@xk2800/nextjs-template 0.7.1-beta.0 → 0.7.1-beta.10

package/dist/marketing/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../config/env-schema.ts","../../config/env.ts","../../lib/resend.ts","../../lib/marketing.ts"],"names":["z","error"],"mappings":";;;;;;AAMO,IAAM,SAAA,GAAYA,MAAE,MAAA,CAAO;AAAA,EAChC,QAAA,EAAUA,KAAA,CAAE,IAAA,CAAK,CAAC,aAAA,EAAe,cAAc,MAAM,CAAC,CAAA,CAAE,OAAA,CAAQ,aAAa,CAAA;AAAA,EAC7E,IAAA,EAAMA,MAAE,MAAA,EAAO,CAAE,QAAQ,MAAM,CAAA,CAAE,UAAU,MAAM,CAAA;AAAA,EACjD,YAAA,EAAcA,KAAA,CAAE,MAAA,EAAO,CAAE,QAAQ,EAAE,CAAA;AAAA,EACnC,cAAA,EAAgBA,KAAA,CAAE,MAAA,EAAO,CAAE,QAAQ,EAAE,CAAA;AAAA;AAAA;AAAA,EAGrC,wBAAA,EAA0BA,KAAA,CAAE,MAAA,EAAO,CAAE,QAAQ,EAAE,CAAA;AAAA;AAAA;AAAA,EAG/C,2BAAA,EAA6BA,KAAA,CAAE,MAAA,EAAO,CAAE,QAAQ,EAAE,CAAA;AAAA;AAAA;AAAA,EAGlD,UAAA,EAAYA,KAAA,CAAE,MAAA,EAAO,CAAE,QAAQ,kCAAkC,CAAA;AAAA;AAAA;AAAA;AAAA,EAIjE,QAAA,EAAUA,KAAA,CAAE,MAAA,EAAO,CAAE,QAAQ,kBAAkB,CAAA;AAAA;AAAA;AAAA;AAAA,EAI/C,4BAAA,EAA8BA,KAAA,CAAE,MAAA,EAAO,CAAE,QAAQ,EAAE,CAAA;AAAA,EACnD,cAAA,EAAgBA,KAAA,CAAE,MAAA,EAAO,CAAE,QAAQ,EAAE,CAAA;AAAA;AAAA;AAAA;AAAA,EAIrC,yBAAA,EAA2BA,KAAA,CAAE,MAAA,EAAO,CAAE,OAAA,CAAQ,MAAM,CAAA,CAAE,SAAA,CAAU,CAAA,GAAA,KAAO,GAAA,KAAQ,MAAM,CAAA;AAAA,EACrF,kBAAA,EAAoBA,KAAA,CAAE,MAAA,EAAO,CAAE,OAAA,CAAQ,MAAM,CAAA,CAAE,SAAA,CAAU,CAAA,GAAA,KAAO,GAAA,KAAQ,MAAM,CAAA;AAAA,EAC9E,0BAAA,EAA4BA,KAAA,CAAE,MAAA,EAAO,CAAE,OAAA,CAAQ,MAAM,CAAA,CAAE,SAAA,CAAU,CAAA,GAAA,KAAO,GAAA,KAAQ,MAAM,CAAA;AAAA,EACtF,mBAAA,EAAqBA,KAAA,CAAE,MAAA,EAAO,CAAE,OAAA,CAAQ,OAAO,CAAA,CAAE,SAAA,CAAU,CAAA,GAAA,KAAO,GAAA,KAAQ,MAAM,CAAA;AAAA,EAChF,SAAA,EAAWA,MAAE,IAAA,CAAK,CAAC,MAAM,MAAM,CAAC,CAAA,CAAE,OAAA,CAAQ,IAAI,CAAA;AAAA;AAAA;AAAA,EAG9C,YAAA,EAAcA,KAAA,CAAE,MAAA,EAAO,CAAE,OAAA,CAAQ,OAAO,CAAA,CAAE,SAAA,CAAU,CAAA,GAAA,KAAO,GAAA,KAAQ,MAAM;AAC3E,CAAC,CAAA;;;ACrCD,IAAM,OAAA,GAAU,SAAA,CAAU,SAAA,CAAU,OAAA,CAAQ,GAAG,CAAA;AAE/C,IAAI,OAAA,CAAQ,OAAA,IAAY,OAAA,CAAQ,IAAA,CAAK,aAAa,aAAA,EAAgB;AAChE,EAAA,OAAA,CAAQ,IAAI,+BAAA,EAAiC,MAAA,CAAO,IAAA,CAAK,OAAA,CAAQ,IAAI,CAAC,CAAA;AACxE;AAEA,IAAI,CAAC,QAAQ,OAAA,EAAS;AACpB,EAAA,OAAA,CAAQ,KAAA,CAAM,gCAAA,EAAkC,OAAA,CAAQ,KAAA,CAAM,QAAQ,CAAA;AACtE,EAAA,MAAM,IAAI,MAAM,+BAA+B,CAAA;AACjD;AAEO,IAAM,SAAS,OAAA,CAAQ,IAAA;ACRJ,MAAA,CAAO;AAe1B,IAAM,iBAAA,GAAoB,MAAA,CAAO,wBAAA,IAA4B,MAAA,CAAO,cAAA;AAE3E,IAAI,eAAA;AACJ,eAAsB,kBAAA,GAAqB;AACzC,EAAA,IAAI,CAAC,eAAA,EAAiB;AACpB,IAAA,MAAM,EAAE,MAAA,EAAO,GAAI,MAAM,OAAO,QAAQ,CAAA;AACxC,IAAA,eAAA,GAAkB,IAAI,OAAO,iBAAiB,CAAA;AAAA,EAChD;AACA,EAAA,OAAO,eAAA;AACT;;;ACtBO,IAAM,uBAAuB,MAAA,CAAO;AA0B3C,eAAsB,oBAAA,GAInB;AAtCH,EAAA,IAAA,EAAA,EAAA,EAAA;AAuCE,EAAA,IAAI,CAAC,iBAAA,EAAmB;AACtB,IAAA,OAAO,EAAE,UAAU,EAAC,EAAG,YAAY,EAAC,EAAG,OAAO,6DAAA,EAA8D;AAAA,EAC9G;AAEA,EAAA,MAAM,MAAA,GAAS,MAAM,kBAAA,EAAmB;AACxC,EAAA,MAAM,CAAC,MAAA,EAAQ,KAAK,CAAA,GAAI,MAAM,QAAQ,GAAA,CAAI;AAAA,IACxC,MAAA,CAAO,SAAS,IAAA,EAAK;AAAA,IACrB,OAAO,UAAA,CAAW,IAAA,CAAK,EAAE,KAAA,EAAO,IAAI;AAAA,GACrC,CAAA;AACD,EAAA,IAAI,MAAA,CAAO,KAAA,EAAO,OAAO,EAAE,QAAA,EAAU,EAAC,EAAG,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,MAAA,CAAO,MAAM,OAAA,EAAQ;AACrF,EAAA,OAAO,EAAE,QAAA,EAAU,MAAA,CAAO,IAAA,CAAK,MAAM,UAAA,EAAA,CAAY,EAAA,GAAA,CAAA,EAAA,GAAA,KAAA,CAAM,IAAA,KAAN,IAAA,GAAA,MAAA,GAAA,EAAA,CAAY,IAAA,KAAZ,IAAA,GAAA,EAAA,GAAoB,EAAC,EAAG,OAAO,IAAA,EAAK;AACvF;AAIO,IAAM,sBAAA,GAAyB;AAEtC,eAAsB,oBAAoB,SAAA,EAIvC;AACD,EAAA,MAAM,EAAE,IAAA,EAAM,KAAA,EAAM,GAAI,OAAO,MAAM,kBAAA,EAAmB,EAAG,QAAA,CAAS,IAAA,CAAK,EAAE,SAAA,EAAW,KAAA,EAAO,wBAAwB,CAAA;AACrH,EAAA,IAAI,KAAA,EAAO,OAAO,EAAE,QAAA,EAAU,IAAI,OAAA,EAAS,KAAA,EAAO,KAAA,EAAO,KAAA,CAAM,OAAA,EAAQ;AACvE,EAAA,OAAO,EAAE,UAAU,IAAA,CAAK,IAAA,EAAM,SAAS,IAAA,CAAK,QAAA,EAAU,OAAO,IAAA,EAAK;AACpE;AAIA,eAAsB,aAAa,KAAA,EAAiC;AAClE,EAAA,MAAM,MAAA,GAAS,MAAM,kBAAA,EAAmB;AACxC,EAAA,MAAM,UAAU,MAAM,MAAA,CAAO,SAAS,GAAA,CAAI,EAAE,OAAO,CAAA;AACnD,EAAA,IAAI,QAAQ,KAAA,EAAO;AACjB,IAAA,IAAI,OAAA,CAAQ,KAAA,CAAM,IAAA,KAAS,WAAA,EAAa,OAAO,KAAA;AAC/C,IAAA,MAAM,IAAI,KAAA,CAAM,OAAA,CAAQ,KAAA,CAAM,OAAO,CAAA;AAAA,EACvC;AACA,EAAA,IAAI,OAAA,CAAQ,IAAA,CAAK,YAAA,EAAc,OAAO,KAAA;AAEtC,EAAA,MAAM,QAAA,GAAW,MAAM,MAAA,CAAO,QAAA,CAAS,SAAS,IAAA,CAAK,EAAE,OAAO,CAAA;AAC9D,EAAA,IAAI,SAAS,KAAA,EAAO,MAAM,IAAI,KAAA,CAAM,QAAA,CAAS,MAAM,OAAO,CAAA;AAC1D,EAAA,OAAO,QAAA,CAAS,KAAK,IAAA,CAAK,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,OAAO,oBAAoB,CAAA;AACrE;AAEA,eAAsB,aAAA,CAAc,KAAA,EAAe,IAAA,EAAc,UAAA,EAAqB;AACpF,EAAA,MAAM,MAAA,GAAS,MAAM,kBAAA,EAAmB;AACxC,EAAA,MAAM,UAAU,MAAM,MAAA,CAAO,SAAS,GAAA,CAAI,EAAE,OAAO,CAAA;AACnD,EAAA,MAAM,MAAA,GAAS,CAAC,OAAA,CAAQ,KAAA;AACxB,EAAA,IAAI,OAAA,CAAQ,KAAA,IAAS,OAAA,CAAQ,KAAA,CAAM,IAAA,KAAS,WAAA,EAAa,MAAM,IAAI,KAAA,CAAM,OAAA,CAAQ,KAAA,CAAM,OAAO,CAAA;AAE9F,EAAA,IAAI,CAAC,UAAA,EAAY;AAEf,IAAA,IAAI,CAAC,MAAA,EAAQ;AACb,IAAA,MAAM,EAAE,KAAA,EAAAC,MAAAA,EAAM,GAAI,MAAM,MAAA,CAAO,QAAA,CAAS,MAAA,CAAO,EAAE,KAAA,EAAO,YAAA,EAAc,IAAA,EAAM,CAAA;AAC5E,IAAA,IAAIA,MAAAA,EAAO,MAAM,IAAI,KAAA,CAAMA,OAAM,OAAO,CAAA;AACxC,IAAA;AAAA,EACF;AAEA,EAAA,MAAM,EAAE,KAAA,EAAM,GAAI,MAAA,GACd,MAAM,OAAO,QAAA,CAAS,MAAA,CAAO,EAAE,KAAA,EAAO,YAAA,EAAc,KAAA,EAAO,CAAA,GAC3D,MAAM,MAAA,CAAO,QAAA,CAAS,MAAA,CAAO,EAAE,KAAA,EAAO,SAAA,EAAW,IAAA,IAAQ,MAAA,EAAW,YAAA,EAAc,KAAA,EAAO,CAAA;AAC7F,EAAA,IAAI,KAAA,EAAO,MAAM,IAAI,KAAA,CAAM,MAAM,OAAO,CAAA;AAExC,EAAA,MAAM,QAAA,GAAW,MAAM,MAAA,CAAO,QAAA,CAAS,SAAS,IAAA,CAAK,EAAE,OAAO,CAAA;AAC9D,EAAA,IAAI,SAAS,KAAA,EAAO,MAAM,IAAI,KAAA,CAAM,QAAA,CAAS,MAAM,OAAO,CAAA;AAC1D,EAAA,IAAI,CAAC,QAAA,CAAS,IAAA,CAAK,IAAA,CAAK,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,EAAA,KAAO,oBAAoB,CAAA,EAAG;AAClE,IAAA,MAAM,KAAA,GAAQ,MAAM,MAAA,CAAO,QAAA,CAAS,QAAA,CAAS,IAAI,EAAE,KAAA,EAAO,SAAA,EAAW,oBAAA,EAAsB,CAAA;AAC3F,IAAA,IAAI,MAAM,KAAA,EAAO,MAAM,IAAI,KAAA,CAAM,KAAA,CAAM,MAAM,OAAO,CAAA;AAAA,EACtD;AACF","file":"index.js","sourcesContent":["// No \"server-only\" guard here — this schema is also imported by scripts that\n// run outside Next.js's bundler (e.g. scripts/doctor.ts), where that guard\n// throws unconditionally. config/env.ts re-exports the parsed, guarded result\n// for app code; import this file directly only from non-Next scripts.\nimport { z } from 'zod';\n\nexport const envSchema = z.object({\n  NODE_ENV: z.enum(['development', 'production', 'test']).default('development'),\n  PORT: z.string().default('3000').transform(Number),\n  DATABASE_URL: z.string().default(''),\n  RESEND_API_KEY: z.string().default(''),\n  // Full access key for marketing broadcasts (admin Marketing email page).\n  // Blank = use RESEND_API_KEY.\n  RESEND_BROADCAST_API_KEY: z.string().default(''),\n  // Resend segment users join from the dashboard \"Email updates\" toggle.\n  // Blank = toggle hidden.\n  RESEND_MARKETING_SEGMENT_ID: z.string().default(''),\n  // Sender for every transactional email. Must be on a domain verified in\n  // your Resend account.\n  EMAIL_FROM: z.string().default('Acme <onboarding@xavierkhew.xyz>'),\n  // Display name for this deployment — shown as the authenticator-app label\n  // (2FA issuer) and the passkey relying-party name. Consuming projects set\n  // this in their own .env; defaults to the template name.\n  APP_NAME: z.string().default('Next.js Template'),\n  // Where the dashboard feedback form delivers (app/api/feedback). Set either\n  // or both; with neither, the Feedback button is hidden. FEEDBACK_EMAIL takes\n  // a comma-separated list and sends through Resend (needs RESEND_API_KEY).\n  FEEDBACK_DISCORD_WEBHOOK_URL: z.string().default(''),\n  FEEDBACK_EMAIL: z.string().default(''),\n  // Seed-only: the live value lives in the system_settings DB row (see\n  // lib/settings-queries.ts) once it's been seeded on first read, and is\n  // changed from the admin System Settings page, not by editing this var.\n  ENABLE_SESSION_REVOCATION: z.string().default('true').transform(val => val === 'true'),\n  AUTH_ENABLE_GOOGLE: z.string().default('true').transform(val => val === 'true'),\n  AUTH_ENABLE_EMAIL_PASSWORD: z.string().default('true').transform(val => val === 'true'),\n  AUTH_ENABLE_ONE_TAP: z.string().default('false').transform(val => val === 'true'),\n  DB_DRIVER: z.enum(['pg', 'neon']).default('pg'),\n  // Only relevant when DB_DRIVER=pg — whether the target Postgres server has SSL\n  // enabled. Self-hosted Postgres (e.g. via Docker/Dokploy) typically does not.\n  DATABASE_SSL: z.string().default('false').transform(val => val === 'true'),\n});\n","import \"server-only\";\nimport { envSchema } from './env-schema';\n\nconst results = envSchema.safeParse(process.env);\n\nif (results.success && (results.data.NODE_ENV === 'development')) {\n  console.log('Environment variables loaded:', Object.keys(results.data));\n}\n\nif (!results.success) {\n  console.error('Invalid environment variables:', results.error.format());\n  throw new Error('Invalid environment variables');\n}\n\nexport const config = results.data;\n","import \"server-only\"\nimport type { Resend } from \"resend\"\nimport { config } from \"@/config/env\"\n\n// From env, not hardcoded: scaffolded apps run this module from the package's\n// bundled auth, so a local edit here would never reach their auth emails.\nexport const EMAIL_FROM = config.EMAIL_FROM\n\n// Loaded on first send, so projects that never send email don't pay for it\n// at startup.\nlet resend: Resend | undefined\nexport async function getResend() {\n  if (!resend) {\n    const { Resend } = await import(\"resend\")\n    resend = new Resend(config.RESEND_API_KEY)\n  }\n  return resend\n}\n\n// Broadcasts need a full access key, so they can use their own and leave\n// RESEND_API_KEY as a sending-only key.\nexport const BROADCAST_API_KEY = config.RESEND_BROADCAST_API_KEY || config.RESEND_API_KEY\n\nlet broadcastResend: Resend | undefined\nexport async function getBroadcastResend() {\n  if (!broadcastResend) {\n    const { Resend } = await import(\"resend\")\n    broadcastResend = new Resend(BROADCAST_API_KEY)\n  }\n  return broadcastResend\n}\n","import \"server-only\"\n// Marketing email data helpers, shipped as `@xk2800/nextjs-template/marketing`.\n// Everything goes through Resend Broadcasts/Contacts with the broadcast key,\n// so it never touches the transactional sending quota.\nimport { config } from \"../config/env\"\nimport { getBroadcastResend, BROADCAST_API_KEY } from \"./resend\"\n\n// The segment users join from the dashboard toggle. Blank = toggle hidden.\nexport const MARKETING_SEGMENT_ID = config.RESEND_MARKETING_SEGMENT_ID\n\nexport interface MarketingSegment {\n  id: string\n  name: string\n}\n\nexport interface MarketingBroadcast {\n  id: string\n  name: string | null\n  status: string\n  created_at: string\n  sent_at: string | null\n}\n\nexport interface MarketingContact {\n  id: string\n  email: string\n  first_name?: string\n  last_name?: string\n  unsubscribed: boolean\n  created_at: string\n}\n\n// Segments + the 10 latest broadcasts for the admin page. `error` is set\n// instead of throwing, so the page can explain a missing or sending-only key.\nexport async function getMarketingOverview(): Promise<{\n  segments: MarketingSegment[]\n  broadcasts: MarketingBroadcast[]\n  error: string | null\n}> {\n  if (!BROADCAST_API_KEY) {\n    return { segments: [], broadcasts: [], error: \"Neither RESEND_BROADCAST_API_KEY nor RESEND_API_KEY is set.\" }\n  }\n\n  const resend = await getBroadcastResend()\n  const [segRes, bcRes] = await Promise.all([\n    resend.segments.list(),\n    resend.broadcasts.list({ limit: 10 }),\n  ])\n  if (segRes.error) return { segments: [], broadcasts: [], error: segRes.error.message }\n  return { segments: segRes.data.data, broadcasts: bcRes.data?.data ?? [], error: null }\n}\n\n// ponytail: first page only (Resend max 100); add cursor paging (`after`)\n// if a segment outgrows it.\nexport const SEGMENT_CONTACTS_LIMIT = 100\n\nexport async function listSegmentContacts(segmentId: string): Promise<{\n  contacts: MarketingContact[]\n  hasMore: boolean\n  error: string | null\n}> {\n  const { data, error } = await (await getBroadcastResend()).contacts.list({ segmentId, limit: SEGMENT_CONTACTS_LIMIT })\n  if (error) return { contacts: [], hasMore: false, error: error.message }\n  return { contacts: data.data, hasMore: data.has_more, error: null }\n}\n\n// Resend is the source of truth, so the toggle also reflects someone who\n// clicked Unsubscribe in an email or was edited in the Resend dashboard.\nexport async function isSubscribed(email: string): Promise<boolean> {\n  const resend = await getBroadcastResend()\n  const contact = await resend.contacts.get({ email })\n  if (contact.error) {\n    if (contact.error.name === \"not_found\") return false\n    throw new Error(contact.error.message)\n  }\n  if (contact.data.unsubscribed) return false\n\n  const segments = await resend.contacts.segments.list({ email })\n  if (segments.error) throw new Error(segments.error.message)\n  return segments.data.data.some((s) => s.id === MARKETING_SEGMENT_ID)\n}\n\nexport async function setSubscribed(email: string, name: string, subscribed: boolean) {\n  const resend = await getBroadcastResend()\n  const contact = await resend.contacts.get({ email })\n  const exists = !contact.error\n  if (contact.error && contact.error.name !== \"not_found\") throw new Error(contact.error.message)\n\n  if (!subscribed) {\n    // Same as the email's Unsubscribe link: opted out of every broadcast.\n    if (!exists) return\n    const { error } = await resend.contacts.update({ email, unsubscribed: true })\n    if (error) throw new Error(error.message)\n    return\n  }\n\n  const { error } = exists\n    ? await resend.contacts.update({ email, unsubscribed: false })\n    : await resend.contacts.create({ email, firstName: name || undefined, unsubscribed: false })\n  if (error) throw new Error(error.message)\n\n  const segments = await resend.contacts.segments.list({ email })\n  if (segments.error) throw new Error(segments.error.message)\n  if (!segments.data.data.some((s) => s.id === MARKETING_SEGMENT_ID)) {\n    const added = await resend.contacts.segments.add({ email, segmentId: MARKETING_SEGMENT_ID })\n    if (added.error) throw new Error(added.error.message)\n  }\n}\n"]}

package/dist/marketing/index.mjs

@@ -0,0 +1,6 @@
+export { MARKETING_SEGMENT_ID, SEGMENT_CONTACTS_LIMIT, getMarketingOverview, isSubscribed, listSegmentContacts, setSubscribed } from '../chunk-C6RGN6QA.mjs';
+import '../chunk-OVKVD2HH.mjs';
+import '../chunk-TKWNEKK6.mjs';
+import '../chunk-3465SI5N.mjs';
+//# sourceMappingURL=index.mjs.map
+//# sourceMappingURL=index.mjs.map

package/dist/marketing/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"names":[],"mappings":"","file":"index.mjs"}

package/dist/{schema-BNSBWNjK.d.mts → schema-CN_Y6EXv.d.mts}

@@ -1142,7 +1142,7 @@ declare const activityLogs: drizzle_orm_pg_core.PgTableWithColumns<{
             tableName: "activity_log";
             dataType: "string";
             columnType: "PgEnumColumn";
-            data: "login_failed" | "login" | "logout" | "password_changed" | "email_changed" | "profile_updated" | "session_revoked" | "user_deleted" | "user_banned" | "user_unbanned" | "role_changed" | "impersonation_started" | "impersonation_stopped" | "settings_changed" | "passkey_added" | "passkey_removed";
+            data: "login" | "logout" | "login_failed" | "password_changed" | "email_changed" | "profile_updated" | "session_revoked" | "user_deleted" | "user_banned" | "user_unbanned" | "role_changed" | "impersonation_started" | "impersonation_stopped" | "settings_changed" | "passkey_added" | "passkey_removed";
             driverParam: string;
             notNull: true;
             hasDefault: false;
@@ -1467,6 +1467,25 @@ declare const deviceFingerprints: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        components: drizzle_orm_pg_core.PgColumn<{
+            name: "components";
+            tableName: "device_fingerprint";
+            dataType: "json";
+            columnType: "PgJsonb";
+            data: Record<string, unknown>;
+            driverParam: unknown;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            $type: Record<string, unknown>;
+        }>;
         createdAt: drizzle_orm_pg_core.PgColumn<{
             name: "createdAt";
             tableName: "device_fingerprint";
@@ -1487,6 +1506,115 @@ declare const deviceFingerprints: drizzle_orm_pg_core.PgTableWithColumns<{
     };
     dialect: "pg";
 }>;
+declare const consentLog: drizzle_orm_pg_core.PgTableWithColumns<{
+    name: "consent_log";
+    schema: undefined;
+    columns: {
+        id: drizzle_orm_pg_core.PgColumn<{
+            name: "id";
+            tableName: "consent_log";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: true;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        userId: drizzle_orm_pg_core.PgColumn<{
+            name: "userId";
+            tableName: "consent_log";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        choice: drizzle_orm_pg_core.PgColumn<{
+            name: "choice";
+            tableName: "consent_log";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        version: drizzle_orm_pg_core.PgColumn<{
+            name: "version";
+            tableName: "consent_log";
+            dataType: "number";
+            columnType: "PgInteger";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        previousId: drizzle_orm_pg_core.PgColumn<{
+            name: "previousId";
+            tableName: "consent_log";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        createdAt: drizzle_orm_pg_core.PgColumn<{
+            name: "createdAt";
+            tableName: "consent_log";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: "pg";
+}>;
 declare const authThrottle: drizzle_orm_pg_core.PgTableWithColumns<{
     name: "auth_throttle";
     schema: undefined;
@@ -1813,6 +1941,23 @@ declare const systemSettings: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        consentRequired: drizzle_orm_pg_core.PgColumn<{
+            name: "consentRequired";
+            tableName: "system_settings";
+            dataType: "boolean";
+            columnType: "PgBoolean";
+            data: boolean;
+            driverParam: boolean;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         updatedAt: drizzle_orm_pg_core.PgColumn<{
             name: "updatedAt";
             tableName: "system_settings";
@@ -1931,6 +2076,7 @@ declare const schema_RoleEnum: typeof RoleEnum;
 declare const schema_accounts: typeof accounts;
 declare const schema_activityLogs: typeof activityLogs;
 declare const schema_authThrottle: typeof authThrottle;
+declare const schema_consentLog: typeof consentLog;
 declare const schema_deviceFingerprints: typeof deviceFingerprints;
 declare const schema_errorRefs: typeof errorRefs;
 declare const schema_passkeys: typeof passkeys;
@@ -1940,7 +2086,7 @@ declare const schema_twoFactors: typeof twoFactors;
 declare const schema_users: typeof users;
 declare const schema_verifications: typeof verifications;
 declare namespace schema {
-  export { schema_ActivityActionEnum as ActivityActionEnum, schema_RoleEnum as RoleEnum, schema_accounts as accounts, schema_activityLogs as activityLogs, schema_authThrottle as authThrottle, schema_deviceFingerprints as deviceFingerprints, schema_errorRefs as errorRefs, schema_passkeys as passkeys, schema_sessions as sessions, schema_systemSettings as systemSettings, schema_twoFactors as twoFactors, schema_users as users, schema_verifications as verifications };
+  export { schema_ActivityActionEnum as ActivityActionEnum, schema_RoleEnum as RoleEnum, schema_accounts as accounts, schema_activityLogs as activityLogs, schema_authThrottle as authThrottle, schema_consentLog as consentLog, schema_deviceFingerprints as deviceFingerprints, schema_errorRefs as errorRefs, schema_passkeys as passkeys, schema_sessions as sessions, schema_systemSettings as systemSettings, schema_twoFactors as twoFactors, schema_users as users, schema_verifications as verifications };
 }
 
-export { ActivityActionEnum as A, RoleEnum as R, schema as a, accounts as b, activityLogs as c, authThrottle as d, deviceFingerprints as e, errorRefs as f, sessions as g, passkeys as p, systemSettings as s, twoFactors as t, users as u, verifications as v };
+export { ActivityActionEnum as A, RoleEnum as R, schema as a, accounts as b, activityLogs as c, authThrottle as d, consentLog as e, deviceFingerprints as f, errorRefs as g, sessions as h, passkeys as p, systemSettings as s, twoFactors as t, users as u, verifications as v };

package/dist/{schema-BNSBWNjK.d.ts → schema-CN_Y6EXv.d.ts}

@@ -1142,7 +1142,7 @@ declare const activityLogs: drizzle_orm_pg_core.PgTableWithColumns<{
             tableName: "activity_log";
             dataType: "string";
             columnType: "PgEnumColumn";
-            data: "login_failed" | "login" | "logout" | "password_changed" | "email_changed" | "profile_updated" | "session_revoked" | "user_deleted" | "user_banned" | "user_unbanned" | "role_changed" | "impersonation_started" | "impersonation_stopped" | "settings_changed" | "passkey_added" | "passkey_removed";
+            data: "login" | "logout" | "login_failed" | "password_changed" | "email_changed" | "profile_updated" | "session_revoked" | "user_deleted" | "user_banned" | "user_unbanned" | "role_changed" | "impersonation_started" | "impersonation_stopped" | "settings_changed" | "passkey_added" | "passkey_removed";
             driverParam: string;
             notNull: true;
             hasDefault: false;
@@ -1467,6 +1467,25 @@ declare const deviceFingerprints: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        components: drizzle_orm_pg_core.PgColumn<{
+            name: "components";
+            tableName: "device_fingerprint";
+            dataType: "json";
+            columnType: "PgJsonb";
+            data: Record<string, unknown>;
+            driverParam: unknown;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            $type: Record<string, unknown>;
+        }>;
         createdAt: drizzle_orm_pg_core.PgColumn<{
             name: "createdAt";
             tableName: "device_fingerprint";
@@ -1487,6 +1506,115 @@ declare const deviceFingerprints: drizzle_orm_pg_core.PgTableWithColumns<{
     };
     dialect: "pg";
 }>;
+declare const consentLog: drizzle_orm_pg_core.PgTableWithColumns<{
+    name: "consent_log";
+    schema: undefined;
+    columns: {
+        id: drizzle_orm_pg_core.PgColumn<{
+            name: "id";
+            tableName: "consent_log";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: true;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        userId: drizzle_orm_pg_core.PgColumn<{
+            name: "userId";
+            tableName: "consent_log";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        choice: drizzle_orm_pg_core.PgColumn<{
+            name: "choice";
+            tableName: "consent_log";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        version: drizzle_orm_pg_core.PgColumn<{
+            name: "version";
+            tableName: "consent_log";
+            dataType: "number";
+            columnType: "PgInteger";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        previousId: drizzle_orm_pg_core.PgColumn<{
+            name: "previousId";
+            tableName: "consent_log";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        createdAt: drizzle_orm_pg_core.PgColumn<{
+            name: "createdAt";
+            tableName: "consent_log";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: "pg";
+}>;
 declare const authThrottle: drizzle_orm_pg_core.PgTableWithColumns<{
     name: "auth_throttle";
     schema: undefined;
@@ -1813,6 +1941,23 @@ declare const systemSettings: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        consentRequired: drizzle_orm_pg_core.PgColumn<{
+            name: "consentRequired";
+            tableName: "system_settings";
+            dataType: "boolean";
+            columnType: "PgBoolean";
+            data: boolean;
+            driverParam: boolean;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         updatedAt: drizzle_orm_pg_core.PgColumn<{
             name: "updatedAt";
             tableName: "system_settings";
@@ -1931,6 +2076,7 @@ declare const schema_RoleEnum: typeof RoleEnum;
 declare const schema_accounts: typeof accounts;
 declare const schema_activityLogs: typeof activityLogs;
 declare const schema_authThrottle: typeof authThrottle;
+declare const schema_consentLog: typeof consentLog;
 declare const schema_deviceFingerprints: typeof deviceFingerprints;
 declare const schema_errorRefs: typeof errorRefs;
 declare const schema_passkeys: typeof passkeys;
@@ -1940,7 +2086,7 @@ declare const schema_twoFactors: typeof twoFactors;
 declare const schema_users: typeof users;
 declare const schema_verifications: typeof verifications;
 declare namespace schema {
-  export { schema_ActivityActionEnum as ActivityActionEnum, schema_RoleEnum as RoleEnum, schema_accounts as accounts, schema_activityLogs as activityLogs, schema_authThrottle as authThrottle, schema_deviceFingerprints as deviceFingerprints, schema_errorRefs as errorRefs, schema_passkeys as passkeys, schema_sessions as sessions, schema_systemSettings as systemSettings, schema_twoFactors as twoFactors, schema_users as users, schema_verifications as verifications };
+  export { schema_ActivityActionEnum as ActivityActionEnum, schema_RoleEnum as RoleEnum, schema_accounts as accounts, schema_activityLogs as activityLogs, schema_authThrottle as authThrottle, schema_consentLog as consentLog, schema_deviceFingerprints as deviceFingerprints, schema_errorRefs as errorRefs, schema_passkeys as passkeys, schema_sessions as sessions, schema_systemSettings as systemSettings, schema_twoFactors as twoFactors, schema_users as users, schema_verifications as verifications };
 }
 
-export { ActivityActionEnum as A, RoleEnum as R, schema as a, accounts as b, activityLogs as c, authThrottle as d, deviceFingerprints as e, errorRefs as f, sessions as g, passkeys as p, systemSettings as s, twoFactors as t, users as u, verifications as v };
+export { ActivityActionEnum as A, RoleEnum as R, schema as a, accounts as b, activityLogs as c, authThrottle as d, consentLog as e, deviceFingerprints as f, errorRefs as g, sessions as h, passkeys as p, systemSettings as s, twoFactors as t, users as u, verifications as v };

package/dist/sessions/queries.js

@@ -24,6 +24,7 @@ __export(schema_exports, {
   accounts: () => accounts,
   activityLogs: () => activityLogs,
   authThrottle: () => authThrottle,
+  consentLog: () => consentLog,
   deviceFingerprints: () => deviceFingerprints,
   errorRefs: () => errorRefs,
   passkeys: () => passkeys,
@@ -178,10 +179,32 @@ var deviceFingerprints = pgCore.pgTable("device_fingerprint", {
   userAgent: pgCore.text("userAgent"),
   country: pgCore.text("country"),
   city: pgCore.text("city"),
+  // Latest FingerprintJS signals for this device (lib/device-fingerprint.ts
+  // getDeviceSignals(): accessibility signals dropped, large values hashed),
+  // shown on the admin user page. Null for rows from before this column.
+  components: pgCore.jsonb("components").$type(),
   createdAt: pgCore.timestamp("createdAt").notNull().defaultNow()
 }, (table) => [
   pgCore.unique("device_fingerprint_user_visitor").on(table.userId, table.visitorId)
 ]);
+var consentLog = pgCore.pgTable("consent_log", {
+  id: pgCore.text("id").notNull().primaryKey().$defaultFn(() => cuid2.createId()),
+  userId: pgCore.text("userId").notNull().references(() => users.id, { onDelete: "cascade" }),
+  // The cookie_consent value: "all", "necessary" or a comma list of purposes.
+  choice: pgCore.text("choice").notNull(),
+  // CONSENT_VERSION (lib/cookie-names.ts) at the time — which banner/policy
+  // wording the user agreed to.
+  version: pgCore.integer("version").notNull(),
+  // id of the user's record this one follows ("" for their first). Unique per
+  // user, so concurrent posts from several tabs that all saw the same latest
+  // record can't each insert a duplicate — one wins, the rest conflict. Works
+  // without transactions (neon-http has none). Null on rows from before it.
+  previousId: pgCore.text("previousId"),
+  createdAt: pgCore.timestamp("createdAt").notNull().defaultNow()
+}, (table) => [
+  pgCore.index("consent_log_user_idx").on(table.userId, table.createdAt),
+  pgCore.unique("consent_log_chain").on(table.userId, table.previousId)
+]);
 var authThrottle = pgCore.pgTable("auth_throttle", {
   fingerprint: pgCore.text("fingerprint").notNull().primaryKey(),
   count: pgCore.integer("count").notNull().default(0),
@@ -211,6 +234,13 @@ var systemSettings = pgCore.pgTable("system_settings", {
   // Attach the error a user hit to feedback they send from it (see
   // lib/feedback-route.ts). Off = only what the user typed is sent.
   feedbackAttachErrors: pgCore.boolean("feedbackAttachErrors").notNull().default(true),
+  // GDPR/ePrivacy consent mode. On: cookie banner, FingerprintJS and One Tap
+  // only after "Accept all", device record erased on withdrawal. Off (no EU/UK
+  // users): no banner, treated as consented. Null = follow
+  // NEXT_PUBLIC_COOKIE_BANNER (nullable so migrating never flips a deployed
+  // banner on or off). proxy.ts mirrors the effective value into the
+  // consent_required cookie for the client (lib/cookie-consent.ts).
+  consentRequired: pgCore.boolean("consentRequired"),
   updatedAt: pgCore.timestamp("updatedAt").notNull().defaultNow(),
   // Who last changed a setting. This row doesn't "belong" to that admin the
   // way sessions/activityLogs belong to their user, so deleting that admin's
@@ -232,6 +262,12 @@ var envSchema = zod.z.object({
   PORT: zod.z.string().default("3000").transform(Number),
   DATABASE_URL: zod.z.string().default(""),
   RESEND_API_KEY: zod.z.string().default(""),
+  // Full access key for marketing broadcasts (admin Marketing email page).
+  // Blank = use RESEND_API_KEY.
+  RESEND_BROADCAST_API_KEY: zod.z.string().default(""),
+  // Resend segment users join from the dashboard "Email updates" toggle.
+  // Blank = toggle hidden.
+  RESEND_MARKETING_SEGMENT_ID: zod.z.string().default(""),
   // Sender for every transactional email. Must be on a domain verified in
   // your Resend account.
   EMAIL_FROM: zod.z.string().default("Acme <onboarding@xavierkhew.xyz>"),