@xk2800/nextjs-template 0.7.1-beta.1 → 0.7.1-beta.10

package/dist/auth-client/index.d.mts

@@ -826,8 +826,8 @@ declare const authClient: better_auth_react.ReactAuthClient<{
                         $Infer: {
                             body: {
                                 permissions: {
-                                    readonly user?: ("set-role" | "delete" | "update" | "list" | "create" | "ban" | "impersonate" | "impersonate-admins" | "set-password" | "set-email" | "get")[] | undefined;
-                                    readonly session?: ("delete" | "list" | "revoke")[] | undefined;
+                                    readonly user?: ("create" | "list" | "set-role" | "ban" | "impersonate" | "impersonate-admins" | "delete" | "set-password" | "set-email" | "get" | "update")[] | undefined;
+                                    readonly session?: ("list" | "delete" | "revoke")[] | undefined;
                                 };
                             } & {
                                 userId?: string | undefined;
@@ -916,8 +916,8 @@ declare const authClient: better_auth_react.ReactAuthClient<{
             admin: {
                 checkRolePermission: <R extends "user" | "admin">(data: {
                     permissions: {
-                        readonly user?: ("set-role" | "delete" | "update" | "list" | "create" | "ban" | "impersonate" | "impersonate-admins" | "set-password" | "set-email" | "get")[] | undefined;
-                        readonly session?: ("delete" | "list" | "revoke")[] | undefined;
+                        readonly user?: ("create" | "list" | "set-role" | "ban" | "impersonate" | "impersonate-admins" | "delete" | "set-password" | "set-email" | "get" | "update")[] | undefined;
+                        readonly session?: ("list" | "delete" | "revoke")[] | undefined;
                     };
                 } & {
                     role: R;
@@ -2423,8 +2423,8 @@ declare const useSession: () => {
             banned: boolean | null | undefined;
         } & {
             role?: string | null | undefined;
-            banExpires?: Date | null | undefined;
             banReason?: string | null | undefined;
+            banExpires?: Date | null | undefined;
         } & {
             twoFactorEnabled: boolean | null | undefined;
         } & {}>;
@@ -2450,7 +2450,7 @@ declare const useSession: () => {
 };
 declare const signIn: {
     social: <FetchOptions extends better_auth.ClientFetchOption<Partial<{
-        provider: "github" | "apple" | "atlassian" | "cloudflare" | "cognito" | "discord" | "facebook" | "figma" | "microsoft" | "google" | "huggingface" | "slack" | "spotify" | "twitch" | "twitter" | "dropbox" | "kick" | "linear" | "linkedin" | "gitlab" | "tiktok" | "reddit" | "roblox" | "salesforce" | "vk" | "zoom" | "notion" | "kakao" | "naver" | "line" | "paybin" | "paypal" | "polar" | "railway" | "vercel" | "wechat" | (string & {});
+        provider: (string & {}) | "github" | "apple" | "atlassian" | "cloudflare" | "cognito" | "discord" | "facebook" | "figma" | "microsoft" | "google" | "huggingface" | "slack" | "spotify" | "twitch" | "twitter" | "dropbox" | "kick" | "linear" | "linkedin" | "gitlab" | "tiktok" | "reddit" | "roblox" | "salesforce" | "vk" | "zoom" | "notion" | "kakao" | "naver" | "line" | "paybin" | "paypal" | "polar" | "railway" | "vercel" | "wechat";
         callbackURL?: string | undefined;
         newUserCallbackURL?: string | undefined;
         errorCallbackURL?: string | undefined;
@@ -2475,7 +2475,7 @@ declare const signIn: {
         additionalParams?: Record<string, string> | undefined;
         additionalData?: Record<string, any> | undefined;
     }> & Record<string, any>, Partial<Record<string, any>> & Record<string, any>, Record<string, string | undefined> | undefined>>(data_0: better_auth.Prettify<Omit<{
-        provider: "github" | "apple" | "atlassian" | "cloudflare" | "cognito" | "discord" | "facebook" | "figma" | "microsoft" | "google" | "huggingface" | "slack" | "spotify" | "twitch" | "twitter" | "dropbox" | "kick" | "linear" | "linkedin" | "gitlab" | "tiktok" | "reddit" | "roblox" | "salesforce" | "vk" | "zoom" | "notion" | "kakao" | "naver" | "line" | "paybin" | "paypal" | "polar" | "railway" | "vercel" | "wechat" | (string & {});
+        provider: (string & {}) | "github" | "apple" | "atlassian" | "cloudflare" | "cognito" | "discord" | "facebook" | "figma" | "microsoft" | "google" | "huggingface" | "slack" | "spotify" | "twitch" | "twitter" | "dropbox" | "kick" | "linear" | "linkedin" | "gitlab" | "tiktok" | "reddit" | "roblox" | "salesforce" | "vk" | "zoom" | "notion" | "kakao" | "naver" | "line" | "paybin" | "paypal" | "polar" | "railway" | "vercel" | "wechat";
         callbackURL?: string | undefined;
         newUserCallbackURL?: string | undefined;
         errorCallbackURL?: string | undefined;
@@ -2502,7 +2502,7 @@ declare const signIn: {
     } & {
         fetchOptions?: FetchOptions | undefined;
     }, "provider"> & {
-        provider: "github" | "apple" | "atlassian" | "cloudflare" | "cognito" | "discord" | "facebook" | "figma" | "microsoft" | "google" | "huggingface" | "slack" | "spotify" | "twitch" | "twitter" | "dropbox" | "kick" | "linear" | "linkedin" | "gitlab" | "tiktok" | "reddit" | "roblox" | "salesforce" | "vk" | "zoom" | "notion" | "kakao" | "naver" | "line" | "paybin" | "paypal" | "polar" | "railway" | "vercel" | "wechat" | (string & {});
+        provider: (string & {}) | "github" | "apple" | "atlassian" | "cloudflare" | "cognito" | "discord" | "facebook" | "figma" | "microsoft" | "google" | "huggingface" | "slack" | "spotify" | "twitch" | "twitter" | "dropbox" | "kick" | "linear" | "linkedin" | "gitlab" | "tiktok" | "reddit" | "roblox" | "salesforce" | "vk" | "zoom" | "notion" | "kakao" | "naver" | "line" | "paybin" | "paypal" | "polar" | "railway" | "vercel" | "wechat";
         fetchOptions?: FetchOptions | undefined;
     }>, data_1?: FetchOptions | undefined) => Promise<_better_fetch_fetch.BetterFetchResponse<{
         redirect: boolean;
@@ -2533,8 +2533,8 @@ declare const signIn: {
             banned: boolean | null | undefined;
         } & {
             role?: string | null | undefined;
-            banExpires?: Date | null | undefined;
             banReason?: string | null | undefined;
+            banExpires?: Date | null | undefined;
         } & {
             twoFactorEnabled: boolean | null | undefined;
         } & {}>;
@@ -2581,8 +2581,8 @@ declare const signIn: {
             banned: boolean | null | undefined;
         } & {
             role?: string | null | undefined;
-            banExpires?: Date | null | undefined;
             banReason?: string | null | undefined;
+            banExpires?: Date | null | undefined;
         } & {
             twoFactorEnabled: boolean | null | undefined;
         } & {}>;
@@ -3481,8 +3481,8 @@ declare const signUp: {
                             $Infer: {
                                 body: {
                                     permissions: {
-                                        readonly user?: ("set-role" | "delete" | "update" | "list" | "create" | "ban" | "impersonate" | "impersonate-admins" | "set-password" | "set-email" | "get")[] | undefined;
-                                        readonly session?: ("delete" | "list" | "revoke")[] | undefined;
+                                        readonly user?: ("create" | "list" | "set-role" | "ban" | "impersonate" | "impersonate-admins" | "delete" | "set-password" | "set-email" | "get" | "update")[] | undefined;
+                                        readonly session?: ("list" | "delete" | "revoke")[] | undefined;
                                     };
                                 } & {
                                     userId?: string | undefined;
@@ -3571,8 +3571,8 @@ declare const signUp: {
                 admin: {
                     checkRolePermission: <R extends "user" | "admin">(data: {
                         permissions: {
-                            readonly user?: ("set-role" | "delete" | "update" | "list" | "create" | "ban" | "impersonate" | "impersonate-admins" | "set-password" | "set-email" | "get")[] | undefined;
-                            readonly session?: ("delete" | "list" | "revoke")[] | undefined;
+                            readonly user?: ("create" | "list" | "set-role" | "ban" | "impersonate" | "impersonate-admins" | "delete" | "set-password" | "set-email" | "get" | "update")[] | undefined;
+                            readonly session?: ("list" | "delete" | "revoke")[] | undefined;
                         };
                     } & {
                         role: R;
@@ -5155,8 +5155,8 @@ declare const signUp: {
             banned: boolean | null | undefined;
         } & {
             role?: string | null | undefined;
-            banExpires?: Date | null | undefined;
             banReason?: string | null | undefined;
+            banExpires?: Date | null | undefined;
         } & {
             twoFactorEnabled: boolean | null | undefined;
         } & {}>;
@@ -5184,8 +5184,8 @@ declare const signUp: {
             banned: boolean | null | undefined;
         } & {
             role?: string | null | undefined;
-            banExpires?: Date | null | undefined;
             banReason?: string | null | undefined;
+            banExpires?: Date | null | undefined;
         } & {
             twoFactorEnabled: boolean | null | undefined;
         } & {}>;

package/dist/auth-client/index.d.ts

@@ -826,8 +826,8 @@ declare const authClient: better_auth_react.ReactAuthClient<{
                         $Infer: {
                             body: {
                                 permissions: {
-                                    readonly user?: ("set-role" | "delete" | "update" | "list" | "create" | "ban" | "impersonate" | "impersonate-admins" | "set-password" | "set-email" | "get")[] | undefined;
-                                    readonly session?: ("delete" | "list" | "revoke")[] | undefined;
+                                    readonly user?: ("create" | "list" | "set-role" | "ban" | "impersonate" | "impersonate-admins" | "delete" | "set-password" | "set-email" | "get" | "update")[] | undefined;
+                                    readonly session?: ("list" | "delete" | "revoke")[] | undefined;
                                 };
                             } & {
                                 userId?: string | undefined;
@@ -916,8 +916,8 @@ declare const authClient: better_auth_react.ReactAuthClient<{
             admin: {
                 checkRolePermission: <R extends "user" | "admin">(data: {
                     permissions: {
-                        readonly user?: ("set-role" | "delete" | "update" | "list" | "create" | "ban" | "impersonate" | "impersonate-admins" | "set-password" | "set-email" | "get")[] | undefined;
-                        readonly session?: ("delete" | "list" | "revoke")[] | undefined;
+                        readonly user?: ("create" | "list" | "set-role" | "ban" | "impersonate" | "impersonate-admins" | "delete" | "set-password" | "set-email" | "get" | "update")[] | undefined;
+                        readonly session?: ("list" | "delete" | "revoke")[] | undefined;
                     };
                 } & {
                     role: R;
@@ -2423,8 +2423,8 @@ declare const useSession: () => {
             banned: boolean | null | undefined;
         } & {
             role?: string | null | undefined;
-            banExpires?: Date | null | undefined;
             banReason?: string | null | undefined;
+            banExpires?: Date | null | undefined;
         } & {
             twoFactorEnabled: boolean | null | undefined;
         } & {}>;
@@ -2450,7 +2450,7 @@ declare const useSession: () => {
 };
 declare const signIn: {
     social: <FetchOptions extends better_auth.ClientFetchOption<Partial<{
-        provider: "github" | "apple" | "atlassian" | "cloudflare" | "cognito" | "discord" | "facebook" | "figma" | "microsoft" | "google" | "huggingface" | "slack" | "spotify" | "twitch" | "twitter" | "dropbox" | "kick" | "linear" | "linkedin" | "gitlab" | "tiktok" | "reddit" | "roblox" | "salesforce" | "vk" | "zoom" | "notion" | "kakao" | "naver" | "line" | "paybin" | "paypal" | "polar" | "railway" | "vercel" | "wechat" | (string & {});
+        provider: (string & {}) | "github" | "apple" | "atlassian" | "cloudflare" | "cognito" | "discord" | "facebook" | "figma" | "microsoft" | "google" | "huggingface" | "slack" | "spotify" | "twitch" | "twitter" | "dropbox" | "kick" | "linear" | "linkedin" | "gitlab" | "tiktok" | "reddit" | "roblox" | "salesforce" | "vk" | "zoom" | "notion" | "kakao" | "naver" | "line" | "paybin" | "paypal" | "polar" | "railway" | "vercel" | "wechat";
         callbackURL?: string | undefined;
         newUserCallbackURL?: string | undefined;
         errorCallbackURL?: string | undefined;
@@ -2475,7 +2475,7 @@ declare const signIn: {
         additionalParams?: Record<string, string> | undefined;
         additionalData?: Record<string, any> | undefined;
     }> & Record<string, any>, Partial<Record<string, any>> & Record<string, any>, Record<string, string | undefined> | undefined>>(data_0: better_auth.Prettify<Omit<{
-        provider: "github" | "apple" | "atlassian" | "cloudflare" | "cognito" | "discord" | "facebook" | "figma" | "microsoft" | "google" | "huggingface" | "slack" | "spotify" | "twitch" | "twitter" | "dropbox" | "kick" | "linear" | "linkedin" | "gitlab" | "tiktok" | "reddit" | "roblox" | "salesforce" | "vk" | "zoom" | "notion" | "kakao" | "naver" | "line" | "paybin" | "paypal" | "polar" | "railway" | "vercel" | "wechat" | (string & {});
+        provider: (string & {}) | "github" | "apple" | "atlassian" | "cloudflare" | "cognito" | "discord" | "facebook" | "figma" | "microsoft" | "google" | "huggingface" | "slack" | "spotify" | "twitch" | "twitter" | "dropbox" | "kick" | "linear" | "linkedin" | "gitlab" | "tiktok" | "reddit" | "roblox" | "salesforce" | "vk" | "zoom" | "notion" | "kakao" | "naver" | "line" | "paybin" | "paypal" | "polar" | "railway" | "vercel" | "wechat";
         callbackURL?: string | undefined;
         newUserCallbackURL?: string | undefined;
         errorCallbackURL?: string | undefined;
@@ -2502,7 +2502,7 @@ declare const signIn: {
     } & {
         fetchOptions?: FetchOptions | undefined;
     }, "provider"> & {
-        provider: "github" | "apple" | "atlassian" | "cloudflare" | "cognito" | "discord" | "facebook" | "figma" | "microsoft" | "google" | "huggingface" | "slack" | "spotify" | "twitch" | "twitter" | "dropbox" | "kick" | "linear" | "linkedin" | "gitlab" | "tiktok" | "reddit" | "roblox" | "salesforce" | "vk" | "zoom" | "notion" | "kakao" | "naver" | "line" | "paybin" | "paypal" | "polar" | "railway" | "vercel" | "wechat" | (string & {});
+        provider: (string & {}) | "github" | "apple" | "atlassian" | "cloudflare" | "cognito" | "discord" | "facebook" | "figma" | "microsoft" | "google" | "huggingface" | "slack" | "spotify" | "twitch" | "twitter" | "dropbox" | "kick" | "linear" | "linkedin" | "gitlab" | "tiktok" | "reddit" | "roblox" | "salesforce" | "vk" | "zoom" | "notion" | "kakao" | "naver" | "line" | "paybin" | "paypal" | "polar" | "railway" | "vercel" | "wechat";
         fetchOptions?: FetchOptions | undefined;
     }>, data_1?: FetchOptions | undefined) => Promise<_better_fetch_fetch.BetterFetchResponse<{
         redirect: boolean;
@@ -2533,8 +2533,8 @@ declare const signIn: {
             banned: boolean | null | undefined;
         } & {
             role?: string | null | undefined;
-            banExpires?: Date | null | undefined;
             banReason?: string | null | undefined;
+            banExpires?: Date | null | undefined;
         } & {
             twoFactorEnabled: boolean | null | undefined;
         } & {}>;
@@ -2581,8 +2581,8 @@ declare const signIn: {
             banned: boolean | null | undefined;
         } & {
             role?: string | null | undefined;
-            banExpires?: Date | null | undefined;
             banReason?: string | null | undefined;
+            banExpires?: Date | null | undefined;
         } & {
             twoFactorEnabled: boolean | null | undefined;
         } & {}>;
@@ -3481,8 +3481,8 @@ declare const signUp: {
                             $Infer: {
                                 body: {
                                     permissions: {
-                                        readonly user?: ("set-role" | "delete" | "update" | "list" | "create" | "ban" | "impersonate" | "impersonate-admins" | "set-password" | "set-email" | "get")[] | undefined;
-                                        readonly session?: ("delete" | "list" | "revoke")[] | undefined;
+                                        readonly user?: ("create" | "list" | "set-role" | "ban" | "impersonate" | "impersonate-admins" | "delete" | "set-password" | "set-email" | "get" | "update")[] | undefined;
+                                        readonly session?: ("list" | "delete" | "revoke")[] | undefined;
                                     };
                                 } & {
                                     userId?: string | undefined;
@@ -3571,8 +3571,8 @@ declare const signUp: {
                 admin: {
                     checkRolePermission: <R extends "user" | "admin">(data: {
                         permissions: {
-                            readonly user?: ("set-role" | "delete" | "update" | "list" | "create" | "ban" | "impersonate" | "impersonate-admins" | "set-password" | "set-email" | "get")[] | undefined;
-                            readonly session?: ("delete" | "list" | "revoke")[] | undefined;
+                            readonly user?: ("create" | "list" | "set-role" | "ban" | "impersonate" | "impersonate-admins" | "delete" | "set-password" | "set-email" | "get" | "update")[] | undefined;
+                            readonly session?: ("list" | "delete" | "revoke")[] | undefined;
                         };
                     } & {
                         role: R;
@@ -5155,8 +5155,8 @@ declare const signUp: {
             banned: boolean | null | undefined;
         } & {
             role?: string | null | undefined;
-            banExpires?: Date | null | undefined;
             banReason?: string | null | undefined;
+            banExpires?: Date | null | undefined;
         } & {
             twoFactorEnabled: boolean | null | undefined;
         } & {}>;
@@ -5184,8 +5184,8 @@ declare const signUp: {
             banned: boolean | null | undefined;
         } & {
             role?: string | null | undefined;
-            banExpires?: Date | null | undefined;
             banReason?: string | null | undefined;
+            banExpires?: Date | null | undefined;
         } & {
             twoFactorEnabled: boolean | null | undefined;
         } & {}>;

package/dist/{chunk-KAEA35OC.mjs → chunk-6MDQRT6U.mjs}

@@ -1,5 +1,5 @@
-import { db } from './chunk-WZDAMCUX.mjs';
-import { errorRefs } from './chunk-ZQCALTKB.mjs';
+import { db } from './chunk-ZJMFE5B2.mjs';
+import { errorRefs } from './chunk-TR5XFBTD.mjs';
 import 'server-only';
 import { randomBytes } from 'crypto';
 import { after } from 'next/server';
@@ -72,5 +72,5 @@ function withActionErrors(action) {
 }
 
 export { ActionError, lookupErrorDetail, unexpectedErrorMessage, withActionErrors };
-//# sourceMappingURL=chunk-KAEA35OC.mjs.map
-//# sourceMappingURL=chunk-KAEA35OC.mjs.map
+//# sourceMappingURL=chunk-6MDQRT6U.mjs.map
+//# sourceMappingURL=chunk-6MDQRT6U.mjs.map

package/dist/{chunk-KAEA35OC.mjs.map → chunk-6MDQRT6U.mjs.map}

@@ -1 +1 @@
-{"version":3,"sources":["../lib/errors.ts"],"names":[],"mappings":";;;;;;;AAQA,IAAM,YAAA,GAAe,kCAAA;AACrB,IAAM,WAAA,GAAc,8BAAA;AACpB,IAAM,iBAAA,GAAoB,GAAA;AAC1B,IAAM,YAAA,GAAe,EAAA,GAAK,EAAA,GAAK,EAAA,GAAK,EAAA,GAAK,GAAA;AAEzC,SAAS,cAAc,KAAA,EAAwB;AAC7C,EAAA,IAAI,KAAA,YAAiB,KAAA,EAAO,OAAO,KAAA,CAAM,KAAA,IAAS,GAAG,KAAA,CAAM,IAAI,CAAA,EAAA,EAAK,KAAA,CAAM,OAAO,CAAA,CAAA;AACjF,EAAA,IAAI;AACF,IAAA,OAAO,IAAA,CAAK,SAAA,CAAU,KAAA,EAAO,IAAA,EAAM,CAAC,CAAA;AAAA,EACtC,CAAA,CAAA,OAAQ,CAAA,EAAA;AACN,IAAA,OAAO,OAAO,KAAK,CAAA;AAAA,EACrB;AACF;AAIA,SAAS,WAAA,CAAY,GAAA,EAAa,OAAA,EAAiB,KAAA,EAAgB;AACjE,EAAA,MAAM,OAAO,YAAY;AACvB,IAAA,IAAI;AACF,MAAA,MAAM,EAAA,CAAG,MAAA,CAAO,SAAS,CAAA,CAAE,MAAA,CAAO;AAAA,QAChC,GAAA;AAAA,QACA,OAAA;AAAA,QACA,QAAQ,aAAA,CAAc,KAAK,CAAA,CAAE,KAAA,CAAM,GAAG,iBAAiB;AAAA,OACxD,CAAA;AAED,MAAA,MAAM,EAAA,CAAG,MAAA,CAAO,SAAS,CAAA,CAAE,MAAM,EAAA,CAAG,SAAA,CAAU,SAAA,EAAW,IAAI,KAAK,IAAA,CAAK,GAAA,EAAI,GAAI,YAAY,CAAC,CAAC,CAAA;AAAA,IAC/F,SAAS,UAAA,EAAY;AACnB,MAAA,OAAA,CAAQ,KAAA,CAAM,CAAA,WAAA,EAAc,GAAG,CAAA,8BAAA,CAAA,EAAkC,UAAU,CAAA;AAAA,IAC7E;AAAA,EACF,CAAA;AACA,EAAA,IAAI;AACF,IAAA,KAAA,CAAM,IAAI,CAAA;AAAA,EACZ,CAAA,CAAA,OAAQ,CAAA,EAAA;AACN,IAAA,KAAK,IAAA,EAAK;AAAA,EACZ;AACF;AAGA,eAAsB,kBAAkB,IAAA,EAAsC;AA9C9E,EAAA,IAAA,EAAA,EAAA,EAAA;AA+CE,EAAA,MAAM,GAAA,GAAA,CAAM,EAAA,GAAA,IAAA,CAAK,KAAA,CAAM,WAAW,MAAtB,IAAA,GAAA,MAAA,GAAA,EAAA,CAA0B,CAAA,CAAA;AACtC,EAAA,IAAI,CAAC,KAAK,OAAO,IAAA;AACjB,EAAA,MAAM,CAAC,GAAG,CAAA,GAAI,MAAM,GACjB,MAAA,CAAO,EAAE,MAAA,EAAQ,SAAA,CAAU,MAAA,EAAQ,EACnC,IAAA,CAAK,SAAS,CAAA,CACd,KAAA,CAAM,EAAA,CAAG,SAAA,CAAU,KAAK,GAAG,CAAC,CAAA,CAC5B,KAAA,CAAM,CAAC,CAAA;AACV,EAAA,OAAA,CAAO,EAAA,GAAA,GAAA,IAAA,IAAA,GAAA,MAAA,GAAA,GAAA,CAAK,WAAL,IAAA,GAAA,EAAA,GAAe,IAAA;AACxB;AASO,SAAS,sBAAA,CACd,KAAA,EACA,OAAA,GAAU,yCAAA,EACF;AACR,EAAA,MAAM,GAAA,GAAM,KAAA,CAAM,IAAA,CAAK,WAAA,CAAY,CAAC,CAAA,EAAG,CAAC,CAAA,KAAM,YAAA,CAAa,IAAI,YAAA,CAAa,MAAM,CAAC,CAAA,CAAE,KAAK,EAAE,CAAA;AAC5F,EAAA,OAAA,CAAQ,MAAM,CAAA,WAAA,EAAc,GAAG,CAAA,EAAA,EAAK,OAAO,IAAI,KAAK,CAAA;AACpD,EAAA,WAAA,CAAY,GAAA,EAAK,SAAS,KAAK,CAAA;AAC/B,EAAA,OAAO,CAAA,EAAG,OAAO,CAAA,OAAA,EAAU,GAAG,CAAA,CAAA,CAAA;AAChC;AAQO,IAAM,WAAA,GAAN,cAA0B,KAAA,CAAM;AAAC;AAMxC,SAAS,4BAA4B,KAAA,EAAyB;AAC5D,EAAA,MAAM,SAAU,KAAA,IAAA,IAAA,GAAA,MAAA,GAAA,KAAA,CAAuC,MAAA;AACvD,EAAA,OACE,OAAO,WAAW,QAAA,KACjB,MAAA,CAAO,WAAW,eAAe,CAAA,IAAK,MAAA,CAAO,UAAA,CAAW,0BAA0B,CAAA,CAAA;AAEvF;AAGO,SAAS,iBACd,MAAA,EAC6C;AAC7C,EAAA,OAAO,UAAU,IAAA,KAAyC;AACxD,IAAA,IAAI;AACF,MAAA,OAAO,EAAE,IAAI,IAAA,EAAM,IAAA,EAAM,MAAM,MAAA,CAAO,GAAG,IAAI,CAAA,EAAE;AAAA,IACjD,SAAS,KAAA,EAAO;AACd,MAAA,IAAI,iBAAiB,WAAA,EAAa;AAChC,QAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,OAAA,EAAS,MAAM,OAAA,EAAQ;AAAA,MAC7C;AACA,MAAA,IAAI,2BAAA,CAA4B,KAAK,CAAA,EAAG;AACtC,QAAA,MAAM,KAAA;AAAA,MACR;AAGA,MAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,OAAA,EAAS,sBAAA,CAAuB,KAAK,CAAA,EAAE;AAAA,IAC7D;AAAA,EACF,CAAA;AACF","file":"chunk-KAEA35OC.mjs","sourcesContent":["import \"server-only\"\nimport { randomBytes } from \"node:crypto\"\nimport { after } from \"next/server\"\nimport { eq, lt } from \"drizzle-orm\"\nimport { db } from \"../server/db\"\nimport { errorRefs } from \"../server/db/schema\"\n\n// No 0/O/1/I so a user can read a ref back without mix-ups.\nconst REF_ALPHABET = \"23456789ABCDEFGHJKLMNPQRSTUVWXYZ\"\nconst REF_PATTERN = /\\(ref: ([2-9A-HJ-NP-Z]{6})\\)/\nconst DETAIL_MAX_LENGTH = 8000\nconst RETENTION_MS = 30 * 24 * 60 * 60 * 1000\n\nfunction describeError(error: unknown): string {\n  if (error instanceof Error) return error.stack || `${error.name}: ${error.message}`\n  try {\n    return JSON.stringify(error, null, 2)\n  } catch {\n    return String(error)\n  }\n}\n\n// Saves the detail so a later feedback report can carry it. Runs after the\n// response when inside a request (after()), and never fails the caller.\nfunction storeDetail(ref: string, message: string, error: unknown) {\n  const save = async () => {\n    try {\n      await db.insert(errorRefs).values({\n        ref,\n        message,\n        detail: describeError(error).slice(0, DETAIL_MAX_LENGTH),\n      })\n      // ponytail: prune on insert; a scheduled cleanup if error volume ever gets high.\n      await db.delete(errorRefs).where(lt(errorRefs.createdAt, new Date(Date.now() - RETENTION_MS)))\n    } catch (storeError) {\n      console.error(`[error ref ${ref}] could not store error detail`, storeError)\n    }\n  }\n  try {\n    after(save)\n  } catch {\n    void save() // outside a request scope (e.g. a script)\n  }\n}\n\n/** The stored technical detail for the ref inside a user-facing error message, if any. */\nexport async function lookupErrorDetail(text: string): Promise<string | null> {\n  const ref = text.match(REF_PATTERN)?.[1]\n  if (!ref) return null\n  const [row] = await db\n    .select({ detail: errorRefs.detail })\n    .from(errorRefs)\n    .where(eq(errorRefs.ref, ref))\n    .limit(1)\n  return row?.detail ?? null\n}\n\n/**\n * Logs an unexpected error under a short reference and returns the message to\n * show instead, e.g. \"Failed to update role (ref: K7Q2PX)\". The user, and any\n * feedback report they send, only ever get the ref. The error itself goes to\n * the server log (\"error ref K7Q2PX\") and the error_refs table, from which the\n * feedback route attaches it to reports sent to Discord/email.\n */\nexport function unexpectedErrorMessage(\n  error: unknown,\n  message = \"Something went wrong. Please try again.\"\n): string {\n  const ref = Array.from(randomBytes(6), (b) => REF_ALPHABET[b % REF_ALPHABET.length]).join(\"\")\n  console.error(`[error ref ${ref}] ${message}`, error)\n  storeDetail(ref, message, error)\n  return `${message} (ref: ${ref})`\n}\n\n/**\n * Throw this for messages that are safe to show to the end user (validation,\n * permission, and state-conflict errors). Anything else thrown inside a\n * `withActionErrors`-wrapped action is logged server-side and replaced with a\n * generic message carrying an error ref.\n */\nexport class ActionError extends Error {}\n\nexport type ActionResult<T> =\n  | { ok: true; data: T }\n  | { ok: false; message: string }\n\nfunction isFrameworkControlFlowError(error: unknown): boolean {\n  const digest = (error as { digest?: unknown } | null)?.digest\n  return (\n    typeof digest === \"string\" &&\n    (digest.startsWith(\"NEXT_REDIRECT\") || digest.startsWith(\"NEXT_HTTP_ERROR_FALLBACK\"))\n  )\n}\n\n/** Wraps a server action so it returns an ActionResult instead of throwing. */\nexport function withActionErrors<Args extends unknown[], T>(\n  action: (...args: Args) => Promise<T>\n): (...args: Args) => Promise<ActionResult<T>> {\n  return async (...args: Args): Promise<ActionResult<T>> => {\n    try {\n      return { ok: true, data: await action(...args) }\n    } catch (error) {\n      if (error instanceof ActionError) {\n        return { ok: false, message: error.message }\n      }\n      if (isFrameworkControlFlowError(error)) {\n        throw error\n      }\n      // Returned, not thrown: Next.js replaces thrown server-action messages\n      // in production, which would drop the ref.\n      return { ok: false, message: unexpectedErrorMessage(error) }\n    }\n  }\n}\n"]}
+{"version":3,"sources":["../lib/errors.ts"],"names":[],"mappings":";;;;;;;AAQA,IAAM,YAAA,GAAe,kCAAA;AACrB,IAAM,WAAA,GAAc,8BAAA;AACpB,IAAM,iBAAA,GAAoB,GAAA;AAC1B,IAAM,YAAA,GAAe,EAAA,GAAK,EAAA,GAAK,EAAA,GAAK,EAAA,GAAK,GAAA;AAEzC,SAAS,cAAc,KAAA,EAAwB;AAC7C,EAAA,IAAI,KAAA,YAAiB,KAAA,EAAO,OAAO,KAAA,CAAM,KAAA,IAAS,GAAG,KAAA,CAAM,IAAI,CAAA,EAAA,EAAK,KAAA,CAAM,OAAO,CAAA,CAAA;AACjF,EAAA,IAAI;AACF,IAAA,OAAO,IAAA,CAAK,SAAA,CAAU,KAAA,EAAO,IAAA,EAAM,CAAC,CAAA;AAAA,EACtC,CAAA,CAAA,OAAQ,CAAA,EAAA;AACN,IAAA,OAAO,OAAO,KAAK,CAAA;AAAA,EACrB;AACF;AAIA,SAAS,WAAA,CAAY,GAAA,EAAa,OAAA,EAAiB,KAAA,EAAgB;AACjE,EAAA,MAAM,OAAO,YAAY;AACvB,IAAA,IAAI;AACF,MAAA,MAAM,EAAA,CAAG,MAAA,CAAO,SAAS,CAAA,CAAE,MAAA,CAAO;AAAA,QAChC,GAAA;AAAA,QACA,OAAA;AAAA,QACA,QAAQ,aAAA,CAAc,KAAK,CAAA,CAAE,KAAA,CAAM,GAAG,iBAAiB;AAAA,OACxD,CAAA;AAED,MAAA,MAAM,EAAA,CAAG,MAAA,CAAO,SAAS,CAAA,CAAE,MAAM,EAAA,CAAG,SAAA,CAAU,SAAA,EAAW,IAAI,KAAK,IAAA,CAAK,GAAA,EAAI,GAAI,YAAY,CAAC,CAAC,CAAA;AAAA,IAC/F,SAAS,UAAA,EAAY;AACnB,MAAA,OAAA,CAAQ,KAAA,CAAM,CAAA,WAAA,EAAc,GAAG,CAAA,8BAAA,CAAA,EAAkC,UAAU,CAAA;AAAA,IAC7E;AAAA,EACF,CAAA;AACA,EAAA,IAAI;AACF,IAAA,KAAA,CAAM,IAAI,CAAA;AAAA,EACZ,CAAA,CAAA,OAAQ,CAAA,EAAA;AACN,IAAA,KAAK,IAAA,EAAK;AAAA,EACZ;AACF;AAGA,eAAsB,kBAAkB,IAAA,EAAsC;AA9C9E,EAAA,IAAA,EAAA,EAAA,EAAA;AA+CE,EAAA,MAAM,GAAA,GAAA,CAAM,EAAA,GAAA,IAAA,CAAK,KAAA,CAAM,WAAW,MAAtB,IAAA,GAAA,MAAA,GAAA,EAAA,CAA0B,CAAA,CAAA;AACtC,EAAA,IAAI,CAAC,KAAK,OAAO,IAAA;AACjB,EAAA,MAAM,CAAC,GAAG,CAAA,GAAI,MAAM,GACjB,MAAA,CAAO,EAAE,MAAA,EAAQ,SAAA,CAAU,MAAA,EAAQ,EACnC,IAAA,CAAK,SAAS,CAAA,CACd,KAAA,CAAM,EAAA,CAAG,SAAA,CAAU,KAAK,GAAG,CAAC,CAAA,CAC5B,KAAA,CAAM,CAAC,CAAA;AACV,EAAA,OAAA,CAAO,EAAA,GAAA,GAAA,IAAA,IAAA,GAAA,MAAA,GAAA,GAAA,CAAK,WAAL,IAAA,GAAA,EAAA,GAAe,IAAA;AACxB;AASO,SAAS,sBAAA,CACd,KAAA,EACA,OAAA,GAAU,yCAAA,EACF;AACR,EAAA,MAAM,GAAA,GAAM,KAAA,CAAM,IAAA,CAAK,WAAA,CAAY,CAAC,CAAA,EAAG,CAAC,CAAA,KAAM,YAAA,CAAa,IAAI,YAAA,CAAa,MAAM,CAAC,CAAA,CAAE,KAAK,EAAE,CAAA;AAC5F,EAAA,OAAA,CAAQ,MAAM,CAAA,WAAA,EAAc,GAAG,CAAA,EAAA,EAAK,OAAO,IAAI,KAAK,CAAA;AACpD,EAAA,WAAA,CAAY,GAAA,EAAK,SAAS,KAAK,CAAA;AAC/B,EAAA,OAAO,CAAA,EAAG,OAAO,CAAA,OAAA,EAAU,GAAG,CAAA,CAAA,CAAA;AAChC;AAQO,IAAM,WAAA,GAAN,cAA0B,KAAA,CAAM;AAAC;AAMxC,SAAS,4BAA4B,KAAA,EAAyB;AAC5D,EAAA,MAAM,SAAU,KAAA,IAAA,IAAA,GAAA,MAAA,GAAA,KAAA,CAAuC,MAAA;AACvD,EAAA,OACE,OAAO,WAAW,QAAA,KACjB,MAAA,CAAO,WAAW,eAAe,CAAA,IAAK,MAAA,CAAO,UAAA,CAAW,0BAA0B,CAAA,CAAA;AAEvF;AAGO,SAAS,iBACd,MAAA,EAC6C;AAC7C,EAAA,OAAO,UAAU,IAAA,KAAyC;AACxD,IAAA,IAAI;AACF,MAAA,OAAO,EAAE,IAAI,IAAA,EAAM,IAAA,EAAM,MAAM,MAAA,CAAO,GAAG,IAAI,CAAA,EAAE;AAAA,IACjD,SAAS,KAAA,EAAO;AACd,MAAA,IAAI,iBAAiB,WAAA,EAAa;AAChC,QAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,OAAA,EAAS,MAAM,OAAA,EAAQ;AAAA,MAC7C;AACA,MAAA,IAAI,2BAAA,CAA4B,KAAK,CAAA,EAAG;AACtC,QAAA,MAAM,KAAA;AAAA,MACR;AAGA,MAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,OAAA,EAAS,sBAAA,CAAuB,KAAK,CAAA,EAAE;AAAA,IAC7D;AAAA,EACF,CAAA;AACF","file":"chunk-6MDQRT6U.mjs","sourcesContent":["import \"server-only\"\nimport { randomBytes } from \"node:crypto\"\nimport { after } from \"next/server\"\nimport { eq, lt } from \"drizzle-orm\"\nimport { db } from \"../server/db\"\nimport { errorRefs } from \"../server/db/schema\"\n\n// No 0/O/1/I so a user can read a ref back without mix-ups.\nconst REF_ALPHABET = \"23456789ABCDEFGHJKLMNPQRSTUVWXYZ\"\nconst REF_PATTERN = /\\(ref: ([2-9A-HJ-NP-Z]{6})\\)/\nconst DETAIL_MAX_LENGTH = 8000\nconst RETENTION_MS = 30 * 24 * 60 * 60 * 1000\n\nfunction describeError(error: unknown): string {\n  if (error instanceof Error) return error.stack || `${error.name}: ${error.message}`\n  try {\n    return JSON.stringify(error, null, 2)\n  } catch {\n    return String(error)\n  }\n}\n\n// Saves the detail so a later feedback report can carry it. Runs after the\n// response when inside a request (after()), and never fails the caller.\nfunction storeDetail(ref: string, message: string, error: unknown) {\n  const save = async () => {\n    try {\n      await db.insert(errorRefs).values({\n        ref,\n        message,\n        detail: describeError(error).slice(0, DETAIL_MAX_LENGTH),\n      })\n      // ponytail: prune on insert; a scheduled cleanup if error volume ever gets high.\n      await db.delete(errorRefs).where(lt(errorRefs.createdAt, new Date(Date.now() - RETENTION_MS)))\n    } catch (storeError) {\n      console.error(`[error ref ${ref}] could not store error detail`, storeError)\n    }\n  }\n  try {\n    after(save)\n  } catch {\n    void save() // outside a request scope (e.g. a script)\n  }\n}\n\n/** The stored technical detail for the ref inside a user-facing error message, if any. */\nexport async function lookupErrorDetail(text: string): Promise<string | null> {\n  const ref = text.match(REF_PATTERN)?.[1]\n  if (!ref) return null\n  const [row] = await db\n    .select({ detail: errorRefs.detail })\n    .from(errorRefs)\n    .where(eq(errorRefs.ref, ref))\n    .limit(1)\n  return row?.detail ?? null\n}\n\n/**\n * Logs an unexpected error under a short reference and returns the message to\n * show instead, e.g. \"Failed to update role (ref: K7Q2PX)\". The user, and any\n * feedback report they send, only ever get the ref. The error itself goes to\n * the server log (\"error ref K7Q2PX\") and the error_refs table, from which the\n * feedback route attaches it to reports sent to Discord/email.\n */\nexport function unexpectedErrorMessage(\n  error: unknown,\n  message = \"Something went wrong. Please try again.\"\n): string {\n  const ref = Array.from(randomBytes(6), (b) => REF_ALPHABET[b % REF_ALPHABET.length]).join(\"\")\n  console.error(`[error ref ${ref}] ${message}`, error)\n  storeDetail(ref, message, error)\n  return `${message} (ref: ${ref})`\n}\n\n/**\n * Throw this for messages that are safe to show to the end user (validation,\n * permission, and state-conflict errors). Anything else thrown inside a\n * `withActionErrors`-wrapped action is logged server-side and replaced with a\n * generic message carrying an error ref.\n */\nexport class ActionError extends Error {}\n\nexport type ActionResult<T> =\n  | { ok: true; data: T }\n  | { ok: false; message: string }\n\nfunction isFrameworkControlFlowError(error: unknown): boolean {\n  const digest = (error as { digest?: unknown } | null)?.digest\n  return (\n    typeof digest === \"string\" &&\n    (digest.startsWith(\"NEXT_REDIRECT\") || digest.startsWith(\"NEXT_HTTP_ERROR_FALLBACK\"))\n  )\n}\n\n/** Wraps a server action so it returns an ActionResult instead of throwing. */\nexport function withActionErrors<Args extends unknown[], T>(\n  action: (...args: Args) => Promise<T>\n): (...args: Args) => Promise<ActionResult<T>> {\n  return async (...args: Args): Promise<ActionResult<T>> => {\n    try {\n      return { ok: true, data: await action(...args) }\n    } catch (error) {\n      if (error instanceof ActionError) {\n        return { ok: false, message: error.message }\n      }\n      if (isFrameworkControlFlowError(error)) {\n        throw error\n      }\n      // Returned, not thrown: Next.js replaces thrown server-action messages\n      // in production, which would drop the ref.\n      return { ok: false, message: unexpectedErrorMessage(error) }\n    }\n  }\n}\n"]}

package/dist/{chunk-N6ECRCHY.mjs → chunk-6OAHCEDJ.mjs}

@@ -50,12 +50,13 @@ function formatLocation({ country, city }) {
 var WINDOW_MS = 15 * 60 * 1e3;
 var MAX = 10;
 var MAX_IP = MAX * 3;
+var RETENTION_MS = 30 * 24 * 60 * 60 * 1e3;
 function isOverLimit(row, now, max = MAX) {
   if (!row) return false;
   if (now - row.windowStart.getTime() >= WINDOW_MS) return false;
   return row.count >= max;
 }
 
-export { MAX_IP, WINDOW_MS, formatDeviceInfo, formatLocation, getClientIp, isOverLimit, lookupGeoLocation, parseUserAgent };
-//# sourceMappingURL=chunk-N6ECRCHY.mjs.map
-//# sourceMappingURL=chunk-N6ECRCHY.mjs.map
+export { MAX_IP, RETENTION_MS, WINDOW_MS, formatDeviceInfo, formatLocation, getClientIp, isOverLimit, lookupGeoLocation, parseUserAgent };
+//# sourceMappingURL=chunk-6OAHCEDJ.mjs.map
+//# sourceMappingURL=chunk-6OAHCEDJ.mjs.map

package/dist/chunk-6OAHCEDJ.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../lib/request-info.ts","../lib/auth-throttle-limits.ts"],"names":[],"mappings":";;;;;AAIA,IAAM,YAAA,GAAe,IAAI,IAAA,CAAK,YAAA,CAAa,CAAC,IAAI,CAAA,EAAG,EAAE,IAAA,EAAM,QAAA,EAAU,CAAA;AAmB9D,SAAS,YAAY,OAAA,EAAoD;AAvBhF,EAAA,IAAA,EAAA;AAwBE,EAAA,MAAM,YAAA,GAAe,mCAAS,GAAA,CAAI,iBAAA,CAAA;AAClC,EAAA,IAAI,YAAA,SAAqB,YAAA,CAAa,KAAA,CAAM,GAAG,CAAA,CAAE,CAAC,EAAE,IAAA,EAAK;AAEzD,EAAA,OAAA,CAAO,EAAA,GAAA,OAAA,IAAA,IAAA,GAAA,MAAA,GAAA,OAAA,CAAS,GAAA,CAAI,WAAA,CAAA,KAAb,IAAA,GAAA,EAAA,GAA6B,IAAA;AACtC;AAEO,SAAS,eAAe,SAAA,EAAkD;AA9BjF,EAAA,IAAA,EAAA;AA+BE,EAAA,IAAI,CAAC,SAAA,EAAW;AACd,IAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,OAAA,EAAS,IAAA,EAAM,YAAY,SAAA,EAAU;AAAA,EAC1D;AAEA,EAAA,MAAM,EAAE,IAAI,OAAA,EAAS,MAAA,KAAW,IAAI,QAAA,CAAS,SAAS,CAAA,CAAE,SAAA,EAAU;AAElE,EAAA,OAAO;AAAA,IACL,EAAA,EAAI,EAAA,CAAG,IAAA,GAAO,CAAC,GAAG,IAAA,EAAM,EAAA,CAAG,OAAO,CAAA,CAAE,MAAA,CAAO,OAAO,CAAA,CAAE,IAAA,CAAK,GAAG,CAAA,GAAI,IAAA;AAAA,IAChE,OAAA,EAAA,CAAS,EAAA,GAAA,OAAA,CAAQ,IAAA,KAAR,IAAA,GAAA,EAAA,GAAgB,IAAA;AAAA,IACzB,UAAA,EAAY,OAAO,IAAA,KAAS,QAAA,IAAY,OAAO,IAAA,KAAS,QAAA,GAAW,OAAO,IAAA,GAAO;AAAA,GACnF;AACF;AAMO,SAAS,kBAAkB,SAAA,EAA+C;AAhDjF,EAAA,IAAA,EAAA;AAiDE,EAAA,IAAI,CAAC,SAAA,EAAW,OAAO,EAAE,OAAA,EAAS,IAAA,EAAM,MAAM,IAAA,EAAK;AAEnD,EAAA,MAAM,GAAA,GAAM,KAAA,CAAM,MAAA,CAAO,SAAS,CAAA;AAClC,EAAA,IAAI,CAAC,GAAA,EAAK,OAAO,EAAE,OAAA,EAAS,IAAA,EAAM,MAAM,IAAA,EAAK;AAE7C,EAAA,IAAI,OAAA,GAAyB,IAAI,OAAA,IAAW,IAAA;AAC5C,EAAA,IAAI,OAAA,EAAS;AACX,IAAA,IAAI;AACF,MAAA,OAAA,GAAA,CAAU,EAAA,GAAA,YAAA,CAAa,EAAA,CAAG,OAAO,CAAA,KAAvB,IAAA,GAAA,EAAA,GAA4B,OAAA;AAAA,IACxC,CAAA,CAAA,OAAQ,CAAA,EAAA;AAAA,IAER;AAAA,EACF;AAEA,EAAA,OAAO,EAAE,OAAA,EAAS,IAAA,EAAM,GAAA,CAAI,QAAQ,IAAA,EAAK;AAC3C;AAEO,SAAS,gBAAA,CAAiB,EAAE,EAAA,EAAI,OAAA,EAAS,YAAW,EAAuB;AAChF,EAAA,MAAM,KAAA,GAAQ,CAAC,OAAA,EAAS,EAAE,EAAE,MAAA,CAAO,OAAO,CAAA,CAAE,IAAA,CAAK,MAAM,CAAA;AACvD,EAAA,MAAM,YAAY,UAAA,KAAe,QAAA,GAAW,QAAA,GAAW,UAAA,KAAe,WAAW,QAAA,GAAW,SAAA;AAE5F,EAAA,OAAO,QAAQ,CAAA,EAAG,KAAK,SAAM,SAAS,CAAA,CAAA,GAAK,uBAAoB,SAAS,CAAA,CAAA;AAC1E;AAEO,SAAS,cAAA,CAAe,EAAE,OAAA,EAAS,IAAA,EAAK,EAAoB;AACjE,EAAA,IAAI,CAAC,OAAA,IAAW,CAAC,IAAA,EAAM,OAAO,SAAA;AAE9B,EAAA,OAAO,CAAC,MAAM,OAAO,CAAA,CAAE,OAAO,OAAO,CAAA,CAAE,KAAK,IAAI,CAAA;AAClD;;;ACzEO,IAAM,SAAA,GAAY,KAAK,EAAA,GAAK;AAC5B,IAAM,GAAA,GAAM,EAAA;AAQZ,IAAM,SAAS,GAAA,GAAM;AAKrB,IAAM,YAAA,GAAe,EAAA,GAAK,EAAA,GAAK,EAAA,GAAK,EAAA,GAAK;AAKzC,SAAS,WAAA,CACd,GAAA,EACA,GAAA,EACA,GAAA,GAAc,GAAA,EACL;AACT,EAAA,IAAI,CAAC,KAAK,OAAO,KAAA;AACjB,EAAA,IAAI,MAAM,GAAA,CAAI,WAAA,CAAY,OAAA,EAAQ,IAAK,WAAW,OAAO,KAAA;AACzD,EAAA,OAAO,IAAI,KAAA,IAAS,GAAA;AACtB","file":"chunk-6OAHCEDJ.mjs","sourcesContent":["import \"server-only\"\nimport { UAParser } from \"ua-parser-js\"\nimport geoip from \"geoip-lite\"\n\nconst countryNames = new Intl.DisplayNames([\"en\"], { type: \"region\" })\n\nexport type DeviceType = \"desktop\" | \"mobile\" | \"tablet\"\n\nexport interface DeviceInfo {\n  os: string | null\n  browser: string | null\n  deviceType: DeviceType\n}\n\nexport interface GeoInfo {\n  country: string | null\n  city: string | null\n}\n\n/**\n * First address in X-Forwarded-For is the original client — everything after\n * is intermediate proxies. Falls back to null (e.g. local dev with no proxy).\n */\nexport function getClientIp(headers: Headers | undefined | null): string | null {\n  const forwardedFor = headers?.get(\"x-forwarded-for\")\n  if (forwardedFor) return forwardedFor.split(\",\")[0].trim()\n\n  return headers?.get(\"x-real-ip\") ?? null\n}\n\nexport function parseUserAgent(userAgent: string | null | undefined): DeviceInfo {\n  if (!userAgent) {\n    return { os: null, browser: null, deviceType: \"desktop\" }\n  }\n\n  const { os, browser, device } = new UAParser(userAgent).getResult()\n\n  return {\n    os: os.name ? [os.name, os.version].filter(Boolean).join(\" \") : null,\n    browser: browser.name ?? null,\n    deviceType: device.type === \"mobile\" || device.type === \"tablet\" ? device.type : \"desktop\",\n  }\n}\n\n/**\n * Offline lookup (geoip-lite ships its own IP-range database, no network\n * call) — resolves to nulls for private/local addresses like 127.0.0.1.\n */\nexport function lookupGeoLocation(ipAddress: string | null | undefined): GeoInfo {\n  if (!ipAddress) return { country: null, city: null }\n\n  const geo = geoip.lookup(ipAddress)\n  if (!geo) return { country: null, city: null }\n\n  let country: string | null = geo.country || null\n  if (country) {\n    try {\n      country = countryNames.of(country) ?? country\n    } catch {\n      // Unrecognized region code — keep the raw code rather than losing it.\n    }\n  }\n\n  return { country, city: geo.city || null }\n}\n\nexport function formatDeviceInfo({ os, browser, deviceType }: DeviceInfo): string {\n  const label = [browser, os].filter(Boolean).join(\" on \")\n  const typeLabel = deviceType === \"mobile\" ? \"Mobile\" : deviceType === \"tablet\" ? \"Tablet\" : \"Desktop\"\n\n  return label ? `${label} · ${typeLabel}` : `Unknown device · ${typeLabel}`\n}\n\nexport function formatLocation({ country, city }: GeoInfo): string {\n  if (!country && !city) return \"Unknown\"\n\n  return [city, country].filter(Boolean).join(\", \")\n}\n","// Pure throttle policy — no DB, no `server-only`, so it stays unit-testable.\n// Consumed by lib/auth-throttle.ts (the DB plumbing) and its test.\n\n// Tune per deployment, or lift to env vars if you need it configurable.\nexport const WINDOW_MS = 15 * 60 * 1000 // how long attempts accumulate\nexport const MAX = 10 // failed sign-ins / sign-ups per window before a 429, per fingerprint\n\n// Backstop cap keyed by IP instead of fingerprint — the fingerprint header is\n// client-supplied and unsigned, so it's trivial to omit or randomize per\n// request (see server/auth.ts before-hook). Higher than MAX because an IP can\n// be shared behind NAT/CGNAT/VPN.\n// ponytail: flat multiplier, not a real per-deployment tuning — revisit if\n// legitimate shared-IP traffic ever gets caught in it.\nexport const MAX_IP = MAX * 3\n\n// Rows untouched this long are deleted (lib/auth-throttle.ts). They hold IP,\n// user agent and the last email typed — often for people with no account — so\n// GDPR storage limitation says don't keep them past their use.\nexport const RETENTION_MS = 30 * 24 * 60 * 60 * 1000\n\n// A row whose window has already elapsed counts as \"no row\" — it resets on\n// the next attempt (see recordDeviceAttempt), so the device isn't blocked in\n// the meantime.\nexport function isOverLimit(\n  row: { count: number; windowStart: Date } | undefined,\n  now: number,\n  max: number = MAX,\n): boolean {\n  if (!row) return false\n  if (now - row.windowStart.getTime() >= WINDOW_MS) return false\n  return row.count >= max\n}\n"]}

package/dist/chunk-6Z3WUSDJ.mjs

@@ -0,0 +1,62 @@
+import { auth } from './chunk-7QVIOQ47.mjs';
+import { db } from './chunk-ZJMFE5B2.mjs';
+import { users } from './chunk-TR5XFBTD.mjs';
+import 'server-only';
+import { cache } from 'react';
+import { headers } from 'next/headers';
+import { redirect } from 'next/navigation';
+import { eq } from 'drizzle-orm';
+
+var getCurrentSession = cache(async () => {
+  const session = await auth.api.getSession({
+    headers: await headers()
+  });
+  return session;
+});
+var requireAuth = cache(async () => {
+  var _a;
+  const session = await getCurrentSession();
+  if (!(session == null ? void 0 : session.user)) {
+    redirect("/login");
+  }
+  const user = await db.select().from(users).where(eq(users.id, session.user.id)).limit(1);
+  if ((_a = user[0]) == null ? void 0 : _a.banned) {
+    await auth.api.signOut({
+      headers: await headers()
+    });
+    redirect("/login?error=account_banned");
+  }
+  return session;
+});
+function hasRole(userRole, requiredRole) {
+  if (!userRole) return false;
+  if (requiredRole === "admin") {
+    return userRole === "admin";
+  }
+  return userRole === "user" || userRole === "admin" || userRole === "tester";
+}
+async function requireRole(requiredRole) {
+  const session = await requireAuth();
+  if (!hasRole(session.user.role, requiredRole)) {
+    redirect("/dashboard");
+  }
+  return session;
+}
+function normalizeCallbackUrl(value) {
+  if (typeof value !== "string" || !value.trim()) return "/dashboard";
+  const candidate = value.trim();
+  try {
+    const appOrigin = new URL(process.env.NEXT_PUBLIC_APP_URL || process.env.BETTER_AUTH_URL || "http://localhost:3000").origin;
+    const callbackUrl = new URL(candidate, appOrigin);
+    if (callbackUrl.origin !== appOrigin) {
+      return "/dashboard";
+    }
+    return `${callbackUrl.pathname}${callbackUrl.search}${callbackUrl.hash}` || "/dashboard";
+  } catch (e) {
+    return "/dashboard";
+  }
+}
+
+export { getCurrentSession, hasRole, normalizeCallbackUrl, requireAuth, requireRole };
+//# sourceMappingURL=chunk-6Z3WUSDJ.mjs.map
+//# sourceMappingURL=chunk-6Z3WUSDJ.mjs.map

package/dist/chunk-6Z3WUSDJ.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../lib/auth-helpers.ts"],"names":[],"mappings":";;;;;;;;;AAgBO,IAAM,iBAAA,GAAoB,MAAM,YAAY;AACjD,EAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,GAAA,CAAI,UAAA,CAAW;AAAA,IACxC,OAAA,EAAS,MAAM,OAAA;AAAQ,GACxB,CAAA;AAED,EAAA,OAAO,OAAA;AACT,CAAC;AASM,IAAM,WAAA,GAAc,MAAM,YAAY;AA/B7C,EAAA,IAAA,EAAA;AAgCE,EAAA,MAAM,OAAA,GAAU,MAAM,iBAAA,EAAkB;AAExC,EAAA,IAAI,EAAC,mCAAS,IAAA,CAAA,EAAM;AAClB,IAAA,QAAA,CAAS,QAAQ,CAAA;AAAA,EACnB;AAGA,EAAA,MAAM,OAAO,MAAM,EAAA,CAChB,QAAO,CACP,IAAA,CAAK,KAAK,CAAA,CACV,KAAA,CAAM,EAAA,CAAG,KAAA,CAAM,IAAI,OAAA,CAAQ,IAAA,CAAK,EAAE,CAAC,CAAA,CACnC,MAAM,CAAC,CAAA;AAEV,EAAA,IAAA,CAAI,EAAA,GAAA,IAAA,CAAK,CAAC,CAAA,KAAN,IAAA,GAAA,MAAA,GAAA,EAAA,CAAS,MAAA,EAAQ;AAEnB,IAAA,MAAM,IAAA,CAAK,IAAI,OAAA,CAAQ;AAAA,MACrB,OAAA,EAAS,MAAM,OAAA;AAAQ,KACxB,CAAA;AACD,IAAA,QAAA,CAAS,6BAA6B,CAAA;AAAA,EACxC;AAEA,EAAA,OAAO,OAAA;AACT,CAAC;AAKM,SAAS,OAAA,CAAQ,UAAqC,YAAA,EAAyC;AACpG,EAAA,IAAI,CAAC,UAAU,OAAO,KAAA;AAEtB,EAAA,IAAI,iBAAiB,OAAA,EAAS;AAC5B,IAAA,OAAO,QAAA,KAAa,OAAA;AAAA,EACtB;AAGA,EAAA,OAAO,QAAA,KAAa,MAAA,IAAU,QAAA,KAAa,OAAA,IAAW,QAAA,KAAa,QAAA;AACrE;AAKA,eAAsB,YAAY,YAAA,EAAgC;AAChE,EAAA,MAAM,OAAA,GAAU,MAAM,WAAA,EAAY;AAElC,EAAA,IAAI,CAAC,OAAA,CAAQ,OAAA,CAAQ,IAAA,CAAK,IAAA,EAAM,YAAY,CAAA,EAAG;AAC7C,IAAA,QAAA,CAAS,YAAY,CAAA;AAAA,EACvB;AAEA,EAAA,OAAO,OAAA;AACT;AAQO,SAAS,qBAAqB,KAAA,EAAmC;AACtE,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,CAAC,KAAA,CAAM,IAAA,IAAQ,OAAO,YAAA;AAEvD,EAAA,MAAM,SAAA,GAAY,MAAM,IAAA,EAAK;AAE7B,EAAA,IAAI;AACF,IAAA,MAAM,SAAA,GAAY,IAAI,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,uBAAuB,OAAA,CAAQ,GAAA,CAAI,eAAA,IAAmB,uBAAuB,CAAA,CAAE,MAAA;AACrH,IAAA,MAAM,WAAA,GAAc,IAAI,GAAA,CAAI,SAAA,EAAW,SAAS,CAAA;AAEhD,IAAA,IAAI,WAAA,CAAY,WAAW,SAAA,EAAW;AACpC,MAAA,OAAO,YAAA;AAAA,IACT;AAEA,IAAA,OAAO,CAAA,EAAG,YAAY,QAAQ,CAAA,EAAG,YAAY,MAAM,CAAA,EAAG,WAAA,CAAY,IAAI,CAAA,CAAA,IAAM,YAAA;AAAA,EAC9E,CAAA,CAAA,OAAQ,CAAA,EAAA;AACN,IAAA,OAAO,YAAA;AAAA,EACT;AACF","file":"chunk-6Z3WUSDJ.mjs","sourcesContent":["import \"server-only\"\nimport { cache } from \"react\"\nimport { auth } from \"../server/auth\"\nimport { headers } from \"next/headers\"\nimport { redirect } from \"next/navigation\"\nimport { db } from \"../server/db\"\nimport { users } from \"../server/db/schema\"\nimport { eq } from \"drizzle-orm\"\n\n/**\n * Get current session (server-side only)\n * Returns session data or null if not authenticated\n *\n * Wrapped in React's cache() so the layout and page (both of which call\n * requireAuth per request) share one auth.api.getSession call instead of two.\n */\nexport const getCurrentSession = cache(async () => {\n  const session = await auth.api.getSession({\n    headers: await headers()\n  })\n\n  return session\n})\n\n/**\n * Require authentication - redirect to login if not authenticated\n * Use in server components/layouts that need protection\n *\n * Wrapped in cache() so the layout, page, and any admin layout that all call\n * requireAuth per request share one banned-status DB lookup instead of several.\n */\nexport const requireAuth = cache(async () => {\n  const session = await getCurrentSession()\n\n  if (!session?.user) {\n    redirect('/login')\n  }\n\n  // Check if user is banned\n  const user = await db\n    .select()\n    .from(users)\n    .where(eq(users.id, session.user.id))\n    .limit(1)\n\n  if (user[0]?.banned) {\n    // Sign out the user\n    await auth.api.signOut({\n      headers: await headers()\n    })\n    redirect('/login?error=account_banned')\n  }\n\n  return session\n})\n\n/**\n * Check if user has specific role\n */\nexport function hasRole(userRole: string | null | undefined, requiredRole: 'user' | 'admin'): boolean {\n  if (!userRole) return false\n\n  if (requiredRole === 'admin') {\n    return userRole === 'admin'\n  }\n\n  // 'user' role check - every role ('user', 'admin', 'tester') has access\n  return userRole === 'user' || userRole === 'admin' || userRole === 'tester'\n}\n\n/**\n * Require specific role - throw error if user doesn't have it\n */\nexport async function requireRole(requiredRole: 'user' | 'admin') {\n  const session = await requireAuth()\n\n  if (!hasRole(session.user.role, requiredRole)) {\n    redirect('/dashboard')\n  }\n\n  return session\n}\n\n/**\n * Normalize a callbackUrl query param to a same-origin path before it's ever\n * passed to redirect() or an auth form's callbackURL. Guards against open\n * redirects (e.g. /login?callbackUrl=https://evil.com) — anything that\n * doesn't resolve to this app's own origin falls back to /dashboard.\n */\nexport function normalizeCallbackUrl(value?: string | string[]): string {\n  if (typeof value !== 'string' || !value.trim()) return '/dashboard'\n\n  const candidate = value.trim()\n\n  try {\n    const appOrigin = new URL(process.env.NEXT_PUBLIC_APP_URL || process.env.BETTER_AUTH_URL || 'http://localhost:3000').origin\n    const callbackUrl = new URL(candidate, appOrigin)\n\n    if (callbackUrl.origin !== appOrigin) {\n      return '/dashboard'\n    }\n\n    return `${callbackUrl.pathname}${callbackUrl.search}${callbackUrl.hash}` || '/dashboard'\n  } catch {\n    return '/dashboard'\n  }\n}\n\n"]}

package/dist/{chunk-VQ5B4MA7.mjs → chunk-7F2POZM6.mjs}

@@ -1,5 +1,5 @@
-import { db } from './chunk-WZDAMCUX.mjs';
-import { activityLogs } from './chunk-ZQCALTKB.mjs';
+import { db } from './chunk-ZJMFE5B2.mjs';
+import { activityLogs } from './chunk-TR5XFBTD.mjs';
 import 'server-only';
 
 async function logActivity({
@@ -37,5 +37,5 @@ async function logActivity({
 }
 
 export { logActivity };
-//# sourceMappingURL=chunk-VQ5B4MA7.mjs.map
-//# sourceMappingURL=chunk-VQ5B4MA7.mjs.map
+//# sourceMappingURL=chunk-7F2POZM6.mjs.map
+//# sourceMappingURL=chunk-7F2POZM6.mjs.map

package/dist/{chunk-VQ5B4MA7.mjs.map → chunk-7F2POZM6.mjs.map}

@@ -1 +1 @@
-{"version":3,"sources":["../lib/activity-logger.ts"],"names":[],"mappings":";;;;AAsCA,eAAsB,WAAA,CAAY;AAAA,EAChC,MAAA;AAAA,EACA,MAAA;AAAA,EACA,WAAA;AAAA,EACA,SAAA;AAAA,EACA,SAAA;AAAA,EACA,QAAA;AAAA,EACA,WAAA;AAAA,EACA,EAAA;AAAA,EACA,OAAA;AAAA,EACA,UAAA;AAAA,EACA,OAAA;AAAA,EACA;AACF,CAAA,EAAsB;AACpB,EAAA,IAAI;AACF,IAAA,MAAM,EAAA,CAAG,MAAA,CAAO,YAAY,CAAA,CAAE,MAAA,CAAO;AAAA,MACnC,MAAA;AAAA,MACA,MAAA;AAAA,MACA,WAAA;AAAA,MACA,WAAW,SAAA,IAAa,IAAA;AAAA,MACxB,WAAW,SAAA,IAAa,IAAA;AAAA,MACxB,QAAA,EAAU,QAAA,GAAW,IAAA,CAAK,SAAA,CAAU,QAAQ,CAAA,GAAI,IAAA;AAAA,MAChD,aAAa,WAAA,IAAe,IAAA;AAAA,MAC5B,IAAI,EAAA,IAAM,IAAA;AAAA,MACV,SAAS,OAAA,IAAW,IAAA;AAAA,MACpB,YAAY,UAAA,IAAc,IAAA;AAAA,MAC1B,SAAS,OAAA,IAAW,IAAA;AAAA,MACpB,MAAM,IAAA,IAAQ;AAAA,KACf,CAAA;AAAA,EACH,SAAS,KAAA,EAAO;AACd,IAAA,OAAA,CAAQ,KAAA,CAAM,2BAA2B,KAAK,CAAA;AAAA,EAEhD;AACF","file":"chunk-VQ5B4MA7.mjs","sourcesContent":["import \"server-only\"\nimport { db } from \"../server/db\"\nimport { activityLogs } from \"../server/db/schema\"\n\nexport type ActivityAction =\n  | 'login'\n  | 'logout'\n  | 'login_failed'\n  | 'password_changed'\n  | 'email_changed'\n  | 'profile_updated'\n  | 'session_revoked'\n  | 'user_deleted'\n  | 'user_banned'\n  | 'user_unbanned'\n  | 'role_changed'\n  | 'impersonation_started'\n  | 'impersonation_stopped'\n  | 'settings_changed'\n  | 'passkey_added'\n  | 'passkey_removed'\n\ninterface LogActivityParams {\n  userId: string\n  action: ActivityAction\n  description: string\n  ipAddress?: string | null\n  userAgent?: string | null\n  metadata?: Record<string, any>\n  // Populated on 'login' events only — see server/auth.ts's session.create hook.\n  referrerUrl?: string | null\n  os?: string | null\n  browser?: string | null\n  deviceType?: string | null\n  country?: string | null\n  city?: string | null\n}\n\nexport async function logActivity({\n  userId,\n  action,\n  description,\n  ipAddress,\n  userAgent,\n  metadata,\n  referrerUrl,\n  os,\n  browser,\n  deviceType,\n  country,\n  city,\n}: LogActivityParams) {\n  try {\n    await db.insert(activityLogs).values({\n      userId,\n      action,\n      description,\n      ipAddress: ipAddress || null,\n      userAgent: userAgent || null,\n      metadata: metadata ? JSON.stringify(metadata) : null,\n      referrerUrl: referrerUrl || null,\n      os: os || null,\n      browser: browser || null,\n      deviceType: deviceType || null,\n      country: country || null,\n      city: city || null,\n    })\n  } catch (error) {\n    console.error('Failed to log activity:', error)\n    // Don't throw - activity logging should not break the app\n  }\n}\n"]}
+{"version":3,"sources":["../lib/activity-logger.ts"],"names":[],"mappings":";;;;AAsCA,eAAsB,WAAA,CAAY;AAAA,EAChC,MAAA;AAAA,EACA,MAAA;AAAA,EACA,WAAA;AAAA,EACA,SAAA;AAAA,EACA,SAAA;AAAA,EACA,QAAA;AAAA,EACA,WAAA;AAAA,EACA,EAAA;AAAA,EACA,OAAA;AAAA,EACA,UAAA;AAAA,EACA,OAAA;AAAA,EACA;AACF,CAAA,EAAsB;AACpB,EAAA,IAAI;AACF,IAAA,MAAM,EAAA,CAAG,MAAA,CAAO,YAAY,CAAA,CAAE,MAAA,CAAO;AAAA,MACnC,MAAA;AAAA,MACA,MAAA;AAAA,MACA,WAAA;AAAA,MACA,WAAW,SAAA,IAAa,IAAA;AAAA,MACxB,WAAW,SAAA,IAAa,IAAA;AAAA,MACxB,QAAA,EAAU,QAAA,GAAW,IAAA,CAAK,SAAA,CAAU,QAAQ,CAAA,GAAI,IAAA;AAAA,MAChD,aAAa,WAAA,IAAe,IAAA;AAAA,MAC5B,IAAI,EAAA,IAAM,IAAA;AAAA,MACV,SAAS,OAAA,IAAW,IAAA;AAAA,MACpB,YAAY,UAAA,IAAc,IAAA;AAAA,MAC1B,SAAS,OAAA,IAAW,IAAA;AAAA,MACpB,MAAM,IAAA,IAAQ;AAAA,KACf,CAAA;AAAA,EACH,SAAS,KAAA,EAAO;AACd,IAAA,OAAA,CAAQ,KAAA,CAAM,2BAA2B,KAAK,CAAA;AAAA,EAEhD;AACF","file":"chunk-7F2POZM6.mjs","sourcesContent":["import \"server-only\"\nimport { db } from \"../server/db\"\nimport { activityLogs } from \"../server/db/schema\"\n\nexport type ActivityAction =\n  | 'login'\n  | 'logout'\n  | 'login_failed'\n  | 'password_changed'\n  | 'email_changed'\n  | 'profile_updated'\n  | 'session_revoked'\n  | 'user_deleted'\n  | 'user_banned'\n  | 'user_unbanned'\n  | 'role_changed'\n  | 'impersonation_started'\n  | 'impersonation_stopped'\n  | 'settings_changed'\n  | 'passkey_added'\n  | 'passkey_removed'\n\ninterface LogActivityParams {\n  userId: string\n  action: ActivityAction\n  description: string\n  ipAddress?: string | null\n  userAgent?: string | null\n  metadata?: Record<string, any>\n  // Populated on 'login' events only — see server/auth.ts's session.create hook.\n  referrerUrl?: string | null\n  os?: string | null\n  browser?: string | null\n  deviceType?: string | null\n  country?: string | null\n  city?: string | null\n}\n\nexport async function logActivity({\n  userId,\n  action,\n  description,\n  ipAddress,\n  userAgent,\n  metadata,\n  referrerUrl,\n  os,\n  browser,\n  deviceType,\n  country,\n  city,\n}: LogActivityParams) {\n  try {\n    await db.insert(activityLogs).values({\n      userId,\n      action,\n      description,\n      ipAddress: ipAddress || null,\n      userAgent: userAgent || null,\n      metadata: metadata ? JSON.stringify(metadata) : null,\n      referrerUrl: referrerUrl || null,\n      os: os || null,\n      browser: browser || null,\n      deviceType: deviceType || null,\n      country: country || null,\n      city: city || null,\n    })\n  } catch (error) {\n    console.error('Failed to log activity:', error)\n    // Don't throw - activity logging should not break the app\n  }\n}\n"]}

package/dist/{chunk-XWVAJXAG.mjs → chunk-7QVIOQ47.mjs}

@@ -1,15 +1,16 @@
-import { logActivity } from './chunk-VQ5B4MA7.mjs';
-import { getClientIp, parseUserAgent, lookupGeoLocation, formatLocation, formatDeviceInfo, WINDOW_MS, isOverLimit, MAX_IP } from './chunk-N6ECRCHY.mjs';
-import { getEffectiveAuthFlags } from './chunk-3MGEAGHU.mjs';
-import { db } from './chunk-WZDAMCUX.mjs';
-import { users, sessions, passkeys, twoFactors, verifications, accounts, authThrottle } from './chunk-ZQCALTKB.mjs';
-import { config } from './chunk-TMJYAOC2.mjs';
+import { logActivity } from './chunk-7F2POZM6.mjs';
+import { getClientIp, parseUserAgent, lookupGeoLocation, formatLocation, formatDeviceInfo, WINDOW_MS, isOverLimit, MAX_IP, RETENTION_MS } from './chunk-6OAHCEDJ.mjs';
+import { getEffectiveAuthFlags } from './chunk-P2G23JMY.mjs';
+import { getResend, EMAIL_FROM } from './chunk-OVKVD2HH.mjs';
+import { db } from './chunk-ZJMFE5B2.mjs';
+import { users, sessions, passkeys, twoFactors, verifications, accounts, authThrottle } from './chunk-TR5XFBTD.mjs';
+import { config } from './chunk-TKWNEKK6.mjs';
 import { __spreadValues, __spreadProps } from './chunk-3465SI5N.mjs';
 import 'server-only';
 import { betterAuth } from 'better-auth';
 import { drizzleAdapter } from 'better-auth/adapters/drizzle';
 import { createId } from '@paralleldrive/cuid2';
-import { sql, eq } from 'drizzle-orm';
+import { sql, eq, lt } from 'drizzle-orm';
 import { admin, twoFactor, oneTap } from 'better-auth/plugins';
 import { passkey } from '@better-auth/passkey';
 import { createAuthMiddleware, APIError, getSessionFromCtx } from 'better-auth/api';
@@ -47,6 +48,18 @@ async function recordDeviceAttempt(fingerprint, meta) {
   } catch (error) {
     console.error("auth-throttle write failed", error);
   }
+  await pruneStaleRows(now);
+}
+var PRUNE_EVERY_MS = 60 * 60 * 1e3;
+var lastPrune = 0;
+async function pruneStaleRows(now = /* @__PURE__ */ new Date()) {
+  if (now.getTime() - lastPrune < PRUNE_EVERY_MS) return;
+  lastPrune = now.getTime();
+  try {
+    await db.delete(authThrottle).where(lt(authThrottle.lastAttemptAt, new Date(now.getTime() - RETENTION_MS)));
+  } catch (error) {
+    console.error("auth-throttle prune failed", error);
+  }
 }
 async function clearDeviceThrottle(fingerprint) {
   try {
@@ -55,15 +68,6 @@ async function clearDeviceThrottle(fingerprint) {
     console.error("auth-throttle clear failed", error);
   }
 }
-var EMAIL_FROM = config.EMAIL_FROM;
-var resend;
-async function getResend() {
-  if (!resend) {
-    const { Resend } = await import('resend');
-    resend = new Resend(config.RESEND_API_KEY);
-  }
-  return resend;
-}
 
 // server/auth.ts
 async function logFailedLogin(ctx) {
@@ -453,6 +457,6 @@ var auth = new Proxy({}, {
   }
 });
 
-export { EMAIL_FROM, auth, createAuth, getResend };
-//# sourceMappingURL=chunk-XWVAJXAG.mjs.map
-//# sourceMappingURL=chunk-XWVAJXAG.mjs.map
+export { auth, createAuth };
+//# sourceMappingURL=chunk-7QVIOQ47.mjs.map
+//# sourceMappingURL=chunk-7QVIOQ47.mjs.map