@aotter/mantle 0.2.1 → 0.2.2-alpha.1

package/dist/auth/routes.d.ts

@@ -13,7 +13,7 @@ export interface AuthRoutesOptions {
         readonly providerId: string;
         readonly displayName?: string;
     } | {
-        readonly kind: "email-otp" | "magic-link";
+        readonly kind: "email-otp" | "magic-link" | "passkey";
     })[];
     readonly connectedAppsPage?: string;
 }
@@ -21,6 +21,8 @@ export interface AuthRoutesOptions {
 export declare function authRoutes(loader: AuthLoader<AuthInstance & {
     handler(request: Request): Promise<Response>;
 }>, options: AuthRoutesOptions): (request: Request) => Promise<Response | null>;
+/** Uniform public OTP failures; validation, expiry and attempt budgets remain Better Auth's. */
+export declare function normalizeEmailOtpResponse(response: Response): Promise<Response>;
 /**
  * A dynamic registration whose every redirect URI is http on a loopback host and that names no application_type is a
  * native app (RFC 8252 7.3): local MCP clients register this way. Better Auth reads the missing type as `web`, which

package/dist/auth/routes.js

@@ -2,7 +2,7 @@ import { ContractError } from "../kernel/contracts.js";
 import { checkOrigin, surfaceFailure } from "../kernel/surface-failure.js";
 import { draining } from "../kernel/drain.js";
 import { guardAuthAdminRequest } from "./admin.js";
-import { CONSENT, MAX_BODY, json, readBody, text } from "./route-http.js";
+import { CONSENT, MAX_BODY, PRIVATE, json, readBody, text } from "./route-http.js";
 import { resolveCaller } from "./caller.js";
 const basePathOf = (options) => (options.basePath ?? "/api/auth").replace(/\/+$/, "");
 const WELL_KNOWN = /^\/\.well-known\/(oauth-authorization-server|oauth-protected-resource)(\/|$)/;
@@ -24,7 +24,7 @@ export function authRoutes(loader, options) {
                 const bounded = request.body ? new Request(request, { body: await readBody(request) }) : request;
                 await guardAuthAdminRequest(bounded, () => resolve(bounded), base);
                 const registration = bounded.method === "POST" && pathname === `${base}/oauth2/register` ? await loopbackClientsAreNative(bounded) : bounded;
-                return await normalizeAuthResponseCookies(await auth.handler(registration));
+                return await normalizeAuthResponseCookies(await normalizeEmailOtpResponse(await auth.handler(registration)));
             }
             catch (error) {
                 return surfaceFailure(error, undefined, `auth ${route}`);
@@ -45,6 +45,19 @@ export function authRoutes(loader, options) {
         }
     });
 }
+export async function normalizeEmailOtpResponse(response) {
+    if ((response.status !== 400 && response.status !== 403) ||
+        response.headers.get("content-type")?.split(";")[0]?.trim().toLowerCase() !== "application/json")
+        return response;
+    const error = await response.clone().json().catch(() => null);
+    if (!error || typeof error !== "object" || !("code" in error) || typeof error.code !== "string" ||
+        !["INVALID_OTP", "OTP_EXPIRED", "TOO_MANY_ATTEMPTS"].includes(error.code))
+        return response;
+    void response.body?.cancel().catch(() => { });
+    return Response.json({ code: "INVALID_OTP", message: "Invalid OTP" }, {
+        status: 400, statusText: "BAD_REQUEST", headers: { ...PRIVATE, "content-type": "application/json" },
+    });
+}
 const LOOPBACK_HOSTS = new Set(["localhost", "127.0.0.1", "[::1]"]);
 export async function loopbackClientsAreNative(request) {
     const body = await readBody(request.clone()).then(JSON.parse).catch(error => { if (error instanceof ContractError)

package/dist/build/compiler.d.ts

@@ -26,6 +26,7 @@ export interface MediaPurposePolicy {
     readonly name: string;
     readonly required: readonly string[];
     readonly maxBytes: Readonly<Record<string, number>>;
+    readonly visibility?: "public" | "private";
 }
 export interface SiteIcon {
     readonly src: string;