moonhead 1.0.0

package/dist/lib/actions/state.d.ts

@@ -0,0 +1,22 @@
+type SuccessMessage = {
+    message?: string;
+};
+type FormSuccess<T> = T extends void ? {
+    ok: true;
+} & SuccessMessage : {
+    ok: true;
+} & SuccessMessage & T;
+export type FieldErrors = Record<string, string[]>;
+type Failure = {
+    ok: false;
+    error: string;
+    fieldErrors?: FieldErrors;
+    toast?: true;
+};
+export type FormState<T = void> = undefined | FormSuccess<T> | Failure;
+export type ActionResult<T> = {
+    ok: true;
+    data: T;
+    message?: string;
+} | Failure;
+export {};

package/dist/lib/audit/actions.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Single source of truth for every audit action key. Keys follow the
+ * `entity.action` convention. `ctx.audit({ action })` is typed to this union,
+ * so a typo or an unregistered key fails at compile time. Add new actions here
+ * (and give them an i18n label under `AuditLog.actions` — enforced by
+ * `features/audit/action-labels.ts`).
+ */
+export declare const AUDIT_ACTIONS: readonly ["user.status.update", "user.password.change", "user.totp.enable", "user.totp.disable", "affiliate.create", "affiliate.sub_invite", "affiliate.update", "affiliate.delete", "affiliate.approve", "affiliate.reject", "affiliate.unreject", "affiliate.attach", "affiliate.detach", "manager.create", "manager.update", "manager.permissions.update", "manager.delete", "group.create", "group.update", "group.delete", "casino.create", "casino.update", "casino.activate", "casino.deactivate", "casino.delete", "casino.postback_update", "casino.postback_secret_regenerate", "campaign.create", "campaign.deactivate", "campaign.reactivate", "deal.create", "deal.update", "deal.deactivate", "deal.reactivate", "deal.delegate", "commission.create", "commission.update", "commission.publish", "commission.deactivate", "commission.reactivate", "commission.duplicate", "commission.delete", "payout.request", "payout.approve", "payout.reject", "payout.paid", "settings.update"];
+export type AuditAction = (typeof AUDIT_ACTIONS)[number];

package/dist/lib/audit/actions.js

@@ -0,0 +1 @@
+const e=["user.status.update","user.password.change","user.totp.enable","user.totp.disable","affiliate.create","affiliate.sub_invite","affiliate.update","affiliate.delete","affiliate.approve","affiliate.reject","affiliate.unreject","affiliate.attach","affiliate.detach","manager.create","manager.update","manager.permissions.update","manager.delete","group.create","group.update","group.delete","casino.create","casino.update","casino.activate","casino.deactivate","casino.delete","casino.postback_update","casino.postback_secret_regenerate","campaign.create","campaign.deactivate","campaign.reactivate","deal.create","deal.update","deal.deactivate","deal.reactivate","deal.delegate","commission.create","commission.update","commission.publish","commission.deactivate","commission.reactivate","commission.duplicate","commission.delete","payout.request","payout.approve","payout.reject","payout.paid","settings.update"];export{e as AUDIT_ACTIONS};

package/dist/lib/audit/record.d.ts

@@ -0,0 +1,4 @@
+import "server-only";
+import { type Executor } from "../../db/index.js";
+import { type NewAuditLog } from "../../db/schema/index.js";
+export declare function recordAuditLog(entry: NewAuditLog, executor?: Executor): Promise<void>;

package/dist/lib/audit/record.js

@@ -0,0 +1 @@
+import"server-only";import{db as i}from"../../db/index.js";import{auditLogs as r}from"../../db/schema/index.js";async function m(o,t=i){await t.insert(r).values(o)}export{m as recordAuditLog};

package/dist/lib/auth/action.d.ts

@@ -0,0 +1,45 @@
+import "server-only";
+import type { Executor } from "../../db/index.js";
+import type { PublicUser, UserRole } from "../../db/schema/index.js";
+import type { Permission, PermissionCarrier } from "../../features/auth/permissions.js";
+import type { ActionResult, FormState } from "../actions/state.js";
+import type { AuditAction } from "../audit/actions.js";
+export type AuditInput = {
+    action: AuditAction;
+    subjectId?: string;
+    target?: {
+        type: string;
+        id: string;
+        label?: string;
+    };
+    metadata?: Record<string, unknown>;
+};
+export type AuditFn = (input: AuditInput, tx?: Executor) => Promise<void>;
+export type AuthCtx = {
+    user: PublicUser;
+    carrier: PermissionCarrier;
+    audit: AuditFn;
+};
+type Resolver<Args extends unknown[], R extends object> = (ctx: AuthCtx, ...args: Args) => Promise<R>;
+type AuthOptions<Args extends unknown[], R extends object> = {
+    permission?: Permission;
+    role?: UserRole;
+    requireAdmin?: boolean;
+    resolve?: Resolver<Args, R>;
+    revalidate?: readonly string[];
+};
+type FormOptions = {
+    revalidate?: readonly string[];
+};
+type WithOptionalMessage<T> = T extends void ? {
+    message: string;
+} | undefined : T | (T & {
+    message: string;
+});
+export declare function authAction<Args extends unknown[], T = void, R extends object = object>(options: AuthOptions<Args, R>, fn: (ctx: AuthCtx & R, ...args: Args) => Promise<WithOptionalMessage<T>>): (...args: Args) => Promise<ActionResult<T>>;
+export declare function authFormAction<P extends unknown[] = [], T = void, R extends object = object>(options: AuthOptions<[...P, FormData], R>, fn: (ctx: AuthCtx & R, ...args: [...P, FormData]) => Promise<WithOptionalMessage<T>>): (...args: [...P, FormState<T>, FormData]) => Promise<FormState<T>>;
+export declare function formAction<P extends unknown[] = [], T = void>(options: FormOptions, fn: (...args: [...P, FormData]) => Promise<WithOptionalMessage<T>>): (...args: [...P, FormState<T>, FormData]) => Promise<FormState<T>>;
+export declare function authQuery<Args extends unknown[], R>(permission: Permission, fn: (ctx: AuthCtx, ...args: Args) => Promise<R>): (...args: Args) => Promise<R>;
+export declare function adminQuery<Args extends unknown[], R>(fn: (ctx: AuthCtx, ...args: Args) => Promise<R>): (...args: Args) => Promise<R>;
+export declare function roleQuery<Args extends unknown[], R>(role: UserRole, fn: (ctx: AuthCtx, ...args: Args) => Promise<R>): (...args: Args) => Promise<R>;
+export {};

package/dist/lib/auth/action.js

@@ -0,0 +1 @@
+import"server-only";import{revalidatePath as x}from"next/cache";import{headers as y}from"next/headers";import{getTranslations as h}from"next-intl/server";import{requirePermission as m,requirePlatformAdmin as l,requireRole as g,requireSession as i}from"../../features/auth/authorization.js";import{recordAuditLog as f}from"../audit/record.js";import{isDbUnavailable as P}from"../db/errors.js";import{errorI18nKey as w,isAppError as R}from"../errors/codes.js";function b(r){return async(t,e)=>{const s=await y(),a={actorId:r.id,actorRole:r.role,actorEmail:r.email,action:t.action,subjectId:t.subjectId??null,targetType:t.target?.type??null,targetId:t.target?.id??null,targetLabel:t.target?.label??null,metadata:t.metadata??null,ipAddress:s.get("x-forwarded-for")?.split(",")[0]?.trim()??null,userAgent:s.get("user-agent")??null};if(e){await f(a,e);return}try{await f(a)}catch(o){console.error("[audit] record failed:",t.action,o)}}}function u(r){return{...r,audit:b(r.user)}}async function A(r,t){const e=await i();r.permission&&m(e.carrier,r.permission),r.role&&g(e.user,r.role),r.requireAdmin&&l(e.user);const s=u(e),a=r.resolve?await r.resolve(s,...t):{};return{...s,...a}}function d(r){for(const t of r??[])x(t)}async function p(r,t){const s=(await h())(w(r)),a=t?.fieldErrors?t.fieldErrors:t?.field?{[t.field]:[s]}:t?.toast?void 0:{_form:[s]};return{ok:!1,error:s,...a?{fieldErrors:a}:{},...t?.toast?{toast:!0}:{}}}async function c(r){if(R(r))return await p(r.code,{field:r.field,fieldErrors:r.fieldErrors,toast:r.toast});if(P(r))return await p("service_unavailable",{toast:!0})}function F(r){if(r!==null&&typeof r=="object"&&"message"in r&&typeof r.message=="string"){const{message:t,...e}=r;return{data:e,message:t}}return{data:r}}function S(r,t){return async(...e)=>{try{const s=await A(r,e),a=await t(s,...e);return d(r.revalidate),{ok:!0,...F(a)}}catch(s){const a=await c(s);if(a)return a;throw s}}}function I(r,t){return async(...e)=>{const s=e[e.length-1],a=[...e.slice(0,-2),s];try{const o=await A(r,a),n=await t(o,...a);return d(r.revalidate),{ok:!0,...n??{}}}catch(o){const n=await c(o);if(n)return n;throw o}}}function U(r,t){return async(...e)=>{const s=e[e.length-1],a=[...e.slice(0,-2),s];try{const o=await t(...a);return d(r.revalidate),{ok:!0,...o??{}}}catch(o){const n=await c(o);if(n)return n;throw o}}}function q(r,t){return async(...e)=>{const s=await i();return m(s.carrier,r),t(u(s),...e)}}function M(r){return async(...t)=>{const e=await i();return l(e.user),r(u(e),...t)}}function W(r,t){return async(...e)=>{const s=await i();return g(s.user,r),t(u(s),...e)}}export{M as adminQuery,S as authAction,I as authFormAction,q as authQuery,U as formAction,W as roleQuery};

package/dist/lib/auth/config.d.ts

@@ -0,0 +1,24 @@
+export declare const ACCESS_COOKIE: string;
+export declare const REFRESH_COOKIE: string;
+export declare const TOTP_CHALLENGE_COOKIE: string;
+export declare const JWT_TTL_SECONDS: number;
+export declare const REFRESH_TTL_SECONDS: number;
+export declare const TOTP_CHALLENGE_TTL_SECONDS: number;
+export type CookieOptions = {
+    path: "/";
+    maxAge: number;
+    httpOnly: true;
+    sameSite: "lax";
+    secure: boolean;
+};
+export type ClearCookieOptions = {
+    name: string;
+    path: "/";
+    httpOnly: true;
+    sameSite: "lax";
+    secure: boolean;
+};
+export declare function clearCookieOptions(name: string): ClearCookieOptions;
+export declare function accessCookieOptions(): CookieOptions;
+export declare function refreshCookieOptions(): CookieOptions;
+export declare function totpChallengeCookieOptions(): CookieOptions;

package/dist/lib/auth/config.js

@@ -0,0 +1 @@
+const e=process.env.NODE_ENV==="production",s=e?"__Host-access":"access",p=e?"__Host-refresh":"refresh",a=e?"__Host-totp-challenge":"totp-challenge",o=600,r=3600*24*30,n=300;function i(t){return{name:t,path:"/",httpOnly:!0,sameSite:"lax",secure:e}}function c(){return{path:"/",maxAge:o,httpOnly:!0,sameSite:"lax",secure:e}}function O(){return{path:"/",maxAge:r,httpOnly:!0,sameSite:"lax",secure:e}}function l(){return{path:"/",maxAge:n,httpOnly:!0,sameSite:"lax",secure:e}}export{s as ACCESS_COOKIE,o as JWT_TTL_SECONDS,p as REFRESH_COOKIE,r as REFRESH_TTL_SECONDS,a as TOTP_CHALLENGE_COOKIE,n as TOTP_CHALLENGE_TTL_SECONDS,c as accessCookieOptions,i as clearCookieOptions,O as refreshCookieOptions,l as totpChallengeCookieOptions};

package/dist/lib/auth/jwt.d.ts

@@ -0,0 +1,17 @@
+import "server-only";
+export type SessionClaims = {
+    userId: string;
+    sessionId: string;
+};
+export type VerifiedSessionClaims = SessionClaims & {
+    expiresAt: number;
+};
+export type VerifyAccessResult = {
+    ok: true;
+    claims: VerifiedSessionClaims;
+} | {
+    ok: false;
+    reason: "missing" | "expired" | "invalid";
+};
+export declare function createSessionJwt(claims: SessionClaims, ttlSeconds?: number): Promise<string>;
+export declare function verifySessionJwt(token: string | undefined | null): Promise<VerifyAccessResult>;

package/dist/lib/auth/jwt.js

@@ -0,0 +1 @@
+import"server-only";import{errors as d,jwtVerify as p,SignJWT as f}from"jose";import{JWT_TTL_SECONDS as l}from"./config.js";import{env as t}from"../env.js";const o="HS256",a=t.BRAND_NAME.toLowerCase(),u="session",c=new TextEncoder().encode(t.JWT_SECRET);async function T(e,s=l){return new f({sid:e.sessionId}).setProtectedHeader({alg:o,typ:"JWT"}).setSubject(e.userId).setIssuer(a).setAudience(u).setIssuedAt().setExpirationTime(`${s}s`).sign(c)}async function g(e){if(!e)return{ok:!1,reason:"missing"};try{const{payload:s}=await p(e,c,{algorithms:[o],issuer:a,audience:u,clockTolerance:5,requiredClaims:["sub","sid","exp"]}),{sub:r,sid:i,exp:n}=s;return typeof r!="string"||typeof i!="string"||typeof n!="number"?{ok:!1,reason:"invalid"}:{ok:!0,claims:{userId:r,sessionId:i,expiresAt:n}}}catch(s){return s instanceof d.JWTExpired?{ok:!1,reason:"expired"}:{ok:!1,reason:"invalid"}}}export{T as createSessionJwt,g as verifySessionJwt};

package/dist/lib/auth/password-options.d.ts

@@ -0,0 +1,6 @@
+export declare const ARGON2_OPTIONS: {
+    readonly algorithm: 2;
+    readonly memoryCost: 19456;
+    readonly timeCost: 2;
+    readonly parallelism: 1;
+};

package/dist/lib/auth/password-options.js

@@ -0,0 +1 @@
+const o={algorithm:2,memoryCost:19456,timeCost:2,parallelism:1};export{o as ARGON2_OPTIONS};

package/dist/lib/auth/password.d.ts

@@ -0,0 +1,3 @@
+import "server-only";
+export declare function hashPassword(password: string): Promise<string>;
+export declare function verifyPassword(storedHash: string, password: string): Promise<boolean>;

package/dist/lib/auth/password.js

@@ -0,0 +1 @@
+import"server-only";import{hash as s,verify as i}from"@node-rs/argon2";import{ARGON2_OPTIONS as t}from"./password-options.js";async function f(r){return s(r,t)}async function m(r,o){try{return await i(r,o,t)}catch{return!1}}export{f as hashPassword,m as verifyPassword};

package/dist/lib/auth/session.d.ts

@@ -0,0 +1,26 @@
+import "server-only";
+import { type PublicUser } from "../../db/schema/index.js";
+import { type SessionContext } from "./tokens.js";
+export type Session = {
+    user: PublicUser;
+    permissions: ReadonlyArray<string>;
+};
+export declare const loadSession: () => Promise<Session | null>;
+export declare function getCurrentUser(): Promise<PublicUser | null>;
+export declare function signIn(userId: string): Promise<void>;
+export declare function signOut(): Promise<void>;
+type RotateOk = {
+    ok: true;
+    userId: string;
+    sessionId: string;
+    context: SessionContext;
+    accessToken: string;
+    refreshToken: string;
+};
+type RotateFail = {
+    ok: false;
+    reason: "missing" | "invalid" | "reuse";
+};
+export type RotateResult = RotateOk | RotateFail;
+export declare function rotateSession(rawRt: string | undefined): Promise<RotateResult>;
+export {};

package/dist/lib/auth/session.js

@@ -0,0 +1 @@
+import"server-only";import{db as l}from"../../db/index.js";import{canSignIn as y,groupPermissions as c,publicUserColumns as S,userGroups as n,userPermissions as a,users as m}from"../../db/schema/index.js";import{eq as t}from"drizzle-orm";import{cookies as d,headers as C}from"next/headers";import{cache as p}from"react";import{ACCESS_COOKIE as u,accessCookieOptions as v,clearCookieOptions as k,REFRESH_COOKIE as f,refreshCookieOptions as h}from"./config.js";import{createSessionJwt as w,verifySessionJwt as I}from"./jwt.js";import{consumeAndRotate as A,createSession as x,revokeAllSessionsForUser as R,revokeSession as P,revokeSessionByRawToken as O}from"./tokens.js";import{isDbUnavailable as b}from"../db/errors.js";import{appError as T}from"../errors/codes.js";const U=p(async()=>{const e=await d();return I(e.get(u)?.value)}),E=p(async()=>{const e=await U();return e.ok?e.claims:null}),F=p(async()=>{const e=await E();if(!e)return null;try{const s=l.select({userId:n.userId,permission:c.permission}).from(n).innerJoin(c,t(n.groupId,c.groupId)).where(t(n.userId,e.userId)).unionAll(l.select({userId:a.userId,permission:a.permission}).from(a).where(t(a.userId,e.userId))).as("perms"),r=await l.select({user:S,permission:s.permission}).from(m).leftJoin(s,t(s.userId,m.id)).where(t(m.id,e.userId));if(r.length===0)return null;const o=r[0].user;if(!y(o.status))return await R(o.id),null;const i=Array.from(new Set(r.flatMap(g=>g.permission===null?[]:[g.permission])));return{user:o,permissions:i}}catch(s){throw b(s)?T("service_unavailable",{toast:!0}):s}});async function L(){return(await F())?.user??null}async function J(){const e=await C(),s=e.get("user-agent"),r=e.get("x-forwarded-for"),o=(r?r.split(",")[0]?.trim():null)||e.get("x-real-ip")||null;return{userAgent:s??null,ipAddress:o}}async function N(e){const s=await J(),r=await x({userId:e,...s}),o=await w({userId:e,sessionId:r.sessionId}),i=await d();i.set(u,o,v()),i.set(f,r.refreshToken.raw,h())}async function Q(){const e=await d(),s=e.get(u)?.value,r=e.get(f)?.value,o=s?await I(s):{ok:!1,reason:"missing"};o.ok?await P(o.claims.sessionId):r&&await O(r),e.delete(k(u)),e.delete(k(f))}async function W(e){if(!e)return{ok:!1,reason:"missing"};const s=await A(e);if(s.kind==="invalid")return{ok:!1,reason:"invalid"};if(s.kind==="reuse")return{ok:!1,reason:"reuse"};const r=await w({userId:s.userId,sessionId:s.sessionId});return{ok:!0,userId:s.userId,sessionId:s.sessionId,context:{role:s.role,totpConfirmedAt:s.totpConfirmedAt},accessToken:r,refreshToken:s.raw}}export{L as getCurrentUser,F as loadSession,W as rotateSession,N as signIn,Q as signOut};

package/dist/lib/auth/tokens.d.ts

@@ -0,0 +1,43 @@
+import "server-only";
+import { type Tx } from "../../db/index.js";
+import { type UserRole } from "../../db/schema/index.js";
+export type IssuedRefreshToken = {
+    id: string;
+    raw: string;
+    expiresAt: Date;
+};
+export type CreatedSession = {
+    sessionId: string;
+    refreshToken: IssuedRefreshToken;
+};
+export type SessionContext = {
+    role: UserRole;
+    totpConfirmedAt: Date | null;
+};
+export type ConsumeResult = ({
+    kind: "ok";
+    userId: string;
+    sessionId: string;
+    raw: string;
+    expiresAt: Date;
+} & SessionContext) | {
+    kind: "invalid";
+} | {
+    kind: "reuse";
+    sessionId: string;
+    userId: string;
+};
+export declare function createSession(args: {
+    userId: string;
+    userAgent?: string | null;
+    ipAddress?: string | null;
+}): Promise<CreatedSession>;
+export declare function issueRefreshToken(args: {
+    sessionId: string;
+    tx?: Tx;
+}): Promise<IssuedRefreshToken>;
+export declare function consumeAndRotate(rawToken: string): Promise<ConsumeResult>;
+export declare function loadSessionContext(sessionId: string): Promise<SessionContext | null>;
+export declare function revokeSession(sessionId: string): Promise<void>;
+export declare function revokeSessionByRawToken(rawToken: string): Promise<void>;
+export declare function revokeAllSessionsForUser(userId: string): Promise<void>;

package/dist/lib/auth/tokens.js

@@ -0,0 +1 @@
+import"server-only";import{createHash as m,randomBytes as I}from"node:crypto";import{db as u}from"../../db/index.js";import{refreshTokens as r,sessions as s,users as d}from"../../db/schema/index.js";import{and as k,eq as i,gt as x,lt as g}from"drizzle-orm";import{REFRESH_TTL_SECONDS as h}from"./config.js";const A=32,v=1e4;function p(t){return m("sha256").update(t).digest("hex")}function l(){return new Date(Date.now()+h*1e3)}async function H(t){const o=I(A).toString("base64url"),n=l();return await u.transaction(async e=>{const[a]=await e.insert(s).values({userId:t.userId,userAgent:t.userAgent??null,ipAddress:t.ipAddress??null,expiresAt:n}).returning({id:s.id}),[c]=await e.insert(r).values({sessionId:a.id,tokenHash:p(o),expiresAt:n}).returning({id:r.id});return{sessionId:a.id,refreshToken:{id:c.id,raw:o,expiresAt:n}}})}async function f(t){const o=I(A).toString("base64url"),n=l(),e=t.tx??u,[a]=await e.insert(r).values({sessionId:t.sessionId,tokenHash:p(o),expiresAt:n}).returning({id:r.id});return{id:a.id,raw:o,expiresAt:n}}async function P(t){const o=p(t);return await u.transaction(async n=>{await n.delete(s).where(g(s.expiresAt,new Date));const[e]=await n.select({rtId:r.id,rtRevokedAt:r.revokedAt,rtExpiresAt:r.expiresAt,sessionId:r.sessionId,userId:s.userId,sessionExpiresAt:s.expiresAt,role:d.role,totpConfirmedAt:d.totpConfirmedAt}).from(r).innerJoin(s,i(s.id,r.sessionId)).innerJoin(d,i(d.id,s.userId)).where(i(r.tokenHash,o)).for("update").limit(1);if(!e)return{kind:"invalid"};if(e.rtExpiresAt<new Date)return{kind:"invalid"};if(e.sessionExpiresAt<new Date)return{kind:"invalid"};if(e.rtRevokedAt){if(Date.now()-e.rtRevokedAt.getTime()<v){const w=await f({sessionId:e.sessionId,tx:n});return await n.update(s).set({lastSeenAt:new Date,expiresAt:l()}).where(i(s.id,e.sessionId)),{kind:"ok",userId:e.userId,sessionId:e.sessionId,role:e.role,totpConfirmedAt:e.totpConfirmedAt,raw:w.raw,expiresAt:w.expiresAt}}return await n.delete(s).where(i(s.id,e.sessionId)),{kind:"reuse",sessionId:e.sessionId,userId:e.userId}}const a=await f({sessionId:e.sessionId,tx:n});return await n.update(r).set({revokedAt:new Date}).where(i(r.id,e.rtId)),await n.update(s).set({lastSeenAt:new Date,expiresAt:l()}).where(i(s.id,e.sessionId)),{kind:"ok",userId:e.userId,sessionId:e.sessionId,role:e.role,totpConfirmedAt:e.totpConfirmedAt,raw:a.raw,expiresAt:a.expiresAt}})}async function _(t){const[o]=await u.select({role:d.role,totpConfirmedAt:d.totpConfirmedAt}).from(s).innerJoin(d,i(d.id,s.userId)).where(k(i(s.id,t),x(s.expiresAt,new Date))).limit(1);return o??null}async function C(t){await u.delete(s).where(i(s.id,t))}async function O(t){const o=p(t),[n]=await u.select({sessionId:r.sessionId}).from(r).where(i(r.tokenHash,o)).limit(1);n&&await C(n.sessionId)}async function b(t){await u.delete(s).where(i(s.userId,t))}export{P as consumeAndRotate,H as createSession,f as issueRefreshToken,_ as loadSessionContext,b as revokeAllSessionsForUser,C as revokeSession,O as revokeSessionByRawToken};

package/dist/lib/auth/totp-challenge.d.ts

@@ -0,0 +1,4 @@
+import "server-only";
+export declare function issueTotpChallenge(userId: string): Promise<void>;
+export declare function readTotpChallenge(): Promise<string | null>;
+export declare function clearTotpChallenge(): Promise<void>;

package/dist/lib/auth/totp-challenge.js

@@ -0,0 +1 @@
+import"server-only";import{jwtVerify as u,SignJWT as E}from"jose";import{cookies as s}from"next/headers";import{clearCookieOptions as p,TOTP_CHALLENGE_COOKIE as n,TOTP_CHALLENGE_TTL_SECONDS as C,totpChallengeCookieOptions as T}from"./config.js";import{env as r}from"../env.js";const i="HS256",a=r.BRAND_NAME.toLowerCase(),c="totp-challenge",l=new TextEncoder().encode(r.JWT_SECRET);async function f(t){const e=await new E({}).setProtectedHeader({alg:i,typ:"JWT"}).setSubject(t).setIssuer(a).setAudience(c).setIssuedAt().setExpirationTime(`${C}s`).sign(l);(await s()).set(n,e,T())}async function _(){const e=(await s()).get(n)?.value;if(!e)return null;try{const{payload:o}=await u(e,l,{algorithms:[i],issuer:a,audience:c,clockTolerance:5,requiredClaims:["sub","exp"]});return typeof o.sub=="string"?o.sub:null}catch{return null}}async function w(){(await s()).delete(p(n))}export{w as clearTotpChallenge,f as issueTotpChallenge,_ as readTotpChallenge};

package/dist/lib/auth/totp.d.ts

@@ -0,0 +1,7 @@
+import "server-only";
+export declare function encryptSecret(plain: string): string;
+export declare function decryptSecret(encoded: string): string;
+export declare function generateSecret(): string;
+export declare function buildOtpAuthUri(secretBase32: string, accountLabel: string): string;
+export declare function renderQrDataUrl(otpAuthUri: string): Promise<string>;
+export declare function verifyCode(secretBase32: string, code: string, accountLabel: string): boolean;

package/dist/lib/auth/totp.js

@@ -0,0 +1 @@
+import"server-only";import u from"node:crypto";import{Secret as a,TOTP as d}from"otpauth";import m from"qrcode";import{env as f}from"../env.js";const _=f.BRAND_NAME,O="SHA1",P=6,E=30,b=20,T="aes-256-gcm",n=12,g=16;let i=null;function p(){if(i)return i;const t=Buffer.from(f.TOTP_ENCRYPTION_KEY,"base64url");if(t.length!==32)throw new Error("TOTP_ENCRYPTION_KEY must decode to exactly 32 bytes (AES-256)");return i=t,i}function x(t){const r=u.randomBytes(n),e=u.createCipheriv(T,p(),r),o=Buffer.concat([e.update(t,"utf8"),e.final()]),s=e.getAuthTag();return Buffer.concat([r,s,o]).toString("base64url")}function N(t){const r=Buffer.from(t,"base64url"),e=r.subarray(0,n),o=r.subarray(n,n+g),s=r.subarray(n+g),c=u.createDecipheriv(T,p(),e);return c.setAuthTag(o),Buffer.concat([c.update(s),c.final()]).toString("utf8")}function v(){return new a({size:b}).base32}function l(t,r){return new d({issuer:_,label:r,algorithm:O,digits:P,period:E,secret:a.fromBase32(t)})}function C(t,r){return l(t,r).toString()}async function R(t){return m.toDataURL(t,{margin:1,width:240,errorCorrectionLevel:"M"})}function w(t,r,e){return/^\d{6}$/.test(r)?l(t,e).validate({token:r,window:1})!==null:!1}export{C as buildOtpAuthUri,N as decryptSecret,x as encryptSecret,v as generateSecret,R as renderQrDataUrl,w as verifyCode};

package/dist/lib/auth/verification-tokens.d.ts

@@ -0,0 +1,19 @@
+import "server-only";
+import { type VerificationTokenPurpose } from "../../db/schema/index.js";
+export type IssuedVerificationToken = {
+    id: string;
+    raw: string;
+    expiresAt: Date;
+};
+export type ConsumeVerificationResult = {
+    kind: "ok";
+    userId: string;
+} | {
+    kind: "invalid";
+};
+export declare function issueVerificationToken(args: {
+    userId: string;
+    purpose: VerificationTokenPurpose;
+}): Promise<IssuedVerificationToken>;
+export declare function consumeVerificationToken(rawToken: string, purpose: VerificationTokenPurpose): Promise<ConsumeVerificationResult>;
+export declare function inspectVerificationToken(rawToken: string, purpose: VerificationTokenPurpose): Promise<ConsumeVerificationResult>;

package/dist/lib/auth/verification-tokens.js

@@ -0,0 +1 @@
+import"server-only";import{createHash as p,randomBytes as c}from"node:crypto";import{db as s}from"../../db/index.js";import{verificationTokens as e}from"../../db/schema/index.js";import{and as u,eq as o}from"drizzle-orm";const f=32,k={invite:4320*60,password_reset:3600,email_verify:1440*60};function a(r){return p("sha256").update(r).digest("hex")}async function x(r){const t=c(f).toString("base64url"),n=a(t),i=new Date(Date.now()+k[r.purpose]*1e3),[d]=await s.insert(e).values({userId:r.userId,purpose:r.purpose,tokenHash:n,expiresAt:i}).onConflictDoUpdate({target:[e.userId,e.purpose],set:{tokenHash:n,expiresAt:i,createdAt:new Date}}).returning({id:e.id});return{id:d.id,raw:t,expiresAt:i}}async function V(r,t){const n=a(r),[i]=await s.delete(e).where(u(o(e.tokenHash,n),o(e.purpose,t))).returning({userId:e.userId,expiresAt:e.expiresAt});return i?i.expiresAt<new Date?{kind:"invalid"}:{kind:"ok",userId:i.userId}:{kind:"invalid"}}async function h(r,t){const n=a(r),[i]=await s.select({userId:e.userId,expiresAt:e.expiresAt}).from(e).where(u(o(e.tokenHash,n),o(e.purpose,t))).limit(1);return i?i.expiresAt<new Date?{kind:"invalid"}:{kind:"ok",userId:i.userId}:{kind:"invalid"}}export{V as consumeVerificationToken,h as inspectVerificationToken,x as issueVerificationToken};

package/dist/lib/cn.d.ts

@@ -0,0 +1,2 @@
+import { type ClassValue } from "clsx";
+export declare function cn(...inputs: ClassValue[]): string;

package/dist/lib/cn.js

@@ -0,0 +1 @@
+import{clsx as e}from"clsx";import{twMerge as t}from"tailwind-merge";function s(...r){return t(e(r))}export{s as cn};

package/dist/lib/countries.d.ts

@@ -0,0 +1,18 @@
+export declare const CONTINENT_KEYS: readonly ["europe", "americas", "asia", "africa", "oceania", "antarctica"];
+export type ContinentKey = (typeof CONTINENT_KEYS)[number];
+export declare const COUNTRIES_BY_CONTINENT: {
+    europe: string[];
+    americas: string[];
+    asia: string[];
+    africa: string[];
+    oceania: string[];
+    antarctica: string[];
+};
+export declare function getCountryName(code: string, locale: string): string;
+export declare function countriesByContinent(locale: string): {
+    continent: ContinentKey;
+    countries: {
+        code: string;
+        name: string;
+    }[];
+}[];

package/dist/lib/countries.js

@@ -0,0 +1 @@
+import a from"./data/countries-by-continent.json";const s=["europe","americas","asia","africa","oceania","antarctica"],o=a,r=new Map;function c(n){const e=r.get(n);if(e!==void 0)return e;let t;try{t=new Intl.DisplayNames([n],{type:"region"})}catch{t=null}return r.set(n,t),t}function u(n,e){try{return c(e)?.of(n)??n}catch{return n}}function m(n){return s.map(e=>({continent:e,countries:o[e].map(t=>({code:t,name:u(t,n)})).sort((t,i)=>t.name.localeCompare(i.name,n))}))}export{s as CONTINENT_KEYS,o as COUNTRIES_BY_CONTINENT,m as countriesByContinent,u as getCountryName};

package/dist/lib/currencies.d.ts

@@ -0,0 +1,6 @@
+export declare const FIAT_CURRENCIES: readonly ["EUR", "USD", "GBP"];
+export declare const CRYPTO_CURRENCIES: readonly ["BTC", "ETH", "USDT", "USDC"];
+export declare const SUPPORTED_CURRENCIES: readonly ["EUR", "USD", "GBP", "BTC", "ETH", "USDT", "USDC"];
+export type SupportedCurrency = (typeof SUPPORTED_CURRENCIES)[number];
+export declare const DEFAULT_CURRENCY: SupportedCurrency;
+export declare function isSupportedCurrency(code: string): code is SupportedCurrency;

package/dist/lib/currencies.js

@@ -0,0 +1 @@
+const e=["EUR","USD","GBP"],r=["BTC","ETH","USDT","USDC"],o=[...e,...r],C="EUR",n=new Set(o);function E(t){return n.has(t)}export{r as CRYPTO_CURRENCIES,C as DEFAULT_CURRENCY,e as FIAT_CURRENCIES,o as SUPPORTED_CURRENCIES,E as isSupportedCurrency};

package/dist/lib/data/countries-by-continent.json

@@ -0,0 +1,257 @@
+{
+  "europe": [
+    "AD",
+    "AL",
+    "AT",
+    "AX",
+    "BA",
+    "BE",
+    "BG",
+    "BY",
+    "CH",
+    "CZ",
+    "DE",
+    "DK",
+    "EE",
+    "ES",
+    "FI",
+    "FO",
+    "FR",
+    "GB",
+    "GG",
+    "GI",
+    "GR",
+    "HR",
+    "HU",
+    "IE",
+    "IM",
+    "IS",
+    "IT",
+    "JE",
+    "LI",
+    "LT",
+    "LU",
+    "LV",
+    "MC",
+    "MD",
+    "ME",
+    "MK",
+    "MT",
+    "NL",
+    "NO",
+    "PL",
+    "PT",
+    "RO",
+    "RS",
+    "RU",
+    "SE",
+    "SI",
+    "SJ",
+    "SK",
+    "SM",
+    "UA",
+    "VA"
+  ],
+  "americas": [
+    "AG",
+    "AI",
+    "AR",
+    "AW",
+    "BB",
+    "BL",
+    "BM",
+    "BO",
+    "BQ",
+    "BR",
+    "BS",
+    "BZ",
+    "CA",
+    "CL",
+    "CO",
+    "CR",
+    "CU",
+    "CW",
+    "DM",
+    "DO",
+    "EC",
+    "FK",
+    "GD",
+    "GF",
+    "GL",
+    "GP",
+    "GT",
+    "GY",
+    "HN",
+    "HT",
+    "JM",
+    "KN",
+    "KY",
+    "LC",
+    "MF",
+    "MQ",
+    "MS",
+    "MX",
+    "NI",
+    "PA",
+    "PE",
+    "PM",
+    "PR",
+    "PY",
+    "SR",
+    "SV",
+    "SX",
+    "TC",
+    "TT",
+    "US",
+    "UY",
+    "VC",
+    "VE",
+    "VG",
+    "VI"
+  ],
+  "asia": [
+    "AE",
+    "AF",
+    "AM",
+    "AZ",
+    "BD",
+    "BH",
+    "BN",
+    "BT",
+    "CN",
+    "CY",
+    "GE",
+    "HK",
+    "ID",
+    "IL",
+    "IN",
+    "IO",
+    "IQ",
+    "IR",
+    "JO",
+    "JP",
+    "KG",
+    "KH",
+    "KP",
+    "KR",
+    "KW",
+    "KZ",
+    "LA",
+    "LB",
+    "LK",
+    "MM",
+    "MN",
+    "MO",
+    "MV",
+    "MY",
+    "NP",
+    "OM",
+    "PH",
+    "PK",
+    "PS",
+    "QA",
+    "SA",
+    "SG",
+    "SY",
+    "TH",
+    "TJ",
+    "TL",
+    "TM",
+    "TR",
+    "TW",
+    "UZ",
+    "VN",
+    "YE"
+  ],
+  "africa": [
+    "AO",
+    "BF",
+    "BI",
+    "BJ",
+    "BW",
+    "CD",
+    "CF",
+    "CG",
+    "CI",
+    "CM",
+    "CV",
+    "DJ",
+    "DZ",
+    "EG",
+    "EH",
+    "ER",
+    "ET",
+    "GA",
+    "GH",
+    "GM",
+    "GN",
+    "GQ",
+    "GW",
+    "KE",
+    "KM",
+    "LR",
+    "LS",
+    "LY",
+    "MA",
+    "MG",
+    "ML",
+    "MR",
+    "MU",
+    "MW",
+    "MZ",
+    "NA",
+    "NE",
+    "NG",
+    "RE",
+    "RW",
+    "SC",
+    "SD",
+    "SH",
+    "SL",
+    "SN",
+    "SO",
+    "SS",
+    "ST",
+    "SZ",
+    "TD",
+    "TG",
+    "TN",
+    "TZ",
+    "UG",
+    "YT",
+    "ZA",
+    "ZM",
+    "ZW"
+  ],
+  "oceania": [
+    "AS",
+    "AU",
+    "CC",
+    "CK",
+    "CX",
+    "FJ",
+    "FM",
+    "GU",
+    "KI",
+    "MH",
+    "MP",
+    "NC",
+    "NF",
+    "NR",
+    "NU",
+    "NZ",
+    "PF",
+    "PG",
+    "PN",
+    "PW",
+    "SB",
+    "TK",
+    "TO",
+    "TV",
+    "UM",
+    "VU",
+    "WF",
+    "WS"
+  ],
+  "antarctica": ["AQ", "BV", "GS", "HM", "TF"]
+}

package/dist/lib/db/errors.d.ts

@@ -0,0 +1,4 @@
+import "server-only";
+export declare function isDbUnavailable(err: unknown): boolean;
+export declare function isUniqueViolation(err: unknown): boolean;
+export declare function isForeignKeyViolation(err: unknown): boolean;

package/dist/lib/db/errors.js

@@ -0,0 +1 @@
+import"server-only";import{isAppError as i}from"../errors/codes.js";const r=new Set(["ECONNREFUSED","ECONNRESET","ETIMEDOUT","ENOTFOUND","EPIPE","EAI_AGAIN","CONNECT_TIMEOUT","CONNECTION_CLOSED","57P01","57P02","57P03","08000","08001","08003","08004","08006","3D000","3D001","28000","28P01"]);function e(n,o=5){if(o<=0||n==null||typeof n!="object")return null;const t=n.code;if(typeof t=="string")return t;const u=n.cause??n.errors?.[0];return e(u,o-1)}function a(n){if(i(n,"service_unavailable"))return!0;const o=e(n);return o!=null&&r.has(o)}function l(n){return e(n)==="23505"}function c(n){return e(n)==="23503"}export{a as isDbUnavailable,c as isForeignKeyViolation,l as isUniqueViolation};

package/dist/lib/email/client.d.ts

@@ -0,0 +1,6 @@
+import "server-only";
+import { type Transporter } from "nodemailer";
+export declare function getTransporter(): {
+    transporter: Transporter;
+    from: string;
+};

package/dist/lib/email/client.js

@@ -0,0 +1 @@
+import"server-only";import e from"nodemailer";import{env as s}from"../env.js";import{emailEnv as a}from"./env.js";const n=globalThis;function c(){const r=a(),o=r.SMTP_PORT===465,t=n.transporter??e.createTransport({host:r.SMTP_HOST,port:r.SMTP_PORT,secure:o,requireTLS:!o,auth:{user:r.SMTP_USER,pass:r.SMTP_PASSWORD}});return s.NODE_ENV!=="production"&&(n.transporter=t),{transporter:t,from:r.EMAIL_FROM}}export{c as getTransporter};

package/dist/lib/email/env.d.ts

@@ -0,0 +1,12 @@
+import "server-only";
+import { z } from "zod";
+declare const EmailEnvSchema: z.ZodObject<{
+    SMTP_HOST: z.ZodString;
+    SMTP_PORT: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    SMTP_USER: z.ZodString;
+    SMTP_PASSWORD: z.ZodString;
+    EMAIL_FROM: z.ZodString;
+}, z.core.$strip>;
+export type EmailEnv = z.infer<typeof EmailEnvSchema>;
+export declare function emailEnv(): EmailEnv;
+export {};