@dbx-tools/auth 0.6.91

package/README.md

@@ -0,0 +1,44 @@
+# `@dbx-tools/auth`
+
+Passwordless authentication runtime built on Better Auth, email OTP, passkeys,
+and caller-provided identity policy and delivery.
+
+Key features:
+
+- Better Auth ownership of users, sessions, OTP lifecycle, rate limits, and
+  passkey credentials;
+- session-required passkey enrollment and discoverable passkey login;
+- caller-provided `authorizeIdentity`, email sender, secret, origin, and
+  database;
+- native AppKit Lakebase pool or local SQLite storage;
+- programmatic Better Auth migrations under advisory or file locks.
+
+## Relationship To Native AppKit
+
+Use the Databricks Apps front door and AppKit execution context when traffic
+arrives through the platform. Use this package for a public tunnel or another
+route that bypasses that identity-aware proxy and therefore needs its own
+passwordless session. A passkey session proves the configured identity only; it
+does not mint a Databricks OBO access token.
+
+```ts
+import { auth, storage } from "@dbx-tools/auth";
+
+const database = await storage.createAuthStorage({ storage: "sqlite" });
+const runtime = await auth.createPasswordlessAuth({
+  storage: database,
+  baseURL: "http://localhost:8000",
+  appName: "My app",
+  secret: process.env.AUTH_SECRET!,
+  sessionTtlSeconds: 2_592_000,
+  codeTtlSeconds: 600,
+  maxAttempts: 5,
+  authorizeIdentity: (email) => email.endsWith("@example.com"),
+  sendCode: async (email, code) => sendEmail(email, code),
+});
+```
+
+## Modules
+
+- `auth` - Better Auth runtime and compatibility routes;
+- `storage` - Lakebase/SQLite selection and migration locking.

package/index.ts

@@ -0,0 +1,9 @@
+// GENERATED by projen watch - DO NOT EDIT.
+// Regenerated from the exporting modules in ./src.
+// Hand edits are overwritten on the next watch; this file is read-only.
+
+export const PACKAGE_IDENTIFIER = "@dbx-tools/auth";
+export * as auth from "./src/auth.ts";
+export * as storage from "./src/storage.ts";
+export type { AuthorizeIdentity, AuthEmailOptions, PasswordlessAuthOptions, PasswordlessAuthRuntime } from "./src/auth.ts";
+export type { AuthStorageMode, AuthStorageConfig, ResolvedAuthStorageConfig, AuthDatabase, AuthStorage } from "./src/storage.ts";

package/lib/index.d.ts

@@ -0,0 +1,5 @@
+export declare const PACKAGE_IDENTIFIER = "@dbx-tools/auth";
+export * as auth from "./src/auth.ts";
+export * as storage from "./src/storage.ts";
+export type { AuthorizeIdentity, AuthEmailOptions, PasswordlessAuthOptions, PasswordlessAuthRuntime } from "./src/auth.ts";
+export type { AuthStorageMode, AuthStorageConfig, ResolvedAuthStorageConfig, AuthDatabase, AuthStorage } from "./src/storage.ts";

package/lib/index.js

@@ -0,0 +1,7 @@
+// GENERATED by projen watch - DO NOT EDIT.
+// Regenerated from the exporting modules in ./src.
+// Hand edits are overwritten on the next watch; this file is read-only.
+export const PACKAGE_IDENTIFIER = "@dbx-tools/auth";
+export * as auth from "./src/auth.js";
+export * as storage from "./src/storage.js";
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSwyQ0FBMkM7QUFDM0MsbURBQW1EO0FBQ25ELHdFQUF3RTtBQUV4RSxNQUFNLENBQUMsTUFBTSxrQkFBa0IsR0FBRyxpQkFBaUIsQ0FBQztBQUNwRCxPQUFPLEtBQUssSUFBSSxNQUFNLGVBQWUsQ0FBQztBQUN0QyxPQUFPLEtBQUssT0FBTyxNQUFNLGtCQUFrQixDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiLy8gR0VORVJBVEVEIGJ5IHByb2plbiB3YXRjaCAtIERPIE5PVCBFRElULlxuLy8gUmVnZW5lcmF0ZWQgZnJvbSB0aGUgZXhwb3J0aW5nIG1vZHVsZXMgaW4gLi9zcmMuXG4vLyBIYW5kIGVkaXRzIGFyZSBvdmVyd3JpdHRlbiBvbiB0aGUgbmV4dCB3YXRjaDsgdGhpcyBmaWxlIGlzIHJlYWQtb25seS5cblxuZXhwb3J0IGNvbnN0IFBBQ0tBR0VfSURFTlRJRklFUiA9IFwiQGRieC10b29scy9hdXRoXCI7XG5leHBvcnQgKiBhcyBhdXRoIGZyb20gXCIuL3NyYy9hdXRoLnRzXCI7XG5leHBvcnQgKiBhcyBzdG9yYWdlIGZyb20gXCIuL3NyYy9zdG9yYWdlLnRzXCI7XG5leHBvcnQgdHlwZSB7IEF1dGhvcml6ZUlkZW50aXR5LCBBdXRoRW1haWxPcHRpb25zLCBQYXNzd29yZGxlc3NBdXRoT3B0aW9ucywgUGFzc3dvcmRsZXNzQXV0aFJ1bnRpbWUgfSBmcm9tIFwiLi9zcmMvYXV0aC50c1wiO1xuZXhwb3J0IHR5cGUgeyBBdXRoU3RvcmFnZU1vZGUsIEF1dGhTdG9yYWdlQ29uZmlnLCBSZXNvbHZlZEF1dGhTdG9yYWdlQ29uZmlnLCBBdXRoRGF0YWJhc2UsIEF1dGhTdG9yYWdlIH0gZnJvbSBcIi4vc3JjL3N0b3JhZ2UudHNcIjtcbiJdfQ==

package/lib/src/auth.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Better Auth passwordless runtime with email OTP and passkeys.
+ *
+ * Callers provide authorization, delivery, storage, origin, and secret. Better
+ * Auth owns users, OTP verification records, sessions, rate limits, passkey
+ * credentials, and their native HTTP routes.
+ *
+ * @module
+ */
+import { type AuthStatus } from "@dbx-tools/shared-auth";
+import type { AuthStorage } from "./storage.ts";
+export type AuthorizeIdentity = (email: string) => boolean | Promise<boolean>;
+export interface AuthEmailOptions {
+    subject: string;
+    brandName: string;
+    message: string;
+    codeTtlSeconds: number;
+}
+export interface PasswordlessAuthOptions {
+    storage: AuthStorage;
+    baseURL: string;
+    basePath?: string;
+    appName: string;
+    secret: string;
+    sessionCookieName?: string;
+    sessionTtlSeconds: number;
+    sessionCutoffMs?: number;
+    codeTtlSeconds: number;
+    maxAttempts: number;
+    authorizeIdentity: AuthorizeIdentity;
+    sendCode(email: string, code: string, options: AuthEmailOptions): Promise<void>;
+    subject?: string;
+    message?: string;
+}
+export interface PasswordlessAuthRuntime {
+    readonly basePath: string;
+    readonly passkeysEnabled: boolean;
+    handler(request: Request): Promise<Response>;
+    session(headers: Headers): Promise<string | undefined>;
+    status(headers: Headers): Promise<AuthStatus>;
+    close(): Promise<void>;
+}
+export declare function createPasswordlessAuth(config: PasswordlessAuthOptions): Promise<PasswordlessAuthRuntime>;

package/lib/src/auth.js

@@ -0,0 +1,218 @@
+/**
+ * Better Auth passwordless runtime with email OTP and passkeys.
+ *
+ * Callers provide authorization, delivery, storage, origin, and secret. Better
+ * Auth owns users, OTP verification records, sessions, rate limits, passkey
+ * credentials, and their native HTTP routes.
+ *
+ * @module
+ */
+import { passkey } from "@better-auth/passkey";
+import { authRequestSchema, authVerifySchema, SESSION_COOKIE_NAME, } from "@dbx-tools/shared-auth";
+import { log } from "@dbx-tools/shared-core";
+import { APIError, betterAuth } from "better-auth";
+import { emailOTP } from "better-auth/plugins";
+import { migrateAuth } from "./storage.js";
+const logger = log.logger("auth");
+export async function createPasswordlessAuth(config) {
+    const origin = new URL(config.baseURL).origin;
+    const rpID = new URL(origin).hostname;
+    const basePath = config.basePath ?? "/api/auth";
+    const emailOptions = {
+        subject: config.subject ?? "Your verification code",
+        brandName: config.appName,
+        message: config.message ?? "Your verification code is:",
+        codeTtlSeconds: config.codeTtlSeconds,
+    };
+    const options = {
+        appName: config.appName,
+        baseURL: origin,
+        basePath,
+        database: config.storage.database,
+        secret: config.secret,
+        trustedOrigins: [origin],
+        session: {
+            expiresIn: config.sessionTtlSeconds,
+            updateAge: Math.min(24 * 60 * 60, config.sessionTtlSeconds),
+        },
+        verification: {
+            storeIdentifier: "hashed",
+            storeInDatabase: true,
+        },
+        rateLimit: {
+            enabled: true,
+            window: 15 * 60,
+            max: 10,
+            customRules: {
+                "/email-otp/send-verification-otp": { window: 15 * 60, max: 5 },
+                "/sign-in/email-otp": { window: 15 * 60, max: 10 },
+            },
+        },
+        advanced: {
+            useSecureCookies: origin.startsWith("https://"),
+            ipAddress: {
+                ipAddressHeaders: ["x-real-ip"],
+                disableIpTracking: false,
+            },
+            cookies: {
+                session_token: {
+                    name: config.sessionCookieName ?? SESSION_COOKIE_NAME,
+                    attributes: {
+                        httpOnly: true,
+                        sameSite: "lax",
+                        secure: origin.startsWith("https://"),
+                        path: "/",
+                    },
+                },
+            },
+        },
+        databaseHooks: {
+            user: {
+                create: {
+                    before: async (user) => {
+                        if (!(await config.authorizeIdentity(normalizeEmail(user.email)))) {
+                            throw new APIError("FORBIDDEN", { message: "Identity is not authorized" });
+                        }
+                        return { data: user };
+                    },
+                },
+            },
+        },
+        plugins: [
+            emailOTP({
+                otpLength: 6,
+                expiresIn: config.codeTtlSeconds,
+                allowedAttempts: config.maxAttempts,
+                storeOTP: "hashed",
+                async sendVerificationOTP({ email, otp, type }) {
+                    if (type !== "sign-in")
+                        return;
+                    const address = normalizeEmail(email);
+                    if (!(await config.authorizeIdentity(address)))
+                        return;
+                    void config.sendCode(address, otp, emailOptions).catch((error) => {
+                        logger.error("verification email failed", { email: address, error });
+                    });
+                },
+            }),
+            passkey({
+                rpID,
+                rpName: config.appName,
+                origin,
+                authenticatorSelection: {
+                    residentKey: "preferred",
+                    userVerification: "preferred",
+                },
+                registration: { requireSession: true },
+            }),
+        ],
+    };
+    await migrateAuth(options, config.storage);
+    const auth = betterAuth(options);
+    const session = async (headers) => {
+        const current = await auth.api.getSession({ headers });
+        const email = normalizeEmail(current?.user.email);
+        const createdAt = current?.session.createdAt;
+        const createdAtMs = createdAt ? new Date(createdAt).getTime() : Number.NaN;
+        if (config.sessionCutoffMs && !(createdAtMs >= config.sessionCutoffMs))
+            return undefined;
+        if (!email || !(await config.authorizeIdentity(email)))
+            return undefined;
+        return email;
+    };
+    const handleCompatibilityRoute = async (request) => {
+        const path = new URL(request.url).pathname;
+        if (path === `${basePath}/status`) {
+            const email = await session(request.headers);
+            return jsonResponse({
+                authenticated: Boolean(email),
+                ...(email ? { email } : {}),
+                enabled: true,
+                passkeysEnabled: true,
+            });
+        }
+        if (path === `${basePath}/request` && request.method === "POST") {
+            const parsed = authRequestSchema.safeParse(await requestJson(request));
+            if (parsed.success) {
+                await auth.api
+                    .sendVerificationOTP({
+                    body: { email: normalizeEmail(parsed.data.email), type: "sign-in" },
+                    headers: request.headers,
+                })
+                    .catch(() => undefined);
+            }
+            return jsonResponse({ ok: true });
+        }
+        if (path === `${basePath}/verify` && request.method === "POST") {
+            const parsed = authVerifySchema.safeParse(await requestJson(request));
+            if (!parsed.success)
+                return jsonResponse({ ok: false });
+            try {
+                const response = await auth.api.signInEmailOTP({
+                    body: {
+                        email: normalizeEmail(parsed.data.email),
+                        otp: parsed.data.code,
+                        name: displayName(parsed.data.email),
+                    },
+                    headers: request.headers,
+                    asResponse: true,
+                });
+                return compatibilityResponse(response, { ok: response.ok });
+            }
+            catch {
+                return jsonResponse({ ok: false });
+            }
+        }
+        if (path === `${basePath}/logout` && request.method === "POST") {
+            const response = await auth.api.signOut({
+                headers: request.headers,
+                asResponse: true,
+            });
+            return compatibilityResponse(response, { ok: response.ok });
+        }
+        return undefined;
+    };
+    return {
+        basePath,
+        passkeysEnabled: true,
+        handler: async (request) => (await handleCompatibilityRoute(request)) ?? auth.handler(request),
+        session,
+        status: async (headers) => {
+            const email = await session(headers);
+            return {
+                authenticated: Boolean(email),
+                ...(email ? { email } : {}),
+                enabled: true,
+                passkeysEnabled: true,
+            };
+        },
+        close: () => config.storage.close(),
+    };
+}
+function normalizeEmail(email) {
+    return email?.trim().toLowerCase() ?? "";
+}
+function displayName(email) {
+    return normalizeEmail(email).split("@")[0] || "User";
+}
+async function requestJson(request) {
+    try {
+        return await request.json();
+    }
+    catch {
+        return undefined;
+    }
+}
+function jsonResponse(body, status = 200) {
+    return new Response(JSON.stringify(body), {
+        status,
+        headers: { "content-type": "application/json" },
+    });
+}
+function compatibilityResponse(response, body) {
+    const headers = new Headers({ "content-type": "application/json" });
+    for (const cookie of response.headers.getSetCookie())
+        headers.append("set-cookie", cookie);
+    return new Response(JSON.stringify(body), { status: 200, headers });
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXV0aC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9hdXRoLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOzs7Ozs7OztHQVFHO0FBRUgsT0FBTyxFQUFFLE9BQU8sRUFBRSxNQUFNLHNCQUFzQixDQUFDO0FBQy9DLE9BQU8sRUFDTCxpQkFBaUIsRUFDakIsZ0JBQWdCLEVBRWhCLG1CQUFtQixHQUNwQixNQUFNLHdCQUF3QixDQUFDO0FBQ2hDLE9BQU8sRUFBRSxHQUFHLEVBQUUsTUFBTSx3QkFBd0IsQ0FBQztBQUM3QyxPQUFPLEVBQUUsUUFBUSxFQUFFLFVBQVUsRUFBMEIsTUFBTSxhQUFhLENBQUM7QUFDM0UsT0FBTyxFQUFFLFFBQVEsRUFBRSxNQUFNLHFCQUFxQixDQUFDO0FBRy9DLE9BQU8sRUFBRSxXQUFXLEVBQUUsTUFBTSxjQUFjLENBQUM7QUFFM0MsTUFBTSxNQUFNLEdBQUcsR0FBRyxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsQ0FBQztBQXFDbEMsTUFBTSxDQUFDLEtBQUssVUFBVSxzQkFBc0IsQ0FDMUMsTUFBK0I7SUFFL0IsTUFBTSxNQUFNLEdBQUcsSUFBSSxHQUFHLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQyxDQUFDLE1BQU0sQ0FBQztJQUM5QyxNQUFNLElBQUksR0FBRyxJQUFJLEdBQUcsQ0FBQyxNQUFNLENBQUMsQ0FBQyxRQUFRLENBQUM7SUFDdEMsTUFBTSxRQUFRLEdBQUcsTUFBTSxDQUFDLFFBQVEsSUFBSSxXQUFXLENBQUM7SUFDaEQsTUFBTSxZQUFZLEdBQXFCO1FBQ3JDLE9BQU8sRUFBRSxNQUFNLENBQUMsT0FBTyxJQUFJLHdCQUF3QjtRQUNuRCxTQUFTLEVBQUUsTUFBTSxDQUFDLE9BQU87UUFDekIsT0FBTyxFQUFFLE1BQU0sQ0FBQyxPQUFPLElBQUksNEJBQTRCO1FBQ3ZELGNBQWMsRUFBRSxNQUFNLENBQUMsY0FBYztLQUN0QyxDQUFDO0lBRUYsTUFBTSxPQUFPLEdBQUc7UUFDZCxPQUFPLEVBQUUsTUFBTSxDQUFDLE9BQU87UUFDdkIsT0FBTyxFQUFFLE1BQU07UUFDZixRQUFRO1FBQ1IsUUFBUSxFQUFFLE1BQU0sQ0FBQyxPQUFPLENBQUMsUUFBUTtRQUNqQyxNQUFNLEVBQUUsTUFBTSxDQUFDLE1BQU07UUFDckIsY0FBYyxFQUFFLENBQUMsTUFBTSxDQUFDO1FBQ3hCLE9BQU8sRUFBRTtZQUNQLFNBQVMsRUFBRSxNQUFNLENBQUMsaUJBQWlCO1lBQ25DLFNBQVMsRUFBRSxJQUFJLENBQUMsR0FBRyxDQUFDLEVBQUUsR0FBRyxFQUFFLEdBQUcsRUFBRSxFQUFFLE1BQU0sQ0FBQyxpQkFBaUIsQ0FBQztTQUM1RDtRQUNELFlBQVksRUFBRTtZQUNaLGVBQWUsRUFBRSxRQUFRO1lBQ3pCLGVBQWUsRUFBRSxJQUFJO1NBQ3RCO1FBQ0QsU0FBUyxFQUFFO1lBQ1QsT0FBTyxFQUFFLElBQUk7WUFDYixNQUFNLEVBQUUsRUFBRSxHQUFHLEVBQUU7WUFDZixHQUFHLEVBQUUsRUFBRTtZQUNQLFdBQVcsRUFBRTtnQkFDWCxrQ0FBa0MsRUFBRSxFQUFFLE1BQU0sRUFBRSxFQUFFLEdBQUcsRUFBRSxFQUFFLEdBQUcsRUFBRSxDQUFDLEVBQUU7Z0JBQy9ELG9CQUFvQixFQUFFLEVBQUUsTUFBTSxFQUFFLEVBQUUsR0FBRyxFQUFFLEVBQUUsR0FBRyxFQUFFLEVBQUUsRUFBRTthQUNuRDtTQUNGO1FBQ0QsUUFBUSxFQUFFO1lBQ1IsZ0JBQWdCLEVBQUUsTUFBTSxDQUFDLFVBQVUsQ0FBQyxVQUFVLENBQUM7WUFDL0MsU0FBUyxFQUFFO2dCQUNULGdCQUFnQixFQUFFLENBQUMsV0FBVyxDQUFDO2dCQUMvQixpQkFBaUIsRUFBRSxLQUFLO2FBQ3pCO1lBQ0QsT0FBTyxFQUFFO2dCQUNQLGFBQWEsRUFBRTtvQkFDYixJQUFJLEVBQUUsTUFBTSxDQUFDLGlCQUFpQixJQUFJLG1CQUFtQjtvQkFDckQsVUFBVSxFQUFFO3dCQUNWLFFBQVEsRUFBRSxJQUFJO3dCQUNkLFFBQVEsRUFBRSxLQUFLO3dCQUNmLE1BQU0sRUFBRSxNQUFNLENBQUMsVUFBVSxDQUFDLFVBQVUsQ0FBQzt3QkFDckMsSUFBSSxFQUFFLEdBQUc7cUJBQ1Y7aUJBQ0Y7YUFDRjtTQUNGO1FBQ0QsYUFBYSxFQUFFO1lBQ2IsSUFBSSxFQUFFO2dCQUNKLE1BQU0sRUFBRTtvQkFDTixNQUFNLEVBQUUsS0FBSyxFQUFFLElBQXVCLEVBQUUsRUFBRTt3QkFDeEMsSUFBSSxDQUFDLENBQUMsTUFBTSxNQUFNLENBQUMsaUJBQWlCLENBQUMsY0FBYyxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQzs0QkFDbEUsTUFBTSxJQUFJLFFBQVEsQ0FBQyxXQUFXLEVBQUUsRUFBRSxPQUFPLEVBQUUsNEJBQTRCLEVBQUUsQ0FBQyxDQUFDO3dCQUM3RSxDQUFDO3dCQUNELE9BQU8sRUFBRSxJQUFJLEVBQUUsSUFBSSxFQUFFLENBQUM7b0JBQ3hCLENBQUM7aUJBQ0Y7YUFDRjtTQUNGO1FBQ0QsT0FBTyxFQUFFO1lBQ1AsUUFBUSxDQUFDO2dCQUNQLFNBQVMsRUFBRSxDQUFDO2dCQUNaLFNBQVMsRUFBRSxNQUFNLENBQUMsY0FBYztnQkFDaEMsZUFBZSxFQUFFLE1BQU0sQ0FBQyxXQUFXO2dCQUNuQyxRQUFRLEVBQUUsUUFBUTtnQkFDbEIsS0FBSyxDQUFDLG1CQUFtQixDQUFDLEVBQUUsS0FBSyxFQUFFLEdBQUcsRUFBRSxJQUFJLEVBQUU7b0JBQzVDLElBQUksSUFBSSxLQUFLLFNBQVM7d0JBQUUsT0FBTztvQkFDL0IsTUFBTSxPQUFPLEdBQUcsY0FBYyxDQUFDLEtBQUssQ0FBQyxDQUFDO29CQUN0QyxJQUFJLENBQUMsQ0FBQyxNQUFNLE1BQU0sQ0FBQyxpQkFBaUIsQ0FBQyxPQUFPLENBQUMsQ0FBQzt3QkFBRSxPQUFPO29CQUN2RCxLQUFLLE1BQU0sQ0FBQyxRQUFRLENBQUMsT0FBTyxFQUFFLEdBQUcsRUFBRSxZQUFZLENBQUMsQ0FBQyxLQUFLLENBQUMsQ0FBQyxLQUFjLEVBQUUsRUFBRTt3QkFDeEUsTUFBTSxDQUFDLEtBQUssQ0FBQywyQkFBMkIsRUFBRSxFQUFFLEtBQUssRUFBRSxPQUFPLEVBQUUsS0FBSyxFQUFFLENBQUMsQ0FBQztvQkFDdkUsQ0FBQyxDQUFDLENBQUM7Z0JBQ0wsQ0FBQzthQUNGLENBQUM7WUFDRixPQUFPLENBQUM7Z0JBQ04sSUFBSTtnQkFDSixNQUFNLEVBQUUsTUFBTSxDQUFDLE9BQU87Z0JBQ3RCLE1BQU07Z0JBQ04sc0JBQXNCLEVBQUU7b0JBQ3RCLFdBQVcsRUFBRSxXQUFXO29CQUN4QixnQkFBZ0IsRUFBRSxXQUFXO2lCQUM5QjtnQkFDRCxZQUFZLEVBQUUsRUFBRSxjQUFjLEVBQUUsSUFBSSxFQUFFO2FBQ3ZDLENBQUM7U0FDTTtLQUNpQixDQUFDO0lBRTlCLE1BQU0sV0FBVyxDQUFDLE9BQU8sRUFBRSxNQUFNLENBQUMsT0FBTyxDQUFDLENBQUM7SUFDM0MsTUFBTSxJQUFJLEdBQUcsVUFBVSxDQUFDLE9BQU8sQ0FBQyxDQUFDO0lBRWpDLE1BQU0sT0FBTyxHQUFHLEtBQUssRUFBRSxPQUFnQixFQUErQixFQUFFO1FBQ3RFLE1BQU0sT0FBTyxHQUFHLE1BQU0sSUFBSSxDQUFDLEdBQUcsQ0FBQyxVQUFVLENBQUMsRUFBRSxPQUFPLEVBQUUsQ0FBQyxDQUFDO1FBQ3ZELE1BQU0sS0FBSyxHQUFHLGNBQWMsQ0FBQyxPQUFPLEVBQUUsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQ2xELE1BQU0sU0FBUyxHQUFHLE9BQU8sRUFBRSxPQUFPLENBQUMsU0FBUyxDQUFDO1FBQzdDLE1BQU0sV0FBVyxHQUFHLFNBQVMsQ0FBQyxDQUFDLENBQUMsSUFBSSxJQUFJLENBQUMsU0FBUyxDQUFDLENBQUMsT0FBTyxFQUFFLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUM7UUFDM0UsSUFBSSxNQUFNLENBQUMsZUFBZSxJQUFJLENBQUMsQ0FBQyxXQUFXLElBQUksTUFBTSxDQUFDLGVBQWUsQ0FBQztZQUFFLE9BQU8sU0FBUyxDQUFDO1FBQ3pGLElBQUksQ0FBQyxLQUFLLElBQUksQ0FBQyxDQUFDLE1BQU0sTUFBTSxDQUFDLGlCQUFpQixDQUFDLEtBQUssQ0FBQyxDQUFDO1lBQUUsT0FBTyxTQUFTLENBQUM7UUFDekUsT0FBTyxLQUFLLENBQUM7SUFDZixDQUFDLENBQUM7SUFFRixNQUFNLHdCQUF3QixHQUFHLEtBQUssRUFBRSxPQUFnQixFQUFpQyxFQUFFO1FBQ3pGLE1BQU0sSUFBSSxHQUFHLElBQUksR0FBRyxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsQ0FBQyxRQUFRLENBQUM7UUFDM0MsSUFBSSxJQUFJLEtBQUssR0FBRyxRQUFRLFNBQVMsRUFBRSxDQUFDO1lBQ2xDLE1BQU0sS0FBSyxHQUFHLE1BQU0sT0FBTyxDQUFDLE9BQU8sQ0FBQyxPQUFPLENBQUMsQ0FBQztZQUM3QyxPQUFPLFlBQVksQ0FBQztnQkFDbEIsYUFBYSxFQUFFLE9BQU8sQ0FBQyxLQUFLLENBQUM7Z0JBQzdCLEdBQUcsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLEVBQUUsS0FBSyxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztnQkFDM0IsT0FBTyxFQUFFLElBQUk7Z0JBQ2IsZUFBZSxFQUFFLElBQUk7YUFDdEIsQ0FBQyxDQUFDO1FBQ0wsQ0FBQztRQUNELElBQUksSUFBSSxLQUFLLEdBQUcsUUFBUSxVQUFVLElBQUksT0FBTyxDQUFDLE1BQU0sS0FBSyxNQUFNLEVBQUUsQ0FBQztZQUNoRSxNQUFNLE1BQU0sR0FBRyxpQkFBaUIsQ0FBQyxTQUFTLENBQUMsTUFBTSxXQUFXLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQztZQUN2RSxJQUFJLE1BQU0sQ0FBQyxPQUFPLEVBQUUsQ0FBQztnQkFDbkIsTUFBTSxJQUFJLENBQUMsR0FBRztxQkFDWCxtQkFBbUIsQ0FBQztvQkFDbkIsSUFBSSxFQUFFLEVBQUUsS0FBSyxFQUFFLGNBQWMsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxFQUFFLElBQUksRUFBRSxTQUFTLEVBQUU7b0JBQ25FLE9BQU8sRUFBRSxPQUFPLENBQUMsT0FBTztpQkFDekIsQ0FBQztxQkFDRCxLQUFLLENBQUMsR0FBRyxFQUFFLENBQUMsU0FBUyxDQUFDLENBQUM7WUFDNUIsQ0FBQztZQUNELE9BQU8sWUFBWSxDQUFDLEVBQUUsRUFBRSxFQUFFLElBQUksRUFBRSxDQUFDLENBQUM7UUFDcEMsQ0FBQztRQUNELElBQUksSUFBSSxLQUFLLEdBQUcsUUFBUSxTQUFTLElBQUksT0FBTyxDQUFDLE1BQU0sS0FBSyxNQUFNLEVBQUUsQ0FBQztZQUMvRCxNQUFNLE1BQU0sR0FBRyxnQkFBZ0IsQ0FBQyxTQUFTLENBQUMsTUFBTSxXQUFXLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQztZQUN0RSxJQUFJLENBQUMsTUFBTSxDQUFDLE9BQU87Z0JBQUUsT0FBTyxZQUFZLENBQUMsRUFBRSxFQUFFLEVBQUUsS0FBSyxFQUFFLENBQUMsQ0FBQztZQUN4RCxJQUFJLENBQUM7Z0JBQ0gsTUFBTSxRQUFRLEdBQUcsTUFBTSxJQUFJLENBQUMsR0FBRyxDQUFDLGNBQWMsQ0FBQztvQkFDN0MsSUFBSSxFQUFFO3dCQUNKLEtBQUssRUFBRSxjQUFjLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUM7d0JBQ3hDLEdBQUcsRUFBRSxNQUFNLENBQUMsSUFBSSxDQUFDLElBQUk7d0JBQ3JCLElBQUksRUFBRSxXQUFXLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUM7cUJBQ3JDO29CQUNELE9BQU8sRUFBRSxPQUFPLENBQUMsT0FBTztvQkFDeEIsVUFBVSxFQUFFLElBQUk7aUJBQ2pCLENBQUMsQ0FBQztnQkFDSCxPQUFPLHFCQUFxQixDQUFDLFFBQVEsRUFBRSxFQUFFLEVBQUUsRUFBRSxRQUFRLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FBQztZQUM5RCxDQUFDO1lBQUMsTUFBTSxDQUFDO2dCQUNQLE9BQU8sWUFBWSxDQUFDLEVBQUUsRUFBRSxFQUFFLEtBQUssRUFBRSxDQUFDLENBQUM7WUFDckMsQ0FBQztRQUNILENBQUM7UUFDRCxJQUFJLElBQUksS0FBSyxHQUFHLFFBQVEsU0FBUyxJQUFJLE9BQU8sQ0FBQyxNQUFNLEtBQUssTUFBTSxFQUFFLENBQUM7WUFDL0QsTUFBTSxRQUFRLEdBQUcsTUFBTSxJQUFJLENBQUMsR0FBRyxDQUFDLE9BQU8sQ0FBQztnQkFDdEMsT0FBTyxFQUFFLE9BQU8sQ0FBQyxPQUFPO2dCQUN4QixVQUFVLEVBQUUsSUFBSTthQUNqQixDQUFDLENBQUM7WUFDSCxPQUFPLHFCQUFxQixDQUFDLFFBQVEsRUFBRSxFQUFFLEVBQUUsRUFBRSxRQUFRLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FBQztRQUM5RCxDQUFDO1FBQ0QsT0FBTyxTQUFTLENBQUM7SUFDbkIsQ0FBQyxDQUFDO0lBRUYsT0FBTztRQUNMLFFBQVE7UUFDUixlQUFlLEVBQUUsSUFBSTtRQUNyQixPQUFPLEVBQUUsS0FBSyxFQUFFLE9BQU8sRUFBRSxFQUFFLENBQUMsQ0FBQyxNQUFNLHdCQUF3QixDQUFDLE9BQU8sQ0FBQyxDQUFDLElBQUksSUFBSSxDQUFDLE9BQU8sQ0FBQyxPQUFPLENBQUM7UUFDOUYsT0FBTztRQUNQLE1BQU0sRUFBRSxLQUFLLEVBQUUsT0FBTyxFQUFFLEVBQUU7WUFDeEIsTUFBTSxLQUFLLEdBQUcsTUFBTSxPQUFPLENBQUMsT0FBTyxDQUFDLENBQUM7WUFDckMsT0FBTztnQkFDTCxhQUFhLEVBQUUsT0FBTyxDQUFDLEtBQUssQ0FBQztnQkFDN0IsR0FBRyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsRUFBRSxLQUFLLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO2dCQUMzQixPQUFPLEVBQUUsSUFBSTtnQkFDYixlQUFlLEVBQUUsSUFBSTthQUN0QixDQUFDO1FBQ0osQ0FBQztRQUNELEtBQUssRUFBRSxHQUFHLEVBQUUsQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDLEtBQUssRUFBRTtLQUNwQyxDQUFDO0FBQ0osQ0FBQztBQUVELFNBQVMsY0FBYyxDQUFDLEtBQXlCO0lBQy9DLE9BQU8sS0FBSyxFQUFFLElBQUksRUFBRSxDQUFDLFdBQVcsRUFBRSxJQUFJLEVBQUUsQ0FBQztBQUMzQyxDQUFDO0FBRUQsU0FBUyxXQUFXLENBQUMsS0FBYTtJQUNoQyxPQUFPLGNBQWMsQ0FBQyxLQUFLLENBQUMsQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDLElBQUksTUFBTSxDQUFDO0FBQ3ZELENBQUM7QUFFRCxLQUFLLFVBQVUsV0FBVyxDQUFDLE9BQWdCO0lBQ3pDLElBQUksQ0FBQztRQUNILE9BQU8sTUFBTSxPQUFPLENBQUMsSUFBSSxFQUFFLENBQUM7SUFDOUIsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUNQLE9BQU8sU0FBUyxDQUFDO0lBQ25CLENBQUM7QUFDSCxDQUFDO0FBRUQsU0FBUyxZQUFZLENBQUMsSUFBYSxFQUFFLE1BQU0sR0FBRyxHQUFHO0lBQy9DLE9BQU8sSUFBSSxRQUFRLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxJQUFJLENBQUMsRUFBRTtRQUN4QyxNQUFNO1FBQ04sT0FBTyxFQUFFLEVBQUUsY0FBYyxFQUFFLGtCQUFrQixFQUFFO0tBQ2hELENBQUMsQ0FBQztBQUNMLENBQUM7QUFFRCxTQUFTLHFCQUFxQixDQUFDLFFBQWtCLEVBQUUsSUFBYTtJQUM5RCxNQUFNLE9BQU8sR0FBRyxJQUFJLE9BQU8sQ0FBQyxFQUFFLGNBQWMsRUFBRSxrQkFBa0IsRUFBRSxDQUFDLENBQUM7SUFDcEUsS0FBSyxNQUFNLE1BQU0sSUFBSSxRQUFRLENBQUMsT0FBTyxDQUFDLFlBQVksRUFBRTtRQUFFLE9BQU8sQ0FBQyxNQUFNLENBQUMsWUFBWSxFQUFFLE1BQU0sQ0FBQyxDQUFDO0lBQzNGLE9BQU8sSUFBSSxRQUFRLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxJQUFJLENBQUMsRUFBRSxFQUFFLE1BQU0sRUFBRSxHQUFHLEVBQUUsT0FBTyxFQUFFLENBQUMsQ0FBQztBQUN0RSxDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiLyoqXG4gKiBCZXR0ZXIgQXV0aCBwYXNzd29yZGxlc3MgcnVudGltZSB3aXRoIGVtYWlsIE9UUCBhbmQgcGFzc2tleXMuXG4gKlxuICogQ2FsbGVycyBwcm92aWRlIGF1dGhvcml6YXRpb24sIGRlbGl2ZXJ5LCBzdG9yYWdlLCBvcmlnaW4sIGFuZCBzZWNyZXQuIEJldHRlclxuICogQXV0aCBvd25zIHVzZXJzLCBPVFAgdmVyaWZpY2F0aW9uIHJlY29yZHMsIHNlc3Npb25zLCByYXRlIGxpbWl0cywgcGFzc2tleVxuICogY3JlZGVudGlhbHMsIGFuZCB0aGVpciBuYXRpdmUgSFRUUCByb3V0ZXMuXG4gKlxuICogQG1vZHVsZVxuICovXG5cbmltcG9ydCB7IHBhc3NrZXkgfSBmcm9tIFwiQGJldHRlci1hdXRoL3Bhc3NrZXlcIjtcbmltcG9ydCB7XG4gIGF1dGhSZXF1ZXN0U2NoZW1hLFxuICBhdXRoVmVyaWZ5U2NoZW1hLFxuICB0eXBlIEF1dGhTdGF0dXMsXG4gIFNFU1NJT05fQ09PS0lFX05BTUUsXG59IGZyb20gXCJAZGJ4LXRvb2xzL3NoYXJlZC1hdXRoXCI7XG5pbXBvcnQgeyBsb2cgfSBmcm9tIFwiQGRieC10b29scy9zaGFyZWQtY29yZVwiO1xuaW1wb3J0IHsgQVBJRXJyb3IsIGJldHRlckF1dGgsIHR5cGUgQmV0dGVyQXV0aE9wdGlvbnMgfSBmcm9tIFwiYmV0dGVyLWF1dGhcIjtcbmltcG9ydCB7IGVtYWlsT1RQIH0gZnJvbSBcImJldHRlci1hdXRoL3BsdWdpbnNcIjtcblxuaW1wb3J0IHR5cGUgeyBBdXRoU3RvcmFnZSB9IGZyb20gXCIuL3N0b3JhZ2UudHNcIjtcbmltcG9ydCB7IG1pZ3JhdGVBdXRoIH0gZnJvbSBcIi4vc3RvcmFnZS50c1wiO1xuXG5jb25zdCBsb2dnZXIgPSBsb2cubG9nZ2VyKFwiYXV0aFwiKTtcblxuZXhwb3J0IHR5cGUgQXV0aG9yaXplSWRlbnRpdHkgPSAoZW1haWw6IHN0cmluZykgPT4gYm9vbGVhbiB8IFByb21pc2U8Ym9vbGVhbj47XG5cbmV4cG9ydCBpbnRlcmZhY2UgQXV0aEVtYWlsT3B0aW9ucyB7XG4gIHN1YmplY3Q6IHN0cmluZztcbiAgYnJhbmROYW1lOiBzdHJpbmc7XG4gIG1lc3NhZ2U6IHN0cmluZztcbiAgY29kZVR0bFNlY29uZHM6IG51bWJlcjtcbn1cblxuZXhwb3J0IGludGVyZmFjZSBQYXNzd29yZGxlc3NBdXRoT3B0aW9ucyB7XG4gIHN0b3JhZ2U6IEF1dGhTdG9yYWdlO1xuICBiYXNlVVJMOiBzdHJpbmc7XG4gIGJhc2VQYXRoPzogc3RyaW5nO1xuICBhcHBOYW1lOiBzdHJpbmc7XG4gIHNlY3JldDogc3RyaW5nO1xuICBzZXNzaW9uQ29va2llTmFtZT86IHN0cmluZztcbiAgc2Vzc2lvblR0bFNlY29uZHM6IG51bWJlcjtcbiAgc2Vzc2lvbkN1dG9mZk1zPzogbnVtYmVyO1xuICBjb2RlVHRsU2Vjb25kczogbnVtYmVyO1xuICBtYXhBdHRlbXB0czogbnVtYmVyO1xuICBhdXRob3JpemVJZGVudGl0eTogQXV0aG9yaXplSWRlbnRpdHk7XG4gIHNlbmRDb2RlKGVtYWlsOiBzdHJpbmcsIGNvZGU6IHN0cmluZywgb3B0aW9uczogQXV0aEVtYWlsT3B0aW9ucyk6IFByb21pc2U8dm9pZD47XG4gIHN1YmplY3Q/OiBzdHJpbmc7XG4gIG1lc3NhZ2U/OiBzdHJpbmc7XG59XG5cbmV4cG9ydCBpbnRlcmZhY2UgUGFzc3dvcmRsZXNzQXV0aFJ1bnRpbWUge1xuICByZWFkb25seSBiYXNlUGF0aDogc3RyaW5nO1xuICByZWFkb25seSBwYXNza2V5c0VuYWJsZWQ6IGJvb2xlYW47XG4gIGhhbmRsZXIocmVxdWVzdDogUmVxdWVzdCk6IFByb21pc2U8UmVzcG9uc2U+O1xuICBzZXNzaW9uKGhlYWRlcnM6IEhlYWRlcnMpOiBQcm9taXNlPHN0cmluZyB8IHVuZGVmaW5lZD47XG4gIHN0YXR1cyhoZWFkZXJzOiBIZWFkZXJzKTogUHJvbWlzZTxBdXRoU3RhdHVzPjtcbiAgY2xvc2UoKTogUHJvbWlzZTx2b2lkPjtcbn1cblxuZXhwb3J0IGFzeW5jIGZ1bmN0aW9uIGNyZWF0ZVBhc3N3b3JkbGVzc0F1dGgoXG4gIGNvbmZpZzogUGFzc3dvcmRsZXNzQXV0aE9wdGlvbnMsXG4pOiBQcm9taXNlPFBhc3N3b3JkbGVzc0F1dGhSdW50aW1lPiB7XG4gIGNvbnN0IG9yaWdpbiA9IG5ldyBVUkwoY29uZmlnLmJhc2VVUkwpLm9yaWdpbjtcbiAgY29uc3QgcnBJRCA9IG5ldyBVUkwob3JpZ2luKS5ob3N0bmFtZTtcbiAgY29uc3QgYmFzZVBhdGggPSBjb25maWcuYmFzZVBhdGggPz8gXCIvYXBpL2F1dGhcIjtcbiAgY29uc3QgZW1haWxPcHRpb25zOiBBdXRoRW1haWxPcHRpb25zID0ge1xuICAgIHN1YmplY3Q6IGNvbmZpZy5zdWJqZWN0ID8/IFwiWW91ciB2ZXJpZmljYXRpb24gY29kZVwiLFxuICAgIGJyYW5kTmFtZTogY29uZmlnLmFwcE5hbWUsXG4gICAgbWVzc2FnZTogY29uZmlnLm1lc3NhZ2UgPz8gXCJZb3VyIHZlcmlmaWNhdGlvbiBjb2RlIGlzOlwiLFxuICAgIGNvZGVUdGxTZWNvbmRzOiBjb25maWcuY29kZVR0bFNlY29uZHMsXG4gIH07XG5cbiAgY29uc3Qgb3B0aW9ucyA9IHtcbiAgICBhcHBOYW1lOiBjb25maWcuYXBwTmFtZSxcbiAgICBiYXNlVVJMOiBvcmlnaW4sXG4gICAgYmFzZVBhdGgsXG4gICAgZGF0YWJhc2U6IGNvbmZpZy5zdG9yYWdlLmRhdGFiYXNlLFxuICAgIHNlY3JldDogY29uZmlnLnNlY3JldCxcbiAgICB0cnVzdGVkT3JpZ2luczogW29yaWdpbl0sXG4gICAgc2Vzc2lvbjoge1xuICAgICAgZXhwaXJlc0luOiBjb25maWcuc2Vzc2lvblR0bFNlY29uZHMsXG4gICAgICB1cGRhdGVBZ2U6IE1hdGgubWluKDI0ICogNjAgKiA2MCwgY29uZmlnLnNlc3Npb25UdGxTZWNvbmRzKSxcbiAgICB9LFxuICAgIHZlcmlmaWNhdGlvbjoge1xuICAgICAgc3RvcmVJZGVudGlmaWVyOiBcImhhc2hlZFwiLFxuICAgICAgc3RvcmVJbkRhdGFiYXNlOiB0cnVlLFxuICAgIH0sXG4gICAgcmF0ZUxpbWl0OiB7XG4gICAgICBlbmFibGVkOiB0cnVlLFxuICAgICAgd2luZG93OiAxNSAqIDYwLFxuICAgICAgbWF4OiAxMCxcbiAgICAgIGN1c3RvbVJ1bGVzOiB7XG4gICAgICAgIFwiL2VtYWlsLW90cC9zZW5kLXZlcmlmaWNhdGlvbi1vdHBcIjogeyB3aW5kb3c6IDE1ICogNjAsIG1heDogNSB9LFxuICAgICAgICBcIi9zaWduLWluL2VtYWlsLW90cFwiOiB7IHdpbmRvdzogMTUgKiA2MCwgbWF4OiAxMCB9LFxuICAgICAgfSxcbiAgICB9LFxuICAgIGFkdmFuY2VkOiB7XG4gICAgICB1c2VTZWN1cmVDb29raWVzOiBvcmlnaW4uc3RhcnRzV2l0aChcImh0dHBzOi8vXCIpLFxuICAgICAgaXBBZGRyZXNzOiB7XG4gICAgICAgIGlwQWRkcmVzc0hlYWRlcnM6IFtcIngtcmVhbC1pcFwiXSxcbiAgICAgICAgZGlzYWJsZUlwVHJhY2tpbmc6IGZhbHNlLFxuICAgICAgfSxcbiAgICAgIGNvb2tpZXM6IHtcbiAgICAgICAgc2Vzc2lvbl90b2tlbjoge1xuICAgICAgICAgIG5hbWU6IGNvbmZpZy5zZXNzaW9uQ29va2llTmFtZSA/PyBTRVNTSU9OX0NPT0tJRV9OQU1FLFxuICAgICAgICAgIGF0dHJpYnV0ZXM6IHtcbiAgICAgICAgICAgIGh0dHBPbmx5OiB0cnVlLFxuICAgICAgICAgICAgc2FtZVNpdGU6IFwibGF4XCIsXG4gICAgICAgICAgICBzZWN1cmU6IG9yaWdpbi5zdGFydHNXaXRoKFwiaHR0cHM6Ly9cIiksXG4gICAgICAgICAgICBwYXRoOiBcIi9cIixcbiAgICAgICAgICB9LFxuICAgICAgICB9LFxuICAgICAgfSxcbiAgICB9LFxuICAgIGRhdGFiYXNlSG9va3M6IHtcbiAgICAgIHVzZXI6IHtcbiAgICAgICAgY3JlYXRlOiB7XG4gICAgICAgICAgYmVmb3JlOiBhc3luYyAodXNlcjogeyBlbWFpbDogc3RyaW5nIH0pID0+IHtcbiAgICAgICAgICAgIGlmICghKGF3YWl0IGNvbmZpZy5hdXRob3JpemVJZGVudGl0eShub3JtYWxpemVFbWFpbCh1c2VyLmVtYWlsKSkpKSB7XG4gICAgICAgICAgICAgIHRocm93IG5ldyBBUElFcnJvcihcIkZPUkJJRERFTlwiLCB7IG1lc3NhZ2U6IFwiSWRlbnRpdHkgaXMgbm90IGF1dGhvcml6ZWRcIiB9KTtcbiAgICAgICAgICAgIH1cbiAgICAgICAgICAgIHJldHVybiB7IGRhdGE6IHVzZXIgfTtcbiAgICAgICAgICB9LFxuICAgICAgICB9LFxuICAgICAgfSxcbiAgICB9LFxuICAgIHBsdWdpbnM6IFtcbiAgICAgIGVtYWlsT1RQKHtcbiAgICAgICAgb3RwTGVuZ3RoOiA2LFxuICAgICAgICBleHBpcmVzSW46IGNvbmZpZy5jb2RlVHRsU2Vjb25kcyxcbiAgICAgICAgYWxsb3dlZEF0dGVtcHRzOiBjb25maWcubWF4QXR0ZW1wdHMsXG4gICAgICAgIHN0b3JlT1RQOiBcImhhc2hlZFwiLFxuICAgICAgICBhc3luYyBzZW5kVmVyaWZpY2F0aW9uT1RQKHsgZW1haWwsIG90cCwgdHlwZSB9KSB7XG4gICAgICAgICAgaWYgKHR5cGUgIT09IFwic2lnbi1pblwiKSByZXR1cm47XG4gICAgICAgICAgY29uc3QgYWRkcmVzcyA9IG5vcm1hbGl6ZUVtYWlsKGVtYWlsKTtcbiAgICAgICAgICBpZiAoIShhd2FpdCBjb25maWcuYXV0aG9yaXplSWRlbnRpdHkoYWRkcmVzcykpKSByZXR1cm47XG4gICAgICAgICAgdm9pZCBjb25maWcuc2VuZENvZGUoYWRkcmVzcywgb3RwLCBlbWFpbE9wdGlvbnMpLmNhdGNoKChlcnJvcjogdW5rbm93bikgPT4ge1xuICAgICAgICAgICAgbG9nZ2VyLmVycm9yKFwidmVyaWZpY2F0aW9uIGVtYWlsIGZhaWxlZFwiLCB7IGVtYWlsOiBhZGRyZXNzLCBlcnJvciB9KTtcbiAgICAgICAgICB9KTtcbiAgICAgICAgfSxcbiAgICAgIH0pLFxuICAgICAgcGFzc2tleSh7XG4gICAgICAgIHJwSUQsXG4gICAgICAgIHJwTmFtZTogY29uZmlnLmFwcE5hbWUsXG4gICAgICAgIG9yaWdpbixcbiAgICAgICAgYXV0aGVudGljYXRvclNlbGVjdGlvbjoge1xuICAgICAgICAgIHJlc2lkZW50S2V5OiBcInByZWZlcnJlZFwiLFxuICAgICAgICAgIHVzZXJWZXJpZmljYXRpb246IFwicHJlZmVycmVkXCIsXG4gICAgICAgIH0sXG4gICAgICAgIHJlZ2lzdHJhdGlvbjogeyByZXF1aXJlU2Vzc2lvbjogdHJ1ZSB9LFxuICAgICAgfSksXG4gICAgXSBhcyBjb25zdCxcbiAgfSBzYXRpc2ZpZXMgQmV0dGVyQXV0aE9wdGlvbnM7XG5cbiAgYXdhaXQgbWlncmF0ZUF1dGgob3B0aW9ucywgY29uZmlnLnN0b3JhZ2UpO1xuICBjb25zdCBhdXRoID0gYmV0dGVyQXV0aChvcHRpb25zKTtcblxuICBjb25zdCBzZXNzaW9uID0gYXN5bmMgKGhlYWRlcnM6IEhlYWRlcnMpOiBQcm9taXNlPHN0cmluZyB8IHVuZGVmaW5lZD4gPT4ge1xuICAgIGNvbnN0IGN1cnJlbnQgPSBhd2FpdCBhdXRoLmFwaS5nZXRTZXNzaW9uKHsgaGVhZGVycyB9KTtcbiAgICBjb25zdCBlbWFpbCA9IG5vcm1hbGl6ZUVtYWlsKGN1cnJlbnQ/LnVzZXIuZW1haWwpO1xuICAgIGNvbnN0IGNyZWF0ZWRBdCA9IGN1cnJlbnQ/LnNlc3Npb24uY3JlYXRlZEF0O1xuICAgIGNvbnN0IGNyZWF0ZWRBdE1zID0gY3JlYXRlZEF0ID8gbmV3IERhdGUoY3JlYXRlZEF0KS5nZXRUaW1lKCkgOiBOdW1iZXIuTmFOO1xuICAgIGlmIChjb25maWcuc2Vzc2lvbkN1dG9mZk1zICYmICEoY3JlYXRlZEF0TXMgPj0gY29uZmlnLnNlc3Npb25DdXRvZmZNcykpIHJldHVybiB1bmRlZmluZWQ7XG4gICAgaWYgKCFlbWFpbCB8fCAhKGF3YWl0IGNvbmZpZy5hdXRob3JpemVJZGVudGl0eShlbWFpbCkpKSByZXR1cm4gdW5kZWZpbmVkO1xuICAgIHJldHVybiBlbWFpbDtcbiAgfTtcblxuICBjb25zdCBoYW5kbGVDb21wYXRpYmlsaXR5Um91dGUgPSBhc3luYyAocmVxdWVzdDogUmVxdWVzdCk6IFByb21pc2U8UmVzcG9uc2UgfCB1bmRlZmluZWQ+ID0+IHtcbiAgICBjb25zdCBwYXRoID0gbmV3IFVSTChyZXF1ZXN0LnVybCkucGF0aG5hbWU7XG4gICAgaWYgKHBhdGggPT09IGAke2Jhc2VQYXRofS9zdGF0dXNgKSB7XG4gICAgICBjb25zdCBlbWFpbCA9IGF3YWl0IHNlc3Npb24ocmVxdWVzdC5oZWFkZXJzKTtcbiAgICAgIHJldHVybiBqc29uUmVzcG9uc2Uoe1xuICAgICAgICBhdXRoZW50aWNhdGVkOiBCb29sZWFuKGVtYWlsKSxcbiAgICAgICAgLi4uKGVtYWlsID8geyBlbWFpbCB9IDoge30pLFxuICAgICAgICBlbmFibGVkOiB0cnVlLFxuICAgICAgICBwYXNza2V5c0VuYWJsZWQ6IHRydWUsXG4gICAgICB9KTtcbiAgICB9XG4gICAgaWYgKHBhdGggPT09IGAke2Jhc2VQYXRofS9yZXF1ZXN0YCAmJiByZXF1ZXN0Lm1ldGhvZCA9PT0gXCJQT1NUXCIpIHtcbiAgICAgIGNvbnN0IHBhcnNlZCA9IGF1dGhSZXF1ZXN0U2NoZW1hLnNhZmVQYXJzZShhd2FpdCByZXF1ZXN0SnNvbihyZXF1ZXN0KSk7XG4gICAgICBpZiAocGFyc2VkLnN1Y2Nlc3MpIHtcbiAgICAgICAgYXdhaXQgYXV0aC5hcGlcbiAgICAgICAgICAuc2VuZFZlcmlmaWNhdGlvbk9UUCh7XG4gICAgICAgICAgICBib2R5OiB7IGVtYWlsOiBub3JtYWxpemVFbWFpbChwYXJzZWQuZGF0YS5lbWFpbCksIHR5cGU6IFwic2lnbi1pblwiIH0sXG4gICAgICAgICAgICBoZWFkZXJzOiByZXF1ZXN0LmhlYWRlcnMsXG4gICAgICAgICAgfSlcbiAgICAgICAgICAuY2F0Y2goKCkgPT4gdW5kZWZpbmVkKTtcbiAgICAgIH1cbiAgICAgIHJldHVybiBqc29uUmVzcG9uc2UoeyBvazogdHJ1ZSB9KTtcbiAgICB9XG4gICAgaWYgKHBhdGggPT09IGAke2Jhc2VQYXRofS92ZXJpZnlgICYmIHJlcXVlc3QubWV0aG9kID09PSBcIlBPU1RcIikge1xuICAgICAgY29uc3QgcGFyc2VkID0gYXV0aFZlcmlmeVNjaGVtYS5zYWZlUGFyc2UoYXdhaXQgcmVxdWVzdEpzb24ocmVxdWVzdCkpO1xuICAgICAgaWYgKCFwYXJzZWQuc3VjY2VzcykgcmV0dXJuIGpzb25SZXNwb25zZSh7IG9rOiBmYWxzZSB9KTtcbiAgICAgIHRyeSB7XG4gICAgICAgIGNvbnN0IHJlc3BvbnNlID0gYXdhaXQgYXV0aC5hcGkuc2lnbkluRW1haWxPVFAoe1xuICAgICAgICAgIGJvZHk6IHtcbiAgICAgICAgICAgIGVtYWlsOiBub3JtYWxpemVFbWFpbChwYXJzZWQuZGF0YS5lbWFpbCksXG4gICAgICAgICAgICBvdHA6IHBhcnNlZC5kYXRhLmNvZGUsXG4gICAgICAgICAgICBuYW1lOiBkaXNwbGF5TmFtZShwYXJzZWQuZGF0YS5lbWFpbCksXG4gICAgICAgICAgfSxcbiAgICAgICAgICBoZWFkZXJzOiByZXF1ZXN0LmhlYWRlcnMsXG4gICAgICAgICAgYXNSZXNwb25zZTogdHJ1ZSxcbiAgICAgICAgfSk7XG4gICAgICAgIHJldHVybiBjb21wYXRpYmlsaXR5UmVzcG9uc2UocmVzcG9uc2UsIHsgb2s6IHJlc3BvbnNlLm9rIH0pO1xuICAgICAgfSBjYXRjaCB7XG4gICAgICAgIHJldHVybiBqc29uUmVzcG9uc2UoeyBvazogZmFsc2UgfSk7XG4gICAgICB9XG4gICAgfVxuICAgIGlmIChwYXRoID09PSBgJHtiYXNlUGF0aH0vbG9nb3V0YCAmJiByZXF1ZXN0Lm1ldGhvZCA9PT0gXCJQT1NUXCIpIHtcbiAgICAgIGNvbnN0IHJlc3BvbnNlID0gYXdhaXQgYXV0aC5hcGkuc2lnbk91dCh7XG4gICAgICAgIGhlYWRlcnM6IHJlcXVlc3QuaGVhZGVycyxcbiAgICAgICAgYXNSZXNwb25zZTogdHJ1ZSxcbiAgICAgIH0pO1xuICAgICAgcmV0dXJuIGNvbXBhdGliaWxpdHlSZXNwb25zZShyZXNwb25zZSwgeyBvazogcmVzcG9uc2Uub2sgfSk7XG4gICAgfVxuICAgIHJldHVybiB1bmRlZmluZWQ7XG4gIH07XG5cbiAgcmV0dXJuIHtcbiAgICBiYXNlUGF0aCxcbiAgICBwYXNza2V5c0VuYWJsZWQ6IHRydWUsXG4gICAgaGFuZGxlcjogYXN5bmMgKHJlcXVlc3QpID0+IChhd2FpdCBoYW5kbGVDb21wYXRpYmlsaXR5Um91dGUocmVxdWVzdCkpID8/IGF1dGguaGFuZGxlcihyZXF1ZXN0KSxcbiAgICBzZXNzaW9uLFxuICAgIHN0YXR1czogYXN5bmMgKGhlYWRlcnMpID0+IHtcbiAgICAgIGNvbnN0IGVtYWlsID0gYXdhaXQgc2Vzc2lvbihoZWFkZXJzKTtcbiAgICAgIHJldHVybiB7XG4gICAgICAgIGF1dGhlbnRpY2F0ZWQ6IEJvb2xlYW4oZW1haWwpLFxuICAgICAgICAuLi4oZW1haWwgPyB7IGVtYWlsIH0gOiB7fSksXG4gICAgICAgIGVuYWJsZWQ6IHRydWUsXG4gICAgICAgIHBhc3NrZXlzRW5hYmxlZDogdHJ1ZSxcbiAgICAgIH07XG4gICAgfSxcbiAgICBjbG9zZTogKCkgPT4gY29uZmlnLnN0b3JhZ2UuY2xvc2UoKSxcbiAgfTtcbn1cblxuZnVuY3Rpb24gbm9ybWFsaXplRW1haWwoZW1haWw6IHN0cmluZyB8IHVuZGVmaW5lZCk6IHN0cmluZyB7XG4gIHJldHVybiBlbWFpbD8udHJpbSgpLnRvTG93ZXJDYXNlKCkgPz8gXCJcIjtcbn1cblxuZnVuY3Rpb24gZGlzcGxheU5hbWUoZW1haWw6IHN0cmluZyk6IHN0cmluZyB7XG4gIHJldHVybiBub3JtYWxpemVFbWFpbChlbWFpbCkuc3BsaXQoXCJAXCIpWzBdIHx8IFwiVXNlclwiO1xufVxuXG5hc3luYyBmdW5jdGlvbiByZXF1ZXN0SnNvbihyZXF1ZXN0OiBSZXF1ZXN0KTogUHJvbWlzZTx1bmtub3duPiB7XG4gIHRyeSB7XG4gICAgcmV0dXJuIGF3YWl0IHJlcXVlc3QuanNvbigpO1xuICB9IGNhdGNoIHtcbiAgICByZXR1cm4gdW5kZWZpbmVkO1xuICB9XG59XG5cbmZ1bmN0aW9uIGpzb25SZXNwb25zZShib2R5OiB1bmtub3duLCBzdGF0dXMgPSAyMDApOiBSZXNwb25zZSB7XG4gIHJldHVybiBuZXcgUmVzcG9uc2UoSlNPTi5zdHJpbmdpZnkoYm9keSksIHtcbiAgICBzdGF0dXMsXG4gICAgaGVhZGVyczogeyBcImNvbnRlbnQtdHlwZVwiOiBcImFwcGxpY2F0aW9uL2pzb25cIiB9LFxuICB9KTtcbn1cblxuZnVuY3Rpb24gY29tcGF0aWJpbGl0eVJlc3BvbnNlKHJlc3BvbnNlOiBSZXNwb25zZSwgYm9keTogdW5rbm93bik6IFJlc3BvbnNlIHtcbiAgY29uc3QgaGVhZGVycyA9IG5ldyBIZWFkZXJzKHsgXCJjb250ZW50LXR5cGVcIjogXCJhcHBsaWNhdGlvbi9qc29uXCIgfSk7XG4gIGZvciAoY29uc3QgY29va2llIG9mIHJlc3BvbnNlLmhlYWRlcnMuZ2V0U2V0Q29va2llKCkpIGhlYWRlcnMuYXBwZW5kKFwic2V0LWNvb2tpZVwiLCBjb29raWUpO1xuICByZXR1cm4gbmV3IFJlc3BvbnNlKEpTT04uc3RyaW5naWZ5KGJvZHkpLCB7IHN0YXR1czogMjAwLCBoZWFkZXJzIH0pO1xufVxuIl19

package/lib/src/storage.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Better Auth database selection and migration locking.
+ *
+ * Callers pass a native AppKit Lakebase pool when available. Otherwise auth
+ * uses SQLite in the operating system's application-data directory.
+ *
+ * @module
+ */
+import { type PgPoolLike } from "@dbx-tools/postgres";
+import type { BetterAuthOptions } from "better-auth";
+export type AuthStorageMode = "auto" | "lakebase" | "sqlite";
+export interface AuthStorageConfig {
+    storage?: AuthStorageMode;
+    sqlitePath?: string;
+}
+export interface ResolvedAuthStorageConfig {
+    mode: AuthStorageMode;
+    sqlitePath: string;
+}
+export type AuthDatabase = NonNullable<BetterAuthOptions["database"]>;
+export interface AuthStorage {
+    kind: "lakebase" | "sqlite";
+    database: AuthDatabase;
+    pool?: PgPoolLike;
+    path?: string;
+    close(): Promise<void>;
+}
+export declare function resolveAuthStorageConfig(config?: AuthStorageConfig): ResolvedAuthStorageConfig;
+export declare function shouldUseLakebase(config?: AuthStorageConfig): boolean;
+export declare function createAuthStorage(config: AuthStorageConfig, pool?: PgPoolLike): Promise<AuthStorage>;
+export declare function migrateAuth(options: BetterAuthOptions, storage: AuthStorage): Promise<void>;

package/lib/src/storage.js

@@ -0,0 +1,95 @@
+/**
+ * Better Auth database selection and migration locking.
+ *
+ * Callers pass a native AppKit Lakebase pool when available. Otherwise auth
+ * uses SQLite in the operating system's application-data directory.
+ *
+ * @module
+ */
+var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
+    if (typeof path === "string" && /^\.\.?\//.test(path)) {
+        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
+            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
+        });
+    }
+    return path;
+};
+import { mkdirSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+import { fileLock } from "@dbx-tools/core";
+import { advisoryLock } from "@dbx-tools/postgres";
+import envPaths from "env-paths";
+const MIGRATION_LOCK = ["auth", "better-auth", "migrations"];
+export function resolveAuthStorageConfig(config = {}) {
+    const mode = config.storage ?? "auto";
+    if (mode !== "auto" && mode !== "lakebase" && mode !== "sqlite") {
+        throw new TypeError('auth storage must be "auto", "lakebase", or "sqlite"');
+    }
+    const dataDirectory = envPaths("dbx-tools", { suffix: "" }).data;
+    return {
+        mode,
+        sqlitePath: resolve(config.sqlitePath ?? resolve(dataDirectory, "auth", "auth.sqlite")),
+    };
+}
+export function shouldUseLakebase(config = {}) {
+    const resolved = resolveAuthStorageConfig(config);
+    if (resolved.mode === "lakebase")
+        return true;
+    if (resolved.mode === "sqlite")
+        return false;
+    return Boolean(process.env.LAKEBASE_ENDPOINT ?? process.env.PGHOST);
+}
+export async function createAuthStorage(config, pool) {
+    const resolved = resolveAuthStorageConfig(config);
+    if (pool && resolved.mode !== "sqlite") {
+        return {
+            kind: "lakebase",
+            database: pool,
+            pool,
+            close: async () => undefined,
+        };
+    }
+    if (resolved.mode === "lakebase") {
+        throw new Error("auth storage is lakebase but no Lakebase pool was supplied");
+    }
+    mkdirSync(dirname(resolved.sqlitePath), { recursive: true });
+    const database = await openSqlite(resolved.sqlitePath);
+    return {
+        kind: "sqlite",
+        database,
+        path: resolved.sqlitePath,
+        close: async () => {
+            database.close();
+        },
+    };
+}
+export async function migrateAuth(options, storage) {
+    const run = async () => {
+        const module = (await import(__rewriteRelativeImportExtension(migrationModuleUrl())));
+        const migrations = await module.getMigrations(options);
+        await migrations.runMigrations();
+    };
+    if (storage.kind === "lakebase" && storage.pool) {
+        await advisoryLock.withAdvisoryLock(storage.pool, MIGRATION_LOCK, run);
+        return;
+    }
+    await fileLock.withFileLock(MIGRATION_LOCK, run);
+}
+async function openSqlite(path) {
+    if (process.versions.bun) {
+        const specifier = "bun:sqlite";
+        const { Database } = (await import(__rewriteRelativeImportExtension(specifier)));
+        const database = new Database(path, { create: true, strict: true });
+        database.exec("PRAGMA journal_mode = WAL; PRAGMA foreign_keys = ON");
+        return database;
+    }
+    const { DatabaseSync } = await import("node:sqlite");
+    const database = new DatabaseSync(path);
+    database.exec("PRAGMA journal_mode = WAL; PRAGMA foreign_keys = ON");
+    return database;
+}
+function migrationModuleUrl() {
+    const entry = import.meta.resolve("better-auth");
+    return new URL("./db/get-migration.mjs", entry).href;
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic3RvcmFnZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9zdG9yYWdlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOzs7Ozs7O0dBT0c7Ozs7Ozs7OztBQUVILE9BQU8sRUFBRSxTQUFTLEVBQUUsTUFBTSxTQUFTLENBQUM7QUFDcEMsT0FBTyxFQUFFLE9BQU8sRUFBRSxPQUFPLEVBQUUsTUFBTSxXQUFXLENBQUM7QUFDN0MsT0FBTyxFQUFFLFFBQVEsRUFBRSxNQUFNLGlCQUFpQixDQUFDO0FBQzNDLE9BQU8sRUFBRSxZQUFZLEVBQW1CLE1BQU0scUJBQXFCLENBQUM7QUFFcEUsT0FBTyxRQUFRLE1BQU0sV0FBVyxDQUFDO0FBdUNqQyxNQUFNLGNBQWMsR0FBRyxDQUFDLE1BQU0sRUFBRSxhQUFhLEVBQUUsWUFBWSxDQUFVLENBQUM7QUFFdEUsTUFBTSxVQUFVLHdCQUF3QixDQUN0QyxTQUE0QixFQUFFO0lBRTlCLE1BQU0sSUFBSSxHQUFHLE1BQU0sQ0FBQyxPQUFPLElBQUksTUFBTSxDQUFDO0lBQ3RDLElBQUksSUFBSSxLQUFLLE1BQU0sSUFBSSxJQUFJLEtBQUssVUFBVSxJQUFJLElBQUksS0FBSyxRQUFRLEVBQUUsQ0FBQztRQUNoRSxNQUFNLElBQUksU0FBUyxDQUFDLHNEQUFzRCxDQUFDLENBQUM7SUFDOUUsQ0FBQztJQUNELE1BQU0sYUFBYSxHQUFHLFFBQVEsQ0FBQyxXQUFXLEVBQUUsRUFBRSxNQUFNLEVBQUUsRUFBRSxFQUFFLENBQUMsQ0FBQyxJQUFJLENBQUM7SUFDakUsT0FBTztRQUNMLElBQUk7UUFDSixVQUFVLEVBQUUsT0FBTyxDQUFDLE1BQU0sQ0FBQyxVQUFVLElBQUksT0FBTyxDQUFDLGFBQWEsRUFBRSxNQUFNLEVBQUUsYUFBYSxDQUFDLENBQUM7S0FDeEYsQ0FBQztBQUNKLENBQUM7QUFFRCxNQUFNLFVBQVUsaUJBQWlCLENBQUMsU0FBNEIsRUFBRTtJQUM5RCxNQUFNLFFBQVEsR0FBRyx3QkFBd0IsQ0FBQyxNQUFNLENBQUMsQ0FBQztJQUNsRCxJQUFJLFFBQVEsQ0FBQyxJQUFJLEtBQUssVUFBVTtRQUFFLE9BQU8sSUFBSSxDQUFDO0lBQzlDLElBQUksUUFBUSxDQUFDLElBQUksS0FBSyxRQUFRO1FBQUUsT0FBTyxLQUFLLENBQUM7SUFDN0MsT0FBTyxPQUFPLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxpQkFBaUIsSUFBSSxPQUFPLENBQUMsR0FBRyxDQUFDLE1BQU0sQ0FBQyxDQUFDO0FBQ3RFLENBQUM7QUFFRCxNQUFNLENBQUMsS0FBSyxVQUFVLGlCQUFpQixDQUNyQyxNQUF5QixFQUN6QixJQUFpQjtJQUVqQixNQUFNLFFBQVEsR0FBRyx3QkFBd0IsQ0FBQyxNQUFNLENBQUMsQ0FBQztJQUNsRCxJQUFJLElBQUksSUFBSSxRQUFRLENBQUMsSUFBSSxLQUFLLFFBQVEsRUFBRSxDQUFDO1FBQ3ZDLE9BQU87WUFDTCxJQUFJLEVBQUUsVUFBVTtZQUNoQixRQUFRLEVBQUUsSUFBSTtZQUNkLElBQUk7WUFDSixLQUFLLEVBQUUsS0FBSyxJQUFJLEVBQUUsQ0FBQyxTQUFTO1NBQzdCLENBQUM7SUFDSixDQUFDO0lBQ0QsSUFBSSxRQUFRLENBQUMsSUFBSSxLQUFLLFVBQVUsRUFBRSxDQUFDO1FBQ2pDLE1BQU0sSUFBSSxLQUFLLENBQUMsNERBQTRELENBQUMsQ0FBQztJQUNoRixDQUFDO0lBRUQsU0FBUyxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsVUFBVSxDQUFDLEVBQUUsRUFBRSxTQUFTLEVBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQztJQUM3RCxNQUFNLFFBQVEsR0FBRyxNQUFNLFVBQVUsQ0FBQyxRQUFRLENBQUMsVUFBVSxDQUFDLENBQUM7SUFDdkQsT0FBTztRQUNMLElBQUksRUFBRSxRQUFRO1FBQ2QsUUFBUTtRQUNSLElBQUksRUFBRSxRQUFRLENBQUMsVUFBVTtRQUN6QixLQUFLLEVBQUUsS0FBSyxJQUFJLEVBQUU7WUFDaEIsUUFBUSxDQUFDLEtBQUssRUFBRSxDQUFDO1FBQ25CLENBQUM7S0FDRixDQUFDO0FBQ0osQ0FBQztBQUVELE1BQU0sQ0FBQyxLQUFLLFVBQVUsV0FBVyxDQUFDLE9BQTBCLEVBQUUsT0FBb0I7SUFDaEYsTUFBTSxHQUFHLEdBQUcsS0FBSyxJQUFtQixFQUFFO1FBQ3BDLE1BQU0sTUFBTSxHQUFHLENBQUMsTUFBTSxNQUFNLGtDQUFDLGtCQUFrQixFQUFFLEVBQUMsQ0FBb0IsQ0FBQztRQUN2RSxNQUFNLFVBQVUsR0FBRyxNQUFNLE1BQU0sQ0FBQyxhQUFhLENBQUMsT0FBTyxDQUFDLENBQUM7UUFDdkQsTUFBTSxVQUFVLENBQUMsYUFBYSxFQUFFLENBQUM7SUFDbkMsQ0FBQyxDQUFDO0lBRUYsSUFBSSxPQUFPLENBQUMsSUFBSSxLQUFLLFVBQVUsSUFBSSxPQUFPLENBQUMsSUFBSSxFQUFFLENBQUM7UUFDaEQsTUFBTSxZQUFZLENBQUMsZ0JBQWdCLENBQUMsT0FBTyxDQUFDLElBQUksRUFBRSxjQUFjLEVBQUUsR0FBRyxDQUFDLENBQUM7UUFDdkUsT0FBTztJQUNULENBQUM7SUFDRCxNQUFNLFFBQVEsQ0FBQyxZQUFZLENBQUMsY0FBYyxFQUFFLEdBQUcsQ0FBQyxDQUFDO0FBQ25ELENBQUM7QUFFRCxLQUFLLFVBQVUsVUFBVSxDQUFDLElBQVk7SUFDcEMsSUFBSSxPQUFPLENBQUMsUUFBUSxDQUFDLEdBQUcsRUFBRSxDQUFDO1FBQ3pCLE1BQU0sU0FBUyxHQUFHLFlBQVksQ0FBQztRQUMvQixNQUFNLEVBQUUsUUFBUSxFQUFFLEdBQUcsQ0FBQyxNQUFNLE1BQU0sa0NBQUMsU0FBUyxFQUFDLENBQW9CLENBQUM7UUFDbEUsTUFBTSxRQUFRLEdBQUcsSUFBSSxRQUFRLENBQUMsSUFBSSxFQUFFLEVBQUUsTUFBTSxFQUFFLElBQUksRUFBRSxNQUFNLEVBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQztRQUNwRSxRQUFRLENBQUMsSUFBSSxDQUFDLHFEQUFxRCxDQUFDLENBQUM7UUFDckUsT0FBTyxRQUFRLENBQUM7SUFDbEIsQ0FBQztJQUNELE1BQU0sRUFBRSxZQUFZLEVBQUUsR0FBRyxNQUFNLE1BQU0sQ0FBQyxhQUFhLENBQUMsQ0FBQztJQUNyRCxNQUFNLFFBQVEsR0FBRyxJQUFJLFlBQVksQ0FBQyxJQUFJLENBQUMsQ0FBQztJQUN4QyxRQUFRLENBQUMsSUFBSSxDQUFDLHFEQUFxRCxDQUFDLENBQUM7SUFDckUsT0FBTyxRQUFRLENBQUM7QUFDbEIsQ0FBQztBQUVELFNBQVMsa0JBQWtCO0lBQ3pCLE1BQU0sS0FBSyxHQUFHLE1BQU0sQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLGFBQWEsQ0FBQyxDQUFDO0lBQ2pELE9BQU8sSUFBSSxHQUFHLENBQUMsd0JBQXdCLEVBQUUsS0FBSyxDQUFDLENBQUMsSUFBSSxDQUFDO0FBQ3ZELENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyIvKipcbiAqIEJldHRlciBBdXRoIGRhdGFiYXNlIHNlbGVjdGlvbiBhbmQgbWlncmF0aW9uIGxvY2tpbmcuXG4gKlxuICogQ2FsbGVycyBwYXNzIGEgbmF0aXZlIEFwcEtpdCBMYWtlYmFzZSBwb29sIHdoZW4gYXZhaWxhYmxlLiBPdGhlcndpc2UgYXV0aFxuICogdXNlcyBTUUxpdGUgaW4gdGhlIG9wZXJhdGluZyBzeXN0ZW0ncyBhcHBsaWNhdGlvbi1kYXRhIGRpcmVjdG9yeS5cbiAqXG4gKiBAbW9kdWxlXG4gKi9cblxuaW1wb3J0IHsgbWtkaXJTeW5jIH0gZnJvbSBcIm5vZGU6ZnNcIjtcbmltcG9ydCB7IGRpcm5hbWUsIHJlc29sdmUgfSBmcm9tIFwibm9kZTpwYXRoXCI7XG5pbXBvcnQgeyBmaWxlTG9jayB9IGZyb20gXCJAZGJ4LXRvb2xzL2NvcmVcIjtcbmltcG9ydCB7IGFkdmlzb3J5TG9jaywgdHlwZSBQZ1Bvb2xMaWtlIH0gZnJvbSBcIkBkYngtdG9vbHMvcG9zdGdyZXNcIjtcbmltcG9ydCB0eXBlIHsgQmV0dGVyQXV0aE9wdGlvbnMgfSBmcm9tIFwiYmV0dGVyLWF1dGhcIjtcbmltcG9ydCBlbnZQYXRocyBmcm9tIFwiZW52LXBhdGhzXCI7XG5cbmV4cG9ydCB0eXBlIEF1dGhTdG9yYWdlTW9kZSA9IFwiYXV0b1wiIHwgXCJsYWtlYmFzZVwiIHwgXCJzcWxpdGVcIjtcblxuZXhwb3J0IGludGVyZmFjZSBBdXRoU3RvcmFnZUNvbmZpZyB7XG4gIHN0b3JhZ2U/OiBBdXRoU3RvcmFnZU1vZGU7XG4gIHNxbGl0ZVBhdGg/OiBzdHJpbmc7XG59XG5cbmV4cG9ydCBpbnRlcmZhY2UgUmVzb2x2ZWRBdXRoU3RvcmFnZUNvbmZpZyB7XG4gIG1vZGU6IEF1dGhTdG9yYWdlTW9kZTtcbiAgc3FsaXRlUGF0aDogc3RyaW5nO1xufVxuXG5leHBvcnQgdHlwZSBBdXRoRGF0YWJhc2UgPSBOb25OdWxsYWJsZTxCZXR0ZXJBdXRoT3B0aW9uc1tcImRhdGFiYXNlXCJdPjtcblxuZXhwb3J0IGludGVyZmFjZSBBdXRoU3RvcmFnZSB7XG4gIGtpbmQ6IFwibGFrZWJhc2VcIiB8IFwic3FsaXRlXCI7XG4gIGRhdGFiYXNlOiBBdXRoRGF0YWJhc2U7XG4gIHBvb2w/OiBQZ1Bvb2xMaWtlO1xuICBwYXRoPzogc3RyaW5nO1xuICBjbG9zZSgpOiBQcm9taXNlPHZvaWQ+O1xufVxuXG50eXBlIE1pZ3JhdGlvbk1vZHVsZSA9IHtcbiAgZ2V0TWlncmF0aW9ucyhvcHRpb25zOiBCZXR0ZXJBdXRoT3B0aW9ucyk6IFByb21pc2U8e1xuICAgIHJ1bk1pZ3JhdGlvbnMoKTogUHJvbWlzZTx2b2lkPjtcbiAgfT47XG59O1xuXG5pbnRlcmZhY2UgU3FsaXRlRGF0YWJhc2Uge1xuICBleGVjKHNxbDogc3RyaW5nKTogdW5rbm93bjtcbiAgY2xvc2UoKTogdm9pZDtcbn1cblxuaW50ZXJmYWNlIEJ1blNxbGl0ZU1vZHVsZSB7XG4gIERhdGFiYXNlOiBuZXcgKHBhdGg6IHN0cmluZywgb3B0aW9ucz86IHsgY3JlYXRlPzogYm9vbGVhbjsgc3RyaWN0PzogYm9vbGVhbiB9KSA9PiBTcWxpdGVEYXRhYmFzZTtcbn1cblxuY29uc3QgTUlHUkFUSU9OX0xPQ0sgPSBbXCJhdXRoXCIsIFwiYmV0dGVyLWF1dGhcIiwgXCJtaWdyYXRpb25zXCJdIGFzIGNvbnN0O1xuXG5leHBvcnQgZnVuY3Rpb24gcmVzb2x2ZUF1dGhTdG9yYWdlQ29uZmlnKFxuICBjb25maWc6IEF1dGhTdG9yYWdlQ29uZmlnID0ge30sXG4pOiBSZXNvbHZlZEF1dGhTdG9yYWdlQ29uZmlnIHtcbiAgY29uc3QgbW9kZSA9IGNvbmZpZy5zdG9yYWdlID8/IFwiYXV0b1wiO1xuICBpZiAobW9kZSAhPT0gXCJhdXRvXCIgJiYgbW9kZSAhPT0gXCJsYWtlYmFzZVwiICYmIG1vZGUgIT09IFwic3FsaXRlXCIpIHtcbiAgICB0aHJvdyBuZXcgVHlwZUVycm9yKCdhdXRoIHN0b3JhZ2UgbXVzdCBiZSBcImF1dG9cIiwgXCJsYWtlYmFzZVwiLCBvciBcInNxbGl0ZVwiJyk7XG4gIH1cbiAgY29uc3QgZGF0YURpcmVjdG9yeSA9IGVudlBhdGhzKFwiZGJ4LXRvb2xzXCIsIHsgc3VmZml4OiBcIlwiIH0pLmRhdGE7XG4gIHJldHVybiB7XG4gICAgbW9kZSxcbiAgICBzcWxpdGVQYXRoOiByZXNvbHZlKGNvbmZpZy5zcWxpdGVQYXRoID8/IHJlc29sdmUoZGF0YURpcmVjdG9yeSwgXCJhdXRoXCIsIFwiYXV0aC5zcWxpdGVcIikpLFxuICB9O1xufVxuXG5leHBvcnQgZnVuY3Rpb24gc2hvdWxkVXNlTGFrZWJhc2UoY29uZmlnOiBBdXRoU3RvcmFnZUNvbmZpZyA9IHt9KTogYm9vbGVhbiB7XG4gIGNvbnN0IHJlc29sdmVkID0gcmVzb2x2ZUF1dGhTdG9yYWdlQ29uZmlnKGNvbmZpZyk7XG4gIGlmIChyZXNvbHZlZC5tb2RlID09PSBcImxha2ViYXNlXCIpIHJldHVybiB0cnVlO1xuICBpZiAocmVzb2x2ZWQubW9kZSA9PT0gXCJzcWxpdGVcIikgcmV0dXJuIGZhbHNlO1xuICByZXR1cm4gQm9vbGVhbihwcm9jZXNzLmVudi5MQUtFQkFTRV9FTkRQT0lOVCA/PyBwcm9jZXNzLmVudi5QR0hPU1QpO1xufVxuXG5leHBvcnQgYXN5bmMgZnVuY3Rpb24gY3JlYXRlQXV0aFN0b3JhZ2UoXG4gIGNvbmZpZzogQXV0aFN0b3JhZ2VDb25maWcsXG4gIHBvb2w/OiBQZ1Bvb2xMaWtlLFxuKTogUHJvbWlzZTxBdXRoU3RvcmFnZT4ge1xuICBjb25zdCByZXNvbHZlZCA9IHJlc29sdmVBdXRoU3RvcmFnZUNvbmZpZyhjb25maWcpO1xuICBpZiAocG9vbCAmJiByZXNvbHZlZC5tb2RlICE9PSBcInNxbGl0ZVwiKSB7XG4gICAgcmV0dXJuIHtcbiAgICAgIGtpbmQ6IFwibGFrZWJhc2VcIixcbiAgICAgIGRhdGFiYXNlOiBwb29sLFxuICAgICAgcG9vbCxcbiAgICAgIGNsb3NlOiBhc3luYyAoKSA9PiB1bmRlZmluZWQsXG4gICAgfTtcbiAgfVxuICBpZiAocmVzb2x2ZWQubW9kZSA9PT0gXCJsYWtlYmFzZVwiKSB7XG4gICAgdGhyb3cgbmV3IEVycm9yKFwiYXV0aCBzdG9yYWdlIGlzIGxha2ViYXNlIGJ1dCBubyBMYWtlYmFzZSBwb29sIHdhcyBzdXBwbGllZFwiKTtcbiAgfVxuXG4gIG1rZGlyU3luYyhkaXJuYW1lKHJlc29sdmVkLnNxbGl0ZVBhdGgpLCB7IHJlY3Vyc2l2ZTogdHJ1ZSB9KTtcbiAgY29uc3QgZGF0YWJhc2UgPSBhd2FpdCBvcGVuU3FsaXRlKHJlc29sdmVkLnNxbGl0ZVBhdGgpO1xuICByZXR1cm4ge1xuICAgIGtpbmQ6IFwic3FsaXRlXCIsXG4gICAgZGF0YWJhc2UsXG4gICAgcGF0aDogcmVzb2x2ZWQuc3FsaXRlUGF0aCxcbiAgICBjbG9zZTogYXN5bmMgKCkgPT4ge1xuICAgICAgZGF0YWJhc2UuY2xvc2UoKTtcbiAgICB9LFxuICB9O1xufVxuXG5leHBvcnQgYXN5bmMgZnVuY3Rpb24gbWlncmF0ZUF1dGgob3B0aW9uczogQmV0dGVyQXV0aE9wdGlvbnMsIHN0b3JhZ2U6IEF1dGhTdG9yYWdlKTogUHJvbWlzZTx2b2lkPiB7XG4gIGNvbnN0IHJ1biA9IGFzeW5jICgpOiBQcm9taXNlPHZvaWQ+ID0+IHtcbiAgICBjb25zdCBtb2R1bGUgPSAoYXdhaXQgaW1wb3J0KG1pZ3JhdGlvbk1vZHVsZVVybCgpKSkgYXMgTWlncmF0aW9uTW9kdWxlO1xuICAgIGNvbnN0IG1pZ3JhdGlvbnMgPSBhd2FpdCBtb2R1bGUuZ2V0TWlncmF0aW9ucyhvcHRpb25zKTtcbiAgICBhd2FpdCBtaWdyYXRpb25zLnJ1bk1pZ3JhdGlvbnMoKTtcbiAgfTtcblxuICBpZiAoc3RvcmFnZS5raW5kID09PSBcImxha2ViYXNlXCIgJiYgc3RvcmFnZS5wb29sKSB7XG4gICAgYXdhaXQgYWR2aXNvcnlMb2NrLndpdGhBZHZpc29yeUxvY2soc3RvcmFnZS5wb29sLCBNSUdSQVRJT05fTE9DSywgcnVuKTtcbiAgICByZXR1cm47XG4gIH1cbiAgYXdhaXQgZmlsZUxvY2sud2l0aEZpbGVMb2NrKE1JR1JBVElPTl9MT0NLLCBydW4pO1xufVxuXG5hc3luYyBmdW5jdGlvbiBvcGVuU3FsaXRlKHBhdGg6IHN0cmluZyk6IFByb21pc2U8QXV0aERhdGFiYXNlICYgeyBjbG9zZSgpOiB2b2lkIH0+IHtcbiAgaWYgKHByb2Nlc3MudmVyc2lvbnMuYnVuKSB7XG4gICAgY29uc3Qgc3BlY2lmaWVyID0gXCJidW46c3FsaXRlXCI7XG4gICAgY29uc3QgeyBEYXRhYmFzZSB9ID0gKGF3YWl0IGltcG9ydChzcGVjaWZpZXIpKSBhcyBCdW5TcWxpdGVNb2R1bGU7XG4gICAgY29uc3QgZGF0YWJhc2UgPSBuZXcgRGF0YWJhc2UocGF0aCwgeyBjcmVhdGU6IHRydWUsIHN0cmljdDogdHJ1ZSB9KTtcbiAgICBkYXRhYmFzZS5leGVjKFwiUFJBR01BIGpvdXJuYWxfbW9kZSA9IFdBTDsgUFJBR01BIGZvcmVpZ25fa2V5cyA9IE9OXCIpO1xuICAgIHJldHVybiBkYXRhYmFzZTtcbiAgfVxuICBjb25zdCB7IERhdGFiYXNlU3luYyB9ID0gYXdhaXQgaW1wb3J0KFwibm9kZTpzcWxpdGVcIik7XG4gIGNvbnN0IGRhdGFiYXNlID0gbmV3IERhdGFiYXNlU3luYyhwYXRoKTtcbiAgZGF0YWJhc2UuZXhlYyhcIlBSQUdNQSBqb3VybmFsX21vZGUgPSBXQUw7IFBSQUdNQSBmb3JlaWduX2tleXMgPSBPTlwiKTtcbiAgcmV0dXJuIGRhdGFiYXNlO1xufVxuXG5mdW5jdGlvbiBtaWdyYXRpb25Nb2R1bGVVcmwoKTogc3RyaW5nIHtcbiAgY29uc3QgZW50cnkgPSBpbXBvcnQubWV0YS5yZXNvbHZlKFwiYmV0dGVyLWF1dGhcIik7XG4gIHJldHVybiBuZXcgVVJMKFwiLi9kYi9nZXQtbWlncmF0aW9uLm1qc1wiLCBlbnRyeSkuaHJlZjtcbn1cbiJdfQ==

package/lib/tsconfig.tsbuildinfo

@@ -0,0 +1 @@
+{"root":["../src/auth.ts","../src/storage.ts","../index.ts"],"version":"5.9.3"}

package/package.json

@@ -0,0 +1,69 @@
+{
+  "name": "@dbx-tools/auth",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/reggie-db/dbx-tools.git",
+    "directory": "packages/js/node/auth"
+  },
+  "scripts": {
+    "build": "projen build",
+    "compile": "projen compile",
+    "default": "projen default",
+    "package": "projen package",
+    "post-compile": "projen post-compile",
+    "pre-compile": "projen pre-compile",
+    "prepack": "projen prepack",
+    "test": "projen test",
+    "watch": "projen watch",
+    "projen": "projen"
+  },
+  "devDependencies": {
+    "@types/bun": "^1.3.14",
+    "@types/node": "^24.6.0",
+    "typescript": "^5.9.3"
+  },
+  "dependencies": {
+    "@better-auth/passkey": "^1.6.25",
+    "@dbx-tools/core": "0.6.91",
+    "@dbx-tools/postgres": "0.6.91",
+    "@dbx-tools/shared-auth": "0.6.91",
+    "@dbx-tools/shared-core": "0.6.91",
+    "better-auth": "^1.6.25",
+    "env-paths": "^4.0.0"
+  },
+  "main": "./lib/index.js",
+  "license": "UNLICENSED",
+  "publishConfig": {
+    "access": "public",
+    "main": "./lib/index.js",
+    "types": "./lib/index.d.ts",
+    "exports": {
+      ".": {
+        "types": "./lib/index.d.ts",
+        "default": "./lib/index.js"
+      },
+      "./package.json": "./package.json"
+    }
+  },
+  "version": "0.6.91",
+  "types": "./lib/index.d.ts",
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./lib/index.d.ts",
+      "default": "./lib/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "index.ts",
+    "src",
+    "lib"
+  ],
+  "dbxToolsConfig": {
+    "tags": [
+      "node"
+    ]
+  },
+  "//": "~~ Generated by projen. To modify, edit .projenrc.js and run \"bunx projen\"."
+}

package/src/auth.ts

@@ -0,0 +1,266 @@
+/**
+ * Better Auth passwordless runtime with email OTP and passkeys.
+ *
+ * Callers provide authorization, delivery, storage, origin, and secret. Better
+ * Auth owns users, OTP verification records, sessions, rate limits, passkey
+ * credentials, and their native HTTP routes.
+ *
+ * @module
+ */
+
+import { passkey } from "@better-auth/passkey";
+import {
+  authRequestSchema,
+  authVerifySchema,
+  type AuthStatus,
+  SESSION_COOKIE_NAME,
+} from "@dbx-tools/shared-auth";
+import { log } from "@dbx-tools/shared-core";
+import { APIError, betterAuth, type BetterAuthOptions } from "better-auth";
+import { emailOTP } from "better-auth/plugins";
+
+import type { AuthStorage } from "./storage.ts";
+import { migrateAuth } from "./storage.ts";
+
+const logger = log.logger("auth");
+
+export type AuthorizeIdentity = (email: string) => boolean | Promise<boolean>;
+
+export interface AuthEmailOptions {
+  subject: string;
+  brandName: string;
+  message: string;
+  codeTtlSeconds: number;
+}
+
+export interface PasswordlessAuthOptions {
+  storage: AuthStorage;
+  baseURL: string;
+  basePath?: string;
+  appName: string;
+  secret: string;
+  sessionCookieName?: string;
+  sessionTtlSeconds: number;
+  sessionCutoffMs?: number;
+  codeTtlSeconds: number;
+  maxAttempts: number;
+  authorizeIdentity: AuthorizeIdentity;
+  sendCode(email: string, code: string, options: AuthEmailOptions): Promise<void>;
+  subject?: string;
+  message?: string;
+}
+
+export interface PasswordlessAuthRuntime {
+  readonly basePath: string;
+  readonly passkeysEnabled: boolean;
+  handler(request: Request): Promise<Response>;
+  session(headers: Headers): Promise<string | undefined>;
+  status(headers: Headers): Promise<AuthStatus>;
+  close(): Promise<void>;
+}
+
+export async function createPasswordlessAuth(
+  config: PasswordlessAuthOptions,
+): Promise<PasswordlessAuthRuntime> {
+  const origin = new URL(config.baseURL).origin;
+  const rpID = new URL(origin).hostname;
+  const basePath = config.basePath ?? "/api/auth";
+  const emailOptions: AuthEmailOptions = {
+    subject: config.subject ?? "Your verification code",
+    brandName: config.appName,
+    message: config.message ?? "Your verification code is:",
+    codeTtlSeconds: config.codeTtlSeconds,
+  };
+
+  const options = {
+    appName: config.appName,
+    baseURL: origin,
+    basePath,
+    database: config.storage.database,
+    secret: config.secret,
+    trustedOrigins: [origin],
+    session: {
+      expiresIn: config.sessionTtlSeconds,
+      updateAge: Math.min(24 * 60 * 60, config.sessionTtlSeconds),
+    },
+    verification: {
+      storeIdentifier: "hashed",
+      storeInDatabase: true,
+    },
+    rateLimit: {
+      enabled: true,
+      window: 15 * 60,
+      max: 10,
+      customRules: {
+        "/email-otp/send-verification-otp": { window: 15 * 60, max: 5 },
+        "/sign-in/email-otp": { window: 15 * 60, max: 10 },
+      },
+    },
+    advanced: {
+      useSecureCookies: origin.startsWith("https://"),
+      ipAddress: {
+        ipAddressHeaders: ["x-real-ip"],
+        disableIpTracking: false,
+      },
+      cookies: {
+        session_token: {
+          name: config.sessionCookieName ?? SESSION_COOKIE_NAME,
+          attributes: {
+            httpOnly: true,
+            sameSite: "lax",
+            secure: origin.startsWith("https://"),
+            path: "/",
+          },
+        },
+      },
+    },
+    databaseHooks: {
+      user: {
+        create: {
+          before: async (user: { email: string }) => {
+            if (!(await config.authorizeIdentity(normalizeEmail(user.email)))) {
+              throw new APIError("FORBIDDEN", { message: "Identity is not authorized" });
+            }
+            return { data: user };
+          },
+        },
+      },
+    },
+    plugins: [
+      emailOTP({
+        otpLength: 6,
+        expiresIn: config.codeTtlSeconds,
+        allowedAttempts: config.maxAttempts,
+        storeOTP: "hashed",
+        async sendVerificationOTP({ email, otp, type }) {
+          if (type !== "sign-in") return;
+          const address = normalizeEmail(email);
+          if (!(await config.authorizeIdentity(address))) return;
+          void config.sendCode(address, otp, emailOptions).catch((error: unknown) => {
+            logger.error("verification email failed", { email: address, error });
+          });
+        },
+      }),
+      passkey({
+        rpID,
+        rpName: config.appName,
+        origin,
+        authenticatorSelection: {
+          residentKey: "preferred",
+          userVerification: "preferred",
+        },
+        registration: { requireSession: true },
+      }),
+    ] as const,
+  } satisfies BetterAuthOptions;
+
+  await migrateAuth(options, config.storage);
+  const auth = betterAuth(options);
+
+  const session = async (headers: Headers): Promise<string | undefined> => {
+    const current = await auth.api.getSession({ headers });
+    const email = normalizeEmail(current?.user.email);
+    const createdAt = current?.session.createdAt;
+    const createdAtMs = createdAt ? new Date(createdAt).getTime() : Number.NaN;
+    if (config.sessionCutoffMs && !(createdAtMs >= config.sessionCutoffMs)) return undefined;
+    if (!email || !(await config.authorizeIdentity(email))) return undefined;
+    return email;
+  };
+
+  const handleCompatibilityRoute = async (request: Request): Promise<Response | undefined> => {
+    const path = new URL(request.url).pathname;
+    if (path === `${basePath}/status`) {
+      const email = await session(request.headers);
+      return jsonResponse({
+        authenticated: Boolean(email),
+        ...(email ? { email } : {}),
+        enabled: true,
+        passkeysEnabled: true,
+      });
+    }
+    if (path === `${basePath}/request` && request.method === "POST") {
+      const parsed = authRequestSchema.safeParse(await requestJson(request));
+      if (parsed.success) {
+        await auth.api
+          .sendVerificationOTP({
+            body: { email: normalizeEmail(parsed.data.email), type: "sign-in" },
+            headers: request.headers,
+          })
+          .catch(() => undefined);
+      }
+      return jsonResponse({ ok: true });
+    }
+    if (path === `${basePath}/verify` && request.method === "POST") {
+      const parsed = authVerifySchema.safeParse(await requestJson(request));
+      if (!parsed.success) return jsonResponse({ ok: false });
+      try {
+        const response = await auth.api.signInEmailOTP({
+          body: {
+            email: normalizeEmail(parsed.data.email),
+            otp: parsed.data.code,
+            name: displayName(parsed.data.email),
+          },
+          headers: request.headers,
+          asResponse: true,
+        });
+        return compatibilityResponse(response, { ok: response.ok });
+      } catch {
+        return jsonResponse({ ok: false });
+      }
+    }
+    if (path === `${basePath}/logout` && request.method === "POST") {
+      const response = await auth.api.signOut({
+        headers: request.headers,
+        asResponse: true,
+      });
+      return compatibilityResponse(response, { ok: response.ok });
+    }
+    return undefined;
+  };
+
+  return {
+    basePath,
+    passkeysEnabled: true,
+    handler: async (request) => (await handleCompatibilityRoute(request)) ?? auth.handler(request),
+    session,
+    status: async (headers) => {
+      const email = await session(headers);
+      return {
+        authenticated: Boolean(email),
+        ...(email ? { email } : {}),
+        enabled: true,
+        passkeysEnabled: true,
+      };
+    },
+    close: () => config.storage.close(),
+  };
+}
+
+function normalizeEmail(email: string | undefined): string {
+  return email?.trim().toLowerCase() ?? "";
+}
+
+function displayName(email: string): string {
+  return normalizeEmail(email).split("@")[0] || "User";
+}
+
+async function requestJson(request: Request): Promise<unknown> {
+  try {
+    return await request.json();
+  } catch {
+    return undefined;
+  }
+}
+
+function jsonResponse(body: unknown, status = 200): Response {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { "content-type": "application/json" },
+  });
+}
+
+function compatibilityResponse(response: Response, body: unknown): Response {
+  const headers = new Headers({ "content-type": "application/json" });
+  for (const cookie of response.headers.getSetCookie()) headers.append("set-cookie", cookie);
+  return new Response(JSON.stringify(body), { status: 200, headers });
+}

package/src/storage.ts

@@ -0,0 +1,137 @@
+/**
+ * Better Auth database selection and migration locking.
+ *
+ * Callers pass a native AppKit Lakebase pool when available. Otherwise auth
+ * uses SQLite in the operating system's application-data directory.
+ *
+ * @module
+ */
+
+import { mkdirSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+import { fileLock } from "@dbx-tools/core";
+import { advisoryLock, type PgPoolLike } from "@dbx-tools/postgres";
+import type { BetterAuthOptions } from "better-auth";
+import envPaths from "env-paths";
+
+export type AuthStorageMode = "auto" | "lakebase" | "sqlite";
+
+export interface AuthStorageConfig {
+  storage?: AuthStorageMode;
+  sqlitePath?: string;
+}
+
+export interface ResolvedAuthStorageConfig {
+  mode: AuthStorageMode;
+  sqlitePath: string;
+}
+
+export type AuthDatabase = NonNullable<BetterAuthOptions["database"]>;
+
+export interface AuthStorage {
+  kind: "lakebase" | "sqlite";
+  database: AuthDatabase;
+  pool?: PgPoolLike;
+  path?: string;
+  close(): Promise<void>;
+}
+
+type MigrationModule = {
+  getMigrations(options: BetterAuthOptions): Promise<{
+    runMigrations(): Promise<void>;
+  }>;
+};
+
+interface SqliteDatabase {
+  exec(sql: string): unknown;
+  close(): void;
+}
+
+interface BunSqliteModule {
+  Database: new (path: string, options?: { create?: boolean; strict?: boolean }) => SqliteDatabase;
+}
+
+const MIGRATION_LOCK = ["auth", "better-auth", "migrations"] as const;
+
+export function resolveAuthStorageConfig(
+  config: AuthStorageConfig = {},
+): ResolvedAuthStorageConfig {
+  const mode = config.storage ?? "auto";
+  if (mode !== "auto" && mode !== "lakebase" && mode !== "sqlite") {
+    throw new TypeError('auth storage must be "auto", "lakebase", or "sqlite"');
+  }
+  const dataDirectory = envPaths("dbx-tools", { suffix: "" }).data;
+  return {
+    mode,
+    sqlitePath: resolve(config.sqlitePath ?? resolve(dataDirectory, "auth", "auth.sqlite")),
+  };
+}
+
+export function shouldUseLakebase(config: AuthStorageConfig = {}): boolean {
+  const resolved = resolveAuthStorageConfig(config);
+  if (resolved.mode === "lakebase") return true;
+  if (resolved.mode === "sqlite") return false;
+  return Boolean(process.env.LAKEBASE_ENDPOINT ?? process.env.PGHOST);
+}
+
+export async function createAuthStorage(
+  config: AuthStorageConfig,
+  pool?: PgPoolLike,
+): Promise<AuthStorage> {
+  const resolved = resolveAuthStorageConfig(config);
+  if (pool && resolved.mode !== "sqlite") {
+    return {
+      kind: "lakebase",
+      database: pool,
+      pool,
+      close: async () => undefined,
+    };
+  }
+  if (resolved.mode === "lakebase") {
+    throw new Error("auth storage is lakebase but no Lakebase pool was supplied");
+  }
+
+  mkdirSync(dirname(resolved.sqlitePath), { recursive: true });
+  const database = await openSqlite(resolved.sqlitePath);
+  return {
+    kind: "sqlite",
+    database,
+    path: resolved.sqlitePath,
+    close: async () => {
+      database.close();
+    },
+  };
+}
+
+export async function migrateAuth(options: BetterAuthOptions, storage: AuthStorage): Promise<void> {
+  const run = async (): Promise<void> => {
+    const module = (await import(migrationModuleUrl())) as MigrationModule;
+    const migrations = await module.getMigrations(options);
+    await migrations.runMigrations();
+  };
+
+  if (storage.kind === "lakebase" && storage.pool) {
+    await advisoryLock.withAdvisoryLock(storage.pool, MIGRATION_LOCK, run);
+    return;
+  }
+  await fileLock.withFileLock(MIGRATION_LOCK, run);
+}
+
+async function openSqlite(path: string): Promise<AuthDatabase & { close(): void }> {
+  if (process.versions.bun) {
+    const specifier = "bun:sqlite";
+    const { Database } = (await import(specifier)) as BunSqliteModule;
+    const database = new Database(path, { create: true, strict: true });
+    database.exec("PRAGMA journal_mode = WAL; PRAGMA foreign_keys = ON");
+    return database;
+  }
+  const { DatabaseSync } = await import("node:sqlite");
+  const database = new DatabaseSync(path);
+  database.exec("PRAGMA journal_mode = WAL; PRAGMA foreign_keys = ON");
+  return database;
+}
+
+function migrationModuleUrl(): string {
+  const entry = import.meta.resolve("better-auth");
+  return new URL("./db/get-migration.mjs", entry).href;
+}