@dbx-tools/auth-gate 0.6.168

package/README.md

@@ -0,0 +1,50 @@
+# `@dbx-tools/auth-gate`
+
+Passwordless authentication runtime built on Better Auth, email OTP, passkeys,
+and caller-provided identity policy and delivery.
+
+Key features:
+
+- Better Auth ownership of users, sessions, OTP lifecycle, rate limits, and
+  passkey credentials;
+- session-required passkey enrollment and discoverable passkey login;
+- POST and browser-redirect logout routes with a same-origin destination;
+- caller-provided `authorizeIdentity`, email sender, secret, origin, and
+  database;
+- native AppKit Lakebase pool or local SQLite storage;
+- programmatic Better Auth migrations under advisory or file locks.
+
+## Relationship To Native AppKit
+
+Use the Databricks Apps front door and AppKit execution context when traffic
+arrives through the platform. Use this package for a public tunnel or another
+route that bypasses that identity-aware proxy and therefore needs its own
+passwordless session. A passkey session proves the configured identity only; it
+does not mint a Databricks OBO access token.
+
+```ts
+import { auth, storage } from "@dbx-tools/auth-gate";
+
+const database = await storage.createAuthStorage({ storage: "sqlite" });
+const runtime = await auth.createPasswordlessAuth({
+  storage: database,
+  baseURL: "http://localhost:8000",
+  appName: "My app",
+  secret: process.env.AUTH_SECRET!,
+  logoutRedirectPath: "/",
+  sessionTtlSeconds: 2_592_000,
+  codeTtlSeconds: 600,
+  maxAttempts: 5,
+  authorizeIdentity: (email) => email.endsWith("@example.com"),
+  sendCode: async (email, code) => sendEmail(email, code),
+});
+```
+
+`POST <basePath>/logout` returns `{ ok, redirectTo }`; `GET` clears the same
+session and redirects with status `303`. The redirect defaults to `/` and is
+restricted to a same-origin path.
+
+## Modules
+
+- `auth` - Better Auth runtime and compatibility routes;
+- `storage` - Lakebase/SQLite selection and migration locking.

package/index.ts

@@ -0,0 +1,9 @@
+// GENERATED by projen watch - DO NOT EDIT.
+// Regenerated from the exporting modules in ./src.
+// Hand edits are overwritten on the next watch; this file is read-only.
+
+export const PACKAGE_IDENTIFIER = "@dbx-tools/auth-gate";
+export * as auth from "./src/auth.ts";
+export * as storage from "./src/storage.ts";
+export type { AuthorizeIdentity, AuthEmailOptions, PasswordlessAuthOptions, PasswordlessAuthRuntime } from "./src/auth.ts";
+export type { AuthStorageMode, AuthStorageConfig, ResolvedAuthStorageConfig, AuthDatabase, AuthStorage } from "./src/storage.ts";

package/lib/index.d.ts

@@ -0,0 +1,5 @@
+export declare const PACKAGE_IDENTIFIER = "@dbx-tools/auth-gate";
+export * as auth from "./src/auth.ts";
+export * as storage from "./src/storage.ts";
+export type { AuthorizeIdentity, AuthEmailOptions, PasswordlessAuthOptions, PasswordlessAuthRuntime } from "./src/auth.ts";
+export type { AuthStorageMode, AuthStorageConfig, ResolvedAuthStorageConfig, AuthDatabase, AuthStorage } from "./src/storage.ts";

package/lib/index.js

@@ -0,0 +1,7 @@
+// GENERATED by projen watch - DO NOT EDIT.
+// Regenerated from the exporting modules in ./src.
+// Hand edits are overwritten on the next watch; this file is read-only.
+export const PACKAGE_IDENTIFIER = "@dbx-tools/auth-gate";
+export * as auth from "./src/auth.js";
+export * as storage from "./src/storage.js";
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSwyQ0FBMkM7QUFDM0MsbURBQW1EO0FBQ25ELHdFQUF3RTtBQUV4RSxNQUFNLENBQUMsTUFBTSxrQkFBa0IsR0FBRyxzQkFBc0IsQ0FBQztBQUN6RCxPQUFPLEtBQUssSUFBSSxNQUFNLGVBQWUsQ0FBQztBQUN0QyxPQUFPLEtBQUssT0FBTyxNQUFNLGtCQUFrQixDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiLy8gR0VORVJBVEVEIGJ5IHByb2plbiB3YXRjaCAtIERPIE5PVCBFRElULlxuLy8gUmVnZW5lcmF0ZWQgZnJvbSB0aGUgZXhwb3J0aW5nIG1vZHVsZXMgaW4gLi9zcmMuXG4vLyBIYW5kIGVkaXRzIGFyZSBvdmVyd3JpdHRlbiBvbiB0aGUgbmV4dCB3YXRjaDsgdGhpcyBmaWxlIGlzIHJlYWQtb25seS5cblxuZXhwb3J0IGNvbnN0IFBBQ0tBR0VfSURFTlRJRklFUiA9IFwiQGRieC10b29scy9hdXRoLWdhdGVcIjtcbmV4cG9ydCAqIGFzIGF1dGggZnJvbSBcIi4vc3JjL2F1dGgudHNcIjtcbmV4cG9ydCAqIGFzIHN0b3JhZ2UgZnJvbSBcIi4vc3JjL3N0b3JhZ2UudHNcIjtcbmV4cG9ydCB0eXBlIHsgQXV0aG9yaXplSWRlbnRpdHksIEF1dGhFbWFpbE9wdGlvbnMsIFBhc3N3b3JkbGVzc0F1dGhPcHRpb25zLCBQYXNzd29yZGxlc3NBdXRoUnVudGltZSB9IGZyb20gXCIuL3NyYy9hdXRoLnRzXCI7XG5leHBvcnQgdHlwZSB7IEF1dGhTdG9yYWdlTW9kZSwgQXV0aFN0b3JhZ2VDb25maWcsIFJlc29sdmVkQXV0aFN0b3JhZ2VDb25maWcsIEF1dGhEYXRhYmFzZSwgQXV0aFN0b3JhZ2UgfSBmcm9tIFwiLi9zcmMvc3RvcmFnZS50c1wiO1xuIl19

package/lib/src/auth.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Better Auth passwordless runtime with email OTP and passkeys.
+ *
+ * Callers provide authorization, delivery, storage, origin, and secret. Better
+ * Auth owns users, OTP verification records, sessions, rate limits, passkey
+ * credentials, and their native HTTP routes.
+ *
+ * @module
+ */
+import { type AuthStatus } from "@dbx-tools/shared-auth";
+import type { AuthStorage } from "./storage.ts";
+export type AuthorizeIdentity = (email: string) => boolean | Promise<boolean>;
+export interface AuthEmailOptions {
+    subject: string;
+    brandName: string;
+    message: string;
+    codeTtlSeconds: number;
+}
+export interface PasswordlessAuthOptions {
+    storage: AuthStorage;
+    baseURL: string;
+    basePath?: string;
+    appName: string;
+    secret: string;
+    sessionCookieName?: string;
+    /** Same-origin path returned after logout. Defaults to `/`. */
+    logoutRedirectPath?: string;
+    sessionTtlSeconds: number;
+    sessionCutoffMs?: number;
+    codeTtlSeconds: number;
+    maxAttempts: number;
+    authorizeIdentity: AuthorizeIdentity;
+    sendCode(email: string, code: string, options: AuthEmailOptions): Promise<void>;
+    subject?: string;
+    message?: string;
+}
+export interface PasswordlessAuthRuntime {
+    readonly basePath: string;
+    readonly passkeysEnabled: boolean;
+    handler(request: Request): Promise<Response>;
+    session(headers: Headers): Promise<string | undefined>;
+    status(headers: Headers): Promise<AuthStatus>;
+    close(): Promise<void>;
+}
+export declare function createPasswordlessAuth(config: PasswordlessAuthOptions): Promise<PasswordlessAuthRuntime>;
+/** Restrict logout redirects to one same-origin application path. */
+export declare function normalizeLogoutRedirectPath(value: string | undefined): string;

package/lib/src/auth.js

@@ -0,0 +1,217 @@
+/**
+ * Better Auth passwordless runtime with email OTP and passkeys.
+ *
+ * Callers provide authorization, delivery, storage, origin, and secret. Better
+ * Auth owns users, OTP verification records, sessions, rate limits, passkey
+ * credentials, and their native HTTP routes.
+ *
+ * @module
+ */
+import { passkey } from "@better-auth/passkey";
+import { SESSION_COOKIE_NAME } from "@dbx-tools/shared-auth";
+import { log } from "@dbx-tools/shared-core";
+import { APIError, betterAuth } from "better-auth";
+import { emailOTP } from "better-auth/plugins";
+import { migrateAuth } from "./storage.js";
+const logger = log.logger("auth");
+export async function createPasswordlessAuth(config) {
+    const origin = new URL(config.baseURL).origin;
+    const rpID = new URL(origin).hostname;
+    const basePath = config.basePath ?? "/api/auth";
+    const logoutRedirectPath = normalizeLogoutRedirectPath(config.logoutRedirectPath);
+    const emailOptions = {
+        subject: config.subject ?? "Your verification code",
+        brandName: config.appName,
+        message: config.message ?? "Your verification code is:",
+        codeTtlSeconds: config.codeTtlSeconds,
+    };
+    const options = {
+        appName: config.appName,
+        baseURL: origin,
+        basePath,
+        database: config.storage.database,
+        secret: config.secret,
+        // The gate fronts the app on whatever interface address the tunnel binds
+        // (an overlay/LAN IP, localhost, or a public domain) — not just `baseURL`.
+        // Better Auth's origin check would reject every other host with
+        // INVALID_ORIGIN and block sign-in. Trust the request's own origin here:
+        // this endpoint sits behind the OTP gate and the tunnel preserves the
+        // browser's Host, so the fixed-origin CSRF check adds nothing while breaking
+        // legitimate access. Same-origin requests (no Origin header) are allowed too.
+        trustedOrigins: (request) => {
+            const requestOrigin = request?.headers.get("origin");
+            return requestOrigin ? [requestOrigin, origin] : [origin];
+        },
+        session: {
+            expiresIn: config.sessionTtlSeconds,
+            updateAge: Math.min(24 * 60 * 60, config.sessionTtlSeconds),
+        },
+        verification: {
+            storeIdentifier: "hashed",
+            storeInDatabase: true,
+        },
+        rateLimit: {
+            enabled: true,
+            window: 15 * 60,
+            max: 10,
+            customRules: {
+                "/email-otp/send-verification-otp": { window: 15 * 60, max: 5 },
+                "/sign-in/email-otp": { window: 15 * 60, max: 10 },
+            },
+        },
+        advanced: {
+            useSecureCookies: origin.startsWith("https://"),
+            ipAddress: {
+                ipAddressHeaders: ["x-real-ip"],
+                disableIpTracking: false,
+            },
+            cookies: {
+                session_token: {
+                    name: config.sessionCookieName ?? SESSION_COOKIE_NAME,
+                    attributes: {
+                        httpOnly: true,
+                        sameSite: "lax",
+                        secure: origin.startsWith("https://"),
+                        path: "/",
+                    },
+                },
+            },
+        },
+        databaseHooks: {
+            user: {
+                create: {
+                    before: async (user) => {
+                        if (!(await config.authorizeIdentity(normalizeEmail(user.email)))) {
+                            throw new APIError("FORBIDDEN", { message: "Identity is not authorized" });
+                        }
+                        return { data: user };
+                    },
+                },
+            },
+        },
+        plugins: [
+            emailOTP({
+                otpLength: 6,
+                expiresIn: config.codeTtlSeconds,
+                allowedAttempts: config.maxAttempts,
+                storeOTP: "hashed",
+                async sendVerificationOTP({ email, otp, type }) {
+                    if (type !== "sign-in")
+                        return;
+                    const address = normalizeEmail(email);
+                    if (!(await config.authorizeIdentity(address))) {
+                        // Accept any address and fail SILENTLY for one not on the allow-list:
+                        // the request still returns 200 (so the gate never reveals who is
+                        // allowed), and no code is sent. Logged at debug for diagnostics, not
+                        // as a warning — an unknown address hitting the login page is normal.
+                        logger.debug("verification code suppressed: identity not authorized", {
+                            email: address,
+                        });
+                        return;
+                    }
+                    logger.info("sending verification code", { email: address });
+                    void config.sendCode(address, otp, emailOptions).catch((error) => {
+                        logger.error("verification email failed", { email: address, error });
+                    });
+                },
+            }),
+            passkey({
+                rpID,
+                rpName: config.appName,
+                origin,
+                authenticatorSelection: {
+                    residentKey: "preferred",
+                    userVerification: "preferred",
+                },
+                registration: { requireSession: true },
+            }),
+        ],
+    };
+    await migrateAuth(options, config.storage);
+    const auth = betterAuth(options);
+    const session = async (headers) => {
+        const current = await auth.api.getSession({ headers });
+        const email = normalizeEmail(current?.user.email);
+        const createdAt = current?.session.createdAt;
+        const createdAtMs = createdAt ? new Date(createdAt).getTime() : Number.NaN;
+        if (config.sessionCutoffMs && !(createdAtMs >= config.sessionCutoffMs))
+            return undefined;
+        if (!email || !(await config.authorizeIdentity(email)))
+            return undefined;
+        return email;
+    };
+    const handleCompatibilityRoute = async (request) => {
+        const path = new URL(request.url).pathname;
+        if (path === `${basePath}/status`) {
+            const email = await session(request.headers);
+            return jsonResponse({
+                authenticated: Boolean(email),
+                ...(email ? { email } : {}),
+                enabled: true,
+                passkeysEnabled: true,
+            });
+        }
+        // OTP send + verify go straight to better-auth's native emailOTP endpoints
+        // (`/email-otp/send-verification-otp`, `/sign-in/email-otp`); there is no
+        // compatibility wrapper for them. Failures there are logged by the plugin's
+        // sendVerificationOTP hook, not swallowed behind an always-ok response.
+        if (path === `${basePath}/logout` && request.method === "POST") {
+            const response = await auth.api.signOut({
+                headers: request.headers,
+                asResponse: true,
+            });
+            return compatibilityResponse(response, { ok: response.ok, redirectTo: logoutRedirectPath });
+        }
+        if (path === `${basePath}/logout` && request.method === "GET") {
+            const response = await auth.api.signOut({
+                headers: request.headers,
+                asResponse: true,
+            });
+            return redirectResponse(response, logoutRedirectPath);
+        }
+        return undefined;
+    };
+    return {
+        basePath,
+        passkeysEnabled: true,
+        handler: async (request) => (await handleCompatibilityRoute(request)) ?? auth.handler(request),
+        session,
+        status: async (headers) => {
+            const email = await session(headers);
+            return {
+                authenticated: Boolean(email),
+                ...(email ? { email } : {}),
+                enabled: true,
+                passkeysEnabled: true,
+            };
+        },
+        close: () => config.storage.close(),
+    };
+}
+/** Restrict logout redirects to one same-origin application path. */
+export function normalizeLogoutRedirectPath(value) {
+    const path = value?.trim();
+    return path?.startsWith("/") && !path.startsWith("//") && !path.includes("\\") ? path : "/";
+}
+function normalizeEmail(email) {
+    return email?.trim().toLowerCase() ?? "";
+}
+function jsonResponse(body, status = 200) {
+    return new Response(JSON.stringify(body), {
+        status,
+        headers: { "content-type": "application/json" },
+    });
+}
+function compatibilityResponse(response, body) {
+    const headers = new Headers({ "content-type": "application/json" });
+    for (const cookie of response.headers.getSetCookie())
+        headers.append("set-cookie", cookie);
+    return new Response(JSON.stringify(body), { status: 200, headers });
+}
+function redirectResponse(response, location) {
+    const headers = new Headers({ location });
+    for (const cookie of response.headers.getSetCookie())
+        headers.append("set-cookie", cookie);
+    return new Response(null, { status: 303, headers });
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXV0aC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9hdXRoLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOzs7Ozs7OztHQVFHO0FBRUgsT0FBTyxFQUFFLE9BQU8sRUFBRSxNQUFNLHNCQUFzQixDQUFDO0FBQy9DLE9BQU8sRUFBbUIsbUJBQW1CLEVBQUUsTUFBTSx3QkFBd0IsQ0FBQztBQUM5RSxPQUFPLEVBQUUsR0FBRyxFQUFFLE1BQU0sd0JBQXdCLENBQUM7QUFDN0MsT0FBTyxFQUFFLFFBQVEsRUFBRSxVQUFVLEVBQTBCLE1BQU0sYUFBYSxDQUFDO0FBQzNFLE9BQU8sRUFBRSxRQUFRLEVBQUUsTUFBTSxxQkFBcUIsQ0FBQztBQUcvQyxPQUFPLEVBQUUsV0FBVyxFQUFFLE1BQU0sY0FBYyxDQUFDO0FBRTNDLE1BQU0sTUFBTSxHQUFHLEdBQUcsQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLENBQUM7QUF1Q2xDLE1BQU0sQ0FBQyxLQUFLLFVBQVUsc0JBQXNCLENBQzFDLE1BQStCO0lBRS9CLE1BQU0sTUFBTSxHQUFHLElBQUksR0FBRyxDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQUMsQ0FBQyxNQUFNLENBQUM7SUFDOUMsTUFBTSxJQUFJLEdBQUcsSUFBSSxHQUFHLENBQUMsTUFBTSxDQUFDLENBQUMsUUFBUSxDQUFDO0lBQ3RDLE1BQU0sUUFBUSxHQUFHLE1BQU0sQ0FBQyxRQUFRLElBQUksV0FBVyxDQUFDO0lBQ2hELE1BQU0sa0JBQWtCLEdBQUcsMkJBQTJCLENBQUMsTUFBTSxDQUFDLGtCQUFrQixDQUFDLENBQUM7SUFDbEYsTUFBTSxZQUFZLEdBQXFCO1FBQ3JDLE9BQU8sRUFBRSxNQUFNLENBQUMsT0FBTyxJQUFJLHdCQUF3QjtRQUNuRCxTQUFTLEVBQUUsTUFBTSxDQUFDLE9BQU87UUFDekIsT0FBTyxFQUFFLE1BQU0sQ0FBQyxPQUFPLElBQUksNEJBQTRCO1FBQ3ZELGNBQWMsRUFBRSxNQUFNLENBQUMsY0FBYztLQUN0QyxDQUFDO0lBRUYsTUFBTSxPQUFPLEdBQUc7UUFDZCxPQUFPLEVBQUUsTUFBTSxDQUFDLE9BQU87UUFDdkIsT0FBTyxFQUFFLE1BQU07UUFDZixRQUFRO1FBQ1IsUUFBUSxFQUFFLE1BQU0sQ0FBQyxPQUFPLENBQUMsUUFBUTtRQUNqQyxNQUFNLEVBQUUsTUFBTSxDQUFDLE1BQU07UUFDckIseUVBQXlFO1FBQ3pFLDJFQUEyRTtRQUMzRSxnRUFBZ0U7UUFDaEUseUVBQXlFO1FBQ3pFLHNFQUFzRTtRQUN0RSw2RUFBNkU7UUFDN0UsOEVBQThFO1FBQzlFLGNBQWMsRUFBRSxDQUFDLE9BQWlCLEVBQUUsRUFBRTtZQUNwQyxNQUFNLGFBQWEsR0FBRyxPQUFPLEVBQUUsT0FBTyxDQUFDLEdBQUcsQ0FBQyxRQUFRLENBQUMsQ0FBQztZQUNyRCxPQUFPLGFBQWEsQ0FBQyxDQUFDLENBQUMsQ0FBQyxhQUFhLEVBQUUsTUFBTSxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDLENBQUM7UUFDNUQsQ0FBQztRQUNELE9BQU8sRUFBRTtZQUNQLFNBQVMsRUFBRSxNQUFNLENBQUMsaUJBQWlCO1lBQ25DLFNBQVMsRUFBRSxJQUFJLENBQUMsR0FBRyxDQUFDLEVBQUUsR0FBRyxFQUFFLEdBQUcsRUFBRSxFQUFFLE1BQU0sQ0FBQyxpQkFBaUIsQ0FBQztTQUM1RDtRQUNELFlBQVksRUFBRTtZQUNaLGVBQWUsRUFBRSxRQUFRO1lBQ3pCLGVBQWUsRUFBRSxJQUFJO1NBQ3RCO1FBQ0QsU0FBUyxFQUFFO1lBQ1QsT0FBTyxFQUFFLElBQUk7WUFDYixNQUFNLEVBQUUsRUFBRSxHQUFHLEVBQUU7WUFDZixHQUFHLEVBQUUsRUFBRTtZQUNQLFdBQVcsRUFBRTtnQkFDWCxrQ0FBa0MsRUFBRSxFQUFFLE1BQU0sRUFBRSxFQUFFLEdBQUcsRUFBRSxFQUFFLEdBQUcsRUFBRSxDQUFDLEVBQUU7Z0JBQy9ELG9CQUFvQixFQUFFLEVBQUUsTUFBTSxFQUFFLEVBQUUsR0FBRyxFQUFFLEVBQUUsR0FBRyxFQUFFLEVBQUUsRUFBRTthQUNuRDtTQUNGO1FBQ0QsUUFBUSxFQUFFO1lBQ1IsZ0JBQWdCLEVBQUUsTUFBTSxDQUFDLFVBQVUsQ0FBQyxVQUFVLENBQUM7WUFDL0MsU0FBUyxFQUFFO2dCQUNULGdCQUFnQixFQUFFLENBQUMsV0FBVyxDQUFDO2dCQUMvQixpQkFBaUIsRUFBRSxLQUFLO2FBQ3pCO1lBQ0QsT0FBTyxFQUFFO2dCQUNQLGFBQWEsRUFBRTtvQkFDYixJQUFJLEVBQUUsTUFBTSxDQUFDLGlCQUFpQixJQUFJLG1CQUFtQjtvQkFDckQsVUFBVSxFQUFFO3dCQUNWLFFBQVEsRUFBRSxJQUFJO3dCQUNkLFFBQVEsRUFBRSxLQUFLO3dCQUNmLE1BQU0sRUFBRSxNQUFNLENBQUMsVUFBVSxDQUFDLFVBQVUsQ0FBQzt3QkFDckMsSUFBSSxFQUFFLEdBQUc7cUJBQ1Y7aUJBQ0Y7YUFDRjtTQUNGO1FBQ0QsYUFBYSxFQUFFO1lBQ2IsSUFBSSxFQUFFO2dCQUNKLE1BQU0sRUFBRTtvQkFDTixNQUFNLEVBQUUsS0FBSyxFQUFFLElBQXVCLEVBQUUsRUFBRTt3QkFDeEMsSUFBSSxDQUFDLENBQUMsTUFBTSxNQUFNLENBQUMsaUJBQWlCLENBQUMsY0FBYyxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQzs0QkFDbEUsTUFBTSxJQUFJLFFBQVEsQ0FBQyxXQUFXLEVBQUUsRUFBRSxPQUFPLEVBQUUsNEJBQTRCLEVBQUUsQ0FBQyxDQUFDO3dCQUM3RSxDQUFDO3dCQUNELE9BQU8sRUFBRSxJQUFJLEVBQUUsSUFBSSxFQUFFLENBQUM7b0JBQ3hCLENBQUM7aUJBQ0Y7YUFDRjtTQUNGO1FBQ0QsT0FBTyxFQUFFO1lBQ1AsUUFBUSxDQUFDO2dCQUNQLFNBQVMsRUFBRSxDQUFDO2dCQUNaLFNBQVMsRUFBRSxNQUFNLENBQUMsY0FBYztnQkFDaEMsZUFBZSxFQUFFLE1BQU0sQ0FBQyxXQUFXO2dCQUNuQyxRQUFRLEVBQUUsUUFBUTtnQkFDbEIsS0FBSyxDQUFDLG1CQUFtQixDQUFDLEVBQUUsS0FBSyxFQUFFLEdBQUcsRUFBRSxJQUFJLEVBQUU7b0JBQzVDLElBQUksSUFBSSxLQUFLLFNBQVM7d0JBQUUsT0FBTztvQkFDL0IsTUFBTSxPQUFPLEdBQUcsY0FBYyxDQUFDLEtBQUssQ0FBQyxDQUFDO29CQUN0QyxJQUFJLENBQUMsQ0FBQyxNQUFNLE1BQU0sQ0FBQyxpQkFBaUIsQ0FBQyxPQUFPLENBQUMsQ0FBQyxFQUFFLENBQUM7d0JBQy9DLHNFQUFzRTt3QkFDdEUsa0VBQWtFO3dCQUNsRSxzRUFBc0U7d0JBQ3RFLHNFQUFzRTt3QkFDdEUsTUFBTSxDQUFDLEtBQUssQ0FBQyx1REFBdUQsRUFBRTs0QkFDcEUsS0FBSyxFQUFFLE9BQU87eUJBQ2YsQ0FBQyxDQUFDO3dCQUNILE9BQU87b0JBQ1QsQ0FBQztvQkFDRCxNQUFNLENBQUMsSUFBSSxDQUFDLDJCQUEyQixFQUFFLEVBQUUsS0FBSyxFQUFFLE9BQU8sRUFBRSxDQUFDLENBQUM7b0JBQzdELEtBQUssTUFBTSxDQUFDLFFBQVEsQ0FBQyxPQUFPLEVBQUUsR0FBRyxFQUFFLFlBQVksQ0FBQyxDQUFDLEtBQUssQ0FBQyxDQUFDLEtBQWMsRUFBRSxFQUFFO3dCQUN4RSxNQUFNLENBQUMsS0FBSyxDQUFDLDJCQUEyQixFQUFFLEVBQUUsS0FBSyxFQUFFLE9BQU8sRUFBRSxLQUFLLEVBQUUsQ0FBQyxDQUFDO29CQUN2RSxDQUFDLENBQUMsQ0FBQztnQkFDTCxDQUFDO2FBQ0YsQ0FBQztZQUNGLE9BQU8sQ0FBQztnQkFDTixJQUFJO2dCQUNKLE1BQU0sRUFBRSxNQUFNLENBQUMsT0FBTztnQkFDdEIsTUFBTTtnQkFDTixzQkFBc0IsRUFBRTtvQkFDdEIsV0FBVyxFQUFFLFdBQVc7b0JBQ3hCLGdCQUFnQixFQUFFLFdBQVc7aUJBQzlCO2dCQUNELFlBQVksRUFBRSxFQUFFLGNBQWMsRUFBRSxJQUFJLEVBQUU7YUFDdkMsQ0FBQztTQUNNO0tBQ2lCLENBQUM7SUFFOUIsTUFBTSxXQUFXLENBQUMsT0FBTyxFQUFFLE1BQU0sQ0FBQyxPQUFPLENBQUMsQ0FBQztJQUMzQyxNQUFNLElBQUksR0FBRyxVQUFVLENBQUMsT0FBTyxDQUFDLENBQUM7SUFFakMsTUFBTSxPQUFPLEdBQUcsS0FBSyxFQUFFLE9BQWdCLEVBQStCLEVBQUU7UUFDdEUsTUFBTSxPQUFPLEdBQUcsTUFBTSxJQUFJLENBQUMsR0FBRyxDQUFDLFVBQVUsQ0FBQyxFQUFFLE9BQU8sRUFBRSxDQUFDLENBQUM7UUFDdkQsTUFBTSxLQUFLLEdBQUcsY0FBYyxDQUFDLE9BQU8sRUFBRSxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDbEQsTUFBTSxTQUFTLEdBQUcsT0FBTyxFQUFFLE9BQU8sQ0FBQyxTQUFTLENBQUM7UUFDN0MsTUFBTSxXQUFXLEdBQUcsU0FBUyxDQUFDLENBQUMsQ0FBQyxJQUFJLElBQUksQ0FBQyxTQUFTLENBQUMsQ0FBQyxPQUFPLEVBQUUsQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQztRQUMzRSxJQUFJLE1BQU0sQ0FBQyxlQUFlLElBQUksQ0FBQyxDQUFDLFdBQVcsSUFBSSxNQUFNLENBQUMsZUFBZSxDQUFDO1lBQUUsT0FBTyxTQUFTLENBQUM7UUFDekYsSUFBSSxDQUFDLEtBQUssSUFBSSxDQUFDLENBQUMsTUFBTSxNQUFNLENBQUMsaUJBQWlCLENBQUMsS0FBSyxDQUFDLENBQUM7WUFBRSxPQUFPLFNBQVMsQ0FBQztRQUN6RSxPQUFPLEtBQUssQ0FBQztJQUNmLENBQUMsQ0FBQztJQUVGLE1BQU0sd0JBQXdCLEdBQUcsS0FBSyxFQUFFLE9BQWdCLEVBQWlDLEVBQUU7UUFDekYsTUFBTSxJQUFJLEdBQUcsSUFBSSxHQUFHLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxDQUFDLFFBQVEsQ0FBQztRQUMzQyxJQUFJLElBQUksS0FBSyxHQUFHLFFBQVEsU0FBUyxFQUFFLENBQUM7WUFDbEMsTUFBTSxLQUFLLEdBQUcsTUFBTSxPQUFPLENBQUMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxDQUFDO1lBQzdDLE9BQU8sWUFBWSxDQUFDO2dCQUNsQixhQUFhLEVBQUUsT0FBTyxDQUFDLEtBQUssQ0FBQztnQkFDN0IsR0FBRyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsRUFBRSxLQUFLLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO2dCQUMzQixPQUFPLEVBQUUsSUFBSTtnQkFDYixlQUFlLEVBQUUsSUFBSTthQUN0QixDQUFDLENBQUM7UUFDTCxDQUFDO1FBQ0QsMkVBQTJFO1FBQzNFLDBFQUEwRTtRQUMxRSw0RUFBNEU7UUFDNUUsd0VBQXdFO1FBQ3hFLElBQUksSUFBSSxLQUFLLEdBQUcsUUFBUSxTQUFTLElBQUksT0FBTyxDQUFDLE1BQU0sS0FBSyxNQUFNLEVBQUUsQ0FBQztZQUMvRCxNQUFNLFFBQVEsR0FBRyxNQUFNLElBQUksQ0FBQyxHQUFHLENBQUMsT0FBTyxDQUFDO2dCQUN0QyxPQUFPLEVBQUUsT0FBTyxDQUFDLE9BQU87Z0JBQ3hCLFVBQVUsRUFBRSxJQUFJO2FBQ2pCLENBQUMsQ0FBQztZQUNILE9BQU8scUJBQXFCLENBQUMsUUFBUSxFQUFFLEVBQUUsRUFBRSxFQUFFLFFBQVEsQ0FBQyxFQUFFLEVBQUUsVUFBVSxFQUFFLGtCQUFrQixFQUFFLENBQUMsQ0FBQztRQUM5RixDQUFDO1FBQ0QsSUFBSSxJQUFJLEtBQUssR0FBRyxRQUFRLFNBQVMsSUFBSSxPQUFPLENBQUMsTUFBTSxLQUFLLEtBQUssRUFBRSxDQUFDO1lBQzlELE1BQU0sUUFBUSxHQUFHLE1BQU0sSUFBSSxDQUFDLEdBQUcsQ0FBQyxPQUFPLENBQUM7Z0JBQ3RDLE9BQU8sRUFBRSxPQUFPLENBQUMsT0FBTztnQkFDeEIsVUFBVSxFQUFFLElBQUk7YUFDakIsQ0FBQyxDQUFDO1lBQ0gsT0FBTyxnQkFBZ0IsQ0FBQyxRQUFRLEVBQUUsa0JBQWtCLENBQUMsQ0FBQztRQUN4RCxDQUFDO1FBQ0QsT0FBTyxTQUFTLENBQUM7SUFDbkIsQ0FBQyxDQUFDO0lBRUYsT0FBTztRQUNMLFFBQVE7UUFDUixlQUFlLEVBQUUsSUFBSTtRQUNyQixPQUFPLEVBQUUsS0FBSyxFQUFFLE9BQU8sRUFBRSxFQUFFLENBQUMsQ0FBQyxNQUFNLHdCQUF3QixDQUFDLE9BQU8sQ0FBQyxDQUFDLElBQUksSUFBSSxDQUFDLE9BQU8sQ0FBQyxPQUFPLENBQUM7UUFDOUYsT0FBTztRQUNQLE1BQU0sRUFBRSxLQUFLLEVBQUUsT0FBTyxFQUFFLEVBQUU7WUFDeEIsTUFBTSxLQUFLLEdBQUcsTUFBTSxPQUFPLENBQUMsT0FBTyxDQUFDLENBQUM7WUFDckMsT0FBTztnQkFDTCxhQUFhLEVBQUUsT0FBTyxDQUFDLEtBQUssQ0FBQztnQkFDN0IsR0FBRyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsRUFBRSxLQUFLLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO2dCQUMzQixPQUFPLEVBQUUsSUFBSTtnQkFDYixlQUFlLEVBQUUsSUFBSTthQUN0QixDQUFDO1FBQ0osQ0FBQztRQUNELEtBQUssRUFBRSxHQUFHLEVBQUUsQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDLEtBQUssRUFBRTtLQUNwQyxDQUFDO0FBQ0osQ0FBQztBQUVELHFFQUFxRTtBQUNyRSxNQUFNLFVBQVUsMkJBQTJCLENBQUMsS0FBeUI7SUFDbkUsTUFBTSxJQUFJLEdBQUcsS0FBSyxFQUFFLElBQUksRUFBRSxDQUFDO0lBQzNCLE9BQU8sSUFBSSxFQUFFLFVBQVUsQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLEdBQUcsQ0FBQztBQUM5RixDQUFDO0FBRUQsU0FBUyxjQUFjLENBQUMsS0FBeUI7SUFDL0MsT0FBTyxLQUFLLEVBQUUsSUFBSSxFQUFFLENBQUMsV0FBVyxFQUFFLElBQUksRUFBRSxDQUFDO0FBQzNDLENBQUM7QUFFRCxTQUFTLFlBQVksQ0FBQyxJQUFhLEVBQUUsTUFBTSxHQUFHLEdBQUc7SUFDL0MsT0FBTyxJQUFJLFFBQVEsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLElBQUksQ0FBQyxFQUFFO1FBQ3hDLE1BQU07UUFDTixPQUFPLEVBQUUsRUFBRSxjQUFjLEVBQUUsa0JBQWtCLEVBQUU7S0FDaEQsQ0FBQyxDQUFDO0FBQ0wsQ0FBQztBQUVELFNBQVMscUJBQXFCLENBQUMsUUFBa0IsRUFBRSxJQUFhO0lBQzlELE1BQU0sT0FBTyxHQUFHLElBQUksT0FBTyxDQUFDLEVBQUUsY0FBYyxFQUFFLGtCQUFrQixFQUFFLENBQUMsQ0FBQztJQUNwRSxLQUFLLE1BQU0sTUFBTSxJQUFJLFFBQVEsQ0FBQyxPQUFPLENBQUMsWUFBWSxFQUFFO1FBQUUsT0FBTyxDQUFDLE1BQU0sQ0FBQyxZQUFZLEVBQUUsTUFBTSxDQUFDLENBQUM7SUFDM0YsT0FBTyxJQUFJLFFBQVEsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLElBQUksQ0FBQyxFQUFFLEVBQUUsTUFBTSxFQUFFLEdBQUcsRUFBRSxPQUFPLEVBQUUsQ0FBQyxDQUFDO0FBQ3RFLENBQUM7QUFFRCxTQUFTLGdCQUFnQixDQUFDLFFBQWtCLEVBQUUsUUFBZ0I7SUFDNUQsTUFBTSxPQUFPLEdBQUcsSUFBSSxPQUFPLENBQUMsRUFBRSxRQUFRLEVBQUUsQ0FBQyxDQUFDO0lBQzFDLEtBQUssTUFBTSxNQUFNLElBQUksUUFBUSxDQUFDLE9BQU8sQ0FBQyxZQUFZLEVBQUU7UUFBRSxPQUFPLENBQUMsTUFBTSxDQUFDLFlBQVksRUFBRSxNQUFNLENBQUMsQ0FBQztJQUMzRixPQUFPLElBQUksUUFBUSxDQUFDLElBQUksRUFBRSxFQUFFLE1BQU0sRUFBRSxHQUFHLEVBQUUsT0FBTyxFQUFFLENBQUMsQ0FBQztBQUN0RCxDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiLyoqXG4gKiBCZXR0ZXIgQXV0aCBwYXNzd29yZGxlc3MgcnVudGltZSB3aXRoIGVtYWlsIE9UUCBhbmQgcGFzc2tleXMuXG4gKlxuICogQ2FsbGVycyBwcm92aWRlIGF1dGhvcml6YXRpb24sIGRlbGl2ZXJ5LCBzdG9yYWdlLCBvcmlnaW4sIGFuZCBzZWNyZXQuIEJldHRlclxuICogQXV0aCBvd25zIHVzZXJzLCBPVFAgdmVyaWZpY2F0aW9uIHJlY29yZHMsIHNlc3Npb25zLCByYXRlIGxpbWl0cywgcGFzc2tleVxuICogY3JlZGVudGlhbHMsIGFuZCB0aGVpciBuYXRpdmUgSFRUUCByb3V0ZXMuXG4gKlxuICogQG1vZHVsZVxuICovXG5cbmltcG9ydCB7IHBhc3NrZXkgfSBmcm9tIFwiQGJldHRlci1hdXRoL3Bhc3NrZXlcIjtcbmltcG9ydCB7IHR5cGUgQXV0aFN0YXR1cywgU0VTU0lPTl9DT09LSUVfTkFNRSB9IGZyb20gXCJAZGJ4LXRvb2xzL3NoYXJlZC1hdXRoXCI7XG5pbXBvcnQgeyBsb2cgfSBmcm9tIFwiQGRieC10b29scy9zaGFyZWQtY29yZVwiO1xuaW1wb3J0IHsgQVBJRXJyb3IsIGJldHRlckF1dGgsIHR5cGUgQmV0dGVyQXV0aE9wdGlvbnMgfSBmcm9tIFwiYmV0dGVyLWF1dGhcIjtcbmltcG9ydCB7IGVtYWlsT1RQIH0gZnJvbSBcImJldHRlci1hdXRoL3BsdWdpbnNcIjtcblxuaW1wb3J0IHR5cGUgeyBBdXRoU3RvcmFnZSB9IGZyb20gXCIuL3N0b3JhZ2UudHNcIjtcbmltcG9ydCB7IG1pZ3JhdGVBdXRoIH0gZnJvbSBcIi4vc3RvcmFnZS50c1wiO1xuXG5jb25zdCBsb2dnZXIgPSBsb2cubG9nZ2VyKFwiYXV0aFwiKTtcblxuZXhwb3J0IHR5cGUgQXV0aG9yaXplSWRlbnRpdHkgPSAoZW1haWw6IHN0cmluZykgPT4gYm9vbGVhbiB8IFByb21pc2U8Ym9vbGVhbj47XG5cbmV4cG9ydCBpbnRlcmZhY2UgQXV0aEVtYWlsT3B0aW9ucyB7XG4gIHN1YmplY3Q6IHN0cmluZztcbiAgYnJhbmROYW1lOiBzdHJpbmc7XG4gIG1lc3NhZ2U6IHN0cmluZztcbiAgY29kZVR0bFNlY29uZHM6IG51bWJlcjtcbn1cblxuZXhwb3J0IGludGVyZmFjZSBQYXNzd29yZGxlc3NBdXRoT3B0aW9ucyB7XG4gIHN0b3JhZ2U6IEF1dGhTdG9yYWdlO1xuICBiYXNlVVJMOiBzdHJpbmc7XG4gIGJhc2VQYXRoPzogc3RyaW5nO1xuICBhcHBOYW1lOiBzdHJpbmc7XG4gIHNlY3JldDogc3RyaW5nO1xuICBzZXNzaW9uQ29va2llTmFtZT86IHN0cmluZztcbiAgLyoqIFNhbWUtb3JpZ2luIHBhdGggcmV0dXJuZWQgYWZ0ZXIgbG9nb3V0LiBEZWZhdWx0cyB0byBgL2AuICovXG4gIGxvZ291dFJlZGlyZWN0UGF0aD86IHN0cmluZztcbiAgc2Vzc2lvblR0bFNlY29uZHM6IG51bWJlcjtcbiAgc2Vzc2lvbkN1dG9mZk1zPzogbnVtYmVyO1xuICBjb2RlVHRsU2Vjb25kczogbnVtYmVyO1xuICBtYXhBdHRlbXB0czogbnVtYmVyO1xuICBhdXRob3JpemVJZGVudGl0eTogQXV0aG9yaXplSWRlbnRpdHk7XG4gIHNlbmRDb2RlKGVtYWlsOiBzdHJpbmcsIGNvZGU6IHN0cmluZywgb3B0aW9uczogQXV0aEVtYWlsT3B0aW9ucyk6IFByb21pc2U8dm9pZD47XG4gIHN1YmplY3Q/OiBzdHJpbmc7XG4gIG1lc3NhZ2U/OiBzdHJpbmc7XG59XG5cbmV4cG9ydCBpbnRlcmZhY2UgUGFzc3dvcmRsZXNzQXV0aFJ1bnRpbWUge1xuICByZWFkb25seSBiYXNlUGF0aDogc3RyaW5nO1xuICByZWFkb25seSBwYXNza2V5c0VuYWJsZWQ6IGJvb2xlYW47XG4gIGhhbmRsZXIocmVxdWVzdDogUmVxdWVzdCk6IFByb21pc2U8UmVzcG9uc2U+O1xuICBzZXNzaW9uKGhlYWRlcnM6IEhlYWRlcnMpOiBQcm9taXNlPHN0cmluZyB8IHVuZGVmaW5lZD47XG4gIHN0YXR1cyhoZWFkZXJzOiBIZWFkZXJzKTogUHJvbWlzZTxBdXRoU3RhdHVzPjtcbiAgY2xvc2UoKTogUHJvbWlzZTx2b2lkPjtcbn1cblxuZXhwb3J0IGFzeW5jIGZ1bmN0aW9uIGNyZWF0ZVBhc3N3b3JkbGVzc0F1dGgoXG4gIGNvbmZpZzogUGFzc3dvcmRsZXNzQXV0aE9wdGlvbnMsXG4pOiBQcm9taXNlPFBhc3N3b3JkbGVzc0F1dGhSdW50aW1lPiB7XG4gIGNvbnN0IG9yaWdpbiA9IG5ldyBVUkwoY29uZmlnLmJhc2VVUkwpLm9yaWdpbjtcbiAgY29uc3QgcnBJRCA9IG5ldyBVUkwob3JpZ2luKS5ob3N0bmFtZTtcbiAgY29uc3QgYmFzZVBhdGggPSBjb25maWcuYmFzZVBhdGggPz8gXCIvYXBpL2F1dGhcIjtcbiAgY29uc3QgbG9nb3V0UmVkaXJlY3RQYXRoID0gbm9ybWFsaXplTG9nb3V0UmVkaXJlY3RQYXRoKGNvbmZpZy5sb2dvdXRSZWRpcmVjdFBhdGgpO1xuICBjb25zdCBlbWFpbE9wdGlvbnM6IEF1dGhFbWFpbE9wdGlvbnMgPSB7XG4gICAgc3ViamVjdDogY29uZmlnLnN1YmplY3QgPz8gXCJZb3VyIHZlcmlmaWNhdGlvbiBjb2RlXCIsXG4gICAgYnJhbmROYW1lOiBjb25maWcuYXBwTmFtZSxcbiAgICBtZXNzYWdlOiBjb25maWcubWVzc2FnZSA/PyBcIllvdXIgdmVyaWZpY2F0aW9uIGNvZGUgaXM6XCIsXG4gICAgY29kZVR0bFNlY29uZHM6IGNvbmZpZy5jb2RlVHRsU2Vjb25kcyxcbiAgfTtcblxuICBjb25zdCBvcHRpb25zID0ge1xuICAgIGFwcE5hbWU6IGNvbmZpZy5hcHBOYW1lLFxuICAgIGJhc2VVUkw6IG9yaWdpbixcbiAgICBiYXNlUGF0aCxcbiAgICBkYXRhYmFzZTogY29uZmlnLnN0b3JhZ2UuZGF0YWJhc2UsXG4gICAgc2VjcmV0OiBjb25maWcuc2VjcmV0LFxuICAgIC8vIFRoZSBnYXRlIGZyb250cyB0aGUgYXBwIG9uIHdoYXRldmVyIGludGVyZmFjZSBhZGRyZXNzIHRoZSB0dW5uZWwgYmluZHNcbiAgICAvLyAoYW4gb3ZlcmxheS9MQU4gSVAsIGxvY2FsaG9zdCwgb3IgYSBwdWJsaWMgZG9tYWluKSDigJQgbm90IGp1c3QgYGJhc2VVUkxgLlxuICAgIC8vIEJldHRlciBBdXRoJ3Mgb3JpZ2luIGNoZWNrIHdvdWxkIHJlamVjdCBldmVyeSBvdGhlciBob3N0IHdpdGhcbiAgICAvLyBJTlZBTElEX09SSUdJTiBhbmQgYmxvY2sgc2lnbi1pbi4gVHJ1c3QgdGhlIHJlcXVlc3QncyBvd24gb3JpZ2luIGhlcmU6XG4gICAgLy8gdGhpcyBlbmRwb2ludCBzaXRzIGJlaGluZCB0aGUgT1RQIGdhdGUgYW5kIHRoZSB0dW5uZWwgcHJlc2VydmVzIHRoZVxuICAgIC8vIGJyb3dzZXIncyBIb3N0LCBzbyB0aGUgZml4ZWQtb3JpZ2luIENTUkYgY2hlY2sgYWRkcyBub3RoaW5nIHdoaWxlIGJyZWFraW5nXG4gICAgLy8gbGVnaXRpbWF0ZSBhY2Nlc3MuIFNhbWUtb3JpZ2luIHJlcXVlc3RzIChubyBPcmlnaW4gaGVhZGVyKSBhcmUgYWxsb3dlZCB0b28uXG4gICAgdHJ1c3RlZE9yaWdpbnM6IChyZXF1ZXN0PzogUmVxdWVzdCkgPT4ge1xuICAgICAgY29uc3QgcmVxdWVzdE9yaWdpbiA9IHJlcXVlc3Q/LmhlYWRlcnMuZ2V0KFwib3JpZ2luXCIpO1xuICAgICAgcmV0dXJuIHJlcXVlc3RPcmlnaW4gPyBbcmVxdWVzdE9yaWdpbiwgb3JpZ2luXSA6IFtvcmlnaW5dO1xuICAgIH0sXG4gICAgc2Vzc2lvbjoge1xuICAgICAgZXhwaXJlc0luOiBjb25maWcuc2Vzc2lvblR0bFNlY29uZHMsXG4gICAgICB1cGRhdGVBZ2U6IE1hdGgubWluKDI0ICogNjAgKiA2MCwgY29uZmlnLnNlc3Npb25UdGxTZWNvbmRzKSxcbiAgICB9LFxuICAgIHZlcmlmaWNhdGlvbjoge1xuICAgICAgc3RvcmVJZGVudGlmaWVyOiBcImhhc2hlZFwiLFxuICAgICAgc3RvcmVJbkRhdGFiYXNlOiB0cnVlLFxuICAgIH0sXG4gICAgcmF0ZUxpbWl0OiB7XG4gICAgICBlbmFibGVkOiB0cnVlLFxuICAgICAgd2luZG93OiAxNSAqIDYwLFxuICAgICAgbWF4OiAxMCxcbiAgICAgIGN1c3RvbVJ1bGVzOiB7XG4gICAgICAgIFwiL2VtYWlsLW90cC9zZW5kLXZlcmlmaWNhdGlvbi1vdHBcIjogeyB3aW5kb3c6IDE1ICogNjAsIG1heDogNSB9LFxuICAgICAgICBcIi9zaWduLWluL2VtYWlsLW90cFwiOiB7IHdpbmRvdzogMTUgKiA2MCwgbWF4OiAxMCB9LFxuICAgICAgfSxcbiAgICB9LFxuICAgIGFkdmFuY2VkOiB7XG4gICAgICB1c2VTZWN1cmVDb29raWVzOiBvcmlnaW4uc3RhcnRzV2l0aChcImh0dHBzOi8vXCIpLFxuICAgICAgaXBBZGRyZXNzOiB7XG4gICAgICAgIGlwQWRkcmVzc0hlYWRlcnM6IFtcIngtcmVhbC1pcFwiXSxcbiAgICAgICAgZGlzYWJsZUlwVHJhY2tpbmc6IGZhbHNlLFxuICAgICAgfSxcbiAgICAgIGNvb2tpZXM6IHtcbiAgICAgICAgc2Vzc2lvbl90b2tlbjoge1xuICAgICAgICAgIG5hbWU6IGNvbmZpZy5zZXNzaW9uQ29va2llTmFtZSA/PyBTRVNTSU9OX0NPT0tJRV9OQU1FLFxuICAgICAgICAgIGF0dHJpYnV0ZXM6IHtcbiAgICAgICAgICAgIGh0dHBPbmx5OiB0cnVlLFxuICAgICAgICAgICAgc2FtZVNpdGU6IFwibGF4XCIsXG4gICAgICAgICAgICBzZWN1cmU6IG9yaWdpbi5zdGFydHNXaXRoKFwiaHR0cHM6Ly9cIiksXG4gICAgICAgICAgICBwYXRoOiBcIi9cIixcbiAgICAgICAgICB9LFxuICAgICAgICB9LFxuICAgICAgfSxcbiAgICB9LFxuICAgIGRhdGFiYXNlSG9va3M6IHtcbiAgICAgIHVzZXI6IHtcbiAgICAgICAgY3JlYXRlOiB7XG4gICAgICAgICAgYmVmb3JlOiBhc3luYyAodXNlcjogeyBlbWFpbDogc3RyaW5nIH0pID0+IHtcbiAgICAgICAgICAgIGlmICghKGF3YWl0IGNvbmZpZy5hdXRob3JpemVJZGVudGl0eShub3JtYWxpemVFbWFpbCh1c2VyLmVtYWlsKSkpKSB7XG4gICAgICAgICAgICAgIHRocm93IG5ldyBBUElFcnJvcihcIkZPUkJJRERFTlwiLCB7IG1lc3NhZ2U6IFwiSWRlbnRpdHkgaXMgbm90IGF1dGhvcml6ZWRcIiB9KTtcbiAgICAgICAgICAgIH1cbiAgICAgICAgICAgIHJldHVybiB7IGRhdGE6IHVzZXIgfTtcbiAgICAgICAgICB9LFxuICAgICAgICB9LFxuICAgICAgfSxcbiAgICB9LFxuICAgIHBsdWdpbnM6IFtcbiAgICAgIGVtYWlsT1RQKHtcbiAgICAgICAgb3RwTGVuZ3RoOiA2LFxuICAgICAgICBleHBpcmVzSW46IGNvbmZpZy5jb2RlVHRsU2Vjb25kcyxcbiAgICAgICAgYWxsb3dlZEF0dGVtcHRzOiBjb25maWcubWF4QXR0ZW1wdHMsXG4gICAgICAgIHN0b3JlT1RQOiBcImhhc2hlZFwiLFxuICAgICAgICBhc3luYyBzZW5kVmVyaWZpY2F0aW9uT1RQKHsgZW1haWwsIG90cCwgdHlwZSB9KSB7XG4gICAgICAgICAgaWYgKHR5cGUgIT09IFwic2lnbi1pblwiKSByZXR1cm47XG4gICAgICAgICAgY29uc3QgYWRkcmVzcyA9IG5vcm1hbGl6ZUVtYWlsKGVtYWlsKTtcbiAgICAgICAgICBpZiAoIShhd2FpdCBjb25maWcuYXV0aG9yaXplSWRlbnRpdHkoYWRkcmVzcykpKSB7XG4gICAgICAgICAgICAvLyBBY2NlcHQgYW55IGFkZHJlc3MgYW5kIGZhaWwgU0lMRU5UTFkgZm9yIG9uZSBub3Qgb24gdGhlIGFsbG93LWxpc3Q6XG4gICAgICAgICAgICAvLyB0aGUgcmVxdWVzdCBzdGlsbCByZXR1cm5zIDIwMCAoc28gdGhlIGdhdGUgbmV2ZXIgcmV2ZWFscyB3aG8gaXNcbiAgICAgICAgICAgIC8vIGFsbG93ZWQpLCBhbmQgbm8gY29kZSBpcyBzZW50LiBMb2dnZWQgYXQgZGVidWcgZm9yIGRpYWdub3N0aWNzLCBub3RcbiAgICAgICAgICAgIC8vIGFzIGEgd2FybmluZyDigJQgYW4gdW5rbm93biBhZGRyZXNzIGhpdHRpbmcgdGhlIGxvZ2luIHBhZ2UgaXMgbm9ybWFsLlxuICAgICAgICAgICAgbG9nZ2VyLmRlYnVnKFwidmVyaWZpY2F0aW9uIGNvZGUgc3VwcHJlc3NlZDogaWRlbnRpdHkgbm90IGF1dGhvcml6ZWRcIiwge1xuICAgICAgICAgICAgICBlbWFpbDogYWRkcmVzcyxcbiAgICAgICAgICAgIH0pO1xuICAgICAgICAgICAgcmV0dXJuO1xuICAgICAgICAgIH1cbiAgICAgICAgICBsb2dnZXIuaW5mbyhcInNlbmRpbmcgdmVyaWZpY2F0aW9uIGNvZGVcIiwgeyBlbWFpbDogYWRkcmVzcyB9KTtcbiAgICAgICAgICB2b2lkIGNvbmZpZy5zZW5kQ29kZShhZGRyZXNzLCBvdHAsIGVtYWlsT3B0aW9ucykuY2F0Y2goKGVycm9yOiB1bmtub3duKSA9PiB7XG4gICAgICAgICAgICBsb2dnZXIuZXJyb3IoXCJ2ZXJpZmljYXRpb24gZW1haWwgZmFpbGVkXCIsIHsgZW1haWw6IGFkZHJlc3MsIGVycm9yIH0pO1xuICAgICAgICAgIH0pO1xuICAgICAgICB9LFxuICAgICAgfSksXG4gICAgICBwYXNza2V5KHtcbiAgICAgICAgcnBJRCxcbiAgICAgICAgcnBOYW1lOiBjb25maWcuYXBwTmFtZSxcbiAgICAgICAgb3JpZ2luLFxuICAgICAgICBhdXRoZW50aWNhdG9yU2VsZWN0aW9uOiB7XG4gICAgICAgICAgcmVzaWRlbnRLZXk6IFwicHJlZmVycmVkXCIsXG4gICAgICAgICAgdXNlclZlcmlmaWNhdGlvbjogXCJwcmVmZXJyZWRcIixcbiAgICAgICAgfSxcbiAgICAgICAgcmVnaXN0cmF0aW9uOiB7IHJlcXVpcmVTZXNzaW9uOiB0cnVlIH0sXG4gICAgICB9KSxcbiAgICBdIGFzIGNvbnN0LFxuICB9IHNhdGlzZmllcyBCZXR0ZXJBdXRoT3B0aW9ucztcblxuICBhd2FpdCBtaWdyYXRlQXV0aChvcHRpb25zLCBjb25maWcuc3RvcmFnZSk7XG4gIGNvbnN0IGF1dGggPSBiZXR0ZXJBdXRoKG9wdGlvbnMpO1xuXG4gIGNvbnN0IHNlc3Npb24gPSBhc3luYyAoaGVhZGVyczogSGVhZGVycyk6IFByb21pc2U8c3RyaW5nIHwgdW5kZWZpbmVkPiA9PiB7XG4gICAgY29uc3QgY3VycmVudCA9IGF3YWl0IGF1dGguYXBpLmdldFNlc3Npb24oeyBoZWFkZXJzIH0pO1xuICAgIGNvbnN0IGVtYWlsID0gbm9ybWFsaXplRW1haWwoY3VycmVudD8udXNlci5lbWFpbCk7XG4gICAgY29uc3QgY3JlYXRlZEF0ID0gY3VycmVudD8uc2Vzc2lvbi5jcmVhdGVkQXQ7XG4gICAgY29uc3QgY3JlYXRlZEF0TXMgPSBjcmVhdGVkQXQgPyBuZXcgRGF0ZShjcmVhdGVkQXQpLmdldFRpbWUoKSA6IE51bWJlci5OYU47XG4gICAgaWYgKGNvbmZpZy5zZXNzaW9uQ3V0b2ZmTXMgJiYgIShjcmVhdGVkQXRNcyA+PSBjb25maWcuc2Vzc2lvbkN1dG9mZk1zKSkgcmV0dXJuIHVuZGVmaW5lZDtcbiAgICBpZiAoIWVtYWlsIHx8ICEoYXdhaXQgY29uZmlnLmF1dGhvcml6ZUlkZW50aXR5KGVtYWlsKSkpIHJldHVybiB1bmRlZmluZWQ7XG4gICAgcmV0dXJuIGVtYWlsO1xuICB9O1xuXG4gIGNvbnN0IGhhbmRsZUNvbXBhdGliaWxpdHlSb3V0ZSA9IGFzeW5jIChyZXF1ZXN0OiBSZXF1ZXN0KTogUHJvbWlzZTxSZXNwb25zZSB8IHVuZGVmaW5lZD4gPT4ge1xuICAgIGNvbnN0IHBhdGggPSBuZXcgVVJMKHJlcXVlc3QudXJsKS5wYXRobmFtZTtcbiAgICBpZiAocGF0aCA9PT0gYCR7YmFzZVBhdGh9L3N0YXR1c2ApIHtcbiAgICAgIGNvbnN0IGVtYWlsID0gYXdhaXQgc2Vzc2lvbihyZXF1ZXN0LmhlYWRlcnMpO1xuICAgICAgcmV0dXJuIGpzb25SZXNwb25zZSh7XG4gICAgICAgIGF1dGhlbnRpY2F0ZWQ6IEJvb2xlYW4oZW1haWwpLFxuICAgICAgICAuLi4oZW1haWwgPyB7IGVtYWlsIH0gOiB7fSksXG4gICAgICAgIGVuYWJsZWQ6IHRydWUsXG4gICAgICAgIHBhc3NrZXlzRW5hYmxlZDogdHJ1ZSxcbiAgICAgIH0pO1xuICAgIH1cbiAgICAvLyBPVFAgc2VuZCArIHZlcmlmeSBnbyBzdHJhaWdodCB0byBiZXR0ZXItYXV0aCdzIG5hdGl2ZSBlbWFpbE9UUCBlbmRwb2ludHNcbiAgICAvLyAoYC9lbWFpbC1vdHAvc2VuZC12ZXJpZmljYXRpb24tb3RwYCwgYC9zaWduLWluL2VtYWlsLW90cGApOyB0aGVyZSBpcyBub1xuICAgIC8vIGNvbXBhdGliaWxpdHkgd3JhcHBlciBmb3IgdGhlbS4gRmFpbHVyZXMgdGhlcmUgYXJlIGxvZ2dlZCBieSB0aGUgcGx1Z2luJ3NcbiAgICAvLyBzZW5kVmVyaWZpY2F0aW9uT1RQIGhvb2ssIG5vdCBzd2FsbG93ZWQgYmVoaW5kIGFuIGFsd2F5cy1vayByZXNwb25zZS5cbiAgICBpZiAocGF0aCA9PT0gYCR7YmFzZVBhdGh9L2xvZ291dGAgJiYgcmVxdWVzdC5tZXRob2QgPT09IFwiUE9TVFwiKSB7XG4gICAgICBjb25zdCByZXNwb25zZSA9IGF3YWl0IGF1dGguYXBpLnNpZ25PdXQoe1xuICAgICAgICBoZWFkZXJzOiByZXF1ZXN0LmhlYWRlcnMsXG4gICAgICAgIGFzUmVzcG9uc2U6IHRydWUsXG4gICAgICB9KTtcbiAgICAgIHJldHVybiBjb21wYXRpYmlsaXR5UmVzcG9uc2UocmVzcG9uc2UsIHsgb2s6IHJlc3BvbnNlLm9rLCByZWRpcmVjdFRvOiBsb2dvdXRSZWRpcmVjdFBhdGggfSk7XG4gICAgfVxuICAgIGlmIChwYXRoID09PSBgJHtiYXNlUGF0aH0vbG9nb3V0YCAmJiByZXF1ZXN0Lm1ldGhvZCA9PT0gXCJHRVRcIikge1xuICAgICAgY29uc3QgcmVzcG9uc2UgPSBhd2FpdCBhdXRoLmFwaS5zaWduT3V0KHtcbiAgICAgICAgaGVhZGVyczogcmVxdWVzdC5oZWFkZXJzLFxuICAgICAgICBhc1Jlc3BvbnNlOiB0cnVlLFxuICAgICAgfSk7XG4gICAgICByZXR1cm4gcmVkaXJlY3RSZXNwb25zZShyZXNwb25zZSwgbG9nb3V0UmVkaXJlY3RQYXRoKTtcbiAgICB9XG4gICAgcmV0dXJuIHVuZGVmaW5lZDtcbiAgfTtcblxuICByZXR1cm4ge1xuICAgIGJhc2VQYXRoLFxuICAgIHBhc3NrZXlzRW5hYmxlZDogdHJ1ZSxcbiAgICBoYW5kbGVyOiBhc3luYyAocmVxdWVzdCkgPT4gKGF3YWl0IGhhbmRsZUNvbXBhdGliaWxpdHlSb3V0ZShyZXF1ZXN0KSkgPz8gYXV0aC5oYW5kbGVyKHJlcXVlc3QpLFxuICAgIHNlc3Npb24sXG4gICAgc3RhdHVzOiBhc3luYyAoaGVhZGVycykgPT4ge1xuICAgICAgY29uc3QgZW1haWwgPSBhd2FpdCBzZXNzaW9uKGhlYWRlcnMpO1xuICAgICAgcmV0dXJuIHtcbiAgICAgICAgYXV0aGVudGljYXRlZDogQm9vbGVhbihlbWFpbCksXG4gICAgICAgIC4uLihlbWFpbCA/IHsgZW1haWwgfSA6IHt9KSxcbiAgICAgICAgZW5hYmxlZDogdHJ1ZSxcbiAgICAgICAgcGFzc2tleXNFbmFibGVkOiB0cnVlLFxuICAgICAgfTtcbiAgICB9LFxuICAgIGNsb3NlOiAoKSA9PiBjb25maWcuc3RvcmFnZS5jbG9zZSgpLFxuICB9O1xufVxuXG4vKiogUmVzdHJpY3QgbG9nb3V0IHJlZGlyZWN0cyB0byBvbmUgc2FtZS1vcmlnaW4gYXBwbGljYXRpb24gcGF0aC4gKi9cbmV4cG9ydCBmdW5jdGlvbiBub3JtYWxpemVMb2dvdXRSZWRpcmVjdFBhdGgodmFsdWU6IHN0cmluZyB8IHVuZGVmaW5lZCk6IHN0cmluZyB7XG4gIGNvbnN0IHBhdGggPSB2YWx1ZT8udHJpbSgpO1xuICByZXR1cm4gcGF0aD8uc3RhcnRzV2l0aChcIi9cIikgJiYgIXBhdGguc3RhcnRzV2l0aChcIi8vXCIpICYmICFwYXRoLmluY2x1ZGVzKFwiXFxcXFwiKSA/IHBhdGggOiBcIi9cIjtcbn1cblxuZnVuY3Rpb24gbm9ybWFsaXplRW1haWwoZW1haWw6IHN0cmluZyB8IHVuZGVmaW5lZCk6IHN0cmluZyB7XG4gIHJldHVybiBlbWFpbD8udHJpbSgpLnRvTG93ZXJDYXNlKCkgPz8gXCJcIjtcbn1cblxuZnVuY3Rpb24ganNvblJlc3BvbnNlKGJvZHk6IHVua25vd24sIHN0YXR1cyA9IDIwMCk6IFJlc3BvbnNlIHtcbiAgcmV0dXJuIG5ldyBSZXNwb25zZShKU09OLnN0cmluZ2lmeShib2R5KSwge1xuICAgIHN0YXR1cyxcbiAgICBoZWFkZXJzOiB7IFwiY29udGVudC10eXBlXCI6IFwiYXBwbGljYXRpb24vanNvblwiIH0sXG4gIH0pO1xufVxuXG5mdW5jdGlvbiBjb21wYXRpYmlsaXR5UmVzcG9uc2UocmVzcG9uc2U6IFJlc3BvbnNlLCBib2R5OiB1bmtub3duKTogUmVzcG9uc2Uge1xuICBjb25zdCBoZWFkZXJzID0gbmV3IEhlYWRlcnMoeyBcImNvbnRlbnQtdHlwZVwiOiBcImFwcGxpY2F0aW9uL2pzb25cIiB9KTtcbiAgZm9yIChjb25zdCBjb29raWUgb2YgcmVzcG9uc2UuaGVhZGVycy5nZXRTZXRDb29raWUoKSkgaGVhZGVycy5hcHBlbmQoXCJzZXQtY29va2llXCIsIGNvb2tpZSk7XG4gIHJldHVybiBuZXcgUmVzcG9uc2UoSlNPTi5zdHJpbmdpZnkoYm9keSksIHsgc3RhdHVzOiAyMDAsIGhlYWRlcnMgfSk7XG59XG5cbmZ1bmN0aW9uIHJlZGlyZWN0UmVzcG9uc2UocmVzcG9uc2U6IFJlc3BvbnNlLCBsb2NhdGlvbjogc3RyaW5nKTogUmVzcG9uc2Uge1xuICBjb25zdCBoZWFkZXJzID0gbmV3IEhlYWRlcnMoeyBsb2NhdGlvbiB9KTtcbiAgZm9yIChjb25zdCBjb29raWUgb2YgcmVzcG9uc2UuaGVhZGVycy5nZXRTZXRDb29raWUoKSkgaGVhZGVycy5hcHBlbmQoXCJzZXQtY29va2llXCIsIGNvb2tpZSk7XG4gIHJldHVybiBuZXcgUmVzcG9uc2UobnVsbCwgeyBzdGF0dXM6IDMwMywgaGVhZGVycyB9KTtcbn1cbiJdfQ==

package/lib/src/storage.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Better Auth database selection and migration locking.
+ *
+ * Callers pass a native AppKit Lakebase pool when available. Otherwise auth
+ * uses SQLite in the operating system's application-data directory.
+ *
+ * @module
+ */
+import { type PgPoolLike } from "@dbx-tools/postgres";
+import type { BetterAuthOptions } from "better-auth";
+export type AuthStorageMode = "auto" | "lakebase" | "sqlite";
+export interface AuthStorageConfig {
+    storage?: AuthStorageMode;
+    sqlitePath?: string;
+}
+export interface ResolvedAuthStorageConfig {
+    mode: AuthStorageMode;
+    sqlitePath: string;
+}
+export type AuthDatabase = NonNullable<BetterAuthOptions["database"]>;
+export interface AuthStorage {
+    kind: "lakebase" | "sqlite" | "memory";
+    database: AuthDatabase;
+    pool?: PgPoolLike;
+    path?: string;
+    close(): Promise<void>;
+}
+export declare function resolveAuthStorageConfig(config?: AuthStorageConfig): ResolvedAuthStorageConfig;
+export declare function shouldUseLakebase(config?: AuthStorageConfig): boolean;
+export declare function createAuthStorage(config: AuthStorageConfig, pool?: PgPoolLike): Promise<AuthStorage>;
+export declare function migrateAuth(options: BetterAuthOptions, storage: AuthStorage): Promise<void>;

package/lib/src/storage.js

@@ -0,0 +1,120 @@
+/**
+ * Better Auth database selection and migration locking.
+ *
+ * Callers pass a native AppKit Lakebase pool when available. Otherwise auth
+ * uses SQLite in the operating system's application-data directory.
+ *
+ * @module
+ */
+var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
+    if (typeof path === "string" && /^\.\.?\//.test(path)) {
+        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
+            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
+        });
+    }
+    return path;
+};
+import { mkdirSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+import { fileLock } from "@dbx-tools/core";
+import { advisoryLock } from "@dbx-tools/postgres";
+import { log } from "@dbx-tools/shared-core";
+import envPaths from "env-paths";
+const logger = log.logger("auth:storage");
+const MIGRATION_LOCK = ["auth", "better-auth", "migrations"];
+export function resolveAuthStorageConfig(config = {}) {
+    const mode = config.storage ?? "auto";
+    if (mode !== "auto" && mode !== "lakebase" && mode !== "sqlite") {
+        throw new TypeError('auth storage must be "auto", "lakebase", or "sqlite"');
+    }
+    const dataDirectory = envPaths("dbx-tools", { suffix: "" }).data;
+    return {
+        mode,
+        sqlitePath: resolve(config.sqlitePath ?? resolve(dataDirectory, "auth", "auth.sqlite")),
+    };
+}
+export function shouldUseLakebase(config = {}) {
+    const resolved = resolveAuthStorageConfig(config);
+    if (resolved.mode === "lakebase")
+        return true;
+    if (resolved.mode === "sqlite")
+        return false;
+    return Boolean(process.env.LAKEBASE_ENDPOINT ?? process.env.PGHOST);
+}
+export async function createAuthStorage(config, pool) {
+    const resolved = resolveAuthStorageConfig(config);
+    if (pool && resolved.mode !== "sqlite") {
+        return {
+            kind: "lakebase",
+            database: pool,
+            pool,
+            close: async () => undefined,
+        };
+    }
+    if (resolved.mode === "lakebase") {
+        throw new Error("auth storage is lakebase but no Lakebase pool was supplied");
+    }
+    // Prefer SQLite (durable, survives restarts) when a SQLite binding is present
+    // — bun:sqlite in Bun, node:sqlite in Node. Both are optional runtime
+    // features, so fall back to an in-memory adapter when neither can be opened
+    // rather than failing the whole gate. Memory loses sessions/OTPs on restart
+    // but keeps sign-in working; an explicit `--auth-storage sqlite` still errors
+    // if SQLite is genuinely unavailable, so the fallback is auto-mode only.
+    try {
+        mkdirSync(dirname(resolved.sqlitePath), { recursive: true });
+        const database = await openSqlite(resolved.sqlitePath);
+        return {
+            kind: "sqlite",
+            database,
+            path: resolved.sqlitePath,
+            close: async () => {
+                database.close();
+            },
+        };
+    }
+    catch (error) {
+        if (resolved.mode === "sqlite")
+            throw error;
+        logger.warn("sqlite unavailable for auth storage; using in-memory adapter", { error });
+        const { memoryAdapter } = await import("better-auth/adapters/memory");
+        return {
+            kind: "memory",
+            database: memoryAdapter({}),
+            close: async () => undefined,
+        };
+    }
+}
+export async function migrateAuth(options, storage) {
+    // The in-memory adapter builds its schema in memory on init — there is no
+    // database to migrate.
+    if (storage.kind === "memory")
+        return;
+    const run = async () => {
+        const module = (await import(__rewriteRelativeImportExtension(migrationModuleUrl())));
+        const migrations = await module.getMigrations(options);
+        await migrations.runMigrations();
+    };
+    if (storage.kind === "lakebase" && storage.pool) {
+        await advisoryLock.withAdvisoryLock(storage.pool, MIGRATION_LOCK, run);
+        return;
+    }
+    await fileLock.withFileLock(MIGRATION_LOCK, run);
+}
+async function openSqlite(path) {
+    if (process.versions.bun) {
+        const specifier = "bun:sqlite";
+        const { Database } = (await import(__rewriteRelativeImportExtension(specifier)));
+        const database = new Database(path, { create: true, strict: true });
+        database.exec("PRAGMA journal_mode = WAL; PRAGMA foreign_keys = ON");
+        return database;
+    }
+    const { DatabaseSync } = await import("node:sqlite");
+    const database = new DatabaseSync(path);
+    database.exec("PRAGMA journal_mode = WAL; PRAGMA foreign_keys = ON");
+    return database;
+}
+function migrationModuleUrl() {
+    const entry = import.meta.resolve("better-auth");
+    return new URL("./db/get-migration.mjs", entry).href;
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic3RvcmFnZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9zdG9yYWdlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOzs7Ozs7O0dBT0c7Ozs7Ozs7OztBQUVILE9BQU8sRUFBRSxTQUFTLEVBQUUsTUFBTSxTQUFTLENBQUM7QUFDcEMsT0FBTyxFQUFFLE9BQU8sRUFBRSxPQUFPLEVBQUUsTUFBTSxXQUFXLENBQUM7QUFDN0MsT0FBTyxFQUFFLFFBQVEsRUFBRSxNQUFNLGlCQUFpQixDQUFDO0FBQzNDLE9BQU8sRUFBRSxZQUFZLEVBQW1CLE1BQU0scUJBQXFCLENBQUM7QUFDcEUsT0FBTyxFQUFFLEdBQUcsRUFBRSxNQUFNLHdCQUF3QixDQUFDO0FBRTdDLE9BQU8sUUFBUSxNQUFNLFdBQVcsQ0FBQztBQUVqQyxNQUFNLE1BQU0sR0FBRyxHQUFHLENBQUMsTUFBTSxDQUFDLGNBQWMsQ0FBQyxDQUFDO0FBdUMxQyxNQUFNLGNBQWMsR0FBRyxDQUFDLE1BQU0sRUFBRSxhQUFhLEVBQUUsWUFBWSxDQUFVLENBQUM7QUFFdEUsTUFBTSxVQUFVLHdCQUF3QixDQUN0QyxTQUE0QixFQUFFO0lBRTlCLE1BQU0sSUFBSSxHQUFHLE1BQU0sQ0FBQyxPQUFPLElBQUksTUFBTSxDQUFDO0lBQ3RDLElBQUksSUFBSSxLQUFLLE1BQU0sSUFBSSxJQUFJLEtBQUssVUFBVSxJQUFJLElBQUksS0FBSyxRQUFRLEVBQUUsQ0FBQztRQUNoRSxNQUFNLElBQUksU0FBUyxDQUFDLHNEQUFzRCxDQUFDLENBQUM7SUFDOUUsQ0FBQztJQUNELE1BQU0sYUFBYSxHQUFHLFFBQVEsQ0FBQyxXQUFXLEVBQUUsRUFBRSxNQUFNLEVBQUUsRUFBRSxFQUFFLENBQUMsQ0FBQyxJQUFJLENBQUM7SUFDakUsT0FBTztRQUNMLElBQUk7UUFDSixVQUFVLEVBQUUsT0FBTyxDQUFDLE1BQU0sQ0FBQyxVQUFVLElBQUksT0FBTyxDQUFDLGFBQWEsRUFBRSxNQUFNLEVBQUUsYUFBYSxDQUFDLENBQUM7S0FDeEYsQ0FBQztBQUNKLENBQUM7QUFFRCxNQUFNLFVBQVUsaUJBQWlCLENBQUMsU0FBNEIsRUFBRTtJQUM5RCxNQUFNLFFBQVEsR0FBRyx3QkFBd0IsQ0FBQyxNQUFNLENBQUMsQ0FBQztJQUNsRCxJQUFJLFFBQVEsQ0FBQyxJQUFJLEtBQUssVUFBVTtRQUFFLE9BQU8sSUFBSSxDQUFDO0lBQzlDLElBQUksUUFBUSxDQUFDLElBQUksS0FBSyxRQUFRO1FBQUUsT0FBTyxLQUFLLENBQUM7SUFDN0MsT0FBTyxPQUFPLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxpQkFBaUIsSUFBSSxPQUFPLENBQUMsR0FBRyxDQUFDLE1BQU0sQ0FBQyxDQUFDO0FBQ3RFLENBQUM7QUFFRCxNQUFNLENBQUMsS0FBSyxVQUFVLGlCQUFpQixDQUNyQyxNQUF5QixFQUN6QixJQUFpQjtJQUVqQixNQUFNLFFBQVEsR0FBRyx3QkFBd0IsQ0FBQyxNQUFNLENBQUMsQ0FBQztJQUNsRCxJQUFJLElBQUksSUFBSSxRQUFRLENBQUMsSUFBSSxLQUFLLFFBQVEsRUFBRSxDQUFDO1FBQ3ZDLE9BQU87WUFDTCxJQUFJLEVBQUUsVUFBVTtZQUNoQixRQUFRLEVBQUUsSUFBSTtZQUNkLElBQUk7WUFDSixLQUFLLEVBQUUsS0FBSyxJQUFJLEVBQUUsQ0FBQyxTQUFTO1NBQzdCLENBQUM7SUFDSixDQUFDO0lBQ0QsSUFBSSxRQUFRLENBQUMsSUFBSSxLQUFLLFVBQVUsRUFBRSxDQUFDO1FBQ2pDLE1BQU0sSUFBSSxLQUFLLENBQUMsNERBQTRELENBQUMsQ0FBQztJQUNoRixDQUFDO0lBRUQsOEVBQThFO0lBQzlFLHNFQUFzRTtJQUN0RSw0RUFBNEU7SUFDNUUsNEVBQTRFO0lBQzVFLDhFQUE4RTtJQUM5RSx5RUFBeUU7SUFDekUsSUFBSSxDQUFDO1FBQ0gsU0FBUyxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsVUFBVSxDQUFDLEVBQUUsRUFBRSxTQUFTLEVBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQztRQUM3RCxNQUFNLFFBQVEsR0FBRyxNQUFNLFVBQVUsQ0FBQyxRQUFRLENBQUMsVUFBVSxDQUFDLENBQUM7UUFDdkQsT0FBTztZQUNMLElBQUksRUFBRSxRQUFRO1lBQ2QsUUFBUTtZQUNSLElBQUksRUFBRSxRQUFRLENBQUMsVUFBVTtZQUN6QixLQUFLLEVBQUUsS0FBSyxJQUFJLEVBQUU7Z0JBQ2hCLFFBQVEsQ0FBQyxLQUFLLEVBQUUsQ0FBQztZQUNuQixDQUFDO1NBQ0YsQ0FBQztJQUNKLENBQUM7SUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1FBQ2YsSUFBSSxRQUFRLENBQUMsSUFBSSxLQUFLLFFBQVE7WUFBRSxNQUFNLEtBQUssQ0FBQztRQUM1QyxNQUFNLENBQUMsSUFBSSxDQUFDLDhEQUE4RCxFQUFFLEVBQUUsS0FBSyxFQUFFLENBQUMsQ0FBQztRQUN2RixNQUFNLEVBQUUsYUFBYSxFQUFFLEdBQUcsTUFBTSxNQUFNLENBQUMsNkJBQTZCLENBQUMsQ0FBQztRQUN0RSxPQUFPO1lBQ0wsSUFBSSxFQUFFLFFBQVE7WUFDZCxRQUFRLEVBQUUsYUFBYSxDQUFDLEVBQUUsQ0FBNEI7WUFDdEQsS0FBSyxFQUFFLEtBQUssSUFBSSxFQUFFLENBQUMsU0FBUztTQUM3QixDQUFDO0lBQ0osQ0FBQztBQUNILENBQUM7QUFFRCxNQUFNLENBQUMsS0FBSyxVQUFVLFdBQVcsQ0FBQyxPQUEwQixFQUFFLE9BQW9CO0lBQ2hGLDBFQUEwRTtJQUMxRSx1QkFBdUI7SUFDdkIsSUFBSSxPQUFPLENBQUMsSUFBSSxLQUFLLFFBQVE7UUFBRSxPQUFPO0lBRXRDLE1BQU0sR0FBRyxHQUFHLEtBQUssSUFBbUIsRUFBRTtRQUNwQyxNQUFNLE1BQU0sR0FBRyxDQUFDLE1BQU0sTUFBTSxrQ0FBQyxrQkFBa0IsRUFBRSxFQUFDLENBQW9CLENBQUM7UUFDdkUsTUFBTSxVQUFVLEdBQUcsTUFBTSxNQUFNLENBQUMsYUFBYSxDQUFDLE9BQU8sQ0FBQyxDQUFDO1FBQ3ZELE1BQU0sVUFBVSxDQUFDLGFBQWEsRUFBRSxDQUFDO0lBQ25DLENBQUMsQ0FBQztJQUVGLElBQUksT0FBTyxDQUFDLElBQUksS0FBSyxVQUFVLElBQUksT0FBTyxDQUFDLElBQUksRUFBRSxDQUFDO1FBQ2hELE1BQU0sWUFBWSxDQUFDLGdCQUFnQixDQUFDLE9BQU8sQ0FBQyxJQUFJLEVBQUUsY0FBYyxFQUFFLEdBQUcsQ0FBQyxDQUFDO1FBQ3ZFLE9BQU87SUFDVCxDQUFDO0lBQ0QsTUFBTSxRQUFRLENBQUMsWUFBWSxDQUFDLGNBQWMsRUFBRSxHQUFHLENBQUMsQ0FBQztBQUNuRCxDQUFDO0FBRUQsS0FBSyxVQUFVLFVBQVUsQ0FBQyxJQUFZO0lBQ3BDLElBQUksT0FBTyxDQUFDLFFBQVEsQ0FBQyxHQUFHLEVBQUUsQ0FBQztRQUN6QixNQUFNLFNBQVMsR0FBRyxZQUFZLENBQUM7UUFDL0IsTUFBTSxFQUFFLFFBQVEsRUFBRSxHQUFHLENBQUMsTUFBTSxNQUFNLGtDQUFDLFNBQVMsRUFBQyxDQUFvQixDQUFDO1FBQ2xFLE1BQU0sUUFBUSxHQUFHLElBQUksUUFBUSxDQUFDLElBQUksRUFBRSxFQUFFLE1BQU0sRUFBRSxJQUFJLEVBQUUsTUFBTSxFQUFFLElBQUksRUFBRSxDQUFDLENBQUM7UUFDcEUsUUFBUSxDQUFDLElBQUksQ0FBQyxxREFBcUQsQ0FBQyxDQUFDO1FBQ3JFLE9BQU8sUUFBUSxDQUFDO0lBQ2xCLENBQUM7SUFDRCxNQUFNLEVBQUUsWUFBWSxFQUFFLEdBQUcsTUFBTSxNQUFNLENBQUMsYUFBYSxDQUFDLENBQUM7SUFDckQsTUFBTSxRQUFRLEdBQUcsSUFBSSxZQUFZLENBQUMsSUFBSSxDQUFDLENBQUM7SUFDeEMsUUFBUSxDQUFDLElBQUksQ0FBQyxxREFBcUQsQ0FBQyxDQUFDO0lBQ3JFLE9BQU8sUUFBUSxDQUFDO0FBQ2xCLENBQUM7QUFFRCxTQUFTLGtCQUFrQjtJQUN6QixNQUFNLEtBQUssR0FBRyxNQUFNLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxhQUFhLENBQUMsQ0FBQztJQUNqRCxPQUFPLElBQUksR0FBRyxDQUFDLHdCQUF3QixFQUFFLEtBQUssQ0FBQyxDQUFDLElBQUksQ0FBQztBQUN2RCxDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiLyoqXG4gKiBCZXR0ZXIgQXV0aCBkYXRhYmFzZSBzZWxlY3Rpb24gYW5kIG1pZ3JhdGlvbiBsb2NraW5nLlxuICpcbiAqIENhbGxlcnMgcGFzcyBhIG5hdGl2ZSBBcHBLaXQgTGFrZWJhc2UgcG9vbCB3aGVuIGF2YWlsYWJsZS4gT3RoZXJ3aXNlIGF1dGhcbiAqIHVzZXMgU1FMaXRlIGluIHRoZSBvcGVyYXRpbmcgc3lzdGVtJ3MgYXBwbGljYXRpb24tZGF0YSBkaXJlY3RvcnkuXG4gKlxuICogQG1vZHVsZVxuICovXG5cbmltcG9ydCB7IG1rZGlyU3luYyB9IGZyb20gXCJub2RlOmZzXCI7XG5pbXBvcnQgeyBkaXJuYW1lLCByZXNvbHZlIH0gZnJvbSBcIm5vZGU6cGF0aFwiO1xuaW1wb3J0IHsgZmlsZUxvY2sgfSBmcm9tIFwiQGRieC10b29scy9jb3JlXCI7XG5pbXBvcnQgeyBhZHZpc29yeUxvY2ssIHR5cGUgUGdQb29sTGlrZSB9IGZyb20gXCJAZGJ4LXRvb2xzL3Bvc3RncmVzXCI7XG5pbXBvcnQgeyBsb2cgfSBmcm9tIFwiQGRieC10b29scy9zaGFyZWQtY29yZVwiO1xuaW1wb3J0IHR5cGUgeyBCZXR0ZXJBdXRoT3B0aW9ucyB9IGZyb20gXCJiZXR0ZXItYXV0aFwiO1xuaW1wb3J0IGVudlBhdGhzIGZyb20gXCJlbnYtcGF0aHNcIjtcblxuY29uc3QgbG9nZ2VyID0gbG9nLmxvZ2dlcihcImF1dGg6c3RvcmFnZVwiKTtcblxuZXhwb3J0IHR5cGUgQXV0aFN0b3JhZ2VNb2RlID0gXCJhdXRvXCIgfCBcImxha2ViYXNlXCIgfCBcInNxbGl0ZVwiO1xuXG5leHBvcnQgaW50ZXJmYWNlIEF1dGhTdG9yYWdlQ29uZmlnIHtcbiAgc3RvcmFnZT86IEF1dGhTdG9yYWdlTW9kZTtcbiAgc3FsaXRlUGF0aD86IHN0cmluZztcbn1cblxuZXhwb3J0IGludGVyZmFjZSBSZXNvbHZlZEF1dGhTdG9yYWdlQ29uZmlnIHtcbiAgbW9kZTogQXV0aFN0b3JhZ2VNb2RlO1xuICBzcWxpdGVQYXRoOiBzdHJpbmc7XG59XG5cbmV4cG9ydCB0eXBlIEF1dGhEYXRhYmFzZSA9IE5vbk51bGxhYmxlPEJldHRlckF1dGhPcHRpb25zW1wiZGF0YWJhc2VcIl0+O1xuXG5leHBvcnQgaW50ZXJmYWNlIEF1dGhTdG9yYWdlIHtcbiAga2luZDogXCJsYWtlYmFzZVwiIHwgXCJzcWxpdGVcIiB8IFwibWVtb3J5XCI7XG4gIGRhdGFiYXNlOiBBdXRoRGF0YWJhc2U7XG4gIHBvb2w/OiBQZ1Bvb2xMaWtlO1xuICBwYXRoPzogc3RyaW5nO1xuICBjbG9zZSgpOiBQcm9taXNlPHZvaWQ+O1xufVxuXG50eXBlIE1pZ3JhdGlvbk1vZHVsZSA9IHtcbiAgZ2V0TWlncmF0aW9ucyhvcHRpb25zOiBCZXR0ZXJBdXRoT3B0aW9ucyk6IFByb21pc2U8e1xuICAgIHJ1bk1pZ3JhdGlvbnMoKTogUHJvbWlzZTx2b2lkPjtcbiAgfT47XG59O1xuXG5pbnRlcmZhY2UgU3FsaXRlRGF0YWJhc2Uge1xuICBleGVjKHNxbDogc3RyaW5nKTogdW5rbm93bjtcbiAgY2xvc2UoKTogdm9pZDtcbn1cblxuaW50ZXJmYWNlIEJ1blNxbGl0ZU1vZHVsZSB7XG4gIERhdGFiYXNlOiBuZXcgKHBhdGg6IHN0cmluZywgb3B0aW9ucz86IHsgY3JlYXRlPzogYm9vbGVhbjsgc3RyaWN0PzogYm9vbGVhbiB9KSA9PiBTcWxpdGVEYXRhYmFzZTtcbn1cblxuY29uc3QgTUlHUkFUSU9OX0xPQ0sgPSBbXCJhdXRoXCIsIFwiYmV0dGVyLWF1dGhcIiwgXCJtaWdyYXRpb25zXCJdIGFzIGNvbnN0O1xuXG5leHBvcnQgZnVuY3Rpb24gcmVzb2x2ZUF1dGhTdG9yYWdlQ29uZmlnKFxuICBjb25maWc6IEF1dGhTdG9yYWdlQ29uZmlnID0ge30sXG4pOiBSZXNvbHZlZEF1dGhTdG9yYWdlQ29uZmlnIHtcbiAgY29uc3QgbW9kZSA9IGNvbmZpZy5zdG9yYWdlID8/IFwiYXV0b1wiO1xuICBpZiAobW9kZSAhPT0gXCJhdXRvXCIgJiYgbW9kZSAhPT0gXCJsYWtlYmFzZVwiICYmIG1vZGUgIT09IFwic3FsaXRlXCIpIHtcbiAgICB0aHJvdyBuZXcgVHlwZUVycm9yKCdhdXRoIHN0b3JhZ2UgbXVzdCBiZSBcImF1dG9cIiwgXCJsYWtlYmFzZVwiLCBvciBcInNxbGl0ZVwiJyk7XG4gIH1cbiAgY29uc3QgZGF0YURpcmVjdG9yeSA9IGVudlBhdGhzKFwiZGJ4LXRvb2xzXCIsIHsgc3VmZml4OiBcIlwiIH0pLmRhdGE7XG4gIHJldHVybiB7XG4gICAgbW9kZSxcbiAgICBzcWxpdGVQYXRoOiByZXNvbHZlKGNvbmZpZy5zcWxpdGVQYXRoID8/IHJlc29sdmUoZGF0YURpcmVjdG9yeSwgXCJhdXRoXCIsIFwiYXV0aC5zcWxpdGVcIikpLFxuICB9O1xufVxuXG5leHBvcnQgZnVuY3Rpb24gc2hvdWxkVXNlTGFrZWJhc2UoY29uZmlnOiBBdXRoU3RvcmFnZUNvbmZpZyA9IHt9KTogYm9vbGVhbiB7XG4gIGNvbnN0IHJlc29sdmVkID0gcmVzb2x2ZUF1dGhTdG9yYWdlQ29uZmlnKGNvbmZpZyk7XG4gIGlmIChyZXNvbHZlZC5tb2RlID09PSBcImxha2ViYXNlXCIpIHJldHVybiB0cnVlO1xuICBpZiAocmVzb2x2ZWQubW9kZSA9PT0gXCJzcWxpdGVcIikgcmV0dXJuIGZhbHNlO1xuICByZXR1cm4gQm9vbGVhbihwcm9jZXNzLmVudi5MQUtFQkFTRV9FTkRQT0lOVCA/PyBwcm9jZXNzLmVudi5QR0hPU1QpO1xufVxuXG5leHBvcnQgYXN5bmMgZnVuY3Rpb24gY3JlYXRlQXV0aFN0b3JhZ2UoXG4gIGNvbmZpZzogQXV0aFN0b3JhZ2VDb25maWcsXG4gIHBvb2w/OiBQZ1Bvb2xMaWtlLFxuKTogUHJvbWlzZTxBdXRoU3RvcmFnZT4ge1xuICBjb25zdCByZXNvbHZlZCA9IHJlc29sdmVBdXRoU3RvcmFnZUNvbmZpZyhjb25maWcpO1xuICBpZiAocG9vbCAmJiByZXNvbHZlZC5tb2RlICE9PSBcInNxbGl0ZVwiKSB7XG4gICAgcmV0dXJuIHtcbiAgICAgIGtpbmQ6IFwibGFrZWJhc2VcIixcbiAgICAgIGRhdGFiYXNlOiBwb29sLFxuICAgICAgcG9vbCxcbiAgICAgIGNsb3NlOiBhc3luYyAoKSA9PiB1bmRlZmluZWQsXG4gICAgfTtcbiAgfVxuICBpZiAocmVzb2x2ZWQubW9kZSA9PT0gXCJsYWtlYmFzZVwiKSB7XG4gICAgdGhyb3cgbmV3IEVycm9yKFwiYXV0aCBzdG9yYWdlIGlzIGxha2ViYXNlIGJ1dCBubyBMYWtlYmFzZSBwb29sIHdhcyBzdXBwbGllZFwiKTtcbiAgfVxuXG4gIC8vIFByZWZlciBTUUxpdGUgKGR1cmFibGUsIHN1cnZpdmVzIHJlc3RhcnRzKSB3aGVuIGEgU1FMaXRlIGJpbmRpbmcgaXMgcHJlc2VudFxuICAvLyDigJQgYnVuOnNxbGl0ZSBpbiBCdW4sIG5vZGU6c3FsaXRlIGluIE5vZGUuIEJvdGggYXJlIG9wdGlvbmFsIHJ1bnRpbWVcbiAgLy8gZmVhdHVyZXMsIHNvIGZhbGwgYmFjayB0byBhbiBpbi1tZW1vcnkgYWRhcHRlciB3aGVuIG5laXRoZXIgY2FuIGJlIG9wZW5lZFxuICAvLyByYXRoZXIgdGhhbiBmYWlsaW5nIHRoZSB3aG9sZSBnYXRlLiBNZW1vcnkgbG9zZXMgc2Vzc2lvbnMvT1RQcyBvbiByZXN0YXJ0XG4gIC8vIGJ1dCBrZWVwcyBzaWduLWluIHdvcmtpbmc7IGFuIGV4cGxpY2l0IGAtLWF1dGgtc3RvcmFnZSBzcWxpdGVgIHN0aWxsIGVycm9yc1xuICAvLyBpZiBTUUxpdGUgaXMgZ2VudWluZWx5IHVuYXZhaWxhYmxlLCBzbyB0aGUgZmFsbGJhY2sgaXMgYXV0by1tb2RlIG9ubHkuXG4gIHRyeSB7XG4gICAgbWtkaXJTeW5jKGRpcm5hbWUocmVzb2x2ZWQuc3FsaXRlUGF0aCksIHsgcmVjdXJzaXZlOiB0cnVlIH0pO1xuICAgIGNvbnN0IGRhdGFiYXNlID0gYXdhaXQgb3BlblNxbGl0ZShyZXNvbHZlZC5zcWxpdGVQYXRoKTtcbiAgICByZXR1cm4ge1xuICAgICAga2luZDogXCJzcWxpdGVcIixcbiAgICAgIGRhdGFiYXNlLFxuICAgICAgcGF0aDogcmVzb2x2ZWQuc3FsaXRlUGF0aCxcbiAgICAgIGNsb3NlOiBhc3luYyAoKSA9PiB7XG4gICAgICAgIGRhdGFiYXNlLmNsb3NlKCk7XG4gICAgICB9LFxuICAgIH07XG4gIH0gY2F0Y2ggKGVycm9yKSB7XG4gICAgaWYgKHJlc29sdmVkLm1vZGUgPT09IFwic3FsaXRlXCIpIHRocm93IGVycm9yO1xuICAgIGxvZ2dlci53YXJuKFwic3FsaXRlIHVuYXZhaWxhYmxlIGZvciBhdXRoIHN0b3JhZ2U7IHVzaW5nIGluLW1lbW9yeSBhZGFwdGVyXCIsIHsgZXJyb3IgfSk7XG4gICAgY29uc3QgeyBtZW1vcnlBZGFwdGVyIH0gPSBhd2FpdCBpbXBvcnQoXCJiZXR0ZXItYXV0aC9hZGFwdGVycy9tZW1vcnlcIik7XG4gICAgcmV0dXJuIHtcbiAgICAgIGtpbmQ6IFwibWVtb3J5XCIsXG4gICAgICBkYXRhYmFzZTogbWVtb3J5QWRhcHRlcih7fSkgYXMgdW5rbm93biBhcyBBdXRoRGF0YWJhc2UsXG4gICAgICBjbG9zZTogYXN5bmMgKCkgPT4gdW5kZWZpbmVkLFxuICAgIH07XG4gIH1cbn1cblxuZXhwb3J0IGFzeW5jIGZ1bmN0aW9uIG1pZ3JhdGVBdXRoKG9wdGlvbnM6IEJldHRlckF1dGhPcHRpb25zLCBzdG9yYWdlOiBBdXRoU3RvcmFnZSk6IFByb21pc2U8dm9pZD4ge1xuICAvLyBUaGUgaW4tbWVtb3J5IGFkYXB0ZXIgYnVpbGRzIGl0cyBzY2hlbWEgaW4gbWVtb3J5IG9uIGluaXQg4oCUIHRoZXJlIGlzIG5vXG4gIC8vIGRhdGFiYXNlIHRvIG1pZ3JhdGUuXG4gIGlmIChzdG9yYWdlLmtpbmQgPT09IFwibWVtb3J5XCIpIHJldHVybjtcblxuICBjb25zdCBydW4gPSBhc3luYyAoKTogUHJvbWlzZTx2b2lkPiA9PiB7XG4gICAgY29uc3QgbW9kdWxlID0gKGF3YWl0IGltcG9ydChtaWdyYXRpb25Nb2R1bGVVcmwoKSkpIGFzIE1pZ3JhdGlvbk1vZHVsZTtcbiAgICBjb25zdCBtaWdyYXRpb25zID0gYXdhaXQgbW9kdWxlLmdldE1pZ3JhdGlvbnMob3B0aW9ucyk7XG4gICAgYXdhaXQgbWlncmF0aW9ucy5ydW5NaWdyYXRpb25zKCk7XG4gIH07XG5cbiAgaWYgKHN0b3JhZ2Uua2luZCA9PT0gXCJsYWtlYmFzZVwiICYmIHN0b3JhZ2UucG9vbCkge1xuICAgIGF3YWl0IGFkdmlzb3J5TG9jay53aXRoQWR2aXNvcnlMb2NrKHN0b3JhZ2UucG9vbCwgTUlHUkFUSU9OX0xPQ0ssIHJ1bik7XG4gICAgcmV0dXJuO1xuICB9XG4gIGF3YWl0IGZpbGVMb2NrLndpdGhGaWxlTG9jayhNSUdSQVRJT05fTE9DSywgcnVuKTtcbn1cblxuYXN5bmMgZnVuY3Rpb24gb3BlblNxbGl0ZShwYXRoOiBzdHJpbmcpOiBQcm9taXNlPEF1dGhEYXRhYmFzZSAmIHsgY2xvc2UoKTogdm9pZCB9PiB7XG4gIGlmIChwcm9jZXNzLnZlcnNpb25zLmJ1bikge1xuICAgIGNvbnN0IHNwZWNpZmllciA9IFwiYnVuOnNxbGl0ZVwiO1xuICAgIGNvbnN0IHsgRGF0YWJhc2UgfSA9IChhd2FpdCBpbXBvcnQoc3BlY2lmaWVyKSkgYXMgQnVuU3FsaXRlTW9kdWxlO1xuICAgIGNvbnN0IGRhdGFiYXNlID0gbmV3IERhdGFiYXNlKHBhdGgsIHsgY3JlYXRlOiB0cnVlLCBzdHJpY3Q6IHRydWUgfSk7XG4gICAgZGF0YWJhc2UuZXhlYyhcIlBSQUdNQSBqb3VybmFsX21vZGUgPSBXQUw7IFBSQUdNQSBmb3JlaWduX2tleXMgPSBPTlwiKTtcbiAgICByZXR1cm4gZGF0YWJhc2U7XG4gIH1cbiAgY29uc3QgeyBEYXRhYmFzZVN5bmMgfSA9IGF3YWl0IGltcG9ydChcIm5vZGU6c3FsaXRlXCIpO1xuICBjb25zdCBkYXRhYmFzZSA9IG5ldyBEYXRhYmFzZVN5bmMocGF0aCk7XG4gIGRhdGFiYXNlLmV4ZWMoXCJQUkFHTUEgam91cm5hbF9tb2RlID0gV0FMOyBQUkFHTUEgZm9yZWlnbl9rZXlzID0gT05cIik7XG4gIHJldHVybiBkYXRhYmFzZTtcbn1cblxuZnVuY3Rpb24gbWlncmF0aW9uTW9kdWxlVXJsKCk6IHN0cmluZyB7XG4gIGNvbnN0IGVudHJ5ID0gaW1wb3J0Lm1ldGEucmVzb2x2ZShcImJldHRlci1hdXRoXCIpO1xuICByZXR1cm4gbmV3IFVSTChcIi4vZGIvZ2V0LW1pZ3JhdGlvbi5tanNcIiwgZW50cnkpLmhyZWY7XG59XG4iXX0=

package/lib/tsconfig.tsbuildinfo

@@ -0,0 +1 @@
+{"root":["../src/auth.ts","../src/storage.ts","../index.ts"],"version":"5.9.3"}

package/package.json

@@ -0,0 +1,69 @@
+{
+  "name": "@dbx-tools/auth-gate",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/reggie-db/dbx-tools.git",
+    "directory": "packages/js/node/auth-gate"
+  },
+  "scripts": {
+    "build": "projen build",
+    "compile": "projen compile",
+    "default": "projen default",
+    "package": "projen package",
+    "post-compile": "projen post-compile",
+    "pre-compile": "projen pre-compile",
+    "prepack": "projen prepack",
+    "test": "projen test",
+    "watch": "projen watch",
+    "projen": "projen"
+  },
+  "devDependencies": {
+    "@types/bun": "1.3.14",
+    "@types/node": "^24.6.0",
+    "typescript": "^5.9.3"
+  },
+  "dependencies": {
+    "@better-auth/passkey": "^1.6.25",
+    "@dbx-tools/core": "0.6.168",
+    "@dbx-tools/postgres": "0.6.168",
+    "@dbx-tools/shared-auth": "0.6.168",
+    "@dbx-tools/shared-core": "0.6.168",
+    "better-auth": "^1.6.25",
+    "env-paths": "^4.0.0"
+  },
+  "main": "./lib/index.js",
+  "license": "UNLICENSED",
+  "publishConfig": {
+    "access": "public",
+    "main": "./lib/index.js",
+    "types": "./lib/index.d.ts",
+    "exports": {
+      ".": {
+        "types": "./lib/index.d.ts",
+        "default": "./lib/index.js"
+      },
+      "./package.json": "./package.json"
+    }
+  },
+  "version": "0.6.168",
+  "types": "./lib/index.d.ts",
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./lib/index.d.ts",
+      "default": "./lib/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "index.ts",
+    "src",
+    "lib"
+  ],
+  "dbxToolsConfig": {
+    "tags": [
+      "node"
+    ]
+  },
+  "//": "~~ Generated by projen. To modify, edit .projenrc.js and run \"bunx projen\"."
+}

package/src/auth.ts

@@ -0,0 +1,265 @@
+/**
+ * Better Auth passwordless runtime with email OTP and passkeys.
+ *
+ * Callers provide authorization, delivery, storage, origin, and secret. Better
+ * Auth owns users, OTP verification records, sessions, rate limits, passkey
+ * credentials, and their native HTTP routes.
+ *
+ * @module
+ */
+
+import { passkey } from "@better-auth/passkey";
+import { type AuthStatus, SESSION_COOKIE_NAME } from "@dbx-tools/shared-auth";
+import { log } from "@dbx-tools/shared-core";
+import { APIError, betterAuth, type BetterAuthOptions } from "better-auth";
+import { emailOTP } from "better-auth/plugins";
+
+import type { AuthStorage } from "./storage.ts";
+import { migrateAuth } from "./storage.ts";
+
+const logger = log.logger("auth");
+
+export type AuthorizeIdentity = (email: string) => boolean | Promise<boolean>;
+
+export interface AuthEmailOptions {
+  subject: string;
+  brandName: string;
+  message: string;
+  codeTtlSeconds: number;
+}
+
+export interface PasswordlessAuthOptions {
+  storage: AuthStorage;
+  baseURL: string;
+  basePath?: string;
+  appName: string;
+  secret: string;
+  sessionCookieName?: string;
+  /** Same-origin path returned after logout. Defaults to `/`. */
+  logoutRedirectPath?: string;
+  sessionTtlSeconds: number;
+  sessionCutoffMs?: number;
+  codeTtlSeconds: number;
+  maxAttempts: number;
+  authorizeIdentity: AuthorizeIdentity;
+  sendCode(email: string, code: string, options: AuthEmailOptions): Promise<void>;
+  subject?: string;
+  message?: string;
+}
+
+export interface PasswordlessAuthRuntime {
+  readonly basePath: string;
+  readonly passkeysEnabled: boolean;
+  handler(request: Request): Promise<Response>;
+  session(headers: Headers): Promise<string | undefined>;
+  status(headers: Headers): Promise<AuthStatus>;
+  close(): Promise<void>;
+}
+
+export async function createPasswordlessAuth(
+  config: PasswordlessAuthOptions,
+): Promise<PasswordlessAuthRuntime> {
+  const origin = new URL(config.baseURL).origin;
+  const rpID = new URL(origin).hostname;
+  const basePath = config.basePath ?? "/api/auth";
+  const logoutRedirectPath = normalizeLogoutRedirectPath(config.logoutRedirectPath);
+  const emailOptions: AuthEmailOptions = {
+    subject: config.subject ?? "Your verification code",
+    brandName: config.appName,
+    message: config.message ?? "Your verification code is:",
+    codeTtlSeconds: config.codeTtlSeconds,
+  };
+
+  const options = {
+    appName: config.appName,
+    baseURL: origin,
+    basePath,
+    database: config.storage.database,
+    secret: config.secret,
+    // The gate fronts the app on whatever interface address the tunnel binds
+    // (an overlay/LAN IP, localhost, or a public domain) — not just `baseURL`.
+    // Better Auth's origin check would reject every other host with
+    // INVALID_ORIGIN and block sign-in. Trust the request's own origin here:
+    // this endpoint sits behind the OTP gate and the tunnel preserves the
+    // browser's Host, so the fixed-origin CSRF check adds nothing while breaking
+    // legitimate access. Same-origin requests (no Origin header) are allowed too.
+    trustedOrigins: (request?: Request) => {
+      const requestOrigin = request?.headers.get("origin");
+      return requestOrigin ? [requestOrigin, origin] : [origin];
+    },
+    session: {
+      expiresIn: config.sessionTtlSeconds,
+      updateAge: Math.min(24 * 60 * 60, config.sessionTtlSeconds),
+    },
+    verification: {
+      storeIdentifier: "hashed",
+      storeInDatabase: true,
+    },
+    rateLimit: {
+      enabled: true,
+      window: 15 * 60,
+      max: 10,
+      customRules: {
+        "/email-otp/send-verification-otp": { window: 15 * 60, max: 5 },
+        "/sign-in/email-otp": { window: 15 * 60, max: 10 },
+      },
+    },
+    advanced: {
+      useSecureCookies: origin.startsWith("https://"),
+      ipAddress: {
+        ipAddressHeaders: ["x-real-ip"],
+        disableIpTracking: false,
+      },
+      cookies: {
+        session_token: {
+          name: config.sessionCookieName ?? SESSION_COOKIE_NAME,
+          attributes: {
+            httpOnly: true,
+            sameSite: "lax",
+            secure: origin.startsWith("https://"),
+            path: "/",
+          },
+        },
+      },
+    },
+    databaseHooks: {
+      user: {
+        create: {
+          before: async (user: { email: string }) => {
+            if (!(await config.authorizeIdentity(normalizeEmail(user.email)))) {
+              throw new APIError("FORBIDDEN", { message: "Identity is not authorized" });
+            }
+            return { data: user };
+          },
+        },
+      },
+    },
+    plugins: [
+      emailOTP({
+        otpLength: 6,
+        expiresIn: config.codeTtlSeconds,
+        allowedAttempts: config.maxAttempts,
+        storeOTP: "hashed",
+        async sendVerificationOTP({ email, otp, type }) {
+          if (type !== "sign-in") return;
+          const address = normalizeEmail(email);
+          if (!(await config.authorizeIdentity(address))) {
+            // Accept any address and fail SILENTLY for one not on the allow-list:
+            // the request still returns 200 (so the gate never reveals who is
+            // allowed), and no code is sent. Logged at debug for diagnostics, not
+            // as a warning — an unknown address hitting the login page is normal.
+            logger.debug("verification code suppressed: identity not authorized", {
+              email: address,
+            });
+            return;
+          }
+          logger.info("sending verification code", { email: address });
+          void config.sendCode(address, otp, emailOptions).catch((error: unknown) => {
+            logger.error("verification email failed", { email: address, error });
+          });
+        },
+      }),
+      passkey({
+        rpID,
+        rpName: config.appName,
+        origin,
+        authenticatorSelection: {
+          residentKey: "preferred",
+          userVerification: "preferred",
+        },
+        registration: { requireSession: true },
+      }),
+    ] as const,
+  } satisfies BetterAuthOptions;
+
+  await migrateAuth(options, config.storage);
+  const auth = betterAuth(options);
+
+  const session = async (headers: Headers): Promise<string | undefined> => {
+    const current = await auth.api.getSession({ headers });
+    const email = normalizeEmail(current?.user.email);
+    const createdAt = current?.session.createdAt;
+    const createdAtMs = createdAt ? new Date(createdAt).getTime() : Number.NaN;
+    if (config.sessionCutoffMs && !(createdAtMs >= config.sessionCutoffMs)) return undefined;
+    if (!email || !(await config.authorizeIdentity(email))) return undefined;
+    return email;
+  };
+
+  const handleCompatibilityRoute = async (request: Request): Promise<Response | undefined> => {
+    const path = new URL(request.url).pathname;
+    if (path === `${basePath}/status`) {
+      const email = await session(request.headers);
+      return jsonResponse({
+        authenticated: Boolean(email),
+        ...(email ? { email } : {}),
+        enabled: true,
+        passkeysEnabled: true,
+      });
+    }
+    // OTP send + verify go straight to better-auth's native emailOTP endpoints
+    // (`/email-otp/send-verification-otp`, `/sign-in/email-otp`); there is no
+    // compatibility wrapper for them. Failures there are logged by the plugin's
+    // sendVerificationOTP hook, not swallowed behind an always-ok response.
+    if (path === `${basePath}/logout` && request.method === "POST") {
+      const response = await auth.api.signOut({
+        headers: request.headers,
+        asResponse: true,
+      });
+      return compatibilityResponse(response, { ok: response.ok, redirectTo: logoutRedirectPath });
+    }
+    if (path === `${basePath}/logout` && request.method === "GET") {
+      const response = await auth.api.signOut({
+        headers: request.headers,
+        asResponse: true,
+      });
+      return redirectResponse(response, logoutRedirectPath);
+    }
+    return undefined;
+  };
+
+  return {
+    basePath,
+    passkeysEnabled: true,
+    handler: async (request) => (await handleCompatibilityRoute(request)) ?? auth.handler(request),
+    session,
+    status: async (headers) => {
+      const email = await session(headers);
+      return {
+        authenticated: Boolean(email),
+        ...(email ? { email } : {}),
+        enabled: true,
+        passkeysEnabled: true,
+      };
+    },
+    close: () => config.storage.close(),
+  };
+}
+
+/** Restrict logout redirects to one same-origin application path. */
+export function normalizeLogoutRedirectPath(value: string | undefined): string {
+  const path = value?.trim();
+  return path?.startsWith("/") && !path.startsWith("//") && !path.includes("\\") ? path : "/";
+}
+
+function normalizeEmail(email: string | undefined): string {
+  return email?.trim().toLowerCase() ?? "";
+}
+
+function jsonResponse(body: unknown, status = 200): Response {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { "content-type": "application/json" },
+  });
+}
+
+function compatibilityResponse(response: Response, body: unknown): Response {
+  const headers = new Headers({ "content-type": "application/json" });
+  for (const cookie of response.headers.getSetCookie()) headers.append("set-cookie", cookie);
+  return new Response(JSON.stringify(body), { status: 200, headers });
+}
+
+function redirectResponse(response: Response, location: string): Response {
+  const headers = new Headers({ location });
+  for (const cookie of response.headers.getSetCookie()) headers.append("set-cookie", cookie);
+  return new Response(null, { status: 303, headers });
+}

package/src/storage.ts

@@ -0,0 +1,161 @@
+/**
+ * Better Auth database selection and migration locking.
+ *
+ * Callers pass a native AppKit Lakebase pool when available. Otherwise auth
+ * uses SQLite in the operating system's application-data directory.
+ *
+ * @module
+ */
+
+import { mkdirSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+import { fileLock } from "@dbx-tools/core";
+import { advisoryLock, type PgPoolLike } from "@dbx-tools/postgres";
+import { log } from "@dbx-tools/shared-core";
+import type { BetterAuthOptions } from "better-auth";
+import envPaths from "env-paths";
+
+const logger = log.logger("auth:storage");
+
+export type AuthStorageMode = "auto" | "lakebase" | "sqlite";
+
+export interface AuthStorageConfig {
+  storage?: AuthStorageMode;
+  sqlitePath?: string;
+}
+
+export interface ResolvedAuthStorageConfig {
+  mode: AuthStorageMode;
+  sqlitePath: string;
+}
+
+export type AuthDatabase = NonNullable<BetterAuthOptions["database"]>;
+
+export interface AuthStorage {
+  kind: "lakebase" | "sqlite" | "memory";
+  database: AuthDatabase;
+  pool?: PgPoolLike;
+  path?: string;
+  close(): Promise<void>;
+}
+
+type MigrationModule = {
+  getMigrations(options: BetterAuthOptions): Promise<{
+    runMigrations(): Promise<void>;
+  }>;
+};
+
+interface SqliteDatabase {
+  exec(sql: string): unknown;
+  close(): void;
+}
+
+interface BunSqliteModule {
+  Database: new (path: string, options?: { create?: boolean; strict?: boolean }) => SqliteDatabase;
+}
+
+const MIGRATION_LOCK = ["auth", "better-auth", "migrations"] as const;
+
+export function resolveAuthStorageConfig(
+  config: AuthStorageConfig = {},
+): ResolvedAuthStorageConfig {
+  const mode = config.storage ?? "auto";
+  if (mode !== "auto" && mode !== "lakebase" && mode !== "sqlite") {
+    throw new TypeError('auth storage must be "auto", "lakebase", or "sqlite"');
+  }
+  const dataDirectory = envPaths("dbx-tools", { suffix: "" }).data;
+  return {
+    mode,
+    sqlitePath: resolve(config.sqlitePath ?? resolve(dataDirectory, "auth", "auth.sqlite")),
+  };
+}
+
+export function shouldUseLakebase(config: AuthStorageConfig = {}): boolean {
+  const resolved = resolveAuthStorageConfig(config);
+  if (resolved.mode === "lakebase") return true;
+  if (resolved.mode === "sqlite") return false;
+  return Boolean(process.env.LAKEBASE_ENDPOINT ?? process.env.PGHOST);
+}
+
+export async function createAuthStorage(
+  config: AuthStorageConfig,
+  pool?: PgPoolLike,
+): Promise<AuthStorage> {
+  const resolved = resolveAuthStorageConfig(config);
+  if (pool && resolved.mode !== "sqlite") {
+    return {
+      kind: "lakebase",
+      database: pool,
+      pool,
+      close: async () => undefined,
+    };
+  }
+  if (resolved.mode === "lakebase") {
+    throw new Error("auth storage is lakebase but no Lakebase pool was supplied");
+  }
+
+  // Prefer SQLite (durable, survives restarts) when a SQLite binding is present
+  // — bun:sqlite in Bun, node:sqlite in Node. Both are optional runtime
+  // features, so fall back to an in-memory adapter when neither can be opened
+  // rather than failing the whole gate. Memory loses sessions/OTPs on restart
+  // but keeps sign-in working; an explicit `--auth-storage sqlite` still errors
+  // if SQLite is genuinely unavailable, so the fallback is auto-mode only.
+  try {
+    mkdirSync(dirname(resolved.sqlitePath), { recursive: true });
+    const database = await openSqlite(resolved.sqlitePath);
+    return {
+      kind: "sqlite",
+      database,
+      path: resolved.sqlitePath,
+      close: async () => {
+        database.close();
+      },
+    };
+  } catch (error) {
+    if (resolved.mode === "sqlite") throw error;
+    logger.warn("sqlite unavailable for auth storage; using in-memory adapter", { error });
+    const { memoryAdapter } = await import("better-auth/adapters/memory");
+    return {
+      kind: "memory",
+      database: memoryAdapter({}) as unknown as AuthDatabase,
+      close: async () => undefined,
+    };
+  }
+}
+
+export async function migrateAuth(options: BetterAuthOptions, storage: AuthStorage): Promise<void> {
+  // The in-memory adapter builds its schema in memory on init — there is no
+  // database to migrate.
+  if (storage.kind === "memory") return;
+
+  const run = async (): Promise<void> => {
+    const module = (await import(migrationModuleUrl())) as MigrationModule;
+    const migrations = await module.getMigrations(options);
+    await migrations.runMigrations();
+  };
+
+  if (storage.kind === "lakebase" && storage.pool) {
+    await advisoryLock.withAdvisoryLock(storage.pool, MIGRATION_LOCK, run);
+    return;
+  }
+  await fileLock.withFileLock(MIGRATION_LOCK, run);
+}
+
+async function openSqlite(path: string): Promise<AuthDatabase & { close(): void }> {
+  if (process.versions.bun) {
+    const specifier = "bun:sqlite";
+    const { Database } = (await import(specifier)) as BunSqliteModule;
+    const database = new Database(path, { create: true, strict: true });
+    database.exec("PRAGMA journal_mode = WAL; PRAGMA foreign_keys = ON");
+    return database;
+  }
+  const { DatabaseSync } = await import("node:sqlite");
+  const database = new DatabaseSync(path);
+  database.exec("PRAGMA journal_mode = WAL; PRAGMA foreign_keys = ON");
+  return database;
+}
+
+function migrationModuleUrl(): string {
+  const entry = import.meta.resolve("better-auth");
+  return new URL("./db/get-migration.mjs", entry).href;
+}