@avelonjs/neon 0.3.0

package/src/identity/driver.ts

@@ -0,0 +1,462 @@
+import {
+  Invalid,
+  Unauthenticated,
+  type EmailVerificationIdentitySurface,
+  type IdentityDriver,
+  type MagicLinkIdentitySurface,
+  type MfaChallenge,
+  type MfaIdentitySurface,
+  type PasswordIdentitySurface,
+  type RequestCookies,
+} from '@avelonjs/core'
+import {
+  clearSessionCookie,
+  DEFAULT_SESSION_COOKIE,
+  readSessionCookie,
+  writeSessionCookie,
+} from './cookies'
+import { describeAuthFailure, mapAuthError, readAuthResponse } from './errors'
+import type { NeonActor, NeonSession } from './types'
+
+/** Exact capability declaration for the Neon identity driver. */
+export const neonIdentityCapabilities = {
+  passwords: true,
+  magicLinks: true,
+  oauth: false,
+  organizations: false,
+  mfa: ['totp'] as const,
+  emailVerification: true,
+} as const
+
+type NeonMfaFactor = (typeof neonIdentityCapabilities.mfa)[number]
+
+/** Construction options for {@link createNeonIdentity}. */
+export interface NeonIdentityOptions {
+  /** Neon Auth / Better Auth base URL, e.g. `https://ep-xxx.neonauth.net`. */
+  authUrl?: string
+  /** Configured identity instance name. */
+  instance?: string
+  /** Session cookie name written into the request cookie jar. */
+  cookieName?: string
+}
+
+interface AuthUser {
+  id?: string
+  email?: string | null
+}
+
+interface AuthSessionBody {
+  user?: AuthUser
+  session?: { id?: string; expiresAt?: string; token?: string }
+  token?: string
+  error?: string
+  message?: string
+}
+
+/**
+ * Neon Auth identity driver.
+ *
+ * Talks to the Better Auth HTTP surface Neon Auth exposes. The config-time factory receives
+ * request-scoped cookies explicitly so SSR and route handlers share one request-local identity view.
+ */
+export class NeonIdentity
+  implements
+    IdentityDriver<typeof neonIdentityCapabilities, { authUrl: string }, NeonActor, NeonSession>,
+    PasswordIdentitySurface<NeonActor>,
+    MagicLinkIdentitySurface,
+    MfaIdentitySurface<NeonMfaFactor>,
+    EmailVerificationIdentitySurface
+{
+  readonly name = 'neon'
+  readonly instance: string
+  readonly capabilities = neonIdentityCapabilities
+
+  readonly #cookies: RequestCookies
+  readonly #authUrl: string
+  readonly #cookieName: string
+
+  constructor(cookies: RequestCookies, options: Required<NeonIdentityOptions>) {
+    this.#cookies = cookies
+    this.#authUrl = options.authUrl.replace(/\/$/, '')
+    this.#cookieName = options.cookieName
+    this.instance = options.instance
+  }
+
+  raw(): { authUrl: string } {
+    return { authUrl: this.#authUrl }
+  }
+
+  async user(): Promise<NeonActor | null> {
+    const session = readSessionCookie(this.#cookies, this.#cookieName)
+    if (!session) return null
+    const response = await this.#request('/get-session', {
+      method: 'GET',
+      headers: this.#authHeaders(session.accessToken),
+    })
+    if (!response.ok) return null
+    const body = asSessionBody((await readAuthResponse(response)).json)
+    const user = body.user
+    if (typeof user?.id !== 'string' || typeof user.email !== 'string') return null
+    return { id: user.id, email: user.email }
+  }
+
+  async session(): Promise<NeonSession | null> {
+    return readSessionCookie(this.#cookies, this.#cookieName)
+  }
+
+  async signOut(): Promise<void> {
+    const session = readSessionCookie(this.#cookies, this.#cookieName)
+    if (!session) {
+      throw new Unauthenticated('No authenticated session is present.', {
+        metadata: { guard: 'identity' },
+      })
+    }
+    await this.#request('/sign-out', {
+      method: 'POST',
+      headers: this.#authHeaders(session.accessToken),
+    })
+    clearSessionCookie(this.#cookies, this.#cookieName)
+  }
+
+  async register(email: string, password: string): Promise<NeonActor> {
+    const response = await this.#request('/sign-up/email', {
+      method: 'POST',
+      headers: this.#jsonHeaders(),
+      body: JSON.stringify({ email, password }),
+    })
+    const body = await readAuthResponse(response)
+    if (!response.ok) {
+      mapAuthError(describeAuthFailure(response, body, 'Registration failed.'), {
+        operation: 'identity.register',
+        field: 'email',
+        rejection: 'unavailable',
+        cause: body.text,
+      })
+    }
+    const parsed = asSessionBody(body.json)
+    // Better Auth answers a signup that still needs email verification with the user and a null
+    // token. The actor exists; reporting that as a failed registration says the opposite of what
+    // happened, and the retry then collides with the account the first attempt created.
+    const pending = pendingVerificationActor(parsed)
+    if (pending !== undefined) return pending
+    return this.#commitSession(parsed)
+  }
+
+  async signInWithPassword(email: string, password: string): Promise<NeonActor> {
+    const response = await this.#request('/sign-in/email', {
+      method: 'POST',
+      headers: this.#jsonHeaders(),
+      body: JSON.stringify({ email, password }),
+    })
+    const body = await readAuthResponse(response)
+    if (!response.ok) {
+      mapAuthError(describeAuthFailure(response, body, 'Invalid login credentials.'), {
+        operation: 'identity.signInWithPassword',
+        field: 'email',
+        rejection: 'unauthenticated',
+        cause: body.text,
+      })
+    }
+    return this.#commitSession(asSessionBody(body.json))
+  }
+
+  /**
+   * Asks Neon Auth to email a recovery link.
+   *
+   * Better Auth answers 200 for an address it does not know, so reporting the failure statuses does
+   * not reveal whether an account exists. Discarding them does hide a throttled project behind a
+   * screen that claims the message was sent.
+   */
+  async sendPasswordReset(email: string): Promise<void> {
+    const response = await this.#request('/forget-password', {
+      method: 'POST',
+      headers: this.#jsonHeaders(),
+      body: JSON.stringify({ email }),
+    })
+    if (!response.ok) {
+      const body = await readAuthResponse(response)
+      mapAuthError(describeAuthFailure(response, body, 'Password reset could not be sent.'), {
+        operation: 'identity.sendPasswordReset',
+        field: 'email',
+        rejection: 'unavailable',
+        cause: body.text,
+      })
+    }
+  }
+
+  async resetPassword(token: string, password: string): Promise<void> {
+    const response = await this.#request('/reset-password', {
+      method: 'POST',
+      headers: this.#jsonHeaders(),
+      body: JSON.stringify({ token, newPassword: password }),
+    })
+    if (!response.ok) {
+      const body = await readAuthResponse(response)
+      mapAuthError(describeAuthFailure(response, body, 'Invalid recovery token.'), {
+        operation: 'identity.resetPassword',
+        field: 'token',
+        rejection: 'unauthenticated',
+        cause: body.text,
+      })
+    }
+  }
+
+  async updatePassword(password: string): Promise<void> {
+    const session = readSessionCookie(this.#cookies, this.#cookieName)
+    if (!session) {
+      throw new Unauthenticated('No authenticated session is present.', {
+        metadata: { guard: 'identity' },
+      })
+    }
+    const response = await this.#request('/change-password', {
+      method: 'POST',
+      headers: { ...this.#jsonHeaders(), ...this.#authHeaders(session.accessToken) },
+      body: JSON.stringify({ newPassword: password }),
+    })
+    if (!response.ok) {
+      throw new Unauthenticated('No authenticated session is present.', {
+        metadata: { guard: 'identity' },
+      })
+    }
+  }
+
+  async sendMagicLink(email: string, redirectTo?: string): Promise<void> {
+    const response = await this.#request('/sign-in/magic-link', {
+      method: 'POST',
+      headers: this.#jsonHeaders(),
+      body: JSON.stringify({
+        email,
+        ...(redirectTo === undefined ? {} : { callbackURL: redirectTo }),
+      }),
+    })
+    if (!response.ok) {
+      const body = await readAuthResponse(response)
+      mapAuthError(describeAuthFailure(response, body, 'Magic link could not be sent.'), {
+        operation: 'identity.sendMagicLink',
+        field: 'email',
+        rejection: 'unavailable',
+        cause: body.text,
+      })
+    }
+  }
+
+  /** Completes a sign-in from the token the emailed link carried. */
+  async signInWithMagicLink(token: string): Promise<NeonActor> {
+    const response = await this.#request(`/magic-link/verify?token=${encodeURIComponent(token)}`, {
+      method: 'GET',
+      headers: this.#jsonHeaders(),
+    })
+    const body = await readAuthResponse(response)
+    if (!response.ok) {
+      mapAuthError(describeAuthFailure(response, body, 'Invalid sign-in link.'), {
+        operation: 'identity.signInWithMagicLink',
+        field: 'token',
+        rejection: 'unauthenticated',
+        cause: body.text,
+      })
+    }
+    return this.#commitSession(asSessionBody(body.json))
+  }
+
+  async challengeMfa(factor?: NeonMfaFactor): Promise<MfaChallenge<NeonMfaFactor>> {
+    const selected: string = factor ?? 'totp'
+    if (selected !== 'totp') {
+      throw invalidField('factor', 'Unsupported multi-factor method.')
+    }
+    const accessToken = this.#requireAccessToken()
+    if (!(await this.#isTotpEnrolled(accessToken))) {
+      throw invalidField('factor', 'No TOTP factor is enrolled.')
+    }
+    const expiresAt = new Date(Date.now() + 5 * 60 * 1000)
+    return {
+      id: `totp:${expiresAt.getTime()}`,
+      factor: 'totp',
+      expiresAt,
+    }
+  }
+
+  async verifyMfa(challengeId: string, code: string): Promise<void> {
+    const accessToken = this.#requireAccessToken()
+    const encoded = parseEncodedTotpChallenge(challengeId)
+    if (encoded.expiresAt <= Date.now()) {
+      throw invalidField('challengeId', 'MFA challenge has expired.')
+    }
+    const verified = await this.#request('/two-factor/verify-totp', {
+      method: 'POST',
+      headers: { ...this.#jsonHeaders(), ...this.#authHeaders(accessToken) },
+      body: JSON.stringify({ code }),
+    })
+    if (!verified.ok) {
+      if (verified.status === 401) {
+        throw unauthenticated('No authenticated session is present.')
+      }
+      throw invalidField('code', 'Invalid multi-factor challenge.')
+    }
+  }
+
+  async sendEmailVerification(email?: string): Promise<void> {
+    let target = email
+    if (target === undefined) {
+      const actor = await this.user()
+      if (!actor) throw invalidField('email', 'No email to verify.')
+      target = actor.email
+    }
+    const session = readSessionCookie(this.#cookies, this.#cookieName)
+    const response = await this.#request('/send-verification-email', {
+      method: 'POST',
+      headers: {
+        ...this.#jsonHeaders(),
+        ...(session ? this.#authHeaders(session.accessToken) : {}),
+      },
+      body: JSON.stringify({ email: target }),
+    })
+    if (!response.ok) {
+      const body = await readAuthResponse(response)
+      mapAuthError(describeAuthFailure(response, body, 'Verification email could not be sent.'), {
+        operation: 'identity.sendEmailVerification',
+        field: 'email',
+        rejection: 'unavailable',
+        cause: body.text,
+      })
+    }
+  }
+
+  async verifyEmail(token: string): Promise<void> {
+    const verified = await this.#request(`/verify-email?token=${encodeURIComponent(token)}`, {
+      method: 'GET',
+    })
+    if (!verified.ok) {
+      throw invalidField('token', 'Invalid email verification token.')
+    }
+  }
+
+  #commitSession(body: AuthSessionBody): NeonActor {
+    const user = body.user
+    const token = body.token ?? body.session?.token
+    const sessionId = body.session?.id ?? token
+    if (
+      typeof user?.id !== 'string' ||
+      typeof user.email !== 'string' ||
+      typeof token !== 'string' ||
+      typeof sessionId !== 'string'
+    ) {
+      throw new Invalid('Auth response was missing a session.', {
+        metadata: { fields: { session: ['Incomplete auth response'] } },
+      })
+    }
+    const expiresAt = body.session?.expiresAt
+      ? new Date(body.session.expiresAt)
+      : new Date(Date.now() + 3600 * 1000)
+    const session: NeonSession = {
+      id: sessionId,
+      accessToken: token,
+      refreshToken: token,
+      expiresAt,
+    }
+    writeSessionCookie(this.#cookies, this.#cookieName, session)
+    return { id: user.id, email: user.email }
+  }
+
+  #jsonHeaders(): Record<string, string> {
+    return { 'Content-Type': 'application/json' }
+  }
+
+  #authHeaders(accessToken: string): Record<string, string> {
+    return { Authorization: `Bearer ${accessToken}` }
+  }
+
+  #requireAccessToken(): string {
+    const session = readSessionCookie(this.#cookies, this.#cookieName)
+    if (!session) throw unauthenticated('No authenticated session is present.')
+    return session.accessToken
+  }
+
+  async #isTotpEnrolled(accessToken: string): Promise<boolean> {
+    const sessionResponse = await this.#request('/get-session', {
+      method: 'GET',
+      headers: this.#authHeaders(accessToken),
+    })
+    if (!sessionResponse.ok) {
+      throw unauthenticated('No authenticated session is present.')
+    }
+    if (twoFactorEnabled(await readVendorJson(sessionResponse))) return true
+    const statusResponse = await this.#request('/two-factor/status', {
+      method: 'GET',
+      headers: this.#authHeaders(accessToken),
+    })
+    if (!statusResponse.ok) {
+      if (statusResponse.status === 401) {
+        throw unauthenticated('No authenticated session is present.')
+      }
+      return false
+    }
+    return twoFactorEnabled(await readVendorJson(statusResponse))
+  }
+
+  async #request(path: string, init: RequestInit): Promise<Response> {
+    return fetch(`${this.#authUrl}${path}`, init)
+  }
+}
+
+function unauthenticated(message: string): Unauthenticated {
+  return new Unauthenticated(message, { metadata: { guard: 'identity' } })
+}
+
+function invalidField(field: string, message: string): Invalid {
+  return new Invalid(message, { metadata: { fields: { [field]: [message] } } })
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value)
+}
+
+/** Reads a Better Auth JSON body at the vendor HTTP boundary. */
+async function readVendorJson(response: Response): Promise<unknown> {
+  return (await readAuthResponse(response)).json
+}
+
+function asSessionBody(json: unknown): AuthSessionBody {
+  return isRecord(json) ? (json as AuthSessionBody) : {}
+}
+
+/** The actor from a signup that succeeded but issued no session token. */
+function pendingVerificationActor(body: AuthSessionBody): NeonActor | undefined {
+  if (body.token !== undefined && body.token !== null) return undefined
+  if (body.session?.token !== undefined && body.session.token !== null) return undefined
+  const user = body.user
+  if (typeof user?.id !== 'string' || typeof user.email !== 'string') return undefined
+  return { id: user.id, email: user.email }
+}
+
+function twoFactorEnabled(body: unknown): boolean {
+  if (!isRecord(body)) return false
+  if (body.enabled === true) return true
+  const user = body.user
+  return isRecord(user) && user.twoFactorEnabled === true
+}
+
+function parseEncodedTotpChallenge(challengeId: string): { expiresAt: number } {
+  if (!challengeId.startsWith('totp:') || challengeId.length <= 'totp:'.length) {
+    throw invalidField('challengeId', 'MFA challenge id is malformed.')
+  }
+  const expiresAt = Number(challengeId.slice('totp:'.length))
+  if (!Number.isFinite(expiresAt)) {
+    throw invalidField('challengeId', 'MFA challenge id is malformed.')
+  }
+  return { expiresAt }
+}
+
+/**
+ * Creates the config-time identity factory pinned by conformance:
+ * `(cookies: RequestCookies) => NeonIdentity`.
+ */
+export function createNeonIdentity(
+  options: NeonIdentityOptions = {},
+): (cookies: RequestCookies) => NeonIdentity {
+  const resolved: Required<NeonIdentityOptions> = {
+    authUrl: options.authUrl ?? process.env.NEON_AUTH_URL ?? 'http://127.0.0.1:3000/api/auth',
+    instance: options.instance ?? 'default',
+    cookieName: options.cookieName ?? DEFAULT_SESSION_COOKIE,
+  }
+  return (cookies) => new NeonIdentity(cookies, resolved)
+}

package/src/identity/errors.ts

@@ -0,0 +1,206 @@
+import { Conflict, Invalid, RateLimited, Unauthenticated, Unavailable } from '@avelonjs/core'
+
+/**
+ * A Better Auth response body read once, before anything decides whether it succeeded.
+ *
+ * Neon Auth answers a rejected route with HTML or an empty body, so `response.json()` on the
+ * failure path throws a `SyntaxError` that never reaches the error taxonomy. Reading the text
+ * first keeps the raw payload for `.cause`.
+ */
+export interface AuthResponseBody {
+  /** Parsed JSON, or `undefined` when the body was empty or not JSON. */
+  readonly json: unknown
+  /** Raw response text. */
+  readonly text: string
+}
+
+/** Reads a Better Auth body at the vendor HTTP boundary without throwing on a non-JSON payload. */
+export async function readAuthResponse(response: Response): Promise<AuthResponseBody> {
+  const text = await response.text()
+  if (text.length === 0) return { json: undefined, text }
+  try {
+    return { json: JSON.parse(text) as unknown, text }
+  } catch {
+    return { json: undefined, text }
+  }
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value)
+}
+
+function stringOrUndefined(value: unknown): string | undefined {
+  return typeof value === 'string' && value.length > 0 ? value : undefined
+}
+
+/**
+ * Whether a string is a machine code rather than prose.
+ *
+ * Better Auth puts a code in `error` on the routes it inherits from the OAuth shape and a sentence
+ * in `error` on the ones it does not. One field, two meanings, separated by whether it has a space.
+ */
+function isCodeLike(value: string): boolean {
+  return !/\s/.test(value)
+}
+
+/** The human-readable reason, across the flat and nested shapes Better Auth returns. */
+export function authErrorMessage(json: unknown): string | undefined {
+  if (!isRecord(json)) return undefined
+  const nested = isRecord(json.error) ? json.error : undefined
+  const bare = stringOrUndefined(json.error)
+  return (
+    stringOrUndefined(json.message) ??
+    stringOrUndefined(nested?.message) ??
+    stringOrUndefined(json.statusText) ??
+    (bare !== undefined && !isCodeLike(bare) ? bare : undefined)
+  )
+}
+
+/** The stable Better Auth error code, upper-cased so a shape change in casing does not matter. */
+export function authErrorCode(json: unknown): string | undefined {
+  if (!isRecord(json)) return undefined
+  const nested = isRecord(json.error) ? json.error : undefined
+  const bare = stringOrUndefined(json.error)
+  const code =
+    stringOrUndefined(json.code) ??
+    stringOrUndefined(nested?.code) ??
+    (bare !== undefined && isCodeLike(bare) ? bare : undefined)
+  return code?.toUpperCase()
+}
+
+const DUPLICATE_CODES = new Set([
+  'USER_ALREADY_EXISTS',
+  'USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL',
+  'EMAIL_ALREADY_EXISTS',
+  'USER_EXISTS',
+])
+
+const RATE_LIMIT_CODES = new Set(['TOO_MANY_REQUESTS', 'RATE_LIMITED'])
+
+const DISABLED_CODES = new Set(['SIGN_UP_DISABLED', 'EMAIL_AND_PASSWORD_DISABLED'])
+
+const CREDENTIAL_CODES = new Set([
+  'INVALID_EMAIL_OR_PASSWORD',
+  'INVALID_GRANT',
+  'NOT_AUTHENTICATED',
+  'INVALID_PASSWORD',
+  'EMAIL_NOT_VERIFIED',
+  'USER_NOT_FOUND',
+  'SESSION_EXPIRED',
+  'UNAUTHORIZED',
+])
+
+const WEAK_PASSWORD_CODES = new Set([
+  'PASSWORD_TOO_SHORT',
+  'PASSWORD_TOO_LONG',
+  'WEAK_PASSWORD',
+  'INVALID_PASSWORD_FORMAT',
+])
+
+/** How a Better Auth failure is described once the vendor shape has been read. */
+export interface AuthFailure {
+  /** HTTP status the Auth surface returned. */
+  readonly status: number
+  /** Stable Better Auth error code when the body carried one. */
+  readonly code: string | undefined
+  /** Vendor message, already falling back to the caller's wording. */
+  readonly message: string
+}
+
+/**
+ * Describes a failed Auth response without deciding which taxonomy member it belongs to.
+ *
+ * A body with no readable message leaves only the status to report, so the status is stated.
+ */
+export function describeAuthFailure(
+  response: Response,
+  body: AuthResponseBody,
+  fallback: string,
+): AuthFailure {
+  const message = authErrorMessage(body.json)
+  return {
+    status: response.status,
+    code: authErrorCode(body.json),
+    message: message ?? `${fallback} Neon Auth returned HTTP ${response.status}.`,
+  }
+}
+
+/** Where a failure belongs in the form: the field that carries its message. */
+export type AuthField = 'email' | 'password' | 'token' | 'code'
+
+/** How a caller wants a 401 or 403 that is not a rejected key classified. */
+export type AuthRejection = 'unauthenticated' | 'unavailable'
+
+/**
+ * Maps a failed Better Auth response onto the framework taxonomy, keeping the body as `.cause`.
+ *
+ * `rejection` exists because a 401 means different things per operation. Sign-in answers one with
+ * `Unauthenticated`, which the kernel turns into a redirect to the login page. Registration answers
+ * the same status with `Unavailable`: nobody was authenticating, so bouncing to a login page hides
+ * a project that is refusing the call.
+ */
+export function mapAuthError(
+  failure: AuthFailure,
+  options: {
+    readonly operation: string
+    readonly field: AuthField
+    readonly rejection: AuthRejection
+    readonly cause: unknown
+  },
+): never {
+  const { message, code, status } = failure
+  const cause = { status, code, body: options.cause, operation: options.operation }
+
+  if (
+    DUPLICATE_CODES.has(code ?? '') ||
+    /already (registered|been registered|exists)/i.test(message)
+  ) {
+    throw new Conflict(message, { metadata: { resource: 'actor', key: 'email' }, cause })
+  }
+
+  if (RATE_LIMIT_CODES.has(code ?? '') || status === 429) {
+    throw new RateLimited(message, { metadata: { key: options.operation }, cause })
+  }
+
+  if (DISABLED_CODES.has(code ?? '')) {
+    throw new Unavailable(message, { metadata: { service: 'identity' }, cause })
+  }
+
+  // Better Auth serves every documented path; a 404 or 405 means the configured URL is not one.
+  if (status === 404 || status === 405) {
+    throw new Unavailable(message, { metadata: { service: 'identity' }, cause })
+  }
+
+  if (WEAK_PASSWORD_CODES.has(code ?? '')) {
+    throw new Invalid(message, { metadata: { fields: { password: [message] } }, cause })
+  }
+
+  if (CREDENTIAL_CODES.has(code ?? '') || status === 401 || status === 403) {
+    if (options.rejection === 'unavailable') {
+      throw new Unavailable(message, { metadata: { service: 'identity' }, cause })
+    }
+    throw new Unauthenticated(message, { metadata: { guard: 'identity' }, cause })
+  }
+
+  if (status >= 500) {
+    throw new Unavailable(message, { metadata: { service: 'identity' }, cause })
+  }
+
+  throw new Invalid(message, { metadata: { fields: { [options.field]: [message] } }, cause })
+}
+
+/** Better Auth error codes this driver maps, and the taxonomy member each becomes. */
+export const NEON_IDENTITY_ERROR_MAP = [
+  { code: 'USER_ALREADY_EXISTS', framework: 'Conflict', meaning: 'email is already registered' },
+  { code: 'EMAIL_ALREADY_EXISTS', framework: 'Conflict', meaning: 'email is already registered' },
+  { code: 'TOO_MANY_REQUESTS', framework: 'RateLimited', meaning: 'request throttled' },
+  { code: 'SIGN_UP_DISABLED', framework: 'Unavailable', meaning: 'project refuses new signups' },
+  {
+    code: 'INVALID_EMAIL_OR_PASSWORD',
+    framework: 'Unauthenticated',
+    meaning: 'credentials did not match',
+  },
+  { code: 'EMAIL_NOT_VERIFIED', framework: 'Unauthenticated', meaning: 'email is unverified' },
+  { code: 'PASSWORD_TOO_SHORT', framework: 'Invalid', meaning: 'password fails the policy' },
+  { code: 'WEAK_PASSWORD', framework: 'Invalid', meaning: 'password fails the policy' },
+] as const

package/src/identity/index.ts

@@ -0,0 +1,15 @@
+export {
+  clearSessionCookie,
+  DEFAULT_SESSION_COOKIE,
+  readSessionCookie,
+  writeSessionCookie,
+} from './cookies'
+export { NEON_IDENTITY_ERROR_MAP } from './errors'
+export {
+  createNeonIdentity,
+  NeonIdentity,
+  neonIdentityCapabilities,
+  type NeonIdentityOptions,
+} from './driver'
+export { LocalAuthServer } from './local-auth'
+export type { NeonActor, NeonSession } from './types'