@bitbaum/accountkit 0.0.0-stage → 0.6.3

package/dist/auth/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../src/auth/schema.ts"],"names":[],"mappings":"AAmCA,eAAO,MAAM,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAUf,CAAC;AAEH,eAAO,MAAM,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAenB,CAAC;AAEF,eAAO,MAAM,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA6BnB,CAAC;AAEF,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAUxB,CAAC;AAEF,eAAO,MAAM,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAkBnB,CAAC;AAEF,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAkBrB,CAAC;AAEF,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAOtB,CAAC"}

package/dist/auth/schema.js

@@ -0,0 +1,120 @@
+/**
+ * The tables better-auth and its passkey and two-factor plugins expect, as
+ * Drizzle tables. Every product re-exports these from its own schema file:
+ *
+ *   export * from "@bitbaum/accountkit/auth/schema";
+ *
+ * so drizzle-kit generates ONE migration for accounts that is identical in
+ * every product. A column that drifts here does not fail the build, it fails
+ * at sign-in, which is why this lives in one place.
+ *
+ * Pseudonymous by default: `name` may be empty and is never required to be
+ * real. A method that brings no email gets an address under `.invalid`
+ * (see methods.ts `placeholderEmail`).
+ */
+import { boolean, index, integer, pgTable, text, timestamp, uniqueIndex, } from "drizzle-orm/pg-core";
+import { DEFAULT_ROLE } from "./roles.js";
+const timestamps = {
+    createdAt: timestamp("created_at", { withTimezone: true })
+        .defaultNow()
+        .notNull(),
+    updatedAt: timestamp("updated_at", { withTimezone: true })
+        .defaultNow()
+        .$onUpdate(() => new Date())
+        .notNull(),
+};
+export const user = pgTable("users", {
+    id: text("id").primaryKey(),
+    name: text("name").notNull().default(""),
+    email: text("email").notNull().unique(),
+    emailVerified: boolean("email_verified").notNull().default(false),
+    image: text("image"),
+    /** What this person is to the product. Never set by the person: sign-up ignores it. */
+    role: text("role").notNull().default(DEFAULT_ROLE),
+    twoFactorEnabled: boolean("two_factor_enabled").notNull().default(false),
+    ...timestamps,
+});
+export const session = pgTable("sessions", {
+    id: text("id").primaryKey(),
+    expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
+    token: text("token").notNull().unique(),
+    // Left empty on purpose: IP tracking is switched off.
+    ipAddress: text("ip_address"),
+    userAgent: text("user_agent"),
+    userId: text("user_id")
+        .notNull()
+        .references(() => user.id, { onDelete: "cascade" }),
+    ...timestamps,
+}, (t) => [index("sessions_user_id_idx").on(t.userId)]);
+export const account = pgTable("accounts", {
+    id: text("id").primaryKey(),
+    accountId: text("account_id").notNull(),
+    providerId: text("provider_id").notNull(),
+    userId: text("user_id")
+        .notNull()
+        .references(() => user.id, { onDelete: "cascade" }),
+    // Provider tokens are never kept: the product needs to know WHO signed in.
+    accessToken: text("access_token"),
+    refreshToken: text("refresh_token"),
+    idToken: text("id_token"),
+    accessTokenExpiresAt: timestamp("access_token_expires_at", {
+        withTimezone: true,
+    }),
+    refreshTokenExpiresAt: timestamp("refresh_token_expires_at", {
+        withTimezone: true,
+    }),
+    scope: text("scope"),
+    /** A slow, salted hash (scrypt). Never a plaintext secret. */
+    password: text("password"),
+    ...timestamps,
+}, (t) => [
+    index("accounts_user_id_idx").on(t.userId),
+    // One local person per provider identity.
+    uniqueIndex("accounts_provider_account_uidx").on(t.providerId, t.accountId),
+]);
+export const verification = pgTable("verifications", {
+    id: text("id").primaryKey(),
+    identifier: text("identifier").notNull(),
+    value: text("value").notNull(),
+    expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
+    ...timestamps,
+}, (t) => [index("verifications_identifier_idx").on(t.identifier)]);
+export const passkey = pgTable("passkeys", {
+    id: text("id").primaryKey(),
+    name: text("name"),
+    publicKey: text("public_key").notNull(),
+    userId: text("user_id")
+        .notNull()
+        .references(() => user.id, { onDelete: "cascade" }),
+    credentialID: text("credential_id").notNull().unique(),
+    counter: integer("counter").notNull(),
+    deviceType: text("device_type").notNull(),
+    backedUp: boolean("backed_up").notNull(),
+    transports: text("transports"),
+    aaguid: text("aaguid"),
+    createdAt: timestamp("created_at", { withTimezone: true }).defaultNow(),
+}, (t) => [index("passkeys_user_id_idx").on(t.userId)]);
+export const twoFactor = pgTable("two_factors", {
+    id: text("id").primaryKey(),
+    /** Encrypted by better-auth with BETTER_AUTH_SECRET before it is stored. */
+    secret: text("secret").notNull(),
+    backupCodes: text("backup_codes").notNull(),
+    userId: text("user_id")
+        .notNull()
+        .references(() => user.id, { onDelete: "cascade" }),
+    verified: boolean("verified").default(true),
+    failedVerificationCount: integer("failed_verification_count").default(0),
+    lockedUntil: timestamp("locked_until", { withTimezone: true }),
+}, (t) => [
+    index("two_factors_user_id_idx").on(t.userId),
+    index("two_factors_secret_idx").on(t.secret),
+]);
+export const authSchema = {
+    user,
+    session,
+    account,
+    verification,
+    passkey,
+    twoFactor,
+};
+//# sourceMappingURL=schema.js.map

package/dist/auth/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/auth/schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EACL,OAAO,EACP,KAAK,EACL,OAAO,EACP,OAAO,EACP,IAAI,EACJ,SAAS,EACT,WAAW,GACZ,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE1C,MAAM,UAAU,GAAG;IACjB,SAAS,EAAE,SAAS,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;SACvD,UAAU,EAAE;SACZ,OAAO,EAAE;IACZ,SAAS,EAAE,SAAS,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;SACvD,UAAU,EAAE;SACZ,SAAS,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;SAC3B,OAAO,EAAE;CACb,CAAC;AAEF,MAAM,CAAC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,EAAE;IACnC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;IAC3B,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IACxC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;IACvC,aAAa,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACjE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC;IACpB,uFAAuF;IACvF,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC;IAClD,gBAAgB,EAAE,OAAO,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACxE,GAAG,UAAU;CACd,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAC5B,UAAU,EACV;IACE,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;IAC3B,SAAS,EAAE,SAAS,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;IACpE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;IACvC,sDAAsD;IACtD,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC;IAC7B,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC;IAC7B,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC;SACpB,OAAO,EAAE;SACT,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IACrD,GAAG,UAAU;CACd,EACD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CACpD,CAAC;AAEF,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAC5B,UAAU,EACV;IACE,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;IAC3B,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IACvC,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE;IACzC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC;SACpB,OAAO,EAAE;SACT,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IACrD,2EAA2E;IAC3E,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC;IACjC,YAAY,EAAE,IAAI,CAAC,eAAe,CAAC;IACnC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC;IACzB,oBAAoB,EAAE,SAAS,CAAC,yBAAyB,EAAE;QACzD,YAAY,EAAE,IAAI;KACnB,CAAC;IACF,qBAAqB,EAAE,SAAS,CAAC,0BAA0B,EAAE;QAC3D,YAAY,EAAE,IAAI;KACnB,CAAC;IACF,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC;IACpB,8DAA8D;IAC9D,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC;IAC1B,GAAG,UAAU;CACd,EACD,CAAC,CAAC,EAAE,EAAE,CAAC;IACL,KAAK,CAAC,sBAAsB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IAC1C,0CAA0C;IAC1C,WAAW,CAAC,gCAAgC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,SAAS,CAAC;CAC5E,CACF,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAG,OAAO,CACjC,eAAe,EACf;IACE,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;IAC3B,UAAU,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IACxC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;IAC9B,SAAS,EAAE,SAAS,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;IACpE,GAAG,UAAU;CACd,EACD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAChE,CAAC;AAEF,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAC5B,UAAU,EACV;IACE,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;IAC3B,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC;IAClB,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IACvC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC;SACpB,OAAO,EAAE;SACT,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IACrD,YAAY,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;IACtD,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;IACrC,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE;IACzC,QAAQ,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE;IACxC,UAAU,EAAE,IAAI,CAAC,YAAY,CAAC;IAC9B,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC;IACtB,SAAS,EAAE,SAAS,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,UAAU,EAAE;CACxE,EACD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CACpD,CAAC;AAEF,MAAM,CAAC,MAAM,SAAS,GAAG,OAAO,CAC9B,aAAa,EACb;IACE,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;IAC3B,4EAA4E;IAC5E,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE;IAChC,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IAC3C,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC;SACpB,OAAO,EAAE;SACT,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IACrD,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3C,uBAAuB,EAAE,OAAO,CAAC,2BAA2B,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACxE,WAAW,EAAE,SAAS,CAAC,cAAc,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;CAC/D,EACD,CAAC,CAAC,EAAE,EAAE,CAAC;IACL,KAAK,CAAC,yBAAyB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IAC7C,KAAK,CAAC,wBAAwB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;CAC7C,CACF,CAAC;AAEF,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,IAAI;IACJ,OAAO;IACP,OAAO;IACP,YAAY;IACZ,OAAO;IACP,SAAS;CACV,CAAC"}

package/dist/auth/server.d.ts

@@ -0,0 +1,56 @@
+import { betterAuth } from "better-auth";
+import type { GenericOAuthConfig } from "better-auth/plugins";
+import { type OidcClient } from "./methods.js";
+export type AuthMailKind = "verify" | "magicLink" | "reset";
+export interface AuthMailer {
+    /** Whether mail can be sent at all. Without it the methods that need mail are hidden. */
+    configured: boolean;
+    /** Send an account mail. Must not throw, and must not log the link. */
+    send(kind: AuthMailKind, to: string, url: string): Promise<void>;
+}
+export interface AuthSite {
+    /** The public origin, e.g. https://causius.orangecat.ch. Pinned, never inferred. */
+    url: string;
+    /** Shown in authenticator apps and passkey prompts. */
+    title: string;
+    /** Cookie prefix. */
+    slug: string;
+}
+export interface CreateAuthOptions {
+    site: AuthSite;
+    /** A Drizzle node-postgres or pglite database holding the tables in ./schema. */
+    database: unknown;
+    /** Defaults to this package's tables; pass your own only if you must. */
+    schema?: Record<string, unknown>;
+    mail: AuthMailer;
+    env?: NodeJS.ProcessEnv;
+    /**
+     * Called as a sign-in method is attached to a person (a first sign-up
+     * included), once the person exists. A product that used to identify people by another id — an
+     * OrangeCat actor id, say — re-keys its own rows here. Must be idempotent;
+     * a throw is logged and never blocks the sign-in.
+     */
+    onAccountCreated?: (account: {
+        userId: string;
+        providerId: string;
+        accountId: string;
+    }) => Promise<void>;
+}
+export type AuthStatus = {
+    ready: true;
+} | {
+    ready: false;
+    reason: "no_database" | "no_secret";
+};
+/**
+ * The session secret: BETTER_AUTH_SECRET, or the AUTH_SECRET a product moving
+ * off next-auth already has on its server (better-auth reads the same pair).
+ * Either way it must be 32+ characters in production.
+ */
+export declare function secretFrom(env: NodeJS.ProcessEnv): string;
+export declare function authStatusFor(databaseConfigured: boolean, env?: NodeJS.ProcessEnv): AuthStatus;
+/** An OIDC client as better-auth's generic OAuth provider. */
+export declare function oidcProvider(client: OidcClient): GenericOAuthConfig;
+export type Auth = ReturnType<typeof betterAuth>;
+export declare function createAuthInstance(options: CreateAuthOptions): Auth;
+//# sourceMappingURL=server.d.ts.map

package/dist/auth/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/auth/server.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAIzC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EAIL,KAAK,UAAU,EAChB,MAAM,cAAc,CAAC;AActB,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,WAAW,GAAG,OAAO,CAAC;AAE5D,MAAM,WAAW,UAAU;IACzB,yFAAyF;IACzF,UAAU,EAAE,OAAO,CAAC;IACpB,uEAAuE;IACvE,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAClE;AAED,MAAM,WAAW,QAAQ;IACvB,oFAAoF;IACpF,GAAG,EAAE,MAAM,CAAC;IACZ,uDAAuD;IACvD,KAAK,EAAE,MAAM,CAAC;IACd,qBAAqB;IACrB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,QAAQ,CAAC;IACf,iFAAiF;IACjF,QAAQ,EAAE,OAAO,CAAC;IAClB,yEAAyE;IACzE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,IAAI,EAAE,UAAU,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE;QAC3B,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,MAAM,CAAC;QACnB,SAAS,EAAE,MAAM,CAAC;KACnB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACrB;AAED,MAAM,MAAM,UAAU,GACpB;IAAE,KAAK,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,aAAa,GAAG,WAAW,CAAA;CAAE,CAAC;AAE1E;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAEzD;AAED,wBAAgB,aAAa,CAC3B,kBAAkB,EAAE,OAAO,EAC3B,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,UAAU,CAOZ;AAaD,8DAA8D;AAC9D,wBAAgB,YAAY,CAAC,MAAM,EAAE,UAAU,GAAG,kBAAkB,CAiCnE;AAED,MAAM,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC;AAEjD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,iBAAiB,GAAG,IAAI,CA0JnE"}

package/dist/auth/server.js

@@ -0,0 +1,229 @@
+import { passkey } from "@better-auth/passkey";
+import { betterAuth } from "better-auth";
+import { drizzleAdapter } from "better-auth/adapters/drizzle";
+import { nextCookies } from "better-auth/next-js";
+import { genericOAuth, magicLink } from "better-auth/plugins";
+import { oidcClients, placeholderEmail, signInMethods, } from "./methods.js";
+import { DEFAULT_ROLE } from "./roles.js";
+import { authSchema } from "./schema.js";
+import { factorForAllMethods } from "./factor.js";
+/**
+ * Accounts for a bitbaum product: better-auth 1.x on Drizzle + pg, configured
+ * the same way everywhere (fleet STACK.md, "Identity"). A product passes in
+ * what is its own — its address, its database, its mail — and gets the same
+ * methods, limits, cookie rules and account-linking rules as every other.
+ */
+const MIN_SECRET_LENGTH = 32;
+const DEV_SECRET = "development-only-secret-never-used-in-production-0000";
+/**
+ * The session secret: BETTER_AUTH_SECRET, or the AUTH_SECRET a product moving
+ * off next-auth already has on its server (better-auth reads the same pair).
+ * Either way it must be 32+ characters in production.
+ */
+export function secretFrom(env) {
+    return (env.BETTER_AUTH_SECRET?.trim() || env.AUTH_SECRET?.trim()) ?? "";
+}
+export function authStatusFor(databaseConfigured, env = process.env) {
+    if (!databaseConfigured)
+        return { ready: false, reason: "no_database" };
+    const secret = secretFrom(env);
+    if (env.NODE_ENV === "production" && secret.length < MIN_SECRET_LENGTH) {
+        return { ready: false, reason: "no_secret" };
+    }
+    return { ready: true };
+}
+function authSecret(env) {
+    const secret = secretFrom(env);
+    if (secret.length >= MIN_SECRET_LENGTH)
+        return secret;
+    if (env.NODE_ENV === "production") {
+        throw new Error("BETTER_AUTH_SECRET is missing or shorter than 32 characters");
+    }
+    return DEV_SECRET;
+}
+/** An OIDC client as better-auth's generic OAuth provider. */
+export function oidcProvider(client) {
+    return {
+        providerId: client.providerId,
+        discoveryUrl: client.discoveryUrl,
+        // Identity comes from a VERIFIED id_token (issuer + JWKS from discovery);
+        // a discovery that cannot provide them skips the provider instead of
+        // silently decoding an unverified token.
+        requireIdTokenVerification: true,
+        clientId: client.clientId,
+        clientSecret: client.clientSecret,
+        // OrangeCat's token endpoint accepts ONLY client_secret_post (it answers
+        // basic with a misleading 400 "client_id is required"); the shared sign-in
+        // speaks the same. PKCE is required even for confidential clients.
+        tokenEndpointAuth: { method: "client_secret_post" },
+        pkce: true,
+        scopes: ["openid", "profile", "email"],
+        // Who signed in, never their provider address: see placeholderEmail.
+        mapProfileToUser: (profile) => {
+            const subject = String(profile.sub ?? profile.id ?? "");
+            if (!subject)
+                throw new Error(`${client.providerId}: id_token has no sub`);
+            const handle = typeof profile.preferred_username === "string"
+                ? profile.preferred_username
+                : "";
+            return {
+                name: handle.replace(/^@/, "").slice(0, 80),
+                email: placeholderEmail(client.providerId, subject),
+                emailVerified: false,
+                image: undefined,
+            };
+        },
+    };
+}
+export function createAuthInstance(options) {
+    const env = options.env ?? process.env;
+    const { site, mail } = options;
+    const methods = signInMethods(env, mail.configured);
+    const providers = oidcClients(env).map(oidcProvider);
+    const origin = new URL(site.url);
+    const schema = options.schema ?? authSchema;
+    const auth = betterAuth({
+        appName: site.title,
+        secret: authSecret(env),
+        // Pinned, never inferred from the request: behind Caddy the app sees its
+        // INTERNAL origin, and links built from it point at localhost.
+        baseURL: site.url,
+        trustedOrigins: [origin.origin],
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        database: drizzleAdapter(options.database, {
+            provider: "pg",
+            schema: {
+                user: schema.user,
+                session: schema.session,
+                account: schema.account,
+                verification: schema.verification,
+                passkey: schema.passkey,
+                twoFactor: schema.twoFactor,
+            },
+        }),
+        telemetry: { enabled: false },
+        // One rate limiter, keyed on the proxy's hop (./limits), run by the route
+        // handler. better-auth's own would key on the first X-Forwarded-For entry,
+        // which the caller chooses.
+        rateLimit: { enabled: false },
+        advanced: {
+            useSecureCookies: env.NODE_ENV === "production",
+            // An IP address next to a session is personal data the product does not need.
+            ipAddress: { disableIpTracking: true },
+            cookiePrefix: site.slug,
+        },
+        session: {
+            expiresIn: 14 * 24 * 60 * 60,
+            updateAge: 24 * 60 * 60,
+            // Changing a password, a passkey or 2FA needs a session younger than this.
+            freshAge: 15 * 60,
+        },
+        user: {
+            additionalFields: {
+                // Never accepted from the person: a sign-up body carrying role: "admin" is ignored.
+                role: {
+                    type: "string",
+                    required: false,
+                    defaultValue: DEFAULT_ROLE,
+                    input: false,
+                },
+            },
+            deleteUser: { enabled: true },
+            changeEmail: { enabled: mail.configured },
+        },
+        account: {
+            accountLinking: {
+                enabled: true,
+                // An address is never an identity: a new sign-in method joins an
+                // account only when the signed-in person links it from their account page.
+                disableImplicitLinking: true,
+                allowDifferentEmails: true,
+            },
+            encryptOAuthTokens: true,
+        },
+        databaseHooks: {
+            account: {
+                // The product needs to know WHO signed in, not to act at the provider
+                // on their behalf, so provider tokens are dropped before they are stored.
+                create: {
+                    // Runs just before the sign-in method is stored, when the person's
+                    // row already exists. (better-auth's `after` hooks are queued behind
+                    // a transaction this adapter never opens, and did not fire.)
+                    before: async (data) => {
+                        try {
+                            await options.onAccountCreated?.({
+                                userId: String(data.userId),
+                                providerId: String(data.providerId),
+                                accountId: String(data.accountId),
+                            });
+                        }
+                        catch (error) {
+                            console.error(`[auth] onAccountCreated failed: ${error.name}`);
+                        }
+                        return {
+                            data: {
+                                ...data,
+                                accessToken: null,
+                                refreshToken: null,
+                                idToken: null,
+                            },
+                        };
+                    },
+                },
+                update: {
+                    before: async (data) => ({
+                        data: {
+                            ...data,
+                            accessToken: null,
+                            refreshToken: null,
+                            idToken: null,
+                        },
+                    }),
+                },
+            },
+        },
+        emailAndPassword: {
+            enabled: true,
+            minPasswordLength: 12,
+            maxPasswordLength: 128,
+            autoSignIn: !methods.verifyEmail,
+            // Without mail a verification link could never arrive, and requiring
+            // one would strand every new account.
+            requireEmailVerification: methods.verifyEmail,
+            revokeSessionsOnPasswordReset: true,
+            sendResetPassword: mail.configured
+                ? async ({ user, url }) => mail.send("reset", user.email, url)
+                : undefined,
+        },
+        emailVerification: {
+            sendOnSignUp: methods.verifyEmail,
+            autoSignInAfterVerification: true,
+            sendVerificationEmail: async ({ user, url }) => mail.send("verify", user.email, url),
+        },
+        plugins: [
+            // allowPasswordless: someone who signs in only by passkey, link or OIDC can
+            // still add a second factor (with a fresh session instead of a password).
+            factorForAllMethods(site),
+            passkey({
+                rpID: origin.hostname,
+                rpName: site.title,
+                origin: origin.origin,
+            }),
+            ...(methods.magicLink
+                ? [
+                    magicLink({
+                        expiresIn: 10 * 60,
+                        sendMagicLink: async ({ email, url }) => mail.send("magicLink", email, url),
+                    }),
+                ]
+                : []),
+            ...(providers.length > 0 ? [genericOAuth({ config: providers })] : []),
+            // Lets server actions set cookies; keep it last.
+            nextCookies(),
+        ],
+    });
+    // The inferred type names zod internals and cannot be published; the base
+    // type carries every call the products make (api.getSession, handler).
+    return auth;
+}
+//# sourceMappingURL=server.js.map

package/dist/auth/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/auth/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAE9D,OAAO,EACL,WAAW,EACX,gBAAgB,EAChB,aAAa,GAEd,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAElD;;;;;GAKG;AACH,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAC7B,MAAM,UAAU,GAAG,uDAAuD,CAAC;AA4C3E;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,GAAsB;IAC/C,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,IAAI,GAAG,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;AAC3E,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,kBAA2B,EAC3B,MAAyB,OAAO,CAAC,GAAG;IAEpC,IAAI,CAAC,kBAAkB;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACxE,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,GAAG,CAAC,QAAQ,KAAK,YAAY,IAAI,MAAM,CAAC,MAAM,GAAG,iBAAiB,EAAE,CAAC;QACvE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC/C,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACzB,CAAC;AAED,SAAS,UAAU,CAAC,GAAsB;IACxC,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,MAAM,CAAC,MAAM,IAAI,iBAAiB;QAAE,OAAO,MAAM,CAAC;IACtD,IAAI,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CACb,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,YAAY,CAAC,MAAkB;IAC7C,OAAO;QACL,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,0EAA0E;QAC1E,qEAAqE;QACrE,yCAAyC;QACzC,0BAA0B,EAAE,IAAI;QAChC,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,yEAAyE;QACzE,2EAA2E;QAC3E,mEAAmE;QACnE,iBAAiB,EAAE,EAAE,MAAM,EAAE,oBAAoB,EAAE;QACnD,IAAI,EAAE,IAAI;QACV,MAAM,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC;QACtC,qEAAqE;QACrE,gBAAgB,EAAE,CAAC,OAAO,EAAE,EAAE;YAC5B,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;YACxD,IAAI,CAAC,OAAO;gBACV,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,CAAC,UAAU,uBAAuB,CAAC,CAAC;YAC/D,MAAM,MAAM,GACV,OAAO,OAAO,CAAC,kBAAkB,KAAK,QAAQ;gBAC5C,CAAC,CAAC,OAAO,CAAC,kBAAkB;gBAC5B,CAAC,CAAC,EAAE,CAAC;YACT,OAAO;gBACL,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;gBAC3C,KAAK,EAAE,gBAAgB,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC;gBACnD,aAAa,EAAE,KAAK;gBACpB,KAAK,EAAE,SAAS;aACjB,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAID,MAAM,UAAU,kBAAkB,CAAC,OAA0B;IAC3D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC;IAC/B,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,UAAU,CAAC;IAE5C,MAAM,IAAI,GAAG,UAAU,CAAC;QACtB,OAAO,EAAE,IAAI,CAAC,KAAK;QACnB,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC;QACvB,yEAAyE;QACzE,+DAA+D;QAC/D,OAAO,EAAE,IAAI,CAAC,GAAG;QACjB,cAAc,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC;QAC/B,8DAA8D;QAC9D,QAAQ,EAAE,cAAc,CAAC,OAAO,CAAC,QAAe,EAAE;YAChD,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE;gBACN,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,SAAS,EAAE,MAAM,CAAC,SAAS;aAC5B;SACF,CAAC;QACF,SAAS,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;QAC7B,0EAA0E;QAC1E,2EAA2E;QAC3E,4BAA4B;QAC5B,SAAS,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;QAC7B,QAAQ,EAAE;YACR,gBAAgB,EAAE,GAAG,CAAC,QAAQ,KAAK,YAAY;YAC/C,8EAA8E;YAC9E,SAAS,EAAE,EAAE,iBAAiB,EAAE,IAAI,EAAE;YACtC,YAAY,EAAE,IAAI,CAAC,IAAI;SACxB;QACD,OAAO,EAAE;YACP,SAAS,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE;YAC5B,SAAS,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE;YACvB,2EAA2E;YAC3E,QAAQ,EAAE,EAAE,GAAG,EAAE;SAClB;QACD,IAAI,EAAE;YACJ,gBAAgB,EAAE;gBAChB,oFAAoF;gBACpF,IAAI,EAAE;oBACJ,IAAI,EAAE,QAAQ;oBACd,QAAQ,EAAE,KAAK;oBACf,YAAY,EAAE,YAAY;oBAC1B,KAAK,EAAE,KAAK;iBACb;aACF;YACD,UAAU,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;YAC7B,WAAW,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE;SAC1C;QACD,OAAO,EAAE;YACP,cAAc,EAAE;gBACd,OAAO,EAAE,IAAI;gBACb,iEAAiE;gBACjE,2EAA2E;gBAC3E,sBAAsB,EAAE,IAAI;gBAC5B,oBAAoB,EAAE,IAAI;aAC3B;YACD,kBAAkB,EAAE,IAAI;SACzB;QACD,aAAa,EAAE;YACb,OAAO,EAAE;gBACP,sEAAsE;gBACtE,0EAA0E;gBAC1E,MAAM,EAAE;oBACN,mEAAmE;oBACnE,qEAAqE;oBACrE,6DAA6D;oBAC7D,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;wBACrB,IAAI,CAAC;4BACH,MAAM,OAAO,CAAC,gBAAgB,EAAE,CAAC;gCAC/B,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;gCAC3B,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;gCACnC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;6BAClC,CAAC,CAAC;wBACL,CAAC;wBAAC,OAAO,KAAK,EAAE,CAAC;4BACf,OAAO,CAAC,KAAK,CACX,mCAAoC,KAAe,CAAC,IAAI,EAAE,CAC3D,CAAC;wBACJ,CAAC;wBACD,OAAO;4BACL,IAAI,EAAE;gCACJ,GAAG,IAAI;gCACP,WAAW,EAAE,IAAI;gCACjB,YAAY,EAAE,IAAI;gCAClB,OAAO,EAAE,IAAI;6BACd;yBACF,CAAC;oBACJ,CAAC;iBACF;gBACD,MAAM,EAAE;oBACN,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;wBACvB,IAAI,EAAE;4BACJ,GAAG,IAAI;4BACP,WAAW,EAAE,IAAI;4BACjB,YAAY,EAAE,IAAI;4BAClB,OAAO,EAAE,IAAI;yBACd;qBACF,CAAC;iBACH;aACF;SACF;QACD,gBAAgB,EAAE;YAChB,OAAO,EAAE,IAAI;YACb,iBAAiB,EAAE,EAAE;YACrB,iBAAiB,EAAE,GAAG;YACtB,UAAU,EAAE,CAAC,OAAO,CAAC,WAAW;YAChC,qEAAqE;YACrE,sCAAsC;YACtC,wBAAwB,EAAE,OAAO,CAAC,WAAW;YAC7C,6BAA6B,EAAE,IAAI;YACnC,iBAAiB,EAAE,IAAI,CAAC,UAAU;gBAChC,CAAC,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC;gBAC9D,CAAC,CAAC,SAAS;SACd;QACD,iBAAiB,EAAE;YACjB,YAAY,EAAE,OAAO,CAAC,WAAW;YACjC,2BAA2B,EAAE,IAAI;YACjC,qBAAqB,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,CAC7C,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC;SACvC;QACD,OAAO,EAAE;YACP,4EAA4E;YAC5E,0EAA0E;YAC1E,mBAAmB,CAAC,IAAI,CAAC;YACzB,OAAO,CAAC;gBACN,IAAI,EAAE,MAAM,CAAC,QAAQ;gBACrB,MAAM,EAAE,IAAI,CAAC,KAAK;gBAClB,MAAM,EAAE,MAAM,CAAC,MAAM;aACtB,CAAC;YACF,GAAG,CAAC,OAAO,CAAC,SAAS;gBACnB,CAAC,CAAC;oBACE,SAAS,CAAC;wBACR,SAAS,EAAE,EAAE,GAAG,EAAE;wBAClB,aAAa,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE,CACtC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,GAAG,CAAC;qBACrC,CAAC;iBACH;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACtE,iDAAiD;YACjD,WAAW,EAAE;SACd;KACF,CAAC,CAAC;IACH,0EAA0E;IAC1E,uEAAuE;IACvE,OAAO,IAAuB,CAAC;AACjC,CAAC"}

package/dist/auth/translations.d.ts

@@ -0,0 +1,9 @@
+import { type AuthLabels } from "./labels.js";
+/** The languages with a full set of labels. */
+export declare const AUTH_LABEL_LOCALES: string[];
+/**
+ * The labels for a locale such as `de`, `de-CH` or `fr`. Unknown languages
+ * get English, which is the package's own default.
+ */
+export declare function authLabelsFor(locale: string | null | undefined): AuthLabels;
+//# sourceMappingURL=translations.d.ts.map

package/dist/auth/translations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"translations.d.ts","sourceRoot":"","sources":["../../src/auth/translations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAuB,KAAK,UAAU,EAAE,MAAM,aAAa,CAAC;AAqmBnE,+CAA+C;AAC/C,eAAO,MAAM,kBAAkB,UAA2B,CAAC;AAE3D;;;GAGG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,UAAU,CAG3E"}