@xk2800/nextjs-template 0.7.1-beta.6 → 0.7.1-beta.8

package/dist/chunk-C6RGN6QA.mjs

@@ -0,0 +1,60 @@
+import { BROADCAST_API_KEY, getBroadcastResend } from './chunk-OVKVD2HH.mjs';
+import { config } from './chunk-TKWNEKK6.mjs';
+import 'server-only';
+
+var MARKETING_SEGMENT_ID = config.RESEND_MARKETING_SEGMENT_ID;
+async function getMarketingOverview() {
+  var _a, _b;
+  if (!BROADCAST_API_KEY) {
+    return { segments: [], broadcasts: [], error: "Neither RESEND_BROADCAST_API_KEY nor RESEND_API_KEY is set." };
+  }
+  const resend = await getBroadcastResend();
+  const [segRes, bcRes] = await Promise.all([
+    resend.segments.list(),
+    resend.broadcasts.list({ limit: 10 })
+  ]);
+  if (segRes.error) return { segments: [], broadcasts: [], error: segRes.error.message };
+  return { segments: segRes.data.data, broadcasts: (_b = (_a = bcRes.data) == null ? void 0 : _a.data) != null ? _b : [], error: null };
+}
+var SEGMENT_CONTACTS_LIMIT = 100;
+async function listSegmentContacts(segmentId) {
+  const { data, error } = await (await getBroadcastResend()).contacts.list({ segmentId, limit: SEGMENT_CONTACTS_LIMIT });
+  if (error) return { contacts: [], hasMore: false, error: error.message };
+  return { contacts: data.data, hasMore: data.has_more, error: null };
+}
+async function isSubscribed(email) {
+  const resend = await getBroadcastResend();
+  const contact = await resend.contacts.get({ email });
+  if (contact.error) {
+    if (contact.error.name === "not_found") return false;
+    throw new Error(contact.error.message);
+  }
+  if (contact.data.unsubscribed) return false;
+  const segments = await resend.contacts.segments.list({ email });
+  if (segments.error) throw new Error(segments.error.message);
+  return segments.data.data.some((s) => s.id === MARKETING_SEGMENT_ID);
+}
+async function setSubscribed(email, name, subscribed) {
+  const resend = await getBroadcastResend();
+  const contact = await resend.contacts.get({ email });
+  const exists = !contact.error;
+  if (contact.error && contact.error.name !== "not_found") throw new Error(contact.error.message);
+  if (!subscribed) {
+    if (!exists) return;
+    const { error: error2 } = await resend.contacts.update({ email, unsubscribed: true });
+    if (error2) throw new Error(error2.message);
+    return;
+  }
+  const { error } = exists ? await resend.contacts.update({ email, unsubscribed: false }) : await resend.contacts.create({ email, firstName: name || void 0, unsubscribed: false });
+  if (error) throw new Error(error.message);
+  const segments = await resend.contacts.segments.list({ email });
+  if (segments.error) throw new Error(segments.error.message);
+  if (!segments.data.data.some((s) => s.id === MARKETING_SEGMENT_ID)) {
+    const added = await resend.contacts.segments.add({ email, segmentId: MARKETING_SEGMENT_ID });
+    if (added.error) throw new Error(added.error.message);
+  }
+}
+
+export { MARKETING_SEGMENT_ID, SEGMENT_CONTACTS_LIMIT, getMarketingOverview, isSubscribed, listSegmentContacts, setSubscribed };
+//# sourceMappingURL=chunk-C6RGN6QA.mjs.map
+//# sourceMappingURL=chunk-C6RGN6QA.mjs.map

package/dist/chunk-C6RGN6QA.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../lib/marketing.ts"],"names":["error"],"mappings":";;;;AAQO,IAAM,uBAAuB,MAAA,CAAO;AA0B3C,eAAsB,oBAAA,GAInB;AAtCH,EAAA,IAAA,EAAA,EAAA,EAAA;AAuCE,EAAA,IAAI,CAAC,iBAAA,EAAmB;AACtB,IAAA,OAAO,EAAE,UAAU,EAAC,EAAG,YAAY,EAAC,EAAG,OAAO,6DAAA,EAA8D;AAAA,EAC9G;AAEA,EAAA,MAAM,MAAA,GAAS,MAAM,kBAAA,EAAmB;AACxC,EAAA,MAAM,CAAC,MAAA,EAAQ,KAAK,CAAA,GAAI,MAAM,QAAQ,GAAA,CAAI;AAAA,IACxC,MAAA,CAAO,SAAS,IAAA,EAAK;AAAA,IACrB,OAAO,UAAA,CAAW,IAAA,CAAK,EAAE,KAAA,EAAO,IAAI;AAAA,GACrC,CAAA;AACD,EAAA,IAAI,MAAA,CAAO,KAAA,EAAO,OAAO,EAAE,QAAA,EAAU,EAAC,EAAG,UAAA,EAAY,EAAC,EAAG,KAAA,EAAO,MAAA,CAAO,MAAM,OAAA,EAAQ;AACrF,EAAA,OAAO,EAAE,QAAA,EAAU,MAAA,CAAO,IAAA,CAAK,MAAM,UAAA,EAAA,CAAY,EAAA,GAAA,CAAA,EAAA,GAAA,KAAA,CAAM,IAAA,KAAN,IAAA,GAAA,MAAA,GAAA,EAAA,CAAY,IAAA,KAAZ,IAAA,GAAA,EAAA,GAAoB,EAAC,EAAG,OAAO,IAAA,EAAK;AACvF;AAIO,IAAM,sBAAA,GAAyB;AAEtC,eAAsB,oBAAoB,SAAA,EAIvC;AACD,EAAA,MAAM,EAAE,IAAA,EAAM,KAAA,EAAM,GAAI,OAAO,MAAM,kBAAA,EAAmB,EAAG,QAAA,CAAS,IAAA,CAAK,EAAE,SAAA,EAAW,KAAA,EAAO,wBAAwB,CAAA;AACrH,EAAA,IAAI,KAAA,EAAO,OAAO,EAAE,QAAA,EAAU,IAAI,OAAA,EAAS,KAAA,EAAO,KAAA,EAAO,KAAA,CAAM,OAAA,EAAQ;AACvE,EAAA,OAAO,EAAE,UAAU,IAAA,CAAK,IAAA,EAAM,SAAS,IAAA,CAAK,QAAA,EAAU,OAAO,IAAA,EAAK;AACpE;AAIA,eAAsB,aAAa,KAAA,EAAiC;AAClE,EAAA,MAAM,MAAA,GAAS,MAAM,kBAAA,EAAmB;AACxC,EAAA,MAAM,UAAU,MAAM,MAAA,CAAO,SAAS,GAAA,CAAI,EAAE,OAAO,CAAA;AACnD,EAAA,IAAI,QAAQ,KAAA,EAAO;AACjB,IAAA,IAAI,OAAA,CAAQ,KAAA,CAAM,IAAA,KAAS,WAAA,EAAa,OAAO,KAAA;AAC/C,IAAA,MAAM,IAAI,KAAA,CAAM,OAAA,CAAQ,KAAA,CAAM,OAAO,CAAA;AAAA,EACvC;AACA,EAAA,IAAI,OAAA,CAAQ,IAAA,CAAK,YAAA,EAAc,OAAO,KAAA;AAEtC,EAAA,MAAM,QAAA,GAAW,MAAM,MAAA,CAAO,QAAA,CAAS,SAAS,IAAA,CAAK,EAAE,OAAO,CAAA;AAC9D,EAAA,IAAI,SAAS,KAAA,EAAO,MAAM,IAAI,KAAA,CAAM,QAAA,CAAS,MAAM,OAAO,CAAA;AAC1D,EAAA,OAAO,QAAA,CAAS,KAAK,IAAA,CAAK,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,OAAO,oBAAoB,CAAA;AACrE;AAEA,eAAsB,aAAA,CAAc,KAAA,EAAe,IAAA,EAAc,UAAA,EAAqB;AACpF,EAAA,MAAM,MAAA,GAAS,MAAM,kBAAA,EAAmB;AACxC,EAAA,MAAM,UAAU,MAAM,MAAA,CAAO,SAAS,GAAA,CAAI,EAAE,OAAO,CAAA;AACnD,EAAA,MAAM,MAAA,GAAS,CAAC,OAAA,CAAQ,KAAA;AACxB,EAAA,IAAI,OAAA,CAAQ,KAAA,IAAS,OAAA,CAAQ,KAAA,CAAM,IAAA,KAAS,WAAA,EAAa,MAAM,IAAI,KAAA,CAAM,OAAA,CAAQ,KAAA,CAAM,OAAO,CAAA;AAE9F,EAAA,IAAI,CAAC,UAAA,EAAY;AAEf,IAAA,IAAI,CAAC,MAAA,EAAQ;AACb,IAAA,MAAM,EAAE,KAAA,EAAAA,MAAAA,EAAM,GAAI,MAAM,MAAA,CAAO,QAAA,CAAS,MAAA,CAAO,EAAE,KAAA,EAAO,YAAA,EAAc,IAAA,EAAM,CAAA;AAC5E,IAAA,IAAIA,MAAAA,EAAO,MAAM,IAAI,KAAA,CAAMA,OAAM,OAAO,CAAA;AACxC,IAAA;AAAA,EACF;AAEA,EAAA,MAAM,EAAE,KAAA,EAAM,GAAI,MAAA,GACd,MAAM,OAAO,QAAA,CAAS,MAAA,CAAO,EAAE,KAAA,EAAO,YAAA,EAAc,KAAA,EAAO,CAAA,GAC3D,MAAM,MAAA,CAAO,QAAA,CAAS,MAAA,CAAO,EAAE,KAAA,EAAO,SAAA,EAAW,IAAA,IAAQ,MAAA,EAAW,YAAA,EAAc,KAAA,EAAO,CAAA;AAC7F,EAAA,IAAI,KAAA,EAAO,MAAM,IAAI,KAAA,CAAM,MAAM,OAAO,CAAA;AAExC,EAAA,MAAM,QAAA,GAAW,MAAM,MAAA,CAAO,QAAA,CAAS,SAAS,IAAA,CAAK,EAAE,OAAO,CAAA;AAC9D,EAAA,IAAI,SAAS,KAAA,EAAO,MAAM,IAAI,KAAA,CAAM,QAAA,CAAS,MAAM,OAAO,CAAA;AAC1D,EAAA,IAAI,CAAC,QAAA,CAAS,IAAA,CAAK,IAAA,CAAK,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,EAAA,KAAO,oBAAoB,CAAA,EAAG;AAClE,IAAA,MAAM,KAAA,GAAQ,MAAM,MAAA,CAAO,QAAA,CAAS,QAAA,CAAS,IAAI,EAAE,KAAA,EAAO,SAAA,EAAW,oBAAA,EAAsB,CAAA;AAC3F,IAAA,IAAI,MAAM,KAAA,EAAO,MAAM,IAAI,KAAA,CAAM,KAAA,CAAM,MAAM,OAAO,CAAA;AAAA,EACtD;AACF","file":"chunk-C6RGN6QA.mjs","sourcesContent":["import \"server-only\"\n// Marketing email data helpers, shipped as `@xk2800/nextjs-template/marketing`.\n// Everything goes through Resend Broadcasts/Contacts with the broadcast key,\n// so it never touches the transactional sending quota.\nimport { config } from \"../config/env\"\nimport { getBroadcastResend, BROADCAST_API_KEY } from \"./resend\"\n\n// The segment users join from the dashboard toggle. Blank = toggle hidden.\nexport const MARKETING_SEGMENT_ID = config.RESEND_MARKETING_SEGMENT_ID\n\nexport interface MarketingSegment {\n  id: string\n  name: string\n}\n\nexport interface MarketingBroadcast {\n  id: string\n  name: string | null\n  status: string\n  created_at: string\n  sent_at: string | null\n}\n\nexport interface MarketingContact {\n  id: string\n  email: string\n  first_name?: string\n  last_name?: string\n  unsubscribed: boolean\n  created_at: string\n}\n\n// Segments + the 10 latest broadcasts for the admin page. `error` is set\n// instead of throwing, so the page can explain a missing or sending-only key.\nexport async function getMarketingOverview(): Promise<{\n  segments: MarketingSegment[]\n  broadcasts: MarketingBroadcast[]\n  error: string | null\n}> {\n  if (!BROADCAST_API_KEY) {\n    return { segments: [], broadcasts: [], error: \"Neither RESEND_BROADCAST_API_KEY nor RESEND_API_KEY is set.\" }\n  }\n\n  const resend = await getBroadcastResend()\n  const [segRes, bcRes] = await Promise.all([\n    resend.segments.list(),\n    resend.broadcasts.list({ limit: 10 }),\n  ])\n  if (segRes.error) return { segments: [], broadcasts: [], error: segRes.error.message }\n  return { segments: segRes.data.data, broadcasts: bcRes.data?.data ?? [], error: null }\n}\n\n// ponytail: first page only (Resend max 100); add cursor paging (`after`)\n// if a segment outgrows it.\nexport const SEGMENT_CONTACTS_LIMIT = 100\n\nexport async function listSegmentContacts(segmentId: string): Promise<{\n  contacts: MarketingContact[]\n  hasMore: boolean\n  error: string | null\n}> {\n  const { data, error } = await (await getBroadcastResend()).contacts.list({ segmentId, limit: SEGMENT_CONTACTS_LIMIT })\n  if (error) return { contacts: [], hasMore: false, error: error.message }\n  return { contacts: data.data, hasMore: data.has_more, error: null }\n}\n\n// Resend is the source of truth, so the toggle also reflects someone who\n// clicked Unsubscribe in an email or was edited in the Resend dashboard.\nexport async function isSubscribed(email: string): Promise<boolean> {\n  const resend = await getBroadcastResend()\n  const contact = await resend.contacts.get({ email })\n  if (contact.error) {\n    if (contact.error.name === \"not_found\") return false\n    throw new Error(contact.error.message)\n  }\n  if (contact.data.unsubscribed) return false\n\n  const segments = await resend.contacts.segments.list({ email })\n  if (segments.error) throw new Error(segments.error.message)\n  return segments.data.data.some((s) => s.id === MARKETING_SEGMENT_ID)\n}\n\nexport async function setSubscribed(email: string, name: string, subscribed: boolean) {\n  const resend = await getBroadcastResend()\n  const contact = await resend.contacts.get({ email })\n  const exists = !contact.error\n  if (contact.error && contact.error.name !== \"not_found\") throw new Error(contact.error.message)\n\n  if (!subscribed) {\n    // Same as the email's Unsubscribe link: opted out of every broadcast.\n    if (!exists) return\n    const { error } = await resend.contacts.update({ email, unsubscribed: true })\n    if (error) throw new Error(error.message)\n    return\n  }\n\n  const { error } = exists\n    ? await resend.contacts.update({ email, unsubscribed: false })\n    : await resend.contacts.create({ email, firstName: name || undefined, unsubscribed: false })\n  if (error) throw new Error(error.message)\n\n  const segments = await resend.contacts.segments.list({ email })\n  if (segments.error) throw new Error(segments.error.message)\n  if (!segments.data.data.some((s) => s.id === MARKETING_SEGMENT_ID)) {\n    const added = await resend.contacts.segments.add({ email, segmentId: MARKETING_SEGMENT_ID })\n    if (added.error) throw new Error(added.error.message)\n  }\n}\n"]}

package/dist/chunk-OVKVD2HH.mjs

@@ -0,0 +1,25 @@
+import { config } from './chunk-TKWNEKK6.mjs';
+import 'server-only';
+
+var EMAIL_FROM = config.EMAIL_FROM;
+var resend;
+async function getResend() {
+  if (!resend) {
+    const { Resend } = await import('resend');
+    resend = new Resend(config.RESEND_API_KEY);
+  }
+  return resend;
+}
+var BROADCAST_API_KEY = config.RESEND_BROADCAST_API_KEY || config.RESEND_API_KEY;
+var broadcastResend;
+async function getBroadcastResend() {
+  if (!broadcastResend) {
+    const { Resend } = await import('resend');
+    broadcastResend = new Resend(BROADCAST_API_KEY);
+  }
+  return broadcastResend;
+}
+
+export { BROADCAST_API_KEY, EMAIL_FROM, getBroadcastResend, getResend };
+//# sourceMappingURL=chunk-OVKVD2HH.mjs.map
+//# sourceMappingURL=chunk-OVKVD2HH.mjs.map

package/dist/chunk-OVKVD2HH.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../lib/resend.ts"],"names":[],"mappings":";;;AAMO,IAAM,aAAa,MAAA,CAAO;AAIjC,IAAI,MAAA;AACJ,eAAsB,SAAA,GAAY;AAChC,EAAA,IAAI,CAAC,MAAA,EAAQ;AACX,IAAA,MAAM,EAAE,MAAA,EAAO,GAAI,MAAM,OAAO,QAAQ,CAAA;AACxC,IAAA,MAAA,GAAS,IAAI,MAAA,CAAO,MAAA,CAAO,cAAc,CAAA;AAAA,EAC3C;AACA,EAAA,OAAO,MAAA;AACT;AAIO,IAAM,iBAAA,GAAoB,MAAA,CAAO,wBAAA,IAA4B,MAAA,CAAO;AAE3E,IAAI,eAAA;AACJ,eAAsB,kBAAA,GAAqB;AACzC,EAAA,IAAI,CAAC,eAAA,EAAiB;AACpB,IAAA,MAAM,EAAE,MAAA,EAAO,GAAI,MAAM,OAAO,QAAQ,CAAA;AACxC,IAAA,eAAA,GAAkB,IAAI,OAAO,iBAAiB,CAAA;AAAA,EAChD;AACA,EAAA,OAAO,eAAA;AACT","file":"chunk-OVKVD2HH.mjs","sourcesContent":["import \"server-only\"\nimport type { Resend } from \"resend\"\nimport { config } from \"@/config/env\"\n\n// From env, not hardcoded: scaffolded apps run this module from the package's\n// bundled auth, so a local edit here would never reach their auth emails.\nexport const EMAIL_FROM = config.EMAIL_FROM\n\n// Loaded on first send, so projects that never send email don't pay for it\n// at startup.\nlet resend: Resend | undefined\nexport async function getResend() {\n  if (!resend) {\n    const { Resend } = await import(\"resend\")\n    resend = new Resend(config.RESEND_API_KEY)\n  }\n  return resend\n}\n\n// Broadcasts need a full access key, so they can use their own and leave\n// RESEND_API_KEY as a sending-only key.\nexport const BROADCAST_API_KEY = config.RESEND_BROADCAST_API_KEY || config.RESEND_API_KEY\n\nlet broadcastResend: Resend | undefined\nexport async function getBroadcastResend() {\n  if (!broadcastResend) {\n    const { Resend } = await import(\"resend\")\n    broadcastResend = new Resend(BROADCAST_API_KEY)\n  }\n  return broadcastResend\n}\n"]}

package/dist/{chunk-F776DQAM.mjs → chunk-P2G23JMY.mjs}

@@ -1,6 +1,6 @@
-import { db } from './chunk-F7CG5CA3.mjs';
+import { db } from './chunk-ZJMFE5B2.mjs';
 import { systemSettings, DEFAULT_MAINTENANCE_EXEMPT_PATHS } from './chunk-TR5XFBTD.mjs';
-import { config } from './chunk-TMJYAOC2.mjs';
+import { config } from './chunk-TKWNEKK6.mjs';
 import { __spreadProps, __spreadValues } from './chunk-3465SI5N.mjs';
 import 'server-only';
 import { eq } from 'drizzle-orm';
@@ -82,5 +82,5 @@ function getConfiguredAuthFlags() {
 }
 
 export { getConfiguredAuthFlags, getEffectiveAuthFlags, getSystemSettings, invalidateSystemSettingsCache, isConsentRequired, updateSystemSettings };
-//# sourceMappingURL=chunk-F776DQAM.mjs.map
-//# sourceMappingURL=chunk-F776DQAM.mjs.map
+//# sourceMappingURL=chunk-P2G23JMY.mjs.map
+//# sourceMappingURL=chunk-P2G23JMY.mjs.map

package/dist/{chunk-F776DQAM.mjs.map → chunk-P2G23JMY.mjs.map}

@@ -1 +1 @@
-{"version":3,"sources":["../lib/settings-queries.ts"],"names":[],"mappings":";;;;;;;AAOA,IAAM,eAAA,GAAkB,SAAA;AAKxB,IAAM,YAAA,GAAe,GAAA;AAIrB,IAAI,MAAA,GAA8D,IAAA;AAKlE,SAAS,gBAAA,GAAmC;AAC1C,EAAA,OAAO;AAAA,IACL,EAAA,EAAI,eAAA;AAAA,IACJ,eAAA,EAAiB,KAAA;AAAA,IACjB,kBAAA,EAAoB,IAAA;AAAA,IACpB,sBAAA,EAAwB,gCAAA;AAAA,IACxB,kBAAkB,MAAA,CAAO,kBAAA;AAAA,IACzB,yBAAyB,MAAA,CAAO,0BAAA;AAAA,IAChC,kBAAkB,MAAA,CAAO,mBAAA;AAAA,IACzB,yBAAyB,MAAA,CAAO,yBAAA;AAAA,IAChC,oBAAA,EAAsB,IAAA;AAAA,IACtB,eAAA,EAAiB,IAAA;AAAA,IACjB,SAAA,kBAAW,IAAI,IAAA,CAAK,CAAC,CAAA;AAAA,IACrB,SAAA,EAAW;AAAA,GACb;AACF;AAEA,eAAe,UAAA,GAAsC;AAtCrD,EAAA,IAAA,EAAA;AAuCE,EAAA,MAAM,WAAW,MAAM,EAAA,CACpB,MAAA,EAAO,CACP,KAAK,cAAc,CAAA,CACnB,KAAA,CAAM,EAAA,CAAG,eAAe,EAAA,EAAI,eAAe,CAAC,CAAA,CAC5C,MAAM,CAAC,CAAA;AACV,EAAA,IAAI,QAAA,CAAS,CAAC,CAAA,EAAG,OAAO,SAAS,CAAC,CAAA;AAMlC,EAAA,MAAM,SAAS,MAAM,EAAA,CAClB,MAAA,CAAO,cAAc,EACrB,MAAA,CAAO;AAAA,IACN,EAAA,EAAI,eAAA;AAAA,IACJ,eAAA,EAAiB,KAAA;AAAA,IACjB,kBAAkB,MAAA,CAAO,kBAAA;AAAA,IACzB,yBAAyB,MAAA,CAAO,0BAAA;AAAA,IAChC,kBAAkB,MAAA,CAAO,mBAAA;AAAA,IACzB,yBAAyB,MAAA,CAAO;AAAA,GACjC,CAAA,CACA,mBAAA,EAAoB,CACpB,SAAA,EAAU;AAEb,EAAA,IAAI,MAAA,CAAO,CAAC,CAAA,EAAG,OAAO,OAAO,CAAC,CAAA;AAG9B,EAAA,MAAM,QAAQ,MAAM,EAAA,CACjB,MAAA,EAAO,CACP,KAAK,cAAc,CAAA,CACnB,KAAA,CAAM,EAAA,CAAG,eAAe,EAAA,EAAI,eAAe,CAAC,CAAA,CAC5C,MAAM,CAAC,CAAA;AACV,EAAA,OAAA,CAAO,EAAA,GAAA,KAAA,CAAM,CAAC,CAAA,KAAP,IAAA,GAAA,EAAA,GAAY,gBAAA,EAAiB;AACtC;AAEA,eAAsB,iBAAA,GAA6C;AACjE,EAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,EAAA,IAAI,MAAA,IAAU,MAAA,CAAO,SAAA,GAAY,GAAA,SAAY,MAAA,CAAO,KAAA;AAEpD,EAAA,IAAI;AACF,IAAA,MAAM,KAAA,GAAQ,MAAM,UAAA,EAAW;AAC/B,IAAA,MAAA,GAAS,EAAE,KAAA,EAAO,SAAA,EAAW,GAAA,GAAM,YAAA,EAAa;AAChD,IAAA,OAAO,KAAA;AAAA,EACT,SAAS,KAAA,EAAO;AACd,IAAA,OAAA,CAAQ,KAAA,CAAM,iDAAiD,KAAK,CAAA;AACpE,IAAA,OAAO,gBAAA,EAAiB;AAAA,EAC1B;AACF;AAEO,SAAS,6BAAA,GAAgC;AAC9C,EAAA,MAAA,GAAS,IAAA;AACX;AAQA,eAAsB,oBAAA,CACpB,OACA,SAAA,EACyB;AACzB,EAAA,MAAM,UAAA,EAAW;AAEjB,EAAA,MAAM,CAAC,OAAO,CAAA,GAAI,MAAM,EAAA,CACrB,MAAA,CAAO,cAAc,CAAA,CACrB,GAAA,CAAI,aAAA,CAAA,cAAA,CAAA,EAAA,EAAK,KAAA,CAAA,EAAL,EAAY,SAAA,sBAAe,IAAA,EAAK,EAAG,SAAA,EAAU,CAAC,CAAA,CAClD,KAAA,CAAM,EAAA,CAAG,cAAA,CAAe,EAAA,EAAI,eAAe,CAAC,CAAA,CAC5C,SAAA,EAAU;AAEb,EAAA,6BAAA,EAA8B;AAC9B,EAAA,OAAO,OAAA;AACT;AAKA,eAAsB,qBAAA,GAAwB;AAC5C,EAAA,MAAM,QAAA,GAAW,MAAM,iBAAA,EAAkB;AACzC,EAAA,OAAO;AAAA,IACL,MAAA,EAAQ,MAAA,CAAO,kBAAA,IAAsB,QAAA,CAAS,gBAAA;AAAA,IAC9C,aAAA,EAAe,MAAA,CAAO,0BAAA,IAA8B,QAAA,CAAS,uBAAA;AAAA,IAC7D,MAAA,EAAQ,MAAA,CAAO,mBAAA,IAAuB,QAAA,CAAS;AAAA,GACjD;AACF;AAIO,SAAS,kBAAkB,QAAA,EAA4D;AAhI9F,EAAA,IAAA,EAAA;AAiIE,EAAA,OAAA,CAAO,EAAA,GAAA,QAAA,CAAS,eAAA,KAAT,IAAA,GAAA,EAAA,GAA4B,OAAA,CAAQ,IAAI,yBAAA,KAA8B,OAAA;AAC/E;AAMO,SAAS,sBAAA,GAAyB;AACvC,EAAA,OAAO;AAAA,IACL,QAAQ,MAAA,CAAO,kBAAA;AAAA,IACf,eAAe,MAAA,CAAO,0BAAA;AAAA,IACtB,QAAQ,MAAA,CAAO;AAAA,GACjB;AACF","file":"chunk-F776DQAM.mjs","sourcesContent":["import \"server-only\"\nimport { db } from \"../server/db\"\nimport { systemSettings } from \"../server/db/schema\"\nimport { config } from \"../config/env\"\nimport { eq } from \"drizzle-orm\"\nimport { DEFAULT_MAINTENANCE_EXEMPT_PATHS } from \"./maintenance\"\n\nconst SETTINGS_ROW_ID = \"default\"\n// Short TTL: cheap reads (no DB round trip on every request), while an\n// admin's change is guaranteed live within this window even for a reader\n// that isn't the one who just saved (invalidateSystemSettingsCache() makes\n// it instant for that request's own process).\nconst CACHE_TTL_MS = 10_000\n\nexport type SystemSettings = typeof systemSettings.$inferSelect\n\nlet cached: { value: SystemSettings; expiresAt: number } | null = null\n\n// Fail-open shape if the DB is unreachable: auth flags fall back to their\n// config/env.ts defaults (unchanged behavior), maintenance mode is always\n// off — a DB hiccup must never lock out the whole site, including admins.\nfunction fallbackSettings(): SystemSettings {\n  return {\n    id: SETTINGS_ROW_ID,\n    maintenanceMode: false,\n    maintenanceMessage: null,\n    maintenanceExemptPaths: DEFAULT_MAINTENANCE_EXEMPT_PATHS,\n    authEnableGoogle: config.AUTH_ENABLE_GOOGLE,\n    authEnableEmailPassword: config.AUTH_ENABLE_EMAIL_PASSWORD,\n    authEnableOneTap: config.AUTH_ENABLE_ONE_TAP,\n    enableSessionRevocation: config.ENABLE_SESSION_REVOCATION,\n    feedbackAttachErrors: true,\n    consentRequired: null,\n    updatedAt: new Date(0),\n    updatedBy: null,\n  }\n}\n\nasync function loadOrSeed(): Promise<SystemSettings> {\n  const existing = await db\n    .select()\n    .from(systemSettings)\n    .where(eq(systemSettings.id, SETTINGS_ROW_ID))\n    .limit(1)\n  if (existing[0]) return existing[0]\n\n  // Lazy-seed on first read, from the *current* env config — not the\n  // schema's hardcoded column defaults — so turning this feature on never\n  // silently flips an already-deployed flag (e.g. a prod deploy that\n  // already set AUTH_ENABLE_GOOGLE=false).\n  const seeded = await db\n    .insert(systemSettings)\n    .values({\n      id: SETTINGS_ROW_ID,\n      maintenanceMode: false,\n      authEnableGoogle: config.AUTH_ENABLE_GOOGLE,\n      authEnableEmailPassword: config.AUTH_ENABLE_EMAIL_PASSWORD,\n      authEnableOneTap: config.AUTH_ENABLE_ONE_TAP,\n      enableSessionRevocation: config.ENABLE_SESSION_REVOCATION,\n    })\n    .onConflictDoNothing()\n    .returning()\n\n  if (seeded[0]) return seeded[0]\n\n  // Lost the seed race to a concurrent first-reader.\n  const retry = await db\n    .select()\n    .from(systemSettings)\n    .where(eq(systemSettings.id, SETTINGS_ROW_ID))\n    .limit(1)\n  return retry[0] ?? fallbackSettings()\n}\n\nexport async function getSystemSettings(): Promise<SystemSettings> {\n  const now = Date.now()\n  if (cached && cached.expiresAt > now) return cached.value\n\n  try {\n    const value = await loadOrSeed()\n    cached = { value, expiresAt: now + CACHE_TTL_MS }\n    return value\n  } catch (error) {\n    console.error(\"Failed to load system settings, failing open:\", error)\n    return fallbackSettings() // not cached — retry next request\n  }\n}\n\nexport function invalidateSystemSettingsCache() {\n  cached = null\n}\n\nexport type SystemSettingsPatch = Partial<Pick<SystemSettings,\n  | 'maintenanceMode' | 'maintenanceMessage' | 'maintenanceExemptPaths'\n  | 'authEnableGoogle' | 'authEnableEmailPassword' | 'authEnableOneTap'\n  | 'enableSessionRevocation' | 'feedbackAttachErrors' | 'consentRequired'\n>>\n\nexport async function updateSystemSettings(\n  patch: SystemSettingsPatch,\n  updatedBy: string\n): Promise<SystemSettings> {\n  await loadOrSeed() // ensure the row exists even if nobody's read it yet\n\n  const [updated] = await db\n    .update(systemSettings)\n    .set({ ...patch, updatedAt: new Date(), updatedBy })\n    .where(eq(systemSettings.id, SETTINGS_ROW_ID))\n    .returning()\n\n  invalidateSystemSettingsCache()\n  return updated\n}\n\n// Effective auth-method visibility = deploy-time \"configured\" (env, decides\n// whether the provider is even registered with better-auth — see\n// server/auth.ts's createAuth()) AND runtime \"offered\" (this DB flag).\nexport async function getEffectiveAuthFlags() {\n  const settings = await getSystemSettings()\n  return {\n    google: config.AUTH_ENABLE_GOOGLE && settings.authEnableGoogle,\n    emailPassword: config.AUTH_ENABLE_EMAIL_PASSWORD && settings.authEnableEmailPassword,\n    oneTap: config.AUTH_ENABLE_ONE_TAP && settings.authEnableOneTap,\n  }\n}\n\n// Consent mode: the admin's choice if they've made one, else the\n// NEXT_PUBLIC_COOKIE_BANNER default (banner on unless it's \"false\").\nexport function isConsentRequired(settings: Pick<SystemSettings, 'consentRequired'>): boolean {\n  return settings.consentRequired ?? process.env.NEXT_PUBLIC_COOKIE_BANNER !== \"false\"\n}\n\n// The env-only half of the AND above. The System Settings page needs this\n// to explain *why* a toggle it controls isn't taking effect — flipping the\n// DB flag on can't do anything if the env var for that method is off, so\n// the UI should say so instead of looking like a silent no-op.\nexport function getConfiguredAuthFlags() {\n  return {\n    google: config.AUTH_ENABLE_GOOGLE,\n    emailPassword: config.AUTH_ENABLE_EMAIL_PASSWORD,\n    oneTap: config.AUTH_ENABLE_ONE_TAP,\n  }\n}\n"]}
+{"version":3,"sources":["../lib/settings-queries.ts"],"names":[],"mappings":";;;;;;;AAOA,IAAM,eAAA,GAAkB,SAAA;AAKxB,IAAM,YAAA,GAAe,GAAA;AAIrB,IAAI,MAAA,GAA8D,IAAA;AAKlE,SAAS,gBAAA,GAAmC;AAC1C,EAAA,OAAO;AAAA,IACL,EAAA,EAAI,eAAA;AAAA,IACJ,eAAA,EAAiB,KAAA;AAAA,IACjB,kBAAA,EAAoB,IAAA;AAAA,IACpB,sBAAA,EAAwB,gCAAA;AAAA,IACxB,kBAAkB,MAAA,CAAO,kBAAA;AAAA,IACzB,yBAAyB,MAAA,CAAO,0BAAA;AAAA,IAChC,kBAAkB,MAAA,CAAO,mBAAA;AAAA,IACzB,yBAAyB,MAAA,CAAO,yBAAA;AAAA,IAChC,oBAAA,EAAsB,IAAA;AAAA,IACtB,eAAA,EAAiB,IAAA;AAAA,IACjB,SAAA,kBAAW,IAAI,IAAA,CAAK,CAAC,CAAA;AAAA,IACrB,SAAA,EAAW;AAAA,GACb;AACF;AAEA,eAAe,UAAA,GAAsC;AAtCrD,EAAA,IAAA,EAAA;AAuCE,EAAA,MAAM,WAAW,MAAM,EAAA,CACpB,MAAA,EAAO,CACP,KAAK,cAAc,CAAA,CACnB,KAAA,CAAM,EAAA,CAAG,eAAe,EAAA,EAAI,eAAe,CAAC,CAAA,CAC5C,MAAM,CAAC,CAAA;AACV,EAAA,IAAI,QAAA,CAAS,CAAC,CAAA,EAAG,OAAO,SAAS,CAAC,CAAA;AAMlC,EAAA,MAAM,SAAS,MAAM,EAAA,CAClB,MAAA,CAAO,cAAc,EACrB,MAAA,CAAO;AAAA,IACN,EAAA,EAAI,eAAA;AAAA,IACJ,eAAA,EAAiB,KAAA;AAAA,IACjB,kBAAkB,MAAA,CAAO,kBAAA;AAAA,IACzB,yBAAyB,MAAA,CAAO,0BAAA;AAAA,IAChC,kBAAkB,MAAA,CAAO,mBAAA;AAAA,IACzB,yBAAyB,MAAA,CAAO;AAAA,GACjC,CAAA,CACA,mBAAA,EAAoB,CACpB,SAAA,EAAU;AAEb,EAAA,IAAI,MAAA,CAAO,CAAC,CAAA,EAAG,OAAO,OAAO,CAAC,CAAA;AAG9B,EAAA,MAAM,QAAQ,MAAM,EAAA,CACjB,MAAA,EAAO,CACP,KAAK,cAAc,CAAA,CACnB,KAAA,CAAM,EAAA,CAAG,eAAe,EAAA,EAAI,eAAe,CAAC,CAAA,CAC5C,MAAM,CAAC,CAAA;AACV,EAAA,OAAA,CAAO,EAAA,GAAA,KAAA,CAAM,CAAC,CAAA,KAAP,IAAA,GAAA,EAAA,GAAY,gBAAA,EAAiB;AACtC;AAEA,eAAsB,iBAAA,GAA6C;AACjE,EAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,EAAA,IAAI,MAAA,IAAU,MAAA,CAAO,SAAA,GAAY,GAAA,SAAY,MAAA,CAAO,KAAA;AAEpD,EAAA,IAAI;AACF,IAAA,MAAM,KAAA,GAAQ,MAAM,UAAA,EAAW;AAC/B,IAAA,MAAA,GAAS,EAAE,KAAA,EAAO,SAAA,EAAW,GAAA,GAAM,YAAA,EAAa;AAChD,IAAA,OAAO,KAAA;AAAA,EACT,SAAS,KAAA,EAAO;AACd,IAAA,OAAA,CAAQ,KAAA,CAAM,iDAAiD,KAAK,CAAA;AACpE,IAAA,OAAO,gBAAA,EAAiB;AAAA,EAC1B;AACF;AAEO,SAAS,6BAAA,GAAgC;AAC9C,EAAA,MAAA,GAAS,IAAA;AACX;AAQA,eAAsB,oBAAA,CACpB,OACA,SAAA,EACyB;AACzB,EAAA,MAAM,UAAA,EAAW;AAEjB,EAAA,MAAM,CAAC,OAAO,CAAA,GAAI,MAAM,EAAA,CACrB,MAAA,CAAO,cAAc,CAAA,CACrB,GAAA,CAAI,aAAA,CAAA,cAAA,CAAA,EAAA,EAAK,KAAA,CAAA,EAAL,EAAY,SAAA,sBAAe,IAAA,EAAK,EAAG,SAAA,EAAU,CAAC,CAAA,CAClD,KAAA,CAAM,EAAA,CAAG,cAAA,CAAe,EAAA,EAAI,eAAe,CAAC,CAAA,CAC5C,SAAA,EAAU;AAEb,EAAA,6BAAA,EAA8B;AAC9B,EAAA,OAAO,OAAA;AACT;AAKA,eAAsB,qBAAA,GAAwB;AAC5C,EAAA,MAAM,QAAA,GAAW,MAAM,iBAAA,EAAkB;AACzC,EAAA,OAAO;AAAA,IACL,MAAA,EAAQ,MAAA,CAAO,kBAAA,IAAsB,QAAA,CAAS,gBAAA;AAAA,IAC9C,aAAA,EAAe,MAAA,CAAO,0BAAA,IAA8B,QAAA,CAAS,uBAAA;AAAA,IAC7D,MAAA,EAAQ,MAAA,CAAO,mBAAA,IAAuB,QAAA,CAAS;AAAA,GACjD;AACF;AAIO,SAAS,kBAAkB,QAAA,EAA4D;AAhI9F,EAAA,IAAA,EAAA;AAiIE,EAAA,OAAA,CAAO,EAAA,GAAA,QAAA,CAAS,eAAA,KAAT,IAAA,GAAA,EAAA,GAA4B,OAAA,CAAQ,IAAI,yBAAA,KAA8B,OAAA;AAC/E;AAMO,SAAS,sBAAA,GAAyB;AACvC,EAAA,OAAO;AAAA,IACL,QAAQ,MAAA,CAAO,kBAAA;AAAA,IACf,eAAe,MAAA,CAAO,0BAAA;AAAA,IACtB,QAAQ,MAAA,CAAO;AAAA,GACjB;AACF","file":"chunk-P2G23JMY.mjs","sourcesContent":["import \"server-only\"\nimport { db } from \"../server/db\"\nimport { systemSettings } from \"../server/db/schema\"\nimport { config } from \"../config/env\"\nimport { eq } from \"drizzle-orm\"\nimport { DEFAULT_MAINTENANCE_EXEMPT_PATHS } from \"./maintenance\"\n\nconst SETTINGS_ROW_ID = \"default\"\n// Short TTL: cheap reads (no DB round trip on every request), while an\n// admin's change is guaranteed live within this window even for a reader\n// that isn't the one who just saved (invalidateSystemSettingsCache() makes\n// it instant for that request's own process).\nconst CACHE_TTL_MS = 10_000\n\nexport type SystemSettings = typeof systemSettings.$inferSelect\n\nlet cached: { value: SystemSettings; expiresAt: number } | null = null\n\n// Fail-open shape if the DB is unreachable: auth flags fall back to their\n// config/env.ts defaults (unchanged behavior), maintenance mode is always\n// off — a DB hiccup must never lock out the whole site, including admins.\nfunction fallbackSettings(): SystemSettings {\n  return {\n    id: SETTINGS_ROW_ID,\n    maintenanceMode: false,\n    maintenanceMessage: null,\n    maintenanceExemptPaths: DEFAULT_MAINTENANCE_EXEMPT_PATHS,\n    authEnableGoogle: config.AUTH_ENABLE_GOOGLE,\n    authEnableEmailPassword: config.AUTH_ENABLE_EMAIL_PASSWORD,\n    authEnableOneTap: config.AUTH_ENABLE_ONE_TAP,\n    enableSessionRevocation: config.ENABLE_SESSION_REVOCATION,\n    feedbackAttachErrors: true,\n    consentRequired: null,\n    updatedAt: new Date(0),\n    updatedBy: null,\n  }\n}\n\nasync function loadOrSeed(): Promise<SystemSettings> {\n  const existing = await db\n    .select()\n    .from(systemSettings)\n    .where(eq(systemSettings.id, SETTINGS_ROW_ID))\n    .limit(1)\n  if (existing[0]) return existing[0]\n\n  // Lazy-seed on first read, from the *current* env config — not the\n  // schema's hardcoded column defaults — so turning this feature on never\n  // silently flips an already-deployed flag (e.g. a prod deploy that\n  // already set AUTH_ENABLE_GOOGLE=false).\n  const seeded = await db\n    .insert(systemSettings)\n    .values({\n      id: SETTINGS_ROW_ID,\n      maintenanceMode: false,\n      authEnableGoogle: config.AUTH_ENABLE_GOOGLE,\n      authEnableEmailPassword: config.AUTH_ENABLE_EMAIL_PASSWORD,\n      authEnableOneTap: config.AUTH_ENABLE_ONE_TAP,\n      enableSessionRevocation: config.ENABLE_SESSION_REVOCATION,\n    })\n    .onConflictDoNothing()\n    .returning()\n\n  if (seeded[0]) return seeded[0]\n\n  // Lost the seed race to a concurrent first-reader.\n  const retry = await db\n    .select()\n    .from(systemSettings)\n    .where(eq(systemSettings.id, SETTINGS_ROW_ID))\n    .limit(1)\n  return retry[0] ?? fallbackSettings()\n}\n\nexport async function getSystemSettings(): Promise<SystemSettings> {\n  const now = Date.now()\n  if (cached && cached.expiresAt > now) return cached.value\n\n  try {\n    const value = await loadOrSeed()\n    cached = { value, expiresAt: now + CACHE_TTL_MS }\n    return value\n  } catch (error) {\n    console.error(\"Failed to load system settings, failing open:\", error)\n    return fallbackSettings() // not cached — retry next request\n  }\n}\n\nexport function invalidateSystemSettingsCache() {\n  cached = null\n}\n\nexport type SystemSettingsPatch = Partial<Pick<SystemSettings,\n  | 'maintenanceMode' | 'maintenanceMessage' | 'maintenanceExemptPaths'\n  | 'authEnableGoogle' | 'authEnableEmailPassword' | 'authEnableOneTap'\n  | 'enableSessionRevocation' | 'feedbackAttachErrors' | 'consentRequired'\n>>\n\nexport async function updateSystemSettings(\n  patch: SystemSettingsPatch,\n  updatedBy: string\n): Promise<SystemSettings> {\n  await loadOrSeed() // ensure the row exists even if nobody's read it yet\n\n  const [updated] = await db\n    .update(systemSettings)\n    .set({ ...patch, updatedAt: new Date(), updatedBy })\n    .where(eq(systemSettings.id, SETTINGS_ROW_ID))\n    .returning()\n\n  invalidateSystemSettingsCache()\n  return updated\n}\n\n// Effective auth-method visibility = deploy-time \"configured\" (env, decides\n// whether the provider is even registered with better-auth — see\n// server/auth.ts's createAuth()) AND runtime \"offered\" (this DB flag).\nexport async function getEffectiveAuthFlags() {\n  const settings = await getSystemSettings()\n  return {\n    google: config.AUTH_ENABLE_GOOGLE && settings.authEnableGoogle,\n    emailPassword: config.AUTH_ENABLE_EMAIL_PASSWORD && settings.authEnableEmailPassword,\n    oneTap: config.AUTH_ENABLE_ONE_TAP && settings.authEnableOneTap,\n  }\n}\n\n// Consent mode: the admin's choice if they've made one, else the\n// NEXT_PUBLIC_COOKIE_BANNER default (banner on unless it's \"false\").\nexport function isConsentRequired(settings: Pick<SystemSettings, 'consentRequired'>): boolean {\n  return settings.consentRequired ?? process.env.NEXT_PUBLIC_COOKIE_BANNER !== \"false\"\n}\n\n// The env-only half of the AND above. The System Settings page needs this\n// to explain *why* a toggle it controls isn't taking effect — flipping the\n// DB flag on can't do anything if the env var for that method is off, so\n// the UI should say so instead of looking like a silent no-op.\nexport function getConfiguredAuthFlags() {\n  return {\n    google: config.AUTH_ENABLE_GOOGLE,\n    emailPassword: config.AUTH_ENABLE_EMAIL_PASSWORD,\n    oneTap: config.AUTH_ENABLE_ONE_TAP,\n  }\n}\n"]}

package/dist/{chunk-TMJYAOC2.mjs → chunk-TKWNEKK6.mjs}

@@ -7,6 +7,12 @@ var envSchema = z.object({
   PORT: z.string().default("3000").transform(Number),
   DATABASE_URL: z.string().default(""),
   RESEND_API_KEY: z.string().default(""),
+  // Full access key for marketing broadcasts (admin Marketing email page).
+  // Blank = use RESEND_API_KEY.
+  RESEND_BROADCAST_API_KEY: z.string().default(""),
+  // Resend segment users join from the dashboard "Email updates" toggle.
+  // Blank = toggle hidden.
+  RESEND_MARKETING_SEGMENT_ID: z.string().default(""),
   // Sender for every transactional email. Must be on a domain verified in
   // your Resend account.
   EMAIL_FROM: z.string().default("Acme <onboarding@xavierkhew.xyz>"),
@@ -44,5 +50,5 @@ if (!results.success) {
 var config = results.data;
 
 export { config };
-//# sourceMappingURL=chunk-TMJYAOC2.mjs.map
-//# sourceMappingURL=chunk-TMJYAOC2.mjs.map
+//# sourceMappingURL=chunk-TKWNEKK6.mjs.map
+//# sourceMappingURL=chunk-TKWNEKK6.mjs.map

package/dist/chunk-TKWNEKK6.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../config/env-schema.ts","../config/env.ts"],"names":[],"mappings":";;;;AAMO,IAAM,SAAA,GAAY,EAAE,MAAA,CAAO;AAAA,EAChC,QAAA,EAAU,CAAA,CAAE,IAAA,CAAK,CAAC,aAAA,EAAe,cAAc,MAAM,CAAC,CAAA,CAAE,OAAA,CAAQ,aAAa,CAAA;AAAA,EAC7E,IAAA,EAAM,EAAE,MAAA,EAAO,CAAE,QAAQ,MAAM,CAAA,CAAE,UAAU,MAAM,CAAA;AAAA,EACjD,YAAA,EAAc,CAAA,CAAE,MAAA,EAAO,CAAE,QAAQ,EAAE,CAAA;AAAA,EACnC,cAAA,EAAgB,CAAA,CAAE,MAAA,EAAO,CAAE,QAAQ,EAAE,CAAA;AAAA;AAAA;AAAA,EAGrC,wBAAA,EAA0B,CAAA,CAAE,MAAA,EAAO,CAAE,QAAQ,EAAE,CAAA;AAAA;AAAA;AAAA,EAG/C,2BAAA,EAA6B,CAAA,CAAE,MAAA,EAAO,CAAE,QAAQ,EAAE,CAAA;AAAA;AAAA;AAAA,EAGlD,UAAA,EAAY,CAAA,CAAE,MAAA,EAAO,CAAE,QAAQ,kCAAkC,CAAA;AAAA;AAAA;AAAA;AAAA,EAIjE,QAAA,EAAU,CAAA,CAAE,MAAA,EAAO,CAAE,QAAQ,kBAAkB,CAAA;AAAA;AAAA;AAAA;AAAA,EAI/C,4BAAA,EAA8B,CAAA,CAAE,MAAA,EAAO,CAAE,QAAQ,EAAE,CAAA;AAAA,EACnD,cAAA,EAAgB,CAAA,CAAE,MAAA,EAAO,CAAE,QAAQ,EAAE,CAAA;AAAA;AAAA;AAAA;AAAA,EAIrC,yBAAA,EAA2B,CAAA,CAAE,MAAA,EAAO,CAAE,OAAA,CAAQ,MAAM,CAAA,CAAE,SAAA,CAAU,CAAA,GAAA,KAAO,GAAA,KAAQ,MAAM,CAAA;AAAA,EACrF,kBAAA,EAAoB,CAAA,CAAE,MAAA,EAAO,CAAE,OAAA,CAAQ,MAAM,CAAA,CAAE,SAAA,CAAU,CAAA,GAAA,KAAO,GAAA,KAAQ,MAAM,CAAA;AAAA,EAC9E,0BAAA,EAA4B,CAAA,CAAE,MAAA,EAAO,CAAE,OAAA,CAAQ,MAAM,CAAA,CAAE,SAAA,CAAU,CAAA,GAAA,KAAO,GAAA,KAAQ,MAAM,CAAA;AAAA,EACtF,mBAAA,EAAqB,CAAA,CAAE,MAAA,EAAO,CAAE,OAAA,CAAQ,OAAO,CAAA,CAAE,SAAA,CAAU,CAAA,GAAA,KAAO,GAAA,KAAQ,MAAM,CAAA;AAAA,EAChF,SAAA,EAAW,EAAE,IAAA,CAAK,CAAC,MAAM,MAAM,CAAC,CAAA,CAAE,OAAA,CAAQ,IAAI,CAAA;AAAA;AAAA;AAAA,EAG9C,YAAA,EAAc,CAAA,CAAE,MAAA,EAAO,CAAE,OAAA,CAAQ,OAAO,CAAA,CAAE,SAAA,CAAU,CAAA,GAAA,KAAO,GAAA,KAAQ,MAAM;AAC3E,CAAC,CAAA;;;ACrCD,IAAM,OAAA,GAAU,SAAA,CAAU,SAAA,CAAU,OAAA,CAAQ,GAAG,CAAA;AAE/C,IAAI,OAAA,CAAQ,OAAA,IAAY,OAAA,CAAQ,IAAA,CAAK,aAAa,aAAA,EAAgB;AAChE,EAAA,OAAA,CAAQ,IAAI,+BAAA,EAAiC,MAAA,CAAO,IAAA,CAAK,OAAA,CAAQ,IAAI,CAAC,CAAA;AACxE;AAEA,IAAI,CAAC,QAAQ,OAAA,EAAS;AACpB,EAAA,OAAA,CAAQ,KAAA,CAAM,gCAAA,EAAkC,OAAA,CAAQ,KAAA,CAAM,QAAQ,CAAA;AACtE,EAAA,MAAM,IAAI,MAAM,+BAA+B,CAAA;AACjD;AAEO,IAAM,SAAS,OAAA,CAAQ","file":"chunk-TKWNEKK6.mjs","sourcesContent":["// No \"server-only\" guard here — this schema is also imported by scripts that\n// run outside Next.js's bundler (e.g. scripts/doctor.ts), where that guard\n// throws unconditionally. config/env.ts re-exports the parsed, guarded result\n// for app code; import this file directly only from non-Next scripts.\nimport { z } from 'zod';\n\nexport const envSchema = z.object({\n  NODE_ENV: z.enum(['development', 'production', 'test']).default('development'),\n  PORT: z.string().default('3000').transform(Number),\n  DATABASE_URL: z.string().default(''),\n  RESEND_API_KEY: z.string().default(''),\n  // Full access key for marketing broadcasts (admin Marketing email page).\n  // Blank = use RESEND_API_KEY.\n  RESEND_BROADCAST_API_KEY: z.string().default(''),\n  // Resend segment users join from the dashboard \"Email updates\" toggle.\n  // Blank = toggle hidden.\n  RESEND_MARKETING_SEGMENT_ID: z.string().default(''),\n  // Sender for every transactional email. Must be on a domain verified in\n  // your Resend account.\n  EMAIL_FROM: z.string().default('Acme <onboarding@xavierkhew.xyz>'),\n  // Display name for this deployment — shown as the authenticator-app label\n  // (2FA issuer) and the passkey relying-party name. Consuming projects set\n  // this in their own .env; defaults to the template name.\n  APP_NAME: z.string().default('Next.js Template'),\n  // Where the dashboard feedback form delivers (app/api/feedback). Set either\n  // or both; with neither, the Feedback button is hidden. FEEDBACK_EMAIL takes\n  // a comma-separated list and sends through Resend (needs RESEND_API_KEY).\n  FEEDBACK_DISCORD_WEBHOOK_URL: z.string().default(''),\n  FEEDBACK_EMAIL: z.string().default(''),\n  // Seed-only: the live value lives in the system_settings DB row (see\n  // lib/settings-queries.ts) once it's been seeded on first read, and is\n  // changed from the admin System Settings page, not by editing this var.\n  ENABLE_SESSION_REVOCATION: z.string().default('true').transform(val => val === 'true'),\n  AUTH_ENABLE_GOOGLE: z.string().default('true').transform(val => val === 'true'),\n  AUTH_ENABLE_EMAIL_PASSWORD: z.string().default('true').transform(val => val === 'true'),\n  AUTH_ENABLE_ONE_TAP: z.string().default('false').transform(val => val === 'true'),\n  DB_DRIVER: z.enum(['pg', 'neon']).default('pg'),\n  // Only relevant when DB_DRIVER=pg — whether the target Postgres server has SSL\n  // enabled. Self-hosted Postgres (e.g. via Docker/Dokploy) typically does not.\n  DATABASE_SSL: z.string().default('false').transform(val => val === 'true'),\n});\n","import \"server-only\";\nimport { envSchema } from './env-schema';\n\nconst results = envSchema.safeParse(process.env);\n\nif (results.success && (results.data.NODE_ENV === 'development')) {\n  console.log('Environment variables loaded:', Object.keys(results.data));\n}\n\nif (!results.success) {\n  console.error('Invalid environment variables:', results.error.format());\n  throw new Error('Invalid environment variables');\n}\n\nexport const config = results.data;\n"]}

package/dist/{chunk-F7CG5CA3.mjs → chunk-ZJMFE5B2.mjs}

@@ -1,5 +1,5 @@
 import { schema_exports } from './chunk-TR5XFBTD.mjs';
-import { config } from './chunk-TMJYAOC2.mjs';
+import { config } from './chunk-TKWNEKK6.mjs';
 import 'server-only';
 import { neon } from '@neondatabase/serverless';
 import { drizzle as drizzle$1 } from 'drizzle-orm/neon-http';
@@ -26,5 +26,5 @@ if (config.DB_DRIVER === "pg") {
 }
 
 export { db };
-//# sourceMappingURL=chunk-F7CG5CA3.mjs.map
-//# sourceMappingURL=chunk-F7CG5CA3.mjs.map
+//# sourceMappingURL=chunk-ZJMFE5B2.mjs.map
+//# sourceMappingURL=chunk-ZJMFE5B2.mjs.map

package/dist/{chunk-F7CG5CA3.mjs.map → chunk-ZJMFE5B2.mjs.map}

@@ -1 +1 @@
-{"version":3,"sources":["../server/db/index.ts"],"names":["drizzlePg","drizzle"],"mappings":";;;;;;;;AAoBA,IAAI;AAGJ,IAAI,MAAA,CAAO,cAAc,IAAA,EAAM;AAC7B,EAAA,MAAM,IAAA,GAAO,IAAI,IAAA,CAAK;AAAA,IACpB,kBAAkB,MAAA,CAAO,YAAA;AAAA,IACzB,KAAK,MAAA,CAAO,YAAA,GAAe,EAAE,kBAAA,EAAoB,OAAM,GAAI;AAAA,GAC5D,CAAA;AACD,EAAA,EAAA,GAAKA,QAAU,IAAA,EAAM;AAAA,IACnB,MAAA,EAAA,cAAA;AAAA,IACA,MAAA,EAAQ;AAAA,GACT,CAAA;AAED,EAAA,OAAA,CAAQ,IAAI,wCAAiC,CAAA;AAE/C,CAAA,MAAA,IAAW,MAAA,CAAO,cAAc,MAAA,EAAQ;AACtC,EAAA,MAAM,GAAA,GAAM,IAAA,CAAK,MAAA,CAAO,YAAa,CAAA;AACrC,EAAA,EAAA,GAAKC,UAAQ,GAAA,EAAK,EAAE,MAAA,EAAA,cAAA,EAAQ,MAAA,EAAQ,MAAM,CAAA;AAE1C,EAAA,OAAA,CAAQ,IAAI,oCAA6B,CAAA;AAE3C,CAAA,MAAO;AACL,EAAA,OAAA,CAAQ,GAAA,CAAI,yDAAA,EAA2D,MAAA,CAAO,SAAS,CAAA;AACzF","file":"chunk-F7CG5CA3.mjs","sourcesContent":["import 'server-only';\n\n// neon-http driver for production\nimport { neon } from '@neondatabase/serverless';\nimport { drizzle } from 'drizzle-orm/neon-http';\n\n// postgres driver for local development\nimport { drizzle as drizzlePg } from 'drizzle-orm/node-postgres';\nimport { Pool } from 'pg';\n\nimport * as schema from './schema';\nimport { config } from '../../config/env';\n\n// Import the query builder\nimport { PostgresJsDatabase } from 'drizzle-orm/postgres-js';\nimport { NeonHttpDatabase } from 'drizzle-orm/neon-http';\n\ntype DrizzleNeon = NeonHttpDatabase<typeof schema>;\ntype DrizzlePg = PostgresJsDatabase<typeof schema>;\n\nlet db: DrizzleNeon | DrizzlePg\n\n\nif (config.DB_DRIVER === 'pg') {\n  const pool = new Pool({\n    connectionString: config.DATABASE_URL!,\n    ssl: config.DATABASE_SSL ? { rejectUnauthorized: false } : undefined,\n  });\n  db = drizzlePg(pool, {\n    schema,\n    logger: true,\n  });\n\n  console.log('🟡 Using PostgreSQL (pg) driver');\n\n} else if (config.DB_DRIVER === 'neon') {\n  const sql = neon(config.DATABASE_URL!);\n  db = drizzle(sql, { schema, logger: true });\n\n  console.log('🟢 Using Neon (HTTP) driver');\n\n} else {\n  console.log('Database connection not established, unknown DB_DRIVER:', config.DB_DRIVER);\n}\n// Note: In production, you might want to disable logging or use a more sophisticated logger.\n\nexport { db }"]}
+{"version":3,"sources":["../server/db/index.ts"],"names":["drizzlePg","drizzle"],"mappings":";;;;;;;;AAoBA,IAAI;AAGJ,IAAI,MAAA,CAAO,cAAc,IAAA,EAAM;AAC7B,EAAA,MAAM,IAAA,GAAO,IAAI,IAAA,CAAK;AAAA,IACpB,kBAAkB,MAAA,CAAO,YAAA;AAAA,IACzB,KAAK,MAAA,CAAO,YAAA,GAAe,EAAE,kBAAA,EAAoB,OAAM,GAAI;AAAA,GAC5D,CAAA;AACD,EAAA,EAAA,GAAKA,QAAU,IAAA,EAAM;AAAA,IACnB,MAAA,EAAA,cAAA;AAAA,IACA,MAAA,EAAQ;AAAA,GACT,CAAA;AAED,EAAA,OAAA,CAAQ,IAAI,wCAAiC,CAAA;AAE/C,CAAA,MAAA,IAAW,MAAA,CAAO,cAAc,MAAA,EAAQ;AACtC,EAAA,MAAM,GAAA,GAAM,IAAA,CAAK,MAAA,CAAO,YAAa,CAAA;AACrC,EAAA,EAAA,GAAKC,UAAQ,GAAA,EAAK,EAAE,MAAA,EAAA,cAAA,EAAQ,MAAA,EAAQ,MAAM,CAAA;AAE1C,EAAA,OAAA,CAAQ,IAAI,oCAA6B,CAAA;AAE3C,CAAA,MAAO;AACL,EAAA,OAAA,CAAQ,GAAA,CAAI,yDAAA,EAA2D,MAAA,CAAO,SAAS,CAAA;AACzF","file":"chunk-ZJMFE5B2.mjs","sourcesContent":["import 'server-only';\n\n// neon-http driver for production\nimport { neon } from '@neondatabase/serverless';\nimport { drizzle } from 'drizzle-orm/neon-http';\n\n// postgres driver for local development\nimport { drizzle as drizzlePg } from 'drizzle-orm/node-postgres';\nimport { Pool } from 'pg';\n\nimport * as schema from './schema';\nimport { config } from '../../config/env';\n\n// Import the query builder\nimport { PostgresJsDatabase } from 'drizzle-orm/postgres-js';\nimport { NeonHttpDatabase } from 'drizzle-orm/neon-http';\n\ntype DrizzleNeon = NeonHttpDatabase<typeof schema>;\ntype DrizzlePg = PostgresJsDatabase<typeof schema>;\n\nlet db: DrizzleNeon | DrizzlePg\n\n\nif (config.DB_DRIVER === 'pg') {\n  const pool = new Pool({\n    connectionString: config.DATABASE_URL!,\n    ssl: config.DATABASE_SSL ? { rejectUnauthorized: false } : undefined,\n  });\n  db = drizzlePg(pool, {\n    schema,\n    logger: true,\n  });\n\n  console.log('🟡 Using PostgreSQL (pg) driver');\n\n} else if (config.DB_DRIVER === 'neon') {\n  const sql = neon(config.DATABASE_URL!);\n  db = drizzle(sql, { schema, logger: true });\n\n  console.log('🟢 Using Neon (HTTP) driver');\n\n} else {\n  console.log('Database connection not established, unknown DB_DRIVER:', config.DB_DRIVER);\n}\n// Note: In production, you might want to disable logging or use a more sophisticated logger.\n\nexport { db }"]}

package/dist/config/env.d.mts

@@ -3,6 +3,8 @@ declare const config: {
     PORT: number;
     DATABASE_URL: string;
     RESEND_API_KEY: string;
+    RESEND_BROADCAST_API_KEY: string;
+    RESEND_MARKETING_SEGMENT_ID: string;
     EMAIL_FROM: string;
     APP_NAME: string;
     FEEDBACK_DISCORD_WEBHOOK_URL: string;

package/dist/config/env.d.ts

@@ -3,6 +3,8 @@ declare const config: {
     PORT: number;
     DATABASE_URL: string;
     RESEND_API_KEY: string;
+    RESEND_BROADCAST_API_KEY: string;
+    RESEND_MARKETING_SEGMENT_ID: string;
     EMAIL_FROM: string;
     APP_NAME: string;
     FEEDBACK_DISCORD_WEBHOOK_URL: string;

package/dist/config/env.js

@@ -9,6 +9,12 @@ var envSchema = zod.z.object({
   PORT: zod.z.string().default("3000").transform(Number),
   DATABASE_URL: zod.z.string().default(""),
   RESEND_API_KEY: zod.z.string().default(""),
+  // Full access key for marketing broadcasts (admin Marketing email page).
+  // Blank = use RESEND_API_KEY.
+  RESEND_BROADCAST_API_KEY: zod.z.string().default(""),
+  // Resend segment users join from the dashboard "Email updates" toggle.
+  // Blank = toggle hidden.
+  RESEND_MARKETING_SEGMENT_ID: zod.z.string().default(""),
   // Sender for every transactional email. Must be on a domain verified in
   // your Resend account.
   EMAIL_FROM: zod.z.string().default("Acme <onboarding@xavierkhew.xyz>"),

package/dist/config/env.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../config/env-schema.ts","../../config/env.ts"],"names":["z"],"mappings":";;;;;;AAMO,IAAM,SAAA,GAAYA,MAAE,MAAA,CAAO;AAAA,EAChC,QAAA,EAAUA,KAAA,CAAE,IAAA,CAAK,CAAC,aAAA,EAAe,cAAc,MAAM,CAAC,CAAA,CAAE,OAAA,CAAQ,aAAa,CAAA;AAAA,EAC7E,IAAA,EAAMA,MAAE,MAAA,EAAO,CAAE,QAAQ,MAAM,CAAA,CAAE,UAAU,MAAM,CAAA;AAAA,EACjD,YAAA,EAAcA,KAAA,CAAE,MAAA,EAAO,CAAE,QAAQ,EAAE,CAAA;AAAA,EACnC,cAAA,EAAgBA,KAAA,CAAE,MAAA,EAAO,CAAE,QAAQ,EAAE,CAAA;AAAA;AAAA;AAAA,EAGrC,UAAA,EAAYA,KAAA,CAAE,MAAA,EAAO,CAAE,QAAQ,kCAAkC,CAAA;AAAA;AAAA;AAAA;AAAA,EAIjE,QAAA,EAAUA,KAAA,CAAE,MAAA,EAAO,CAAE,QAAQ,kBAAkB,CAAA;AAAA;AAAA;AAAA;AAAA,EAI/C,4BAAA,EAA8BA,KAAA,CAAE,MAAA,EAAO,CAAE,QAAQ,EAAE,CAAA;AAAA,EACnD,cAAA,EAAgBA,KAAA,CAAE,MAAA,EAAO,CAAE,QAAQ,EAAE,CAAA;AAAA;AAAA;AAAA;AAAA,EAIrC,yBAAA,EAA2BA,KAAA,CAAE,MAAA,EAAO,CAAE,OAAA,CAAQ,MAAM,CAAA,CAAE,SAAA,CAAU,CAAA,GAAA,KAAO,GAAA,KAAQ,MAAM,CAAA;AAAA,EACrF,kBAAA,EAAoBA,KAAA,CAAE,MAAA,EAAO,CAAE,OAAA,CAAQ,MAAM,CAAA,CAAE,SAAA,CAAU,CAAA,GAAA,KAAO,GAAA,KAAQ,MAAM,CAAA;AAAA,EAC9E,0BAAA,EAA4BA,KAAA,CAAE,MAAA,EAAO,CAAE,OAAA,CAAQ,MAAM,CAAA,CAAE,SAAA,CAAU,CAAA,GAAA,KAAO,GAAA,KAAQ,MAAM,CAAA;AAAA,EACtF,mBAAA,EAAqBA,KAAA,CAAE,MAAA,EAAO,CAAE,OAAA,CAAQ,OAAO,CAAA,CAAE,SAAA,CAAU,CAAA,GAAA,KAAO,GAAA,KAAQ,MAAM,CAAA;AAAA,EAChF,SAAA,EAAWA,MAAE,IAAA,CAAK,CAAC,MAAM,MAAM,CAAC,CAAA,CAAE,OAAA,CAAQ,IAAI,CAAA;AAAA;AAAA;AAAA,EAG9C,YAAA,EAAcA,KAAA,CAAE,MAAA,EAAO,CAAE,OAAA,CAAQ,OAAO,CAAA,CAAE,SAAA,CAAU,CAAA,GAAA,KAAO,GAAA,KAAQ,MAAM;AAC3E,CAAC,CAAA;;;AC/BD,IAAM,OAAA,GAAU,SAAA,CAAU,SAAA,CAAU,OAAA,CAAQ,GAAG,CAAA;AAE/C,IAAI,OAAA,CAAQ,OAAA,IAAY,OAAA,CAAQ,IAAA,CAAK,aAAa,aAAA,EAAgB;AAChE,EAAA,OAAA,CAAQ,IAAI,+BAAA,EAAiC,MAAA,CAAO,IAAA,CAAK,OAAA,CAAQ,IAAI,CAAC,CAAA;AACxE;AAEA,IAAI,CAAC,QAAQ,OAAA,EAAS;AACpB,EAAA,OAAA,CAAQ,KAAA,CAAM,gCAAA,EAAkC,OAAA,CAAQ,KAAA,CAAM,QAAQ,CAAA;AACtE,EAAA,MAAM,IAAI,MAAM,+BAA+B,CAAA;AACjD;AAEO,IAAM,SAAS,OAAA,CAAQ","file":"env.js","sourcesContent":["// No \"server-only\" guard here — this schema is also imported by scripts that\n// run outside Next.js's bundler (e.g. scripts/doctor.ts), where that guard\n// throws unconditionally. config/env.ts re-exports the parsed, guarded result\n// for app code; import this file directly only from non-Next scripts.\nimport { z } from 'zod';\n\nexport const envSchema = z.object({\n  NODE_ENV: z.enum(['development', 'production', 'test']).default('development'),\n  PORT: z.string().default('3000').transform(Number),\n  DATABASE_URL: z.string().default(''),\n  RESEND_API_KEY: z.string().default(''),\n  // Sender for every transactional email. Must be on a domain verified in\n  // your Resend account.\n  EMAIL_FROM: z.string().default('Acme <onboarding@xavierkhew.xyz>'),\n  // Display name for this deployment — shown as the authenticator-app label\n  // (2FA issuer) and the passkey relying-party name. Consuming projects set\n  // this in their own .env; defaults to the template name.\n  APP_NAME: z.string().default('Next.js Template'),\n  // Where the dashboard feedback form delivers (app/api/feedback). Set either\n  // or both; with neither, the Feedback button is hidden. FEEDBACK_EMAIL takes\n  // a comma-separated list and sends through Resend (needs RESEND_API_KEY).\n  FEEDBACK_DISCORD_WEBHOOK_URL: z.string().default(''),\n  FEEDBACK_EMAIL: z.string().default(''),\n  // Seed-only: the live value lives in the system_settings DB row (see\n  // lib/settings-queries.ts) once it's been seeded on first read, and is\n  // changed from the admin System Settings page, not by editing this var.\n  ENABLE_SESSION_REVOCATION: z.string().default('true').transform(val => val === 'true'),\n  AUTH_ENABLE_GOOGLE: z.string().default('true').transform(val => val === 'true'),\n  AUTH_ENABLE_EMAIL_PASSWORD: z.string().default('true').transform(val => val === 'true'),\n  AUTH_ENABLE_ONE_TAP: z.string().default('false').transform(val => val === 'true'),\n  DB_DRIVER: z.enum(['pg', 'neon']).default('pg'),\n  // Only relevant when DB_DRIVER=pg — whether the target Postgres server has SSL\n  // enabled. Self-hosted Postgres (e.g. via Docker/Dokploy) typically does not.\n  DATABASE_SSL: z.string().default('false').transform(val => val === 'true'),\n});\n","import \"server-only\";\nimport { envSchema } from './env-schema';\n\nconst results = envSchema.safeParse(process.env);\n\nif (results.success && (results.data.NODE_ENV === 'development')) {\n  console.log('Environment variables loaded:', Object.keys(results.data));\n}\n\nif (!results.success) {\n  console.error('Invalid environment variables:', results.error.format());\n  throw new Error('Invalid environment variables');\n}\n\nexport const config = results.data;\n"]}
+{"version":3,"sources":["../../config/env-schema.ts","../../config/env.ts"],"names":["z"],"mappings":";;;;;;AAMO,IAAM,SAAA,GAAYA,MAAE,MAAA,CAAO;AAAA,EAChC,QAAA,EAAUA,KAAA,CAAE,IAAA,CAAK,CAAC,aAAA,EAAe,cAAc,MAAM,CAAC,CAAA,CAAE,OAAA,CAAQ,aAAa,CAAA;AAAA,EAC7E,IAAA,EAAMA,MAAE,MAAA,EAAO,CAAE,QAAQ,MAAM,CAAA,CAAE,UAAU,MAAM,CAAA;AAAA,EACjD,YAAA,EAAcA,KAAA,CAAE,MAAA,EAAO,CAAE,QAAQ,EAAE,CAAA;AAAA,EACnC,cAAA,EAAgBA,KAAA,CAAE,MAAA,EAAO,CAAE,QAAQ,EAAE,CAAA;AAAA;AAAA;AAAA,EAGrC,wBAAA,EAA0BA,KAAA,CAAE,MAAA,EAAO,CAAE,QAAQ,EAAE,CAAA;AAAA;AAAA;AAAA,EAG/C,2BAAA,EAA6BA,KAAA,CAAE,MAAA,EAAO,CAAE,QAAQ,EAAE,CAAA;AAAA;AAAA;AAAA,EAGlD,UAAA,EAAYA,KAAA,CAAE,MAAA,EAAO,CAAE,QAAQ,kCAAkC,CAAA;AAAA;AAAA;AAAA;AAAA,EAIjE,QAAA,EAAUA,KAAA,CAAE,MAAA,EAAO,CAAE,QAAQ,kBAAkB,CAAA;AAAA;AAAA;AAAA;AAAA,EAI/C,4BAAA,EAA8BA,KAAA,CAAE,MAAA,EAAO,CAAE,QAAQ,EAAE,CAAA;AAAA,EACnD,cAAA,EAAgBA,KAAA,CAAE,MAAA,EAAO,CAAE,QAAQ,EAAE,CAAA;AAAA;AAAA;AAAA;AAAA,EAIrC,yBAAA,EAA2BA,KAAA,CAAE,MAAA,EAAO,CAAE,OAAA,CAAQ,MAAM,CAAA,CAAE,SAAA,CAAU,CAAA,GAAA,KAAO,GAAA,KAAQ,MAAM,CAAA;AAAA,EACrF,kBAAA,EAAoBA,KAAA,CAAE,MAAA,EAAO,CAAE,OAAA,CAAQ,MAAM,CAAA,CAAE,SAAA,CAAU,CAAA,GAAA,KAAO,GAAA,KAAQ,MAAM,CAAA;AAAA,EAC9E,0BAAA,EAA4BA,KAAA,CAAE,MAAA,EAAO,CAAE,OAAA,CAAQ,MAAM,CAAA,CAAE,SAAA,CAAU,CAAA,GAAA,KAAO,GAAA,KAAQ,MAAM,CAAA;AAAA,EACtF,mBAAA,EAAqBA,KAAA,CAAE,MAAA,EAAO,CAAE,OAAA,CAAQ,OAAO,CAAA,CAAE,SAAA,CAAU,CAAA,GAAA,KAAO,GAAA,KAAQ,MAAM,CAAA;AAAA,EAChF,SAAA,EAAWA,MAAE,IAAA,CAAK,CAAC,MAAM,MAAM,CAAC,CAAA,CAAE,OAAA,CAAQ,IAAI,CAAA;AAAA;AAAA;AAAA,EAG9C,YAAA,EAAcA,KAAA,CAAE,MAAA,EAAO,CAAE,OAAA,CAAQ,OAAO,CAAA,CAAE,SAAA,CAAU,CAAA,GAAA,KAAO,GAAA,KAAQ,MAAM;AAC3E,CAAC,CAAA;;;ACrCD,IAAM,OAAA,GAAU,SAAA,CAAU,SAAA,CAAU,OAAA,CAAQ,GAAG,CAAA;AAE/C,IAAI,OAAA,CAAQ,OAAA,IAAY,OAAA,CAAQ,IAAA,CAAK,aAAa,aAAA,EAAgB;AAChE,EAAA,OAAA,CAAQ,IAAI,+BAAA,EAAiC,MAAA,CAAO,IAAA,CAAK,OAAA,CAAQ,IAAI,CAAC,CAAA;AACxE;AAEA,IAAI,CAAC,QAAQ,OAAA,EAAS;AACpB,EAAA,OAAA,CAAQ,KAAA,CAAM,gCAAA,EAAkC,OAAA,CAAQ,KAAA,CAAM,QAAQ,CAAA;AACtE,EAAA,MAAM,IAAI,MAAM,+BAA+B,CAAA;AACjD;AAEO,IAAM,SAAS,OAAA,CAAQ","file":"env.js","sourcesContent":["// No \"server-only\" guard here — this schema is also imported by scripts that\n// run outside Next.js's bundler (e.g. scripts/doctor.ts), where that guard\n// throws unconditionally. config/env.ts re-exports the parsed, guarded result\n// for app code; import this file directly only from non-Next scripts.\nimport { z } from 'zod';\n\nexport const envSchema = z.object({\n  NODE_ENV: z.enum(['development', 'production', 'test']).default('development'),\n  PORT: z.string().default('3000').transform(Number),\n  DATABASE_URL: z.string().default(''),\n  RESEND_API_KEY: z.string().default(''),\n  // Full access key for marketing broadcasts (admin Marketing email page).\n  // Blank = use RESEND_API_KEY.\n  RESEND_BROADCAST_API_KEY: z.string().default(''),\n  // Resend segment users join from the dashboard \"Email updates\" toggle.\n  // Blank = toggle hidden.\n  RESEND_MARKETING_SEGMENT_ID: z.string().default(''),\n  // Sender for every transactional email. Must be on a domain verified in\n  // your Resend account.\n  EMAIL_FROM: z.string().default('Acme <onboarding@xavierkhew.xyz>'),\n  // Display name for this deployment — shown as the authenticator-app label\n  // (2FA issuer) and the passkey relying-party name. Consuming projects set\n  // this in their own .env; defaults to the template name.\n  APP_NAME: z.string().default('Next.js Template'),\n  // Where the dashboard feedback form delivers (app/api/feedback). Set either\n  // or both; with neither, the Feedback button is hidden. FEEDBACK_EMAIL takes\n  // a comma-separated list and sends through Resend (needs RESEND_API_KEY).\n  FEEDBACK_DISCORD_WEBHOOK_URL: z.string().default(''),\n  FEEDBACK_EMAIL: z.string().default(''),\n  // Seed-only: the live value lives in the system_settings DB row (see\n  // lib/settings-queries.ts) once it's been seeded on first read, and is\n  // changed from the admin System Settings page, not by editing this var.\n  ENABLE_SESSION_REVOCATION: z.string().default('true').transform(val => val === 'true'),\n  AUTH_ENABLE_GOOGLE: z.string().default('true').transform(val => val === 'true'),\n  AUTH_ENABLE_EMAIL_PASSWORD: z.string().default('true').transform(val => val === 'true'),\n  AUTH_ENABLE_ONE_TAP: z.string().default('false').transform(val => val === 'true'),\n  DB_DRIVER: z.enum(['pg', 'neon']).default('pg'),\n  // Only relevant when DB_DRIVER=pg — whether the target Postgres server has SSL\n  // enabled. Self-hosted Postgres (e.g. via Docker/Dokploy) typically does not.\n  DATABASE_SSL: z.string().default('false').transform(val => val === 'true'),\n});\n","import \"server-only\";\nimport { envSchema } from './env-schema';\n\nconst results = envSchema.safeParse(process.env);\n\nif (results.success && (results.data.NODE_ENV === 'development')) {\n  console.log('Environment variables loaded:', Object.keys(results.data));\n}\n\nif (!results.success) {\n  console.error('Invalid environment variables:', results.error.format());\n  throw new Error('Invalid environment variables');\n}\n\nexport const config = results.data;\n"]}

package/dist/config/env.mjs

@@ -1,4 +1,4 @@
-export { config } from '../chunk-TMJYAOC2.mjs';
+export { config } from '../chunk-TKWNEKK6.mjs';
 import '../chunk-3465SI5N.mjs';
 //# sourceMappingURL=env.mjs.map
 //# sourceMappingURL=env.mjs.map

package/dist/db/index.js

@@ -262,6 +262,12 @@ var envSchema = zod.z.object({
   PORT: zod.z.string().default("3000").transform(Number),
   DATABASE_URL: zod.z.string().default(""),
   RESEND_API_KEY: zod.z.string().default(""),
+  // Full access key for marketing broadcasts (admin Marketing email page).
+  // Blank = use RESEND_API_KEY.
+  RESEND_BROADCAST_API_KEY: zod.z.string().default(""),
+  // Resend segment users join from the dashboard "Email updates" toggle.
+  // Blank = toggle hidden.
+  RESEND_MARKETING_SEGMENT_ID: zod.z.string().default(""),
   // Sender for every transactional email. Must be on a domain verified in
   // your Resend account.
   EMAIL_FROM: zod.z.string().default("Acme <onboarding@xavierkhew.xyz>"),

package/dist/db/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../server/db/schema.ts","../../lib/maintenance.ts","../../config/env-schema.ts","../../config/env.ts","../../server/db/index.ts"],"names":["pgEnum","pgTable","text","createId","boolean","timestamp","integer","jsonb","unique","index","check","sql","z","db","Pool","drizzlePg","neon","drizzle"],"mappings":";;;;;;;;;;;;;;;;;;;AAAA,IAAA,cAAA,GAAA,EAAA;AAAA,QAAA,CAAA,cAAA,EAAA;AAAA,EAAA,kBAAA,EAAA,MAAA,kBAAA;AAAA,EAAA,QAAA,EAAA,MAAA,QAAA;AAAA,EAAA,QAAA,EAAA,MAAA,QAAA;AAAA,EAAA,YAAA,EAAA,MAAA,YAAA;AAAA,EAAA,YAAA,EAAA,MAAA,YAAA;AAAA,EAAA,UAAA,EAAA,MAAA,UAAA;AAAA,EAAA,kBAAA,EAAA,MAAA,kBAAA;AAAA,EAAA,SAAA,EAAA,MAAA,SAAA;AAAA,EAAA,QAAA,EAAA,MAAA,QAAA;AAAA,EAAA,QAAA,EAAA,MAAA,QAAA;AAAA,EAAA,cAAA,EAAA,MAAA,cAAA;AAAA,EAAA,UAAA,EAAA,MAAA,UAAA;AAAA,EAAA,KAAA,EAAA,MAAA,KAAA;AAAA,EAAA,aAAA,EAAA,MAAA;AAAA,CAAA,CAAA;;;ACIO,IAAM,gCAAA,GAAmC;AAAA,EAC9C,GAAA;AAAA,EACA,WAAA;AAAA,EACA,YAAA;AAAA,EACA,qBAAA;AAAA,EACA,UAAA;AAAA,EACA;AACF,CAAA;;;ADJO,IAAM,WAAWA,aAAA,CAAO,OAAA,EAAS,CAAC,MAAA,EAAQ,OAAA,EAAS,QAAQ,CAAC,CAAA;AAE5D,IAAM,kBAAA,GAAqBA,cAAO,kBAAA,EAAoB;AAAA,EAC3D,OAAA;AAAA,EACA,QAAA;AAAA,EACA,cAAA;AAAA,EACA,kBAAA;AAAA,EACA,eAAA;AAAA,EACA,iBAAA;AAAA,EACA,iBAAA;AAAA,EACA,cAAA;AAAA,EACA,aAAA;AAAA,EACA,eAAA;AAAA,EACA,cAAA;AAAA,EACA,uBAAA;AAAA,EACA,uBAAA;AAAA,EACA,kBAAA;AAAA,EACA,eAAA;AAAA,EACA;AACF,CAAC,CAAA;AAEM,IAAM,KAAA,GAAQC,eAAQ,MAAA,EAAQ;AAAA,EACnC,EAAA,EAAIC,WAAA,CAAK,IAAI,CAAA,CAAE,OAAA,EAAQ,CAAE,UAAA,EAAW,CAAE,UAAA,CAAW,MAAMC,cAAA,EAAU,CAAA;AAAA,EACjE,IAAA,EAAMD,WAAA,CAAK,MAAM,CAAA,CAAE,OAAA,EAAQ;AAAA,EAC3B,OAAOA,WAAA,CAAK,OAAO,CAAA,CAAE,OAAA,GAAU,MAAA,EAAO;AAAA,EACtC,QAAA,EAAUA,YAAK,UAAU,CAAA;AAAA,EACzB,eAAeE,cAAA,CAAQ,eAAe,EAAE,OAAA,EAAQ,CAAE,QAAQ,KAAK,CAAA;AAAA,EAC/D,KAAA,EAAOF,YAAK,OAAO,CAAA;AAAA,EACnB,MAAM,QAAA,CAAS,OAAO,EAAE,OAAA,CAAQ,MAAM,EAAE,OAAA,EAAQ;AAAA,EAChD,QAAQE,cAAA,CAAQ,QAAQ,EAAE,OAAA,CAAQ,KAAK,EAAE,OAAA,EAAQ;AAAA,EACjD,QAAA,EAAUC,iBAAU,UAAU,CAAA;AAAA,EAC9B,YAAA,EAAcH,YAAK,cAAc,CAAA;AAAA;AAAA;AAAA;AAAA,EAIjC,UAAA,EAAYG,iBAAU,YAAY,CAAA;AAAA,EAClC,WAAA,EAAaA,iBAAU,aAAa,CAAA;AAAA,EACpC,YAAA,EAAcA,iBAAU,cAAc,CAAA;AAAA;AAAA;AAAA;AAAA,EAItC,kBAAkBD,cAAA,CAAQ,kBAAkB,EAAE,OAAA,EAAQ,CAAE,QAAQ,KAAK,CAAA;AAAA,EACrE,WAAWC,gBAAA,CAAU,WAAW,CAAA,CAAE,OAAA,GAAU,UAAA,EAAW;AAAA,EACvD,WAAWA,gBAAA,CAAU,WAAW,CAAA,CAAE,OAAA,GAAU,UAAA;AAC9C,CAAC,CAAA;AAEM,IAAM,QAAA,GAAWJ,eAAQ,SAAA,EAAW;AAAA,EACzC,EAAA,EAAIC,WAAA,CAAK,IAAI,CAAA,CAAE,OAAA,EAAQ,CAAE,UAAA,EAAW,CAAE,UAAA,CAAW,MAAMC,cAAA,EAAU,CAAA;AAAA,EACjE,SAAA,EAAWE,gBAAA,CAAU,WAAW,CAAA,CAAE,OAAA,EAAQ;AAAA,EAC1C,OAAOH,WAAA,CAAK,OAAO,CAAA,CAAE,OAAA,GAAU,MAAA,EAAO;AAAA,EACtC,WAAWG,gBAAA,CAAU,WAAW,CAAA,CAAE,OAAA,GAAU,UAAA,EAAW;AAAA,EACvD,WAAWA,gBAAA,CAAU,WAAW,CAAA,CAAE,OAAA,GAAU,UAAA,EAAW;AAAA,EACvD,SAAA,EAAWH,YAAK,WAAW,CAAA;AAAA,EAC3B,SAAA,EAAWA,YAAK,WAAW,CAAA;AAAA,EAC3B,MAAA,EAAQA,WAAA,CAAK,QAAQ,CAAA,CAClB,OAAA,EAAQ,CACR,UAAA,CAAW,MAAM,KAAA,CAAM,EAAA,EAAI,EAAE,QAAA,EAAU,WAAW,CAAA;AAAA;AAAA;AAAA,EAGrD,cAAA,EAAgBA,YAAK,gBAAgB;AACvC,CAAC,CAAA;AAEM,IAAM,QAAA,GAAWD,eAAQ,SAAA,EAAW;AAAA,EACzC,EAAA,EAAIC,WAAA,CAAK,IAAI,CAAA,CAAE,OAAA,EAAQ,CAAE,UAAA,EAAW,CAAE,UAAA,CAAW,MAAMC,cAAA,EAAU,CAAA;AAAA,EACjE,SAAA,EAAWD,WAAA,CAAK,WAAW,CAAA,CAAE,OAAA,EAAQ;AAAA,EACrC,UAAA,EAAYA,WAAA,CAAK,YAAY,CAAA,CAAE,OAAA,EAAQ;AAAA,EACvC,MAAA,EAAQA,WAAA,CAAK,QAAQ,CAAA,CAClB,OAAA,EAAQ,CACR,UAAA,CAAW,MAAM,KAAA,CAAM,EAAA,EAAI,EAAE,QAAA,EAAU,WAAW,CAAA;AAAA,EACrD,WAAA,EAAaA,YAAK,aAAa,CAAA;AAAA,EAC/B,YAAA,EAAcA,YAAK,cAAc,CAAA;AAAA,EACjC,OAAA,EAASA,YAAK,SAAS,CAAA;AAAA,EACvB,oBAAA,EAAsBG,iBAAU,sBAAsB,CAAA;AAAA,EACtD,qBAAA,EAAuBA,iBAAU,uBAAuB,CAAA;AAAA,EACxD,KAAA,EAAOH,YAAK,OAAO,CAAA;AAAA,EACnB,QAAA,EAAUA,YAAK,UAAU,CAAA;AAAA,EACzB,WAAWG,gBAAA,CAAU,WAAW,CAAA,CAAE,OAAA,GAAU,UAAA,EAAW;AAAA,EACvD,WAAWA,gBAAA,CAAU,WAAW,CAAA,CAAE,OAAA,GAAU,UAAA;AAC9C,CAAC,CAAA;AAMM,IAAM,UAAA,GAAaJ,eAAQ,WAAA,EAAa;AAAA,EAC7C,EAAA,EAAIC,WAAA,CAAK,IAAI,CAAA,CAAE,OAAA,EAAQ,CAAE,UAAA,EAAW,CAAE,UAAA,CAAW,MAAMC,cAAA,EAAU,CAAA;AAAA,EACjE,MAAA,EAAQD,WAAA,CAAK,QAAQ,CAAA,CAAE,OAAA,EAAQ;AAAA,EAC/B,WAAA,EAAaA,WAAA,CAAK,aAAa,CAAA,CAAE,OAAA,EAAQ;AAAA,EACzC,MAAA,EAAQA,WAAA,CAAK,QAAQ,CAAA,CAClB,OAAA,EAAQ,CACR,UAAA,CAAW,MAAM,KAAA,CAAM,EAAA,EAAI,EAAE,QAAA,EAAU,WAAW,CAAA;AAAA;AAAA,EAErD,QAAA,EAAUE,cAAA,CAAQ,UAAU,CAAA,CAAE,QAAQ,IAAI,CAAA;AAAA,EAC1C,uBAAA,EAAyBE,cAAA,CAAQ,yBAAyB,CAAA,CAAE,QAAQ,CAAC,CAAA;AAAA,EACrE,WAAA,EAAaD,iBAAU,aAAa;AACtC,CAAC,CAAA;AAGM,IAAM,QAAA,GAAWJ,eAAQ,SAAA,EAAW;AAAA,EACzC,EAAA,EAAIC,WAAA,CAAK,IAAI,CAAA,CAAE,OAAA,EAAQ,CAAE,UAAA,EAAW,CAAE,UAAA,CAAW,MAAMC,cAAA,EAAU,CAAA;AAAA,EACjE,IAAA,EAAMD,YAAK,MAAM,CAAA;AAAA,EACjB,SAAA,EAAWA,WAAA,CAAK,WAAW,CAAA,CAAE,OAAA,EAAQ;AAAA,EACrC,MAAA,EAAQA,WAAA,CAAK,QAAQ,CAAA,CAClB,OAAA,EAAQ,CACR,UAAA,CAAW,MAAM,KAAA,CAAM,EAAA,EAAI,EAAE,QAAA,EAAU,WAAW,CAAA;AAAA,EACrD,cAAcA,WAAA,CAAK,cAAc,CAAA,CAAE,OAAA,GAAU,MAAA,EAAO;AAAA,EACpD,OAAA,EAASI,cAAA,CAAQ,SAAS,CAAA,CAAE,OAAA,EAAQ;AAAA,EACpC,UAAA,EAAYJ,WAAA,CAAK,YAAY,CAAA,CAAE,OAAA,EAAQ;AAAA,EACvC,QAAA,EAAUE,cAAA,CAAQ,UAAU,CAAA,CAAE,OAAA,EAAQ;AAAA,EACtC,UAAA,EAAYF,YAAK,YAAY,CAAA;AAAA,EAC7B,SAAA,EAAWG,iBAAU,WAAW,CAAA;AAAA,EAChC,MAAA,EAAQH,YAAK,QAAQ;AACvB,CAAC,CAAA;AAEM,IAAM,aAAA,GAAgBD,eAAQ,cAAA,EAAgB;AAAA,EACnD,EAAA,EAAIC,WAAA,CAAK,IAAI,CAAA,CAAE,OAAA,EAAQ,CAAE,UAAA,EAAW,CAAE,UAAA,CAAW,MAAMC,cAAA,EAAU,CAAA;AAAA,EACjE,UAAA,EAAYD,WAAA,CAAK,YAAY,CAAA,CAAE,OAAA,EAAQ;AAAA,EACvC,KAAA,EAAOA,WAAA,CAAK,OAAO,CAAA,CAAE,OAAA,EAAQ;AAAA,EAC7B,SAAA,EAAWG,gBAAA,CAAU,WAAW,CAAA,CAAE,OAAA,EAAQ;AAAA,EAC1C,WAAWA,gBAAA,CAAU,WAAW,CAAA,CAAE,OAAA,GAAU,UAAA,EAAW;AAAA,EACvD,WAAWA,gBAAA,CAAU,WAAW,CAAA,CAAE,OAAA,GAAU,UAAA;AAC9C,CAAC,CAAA;AAEM,IAAM,YAAA,GAAeJ,eAAQ,cAAA,EAAgB;AAAA,EAClD,EAAA,EAAIC,WAAA,CAAK,IAAI,CAAA,CAAE,OAAA,EAAQ,CAAE,UAAA,EAAW,CAAE,UAAA,CAAW,MAAMC,cAAA,EAAU,CAAA;AAAA,EACjE,MAAA,EAAQD,WAAA,CAAK,QAAQ,CAAA,CAClB,OAAA,EAAQ,CACR,UAAA,CAAW,MAAM,KAAA,CAAM,EAAA,EAAI,EAAE,QAAA,EAAU,WAAW,CAAA;AAAA,EACrD,MAAA,EAAQ,kBAAA,CAAmB,QAAQ,CAAA,CAAE,OAAA,EAAQ;AAAA,EAC7C,WAAA,EAAaA,WAAA,CAAK,aAAa,CAAA,CAAE,OAAA,EAAQ;AAAA,EACzC,SAAA,EAAWA,YAAK,WAAW,CAAA;AAAA,EAC3B,SAAA,EAAWA,YAAK,WAAW,CAAA;AAAA,EAC3B,QAAA,EAAUA,YAAK,UAAU,CAAA;AAAA;AAAA;AAAA;AAAA,EAIzB,WAAA,EAAaA,YAAK,aAAa,CAAA;AAAA,EAC/B,EAAA,EAAIA,YAAK,IAAI,CAAA;AAAA,EACb,OAAA,EAASA,YAAK,SAAS,CAAA;AAAA,EACvB,UAAA,EAAYA,YAAK,YAAY,CAAA;AAAA,EAC7B,OAAA,EAASA,YAAK,SAAS,CAAA;AAAA,EACvB,IAAA,EAAMA,YAAK,MAAM,CAAA;AAAA,EACjB,WAAWG,gBAAA,CAAU,WAAW,CAAA,CAAE,OAAA,GAAU,UAAA;AAC9C,CAAC,CAAA;AAQM,IAAM,kBAAA,GAAqBJ,eAAQ,oBAAA,EAAsB;AAAA,EAC9D,EAAA,EAAIC,WAAA,CAAK,IAAI,CAAA,CAAE,OAAA,EAAQ,CAAE,UAAA,EAAW,CAAE,UAAA,CAAW,MAAMC,cAAA,EAAU,CAAA;AAAA,EACjE,MAAA,EAAQD,WAAA,CAAK,QAAQ,CAAA,CAClB,OAAA,EAAQ,CACR,UAAA,CAAW,MAAM,KAAA,CAAM,EAAA,EAAI,EAAE,QAAA,EAAU,WAAW,CAAA;AAAA,EACrD,SAAA,EAAWA,WAAA,CAAK,WAAW,CAAA,CAAE,OAAA,EAAQ;AAAA;AAAA;AAAA;AAAA;AAAA,EAKrC,SAAA,EAAWA,YAAK,WAAW,CAAA;AAAA,EAC3B,SAAA,EAAWA,YAAK,WAAW,CAAA;AAAA,EAC3B,OAAA,EAASA,YAAK,SAAS,CAAA;AAAA,EACvB,IAAA,EAAMA,YAAK,MAAM,CAAA;AAAA;AAAA;AAAA;AAAA,EAIjB,UAAA,EAAYK,YAAA,CAAM,YAAY,CAAA,CAAE,KAAA,EAA+B;AAAA,EAC/D,WAAWF,gBAAA,CAAU,WAAW,CAAA,CAAE,OAAA,GAAU,UAAA;AAC9C,CAAA,EAAG,CAAC,KAAA,KAAU;AAAA,EACZG,cAAO,iCAAiC,CAAA,CAAE,GAAG,KAAA,CAAM,MAAA,EAAQ,MAAM,SAAS;AAC5E,CAAC,CAAA;AAMM,IAAM,UAAA,GAAaP,eAAQ,aAAA,EAAe;AAAA,EAC/C,EAAA,EAAIC,WAAA,CAAK,IAAI,CAAA,CAAE,OAAA,EAAQ,CAAE,UAAA,EAAW,CAAE,UAAA,CAAW,MAAMC,cAAA,EAAU,CAAA;AAAA,EACjE,MAAA,EAAQD,WAAA,CAAK,QAAQ,CAAA,CAClB,OAAA,EAAQ,CACR,UAAA,CAAW,MAAM,KAAA,CAAM,EAAA,EAAI,EAAE,QAAA,EAAU,WAAW,CAAA;AAAA;AAAA,EAErD,MAAA,EAAQA,WAAA,CAAK,QAAQ,CAAA,CAAE,OAAA,EAAQ;AAAA;AAAA;AAAA,EAG/B,OAAA,EAASI,cAAA,CAAQ,SAAS,CAAA,CAAE,OAAA,EAAQ;AAAA;AAAA;AAAA;AAAA;AAAA,EAKpC,UAAA,EAAYJ,YAAK,YAAY,CAAA;AAAA,EAC7B,WAAWG,gBAAA,CAAU,WAAW,CAAA,CAAE,OAAA,GAAU,UAAA;AAC9C,CAAA,EAAG,CAAC,KAAA,KAAU;AAAA,EACZI,aAAM,sBAAsB,CAAA,CAAE,GAAG,KAAA,CAAM,MAAA,EAAQ,MAAM,SAAS,CAAA;AAAA,EAC9DD,cAAO,mBAAmB,CAAA,CAAE,GAAG,KAAA,CAAM,MAAA,EAAQ,MAAM,UAAU;AAC/D,CAAC,CAAA;AASM,IAAM,YAAA,GAAeP,eAAQ,eAAA,EAAiB;AAAA,EACnD,aAAaC,WAAA,CAAK,aAAa,CAAA,CAAE,OAAA,GAAU,UAAA,EAAW;AAAA,EACtD,OAAOI,cAAA,CAAQ,OAAO,EAAE,OAAA,EAAQ,CAAE,QAAQ,CAAC,CAAA;AAAA,EAC3C,aAAaD,gBAAA,CAAU,aAAa,CAAA,CAAE,OAAA,GAAU,UAAA,EAAW;AAAA;AAAA;AAAA;AAAA;AAAA,EAK3D,eAAeA,gBAAA,CAAU,eAAe,CAAA,CAAE,OAAA,GAAU,UAAA,EAAW;AAAA,EAC/D,SAAA,EAAWH,YAAK,WAAW,CAAA;AAAA,EAC3B,SAAA,EAAWA,YAAK,WAAW,CAAA;AAAA,EAC3B,SAAA,EAAWA,YAAK,WAAW,CAAA;AAAA,EAC3B,QAAA,EAAUA,YAAK,UAAU;AAAA;AAC3B,CAAC,CAAA;AAKM,IAAM,cAAA,GAAiBD,eAAQ,iBAAA,EAAmB;AAAA,EACvD,IAAIC,WAAA,CAAK,IAAI,EAAE,UAAA,EAAW,CAAE,QAAQ,SAAS,CAAA;AAAA,EAC7C,iBAAiBE,cAAA,CAAQ,iBAAiB,EAAE,OAAA,EAAQ,CAAE,QAAQ,KAAK,CAAA;AAAA,EACnE,kBAAA,EAAoBF,YAAK,oBAAoB,CAAA;AAAA;AAAA;AAAA,EAG7C,sBAAA,EAAwBA,YAAK,wBAAwB,CAAA,CAAE,OAAM,CAAE,OAAA,EAAQ,CAAE,OAAA,CAAQ,gCAAgC,CAAA;AAAA,EACjH,kBAAkBE,cAAA,CAAQ,kBAAkB,EAAE,OAAA,EAAQ,CAAE,QAAQ,IAAI,CAAA;AAAA,EACpE,yBAAyBA,cAAA,CAAQ,yBAAyB,EAAE,OAAA,EAAQ,CAAE,QAAQ,IAAI,CAAA;AAAA,EAClF,kBAAkBA,cAAA,CAAQ,kBAAkB,EAAE,OAAA,EAAQ,CAAE,QAAQ,KAAK,CAAA;AAAA,EACrE,yBAAyBA,cAAA,CAAQ,yBAAyB,EAAE,OAAA,EAAQ,CAAE,QAAQ,IAAI,CAAA;AAAA;AAAA;AAAA,EAGlF,sBAAsBA,cAAA,CAAQ,sBAAsB,EAAE,OAAA,EAAQ,CAAE,QAAQ,IAAI,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAO5E,eAAA,EAAiBA,eAAQ,iBAAiB,CAAA;AAAA,EAC1C,WAAWC,gBAAA,CAAU,WAAW,CAAA,CAAE,OAAA,GAAU,UAAA,EAAW;AAAA;AAAA;AAAA;AAAA,EAIvD,SAAA,EAAWH,WAAA,CAAK,WAAW,CAAA,CAAE,UAAA,CAAW,MAAM,KAAA,CAAM,EAAA,EAAI,EAAE,QAAA,EAAU,UAAA,EAAY;AAClF,CAAA,EAAG,CAAC,KAAA,KAAU;AAAA,EACZQ,YAAA,CAAM,2BAAA,EAA6BC,cAAA,CAAA,EAAM,KAAA,CAAM,EAAE,CAAA,YAAA,CAAc;AACjE,CAAC,CAAA;AAKM,IAAM,SAAA,GAAYV,eAAQ,YAAA,EAAc;AAAA,EAC7C,GAAA,EAAKC,WAAA,CAAK,KAAK,CAAA,CAAE,UAAA,EAAW;AAAA,EAC5B,OAAA,EAASA,WAAA,CAAK,SAAS,CAAA,CAAE,OAAA,EAAQ;AAAA,EACjC,MAAA,EAAQA,WAAA,CAAK,QAAQ,CAAA,CAAE,OAAA,EAAQ;AAAA,EAC/B,WAAWG,gBAAA,CAAU,WAAW,CAAA,CAAE,OAAA,GAAU,UAAA;AAC9C,CAAA,EAAG,CAAC,KAAA,KAAU;AAAA,EACZI,YAAA,CAAM,2BAA2B,CAAA,CAAE,EAAA,CAAG,MAAM,SAAS;AACvD,CAAC,CAAA;AEzQM,IAAM,SAAA,GAAYG,MAAE,MAAA,CAAO;AAAA,EAChC,QAAA,EAAUA,KAAA,CAAE,IAAA,CAAK,CAAC,aAAA,EAAe,cAAc,MAAM,CAAC,CAAA,CAAE,OAAA,CAAQ,aAAa,CAAA;AAAA,EAC7E,IAAA,EAAMA,MAAE,MAAA,EAAO,CAAE,QAAQ,MAAM,CAAA,CAAE,UAAU,MAAM,CAAA;AAAA,EACjD,YAAA,EAAcA,KAAA,CAAE,MAAA,EAAO,CAAE,QAAQ,EAAE,CAAA;AAAA,EACnC,cAAA,EAAgBA,KAAA,CAAE,MAAA,EAAO,CAAE,QAAQ,EAAE,CAAA;AAAA;AAAA;AAAA,EAGrC,UAAA,EAAYA,KAAA,CAAE,MAAA,EAAO,CAAE,QAAQ,kCAAkC,CAAA;AAAA;AAAA;AAAA;AAAA,EAIjE,QAAA,EAAUA,KAAA,CAAE,MAAA,EAAO,CAAE,QAAQ,kBAAkB,CAAA;AAAA;AAAA;AAAA;AAAA,EAI/C,4BAAA,EAA8BA,KAAA,CAAE,MAAA,EAAO,CAAE,QAAQ,EAAE,CAAA;AAAA,EACnD,cAAA,EAAgBA,KAAA,CAAE,MAAA,EAAO,CAAE,QAAQ,EAAE,CAAA;AAAA;AAAA;AAAA;AAAA,EAIrC,yBAAA,EAA2BA,KAAA,CAAE,MAAA,EAAO,CAAE,OAAA,CAAQ,MAAM,CAAA,CAAE,SAAA,CAAU,CAAA,GAAA,KAAO,GAAA,KAAQ,MAAM,CAAA;AAAA,EACrF,kBAAA,EAAoBA,KAAA,CAAE,MAAA,EAAO,CAAE,OAAA,CAAQ,MAAM,CAAA,CAAE,SAAA,CAAU,CAAA,GAAA,KAAO,GAAA,KAAQ,MAAM,CAAA;AAAA,EAC9E,0BAAA,EAA4BA,KAAA,CAAE,MAAA,EAAO,CAAE,OAAA,CAAQ,MAAM,CAAA,CAAE,SAAA,CAAU,CAAA,GAAA,KAAO,GAAA,KAAQ,MAAM,CAAA;AAAA,EACtF,mBAAA,EAAqBA,KAAA,CAAE,MAAA,EAAO,CAAE,OAAA,CAAQ,OAAO,CAAA,CAAE,SAAA,CAAU,CAAA,GAAA,KAAO,GAAA,KAAQ,MAAM,CAAA;AAAA,EAChF,SAAA,EAAWA,MAAE,IAAA,CAAK,CAAC,MAAM,MAAM,CAAC,CAAA,CAAE,OAAA,CAAQ,IAAI,CAAA;AAAA;AAAA;AAAA,EAG9C,YAAA,EAAcA,KAAA,CAAE,MAAA,EAAO,CAAE,OAAA,CAAQ,OAAO,CAAA,CAAE,SAAA,CAAU,CAAA,GAAA,KAAO,GAAA,KAAQ,MAAM;AAC3E,CAAC,CAAA;;;AC/BD,IAAM,OAAA,GAAU,SAAA,CAAU,SAAA,CAAU,OAAA,CAAQ,GAAG,CAAA;AAE/C,IAAI,OAAA,CAAQ,OAAA,IAAY,OAAA,CAAQ,IAAA,CAAK,aAAa,aAAA,EAAgB;AAChE,EAAA,OAAA,CAAQ,IAAI,+BAAA,EAAiC,MAAA,CAAO,IAAA,CAAK,OAAA,CAAQ,IAAI,CAAC,CAAA;AACxE;AAEA,IAAI,CAAC,QAAQ,OAAA,EAAS;AACpB,EAAA,OAAA,CAAQ,KAAA,CAAM,gCAAA,EAAkC,OAAA,CAAQ,KAAA,CAAM,QAAQ,CAAA;AACtE,EAAA,MAAM,IAAI,MAAM,+BAA+B,CAAA;AACjD;AAEO,IAAM,SAAS,OAAA,CAAQ,IAAA;;;ACM1BC;AAGJ,IAAI,MAAA,CAAO,cAAc,IAAA,EAAM;AAC7B,EAAA,MAAM,IAAA,GAAO,IAAIC,OAAA,CAAK;AAAA,IACpB,kBAAkB,MAAA,CAAO,YAAA;AAAA,IACzB,KAAK,MAAA,CAAO,YAAA,GAAe,EAAE,kBAAA,EAAoB,OAAM,GAAI;AAAA,GAC5D,CAAA;AACD,EAAAD,UAAA,GAAKE,qBAAU,IAAA,EAAM;AAAA,IACnB,MAAA,EAAA,cAAA;AAAA,IACA,MAAA,EAAQ;AAAA,GACT,CAAA;AAED,EAAA,OAAA,CAAQ,IAAI,wCAAiC,CAAA;AAE/C,CAAA,MAAA,IAAW,MAAA,CAAO,cAAc,MAAA,EAAQ;AACtC,EAAA,MAAMJ,IAAAA,GAAMK,eAAA,CAAK,MAAA,CAAO,YAAa,CAAA;AACrC,EAAAH,UAAA,GAAKI,iBAAQN,IAAAA,EAAK,EAAE,MAAA,EAAA,cAAA,EAAQ,MAAA,EAAQ,MAAM,CAAA;AAE1C,EAAA,OAAA,CAAQ,IAAI,oCAA6B,CAAA;AAE3C,CAAA,MAAO;AACL,EAAA,OAAA,CAAQ,GAAA,CAAI,yDAAA,EAA2D,MAAA,CAAO,SAAS,CAAA;AACzF","file":"index.js","sourcesContent":["import { boolean, check, index, integer, jsonb, pgEnum, pgTable, text, timestamp, unique } from \"drizzle-orm/pg-core\";\nimport { sql } from \"drizzle-orm\";\nimport { createId } from '@paralleldrive/cuid2'\nimport { DEFAULT_MAINTENANCE_EXEMPT_PATHS } from \"../../lib/maintenance\";\n\n// 'tester' is a regular user account flagged for testing; apps can use it to\n// keep test accounts apart from real users. It has no admin access.\nexport const RoleEnum = pgEnum('roles', ['user', 'admin', 'tester'])\n\nexport const ActivityActionEnum = pgEnum('activity_actions', [\n  'login',\n  'logout',\n  'login_failed',\n  'password_changed',\n  'email_changed',\n  'profile_updated',\n  'session_revoked',\n  'user_deleted',\n  'user_banned',\n  'user_unbanned',\n  'role_changed',\n  'impersonation_started',\n  'impersonation_stopped',\n  'settings_changed',\n  'passkey_added',\n  'passkey_removed',\n])\n\nexport const users = pgTable(\"user\", {\n  id: text(\"id\").notNull().primaryKey().$defaultFn(() => createId()),\n  name: text('name').notNull(),\n  email: text('email').notNull().unique(),\n  password: text('password'),\n  emailVerified: boolean(\"emailVerified\").notNull().default(false),\n  image: text(\"image\"),\n  role: RoleEnum('roles').default('user').notNull(),\n  banned: boolean('banned').default(false).notNull(),\n  bannedAt: timestamp('bannedAt'),\n  bannedReason: text('bannedReason'),\n  // Required by better-auth's admin plugin schema (auto-expiring bans). We\n  // never set this ourselves, so it stays null and bans behave as permanent,\n  // same as before the plugin was added.\n  banExpires: timestamp('banExpires'),\n  lastLoginAt: timestamp('lastLoginAt'),\n  lastActiveAt: timestamp('lastActiveAt'),\n  // Set by better-auth's twoFactor plugin — true once the user has\n  // completed TOTP setup (see twoFactor pgTable below for the secret /\n  // backup codes themselves).\n  twoFactorEnabled: boolean('twoFactorEnabled').notNull().default(false),\n  createdAt: timestamp('createdAt').notNull().defaultNow(),\n  updatedAt: timestamp('updatedAt').notNull().defaultNow(),\n});\n\nexport const sessions = pgTable(\"session\", {\n  id: text(\"id\").notNull().primaryKey().$defaultFn(() => createId()),\n  expiresAt: timestamp(\"expiresAt\").notNull(),\n  token: text(\"token\").notNull().unique(),\n  createdAt: timestamp(\"createdAt\").notNull().defaultNow(),\n  updatedAt: timestamp(\"updatedAt\").notNull().defaultNow(),\n  ipAddress: text(\"ipAddress\"),\n  userAgent: text(\"userAgent\"),\n  userId: text(\"userId\")\n    .notNull()\n    .references(() => users.id, { onDelete: \"cascade\" }),\n  // Set by better-auth's admin plugin while this session is an admin\n  // impersonating another user; holds the impersonating admin's user id.\n  impersonatedBy: text(\"impersonatedBy\"),\n});\n\nexport const accounts = pgTable(\"account\", {\n  id: text(\"id\").notNull().primaryKey().$defaultFn(() => createId()),\n  accountId: text(\"accountId\").notNull(),\n  providerId: text(\"providerId\").notNull(),\n  userId: text(\"userId\")\n    .notNull()\n    .references(() => users.id, { onDelete: \"cascade\" }),\n  accessToken: text(\"accessToken\"),\n  refreshToken: text(\"refreshToken\"),\n  idToken: text(\"idToken\"),\n  accessTokenExpiresAt: timestamp(\"accessTokenExpiresAt\"),\n  refreshTokenExpiresAt: timestamp(\"refreshTokenExpiresAt\"),\n  scope: text(\"scope\"),\n  password: text(\"password\"),\n  createdAt: timestamp(\"createdAt\").notNull().defaultNow(),\n  updatedAt: timestamp(\"updatedAt\").notNull().defaultNow(),\n});\n\n// Better-auth's twoFactor plugin. One row per user (created on first\n// `enable`); secret and backupCodes are its own encrypted-at-rest strings,\n// field names/types must match its expectations exactly (drizzleAdapter in\n// server/auth.ts maps this table to the plugin's \"twoFactor\" model as-is).\nexport const twoFactors = pgTable(\"twoFactor\", {\n  id: text(\"id\").notNull().primaryKey().$defaultFn(() => createId()),\n  secret: text(\"secret\").notNull(),\n  backupCodes: text(\"backupCodes\").notNull(),\n  userId: text(\"userId\")\n    .notNull()\n    .references(() => users.id, { onDelete: \"cascade\" }),\n  // Added in better-auth 1.7 (TOTP lockout). Defaults match the plugin's.\n  verified: boolean(\"verified\").default(true),\n  failedVerificationCount: integer(\"failedVerificationCount\").default(0),\n  lockedUntil: timestamp(\"lockedUntil\"),\n});\n\n// Better-auth's passkey plugin — one row per registered WebAuthn credential.\nexport const passkeys = pgTable(\"passkey\", {\n  id: text(\"id\").notNull().primaryKey().$defaultFn(() => createId()),\n  name: text(\"name\"),\n  publicKey: text(\"publicKey\").notNull(),\n  userId: text(\"userId\")\n    .notNull()\n    .references(() => users.id, { onDelete: \"cascade\" }),\n  credentialID: text(\"credentialID\").notNull().unique(),\n  counter: integer(\"counter\").notNull(),\n  deviceType: text(\"deviceType\").notNull(),\n  backedUp: boolean(\"backedUp\").notNull(),\n  transports: text(\"transports\"),\n  createdAt: timestamp(\"createdAt\"),\n  aaguid: text(\"aaguid\"),\n});\n\nexport const verifications = pgTable(\"verification\", {\n  id: text(\"id\").notNull().primaryKey().$defaultFn(() => createId()),\n  identifier: text(\"identifier\").notNull(),\n  value: text(\"value\").notNull(),\n  expiresAt: timestamp(\"expiresAt\").notNull(),\n  createdAt: timestamp(\"createdAt\").notNull().defaultNow(),\n  updatedAt: timestamp(\"updatedAt\").notNull().defaultNow(),\n});\n\nexport const activityLogs = pgTable(\"activity_log\", {\n  id: text(\"id\").notNull().primaryKey().$defaultFn(() => createId()),\n  userId: text(\"userId\")\n    .notNull()\n    .references(() => users.id, { onDelete: \"cascade\" }),\n  action: ActivityActionEnum('action').notNull(),\n  description: text('description').notNull(),\n  ipAddress: text('ipAddress'),\n  userAgent: text('userAgent'),\n  metadata: text('metadata'),\n  // Populated on 'login' events only (registration + sign-in) — parsed from\n  // userAgent/ipAddress at write time so the record stays stable even if\n  // the parsing library or geoip database changes later.\n  referrerUrl: text('referrerUrl'),\n  os: text('os'),\n  browser: text('browser'),\n  deviceType: text('deviceType'),\n  country: text('country'),\n  city: text('city'),\n  createdAt: timestamp('createdAt').notNull().defaultNow(),\n});\n\n// One row per (user, device fingerprint) pair. Its only job is to answer\n// \"has this account signed in from this device before?\" — no matching row ⇒\n// send a new-device alert (see app/api/device-check/route.ts). visitorId is\n// FingerprintJS's identifier, computed client-side in\n// components/auth/deviceCheck.tsx. UA+IP are deliberately NOT the signal here:\n// they churn constantly on mobile and would alert on every other login.\nexport const deviceFingerprints = pgTable(\"device_fingerprint\", {\n  id: text(\"id\").notNull().primaryKey().$defaultFn(() => createId()),\n  userId: text(\"userId\")\n    .notNull()\n    .references(() => users.id, { onDelete: \"cascade\" }),\n  visitorId: text(\"visitorId\").notNull(),\n  // Context captured at first-seen time — for the admin panel's \"New devices\"\n  // card and the alert email. Not part of the new-vs-known decision (that's\n  // visitorId only), just so an admin can eyeball whether a sign-in looks like\n  // a hijack. Nullable: an old row predates these columns, or geoip missed.\n  ipAddress: text(\"ipAddress\"),\n  userAgent: text(\"userAgent\"),\n  country: text(\"country\"),\n  city: text(\"city\"),\n  // Latest FingerprintJS signals for this device (lib/device-fingerprint.ts\n  // getDeviceSignals(): accessibility signals dropped, large values hashed),\n  // shown on the admin user page. Null for rows from before this column.\n  components: jsonb(\"components\").$type<Record<string, unknown>>(),\n  createdAt: timestamp(\"createdAt\").notNull().defaultNow(),\n}, (table) => [\n  unique(\"device_fingerprint_user_visitor\").on(table.userId, table.visitorId),\n]);\n\n// Proof of cookie consent (GDPR Art. 7(1): the controller must be able to\n// demonstrate consent). One row per choice a signed-in user makes, written by\n// app/api/consent from the banner (components/site/cookie-banner.tsx).\n// Deliberately minimal — no IP/UA. Deleted with the account.\nexport const consentLog = pgTable(\"consent_log\", {\n  id: text(\"id\").notNull().primaryKey().$defaultFn(() => createId()),\n  userId: text(\"userId\")\n    .notNull()\n    .references(() => users.id, { onDelete: \"cascade\" }),\n  // The cookie_consent value: \"all\", \"necessary\" or a comma list of purposes.\n  choice: text(\"choice\").notNull(),\n  // CONSENT_VERSION (lib/cookie-names.ts) at the time — which banner/policy\n  // wording the user agreed to.\n  version: integer(\"version\").notNull(),\n  // id of the user's record this one follows (\"\" for their first). Unique per\n  // user, so concurrent posts from several tabs that all saw the same latest\n  // record can't each insert a duplicate — one wins, the rest conflict. Works\n  // without transactions (neon-http has none). Null on rows from before it.\n  previousId: text(\"previousId\"),\n  createdAt: timestamp(\"createdAt\").notNull().defaultNow(),\n}, (table) => [\n  index(\"consent_log_user_idx\").on(table.userId, table.createdAt),\n  unique(\"consent_log_chain\").on(table.userId, table.previousId),\n]);\n\n// Per-device abuse throttle for /sign-in/email and /sign-up/email — one\n// fixed-window counter row per FingerprintJS visitorId (sent by the auth\n// forms as the x-device-fingerprint header; see lib/auth-throttle.ts).\n// Keyed by device, not IP: IP is shared behind corporate NAT / CGNAT / VPN,\n// so an IP counter throttles coworkers together while missing an abuser who\n// rotates IPs. Rows untouched for 30 days are deleted (RETENTION_MS in\n// lib/auth-throttle-limits.ts, swept by lib/auth-throttle.ts).\nexport const authThrottle = pgTable(\"auth_throttle\", {\n  fingerprint: text(\"fingerprint\").notNull().primaryKey(),\n  count: integer(\"count\").notNull().default(0),\n  windowStart: timestamp(\"windowStart\").notNull().defaultNow(),\n  // Blockable data points, overwritten on every attempt (last-write-wins) so\n  // the admin panel can show who to block — by IP or by fingerprint — with no\n  // join and no per-attempt history table. windowStart anchors the counter's\n  // window; lastAttemptAt is just \"most recently seen\".\n  lastAttemptAt: timestamp(\"lastAttemptAt\").notNull().defaultNow(),\n  ipAddress: text(\"ipAddress\"),\n  userAgent: text(\"userAgent\"),\n  lastEmail: text(\"lastEmail\"),\n  lastKind: text(\"lastKind\"), // 'signin' | 'signup'\n});\n\n// Singleton row (id is always 'default') holding admin-editable settings for\n// config that used to be env-var-only. See lib/settings-queries.ts for the\n// cached read path and lazy-seed-from-env behavior.\nexport const systemSettings = pgTable(\"system_settings\", {\n  id: text(\"id\").primaryKey().default(\"default\"),\n  maintenanceMode: boolean(\"maintenanceMode\").notNull().default(false),\n  maintenanceMessage: text(\"maintenanceMessage\"),\n  // Path prefixes that stay reachable while maintenance mode is on (see\n  // lib/maintenance.ts — a few auth paths are always open on top of these).\n  maintenanceExemptPaths: text(\"maintenanceExemptPaths\").array().notNull().default(DEFAULT_MAINTENANCE_EXEMPT_PATHS),\n  authEnableGoogle: boolean(\"authEnableGoogle\").notNull().default(true),\n  authEnableEmailPassword: boolean(\"authEnableEmailPassword\").notNull().default(true),\n  authEnableOneTap: boolean(\"authEnableOneTap\").notNull().default(false),\n  enableSessionRevocation: boolean(\"enableSessionRevocation\").notNull().default(true),\n  // Attach the error a user hit to feedback they send from it (see\n  // lib/feedback-route.ts). Off = only what the user typed is sent.\n  feedbackAttachErrors: boolean(\"feedbackAttachErrors\").notNull().default(true),\n  // GDPR/ePrivacy consent mode. On: cookie banner, FingerprintJS and One Tap\n  // only after \"Accept all\", device record erased on withdrawal. Off (no EU/UK\n  // users): no banner, treated as consented. Null = follow\n  // NEXT_PUBLIC_COOKIE_BANNER (nullable so migrating never flips a deployed\n  // banner on or off). proxy.ts mirrors the effective value into the\n  // consent_required cookie for the client (lib/cookie-consent.ts).\n  consentRequired: boolean(\"consentRequired\"),\n  updatedAt: timestamp(\"updatedAt\").notNull().defaultNow(),\n  // Who last changed a setting. This row doesn't \"belong\" to that admin the\n  // way sessions/activityLogs belong to their user, so deleting that admin's\n  // account should null this out rather than cascade-delete the singleton row.\n  updatedBy: text(\"updatedBy\").references(() => users.id, { onDelete: \"set null\" }),\n}, (table) => [\n  check(\"system_settings_singleton\", sql`${table.id} = 'default'`),\n]);\n// Technical detail of unexpected errors, keyed by the short ref the user sees\n// (\"... (ref: K7Q2PX)\", see lib/errors.ts). Never sent to the browser: the\n// feedback route looks a ref up and attaches the detail to the report it\n// sends to Discord/email. Rows older than 30 days are pruned on insert.\nexport const errorRefs = pgTable(\"error_refs\", {\n  ref: text(\"ref\").primaryKey(),\n  message: text(\"message\").notNull(),\n  detail: text(\"detail\").notNull(),\n  createdAt: timestamp(\"createdAt\").notNull().defaultNow(),\n}, (table) => [\n  index(\"error_refs_created_at_idx\").on(table.createdAt),\n]);\n","// Pure path logic for maintenance mode — no DB / server-only imports, so it\n// can run in proxy.ts and in the admin form alike.\n\n// Default for the admin-editable exempt list: the public marketing pages.\nexport const DEFAULT_MAINTENANCE_EXEMPT_PATHS = [\n  \"/\",\n  \"/features\",\n  \"/changelog\",\n  \"/changelog-template\",\n  \"/privacy\",\n  \"/terms\",\n]\n\n// Always reachable, whatever the admin saves — otherwise an admin could\n// lock themselves out of the sign-in flow needed to turn maintenance off.\nexport const ALWAYS_OPEN_PATHS = [\n  \"/maintenance\",\n  \"/login\", // includes /login/2fa\n  \"/forgot-password\",\n  \"/reset-password\",\n  \"/api/auth\",\n  \"/api/settings/public\", // login page reads the One Tap flag from here\n]\n\n// `/foo` matches `/foo` and `/foo/...` but not `/foobar`; `/` matches only `/`.\nfunction matches(pathname: string, prefix: string) {\n  const p = prefix.length > 1 ? prefix.replace(/\\/+$/, \"\") : prefix\n  return pathname === p || (p !== \"/\" && pathname.startsWith(p + \"/\"))\n}\n\nexport function isMaintenanceExempt(pathname: string, exemptPaths: string[]) {\n  return [...ALWAYS_OPEN_PATHS, ...exemptPaths].some((p) => matches(pathname, p))\n}\n","// No \"server-only\" guard here — this schema is also imported by scripts that\n// run outside Next.js's bundler (e.g. scripts/doctor.ts), where that guard\n// throws unconditionally. config/env.ts re-exports the parsed, guarded result\n// for app code; import this file directly only from non-Next scripts.\nimport { z } from 'zod';\n\nexport const envSchema = z.object({\n  NODE_ENV: z.enum(['development', 'production', 'test']).default('development'),\n  PORT: z.string().default('3000').transform(Number),\n  DATABASE_URL: z.string().default(''),\n  RESEND_API_KEY: z.string().default(''),\n  // Sender for every transactional email. Must be on a domain verified in\n  // your Resend account.\n  EMAIL_FROM: z.string().default('Acme <onboarding@xavierkhew.xyz>'),\n  // Display name for this deployment — shown as the authenticator-app label\n  // (2FA issuer) and the passkey relying-party name. Consuming projects set\n  // this in their own .env; defaults to the template name.\n  APP_NAME: z.string().default('Next.js Template'),\n  // Where the dashboard feedback form delivers (app/api/feedback). Set either\n  // or both; with neither, the Feedback button is hidden. FEEDBACK_EMAIL takes\n  // a comma-separated list and sends through Resend (needs RESEND_API_KEY).\n  FEEDBACK_DISCORD_WEBHOOK_URL: z.string().default(''),\n  FEEDBACK_EMAIL: z.string().default(''),\n  // Seed-only: the live value lives in the system_settings DB row (see\n  // lib/settings-queries.ts) once it's been seeded on first read, and is\n  // changed from the admin System Settings page, not by editing this var.\n  ENABLE_SESSION_REVOCATION: z.string().default('true').transform(val => val === 'true'),\n  AUTH_ENABLE_GOOGLE: z.string().default('true').transform(val => val === 'true'),\n  AUTH_ENABLE_EMAIL_PASSWORD: z.string().default('true').transform(val => val === 'true'),\n  AUTH_ENABLE_ONE_TAP: z.string().default('false').transform(val => val === 'true'),\n  DB_DRIVER: z.enum(['pg', 'neon']).default('pg'),\n  // Only relevant when DB_DRIVER=pg — whether the target Postgres server has SSL\n  // enabled. Self-hosted Postgres (e.g. via Docker/Dokploy) typically does not.\n  DATABASE_SSL: z.string().default('false').transform(val => val === 'true'),\n});\n","import \"server-only\";\nimport { envSchema } from './env-schema';\n\nconst results = envSchema.safeParse(process.env);\n\nif (results.success && (results.data.NODE_ENV === 'development')) {\n  console.log('Environment variables loaded:', Object.keys(results.data));\n}\n\nif (!results.success) {\n  console.error('Invalid environment variables:', results.error.format());\n  throw new Error('Invalid environment variables');\n}\n\nexport const config = results.data;\n","import 'server-only';\n\n// neon-http driver for production\nimport { neon } from '@neondatabase/serverless';\nimport { drizzle } from 'drizzle-orm/neon-http';\n\n// postgres driver for local development\nimport { drizzle as drizzlePg } from 'drizzle-orm/node-postgres';\nimport { Pool } from 'pg';\n\nimport * as schema from './schema';\nimport { config } from '../../config/env';\n\n// Import the query builder\nimport { PostgresJsDatabase } from 'drizzle-orm/postgres-js';\nimport { NeonHttpDatabase } from 'drizzle-orm/neon-http';\n\ntype DrizzleNeon = NeonHttpDatabase<typeof schema>;\ntype DrizzlePg = PostgresJsDatabase<typeof schema>;\n\nlet db: DrizzleNeon | DrizzlePg\n\n\nif (config.DB_DRIVER === 'pg') {\n  const pool = new Pool({\n    connectionString: config.DATABASE_URL!,\n    ssl: config.DATABASE_SSL ? { rejectUnauthorized: false } : undefined,\n  });\n  db = drizzlePg(pool, {\n    schema,\n    logger: true,\n  });\n\n  console.log('🟡 Using PostgreSQL (pg) driver');\n\n} else if (config.DB_DRIVER === 'neon') {\n  const sql = neon(config.DATABASE_URL!);\n  db = drizzle(sql, { schema, logger: true });\n\n  console.log('🟢 Using Neon (HTTP) driver');\n\n} else {\n  console.log('Database connection not established, unknown DB_DRIVER:', config.DB_DRIVER);\n}\n// Note: In production, you might want to disable logging or use a more sophisticated logger.\n\nexport { db }"]}
+{"version":3,"sources":["../../server/db/schema.ts","../../lib/maintenance.ts","../../config/env-schema.ts","../../config/env.ts","../../server/db/index.ts"],"names":["pgEnum","pgTable","text","createId","boolean","timestamp","integer","jsonb","unique","index","check","sql","z","db","Pool","drizzlePg","neon","drizzle"],"mappings":";;;;;;;;;;;;;;;;;;;AAAA,IAAA,cAAA,GAAA,EAAA;AAAA,QAAA,CAAA,cAAA,EAAA;AAAA,EAAA,kBAAA,EAAA,MAAA,kBAAA;AAAA,EAAA,QAAA,EAAA,MAAA,QAAA;AAAA,EAAA,QAAA,EAAA,MAAA,QAAA;AAAA,EAAA,YAAA,EAAA,MAAA,YAAA;AAAA,EAAA,YAAA,EAAA,MAAA,YAAA;AAAA,EAAA,UAAA,EAAA,MAAA,UAAA;AAAA,EAAA,kBAAA,EAAA,MAAA,kBAAA;AAAA,EAAA,SAAA,EAAA,MAAA,SAAA;AAAA,EAAA,QAAA,EAAA,MAAA,QAAA;AAAA,EAAA,QAAA,EAAA,MAAA,QAAA;AAAA,EAAA,cAAA,EAAA,MAAA,cAAA;AAAA,EAAA,UAAA,EAAA,MAAA,UAAA;AAAA,EAAA,KAAA,EAAA,MAAA,KAAA;AAAA,EAAA,aAAA,EAAA,MAAA;AAAA,CAAA,CAAA;;;ACIO,IAAM,gCAAA,GAAmC;AAAA,EAC9C,GAAA;AAAA,EACA,WAAA;AAAA,EACA,YAAA;AAAA,EACA,qBAAA;AAAA,EACA,UAAA;AAAA,EACA;AACF,CAAA;;;ADJO,IAAM,WAAWA,aAAA,CAAO,OAAA,EAAS,CAAC,MAAA,EAAQ,OAAA,EAAS,QAAQ,CAAC,CAAA;AAE5D,IAAM,kBAAA,GAAqBA,cAAO,kBAAA,EAAoB;AAAA,EAC3D,OAAA;AAAA,EACA,QAAA;AAAA,EACA,cAAA;AAAA,EACA,kBAAA;AAAA,EACA,eAAA;AAAA,EACA,iBAAA;AAAA,EACA,iBAAA;AAAA,EACA,cAAA;AAAA,EACA,aAAA;AAAA,EACA,eAAA;AAAA,EACA,cAAA;AAAA,EACA,uBAAA;AAAA,EACA,uBAAA;AAAA,EACA,kBAAA;AAAA,EACA,eAAA;AAAA,EACA;AACF,CAAC,CAAA;AAEM,IAAM,KAAA,GAAQC,eAAQ,MAAA,EAAQ;AAAA,EACnC,EAAA,EAAIC,WAAA,CAAK,IAAI,CAAA,CAAE,OAAA,EAAQ,CAAE,UAAA,EAAW,CAAE,UAAA,CAAW,MAAMC,cAAA,EAAU,CAAA;AAAA,EACjE,IAAA,EAAMD,WAAA,CAAK,MAAM,CAAA,CAAE,OAAA,EAAQ;AAAA,EAC3B,OAAOA,WAAA,CAAK,OAAO,CAAA,CAAE,OAAA,GAAU,MAAA,EAAO;AAAA,EACtC,QAAA,EAAUA,YAAK,UAAU,CAAA;AAAA,EACzB,eAAeE,cAAA,CAAQ,eAAe,EAAE,OAAA,EAAQ,CAAE,QAAQ,KAAK,CAAA;AAAA,EAC/D,KAAA,EAAOF,YAAK,OAAO,CAAA;AAAA,EACnB,MAAM,QAAA,CAAS,OAAO,EAAE,OAAA,CAAQ,MAAM,EAAE,OAAA,EAAQ;AAAA,EAChD,QAAQE,cAAA,CAAQ,QAAQ,EAAE,OAAA,CAAQ,KAAK,EAAE,OAAA,EAAQ;AAAA,EACjD,QAAA,EAAUC,iBAAU,UAAU,CAAA;AAAA,EAC9B,YAAA,EAAcH,YAAK,cAAc,CAAA;AAAA;AAAA;AAAA;AAAA,EAIjC,UAAA,EAAYG,iBAAU,YAAY,CAAA;AAAA,EAClC,WAAA,EAAaA,iBAAU,aAAa,CAAA;AAAA,EACpC,YAAA,EAAcA,iBAAU,cAAc,CAAA;AAAA;AAAA;AAAA;AAAA,EAItC,kBAAkBD,cAAA,CAAQ,kBAAkB,EAAE,OAAA,EAAQ,CAAE,QAAQ,KAAK,CAAA;AAAA,EACrE,WAAWC,gBAAA,CAAU,WAAW,CAAA,CAAE,OAAA,GAAU,UAAA,EAAW;AAAA,EACvD,WAAWA,gBAAA,CAAU,WAAW,CAAA,CAAE,OAAA,GAAU,UAAA;AAC9C,CAAC,CAAA;AAEM,IAAM,QAAA,GAAWJ,eAAQ,SAAA,EAAW;AAAA,EACzC,EAAA,EAAIC,WAAA,CAAK,IAAI,CAAA,CAAE,OAAA,EAAQ,CAAE,UAAA,EAAW,CAAE,UAAA,CAAW,MAAMC,cAAA,EAAU,CAAA;AAAA,EACjE,SAAA,EAAWE,gBAAA,CAAU,WAAW,CAAA,CAAE,OAAA,EAAQ;AAAA,EAC1C,OAAOH,WAAA,CAAK,OAAO,CAAA,CAAE,OAAA,GAAU,MAAA,EAAO;AAAA,EACtC,WAAWG,gBAAA,CAAU,WAAW,CAAA,CAAE,OAAA,GAAU,UAAA,EAAW;AAAA,EACvD,WAAWA,gBAAA,CAAU,WAAW,CAAA,CAAE,OAAA,GAAU,UAAA,EAAW;AAAA,EACvD,SAAA,EAAWH,YAAK,WAAW,CAAA;AAAA,EAC3B,SAAA,EAAWA,YAAK,WAAW,CAAA;AAAA,EAC3B,MAAA,EAAQA,WAAA,CAAK,QAAQ,CAAA,CAClB,OAAA,EAAQ,CACR,UAAA,CAAW,MAAM,KAAA,CAAM,EAAA,EAAI,EAAE,QAAA,EAAU,WAAW,CAAA;AAAA;AAAA;AAAA,EAGrD,cAAA,EAAgBA,YAAK,gBAAgB;AACvC,CAAC,CAAA;AAEM,IAAM,QAAA,GAAWD,eAAQ,SAAA,EAAW;AAAA,EACzC,EAAA,EAAIC,WAAA,CAAK,IAAI,CAAA,CAAE,OAAA,EAAQ,CAAE,UAAA,EAAW,CAAE,UAAA,CAAW,MAAMC,cAAA,EAAU,CAAA;AAAA,EACjE,SAAA,EAAWD,WAAA,CAAK,WAAW,CAAA,CAAE,OAAA,EAAQ;AAAA,EACrC,UAAA,EAAYA,WAAA,CAAK,YAAY,CAAA,CAAE,OAAA,EAAQ;AAAA,EACvC,MAAA,EAAQA,WAAA,CAAK,QAAQ,CAAA,CAClB,OAAA,EAAQ,CACR,UAAA,CAAW,MAAM,KAAA,CAAM,EAAA,EAAI,EAAE,QAAA,EAAU,WAAW,CAAA;AAAA,EACrD,WAAA,EAAaA,YAAK,aAAa,CAAA;AAAA,EAC/B,YAAA,EAAcA,YAAK,cAAc,CAAA;AAAA,EACjC,OAAA,EAASA,YAAK,SAAS,CAAA;AAAA,EACvB,oBAAA,EAAsBG,iBAAU,sBAAsB,CAAA;AAAA,EACtD,qBAAA,EAAuBA,iBAAU,uBAAuB,CAAA;AAAA,EACxD,KAAA,EAAOH,YAAK,OAAO,CAAA;AAAA,EACnB,QAAA,EAAUA,YAAK,UAAU,CAAA;AAAA,EACzB,WAAWG,gBAAA,CAAU,WAAW,CAAA,CAAE,OAAA,GAAU,UAAA,EAAW;AAAA,EACvD,WAAWA,gBAAA,CAAU,WAAW,CAAA,CAAE,OAAA,GAAU,UAAA;AAC9C,CAAC,CAAA;AAMM,IAAM,UAAA,GAAaJ,eAAQ,WAAA,EAAa;AAAA,EAC7C,EAAA,EAAIC,WAAA,CAAK,IAAI,CAAA,CAAE,OAAA,EAAQ,CAAE,UAAA,EAAW,CAAE,UAAA,CAAW,MAAMC,cAAA,EAAU,CAAA;AAAA,EACjE,MAAA,EAAQD,WAAA,CAAK,QAAQ,CAAA,CAAE,OAAA,EAAQ;AAAA,EAC/B,WAAA,EAAaA,WAAA,CAAK,aAAa,CAAA,CAAE,OAAA,EAAQ;AAAA,EACzC,MAAA,EAAQA,WAAA,CAAK,QAAQ,CAAA,CAClB,OAAA,EAAQ,CACR,UAAA,CAAW,MAAM,KAAA,CAAM,EAAA,EAAI,EAAE,QAAA,EAAU,WAAW,CAAA;AAAA;AAAA,EAErD,QAAA,EAAUE,cAAA,CAAQ,UAAU,CAAA,CAAE,QAAQ,IAAI,CAAA;AAAA,EAC1C,uBAAA,EAAyBE,cAAA,CAAQ,yBAAyB,CAAA,CAAE,QAAQ,CAAC,CAAA;AAAA,EACrE,WAAA,EAAaD,iBAAU,aAAa;AACtC,CAAC,CAAA;AAGM,IAAM,QAAA,GAAWJ,eAAQ,SAAA,EAAW;AAAA,EACzC,EAAA,EAAIC,WAAA,CAAK,IAAI,CAAA,CAAE,OAAA,EAAQ,CAAE,UAAA,EAAW,CAAE,UAAA,CAAW,MAAMC,cAAA,EAAU,CAAA;AAAA,EACjE,IAAA,EAAMD,YAAK,MAAM,CAAA;AAAA,EACjB,SAAA,EAAWA,WAAA,CAAK,WAAW,CAAA,CAAE,OAAA,EAAQ;AAAA,EACrC,MAAA,EAAQA,WAAA,CAAK,QAAQ,CAAA,CAClB,OAAA,EAAQ,CACR,UAAA,CAAW,MAAM,KAAA,CAAM,EAAA,EAAI,EAAE,QAAA,EAAU,WAAW,CAAA;AAAA,EACrD,cAAcA,WAAA,CAAK,cAAc,CAAA,CAAE,OAAA,GAAU,MAAA,EAAO;AAAA,EACpD,OAAA,EAASI,cAAA,CAAQ,SAAS,CAAA,CAAE,OAAA,EAAQ;AAAA,EACpC,UAAA,EAAYJ,WAAA,CAAK,YAAY,CAAA,CAAE,OAAA,EAAQ;AAAA,EACvC,QAAA,EAAUE,cAAA,CAAQ,UAAU,CAAA,CAAE,OAAA,EAAQ;AAAA,EACtC,UAAA,EAAYF,YAAK,YAAY,CAAA;AAAA,EAC7B,SAAA,EAAWG,iBAAU,WAAW,CAAA;AAAA,EAChC,MAAA,EAAQH,YAAK,QAAQ;AACvB,CAAC,CAAA;AAEM,IAAM,aAAA,GAAgBD,eAAQ,cAAA,EAAgB;AAAA,EACnD,EAAA,EAAIC,WAAA,CAAK,IAAI,CAAA,CAAE,OAAA,EAAQ,CAAE,UAAA,EAAW,CAAE,UAAA,CAAW,MAAMC,cAAA,EAAU,CAAA;AAAA,EACjE,UAAA,EAAYD,WAAA,CAAK,YAAY,CAAA,CAAE,OAAA,EAAQ;AAAA,EACvC,KAAA,EAAOA,WAAA,CAAK,OAAO,CAAA,CAAE,OAAA,EAAQ;AAAA,EAC7B,SAAA,EAAWG,gBAAA,CAAU,WAAW,CAAA,CAAE,OAAA,EAAQ;AAAA,EAC1C,WAAWA,gBAAA,CAAU,WAAW,CAAA,CAAE,OAAA,GAAU,UAAA,EAAW;AAAA,EACvD,WAAWA,gBAAA,CAAU,WAAW,CAAA,CAAE,OAAA,GAAU,UAAA;AAC9C,CAAC,CAAA;AAEM,IAAM,YAAA,GAAeJ,eAAQ,cAAA,EAAgB;AAAA,EAClD,EAAA,EAAIC,WAAA,CAAK,IAAI,CAAA,CAAE,OAAA,EAAQ,CAAE,UAAA,EAAW,CAAE,UAAA,CAAW,MAAMC,cAAA,EAAU,CAAA;AAAA,EACjE,MAAA,EAAQD,WAAA,CAAK,QAAQ,CAAA,CAClB,OAAA,EAAQ,CACR,UAAA,CAAW,MAAM,KAAA,CAAM,EAAA,EAAI,EAAE,QAAA,EAAU,WAAW,CAAA;AAAA,EACrD,MAAA,EAAQ,kBAAA,CAAmB,QAAQ,CAAA,CAAE,OAAA,EAAQ;AAAA,EAC7C,WAAA,EAAaA,WAAA,CAAK,aAAa,CAAA,CAAE,OAAA,EAAQ;AAAA,EACzC,SAAA,EAAWA,YAAK,WAAW,CAAA;AAAA,EAC3B,SAAA,EAAWA,YAAK,WAAW,CAAA;AAAA,EAC3B,QAAA,EAAUA,YAAK,UAAU,CAAA;AAAA;AAAA;AAAA;AAAA,EAIzB,WAAA,EAAaA,YAAK,aAAa,CAAA;AAAA,EAC/B,EAAA,EAAIA,YAAK,IAAI,CAAA;AAAA,EACb,OAAA,EAASA,YAAK,SAAS,CAAA;AAAA,EACvB,UAAA,EAAYA,YAAK,YAAY,CAAA;AAAA,EAC7B,OAAA,EAASA,YAAK,SAAS,CAAA;AAAA,EACvB,IAAA,EAAMA,YAAK,MAAM,CAAA;AAAA,EACjB,WAAWG,gBAAA,CAAU,WAAW,CAAA,CAAE,OAAA,GAAU,UAAA;AAC9C,CAAC,CAAA;AAQM,IAAM,kBAAA,GAAqBJ,eAAQ,oBAAA,EAAsB;AAAA,EAC9D,EAAA,EAAIC,WAAA,CAAK,IAAI,CAAA,CAAE,OAAA,EAAQ,CAAE,UAAA,EAAW,CAAE,UAAA,CAAW,MAAMC,cAAA,EAAU,CAAA;AAAA,EACjE,MAAA,EAAQD,WAAA,CAAK,QAAQ,CAAA,CAClB,OAAA,EAAQ,CACR,UAAA,CAAW,MAAM,KAAA,CAAM,EAAA,EAAI,EAAE,QAAA,EAAU,WAAW,CAAA;AAAA,EACrD,SAAA,EAAWA,WAAA,CAAK,WAAW,CAAA,CAAE,OAAA,EAAQ;AAAA;AAAA;AAAA;AAAA;AAAA,EAKrC,SAAA,EAAWA,YAAK,WAAW,CAAA;AAAA,EAC3B,SAAA,EAAWA,YAAK,WAAW,CAAA;AAAA,EAC3B,OAAA,EAASA,YAAK,SAAS,CAAA;AAAA,EACvB,IAAA,EAAMA,YAAK,MAAM,CAAA;AAAA;AAAA;AAAA;AAAA,EAIjB,UAAA,EAAYK,YAAA,CAAM,YAAY,CAAA,CAAE,KAAA,EAA+B;AAAA,EAC/D,WAAWF,gBAAA,CAAU,WAAW,CAAA,CAAE,OAAA,GAAU,UAAA;AAC9C,CAAA,EAAG,CAAC,KAAA,KAAU;AAAA,EACZG,cAAO,iCAAiC,CAAA,CAAE,GAAG,KAAA,CAAM,MAAA,EAAQ,MAAM,SAAS;AAC5E,CAAC,CAAA;AAMM,IAAM,UAAA,GAAaP,eAAQ,aAAA,EAAe;AAAA,EAC/C,EAAA,EAAIC,WAAA,CAAK,IAAI,CAAA,CAAE,OAAA,EAAQ,CAAE,UAAA,EAAW,CAAE,UAAA,CAAW,MAAMC,cAAA,EAAU,CAAA;AAAA,EACjE,MAAA,EAAQD,WAAA,CAAK,QAAQ,CAAA,CAClB,OAAA,EAAQ,CACR,UAAA,CAAW,MAAM,KAAA,CAAM,EAAA,EAAI,EAAE,QAAA,EAAU,WAAW,CAAA;AAAA;AAAA,EAErD,MAAA,EAAQA,WAAA,CAAK,QAAQ,CAAA,CAAE,OAAA,EAAQ;AAAA;AAAA;AAAA,EAG/B,OAAA,EAASI,cAAA,CAAQ,SAAS,CAAA,CAAE,OAAA,EAAQ;AAAA;AAAA;AAAA;AAAA;AAAA,EAKpC,UAAA,EAAYJ,YAAK,YAAY,CAAA;AAAA,EAC7B,WAAWG,gBAAA,CAAU,WAAW,CAAA,CAAE,OAAA,GAAU,UAAA;AAC9C,CAAA,EAAG,CAAC,KAAA,KAAU;AAAA,EACZI,aAAM,sBAAsB,CAAA,CAAE,GAAG,KAAA,CAAM,MAAA,EAAQ,MAAM,SAAS,CAAA;AAAA,EAC9DD,cAAO,mBAAmB,CAAA,CAAE,GAAG,KAAA,CAAM,MAAA,EAAQ,MAAM,UAAU;AAC/D,CAAC,CAAA;AASM,IAAM,YAAA,GAAeP,eAAQ,eAAA,EAAiB;AAAA,EACnD,aAAaC,WAAA,CAAK,aAAa,CAAA,CAAE,OAAA,GAAU,UAAA,EAAW;AAAA,EACtD,OAAOI,cAAA,CAAQ,OAAO,EAAE,OAAA,EAAQ,CAAE,QAAQ,CAAC,CAAA;AAAA,EAC3C,aAAaD,gBAAA,CAAU,aAAa,CAAA,CAAE,OAAA,GAAU,UAAA,EAAW;AAAA;AAAA;AAAA;AAAA;AAAA,EAK3D,eAAeA,gBAAA,CAAU,eAAe,CAAA,CAAE,OAAA,GAAU,UAAA,EAAW;AAAA,EAC/D,SAAA,EAAWH,YAAK,WAAW,CAAA;AAAA,EAC3B,SAAA,EAAWA,YAAK,WAAW,CAAA;AAAA,EAC3B,SAAA,EAAWA,YAAK,WAAW,CAAA;AAAA,EAC3B,QAAA,EAAUA,YAAK,UAAU;AAAA;AAC3B,CAAC,CAAA;AAKM,IAAM,cAAA,GAAiBD,eAAQ,iBAAA,EAAmB;AAAA,EACvD,IAAIC,WAAA,CAAK,IAAI,EAAE,UAAA,EAAW,CAAE,QAAQ,SAAS,CAAA;AAAA,EAC7C,iBAAiBE,cAAA,CAAQ,iBAAiB,EAAE,OAAA,EAAQ,CAAE,QAAQ,KAAK,CAAA;AAAA,EACnE,kBAAA,EAAoBF,YAAK,oBAAoB,CAAA;AAAA;AAAA;AAAA,EAG7C,sBAAA,EAAwBA,YAAK,wBAAwB,CAAA,CAAE,OAAM,CAAE,OAAA,EAAQ,CAAE,OAAA,CAAQ,gCAAgC,CAAA;AAAA,EACjH,kBAAkBE,cAAA,CAAQ,kBAAkB,EAAE,OAAA,EAAQ,CAAE,QAAQ,IAAI,CAAA;AAAA,EACpE,yBAAyBA,cAAA,CAAQ,yBAAyB,EAAE,OAAA,EAAQ,CAAE,QAAQ,IAAI,CAAA;AAAA,EAClF,kBAAkBA,cAAA,CAAQ,kBAAkB,EAAE,OAAA,EAAQ,CAAE,QAAQ,KAAK,CAAA;AAAA,EACrE,yBAAyBA,cAAA,CAAQ,yBAAyB,EAAE,OAAA,EAAQ,CAAE,QAAQ,IAAI,CAAA;AAAA;AAAA;AAAA,EAGlF,sBAAsBA,cAAA,CAAQ,sBAAsB,EAAE,OAAA,EAAQ,CAAE,QAAQ,IAAI,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAO5E,eAAA,EAAiBA,eAAQ,iBAAiB,CAAA;AAAA,EAC1C,WAAWC,gBAAA,CAAU,WAAW,CAAA,CAAE,OAAA,GAAU,UAAA,EAAW;AAAA;AAAA;AAAA;AAAA,EAIvD,SAAA,EAAWH,WAAA,CAAK,WAAW,CAAA,CAAE,UAAA,CAAW,MAAM,KAAA,CAAM,EAAA,EAAI,EAAE,QAAA,EAAU,UAAA,EAAY;AAClF,CAAA,EAAG,CAAC,KAAA,KAAU;AAAA,EACZQ,YAAA,CAAM,2BAAA,EAA6BC,cAAA,CAAA,EAAM,KAAA,CAAM,EAAE,CAAA,YAAA,CAAc;AACjE,CAAC,CAAA;AAKM,IAAM,SAAA,GAAYV,eAAQ,YAAA,EAAc;AAAA,EAC7C,GAAA,EAAKC,WAAA,CAAK,KAAK,CAAA,CAAE,UAAA,EAAW;AAAA,EAC5B,OAAA,EAASA,WAAA,CAAK,SAAS,CAAA,CAAE,OAAA,EAAQ;AAAA,EACjC,MAAA,EAAQA,WAAA,CAAK,QAAQ,CAAA,CAAE,OAAA,EAAQ;AAAA,EAC/B,WAAWG,gBAAA,CAAU,WAAW,CAAA,CAAE,OAAA,GAAU,UAAA;AAC9C,CAAA,EAAG,CAAC,KAAA,KAAU;AAAA,EACZI,YAAA,CAAM,2BAA2B,CAAA,CAAE,EAAA,CAAG,MAAM,SAAS;AACvD,CAAC,CAAA;AEzQM,IAAM,SAAA,GAAYG,MAAE,MAAA,CAAO;AAAA,EAChC,QAAA,EAAUA,KAAA,CAAE,IAAA,CAAK,CAAC,aAAA,EAAe,cAAc,MAAM,CAAC,CAAA,CAAE,OAAA,CAAQ,aAAa,CAAA;AAAA,EAC7E,IAAA,EAAMA,MAAE,MAAA,EAAO,CAAE,QAAQ,MAAM,CAAA,CAAE,UAAU,MAAM,CAAA;AAAA,EACjD,YAAA,EAAcA,KAAA,CAAE,MAAA,EAAO,CAAE,QAAQ,EAAE,CAAA;AAAA,EACnC,cAAA,EAAgBA,KAAA,CAAE,MAAA,EAAO,CAAE,QAAQ,EAAE,CAAA;AAAA;AAAA;AAAA,EAGrC,wBAAA,EAA0BA,KAAA,CAAE,MAAA,EAAO,CAAE,QAAQ,EAAE,CAAA;AAAA;AAAA;AAAA,EAG/C,2BAAA,EAA6BA,KAAA,CAAE,MAAA,EAAO,CAAE,QAAQ,EAAE,CAAA;AAAA;AAAA;AAAA,EAGlD,UAAA,EAAYA,KAAA,CAAE,MAAA,EAAO,CAAE,QAAQ,kCAAkC,CAAA;AAAA;AAAA;AAAA;AAAA,EAIjE,QAAA,EAAUA,KAAA,CAAE,MAAA,EAAO,CAAE,QAAQ,kBAAkB,CAAA;AAAA;AAAA;AAAA;AAAA,EAI/C,4BAAA,EAA8BA,KAAA,CAAE,MAAA,EAAO,CAAE,QAAQ,EAAE,CAAA;AAAA,EACnD,cAAA,EAAgBA,KAAA,CAAE,MAAA,EAAO,CAAE,QAAQ,EAAE,CAAA;AAAA;AAAA;AAAA;AAAA,EAIrC,yBAAA,EAA2BA,KAAA,CAAE,MAAA,EAAO,CAAE,OAAA,CAAQ,MAAM,CAAA,CAAE,SAAA,CAAU,CAAA,GAAA,KAAO,GAAA,KAAQ,MAAM,CAAA;AAAA,EACrF,kBAAA,EAAoBA,KAAA,CAAE,MAAA,EAAO,CAAE,OAAA,CAAQ,MAAM,CAAA,CAAE,SAAA,CAAU,CAAA,GAAA,KAAO,GAAA,KAAQ,MAAM,CAAA;AAAA,EAC9E,0BAAA,EAA4BA,KAAA,CAAE,MAAA,EAAO,CAAE,OAAA,CAAQ,MAAM,CAAA,CAAE,SAAA,CAAU,CAAA,GAAA,KAAO,GAAA,KAAQ,MAAM,CAAA;AAAA,EACtF,mBAAA,EAAqBA,KAAA,CAAE,MAAA,EAAO,CAAE,OAAA,CAAQ,OAAO,CAAA,CAAE,SAAA,CAAU,CAAA,GAAA,KAAO,GAAA,KAAQ,MAAM,CAAA;AAAA,EAChF,SAAA,EAAWA,MAAE,IAAA,CAAK,CAAC,MAAM,MAAM,CAAC,CAAA,CAAE,OAAA,CAAQ,IAAI,CAAA;AAAA;AAAA;AAAA,EAG9C,YAAA,EAAcA,KAAA,CAAE,MAAA,EAAO,CAAE,OAAA,CAAQ,OAAO,CAAA,CAAE,SAAA,CAAU,CAAA,GAAA,KAAO,GAAA,KAAQ,MAAM;AAC3E,CAAC,CAAA;;;ACrCD,IAAM,OAAA,GAAU,SAAA,CAAU,SAAA,CAAU,OAAA,CAAQ,GAAG,CAAA;AAE/C,IAAI,OAAA,CAAQ,OAAA,IAAY,OAAA,CAAQ,IAAA,CAAK,aAAa,aAAA,EAAgB;AAChE,EAAA,OAAA,CAAQ,IAAI,+BAAA,EAAiC,MAAA,CAAO,IAAA,CAAK,OAAA,CAAQ,IAAI,CAAC,CAAA;AACxE;AAEA,IAAI,CAAC,QAAQ,OAAA,EAAS;AACpB,EAAA,OAAA,CAAQ,KAAA,CAAM,gCAAA,EAAkC,OAAA,CAAQ,KAAA,CAAM,QAAQ,CAAA;AACtE,EAAA,MAAM,IAAI,MAAM,+BAA+B,CAAA;AACjD;AAEO,IAAM,SAAS,OAAA,CAAQ,IAAA;;;ACM1BC;AAGJ,IAAI,MAAA,CAAO,cAAc,IAAA,EAAM;AAC7B,EAAA,MAAM,IAAA,GAAO,IAAIC,OAAA,CAAK;AAAA,IACpB,kBAAkB,MAAA,CAAO,YAAA;AAAA,IACzB,KAAK,MAAA,CAAO,YAAA,GAAe,EAAE,kBAAA,EAAoB,OAAM,GAAI;AAAA,GAC5D,CAAA;AACD,EAAAD,UAAA,GAAKE,qBAAU,IAAA,EAAM;AAAA,IACnB,MAAA,EAAA,cAAA;AAAA,IACA,MAAA,EAAQ;AAAA,GACT,CAAA;AAED,EAAA,OAAA,CAAQ,IAAI,wCAAiC,CAAA;AAE/C,CAAA,MAAA,IAAW,MAAA,CAAO,cAAc,MAAA,EAAQ;AACtC,EAAA,MAAMJ,IAAAA,GAAMK,eAAA,CAAK,MAAA,CAAO,YAAa,CAAA;AACrC,EAAAH,UAAA,GAAKI,iBAAQN,IAAAA,EAAK,EAAE,MAAA,EAAA,cAAA,EAAQ,MAAA,EAAQ,MAAM,CAAA;AAE1C,EAAA,OAAA,CAAQ,IAAI,oCAA6B,CAAA;AAE3C,CAAA,MAAO;AACL,EAAA,OAAA,CAAQ,GAAA,CAAI,yDAAA,EAA2D,MAAA,CAAO,SAAS,CAAA;AACzF","file":"index.js","sourcesContent":["import { boolean, check, index, integer, jsonb, pgEnum, pgTable, text, timestamp, unique } from \"drizzle-orm/pg-core\";\nimport { sql } from \"drizzle-orm\";\nimport { createId } from '@paralleldrive/cuid2'\nimport { DEFAULT_MAINTENANCE_EXEMPT_PATHS } from \"../../lib/maintenance\";\n\n// 'tester' is a regular user account flagged for testing; apps can use it to\n// keep test accounts apart from real users. It has no admin access.\nexport const RoleEnum = pgEnum('roles', ['user', 'admin', 'tester'])\n\nexport const ActivityActionEnum = pgEnum('activity_actions', [\n  'login',\n  'logout',\n  'login_failed',\n  'password_changed',\n  'email_changed',\n  'profile_updated',\n  'session_revoked',\n  'user_deleted',\n  'user_banned',\n  'user_unbanned',\n  'role_changed',\n  'impersonation_started',\n  'impersonation_stopped',\n  'settings_changed',\n  'passkey_added',\n  'passkey_removed',\n])\n\nexport const users = pgTable(\"user\", {\n  id: text(\"id\").notNull().primaryKey().$defaultFn(() => createId()),\n  name: text('name').notNull(),\n  email: text('email').notNull().unique(),\n  password: text('password'),\n  emailVerified: boolean(\"emailVerified\").notNull().default(false),\n  image: text(\"image\"),\n  role: RoleEnum('roles').default('user').notNull(),\n  banned: boolean('banned').default(false).notNull(),\n  bannedAt: timestamp('bannedAt'),\n  bannedReason: text('bannedReason'),\n  // Required by better-auth's admin plugin schema (auto-expiring bans). We\n  // never set this ourselves, so it stays null and bans behave as permanent,\n  // same as before the plugin was added.\n  banExpires: timestamp('banExpires'),\n  lastLoginAt: timestamp('lastLoginAt'),\n  lastActiveAt: timestamp('lastActiveAt'),\n  // Set by better-auth's twoFactor plugin — true once the user has\n  // completed TOTP setup (see twoFactor pgTable below for the secret /\n  // backup codes themselves).\n  twoFactorEnabled: boolean('twoFactorEnabled').notNull().default(false),\n  createdAt: timestamp('createdAt').notNull().defaultNow(),\n  updatedAt: timestamp('updatedAt').notNull().defaultNow(),\n});\n\nexport const sessions = pgTable(\"session\", {\n  id: text(\"id\").notNull().primaryKey().$defaultFn(() => createId()),\n  expiresAt: timestamp(\"expiresAt\").notNull(),\n  token: text(\"token\").notNull().unique(),\n  createdAt: timestamp(\"createdAt\").notNull().defaultNow(),\n  updatedAt: timestamp(\"updatedAt\").notNull().defaultNow(),\n  ipAddress: text(\"ipAddress\"),\n  userAgent: text(\"userAgent\"),\n  userId: text(\"userId\")\n    .notNull()\n    .references(() => users.id, { onDelete: \"cascade\" }),\n  // Set by better-auth's admin plugin while this session is an admin\n  // impersonating another user; holds the impersonating admin's user id.\n  impersonatedBy: text(\"impersonatedBy\"),\n});\n\nexport const accounts = pgTable(\"account\", {\n  id: text(\"id\").notNull().primaryKey().$defaultFn(() => createId()),\n  accountId: text(\"accountId\").notNull(),\n  providerId: text(\"providerId\").notNull(),\n  userId: text(\"userId\")\n    .notNull()\n    .references(() => users.id, { onDelete: \"cascade\" }),\n  accessToken: text(\"accessToken\"),\n  refreshToken: text(\"refreshToken\"),\n  idToken: text(\"idToken\"),\n  accessTokenExpiresAt: timestamp(\"accessTokenExpiresAt\"),\n  refreshTokenExpiresAt: timestamp(\"refreshTokenExpiresAt\"),\n  scope: text(\"scope\"),\n  password: text(\"password\"),\n  createdAt: timestamp(\"createdAt\").notNull().defaultNow(),\n  updatedAt: timestamp(\"updatedAt\").notNull().defaultNow(),\n});\n\n// Better-auth's twoFactor plugin. One row per user (created on first\n// `enable`); secret and backupCodes are its own encrypted-at-rest strings,\n// field names/types must match its expectations exactly (drizzleAdapter in\n// server/auth.ts maps this table to the plugin's \"twoFactor\" model as-is).\nexport const twoFactors = pgTable(\"twoFactor\", {\n  id: text(\"id\").notNull().primaryKey().$defaultFn(() => createId()),\n  secret: text(\"secret\").notNull(),\n  backupCodes: text(\"backupCodes\").notNull(),\n  userId: text(\"userId\")\n    .notNull()\n    .references(() => users.id, { onDelete: \"cascade\" }),\n  // Added in better-auth 1.7 (TOTP lockout). Defaults match the plugin's.\n  verified: boolean(\"verified\").default(true),\n  failedVerificationCount: integer(\"failedVerificationCount\").default(0),\n  lockedUntil: timestamp(\"lockedUntil\"),\n});\n\n// Better-auth's passkey plugin — one row per registered WebAuthn credential.\nexport const passkeys = pgTable(\"passkey\", {\n  id: text(\"id\").notNull().primaryKey().$defaultFn(() => createId()),\n  name: text(\"name\"),\n  publicKey: text(\"publicKey\").notNull(),\n  userId: text(\"userId\")\n    .notNull()\n    .references(() => users.id, { onDelete: \"cascade\" }),\n  credentialID: text(\"credentialID\").notNull().unique(),\n  counter: integer(\"counter\").notNull(),\n  deviceType: text(\"deviceType\").notNull(),\n  backedUp: boolean(\"backedUp\").notNull(),\n  transports: text(\"transports\"),\n  createdAt: timestamp(\"createdAt\"),\n  aaguid: text(\"aaguid\"),\n});\n\nexport const verifications = pgTable(\"verification\", {\n  id: text(\"id\").notNull().primaryKey().$defaultFn(() => createId()),\n  identifier: text(\"identifier\").notNull(),\n  value: text(\"value\").notNull(),\n  expiresAt: timestamp(\"expiresAt\").notNull(),\n  createdAt: timestamp(\"createdAt\").notNull().defaultNow(),\n  updatedAt: timestamp(\"updatedAt\").notNull().defaultNow(),\n});\n\nexport const activityLogs = pgTable(\"activity_log\", {\n  id: text(\"id\").notNull().primaryKey().$defaultFn(() => createId()),\n  userId: text(\"userId\")\n    .notNull()\n    .references(() => users.id, { onDelete: \"cascade\" }),\n  action: ActivityActionEnum('action').notNull(),\n  description: text('description').notNull(),\n  ipAddress: text('ipAddress'),\n  userAgent: text('userAgent'),\n  metadata: text('metadata'),\n  // Populated on 'login' events only (registration + sign-in) — parsed from\n  // userAgent/ipAddress at write time so the record stays stable even if\n  // the parsing library or geoip database changes later.\n  referrerUrl: text('referrerUrl'),\n  os: text('os'),\n  browser: text('browser'),\n  deviceType: text('deviceType'),\n  country: text('country'),\n  city: text('city'),\n  createdAt: timestamp('createdAt').notNull().defaultNow(),\n});\n\n// One row per (user, device fingerprint) pair. Its only job is to answer\n// \"has this account signed in from this device before?\" — no matching row ⇒\n// send a new-device alert (see app/api/device-check/route.ts). visitorId is\n// FingerprintJS's identifier, computed client-side in\n// components/auth/deviceCheck.tsx. UA+IP are deliberately NOT the signal here:\n// they churn constantly on mobile and would alert on every other login.\nexport const deviceFingerprints = pgTable(\"device_fingerprint\", {\n  id: text(\"id\").notNull().primaryKey().$defaultFn(() => createId()),\n  userId: text(\"userId\")\n    .notNull()\n    .references(() => users.id, { onDelete: \"cascade\" }),\n  visitorId: text(\"visitorId\").notNull(),\n  // Context captured at first-seen time — for the admin panel's \"New devices\"\n  // card and the alert email. Not part of the new-vs-known decision (that's\n  // visitorId only), just so an admin can eyeball whether a sign-in looks like\n  // a hijack. Nullable: an old row predates these columns, or geoip missed.\n  ipAddress: text(\"ipAddress\"),\n  userAgent: text(\"userAgent\"),\n  country: text(\"country\"),\n  city: text(\"city\"),\n  // Latest FingerprintJS signals for this device (lib/device-fingerprint.ts\n  // getDeviceSignals(): accessibility signals dropped, large values hashed),\n  // shown on the admin user page. Null for rows from before this column.\n  components: jsonb(\"components\").$type<Record<string, unknown>>(),\n  createdAt: timestamp(\"createdAt\").notNull().defaultNow(),\n}, (table) => [\n  unique(\"device_fingerprint_user_visitor\").on(table.userId, table.visitorId),\n]);\n\n// Proof of cookie consent (GDPR Art. 7(1): the controller must be able to\n// demonstrate consent). One row per choice a signed-in user makes, written by\n// app/api/consent from the banner (components/site/cookie-banner.tsx).\n// Deliberately minimal — no IP/UA. Deleted with the account.\nexport const consentLog = pgTable(\"consent_log\", {\n  id: text(\"id\").notNull().primaryKey().$defaultFn(() => createId()),\n  userId: text(\"userId\")\n    .notNull()\n    .references(() => users.id, { onDelete: \"cascade\" }),\n  // The cookie_consent value: \"all\", \"necessary\" or a comma list of purposes.\n  choice: text(\"choice\").notNull(),\n  // CONSENT_VERSION (lib/cookie-names.ts) at the time — which banner/policy\n  // wording the user agreed to.\n  version: integer(\"version\").notNull(),\n  // id of the user's record this one follows (\"\" for their first). Unique per\n  // user, so concurrent posts from several tabs that all saw the same latest\n  // record can't each insert a duplicate — one wins, the rest conflict. Works\n  // without transactions (neon-http has none). Null on rows from before it.\n  previousId: text(\"previousId\"),\n  createdAt: timestamp(\"createdAt\").notNull().defaultNow(),\n}, (table) => [\n  index(\"consent_log_user_idx\").on(table.userId, table.createdAt),\n  unique(\"consent_log_chain\").on(table.userId, table.previousId),\n]);\n\n// Per-device abuse throttle for /sign-in/email and /sign-up/email — one\n// fixed-window counter row per FingerprintJS visitorId (sent by the auth\n// forms as the x-device-fingerprint header; see lib/auth-throttle.ts).\n// Keyed by device, not IP: IP is shared behind corporate NAT / CGNAT / VPN,\n// so an IP counter throttles coworkers together while missing an abuser who\n// rotates IPs. Rows untouched for 30 days are deleted (RETENTION_MS in\n// lib/auth-throttle-limits.ts, swept by lib/auth-throttle.ts).\nexport const authThrottle = pgTable(\"auth_throttle\", {\n  fingerprint: text(\"fingerprint\").notNull().primaryKey(),\n  count: integer(\"count\").notNull().default(0),\n  windowStart: timestamp(\"windowStart\").notNull().defaultNow(),\n  // Blockable data points, overwritten on every attempt (last-write-wins) so\n  // the admin panel can show who to block — by IP or by fingerprint — with no\n  // join and no per-attempt history table. windowStart anchors the counter's\n  // window; lastAttemptAt is just \"most recently seen\".\n  lastAttemptAt: timestamp(\"lastAttemptAt\").notNull().defaultNow(),\n  ipAddress: text(\"ipAddress\"),\n  userAgent: text(\"userAgent\"),\n  lastEmail: text(\"lastEmail\"),\n  lastKind: text(\"lastKind\"), // 'signin' | 'signup'\n});\n\n// Singleton row (id is always 'default') holding admin-editable settings for\n// config that used to be env-var-only. See lib/settings-queries.ts for the\n// cached read path and lazy-seed-from-env behavior.\nexport const systemSettings = pgTable(\"system_settings\", {\n  id: text(\"id\").primaryKey().default(\"default\"),\n  maintenanceMode: boolean(\"maintenanceMode\").notNull().default(false),\n  maintenanceMessage: text(\"maintenanceMessage\"),\n  // Path prefixes that stay reachable while maintenance mode is on (see\n  // lib/maintenance.ts — a few auth paths are always open on top of these).\n  maintenanceExemptPaths: text(\"maintenanceExemptPaths\").array().notNull().default(DEFAULT_MAINTENANCE_EXEMPT_PATHS),\n  authEnableGoogle: boolean(\"authEnableGoogle\").notNull().default(true),\n  authEnableEmailPassword: boolean(\"authEnableEmailPassword\").notNull().default(true),\n  authEnableOneTap: boolean(\"authEnableOneTap\").notNull().default(false),\n  enableSessionRevocation: boolean(\"enableSessionRevocation\").notNull().default(true),\n  // Attach the error a user hit to feedback they send from it (see\n  // lib/feedback-route.ts). Off = only what the user typed is sent.\n  feedbackAttachErrors: boolean(\"feedbackAttachErrors\").notNull().default(true),\n  // GDPR/ePrivacy consent mode. On: cookie banner, FingerprintJS and One Tap\n  // only after \"Accept all\", device record erased on withdrawal. Off (no EU/UK\n  // users): no banner, treated as consented. Null = follow\n  // NEXT_PUBLIC_COOKIE_BANNER (nullable so migrating never flips a deployed\n  // banner on or off). proxy.ts mirrors the effective value into the\n  // consent_required cookie for the client (lib/cookie-consent.ts).\n  consentRequired: boolean(\"consentRequired\"),\n  updatedAt: timestamp(\"updatedAt\").notNull().defaultNow(),\n  // Who last changed a setting. This row doesn't \"belong\" to that admin the\n  // way sessions/activityLogs belong to their user, so deleting that admin's\n  // account should null this out rather than cascade-delete the singleton row.\n  updatedBy: text(\"updatedBy\").references(() => users.id, { onDelete: \"set null\" }),\n}, (table) => [\n  check(\"system_settings_singleton\", sql`${table.id} = 'default'`),\n]);\n// Technical detail of unexpected errors, keyed by the short ref the user sees\n// (\"... (ref: K7Q2PX)\", see lib/errors.ts). Never sent to the browser: the\n// feedback route looks a ref up and attaches the detail to the report it\n// sends to Discord/email. Rows older than 30 days are pruned on insert.\nexport const errorRefs = pgTable(\"error_refs\", {\n  ref: text(\"ref\").primaryKey(),\n  message: text(\"message\").notNull(),\n  detail: text(\"detail\").notNull(),\n  createdAt: timestamp(\"createdAt\").notNull().defaultNow(),\n}, (table) => [\n  index(\"error_refs_created_at_idx\").on(table.createdAt),\n]);\n","// Pure path logic for maintenance mode — no DB / server-only imports, so it\n// can run in proxy.ts and in the admin form alike.\n\n// Default for the admin-editable exempt list: the public marketing pages.\nexport const DEFAULT_MAINTENANCE_EXEMPT_PATHS = [\n  \"/\",\n  \"/features\",\n  \"/changelog\",\n  \"/changelog-template\",\n  \"/privacy\",\n  \"/terms\",\n]\n\n// Always reachable, whatever the admin saves — otherwise an admin could\n// lock themselves out of the sign-in flow needed to turn maintenance off.\nexport const ALWAYS_OPEN_PATHS = [\n  \"/maintenance\",\n  \"/login\", // includes /login/2fa\n  \"/forgot-password\",\n  \"/reset-password\",\n  \"/api/auth\",\n  \"/api/settings/public\", // login page reads the One Tap flag from here\n]\n\n// `/foo` matches `/foo` and `/foo/...` but not `/foobar`; `/` matches only `/`.\nfunction matches(pathname: string, prefix: string) {\n  const p = prefix.length > 1 ? prefix.replace(/\\/+$/, \"\") : prefix\n  return pathname === p || (p !== \"/\" && pathname.startsWith(p + \"/\"))\n}\n\nexport function isMaintenanceExempt(pathname: string, exemptPaths: string[]) {\n  return [...ALWAYS_OPEN_PATHS, ...exemptPaths].some((p) => matches(pathname, p))\n}\n","// No \"server-only\" guard here — this schema is also imported by scripts that\n// run outside Next.js's bundler (e.g. scripts/doctor.ts), where that guard\n// throws unconditionally. config/env.ts re-exports the parsed, guarded result\n// for app code; import this file directly only from non-Next scripts.\nimport { z } from 'zod';\n\nexport const envSchema = z.object({\n  NODE_ENV: z.enum(['development', 'production', 'test']).default('development'),\n  PORT: z.string().default('3000').transform(Number),\n  DATABASE_URL: z.string().default(''),\n  RESEND_API_KEY: z.string().default(''),\n  // Full access key for marketing broadcasts (admin Marketing email page).\n  // Blank = use RESEND_API_KEY.\n  RESEND_BROADCAST_API_KEY: z.string().default(''),\n  // Resend segment users join from the dashboard \"Email updates\" toggle.\n  // Blank = toggle hidden.\n  RESEND_MARKETING_SEGMENT_ID: z.string().default(''),\n  // Sender for every transactional email. Must be on a domain verified in\n  // your Resend account.\n  EMAIL_FROM: z.string().default('Acme <onboarding@xavierkhew.xyz>'),\n  // Display name for this deployment — shown as the authenticator-app label\n  // (2FA issuer) and the passkey relying-party name. Consuming projects set\n  // this in their own .env; defaults to the template name.\n  APP_NAME: z.string().default('Next.js Template'),\n  // Where the dashboard feedback form delivers (app/api/feedback). Set either\n  // or both; with neither, the Feedback button is hidden. FEEDBACK_EMAIL takes\n  // a comma-separated list and sends through Resend (needs RESEND_API_KEY).\n  FEEDBACK_DISCORD_WEBHOOK_URL: z.string().default(''),\n  FEEDBACK_EMAIL: z.string().default(''),\n  // Seed-only: the live value lives in the system_settings DB row (see\n  // lib/settings-queries.ts) once it's been seeded on first read, and is\n  // changed from the admin System Settings page, not by editing this var.\n  ENABLE_SESSION_REVOCATION: z.string().default('true').transform(val => val === 'true'),\n  AUTH_ENABLE_GOOGLE: z.string().default('true').transform(val => val === 'true'),\n  AUTH_ENABLE_EMAIL_PASSWORD: z.string().default('true').transform(val => val === 'true'),\n  AUTH_ENABLE_ONE_TAP: z.string().default('false').transform(val => val === 'true'),\n  DB_DRIVER: z.enum(['pg', 'neon']).default('pg'),\n  // Only relevant when DB_DRIVER=pg — whether the target Postgres server has SSL\n  // enabled. Self-hosted Postgres (e.g. via Docker/Dokploy) typically does not.\n  DATABASE_SSL: z.string().default('false').transform(val => val === 'true'),\n});\n","import \"server-only\";\nimport { envSchema } from './env-schema';\n\nconst results = envSchema.safeParse(process.env);\n\nif (results.success && (results.data.NODE_ENV === 'development')) {\n  console.log('Environment variables loaded:', Object.keys(results.data));\n}\n\nif (!results.success) {\n  console.error('Invalid environment variables:', results.error.format());\n  throw new Error('Invalid environment variables');\n}\n\nexport const config = results.data;\n","import 'server-only';\n\n// neon-http driver for production\nimport { neon } from '@neondatabase/serverless';\nimport { drizzle } from 'drizzle-orm/neon-http';\n\n// postgres driver for local development\nimport { drizzle as drizzlePg } from 'drizzle-orm/node-postgres';\nimport { Pool } from 'pg';\n\nimport * as schema from './schema';\nimport { config } from '../../config/env';\n\n// Import the query builder\nimport { PostgresJsDatabase } from 'drizzle-orm/postgres-js';\nimport { NeonHttpDatabase } from 'drizzle-orm/neon-http';\n\ntype DrizzleNeon = NeonHttpDatabase<typeof schema>;\ntype DrizzlePg = PostgresJsDatabase<typeof schema>;\n\nlet db: DrizzleNeon | DrizzlePg\n\n\nif (config.DB_DRIVER === 'pg') {\n  const pool = new Pool({\n    connectionString: config.DATABASE_URL!,\n    ssl: config.DATABASE_SSL ? { rejectUnauthorized: false } : undefined,\n  });\n  db = drizzlePg(pool, {\n    schema,\n    logger: true,\n  });\n\n  console.log('🟡 Using PostgreSQL (pg) driver');\n\n} else if (config.DB_DRIVER === 'neon') {\n  const sql = neon(config.DATABASE_URL!);\n  db = drizzle(sql, { schema, logger: true });\n\n  console.log('🟢 Using Neon (HTTP) driver');\n\n} else {\n  console.log('Database connection not established, unknown DB_DRIVER:', config.DB_DRIVER);\n}\n// Note: In production, you might want to disable logging or use a more sophisticated logger.\n\nexport { db }"]}

package/dist/db/index.mjs

@@ -1,6 +1,6 @@
-export { db } from '../chunk-F7CG5CA3.mjs';
+export { db } from '../chunk-ZJMFE5B2.mjs';
 import '../chunk-TR5XFBTD.mjs';
-import '../chunk-TMJYAOC2.mjs';
+import '../chunk-TKWNEKK6.mjs';
 import '../chunk-3465SI5N.mjs';
 //# sourceMappingURL=index.mjs.map
 //# sourceMappingURL=index.mjs.map

package/dist/errors.js

@@ -264,6 +264,12 @@ var envSchema = zod.z.object({
   PORT: zod.z.string().default("3000").transform(Number),
   DATABASE_URL: zod.z.string().default(""),
   RESEND_API_KEY: zod.z.string().default(""),
+  // Full access key for marketing broadcasts (admin Marketing email page).
+  // Blank = use RESEND_API_KEY.
+  RESEND_BROADCAST_API_KEY: zod.z.string().default(""),
+  // Resend segment users join from the dashboard "Email updates" toggle.
+  // Blank = toggle hidden.
+  RESEND_MARKETING_SEGMENT_ID: zod.z.string().default(""),
   // Sender for every transactional email. Must be on a domain verified in
   // your Resend account.
   EMAIL_FROM: zod.z.string().default("Acme <onboarding@xavierkhew.xyz>"),