@xk2800/nextjs-template 0.7.1-beta.7 → 0.7.1-beta.8

package/dist/api/marketing.js

@@ -0,0 +1,1357 @@
+'use strict';
+
+var components = require('@react-email/components');
+var jsxRuntime = require('react/jsx-runtime');
+require('server-only');
+var server = require('next/server');
+var headers = require('next/headers');
+var zod = require('zod');
+var betterAuth = require('better-auth');
+var drizzle = require('better-auth/adapters/drizzle');
+var cuid2 = require('@paralleldrive/cuid2');
+var drizzleOrm = require('drizzle-orm');
+var serverless = require('@neondatabase/serverless');
+var neonHttp = require('drizzle-orm/neon-http');
+var nodePostgres = require('drizzle-orm/node-postgres');
+var pg = require('pg');
+var pgCore = require('drizzle-orm/pg-core');
+var plugins = require('better-auth/plugins');
+var passkey = require('@better-auth/passkey');
+var api = require('better-auth/api');
+var uaParserJs = require('ua-parser-js');
+var geoip = require('geoip-lite');
+var react = require('react');
+var navigation = require('next/navigation');
+var crypto = require('crypto');
+
+function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
+
+var geoip__default = /*#__PURE__*/_interopDefault(geoip);
+
+var __defProp = Object.defineProperty;
+var __defProps = Object.defineProperties;
+var __getOwnPropDescs = Object.getOwnPropertyDescriptors;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getOwnPropSymbols = Object.getOwnPropertySymbols;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __propIsEnum = Object.prototype.propertyIsEnumerable;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __spreadValues = (a, b) => {
+  for (var prop in b || (b = {}))
+    if (__hasOwnProp.call(b, prop))
+      __defNormalProp(a, prop, b[prop]);
+  if (__getOwnPropSymbols)
+    for (var prop of __getOwnPropSymbols(b)) {
+      if (__propIsEnum.call(b, prop))
+        __defNormalProp(a, prop, b[prop]);
+    }
+  return a;
+};
+var __spreadProps = (a, b) => __defProps(a, __getOwnPropDescs(b));
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+// components/email/email-template-passkey-change.tsx
+var email_template_passkey_change_exports = {};
+__export(email_template_passkey_change_exports, {
+  EmailTemplatePasskeyChange: () => EmailTemplatePasskeyChange
+});
+function EmailTemplatePasskeyChange({
+  firstName,
+  action,
+  device,
+  location,
+  ipAddress,
+  when,
+  manageUrl
+}) {
+  const verb = action === "added" ? "added to" : "removed from";
+  return /* @__PURE__ */ jsxRuntime.jsxs(components.Html, { children: [
+    /* @__PURE__ */ jsxRuntime.jsx(components.Head, {}),
+    /* @__PURE__ */ jsxRuntime.jsx(components.Tailwind, { children: /* @__PURE__ */ jsxRuntime.jsx(components.Body, { className: "bg-white font-sans", children: /* @__PURE__ */ jsxRuntime.jsx(components.Container, { className: "mx-auto max-w-[560px] px-0 pt-5 pb-12", children: /* @__PURE__ */ jsxRuntime.jsxs(components.Section, { className: "rounded-xl bg-[#f8f9fa] p-10", children: [
+      /* @__PURE__ */ jsxRuntime.jsxs(components.Heading, { className: "mb-3 text-center text-2xl font-bold text-[#1a1a1a]", children: [
+        "A passkey was ",
+        action
+      ] }),
+      /* @__PURE__ */ jsxRuntime.jsxs(components.Text, { className: "mb-6 text-base leading-6 text-[#666666]", children: [
+        "Hi ",
+        firstName,
+        ", a passkey was just ",
+        verb,
+        " your account."
+      ] }),
+      /* @__PURE__ */ jsxRuntime.jsxs(components.Section, { className: "mb-6 rounded-lg bg-white p-5", children: [
+        /* @__PURE__ */ jsxRuntime.jsxs(components.Text, { className: "m-0 mb-2 text-sm leading-5 text-[#1a1a1a]", children: [
+          /* @__PURE__ */ jsxRuntime.jsx("strong", { children: "Device:" }),
+          " ",
+          device
+        ] }),
+        /* @__PURE__ */ jsxRuntime.jsxs(components.Text, { className: "m-0 mb-2 text-sm leading-5 text-[#1a1a1a]", children: [
+          /* @__PURE__ */ jsxRuntime.jsx("strong", { children: "Approx. location:" }),
+          " ",
+          location
+        ] }),
+        /* @__PURE__ */ jsxRuntime.jsxs(components.Text, { className: "m-0 mb-2 text-sm leading-5 text-[#1a1a1a]", children: [
+          /* @__PURE__ */ jsxRuntime.jsx("strong", { children: "IP address:" }),
+          " ",
+          ipAddress
+        ] }),
+        /* @__PURE__ */ jsxRuntime.jsxs(components.Text, { className: "m-0 text-sm leading-5 text-[#1a1a1a]", children: [
+          /* @__PURE__ */ jsxRuntime.jsx("strong", { children: "When:" }),
+          " ",
+          when
+        ] })
+      ] }),
+      manageUrl && /* @__PURE__ */ jsxRuntime.jsx(components.Section, { className: "mb-6 text-center", children: /* @__PURE__ */ jsxRuntime.jsx(
+        components.Button,
+        {
+          href: manageUrl,
+          className: "rounded-lg bg-[#1a1a1a] px-6 py-3 text-sm font-bold text-white no-underline",
+          children: "Review your passkeys"
+        }
+      ) }),
+      /* @__PURE__ */ jsxRuntime.jsx(components.Text, { className: "text-sm leading-[22px] text-[#666666]", children: "If this was you, no action is needed. If you don't recognize it, change your password now and review your passkeys and active sessions." })
+    ] }) }) }) })
+  ] });
+}
+var init_email_template_passkey_change = __esm({
+  "components/email/email-template-passkey-change.tsx"() {
+  }
+});
+
+// components/email/email-template-reset-password.tsx
+var email_template_reset_password_exports = {};
+__export(email_template_reset_password_exports, {
+  EmailTemplateResetPassword: () => EmailTemplateResetPassword
+});
+function EmailTemplateResetPassword({ firstName, url }) {
+  return /* @__PURE__ */ jsxRuntime.jsxs(components.Html, { children: [
+    /* @__PURE__ */ jsxRuntime.jsx(components.Head, {}),
+    /* @__PURE__ */ jsxRuntime.jsx(components.Body, { style: { backgroundColor: "#ffffff", fontFamily: "Arial, sans-serif" }, children: /* @__PURE__ */ jsxRuntime.jsx(components.Container, { style: { margin: "0 auto", padding: "20px 0 48px", maxWidth: "560px" }, children: /* @__PURE__ */ jsxRuntime.jsxs(components.Section, { style: { backgroundColor: "#f8f9fa", borderRadius: "12px", padding: "40px", textAlign: "center" }, children: [
+      /* @__PURE__ */ jsxRuntime.jsx(components.Heading, { style: { fontSize: "28px", fontWeight: "bold", marginBottom: "12px", color: "#1a1a1a" }, children: "Reset your password" }),
+      /* @__PURE__ */ jsxRuntime.jsxs(components.Text, { style: { fontSize: "16px", color: "#666666", marginBottom: "32px", lineHeight: "24px" }, children: [
+        "Hi ",
+        firstName,
+        ", we got a request to reset your password. This link expires in an hour \u2014 if you didn't ask for this, you can safely ignore this email."
+      ] }),
+      /* @__PURE__ */ jsxRuntime.jsx(components.Section, { style: { marginBottom: "32px" }, children: /* @__PURE__ */ jsxRuntime.jsx(
+        components.Button,
+        {
+          href: url,
+          style: {
+            backgroundColor: "#000000",
+            color: "#ffffff",
+            padding: "12px 32px",
+            borderRadius: "6px",
+            textDecoration: "none",
+            fontSize: "16px",
+            fontWeight: "bold"
+          },
+          children: "Reset password"
+        }
+      ) }),
+      /* @__PURE__ */ jsxRuntime.jsxs(components.Text, { style: { fontSize: "13px", color: "#999999", lineHeight: "20px", wordBreak: "break-all" }, children: [
+        "Or paste this link into your browser:",
+        /* @__PURE__ */ jsxRuntime.jsx("br", {}),
+        /* @__PURE__ */ jsxRuntime.jsx("a", { href: url, style: { color: "#000000", textDecoration: "underline" }, children: url })
+      ] })
+    ] }) }) })
+  ] });
+}
+var init_email_template_reset_password = __esm({
+  "components/email/email-template-reset-password.tsx"() {
+  }
+});
+
+// components/email/email-template-verify-email.tsx
+var email_template_verify_email_exports = {};
+__export(email_template_verify_email_exports, {
+  EmailTemplateVerifyEmail: () => EmailTemplateVerifyEmail
+});
+function EmailTemplateVerifyEmail({ firstName, url }) {
+  return /* @__PURE__ */ jsxRuntime.jsxs(components.Html, { children: [
+    /* @__PURE__ */ jsxRuntime.jsx(components.Head, {}),
+    /* @__PURE__ */ jsxRuntime.jsx(components.Tailwind, { children: /* @__PURE__ */ jsxRuntime.jsx(components.Body, { className: "bg-white font-sans", children: /* @__PURE__ */ jsxRuntime.jsx(components.Container, { className: "mx-auto max-w-[560px] px-0 pt-5 pb-12", children: /* @__PURE__ */ jsxRuntime.jsxs(components.Section, { className: "rounded-xl bg-[#f8f9fa] p-10 text-center", children: [
+      /* @__PURE__ */ jsxRuntime.jsx(components.Heading, { className: "mb-3 text-[28px] font-bold text-[#1a1a1a]", children: "Confirm your email" }),
+      /* @__PURE__ */ jsxRuntime.jsxs(components.Text, { className: "mb-8 text-base leading-6 text-[#666666]", children: [
+        "Hi ",
+        firstName,
+        ", click the button below to verify this email address. If you didn't create an account, you can safely ignore this email."
+      ] }),
+      /* @__PURE__ */ jsxRuntime.jsx(components.Section, { className: "mb-8", children: /* @__PURE__ */ jsxRuntime.jsx(
+        components.Button,
+        {
+          href: url,
+          className: "rounded-md bg-black px-8 py-3 text-base font-bold text-white no-underline",
+          children: "Verify email"
+        }
+      ) }),
+      /* @__PURE__ */ jsxRuntime.jsxs(components.Text, { className: "text-[13px] leading-5 break-all text-[#999999]", children: [
+        "Or paste this link into your browser:",
+        /* @__PURE__ */ jsxRuntime.jsx("br", {}),
+        /* @__PURE__ */ jsxRuntime.jsx(components.Link, { href: url, className: "text-black underline", children: url })
+      ] })
+    ] }) }) }) })
+  ] });
+}
+var init_email_template_verify_email = __esm({
+  "components/email/email-template-verify-email.tsx"() {
+  }
+});
+
+// server/db/schema.ts
+var schema_exports = {};
+__export(schema_exports, {
+  ActivityActionEnum: () => ActivityActionEnum,
+  RoleEnum: () => RoleEnum,
+  accounts: () => accounts,
+  activityLogs: () => activityLogs,
+  authThrottle: () => authThrottle,
+  consentLog: () => consentLog,
+  deviceFingerprints: () => deviceFingerprints,
+  errorRefs: () => errorRefs,
+  passkeys: () => passkeys,
+  sessions: () => sessions,
+  systemSettings: () => systemSettings,
+  twoFactors: () => twoFactors,
+  users: () => users,
+  verifications: () => verifications
+});
+
+// lib/maintenance.ts
+var DEFAULT_MAINTENANCE_EXEMPT_PATHS = [
+  "/",
+  "/features",
+  "/changelog",
+  "/changelog-template",
+  "/privacy",
+  "/terms"
+];
+
+// server/db/schema.ts
+var RoleEnum = pgCore.pgEnum("roles", ["user", "admin", "tester"]);
+var ActivityActionEnum = pgCore.pgEnum("activity_actions", [
+  "login",
+  "logout",
+  "login_failed",
+  "password_changed",
+  "email_changed",
+  "profile_updated",
+  "session_revoked",
+  "user_deleted",
+  "user_banned",
+  "user_unbanned",
+  "role_changed",
+  "impersonation_started",
+  "impersonation_stopped",
+  "settings_changed",
+  "passkey_added",
+  "passkey_removed"
+]);
+var users = pgCore.pgTable("user", {
+  id: pgCore.text("id").notNull().primaryKey().$defaultFn(() => cuid2.createId()),
+  name: pgCore.text("name").notNull(),
+  email: pgCore.text("email").notNull().unique(),
+  password: pgCore.text("password"),
+  emailVerified: pgCore.boolean("emailVerified").notNull().default(false),
+  image: pgCore.text("image"),
+  role: RoleEnum("roles").default("user").notNull(),
+  banned: pgCore.boolean("banned").default(false).notNull(),
+  bannedAt: pgCore.timestamp("bannedAt"),
+  bannedReason: pgCore.text("bannedReason"),
+  // Required by better-auth's admin plugin schema (auto-expiring bans). We
+  // never set this ourselves, so it stays null and bans behave as permanent,
+  // same as before the plugin was added.
+  banExpires: pgCore.timestamp("banExpires"),
+  lastLoginAt: pgCore.timestamp("lastLoginAt"),
+  lastActiveAt: pgCore.timestamp("lastActiveAt"),
+  // Set by better-auth's twoFactor plugin — true once the user has
+  // completed TOTP setup (see twoFactor pgTable below for the secret /
+  // backup codes themselves).
+  twoFactorEnabled: pgCore.boolean("twoFactorEnabled").notNull().default(false),
+  createdAt: pgCore.timestamp("createdAt").notNull().defaultNow(),
+  updatedAt: pgCore.timestamp("updatedAt").notNull().defaultNow()
+});
+var sessions = pgCore.pgTable("session", {
+  id: pgCore.text("id").notNull().primaryKey().$defaultFn(() => cuid2.createId()),
+  expiresAt: pgCore.timestamp("expiresAt").notNull(),
+  token: pgCore.text("token").notNull().unique(),
+  createdAt: pgCore.timestamp("createdAt").notNull().defaultNow(),
+  updatedAt: pgCore.timestamp("updatedAt").notNull().defaultNow(),
+  ipAddress: pgCore.text("ipAddress"),
+  userAgent: pgCore.text("userAgent"),
+  userId: pgCore.text("userId").notNull().references(() => users.id, { onDelete: "cascade" }),
+  // Set by better-auth's admin plugin while this session is an admin
+  // impersonating another user; holds the impersonating admin's user id.
+  impersonatedBy: pgCore.text("impersonatedBy")
+});
+var accounts = pgCore.pgTable("account", {
+  id: pgCore.text("id").notNull().primaryKey().$defaultFn(() => cuid2.createId()),
+  accountId: pgCore.text("accountId").notNull(),
+  providerId: pgCore.text("providerId").notNull(),
+  userId: pgCore.text("userId").notNull().references(() => users.id, { onDelete: "cascade" }),
+  accessToken: pgCore.text("accessToken"),
+  refreshToken: pgCore.text("refreshToken"),
+  idToken: pgCore.text("idToken"),
+  accessTokenExpiresAt: pgCore.timestamp("accessTokenExpiresAt"),
+  refreshTokenExpiresAt: pgCore.timestamp("refreshTokenExpiresAt"),
+  scope: pgCore.text("scope"),
+  password: pgCore.text("password"),
+  createdAt: pgCore.timestamp("createdAt").notNull().defaultNow(),
+  updatedAt: pgCore.timestamp("updatedAt").notNull().defaultNow()
+});
+var twoFactors = pgCore.pgTable("twoFactor", {
+  id: pgCore.text("id").notNull().primaryKey().$defaultFn(() => cuid2.createId()),
+  secret: pgCore.text("secret").notNull(),
+  backupCodes: pgCore.text("backupCodes").notNull(),
+  userId: pgCore.text("userId").notNull().references(() => users.id, { onDelete: "cascade" }),
+  // Added in better-auth 1.7 (TOTP lockout). Defaults match the plugin's.
+  verified: pgCore.boolean("verified").default(true),
+  failedVerificationCount: pgCore.integer("failedVerificationCount").default(0),
+  lockedUntil: pgCore.timestamp("lockedUntil")
+});
+var passkeys = pgCore.pgTable("passkey", {
+  id: pgCore.text("id").notNull().primaryKey().$defaultFn(() => cuid2.createId()),
+  name: pgCore.text("name"),
+  publicKey: pgCore.text("publicKey").notNull(),
+  userId: pgCore.text("userId").notNull().references(() => users.id, { onDelete: "cascade" }),
+  credentialID: pgCore.text("credentialID").notNull().unique(),
+  counter: pgCore.integer("counter").notNull(),
+  deviceType: pgCore.text("deviceType").notNull(),
+  backedUp: pgCore.boolean("backedUp").notNull(),
+  transports: pgCore.text("transports"),
+  createdAt: pgCore.timestamp("createdAt"),
+  aaguid: pgCore.text("aaguid")
+});
+var verifications = pgCore.pgTable("verification", {
+  id: pgCore.text("id").notNull().primaryKey().$defaultFn(() => cuid2.createId()),
+  identifier: pgCore.text("identifier").notNull(),
+  value: pgCore.text("value").notNull(),
+  expiresAt: pgCore.timestamp("expiresAt").notNull(),
+  createdAt: pgCore.timestamp("createdAt").notNull().defaultNow(),
+  updatedAt: pgCore.timestamp("updatedAt").notNull().defaultNow()
+});
+var activityLogs = pgCore.pgTable("activity_log", {
+  id: pgCore.text("id").notNull().primaryKey().$defaultFn(() => cuid2.createId()),
+  userId: pgCore.text("userId").notNull().references(() => users.id, { onDelete: "cascade" }),
+  action: ActivityActionEnum("action").notNull(),
+  description: pgCore.text("description").notNull(),
+  ipAddress: pgCore.text("ipAddress"),
+  userAgent: pgCore.text("userAgent"),
+  metadata: pgCore.text("metadata"),
+  // Populated on 'login' events only (registration + sign-in) — parsed from
+  // userAgent/ipAddress at write time so the record stays stable even if
+  // the parsing library or geoip database changes later.
+  referrerUrl: pgCore.text("referrerUrl"),
+  os: pgCore.text("os"),
+  browser: pgCore.text("browser"),
+  deviceType: pgCore.text("deviceType"),
+  country: pgCore.text("country"),
+  city: pgCore.text("city"),
+  createdAt: pgCore.timestamp("createdAt").notNull().defaultNow()
+});
+var deviceFingerprints = pgCore.pgTable("device_fingerprint", {
+  id: pgCore.text("id").notNull().primaryKey().$defaultFn(() => cuid2.createId()),
+  userId: pgCore.text("userId").notNull().references(() => users.id, { onDelete: "cascade" }),
+  visitorId: pgCore.text("visitorId").notNull(),
+  // Context captured at first-seen time — for the admin panel's "New devices"
+  // card and the alert email. Not part of the new-vs-known decision (that's
+  // visitorId only), just so an admin can eyeball whether a sign-in looks like
+  // a hijack. Nullable: an old row predates these columns, or geoip missed.
+  ipAddress: pgCore.text("ipAddress"),
+  userAgent: pgCore.text("userAgent"),
+  country: pgCore.text("country"),
+  city: pgCore.text("city"),
+  // Latest FingerprintJS signals for this device (lib/device-fingerprint.ts
+  // getDeviceSignals(): accessibility signals dropped, large values hashed),
+  // shown on the admin user page. Null for rows from before this column.
+  components: pgCore.jsonb("components").$type(),
+  createdAt: pgCore.timestamp("createdAt").notNull().defaultNow()
+}, (table) => [
+  pgCore.unique("device_fingerprint_user_visitor").on(table.userId, table.visitorId)
+]);
+var consentLog = pgCore.pgTable("consent_log", {
+  id: pgCore.text("id").notNull().primaryKey().$defaultFn(() => cuid2.createId()),
+  userId: pgCore.text("userId").notNull().references(() => users.id, { onDelete: "cascade" }),
+  // The cookie_consent value: "all", "necessary" or a comma list of purposes.
+  choice: pgCore.text("choice").notNull(),
+  // CONSENT_VERSION (lib/cookie-names.ts) at the time — which banner/policy
+  // wording the user agreed to.
+  version: pgCore.integer("version").notNull(),
+  // id of the user's record this one follows ("" for their first). Unique per
+  // user, so concurrent posts from several tabs that all saw the same latest
+  // record can't each insert a duplicate — one wins, the rest conflict. Works
+  // without transactions (neon-http has none). Null on rows from before it.
+  previousId: pgCore.text("previousId"),
+  createdAt: pgCore.timestamp("createdAt").notNull().defaultNow()
+}, (table) => [
+  pgCore.index("consent_log_user_idx").on(table.userId, table.createdAt),
+  pgCore.unique("consent_log_chain").on(table.userId, table.previousId)
+]);
+var authThrottle = pgCore.pgTable("auth_throttle", {
+  fingerprint: pgCore.text("fingerprint").notNull().primaryKey(),
+  count: pgCore.integer("count").notNull().default(0),
+  windowStart: pgCore.timestamp("windowStart").notNull().defaultNow(),
+  // Blockable data points, overwritten on every attempt (last-write-wins) so
+  // the admin panel can show who to block — by IP or by fingerprint — with no
+  // join and no per-attempt history table. windowStart anchors the counter's
+  // window; lastAttemptAt is just "most recently seen".
+  lastAttemptAt: pgCore.timestamp("lastAttemptAt").notNull().defaultNow(),
+  ipAddress: pgCore.text("ipAddress"),
+  userAgent: pgCore.text("userAgent"),
+  lastEmail: pgCore.text("lastEmail"),
+  lastKind: pgCore.text("lastKind")
+  // 'signin' | 'signup'
+});
+var systemSettings = pgCore.pgTable("system_settings", {
+  id: pgCore.text("id").primaryKey().default("default"),
+  maintenanceMode: pgCore.boolean("maintenanceMode").notNull().default(false),
+  maintenanceMessage: pgCore.text("maintenanceMessage"),
+  // Path prefixes that stay reachable while maintenance mode is on (see
+  // lib/maintenance.ts — a few auth paths are always open on top of these).
+  maintenanceExemptPaths: pgCore.text("maintenanceExemptPaths").array().notNull().default(DEFAULT_MAINTENANCE_EXEMPT_PATHS),
+  authEnableGoogle: pgCore.boolean("authEnableGoogle").notNull().default(true),
+  authEnableEmailPassword: pgCore.boolean("authEnableEmailPassword").notNull().default(true),
+  authEnableOneTap: pgCore.boolean("authEnableOneTap").notNull().default(false),
+  enableSessionRevocation: pgCore.boolean("enableSessionRevocation").notNull().default(true),
+  // Attach the error a user hit to feedback they send from it (see
+  // lib/feedback-route.ts). Off = only what the user typed is sent.
+  feedbackAttachErrors: pgCore.boolean("feedbackAttachErrors").notNull().default(true),
+  // GDPR/ePrivacy consent mode. On: cookie banner, FingerprintJS and One Tap
+  // only after "Accept all", device record erased on withdrawal. Off (no EU/UK
+  // users): no banner, treated as consented. Null = follow
+  // NEXT_PUBLIC_COOKIE_BANNER (nullable so migrating never flips a deployed
+  // banner on or off). proxy.ts mirrors the effective value into the
+  // consent_required cookie for the client (lib/cookie-consent.ts).
+  consentRequired: pgCore.boolean("consentRequired"),
+  updatedAt: pgCore.timestamp("updatedAt").notNull().defaultNow(),
+  // Who last changed a setting. This row doesn't "belong" to that admin the
+  // way sessions/activityLogs belong to their user, so deleting that admin's
+  // account should null this out rather than cascade-delete the singleton row.
+  updatedBy: pgCore.text("updatedBy").references(() => users.id, { onDelete: "set null" })
+}, (table) => [
+  pgCore.check("system_settings_singleton", drizzleOrm.sql`${table.id} = 'default'`)
+]);
+var errorRefs = pgCore.pgTable("error_refs", {
+  ref: pgCore.text("ref").primaryKey(),
+  message: pgCore.text("message").notNull(),
+  detail: pgCore.text("detail").notNull(),
+  createdAt: pgCore.timestamp("createdAt").notNull().defaultNow()
+}, (table) => [
+  pgCore.index("error_refs_created_at_idx").on(table.createdAt)
+]);
+var envSchema = zod.z.object({
+  NODE_ENV: zod.z.enum(["development", "production", "test"]).default("development"),
+  PORT: zod.z.string().default("3000").transform(Number),
+  DATABASE_URL: zod.z.string().default(""),
+  RESEND_API_KEY: zod.z.string().default(""),
+  // Full access key for marketing broadcasts (admin Marketing email page).
+  // Blank = use RESEND_API_KEY.
+  RESEND_BROADCAST_API_KEY: zod.z.string().default(""),
+  // Resend segment users join from the dashboard "Email updates" toggle.
+  // Blank = toggle hidden.
+  RESEND_MARKETING_SEGMENT_ID: zod.z.string().default(""),
+  // Sender for every transactional email. Must be on a domain verified in
+  // your Resend account.
+  EMAIL_FROM: zod.z.string().default("Acme <onboarding@xavierkhew.xyz>"),
+  // Display name for this deployment — shown as the authenticator-app label
+  // (2FA issuer) and the passkey relying-party name. Consuming projects set
+  // this in their own .env; defaults to the template name.
+  APP_NAME: zod.z.string().default("Next.js Template"),
+  // Where the dashboard feedback form delivers (app/api/feedback). Set either
+  // or both; with neither, the Feedback button is hidden. FEEDBACK_EMAIL takes
+  // a comma-separated list and sends through Resend (needs RESEND_API_KEY).
+  FEEDBACK_DISCORD_WEBHOOK_URL: zod.z.string().default(""),
+  FEEDBACK_EMAIL: zod.z.string().default(""),
+  // Seed-only: the live value lives in the system_settings DB row (see
+  // lib/settings-queries.ts) once it's been seeded on first read, and is
+  // changed from the admin System Settings page, not by editing this var.
+  ENABLE_SESSION_REVOCATION: zod.z.string().default("true").transform((val) => val === "true"),
+  AUTH_ENABLE_GOOGLE: zod.z.string().default("true").transform((val) => val === "true"),
+  AUTH_ENABLE_EMAIL_PASSWORD: zod.z.string().default("true").transform((val) => val === "true"),
+  AUTH_ENABLE_ONE_TAP: zod.z.string().default("false").transform((val) => val === "true"),
+  DB_DRIVER: zod.z.enum(["pg", "neon"]).default("pg"),
+  // Only relevant when DB_DRIVER=pg — whether the target Postgres server has SSL
+  // enabled. Self-hosted Postgres (e.g. via Docker/Dokploy) typically does not.
+  DATABASE_SSL: zod.z.string().default("false").transform((val) => val === "true")
+});
+
+// config/env.ts
+var results = envSchema.safeParse(process.env);
+if (results.success && results.data.NODE_ENV === "development") {
+  console.log("Environment variables loaded:", Object.keys(results.data));
+}
+if (!results.success) {
+  console.error("Invalid environment variables:", results.error.format());
+  throw new Error("Invalid environment variables");
+}
+var config = results.data;
+
+// server/db/index.ts
+var db;
+if (config.DB_DRIVER === "pg") {
+  const pool = new pg.Pool({
+    connectionString: config.DATABASE_URL,
+    ssl: config.DATABASE_SSL ? { rejectUnauthorized: false } : void 0
+  });
+  db = nodePostgres.drizzle(pool, {
+    schema: schema_exports,
+    logger: true
+  });
+  console.log("\u{1F7E1} Using PostgreSQL (pg) driver");
+} else if (config.DB_DRIVER === "neon") {
+  const sql4 = serverless.neon(config.DATABASE_URL);
+  db = neonHttp.drizzle(sql4, { schema: schema_exports, logger: true });
+  console.log("\u{1F7E2} Using Neon (HTTP) driver");
+} else {
+  console.log("Database connection not established, unknown DB_DRIVER:", config.DB_DRIVER);
+}
+async function logActivity({
+  userId,
+  action,
+  description,
+  ipAddress,
+  userAgent,
+  metadata,
+  referrerUrl,
+  os,
+  browser,
+  deviceType,
+  country,
+  city
+}) {
+  try {
+    await db.insert(activityLogs).values({
+      userId,
+      action,
+      description,
+      ipAddress: ipAddress || null,
+      userAgent: userAgent || null,
+      metadata: metadata ? JSON.stringify(metadata) : null,
+      referrerUrl: referrerUrl || null,
+      os: os || null,
+      browser: browser || null,
+      deviceType: deviceType || null,
+      country: country || null,
+      city: city || null
+    });
+  } catch (error) {
+    console.error("Failed to log activity:", error);
+  }
+}
+var countryNames = new Intl.DisplayNames(["en"], { type: "region" });
+function getClientIp(headers3) {
+  var _a;
+  const forwardedFor = headers3 == null ? void 0 : headers3.get("x-forwarded-for");
+  if (forwardedFor) return forwardedFor.split(",")[0].trim();
+  return (_a = headers3 == null ? void 0 : headers3.get("x-real-ip")) != null ? _a : null;
+}
+function parseUserAgent(userAgent) {
+  var _a;
+  if (!userAgent) {
+    return { os: null, browser: null, deviceType: "desktop" };
+  }
+  const { os, browser, device } = new uaParserJs.UAParser(userAgent).getResult();
+  return {
+    os: os.name ? [os.name, os.version].filter(Boolean).join(" ") : null,
+    browser: (_a = browser.name) != null ? _a : null,
+    deviceType: device.type === "mobile" || device.type === "tablet" ? device.type : "desktop"
+  };
+}
+function lookupGeoLocation(ipAddress) {
+  var _a;
+  if (!ipAddress) return { country: null, city: null };
+  const geo = geoip__default.default.lookup(ipAddress);
+  if (!geo) return { country: null, city: null };
+  let country = geo.country || null;
+  if (country) {
+    try {
+      country = (_a = countryNames.of(country)) != null ? _a : country;
+    } catch (e) {
+    }
+  }
+  return { country, city: geo.city || null };
+}
+function formatDeviceInfo({ os, browser, deviceType }) {
+  const label = [browser, os].filter(Boolean).join(" on ");
+  const typeLabel = deviceType === "mobile" ? "Mobile" : deviceType === "tablet" ? "Tablet" : "Desktop";
+  return label ? `${label} \xB7 ${typeLabel}` : `Unknown device \xB7 ${typeLabel}`;
+}
+function formatLocation({ country, city }) {
+  if (!country && !city) return "Unknown";
+  return [city, country].filter(Boolean).join(", ");
+}
+
+// lib/cookie-names.ts
+var LOGIN_REFERRER_COOKIE = "login_referrer";
+var DEVICE_FINGERPRINT_HEADER = "x-device-fingerprint";
+
+// lib/auth-throttle-limits.ts
+var WINDOW_MS = 15 * 60 * 1e3;
+var MAX = 10;
+var MAX_IP = MAX * 3;
+var RETENTION_MS = 30 * 24 * 60 * 60 * 1e3;
+function isOverLimit(row, now, max = MAX) {
+  if (!row) return false;
+  if (now - row.windowStart.getTime() >= WINDOW_MS) return false;
+  return row.count >= max;
+}
+
+// lib/auth-throttle.ts
+async function isDeviceThrottled(fingerprint, max) {
+  try {
+    const [row] = await db.select({ count: authThrottle.count, windowStart: authThrottle.windowStart }).from(authThrottle).where(drizzleOrm.eq(authThrottle.fingerprint, fingerprint)).limit(1);
+    return isOverLimit(row, Date.now(), max);
+  } catch (error) {
+    console.error("auth-throttle read failed, allowing request", error);
+    return false;
+  }
+}
+async function recordDeviceAttempt(fingerprint, meta) {
+  const now = /* @__PURE__ */ new Date();
+  const cutoff = new Date(now.getTime() - WINDOW_MS);
+  const seen = {
+    lastAttemptAt: now,
+    ipAddress: meta.ipAddress,
+    userAgent: meta.userAgent,
+    lastEmail: meta.email,
+    lastKind: meta.kind
+  };
+  try {
+    await db.insert(authThrottle).values(__spreadValues({ fingerprint, count: 1, windowStart: now }, seen)).onConflictDoUpdate({
+      target: authThrottle.fingerprint,
+      set: __spreadValues({
+        count: drizzleOrm.sql`case when ${authThrottle.windowStart} < ${cutoff} then 1 else ${authThrottle.count} + 1 end`,
+        windowStart: drizzleOrm.sql`case when ${authThrottle.windowStart} < ${cutoff} then ${now} else ${authThrottle.windowStart} end`
+      }, seen)
+    });
+  } catch (error) {
+    console.error("auth-throttle write failed", error);
+  }
+  await pruneStaleRows(now);
+}
+var PRUNE_EVERY_MS = 60 * 60 * 1e3;
+var lastPrune = 0;
+async function pruneStaleRows(now = /* @__PURE__ */ new Date()) {
+  if (now.getTime() - lastPrune < PRUNE_EVERY_MS) return;
+  lastPrune = now.getTime();
+  try {
+    await db.delete(authThrottle).where(drizzleOrm.lt(authThrottle.lastAttemptAt, new Date(now.getTime() - RETENTION_MS)));
+  } catch (error) {
+    console.error("auth-throttle prune failed", error);
+  }
+}
+async function clearDeviceThrottle(fingerprint) {
+  try {
+    await db.delete(authThrottle).where(drizzleOrm.eq(authThrottle.fingerprint, fingerprint));
+  } catch (error) {
+    console.error("auth-throttle clear failed", error);
+  }
+}
+var SETTINGS_ROW_ID = "default";
+var CACHE_TTL_MS = 1e4;
+var cached = null;
+function fallbackSettings() {
+  return {
+    id: SETTINGS_ROW_ID,
+    maintenanceMode: false,
+    maintenanceMessage: null,
+    maintenanceExemptPaths: DEFAULT_MAINTENANCE_EXEMPT_PATHS,
+    authEnableGoogle: config.AUTH_ENABLE_GOOGLE,
+    authEnableEmailPassword: config.AUTH_ENABLE_EMAIL_PASSWORD,
+    authEnableOneTap: config.AUTH_ENABLE_ONE_TAP,
+    enableSessionRevocation: config.ENABLE_SESSION_REVOCATION,
+    feedbackAttachErrors: true,
+    consentRequired: null,
+    updatedAt: /* @__PURE__ */ new Date(0),
+    updatedBy: null
+  };
+}
+async function loadOrSeed() {
+  var _a;
+  const existing = await db.select().from(systemSettings).where(drizzleOrm.eq(systemSettings.id, SETTINGS_ROW_ID)).limit(1);
+  if (existing[0]) return existing[0];
+  const seeded = await db.insert(systemSettings).values({
+    id: SETTINGS_ROW_ID,
+    maintenanceMode: false,
+    authEnableGoogle: config.AUTH_ENABLE_GOOGLE,
+    authEnableEmailPassword: config.AUTH_ENABLE_EMAIL_PASSWORD,
+    authEnableOneTap: config.AUTH_ENABLE_ONE_TAP,
+    enableSessionRevocation: config.ENABLE_SESSION_REVOCATION
+  }).onConflictDoNothing().returning();
+  if (seeded[0]) return seeded[0];
+  const retry = await db.select().from(systemSettings).where(drizzleOrm.eq(systemSettings.id, SETTINGS_ROW_ID)).limit(1);
+  return (_a = retry[0]) != null ? _a : fallbackSettings();
+}
+async function getSystemSettings() {
+  const now = Date.now();
+  if (cached && cached.expiresAt > now) return cached.value;
+  try {
+    const value = await loadOrSeed();
+    cached = { value, expiresAt: now + CACHE_TTL_MS };
+    return value;
+  } catch (error) {
+    console.error("Failed to load system settings, failing open:", error);
+    return fallbackSettings();
+  }
+}
+async function getEffectiveAuthFlags() {
+  const settings = await getSystemSettings();
+  return {
+    google: config.AUTH_ENABLE_GOOGLE && settings.authEnableGoogle,
+    emailPassword: config.AUTH_ENABLE_EMAIL_PASSWORD && settings.authEnableEmailPassword,
+    oneTap: config.AUTH_ENABLE_ONE_TAP && settings.authEnableOneTap
+  };
+}
+var EMAIL_FROM = config.EMAIL_FROM;
+var resend;
+async function getResend() {
+  if (!resend) {
+    const { Resend } = await import('resend');
+    resend = new Resend(config.RESEND_API_KEY);
+  }
+  return resend;
+}
+var BROADCAST_API_KEY = config.RESEND_BROADCAST_API_KEY || config.RESEND_API_KEY;
+var broadcastResend;
+async function getBroadcastResend() {
+  if (!broadcastResend) {
+    const { Resend } = await import('resend');
+    broadcastResend = new Resend(BROADCAST_API_KEY);
+  }
+  return broadcastResend;
+}
+
+// server/auth.ts
+async function logFailedLogin(ctx) {
+  var _a, _b, _c;
+  try {
+    const raw = (_a = ctx.body) == null ? void 0 : _a.email;
+    const email = typeof raw === "string" ? raw.toLowerCase() : null;
+    if (!email) return;
+    const [user] = await db.select({ id: users.id }).from(users).where(drizzleOrm.eq(users.email, email)).limit(1);
+    if (!user) return;
+    await logActivity({
+      userId: user.id,
+      action: "login_failed",
+      description: "Failed login attempt",
+      ipAddress: getClientIp(ctx.headers),
+      userAgent: (_c = (_b = ctx.headers) == null ? void 0 : _b.get("user-agent")) != null ? _c : null
+    });
+  } catch (error) {
+    console.error("Failed to log login_failed activity", error);
+  }
+}
+async function notifyPasskeyChange(ctx, action) {
+  var _a, _b, _c, _d;
+  try {
+    const session = await api.getSessionFromCtx(ctx);
+    const user = session == null ? void 0 : session.user;
+    if (!user) return;
+    const ip = getClientIp(ctx.headers);
+    await logActivity({
+      userId: user.id,
+      action: action === "added" ? "passkey_added" : "passkey_removed",
+      description: `Passkey ${action}`,
+      ipAddress: ip,
+      userAgent: (_b = (_a = ctx.headers) == null ? void 0 : _a.get("user-agent")) != null ? _b : null
+    });
+    if (!config.RESEND_API_KEY) return;
+    const { EmailTemplatePasskeyChange: EmailTemplatePasskeyChange2 } = await Promise.resolve().then(() => (init_email_template_passkey_change(), email_template_passkey_change_exports));
+    await (await getResend()).emails.send({
+      from: EMAIL_FROM,
+      to: [user.email],
+      subject: action === "added" ? "A passkey was added to your account" : "A passkey was removed from your account",
+      react: EmailTemplatePasskeyChange2({
+        firstName: user.name || "there",
+        action,
+        device: formatDeviceInfo(parseUserAgent((_d = (_c = ctx.headers) == null ? void 0 : _c.get("user-agent")) != null ? _d : null)),
+        location: formatLocation(lookupGeoLocation(ip)),
+        ipAddress: ip || "Unknown",
+        when: (/* @__PURE__ */ new Date()).toUTCString(),
+        manageUrl: `${process.env.BETTER_AUTH_URL || process.env.NEXTAUTH_URL || process.env.NEXT_PUBLIC_APP_URL || ""}/dashboard/settings`
+      })
+    });
+  } catch (error) {
+    console.error("Failed to send passkey-change notification", error);
+  }
+}
+function createAuth(overrides = {}) {
+  const socialProviders = __spreadValues(__spreadValues({}, config.AUTH_ENABLE_GOOGLE ? {
+    google: {
+      clientId: process.env.AUTH_GOOGLE_ID || process.env.GOOGLE_CLIENT_ID || "",
+      clientSecret: process.env.AUTH_GOOGLE_SECRET || process.env.GOOGLE_CLIENT_SECRET || ""
+    }
+  } : {}), overrides.socialProviders);
+  const emailAndPasswordEnabled = config.AUTH_ENABLE_EMAIL_PASSWORD;
+  const hasEnabledSocialProvider = Object.values(socialProviders).some(Boolean);
+  if (!hasEnabledSocialProvider && !emailAndPasswordEnabled) {
+    throw new Error(
+      "No auth provider is enabled \u2014 every social provider is off and emailAndPassword.enabled is false. Enable AUTH_ENABLE_GOOGLE / AUTH_ENABLE_EMAIL_PASSWORD, or pass your own provider via createAuth({ socialProviders: {...} })."
+    );
+  }
+  const baseURL = process.env.NEXTAUTH_URL || process.env.BETTER_AUTH_URL || "http://localhost:3000";
+  return betterAuth.betterAuth({
+    database: drizzle.drizzleAdapter(db, {
+      provider: "pg",
+      schema: {
+        user: users,
+        account: accounts,
+        session: sessions,
+        verification: verifications,
+        twoFactor: twoFactors,
+        passkey: passkeys
+      }
+    }),
+    // Session configuration (30 days expiration matching previous NextAuth setup)
+    session: {
+      expiresIn: 60 * 60 * 24 * 30,
+      // 30 days
+      updateAge: 60 * 60 * 24,
+      // Update session every 24 hours
+      cookieCache: {
+        enabled: true,
+        // Enable hybrid session caching for performance
+        maxAge: 5 * 60
+        // 5 minutes
+      }
+    },
+    // Email & Password Authentication (replaces Credentials provider)
+    // Toggle per-project via AUTH_ENABLE_EMAIL_PASSWORD in that project's own .env.*
+    emailAndPassword: {
+      enabled: emailAndPasswordEnabled,
+      requireEmailVerification: false,
+      // `url` is fully composed by better-auth (baseURL + verification token +
+      // callbackURL) — see app/(auth)/forgot-password and reset-password for
+      // the pages this points at.
+      async sendResetPassword({ user, url }) {
+        const { EmailTemplateResetPassword: EmailTemplateResetPassword2 } = await Promise.resolve().then(() => (init_email_template_reset_password(), email_template_reset_password_exports));
+        await (await getResend()).emails.send({
+          from: EMAIL_FROM,
+          to: [user.email],
+          subject: "Reset your password",
+          react: EmailTemplateResetPassword2({ firstName: user.name || "there", url })
+        });
+      }
+    },
+    // Email verification. `requireEmailVerification` above stays false, so this
+    // is opt-in: users trigger it from the dashboard via
+    // authClient.sendVerificationEmail(). better-auth composes `url`
+    // (baseURL + token + callbackURL) and serves the /api/auth/verify-email
+    // callback that flips users.emailVerified on click.
+    emailVerification: {
+      autoSignInAfterVerification: true,
+      async sendVerificationEmail({ user, url }) {
+        const { EmailTemplateVerifyEmail: EmailTemplateVerifyEmail2 } = await Promise.resolve().then(() => (init_email_template_verify_email(), email_template_verify_email_exports));
+        await (await getResend()).emails.send({
+          from: EMAIL_FROM,
+          to: [user.email],
+          subject: "Confirm your email",
+          react: EmailTemplateVerifyEmail2({ firstName: user.name || "there", url })
+        });
+      }
+    },
+    // Social Providers — google is included by default; toggle per-project via
+    // AUTH_ENABLE_GOOGLE. overrides.socialProviders can still add more (or replace it).
+    socialProviders,
+    // User schema configuration
+    user: {
+      additionalFields: {
+        role: {
+          type: "string",
+          required: false,
+          defaultValue: "user",
+          input: false
+          // Prevent users from setting their own role
+        }
+      },
+      // Self-service "Delete account" (dashboard Settings → Danger zone).
+      // Credential users confirm with their password; OAuth-only users have
+      // no password, so better-auth instead requires a session younger than
+      // `freshAge` (default 1 day). Every user-owned table cascades on delete.
+      // Impersonation and last-admin guards live in hooks.before below.
+      deleteUser: { enabled: true }
+    },
+    // Advanced options
+    advanced: {
+      database: {
+        generateId: () => cuid2.createId()
+      }
+    },
+    // Every new session row corresponds to a sign-in (credential or OAuth) —
+    // use that as the "last logged in" signal rather than session updates,
+    // which also fire on cookie-cache refresh / expiry extension.
+    databaseHooks: {
+      session: {
+        create: {
+          async after(session, context) {
+            var _a, _b, _c, _d;
+            const impersonatedBy = session.impersonatedBy;
+            if (impersonatedBy) {
+              const target = await db.select({ email: users.email }).from(users).where(drizzleOrm.eq(users.id, session.userId)).limit(1);
+              await logActivity({
+                userId: impersonatedBy,
+                action: "impersonation_started",
+                description: `Admin started impersonating ${(_b = (_a = target[0]) == null ? void 0 : _a.email) != null ? _b : session.userId}`,
+                metadata: { impersonatedUserId: session.userId }
+              });
+              return;
+            }
+            try {
+              await db.update(users).set({ lastLoginAt: /* @__PURE__ */ new Date() }).where(drizzleOrm.eq(users.id, session.userId));
+            } catch (error) {
+              console.error("Failed to update lastLoginAt", error);
+            }
+            try {
+              const headers3 = context == null ? void 0 : context.headers;
+              const ipAddress = getClientIp(headers3);
+              const userAgent = (_c = headers3 == null ? void 0 : headers3.get("user-agent")) != null ? _c : null;
+              const referrerUrl = ((_d = context == null ? void 0 : context.getCookie) == null ? void 0 : _d.call(context, LOGIN_REFERRER_COOKIE)) || (headers3 == null ? void 0 : headers3.get("referer")) || null;
+              const device = parseUserAgent(userAgent);
+              const geo = lookupGeoLocation(ipAddress);
+              const [{ count }] = await db.select({ count: drizzleOrm.sql`count(*)` }).from(sessions).where(drizzleOrm.eq(sessions.userId, session.userId));
+              const isFirstSession = Number(count) <= 1;
+              await logActivity({
+                userId: session.userId,
+                action: "login",
+                description: isFirstSession ? "New account registered and signed in" : "User logged in",
+                ipAddress,
+                userAgent,
+                referrerUrl,
+                os: device.os,
+                browser: device.browser,
+                deviceType: device.deviceType,
+                country: geo.country,
+                city: geo.city
+              });
+            } catch (error) {
+              console.error("Failed to log login activity", error);
+            }
+          }
+        }
+      }
+    },
+    // better-auth's admin plugin ends impersonation by deleting the
+    // impersonation session and restoring the admin's original session
+    // straight from a signed cookie — it never runs session.create, so
+    // there's no databaseHooks entry point to log the stop event from.
+    // Reading the session here (before the endpoint deletes it) is the only
+    // point where both the admin id and the impersonated user id are still
+    // available together.
+    hooks: {
+      before: api.createAuthMiddleware(async (ctx) => {
+        var _a, _b, _c, _d;
+        if (ctx.path === "/sign-in/email" || ctx.path === "/sign-up/email") {
+          const fingerprint = (_a = ctx.headers) == null ? void 0 : _a.get(DEVICE_FINGERPRINT_HEADER);
+          const ip = getClientIp(ctx.headers);
+          const throttled = fingerprint && await isDeviceThrottled(fingerprint) || ip && await isDeviceThrottled(`ip:${ip}`, MAX_IP);
+          if (throttled) {
+            throw new api.APIError("TOO_MANY_REQUESTS", {
+              message: "Too many attempts from this device. Try again in a few minutes."
+            });
+          }
+        }
+        if (ctx.path === "/sign-in/social") {
+          if (((_b = ctx.body) == null ? void 0 : _b.provider) === "google") {
+            const flags = await getEffectiveAuthFlags();
+            if (!flags.google) {
+              throw new api.APIError("FORBIDDEN", { message: "Google sign-in is currently disabled." });
+            }
+          }
+          return;
+        }
+        if (ctx.path === "/sign-in/email") {
+          const flags = await getEffectiveAuthFlags();
+          if (!flags.emailPassword) {
+            throw new api.APIError("FORBIDDEN", { message: "Email/password sign-in is currently disabled." });
+          }
+          return;
+        }
+        if (ctx.path === "/one-tap/callback") {
+          const flags = await getEffectiveAuthFlags();
+          if (!flags.google || !flags.oneTap) {
+            throw new api.APIError("FORBIDDEN", { message: "Google One Tap is currently disabled." });
+          }
+          return;
+        }
+        if (ctx.path === "/delete-user") {
+          const current2 = await api.getSessionFromCtx(ctx, { disableCookieCache: true });
+          if (!current2) return;
+          if (current2.session.impersonatedBy) {
+            throw new api.APIError("FORBIDDEN", { message: "Stop impersonating before deleting an account." });
+          }
+          if (current2.user.role === "admin") {
+            const [{ count }] = await db.select({ count: drizzleOrm.sql`count(*)` }).from(users).where(drizzleOrm.eq(users.role, "admin"));
+            if (Number(count) <= 1) {
+              throw new api.APIError("FORBIDDEN", { message: "You're the only admin. Promote another user to admin first." });
+            }
+          }
+          return;
+        }
+        if (ctx.path !== "/admin/stop-impersonating") return;
+        const current = await api.getSessionFromCtx(ctx, { disableCookieCache: true });
+        if (current == null ? void 0 : current.session.impersonatedBy) {
+          const target = await db.select({ email: users.email }).from(users).where(drizzleOrm.eq(users.id, current.session.userId)).limit(1);
+          await logActivity({
+            userId: current.session.impersonatedBy,
+            action: "impersonation_stopped",
+            description: `Admin stopped impersonating ${(_d = (_c = target[0]) == null ? void 0 : _c.email) != null ? _d : current.session.userId}`,
+            metadata: { impersonatedUserId: current.session.userId }
+          });
+        }
+      }),
+      after: api.createAuthMiddleware(async (ctx) => {
+        var _a, _b, _c, _d;
+        if (ctx.path === "/passkey/verify-registration" || ctx.path === "/passkey/delete-passkey") {
+          if (ctx.context.returned instanceof api.APIError) return;
+          await notifyPasskeyChange(
+            ctx,
+            ctx.path === "/passkey/verify-registration" ? "added" : "removed"
+          );
+          return;
+        }
+        if (ctx.path !== "/sign-in/email" && ctx.path !== "/sign-up/email") return;
+        const fingerprint = (_a = ctx.headers) == null ? void 0 : _a.get(DEVICE_FINGERPRINT_HEADER);
+        const ip = getClientIp(ctx.headers);
+        const ipKey = ip ? `ip:${ip}` : null;
+        if (!fingerprint && !ipKey) return;
+        const failed = ctx.context.returned instanceof api.APIError;
+        const rawEmail = (_b = ctx.body) == null ? void 0 : _b.email;
+        const meta = {
+          ipAddress: ip,
+          userAgent: (_d = (_c = ctx.headers) == null ? void 0 : _c.get("user-agent")) != null ? _d : null,
+          email: typeof rawEmail === "string" ? rawEmail.toLowerCase() : null
+        };
+        const keys = [fingerprint, ipKey].filter((k) => !!k);
+        if (ctx.path === "/sign-up/email") {
+          await Promise.all(keys.map((key) => recordDeviceAttempt(key, __spreadProps(__spreadValues({}, meta), { kind: "signup" }))));
+          return;
+        }
+        if (failed) {
+          await Promise.all(keys.map((key) => recordDeviceAttempt(key, __spreadProps(__spreadValues({}, meta), { kind: "signin" }))));
+          await logFailedLogin(ctx);
+        } else {
+          await Promise.all(keys.map((key) => clearDeviceThrottle(key)));
+        }
+      })
+    },
+    // Base URL for callbacks
+    baseURL,
+    // Secret for signing cookies and tokens
+    secret: process.env.AUTH_SECRET,
+    // The OAuth `state` is a one-time verification row: the callback consumes
+    // and deletes it. When the same callback URL gets hit twice (browser
+    // prefetch / bfcache / double nav — common on a repeat Google sign-in
+    // where Google auto-redirects with no consent screen), the first hit
+    // logs the user in and the second finds no `state` row and throws
+    // `please_restart_the_process`. Default sends that to better-auth's bare
+    // error page; point it at /login instead, which already bounces an
+    // authenticated user straight to their callbackUrl — so the losing race
+    // just lands them logged in. See better-auth#5658 / #6544.
+    onAPIError: {
+      errorURL: "/login"
+    },
+    plugins: [
+      // Registered for impersonation (auth.api.impersonateUser / stopImpersonating)
+      // only — role/ban/delete stay on our own custom routes above. adminRoles
+      // matches our existing role column so the plugin's own permission checks
+      // line up with hasRole(role, 'admin'). banReason is remapped onto our
+      // existing bannedReason column instead of adding a duplicate field.
+      plugins.admin({
+        adminRoles: ["admin"],
+        schema: {
+          user: {
+            fields: {
+              banReason: "bannedReason"
+            }
+          }
+        }
+      }),
+      // TOTP second factor + encrypted backup codes. `issuer` is the label
+      // shown in the user's authenticator app.
+      plugins.twoFactor({ issuer: config.APP_NAME }),
+      // WebAuthn passkeys (Touch ID / Windows Hello / security keys) as a
+      // passwordless sign-in method. rpID must be the bare host and origin
+      // the full URL — both derived from baseURL above.
+      passkey.passkey({
+        rpID: new URL(baseURL).hostname,
+        rpName: config.APP_NAME,
+        origin: baseURL
+      }),
+      // checks to see if oneTap is enabled and if google provider is available, then add the oneTap plugin.
+      // Keep this spread last: a leading spread turns `plugins` from a tuple into a plain
+      // array and better-auth 1.7 then drops plugin fields (e.g. session.impersonatedBy).
+      ...config.AUTH_ENABLE_ONE_TAP && Boolean(socialProviders.google) ? [plugins.oneTap()] : []
+    ]
+  });
+}
+var _auth;
+function getDefaultAuth() {
+  if (!_auth) _auth = createAuth();
+  return _auth;
+}
+var auth = new Proxy({}, {
+  get(_target, prop) {
+    const instance = getDefaultAuth();
+    const value = Reflect.get(instance, prop);
+    return typeof value === "function" ? value.bind(instance) : value;
+  },
+  // "prop" in auth (e.g. better-auth's toNextJsHandler does `"handler" in auth`)
+  // must also see the real instance — without this it checks the empty
+  // placeholder target and always reports false.
+  has(_target, prop) {
+    return Reflect.has(getDefaultAuth(), prop);
+  },
+  ownKeys(_target) {
+    return Reflect.ownKeys(getDefaultAuth());
+  },
+  getOwnPropertyDescriptor(_target, prop) {
+    return Reflect.getOwnPropertyDescriptor(getDefaultAuth(), prop);
+  }
+});
+var getCurrentSession = react.cache(async () => {
+  const session = await auth.api.getSession({
+    headers: await headers.headers()
+  });
+  return session;
+});
+react.cache(async () => {
+  var _a;
+  const session = await getCurrentSession();
+  if (!(session == null ? void 0 : session.user)) {
+    navigation.redirect("/login");
+  }
+  const user = await db.select().from(users).where(drizzleOrm.eq(users.id, session.user.id)).limit(1);
+  if ((_a = user[0]) == null ? void 0 : _a.banned) {
+    await auth.api.signOut({
+      headers: await headers.headers()
+    });
+    navigation.redirect("/login?error=account_banned");
+  }
+  return session;
+});
+function hasRole(userRole, requiredRole) {
+  if (!userRole) return false;
+  {
+    return userRole === "admin";
+  }
+}
+var MARKETING_SEGMENT_ID = config.RESEND_MARKETING_SEGMENT_ID;
+async function setSubscribed(email, name, subscribed) {
+  const resend2 = await getBroadcastResend();
+  const contact = await resend2.contacts.get({ email });
+  const exists = !contact.error;
+  if (contact.error && contact.error.name !== "not_found") throw new Error(contact.error.message);
+  if (!subscribed) {
+    if (!exists) return;
+    const { error: error2 } = await resend2.contacts.update({ email, unsubscribed: true });
+    if (error2) throw new Error(error2.message);
+    return;
+  }
+  const { error } = exists ? await resend2.contacts.update({ email, unsubscribed: false }) : await resend2.contacts.create({ email, firstName: name || void 0, unsubscribed: false });
+  if (error) throw new Error(error.message);
+  const segments = await resend2.contacts.segments.list({ email });
+  if (segments.error) throw new Error(segments.error.message);
+  if (!segments.data.data.some((s) => s.id === MARKETING_SEGMENT_ID)) {
+    const added = await resend2.contacts.segments.add({ email, segmentId: MARKETING_SEGMENT_ID });
+    if (added.error) throw new Error(added.error.message);
+  }
+}
+
+// lib/marketing-email.ts
+var UNSUBSCRIBE_PLACEHOLDER = "{{{RESEND_UNSUBSCRIBE_URL}}}";
+var escapeHtml = (s) => s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+function textToBroadcastHtml(text2) {
+  const paragraphs = text2.trim().split(/\n\s*\n/).map((p) => `<p style="margin:0 0 16px;line-height:24px">${escapeHtml(p.trim()).replace(/\n/g, "<br>")}</p>`).join("");
+  return `<div style="font-family:Arial,sans-serif;font-size:16px;color:#1a1a1a;max-width:560px;margin:0 auto;padding:20px 0">${paragraphs}<p style="margin-top:32px;font-size:12px;color:#999999"><a href="${UNSUBSCRIBE_PLACEHOLDER}" style="color:#999999">Unsubscribe</a></p></div>`;
+}
+function textToBroadcastText(text2) {
+  return `${text2.trim()}
+
+--
+Unsubscribe: ${UNSUBSCRIBE_PLACEHOLDER}`;
+}
+var REF_ALPHABET = "23456789ABCDEFGHJKLMNPQRSTUVWXYZ";
+var DETAIL_MAX_LENGTH = 8e3;
+var RETENTION_MS2 = 30 * 24 * 60 * 60 * 1e3;
+function describeError(error) {
+  if (error instanceof Error) return error.stack || `${error.name}: ${error.message}`;
+  try {
+    return JSON.stringify(error, null, 2);
+  } catch (e) {
+    return String(error);
+  }
+}
+function storeDetail(ref, message, error) {
+  const save = async () => {
+    try {
+      await db.insert(errorRefs).values({
+        ref,
+        message,
+        detail: describeError(error).slice(0, DETAIL_MAX_LENGTH)
+      });
+      await db.delete(errorRefs).where(drizzleOrm.lt(errorRefs.createdAt, new Date(Date.now() - RETENTION_MS2)));
+    } catch (storeError) {
+      console.error(`[error ref ${ref}] could not store error detail`, storeError);
+    }
+  };
+  try {
+    server.after(save);
+  } catch (e) {
+    void save();
+  }
+}
+function unexpectedErrorMessage(error, message = "Something went wrong. Please try again.") {
+  const ref = Array.from(crypto.randomBytes(6), (b) => REF_ALPHABET[b % REF_ALPHABET.length]).join("");
+  console.error(`[error ref ${ref}] ${message}`, error);
+  storeDetail(ref, message, error);
+  return `${message} (ref: ${ref})`;
+}
+
+// lib/marketing-route.ts
+async function getSession() {
+  return auth.api.getSession({ headers: await headers.headers() });
+}
+async function requireAdmin() {
+  const session = await getSession();
+  if (!(session == null ? void 0 : session.user)) {
+    return server.NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+  if (!hasRole(session.user.role)) {
+    return server.NextResponse.json({ error: "Forbidden" }, { status: 403 });
+  }
+  return null;
+}
+var createSchema = zod.z.object({
+  segmentId: zod.z.string().min(1),
+  subject: zod.z.string().trim().min(1).max(200),
+  previewText: zod.z.string().trim().max(200).optional(),
+  body: zod.z.string().trim().min(1).max(5e4),
+  send: zod.z.boolean()
+});
+async function createBroadcastPOST(request) {
+  const denied = await requireAdmin();
+  if (denied) return denied;
+  const parsed = createSchema.safeParse(await request.json().catch(() => null));
+  if (!parsed.success) {
+    return server.NextResponse.json({ error: "Segment, subject and message are required" }, { status: 400 });
+  }
+  const { segmentId, subject, previewText, body, send } = parsed.data;
+  try {
+    const resend2 = await getBroadcastResend();
+    const created = await resend2.broadcasts.create({
+      segmentId,
+      from: EMAIL_FROM,
+      subject,
+      previewText: previewText || void 0,
+      name: subject,
+      html: textToBroadcastHtml(body),
+      text: textToBroadcastText(body)
+    });
+    if (created.error) {
+      return server.NextResponse.json({ error: created.error.message }, { status: 502 });
+    }
+    if (send) {
+      const sent = await resend2.broadcasts.send(created.data.id);
+      if (sent.error) {
+        return server.NextResponse.json(
+          { error: `Draft saved in Resend, but sending failed: ${sent.error.message}` },
+          { status: 502 }
+        );
+      }
+    }
+    return server.NextResponse.json({ success: true, id: created.data.id, sent: send });
+  } catch (error) {
+    return server.NextResponse.json(
+      { error: unexpectedErrorMessage(error, "Failed to create broadcast") },
+      { status: 500 }
+    );
+  }
+}
+async function getBroadcastGET(_request, { params }) {
+  const denied = await requireAdmin();
+  if (denied) return denied;
+  try {
+    const { id } = await params;
+    const { data, error } = await (await getBroadcastResend()).broadcasts.get(id);
+    if (error) {
+      return server.NextResponse.json({ error: error.message }, { status: 502 });
+    }
+    return server.NextResponse.json({
+      subject: data.subject,
+      from: data.from,
+      previewText: data.preview_text,
+      html: data.html,
+      text: data.text,
+      status: data.status
+    });
+  } catch (error) {
+    return server.NextResponse.json(
+      { error: unexpectedErrorMessage(error, "Failed to load broadcast") },
+      { status: 500 }
+    );
+  }
+}
+async function sendBroadcastPOST(_request, { params }) {
+  const denied = await requireAdmin();
+  if (denied) return denied;
+  try {
+    const { id } = await params;
+    const resend2 = await getBroadcastResend();
+    const current = await resend2.broadcasts.get(id);
+    if (current.error) {
+      return server.NextResponse.json({ error: current.error.message }, { status: 502 });
+    }
+    if (current.data.status !== "draft") {
+      return server.NextResponse.json({ error: "This broadcast has already been sent" }, { status: 409 });
+    }
+    const sent = await resend2.broadcasts.send(id);
+    if (sent.error) {
+      return server.NextResponse.json({ error: sent.error.message }, { status: 502 });
+    }
+    return server.NextResponse.json({ success: true });
+  } catch (error) {
+    return server.NextResponse.json(
+      { error: unexpectedErrorMessage(error, "Failed to send broadcast") },
+      { status: 500 }
+    );
+  }
+}
+var subscriptionSchema = zod.z.object({ subscribed: zod.z.boolean() });
+async function updateSubscriptionPUT(request) {
+  const session = await getSession();
+  if (!(session == null ? void 0 : session.user)) {
+    return server.NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+  if (!MARKETING_SEGMENT_ID) {
+    return server.NextResponse.json({ error: "Product updates aren't set up" }, { status: 404 });
+  }
+  const parsed = subscriptionSchema.safeParse(await request.json().catch(() => null));
+  if (!parsed.success) {
+    return server.NextResponse.json({ error: "Invalid request" }, { status: 400 });
+  }
+  if (parsed.data.subscribed && !session.user.emailVerified) {
+    return server.NextResponse.json({ error: "Verify your email address first" }, { status: 403 });
+  }
+  try {
+    await setSubscribed(session.user.email, session.user.name, parsed.data.subscribed);
+    return server.NextResponse.json({ subscribed: parsed.data.subscribed });
+  } catch (error) {
+    return server.NextResponse.json(
+      { error: unexpectedErrorMessage(error, "Failed to update subscription") },
+      { status: 500 }
+    );
+  }
+}
+
+exports.createBroadcastPOST = createBroadcastPOST;
+exports.getBroadcastGET = getBroadcastGET;
+exports.sendBroadcastPOST = sendBroadcastPOST;
+exports.updateSubscriptionPUT = updateSubscriptionPUT;
+//# sourceMappingURL=marketing.js.map
+//# sourceMappingURL=marketing.js.map