{"total":16,"covered":16,"skipped":0,"pct":100},"functions":{"total":3,"covered":3,"skipped":0,"pct":100},"statements":{"total":16,"covered":16,"skipped":0,"pct":100},"branches":{"total":10,"covered":10,"skipped":0,"pct":100}}
+,"/home/tsavo/platform-core/src/security/tenant-keys/tenant-key-repository.ts": {"lines":{"total":20,"covered":20,"skipped":0,"pct":100},"functions":{"total":7,"covered":7,"skipped":0,"pct":100},"statements":{"total":22,"covered":22,"skipped":0,"pct":100},"branches":{"total":5,"covered":5,"skipped":0,"pct":100}}
+,"/home/tsavo/platform-core/src/tenancy/drizzle-org-repository.ts": {"lines":{"total":38,"covered":37,"skipped":0,"pct":97.36},"functions":{"total":13,"covered":13,"skipped":0,"pct":100},"statements":{"total":45,"covered":42,"skipped":0,"pct":93.33},"branches":{"total":34,"covered":25,"skipped":0,"pct":73.52}}
+,"/home/tsavo/platform-core/src/tenancy/org-member-repository.ts": {"lines":{"total":23,"covered":19,"skipped":0,"pct":82.6},"functions":{"total":16,"covered":13,"skipped":0,"pct":81.25},"statements":{"total":23,"covered":19,"skipped":0,"pct":82.6},"branches":{"total":6,"covered":4,"skipped":0,"pct":66.66}}
+,"/home/tsavo/platform-core/src/tenancy/org-service.ts": {"lines":{"total":91,"covered":87,"skipped":0,"pct":95.6},"functions":{"total":19,"covered":18,"skipped":0,"pct":94.73},"statements":{"total":92,"covered":88,"skipped":0,"pct":95.65},"branches":{"total":47,"covered":42,"skipped":0,"pct":89.36}}
+,"/home/tsavo/platform-core/src/test/db.ts": {"lines":{"total":23,"covered":22,"skipped":0,"pct":95.65},"functions":{"total":9,"covered":8,"skipped":0,"pct":88.88},"statements":{"total":25,"covered":24,"skipped":0,"pct":96},"branches":{"total":20,"covered":13,"skipped":0,"pct":65}}
+,"/home/tsavo/platform-core/src/trpc/init.ts": {"lines":{"total":45,"covered":41,"skipped":0,"pct":91.11},"functions":{"total":5,"covered":5,"skipped":0,"pct":100},"statements":{"total":45,"covered":41,"skipped":0,"pct":91.11},"branches":{"total":24,"covered":20,"skipped":0,"pct":83.33}}
+}

package/dist/admin/index.d.ts

@@ -1,6 +1,6 @@
 export type { IAdminAuditLogRepository } from "./admin-audit-log-repository.js";
 export { DrizzleAdminAuditLogRepository } from "./admin-audit-log-repository.js";
-export type { AuditCategory, AuditEntry, AdminAuditLogRow, AuditFilters } from "./audit-log.js";
+export type { AdminAuditLogRow, AuditCategory, AuditEntry, AuditFilters } from "./audit-log.js";
 export { AdminAuditLog } from "./audit-log.js";
 export type { Role, UserRoleRow } from "./role-store.js";
 export { isValidRole, RoleStore } from "./role-store.js";

package/dist/auth/better-auth.d.ts

@@ -11,10 +11,55 @@ import { betterAuth } from "better-auth";
 import type { Pool } from "pg";
 import type { PlatformDb } from "../db/index.js";
 import { PgEmailVerifier } from "../email/verification.js";
+/** OAuth provider credentials. */
+export interface OAuthProvider {
+    clientId: string;
+    clientSecret: string;
+}
+/** Rate limit rule for a specific auth endpoint. */
+export interface AuthRateLimitRule {
+    window: number;
+    max: number;
+}
 /** Configuration for initializing Better Auth in platform-core. */
 export interface BetterAuthConfig {
     pool: Pool;
     db: PlatformDb;
+    /** HMAC secret for session tokens. Falls back to BETTER_AUTH_SECRET env var. */
+    secret?: string;
+    /** Base URL for OAuth callbacks. Falls back to BETTER_AUTH_URL env var. */
+    baseURL?: string;
+    /** Route prefix. Default: "/api/auth" */
+    basePath?: string;
+    /** Email+password config. Default: enabled with 12-char min. */
+    emailAndPassword?: {
+        enabled: boolean;
+        minPasswordLength?: number;
+    };
+    /** OAuth providers. Default: reads GITHUB/DISCORD/GOOGLE env vars. */
+    socialProviders?: {
+        github?: OAuthProvider;
+        discord?: OAuthProvider;
+        google?: OAuthProvider;
+    };
+    /** Trusted providers for account linking. Default: ["github", "google"] */
+    trustedProviders?: string[];
+    /** Enable 2FA plugin. Default: true */
+    twoFactor?: boolean;
+    /** Cookie cache max age in seconds. Default: 300 (5 min) */
+    sessionCacheMaxAge?: number;
+    /** Cookie prefix. Default: "better-auth" */
+    cookiePrefix?: string;
+    /** Cookie domain (e.g., ".wopr.bot"). Falls back to COOKIE_DOMAIN env var. */
+    cookieDomain?: string;
+    /** Global rate limit window in seconds. Default: 60 */
+    rateLimitWindow?: number;
+    /** Global rate limit max requests. Default: 100 */
+    rateLimitMax?: number;
+    /** Per-endpoint rate limit overrides. Default: sign-in/sign-up/reset limits. */
+    rateLimitRules?: Record<string, AuthRateLimitRule>;
+    /** Trusted origins for CORS. Falls back to UI_ORIGIN env var. */
+    trustedOrigins?: string[];
     /** Called after a new user signs up (e.g., create personal tenant). */
     onUserCreated?: (userId: string, userName: string, email: string) => Promise<void>;
 }

package/dist/auth/better-auth.js

@@ -16,8 +16,11 @@ import { getEmailClient } from "../email/client.js";
 import { passwordResetEmailTemplate, verifyEmailTemplate } from "../email/templates.js";
 import { generateVerificationToken, initVerificationSchema, PgEmailVerifier } from "../email/verification.js";
 import { createUserCreator } from "./user-creator.js";
-const BETTER_AUTH_SECRET = process.env.BETTER_AUTH_SECRET || "";
-const BETTER_AUTH_URL = process.env.BETTER_AUTH_URL || "http://localhost:3100";
+const DEFAULT_RATE_LIMIT_RULES = {
+    "/sign-in/email": { window: 900, max: 5 },
+    "/sign-up/email": { window: 3600, max: 10 },
+    "/request-password-reset": { window: 3600, max: 3 },
+};
 let _config = null;
 let _userCreator = null;
 let _userCreatorPromise = null;
@@ -34,32 +37,57 @@ async function getUserCreator() {
     }
     return _userCreatorPromise;
 }
-function authOptions(pool) {
+/** Resolve OAuth providers from config or env vars. */
+function resolveSocialProviders(cfg) {
+    if (cfg.socialProviders)
+        return cfg.socialProviders;
+    return {
+        ...(process.env.GITHUB_CLIENT_ID && process.env.GITHUB_CLIENT_SECRET
+            ? { github: { clientId: process.env.GITHUB_CLIENT_ID, clientSecret: process.env.GITHUB_CLIENT_SECRET } }
+            : {}),
+        ...(process.env.DISCORD_CLIENT_ID && process.env.DISCORD_CLIENT_SECRET
+            ? { discord: { clientId: process.env.DISCORD_CLIENT_ID, clientSecret: process.env.DISCORD_CLIENT_SECRET } }
+            : {}),
+        ...(process.env.GOOGLE_CLIENT_ID && process.env.GOOGLE_CLIENT_SECRET
+            ? { google: { clientId: process.env.GOOGLE_CLIENT_ID, clientSecret: process.env.GOOGLE_CLIENT_SECRET } }
+            : {}),
+    };
+}
+function authOptions(cfg) {
+    const pool = cfg.pool;
+    const secret = cfg.secret || process.env.BETTER_AUTH_SECRET;
+    if (!secret) {
+        if (process.env.NODE_ENV === "production") {
+            throw new Error("BETTER_AUTH_SECRET is required in production");
+        }
+        logger.warn("BetterAuth secret not configured — sessions may be insecure");
+    }
+    const baseURL = cfg.baseURL || process.env.BETTER_AUTH_URL || "http://localhost:3100";
+    const basePath = cfg.basePath || "/api/auth";
+    const cookieDomain = cfg.cookieDomain || process.env.COOKIE_DOMAIN;
+    const trustedOrigins = cfg.trustedOrigins ||
+        (process.env.UI_ORIGIN || "http://localhost:3001")
+            .split(",")
+            .map((o) => o.trim())
+            .filter(Boolean);
+    // Default minPasswordLength: 12 — caller must explicitly override, not accidentally omit
+    const emailAndPassword = cfg.emailAndPassword
+        ? { minPasswordLength: 12, ...cfg.emailAndPassword }
+        : { enabled: true, minPasswordLength: 12 };
     return {
         database: pool,
-        secret: BETTER_AUTH_SECRET,
-        baseURL: BETTER_AUTH_URL,
-        basePath: "/api/auth",
-        socialProviders: {
-            ...(process.env.GITHUB_CLIENT_ID && process.env.GITHUB_CLIENT_SECRET
-                ? { github: { clientId: process.env.GITHUB_CLIENT_ID, clientSecret: process.env.GITHUB_CLIENT_SECRET } }
-                : {}),
-            ...(process.env.DISCORD_CLIENT_ID && process.env.DISCORD_CLIENT_SECRET
-                ? { discord: { clientId: process.env.DISCORD_CLIENT_ID, clientSecret: process.env.DISCORD_CLIENT_SECRET } }
-                : {}),
-            ...(process.env.GOOGLE_CLIENT_ID && process.env.GOOGLE_CLIENT_SECRET
-                ? { google: { clientId: process.env.GOOGLE_CLIENT_ID, clientSecret: process.env.GOOGLE_CLIENT_SECRET } }
-                : {}),
-        },
+        secret: secret || "",
+        baseURL,
+        basePath,
+        socialProviders: resolveSocialProviders(cfg),
         account: {
             accountLinking: {
                 enabled: true,
-                trustedProviders: ["github", "google"],
+                trustedProviders: cfg.trustedProviders ?? ["github", "google"],
             },
         },
         emailAndPassword: {
-            enabled: true,
-            minPasswordLength: 12,
+            ...emailAndPassword,
             sendResetPassword: async ({ user, url }) => {
                 try {
                     const emailClient = getEmailClient();
@@ -87,12 +115,20 @@ function authOptions(pool) {
                         catch (error) {
                             logger.error("Failed to run user creator:", error);
                         }
+                        if (cfg.onUserCreated) {
+                            try {
+                                await cfg.onUserCreated(user.id, user.name || user.email, user.email);
+                            }
+                            catch (error) {
+                                logger.error("Failed to run onUserCreated callback:", error);
+                            }
+                        }
                         if (user.emailVerified)
                             return;
                         try {
                             await initVerificationSchema(pool);
                             const { token } = await generateVerificationToken(pool, user.id);
-                            const verifyUrl = `${BETTER_AUTH_URL}/auth/verify?token=${token}`;
+                            const verifyUrl = `${baseURL}${basePath}/verify?token=${token}`;
                             const emailClient = getEmailClient();
                             const template = verifyEmailTemplate(verifyUrl, user.email);
                             await emailClient.send({
@@ -105,45 +141,30 @@ function authOptions(pool) {
                         catch (error) {
                             logger.error("Failed to send verification email:", error);
                         }
-                        // Delegate personal tenant creation to the consumer
-                        if (_config?.onUserCreated) {
-                            try {
-                                await _config.onUserCreated(user.id, user.name || user.email, user.email);
-                            }
-                            catch (error) {
-                                logger.error("Failed to run onUserCreated callback:", error);
-                            }
-                        }
                     },
                 },
             },
         },
         session: {
-            cookieCache: { enabled: true, maxAge: 5 * 60 },
+            cookieCache: { enabled: true, maxAge: cfg.sessionCacheMaxAge ?? 300 },
         },
         advanced: {
-            cookiePrefix: "better-auth",
+            cookiePrefix: cfg.cookiePrefix || "better-auth",
             cookies: {
                 session_token: {
-                    attributes: {
-                        domain: process.env.COOKIE_DOMAIN || ".wopr.bot",
-                    },
+                    attributes: cookieDomain ? { domain: cookieDomain } : {},
                 },
             },
         },
-        plugins: [twoFactor()],
+        plugins: cfg.twoFactor !== false ? [twoFactor()] : [],
         rateLimit: {
             enabled: true,
-            window: 60,
-            max: 100,
-            customRules: {
-                "/sign-in/email": { window: 900, max: 5 },
-                "/sign-up/email": { window: 3600, max: 10 },
-                "/request-password-reset": { window: 3600, max: 3 },
-            },
+            window: cfg.rateLimitWindow ?? 60,
+            max: cfg.rateLimitMax ?? 100,
+            customRules: { ...DEFAULT_RATE_LIMIT_RULES, ...cfg.rateLimitRules },
             storage: "memory",
         },
-        trustedOrigins: (process.env.UI_ORIGIN || "http://localhost:3001").split(","),
+        trustedOrigins,
     };
 }
 /** Initialize Better Auth with the given config. Must be called before getAuth(). */
@@ -158,9 +179,11 @@ export async function runAuthMigrations() {
     if (!_config)
         throw new Error("BetterAuth not initialized — call initBetterAuth() first");
     const { getMigrations } = (await import("better-auth/db"));
-    const { runMigrations } = await getMigrations(authOptions(_config.pool));
+    const { runMigrations } = await getMigrations(authOptions(_config));
     await runMigrations();
-    await initTwoFactorSchema(_config.pool);
+    if (_config.twoFactor !== false) {
+        await initTwoFactorSchema(_config.pool);
+    }
 }
 let _auth = null;
 /**
@@ -171,7 +194,7 @@ export function getAuth() {
     if (!_auth) {
         if (!_config)
             throw new Error("BetterAuth not initialized — call initBetterAuth() first");
-        _auth = betterAuth(authOptions(_config.pool));
+        _auth = betterAuth(authOptions(_config));
     }
     return _auth;
 }

package/dist/auth/index.d.ts

@@ -184,3 +184,15 @@ export declare function validateTenantOwnership<T>(c: Context, resource: T | nul
  * @returns true if the user has access, false otherwise.
  */
 export declare function validateTenantAccess(userId: string, requestedTenantId: string | undefined, orgMemberRepo: IOrgMemberRepository): Promise<boolean>;
+export type { IApiKeyRepository } from "./api-key-repository.js";
+export { DrizzleApiKeyRepository } from "./api-key-repository.js";
+export type { Auth, AuthRateLimitRule, BetterAuthConfig, OAuthProvider, } from "./better-auth.js";
+export { getAuth, getEmailVerifier, initBetterAuth, resetAuth, resetUserCreator, runAuthMigrations, setAuth, } from "./better-auth.js";
+export type { ILoginHistoryRepository, LoginHistoryEntry } from "./login-history-repository.js";
+export { BetterAuthLoginHistoryRepository } from "./login-history-repository.js";
+export type { SessionAuthEnv } from "./middleware.js";
+export { dualAuth, sessionAuth } from "./middleware.js";
+export type { IUserCreator } from "./user-creator.js";
+export { createUserCreator } from "./user-creator.js";
+export type { IUserRoleRepository } from "./user-role-repository.js";
+export { DrizzleUserRoleRepository } from "./user-role-repository.js";

package/dist/auth/index.js

@@ -420,3 +420,10 @@ export async function validateTenantAccess(userId, requestedTenantId, orgMemberR
     const member = await orgMemberRepo.findMember(requestedTenantId, userId);
     return member !== null;
 }
+export { DrizzleApiKeyRepository } from "./api-key-repository.js";
+// Test utilities — do not call in production code
+export { getAuth, getEmailVerifier, initBetterAuth, resetAuth, resetUserCreator, runAuthMigrations, setAuth, } from "./better-auth.js";
+export { BetterAuthLoginHistoryRepository } from "./login-history-repository.js";
+export { dualAuth, sessionAuth } from "./middleware.js";
+export { createUserCreator } from "./user-creator.js";
+export { DrizzleUserRoleRepository } from "./user-role-repository.js";

package/dist/billing/drizzle-webhook-seen-repository.d.ts

@@ -1,5 +1,5 @@
-import type { PlatformDb } from "../db/index.js";
 import type { WebhookSeenEvent } from "../credits/repository-types.js";
+import type { PlatformDb } from "../db/index.js";
 import type { IWebhookSeenRepository } from "./webhook-seen-repository.js";
 export declare class DrizzleWebhookSeenRepository implements IWebhookSeenRepository {
     private readonly db;

package/dist/billing/index.d.ts

@@ -1,7 +1,7 @@
-export type { SavedPaymentMethod, CheckoutOpts, CheckoutSession, ChargeOpts, ChargeResult, SetupResult, PortalOpts, WebhookResult, IPaymentProcessor, Invoice, } from "./payment-processor.js";
+export { DrizzleWebhookSeenRepository } from "./drizzle-webhook-seen-repository.js";
+export type { ChargeOpts, ChargeResult, CheckoutOpts, CheckoutSession, Invoice, IPaymentProcessor, PortalOpts, SavedPaymentMethod, SetupResult, WebhookResult, } from "./payment-processor.js";
 export { PaymentMethodOwnershipError } from "./payment-processor.js";
+export * from "./payram/index.js";
+export * from "./stripe/index.js";
 export type { IWebhookSeenRepository } from "./webhook-seen-repository.js";
 export { noOpReplayGuard } from "./webhook-seen-repository.js";
-export { DrizzleWebhookSeenRepository } from "./drizzle-webhook-seen-repository.js";
-export * from "./stripe/index.js";
-export * from "./payram/index.js";

package/dist/billing/index.js

@@ -1,7 +1,7 @@
-export { PaymentMethodOwnershipError } from "./payment-processor.js";
-export { noOpReplayGuard } from "./webhook-seen-repository.js";
 export { DrizzleWebhookSeenRepository } from "./drizzle-webhook-seen-repository.js";
-// Stripe
-export * from "./stripe/index.js";
+export { PaymentMethodOwnershipError } from "./payment-processor.js";
 // PayRam
 export * from "./payram/index.js";
+// Stripe
+export * from "./stripe/index.js";
+export { noOpReplayGuard } from "./webhook-seen-repository.js";

package/dist/billing/payram/webhook.test.js

@@ -5,8 +5,8 @@
  * no-op status, idempotency, replay guard, and bot reactivation.
  */
 import { afterAll, beforeAll, beforeEach, describe, expect, it, vi } from "vitest";
-import { createTestDb, truncateAllTables } from "../../test/db.js";
 import { CreditLedger } from "../../credits/credit-ledger.js";
+import { createTestDb, truncateAllTables } from "../../test/db.js";
 import { DrizzleWebhookSeenRepository } from "../drizzle-webhook-seen-repository.js";
 import { noOpReplayGuard } from "../webhook-seen-repository.js";
 import { PayRamChargeRepository } from "./charge-store.js";

package/dist/billing/stripe/index.d.ts

@@ -1,14 +1,14 @@
 export { createCreditCheckoutSession, createVpsCheckoutSession } from "./checkout.js";
 export { createStripeClient, loadStripeConfig } from "./client.js";
-export type { CreditPricePoint, CreditPriceMap } from "./credit-prices.js";
-export { CREDIT_PRICE_POINTS, loadCreditPriceMap, getCreditAmountForPurchase, lookupCreditPrice, getConfiguredPriceIds } from "./credit-prices.js";
-export { detachPaymentMethod, detachAllPaymentMethods } from "./payment-methods.js";
+export type { CreditPriceMap, CreditPricePoint } from "./credit-prices.js";
+export { CREDIT_PRICE_POINTS, getConfiguredPriceIds, getCreditAmountForPurchase, loadCreditPriceMap, lookupCreditPrice, } from "./credit-prices.js";
 export type { DetachPaymentMethodOpts } from "./payment-methods.js";
+export { detachAllPaymentMethods, detachPaymentMethod } from "./payment-methods.js";
 export { createPortalSession } from "./portal.js";
 export type { SetupIntentOpts } from "./setup-intent.js";
 export { createSetupIntent } from "./setup-intent.js";
-export type { StripeWebhookHandlerResult, StripePaymentProcessorDeps } from "./stripe-payment-processor.js";
+export type { StripePaymentProcessorDeps, StripeWebhookHandlerResult } from "./stripe-payment-processor.js";
 export { StripePaymentProcessor } from "./stripe-payment-processor.js";
 export type { ITenantCustomerRepository } from "./tenant-store.js";
 export { DrizzleTenantCustomerRepository, TenantCustomerRepository } from "./tenant-store.js";
-export type { TenantCustomerRow, CreditCheckoutOpts, PortalSessionOpts, VpsCheckoutOpts, StripeBillingConfig } from "./types.js";
+export type { CreditCheckoutOpts, PortalSessionOpts, StripeBillingConfig, TenantCustomerRow, VpsCheckoutOpts, } from "./types.js";

package/dist/billing/stripe/index.js

@@ -1,7 +1,7 @@
 export { createCreditCheckoutSession, createVpsCheckoutSession } from "./checkout.js";
 export { createStripeClient, loadStripeConfig } from "./client.js";
-export { CREDIT_PRICE_POINTS, loadCreditPriceMap, getCreditAmountForPurchase, lookupCreditPrice, getConfiguredPriceIds } from "./credit-prices.js";
-export { detachPaymentMethod, detachAllPaymentMethods } from "./payment-methods.js";
+export { CREDIT_PRICE_POINTS, getConfiguredPriceIds, getCreditAmountForPurchase, loadCreditPriceMap, lookupCreditPrice, } from "./credit-prices.js";
+export { detachAllPaymentMethods, detachPaymentMethod } from "./payment-methods.js";
 export { createPortalSession } from "./portal.js";
 export { createSetupIntent } from "./setup-intent.js";
 export { StripePaymentProcessor } from "./stripe-payment-processor.js";

package/dist/billing/stripe/stripe-payment-processor.js

@@ -1,5 +1,5 @@
-import { Credit } from "../../credits/credit.js";
 import { chargeAutoTopup } from "../../credits/auto-topup-charge.js";
+import { Credit } from "../../credits/credit.js";
 import { PaymentMethodOwnershipError, } from "../payment-processor.js";
 import { createCreditCheckoutSession } from "./checkout.js";
 import { createPortalSession } from "./portal.js";

package/dist/credits/auto-topup-charge.d.ts

@@ -1,8 +1,8 @@
 import Stripe from "stripe";
-import type { Credit } from "./credit.js";
-import type { ITenantCustomerRepository } from "./tenant-customer-repository.js";
 import type { IAutoTopupEventLogRepository } from "./auto-topup-event-log-repository.js";
+import type { Credit } from "./credit.js";
 import type { ICreditLedger } from "./credit-ledger.js";
+import type { ITenantCustomerRepository } from "./tenant-customer-repository.js";
 /** After this many consecutive Stripe failures, the auto-topup mode is disabled. */
 export declare const MAX_CONSECUTIVE_FAILURES = 3;
 export interface AutoTopupChargeDeps {