/**
 * Adapter layer: Authentik disconnect (provider isolation).
 * Per L5 audit finding (AGENTS.md rule 7): provider reference must stay inside adapter,
 * never leak into route handler.
 */

export async function disconnectFromProvider(user, adapterOptions = {}) {
  // Adapter holds provider reference; route passes only adapter options.
  const result = await adapterOptions.provider?.disconnect?.();
  return result ?? { status: 'disconnected', userId: user?.userId || null };
}