@bitbaum/accountkit 0.17.0 → 0.18.0

package/README.md

@@ -257,6 +257,46 @@ product's hashes; `verify` answers whether the password fits. It works alone or
 beside `legacyBcrypt`, and new passwords are native scrypt either way.
 
 
+### Moving a product off Auth.js
+
+A product whose pages call `next-auth/react` can run on the shared runtime
+before any page changes. `@bitbaum/accountkit/auth/nextauth-compat` answers
+that client protocol (`session`, `csrf`, `providers`, `signout`, each
+credentials callback, and `signin/<oidc>` for every configured OIDC client)
+from AccountKit:
+
+```ts
+const compat = createNextAuthCompat({
+  runtime: sharedAuth, // createAuthRuntime(...)
+  siteUrl: () => process.env.AUTH_URL!,
+  signInPath: "/login",
+  landing: "/dashboard",
+  toSession: async (shared) => productSessionFromRows(shared.user.id),
+  credentials: {
+    credentials: { name: "Email", resolve: async (form) => ({ email: String(form.get("email")) }) },
+  },
+});
+// app/api/auth/[...nextauth]/route.ts, with the switch on:
+export const { GET, POST } = compat.route;
+```
+
+The product supplies only what is its own: the session shape (re-read from
+its rows on every request), which address each credentials form signs in (or
+a refusal code such as an account lock), the codes its login page reads, and
+hooks after a sign-in or a refusal. `sharedRuntimeEnabled()` (`@bitbaum/accountkit/auth/switch`) reads the one
+switch, `AUTH_RUNTIME=accountkit`. `sessionFor(headers)` serves a proxy,
+`currentSession()` a server component, and `sessionIdFor(headers)` names the
+session making a change so the product can keep it while ending the others.
+AccountKit's own sign-up, reset and password endpoints answer 404 through it,
+so the product's writers stay the only ones until it adopts AccountKit's
+screens.
+
+`accountkit-rehearse-import <import.sql>` runs a product's own import SQL
+against `DATABASE_URL` in one transaction that always rolls back, and prints
+only counts. It uses the product's `pg` or `postgres` driver.
+`@bitbaum/accountkit/auth/compat-testing` gives journey tests a client that
+speaks what `next-auth/react` sends and keeps the cookie jar.
+
 ### A product's own plugins
 
 `plugins` (both `createAuthRuntime` and `createAuthInstance`) mounts a

package/dist/auth/compat-testing.d.ts

@@ -0,0 +1,51 @@
+/**
+ * A browser stand-in for journey tests of a product on the compat layer: it
+ * speaks what `next-auth/react` sends, keeps the cookie jar between calls,
+ * and gives each request its own client address so AccountKit's limiter
+ * never trips inside one test file.
+ *
+ *   const client = createCompatClient({ compat, site: "https://app.example.test" });
+ *   const result = await client.signIn("credentials", { email, password });
+ *   expect(client.refusal(result)).toBeNull();
+ *   expect((await client.session())?.user.id).toBe(id);
+ */
+/** What the client needs from `createNextAuthCompat(...)`. */
+export interface CompatRoute {
+    route: {
+        GET: (request: Request) => Promise<Response>;
+        POST: (request: Request) => Promise<Response>;
+    };
+}
+export declare function createCompatClient(options: {
+    compat: CompatRoute;
+    site: string;
+}): {
+    call: (route: string, form?: Record<string, string>) => Promise<Response>;
+    /** The jar as a Cookie header, to hand to server-side helpers. */
+    cookie: string;
+    /** signIn(provider, { redirect: false }) as next-auth/react posts it. */
+    signIn(provider: string, fields: Record<string, string>, callbackUrl?: string): Promise<{
+        url: string;
+    }>;
+    /** signOut({ redirect: false, callbackUrl }) as next-auth/react posts it. */
+    signOut(callbackUrl?: string): Promise<{
+        url: string;
+    }>;
+    /** getSession(): the product session, or null. */
+    session<S = {
+        user: Record<string, unknown>;
+    }>(): Promise<S | null>;
+    /** useSession().update(): the same fresh read, posted. */
+    update<S = {
+        user: Record<string, unknown>;
+    }>(): Promise<S | null>;
+    /** The `error` a sign-in answer carries for the login page, or null on success. */
+    refusal(result: {
+        url: string;
+    }): string | null;
+    /** The login page's `code` from a refused sign-in. */
+    code(result: {
+        url: string;
+    }): string | null;
+};
+//# sourceMappingURL=compat-testing.d.ts.map

package/dist/auth/compat-testing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"compat-testing.d.ts","sourceRoot":"","sources":["../../src/auth/compat-testing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,8DAA8D;AAC9D,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE;QACL,GAAG,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC7C,IAAI,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;KAC/C,CAAC;CACH;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE;IAC1C,MAAM,EAAE,WAAW,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;CACd;kBAqBU,MAAM,SACN,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAC5B,OAAO,CAAC,QAAQ,CAAC;IAsBlB,kEAAkE;YAKhD,MAAM;IAOxB,yEAAyE;qBAE7D,MAAM,UACR,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;aAQW,MAAM;;IAEjD,6EAA6E;;aAMlC,MAAM;;IAEjD,kDAAkD;YACpC,CAAC;cAAW,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;UAAO,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;IAGzE,0DAA0D;WAC7C,CAAC;cAAW,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;UAAO,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;IAKxE,mFAAmF;oBACnE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM,GAAG,IAAI;IAG/C,sDAAsD;iBACzC;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM,GAAG,IAAI;EAI/C"}

package/dist/auth/compat-testing.js

@@ -0,0 +1,97 @@
+/**
+ * A browser stand-in for journey tests of a product on the compat layer: it
+ * speaks what `next-auth/react` sends, keeps the cookie jar between calls,
+ * and gives each request its own client address so AccountKit's limiter
+ * never trips inside one test file.
+ *
+ *   const client = createCompatClient({ compat, site: "https://app.example.test" });
+ *   const result = await client.signIn("credentials", { email, password });
+ *   expect(client.refusal(result)).toBeNull();
+ *   expect((await client.session())?.user.id).toBe(id);
+ */
+export function createCompatClient(options) {
+    const jar = new Map();
+    let ip = 0;
+    const cookieHeader = () => [...jar].map(([name, value]) => `${name}=${value}`).join("; ");
+    function keep(response) {
+        for (const set of response.headers.getSetCookie()) {
+            const [pair] = set.split(";");
+            const at = pair.indexOf("=");
+            const name = pair.slice(0, at);
+            const value = pair.slice(at + 1);
+            if (/max-age=0/i.test(set) || value === "")
+                jar.delete(name);
+            else
+                jar.set(name, value);
+        }
+        return response;
+    }
+    /** One request to /api/auth{route}: a form POST when `form` is given, else a GET. */
+    async function call(route, form) {
+        ip += 1;
+        const headers = new Headers({
+            origin: options.site,
+            "x-forwarded-for": `198.51.100.${ip % 250}`,
+            cookie: cookieHeader(),
+        });
+        if (form)
+            headers.set("content-type", "application/x-www-form-urlencoded");
+        const request = new Request(`${options.site}/api/auth${route}`, {
+            method: form ? "POST" : "GET",
+            headers,
+            body: form ? new URLSearchParams(form) : undefined,
+        });
+        return keep(await (form
+            ? options.compat.route.POST(request)
+            : options.compat.route.GET(request)));
+    }
+    return {
+        call,
+        /** The jar as a Cookie header, to hand to server-side helpers. */
+        get cookie() {
+            return cookieHeader();
+        },
+        /** Replace the jar (switch between people), from a Cookie header. */
+        set cookie(value) {
+            jar.clear();
+            for (const part of value.split("; ").filter(Boolean)) {
+                const at = part.indexOf("=");
+                jar.set(part.slice(0, at), part.slice(at + 1));
+            }
+        },
+        /** signIn(provider, { redirect: false }) as next-auth/react posts it. */
+        async signIn(provider, fields, callbackUrl = `${options.site}/`) {
+            const response = await call(`/callback/${provider}`, {
+                ...fields,
+                csrfToken: "test",
+                callbackUrl,
+            });
+            return (await response.json());
+        },
+        /** signOut({ redirect: false, callbackUrl }) as next-auth/react posts it. */
+        async signOut(callbackUrl = `${options.site}/`) {
+            const response = await call("/signout", {
+                csrfToken: "test",
+                callbackUrl,
+            });
+            return (await response.json());
+        },
+        /** getSession(): the product session, or null. */
+        async session() {
+            return (await (await call("/session")).json());
+        },
+        /** useSession().update(): the same fresh read, posted. */
+        async update() {
+            return (await (await call("/session", { data: "{}" })).json());
+        },
+        /** The `error` a sign-in answer carries for the login page, or null on success. */
+        refusal(result) {
+            return new URL(result.url).searchParams.get("error");
+        },
+        /** The login page's `code` from a refused sign-in. */
+        code(result) {
+            return new URL(result.url).searchParams.get("code");
+        },
+    };
+}
+//# sourceMappingURL=compat-testing.js.map

package/dist/auth/compat-testing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"compat-testing.js","sourceRoot":"","sources":["../../src/auth/compat-testing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAUH,MAAM,UAAU,kBAAkB,CAAC,OAGlC;IACC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;IACtC,IAAI,EAAE,GAAG,CAAC,CAAC;IAEX,MAAM,YAAY,GAAG,GAAG,EAAE,CACxB,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEjE,SAAS,IAAI,CAAC,QAAkB;QAC9B,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC;YAClD,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC9B,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;YACjC,IAAI,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,KAAK,EAAE;gBAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;;gBACxD,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC5B,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,qFAAqF;IACrF,KAAK,UAAU,IAAI,CACjB,KAAa,EACb,IAA6B;QAE7B,EAAE,IAAI,CAAC,CAAC;QACR,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC;YAC1B,MAAM,EAAE,OAAO,CAAC,IAAI;YACpB,iBAAiB,EAAE,cAAc,EAAE,GAAG,GAAG,EAAE;YAC3C,MAAM,EAAE,YAAY,EAAE;SACvB,CAAC,CAAC;QACH,IAAI,IAAI;YAAE,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,mCAAmC,CAAC,CAAC;QAC3E,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,YAAY,KAAK,EAAE,EAAE;YAC9D,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK;YAC7B,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;SACnD,CAAC,CAAC;QACH,OAAO,IAAI,CACT,MAAM,CAAC,IAAI;YACT,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC;YACpC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CACvC,CAAC;IACJ,CAAC;IAED,OAAO;QACL,IAAI;QACJ,kEAAkE;QAClE,IAAI,MAAM;YACR,OAAO,YAAY,EAAE,CAAC;QACxB,CAAC;QACD,qEAAqE;QACrE,IAAI,MAAM,CAAC,KAAa;YACtB,GAAG,CAAC,KAAK,EAAE,CAAC;YACZ,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;gBACrD,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBAC7B,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;YACjD,CAAC;QACH,CAAC;QACD,yEAAyE;QACzE,KAAK,CAAC,MAAM,CACV,QAAgB,EAChB,MAA8B,EAC9B,WAAW,GAAG,GAAG,OAAO,CAAC,IAAI,GAAG;YAEhC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,QAAQ,EAAE,EAAE;gBACnD,GAAG,MAAM;gBACT,SAAS,EAAE,MAAM;gBACjB,WAAW;aACZ,CAAC,CAAC;YACH,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAoB,CAAC;QACpD,CAAC;QACD,6EAA6E;QAC7E,KAAK,CAAC,OAAO,CAAC,WAAW,GAAG,GAAG,OAAO,CAAC,IAAI,GAAG;YAC5C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE;gBACtC,SAAS,EAAE,MAAM;gBACjB,WAAW;aACZ,CAAC,CAAC;YACH,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAoB,CAAC;QACpD,CAAC;QACD,kDAAkD;QAClD,KAAK,CAAC,OAAO;YACX,OAAO,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,CAAa,CAAC;QAC7D,CAAC;QACD,0DAA0D;QAC1D,KAAK,CAAC,MAAM;YACV,OAAO,CAAC,MAAM,CACZ,MAAM,IAAI,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CACvC,CAAC,IAAI,EAAE,CAAa,CAAC;QACxB,CAAC;QACD,mFAAmF;QACnF,OAAO,CAAC,MAAuB;YAC7B,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACvD,CAAC;QACD,sDAAsD;QACtD,IAAI,CAAC,MAAuB;YAC1B,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACtD,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/auth/import-rehearsal.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Rehearse a product's account import (its own SQL, which copies its people
+ * into AccountKit's tables) inside one transaction that always rolls back,
+ * and report only counts. Constraint errors can carry addresses or hashes, so
+ * a failure reports a fixed sentence and never the database's message.
+ *
+ * The product's SQL refuses drift, collisions and a live shared runtime itself;
+ * this only runs it and counts what it would have written.
+ */
+/** Runs one SQL text inside the rehearsal's transaction and returns its rows. */
+export type RehearsalQuery = (text: string) => Promise<Record<string, unknown>[]>;
+export interface RehearsalCounts {
+    rehearsal: "rolled_back";
+    accounts: number;
+    verified_addresses: number;
+    password_accounts: number;
+    /** Linked sign-in providers other than passwords, by provider id. */
+    linked: Record<string, number>;
+}
+/** The counts the import left in the shared tables, read before rolling back. */
+export declare function countsSql(prefix?: string): string;
+/**
+ * Open a transaction with `begin`, run the import and the counts through the
+ * query it provides, then roll back. `begin` must roll back when its callback
+ * throws (postgres-js `sql.begin`, or the pg adapter in ../bin).
+ */
+export declare function rehearseImport(options: {
+    begin: (work: (query: RehearsalQuery) => Promise<void>) => Promise<void>;
+    sql: string;
+    prefix?: string;
+}): Promise<RehearsalCounts>;
+//# sourceMappingURL=import-rehearsal.d.ts.map

package/dist/auth/import-rehearsal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"import-rehearsal.d.ts","sourceRoot":"","sources":["../../src/auth/import-rehearsal.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,iFAAiF;AACjF,MAAM,MAAM,cAAc,GAAG,CAC3B,IAAI,EAAE,MAAM,KACT,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;AAExC,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,aAAa,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChC;AAID,iFAAiF;AACjF,wBAAgB,SAAS,CAAC,MAAM,SAAU,GAAG,MAAM,CAUlD;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAAE;IAC5C,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACzE,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GAAG,OAAO,CAAC,eAAe,CAAC,CAgC3B"}

package/dist/auth/import-rehearsal.js

@@ -0,0 +1,59 @@
+/**
+ * Rehearse a product's account import (its own SQL, which copies its people
+ * into AccountKit's tables) inside one transaction that always rolls back,
+ * and report only counts. Constraint errors can carry addresses or hashes, so
+ * a failure reports a fixed sentence and never the database's message.
+ *
+ * The product's SQL refuses drift, collisions and a live shared runtime itself;
+ * this only runs it and counts what it would have written.
+ */
+const ROLLBACK = Symbol("rollback");
+/** The counts the import left in the shared tables, read before rolling back. */
+export function countsSql(prefix = "auth_") {
+    if (!/^[a-z_]*$/.test(prefix))
+        throw new Error("table prefix must be lower-case letters and _");
+    return `SELECT
+    (SELECT count(*)::int FROM ${prefix}users) AS accounts,
+    (SELECT count(*)::int FROM ${prefix}users WHERE email_verified) AS verified_addresses,
+    (SELECT count(*)::int FROM ${prefix}accounts WHERE provider_id = 'credential') AS password_accounts,
+    (SELECT coalesce(json_object_agg(provider_id, n), '{}'::json) FROM
+      (SELECT provider_id, count(*)::int AS n FROM ${prefix}accounts
+       WHERE provider_id <> 'credential' GROUP BY provider_id) linked) AS linked`;
+}
+/**
+ * Open a transaction with `begin`, run the import and the counts through the
+ * query it provides, then roll back. `begin` must roll back when its callback
+ * throws (postgres-js `sql.begin`, or the pg adapter in ../bin).
+ */
+export async function rehearseImport(options) {
+    let counts;
+    try {
+        await options.begin(async (query) => {
+            await query("SET LOCAL lock_timeout = '5s'");
+            await query("SET LOCAL statement_timeout = '30s'");
+            await query(options.sql);
+            const [row] = await query(countsSql(options.prefix));
+            counts = {
+                rehearsal: "rolled_back",
+                accounts: Number(row.accounts),
+                verified_addresses: Number(row.verified_addresses),
+                password_accounts: Number(row.password_accounts),
+                linked: (row.linked ?? {}),
+            };
+            throw ROLLBACK;
+        });
+    }
+    catch (error) {
+        if (error !== ROLLBACK) {
+            // The message is fixed (the database's can carry addresses or hashes);
+            // the cause stays attached for a debugger, never printed by the CLI.
+            throw new Error("Account import rehearsal failed; transaction rolled back", {
+                cause: error,
+            });
+        }
+    }
+    if (!counts)
+        throw new Error("Account import rehearsal failed; transaction rolled back");
+    return counts;
+}
+//# sourceMappingURL=import-rehearsal.js.map

package/dist/auth/import-rehearsal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"import-rehearsal.js","sourceRoot":"","sources":["../../src/auth/import-rehearsal.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAgBH,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;AAEpC,iFAAiF;AACjF,MAAM,UAAU,SAAS,CAAC,MAAM,GAAG,OAAO;IACxC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,OAAO;iCACwB,MAAM;iCACN,MAAM;iCACN,MAAM;;qDAEc,MAAM;iFACsB,CAAC;AAClF,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAIpC;IACC,IAAI,MAAmC,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YAClC,MAAM,KAAK,CAAC,+BAA+B,CAAC,CAAC;YAC7C,MAAM,KAAK,CAAC,qCAAqC,CAAC,CAAC;YACnD,MAAM,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACzB,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;YACrD,MAAM,GAAG;gBACP,SAAS,EAAE,aAAa;gBACxB,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAC9B,kBAAkB,EAAE,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC;gBAClD,iBAAiB,EAAE,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC;gBAChD,MAAM,EAAE,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAA2B;aACrD,CAAC;YACF,MAAM,QAAQ,CAAC;QACjB,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;YACvB,uEAAuE;YACvE,qEAAqE;YACrE,MAAM,IAAI,KAAK,CACb,0DAA0D,EAC1D;gBACE,KAAK,EAAE,KAAK;aACb,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,CAAC,MAAM;QACT,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/auth/nextauth-compat.d.ts

@@ -0,0 +1,123 @@
+import type { AuthSession } from "./next.js";
+/**
+ * A product's existing screens on the shared runtime, unchanged.
+ *
+ * Products that grew up on Auth.js call `next-auth/react` (signIn, signOut,
+ * useSession, update) from every page. While they move to AccountKit one
+ * reversible step at a time, this answers that client protocol from the
+ * AccountKit runtime, so no page has to learn a second protocol and no Auth.js
+ * credential writer runs beside the shared one.
+ *
+ *   const compat = createNextAuthCompat({ runtime: sharedAuth, siteUrl, ... });
+ *   // /api/auth/[...nextauth]/route.ts, with the switch on:
+ *   export const { GET, POST } = compat.route;
+ *
+ * Only what the screens use is open. AccountKit's own sign-up, reset and
+ * password endpoints answer 404 until the product adopts AccountKit's screens:
+ * a second credential writer would put hashes in the shared table that the
+ * product's own table never sees, and rolling back would lose them.
+ */
+/** The shared runtime, as `createAuthRuntime` returns it. */
+export interface CompatRuntime {
+    GET: (request: Request) => Promise<Response>;
+    POST: (request: Request) => Promise<Response>;
+    sessionFor: (headers: Headers) => Promise<AuthSession | null>;
+    getSession: () => Promise<AuthSession | null>;
+}
+/** Why a sign-in was refused; the product maps each to the code its login page reads. */
+export type RefusalReason = "missing" | "credentials" | "rate_limited" | "unavailable" | "email_unverified";
+/** A credentials provider: what the form is called and which address it signs in. */
+export interface CompatCredentialsProvider {
+    /** The provider's display name in /providers. */
+    name: string;
+    /**
+     * The address this form signs in, or a refusal code the login page reads
+     * (an account lock, say), or null for "missing input". The password is read
+     * by the compat layer from the form's `password` field.
+     */
+    resolve: (form: FormData) => Promise<{
+        email: string;
+    } | {
+        refuse: string;
+    } | null>;
+}
+export interface SignInEvent {
+    provider: string;
+    email: string;
+    user: {
+        id: string;
+        name?: string | null;
+    };
+}
+export interface RefusalEvent {
+    provider: string;
+    email: string;
+    status: number;
+    reason: RefusalReason;
+}
+export interface NextAuthCompatOptions<S> {
+    runtime: CompatRuntime;
+    /** The public origin, read at request time (redirects and AccountKit's origin check). */
+    siteUrl: () => string;
+    /** Where a refusal sends the person (the product's sign-in page). */
+    signInPath: string;
+    /** Where a sign-in lands when the page named no same-origin callbackUrl. */
+    landing: string;
+    /**
+     * The product's session shape from a shared session, re-read from the
+     * product's own rows on every request; null when the person no longer exists.
+     */
+    toSession: (shared: AuthSession) => Promise<S | null>;
+    /** next-auth credentials provider id → how it signs in. */
+    credentials: Record<string, CompatCredentialsProvider>;
+    /** The code the login page reads for each refusal (default: the reason itself). */
+    codes?: Partial<Record<RefusalReason, string>>;
+    /** After a successful credentials sign-in: lockout reset, onboarding, logs. */
+    onSignedIn?: (event: SignInEvent) => Promise<void>;
+    /** After AccountKit refused a password: failed-attempt counters, logs. */
+    onRefused?: (event: RefusalEvent) => Promise<void>;
+    /**
+     * Whether an OIDC sign-in by a person who is already signed in links the
+     * identity to them ("Connect OrangeCat") instead of signing in. Default: yes.
+     */
+    linkWhenSignedIn?: (request: Request, session: S) => boolean | Promise<boolean>;
+    /** Where a failed link returns (default: the page it started from). */
+    linkErrorPath?: string;
+    /** The env OIDC providers are read from (default: process.env). */
+    env?: () => Record<string, string | undefined>;
+}
+/** One AccountKit endpoint's answer, for the compat layer to translate. */
+export interface SharedAnswer {
+    status: number;
+    body: Record<string, unknown>;
+    cookies: string[];
+}
+/** AccountKit endpoints the screens reach directly; everything else answers 404. */
+export declare function compatPathIsOpen(path: string): boolean;
+/** A same-origin path from a client-supplied URL, or `fallback`. */
+export declare function sameOriginPath(raw: FormDataEntryValue | string | null | undefined, site: string, fallback: string): string;
+export declare function createNextAuthCompat<S>(options: NextAuthCompatOptions<S>): {
+    handle: (request: Request) => Promise<Response | null>;
+    /** /api/auth/* with the switch on: the compat answer, else the runtime. */
+    route: {
+        GET: (request: Request) => Promise<Response>;
+        POST: (request: Request) => Promise<Response>;
+    };
+    callShared: (request: Request, route: string, body: Record<string, unknown>) => Promise<SharedAnswer>;
+    sessionFor: (requestHeaders: Headers) => Promise<S | null>;
+    sessionIdFor: (requestHeaders: Headers) => Promise<string | null>;
+    currentSession: () => Promise<S | null>;
+    oidcSignIn: (request: Request, providerId: string, next: string) => Promise<{
+        url: string | null;
+        cookies: string[];
+    }>;
+    providers: () => Record<string, {
+        id: string;
+        name: string;
+        type: string;
+        signinUrl: string;
+        callbackUrl: string;
+    }>;
+};
+export type NextAuthCompat<S> = ReturnType<typeof createNextAuthCompat<S>>;
+//# sourceMappingURL=nextauth-compat.d.ts.map

package/dist/auth/nextauth-compat.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nextauth-compat.d.ts","sourceRoot":"","sources":["../../src/auth/nextauth-compat.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAE7C;;;;;;;;;;;;;;;;;GAiBG;AAEH,6DAA6D;AAC7D,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC9C,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAC9D,UAAU,EAAE,MAAM,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;CAC/C;AAED,yFAAyF;AACzF,MAAM,MAAM,aAAa,GACrB,SAAS,GACT,aAAa,GACb,cAAc,GACd,aAAa,GACb,kBAAkB,CAAC;AAEvB,qFAAqF;AACrF,MAAM,WAAW,yBAAyB;IACxC,iDAAiD;IACjD,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,OAAO,EAAE,CACP,IAAI,EAAE,QAAQ,KACX,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;CAC7D;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;CAC5C;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,aAAa,CAAC;CACvB;AAED,MAAM,WAAW,qBAAqB,CAAC,CAAC;IACtC,OAAO,EAAE,aAAa,CAAC;IACvB,yFAAyF;IACzF,OAAO,EAAE,MAAM,MAAM,CAAC;IACtB,qEAAqE;IACrE,UAAU,EAAE,MAAM,CAAC;IACnB,4EAA4E;IAC5E,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,SAAS,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACtD,2DAA2D;IAC3D,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC;IACvD,mFAAmF;IACnF,KAAK,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC;IAC/C,+EAA+E;IAC/E,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD,0EAA0E;IAC1E,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD;;;OAGG;IACH,gBAAgB,CAAC,EAAE,CACjB,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,CAAC,KACP,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAChC,uEAAuE;IACvE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mEAAmE;IACnE,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;CAChD;AAED,2EAA2E;AAC3E,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAUD,oFAAoF;AACpF,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEtD;AAED,oEAAoE;AACpE,wBAAgB,cAAc,CAC5B,GAAG,EAAE,kBAAkB,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,EACnD,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,GACf,MAAM,CASR;AAkBD,wBAAgB,oBAAoB,CAAC,CAAC,EAAE,OAAO,EAAE,qBAAqB,CAAC,CAAC,CAAC;sBAoNxC,OAAO,KAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAwF/D,2EAA2E;;uBAEpD,OAAO;wBAEN,OAAO;;0BAxStB,OAAO,SACT,MAAM,QACP,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC5B,OAAO,CAAC,YAAY,CAAC;iCAkCkB,OAAO,KAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;mCAOzB,OAAO,KAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;0BAMrC,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;0BA2C7C,OAAO,cACJ,MAAM,QACZ,MAAM,KACX,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;;;;;;;;EAkNtD;AAED,MAAM,MAAM,cAAc,CAAC,CAAC,IAAI,UAAU,CAAC,OAAO,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC"}

package/dist/auth/nextauth-compat.js

@@ -0,0 +1,265 @@
+import * as React from "react";
+import { oidcClients } from "./methods.js";
+const OPEN_PATHS = new Set([
+    "/get-session",
+    "/sign-in/email",
+    "/sign-out",
+    "/ok",
+    "/error",
+]);
+/** AccountKit endpoints the screens reach directly; everything else answers 404. */
+export function compatPathIsOpen(path) {
+    return OPEN_PATHS.has(path) || path.startsWith("/oauth2/callback/");
+}
+/** A same-origin path from a client-supplied URL, or `fallback`. */
+export function sameOriginPath(raw, site, fallback) {
+    const origin = new URL(site).origin;
+    const value = typeof raw === "string" ? raw : "";
+    try {
+        const url = new URL(value || fallback, origin);
+        return url.origin === origin ? url.pathname + url.search : fallback;
+    }
+    catch {
+        return fallback;
+    }
+}
+/** A redirect whose headers can still take cookies (Response.redirect's cannot). */
+function redirectTo(location) {
+    return new Response(null, { status: 302, headers: { location } });
+}
+function withCookies(response, setCookies) {
+    for (const cookie of setCookies)
+        response.headers.append("set-cookie", cookie);
+    return response;
+}
+// React.cache dedupes per request on the server; outside a React server
+// render (tests, scripts) it is absent and every call reads afresh.
+const cache = React.cache ?? ((fn) => fn);
+export function createNextAuthCompat(options) {
+    const { runtime } = options;
+    const code = (reason) => options.codes?.[reason] ?? reason;
+    const env = () => options.env?.() ?? process.env;
+    /** Run one AccountKit endpoint for this request, keeping its cookies and proxy hop. */
+    async function callShared(request, route, body) {
+        const origin = new URL(options.siteUrl()).origin;
+        const forwarded = new Headers(request.headers);
+        forwarded.delete("content-length");
+        forwarded.set("origin", origin);
+        forwarded.set("content-type", "application/json");
+        const response = await runtime.POST(new Request(`${origin}/api/auth${route}`, {
+            method: "POST",
+            headers: forwarded,
+            body: JSON.stringify(body),
+        }));
+        const text = await response.text();
+        let parsed = {};
+        try {
+            parsed = text ? JSON.parse(text) : {};
+        }
+        catch {
+            // Nothing to translate.
+        }
+        return {
+            status: response.status,
+            body: parsed,
+            cookies: response.headers.getSetCookie(),
+        };
+    }
+    async function toSessionOrNull(shared) {
+        return shared ? options.toSession(shared) : null;
+    }
+    /** The product session behind these request headers (proxy, route handlers). */
+    async function sessionFor(requestHeaders) {
+        return toSessionOrNull(await runtime.sessionFor(requestHeaders).catch(() => null));
+    }
+    /** The shared session id behind these headers, for "keep this session" writes. */
+    async function sessionIdFor(requestHeaders) {
+        const shared = await runtime.sessionFor(requestHeaders).catch(() => null);
+        return shared?.session.id ?? null;
+    }
+    /** The product session of this request (server components, actions). */
+    const currentSession = cache(async () => toSessionOrNull(await runtime.getSession()));
+    /** What next-auth/react reads on a refusal: `error` and the login page's `code`. */
+    const refusal = (loginCode) => Response.json({
+        url: `${options.siteUrl()}${options.signInPath}?error=CredentialsSignin&code=${encodeURIComponent(loginCode)}`,
+    });
+    /** The methods the pages may use: the product's credentials, plus each configured OIDC client. */
+    function providers() {
+        const site = options.siteUrl();
+        const entry = (id, name, type) => ({
+            id,
+            name,
+            type,
+            signinUrl: `${site}/api/auth/signin/${id}`,
+            callbackUrl: `${site}/api/auth/callback/${id}`,
+        });
+        const list = {};
+        for (const client of oidcClients(env())) {
+            list[client.providerId] = entry(client.providerId, client.providerId === "orangecat" ? "OrangeCat" : "bitbaum", "oidc");
+        }
+        for (const [id, provider] of Object.entries(options.credentials)) {
+            list[id] = entry(id, provider.name, "credentials");
+        }
+        return list;
+    }
+    function oidcProviderIds() {
+        return new Set(oidcClients(env()).map((client) => client.providerId));
+    }
+    /**
+     * Start an OIDC round-trip: a sign-in, or — for a person already signed in
+     * whom the product lets link — linking the identity to them.
+     */
+    async function oidcSignIn(request, providerId, next) {
+        const site = options.siteUrl();
+        const signedIn = await sessionFor(request.headers);
+        const link = signedIn
+            ? await (options.linkWhenSignedIn?.(request, signedIn) ?? true)
+            : false;
+        const answer = await callShared(request, link ? "/oauth2/link" : "/sign-in/oauth2", {
+            providerId,
+            callbackURL: `${site}${next}`,
+            errorCallbackURL: link
+                ? `${site}${options.linkErrorPath ?? next}`
+                : `${site}${options.signInPath}?error=OAuthSignin`,
+        });
+        return {
+            url: typeof answer.body.url === "string" ? answer.body.url : null,
+            cookies: answer.cookies,
+        };
+    }
+    /** A hook's failure is logged and never costs the person their sign-in. */
+    async function runHook(name, hook) {
+        try {
+            await hook?.();
+        }
+        catch (error) {
+            console.error(`[auth] compat ${name} hook failed: ${error.name}`);
+        }
+    }
+    async function credentialSignIn(request, provider, form) {
+        let resolved;
+        let answer;
+        const password = String(form?.get("password") ?? "");
+        try {
+            resolved = await options.credentials[provider].resolve(form ?? new FormData());
+            if (resolved && "refuse" in resolved)
+                return refusal(resolved.refuse);
+            if (!resolved || !resolved.email || !password)
+                return refusal(code("missing"));
+            answer = await callShared(request, "/sign-in/email", {
+                email: resolved.email.trim().toLowerCase(),
+                password,
+            });
+        }
+        catch (error) {
+            // The product's database or the runtime is down: say so, never a 500.
+            console.error(`[auth] compat sign-in unavailable: ${error.name}`);
+            return refusal(code("unavailable"));
+        }
+        const email = resolved.email.trim().toLowerCase();
+        if (answer.status === 200) {
+            const user = answer.body.user;
+            if (user?.id) {
+                const signedIn = {
+                    provider,
+                    email,
+                    user: { id: user.id, name: user.name },
+                };
+                await runHook("onSignedIn", options.onSignedIn && (() => options.onSignedIn(signedIn)));
+            }
+            const next = sameOriginPath(form?.get("callbackUrl"), options.siteUrl(), options.landing);
+            return withCookies(Response.json({ url: `${options.siteUrl()}${next}` }), answer.cookies);
+        }
+        const reason = answer.body.code === "EMAIL_NOT_VERIFIED"
+            ? "email_unverified"
+            : answer.status === 429
+                ? "rate_limited"
+                : answer.status >= 500
+                    ? "unavailable"
+                    : "credentials";
+        const refused = { provider, email, status: answer.status, reason };
+        await runHook("onRefused", options.onRefused && (() => options.onRefused(refused)));
+        return refusal(code(reason));
+    }
+    /**
+     * Auth.js's client protocol, answered by the shared runtime. Null for an
+     * AccountKit path the screens use, which then goes to the runtime itself.
+     */
+    async function handle(request) {
+        const url = new URL(request.url);
+        const path = url.pathname.replace(/^\/api\/auth/, "");
+        const site = options.siteUrl();
+        const { method } = request;
+        // GET reads the session; POST is useSession().update(), which carries
+        // nothing: the session is re-read from the product's rows every request.
+        if (path === "/session" && (method === "GET" || method === "POST")) {
+            return Response.json(await sessionFor(request.headers), {
+                headers: { "Cache-Control": "no-store" },
+            });
+        }
+        if (method === "GET" && path === "/csrf") {
+            // AccountKit checks the request origin itself; the client needs a value.
+            return Response.json({ csrfToken: "accountkit" });
+        }
+        if (method === "GET" && path === "/providers")
+            return Response.json(providers());
+        if (method === "POST" && path === "/signout") {
+            const form = await request.formData().catch(() => null);
+            const answer = await callShared(request, "/sign-out", {});
+            const next = sameOriginPath(form?.get("callbackUrl"), site, options.signInPath);
+            return withCookies(Response.json({ url: `${site}${next}` }), answer.cookies);
+        }
+        const credentials = /^\/callback\/([^/]+)$/.exec(path);
+        if (method === "POST" &&
+            credentials &&
+            credentials[1] in options.credentials) {
+            return credentialSignIn(request, credentials[1], await request.formData().catch(() => null));
+        }
+        const signin = /^\/signin\/([^/]+)$/.exec(path);
+        if (signin && oidcProviderIds().has(signin[1])) {
+            if (method === "POST") {
+                const form = await request.formData().catch(() => null);
+                const next = sameOriginPath(form?.get("callbackUrl"), site, options.landing);
+                const started = await oidcSignIn(request, signin[1], next);
+                if (!started.url)
+                    return refusal(code("unavailable"));
+                return withCookies(Response.json({ url: started.url }), started.cookies);
+            }
+            if (method === "GET") {
+                // A server-side signIn arrives here by redirect. Only a navigation the
+                // product itself started may begin a round-trip that can link.
+                const fetchSite = request.headers.get("sec-fetch-site");
+                if (fetchSite && fetchSite !== "same-origin" && fetchSite !== "none") {
+                    return redirectTo(`${site}${options.signInPath}`);
+                }
+                const next = sameOriginPath(url.searchParams.get("callbackUrl"), site, options.landing);
+                const started = await oidcSignIn(request, signin[1], next);
+                if (!started.url)
+                    return redirectTo(`${site}${options.signInPath}?error=OAuthSignin`);
+                return withCookies(redirectTo(started.url), started.cookies);
+            }
+        }
+        if (method === "GET" && (path === "/signin" || signin)) {
+            // next-auth/react sends a provider this runtime does not offer here.
+            return redirectTo(`${site}${options.signInPath}?error=OAuthSignin`);
+        }
+        if (compatPathIsOpen(path))
+            return null;
+        return Response.json({ error: "not_found" }, { status: 404 });
+    }
+    return {
+        handle,
+        /** /api/auth/* with the switch on: the compat answer, else the runtime. */
+        route: {
+            GET: async (request) => (await handle(request)) ?? runtime.GET(request),
+            POST: async (request) => (await handle(request)) ?? runtime.POST(request),
+        },
+        callShared,
+        sessionFor,
+        sessionIdFor,
+        currentSession,
+        oidcSignIn,
+        providers,
+    };
+}
+//# sourceMappingURL=nextauth-compat.js.map

package/dist/auth/nextauth-compat.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nextauth-compat.js","sourceRoot":"","sources":["../../src/auth/nextauth-compat.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAC/B,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AA2G3C,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC;IACzB,cAAc;IACd,gBAAgB;IAChB,WAAW;IACX,KAAK;IACL,QAAQ;CACT,CAAC,CAAC;AAEH,oFAAoF;AACpF,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,OAAO,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC;AACtE,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,cAAc,CAC5B,GAAmD,EACnD,IAAY,EACZ,QAAgB;IAEhB,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;IACpC,MAAM,KAAK,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACjD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,IAAI,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC/C,OAAO,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC;AAED,oFAAoF;AACpF,SAAS,UAAU,CAAC,QAAgB;IAClC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,WAAW,CAAC,QAAkB,EAAE,UAAoB;IAC3D,KAAK,MAAM,MAAM,IAAI,UAAU;QAC7B,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IAChD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,wEAAwE;AACxE,oEAAoE;AACpE,MAAM,KAAK,GACR,KAAqC,CAAC,KAAK,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;AAE/D,MAAM,UAAU,oBAAoB,CAAI,OAAiC;IACvE,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAC5B,MAAM,IAAI,GAAG,CAAC,MAAqB,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC;IAC1E,MAAM,GAAG,GAAG,GAAG,EAAE,CACf,OAAO,CAAC,GAAG,EAAE,EAAE,IAAK,OAAO,CAAC,GAA0C,CAAC;IAEzE,uFAAuF;IACvF,KAAK,UAAU,UAAU,CACvB,OAAgB,EAChB,KAAa,EACb,IAA6B;QAE7B,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;QACjD,MAAM,SAAS,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC/C,SAAS,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QACnC,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAChC,SAAS,CAAC,GAAG,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;QAClD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CACjC,IAAI,OAAO,CAAC,GAAG,MAAM,YAAY,KAAK,EAAE,EAAE;YACxC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,SAAS;YAClB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC3B,CAAC,CACH,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,MAAM,GAA4B,EAAE,CAAC;QACzC,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAA6B,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,CAAC;QAAC,MAAM,CAAC;YACP,wBAAwB;QAC1B,CAAC;QACD,OAAO;YACL,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,IAAI,EAAE,MAAM;YACZ,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE;SACzC,CAAC;IACJ,CAAC;IAED,KAAK,UAAU,eAAe,CAC5B,MAA0B;QAE1B,OAAO,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACnD,CAAC;IAED,gFAAgF;IAChF,KAAK,UAAU,UAAU,CAAC,cAAuB;QAC/C,OAAO,eAAe,CACpB,MAAM,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAC3D,CAAC;IACJ,CAAC;IAED,kFAAkF;IAClF,KAAK,UAAU,YAAY,CAAC,cAAuB;QACjD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAC1E,OAAO,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,IAAI,CAAC;IACpC,CAAC;IAED,wEAAwE;IACxE,MAAM,cAAc,GAAG,KAAK,CAAC,KAAK,IAAuB,EAAE,CACzD,eAAe,CAAC,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC,CAC5C,CAAC;IAEF,oFAAoF;IACpF,MAAM,OAAO,GAAG,CAAC,SAAiB,EAAE,EAAE,CACpC,QAAQ,CAAC,IAAI,CAAC;QACZ,GAAG,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,UAAU,iCAAiC,kBAAkB,CAAC,SAAS,CAAC,EAAE;KAC/G,CAAC,CAAC;IAEL,kGAAkG;IAClG,SAAS,SAAS;QAChB,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,CAAC,EAAU,EAAE,IAAY,EAAE,IAAY,EAAE,EAAE,CAAC,CAAC;YACzD,EAAE;YACF,IAAI;YACJ,IAAI;YACJ,SAAS,EAAE,GAAG,IAAI,oBAAoB,EAAE,EAAE;YAC1C,WAAW,EAAE,GAAG,IAAI,sBAAsB,EAAE,EAAE;SAC/C,CAAC,CAAC;QACH,MAAM,IAAI,GAA6C,EAAE,CAAC;QAC1D,KAAK,MAAM,MAAM,IAAI,WAAW,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;YACxC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,KAAK,CAC7B,MAAM,CAAC,UAAU,EACjB,MAAM,CAAC,UAAU,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,EAC3D,MAAM,CACP,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;YACjE,IAAI,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,EAAE,EAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;QACrD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,SAAS,eAAe;QACtB,OAAO,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;IACxE,CAAC;IAED;;;OAGG;IACH,KAAK,UAAU,UAAU,CACvB,OAAgB,EAChB,UAAkB,EAClB,IAAY;QAEZ,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,QAAQ;YACnB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,IAAI,CAAC;YAC/D,CAAC,CAAC,KAAK,CAAC;QACV,MAAM,MAAM,GAAG,MAAM,UAAU,CAC7B,OAAO,EACP,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,iBAAiB,EACzC;YACE,UAAU;YACV,WAAW,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE;YAC7B,gBAAgB,EAAE,IAAI;gBACpB,CAAC,CAAC,GAAG,IAAI,GAAG,OAAO,CAAC,aAAa,IAAI,IAAI,EAAE;gBAC3C,CAAC,CAAC,GAAG,IAAI,GAAG,OAAO,CAAC,UAAU,oBAAoB;SACrD,CACF,CAAC;QACF,OAAO;YACL,GAAG,EAAE,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI;YACjE,OAAO,EAAE,MAAM,CAAC,OAAO;SACxB,CAAC;IACJ,CAAC;IAED,2EAA2E;IAC3E,KAAK,UAAU,OAAO,CACpB,IAAY,EACZ,IAAuC;QAEvC,IAAI,CAAC;YACH,MAAM,IAAI,EAAE,EAAE,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CACX,iBAAiB,IAAI,iBAAkB,KAAe,CAAC,IAAI,EAAE,CAC9D,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,UAAU,gBAAgB,CAC7B,OAAgB,EAChB,QAAgB,EAChB,IAAqB;QAErB,IAAI,QAAmE,CAAC;QACxE,IAAI,MAAoB,CAAC;QACzB,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;QACrD,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,OAAO,CACpD,IAAI,IAAI,IAAI,QAAQ,EAAE,CACvB,CAAC;YACF,IAAI,QAAQ,IAAI,QAAQ,IAAI,QAAQ;gBAAE,OAAO,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACtE,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,QAAQ;gBAC3C,OAAO,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;YAClC,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,gBAAgB,EAAE;gBACnD,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE;gBAC1C,QAAQ;aACT,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,sEAAsE;YACtE,OAAO,CAAC,KAAK,CACX,sCAAuC,KAAe,CAAC,IAAI,EAAE,CAC9D,CAAC;YACF,OAAO,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;QACtC,CAAC;QACD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAClD,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC1B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAC0B,CAAC;YACpD,IAAI,IAAI,EAAE,EAAE,EAAE,CAAC;gBACb,MAAM,QAAQ,GAAG;oBACf,QAAQ;oBACR,KAAK;oBACL,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;iBACvC,CAAC;gBACF,MAAM,OAAO,CACX,YAAY,EACZ,OAAO,CAAC,UAAU,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,UAAW,CAAC,QAAQ,CAAC,CAAC,CAC5D,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,GAAG,cAAc,CACzB,IAAI,EAAE,GAAG,CAAC,aAAa,CAAC,EACxB,OAAO,CAAC,OAAO,EAAE,EACjB,OAAO,CAAC,OAAO,CAChB,CAAC;YACF,OAAO,WAAW,CAChB,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,GAAG,IAAI,EAAE,EAAE,CAAC,EACrD,MAAM,CAAC,OAAO,CACf,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GACV,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,oBAAoB;YACvC,CAAC,CAAC,kBAAkB;YACpB,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,GAAG;gBACrB,CAAC,CAAC,cAAc;gBAChB,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,GAAG;oBACpB,CAAC,CAAC,aAAa;oBACf,CAAC,CAAC,aAAa,CAAC;QACxB,MAAM,OAAO,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;QACnE,MAAM,OAAO,CACX,WAAW,EACX,OAAO,CAAC,SAAS,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,SAAU,CAAC,OAAO,CAAC,CAAC,CACzD,CAAC;QACF,OAAO,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/B,CAAC;IAED;;;OAGG;IACH,KAAK,UAAU,MAAM,CAAC,OAAgB;QACpC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;QACtD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;QAC/B,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;QAE3B,sEAAsE;QACtE,yEAAyE;QACzE,IAAI,IAAI,KAAK,UAAU,IAAI,CAAC,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,CAAC,EAAE,CAAC;YACnE,OAAO,QAAQ,CAAC,IAAI,CAAC,MAAM,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE;gBACtD,OAAO,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE;aACzC,CAAC,CAAC;QACL,CAAC;QACD,IAAI,MAAM,KAAK,KAAK,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACzC,yEAAyE;YACzE,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC,CAAC;QACpD,CAAC;QACD,IAAI,MAAM,KAAK,KAAK,IAAI,IAAI,KAAK,YAAY;YAC3C,OAAO,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QACpC,IAAI,MAAM,KAAK,MAAM,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;YAC7C,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;YACxD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC;YAC1D,MAAM,IAAI,GAAG,cAAc,CACzB,IAAI,EAAE,GAAG,CAAC,aAAa,CAAC,EACxB,IAAI,EACJ,OAAO,CAAC,UAAU,CACnB,CAAC;YACF,OAAO,WAAW,CAChB,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,EAAE,CAAC,EACxC,MAAM,CAAC,OAAO,CACf,CAAC;QACJ,CAAC;QACD,MAAM,WAAW,GAAG,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvD,IACE,MAAM,KAAK,MAAM;YACjB,WAAW;YACX,WAAW,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,WAAW,EACrC,CAAC;YACD,OAAO,gBAAgB,CACrB,OAAO,EACP,WAAW,CAAC,CAAC,CAAC,EACd,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAC3C,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChD,IAAI,MAAM,IAAI,eAAe,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/C,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;gBACtB,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;gBACxD,MAAM,IAAI,GAAG,cAAc,CACzB,IAAI,EAAE,GAAG,CAAC,aAAa,CAAC,EACxB,IAAI,EACJ,OAAO,CAAC,OAAO,CAChB,CAAC;gBACF,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;gBAC3D,IAAI,CAAC,OAAO,CAAC,GAAG;oBAAE,OAAO,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;gBACtD,OAAO,WAAW,CAChB,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,EACnC,OAAO,CAAC,OAAO,CAChB,CAAC;YACJ,CAAC;YACD,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;gBACrB,uEAAuE;gBACvE,+DAA+D;gBAC/D,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;gBACxD,IAAI,SAAS,IAAI,SAAS,KAAK,aAAa,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;oBACrE,OAAO,UAAU,CAAC,GAAG,IAAI,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;gBACpD,CAAC;gBACD,MAAM,IAAI,GAAG,cAAc,CACzB,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,EACnC,IAAI,EACJ,OAAO,CAAC,OAAO,CAChB,CAAC;gBACF,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;gBAC3D,IAAI,CAAC,OAAO,CAAC,GAAG;oBACd,OAAO,UAAU,CAAC,GAAG,IAAI,GAAG,OAAO,CAAC,UAAU,oBAAoB,CAAC,CAAC;gBACtE,OAAO,WAAW,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;YAC/D,CAAC;QACH,CAAC;QACD,IAAI,MAAM,KAAK,KAAK,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,EAAE,CAAC;YACvD,qEAAqE;YACrE,OAAO,UAAU,CAAC,GAAG,IAAI,GAAG,OAAO,CAAC,UAAU,oBAAoB,CAAC,CAAC;QACtE,CAAC;QACD,IAAI,gBAAgB,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACxC,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAChE,CAAC;IAED,OAAO;QACL,MAAM;QACN,2EAA2E;QAC3E,KAAK,EAAE;YACL,GAAG,EAAE,KAAK,EAAE,OAAgB,EAAE,EAAE,CAC9B,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;YACjD,IAAI,EAAE,KAAK,EAAE,OAAgB,EAAE,EAAE,CAC/B,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;SACnD;QACD,UAAU;QACV,UAAU;QACV,YAAY;QACZ,cAAc;QACd,UAAU;QACV,SAAS;KACV,CAAC;AACJ,CAAC"}

package/dist/auth/switch.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Whether a product runs on the shared runtime yet: `AUTH_RUNTIME=accountkit`.
+ * The one switch every product staging AccountKit beside Auth.js reads, so
+ * "on" means the same thing everywhere. Free of every dependency, so a proxy
+ * or a provider gate can ask without loading the runtime.
+ */
+export declare function sharedRuntimeEnabled(env?: Record<string, string | undefined>): boolean;
+//# sourceMappingURL=switch.d.ts.map

package/dist/auth/switch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"switch.d.ts","sourceRoot":"","sources":["../../src/auth/switch.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GACpD,OAAO,CAET"}

package/dist/auth/switch.js

@@ -0,0 +1,10 @@
+/**
+ * Whether a product runs on the shared runtime yet: `AUTH_RUNTIME=accountkit`.
+ * The one switch every product staging AccountKit beside Auth.js reads, so
+ * "on" means the same thing everywhere. Free of every dependency, so a proxy
+ * or a provider gate can ask without loading the runtime.
+ */
+export function sharedRuntimeEnabled(env = process.env) {
+    return env.AUTH_RUNTIME === "accountkit";
+}
+//# sourceMappingURL=switch.js.map

package/dist/auth/switch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"switch.js","sourceRoot":"","sources":["../../src/auth/switch.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAA0C,OAAO,CAAC,GAAG;IAErD,OAAO,GAAG,CAAC,YAAY,KAAK,YAAY,CAAC;AAC3C,CAAC"}

package/dist/bin/rehearse-import.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=rehearse-import.d.ts.map

package/dist/bin/rehearse-import.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rehearse-import.d.ts","sourceRoot":"","sources":["../../src/bin/rehearse-import.ts"],"names":[],"mappings":""}

package/dist/bin/rehearse-import.js

@@ -0,0 +1,82 @@
+#!/usr/bin/env node
+/**
+ * accountkit-rehearse-import <import.sql> [--prefix auth_]
+ *
+ * Rehearses a product's account import against DATABASE_URL in one
+ * transaction that always rolls back, and prints only counts as JSON. There is
+ * no apply mode. It takes locks even though it rolls back, so never point it
+ * at the served database. It uses the product's own driver: `pg` or
+ * `postgres`, resolved from the working directory.
+ */
+import { readFile } from "node:fs/promises";
+import { createRequire } from "node:module";
+import { join, resolve } from "node:path";
+import { rehearseImport, } from "../auth/import-rehearsal.js";
+/** A transaction runner over whichever Postgres driver the product has. */
+function driver(url) {
+    const load = createRequire(join(process.cwd(), "package.json"));
+    try {
+        const pg = load("pg");
+        const pool = new pg.Pool({
+            connectionString: url,
+            connectionTimeoutMillis: 5000,
+            max: 1,
+        });
+        return {
+            begin: async (work) => {
+                const client = await pool.connect();
+                try {
+                    await client.query("BEGIN");
+                    await work(async (text) => (await client.query(text)).rows);
+                }
+                finally {
+                    await client.query("ROLLBACK").catch(() => { });
+                    client.release();
+                }
+            },
+            end: () => pool.end(),
+        };
+    }
+    catch {
+        // Not installed here; try postgres-js.
+    }
+    const postgres = load("postgres");
+    const sql = postgres(url, { max: 1, connect_timeout: 5, onnotice: () => { } });
+    return {
+        begin: async (work) => {
+            await sql.begin(async (tx) => {
+                await work(async (text) => [...(await tx.unsafe(text))]);
+            });
+        },
+        end: () => sql.end(),
+    };
+}
+const args = process.argv.slice(2);
+const file = args.find((arg) => !arg.startsWith("--"));
+const prefixAt = args.indexOf("--prefix");
+const prefix = prefixAt >= 0 ? args[prefixAt + 1] : "auth_";
+if (!file) {
+    console.error("usage: accountkit-rehearse-import <import.sql> [--prefix auth_]");
+    process.exit(2);
+}
+if (!process.env.DATABASE_URL) {
+    console.error("DATABASE_URL is required");
+    process.exit(2);
+}
+const db = driver(process.env.DATABASE_URL);
+try {
+    const counts = await rehearseImport({
+        begin: db.begin,
+        sql: await readFile(resolve(file), "utf8"),
+        prefix,
+    });
+    console.log(JSON.stringify(counts));
+}
+catch (error) {
+    console.error(error.message);
+    process.exitCode = 1;
+}
+finally {
+    await db.end();
+}
+//# sourceMappingURL=rehearse-import.js.map

package/dist/bin/rehearse-import.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rehearse-import.js","sourceRoot":"","sources":["../../src/bin/rehearse-import.ts"],"names":[],"mappings":";AACA;;;;;;;;GAQG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EACL,cAAc,GAEf,MAAM,6BAA6B,CAAC;AAcrC,2EAA2E;AAC3E,SAAS,MAAM,CAAC,GAAW;IACzB,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,CAAC,CAAC,CAAC;IAChE,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAwB,CAAC;QAC7C,MAAM,IAAI,GAAG,IAAI,EAAE,CAAC,IAAI,CAAC;YACvB,gBAAgB,EAAE,GAAG;YACrB,uBAAuB,EAAE,IAAI;YAC7B,GAAG,EAAE,CAAC;SACP,CAAC,CAAC;QACH,OAAO;YACL,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;gBACpB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;gBACpC,IAAI,CAAC;oBACH,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;oBAC5B,MAAM,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBAC9D,CAAC;wBAAS,CAAC;oBACT,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;oBAC/C,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,CAAC;YACH,CAAC;YACD,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;SACtB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,uCAAuC;IACzC,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAGjB,CAAC;IAChB,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,eAAe,EAAE,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,CAAC,CAAC;IAC9E,OAAO;QACL,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YACpB,MAAM,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;gBAC3B,MAAM,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3D,CAAC,CAAC,CAAC;QACL,CAAC;QACD,GAAG,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE;KACrB,CAAC;AACJ,CAAC;AAED,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACnC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;AACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;AAC1C,MAAM,MAAM,GAAG,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;AAC5D,IAAI,CAAC,IAAI,EAAE,CAAC;IACV,OAAO,CAAC,KAAK,CACX,iEAAiE,CAClE,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC;IAC9B,OAAO,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC1C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AACD,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;AAC5C,IAAI,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;QAClC,KAAK,EAAE,EAAE,CAAC,KAAK;QACf,GAAG,EAAE,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAC1C,MAAM;KACP,CAAC,CAAC;IACH,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;AACtC,CAAC;AAAC,OAAO,KAAK,EAAE,CAAC;IACf,OAAO,CAAC,KAAK,CAAE,KAAe,CAAC,OAAO,CAAC,CAAC;IACxC,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC;QAAS,CAAC;IACT,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC;AACjB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bitbaum/accountkit",
-  "version": "0.17.0",
+  "version": "0.18.0",
   "description": "One account for every bitbaum product: the account menu, accounts themselves (better-auth: password, magic link, passkeys, 2FA, OIDC) and Sign in with OrangeCat. Styled from @bitbaum/design-tokens.",
   "license": "MIT",
   "author": "Cato",
@@ -75,6 +75,22 @@
       "types": "./dist/auth/next.d.ts",
       "default": "./dist/auth/next.js"
     },
+    "./auth/nextauth-compat": {
+      "types": "./dist/auth/nextauth-compat.d.ts",
+      "default": "./dist/auth/nextauth-compat.js"
+    },
+    "./auth/switch": {
+      "types": "./dist/auth/switch.d.ts",
+      "default": "./dist/auth/switch.js"
+    },
+    "./auth/compat-testing": {
+      "types": "./dist/auth/compat-testing.d.ts",
+      "default": "./dist/auth/compat-testing.js"
+    },
+    "./auth/import-rehearsal": {
+      "types": "./dist/auth/import-rehearsal.d.ts",
+      "default": "./dist/auth/import-rehearsal.js"
+    },
     "./auth/client": {
       "types": "./dist/auth/client.d.ts",
       "default": "./dist/auth/client.js"
@@ -169,5 +185,8 @@
   "dependencies": {
     "limitkit": "^0.2.1",
     "zod": "^4.6.7"
+  },
+  "bin": {
+    "accountkit-rehearse-import": "./dist/bin/rehearse-import.js"
   }
 }