qarpeo 0.0.0-alpha.10

package/dist/runtime/server/utils/analytics-query.mjs

@@ -0,0 +1,234 @@
+function rangeToInterval(range = "7d") {
+  const map = {
+    "1h": "1 HOUR",
+    "24h": "24 HOUR",
+    "7d": "7 DAY",
+    "30d": "30 DAY",
+    "90d": "90 DAY"
+  };
+  return map[range] || "7 DAY";
+}
+function rangeToGranularity(range = "7d") {
+  if (range === "1h") return "toStartOfFiveMinutes";
+  if (range === "24h") return "toStartOfHour";
+  return "toStartOfDay";
+}
+export async function queryAnalytics(sql, options = {}) {
+  const accountId = options.accountId || process.env.CLOUDFLARE_ACCOUNT_ID || process.env.CF_ACCOUNT_ID;
+  const apiToken = options.apiToken || process.env.CLOUDFLARE_API_TOKEN || process.env.CF_API_TOKEN;
+  if (!accountId || !apiToken) {
+    if (process.env.NODE_ENV !== "production") {
+      return [];
+    }
+    throw new Error(
+      "[qarpeo/analytics] Missing Cloudflare credentials. Set CLOUDFLARE_ACCOUNT_ID and CLOUDFLARE_API_TOKEN, or pass them via AnalyticsOptions."
+    );
+  }
+  const url = `https://api.cloudflare.com/client/v4/accounts/${accountId}/analytics_engine/sql`;
+  let res;
+  try {
+    res = await fetch(url, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${apiToken}`,
+        "Content-Type": "text/plain"
+      },
+      body: sql
+    });
+  } catch (err) {
+    if (process.env.NODE_ENV !== "production") return [];
+    throw new Error(`[qarpeo/analytics] Network error querying AE SQL API: ${err.message}`);
+  }
+  if (!res.ok) {
+    if (process.env.NODE_ENV !== "production") return [];
+    const body = await res.text().catch(() => "");
+    throw new Error(`[qarpeo/analytics] AE SQL API error ${res.status}: ${body}`);
+  }
+  const json = await res.json();
+  return json.data || [];
+}
+export function useAnalyticsDashboard(options = {}) {
+  const dataset = options.dataset || process.env.QARPEO_ANALYTICS_DATASET || "analytics";
+  const siteFilter = options.siteId ? `AND index1 = '${options.siteId.replace(/'/g, "''")}'` : "";
+  const query = (sql) => queryAnalytics(sql, options);
+  return {
+    /**
+     * Total pageviews and time-series breakdown.
+     *
+     * @param range Time range (default: '7d')
+     */
+    async pageviews(range = "7d") {
+      const interval = rangeToInterval(range);
+      const granFn = rangeToGranularity(range);
+      const seriesRows = await query(`
+        SELECT
+          ${granFn}(timestamp) AS date,
+          count() AS count
+        FROM ${dataset}
+        WHERE blob1 = 'pageview'
+          AND timestamp > NOW() - INTERVAL '${interval}'
+          ${siteFilter}
+        GROUP BY date
+        ORDER BY date ASC
+      `);
+      const series = seriesRows.map((r) => ({
+        date: String(r.date),
+        count: Number(r.count)
+      }));
+      const total = series.reduce((s, r) => s + r.count, 0);
+      return { total, series };
+    },
+    /**
+     * Unique visitor count (unique session fingerprints).
+     *
+     * @param range Time range (default: '7d')
+     */
+    async visitors(range = "7d") {
+      const interval = rangeToInterval(range);
+      const rows = await query(`
+        SELECT count(DISTINCT blob7) AS visitors
+        FROM ${dataset}
+        WHERE blob1 = 'pageview'
+          AND timestamp > NOW() - INTERVAL '${interval}'
+          ${siteFilter}
+      `);
+      return Number(rows[0]?.visitors ?? 0);
+    },
+    /**
+     * Top pages by pageview count.
+     *
+     * @param limit Max results (default: 10)
+     * @param range Time range (default: '7d')
+     */
+    async topPages(limit = 10, range = "7d") {
+      const interval = rangeToInterval(range);
+      const rows = await query(`
+        SELECT blob2 AS path, count() AS views
+        FROM ${dataset}
+        WHERE blob1 = 'pageview'
+          AND timestamp > NOW() - INTERVAL '${interval}'
+          ${siteFilter}
+        GROUP BY path
+        ORDER BY views DESC
+        LIMIT ${limit}
+      `);
+      return rows.map((r) => ({ path: String(r.path || "/"), views: Number(r.views) }));
+    },
+    /**
+     * Top referrers by visit count.
+     *
+     * @param limit Max results (default: 10)
+     * @param range Time range (default: '7d')
+     */
+    async topReferrers(limit = 10, range = "7d") {
+      const interval = rangeToInterval(range);
+      const rows = await query(`
+        SELECT blob3 AS referrer, count() AS count
+        FROM ${dataset}
+        WHERE blob1 = 'pageview'
+          AND blob3 != ''
+          AND timestamp > NOW() - INTERVAL '${interval}'
+          ${siteFilter}
+        GROUP BY referrer
+        ORDER BY count DESC
+        LIMIT ${limit}
+      `);
+      return rows.map((r) => ({ referrer: String(r.referrer), count: Number(r.count) }));
+    },
+    /**
+     * Pageview breakdown by country.
+     *
+     * @param limit Max results (default: 10)
+     * @param range Time range (default: '7d')
+     */
+    async countries(limit = 10, range = "7d") {
+      const interval = rangeToInterval(range);
+      const rows = await query(`
+        SELECT blob4 AS country, count() AS count
+        FROM ${dataset}
+        WHERE blob1 = 'pageview'
+          AND timestamp > NOW() - INTERVAL '${interval}'
+          ${siteFilter}
+        GROUP BY country
+        ORDER BY count DESC
+        LIMIT ${limit}
+      `);
+      return rows.map((r) => ({ country: String(r.country || "XX"), count: Number(r.count) }));
+    },
+    /**
+     * Device type breakdown.
+     *
+     * @param range Time range (default: '7d')
+     */
+    async devices(range = "7d") {
+      const interval = rangeToInterval(range);
+      const rows = await query(`
+        SELECT blob5 AS device, count() AS count
+        FROM ${dataset}
+        WHERE blob1 = 'pageview'
+          AND timestamp > NOW() - INTERVAL '${interval}'
+          ${siteFilter}
+        GROUP BY device
+      `);
+      const result = { mobile: 0, desktop: 0, bot: 0 };
+      for (const r of rows) {
+        const d = String(r.device);
+        if (d in result) result[d] = Number(r.count);
+      }
+      return result;
+    },
+    /**
+     * Custom event breakdown.
+     *
+     * @param name Filter to a specific event name. If omitted, returns all events.
+     * @param limit Max results (default: 20)
+     * @param range Time range (default: '7d')
+     */
+    async events(name, limit = 20, range = "7d") {
+      const interval = rangeToInterval(range);
+      const nameFilter = name ? `AND blob1 = '${name.replace(/'/g, "''")}'` : "AND blob1 != 'pageview'";
+      const rows = await query(`
+        SELECT
+          blob1 AS name,
+          count() AS count,
+          max(timestamp) AS lastSeen
+        FROM ${dataset}
+        WHERE timestamp > NOW() - INTERVAL '${interval}'
+          ${nameFilter}
+          ${siteFilter}
+        GROUP BY name
+        ORDER BY count DESC
+        LIMIT ${limit}
+      `);
+      return rows.map((r) => ({
+        name: String(r.name),
+        count: Number(r.count),
+        lastSeen: String(r.lastSeen)
+      }));
+    },
+    /**
+     * Returns a full KPI summary object — useful for the dashboard overview card. Runs multiple
+     * queries in parallel.
+     *
+     * @param range Time range (default: '7d')
+     */
+    async summary(range = "7d") {
+      const [pvResult, visitors, topPages, topReferrers, countries, devices] = await Promise.all([
+        this.pageviews(range),
+        this.visitors(range),
+        this.topPages(10, range),
+        this.topReferrers(10, range),
+        this.countries(10, range),
+        this.devices(range)
+      ]);
+      return {
+        pageviews: pvResult.total,
+        visitors,
+        topPages,
+        topReferrers,
+        countries,
+        devices
+      };
+    }
+  };
+}

package/dist/runtime/server/utils/auth.d.ts

@@ -0,0 +1,60 @@
+import type { RequestEvent } from "nuxt/server";
+import type { QarpeoSession } from "../../types/auth";
+/** Ensures core auth tables (_qarpeo_users, _qarpeo_accounts, _qarpeo_sessions) exist in D1. */
+export declare function ensureAuthTables(d1: any): Promise<void>;
+export interface NormalizeOAuthProfileOptions {
+    provider: string;
+    rawUser: any;
+    tokens: any;
+}
+export declare function normalizeOAuthProfile({ provider, rawUser, tokens }: NormalizeOAuthProfileOptions): {
+    provider: string;
+    providerAccountId: string;
+    email: any;
+    emailVerified: boolean;
+    name: any;
+    avatarUrl: any;
+    tokens: any;
+};
+export interface HandleOAuthSuccessOptions {
+    event: RequestEvent;
+    provider: string;
+    user: any;
+    tokens: any;
+}
+/**
+ * Handles OAuth callback success:
+ *
+ * 1. Upserts user in D1 database
+ * 2. Manages account linking according to security rules
+ * 3. Triggers `qarpeo:auth:oauth:success` Nitro hook
+ * 4. Triggers `qarpeo:auth:session:create` Nitro hook
+ * 5. Issues secured session cookie
+ */
+export declare function handleOAuthSuccess({ event, provider, user: rawUser, tokens, }: HandleOAuthSuccessOptions): Promise<QarpeoSession>;
+export interface DeleteAccountOptions {
+    confirm?: boolean;
+    phrase?: string;
+    turnstileToken?: string;
+    cascadeOrg?: boolean;
+}
+/**
+ * Permanently deletes a user account and purges all related sessions, OAuth accounts,
+ * 2FA credentials, WebAuthn authenticators, API tokens, and notification records.
+ * Throws 400 if user is sole owner of an organization and cascadeOrg is not specified.
+ */
+export declare function deleteUserAccount(event: any, userId: string, options?: DeleteAccountOptions): Promise<{
+    success: boolean;
+    userId: string;
+}>;
+/**
+ * Evaluates whether Multi-Factor Authentication is required for a user
+ * based on user 2FA enrollment and global/organization MFA policies.
+ */
+export declare function resolveMfaStatus(d1: any, user: {
+    id: string;
+    role?: string;
+}, authConfig?: any): Promise<{
+    mfaRequired: boolean;
+    mfaVerified: boolean;
+}>;

package/dist/runtime/server/utils/auth.mjs

@@ -0,0 +1,361 @@
+import { useNitroApp } from "nitro/app";
+import { getD1Binding } from "../../db.mjs";
+import { getQarpeoConfig } from "./config.mjs";
+import { encryptToken } from "./crypto.mjs";
+import { createDeviceSession, setAuthSession } from "./session.mjs";
+let tablesEnsured = false;
+export async function ensureAuthTables(d1) {
+  if (tablesEnsured) return;
+  await d1.batch([
+    d1.prepare(`
+      CREATE TABLE IF NOT EXISTS _qarpeo_users (
+        id TEXT PRIMARY KEY,
+        email TEXT UNIQUE NOT NULL,
+        email_verified INTEGER DEFAULT 0,
+        name TEXT,
+        avatar_url TEXT,
+        role TEXT DEFAULT 'user',
+        created_at INTEGER NOT NULL,
+        updated_at INTEGER NOT NULL
+      )
+    `),
+    d1.prepare(`
+      CREATE TABLE IF NOT EXISTS _qarpeo_accounts (
+        id TEXT PRIMARY KEY,
+        user_id TEXT NOT NULL REFERENCES _qarpeo_users(id) ON DELETE CASCADE,
+        provider TEXT NOT NULL,
+        provider_account_id TEXT NOT NULL,
+        email TEXT,
+        email_verified INTEGER DEFAULT 0,
+        access_token TEXT,
+        refresh_token TEXT,
+        expires_at INTEGER,
+        created_at INTEGER NOT NULL,
+        UNIQUE(provider, provider_account_id)
+      )
+    `),
+    d1.prepare(`
+      CREATE TABLE IF NOT EXISTS _qarpeo_sessions (
+        id TEXT PRIMARY KEY,
+        user_id TEXT NOT NULL REFERENCES _qarpeo_users(id) ON DELETE CASCADE,
+        token_hash TEXT NOT NULL,
+        client_type TEXT DEFAULT 'web',
+        user_agent TEXT,
+        ip_address TEXT,
+        last_active INTEGER NOT NULL,
+        expires_at INTEGER NOT NULL
+      )
+    `),
+    d1.prepare(`
+      CREATE TABLE IF NOT EXISTS _qarpeo_two_factor (
+        id TEXT PRIMARY KEY,
+        user_id TEXT NOT NULL UNIQUE REFERENCES _qarpeo_users(id) ON DELETE CASCADE,
+        secret TEXT NOT NULL,
+        backup_codes TEXT NOT NULL,
+        enabled INTEGER DEFAULT 0,
+        created_at INTEGER NOT NULL
+      )
+    `),
+    d1.prepare(`
+      CREATE TABLE IF NOT EXISTS _qarpeo_authenticators (
+        id TEXT PRIMARY KEY,
+        user_id TEXT NOT NULL REFERENCES _qarpeo_users(id) ON DELETE CASCADE,
+        credential_id TEXT NOT NULL UNIQUE,
+        public_key BLOB NOT NULL,
+        counter INTEGER NOT NULL DEFAULT 0,
+        transports TEXT,
+        created_at INTEGER NOT NULL
+      )
+    `),
+    d1.prepare(`
+      CREATE TABLE IF NOT EXISTS _qarpeo_organizations (
+        id TEXT PRIMARY KEY,
+        name TEXT NOT NULL,
+        slug TEXT NOT NULL UNIQUE,
+        logo_url TEXT,
+        created_at INTEGER NOT NULL
+      )
+    `),
+    d1.prepare(`
+      CREATE TABLE IF NOT EXISTS _qarpeo_members (
+        id TEXT PRIMARY KEY,
+        organization_id TEXT NOT NULL REFERENCES _qarpeo_organizations(id) ON DELETE CASCADE,
+        user_id TEXT NOT NULL REFERENCES _qarpeo_users(id) ON DELETE CASCADE,
+        role TEXT NOT NULL DEFAULT 'member',
+        created_at INTEGER NOT NULL,
+        UNIQUE(organization_id, user_id)
+      )
+    `),
+    d1.prepare(`
+      CREATE TABLE IF NOT EXISTS _qarpeo_invitations (
+        id TEXT PRIMARY KEY,
+        organization_id TEXT NOT NULL REFERENCES _qarpeo_organizations(id) ON DELETE CASCADE,
+        email TEXT NOT NULL,
+        role TEXT NOT NULL DEFAULT 'member',
+        token_hash TEXT NOT NULL,
+        expires_at INTEGER NOT NULL,
+        created_at INTEGER NOT NULL
+      )
+    `),
+    d1.prepare(`
+      CREATE TABLE IF NOT EXISTS _qarpeo_api_tokens (
+        id TEXT PRIMARY KEY,
+        user_id TEXT NOT NULL REFERENCES _qarpeo_users(id) ON DELETE CASCADE,
+        name TEXT NOT NULL,
+        token_hash TEXT NOT NULL,
+        scopes TEXT DEFAULT '["*"]',
+        last_used_at INTEGER,
+        expires_at INTEGER,
+        created_at INTEGER NOT NULL
+      )
+    `),
+    // Secondary indexes for hot paths (FK lookups & session validation)
+    d1.prepare(
+      `CREATE INDEX IF NOT EXISTS _qarpeo_sessions_user_id_idx ON _qarpeo_sessions(user_id)`
+    ),
+    d1.prepare(
+      `CREATE INDEX IF NOT EXISTS _qarpeo_sessions_token_hash_idx ON _qarpeo_sessions(token_hash)`
+    ),
+    d1.prepare(
+      `CREATE INDEX IF NOT EXISTS _qarpeo_sessions_expires_at_idx ON _qarpeo_sessions(expires_at)`
+    ),
+    d1.prepare(
+      `CREATE INDEX IF NOT EXISTS _qarpeo_accounts_user_id_idx ON _qarpeo_accounts(user_id)`
+    ),
+    d1.prepare(
+      `CREATE INDEX IF NOT EXISTS _qarpeo_api_tokens_user_id_idx ON _qarpeo_api_tokens(user_id)`
+    ),
+    d1.prepare(
+      `CREATE INDEX IF NOT EXISTS _qarpeo_members_user_id_idx ON _qarpeo_members(user_id)`
+    ),
+    d1.prepare(
+      `CREATE INDEX IF NOT EXISTS _qarpeo_members_org_id_idx ON _qarpeo_members(organization_id)`
+    )
+  ]);
+  tablesEnsured = true;
+}
+export function normalizeOAuthProfile({ provider, rawUser, tokens }) {
+  let email = rawUser.email || null;
+  let name = rawUser.name || rawUser.login || rawUser.username || null;
+  let avatarUrl = rawUser.avatar_url || rawUser.picture || (rawUser.avatar ? `https://cdn.discordapp.com/avatars/${rawUser.id}/${rawUser.avatar}.png` : null);
+  let providerAccountId = String(rawUser.id || rawUser.sub || "");
+  let emailVerified = Boolean(rawUser.email_verified || rawUser.verified);
+  if (provider === "github" && rawUser.email) {
+    emailVerified = Boolean(rawUser.email_verified ?? true);
+  }
+  return {
+    provider,
+    providerAccountId,
+    email,
+    emailVerified,
+    name,
+    avatarUrl,
+    tokens
+  };
+}
+export async function handleOAuthSuccess({
+  event,
+  provider,
+  user: rawUser,
+  tokens
+}) {
+  let d1;
+  try {
+    const bindingName = globalThis.process?.env?.QARPEO_DEFAULT_DB_BINDING || "DB";
+    d1 = getD1Binding(bindingName, event);
+    await ensureAuthTables(d1);
+  } catch (err) {
+    console.warn("[qarpeo:auth] Failed to initialize D1 auth tables:", err);
+    d1 = null;
+  }
+  const profile = normalizeOAuthProfile({ provider, rawUser, tokens });
+  const authConfig = getQarpeoConfig(event).auth;
+  const linkAccounts = authConfig.linkAccounts !== false;
+  const now = Date.now();
+  let dbUser = null;
+  let isNew = false;
+  if (d1 && profile.providerAccountId) {
+    const existingAccount = await d1.prepare(
+      "SELECT * FROM _qarpeo_accounts WHERE provider = ? AND provider_account_id = ? LIMIT 1"
+    ).bind(provider, profile.providerAccountId).first();
+    const encryptedAccessToken = tokens?.access_token ? await encryptToken(tokens.access_token, event) : null;
+    const encryptedRefreshToken = tokens?.refresh_token ? await encryptToken(tokens.refresh_token, event) : null;
+    if (existingAccount) {
+      dbUser = await d1.prepare("SELECT * FROM _qarpeo_users WHERE id = ? LIMIT 1").bind(existingAccount.user_id).first();
+      if (dbUser) {
+        await d1.prepare("UPDATE _qarpeo_accounts SET access_token = ?, refresh_token = ? WHERE id = ?").bind(encryptedAccessToken, encryptedRefreshToken, existingAccount.id).run();
+        await d1.prepare("UPDATE _qarpeo_users SET updated_at = ? WHERE id = ?").bind(now, dbUser.id).run();
+      }
+    }
+    if (!dbUser && profile.email) {
+      const existingUser = await d1.prepare("SELECT * FROM _qarpeo_users WHERE email = ? LIMIT 1").bind(profile.email).first();
+      if (existingUser) {
+        const canLink = linkAccounts && Boolean(existingUser.email_verified) && Boolean(profile.emailVerified);
+        if (canLink || !linkAccounts) {
+          dbUser = existingUser;
+          const accountId = crypto.randomUUID();
+          await d1.prepare(`
+              INSERT INTO _qarpeo_accounts (id, user_id, provider, provider_account_id, email, email_verified, access_token, refresh_token, created_at)
+              VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+            `).bind(
+            accountId,
+            dbUser.id,
+            provider,
+            profile.providerAccountId,
+            profile.email,
+            profile.emailVerified ? 1 : 0,
+            encryptedAccessToken,
+            encryptedRefreshToken,
+            now
+          ).run();
+        }
+      }
+    }
+    if (!dbUser) {
+      isNew = true;
+      const userId = crypto.randomUUID();
+      const accountId = crypto.randomUUID();
+      const userStmt = d1.prepare(`
+          INSERT INTO _qarpeo_users (id, email, email_verified, name, avatar_url, role, created_at, updated_at)
+          VALUES (?, ?, ?, ?, ?, 'user', ?, ?)
+        `).bind(
+        userId,
+        profile.email || `${provider}_${profile.providerAccountId}@qarpeo.local`,
+        profile.emailVerified ? 1 : 0,
+        profile.name || null,
+        profile.avatarUrl || null,
+        now,
+        now
+      );
+      const accountStmt = d1.prepare(`
+          INSERT INTO _qarpeo_accounts (id, user_id, provider, provider_account_id, email, email_verified, access_token, refresh_token, created_at)
+          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+        `).bind(
+        accountId,
+        userId,
+        provider,
+        profile.providerAccountId,
+        profile.email,
+        profile.emailVerified ? 1 : 0,
+        encryptedAccessToken,
+        encryptedRefreshToken,
+        now
+      );
+      await d1.batch([userStmt, accountStmt]);
+      dbUser = {
+        id: userId,
+        email: profile.email || `${provider}_${profile.providerAccountId}@qarpeo.local`,
+        email_verified: profile.emailVerified ? 1 : 0,
+        name: profile.name,
+        avatar_url: profile.avatarUrl,
+        role: "user"
+      };
+    }
+  }
+  const finalUser = dbUser ? {
+    id: dbUser.id,
+    email: dbUser.email,
+    name: dbUser.name,
+    avatarUrl: dbUser.avatar_url,
+    emailVerified: Boolean(dbUser.email_verified),
+    role: dbUser.role || "user"
+  } : {
+    id: profile.providerAccountId || crypto.randomUUID(),
+    email: profile.email || `${provider}@qarpeo.local`,
+    name: profile.name,
+    avatarUrl: profile.avatarUrl,
+    emailVerified: profile.emailVerified,
+    role: "user"
+  };
+  const nitroApp = useNitroApp();
+  await nitroApp.hooks?.callHook("qarpeo:auth:oauth:success", {
+    event,
+    provider,
+    user: { ...finalUser, isNew },
+    tokens
+  });
+  const sessionData = {
+    user: finalUser,
+    provider,
+    loggedInAt: now,
+    tenantId: event?.context?.tenant?.id ?? void 0
+  };
+  await nitroApp.hooks?.callHook("qarpeo:auth:session:create", {
+    event,
+    user: finalUser,
+    session: sessionData
+  });
+  const sessionCfg = authConfig.session || {};
+  try {
+    const deviceSession = await createDeviceSession(event, finalUser, {
+      provider,
+      maxAge: sessionCfg.maxAge || 604800,
+      maxSessionsPerUser: sessionCfg.maxSessionsPerUser ?? 5,
+      backend: sessionCfg.backend || "cookie"
+    });
+    sessionData.sessionId = deviceSession.sessionId;
+  } catch (err) {
+    console.warn("[qarpeo:auth] Failed to register device session:", err);
+  }
+  await setAuthSession(event, sessionData);
+  return sessionData;
+}
+export async function deleteUserAccount(event, userId, options = {}) {
+  let d1;
+  try {
+    const bindingName = globalThis.process?.env?.QARPEO_DEFAULT_DB_BINDING || "DB";
+    d1 = getD1Binding(bindingName, event);
+  } catch {
+    d1 = null;
+  }
+  if (d1) {
+    const memberships = await d1.prepare("SELECT m.organization_id, m.role, o.name as org_name FROM _qarpeo_members m LEFT JOIN _qarpeo_organizations o ON m.organization_id = o.id WHERE m.user_id = ? AND m.role = 'owner'").bind(userId).all();
+    const ownedOrgs = memberships.results || [];
+    for (const org of ownedOrgs) {
+      const otherOwners = await d1.prepare("SELECT COUNT(*) as count FROM _qarpeo_members WHERE organization_id = ? AND role = 'owner' AND user_id != ?").bind(org.organization_id, userId).first();
+      const otherOwnerCount = Number(otherOwners?.count || 0);
+      if (otherOwnerCount === 0) {
+        if (options.cascadeOrg) {
+          await d1.prepare("DELETE FROM _qarpeo_organizations WHERE id = ?").bind(org.organization_id).run();
+        } else {
+          throw new Error(
+            `Cannot delete account: You are the sole owner of organization "${org.org_name || org.organization_id}". Transfer ownership or delete the organization first, or pass cascadeOrg: true.`
+          );
+        }
+      }
+    }
+    try {
+      await d1.prepare("DELETE FROM _qarpeo_notifications WHERE user_id = ?").bind(userId).run();
+      await d1.prepare("DELETE FROM _qarpeo_push_subscriptions WHERE user_id = ?").bind(userId).run();
+    } catch {
+    }
+    await d1.prepare("DELETE FROM _qarpeo_users WHERE id = ?").bind(userId).run();
+  }
+  try {
+    const nitroApp = useNitroApp();
+    await nitroApp.hooks?.callHook("qarpeo:auth:account:delete", {
+      event,
+      userId
+    });
+  } catch {
+  }
+  return { success: true, userId };
+}
+export async function resolveMfaStatus(d1, user, authConfig = {}) {
+  let userHas2FA = false;
+  if (d1 && user?.id) {
+    try {
+      const twoFa = await d1.prepare("SELECT enabled FROM _qarpeo_two_factor WHERE user_id = ? AND enabled = 1 LIMIT 1").bind(user.id).first();
+      userHas2FA = Boolean(twoFa?.enabled);
+    } catch {
+    }
+  }
+  const mfaCfg = typeof authConfig.mfa === "object" ? authConfig.mfa : {};
+  const roleEnforced = mfaCfg.enforce === "role" && Array.isArray(mfaCfg.roles) && mfaCfg.roles.includes(user.role || "user");
+  const globalEnforced = mfaCfg.enforce === true;
+  const required = userHas2FA || globalEnforced || roleEnforced;
+  return {
+    mfaRequired: required,
+    mfaVerified: !required
+  };
+}

package/dist/runtime/server/utils/blob-store.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Shared in-memory Blob/R2 store for local development and preview mode. Attached to globalThis to
+ * ensure cross-chunk persistence in Nitro/Vite.
+ */
+export interface DevMockBlobItem {
+    key: string;
+    size: number;
+    contentType: string;
+    uploaded: string;
+    data?: Uint8Array;
+    access?: string;
+}
+export declare function getDevMockBlobStore(): Map<string, DevMockBlobItem>;