@bitbaum/accountkit 0.0.0-stage → 0.8.0

package/dist/auth/factor.d.ts

@@ -0,0 +1,9 @@
+import { twoFactor } from "better-auth/plugins";
+/** Resolve only app-local challenge UI and return URLs; never carry bearer values. */
+export declare function factorDestination(origin: string, screen: unknown, next: unknown): string;
+/** Reuse BetterAuth's challenge/trusted-device policy for every primary method. */
+export declare function factorForAllMethods(site: {
+    title: string;
+    url: string;
+}): ReturnType<typeof twoFactor>;
+//# sourceMappingURL=factor.d.ts.map

package/dist/auth/factor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"factor.d.ts","sourceRoot":"","sources":["../../src/auth/factor.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAIhD,sFAAsF;AACtF,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,OAAO,EACf,IAAI,EAAE,OAAO,GACZ,MAAM,CA0BR;AAED,mFAAmF;AACnF,wBAAgB,mBAAmB,CAAC,IAAI,EAAE;IACxC,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;CACb,GAAG,UAAU,CAAC,OAAO,SAAS,CAAC,CAqG/B"}

package/dist/auth/factor.js

@@ -0,0 +1,107 @@
+import { createAuthMiddleware, getOAuthState } from "better-auth/api";
+import { twoFactor } from "better-auth/plugins";
+import { deleteSessionCookie } from "better-auth/cookies";
+import { returnPath } from "../paths.js";
+/** Resolve only app-local challenge UI and return URLs; never carry bearer values. */
+export function factorDestination(origin, screen, next) {
+    const local = (value, fallback) => {
+        try {
+            const url = new URL(typeof value === "string" ? value : fallback, origin);
+            if (url.origin !== new URL(origin).origin)
+                return new URL(fallback, origin);
+            return new URL(returnPath(url.pathname + url.search + url.hash, fallback), origin);
+        }
+        catch {
+            return new URL(fallback, origin);
+        }
+    };
+    const target = local(screen, "/sign-in");
+    const destination = local(next, "/");
+    for (const key of ["error", "error_description", "token", "code", "state"])
+        target.searchParams.delete(key);
+    target.searchParams.set("twoFactor", "1");
+    target.searchParams.set("next", destination.pathname === target.pathname
+        ? "/"
+        : destination.pathname + destination.search + destination.hash);
+    return target.toString();
+}
+/** Reuse BetterAuth's challenge/trusted-device policy for every primary method. */
+export function factorForAllMethods(site) {
+    const plugin = twoFactor({ issuer: site.title, allowPasswordless: true });
+    const native = plugin.hooks.after[0];
+    return {
+        ...plugin,
+        hooks: {
+            ...plugin.hooks,
+            after: [
+                ...plugin.hooks.after,
+                {
+                    matcher: ({ path }) => path === "/magic-link/verify" ||
+                        path === "/verify-email" ||
+                        path === "/passkey/verify-authentication" ||
+                        /^\/(?:oauth2\/)?callback\/[^/]+$/.test(path ?? ""),
+                    handler: createAuthMiddleware(async (ctx) => {
+                        const pending = ctx.context.newSession;
+                        if (!pending ||
+                            !("twoFactorEnabled" in pending.user) ||
+                            !pending.user.twoFactorEnabled)
+                            return;
+                        // Delegate cookie revocation, signed challenge creation, expiry,
+                        // attempt limits and trusted-device validation to the native plugin.
+                        let delegated;
+                        try {
+                            // BetterCall's runtime supports returnHeaders even where the
+                            // middleware declaration exposes only its body. Validate it.
+                            const result = await native.handler({
+                                ...ctx,
+                                returnHeaders: true,
+                            });
+                            if (!result ||
+                                typeof result !== "object" ||
+                                !("headers" in result) ||
+                                !(result.headers instanceof Headers) ||
+                                !("response" in result))
+                                throw new Error("Unsupported BetterAuth factor middleware envelope");
+                            const body = result.response;
+                            if (body !== undefined &&
+                                (!body ||
+                                    typeof body !== "object" ||
+                                    !("twoFactorRedirect" in body) ||
+                                    body.twoFactorRedirect !== true ||
+                                    !("twoFactorMethods" in body) ||
+                                    !Array.isArray(body.twoFactorMethods) ||
+                                    !body.twoFactorMethods.every((method) => typeof method === "string")))
+                                throw new Error("Unsupported BetterAuth factor challenge body");
+                            delegated = {
+                                headers: result.headers,
+                                response: body,
+                            };
+                        }
+                        catch (error) {
+                            // Never leave the primary session usable on an SDK failure.
+                            await ctx.context.internalAdapter.deleteSession(pending.session.token);
+                            ctx.context.setNewSession(null);
+                            deleteSessionCookie(ctx, true);
+                            throw error;
+                        }
+                        // Middleware invocations return their own headers and body. Keep
+                        // each Set-Cookie separate, including session revocation + challenge.
+                        for (const [name, value] of delegated.headers) {
+                            if (name !== "set-cookie")
+                                ctx.responseHeaders.set(name, value);
+                        }
+                        for (const cookie of delegated.headers.getSetCookie())
+                            ctx.responseHeaders.append("set-cookie", cookie);
+                        if (ctx.context.newSession ||
+                            ctx.path === "/passkey/verify-authentication")
+                            return delegated.response;
+                        const state = await getOAuthState();
+                        const target = factorDestination(site.url, ctx.query?.errorCallbackURL ?? state?.errorURL, ctx.query?.callbackURL ?? state?.callbackURL);
+                        throw ctx.redirect(target);
+                    }),
+                },
+            ],
+        },
+    };
+}
+//# sourceMappingURL=factor.js.map

package/dist/auth/factor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"factor.js","sourceRoot":"","sources":["../../src/auth/factor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACtE,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,sFAAsF;AACtF,MAAM,UAAU,iBAAiB,CAC/B,MAAc,EACd,MAAe,EACf,IAAa;IAEb,MAAM,KAAK,GAAG,CAAC,KAAc,EAAE,QAAgB,EAAE,EAAE;QACjD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAC1E,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM;gBACvC,OAAO,IAAI,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YACnC,OAAO,IAAI,GAAG,CACZ,UAAU,CAAC,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,EAC1D,MAAM,CACP,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACnC,CAAC;IACH,CAAC,CAAC;IACF,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACzC,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACrC,KAAK,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC;QACxE,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;IAC1C,MAAM,CAAC,YAAY,CAAC,GAAG,CACrB,MAAM,EACN,WAAW,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ;QACtC,CAAC,CAAC,GAAG;QACL,CAAC,CAAC,WAAW,CAAC,QAAQ,GAAG,WAAW,CAAC,MAAM,GAAG,WAAW,CAAC,IAAI,CACjE,CAAC;IACF,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC;AAC3B,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,mBAAmB,CAAC,IAGnC;IACC,MAAM,MAAM,GAAG,SAAS,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1E,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACrC,OAAO;QACL,GAAG,MAAM;QACT,KAAK,EAAE;YACL,GAAG,MAAM,CAAC,KAAK;YACf,KAAK,EAAE;gBACL,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK;gBACrB;oBACE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CACpB,IAAI,KAAK,oBAAoB;wBAC7B,IAAI,KAAK,eAAe;wBACxB,IAAI,KAAK,gCAAgC;wBACzC,kCAAkC,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;oBACrD,OAAO,EAAE,oBAAoB,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;wBAC1C,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC;wBACvC,IACE,CAAC,OAAO;4BACR,CAAC,CAAC,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC;4BACrC,CAAC,OAAO,CAAC,IAAI,CAAC,gBAAgB;4BAE9B,OAAO;wBACT,iEAAiE;wBACjE,qEAAqE;wBACrE,IAAI,SAKH,CAAC;wBACF,IAAI,CAAC;4BACH,6DAA6D;4BAC7D,6DAA6D;4BAC7D,MAAM,MAAM,GAAY,MAAM,MAAM,CAAC,OAAO,CAAC;gCAC3C,GAAG,GAAG;gCACN,aAAa,EAAE,IAAI;6BACpB,CAAC,CAAC;4BACH,IACE,CAAC,MAAM;gCACP,OAAO,MAAM,KAAK,QAAQ;gCAC1B,CAAC,CAAC,SAAS,IAAI,MAAM,CAAC;gCACtB,CAAC,CAAC,MAAM,CAAC,OAAO,YAAY,OAAO,CAAC;gCACpC,CAAC,CAAC,UAAU,IAAI,MAAM,CAAC;gCAEvB,MAAM,IAAI,KAAK,CACb,mDAAmD,CACpD,CAAC;4BACJ,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC;4BAC7B,IACE,IAAI,KAAK,SAAS;gCAClB,CAAC,CAAC,IAAI;oCACJ,OAAO,IAAI,KAAK,QAAQ;oCACxB,CAAC,CAAC,mBAAmB,IAAI,IAAI,CAAC;oCAC9B,IAAI,CAAC,iBAAiB,KAAK,IAAI;oCAC/B,CAAC,CAAC,kBAAkB,IAAI,IAAI,CAAC;oCAC7B,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC;oCACrC,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAC1B,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,MAAM,KAAK,QAAQ,CACvC,CAAC;gCAEJ,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;4BAClE,SAAS,GAAG;gCACV,OAAO,EAAE,MAAM,CAAC,OAAO;gCACvB,QAAQ,EAAE,IAEG;6BACd,CAAC;wBACJ,CAAC;wBAAC,OAAO,KAAK,EAAE,CAAC;4BACf,4DAA4D;4BAC5D,MAAM,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,aAAa,CAC7C,OAAO,CAAC,OAAO,CAAC,KAAK,CACtB,CAAC;4BACF,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;4BAChC,mBAAmB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;4BAC/B,MAAM,KAAK,CAAC;wBACd,CAAC;wBACD,iEAAiE;wBACjE,sEAAsE;wBACtE,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;4BAC9C,IAAI,IAAI,KAAK,YAAY;gCAAE,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;wBAClE,CAAC;wBACD,KAAK,MAAM,MAAM,IAAI,SAAS,CAAC,OAAO,CAAC,YAAY,EAAE;4BACnD,GAAG,CAAC,eAAe,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;wBACnD,IACE,GAAG,CAAC,OAAO,CAAC,UAAU;4BACtB,GAAG,CAAC,IAAI,KAAK,gCAAgC;4BAE7C,OAAO,SAAS,CAAC,QAAQ,CAAC;wBAC5B,MAAM,KAAK,GAAG,MAAM,aAAa,EAAE,CAAC;wBACpC,MAAM,MAAM,GAAG,iBAAiB,CAC9B,IAAI,CAAC,GAAG,EACR,GAAG,CAAC,KAAK,EAAE,gBAAgB,IAAI,KAAK,EAAE,QAAQ,EAC9C,GAAG,CAAC,KAAK,EAAE,WAAW,IAAI,KAAK,EAAE,WAAW,CAC7C,CAAC;wBACF,MAAM,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;oBAC7B,CAAC,CAAC;iBACH;aACF;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/auth/index.d.ts

@@ -0,0 +1,6 @@
+export * from "./methods.js";
+export * from "./roles.js";
+export { authBucket, authLimits, type AuthBucket } from "./limits.js";
+export { DEFAULT_AUTH_LABELS, DEFAULT_RECOVERY_LABELS, authErrorText, fill, type AuthError, type AuthLabels, type RecoveryLabels, } from "./labels.js";
+export { AUTH_LABEL_LOCALES, authLabelsFor } from "./translations.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,UAAU,EAAE,MAAM,aAAa,CAAC;AACtE,OAAO,EACL,mBAAmB,EACnB,uBAAuB,EACvB,aAAa,EACb,IAAI,EACJ,KAAK,SAAS,EACd,KAAK,UAAU,EACf,KAAK,cAAc,GACpB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/auth/index.js

@@ -0,0 +1,6 @@
+export * from "./methods.js";
+export * from "./roles.js";
+export { authBucket, authLimits } from "./limits.js";
+export { DEFAULT_AUTH_LABELS, DEFAULT_RECOVERY_LABELS, authErrorText, fill, } from "./labels.js";
+export { AUTH_LABEL_LOCALES, authLabelsFor } from "./translations.js";
+//# sourceMappingURL=index.js.map

package/dist/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,OAAO,EAAE,UAAU,EAAE,UAAU,EAAmB,MAAM,aAAa,CAAC;AACtE,OAAO,EACL,mBAAmB,EACnB,uBAAuB,EACvB,aAAa,EACb,IAAI,GAIL,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/auth/labels.d.ts

@@ -0,0 +1,126 @@
+/**
+ * Every word the account screens show, so each product can say them in its
+ * own language. Placeholders are `{email}`, `{method}` and `{word}`; a product
+ * on next-intl passes `t.raw(...)`, which keeps them as written.
+ */
+/**
+ * The one password rule: a length. No character classes, no symbols — a
+ * longer password is the person's choice, not a gate (NIST SP 800-63B).
+ */
+export declare const MIN_PASSWORD_LENGTH = 8;
+export interface RecoveryLabels {
+    forgot: string;
+    send: string;
+    sent: string;
+    reset: string;
+    newPassword: string;
+    confirmPassword: string;
+    mismatch: string;
+    invalidToken: string;
+    success: string;
+}
+export declare const DEFAULT_RECOVERY_LABELS: RecoveryLabels;
+export interface AuthLabels {
+    /** Optional for compatibility with existing product label overrides. */
+    passwordVisibility?: {
+        show: string;
+        hide: string;
+    };
+    /** Optional for compatibility with existing product label overrides. */
+    recovery?: RecoveryLabels;
+    signIn: string;
+    createAccount: string;
+    withSignin: string;
+    withOrangecat: string;
+    withPasskey: string;
+    withLink: string;
+    signUpWithLink: string;
+    orEmail: string;
+    email: string;
+    password: string;
+    passwordHint: string;
+    /** @deprecated Sign-up no longer asks for a name; the account page still uses displayName. */
+    displayName: string;
+    /** @deprecated Unused since sign-up stopped asking for a name. */
+    displayNameHint: string;
+    checkInbox: string;
+    confirmInbox: string;
+    back: string;
+    totpPrompt: string;
+    backupPrompt: string;
+    totpCode: string;
+    backupCode: string;
+    trustDevice: string;
+    verify: string;
+    useTotp: string;
+    useBackup: string;
+    resendVerification: string;
+    noAccount: string;
+    haveAccount: string;
+    errors: {
+        rateLimited: string;
+        unavailable: string;
+        generic: string;
+        emailFirst: string;
+        INVALID_EMAIL_OR_PASSWORD: string;
+        EMAIL_NOT_VERIFIED: string;
+        USER_ALREADY_EXISTS: string;
+        USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL: string;
+        PASSWORD_TOO_SHORT: string;
+        PASSWORD_TOO_LONG: string;
+        INVALID_EMAIL: string;
+        INVALID_CODE: string;
+        INVALID_TWO_FACTOR_CODE: string;
+        SESSION_EXPIRED: string;
+        INVALID_PASSWORD: string;
+    };
+    account: {
+        profile: string;
+        noEmail: string;
+        unverified: string;
+        role: string;
+        roles: Record<string, string>;
+        save: string;
+        saved: string;
+        methods: string;
+        methodPassword: string;
+        link: string;
+        passkeys: string;
+        passkeysLede: string;
+        passkeyDefaultName: string;
+        remove: string;
+        addPasskey: string;
+        twoFactor: string;
+        twoFactorOn: string;
+        twoFactorOff: string;
+        currentPassword: string;
+        currentPasswordHint: string;
+        scan: string;
+        openAuthenticator: string;
+        backupCodes: string;
+        turnOn: string;
+        turnOff: string;
+        setUp: string;
+        leave: string;
+        signOut: string;
+        deleteConfirm: string;
+        deleteWord: string;
+        delete: string;
+    };
+}
+export declare const DEFAULT_AUTH_LABELS: AuthLabels;
+/** Put values into a label: `fill("Hi {name}", { name: "Ada" })`. */
+export declare function fill(template: string, values: Record<string, string>): string;
+/** The error shape better-auth's client returns, plus our own guard's answers. */
+export type AuthError = {
+    code?: string;
+    status?: number;
+    message?: string;
+} | null | undefined;
+/**
+ * A failure in words, never a raw code: what happened and what to do next.
+ * Unknown codes get the generic sentence — a provider's message can carry
+ * details the person should not be shown.
+ */
+export declare function authErrorText(labels: AuthLabels, error: AuthError): string | null;
+//# sourceMappingURL=labels.d.ts.map

package/dist/auth/labels.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"labels.d.ts","sourceRoot":"","sources":["../../src/auth/labels.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH;;;GAGG;AACH,eAAO,MAAM,mBAAmB,IAAI,CAAC;AAErC,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,eAAO,MAAM,uBAAuB,EAAE,cAYrC,CAAC;AAEF,MAAM,WAAW,UAAU;IACzB,wEAAwE;IACxE,kBAAkB,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACpD,wEAAwE;IACxE,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,8FAA8F;IAC9F,WAAW,EAAE,MAAM,CAAC;IACpB,kEAAkE;IAClE,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE;QACN,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,MAAM,CAAC;QACpB,OAAO,EAAE,MAAM,CAAC;QAChB,UAAU,EAAE,MAAM,CAAC;QACnB,yBAAyB,EAAE,MAAM,CAAC;QAClC,kBAAkB,EAAE,MAAM,CAAC;QAC3B,mBAAmB,EAAE,MAAM,CAAC;QAC5B,qCAAqC,EAAE,MAAM,CAAC;QAC9C,kBAAkB,EAAE,MAAM,CAAC;QAC3B,iBAAiB,EAAE,MAAM,CAAC;QAC1B,aAAa,EAAE,MAAM,CAAC;QACtB,YAAY,EAAE,MAAM,CAAC;QACrB,uBAAuB,EAAE,MAAM,CAAC;QAChC,eAAe,EAAE,MAAM,CAAC;QACxB,gBAAgB,EAAE,MAAM,CAAC;KAC1B,CAAC;IACF,OAAO,EAAE;QACP,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,MAAM,CAAC;QAChB,UAAU,EAAE,MAAM,CAAC;QACnB,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC9B,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,MAAM,CAAC;QAChB,cAAc,EAAE,MAAM,CAAC;QACvB,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,YAAY,EAAE,MAAM,CAAC;QACrB,kBAAkB,EAAE,MAAM,CAAC;QAC3B,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,MAAM,CAAC;QACnB,SAAS,EAAE,MAAM,CAAC;QAClB,WAAW,EAAE,MAAM,CAAC;QACpB,YAAY,EAAE,MAAM,CAAC;QACrB,eAAe,EAAE,MAAM,CAAC;QACxB,mBAAmB,EAAE,MAAM,CAAC;QAC5B,IAAI,EAAE,MAAM,CAAC;QACb,iBAAiB,EAAE,MAAM,CAAC;QAC1B,WAAW,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,MAAM,CAAC;QAChB,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,MAAM,CAAC;QAChB,aAAa,EAAE,MAAM,CAAC;QACtB,UAAU,EAAE,MAAM,CAAC;QACnB,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;CACH;AAED,eAAO,MAAM,mBAAmB,EAAE,UAqGjC,CAAC;AAEF,qEAAqE;AACrE,wBAAgB,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAK7E;AAED,kFAAkF;AAClF,MAAM,MAAM,SAAS,GACnB;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,GAAG,SAAS,CAAC;AAgB1E;;;;GAIG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,UAAU,EAClB,KAAK,EAAE,SAAS,GACf,MAAM,GAAG,IAAI,CAQf"}

package/dist/auth/labels.js

@@ -0,0 +1,143 @@
+/**
+ * Every word the account screens show, so each product can say them in its
+ * own language. Placeholders are `{email}`, `{method}` and `{word}`; a product
+ * on next-intl passes `t.raw(...)`, which keeps them as written.
+ */
+/**
+ * The one password rule: a length. No character classes, no symbols — a
+ * longer password is the person's choice, not a gate (NIST SP 800-63B).
+ */
+export const MIN_PASSWORD_LENGTH = 8;
+export const DEFAULT_RECOVERY_LABELS = {
+    forgot: "Forgot your password?",
+    send: "Email me a reset link",
+    sent: "If an account can be recovered at that address, a reset link will arrive shortly. Check your inbox and spam folder.",
+    reset: "Reset password",
+    newPassword: "New password",
+    confirmPassword: "Repeat new password",
+    mismatch: "The passwords do not match. Enter the same password in both fields.",
+    invalidToken: "This reset link is invalid or has expired. Request a new link.",
+    success: "Your password has been changed. Sign in with your new password.",
+};
+export const DEFAULT_AUTH_LABELS = {
+    passwordVisibility: { show: "Show password", hide: "Hide password" },
+    recovery: DEFAULT_RECOVERY_LABELS,
+    signIn: "Sign in",
+    createAccount: "Create an account",
+    withSignin: "Continue with Google, Apple, GitHub, X or Facebook",
+    withOrangecat: "Continue with OrangeCat",
+    withPasskey: "Sign in with a passkey",
+    withLink: "Email me a sign-in link instead",
+    signUpWithLink: "Email me a link instead",
+    orEmail: "or with email",
+    email: "Email",
+    password: "Password",
+    passwordHint: "At least 8 characters.",
+    displayName: "Display name",
+    displayNameHint: "Optional. Anything you like — it does not have to be your real name.",
+    checkInbox: "We sent a link to {email}. Open it on this device to continue. It works for 10 minutes.",
+    confirmInbox: "We sent a link to {email}. Open it to confirm your address and finish creating your account.",
+    back: "Back",
+    totpPrompt: "Enter the 6-digit code from your authenticator app.",
+    backupPrompt: "Enter one of the backup codes you saved when you set up two-factor sign-in.",
+    totpCode: "Code",
+    backupCode: "Backup code",
+    trustDevice: "Trust this device for 30 days",
+    verify: "Verify",
+    useTotp: "Use the authenticator app instead",
+    useBackup: "Use a backup code instead",
+    resendVerification: "Send the confirmation link again",
+    noAccount: "No account yet?",
+    haveAccount: "Already have an account?",
+    errors: {
+        rateLimited: "Too many attempts. Wait a few minutes, then try again.",
+        unavailable: "Accounts are not available right now. Try again in a little while.",
+        generic: "That did not work. Try again, or choose another way to sign in.",
+        emailFirst: "Enter your email address first.",
+        INVALID_EMAIL_OR_PASSWORD: "That email and password do not match. Check both, or sign in with a link instead.",
+        EMAIL_NOT_VERIFIED: "Confirm your email address first — the link is in your inbox.",
+        USER_ALREADY_EXISTS: "There is already an account with this address. Sign in instead.",
+        USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL: "There is already an account with this address. Sign in instead.",
+        PASSWORD_TOO_SHORT: "The password needs at least 8 characters.",
+        PASSWORD_TOO_LONG: "The password can have at most 128 characters.",
+        INVALID_EMAIL: "That does not look like an email address.",
+        INVALID_CODE: "That code is not right, or it has expired. Try the newest one.",
+        INVALID_TWO_FACTOR_CODE: "That code is not right, or it has expired. Try the newest one.",
+        SESSION_EXPIRED: "For your safety, sign in again before changing this.",
+        INVALID_PASSWORD: "That password is not right.",
+    },
+    account: {
+        profile: "Profile",
+        noEmail: "none — add a password sign-in to use email",
+        unverified: "not confirmed yet",
+        role: "Role",
+        roles: {
+            customer: "Customer",
+            helper: "Helper",
+            professional: "Professional",
+            staff: "Staff",
+            admin: "Administrator",
+        },
+        save: "Save",
+        saved: "Saved.",
+        methods: "Ways to sign in",
+        methodPassword: "Email and password",
+        link: "Add {method}",
+        passkeys: "Passkeys",
+        passkeysLede: "Sign in with your fingerprint, face or device PIN instead of a password.",
+        passkeyDefaultName: "Passkey",
+        remove: "Remove",
+        addPasskey: "Add a passkey",
+        twoFactor: "Two-factor sign-in",
+        twoFactorOn: "On. Signing in asks for a code from your authenticator app.",
+        twoFactorOff: "Off. Turn it on to ask for a code from an authenticator app at every sign-in.",
+        currentPassword: "Current password",
+        currentPasswordHint: "Needed if your account has a password. Without one, sign in again first.",
+        scan: "Add this account to your authenticator app, then enter the code it shows.",
+        openAuthenticator: "Open in your authenticator app",
+        backupCodes: "Keep these backup codes somewhere safe. Each one works once if you lose your phone.",
+        turnOn: "Turn on",
+        turnOff: "Turn off",
+        setUp: "Set up",
+        leave: "Sign out or leave",
+        signOut: "Sign out",
+        deleteConfirm: "To delete your account and everything in it, type {word}",
+        deleteWord: "delete",
+        delete: "Delete my account",
+    },
+};
+/** Put values into a label: `fill("Hi {name}", { name: "Ada" })`. */
+export function fill(template, values) {
+    return template.replace(/\{(\w+)\}/g, (whole, key) => values[key] ?? whole);
+}
+const KNOWN = new Set([
+    "INVALID_EMAIL_OR_PASSWORD",
+    "EMAIL_NOT_VERIFIED",
+    "USER_ALREADY_EXISTS",
+    "USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL",
+    "PASSWORD_TOO_SHORT",
+    "PASSWORD_TOO_LONG",
+    "INVALID_EMAIL",
+    "INVALID_CODE",
+    "INVALID_TWO_FACTOR_CODE",
+    "SESSION_EXPIRED",
+    "INVALID_PASSWORD",
+]);
+/**
+ * A failure in words, never a raw code: what happened and what to do next.
+ * Unknown codes get the generic sentence — a provider's message can carry
+ * details the person should not be shown.
+ */
+export function authErrorText(labels, error) {
+    if (!error)
+        return null;
+    if (error.status === 429)
+        return labels.errors.rateLimited;
+    if (error.status === 503)
+        return labels.errors.unavailable;
+    if (error.code && KNOWN.has(error.code)) {
+        return labels.errors[error.code];
+    }
+    return labels.errors.generic;
+}
+//# sourceMappingURL=labels.js.map

package/dist/auth/labels.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"labels.js","sourceRoot":"","sources":["../../src/auth/labels.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAcrC,MAAM,CAAC,MAAM,uBAAuB,GAAmB;IACrD,MAAM,EAAE,uBAAuB;IAC/B,IAAI,EAAE,uBAAuB;IAC7B,IAAI,EAAE,qHAAqH;IAC3H,KAAK,EAAE,gBAAgB;IACvB,WAAW,EAAE,cAAc;IAC3B,eAAe,EAAE,qBAAqB;IACtC,QAAQ,EACN,qEAAqE;IACvE,YAAY,EACV,gEAAgE;IAClE,OAAO,EAAE,iEAAiE;CAC3E,CAAC;AAwFF,MAAM,CAAC,MAAM,mBAAmB,GAAe;IAC7C,kBAAkB,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,eAAe,EAAE;IACpE,QAAQ,EAAE,uBAAuB;IACjC,MAAM,EAAE,SAAS;IACjB,aAAa,EAAE,mBAAmB;IAClC,UAAU,EAAE,oDAAoD;IAChE,aAAa,EAAE,yBAAyB;IACxC,WAAW,EAAE,wBAAwB;IACrC,QAAQ,EAAE,iCAAiC;IAC3C,cAAc,EAAE,yBAAyB;IACzC,OAAO,EAAE,eAAe;IACxB,KAAK,EAAE,OAAO;IACd,QAAQ,EAAE,UAAU;IACpB,YAAY,EAAE,wBAAwB;IACtC,WAAW,EAAE,cAAc;IAC3B,eAAe,EACb,sEAAsE;IACxE,UAAU,EACR,yFAAyF;IAC3F,YAAY,EACV,8FAA8F;IAChG,IAAI,EAAE,MAAM;IACZ,UAAU,EAAE,qDAAqD;IACjE,YAAY,EACV,6EAA6E;IAC/E,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,aAAa;IACzB,WAAW,EAAE,+BAA+B;IAC5C,MAAM,EAAE,QAAQ;IAChB,OAAO,EAAE,mCAAmC;IAC5C,SAAS,EAAE,2BAA2B;IACtC,kBAAkB,EAAE,kCAAkC;IACtD,SAAS,EAAE,iBAAiB;IAC5B,WAAW,EAAE,0BAA0B;IACvC,MAAM,EAAE;QACN,WAAW,EAAE,wDAAwD;QACrE,WAAW,EACT,oEAAoE;QACtE,OAAO,EAAE,iEAAiE;QAC1E,UAAU,EAAE,iCAAiC;QAC7C,yBAAyB,EACvB,mFAAmF;QACrF,kBAAkB,EAChB,+DAA+D;QACjE,mBAAmB,EACjB,iEAAiE;QACnE,qCAAqC,EACnC,iEAAiE;QACnE,kBAAkB,EAAE,2CAA2C;QAC/D,iBAAiB,EAAE,+CAA+C;QAClE,aAAa,EAAE,2CAA2C;QAC1D,YAAY,EACV,gEAAgE;QAClE,uBAAuB,EACrB,gEAAgE;QAClE,eAAe,EAAE,sDAAsD;QACvE,gBAAgB,EAAE,6BAA6B;KAChD;IACD,OAAO,EAAE;QACP,OAAO,EAAE,SAAS;QAClB,OAAO,EAAE,4CAA4C;QACrD,UAAU,EAAE,mBAAmB;QAC/B,IAAI,EAAE,MAAM;QACZ,KAAK,EAAE;YACL,QAAQ,EAAE,UAAU;YACpB,MAAM,EAAE,QAAQ;YAChB,YAAY,EAAE,cAAc;YAC5B,KAAK,EAAE,OAAO;YACd,KAAK,EAAE,eAAe;SACvB;QACD,IAAI,EAAE,MAAM;QACZ,KAAK,EAAE,QAAQ;QACf,OAAO,EAAE,iBAAiB;QAC1B,cAAc,EAAE,oBAAoB;QACpC,IAAI,EAAE,cAAc;QACpB,QAAQ,EAAE,UAAU;QACpB,YAAY,EACV,0EAA0E;QAC5E,kBAAkB,EAAE,SAAS;QAC7B,MAAM,EAAE,QAAQ;QAChB,UAAU,EAAE,eAAe;QAC3B,SAAS,EAAE,oBAAoB;QAC/B,WAAW,EAAE,6DAA6D;QAC1E,YAAY,EACV,+EAA+E;QACjF,eAAe,EAAE,kBAAkB;QACnC,mBAAmB,EACjB,0EAA0E;QAC5E,IAAI,EAAE,2EAA2E;QACjF,iBAAiB,EAAE,gCAAgC;QACnD,WAAW,EACT,qFAAqF;QACvF,MAAM,EAAE,SAAS;QACjB,OAAO,EAAE,UAAU;QACnB,KAAK,EAAE,QAAQ;QACf,KAAK,EAAE,mBAAmB;QAC1B,OAAO,EAAE,UAAU;QACnB,aAAa,EAAE,0DAA0D;QACzE,UAAU,EAAE,QAAQ;QACpB,MAAM,EAAE,mBAAmB;KAC5B;CACF,CAAC;AAEF,qEAAqE;AACrE,MAAM,UAAU,IAAI,CAAC,QAAgB,EAAE,MAA8B;IACnE,OAAO,QAAQ,CAAC,OAAO,CACrB,YAAY,EACZ,CAAC,KAAK,EAAE,GAAW,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,KAAK,CAC7C,CAAC;AACJ,CAAC;AAMD,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC;IACpB,2BAA2B;IAC3B,oBAAoB;IACpB,qBAAqB;IACrB,uCAAuC;IACvC,oBAAoB;IACpB,mBAAmB;IACnB,eAAe;IACf,cAAc;IACd,yBAAyB;IACzB,iBAAiB;IACjB,kBAAkB;CACnB,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAC3B,MAAkB,EAClB,KAAgB;IAEhB,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC;IAC3D,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC;IAC3D,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAkC,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;AAC/B,CAAC"}

package/dist/auth/limits.d.ts

@@ -0,0 +1,28 @@
+import { type LimitResult } from "limitkit";
+/**
+ * Rate limits for the account endpoints, the same in every product.
+ *
+ * KEYED ON THE PROXY'S HOP, NEVER THE FIRST X-Forwarded-For ENTRY. limitkit's
+ * `clientIp()` reads the LAST hop, the one Caddy appended, which the caller
+ * cannot choose. `trustedProxies: 1` is Caddy on the box.
+ */
+export declare const authLimits: {
+    /** Guessing a password, a code or a passkey assertion. */
+    credential: import("limitkit").Limiter;
+    /** Anything that sends an email: protects inboxes and the shared quota. */
+    mail: import("limitkit").Limiter;
+    /** The same, per recipient, so rotating IPs cannot flood one inbox. */
+    mailTo: import("limitkit").Limiter;
+    /** Everything else under /api/auth (session reads, sign-out, listing). */
+    auth: import("limitkit").Limiter;
+};
+export type AuthBucket = "credential" | "mail" | "auth";
+/** Which bucket a better-auth path (after /api/auth) spends from. */
+export declare function authBucket(path: string): AuthBucket;
+export declare function callerKey(headers: Headers, scope: string): string;
+/** A recipient as a bucket key: hashed, so the limiter never holds an address. */
+export declare function recipientKey(email: string): string;
+export declare function tooMany(result: LimitResult): Response;
+/** Returns a Response to send INSTEAD of handling the request, or null to go on. */
+export declare function rateLimitAuthRequest(request: Request): Promise<Response | null>;
+//# sourceMappingURL=limits.d.ts.map

package/dist/auth/limits.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"limits.d.ts","sourceRoot":"","sources":["../../src/auth/limits.ts"],"names":[],"mappings":"AACA,OAAO,EAAsC,KAAK,WAAW,EAAE,MAAM,UAAU,CAAC;AAEhF;;;;;;GAMG;AACH,eAAO,MAAM,UAAU;IACrB,0DAA0D;;IAE1D,2EAA2E;;IAE3E,uEAAuE;;IAEvE,0EAA0E;;CAE3E,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG,YAAY,GAAG,MAAM,GAAG,MAAM,CAAC;AAwBxD,qEAAqE;AACrE,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,CAKnD;AAED,wBAAgB,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAEjE;AAED,kFAAkF;AAClF,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAElD;AAED,wBAAgB,OAAO,CAAC,MAAM,EAAE,WAAW,GAAG,QAAQ,CAQrD;AAeD,oFAAoF;AACpF,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAgB1B"}

package/dist/auth/limits.js

@@ -0,0 +1,90 @@
+import { createHash } from "node:crypto";
+import { clientIp, slidingWindow, toHeaders } from "limitkit";
+/**
+ * Rate limits for the account endpoints, the same in every product.
+ *
+ * KEYED ON THE PROXY'S HOP, NEVER THE FIRST X-Forwarded-For ENTRY. limitkit's
+ * `clientIp()` reads the LAST hop, the one Caddy appended, which the caller
+ * cannot choose. `trustedProxies: 1` is Caddy on the box.
+ */
+export const authLimits = {
+    /** Guessing a password, a code or a passkey assertion. */
+    credential: slidingWindow({ limit: 10, windowMs: 15 * 60_000 }),
+    /** Anything that sends an email: protects inboxes and the shared quota. */
+    mail: slidingWindow({ limit: 5, windowMs: 60 * 60_000 }),
+    /** The same, per recipient, so rotating IPs cannot flood one inbox. */
+    mailTo: slidingWindow({ limit: 3, windowMs: 60 * 60_000 }),
+    /** Everything else under /api/auth (session reads, sign-out, listing). */
+    auth: slidingWindow({ limit: 300, windowMs: 10 * 60_000 }),
+};
+const MAIL = new Set([
+    "/sign-up/email",
+    "/sign-in/magic-link",
+    "/send-verification-email",
+    "/request-password-reset",
+    "/forget-password",
+    "/change-email",
+]);
+const CREDENTIAL_PREFIXES = [
+    "/sign-in/email",
+    "/sign-in/social",
+    "/reset-password",
+    "/change-password",
+    "/verify-password",
+    "/two-factor/",
+    "/passkey/verify-authentication",
+    "/passkey/generate-authenticate-options",
+    "/magic-link/verify",
+    "/delete-user",
+];
+/** Which bucket a better-auth path (after /api/auth) spends from. */
+export function authBucket(path) {
+    if (MAIL.has(path))
+        return "mail";
+    if (CREDENTIAL_PREFIXES.some((p) => path === p || path.startsWith(p)))
+        return "credential";
+    return "auth";
+}
+export function callerKey(headers, scope) {
+    return `${scope}:${clientIp(headers, { trustedProxies: 1 })}`;
+}
+/** A recipient as a bucket key: hashed, so the limiter never holds an address. */
+export function recipientKey(email) {
+    return `mail-to:${createHash("sha256").update(email.trim().toLowerCase()).digest("hex")}`;
+}
+export function tooMany(result) {
+    return Response.json({ error: "rate_limited", retryAfterSeconds: result.retryAfterSeconds }, {
+        status: 429,
+        headers: { ...toHeaders(result), "Cache-Control": "no-store" },
+    });
+}
+/** The address a mail-sending request would write to, read from a CLONE of its body. */
+async function recipientOf(request) {
+    try {
+        const body = await request.clone().json();
+        const fields = body ?? {};
+        const value = typeof fields.email === "string" ? fields.email : fields.newEmail;
+        return typeof value === "string" && value.includes("@") ? value : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Returns a Response to send INSTEAD of handling the request, or null to go on. */
+export async function rateLimitAuthRequest(request) {
+    const path = new URL(request.url).pathname.replace(/^\/api\/auth/, "") || "/";
+    const bucket = request.method === "GET" ? "auth" : authBucket(path);
+    const byCaller = authLimits[bucket].check(callerKey(request.headers, `auth-${bucket}`));
+    if (!byCaller.allowed)
+        return tooMany(byCaller);
+    if (bucket === "mail") {
+        const email = await recipientOf(request);
+        if (email) {
+            const byRecipient = authLimits.mailTo.check(recipientKey(email));
+            if (!byRecipient.allowed)
+                return tooMany(byRecipient);
+        }
+    }
+    return null;
+}
+//# sourceMappingURL=limits.js.map

package/dist/auth/limits.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"limits.js","sourceRoot":"","sources":["../../src/auth/limits.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,SAAS,EAAoB,MAAM,UAAU,CAAC;AAEhF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,0DAA0D;IAC1D,UAAU,EAAE,aAAa,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,MAAM,EAAE,CAAC;IAC/D,2EAA2E;IAC3E,IAAI,EAAE,aAAa,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG,MAAM,EAAE,CAAC;IACxD,uEAAuE;IACvE,MAAM,EAAE,aAAa,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG,MAAM,EAAE,CAAC;IAC1D,0EAA0E;IAC1E,IAAI,EAAE,aAAa,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,GAAG,MAAM,EAAE,CAAC;CAC3D,CAAC;AAIF,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC;IACnB,gBAAgB;IAChB,qBAAqB;IACrB,0BAA0B;IAC1B,yBAAyB;IACzB,kBAAkB;IAClB,eAAe;CAChB,CAAC,CAAC;AAEH,MAAM,mBAAmB,GAAG;IAC1B,gBAAgB;IAChB,iBAAiB;IACjB,iBAAiB;IACjB,kBAAkB;IAClB,kBAAkB;IAClB,cAAc;IACd,gCAAgC;IAChC,wCAAwC;IACxC,oBAAoB;IACpB,cAAc;CACf,CAAC;AAEF,qEAAqE;AACrE,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC;IAClC,IAAI,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QACnE,OAAO,YAAY,CAAC;IACtB,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,OAAgB,EAAE,KAAa;IACvD,OAAO,GAAG,KAAK,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;AAChE,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,OAAO,WAAW,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AAC5F,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,MAAmB;IACzC,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,KAAK,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,EAAE,EACtE;QACE,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,EAAE,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE,eAAe,EAAE,UAAU,EAAE;KAC/D,CACF,CAAC;AACJ,CAAC;AAED,wFAAwF;AACxF,KAAK,UAAU,WAAW,CAAC,OAAgB;IACzC,IAAI,CAAC;QACH,MAAM,IAAI,GAAY,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC;QACnD,MAAM,MAAM,GAAI,IAAgD,IAAI,EAAE,CAAC;QACvE,MAAM,KAAK,GACT,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC;QACpE,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IACzE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAgB;IAEhB,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC;IAC9E,MAAM,MAAM,GACV,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,KAAK,CACvC,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,MAAM,EAAE,CAAC,CAC7C,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,OAAO;QAAE,OAAO,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChD,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,WAAW,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;YACjE,IAAI,CAAC,WAAW,CAAC,OAAO;gBAAE,OAAO,OAAO,CAAC,WAAW,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/auth/mail.d.ts

@@ -0,0 +1,10 @@
+import type { AuthMailer, AuthMailKind, AuthSite } from "./server.js";
+export interface AuthMailOptions {
+    site: Pick<AuthSite, "title" | "url">;
+    /** Read lazily so a build never captures deployment credentials. */
+    env?: () => Record<string, string | undefined>;
+    subjects?: Partial<Record<AuthMailKind, string>>;
+}
+/** Shared account-mail adapter; a no-op sender is never reported as configured. */
+export declare function createAuthMailer(options: AuthMailOptions): AuthMailer;
+//# sourceMappingURL=mail.d.ts.map

package/dist/auth/mail.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mail.d.ts","sourceRoot":"","sources":["../../src/auth/mail.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEtE,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,GAAG,KAAK,CAAC,CAAC;IACtC,oEAAoE;IACpE,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IAC/C,QAAQ,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;CAClD;AAED,mFAAmF;AACnF,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,eAAe,GAAG,UAAU,CAgDrE"}

package/dist/auth/mail.js

@@ -0,0 +1,45 @@
+import { conventionalFrom, isMailConfigured, sendMail, } from "@bitbaum/mail-kit";
+/** Shared account-mail adapter; a no-op sender is never reported as configured. */
+export function createAuthMailer(options) {
+    const env = () => {
+        const values = options.env?.() ?? process.env;
+        return {
+            ...values,
+            APP_URL: options.site.url,
+            RESEND_FROM: values.RESEND_FROM || conventionalFrom(options.site.title),
+        };
+    };
+    const subjects = {
+        verify: `Confirm your email for ${options.site.title}`,
+        magicLink: `Sign in to ${options.site.title}`,
+        reset: `Reset your ${options.site.title} password`,
+        ...options.subjects,
+    };
+    return {
+        get configured() {
+            return isMailConfigured(env());
+        },
+        async send(kind, to, url) {
+            // Refuse unexpected origins before sending a bearer credential by email.
+            let sameOrigin = false;
+            try {
+                sameOrigin = new URL(url).origin === new URL(options.site.url).origin;
+            }
+            catch {
+                /* Invalid links must never reach a recipient. */
+            }
+            if (!sameOrigin) {
+                console.error("[auth] refusing account email with an unexpected origin");
+                return;
+            }
+            const result = await sendMail({
+                to,
+                subject: subjects[kind],
+                text: `${subjects[kind]}\n\n${url}\n\nIf you did not request this, you can ignore this email.`,
+            }, { env: env() });
+            if (!result.sent)
+                console.error("[auth] account email delivery failed", result.status ?? "transport");
+        },
+    };
+}
+//# sourceMappingURL=mail.js.map

package/dist/auth/mail.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mail.js","sourceRoot":"","sources":["../../src/auth/mail.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,QAAQ,GACT,MAAM,mBAAmB,CAAC;AAU3B,mFAAmF;AACnF,MAAM,UAAU,gBAAgB,CAAC,OAAwB;IACvD,MAAM,GAAG,GAAG,GAAG,EAAE;QACf,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,OAAO,CAAC,GAAG,CAAC;QAC9C,OAAO;YACL,GAAG,MAAM;YACT,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG;YACzB,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;SACxE,CAAC;IACJ,CAAC,CAAC;IACF,MAAM,QAAQ,GAAiC;QAC7C,MAAM,EAAE,0BAA0B,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE;QACtD,SAAS,EAAE,cAAc,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE;QAC7C,KAAK,EAAE,cAAc,OAAO,CAAC,IAAI,CAAC,KAAK,WAAW;QAClD,GAAG,OAAO,CAAC,QAAQ;KACpB,CAAC;IACF,OAAO;QACL,IAAI,UAAU;YACZ,OAAO,gBAAgB,CAAC,GAAG,EAAE,CAAC,CAAC;QACjC,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG;YACtB,yEAAyE;YACzE,IAAI,UAAU,GAAG,KAAK,CAAC;YACvB,IAAI,CAAC;gBACH,UAAU,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;YACxE,CAAC;YAAC,MAAM,CAAC;gBACP,iDAAiD;YACnD,CAAC;YACD,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,OAAO,CAAC,KAAK,CACX,yDAAyD,CAC1D,CAAC;gBACF,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAC3B;gBACE,EAAE;gBACF,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC;gBACvB,IAAI,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,GAAG,6DAA6D;aAC/F,EACD,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,CACf,CAAC;YACF,IAAI,CAAC,MAAM,CAAC,IAAI;gBACd,OAAO,CAAC,KAAK,CACX,sCAAsC,EACtC,MAAM,CAAC,MAAM,IAAI,WAAW,CAC7B,CAAC;QACN,CAAC;KACF,CAAC;AACJ,CAAC"}