@xk2800/nextjs-template 0.5.3

package/dist/users/queries.d.ts

@@ -0,0 +1,71 @@
+declare function getUserById(id: string): Promise<{
+    id: string;
+    name: string;
+    email: string;
+    password: string | null;
+    emailVerified: boolean;
+    image: string | null;
+    role: "user" | "admin";
+    banned: boolean;
+    bannedAt: Date | null;
+    bannedReason: string | null;
+    banExpires: Date | null;
+    lastLoginAt: Date | null;
+    lastActiveAt: Date | null;
+    twoFactorEnabled: boolean;
+    createdAt: Date;
+    updatedAt: Date;
+}>;
+declare function getAdminEmails(): Promise<string[]>;
+interface UserFilters {
+    search?: string;
+    page?: number;
+    limit?: number;
+}
+declare function getUsersFiltered({ search, page, limit }: UserFilters): Promise<{
+    users: {
+        id: string;
+        name: string;
+        email: string;
+        password: string | null;
+        emailVerified: boolean;
+        image: string | null;
+        role: "user" | "admin";
+        banned: boolean;
+        bannedAt: Date | null;
+        bannedReason: string | null;
+        banExpires: Date | null;
+        lastLoginAt: Date | null;
+        lastActiveAt: Date | null;
+        twoFactorEnabled: boolean;
+        createdAt: Date;
+        updatedAt: Date;
+    }[];
+    total: number;
+    page: number;
+    limit: number;
+    pages: number;
+}>;
+interface UserExportFilters {
+    search?: string;
+}
+declare function getUsersForExport({ search }: UserExportFilters): Promise<{
+    id: string;
+    name: string;
+    email: string;
+    password: string | null;
+    emailVerified: boolean;
+    image: string | null;
+    role: "user" | "admin";
+    banned: boolean;
+    bannedAt: Date | null;
+    bannedReason: string | null;
+    banExpires: Date | null;
+    lastLoginAt: Date | null;
+    lastActiveAt: Date | null;
+    twoFactorEnabled: boolean;
+    createdAt: Date;
+    updatedAt: Date;
+}[]>;
+
+export { type UserExportFilters, type UserFilters, getAdminEmails, getUserById, getUsersFiltered, getUsersForExport };

package/dist/users/queries.js

@@ -0,0 +1,293 @@
+'use strict';
+
+require('server-only');
+var serverless = require('@neondatabase/serverless');
+var neonHttp = require('drizzle-orm/neon-http');
+var nodePostgres = require('drizzle-orm/node-postgres');
+var pg = require('pg');
+var pgCore = require('drizzle-orm/pg-core');
+var drizzleOrm = require('drizzle-orm');
+var cuid2 = require('@paralleldrive/cuid2');
+var zod = require('zod');
+
+var __defProp = Object.defineProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+// server/db/schema.ts
+var schema_exports = {};
+__export(schema_exports, {
+  ActivityActionEnum: () => ActivityActionEnum,
+  RoleEnum: () => RoleEnum,
+  accounts: () => accounts,
+  activityLogs: () => activityLogs,
+  authThrottle: () => authThrottle,
+  deviceFingerprints: () => deviceFingerprints,
+  passkeys: () => passkeys,
+  sessions: () => sessions,
+  systemSettings: () => systemSettings,
+  twoFactors: () => twoFactors,
+  users: () => users,
+  verifications: () => verifications
+});
+var RoleEnum = pgCore.pgEnum("roles", ["user", "admin"]);
+var ActivityActionEnum = pgCore.pgEnum("activity_actions", [
+  "login",
+  "logout",
+  "login_failed",
+  "password_changed",
+  "email_changed",
+  "profile_updated",
+  "session_revoked",
+  "user_deleted",
+  "user_banned",
+  "user_unbanned",
+  "role_changed",
+  "impersonation_started",
+  "impersonation_stopped",
+  "settings_changed",
+  "passkey_added",
+  "passkey_removed"
+]);
+var users = pgCore.pgTable("user", {
+  id: pgCore.text("id").notNull().primaryKey().$defaultFn(() => cuid2.createId()),
+  name: pgCore.text("name").notNull(),
+  email: pgCore.text("email").notNull().unique(),
+  password: pgCore.text("password"),
+  emailVerified: pgCore.boolean("emailVerified").notNull().default(false),
+  image: pgCore.text("image"),
+  role: RoleEnum("roles").default("user").notNull(),
+  banned: pgCore.boolean("banned").default(false).notNull(),
+  bannedAt: pgCore.timestamp("bannedAt"),
+  bannedReason: pgCore.text("bannedReason"),
+  // Required by better-auth's admin plugin schema (auto-expiring bans). We
+  // never set this ourselves, so it stays null and bans behave as permanent,
+  // same as before the plugin was added.
+  banExpires: pgCore.timestamp("banExpires"),
+  lastLoginAt: pgCore.timestamp("lastLoginAt"),
+  lastActiveAt: pgCore.timestamp("lastActiveAt"),
+  // Set by better-auth's twoFactor plugin — true once the user has
+  // completed TOTP setup (see twoFactor pgTable below for the secret /
+  // backup codes themselves).
+  twoFactorEnabled: pgCore.boolean("twoFactorEnabled").notNull().default(false),
+  createdAt: pgCore.timestamp("createdAt").notNull().defaultNow(),
+  updatedAt: pgCore.timestamp("updatedAt").notNull().defaultNow()
+});
+var sessions = pgCore.pgTable("session", {
+  id: pgCore.text("id").notNull().primaryKey().$defaultFn(() => cuid2.createId()),
+  expiresAt: pgCore.timestamp("expiresAt").notNull(),
+  token: pgCore.text("token").notNull().unique(),
+  createdAt: pgCore.timestamp("createdAt").notNull().defaultNow(),
+  updatedAt: pgCore.timestamp("updatedAt").notNull().defaultNow(),
+  ipAddress: pgCore.text("ipAddress"),
+  userAgent: pgCore.text("userAgent"),
+  userId: pgCore.text("userId").notNull().references(() => users.id, { onDelete: "cascade" }),
+  // Set by better-auth's admin plugin while this session is an admin
+  // impersonating another user; holds the impersonating admin's user id.
+  impersonatedBy: pgCore.text("impersonatedBy")
+});
+var accounts = pgCore.pgTable("account", {
+  id: pgCore.text("id").notNull().primaryKey().$defaultFn(() => cuid2.createId()),
+  accountId: pgCore.text("accountId").notNull(),
+  providerId: pgCore.text("providerId").notNull(),
+  userId: pgCore.text("userId").notNull().references(() => users.id, { onDelete: "cascade" }),
+  accessToken: pgCore.text("accessToken"),
+  refreshToken: pgCore.text("refreshToken"),
+  idToken: pgCore.text("idToken"),
+  accessTokenExpiresAt: pgCore.timestamp("accessTokenExpiresAt"),
+  refreshTokenExpiresAt: pgCore.timestamp("refreshTokenExpiresAt"),
+  scope: pgCore.text("scope"),
+  password: pgCore.text("password"),
+  createdAt: pgCore.timestamp("createdAt").notNull().defaultNow(),
+  updatedAt: pgCore.timestamp("updatedAt").notNull().defaultNow()
+});
+var twoFactors = pgCore.pgTable("twoFactor", {
+  id: pgCore.text("id").notNull().primaryKey().$defaultFn(() => cuid2.createId()),
+  secret: pgCore.text("secret").notNull(),
+  backupCodes: pgCore.text("backupCodes").notNull(),
+  userId: pgCore.text("userId").notNull().references(() => users.id, { onDelete: "cascade" })
+});
+var passkeys = pgCore.pgTable("passkey", {
+  id: pgCore.text("id").notNull().primaryKey().$defaultFn(() => cuid2.createId()),
+  name: pgCore.text("name"),
+  publicKey: pgCore.text("publicKey").notNull(),
+  userId: pgCore.text("userId").notNull().references(() => users.id, { onDelete: "cascade" }),
+  credentialID: pgCore.text("credentialID").notNull().unique(),
+  counter: pgCore.integer("counter").notNull(),
+  deviceType: pgCore.text("deviceType").notNull(),
+  backedUp: pgCore.boolean("backedUp").notNull(),
+  transports: pgCore.text("transports"),
+  createdAt: pgCore.timestamp("createdAt"),
+  aaguid: pgCore.text("aaguid")
+});
+var verifications = pgCore.pgTable("verification", {
+  id: pgCore.text("id").notNull().primaryKey().$defaultFn(() => cuid2.createId()),
+  identifier: pgCore.text("identifier").notNull(),
+  value: pgCore.text("value").notNull(),
+  expiresAt: pgCore.timestamp("expiresAt").notNull(),
+  createdAt: pgCore.timestamp("createdAt").notNull().defaultNow(),
+  updatedAt: pgCore.timestamp("updatedAt").notNull().defaultNow()
+});
+var activityLogs = pgCore.pgTable("activity_log", {
+  id: pgCore.text("id").notNull().primaryKey().$defaultFn(() => cuid2.createId()),
+  userId: pgCore.text("userId").notNull().references(() => users.id, { onDelete: "cascade" }),
+  action: ActivityActionEnum("action").notNull(),
+  description: pgCore.text("description").notNull(),
+  ipAddress: pgCore.text("ipAddress"),
+  userAgent: pgCore.text("userAgent"),
+  metadata: pgCore.text("metadata"),
+  // Populated on 'login' events only (registration + sign-in) — parsed from
+  // userAgent/ipAddress at write time so the record stays stable even if
+  // the parsing library or geoip database changes later.
+  referrerUrl: pgCore.text("referrerUrl"),
+  os: pgCore.text("os"),
+  browser: pgCore.text("browser"),
+  deviceType: pgCore.text("deviceType"),
+  country: pgCore.text("country"),
+  city: pgCore.text("city"),
+  createdAt: pgCore.timestamp("createdAt").notNull().defaultNow()
+});
+var deviceFingerprints = pgCore.pgTable("device_fingerprint", {
+  id: pgCore.text("id").notNull().primaryKey().$defaultFn(() => cuid2.createId()),
+  userId: pgCore.text("userId").notNull().references(() => users.id, { onDelete: "cascade" }),
+  visitorId: pgCore.text("visitorId").notNull(),
+  // Context captured at first-seen time — for the admin panel's "New devices"
+  // card and the alert email. Not part of the new-vs-known decision (that's
+  // visitorId only), just so an admin can eyeball whether a sign-in looks like
+  // a hijack. Nullable: an old row predates these columns, or geoip missed.
+  ipAddress: pgCore.text("ipAddress"),
+  userAgent: pgCore.text("userAgent"),
+  country: pgCore.text("country"),
+  city: pgCore.text("city"),
+  createdAt: pgCore.timestamp("createdAt").notNull().defaultNow()
+}, (table) => [
+  pgCore.unique("device_fingerprint_user_visitor").on(table.userId, table.visitorId)
+]);
+var authThrottle = pgCore.pgTable("auth_throttle", {
+  fingerprint: pgCore.text("fingerprint").notNull().primaryKey(),
+  count: pgCore.integer("count").notNull().default(0),
+  windowStart: pgCore.timestamp("windowStart").notNull().defaultNow(),
+  // Blockable data points, overwritten on every attempt (last-write-wins) so
+  // the admin panel can show who to block — by IP or by fingerprint — with no
+  // join and no per-attempt history table. windowStart anchors the counter's
+  // window; lastAttemptAt is just "most recently seen".
+  lastAttemptAt: pgCore.timestamp("lastAttemptAt").notNull().defaultNow(),
+  ipAddress: pgCore.text("ipAddress"),
+  userAgent: pgCore.text("userAgent"),
+  lastEmail: pgCore.text("lastEmail"),
+  lastKind: pgCore.text("lastKind")
+  // 'signin' | 'signup'
+});
+var systemSettings = pgCore.pgTable("system_settings", {
+  id: pgCore.text("id").primaryKey().default("default"),
+  maintenanceMode: pgCore.boolean("maintenanceMode").notNull().default(false),
+  maintenanceMessage: pgCore.text("maintenanceMessage"),
+  authEnableGoogle: pgCore.boolean("authEnableGoogle").notNull().default(true),
+  authEnableEmailPassword: pgCore.boolean("authEnableEmailPassword").notNull().default(true),
+  authEnableOneTap: pgCore.boolean("authEnableOneTap").notNull().default(false),
+  enableSessionRevocation: pgCore.boolean("enableSessionRevocation").notNull().default(true),
+  updatedAt: pgCore.timestamp("updatedAt").notNull().defaultNow(),
+  // Who last changed a setting. This row doesn't "belong" to that admin the
+  // way sessions/activityLogs belong to their user, so deleting that admin's
+  // account should null this out rather than cascade-delete the singleton row.
+  updatedBy: pgCore.text("updatedBy").references(() => users.id, { onDelete: "set null" })
+}, (table) => [
+  pgCore.check("system_settings_singleton", drizzleOrm.sql`${table.id} = 'default'`)
+]);
+var envSchema = zod.z.object({
+  NODE_ENV: zod.z.enum(["development", "production", "test"]).default("development"),
+  PORT: zod.z.string().default("3000").transform(Number),
+  DATABASE_URL: zod.z.string().default(""),
+  RESEND_API_KEY: zod.z.string().default(""),
+  // Display name for this deployment — shown as the authenticator-app label
+  // (2FA issuer) and the passkey relying-party name. Consuming projects set
+  // this in their own .env; defaults to the template name.
+  APP_NAME: zod.z.string().default("Next.js Template"),
+  // Seed-only: the live value lives in the system_settings DB row (see
+  // lib/settings-queries.ts) once it's been seeded on first read, and is
+  // changed from the admin System Settings page, not by editing this var.
+  ENABLE_SESSION_REVOCATION: zod.z.string().default("true").transform((val) => val === "true"),
+  AUTH_ENABLE_GOOGLE: zod.z.string().default("true").transform((val) => val === "true"),
+  AUTH_ENABLE_EMAIL_PASSWORD: zod.z.string().default("true").transform((val) => val === "true"),
+  AUTH_ENABLE_ONE_TAP: zod.z.string().default("false").transform((val) => val === "true"),
+  DB_DRIVER: zod.z.enum(["pg", "neon"]).default("pg"),
+  // Only relevant when DB_DRIVER=pg — whether the target Postgres server has SSL
+  // enabled. Self-hosted Postgres (e.g. via Docker/Dokploy) typically does not.
+  DATABASE_SSL: zod.z.string().default("false").transform((val) => val === "true")
+});
+
+// config/env.ts
+var results = envSchema.safeParse(process.env);
+if (results.success && results.data.NODE_ENV === "development") {
+  console.log("Environment variables loaded:", Object.keys(results.data));
+}
+if (!results.success) {
+  console.error("Invalid environment variables:", results.error.format());
+  throw new Error("Invalid environment variables");
+}
+var config = results.data;
+
+// server/db/index.ts
+var db;
+if (config.DB_DRIVER === "pg") {
+  const pool = new pg.Pool({
+    connectionString: config.DATABASE_URL,
+    ssl: config.DATABASE_SSL ? { rejectUnauthorized: false } : void 0
+  });
+  db = nodePostgres.drizzle(pool, {
+    schema: schema_exports,
+    logger: true
+  });
+  console.log("\u{1F7E1} Using PostgreSQL (pg) driver");
+} else if (config.DB_DRIVER === "neon") {
+  const sql3 = serverless.neon(config.DATABASE_URL);
+  db = neonHttp.drizzle(sql3, { schema: schema_exports, logger: true });
+  console.log("\u{1F7E2} Using Neon (HTTP) driver");
+} else {
+  console.log("Database connection not established, unknown DB_DRIVER:", config.DB_DRIVER);
+}
+async function getUserById(id) {
+  const result = await db.select().from(users).where(drizzleOrm.eq(users.id, id)).limit(1);
+  return result[0] || null;
+}
+async function getAdminEmails() {
+  const rows = await db.select({ email: users.email }).from(users).where(drizzleOrm.eq(users.role, "admin"));
+  return rows.map((r) => r.email);
+}
+function buildUsersWhere(search) {
+  return search.trim() ? drizzleOrm.or(
+    drizzleOrm.like(users.name, `%${search}%`),
+    drizzleOrm.like(users.email, `%${search}%`)
+  ) : void 0;
+}
+async function getUsersFiltered({ search = "", page = 1, limit = 10 }) {
+  var _a, _b;
+  const offset = (page - 1) * limit;
+  const where = buildUsersWhere(search);
+  const [usersList, countResult] = await Promise.all([
+    db.select().from(users).where(where).orderBy(drizzleOrm.desc(users.createdAt)).limit(limit).offset(offset),
+    db.select({ count: drizzleOrm.sql`count(*)` }).from(users).where(where)
+  ]);
+  const total = Number((_b = (_a = countResult[0]) == null ? void 0 : _a.count) != null ? _b : 0);
+  return {
+    users: usersList,
+    total,
+    page,
+    limit,
+    pages: Math.ceil(total / limit)
+  };
+}
+var EXPORT_ROW_LIMIT = 1e4;
+async function getUsersForExport({ search = "" }) {
+  const where = buildUsersWhere(search);
+  return db.select().from(users).where(where).orderBy(drizzleOrm.desc(users.createdAt)).limit(EXPORT_ROW_LIMIT);
+}
+
+exports.getAdminEmails = getAdminEmails;
+exports.getUserById = getUserById;
+exports.getUsersFiltered = getUsersFiltered;
+exports.getUsersForExport = getUsersForExport;
+//# sourceMappingURL=queries.js.map
+//# sourceMappingURL=queries.js.map

package/dist/users/queries.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../server/db/schema.ts","../../config/env-schema.ts","../../config/env.ts","../../server/db/index.ts","../../lib/user-queries.ts"],"names":["pgEnum","pgTable","text","createId","boolean","timestamp","integer","unique","check","sql","z","Pool","drizzlePg","neon","drizzle","eq","or","like","desc"],"mappings":";;;;;;;;;;;;;;;;;;;AAAA,IAAA,cAAA,GAAA,EAAA;AAAA,QAAA,CAAA,cAAA,EAAA;AAAA,EAAA,kBAAA,EAAA,MAAA,kBAAA;AAAA,EAAA,QAAA,EAAA,MAAA,QAAA;AAAA,EAAA,QAAA,EAAA,MAAA,QAAA;AAAA,EAAA,YAAA,EAAA,MAAA,YAAA;AAAA,EAAA,YAAA,EAAA,MAAA,YAAA;AAAA,EAAA,kBAAA,EAAA,MAAA,kBAAA;AAAA,EAAA,QAAA,EAAA,MAAA,QAAA;AAAA,EAAA,QAAA,EAAA,MAAA,QAAA;AAAA,EAAA,cAAA,EAAA,MAAA,cAAA;AAAA,EAAA,UAAA,EAAA,MAAA,UAAA;AAAA,EAAA,KAAA,EAAA,MAAA,KAAA;AAAA,EAAA,aAAA,EAAA,MAAA;AAAA,CAAA,CAAA;AAIO,IAAM,WAAWA,aAAA,CAAO,OAAA,EAAS,CAAC,MAAA,EAAQ,OAAO,CAAC,CAAA;AAElD,IAAM,kBAAA,GAAqBA,cAAO,kBAAA,EAAoB;AAAA,EAC3D,OAAA;AAAA,EACA,QAAA;AAAA,EACA,cAAA;AAAA,EACA,kBAAA;AAAA,EACA,eAAA;AAAA,EACA,iBAAA;AAAA,EACA,iBAAA;AAAA,EACA,cAAA;AAAA,EACA,aAAA;AAAA,EACA,eAAA;AAAA,EACA,cAAA;AAAA,EACA,uBAAA;AAAA,EACA,uBAAA;AAAA,EACA,kBAAA;AAAA,EACA,eAAA;AAAA,EACA;AACF,CAAC,CAAA;AAEM,IAAM,KAAA,GAAQC,eAAQ,MAAA,EAAQ;AAAA,EACnC,EAAA,EAAIC,WAAA,CAAK,IAAI,CAAA,CAAE,OAAA,EAAQ,CAAE,UAAA,EAAW,CAAE,UAAA,CAAW,MAAMC,cAAA,EAAU,CAAA;AAAA,EACjE,IAAA,EAAMD,WAAA,CAAK,MAAM,CAAA,CAAE,OAAA,EAAQ;AAAA,EAC3B,OAAOA,WAAA,CAAK,OAAO,CAAA,CAAE,OAAA,GAAU,MAAA,EAAO;AAAA,EACtC,QAAA,EAAUA,YAAK,UAAU,CAAA;AAAA,EACzB,eAAeE,cAAA,CAAQ,eAAe,EAAE,OAAA,EAAQ,CAAE,QAAQ,KAAK,CAAA;AAAA,EAC/D,KAAA,EAAOF,YAAK,OAAO,CAAA;AAAA,EACnB,MAAM,QAAA,CAAS,OAAO,EAAE,OAAA,CAAQ,MAAM,EAAE,OAAA,EAAQ;AAAA,EAChD,QAAQE,cAAA,CAAQ,QAAQ,EAAE,OAAA,CAAQ,KAAK,EAAE,OAAA,EAAQ;AAAA,EACjD,QAAA,EAAUC,iBAAU,UAAU,CAAA;AAAA,EAC9B,YAAA,EAAcH,YAAK,cAAc,CAAA;AAAA;AAAA;AAAA;AAAA,EAIjC,UAAA,EAAYG,iBAAU,YAAY,CAAA;AAAA,EAClC,WAAA,EAAaA,iBAAU,aAAa,CAAA;AAAA,EACpC,YAAA,EAAcA,iBAAU,cAAc,CAAA;AAAA;AAAA;AAAA;AAAA,EAItC,kBAAkBD,cAAA,CAAQ,kBAAkB,EAAE,OAAA,EAAQ,CAAE,QAAQ,KAAK,CAAA;AAAA,EACrE,WAAWC,gBAAA,CAAU,WAAW,CAAA,CAAE,OAAA,GAAU,UAAA,EAAW;AAAA,EACvD,WAAWA,gBAAA,CAAU,WAAW,CAAA,CAAE,OAAA,GAAU,UAAA;AAC9C,CAAC,CAAA;AAEM,IAAM,QAAA,GAAWJ,eAAQ,SAAA,EAAW;AAAA,EACzC,EAAA,EAAIC,WAAA,CAAK,IAAI,CAAA,CAAE,OAAA,EAAQ,CAAE,UAAA,EAAW,CAAE,UAAA,CAAW,MAAMC,cAAA,EAAU,CAAA;AAAA,EACjE,SAAA,EAAWE,gBAAA,CAAU,WAAW,CAAA,CAAE,OAAA,EAAQ;AAAA,EAC1C,OAAOH,WAAA,CAAK,OAAO,CAAA,CAAE,OAAA,GAAU,MAAA,EAAO;AAAA,EACtC,WAAWG,gBAAA,CAAU,WAAW,CAAA,CAAE,OAAA,GAAU,UAAA,EAAW;AAAA,EACvD,WAAWA,gBAAA,CAAU,WAAW,CAAA,CAAE,OAAA,GAAU,UAAA,EAAW;AAAA,EACvD,SAAA,EAAWH,YAAK,WAAW,CAAA;AAAA,EAC3B,SAAA,EAAWA,YAAK,WAAW,CAAA;AAAA,EAC3B,MAAA,EAAQA,WAAA,CAAK,QAAQ,CAAA,CAClB,OAAA,EAAQ,CACR,UAAA,CAAW,MAAM,KAAA,CAAM,EAAA,EAAI,EAAE,QAAA,EAAU,WAAW,CAAA;AAAA;AAAA;AAAA,EAGrD,cAAA,EAAgBA,YAAK,gBAAgB;AACvC,CAAC,CAAA;AAEM,IAAM,QAAA,GAAWD,eAAQ,SAAA,EAAW;AAAA,EACzC,EAAA,EAAIC,WAAA,CAAK,IAAI,CAAA,CAAE,OAAA,EAAQ,CAAE,UAAA,EAAW,CAAE,UAAA,CAAW,MAAMC,cAAA,EAAU,CAAA;AAAA,EACjE,SAAA,EAAWD,WAAA,CAAK,WAAW,CAAA,CAAE,OAAA,EAAQ;AAAA,EACrC,UAAA,EAAYA,WAAA,CAAK,YAAY,CAAA,CAAE,OAAA,EAAQ;AAAA,EACvC,MAAA,EAAQA,WAAA,CAAK,QAAQ,CAAA,CAClB,OAAA,EAAQ,CACR,UAAA,CAAW,MAAM,KAAA,CAAM,EAAA,EAAI,EAAE,QAAA,EAAU,WAAW,CAAA;AAAA,EACrD,WAAA,EAAaA,YAAK,aAAa,CAAA;AAAA,EAC/B,YAAA,EAAcA,YAAK,cAAc,CAAA;AAAA,EACjC,OAAA,EAASA,YAAK,SAAS,CAAA;AAAA,EACvB,oBAAA,EAAsBG,iBAAU,sBAAsB,CAAA;AAAA,EACtD,qBAAA,EAAuBA,iBAAU,uBAAuB,CAAA;AAAA,EACxD,KAAA,EAAOH,YAAK,OAAO,CAAA;AAAA,EACnB,QAAA,EAAUA,YAAK,UAAU,CAAA;AAAA,EACzB,WAAWG,gBAAA,CAAU,WAAW,CAAA,CAAE,OAAA,GAAU,UAAA,EAAW;AAAA,EACvD,WAAWA,gBAAA,CAAU,WAAW,CAAA,CAAE,OAAA,GAAU,UAAA;AAC9C,CAAC,CAAA;AAMM,IAAM,UAAA,GAAaJ,eAAQ,WAAA,EAAa;AAAA,EAC7C,EAAA,EAAIC,WAAA,CAAK,IAAI,CAAA,CAAE,OAAA,EAAQ,CAAE,UAAA,EAAW,CAAE,UAAA,CAAW,MAAMC,cAAA,EAAU,CAAA;AAAA,EACjE,MAAA,EAAQD,WAAA,CAAK,QAAQ,CAAA,CAAE,OAAA,EAAQ;AAAA,EAC/B,WAAA,EAAaA,WAAA,CAAK,aAAa,CAAA,CAAE,OAAA,EAAQ;AAAA,EACzC,MAAA,EAAQA,WAAA,CAAK,QAAQ,CAAA,CAClB,OAAA,EAAQ,CACR,UAAA,CAAW,MAAM,KAAA,CAAM,EAAA,EAAI,EAAE,QAAA,EAAU,WAAW;AACvD,CAAC,CAAA;AAGM,IAAM,QAAA,GAAWD,eAAQ,SAAA,EAAW;AAAA,EACzC,EAAA,EAAIC,WAAA,CAAK,IAAI,CAAA,CAAE,OAAA,EAAQ,CAAE,UAAA,EAAW,CAAE,UAAA,CAAW,MAAMC,cAAA,EAAU,CAAA;AAAA,EACjE,IAAA,EAAMD,YAAK,MAAM,CAAA;AAAA,EACjB,SAAA,EAAWA,WAAA,CAAK,WAAW,CAAA,CAAE,OAAA,EAAQ;AAAA,EACrC,MAAA,EAAQA,WAAA,CAAK,QAAQ,CAAA,CAClB,OAAA,EAAQ,CACR,UAAA,CAAW,MAAM,KAAA,CAAM,EAAA,EAAI,EAAE,QAAA,EAAU,WAAW,CAAA;AAAA,EACrD,cAAcA,WAAA,CAAK,cAAc,CAAA,CAAE,OAAA,GAAU,MAAA,EAAO;AAAA,EACpD,OAAA,EAASI,cAAA,CAAQ,SAAS,CAAA,CAAE,OAAA,EAAQ;AAAA,EACpC,UAAA,EAAYJ,WAAA,CAAK,YAAY,CAAA,CAAE,OAAA,EAAQ;AAAA,EACvC,QAAA,EAAUE,cAAA,CAAQ,UAAU,CAAA,CAAE,OAAA,EAAQ;AAAA,EACtC,UAAA,EAAYF,YAAK,YAAY,CAAA;AAAA,EAC7B,SAAA,EAAWG,iBAAU,WAAW,CAAA;AAAA,EAChC,MAAA,EAAQH,YAAK,QAAQ;AACvB,CAAC,CAAA;AAEM,IAAM,aAAA,GAAgBD,eAAQ,cAAA,EAAgB;AAAA,EACnD,EAAA,EAAIC,WAAA,CAAK,IAAI,CAAA,CAAE,OAAA,EAAQ,CAAE,UAAA,EAAW,CAAE,UAAA,CAAW,MAAMC,cAAA,EAAU,CAAA;AAAA,EACjE,UAAA,EAAYD,WAAA,CAAK,YAAY,CAAA,CAAE,OAAA,EAAQ;AAAA,EACvC,KAAA,EAAOA,WAAA,CAAK,OAAO,CAAA,CAAE,OAAA,EAAQ;AAAA,EAC7B,SAAA,EAAWG,gBAAA,CAAU,WAAW,CAAA,CAAE,OAAA,EAAQ;AAAA,EAC1C,WAAWA,gBAAA,CAAU,WAAW,CAAA,CAAE,OAAA,GAAU,UAAA,EAAW;AAAA,EACvD,WAAWA,gBAAA,CAAU,WAAW,CAAA,CAAE,OAAA,GAAU,UAAA;AAC9C,CAAC,CAAA;AAEM,IAAM,YAAA,GAAeJ,eAAQ,cAAA,EAAgB;AAAA,EAClD,EAAA,EAAIC,WAAA,CAAK,IAAI,CAAA,CAAE,OAAA,EAAQ,CAAE,UAAA,EAAW,CAAE,UAAA,CAAW,MAAMC,cAAA,EAAU,CAAA;AAAA,EACjE,MAAA,EAAQD,WAAA,CAAK,QAAQ,CAAA,CAClB,OAAA,EAAQ,CACR,UAAA,CAAW,MAAM,KAAA,CAAM,EAAA,EAAI,EAAE,QAAA,EAAU,WAAW,CAAA;AAAA,EACrD,MAAA,EAAQ,kBAAA,CAAmB,QAAQ,CAAA,CAAE,OAAA,EAAQ;AAAA,EAC7C,WAAA,EAAaA,WAAA,CAAK,aAAa,CAAA,CAAE,OAAA,EAAQ;AAAA,EACzC,SAAA,EAAWA,YAAK,WAAW,CAAA;AAAA,EAC3B,SAAA,EAAWA,YAAK,WAAW,CAAA;AAAA,EAC3B,QAAA,EAAUA,YAAK,UAAU,CAAA;AAAA;AAAA;AAAA;AAAA,EAIzB,WAAA,EAAaA,YAAK,aAAa,CAAA;AAAA,EAC/B,EAAA,EAAIA,YAAK,IAAI,CAAA;AAAA,EACb,OAAA,EAASA,YAAK,SAAS,CAAA;AAAA,EACvB,UAAA,EAAYA,YAAK,YAAY,CAAA;AAAA,EAC7B,OAAA,EAASA,YAAK,SAAS,CAAA;AAAA,EACvB,IAAA,EAAMA,YAAK,MAAM,CAAA;AAAA,EACjB,WAAWG,gBAAA,CAAU,WAAW,CAAA,CAAE,OAAA,GAAU,UAAA;AAC9C,CAAC,CAAA;AAQM,IAAM,kBAAA,GAAqBJ,eAAQ,oBAAA,EAAsB;AAAA,EAC9D,EAAA,EAAIC,WAAA,CAAK,IAAI,CAAA,CAAE,OAAA,EAAQ,CAAE,UAAA,EAAW,CAAE,UAAA,CAAW,MAAMC,cAAA,EAAU,CAAA;AAAA,EACjE,MAAA,EAAQD,WAAA,CAAK,QAAQ,CAAA,CAClB,OAAA,EAAQ,CACR,UAAA,CAAW,MAAM,KAAA,CAAM,EAAA,EAAI,EAAE,QAAA,EAAU,WAAW,CAAA;AAAA,EACrD,SAAA,EAAWA,WAAA,CAAK,WAAW,CAAA,CAAE,OAAA,EAAQ;AAAA;AAAA;AAAA;AAAA;AAAA,EAKrC,SAAA,EAAWA,YAAK,WAAW,CAAA;AAAA,EAC3B,SAAA,EAAWA,YAAK,WAAW,CAAA;AAAA,EAC3B,OAAA,EAASA,YAAK,SAAS,CAAA;AAAA,EACvB,IAAA,EAAMA,YAAK,MAAM,CAAA;AAAA,EACjB,WAAWG,gBAAA,CAAU,WAAW,CAAA,CAAE,OAAA,GAAU,UAAA;AAC9C,CAAA,EAAG,CAAC,KAAA,KAAU;AAAA,EACZE,cAAO,iCAAiC,CAAA,CAAE,GAAG,KAAA,CAAM,MAAA,EAAQ,MAAM,SAAS;AAC5E,CAAC,CAAA;AASM,IAAM,YAAA,GAAeN,eAAQ,eAAA,EAAiB;AAAA,EACnD,aAAaC,WAAA,CAAK,aAAa,CAAA,CAAE,OAAA,GAAU,UAAA,EAAW;AAAA,EACtD,OAAOI,cAAA,CAAQ,OAAO,EAAE,OAAA,EAAQ,CAAE,QAAQ,CAAC,CAAA;AAAA,EAC3C,aAAaD,gBAAA,CAAU,aAAa,CAAA,CAAE,OAAA,GAAU,UAAA,EAAW;AAAA;AAAA;AAAA;AAAA;AAAA,EAK3D,eAAeA,gBAAA,CAAU,eAAe,CAAA,CAAE,OAAA,GAAU,UAAA,EAAW;AAAA,EAC/D,SAAA,EAAWH,YAAK,WAAW,CAAA;AAAA,EAC3B,SAAA,EAAWA,YAAK,WAAW,CAAA;AAAA,EAC3B,SAAA,EAAWA,YAAK,WAAW,CAAA;AAAA,EAC3B,QAAA,EAAUA,YAAK,UAAU;AAAA;AAC3B,CAAC,CAAA;AAKM,IAAM,cAAA,GAAiBD,eAAQ,iBAAA,EAAmB;AAAA,EACvD,IAAIC,WAAA,CAAK,IAAI,EAAE,UAAA,EAAW,CAAE,QAAQ,SAAS,CAAA;AAAA,EAC7C,iBAAiBE,cAAA,CAAQ,iBAAiB,EAAE,OAAA,EAAQ,CAAE,QAAQ,KAAK,CAAA;AAAA,EACnE,kBAAA,EAAoBF,YAAK,oBAAoB,CAAA;AAAA,EAC7C,kBAAkBE,cAAA,CAAQ,kBAAkB,EAAE,OAAA,EAAQ,CAAE,QAAQ,IAAI,CAAA;AAAA,EACpE,yBAAyBA,cAAA,CAAQ,yBAAyB,EAAE,OAAA,EAAQ,CAAE,QAAQ,IAAI,CAAA;AAAA,EAClF,kBAAkBA,cAAA,CAAQ,kBAAkB,EAAE,OAAA,EAAQ,CAAE,QAAQ,KAAK,CAAA;AAAA,EACrE,yBAAyBA,cAAA,CAAQ,yBAAyB,EAAE,OAAA,EAAQ,CAAE,QAAQ,IAAI,CAAA;AAAA,EAClF,WAAWC,gBAAA,CAAU,WAAW,CAAA,CAAE,OAAA,GAAU,UAAA,EAAW;AAAA;AAAA;AAAA;AAAA,EAIvD,SAAA,EAAWH,WAAA,CAAK,WAAW,CAAA,CAAE,UAAA,CAAW,MAAM,KAAA,CAAM,EAAA,EAAI,EAAE,QAAA,EAAU,UAAA,EAAY;AAClF,CAAA,EAAG,CAAC,KAAA,KAAU;AAAA,EACZM,YAAA,CAAM,2BAAA,EAA6BC,cAAA,CAAA,EAAM,KAAA,CAAM,EAAE,CAAA,YAAA,CAAc;AACjE,CAAC,CAAA;AC5MM,IAAM,SAAA,GAAYC,MAAE,MAAA,CAAO;AAAA,EAChC,QAAA,EAAUA,KAAA,CAAE,IAAA,CAAK,CAAC,aAAA,EAAe,cAAc,MAAM,CAAC,CAAA,CAAE,OAAA,CAAQ,aAAa,CAAA;AAAA,EAC7E,IAAA,EAAMA,MAAE,MAAA,EAAO,CAAE,QAAQ,MAAM,CAAA,CAAE,UAAU,MAAM,CAAA;AAAA,EACjD,YAAA,EAAcA,KAAA,CAAE,MAAA,EAAO,CAAE,QAAQ,EAAE,CAAA;AAAA,EACnC,cAAA,EAAgBA,KAAA,CAAE,MAAA,EAAO,CAAE,QAAQ,EAAE,CAAA;AAAA;AAAA;AAAA;AAAA,EAIrC,QAAA,EAAUA,KAAA,CAAE,MAAA,EAAO,CAAE,QAAQ,kBAAkB,CAAA;AAAA;AAAA;AAAA;AAAA,EAI/C,yBAAA,EAA2BA,KAAA,CAAE,MAAA,EAAO,CAAE,OAAA,CAAQ,MAAM,CAAA,CAAE,SAAA,CAAU,CAAA,GAAA,KAAO,GAAA,KAAQ,MAAM,CAAA;AAAA,EACrF,kBAAA,EAAoBA,KAAA,CAAE,MAAA,EAAO,CAAE,OAAA,CAAQ,MAAM,CAAA,CAAE,SAAA,CAAU,CAAA,GAAA,KAAO,GAAA,KAAQ,MAAM,CAAA;AAAA,EAC9E,0BAAA,EAA4BA,KAAA,CAAE,MAAA,EAAO,CAAE,OAAA,CAAQ,MAAM,CAAA,CAAE,SAAA,CAAU,CAAA,GAAA,KAAO,GAAA,KAAQ,MAAM,CAAA;AAAA,EACtF,mBAAA,EAAqBA,KAAA,CAAE,MAAA,EAAO,CAAE,OAAA,CAAQ,OAAO,CAAA,CAAE,SAAA,CAAU,CAAA,GAAA,KAAO,GAAA,KAAQ,MAAM,CAAA;AAAA,EAChF,SAAA,EAAWA,MAAE,IAAA,CAAK,CAAC,MAAM,MAAM,CAAC,CAAA,CAAE,OAAA,CAAQ,IAAI,CAAA;AAAA;AAAA;AAAA,EAG9C,YAAA,EAAcA,KAAA,CAAE,MAAA,EAAO,CAAE,OAAA,CAAQ,OAAO,CAAA,CAAE,SAAA,CAAU,CAAA,GAAA,KAAO,GAAA,KAAQ,MAAM;AAC3E,CAAC,CAAA;;;ACvBD,IAAM,OAAA,GAAU,SAAA,CAAU,SAAA,CAAU,OAAA,CAAQ,GAAG,CAAA;AAE/C,IAAI,OAAA,CAAQ,OAAA,IAAY,OAAA,CAAQ,IAAA,CAAK,aAAa,aAAA,EAAgB;AAChE,EAAA,OAAA,CAAQ,IAAI,+BAAA,EAAiC,MAAA,CAAO,IAAA,CAAK,OAAA,CAAQ,IAAI,CAAC,CAAA;AACxE;AAEA,IAAI,CAAC,QAAQ,OAAA,EAAS;AACpB,EAAA,OAAA,CAAQ,KAAA,CAAM,gCAAA,EAAkC,OAAA,CAAQ,KAAA,CAAM,QAAQ,CAAA;AACtE,EAAA,MAAM,IAAI,MAAM,+BAA+B,CAAA;AACjD;AAEO,IAAM,SAAS,OAAA,CAAQ,IAAA;;;ACM9B,IAAI,EAAA;AAGJ,IAAI,MAAA,CAAO,cAAc,IAAA,EAAM;AAC7B,EAAA,MAAM,IAAA,GAAO,IAAIC,OAAA,CAAK;AAAA,IACpB,kBAAkB,MAAA,CAAO,YAAA;AAAA,IACzB,KAAK,MAAA,CAAO,YAAA,GAAe,EAAE,kBAAA,EAAoB,OAAM,GAAI;AAAA,GAC5D,CAAA;AACD,EAAA,EAAA,GAAKC,qBAAU,IAAA,EAAM;AAAA,IACnB,MAAA,EAAA,cAAA;AAAA,IACA,MAAA,EAAQ;AAAA,GACT,CAAA;AAED,EAAA,OAAA,CAAQ,IAAI,wCAAiC,CAAA;AAE/C,CAAA,MAAA,IAAW,MAAA,CAAO,cAAc,MAAA,EAAQ;AACtC,EAAA,MAAMH,IAAAA,GAAMI,eAAA,CAAK,MAAA,CAAO,YAAa,CAAA;AACrC,EAAA,EAAA,GAAKC,iBAAQL,IAAAA,EAAK,EAAE,MAAA,EAAA,cAAA,EAAQ,MAAA,EAAQ,MAAM,CAAA;AAE1C,EAAA,OAAA,CAAQ,IAAI,oCAA6B,CAAA;AAE3C,CAAA,MAAO;AACL,EAAA,OAAA,CAAQ,GAAA,CAAI,yDAAA,EAA2D,MAAA,CAAO,SAAS,CAAA;AACzF;ACtCA,eAAsB,YAAY,EAAA,EAAY;AAC5C,EAAA,MAAM,SAAS,MAAM,EAAA,CAClB,MAAA,EAAO,CACP,KAAK,KAAK,CAAA,CACV,KAAA,CAAMM,aAAA,CAAG,MAAM,EAAA,EAAI,EAAE,CAAC,CAAA,CACtB,MAAM,CAAC,CAAA;AAEV,EAAA,OAAO,MAAA,CAAO,CAAC,CAAA,IAAK,IAAA;AACtB;AAGA,eAAsB,cAAA,GAAoC;AACxD,EAAA,MAAM,OAAO,MAAM,EAAA,CAChB,OAAO,EAAE,KAAA,EAAO,MAAM,KAAA,EAAO,CAAA,CAC7B,IAAA,CAAK,KAAK,CAAA,CACV,KAAA,CAAMA,cAAG,KAAA,CAAM,IAAA,EAAM,OAAO,CAAC,CAAA;AAEhC,EAAA,OAAO,IAAA,CAAK,GAAA,CAAI,CAAC,CAAA,KAAM,EAAE,KAAK,CAAA;AAChC;AAQA,SAAS,gBAAgB,MAAA,EAAiC;AACxD,EAAA,OAAO,MAAA,CAAO,MAAK,GACdC,aAAA;AAAA,IACCC,eAAA,CAAK,KAAA,CAAM,IAAA,EAAM,CAAA,CAAA,EAAI,MAAM,CAAA,CAAA,CAAG,CAAA;AAAA,IAC9BA,eAAA,CAAK,KAAA,CAAM,KAAA,EAAO,CAAA,CAAA,EAAI,MAAM,CAAA,CAAA,CAAG;AAAA,GACjC,GACA,MAAA;AACN;AAEA,eAAsB,gBAAA,CAAiB,EAAE,MAAA,GAAS,EAAA,EAAI,OAAO,CAAA,EAAG,KAAA,GAAQ,IAAG,EAAgB;AAxC3F,EAAA,IAAA,EAAA,EAAA,EAAA;AAyCE,EAAA,MAAM,MAAA,GAAA,CAAU,OAAO,CAAA,IAAK,KAAA;AAE5B,EAAA,MAAM,KAAA,GAAQ,gBAAgB,MAAM,CAAA;AAEpC,EAAA,MAAM,CAAC,SAAA,EAAW,WAAW,CAAA,GAAI,MAAM,QAAQ,GAAA,CAAI;AAAA,IACjD,GACG,MAAA,EAAO,CACP,KAAK,KAAK,CAAA,CACV,MAAM,KAAK,CAAA,CACX,QAAQC,eAAA,CAAK,KAAA,CAAM,SAAS,CAAC,CAAA,CAC7B,MAAM,KAAK,CAAA,CACX,OAAO,MAAM,CAAA;AAAA,IAChB,EAAA,CACG,MAAA,CAAO,EAAE,KAAA,EAAOT,cAAAA,CAAAA,QAAAA,CAAAA,EAAuB,CAAA,CACvC,IAAA,CAAK,KAAK,CAAA,CACV,KAAA,CAAM,KAAK;AAAA,GACf,CAAA;AAED,EAAA,MAAM,KAAA,GAAQ,QAAO,EAAA,GAAA,CAAA,EAAA,GAAA,WAAA,CAAY,CAAC,MAAb,IAAA,GAAA,MAAA,GAAA,EAAA,CAAgB,KAAA,KAAhB,YAAyB,CAAC,CAAA;AAE/C,EAAA,OAAO;AAAA,IACL,KAAA,EAAO,SAAA;AAAA,IACP,KAAA;AAAA,IACA,IAAA;AAAA,IACA,KAAA;AAAA,IACA,KAAA,EAAO,IAAA,CAAK,IAAA,CAAK,KAAA,GAAQ,KAAK;AAAA,GAChC;AACF;AAOA,IAAM,gBAAA,GAAmB,GAAA;AAEzB,eAAsB,iBAAA,CAAkB,EAAE,MAAA,GAAS,EAAA,EAAG,EAAsB;AAC1E,EAAA,MAAM,KAAA,GAAQ,gBAAgB,MAAM,CAAA;AAEpC,EAAA,OAAO,GACJ,MAAA,EAAO,CACP,IAAA,CAAK,KAAK,EACV,KAAA,CAAM,KAAK,CAAA,CACX,OAAA,CAAQS,gBAAK,KAAA,CAAM,SAAS,CAAC,CAAA,CAC7B,MAAM,gBAAgB,CAAA;AAC3B","file":"queries.js","sourcesContent":["import { boolean, check, integer, pgEnum, pgTable, text, timestamp, unique } from \"drizzle-orm/pg-core\";\nimport { sql } from \"drizzle-orm\";\nimport { createId } from '@paralleldrive/cuid2'\n\nexport const RoleEnum = pgEnum('roles', ['user', 'admin'])\n\nexport const ActivityActionEnum = pgEnum('activity_actions', [\n  'login',\n  'logout',\n  'login_failed',\n  'password_changed',\n  'email_changed',\n  'profile_updated',\n  'session_revoked',\n  'user_deleted',\n  'user_banned',\n  'user_unbanned',\n  'role_changed',\n  'impersonation_started',\n  'impersonation_stopped',\n  'settings_changed',\n  'passkey_added',\n  'passkey_removed',\n])\n\nexport const users = pgTable(\"user\", {\n  id: text(\"id\").notNull().primaryKey().$defaultFn(() => createId()),\n  name: text('name').notNull(),\n  email: text('email').notNull().unique(),\n  password: text('password'),\n  emailVerified: boolean(\"emailVerified\").notNull().default(false),\n  image: text(\"image\"),\n  role: RoleEnum('roles').default('user').notNull(),\n  banned: boolean('banned').default(false).notNull(),\n  bannedAt: timestamp('bannedAt'),\n  bannedReason: text('bannedReason'),\n  // Required by better-auth's admin plugin schema (auto-expiring bans). We\n  // never set this ourselves, so it stays null and bans behave as permanent,\n  // same as before the plugin was added.\n  banExpires: timestamp('banExpires'),\n  lastLoginAt: timestamp('lastLoginAt'),\n  lastActiveAt: timestamp('lastActiveAt'),\n  // Set by better-auth's twoFactor plugin — true once the user has\n  // completed TOTP setup (see twoFactor pgTable below for the secret /\n  // backup codes themselves).\n  twoFactorEnabled: boolean('twoFactorEnabled').notNull().default(false),\n  createdAt: timestamp('createdAt').notNull().defaultNow(),\n  updatedAt: timestamp('updatedAt').notNull().defaultNow(),\n});\n\nexport const sessions = pgTable(\"session\", {\n  id: text(\"id\").notNull().primaryKey().$defaultFn(() => createId()),\n  expiresAt: timestamp(\"expiresAt\").notNull(),\n  token: text(\"token\").notNull().unique(),\n  createdAt: timestamp(\"createdAt\").notNull().defaultNow(),\n  updatedAt: timestamp(\"updatedAt\").notNull().defaultNow(),\n  ipAddress: text(\"ipAddress\"),\n  userAgent: text(\"userAgent\"),\n  userId: text(\"userId\")\n    .notNull()\n    .references(() => users.id, { onDelete: \"cascade\" }),\n  // Set by better-auth's admin plugin while this session is an admin\n  // impersonating another user; holds the impersonating admin's user id.\n  impersonatedBy: text(\"impersonatedBy\"),\n});\n\nexport const accounts = pgTable(\"account\", {\n  id: text(\"id\").notNull().primaryKey().$defaultFn(() => createId()),\n  accountId: text(\"accountId\").notNull(),\n  providerId: text(\"providerId\").notNull(),\n  userId: text(\"userId\")\n    .notNull()\n    .references(() => users.id, { onDelete: \"cascade\" }),\n  accessToken: text(\"accessToken\"),\n  refreshToken: text(\"refreshToken\"),\n  idToken: text(\"idToken\"),\n  accessTokenExpiresAt: timestamp(\"accessTokenExpiresAt\"),\n  refreshTokenExpiresAt: timestamp(\"refreshTokenExpiresAt\"),\n  scope: text(\"scope\"),\n  password: text(\"password\"),\n  createdAt: timestamp(\"createdAt\").notNull().defaultNow(),\n  updatedAt: timestamp(\"updatedAt\").notNull().defaultNow(),\n});\n\n// Better-auth's twoFactor plugin. One row per user (created on first\n// `enable`); secret and backupCodes are its own encrypted-at-rest strings,\n// field names/types must match its expectations exactly (drizzleAdapter in\n// server/auth.ts maps this table to the plugin's \"twoFactor\" model as-is).\nexport const twoFactors = pgTable(\"twoFactor\", {\n  id: text(\"id\").notNull().primaryKey().$defaultFn(() => createId()),\n  secret: text(\"secret\").notNull(),\n  backupCodes: text(\"backupCodes\").notNull(),\n  userId: text(\"userId\")\n    .notNull()\n    .references(() => users.id, { onDelete: \"cascade\" }),\n});\n\n// Better-auth's passkey plugin — one row per registered WebAuthn credential.\nexport const passkeys = pgTable(\"passkey\", {\n  id: text(\"id\").notNull().primaryKey().$defaultFn(() => createId()),\n  name: text(\"name\"),\n  publicKey: text(\"publicKey\").notNull(),\n  userId: text(\"userId\")\n    .notNull()\n    .references(() => users.id, { onDelete: \"cascade\" }),\n  credentialID: text(\"credentialID\").notNull().unique(),\n  counter: integer(\"counter\").notNull(),\n  deviceType: text(\"deviceType\").notNull(),\n  backedUp: boolean(\"backedUp\").notNull(),\n  transports: text(\"transports\"),\n  createdAt: timestamp(\"createdAt\"),\n  aaguid: text(\"aaguid\"),\n});\n\nexport const verifications = pgTable(\"verification\", {\n  id: text(\"id\").notNull().primaryKey().$defaultFn(() => createId()),\n  identifier: text(\"identifier\").notNull(),\n  value: text(\"value\").notNull(),\n  expiresAt: timestamp(\"expiresAt\").notNull(),\n  createdAt: timestamp(\"createdAt\").notNull().defaultNow(),\n  updatedAt: timestamp(\"updatedAt\").notNull().defaultNow(),\n});\n\nexport const activityLogs = pgTable(\"activity_log\", {\n  id: text(\"id\").notNull().primaryKey().$defaultFn(() => createId()),\n  userId: text(\"userId\")\n    .notNull()\n    .references(() => users.id, { onDelete: \"cascade\" }),\n  action: ActivityActionEnum('action').notNull(),\n  description: text('description').notNull(),\n  ipAddress: text('ipAddress'),\n  userAgent: text('userAgent'),\n  metadata: text('metadata'),\n  // Populated on 'login' events only (registration + sign-in) — parsed from\n  // userAgent/ipAddress at write time so the record stays stable even if\n  // the parsing library or geoip database changes later.\n  referrerUrl: text('referrerUrl'),\n  os: text('os'),\n  browser: text('browser'),\n  deviceType: text('deviceType'),\n  country: text('country'),\n  city: text('city'),\n  createdAt: timestamp('createdAt').notNull().defaultNow(),\n});\n\n// One row per (user, device fingerprint) pair. Its only job is to answer\n// \"has this account signed in from this device before?\" — no matching row ⇒\n// send a new-device alert (see app/api/device-check/route.ts). visitorId is\n// FingerprintJS's identifier, computed client-side in\n// components/auth/deviceCheck.tsx. UA+IP are deliberately NOT the signal here:\n// they churn constantly on mobile and would alert on every other login.\nexport const deviceFingerprints = pgTable(\"device_fingerprint\", {\n  id: text(\"id\").notNull().primaryKey().$defaultFn(() => createId()),\n  userId: text(\"userId\")\n    .notNull()\n    .references(() => users.id, { onDelete: \"cascade\" }),\n  visitorId: text(\"visitorId\").notNull(),\n  // Context captured at first-seen time — for the admin panel's \"New devices\"\n  // card and the alert email. Not part of the new-vs-known decision (that's\n  // visitorId only), just so an admin can eyeball whether a sign-in looks like\n  // a hijack. Nullable: an old row predates these columns, or geoip missed.\n  ipAddress: text(\"ipAddress\"),\n  userAgent: text(\"userAgent\"),\n  country: text(\"country\"),\n  city: text(\"city\"),\n  createdAt: timestamp(\"createdAt\").notNull().defaultNow(),\n}, (table) => [\n  unique(\"device_fingerprint_user_visitor\").on(table.userId, table.visitorId),\n]);\n\n// Per-device abuse throttle for /sign-in/email and /sign-up/email — one\n// fixed-window counter row per FingerprintJS visitorId (sent by the auth\n// forms as the x-device-fingerprint header; see lib/auth-throttle.ts).\n// Keyed by device, not IP: IP is shared behind corporate NAT / CGNAT / VPN,\n// so an IP counter throttles coworkers together while missing an abuser who\n// rotates IPs. Rows whose window has elapsed are dead weight but harmless\n// (reset on the next attempt) — prune on a cron if the table ever grows.\nexport const authThrottle = pgTable(\"auth_throttle\", {\n  fingerprint: text(\"fingerprint\").notNull().primaryKey(),\n  count: integer(\"count\").notNull().default(0),\n  windowStart: timestamp(\"windowStart\").notNull().defaultNow(),\n  // Blockable data points, overwritten on every attempt (last-write-wins) so\n  // the admin panel can show who to block — by IP or by fingerprint — with no\n  // join and no per-attempt history table. windowStart anchors the counter's\n  // window; lastAttemptAt is just \"most recently seen\".\n  lastAttemptAt: timestamp(\"lastAttemptAt\").notNull().defaultNow(),\n  ipAddress: text(\"ipAddress\"),\n  userAgent: text(\"userAgent\"),\n  lastEmail: text(\"lastEmail\"),\n  lastKind: text(\"lastKind\"), // 'signin' | 'signup'\n});\n\n// Singleton row (id is always 'default') holding admin-editable settings for\n// config that used to be env-var-only. See lib/settings-queries.ts for the\n// cached read path and lazy-seed-from-env behavior.\nexport const systemSettings = pgTable(\"system_settings\", {\n  id: text(\"id\").primaryKey().default(\"default\"),\n  maintenanceMode: boolean(\"maintenanceMode\").notNull().default(false),\n  maintenanceMessage: text(\"maintenanceMessage\"),\n  authEnableGoogle: boolean(\"authEnableGoogle\").notNull().default(true),\n  authEnableEmailPassword: boolean(\"authEnableEmailPassword\").notNull().default(true),\n  authEnableOneTap: boolean(\"authEnableOneTap\").notNull().default(false),\n  enableSessionRevocation: boolean(\"enableSessionRevocation\").notNull().default(true),\n  updatedAt: timestamp(\"updatedAt\").notNull().defaultNow(),\n  // Who last changed a setting. This row doesn't \"belong\" to that admin the\n  // way sessions/activityLogs belong to their user, so deleting that admin's\n  // account should null this out rather than cascade-delete the singleton row.\n  updatedBy: text(\"updatedBy\").references(() => users.id, { onDelete: \"set null\" }),\n}, (table) => [\n  check(\"system_settings_singleton\", sql`${table.id} = 'default'`),\n]);","// No \"server-only\" guard here — this schema is also imported by scripts that\n// run outside Next.js's bundler (e.g. scripts/doctor.ts), where that guard\n// throws unconditionally. config/env.ts re-exports the parsed, guarded result\n// for app code; import this file directly only from non-Next scripts.\nimport { z } from 'zod';\n\nexport const envSchema = z.object({\n  NODE_ENV: z.enum(['development', 'production', 'test']).default('development'),\n  PORT: z.string().default('3000').transform(Number),\n  DATABASE_URL: z.string().default(''),\n  RESEND_API_KEY: z.string().default(''),\n  // Display name for this deployment — shown as the authenticator-app label\n  // (2FA issuer) and the passkey relying-party name. Consuming projects set\n  // this in their own .env; defaults to the template name.\n  APP_NAME: z.string().default('Next.js Template'),\n  // Seed-only: the live value lives in the system_settings DB row (see\n  // lib/settings-queries.ts) once it's been seeded on first read, and is\n  // changed from the admin System Settings page, not by editing this var.\n  ENABLE_SESSION_REVOCATION: z.string().default('true').transform(val => val === 'true'),\n  AUTH_ENABLE_GOOGLE: z.string().default('true').transform(val => val === 'true'),\n  AUTH_ENABLE_EMAIL_PASSWORD: z.string().default('true').transform(val => val === 'true'),\n  AUTH_ENABLE_ONE_TAP: z.string().default('false').transform(val => val === 'true'),\n  DB_DRIVER: z.enum(['pg', 'neon']).default('pg'),\n  // Only relevant when DB_DRIVER=pg — whether the target Postgres server has SSL\n  // enabled. Self-hosted Postgres (e.g. via Docker/Dokploy) typically does not.\n  DATABASE_SSL: z.string().default('false').transform(val => val === 'true'),\n});\n","import \"server-only\";\nimport { envSchema } from './env-schema';\n\nconst results = envSchema.safeParse(process.env);\n\nif (results.success && (results.data.NODE_ENV === 'development')) {\n  console.log('Environment variables loaded:', Object.keys(results.data));\n}\n\nif (!results.success) {\n  console.error('Invalid environment variables:', results.error.format());\n  throw new Error('Invalid environment variables');\n}\n\nexport const config = results.data;\n","import 'server-only';\n\n// neon-http driver for production\nimport { neon } from '@neondatabase/serverless';\nimport { drizzle } from 'drizzle-orm/neon-http';\n\n// postgres driver for local development\nimport { drizzle as drizzlePg } from 'drizzle-orm/node-postgres';\nimport { Pool } from 'pg';\n\nimport * as schema from './schema';\nimport { config } from '../../config/env';\n\n// Import the query builder\nimport { PostgresJsDatabase } from 'drizzle-orm/postgres-js';\nimport { NeonHttpDatabase } from 'drizzle-orm/neon-http';\n\ntype DrizzleNeon = NeonHttpDatabase<typeof schema>;\ntype DrizzlePg = PostgresJsDatabase<typeof schema>;\n\nlet db: DrizzleNeon | DrizzlePg\n\n\nif (config.DB_DRIVER === 'pg') {\n  const pool = new Pool({\n    connectionString: config.DATABASE_URL!,\n    ssl: config.DATABASE_SSL ? { rejectUnauthorized: false } : undefined,\n  });\n  db = drizzlePg(pool, {\n    schema,\n    logger: true,\n  });\n\n  console.log('🟡 Using PostgreSQL (pg) driver');\n\n} else if (config.DB_DRIVER === 'neon') {\n  const sql = neon(config.DATABASE_URL!);\n  db = drizzle(sql, { schema, logger: true });\n\n  console.log('🟢 Using Neon (HTTP) driver');\n\n} else {\n  console.log('Database connection not established, unknown DB_DRIVER:', config.DB_DRIVER);\n}\n// Note: In production, you might want to disable logging or use a more sophisticated logger.\n\nexport { db }","import \"server-only\"\nimport { db } from \"../server/db\"\nimport { users } from \"../server/db/schema\"\nimport { like, desc, or, eq, sql, type SQL } from \"drizzle-orm\"\n\nexport async function getUserById(id: string) {\n  const result = await db\n    .select()\n    .from(users)\n    .where(eq(users.id, id))\n    .limit(1)\n\n  return result[0] || null\n}\n\n// Recipients for security alerts (new-device sign-ins, etc.). Every admin.\nexport async function getAdminEmails(): Promise<string[]> {\n  const rows = await db\n    .select({ email: users.email })\n    .from(users)\n    .where(eq(users.role, \"admin\"))\n\n  return rows.map((r) => r.email)\n}\n\nexport interface UserFilters {\n  search?: string\n  page?: number\n  limit?: number\n}\n\nfunction buildUsersWhere(search: string): SQL | undefined {\n  return search.trim()\n    ? (or(\n        like(users.name, `%${search}%`),\n        like(users.email, `%${search}%`)\n      ) as SQL)\n    : undefined\n}\n\nexport async function getUsersFiltered({ search = \"\", page = 1, limit = 10 }: UserFilters) {\n  const offset = (page - 1) * limit\n\n  const where = buildUsersWhere(search)\n\n  const [usersList, countResult] = await Promise.all([\n    db\n      .select()\n      .from(users)\n      .where(where)\n      .orderBy(desc(users.createdAt))\n      .limit(limit)\n      .offset(offset),\n    db\n      .select({ count: sql<number>`count(*)` })\n      .from(users)\n      .where(where),\n  ])\n\n  const total = Number(countResult[0]?.count ?? 0)\n\n  return {\n    users: usersList,\n    total,\n    page,\n    limit,\n    pages: Math.ceil(total / limit),\n  }\n}\n\nexport interface UserExportFilters {\n  search?: string\n}\n\n// Caps export size to keep the CSV response bounded on very large tables.\nconst EXPORT_ROW_LIMIT = 10_000\n\nexport async function getUsersForExport({ search = \"\" }: UserExportFilters) {\n  const where = buildUsersWhere(search)\n\n  return db\n    .select()\n    .from(users)\n    .where(where)\n    .orderBy(desc(users.createdAt))\n    .limit(EXPORT_ROW_LIMIT)\n}\n"]}

package/dist/users/queries.mjs

@@ -0,0 +1,47 @@
+import { db } from '../chunk-HYKUB3A2.mjs';
+import { users } from '../chunk-ENGYO4K7.mjs';
+import '../chunk-GTPTVNY2.mjs';
+import '../chunk-YN4436PK.mjs';
+import 'server-only';
+import { eq, desc, sql, or, like } from 'drizzle-orm';
+
+async function getUserById(id) {
+  const result = await db.select().from(users).where(eq(users.id, id)).limit(1);
+  return result[0] || null;
+}
+async function getAdminEmails() {
+  const rows = await db.select({ email: users.email }).from(users).where(eq(users.role, "admin"));
+  return rows.map((r) => r.email);
+}
+function buildUsersWhere(search) {
+  return search.trim() ? or(
+    like(users.name, `%${search}%`),
+    like(users.email, `%${search}%`)
+  ) : void 0;
+}
+async function getUsersFiltered({ search = "", page = 1, limit = 10 }) {
+  var _a, _b;
+  const offset = (page - 1) * limit;
+  const where = buildUsersWhere(search);
+  const [usersList, countResult] = await Promise.all([
+    db.select().from(users).where(where).orderBy(desc(users.createdAt)).limit(limit).offset(offset),
+    db.select({ count: sql`count(*)` }).from(users).where(where)
+  ]);
+  const total = Number((_b = (_a = countResult[0]) == null ? void 0 : _a.count) != null ? _b : 0);
+  return {
+    users: usersList,
+    total,
+    page,
+    limit,
+    pages: Math.ceil(total / limit)
+  };
+}
+var EXPORT_ROW_LIMIT = 1e4;
+async function getUsersForExport({ search = "" }) {
+  const where = buildUsersWhere(search);
+  return db.select().from(users).where(where).orderBy(desc(users.createdAt)).limit(EXPORT_ROW_LIMIT);
+}
+
+export { getAdminEmails, getUserById, getUsersFiltered, getUsersForExport };
+//# sourceMappingURL=queries.mjs.map
+//# sourceMappingURL=queries.mjs.map

package/dist/users/queries.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../lib/user-queries.ts"],"names":[],"mappings":";;;;;;;AAKA,eAAsB,YAAY,EAAA,EAAY;AAC5C,EAAA,MAAM,SAAS,MAAM,EAAA,CAClB,MAAA,EAAO,CACP,KAAK,KAAK,CAAA,CACV,KAAA,CAAM,EAAA,CAAG,MAAM,EAAA,EAAI,EAAE,CAAC,CAAA,CACtB,MAAM,CAAC,CAAA;AAEV,EAAA,OAAO,MAAA,CAAO,CAAC,CAAA,IAAK,IAAA;AACtB;AAGA,eAAsB,cAAA,GAAoC;AACxD,EAAA,MAAM,OAAO,MAAM,EAAA,CAChB,OAAO,EAAE,KAAA,EAAO,MAAM,KAAA,EAAO,CAAA,CAC7B,IAAA,CAAK,KAAK,CAAA,CACV,KAAA,CAAM,GAAG,KAAA,CAAM,IAAA,EAAM,OAAO,CAAC,CAAA;AAEhC,EAAA,OAAO,IAAA,CAAK,GAAA,CAAI,CAAC,CAAA,KAAM,EAAE,KAAK,CAAA;AAChC;AAQA,SAAS,gBAAgB,MAAA,EAAiC;AACxD,EAAA,OAAO,MAAA,CAAO,MAAK,GACd,EAAA;AAAA,IACC,IAAA,CAAK,KAAA,CAAM,IAAA,EAAM,CAAA,CAAA,EAAI,MAAM,CAAA,CAAA,CAAG,CAAA;AAAA,IAC9B,IAAA,CAAK,KAAA,CAAM,KAAA,EAAO,CAAA,CAAA,EAAI,MAAM,CAAA,CAAA,CAAG;AAAA,GACjC,GACA,MAAA;AACN;AAEA,eAAsB,gBAAA,CAAiB,EAAE,MAAA,GAAS,EAAA,EAAI,OAAO,CAAA,EAAG,KAAA,GAAQ,IAAG,EAAgB;AAxC3F,EAAA,IAAA,EAAA,EAAA,EAAA;AAyCE,EAAA,MAAM,MAAA,GAAA,CAAU,OAAO,CAAA,IAAK,KAAA;AAE5B,EAAA,MAAM,KAAA,GAAQ,gBAAgB,MAAM,CAAA;AAEpC,EAAA,MAAM,CAAC,SAAA,EAAW,WAAW,CAAA,GAAI,MAAM,QAAQ,GAAA,CAAI;AAAA,IACjD,GACG,MAAA,EAAO,CACP,KAAK,KAAK,CAAA,CACV,MAAM,KAAK,CAAA,CACX,QAAQ,IAAA,CAAK,KAAA,CAAM,SAAS,CAAC,CAAA,CAC7B,MAAM,KAAK,CAAA,CACX,OAAO,MAAM,CAAA;AAAA,IAChB,EAAA,CACG,MAAA,CAAO,EAAE,KAAA,EAAO,GAAA,CAAA,QAAA,CAAA,EAAuB,CAAA,CACvC,IAAA,CAAK,KAAK,CAAA,CACV,KAAA,CAAM,KAAK;AAAA,GACf,CAAA;AAED,EAAA,MAAM,KAAA,GAAQ,QAAO,EAAA,GAAA,CAAA,EAAA,GAAA,WAAA,CAAY,CAAC,MAAb,IAAA,GAAA,MAAA,GAAA,EAAA,CAAgB,KAAA,KAAhB,YAAyB,CAAC,CAAA;AAE/C,EAAA,OAAO;AAAA,IACL,KAAA,EAAO,SAAA;AAAA,IACP,KAAA;AAAA,IACA,IAAA;AAAA,IACA,KAAA;AAAA,IACA,KAAA,EAAO,IAAA,CAAK,IAAA,CAAK,KAAA,GAAQ,KAAK;AAAA,GAChC;AACF;AAOA,IAAM,gBAAA,GAAmB,GAAA;AAEzB,eAAsB,iBAAA,CAAkB,EAAE,MAAA,GAAS,EAAA,EAAG,EAAsB;AAC1E,EAAA,MAAM,KAAA,GAAQ,gBAAgB,MAAM,CAAA;AAEpC,EAAA,OAAO,GACJ,MAAA,EAAO,CACP,IAAA,CAAK,KAAK,EACV,KAAA,CAAM,KAAK,CAAA,CACX,OAAA,CAAQ,KAAK,KAAA,CAAM,SAAS,CAAC,CAAA,CAC7B,MAAM,gBAAgB,CAAA;AAC3B","file":"queries.mjs","sourcesContent":["import \"server-only\"\nimport { db } from \"../server/db\"\nimport { users } from \"../server/db/schema\"\nimport { like, desc, or, eq, sql, type SQL } from \"drizzle-orm\"\n\nexport async function getUserById(id: string) {\n  const result = await db\n    .select()\n    .from(users)\n    .where(eq(users.id, id))\n    .limit(1)\n\n  return result[0] || null\n}\n\n// Recipients for security alerts (new-device sign-ins, etc.). Every admin.\nexport async function getAdminEmails(): Promise<string[]> {\n  const rows = await db\n    .select({ email: users.email })\n    .from(users)\n    .where(eq(users.role, \"admin\"))\n\n  return rows.map((r) => r.email)\n}\n\nexport interface UserFilters {\n  search?: string\n  page?: number\n  limit?: number\n}\n\nfunction buildUsersWhere(search: string): SQL | undefined {\n  return search.trim()\n    ? (or(\n        like(users.name, `%${search}%`),\n        like(users.email, `%${search}%`)\n      ) as SQL)\n    : undefined\n}\n\nexport async function getUsersFiltered({ search = \"\", page = 1, limit = 10 }: UserFilters) {\n  const offset = (page - 1) * limit\n\n  const where = buildUsersWhere(search)\n\n  const [usersList, countResult] = await Promise.all([\n    db\n      .select()\n      .from(users)\n      .where(where)\n      .orderBy(desc(users.createdAt))\n      .limit(limit)\n      .offset(offset),\n    db\n      .select({ count: sql<number>`count(*)` })\n      .from(users)\n      .where(where),\n  ])\n\n  const total = Number(countResult[0]?.count ?? 0)\n\n  return {\n    users: usersList,\n    total,\n    page,\n    limit,\n    pages: Math.ceil(total / limit),\n  }\n}\n\nexport interface UserExportFilters {\n  search?: string\n}\n\n// Caps export size to keep the CSV response bounded on very large tables.\nconst EXPORT_ROW_LIMIT = 10_000\n\nexport async function getUsersForExport({ search = \"\" }: UserExportFilters) {\n  const where = buildUsersWhere(search)\n\n  return db\n    .select()\n    .from(users)\n    .where(where)\n    .orderBy(desc(users.createdAt))\n    .limit(EXPORT_ROW_LIMIT)\n}\n"]}

package/lib/auth-client.ts

@@ -0,0 +1,58 @@
+import { createAuthClient } from "better-auth/react"
+import { oneTapClient, adminClient, twoFactorClient, passkeyClient } from "better-auth/client/plugins"
+import type { BetterAuthClientPlugin } from "better-auth/client"
+
+const oneTapEnabled = process.env.NEXT_PUBLIC_AUTH_ENABLE_ONE_TAP === "true"
+
+// Derived (not hand-written) from the plugin's own return type, so it tracks
+// whatever better-auth version is actually installed by the consumer.
+type OneTapActions = ReturnType<ReturnType<typeof oneTapClient>["getActions"]>
+
+const baseAuthClient = createAuthClient({
+  baseURL: typeof window !== "undefined" ? window.location.origin : undefined,
+
+  plugins: [
+    adminClient(),
+    twoFactorClient(),
+    passkeyClient(),
+    ...(oneTapEnabled ? [
+      // On newer better-auth versions (>=1.6, within our ^1.3.34 range) the
+      // one-tap plugin's `getActions` signature doesn't structurally satisfy
+      // `BetterAuthClientPlugin` (a generic-variance mismatch upstream), so
+      // it can't be assigned into this array as-is. Widen it here —
+      // `.oneTap` is added back to `authClient`'s type below via
+      // `OneTapActions`, independent of this array's inferred plugin type.
+      oneTapClient({
+        clientId: process.env.NEXT_PUBLIC_GOOGLE_CLIENT_ID || "",
+        // Optional client configuration:
+        autoSelect: false,
+        cancelOnTapOutside: true,
+        context: "signin",
+        additionalOptions: {
+          // Any extra options for the Google initialize method
+        },
+        // Configure prompt behavior and exponential backoff:
+        promptOptions: {
+          baseDelay: 1000,   // Base delay in ms (default: 1000)
+          maxAttempts: 5     // Maximum number of attempts before triggering onPromptNotification (default: 5)
+        }
+      }) as unknown as BetterAuthClientPlugin
+    ] : []),
+  ]
+})
+
+// createAuthClient can't narrow `Option["plugins"]` from a conditional spread,
+// so it loses the one-tap plugin's action types. Add `.oneTap` back here
+// instead of forcing the plugin into the array unconditionally — doing that
+// trips a getActions variance mismatch against BetterAuthClientPlugin on
+// newer better-auth versions (>=1.6). The env check above still fully gates
+// whether the plugin (and thus `.oneTap`) is registered at runtime.
+export const authClient = baseAuthClient as typeof baseAuthClient & OneTapActions
+
+// Export commonly used hooks and methods for convenience
+export const {
+  useSession,
+  signIn,
+  signOut,
+  signUp,
+} = authClient

package/lib/cookie-names.ts

@@ -0,0 +1,13 @@
+// Shared cookie/header names used by both client components and server/auth.ts
+// — no "server-only" guard, since both sides need them.
+
+// Stashes the page a social sign-in was initiated from, so the login-activity
+// log shows the real referrer instead of the OAuth provider's own domain
+// (e.g. accounts.google.com) once the browser redirects back.
+export const LOGIN_REFERRER_COOKIE = 'login_referrer'
+
+// Carries the client's FingerprintJS visitorId on /sign-in/email and
+// /sign-up/email requests — the key for the per-device abuse throttle
+// (see lib/auth-throttle.ts). A header, not a cookie, so it's only sent on
+// the auth calls that need it, not every request.
+export const DEVICE_FINGERPRINT_HEADER = 'x-device-fingerprint'

package/lib/device-fingerprint.ts

@@ -0,0 +1,21 @@
+// Shared client-side device id (FingerprintJS visitorId), computed once and
+// cached for the page's lifetime — the library's get() isn't cheap and the
+// login form, signup form and deviceCheck.tsx all want the same value.
+//
+// @fingerprintjs/fingerprintjs is an optional peer dep: if it isn't installed
+// (or is blocked in the browser), this resolves to null and callers carry on
+// without a fingerprint.
+let cached: Promise<string | null> | undefined
+
+export function getVisitorId(): Promise<string | null> {
+  cached ??= (async () => {
+    try {
+      const FingerprintJS = (await import("@fingerprintjs/fingerprintjs")).default
+      const { visitorId } = await (await FingerprintJS.load()).get()
+      return visitorId || null
+    } catch {
+      return null
+    }
+  })()
+  return cached
+}

package/lib/formatters.ts

@@ -0,0 +1,53 @@
+/**
+ * Format date consistently across dashboard
+ */
+export function formatDate(date: Date | string): string {
+  return new Date(date).toLocaleDateString('en-US', {
+    year: 'numeric',
+    month: 'long',
+    day: 'numeric',
+  })
+}
+
+/**
+ * Format date and time
+ */
+export function formatDateTime(date: Date | string): string {
+  return new Date(date).toLocaleString('en-US', {
+    year: 'numeric',
+    month: 'long',
+    day: 'numeric',
+    hour: '2-digit',
+    minute: '2-digit',
+  })
+}
+
+/**
+ * Get user initials for avatar fallback
+ */
+export function getUserInitials(name: string | null | undefined): string {
+  if (!name) return 'U'
+
+  const parts = name.trim().split(' ')
+  if (parts.length === 1) return parts[0].charAt(0).toUpperCase()
+
+  return (parts[0].charAt(0) + parts[parts.length - 1].charAt(0)).toUpperCase()
+}
+
+/**
+ * Badge variant per activity log action, shared by activity log tables
+ */
+export const actionBadgeVariant: Record<string, 'default' | 'secondary' | 'destructive' | 'outline'> = {
+  login: 'default',
+  logout: 'secondary',
+  login_failed: 'destructive',
+  password_changed: 'default',
+  email_changed: 'default',
+  profile_updated: 'secondary',
+  session_revoked: 'destructive',
+  user_deleted: 'destructive',
+  user_banned: 'destructive',
+  user_unbanned: 'default',
+  role_changed: 'default',
+  settings_changed: 'default',
+}