@xk2800/nextjs-template 0.8.0-beta.0 → 0.8.0-beta.2

package/README.md

@@ -93,6 +93,7 @@ Peer dependencies, the full import list, migrations, adding providers and One Ta
 | `bun run migrate:dev` / `:prod` / `:test` | Apply migrations |
 | `bun run studio:dev` | Drizzle Studio |
 | `bun run test` | Unit tests |
+| `bun run storybook` | Storybook for every component (mock data, no DB needed) |
 | `bun run *:doppler` | Any of the above with secrets from Doppler |
 
 **Working on the template itself:** clone this repo, copy `.env.development.example` to `.env.development`, then run `bun install`. Publishing steps are in [PUBLISHING.md](PUBLISHING.md).

package/components/dashboard/admin/adminUsersTable.tsx

@@ -69,7 +69,7 @@ export default function AdminUsersTable({ initialUsers, initialPagination }: Adm
   const [page, setPage] = useState(1)
   const [pagination, setPagination] = useState<PaginationData | null>(initialPagination)
   const [actionUserId, setActionUserId] = useState<string | null>(null)
-  const [actionType, setActionType] = useState<'delete' | 'ban' | 'unban' | 'promote' | 'demote' | 'impersonate' | null>(null)
+  const [actionType, setActionType] = useState<'delete' | 'ban' | 'unban' | 'promote' | 'demote' | 'tester' | 'untester' | 'impersonate' | null>(null)
   const [isProcessing, setIsProcessing] = useState(false)
   const [isExporting, setIsExporting] = useState(false)
   const [selectedIds, setSelectedIds] = useState<Set<string>>(new Set())
@@ -229,6 +229,22 @@ export default function AdminUsersTable({ initialUsers, initialPagination }: Adm
           })
           successMessage = 'Admin access removed'
           break
+        case 'tester':
+          response = await fetch(`/api/admin/users/${actionUserId}/role`, {
+            method: 'PATCH',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ role: 'tester' }),
+          })
+          successMessage = 'User marked as tester'
+          break
+        case 'untester':
+          response = await fetch(`/api/admin/users/${actionUserId}/role`, {
+            method: 'PATCH',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ role: 'user' }),
+          })
+          successMessage = 'Tester role removed'
+          break
       }
 
       if (!response?.ok) throw new Error('Action failed')
@@ -426,7 +442,7 @@ export default function AdminUsersTable({ initialUsers, initialPagination }: Adm
                   title: 'Actions',
                   minWidth: 340,
                   renderer: (user) => (
-                    <div className="space-x-2 text-right">
+                    <div className="flex flex-wrap justify-end gap-2">
                       <Button
                         variant="outline"
                         size="sm"
@@ -462,6 +478,18 @@ export default function AdminUsersTable({ initialUsers, initialPagination }: Adm
                           Make Admin
                         </Button>
                       )}
+                      {user.role !== 'admin' && (
+                        <Button
+                          variant="outline"
+                          size="sm"
+                          onClick={() => {
+                            setActionUserId(user.id)
+                            setActionType(user.role === 'tester' ? 'untester' : 'tester')
+                          }}
+                        >
+                          {user.role === 'tester' ? 'Remove Tester' : 'Make Tester'}
+                        </Button>
+                      )}
                       {user.banned ? (
                         <Button
                           variant="outline"
@@ -530,6 +558,8 @@ export default function AdminUsersTable({ initialUsers, initialPagination }: Adm
               {actionType === 'unban' && 'Unban User?'}
               {actionType === 'promote' && 'Promote to Admin?'}
               {actionType === 'demote' && 'Remove Admin Access?'}
+              {actionType === 'tester' && 'Make Tester?'}
+              {actionType === 'untester' && 'Remove Tester Role?'}
               {actionType === 'impersonate' && 'Impersonate User?'}
             </AlertDialogTitle>
             <AlertDialogDescription>
@@ -540,6 +570,10 @@ export default function AdminUsersTable({ initialUsers, initialPagination }: Adm
               {actionType === 'unban' && 'This will restore the user access.'}
               {actionType === 'promote' &&
                 'This will grant the user full admin dashboard access.'}
+              {actionType === 'tester' &&
+                'Marks this account as a test account. It gets no admin access.'}
+              {actionType === 'untester' &&
+                'Turns this test account back into a regular user.'}
               {actionType === 'demote' &&
                 "This will revoke the user's admin dashboard access."}
               {actionType === 'impersonate' &&

package/components/dashboard/installAppCard.tsx

@@ -0,0 +1,187 @@
+'use client'
+
+import { useEffect, useState, type ReactNode } from 'react'
+import { CircleCheck, Download } from 'lucide-react'
+import { Card, CardContent, CardHeader, CardTitle, CardDescription } from '../ui/card'
+import { Button } from '../ui/button'
+
+// Chrome/Edge's install event; not in the DOM typings yet.
+type InstallPromptEvent = Event & { prompt: () => Promise<{ outcome: 'accepted' | 'dismissed' }> }
+
+declare global {
+  interface Window {
+    // Stashed by app/layout.tsx in case the event fires before this card mounts.
+    __pwaInstallPrompt?: InstallPromptEvent
+  }
+}
+
+export type InstallTarget = {
+  os: 'ios' | 'android' | 'desktop'
+  browser: 'safari' | 'chrome' | 'edge' | 'firefox' | 'samsung' | 'other'
+}
+
+// iPadOS reports a Mac user agent, so touch support tells them apart.
+export function detectInstallTarget(ua: string, maxTouchPoints = 0): InstallTarget {
+  const ios = /iPhone|iPad|iPod/.test(ua) || (/Macintosh/.test(ua) && maxTouchPoints > 1)
+  const os = ios ? 'ios' : /Android/.test(ua) ? 'android' : 'desktop'
+  const browser = /SamsungBrowser/.test(ua)
+    ? 'samsung'
+    : /Edg(e|A|iOS)?\//.test(ua)
+      ? 'edge'
+      : /Firefox|FxiOS/.test(ua)
+        ? 'firefox'
+        : /OPR\/|Opera/.test(ua)
+          ? 'other'
+          : /Chrome|CriOS/.test(ua)
+            ? 'chrome'
+            : /Safari/.test(ua)
+              ? 'safari'
+              : 'other'
+  return { os, browser }
+}
+
+const BROWSER_NAMES: Record<InstallTarget['browser'], string> = {
+  safari: 'Safari',
+  chrome: 'Chrome',
+  edge: 'Edge',
+  firefox: 'Firefox',
+  samsung: 'Samsung Internet',
+  other: 'your browser',
+}
+const OS_NAMES: Record<InstallTarget['os'], string> = {
+  ios: 'iPhone / iPad',
+  android: 'Android',
+  desktop: 'this computer',
+}
+
+// Manual steps for each OS/browser, or null when the browser can't install apps.
+function steps({ os, browser }: InstallTarget): ReactNode[] | null {
+  if (os === 'ios') {
+    return [
+      browser === 'safari' ? (
+        <>Tap <strong>Share</strong> in the toolbar. It may be inside the <strong>⋯</strong> menu.</>
+      ) : (
+        <>Tap <strong>Share</strong> in the address bar or menu.</>
+      ),
+      <>Choose <strong>Add to Home Screen</strong>. Keep &ldquo;Open as Web App&rdquo; on if shown.</>,
+      <>Tap <strong>Add</strong>, then open the new icon on your home screen.</>,
+    ]
+  }
+  if (os === 'android') {
+    if (browser === 'samsung') {
+      return [
+        <>Tap the <strong>☰</strong> menu at the bottom right.</>,
+        <>Choose <strong>Add page to</strong> → <strong>Home screen</strong>.</>,
+      ]
+    }
+    return [
+      <>Tap the <strong>⋮</strong> menu at the top right.</>,
+      <>Choose <strong>Install app</strong> or <strong>Add to Home screen</strong>.</>,
+    ]
+  }
+  if (browser === 'chrome') {
+    return [
+      <>
+        Click the install icon at the right of the address bar, or open the <strong>⋮</strong> menu
+        and choose <strong>Cast, save and share</strong> → <strong>Install page as app</strong>.
+      </>,
+    ]
+  }
+  if (browser === 'edge') {
+    return [
+      <>
+        Click the install icon at the right of the address bar, or open the <strong>⋯</strong> menu
+        and choose <strong>Apps</strong> → <strong>Install this site as an app</strong>.
+      </>,
+    ]
+  }
+  if (browser === 'safari') {
+    return [<>Choose <strong>File</strong> → <strong>Add to Dock</strong> (macOS Sonoma or later).</>]
+  }
+  return null
+}
+
+// Install instructions for the visitor's own OS and browser, plus a one-click
+// Install button where the browser offers one (Chrome, Edge). Shows a
+// confirmation instead once the app runs installed.
+export default function InstallAppCard() {
+  const [target, setTarget] = useState<InstallTarget | undefined>()
+  const [installed, setInstalled] = useState(false)
+  const [prompt, setPrompt] = useState<InstallPromptEvent | undefined>()
+
+  useEffect(() => {
+    setTarget(detectInstallTarget(navigator.userAgent, navigator.maxTouchPoints))
+    setInstalled(
+      matchMedia('(display-mode: standalone)').matches ||
+        (navigator as Navigator & { standalone?: boolean }).standalone === true
+    )
+    setPrompt(window.__pwaInstallPrompt)
+
+    const onPrompt = (e: Event) => setPrompt(e as InstallPromptEvent)
+    const onInstalled = () => setInstalled(true)
+    addEventListener('beforeinstallprompt', onPrompt)
+    addEventListener('appinstalled', onInstalled)
+    return () => {
+      removeEventListener('beforeinstallprompt', onPrompt)
+      removeEventListener('appinstalled', onInstalled)
+    }
+  }, [])
+
+  async function install() {
+    if (!prompt) return
+    const { outcome } = await prompt.prompt()
+    // The event can only be used once.
+    window.__pwaInstallPrompt = undefined
+    setPrompt(undefined)
+    if (outcome === 'accepted') setInstalled(true)
+  }
+
+  // Rendered after mount only: the server can't see the visitor's device.
+  if (!target) return null
+  const list = steps(target)
+
+  return (
+    <Card>
+      <CardHeader>
+        <CardTitle>Install the app</CardTitle>
+        <CardDescription>
+          Open it from your home screen or dock, in its own window.
+        </CardDescription>
+      </CardHeader>
+      <CardContent className="space-y-4">
+        {installed ? (
+          <p className="flex items-center gap-2 text-sm">
+            <CircleCheck className="size-4 text-green-600" aria-hidden />
+            You&apos;re using the installed app on this device.
+          </p>
+        ) : (
+          <>
+            <p className="text-sm text-muted-foreground">
+              {BROWSER_NAMES[target.browser]} on {OS_NAMES[target.os]}
+            </p>
+            {prompt && (
+              <Button onClick={install}>
+                <Download aria-hidden /> Install app
+              </Button>
+            )}
+            {list ? (
+              <ol className="list-decimal space-y-2 pl-5 text-sm marker:text-muted-foreground">
+                {list.map((step, i) => (
+                  <li key={i}>{step}</li>
+                ))}
+              </ol>
+            ) : (
+              !prompt && (
+                <p className="text-sm">
+                  This browser can&apos;t install apps. Open this page in{' '}
+                  {target.os === 'desktop' ? 'Chrome, Edge, or Safari on a Mac' : 'Chrome'} to install
+                  it.
+                </p>
+              )
+            )}
+          </>
+        )}
+      </CardContent>
+    </Card>
+  )
+}

package/dist/activity/logger.js

@@ -44,7 +44,7 @@ var DEFAULT_MAINTENANCE_EXEMPT_PATHS = [
 ];
 
 // server/db/schema.ts
-var RoleEnum = pgCore.pgEnum("roles", ["user", "admin"]);
+var RoleEnum = pgCore.pgEnum("roles", ["user", "admin", "tester"]);
 var ActivityActionEnum = pgCore.pgEnum("activity_actions", [
   "login",
   "logout",

package/dist/activity/logger.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../server/db/schema.ts","../../lib/maintenance.ts","../../config/env-schema.ts","../../config/env.ts","../../server/db/index.ts","../../lib/activity-logger.ts"],"names":["pgEnum","pgTable","text","createId","boolean","timestamp","integer","unique","check","sql","z","Pool","drizzlePg","neon","drizzle"],"mappings":";;;;;;;;;;;;;;;;;;;AAAA,IAAA,cAAA,GAAA,EAAA;AAAA,QAAA,CAAA,cAAA,EAAA;AAAA,EAAA,kBAAA,EAAA,MAAA,kBAAA;AAAA,EAAA,QAAA,EAAA,MAAA,QAAA;AAAA,EAAA,QAAA,EAAA,MAAA,QAAA;AAAA,EAAA,YAAA,EAAA,MAAA,YAAA;AAAA,EAAA,YAAA,EAAA,MAAA,YAAA;AAAA,EAAA,kBAAA,EAAA,MAAA,kBAAA;AAAA,EAAA,QAAA,EAAA,MAAA,QAAA;AAAA,EAAA,QAAA,EAAA,MAAA,QAAA;AAAA,EAAA,cAAA,EAAA,MAAA,cAAA;AAAA,EAAA,UAAA,EAAA,MAAA,UAAA;AAAA,EAAA,KAAA,EAAA,MAAA,KAAA;AAAA,EAAA,aAAA,EAAA,MAAA;AAAA,CAAA,CAAA;;;ACIO,IAAM,gCAAA,GAAmC;AAAA,EAC9C,GAAA;AAAA,EACA,WAAA;AAAA,EACA,YAAA;AAAA,EACA,qBAAA;AAAA,EACA,UAAA;AAAA,EACA;AACF,CAAA;;;ADNO,IAAM,WAAWA,aAAA,CAAO,OAAA,EAAS,CAAC,MAAA,EAAQ,OAAO,CAAC,CAAA;AAElD,IAAM,kBAAA,GAAqBA,cAAO,kBAAA,EAAoB;AAAA,EAC3D,OAAA;AAAA,EACA,QAAA;AAAA,EACA,cAAA;AAAA,EACA,kBAAA;AAAA,EACA,eAAA;AAAA,EACA,iBAAA;AAAA,EACA,iBAAA;AAAA,EACA,cAAA;AAAA,EACA,aAAA;AAAA,EACA,eAAA;AAAA,EACA,cAAA;AAAA,EACA,uBAAA;AAAA,EACA,uBAAA;AAAA,EACA,kBAAA;AAAA,EACA,eAAA;AAAA,EACA;AACF,CAAC,CAAA;AAEM,IAAM,KAAA,GAAQC,eAAQ,MAAA,EAAQ;AAAA,EACnC,EAAA,EAAIC,WAAA,CAAK,IAAI,CAAA,CAAE,OAAA,EAAQ,CAAE,UAAA,EAAW,CAAE,UAAA,CAAW,MAAMC,cAAA,EAAU,CAAA;AAAA,EACjE,IAAA,EAAMD,WAAA,CAAK,MAAM,CAAA,CAAE,OAAA,EAAQ;AAAA,EAC3B,OAAOA,WAAA,CAAK,OAAO,CAAA,CAAE,OAAA,GAAU,MAAA,EAAO;AAAA,EACtC,QAAA,EAAUA,YAAK,UAAU,CAAA;AAAA,EACzB,eAAeE,cAAA,CAAQ,eAAe,EAAE,OAAA,EAAQ,CAAE,QAAQ,KAAK,CAAA;AAAA,EAC/D,KAAA,EAAOF,YAAK,OAAO,CAAA;AAAA,EACnB,MAAM,QAAA,CAAS,OAAO,EAAE,OAAA,CAAQ,MAAM,EAAE,OAAA,EAAQ;AAAA,EAChD,QAAQE,cAAA,CAAQ,QAAQ,EAAE,OAAA,CAAQ,KAAK,EAAE,OAAA,EAAQ;AAAA,EACjD,QAAA,EAAUC,iBAAU,UAAU,CAAA;AAAA,EAC9B,YAAA,EAAcH,YAAK,cAAc,CAAA;AAAA;AAAA;AAAA;AAAA,EAIjC,UAAA,EAAYG,iBAAU,YAAY,CAAA;AAAA,EAClC,WAAA,EAAaA,iBAAU,aAAa,CAAA;AAAA,EACpC,YAAA,EAAcA,iBAAU,cAAc,CAAA;AAAA;AAAA;AAAA;AAAA,EAItC,kBAAkBD,cAAA,CAAQ,kBAAkB,EAAE,OAAA,EAAQ,CAAE,QAAQ,KAAK,CAAA;AAAA,EACrE,WAAWC,gBAAA,CAAU,WAAW,CAAA,CAAE,OAAA,GAAU,UAAA,EAAW;AAAA,EACvD,WAAWA,gBAAA,CAAU,WAAW,CAAA,CAAE,OAAA,GAAU,UAAA;AAC9C,CAAC,CAAA;AAEM,IAAM,QAAA,GAAWJ,eAAQ,SAAA,EAAW;AAAA,EACzC,EAAA,EAAIC,WAAA,CAAK,IAAI,CAAA,CAAE,OAAA,EAAQ,CAAE,UAAA,EAAW,CAAE,UAAA,CAAW,MAAMC,cAAA,EAAU,CAAA;AAAA,EACjE,SAAA,EAAWE,gBAAA,CAAU,WAAW,CAAA,CAAE,OAAA,EAAQ;AAAA,EAC1C,OAAOH,WAAA,CAAK,OAAO,CAAA,CAAE,OAAA,GAAU,MAAA,EAAO;AAAA,EACtC,WAAWG,gBAAA,CAAU,WAAW,CAAA,CAAE,OAAA,GAAU,UAAA,EAAW;AAAA,EACvD,WAAWA,gBAAA,CAAU,WAAW,CAAA,CAAE,OAAA,GAAU,UAAA,EAAW;AAAA,EACvD,SAAA,EAAWH,YAAK,WAAW,CAAA;AAAA,EAC3B,SAAA,EAAWA,YAAK,WAAW,CAAA;AAAA,EAC3B,MAAA,EAAQA,WAAA,CAAK,QAAQ,CAAA,CAClB,OAAA,EAAQ,CACR,UAAA,CAAW,MAAM,KAAA,CAAM,EAAA,EAAI,EAAE,QAAA,EAAU,WAAW,CAAA;AAAA;AAAA;AAAA,EAGrD,cAAA,EAAgBA,YAAK,gBAAgB;AACvC,CAAC,CAAA;AAEM,IAAM,QAAA,GAAWD,eAAQ,SAAA,EAAW;AAAA,EACzC,EAAA,EAAIC,WAAA,CAAK,IAAI,CAAA,CAAE,OAAA,EAAQ,CAAE,UAAA,EAAW,CAAE,UAAA,CAAW,MAAMC,cAAA,EAAU,CAAA;AAAA,EACjE,SAAA,EAAWD,WAAA,CAAK,WAAW,CAAA,CAAE,OAAA,EAAQ;AAAA,EACrC,UAAA,EAAYA,WAAA,CAAK,YAAY,CAAA,CAAE,OAAA,EAAQ;AAAA,EACvC,MAAA,EAAQA,WAAA,CAAK,QAAQ,CAAA,CAClB,OAAA,EAAQ,CACR,UAAA,CAAW,MAAM,KAAA,CAAM,EAAA,EAAI,EAAE,QAAA,EAAU,WAAW,CAAA;AAAA,EACrD,WAAA,EAAaA,YAAK,aAAa,CAAA;AAAA,EAC/B,YAAA,EAAcA,YAAK,cAAc,CAAA;AAAA,EACjC,OAAA,EAASA,YAAK,SAAS,CAAA;AAAA,EACvB,oBAAA,EAAsBG,iBAAU,sBAAsB,CAAA;AAAA,EACtD,qBAAA,EAAuBA,iBAAU,uBAAuB,CAAA;AAAA,EACxD,KAAA,EAAOH,YAAK,OAAO,CAAA;AAAA,EACnB,QAAA,EAAUA,YAAK,UAAU,CAAA;AAAA,EACzB,WAAWG,gBAAA,CAAU,WAAW,CAAA,CAAE,OAAA,GAAU,UAAA,EAAW;AAAA,EACvD,WAAWA,gBAAA,CAAU,WAAW,CAAA,CAAE,OAAA,GAAU,UAAA;AAC9C,CAAC,CAAA;AAMM,IAAM,UAAA,GAAaJ,eAAQ,WAAA,EAAa;AAAA,EAC7C,EAAA,EAAIC,WAAA,CAAK,IAAI,CAAA,CAAE,OAAA,EAAQ,CAAE,UAAA,EAAW,CAAE,UAAA,CAAW,MAAMC,cAAA,EAAU,CAAA;AAAA,EACjE,MAAA,EAAQD,WAAA,CAAK,QAAQ,CAAA,CAAE,OAAA,EAAQ;AAAA,EAC/B,WAAA,EAAaA,WAAA,CAAK,aAAa,CAAA,CAAE,OAAA,EAAQ;AAAA,EACzC,MAAA,EAAQA,WAAA,CAAK,QAAQ,CAAA,CAClB,OAAA,EAAQ,CACR,UAAA,CAAW,MAAM,KAAA,CAAM,EAAA,EAAI,EAAE,QAAA,EAAU,WAAW,CAAA;AAAA;AAAA,EAErD,QAAA,EAAUE,cAAA,CAAQ,UAAU,CAAA,CAAE,QAAQ,IAAI,CAAA;AAAA,EAC1C,uBAAA,EAAyBE,cAAA,CAAQ,yBAAyB,CAAA,CAAE,QAAQ,CAAC,CAAA;AAAA,EACrE,WAAA,EAAaD,iBAAU,aAAa;AACtC,CAAC,CAAA;AAGM,IAAM,QAAA,GAAWJ,eAAQ,SAAA,EAAW;AAAA,EACzC,EAAA,EAAIC,WAAA,CAAK,IAAI,CAAA,CAAE,OAAA,EAAQ,CAAE,UAAA,EAAW,CAAE,UAAA,CAAW,MAAMC,cAAA,EAAU,CAAA;AAAA,EACjE,IAAA,EAAMD,YAAK,MAAM,CAAA;AAAA,EACjB,SAAA,EAAWA,WAAA,CAAK,WAAW,CAAA,CAAE,OAAA,EAAQ;AAAA,EACrC,MAAA,EAAQA,WAAA,CAAK,QAAQ,CAAA,CAClB,OAAA,EAAQ,CACR,UAAA,CAAW,MAAM,KAAA,CAAM,EAAA,EAAI,EAAE,QAAA,EAAU,WAAW,CAAA;AAAA,EACrD,cAAcA,WAAA,CAAK,cAAc,CAAA,CAAE,OAAA,GAAU,MAAA,EAAO;AAAA,EACpD,OAAA,EAASI,cAAA,CAAQ,SAAS,CAAA,CAAE,OAAA,EAAQ;AAAA,EACpC,UAAA,EAAYJ,WAAA,CAAK,YAAY,CAAA,CAAE,OAAA,EAAQ;AAAA,EACvC,QAAA,EAAUE,cAAA,CAAQ,UAAU,CAAA,CAAE,OAAA,EAAQ;AAAA,EACtC,UAAA,EAAYF,YAAK,YAAY,CAAA;AAAA,EAC7B,SAAA,EAAWG,iBAAU,WAAW,CAAA;AAAA,EAChC,MAAA,EAAQH,YAAK,QAAQ;AACvB,CAAC,CAAA;AAEM,IAAM,aAAA,GAAgBD,eAAQ,cAAA,EAAgB;AAAA,EACnD,EAAA,EAAIC,WAAA,CAAK,IAAI,CAAA,CAAE,OAAA,EAAQ,CAAE,UAAA,EAAW,CAAE,UAAA,CAAW,MAAMC,cAAA,EAAU,CAAA;AAAA,EACjE,UAAA,EAAYD,WAAA,CAAK,YAAY,CAAA,CAAE,OAAA,EAAQ;AAAA,EACvC,KAAA,EAAOA,WAAA,CAAK,OAAO,CAAA,CAAE,OAAA,EAAQ;AAAA,EAC7B,SAAA,EAAWG,gBAAA,CAAU,WAAW,CAAA,CAAE,OAAA,EAAQ;AAAA,EAC1C,WAAWA,gBAAA,CAAU,WAAW,CAAA,CAAE,OAAA,GAAU,UAAA,EAAW;AAAA,EACvD,WAAWA,gBAAA,CAAU,WAAW,CAAA,CAAE,OAAA,GAAU,UAAA;AAC9C,CAAC,CAAA;AAEM,IAAM,YAAA,GAAeJ,eAAQ,cAAA,EAAgB;AAAA,EAClD,EAAA,EAAIC,WAAA,CAAK,IAAI,CAAA,CAAE,OAAA,EAAQ,CAAE,UAAA,EAAW,CAAE,UAAA,CAAW,MAAMC,cAAA,EAAU,CAAA;AAAA,EACjE,MAAA,EAAQD,WAAA,CAAK,QAAQ,CAAA,CAClB,OAAA,EAAQ,CACR,UAAA,CAAW,MAAM,KAAA,CAAM,EAAA,EAAI,EAAE,QAAA,EAAU,WAAW,CAAA;AAAA,EACrD,MAAA,EAAQ,kBAAA,CAAmB,QAAQ,CAAA,CAAE,OAAA,EAAQ;AAAA,EAC7C,WAAA,EAAaA,WAAA,CAAK,aAAa,CAAA,CAAE,OAAA,EAAQ;AAAA,EACzC,SAAA,EAAWA,YAAK,WAAW,CAAA;AAAA,EAC3B,SAAA,EAAWA,YAAK,WAAW,CAAA;AAAA,EAC3B,QAAA,EAAUA,YAAK,UAAU,CAAA;AAAA;AAAA;AAAA;AAAA,EAIzB,WAAA,EAAaA,YAAK,aAAa,CAAA;AAAA,EAC/B,EAAA,EAAIA,YAAK,IAAI,CAAA;AAAA,EACb,OAAA,EAASA,YAAK,SAAS,CAAA;AAAA,EACvB,UAAA,EAAYA,YAAK,YAAY,CAAA;AAAA,EAC7B,OAAA,EAASA,YAAK,SAAS,CAAA;AAAA,EACvB,IAAA,EAAMA,YAAK,MAAM,CAAA;AAAA,EACjB,WAAWG,gBAAA,CAAU,WAAW,CAAA,CAAE,OAAA,GAAU,UAAA;AAC9C,CAAC,CAAA;AAQM,IAAM,kBAAA,GAAqBJ,eAAQ,oBAAA,EAAsB;AAAA,EAC9D,EAAA,EAAIC,WAAA,CAAK,IAAI,CAAA,CAAE,OAAA,EAAQ,CAAE,UAAA,EAAW,CAAE,UAAA,CAAW,MAAMC,cAAA,EAAU,CAAA;AAAA,EACjE,MAAA,EAAQD,WAAA,CAAK,QAAQ,CAAA,CAClB,OAAA,EAAQ,CACR,UAAA,CAAW,MAAM,KAAA,CAAM,EAAA,EAAI,EAAE,QAAA,EAAU,WAAW,CAAA;AAAA,EACrD,SAAA,EAAWA,WAAA,CAAK,WAAW,CAAA,CAAE,OAAA,EAAQ;AAAA;AAAA;AAAA;AAAA;AAAA,EAKrC,SAAA,EAAWA,YAAK,WAAW,CAAA;AAAA,EAC3B,SAAA,EAAWA,YAAK,WAAW,CAAA;AAAA,EAC3B,OAAA,EAASA,YAAK,SAAS,CAAA;AAAA,EACvB,IAAA,EAAMA,YAAK,MAAM,CAAA;AAAA,EACjB,WAAWG,gBAAA,CAAU,WAAW,CAAA,CAAE,OAAA,GAAU,UAAA;AAC9C,CAAA,EAAG,CAAC,KAAA,KAAU;AAAA,EACZE,cAAO,iCAAiC,CAAA,CAAE,GAAG,KAAA,CAAM,MAAA,EAAQ,MAAM,SAAS;AAC5E,CAAC,CAAA;AASM,IAAM,YAAA,GAAeN,eAAQ,eAAA,EAAiB;AAAA,EACnD,aAAaC,WAAA,CAAK,aAAa,CAAA,CAAE,OAAA,GAAU,UAAA,EAAW;AAAA,EACtD,OAAOI,cAAA,CAAQ,OAAO,EAAE,OAAA,EAAQ,CAAE,QAAQ,CAAC,CAAA;AAAA,EAC3C,aAAaD,gBAAA,CAAU,aAAa,CAAA,CAAE,OAAA,GAAU,UAAA,EAAW;AAAA;AAAA;AAAA;AAAA;AAAA,EAK3D,eAAeA,gBAAA,CAAU,eAAe,CAAA,CAAE,OAAA,GAAU,UAAA,EAAW;AAAA,EAC/D,SAAA,EAAWH,YAAK,WAAW,CAAA;AAAA,EAC3B,SAAA,EAAWA,YAAK,WAAW,CAAA;AAAA,EAC3B,SAAA,EAAWA,YAAK,WAAW,CAAA;AAAA,EAC3B,QAAA,EAAUA,YAAK,UAAU;AAAA;AAC3B,CAAC,CAAA;AAKM,IAAM,cAAA,GAAiBD,eAAQ,iBAAA,EAAmB;AAAA,EACvD,IAAIC,WAAA,CAAK,IAAI,EAAE,UAAA,EAAW,CAAE,QAAQ,SAAS,CAAA;AAAA,EAC7C,iBAAiBE,cAAA,CAAQ,iBAAiB,EAAE,OAAA,EAAQ,CAAE,QAAQ,KAAK,CAAA;AAAA,EACnE,kBAAA,EAAoBF,YAAK,oBAAoB,CAAA;AAAA;AAAA;AAAA,EAG7C,sBAAA,EAAwBA,YAAK,wBAAwB,CAAA,CAAE,OAAM,CAAE,OAAA,EAAQ,CAAE,OAAA,CAAQ,gCAAgC,CAAA;AAAA,EACjH,kBAAkBE,cAAA,CAAQ,kBAAkB,EAAE,OAAA,EAAQ,CAAE,QAAQ,IAAI,CAAA;AAAA,EACpE,yBAAyBA,cAAA,CAAQ,yBAAyB,EAAE,OAAA,EAAQ,CAAE,QAAQ,IAAI,CAAA;AAAA,EAClF,kBAAkBA,cAAA,CAAQ,kBAAkB,EAAE,OAAA,EAAQ,CAAE,QAAQ,KAAK,CAAA;AAAA,EACrE,yBAAyBA,cAAA,CAAQ,yBAAyB,EAAE,OAAA,EAAQ,CAAE,QAAQ,IAAI,CAAA;AAAA,EAClF,WAAWC,gBAAA,CAAU,WAAW,CAAA,CAAE,OAAA,GAAU,UAAA,EAAW;AAAA;AAAA;AAAA;AAAA,EAIvD,SAAA,EAAWH,WAAA,CAAK,WAAW,CAAA,CAAE,UAAA,CAAW,MAAM,KAAA,CAAM,EAAA,EAAI,EAAE,QAAA,EAAU,UAAA,EAAY;AAClF,CAAA,EAAG,CAAC,KAAA,KAAU;AAAA,EACZM,YAAA,CAAM,2BAAA,EAA6BC,cAAA,CAAA,EAAM,KAAA,CAAM,EAAE,CAAA,YAAA,CAAc;AACjE,CAAC,CAAA;AEpNM,IAAM,SAAA,GAAYC,MAAE,MAAA,CAAO;AAAA,EAChC,QAAA,EAAUA,KAAA,CAAE,IAAA,CAAK,CAAC,aAAA,EAAe,cAAc,MAAM,CAAC,CAAA,CAAE,OAAA,CAAQ,aAAa,CAAA;AAAA,EAC7E,IAAA,EAAMA,MAAE,MAAA,EAAO,CAAE,QAAQ,MAAM,CAAA,CAAE,UAAU,MAAM,CAAA;AAAA,EACjD,YAAA,EAAcA,KAAA,CAAE,MAAA,EAAO,CAAE,QAAQ,EAAE,CAAA;AAAA,EACnC,cAAA,EAAgBA,KAAA,CAAE,MAAA,EAAO,CAAE,QAAQ,EAAE,CAAA;AAAA;AAAA;AAAA,EAGrC,UAAA,EAAYA,KAAA,CAAE,MAAA,EAAO,CAAE,QAAQ,kCAAkC,CAAA;AAAA;AAAA;AAAA;AAAA,EAIjE,QAAA,EAAUA,KAAA,CAAE,MAAA,EAAO,CAAE,QAAQ,kBAAkB,CAAA;AAAA;AAAA;AAAA;AAAA,EAI/C,yBAAA,EAA2BA,KAAA,CAAE,MAAA,EAAO,CAAE,OAAA,CAAQ,MAAM,CAAA,CAAE,SAAA,CAAU,CAAA,GAAA,KAAO,GAAA,KAAQ,MAAM,CAAA;AAAA,EACrF,kBAAA,EAAoBA,KAAA,CAAE,MAAA,EAAO,CAAE,OAAA,CAAQ,MAAM,CAAA,CAAE,SAAA,CAAU,CAAA,GAAA,KAAO,GAAA,KAAQ,MAAM,CAAA;AAAA,EAC9E,0BAAA,EAA4BA,KAAA,CAAE,MAAA,EAAO,CAAE,OAAA,CAAQ,MAAM,CAAA,CAAE,SAAA,CAAU,CAAA,GAAA,KAAO,GAAA,KAAQ,MAAM,CAAA;AAAA,EACtF,mBAAA,EAAqBA,KAAA,CAAE,MAAA,EAAO,CAAE,OAAA,CAAQ,OAAO,CAAA,CAAE,SAAA,CAAU,CAAA,GAAA,KAAO,GAAA,KAAQ,MAAM,CAAA;AAAA,EAChF,SAAA,EAAWA,MAAE,IAAA,CAAK,CAAC,MAAM,MAAM,CAAC,CAAA,CAAE,OAAA,CAAQ,IAAI,CAAA;AAAA;AAAA;AAAA,EAG9C,YAAA,EAAcA,KAAA,CAAE,MAAA,EAAO,CAAE,OAAA,CAAQ,OAAO,CAAA,CAAE,SAAA,CAAU,CAAA,GAAA,KAAO,GAAA,KAAQ,MAAM;AAC3E,CAAC,CAAA;;;AC1BD,IAAM,OAAA,GAAU,SAAA,CAAU,SAAA,CAAU,OAAA,CAAQ,GAAG,CAAA;AAE/C,IAAI,OAAA,CAAQ,OAAA,IAAY,OAAA,CAAQ,IAAA,CAAK,aAAa,aAAA,EAAgB;AAChE,EAAA,OAAA,CAAQ,IAAI,+BAAA,EAAiC,MAAA,CAAO,IAAA,CAAK,OAAA,CAAQ,IAAI,CAAC,CAAA;AACxE;AAEA,IAAI,CAAC,QAAQ,OAAA,EAAS;AACpB,EAAA,OAAA,CAAQ,KAAA,CAAM,gCAAA,EAAkC,OAAA,CAAQ,KAAA,CAAM,QAAQ,CAAA;AACtE,EAAA,MAAM,IAAI,MAAM,+BAA+B,CAAA;AACjD;AAEO,IAAM,SAAS,OAAA,CAAQ,IAAA;;;ACM9B,IAAI,EAAA;AAGJ,IAAI,MAAA,CAAO,cAAc,IAAA,EAAM;AAC7B,EAAA,MAAM,IAAA,GAAO,IAAIC,OAAA,CAAK;AAAA,IACpB,kBAAkB,MAAA,CAAO,YAAA;AAAA,IACzB,KAAK,MAAA,CAAO,YAAA,GAAe,EAAE,kBAAA,EAAoB,OAAM,GAAI;AAAA,GAC5D,CAAA;AACD,EAAA,EAAA,GAAKC,qBAAU,IAAA,EAAM;AAAA,IACnB,MAAA,EAAA,cAAA;AAAA,IACA,MAAA,EAAQ;AAAA,GACT,CAAA;AAED,EAAA,OAAA,CAAQ,IAAI,wCAAiC,CAAA;AAE/C,CAAA,MAAA,IAAW,MAAA,CAAO,cAAc,MAAA,EAAQ;AACtC,EAAA,MAAMH,IAAAA,GAAMI,eAAA,CAAK,MAAA,CAAO,YAAa,CAAA;AACrC,EAAA,EAAA,GAAKC,iBAAQL,IAAAA,EAAK,EAAE,MAAA,EAAA,cAAA,EAAQ,MAAA,EAAQ,MAAM,CAAA;AAE1C,EAAA,OAAA,CAAQ,IAAI,oCAA6B,CAAA;AAE3C,CAAA,MAAO;AACL,EAAA,OAAA,CAAQ,GAAA,CAAI,yDAAA,EAA2D,MAAA,CAAO,SAAS,CAAA;AACzF;;;ACLA,eAAsB,WAAA,CAAY;AAAA,EAChC,MAAA;AAAA,EACA,MAAA;AAAA,EACA,WAAA;AAAA,EACA,SAAA;AAAA,EACA,SAAA;AAAA,EACA,QAAA;AAAA,EACA,WAAA;AAAA,EACA,EAAA;AAAA,EACA,OAAA;AAAA,EACA,UAAA;AAAA,EACA,OAAA;AAAA,EACA;AACF,CAAA,EAAsB;AACpB,EAAA,IAAI;AACF,IAAA,MAAM,EAAA,CAAG,MAAA,CAAO,YAAY,CAAA,CAAE,MAAA,CAAO;AAAA,MACnC,MAAA;AAAA,MACA,MAAA;AAAA,MACA,WAAA;AAAA,MACA,WAAW,SAAA,IAAa,IAAA;AAAA,MACxB,WAAW,SAAA,IAAa,IAAA;AAAA,MACxB,QAAA,EAAU,QAAA,GAAW,IAAA,CAAK,SAAA,CAAU,QAAQ,CAAA,GAAI,IAAA;AAAA,MAChD,aAAa,WAAA,IAAe,IAAA;AAAA,MAC5B,IAAI,EAAA,IAAM,IAAA;AAAA,MACV,SAAS,OAAA,IAAW,IAAA;AAAA,MACpB,YAAY,UAAA,IAAc,IAAA;AAAA,MAC1B,SAAS,OAAA,IAAW,IAAA;AAAA,MACpB,MAAM,IAAA,IAAQ;AAAA,KACf,CAAA;AAAA,EACH,SAAS,KAAA,EAAO;AACd,IAAA,OAAA,CAAQ,KAAA,CAAM,2BAA2B,KAAK,CAAA;AAAA,EAEhD;AACF","file":"logger.js","sourcesContent":["import { boolean, check, integer, pgEnum, pgTable, text, timestamp, unique } from \"drizzle-orm/pg-core\";\nimport { sql } from \"drizzle-orm\";\nimport { createId } from '@paralleldrive/cuid2'\nimport { DEFAULT_MAINTENANCE_EXEMPT_PATHS } from \"../../lib/maintenance\";\n\nexport const RoleEnum = pgEnum('roles', ['user', 'admin'])\n\nexport const ActivityActionEnum = pgEnum('activity_actions', [\n  'login',\n  'logout',\n  'login_failed',\n  'password_changed',\n  'email_changed',\n  'profile_updated',\n  'session_revoked',\n  'user_deleted',\n  'user_banned',\n  'user_unbanned',\n  'role_changed',\n  'impersonation_started',\n  'impersonation_stopped',\n  'settings_changed',\n  'passkey_added',\n  'passkey_removed',\n])\n\nexport const users = pgTable(\"user\", {\n  id: text(\"id\").notNull().primaryKey().$defaultFn(() => createId()),\n  name: text('name').notNull(),\n  email: text('email').notNull().unique(),\n  password: text('password'),\n  emailVerified: boolean(\"emailVerified\").notNull().default(false),\n  image: text(\"image\"),\n  role: RoleEnum('roles').default('user').notNull(),\n  banned: boolean('banned').default(false).notNull(),\n  bannedAt: timestamp('bannedAt'),\n  bannedReason: text('bannedReason'),\n  // Required by better-auth's admin plugin schema (auto-expiring bans). We\n  // never set this ourselves, so it stays null and bans behave as permanent,\n  // same as before the plugin was added.\n  banExpires: timestamp('banExpires'),\n  lastLoginAt: timestamp('lastLoginAt'),\n  lastActiveAt: timestamp('lastActiveAt'),\n  // Set by better-auth's twoFactor plugin — true once the user has\n  // completed TOTP setup (see twoFactor pgTable below for the secret /\n  // backup codes themselves).\n  twoFactorEnabled: boolean('twoFactorEnabled').notNull().default(false),\n  createdAt: timestamp('createdAt').notNull().defaultNow(),\n  updatedAt: timestamp('updatedAt').notNull().defaultNow(),\n});\n\nexport const sessions = pgTable(\"session\", {\n  id: text(\"id\").notNull().primaryKey().$defaultFn(() => createId()),\n  expiresAt: timestamp(\"expiresAt\").notNull(),\n  token: text(\"token\").notNull().unique(),\n  createdAt: timestamp(\"createdAt\").notNull().defaultNow(),\n  updatedAt: timestamp(\"updatedAt\").notNull().defaultNow(),\n  ipAddress: text(\"ipAddress\"),\n  userAgent: text(\"userAgent\"),\n  userId: text(\"userId\")\n    .notNull()\n    .references(() => users.id, { onDelete: \"cascade\" }),\n  // Set by better-auth's admin plugin while this session is an admin\n  // impersonating another user; holds the impersonating admin's user id.\n  impersonatedBy: text(\"impersonatedBy\"),\n});\n\nexport const accounts = pgTable(\"account\", {\n  id: text(\"id\").notNull().primaryKey().$defaultFn(() => createId()),\n  accountId: text(\"accountId\").notNull(),\n  providerId: text(\"providerId\").notNull(),\n  userId: text(\"userId\")\n    .notNull()\n    .references(() => users.id, { onDelete: \"cascade\" }),\n  accessToken: text(\"accessToken\"),\n  refreshToken: text(\"refreshToken\"),\n  idToken: text(\"idToken\"),\n  accessTokenExpiresAt: timestamp(\"accessTokenExpiresAt\"),\n  refreshTokenExpiresAt: timestamp(\"refreshTokenExpiresAt\"),\n  scope: text(\"scope\"),\n  password: text(\"password\"),\n  createdAt: timestamp(\"createdAt\").notNull().defaultNow(),\n  updatedAt: timestamp(\"updatedAt\").notNull().defaultNow(),\n});\n\n// Better-auth's twoFactor plugin. One row per user (created on first\n// `enable`); secret and backupCodes are its own encrypted-at-rest strings,\n// field names/types must match its expectations exactly (drizzleAdapter in\n// server/auth.ts maps this table to the plugin's \"twoFactor\" model as-is).\nexport const twoFactors = pgTable(\"twoFactor\", {\n  id: text(\"id\").notNull().primaryKey().$defaultFn(() => createId()),\n  secret: text(\"secret\").notNull(),\n  backupCodes: text(\"backupCodes\").notNull(),\n  userId: text(\"userId\")\n    .notNull()\n    .references(() => users.id, { onDelete: \"cascade\" }),\n  // Added in better-auth 1.7 (TOTP lockout). Defaults match the plugin's.\n  verified: boolean(\"verified\").default(true),\n  failedVerificationCount: integer(\"failedVerificationCount\").default(0),\n  lockedUntil: timestamp(\"lockedUntil\"),\n});\n\n// Better-auth's passkey plugin — one row per registered WebAuthn credential.\nexport const passkeys = pgTable(\"passkey\", {\n  id: text(\"id\").notNull().primaryKey().$defaultFn(() => createId()),\n  name: text(\"name\"),\n  publicKey: text(\"publicKey\").notNull(),\n  userId: text(\"userId\")\n    .notNull()\n    .references(() => users.id, { onDelete: \"cascade\" }),\n  credentialID: text(\"credentialID\").notNull().unique(),\n  counter: integer(\"counter\").notNull(),\n  deviceType: text(\"deviceType\").notNull(),\n  backedUp: boolean(\"backedUp\").notNull(),\n  transports: text(\"transports\"),\n  createdAt: timestamp(\"createdAt\"),\n  aaguid: text(\"aaguid\"),\n});\n\nexport const verifications = pgTable(\"verification\", {\n  id: text(\"id\").notNull().primaryKey().$defaultFn(() => createId()),\n  identifier: text(\"identifier\").notNull(),\n  value: text(\"value\").notNull(),\n  expiresAt: timestamp(\"expiresAt\").notNull(),\n  createdAt: timestamp(\"createdAt\").notNull().defaultNow(),\n  updatedAt: timestamp(\"updatedAt\").notNull().defaultNow(),\n});\n\nexport const activityLogs = pgTable(\"activity_log\", {\n  id: text(\"id\").notNull().primaryKey().$defaultFn(() => createId()),\n  userId: text(\"userId\")\n    .notNull()\n    .references(() => users.id, { onDelete: \"cascade\" }),\n  action: ActivityActionEnum('action').notNull(),\n  description: text('description').notNull(),\n  ipAddress: text('ipAddress'),\n  userAgent: text('userAgent'),\n  metadata: text('metadata'),\n  // Populated on 'login' events only (registration + sign-in) — parsed from\n  // userAgent/ipAddress at write time so the record stays stable even if\n  // the parsing library or geoip database changes later.\n  referrerUrl: text('referrerUrl'),\n  os: text('os'),\n  browser: text('browser'),\n  deviceType: text('deviceType'),\n  country: text('country'),\n  city: text('city'),\n  createdAt: timestamp('createdAt').notNull().defaultNow(),\n});\n\n// One row per (user, device fingerprint) pair. Its only job is to answer\n// \"has this account signed in from this device before?\" — no matching row ⇒\n// send a new-device alert (see app/api/device-check/route.ts). visitorId is\n// FingerprintJS's identifier, computed client-side in\n// components/auth/deviceCheck.tsx. UA+IP are deliberately NOT the signal here:\n// they churn constantly on mobile and would alert on every other login.\nexport const deviceFingerprints = pgTable(\"device_fingerprint\", {\n  id: text(\"id\").notNull().primaryKey().$defaultFn(() => createId()),\n  userId: text(\"userId\")\n    .notNull()\n    .references(() => users.id, { onDelete: \"cascade\" }),\n  visitorId: text(\"visitorId\").notNull(),\n  // Context captured at first-seen time — for the admin panel's \"New devices\"\n  // card and the alert email. Not part of the new-vs-known decision (that's\n  // visitorId only), just so an admin can eyeball whether a sign-in looks like\n  // a hijack. Nullable: an old row predates these columns, or geoip missed.\n  ipAddress: text(\"ipAddress\"),\n  userAgent: text(\"userAgent\"),\n  country: text(\"country\"),\n  city: text(\"city\"),\n  createdAt: timestamp(\"createdAt\").notNull().defaultNow(),\n}, (table) => [\n  unique(\"device_fingerprint_user_visitor\").on(table.userId, table.visitorId),\n]);\n\n// Per-device abuse throttle for /sign-in/email and /sign-up/email — one\n// fixed-window counter row per FingerprintJS visitorId (sent by the auth\n// forms as the x-device-fingerprint header; see lib/auth-throttle.ts).\n// Keyed by device, not IP: IP is shared behind corporate NAT / CGNAT / VPN,\n// so an IP counter throttles coworkers together while missing an abuser who\n// rotates IPs. Rows whose window has elapsed are dead weight but harmless\n// (reset on the next attempt) — prune on a cron if the table ever grows.\nexport const authThrottle = pgTable(\"auth_throttle\", {\n  fingerprint: text(\"fingerprint\").notNull().primaryKey(),\n  count: integer(\"count\").notNull().default(0),\n  windowStart: timestamp(\"windowStart\").notNull().defaultNow(),\n  // Blockable data points, overwritten on every attempt (last-write-wins) so\n  // the admin panel can show who to block — by IP or by fingerprint — with no\n  // join and no per-attempt history table. windowStart anchors the counter's\n  // window; lastAttemptAt is just \"most recently seen\".\n  lastAttemptAt: timestamp(\"lastAttemptAt\").notNull().defaultNow(),\n  ipAddress: text(\"ipAddress\"),\n  userAgent: text(\"userAgent\"),\n  lastEmail: text(\"lastEmail\"),\n  lastKind: text(\"lastKind\"), // 'signin' | 'signup'\n});\n\n// Singleton row (id is always 'default') holding admin-editable settings for\n// config that used to be env-var-only. See lib/settings-queries.ts for the\n// cached read path and lazy-seed-from-env behavior.\nexport const systemSettings = pgTable(\"system_settings\", {\n  id: text(\"id\").primaryKey().default(\"default\"),\n  maintenanceMode: boolean(\"maintenanceMode\").notNull().default(false),\n  maintenanceMessage: text(\"maintenanceMessage\"),\n  // Path prefixes that stay reachable while maintenance mode is on (see\n  // lib/maintenance.ts — a few auth paths are always open on top of these).\n  maintenanceExemptPaths: text(\"maintenanceExemptPaths\").array().notNull().default(DEFAULT_MAINTENANCE_EXEMPT_PATHS),\n  authEnableGoogle: boolean(\"authEnableGoogle\").notNull().default(true),\n  authEnableEmailPassword: boolean(\"authEnableEmailPassword\").notNull().default(true),\n  authEnableOneTap: boolean(\"authEnableOneTap\").notNull().default(false),\n  enableSessionRevocation: boolean(\"enableSessionRevocation\").notNull().default(true),\n  updatedAt: timestamp(\"updatedAt\").notNull().defaultNow(),\n  // Who last changed a setting. This row doesn't \"belong\" to that admin the\n  // way sessions/activityLogs belong to their user, so deleting that admin's\n  // account should null this out rather than cascade-delete the singleton row.\n  updatedBy: text(\"updatedBy\").references(() => users.id, { onDelete: \"set null\" }),\n}, (table) => [\n  check(\"system_settings_singleton\", sql`${table.id} = 'default'`),\n]);","// Pure path logic for maintenance mode — no DB / server-only imports, so it\n// can run in proxy.ts and in the admin form alike.\n\n// Default for the admin-editable exempt list: the public marketing pages.\nexport const DEFAULT_MAINTENANCE_EXEMPT_PATHS = [\n  \"/\",\n  \"/features\",\n  \"/changelog\",\n  \"/changelog-template\",\n  \"/privacy\",\n  \"/terms\",\n]\n\n// Always reachable, whatever the admin saves — otherwise an admin could\n// lock themselves out of the sign-in flow needed to turn maintenance off.\nexport const ALWAYS_OPEN_PATHS = [\n  \"/maintenance\",\n  \"/login\", // includes /login/2fa\n  \"/forgot-password\",\n  \"/reset-password\",\n  \"/api/auth\",\n  \"/api/settings/public\", // login page reads the One Tap flag from here\n]\n\n// `/foo` matches `/foo` and `/foo/...` but not `/foobar`; `/` matches only `/`.\nfunction matches(pathname: string, prefix: string) {\n  const p = prefix.length > 1 ? prefix.replace(/\\/+$/, \"\") : prefix\n  return pathname === p || (p !== \"/\" && pathname.startsWith(p + \"/\"))\n}\n\nexport function isMaintenanceExempt(pathname: string, exemptPaths: string[]) {\n  return [...ALWAYS_OPEN_PATHS, ...exemptPaths].some((p) => matches(pathname, p))\n}\n","// No \"server-only\" guard here — this schema is also imported by scripts that\n// run outside Next.js's bundler (e.g. scripts/doctor.ts), where that guard\n// throws unconditionally. config/env.ts re-exports the parsed, guarded result\n// for app code; import this file directly only from non-Next scripts.\nimport { z } from 'zod';\n\nexport const envSchema = z.object({\n  NODE_ENV: z.enum(['development', 'production', 'test']).default('development'),\n  PORT: z.string().default('3000').transform(Number),\n  DATABASE_URL: z.string().default(''),\n  RESEND_API_KEY: z.string().default(''),\n  // Sender for every transactional email. Must be on a domain verified in\n  // your Resend account.\n  EMAIL_FROM: z.string().default('Acme <onboarding@xavierkhew.xyz>'),\n  // Display name for this deployment — shown as the authenticator-app label\n  // (2FA issuer) and the passkey relying-party name. Consuming projects set\n  // this in their own .env; defaults to the template name.\n  APP_NAME: z.string().default('Next.js Template'),\n  // Seed-only: the live value lives in the system_settings DB row (see\n  // lib/settings-queries.ts) once it's been seeded on first read, and is\n  // changed from the admin System Settings page, not by editing this var.\n  ENABLE_SESSION_REVOCATION: z.string().default('true').transform(val => val === 'true'),\n  AUTH_ENABLE_GOOGLE: z.string().default('true').transform(val => val === 'true'),\n  AUTH_ENABLE_EMAIL_PASSWORD: z.string().default('true').transform(val => val === 'true'),\n  AUTH_ENABLE_ONE_TAP: z.string().default('false').transform(val => val === 'true'),\n  DB_DRIVER: z.enum(['pg', 'neon']).default('pg'),\n  // Only relevant when DB_DRIVER=pg — whether the target Postgres server has SSL\n  // enabled. Self-hosted Postgres (e.g. via Docker/Dokploy) typically does not.\n  DATABASE_SSL: z.string().default('false').transform(val => val === 'true'),\n});\n","import \"server-only\";\nimport { envSchema } from './env-schema';\n\nconst results = envSchema.safeParse(process.env);\n\nif (results.success && (results.data.NODE_ENV === 'development')) {\n  console.log('Environment variables loaded:', Object.keys(results.data));\n}\n\nif (!results.success) {\n  console.error('Invalid environment variables:', results.error.format());\n  throw new Error('Invalid environment variables');\n}\n\nexport const config = results.data;\n","import 'server-only';\n\n// neon-http driver for production\nimport { neon } from '@neondatabase/serverless';\nimport { drizzle } from 'drizzle-orm/neon-http';\n\n// postgres driver for local development\nimport { drizzle as drizzlePg } from 'drizzle-orm/node-postgres';\nimport { Pool } from 'pg';\n\nimport * as schema from './schema';\nimport { config } from '../../config/env';\n\n// Import the query builder\nimport { PostgresJsDatabase } from 'drizzle-orm/postgres-js';\nimport { NeonHttpDatabase } from 'drizzle-orm/neon-http';\n\ntype DrizzleNeon = NeonHttpDatabase<typeof schema>;\ntype DrizzlePg = PostgresJsDatabase<typeof schema>;\n\nlet db: DrizzleNeon | DrizzlePg\n\n\nif (config.DB_DRIVER === 'pg') {\n  const pool = new Pool({\n    connectionString: config.DATABASE_URL!,\n    ssl: config.DATABASE_SSL ? { rejectUnauthorized: false } : undefined,\n  });\n  db = drizzlePg(pool, {\n    schema,\n    logger: true,\n  });\n\n  console.log('🟡 Using PostgreSQL (pg) driver');\n\n} else if (config.DB_DRIVER === 'neon') {\n  const sql = neon(config.DATABASE_URL!);\n  db = drizzle(sql, { schema, logger: true });\n\n  console.log('🟢 Using Neon (HTTP) driver');\n\n} else {\n  console.log('Database connection not established, unknown DB_DRIVER:', config.DB_DRIVER);\n}\n// Note: In production, you might want to disable logging or use a more sophisticated logger.\n\nexport { db }","import \"server-only\"\nimport { db } from \"../server/db\"\nimport { activityLogs } from \"../server/db/schema\"\n\nexport type ActivityAction =\n  | 'login'\n  | 'logout'\n  | 'login_failed'\n  | 'password_changed'\n  | 'email_changed'\n  | 'profile_updated'\n  | 'session_revoked'\n  | 'user_deleted'\n  | 'user_banned'\n  | 'user_unbanned'\n  | 'role_changed'\n  | 'impersonation_started'\n  | 'impersonation_stopped'\n  | 'settings_changed'\n  | 'passkey_added'\n  | 'passkey_removed'\n\ninterface LogActivityParams {\n  userId: string\n  action: ActivityAction\n  description: string\n  ipAddress?: string | null\n  userAgent?: string | null\n  metadata?: Record<string, any>\n  // Populated on 'login' events only — see server/auth.ts's session.create hook.\n  referrerUrl?: string | null\n  os?: string | null\n  browser?: string | null\n  deviceType?: string | null\n  country?: string | null\n  city?: string | null\n}\n\nexport async function logActivity({\n  userId,\n  action,\n  description,\n  ipAddress,\n  userAgent,\n  metadata,\n  referrerUrl,\n  os,\n  browser,\n  deviceType,\n  country,\n  city,\n}: LogActivityParams) {\n  try {\n    await db.insert(activityLogs).values({\n      userId,\n      action,\n      description,\n      ipAddress: ipAddress || null,\n      userAgent: userAgent || null,\n      metadata: metadata ? JSON.stringify(metadata) : null,\n      referrerUrl: referrerUrl || null,\n      os: os || null,\n      browser: browser || null,\n      deviceType: deviceType || null,\n      country: country || null,\n      city: city || null,\n    })\n  } catch (error) {\n    console.error('Failed to log activity:', error)\n    // Don't throw - activity logging should not break the app\n  }\n}\n"]}
+{"version":3,"sources":["../../server/db/schema.ts","../../lib/maintenance.ts","../../config/env-schema.ts","../../config/env.ts","../../server/db/index.ts","../../lib/activity-logger.ts"],"names":["pgEnum","pgTable","text","createId","boolean","timestamp","integer","unique","check","sql","z","Pool","drizzlePg","neon","drizzle"],"mappings":";;;;;;;;;;;;;;;;;;;AAAA,IAAA,cAAA,GAAA,EAAA;AAAA,QAAA,CAAA,cAAA,EAAA;AAAA,EAAA,kBAAA,EAAA,MAAA,kBAAA;AAAA,EAAA,QAAA,EAAA,MAAA,QAAA;AAAA,EAAA,QAAA,EAAA,MAAA,QAAA;AAAA,EAAA,YAAA,EAAA,MAAA,YAAA;AAAA,EAAA,YAAA,EAAA,MAAA,YAAA;AAAA,EAAA,kBAAA,EAAA,MAAA,kBAAA;AAAA,EAAA,QAAA,EAAA,MAAA,QAAA;AAAA,EAAA,QAAA,EAAA,MAAA,QAAA;AAAA,EAAA,cAAA,EAAA,MAAA,cAAA;AAAA,EAAA,UAAA,EAAA,MAAA,UAAA;AAAA,EAAA,KAAA,EAAA,MAAA,KAAA;AAAA,EAAA,aAAA,EAAA,MAAA;AAAA,CAAA,CAAA;;;ACIO,IAAM,gCAAA,GAAmC;AAAA,EAC9C,GAAA;AAAA,EACA,WAAA;AAAA,EACA,YAAA;AAAA,EACA,qBAAA;AAAA,EACA,UAAA;AAAA,EACA;AACF,CAAA;;;ADJO,IAAM,WAAWA,aAAA,CAAO,OAAA,EAAS,CAAC,MAAA,EAAQ,OAAA,EAAS,QAAQ,CAAC,CAAA;AAE5D,IAAM,kBAAA,GAAqBA,cAAO,kBAAA,EAAoB;AAAA,EAC3D,OAAA;AAAA,EACA,QAAA;AAAA,EACA,cAAA;AAAA,EACA,kBAAA;AAAA,EACA,eAAA;AAAA,EACA,iBAAA;AAAA,EACA,iBAAA;AAAA,EACA,cAAA;AAAA,EACA,aAAA;AAAA,EACA,eAAA;AAAA,EACA,cAAA;AAAA,EACA,uBAAA;AAAA,EACA,uBAAA;AAAA,EACA,kBAAA;AAAA,EACA,eAAA;AAAA,EACA;AACF,CAAC,CAAA;AAEM,IAAM,KAAA,GAAQC,eAAQ,MAAA,EAAQ;AAAA,EACnC,EAAA,EAAIC,WAAA,CAAK,IAAI,CAAA,CAAE,OAAA,EAAQ,CAAE,UAAA,EAAW,CAAE,UAAA,CAAW,MAAMC,cAAA,EAAU,CAAA;AAAA,EACjE,IAAA,EAAMD,WAAA,CAAK,MAAM,CAAA,CAAE,OAAA,EAAQ;AAAA,EAC3B,OAAOA,WAAA,CAAK,OAAO,CAAA,CAAE,OAAA,GAAU,MAAA,EAAO;AAAA,EACtC,QAAA,EAAUA,YAAK,UAAU,CAAA;AAAA,EACzB,eAAeE,cAAA,CAAQ,eAAe,EAAE,OAAA,EAAQ,CAAE,QAAQ,KAAK,CAAA;AAAA,EAC/D,KAAA,EAAOF,YAAK,OAAO,CAAA;AAAA,EACnB,MAAM,QAAA,CAAS,OAAO,EAAE,OAAA,CAAQ,MAAM,EAAE,OAAA,EAAQ;AAAA,EAChD,QAAQE,cAAA,CAAQ,QAAQ,EAAE,OAAA,CAAQ,KAAK,EAAE,OAAA,EAAQ;AAAA,EACjD,QAAA,EAAUC,iBAAU,UAAU,CAAA;AAAA,EAC9B,YAAA,EAAcH,YAAK,cAAc,CAAA;AAAA;AAAA;AAAA;AAAA,EAIjC,UAAA,EAAYG,iBAAU,YAAY,CAAA;AAAA,EAClC,WAAA,EAAaA,iBAAU,aAAa,CAAA;AAAA,EACpC,YAAA,EAAcA,iBAAU,cAAc,CAAA;AAAA;AAAA;AAAA;AAAA,EAItC,kBAAkBD,cAAA,CAAQ,kBAAkB,EAAE,OAAA,EAAQ,CAAE,QAAQ,KAAK,CAAA;AAAA,EACrE,WAAWC,gBAAA,CAAU,WAAW,CAAA,CAAE,OAAA,GAAU,UAAA,EAAW;AAAA,EACvD,WAAWA,gBAAA,CAAU,WAAW,CAAA,CAAE,OAAA,GAAU,UAAA;AAC9C,CAAC,CAAA;AAEM,IAAM,QAAA,GAAWJ,eAAQ,SAAA,EAAW;AAAA,EACzC,EAAA,EAAIC,WAAA,CAAK,IAAI,CAAA,CAAE,OAAA,EAAQ,CAAE,UAAA,EAAW,CAAE,UAAA,CAAW,MAAMC,cAAA,EAAU,CAAA;AAAA,EACjE,SAAA,EAAWE,gBAAA,CAAU,WAAW,CAAA,CAAE,OAAA,EAAQ;AAAA,EAC1C,OAAOH,WAAA,CAAK,OAAO,CAAA,CAAE,OAAA,GAAU,MAAA,EAAO;AAAA,EACtC,WAAWG,gBAAA,CAAU,WAAW,CAAA,CAAE,OAAA,GAAU,UAAA,EAAW;AAAA,EACvD,WAAWA,gBAAA,CAAU,WAAW,CAAA,CAAE,OAAA,GAAU,UAAA,EAAW;AAAA,EACvD,SAAA,EAAWH,YAAK,WAAW,CAAA;AAAA,EAC3B,SAAA,EAAWA,YAAK,WAAW,CAAA;AAAA,EAC3B,MAAA,EAAQA,WAAA,CAAK,QAAQ,CAAA,CAClB,OAAA,EAAQ,CACR,UAAA,CAAW,MAAM,KAAA,CAAM,EAAA,EAAI,EAAE,QAAA,EAAU,WAAW,CAAA;AAAA;AAAA;AAAA,EAGrD,cAAA,EAAgBA,YAAK,gBAAgB;AACvC,CAAC,CAAA;AAEM,IAAM,QAAA,GAAWD,eAAQ,SAAA,EAAW;AAAA,EACzC,EAAA,EAAIC,WAAA,CAAK,IAAI,CAAA,CAAE,OAAA,EAAQ,CAAE,UAAA,EAAW,CAAE,UAAA,CAAW,MAAMC,cAAA,EAAU,CAAA;AAAA,EACjE,SAAA,EAAWD,WAAA,CAAK,WAAW,CAAA,CAAE,OAAA,EAAQ;AAAA,EACrC,UAAA,EAAYA,WAAA,CAAK,YAAY,CAAA,CAAE,OAAA,EAAQ;AAAA,EACvC,MAAA,EAAQA,WAAA,CAAK,QAAQ,CAAA,CAClB,OAAA,EAAQ,CACR,UAAA,CAAW,MAAM,KAAA,CAAM,EAAA,EAAI,EAAE,QAAA,EAAU,WAAW,CAAA;AAAA,EACrD,WAAA,EAAaA,YAAK,aAAa,CAAA;AAAA,EAC/B,YAAA,EAAcA,YAAK,cAAc,CAAA;AAAA,EACjC,OAAA,EAASA,YAAK,SAAS,CAAA;AAAA,EACvB,oBAAA,EAAsBG,iBAAU,sBAAsB,CAAA;AAAA,EACtD,qBAAA,EAAuBA,iBAAU,uBAAuB,CAAA;AAAA,EACxD,KAAA,EAAOH,YAAK,OAAO,CAAA;AAAA,EACnB,QAAA,EAAUA,YAAK,UAAU,CAAA;AAAA,EACzB,WAAWG,gBAAA,CAAU,WAAW,CAAA,CAAE,OAAA,GAAU,UAAA,EAAW;AAAA,EACvD,WAAWA,gBAAA,CAAU,WAAW,CAAA,CAAE,OAAA,GAAU,UAAA;AAC9C,CAAC,CAAA;AAMM,IAAM,UAAA,GAAaJ,eAAQ,WAAA,EAAa;AAAA,EAC7C,EAAA,EAAIC,WAAA,CAAK,IAAI,CAAA,CAAE,OAAA,EAAQ,CAAE,UAAA,EAAW,CAAE,UAAA,CAAW,MAAMC,cAAA,EAAU,CAAA;AAAA,EACjE,MAAA,EAAQD,WAAA,CAAK,QAAQ,CAAA,CAAE,OAAA,EAAQ;AAAA,EAC/B,WAAA,EAAaA,WAAA,CAAK,aAAa,CAAA,CAAE,OAAA,EAAQ;AAAA,EACzC,MAAA,EAAQA,WAAA,CAAK,QAAQ,CAAA,CAClB,OAAA,EAAQ,CACR,UAAA,CAAW,MAAM,KAAA,CAAM,EAAA,EAAI,EAAE,QAAA,EAAU,WAAW,CAAA;AAAA;AAAA,EAErD,QAAA,EAAUE,cAAA,CAAQ,UAAU,CAAA,CAAE,QAAQ,IAAI,CAAA;AAAA,EAC1C,uBAAA,EAAyBE,cAAA,CAAQ,yBAAyB,CAAA,CAAE,QAAQ,CAAC,CAAA;AAAA,EACrE,WAAA,EAAaD,iBAAU,aAAa;AACtC,CAAC,CAAA;AAGM,IAAM,QAAA,GAAWJ,eAAQ,SAAA,EAAW;AAAA,EACzC,EAAA,EAAIC,WAAA,CAAK,IAAI,CAAA,CAAE,OAAA,EAAQ,CAAE,UAAA,EAAW,CAAE,UAAA,CAAW,MAAMC,cAAA,EAAU,CAAA;AAAA,EACjE,IAAA,EAAMD,YAAK,MAAM,CAAA;AAAA,EACjB,SAAA,EAAWA,WAAA,CAAK,WAAW,CAAA,CAAE,OAAA,EAAQ;AAAA,EACrC,MAAA,EAAQA,WAAA,CAAK,QAAQ,CAAA,CAClB,OAAA,EAAQ,CACR,UAAA,CAAW,MAAM,KAAA,CAAM,EAAA,EAAI,EAAE,QAAA,EAAU,WAAW,CAAA;AAAA,EACrD,cAAcA,WAAA,CAAK,cAAc,CAAA,CAAE,OAAA,GAAU,MAAA,EAAO;AAAA,EACpD,OAAA,EAASI,cAAA,CAAQ,SAAS,CAAA,CAAE,OAAA,EAAQ;AAAA,EACpC,UAAA,EAAYJ,WAAA,CAAK,YAAY,CAAA,CAAE,OAAA,EAAQ;AAAA,EACvC,QAAA,EAAUE,cAAA,CAAQ,UAAU,CAAA,CAAE,OAAA,EAAQ;AAAA,EACtC,UAAA,EAAYF,YAAK,YAAY,CAAA;AAAA,EAC7B,SAAA,EAAWG,iBAAU,WAAW,CAAA;AAAA,EAChC,MAAA,EAAQH,YAAK,QAAQ;AACvB,CAAC,CAAA;AAEM,IAAM,aAAA,GAAgBD,eAAQ,cAAA,EAAgB;AAAA,EACnD,EAAA,EAAIC,WAAA,CAAK,IAAI,CAAA,CAAE,OAAA,EAAQ,CAAE,UAAA,EAAW,CAAE,UAAA,CAAW,MAAMC,cAAA,EAAU,CAAA;AAAA,EACjE,UAAA,EAAYD,WAAA,CAAK,YAAY,CAAA,CAAE,OAAA,EAAQ;AAAA,EACvC,KAAA,EAAOA,WAAA,CAAK,OAAO,CAAA,CAAE,OAAA,EAAQ;AAAA,EAC7B,SAAA,EAAWG,gBAAA,CAAU,WAAW,CAAA,CAAE,OAAA,EAAQ;AAAA,EAC1C,WAAWA,gBAAA,CAAU,WAAW,CAAA,CAAE,OAAA,GAAU,UAAA,EAAW;AAAA,EACvD,WAAWA,gBAAA,CAAU,WAAW,CAAA,CAAE,OAAA,GAAU,UAAA;AAC9C,CAAC,CAAA;AAEM,IAAM,YAAA,GAAeJ,eAAQ,cAAA,EAAgB;AAAA,EAClD,EAAA,EAAIC,WAAA,CAAK,IAAI,CAAA,CAAE,OAAA,EAAQ,CAAE,UAAA,EAAW,CAAE,UAAA,CAAW,MAAMC,cAAA,EAAU,CAAA;AAAA,EACjE,MAAA,EAAQD,WAAA,CAAK,QAAQ,CAAA,CAClB,OAAA,EAAQ,CACR,UAAA,CAAW,MAAM,KAAA,CAAM,EAAA,EAAI,EAAE,QAAA,EAAU,WAAW,CAAA;AAAA,EACrD,MAAA,EAAQ,kBAAA,CAAmB,QAAQ,CAAA,CAAE,OAAA,EAAQ;AAAA,EAC7C,WAAA,EAAaA,WAAA,CAAK,aAAa,CAAA,CAAE,OAAA,EAAQ;AAAA,EACzC,SAAA,EAAWA,YAAK,WAAW,CAAA;AAAA,EAC3B,SAAA,EAAWA,YAAK,WAAW,CAAA;AAAA,EAC3B,QAAA,EAAUA,YAAK,UAAU,CAAA;AAAA;AAAA;AAAA;AAAA,EAIzB,WAAA,EAAaA,YAAK,aAAa,CAAA;AAAA,EAC/B,EAAA,EAAIA,YAAK,IAAI,CAAA;AAAA,EACb,OAAA,EAASA,YAAK,SAAS,CAAA;AAAA,EACvB,UAAA,EAAYA,YAAK,YAAY,CAAA;AAAA,EAC7B,OAAA,EAASA,YAAK,SAAS,CAAA;AAAA,EACvB,IAAA,EAAMA,YAAK,MAAM,CAAA;AAAA,EACjB,WAAWG,gBAAA,CAAU,WAAW,CAAA,CAAE,OAAA,GAAU,UAAA;AAC9C,CAAC,CAAA;AAQM,IAAM,kBAAA,GAAqBJ,eAAQ,oBAAA,EAAsB;AAAA,EAC9D,EAAA,EAAIC,WAAA,CAAK,IAAI,CAAA,CAAE,OAAA,EAAQ,CAAE,UAAA,EAAW,CAAE,UAAA,CAAW,MAAMC,cAAA,EAAU,CAAA;AAAA,EACjE,MAAA,EAAQD,WAAA,CAAK,QAAQ,CAAA,CAClB,OAAA,EAAQ,CACR,UAAA,CAAW,MAAM,KAAA,CAAM,EAAA,EAAI,EAAE,QAAA,EAAU,WAAW,CAAA;AAAA,EACrD,SAAA,EAAWA,WAAA,CAAK,WAAW,CAAA,CAAE,OAAA,EAAQ;AAAA;AAAA;AAAA;AAAA;AAAA,EAKrC,SAAA,EAAWA,YAAK,WAAW,CAAA;AAAA,EAC3B,SAAA,EAAWA,YAAK,WAAW,CAAA;AAAA,EAC3B,OAAA,EAASA,YAAK,SAAS,CAAA;AAAA,EACvB,IAAA,EAAMA,YAAK,MAAM,CAAA;AAAA,EACjB,WAAWG,gBAAA,CAAU,WAAW,CAAA,CAAE,OAAA,GAAU,UAAA;AAC9C,CAAA,EAAG,CAAC,KAAA,KAAU;AAAA,EACZE,cAAO,iCAAiC,CAAA,CAAE,GAAG,KAAA,CAAM,MAAA,EAAQ,MAAM,SAAS;AAC5E,CAAC,CAAA;AASM,IAAM,YAAA,GAAeN,eAAQ,eAAA,EAAiB;AAAA,EACnD,aAAaC,WAAA,CAAK,aAAa,CAAA,CAAE,OAAA,GAAU,UAAA,EAAW;AAAA,EACtD,OAAOI,cAAA,CAAQ,OAAO,EAAE,OAAA,EAAQ,CAAE,QAAQ,CAAC,CAAA;AAAA,EAC3C,aAAaD,gBAAA,CAAU,aAAa,CAAA,CAAE,OAAA,GAAU,UAAA,EAAW;AAAA;AAAA;AAAA;AAAA;AAAA,EAK3D,eAAeA,gBAAA,CAAU,eAAe,CAAA,CAAE,OAAA,GAAU,UAAA,EAAW;AAAA,EAC/D,SAAA,EAAWH,YAAK,WAAW,CAAA;AAAA,EAC3B,SAAA,EAAWA,YAAK,WAAW,CAAA;AAAA,EAC3B,SAAA,EAAWA,YAAK,WAAW,CAAA;AAAA,EAC3B,QAAA,EAAUA,YAAK,UAAU;AAAA;AAC3B,CAAC,CAAA;AAKM,IAAM,cAAA,GAAiBD,eAAQ,iBAAA,EAAmB;AAAA,EACvD,IAAIC,WAAA,CAAK,IAAI,EAAE,UAAA,EAAW,CAAE,QAAQ,SAAS,CAAA;AAAA,EAC7C,iBAAiBE,cAAA,CAAQ,iBAAiB,EAAE,OAAA,EAAQ,CAAE,QAAQ,KAAK,CAAA;AAAA,EACnE,kBAAA,EAAoBF,YAAK,oBAAoB,CAAA;AAAA;AAAA;AAAA,EAG7C,sBAAA,EAAwBA,YAAK,wBAAwB,CAAA,CAAE,OAAM,CAAE,OAAA,EAAQ,CAAE,OAAA,CAAQ,gCAAgC,CAAA;AAAA,EACjH,kBAAkBE,cAAA,CAAQ,kBAAkB,EAAE,OAAA,EAAQ,CAAE,QAAQ,IAAI,CAAA;AAAA,EACpE,yBAAyBA,cAAA,CAAQ,yBAAyB,EAAE,OAAA,EAAQ,CAAE,QAAQ,IAAI,CAAA;AAAA,EAClF,kBAAkBA,cAAA,CAAQ,kBAAkB,EAAE,OAAA,EAAQ,CAAE,QAAQ,KAAK,CAAA;AAAA,EACrE,yBAAyBA,cAAA,CAAQ,yBAAyB,EAAE,OAAA,EAAQ,CAAE,QAAQ,IAAI,CAAA;AAAA,EAClF,WAAWC,gBAAA,CAAU,WAAW,CAAA,CAAE,OAAA,GAAU,UAAA,EAAW;AAAA;AAAA;AAAA;AAAA,EAIvD,SAAA,EAAWH,WAAA,CAAK,WAAW,CAAA,CAAE,UAAA,CAAW,MAAM,KAAA,CAAM,EAAA,EAAI,EAAE,QAAA,EAAU,UAAA,EAAY;AAClF,CAAA,EAAG,CAAC,KAAA,KAAU;AAAA,EACZM,YAAA,CAAM,2BAAA,EAA6BC,cAAA,CAAA,EAAM,KAAA,CAAM,EAAE,CAAA,YAAA,CAAc;AACjE,CAAC,CAAA;AEtNM,IAAM,SAAA,GAAYC,MAAE,MAAA,CAAO;AAAA,EAChC,QAAA,EAAUA,KAAA,CAAE,IAAA,CAAK,CAAC,aAAA,EAAe,cAAc,MAAM,CAAC,CAAA,CAAE,OAAA,CAAQ,aAAa,CAAA;AAAA,EAC7E,IAAA,EAAMA,MAAE,MAAA,EAAO,CAAE,QAAQ,MAAM,CAAA,CAAE,UAAU,MAAM,CAAA;AAAA,EACjD,YAAA,EAAcA,KAAA,CAAE,MAAA,EAAO,CAAE,QAAQ,EAAE,CAAA;AAAA,EACnC,cAAA,EAAgBA,KAAA,CAAE,MAAA,EAAO,CAAE,QAAQ,EAAE,CAAA;AAAA;AAAA;AAAA,EAGrC,UAAA,EAAYA,KAAA,CAAE,MAAA,EAAO,CAAE,QAAQ,kCAAkC,CAAA;AAAA;AAAA;AAAA;AAAA,EAIjE,QAAA,EAAUA,KAAA,CAAE,MAAA,EAAO,CAAE,QAAQ,kBAAkB,CAAA;AAAA;AAAA;AAAA;AAAA,EAI/C,yBAAA,EAA2BA,KAAA,CAAE,MAAA,EAAO,CAAE,OAAA,CAAQ,MAAM,CAAA,CAAE,SAAA,CAAU,CAAA,GAAA,KAAO,GAAA,KAAQ,MAAM,CAAA;AAAA,EACrF,kBAAA,EAAoBA,KAAA,CAAE,MAAA,EAAO,CAAE,OAAA,CAAQ,MAAM,CAAA,CAAE,SAAA,CAAU,CAAA,GAAA,KAAO,GAAA,KAAQ,MAAM,CAAA;AAAA,EAC9E,0BAAA,EAA4BA,KAAA,CAAE,MAAA,EAAO,CAAE,OAAA,CAAQ,MAAM,CAAA,CAAE,SAAA,CAAU,CAAA,GAAA,KAAO,GAAA,KAAQ,MAAM,CAAA;AAAA,EACtF,mBAAA,EAAqBA,KAAA,CAAE,MAAA,EAAO,CAAE,OAAA,CAAQ,OAAO,CAAA,CAAE,SAAA,CAAU,CAAA,GAAA,KAAO,GAAA,KAAQ,MAAM,CAAA;AAAA,EAChF,SAAA,EAAWA,MAAE,IAAA,CAAK,CAAC,MAAM,MAAM,CAAC,CAAA,CAAE,OAAA,CAAQ,IAAI,CAAA;AAAA;AAAA;AAAA,EAG9C,YAAA,EAAcA,KAAA,CAAE,MAAA,EAAO,CAAE,OAAA,CAAQ,OAAO,CAAA,CAAE,SAAA,CAAU,CAAA,GAAA,KAAO,GAAA,KAAQ,MAAM;AAC3E,CAAC,CAAA;;;AC1BD,IAAM,OAAA,GAAU,SAAA,CAAU,SAAA,CAAU,OAAA,CAAQ,GAAG,CAAA;AAE/C,IAAI,OAAA,CAAQ,OAAA,IAAY,OAAA,CAAQ,IAAA,CAAK,aAAa,aAAA,EAAgB;AAChE,EAAA,OAAA,CAAQ,IAAI,+BAAA,EAAiC,MAAA,CAAO,IAAA,CAAK,OAAA,CAAQ,IAAI,CAAC,CAAA;AACxE;AAEA,IAAI,CAAC,QAAQ,OAAA,EAAS;AACpB,EAAA,OAAA,CAAQ,KAAA,CAAM,gCAAA,EAAkC,OAAA,CAAQ,KAAA,CAAM,QAAQ,CAAA;AACtE,EAAA,MAAM,IAAI,MAAM,+BAA+B,CAAA;AACjD;AAEO,IAAM,SAAS,OAAA,CAAQ,IAAA;;;ACM9B,IAAI,EAAA;AAGJ,IAAI,MAAA,CAAO,cAAc,IAAA,EAAM;AAC7B,EAAA,MAAM,IAAA,GAAO,IAAIC,OAAA,CAAK;AAAA,IACpB,kBAAkB,MAAA,CAAO,YAAA;AAAA,IACzB,KAAK,MAAA,CAAO,YAAA,GAAe,EAAE,kBAAA,EAAoB,OAAM,GAAI;AAAA,GAC5D,CAAA;AACD,EAAA,EAAA,GAAKC,qBAAU,IAAA,EAAM;AAAA,IACnB,MAAA,EAAA,cAAA;AAAA,IACA,MAAA,EAAQ;AAAA,GACT,CAAA;AAED,EAAA,OAAA,CAAQ,IAAI,wCAAiC,CAAA;AAE/C,CAAA,MAAA,IAAW,MAAA,CAAO,cAAc,MAAA,EAAQ;AACtC,EAAA,MAAMH,IAAAA,GAAMI,eAAA,CAAK,MAAA,CAAO,YAAa,CAAA;AACrC,EAAA,EAAA,GAAKC,iBAAQL,IAAAA,EAAK,EAAE,MAAA,EAAA,cAAA,EAAQ,MAAA,EAAQ,MAAM,CAAA;AAE1C,EAAA,OAAA,CAAQ,IAAI,oCAA6B,CAAA;AAE3C,CAAA,MAAO;AACL,EAAA,OAAA,CAAQ,GAAA,CAAI,yDAAA,EAA2D,MAAA,CAAO,SAAS,CAAA;AACzF;;;ACLA,eAAsB,WAAA,CAAY;AAAA,EAChC,MAAA;AAAA,EACA,MAAA;AAAA,EACA,WAAA;AAAA,EACA,SAAA;AAAA,EACA,SAAA;AAAA,EACA,QAAA;AAAA,EACA,WAAA;AAAA,EACA,EAAA;AAAA,EACA,OAAA;AAAA,EACA,UAAA;AAAA,EACA,OAAA;AAAA,EACA;AACF,CAAA,EAAsB;AACpB,EAAA,IAAI;AACF,IAAA,MAAM,EAAA,CAAG,MAAA,CAAO,YAAY,CAAA,CAAE,MAAA,CAAO;AAAA,MACnC,MAAA;AAAA,MACA,MAAA;AAAA,MACA,WAAA;AAAA,MACA,WAAW,SAAA,IAAa,IAAA;AAAA,MACxB,WAAW,SAAA,IAAa,IAAA;AAAA,MACxB,QAAA,EAAU,QAAA,GAAW,IAAA,CAAK,SAAA,CAAU,QAAQ,CAAA,GAAI,IAAA;AAAA,MAChD,aAAa,WAAA,IAAe,IAAA;AAAA,MAC5B,IAAI,EAAA,IAAM,IAAA;AAAA,MACV,SAAS,OAAA,IAAW,IAAA;AAAA,MACpB,YAAY,UAAA,IAAc,IAAA;AAAA,MAC1B,SAAS,OAAA,IAAW,IAAA;AAAA,MACpB,MAAM,IAAA,IAAQ;AAAA,KACf,CAAA;AAAA,EACH,SAAS,KAAA,EAAO;AACd,IAAA,OAAA,CAAQ,KAAA,CAAM,2BAA2B,KAAK,CAAA;AAAA,EAEhD;AACF","file":"logger.js","sourcesContent":["import { boolean, check, integer, pgEnum, pgTable, text, timestamp, unique } from \"drizzle-orm/pg-core\";\nimport { sql } from \"drizzle-orm\";\nimport { createId } from '@paralleldrive/cuid2'\nimport { DEFAULT_MAINTENANCE_EXEMPT_PATHS } from \"../../lib/maintenance\";\n\n// 'tester' is a regular user account flagged for testing; apps can use it to\n// keep test accounts apart from real users. It has no admin access.\nexport const RoleEnum = pgEnum('roles', ['user', 'admin', 'tester'])\n\nexport const ActivityActionEnum = pgEnum('activity_actions', [\n  'login',\n  'logout',\n  'login_failed',\n  'password_changed',\n  'email_changed',\n  'profile_updated',\n  'session_revoked',\n  'user_deleted',\n  'user_banned',\n  'user_unbanned',\n  'role_changed',\n  'impersonation_started',\n  'impersonation_stopped',\n  'settings_changed',\n  'passkey_added',\n  'passkey_removed',\n])\n\nexport const users = pgTable(\"user\", {\n  id: text(\"id\").notNull().primaryKey().$defaultFn(() => createId()),\n  name: text('name').notNull(),\n  email: text('email').notNull().unique(),\n  password: text('password'),\n  emailVerified: boolean(\"emailVerified\").notNull().default(false),\n  image: text(\"image\"),\n  role: RoleEnum('roles').default('user').notNull(),\n  banned: boolean('banned').default(false).notNull(),\n  bannedAt: timestamp('bannedAt'),\n  bannedReason: text('bannedReason'),\n  // Required by better-auth's admin plugin schema (auto-expiring bans). We\n  // never set this ourselves, so it stays null and bans behave as permanent,\n  // same as before the plugin was added.\n  banExpires: timestamp('banExpires'),\n  lastLoginAt: timestamp('lastLoginAt'),\n  lastActiveAt: timestamp('lastActiveAt'),\n  // Set by better-auth's twoFactor plugin — true once the user has\n  // completed TOTP setup (see twoFactor pgTable below for the secret /\n  // backup codes themselves).\n  twoFactorEnabled: boolean('twoFactorEnabled').notNull().default(false),\n  createdAt: timestamp('createdAt').notNull().defaultNow(),\n  updatedAt: timestamp('updatedAt').notNull().defaultNow(),\n});\n\nexport const sessions = pgTable(\"session\", {\n  id: text(\"id\").notNull().primaryKey().$defaultFn(() => createId()),\n  expiresAt: timestamp(\"expiresAt\").notNull(),\n  token: text(\"token\").notNull().unique(),\n  createdAt: timestamp(\"createdAt\").notNull().defaultNow(),\n  updatedAt: timestamp(\"updatedAt\").notNull().defaultNow(),\n  ipAddress: text(\"ipAddress\"),\n  userAgent: text(\"userAgent\"),\n  userId: text(\"userId\")\n    .notNull()\n    .references(() => users.id, { onDelete: \"cascade\" }),\n  // Set by better-auth's admin plugin while this session is an admin\n  // impersonating another user; holds the impersonating admin's user id.\n  impersonatedBy: text(\"impersonatedBy\"),\n});\n\nexport const accounts = pgTable(\"account\", {\n  id: text(\"id\").notNull().primaryKey().$defaultFn(() => createId()),\n  accountId: text(\"accountId\").notNull(),\n  providerId: text(\"providerId\").notNull(),\n  userId: text(\"userId\")\n    .notNull()\n    .references(() => users.id, { onDelete: \"cascade\" }),\n  accessToken: text(\"accessToken\"),\n  refreshToken: text(\"refreshToken\"),\n  idToken: text(\"idToken\"),\n  accessTokenExpiresAt: timestamp(\"accessTokenExpiresAt\"),\n  refreshTokenExpiresAt: timestamp(\"refreshTokenExpiresAt\"),\n  scope: text(\"scope\"),\n  password: text(\"password\"),\n  createdAt: timestamp(\"createdAt\").notNull().defaultNow(),\n  updatedAt: timestamp(\"updatedAt\").notNull().defaultNow(),\n});\n\n// Better-auth's twoFactor plugin. One row per user (created on first\n// `enable`); secret and backupCodes are its own encrypted-at-rest strings,\n// field names/types must match its expectations exactly (drizzleAdapter in\n// server/auth.ts maps this table to the plugin's \"twoFactor\" model as-is).\nexport const twoFactors = pgTable(\"twoFactor\", {\n  id: text(\"id\").notNull().primaryKey().$defaultFn(() => createId()),\n  secret: text(\"secret\").notNull(),\n  backupCodes: text(\"backupCodes\").notNull(),\n  userId: text(\"userId\")\n    .notNull()\n    .references(() => users.id, { onDelete: \"cascade\" }),\n  // Added in better-auth 1.7 (TOTP lockout). Defaults match the plugin's.\n  verified: boolean(\"verified\").default(true),\n  failedVerificationCount: integer(\"failedVerificationCount\").default(0),\n  lockedUntil: timestamp(\"lockedUntil\"),\n});\n\n// Better-auth's passkey plugin — one row per registered WebAuthn credential.\nexport const passkeys = pgTable(\"passkey\", {\n  id: text(\"id\").notNull().primaryKey().$defaultFn(() => createId()),\n  name: text(\"name\"),\n  publicKey: text(\"publicKey\").notNull(),\n  userId: text(\"userId\")\n    .notNull()\n    .references(() => users.id, { onDelete: \"cascade\" }),\n  credentialID: text(\"credentialID\").notNull().unique(),\n  counter: integer(\"counter\").notNull(),\n  deviceType: text(\"deviceType\").notNull(),\n  backedUp: boolean(\"backedUp\").notNull(),\n  transports: text(\"transports\"),\n  createdAt: timestamp(\"createdAt\"),\n  aaguid: text(\"aaguid\"),\n});\n\nexport const verifications = pgTable(\"verification\", {\n  id: text(\"id\").notNull().primaryKey().$defaultFn(() => createId()),\n  identifier: text(\"identifier\").notNull(),\n  value: text(\"value\").notNull(),\n  expiresAt: timestamp(\"expiresAt\").notNull(),\n  createdAt: timestamp(\"createdAt\").notNull().defaultNow(),\n  updatedAt: timestamp(\"updatedAt\").notNull().defaultNow(),\n});\n\nexport const activityLogs = pgTable(\"activity_log\", {\n  id: text(\"id\").notNull().primaryKey().$defaultFn(() => createId()),\n  userId: text(\"userId\")\n    .notNull()\n    .references(() => users.id, { onDelete: \"cascade\" }),\n  action: ActivityActionEnum('action').notNull(),\n  description: text('description').notNull(),\n  ipAddress: text('ipAddress'),\n  userAgent: text('userAgent'),\n  metadata: text('metadata'),\n  // Populated on 'login' events only (registration + sign-in) — parsed from\n  // userAgent/ipAddress at write time so the record stays stable even if\n  // the parsing library or geoip database changes later.\n  referrerUrl: text('referrerUrl'),\n  os: text('os'),\n  browser: text('browser'),\n  deviceType: text('deviceType'),\n  country: text('country'),\n  city: text('city'),\n  createdAt: timestamp('createdAt').notNull().defaultNow(),\n});\n\n// One row per (user, device fingerprint) pair. Its only job is to answer\n// \"has this account signed in from this device before?\" — no matching row ⇒\n// send a new-device alert (see app/api/device-check/route.ts). visitorId is\n// FingerprintJS's identifier, computed client-side in\n// components/auth/deviceCheck.tsx. UA+IP are deliberately NOT the signal here:\n// they churn constantly on mobile and would alert on every other login.\nexport const deviceFingerprints = pgTable(\"device_fingerprint\", {\n  id: text(\"id\").notNull().primaryKey().$defaultFn(() => createId()),\n  userId: text(\"userId\")\n    .notNull()\n    .references(() => users.id, { onDelete: \"cascade\" }),\n  visitorId: text(\"visitorId\").notNull(),\n  // Context captured at first-seen time — for the admin panel's \"New devices\"\n  // card and the alert email. Not part of the new-vs-known decision (that's\n  // visitorId only), just so an admin can eyeball whether a sign-in looks like\n  // a hijack. Nullable: an old row predates these columns, or geoip missed.\n  ipAddress: text(\"ipAddress\"),\n  userAgent: text(\"userAgent\"),\n  country: text(\"country\"),\n  city: text(\"city\"),\n  createdAt: timestamp(\"createdAt\").notNull().defaultNow(),\n}, (table) => [\n  unique(\"device_fingerprint_user_visitor\").on(table.userId, table.visitorId),\n]);\n\n// Per-device abuse throttle for /sign-in/email and /sign-up/email — one\n// fixed-window counter row per FingerprintJS visitorId (sent by the auth\n// forms as the x-device-fingerprint header; see lib/auth-throttle.ts).\n// Keyed by device, not IP: IP is shared behind corporate NAT / CGNAT / VPN,\n// so an IP counter throttles coworkers together while missing an abuser who\n// rotates IPs. Rows whose window has elapsed are dead weight but harmless\n// (reset on the next attempt) — prune on a cron if the table ever grows.\nexport const authThrottle = pgTable(\"auth_throttle\", {\n  fingerprint: text(\"fingerprint\").notNull().primaryKey(),\n  count: integer(\"count\").notNull().default(0),\n  windowStart: timestamp(\"windowStart\").notNull().defaultNow(),\n  // Blockable data points, overwritten on every attempt (last-write-wins) so\n  // the admin panel can show who to block — by IP or by fingerprint — with no\n  // join and no per-attempt history table. windowStart anchors the counter's\n  // window; lastAttemptAt is just \"most recently seen\".\n  lastAttemptAt: timestamp(\"lastAttemptAt\").notNull().defaultNow(),\n  ipAddress: text(\"ipAddress\"),\n  userAgent: text(\"userAgent\"),\n  lastEmail: text(\"lastEmail\"),\n  lastKind: text(\"lastKind\"), // 'signin' | 'signup'\n});\n\n// Singleton row (id is always 'default') holding admin-editable settings for\n// config that used to be env-var-only. See lib/settings-queries.ts for the\n// cached read path and lazy-seed-from-env behavior.\nexport const systemSettings = pgTable(\"system_settings\", {\n  id: text(\"id\").primaryKey().default(\"default\"),\n  maintenanceMode: boolean(\"maintenanceMode\").notNull().default(false),\n  maintenanceMessage: text(\"maintenanceMessage\"),\n  // Path prefixes that stay reachable while maintenance mode is on (see\n  // lib/maintenance.ts — a few auth paths are always open on top of these).\n  maintenanceExemptPaths: text(\"maintenanceExemptPaths\").array().notNull().default(DEFAULT_MAINTENANCE_EXEMPT_PATHS),\n  authEnableGoogle: boolean(\"authEnableGoogle\").notNull().default(true),\n  authEnableEmailPassword: boolean(\"authEnableEmailPassword\").notNull().default(true),\n  authEnableOneTap: boolean(\"authEnableOneTap\").notNull().default(false),\n  enableSessionRevocation: boolean(\"enableSessionRevocation\").notNull().default(true),\n  updatedAt: timestamp(\"updatedAt\").notNull().defaultNow(),\n  // Who last changed a setting. This row doesn't \"belong\" to that admin the\n  // way sessions/activityLogs belong to their user, so deleting that admin's\n  // account should null this out rather than cascade-delete the singleton row.\n  updatedBy: text(\"updatedBy\").references(() => users.id, { onDelete: \"set null\" }),\n}, (table) => [\n  check(\"system_settings_singleton\", sql`${table.id} = 'default'`),\n]);","// Pure path logic for maintenance mode — no DB / server-only imports, so it\n// can run in proxy.ts and in the admin form alike.\n\n// Default for the admin-editable exempt list: the public marketing pages.\nexport const DEFAULT_MAINTENANCE_EXEMPT_PATHS = [\n  \"/\",\n  \"/features\",\n  \"/changelog\",\n  \"/changelog-template\",\n  \"/privacy\",\n  \"/terms\",\n]\n\n// Always reachable, whatever the admin saves — otherwise an admin could\n// lock themselves out of the sign-in flow needed to turn maintenance off.\nexport const ALWAYS_OPEN_PATHS = [\n  \"/maintenance\",\n  \"/login\", // includes /login/2fa\n  \"/forgot-password\",\n  \"/reset-password\",\n  \"/api/auth\",\n  \"/api/settings/public\", // login page reads the One Tap flag from here\n]\n\n// `/foo` matches `/foo` and `/foo/...` but not `/foobar`; `/` matches only `/`.\nfunction matches(pathname: string, prefix: string) {\n  const p = prefix.length > 1 ? prefix.replace(/\\/+$/, \"\") : prefix\n  return pathname === p || (p !== \"/\" && pathname.startsWith(p + \"/\"))\n}\n\nexport function isMaintenanceExempt(pathname: string, exemptPaths: string[]) {\n  return [...ALWAYS_OPEN_PATHS, ...exemptPaths].some((p) => matches(pathname, p))\n}\n","// No \"server-only\" guard here — this schema is also imported by scripts that\n// run outside Next.js's bundler (e.g. scripts/doctor.ts), where that guard\n// throws unconditionally. config/env.ts re-exports the parsed, guarded result\n// for app code; import this file directly only from non-Next scripts.\nimport { z } from 'zod';\n\nexport const envSchema = z.object({\n  NODE_ENV: z.enum(['development', 'production', 'test']).default('development'),\n  PORT: z.string().default('3000').transform(Number),\n  DATABASE_URL: z.string().default(''),\n  RESEND_API_KEY: z.string().default(''),\n  // Sender for every transactional email. Must be on a domain verified in\n  // your Resend account.\n  EMAIL_FROM: z.string().default('Acme <onboarding@xavierkhew.xyz>'),\n  // Display name for this deployment — shown as the authenticator-app label\n  // (2FA issuer) and the passkey relying-party name. Consuming projects set\n  // this in their own .env; defaults to the template name.\n  APP_NAME: z.string().default('Next.js Template'),\n  // Seed-only: the live value lives in the system_settings DB row (see\n  // lib/settings-queries.ts) once it's been seeded on first read, and is\n  // changed from the admin System Settings page, not by editing this var.\n  ENABLE_SESSION_REVOCATION: z.string().default('true').transform(val => val === 'true'),\n  AUTH_ENABLE_GOOGLE: z.string().default('true').transform(val => val === 'true'),\n  AUTH_ENABLE_EMAIL_PASSWORD: z.string().default('true').transform(val => val === 'true'),\n  AUTH_ENABLE_ONE_TAP: z.string().default('false').transform(val => val === 'true'),\n  DB_DRIVER: z.enum(['pg', 'neon']).default('pg'),\n  // Only relevant when DB_DRIVER=pg — whether the target Postgres server has SSL\n  // enabled. Self-hosted Postgres (e.g. via Docker/Dokploy) typically does not.\n  DATABASE_SSL: z.string().default('false').transform(val => val === 'true'),\n});\n","import \"server-only\";\nimport { envSchema } from './env-schema';\n\nconst results = envSchema.safeParse(process.env);\n\nif (results.success && (results.data.NODE_ENV === 'development')) {\n  console.log('Environment variables loaded:', Object.keys(results.data));\n}\n\nif (!results.success) {\n  console.error('Invalid environment variables:', results.error.format());\n  throw new Error('Invalid environment variables');\n}\n\nexport const config = results.data;\n","import 'server-only';\n\n// neon-http driver for production\nimport { neon } from '@neondatabase/serverless';\nimport { drizzle } from 'drizzle-orm/neon-http';\n\n// postgres driver for local development\nimport { drizzle as drizzlePg } from 'drizzle-orm/node-postgres';\nimport { Pool } from 'pg';\n\nimport * as schema from './schema';\nimport { config } from '../../config/env';\n\n// Import the query builder\nimport { PostgresJsDatabase } from 'drizzle-orm/postgres-js';\nimport { NeonHttpDatabase } from 'drizzle-orm/neon-http';\n\ntype DrizzleNeon = NeonHttpDatabase<typeof schema>;\ntype DrizzlePg = PostgresJsDatabase<typeof schema>;\n\nlet db: DrizzleNeon | DrizzlePg\n\n\nif (config.DB_DRIVER === 'pg') {\n  const pool = new Pool({\n    connectionString: config.DATABASE_URL!,\n    ssl: config.DATABASE_SSL ? { rejectUnauthorized: false } : undefined,\n  });\n  db = drizzlePg(pool, {\n    schema,\n    logger: true,\n  });\n\n  console.log('🟡 Using PostgreSQL (pg) driver');\n\n} else if (config.DB_DRIVER === 'neon') {\n  const sql = neon(config.DATABASE_URL!);\n  db = drizzle(sql, { schema, logger: true });\n\n  console.log('🟢 Using Neon (HTTP) driver');\n\n} else {\n  console.log('Database connection not established, unknown DB_DRIVER:', config.DB_DRIVER);\n}\n// Note: In production, you might want to disable logging or use a more sophisticated logger.\n\nexport { db }","import \"server-only\"\nimport { db } from \"../server/db\"\nimport { activityLogs } from \"../server/db/schema\"\n\nexport type ActivityAction =\n  | 'login'\n  | 'logout'\n  | 'login_failed'\n  | 'password_changed'\n  | 'email_changed'\n  | 'profile_updated'\n  | 'session_revoked'\n  | 'user_deleted'\n  | 'user_banned'\n  | 'user_unbanned'\n  | 'role_changed'\n  | 'impersonation_started'\n  | 'impersonation_stopped'\n  | 'settings_changed'\n  | 'passkey_added'\n  | 'passkey_removed'\n\ninterface LogActivityParams {\n  userId: string\n  action: ActivityAction\n  description: string\n  ipAddress?: string | null\n  userAgent?: string | null\n  metadata?: Record<string, any>\n  // Populated on 'login' events only — see server/auth.ts's session.create hook.\n  referrerUrl?: string | null\n  os?: string | null\n  browser?: string | null\n  deviceType?: string | null\n  country?: string | null\n  city?: string | null\n}\n\nexport async function logActivity({\n  userId,\n  action,\n  description,\n  ipAddress,\n  userAgent,\n  metadata,\n  referrerUrl,\n  os,\n  browser,\n  deviceType,\n  country,\n  city,\n}: LogActivityParams) {\n  try {\n    await db.insert(activityLogs).values({\n      userId,\n      action,\n      description,\n      ipAddress: ipAddress || null,\n      userAgent: userAgent || null,\n      metadata: metadata ? JSON.stringify(metadata) : null,\n      referrerUrl: referrerUrl || null,\n      os: os || null,\n      browser: browser || null,\n      deviceType: deviceType || null,\n      country: country || null,\n      city: city || null,\n    })\n  } catch (error) {\n    console.error('Failed to log activity:', error)\n    // Don't throw - activity logging should not break the app\n  }\n}\n"]}

package/dist/activity/logger.mjs

@@ -1,6 +1,6 @@
-export { logActivity } from '../chunk-KZQNXX2M.mjs';
-import '../chunk-V4UMTNGB.mjs';
-import '../chunk-4B7MJOLH.mjs';
+export { logActivity } from '../chunk-VEFYEHD4.mjs';
+import '../chunk-MRRPHLCL.mjs';
+import '../chunk-YPKOQOTA.mjs';
 import '../chunk-2GFPALUD.mjs';
 import '../chunk-3465SI5N.mjs';
 //# sourceMappingURL=logger.mjs.map

package/dist/activity/queries.d.mts

@@ -1,4 +1,4 @@
-import { A as ActivityActionEnum } from '../schema-BghJ8N4X.mjs';
+import { A as ActivityActionEnum } from '../schema-CCaV4_s9.mjs';
 import 'drizzle-orm';
 import 'drizzle-orm/pg-core';
 

package/dist/activity/queries.d.ts

@@ -1,4 +1,4 @@
-import { A as ActivityActionEnum } from '../schema-BghJ8N4X.js';
+import { A as ActivityActionEnum } from '../schema-CCaV4_s9.js';
 import 'drizzle-orm';
 import 'drizzle-orm/pg-core';
 

package/dist/activity/queries.js

@@ -44,7 +44,7 @@ var DEFAULT_MAINTENANCE_EXEMPT_PATHS = [
 ];
 
 // server/db/schema.ts
-var RoleEnum = pgCore.pgEnum("roles", ["user", "admin"]);
+var RoleEnum = pgCore.pgEnum("roles", ["user", "admin", "tester"]);
 var ActivityActionEnum = pgCore.pgEnum("activity_actions", [
   "login",
   "logout",