@amerged/ohmyhost-auth 0.1.10

package/dist/runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../src/runtime.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,OAAO,EAAE,UAAU,EAA0B,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;AAE1B,OAAO,EAAE,mCAAmC,EAAE,MAAM,4BAA4B,CAAC;AA0BjF,MAAM,UAAU,yBAAyB,CAAC,KAA+B;IACvE,MAAM,YAAY,GAAG,iBAAiB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC3D,MAAM,YAAY,GAAG,mCAAmC,CAAC,IAAI,CAAC,SAAS,CAAC;IACxE,IACE,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ;QACjC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,KAAK,CAAC,OAAO;QACtC,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;QACxB,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,EAAE;QACzB,OAAO,KAAK,CAAC,QAAQ,EAAE,KAAK,KAAK,UAAU;QAC3C,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ;QAChC,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,EAAE;QACxB,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,GAAG;QACzB,OAAO,KAAK,CAAC,KAAK,EAAE,IAAI,KAAK,UAAU,EACvC,CAAC;QACD,MAAM,IAAI,SAAS,CAAC,wCAAwC,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,EAAE,IAA+B,EAAE,KAAa,EAAE,GAAW,EAAE,EAAE;QACjF,MAAM,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC;YACrB,IAAI;YACJ,EAAE,EAAE,KAAK;YACT,GAAG,EACD,IAAI,KAAK,kBAAkB;gBACzB,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,YAAY,EAAE,QAAQ,CAAC;gBACjD,CAAC,CAAC,iBAAiB,CAAC,GAAG,EAAE,YAAY,EAAE,YAAY,CAAC;SACzD,CAAC,CAAC;IACL,CAAC,CAAC;IACF,MAAM,OAAO,GAAsB;QACjC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,YAAY;QACrB,QAAQ,EAAE,YAAY;QACtB,cAAc,EAAE,CAAC,YAAY,CAAC;QAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,gBAAgB,EAAE;YAChB,OAAO,EAAE,IAAI;YACb,wBAAwB,EAAE,IAAI;YAC9B,UAAU,EAAE,KAAK;YACjB,iBAAiB,EAAE,EAAE;YACrB,iBAAiB,EAAE,GAAG;YACtB,6BAA6B,EAAE,IAAI;YACnC,2BAA2B,EAAE,KAAK;YAClC,iBAAiB,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC;YAC7E,eAAe,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,kBAAkB,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,YAAY,QAAQ,CAAC;SAC7F;QACD,iBAAiB,EAAE;YACjB,YAAY,EAAE,IAAI;YAClB,YAAY,EAAE,IAAI;YAClB,2BAA2B,EAAE,KAAK;YAClC,SAAS,EAAE,KAAK;YAChB,qBAAqB,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC;SAChF;QACD,OAAO,EAAE,EAAE,SAAS,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACjE,SAAS,EAAE;YACT,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,EAAE;YACV,GAAG,EAAE,GAAG;YACR,OAAO,EAAE,UAAU;YACnB,WAAW,EAAE;gBACX,gBAAgB,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE;gBACxC,gBAAgB,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE;gBACxC,yBAAyB,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE;aAClD;SACF;QACD,QAAQ,EAAE;YACR,gBAAgB,EAAE,IAAI;YACtB,QAAQ,EAAE;gBACR,UAAU,EAAE,mCAAmC,CAAC,QAAQ,CAAC,YAAY;gBACrE,KAAK,EAAE,IAAI;aACZ;YACD,SAAS,EAAE,EAAE,gBAAgB,EAAE,CAAC,kBAAkB,CAAC,EAAE;SACtD;KACF,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAA+B;IAChE,OAAO,UAAU,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,8BAA8B,CAAC,gBAAwB;IACrE,wBAAwB,CAAC,gBAAgB,CAAC,CAAC;IAC3C,OAAO,IAAI,IAAI,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,wBAAwB,CAAC,gBAAwB;IACxD,IACE,OAAO,gBAAgB,KAAK,QAAQ;QACpC,gBAAgB,CAAC,MAAM,GAAG,CAAC;QAC3B,gBAAgB,CAAC,MAAM,GAAG,KAAK;QAC/B,CAAC,wBAAwB,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAChD,CAAC;QACD,MAAM,IAAI,SAAS,CAAC,uCAAuC,CAAC,CAAC;IAC/D,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,gBAAwB;IACjD,OAAO;QACL,gBAAgB;QAChB,OAAO,EAAE,kBAAkB,mCAAmC,CAAC,QAAQ,CAAC,MAAM,EAAE;QAChF,GAAG,EAAE,CAAC;QACN,uBAAuB,EAAE,KAAK;QAC9B,iBAAiB,EAAE,MAAM;QACzB,aAAa,EAAE,MAAM;QACrB,iBAAiB,EAAE,MAAM;KAC1B,CAAC;AACJ,CAAC;AAID,SAAS,iBAAiB,CAAC,KAAa;IACtC,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,SAAS,CAAC,wCAAwC,CAAC,CAAC;IAChE,CAAC;IACD,IACE,GAAG,CAAC,QAAQ,KAAK,QAAQ;QACzB,GAAG,CAAC,MAAM,KAAK,KAAK;QACpB,GAAG,CAAC,QAAQ,KAAK,GAAG;QACpB,GAAG,CAAC,QAAQ,KAAK,EAAE;QACnB,GAAG,CAAC,QAAQ,KAAK,EAAE;QACnB,GAAG,CAAC,MAAM,KAAK,EAAE;QACjB,GAAG,CAAC,IAAI,KAAK,EAAE,EACf,CAAC;QACD,MAAM,IAAI,SAAS,CAAC,wCAAwC,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,CAAC;AACpB,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa,EAAE,YAAoB,EAAE,YAAoB;IAClF,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,SAAS,CAAC,qCAAqC,CAAC,CAAC;IAC7D,CAAC;IACD,IACE,GAAG,CAAC,MAAM,KAAK,YAAY;QAC3B,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,YAAY,GAAG,CAAC,CAAC,EAC/E,CAAC;QACD,MAAM,IAAI,SAAS,CAAC,qCAAqC,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC;AAClB,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAa,EAAE,YAAoB,EAAE,QAAgB;IAC/E,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,SAAS,CAAC,qCAAqC,CAAC,CAAC;IAC7D,CAAC;IACD,IACE,GAAG,CAAC,MAAM,KAAK,YAAY;QAC3B,GAAG,CAAC,QAAQ,KAAK,QAAQ;QACzB,GAAG,CAAC,MAAM,KAAK,EAAE;QACjB,GAAG,CAAC,IAAI,KAAK,EAAE,EACf,CAAC;QACD,MAAM,IAAI,SAAS,CAAC,qCAAqC,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC;AAClB,CAAC"}

package/dist/schema.d.ts

@@ -0,0 +1,2 @@
+export declare function renderCustomerAuthMigration(generatedSchema: string): string;
+//# sourceMappingURL=schema.d.ts.map

package/dist/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAIA,wBAAgB,2BAA2B,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,CAwB3E"}

package/dist/schema.js

@@ -0,0 +1,26 @@
+import { CUSTOMER_AUTH_INSTALLATION_CONTRACT } from "./installation-contract.js";
+const EXPECTED_TABLES = CUSTOMER_AUTH_INSTALLATION_CONTRACT.database.tables;
+export function renderCustomerAuthMigration(generatedSchema) {
+    if (typeof generatedSchema !== "string" ||
+        generatedSchema.length < 1 ||
+        generatedSchema.length > 256 * 1024 ||
+        generatedSchema.includes("\r") ||
+        /^(?:drop|alter|truncate|delete|update|insert)\b/imu.test(generatedSchema)) {
+        throw new TypeError("Generated Better Auth schema is invalid");
+    }
+    const tables = [...generatedSchema.matchAll(/^create table "([^"]+)"/gmu)]
+        .map((match) => match[1])
+        .sort();
+    if (JSON.stringify(tables) !== JSON.stringify(EXPECTED_TABLES)) {
+        throw new TypeError("Generated Better Auth schema is invalid");
+    }
+    const qualified = generatedSchema
+        .replace(/^create table "([^"]+)"/gmu, 'create table auth."$1"')
+        .replace(/ references "([^"]+)"/gu, ' references auth."$1"')
+        .replace(/^(create (?:unique )?index "[^"]+" on) "([^"]+)"/gmu, '$1 auth."$2"');
+    if (/^create table "| references "| on "/mu.test(qualified)) {
+        throw new TypeError("Generated Better Auth schema is invalid");
+    }
+    return `create schema if not exists auth;\n\n${qualified.trimEnd()}\n`;
+}
+//# sourceMappingURL=schema.js.map

package/dist/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,4BAA4B,CAAC;AAEjF,MAAM,eAAe,GAAG,mCAAmC,CAAC,QAAQ,CAAC,MAAM,CAAC;AAE5E,MAAM,UAAU,2BAA2B,CAAC,eAAuB;IACjE,IACE,OAAO,eAAe,KAAK,QAAQ;QACnC,eAAe,CAAC,MAAM,GAAG,CAAC;QAC1B,eAAe,CAAC,MAAM,GAAG,GAAG,GAAG,IAAI;QACnC,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC;QAC9B,oDAAoD,CAAC,IAAI,CAAC,eAAe,CAAC,EAC1E,CAAC;QACD,MAAM,IAAI,SAAS,CAAC,yCAAyC,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,GAAG,eAAe,CAAC,QAAQ,CAAC,4BAA4B,CAAC,CAAC;SACvE,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;SACxB,IAAI,EAAE,CAAC;IACV,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,EAAE,CAAC;QAC/D,MAAM,IAAI,SAAS,CAAC,yCAAyC,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,SAAS,GAAG,eAAe;SAC9B,OAAO,CAAC,4BAA4B,EAAE,wBAAwB,CAAC;SAC/D,OAAO,CAAC,yBAAyB,EAAE,uBAAuB,CAAC;SAC3D,OAAO,CAAC,qDAAqD,EAAE,cAAc,CAAC,CAAC;IAClF,IAAI,uCAAuC,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,SAAS,CAAC,yCAAyC,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,wCAAwC,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC;AACzE,CAAC"}

package/dist/tanstack.d.ts

@@ -0,0 +1,2 @@
+export { createCustomerAuthFetchHandler as createTanStackCustomerAuthHandler } from "./web-handler.js";
+//# sourceMappingURL=tanstack.d.ts.map

package/dist/tanstack.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tanstack.d.ts","sourceRoot":"","sources":["../src/tanstack.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,8BAA8B,IAAI,iCAAiC,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/tanstack.js

@@ -0,0 +1,2 @@
+export { createCustomerAuthFetchHandler as createTanStackCustomerAuthHandler } from "./web-handler.js";
+//# sourceMappingURL=tanstack.js.map

package/dist/tanstack.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tanstack.js","sourceRoot":"","sources":["../src/tanstack.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,8BAA8B,IAAI,iCAAiC,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/vite-companion.d.ts

@@ -0,0 +1,5 @@
+import type { CustomerAuth } from "./runtime.js";
+export declare function createViteCustomerAuthCompanion(auth: CustomerAuth): Readonly<{
+    fetch: (request: Request) => Promise<Response>;
+}>;
+//# sourceMappingURL=vite-companion.d.ts.map

package/dist/vite-companion.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vite-companion.d.ts","sourceRoot":"","sources":["../src/vite-companion.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAGjD,wBAAgB,+BAA+B,CAAC,IAAI,EAAE,YAAY;;GAEjE"}

package/dist/vite-companion.js

@@ -0,0 +1,5 @@
+import { createCustomerAuthFetchHandler } from "./web-handler.js";
+export function createViteCustomerAuthCompanion(auth) {
+    return Object.freeze({ fetch: createCustomerAuthFetchHandler(auth) });
+}
+//# sourceMappingURL=vite-companion.js.map

package/dist/vite-companion.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vite-companion.js","sourceRoot":"","sources":["../src/vite-companion.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAElE,MAAM,UAAU,+BAA+B,CAAC,IAAkB;IAChE,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,8BAA8B,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACxE,CAAC"}

package/dist/web-handler.d.ts

@@ -0,0 +1,3 @@
+import type { CustomerAuth } from "./runtime.js";
+export declare function createCustomerAuthFetchHandler(auth: CustomerAuth): (request: Request) => Promise<Response>;
+//# sourceMappingURL=web-handler.d.ts.map

package/dist/web-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"web-handler.d.ts","sourceRoot":"","sources":["../src/web-handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAGjD,wBAAgB,8BAA8B,CAAC,IAAI,EAAE,YAAY,IAEjD,SAAS,OAAO,KAAG,OAAO,CAAC,QAAQ,CAAC,CAYnD"}

package/dist/web-handler.js

@@ -0,0 +1,19 @@
+import { CUSTOMER_AUTH_INSTALLATION_CONTRACT } from "./installation-contract.js";
+export function createCustomerAuthFetchHandler(auth) {
+    if (typeof auth?.handler !== "function")
+        throw new TypeError("Customer auth handler is invalid");
+    return async (request) => {
+        if (!(request instanceof Request))
+            throw new TypeError("Customer auth request is invalid");
+        const pathname = new URL(request.url).pathname;
+        const routePath = CUSTOMER_AUTH_INSTALLATION_CONTRACT.http.routePath;
+        if (pathname !== routePath && !pathname.startsWith(`${routePath}/`)) {
+            return new Response("Not Found", {
+                status: 404,
+                headers: { "cache-control": "no-store" },
+            });
+        }
+        return auth.handler(request);
+    };
+}
+//# sourceMappingURL=web-handler.js.map

package/dist/web-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"web-handler.js","sourceRoot":"","sources":["../src/web-handler.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mCAAmC,EAAE,MAAM,4BAA4B,CAAC;AAEjF,MAAM,UAAU,8BAA8B,CAAC,IAAkB;IAC/D,IAAI,OAAO,IAAI,EAAE,OAAO,KAAK,UAAU;QAAE,MAAM,IAAI,SAAS,CAAC,kCAAkC,CAAC,CAAC;IACjG,OAAO,KAAK,EAAE,OAAgB,EAAqB,EAAE;QACnD,IAAI,CAAC,CAAC,OAAO,YAAY,OAAO,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,kCAAkC,CAAC,CAAC;QAC3F,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;QAC/C,MAAM,SAAS,GAAG,mCAAmC,CAAC,IAAI,CAAC,SAAS,CAAC;QACrE,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,SAAS,GAAG,CAAC,EAAE,CAAC;YACpE,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE;gBAC/B,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE;aACzC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC,CAAC;AACJ,CAAC"}

package/package.json

@@ -0,0 +1,49 @@
+{
+  "name": "@amerged/ohmyhost-auth",
+  "version": "0.1.10",
+  "type": "module",
+  "engines": {
+    "node": ">=22"
+  },
+  "files": [
+    "dist",
+    "src",
+    "LICENSE",
+    "NOTICE",
+    "README.md",
+    "THIRD_PARTY_NOTICES.md"
+  ],
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./next": {
+      "types": "./dist/next.d.ts",
+      "import": "./dist/next.js"
+    },
+    "./tanstack": {
+      "types": "./dist/tanstack.d.ts",
+      "import": "./dist/tanstack.js"
+    },
+    "./vite-companion": {
+      "types": "./dist/vite-companion.d.ts",
+      "import": "./dist/vite-companion.js"
+    }
+  },
+  "dependencies": {
+    "@better-fetch/fetch": "1.3.1",
+    "@cloudflare/workers-types": "5.20260906.1",
+    "@types/pg": "8.15.5",
+    "better-auth": "1.7.1",
+    "bun-types": "1.4.1",
+    "pg": "8.22.0"
+  },
+  "license": "Apache-2.0",
+  "homepage": "https://docs.ohmyho.st/",
+  "description": "ohmyho.st auth client",
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  }
+}

package/src/packages/customer-auth-better-auth/index.ts

@@ -0,0 +1,5 @@
+export * from "./runtime.js";
+export * from "./schema.js";
+export * from "./web-handler.js";
+export * from "./mail-gateway.js";
+export * from "./installation-contract.js";

package/src/packages/customer-auth-better-auth/installation-contract.ts

@@ -0,0 +1,17 @@
+const TABLES = Object.freeze(["account", "rateLimit", "session", "user", "verification"]);
+const SECRETS = Object.freeze(["BETTER_AUTH_SECRET"]);
+
+export const CUSTOMER_AUTH_INSTALLATION_CONTRACT = Object.freeze({
+  package: Object.freeze({
+    name: "better-auth" as const,
+    version: "1.7.1" as const,
+  }),
+  database: Object.freeze({
+    schema: "auth" as const,
+    idGeneration: "uuid" as const,
+    tables: TABLES,
+    binding: "OHMYHOST_DATABASE" as const,
+  }),
+  http: Object.freeze({ routePath: "/api/auth" as const, handlerExport: "fetch" as const }),
+  secrets: SECRETS,
+});

package/src/packages/customer-auth-better-auth/mail-gateway.ts

@@ -0,0 +1,149 @@
+import type { CustomerAuthEmailSender } from "./runtime.js";
+
+const ULID_PATTERN = /^[0-7][0-9A-HJKMNP-TV-Z]{25}$/u;
+
+export class CustomerAuthEmailDeliveryError extends Error {
+  public readonly code = "customer_auth_email_delivery_failed";
+  public constructor() {
+    super("Customer authentication email delivery failed");
+    this.name = "CustomerAuthEmailDeliveryError";
+  }
+}
+
+export function createMailGatewayEmailSender(input: {
+  readonly projectId: string;
+  readonly gatewayOrigin: string;
+  readonly key: string;
+  readonly fetch: (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;
+  readonly crypto: Crypto;
+}): CustomerAuthEmailSender {
+  const projectId = input.projectId;
+  if (typeof projectId !== "string" || !ULID_PATTERN.test(projectId))
+    throw new TypeError("Invalid canonical ULID");
+  const gatewayOrigin = canonicalOrigin(input.gatewayOrigin);
+  if (
+    !/^[A-Za-z0-9_-]{43}$/u.test(input.key) ||
+    typeof input.fetch !== "function" ||
+    typeof input.crypto?.subtle?.digest !== "function"
+  ) {
+    throw new TypeError("Mail gateway email sender input is invalid");
+  }
+  return Object.freeze({
+    async send(message: Parameters<CustomerAuthEmailSender["send"]>[0]) {
+      validateMessage(message);
+      const subject =
+        message.kind === "verification"
+          ? "Verify your account"
+          : message.kind === "password-reset"
+            ? "Reset your password"
+            : "Your password was changed";
+      const action = message.kind === "password-changed" ? "Review your account" : subject;
+      const body = {
+        project_id: projectId,
+        to: message.to,
+        subject,
+        text: `${subject}: ${message.url}`,
+        html: `<p><a href="${escapeHtml(message.url)}">${action}</a></p>`,
+      };
+      const idempotencyKey = await sha256Hex(
+        input.crypto,
+        `${message.kind}\n${message.to}\n${message.url}`,
+      );
+      let response: Response;
+      try {
+        response = await input.fetch(`${gatewayOrigin}/v1/send`, {
+          method: "POST",
+          headers: {
+            Authorization: `Bearer ${input.key}`,
+            "Content-Type": "application/json",
+            "Idempotency-Key": idempotencyKey,
+          },
+          body: JSON.stringify(body),
+          redirect: "manual",
+          signal: AbortSignal.timeout(8_000),
+        });
+      } catch {
+        throw new CustomerAuthEmailDeliveryError();
+      }
+      const value = await readJson(response);
+      if (
+        response.status !== 202 ||
+        !isRecord(value) ||
+        value["state"] !== "accepted" ||
+        typeof value["request_id"] !== "string" ||
+        typeof value["message_id"] !== "string"
+      ) {
+        throw new CustomerAuthEmailDeliveryError();
+      }
+      if (!ULID_PATTERN.test(value["request_id"])) throw new TypeError("Invalid canonical ULID");
+    },
+  });
+}
+
+function validateMessage(message: Parameters<CustomerAuthEmailSender["send"]>[0]): void {
+  if (
+    (message.kind !== "verification" &&
+      message.kind !== "password-reset" &&
+      message.kind !== "password-changed") ||
+    !/^[a-z0-9](?:[a-z0-9._%+-]{0,62}[a-z0-9])?@(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/u.test(
+      message.to,
+    ) ||
+    !/^https:\/\//u.test(message.url) ||
+    message.url.length > 4_096
+  ) {
+    throw new CustomerAuthEmailDeliveryError();
+  }
+}
+
+function canonicalOrigin(value: string): string {
+  let url: URL;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new TypeError("Mail gateway origin is invalid");
+  }
+  if (
+    url.protocol !== "https:" ||
+    url.username !== "" ||
+    url.password !== "" ||
+    url.pathname !== "/" ||
+    url.search !== "" ||
+    url.hash !== ""
+  ) {
+    throw new TypeError("Mail gateway origin is invalid");
+  }
+  return url.origin;
+}
+
+async function sha256Hex(crypto: Crypto, value: string): Promise<string> {
+  const bytes = Uint8Array.from(new TextEncoder().encode(value));
+  const digest = new Uint8Array(await crypto.subtle.digest("SHA-256", bytes.buffer));
+  return Array.from(digest, (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+
+async function readJson(response: Response): Promise<unknown> {
+  const declared = response.headers.get("content-length");
+  if (declared !== null && (!/^[0-9]+$/u.test(declared) || Number(declared) > 4_096)) {
+    await response.body?.cancel().catch(() => undefined);
+    throw new CustomerAuthEmailDeliveryError();
+  }
+  const bytes = new Uint8Array(await response.arrayBuffer());
+  if (bytes.byteLength > 4_096) throw new CustomerAuthEmailDeliveryError();
+  try {
+    return JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+  } catch {
+    throw new CustomerAuthEmailDeliveryError();
+  }
+}
+
+function escapeHtml(value: string): string {
+  return value
+    .replaceAll("&", "&amp;")
+    .replaceAll('"', "&quot;")
+    .replaceAll("<", "&lt;")
+    .replaceAll(">", "&gt;");
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}

package/src/packages/customer-auth-better-auth/next.ts

@@ -0,0 +1,7 @@
+import { toNextJsHandler } from "better-auth/next-js";
+
+import type { CustomerAuth } from "./runtime.js";
+
+export function createNextCustomerAuthHandler(auth: CustomerAuth) {
+  return Object.freeze(toNextJsHandler(auth));
+}

package/src/packages/customer-auth-better-auth/runtime.ts

@@ -0,0 +1,193 @@
+/// <reference types="bun-types/sqlite.d.ts" preserve="true" />
+import { betterAuth, type BetterAuthOptions } from "better-auth";
+import { Pool } from "pg";
+
+import { CUSTOMER_AUTH_INSTALLATION_CONTRACT } from "./installation-contract.js";
+
+// Better Fetch 1.3.1 exposes an unbound Timer name; keep its type local to that module.
+// Referencing only Bun's SQLite declarations above avoids changing Node's global APIs.
+declare module "@better-fetch/fetch" {
+  type Timer = ReturnType<typeof globalThis.setTimeout>;
+}
+
+export interface CustomerAuthEmail {
+  readonly kind: "password-changed" | "password-reset" | "verification";
+  readonly to: string;
+  readonly url: string;
+}
+
+export interface CustomerAuthEmailSender {
+  send(message: CustomerAuthEmail): Promise<void>;
+}
+
+export interface CustomerAuthRuntimeInput {
+  readonly appName: string;
+  readonly publicOrigin: string;
+  readonly database: Pool;
+  readonly secret: string;
+  readonly email: CustomerAuthEmailSender;
+}
+
+export function createCustomerAuthOptions(input: CustomerAuthRuntimeInput): BetterAuthOptions {
+  const publicOrigin = parsePublicOrigin(input.publicOrigin);
+  const authBasePath = CUSTOMER_AUTH_INSTALLATION_CONTRACT.http.routePath;
+  if (
+    typeof input.appName !== "string" ||
+    input.appName.trim() !== input.appName ||
+    input.appName.length < 1 ||
+    input.appName.length > 80 ||
+    typeof input.database?.query !== "function" ||
+    typeof input.secret !== "string" ||
+    input.secret.length < 32 ||
+    input.secret.length > 512 ||
+    typeof input.email?.send !== "function"
+  ) {
+    throw new TypeError("Customer auth runtime input is invalid");
+  }
+  const send = async (kind: CustomerAuthEmail["kind"], email: string, url: string) => {
+    await input.email.send({
+      kind,
+      to: email,
+      url:
+        kind === "password-changed"
+          ? sameOriginExactUrl(url, publicOrigin, "/login")
+          : sameOriginAuthUrl(url, publicOrigin, authBasePath),
+    });
+  };
+  const options: BetterAuthOptions = {
+    appName: input.appName,
+    baseURL: publicOrigin,
+    basePath: authBasePath,
+    trustedOrigins: [publicOrigin],
+    secret: input.secret,
+    database: input.database,
+    emailAndPassword: {
+      enabled: true,
+      requireEmailVerification: true,
+      autoSignIn: false,
+      minPasswordLength: 12,
+      maxPasswordLength: 128,
+      revokeSessionsOnPasswordReset: true,
+      resetPasswordTokenExpiresIn: 3_600,
+      sendResetPassword: ({ user, url }) => send("password-reset", user.email, url),
+      onPasswordReset: ({ user }) => send("password-changed", user.email, `${publicOrigin}/login`),
+    },
+    emailVerification: {
+      sendOnSignUp: true,
+      sendOnSignIn: true,
+      autoSignInAfterVerification: false,
+      expiresIn: 3_600,
+      sendVerificationEmail: ({ user, url }) => send("verification", user.email, url),
+    },
+    session: { expiresIn: 7 * 24 * 60 * 60, updateAge: 24 * 60 * 60 },
+    rateLimit: {
+      enabled: true,
+      window: 60,
+      max: 100,
+      storage: "database",
+      customRules: {
+        "/sign-in/email": { window: 60, max: 5 },
+        "/sign-up/email": { window: 60, max: 3 },
+        "/request-password-reset": { window: 60, max: 3 },
+      },
+    },
+    advanced: {
+      useSecureCookies: true,
+      database: {
+        generateId: CUSTOMER_AUTH_INSTALLATION_CONTRACT.database.idGeneration,
+        joins: true,
+      },
+      ipAddress: { ipAddressHeaders: ["cf-connecting-ip"] },
+    },
+  };
+  return Object.freeze(options);
+}
+
+export function createCustomerAuth(input: CustomerAuthRuntimeInput) {
+  return betterAuth(createCustomerAuthOptions(input));
+}
+
+export function createCustomerAuthPostgresPool(connectionString: string): Pool {
+  validateConnectionString(connectionString);
+  return new Pool(poolConfiguration(connectionString));
+}
+
+function validateConnectionString(connectionString: string): void {
+  if (
+    typeof connectionString !== "string" ||
+    connectionString.length < 1 ||
+    connectionString.length > 8_192 ||
+    !/^postgres(?:ql)?:\/\//u.test(connectionString)
+  ) {
+    throw new TypeError("Customer auth database URL is invalid");
+  }
+}
+
+function poolConfiguration(connectionString: string) {
+  return {
+    connectionString,
+    options: `-c search_path=${CUSTOMER_AUTH_INSTALLATION_CONTRACT.database.schema}`,
+    max: 1,
+    connectionTimeoutMillis: 5_000,
+    idleTimeoutMillis: 30_000,
+    query_timeout: 10_000,
+    statement_timeout: 10_000,
+  };
+}
+
+export type CustomerAuth = ReturnType<typeof createCustomerAuth>;
+
+function parsePublicOrigin(value: string): string {
+  let url: URL;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new TypeError("Customer auth public origin is invalid");
+  }
+  if (
+    url.protocol !== "https:" ||
+    url.origin !== value ||
+    url.pathname !== "/" ||
+    url.username !== "" ||
+    url.password !== "" ||
+    url.search !== "" ||
+    url.hash !== ""
+  ) {
+    throw new TypeError("Customer auth public origin is invalid");
+  }
+  return url.origin;
+}
+
+function sameOriginAuthUrl(value: string, publicOrigin: string, authBasePath: string): string {
+  let url: URL;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new TypeError("Customer auth e-mail URL is invalid");
+  }
+  if (
+    url.origin !== publicOrigin ||
+    (url.pathname !== authBasePath && !url.pathname.startsWith(`${authBasePath}/`))
+  ) {
+    throw new TypeError("Customer auth e-mail URL is invalid");
+  }
+  return url.href;
+}
+
+function sameOriginExactUrl(value: string, publicOrigin: string, pathname: string): string {
+  let url: URL;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new TypeError("Customer auth e-mail URL is invalid");
+  }
+  if (
+    url.origin !== publicOrigin ||
+    url.pathname !== pathname ||
+    url.search !== "" ||
+    url.hash !== ""
+  ) {
+    throw new TypeError("Customer auth e-mail URL is invalid");
+  }
+  return url.href;
+}

package/src/packages/customer-auth-better-auth/schema.ts

@@ -0,0 +1,29 @@
+import { CUSTOMER_AUTH_INSTALLATION_CONTRACT } from "./installation-contract.js";
+
+const EXPECTED_TABLES = CUSTOMER_AUTH_INSTALLATION_CONTRACT.database.tables;
+
+export function renderCustomerAuthMigration(generatedSchema: string): string {
+  if (
+    typeof generatedSchema !== "string" ||
+    generatedSchema.length < 1 ||
+    generatedSchema.length > 256 * 1024 ||
+    generatedSchema.includes("\r") ||
+    /^(?:drop|alter|truncate|delete|update|insert)\b/imu.test(generatedSchema)
+  ) {
+    throw new TypeError("Generated Better Auth schema is invalid");
+  }
+  const tables = [...generatedSchema.matchAll(/^create table "([^"]+)"/gmu)]
+    .map((match) => match[1])
+    .sort();
+  if (JSON.stringify(tables) !== JSON.stringify(EXPECTED_TABLES)) {
+    throw new TypeError("Generated Better Auth schema is invalid");
+  }
+  const qualified = generatedSchema
+    .replace(/^create table "([^"]+)"/gmu, 'create table auth."$1"')
+    .replace(/ references "([^"]+)"/gu, ' references auth."$1"')
+    .replace(/^(create (?:unique )?index "[^"]+" on) "([^"]+)"/gmu, '$1 auth."$2"');
+  if (/^create table "| references "| on "/mu.test(qualified)) {
+    throw new TypeError("Generated Better Auth schema is invalid");
+  }
+  return `create schema if not exists auth;\n\n${qualified.trimEnd()}\n`;
+}

package/src/packages/customer-auth-better-auth/tanstack.ts

@@ -0,0 +1 @@
+export { createCustomerAuthFetchHandler as createTanStackCustomerAuthHandler } from "./web-handler.js";

package/src/packages/customer-auth-better-auth/vite-companion.ts

@@ -0,0 +1,6 @@
+import type { CustomerAuth } from "./runtime.js";
+import { createCustomerAuthFetchHandler } from "./web-handler.js";
+
+export function createViteCustomerAuthCompanion(auth: CustomerAuth) {
+  return Object.freeze({ fetch: createCustomerAuthFetchHandler(auth) });
+}

package/src/packages/customer-auth-better-auth/web-handler.ts

@@ -0,0 +1,18 @@
+import type { CustomerAuth } from "./runtime.js";
+import { CUSTOMER_AUTH_INSTALLATION_CONTRACT } from "./installation-contract.js";
+
+export function createCustomerAuthFetchHandler(auth: CustomerAuth) {
+  if (typeof auth?.handler !== "function") throw new TypeError("Customer auth handler is invalid");
+  return async (request: Request): Promise<Response> => {
+    if (!(request instanceof Request)) throw new TypeError("Customer auth request is invalid");
+    const pathname = new URL(request.url).pathname;
+    const routePath = CUSTOMER_AUTH_INSTALLATION_CONTRACT.http.routePath;
+    if (pathname !== routePath && !pathname.startsWith(`${routePath}/`)) {
+      return new Response("Not Found", {
+        status: 404,
+        headers: { "cache-control": "no-store" },
+      });
+    }
+    return auth.handler(request);
+  };
+}