@flaredev/cli 0.4.0 → 0.5.0

package/templates/next/app/dashboard/page.tsx

@@ -0,0 +1,127 @@
+import Link from "next/link";
+import { ArrowRightIcon, CheckCircle2Icon, CircleIcon, PlusIcon } from "lucide-react";
+import { Button } from "@/components/ui/button";
+import { Card, CardContent, CardDescription, CardHeader, CardTitle } from "@/components/ui/card";
+import { Empty, EmptyDescription, EmptyHeader, EmptyTitle } from "@/components/ui/empty";
+import { PageHeader } from "@/components/dashboard/page-header";
+import { resourceIcon } from "@/components/dashboard/resource-icon";
+import { StatCards, type Stat } from "@/components/dashboard/stat-card";
+import { prisma } from "@/lib/db";
+import { authConfig, twoFactorAvailable } from "@/lib/auth-config";
+import { adminPermissions, resourcePath, resourceStats, trend, visibleResources } from "@/lib/dashboard";
+import { requireSession } from "@/lib/session";
+
+export const metadata = { title: "Dashboard" };
+
+/** The first thing you see when you sign in: how much data there is, and what's left to set up. */
+export default async function DashboardPage() {
+  const { user } = await requireSession("/dashboard");
+  const resources = await visibleResources();
+
+  const cards = await Promise.all(
+    resources.map(async (resource) => {
+      // One query per resource for the count and the trend, not two.
+      const [stats, permissions] = await Promise.all([resourceStats(resource.name), adminPermissions(resource.name)]);
+      return { resource, total: stats.total, recent: stats, permissions };
+    }),
+  );
+
+  const stats: Stat[] = cards.slice(0, 4).map(({ resource, total, recent }) => ({
+    label: resource.pluralLabel,
+    value: total,
+    hint: recent.current > 0 ? `${recent.current.toLocaleString()} this week` : "none this week",
+    change: trend(recent.current, recent.previous),
+    icon: resourceIcon(resource.icon),
+    href: resourcePath(resource),
+  }));
+
+  const passkeys = await prisma.passkey.count({ where: { userId: user.id } });
+  const twoFactorOn = Boolean((user as { twoFactorEnabled?: boolean | null }).twoFactorEnabled);
+  const steps = [
+    { done: user.emailVerified, label: "Verify your email address", href: "/verify-email" },
+    ...(twoFactorAvailable ? [{ done: twoFactorOn, label: "Turn on two-factor authentication", href: "/dashboard/account/security" }] : []),
+    ...(authConfig.passkeys ? [{ done: passkeys > 0, label: "Add a passkey for one-tap sign-in", href: "/dashboard/account/security" }] : []),
+  ];
+  const remaining = steps.filter((step) => !step.done).length;
+
+  return (
+    <>
+      <PageHeader
+        title={`Welcome${user.name ? `, ${user.name.split(" ")[0]}` : ""}`}
+        description={resources.length > 0 ? "Everything in your app, and how it's moving." : "Your app is running. Add a resource to fill this page."}
+      />
+
+      <StatCards stats={stats} />
+
+      {resources.length === 0 && (
+        <Empty className="rounded-xl border border-dashed">
+          <EmptyHeader>
+            <EmptyTitle>No resources yet</EmptyTitle>
+            <EmptyDescription>
+              Generate one with <code>flare gen resource Contact --fields &quot;name:string, email:string&quot;</code>, then fill it with{" "}
+              <code>flare seed:resource Contact --count 1000</code>.
+            </EmptyDescription>
+          </EmptyHeader>
+        </Empty>
+      )}
+
+      <div className="grid gap-6 lg:grid-cols-[minmax(0,2fr)_minmax(0,1fr)]">
+        {cards.length > 0 && (
+          <Card>
+            <CardHeader>
+              <CardTitle className="text-base">Your data</CardTitle>
+              <CardDescription>Every resource you can see.</CardDescription>
+            </CardHeader>
+            <CardContent className="flex flex-col">
+              {cards.map(({ resource, total, permissions }) => {
+                const Icon = resourceIcon(resource.icon);
+                return (
+                  <div key={resource.name} className="flex items-center gap-3 border-b py-3 last:border-b-0 last:pb-0">
+                    <span className="grid size-9 shrink-0 place-items-center rounded-md bg-muted text-muted-foreground">
+                      <Icon className="size-4.5" />
+                    </span>
+                    <div className="flex min-w-0 flex-col">
+                      <Link href={resourcePath(resource)} className="truncate text-sm font-medium hover:underline">
+                        {resource.pluralLabel}
+                      </Link>
+                      <span className="text-xs text-muted-foreground">{total.toLocaleString()} records</span>
+                    </div>
+                    <div className="ml-auto flex items-center gap-1">
+                      {permissions.create && (
+                        <Button variant="ghost" size="icon" aria-label={`New ${resource.label.toLowerCase()}`} asChild>
+                          <Link href={resourcePath(resource, "new")}>
+                            <PlusIcon />
+                          </Link>
+                        </Button>
+                      )}
+                      <Button variant="ghost" size="icon" aria-label={`Open ${resource.pluralLabel.toLowerCase()}`} asChild>
+                        <Link href={resourcePath(resource)}>
+                          <ArrowRightIcon />
+                        </Link>
+                      </Button>
+                    </div>
+                  </div>
+                );
+              })}
+            </CardContent>
+          </Card>
+        )}
+
+        <Card className="h-fit">
+          <CardHeader>
+            <CardTitle className="text-base">Secure your account</CardTitle>
+            <CardDescription>{remaining === 0 ? "All done." : `${remaining} to go.`}</CardDescription>
+          </CardHeader>
+          <CardContent className="flex flex-col">
+            {steps.map((step) => (
+              <Link key={step.label} href={step.href} className="flex items-center gap-3 border-b py-3 text-sm last:border-b-0 last:pb-0 hover:text-primary">
+                {step.done ? <CheckCircle2Icon className="size-4.5 text-success" /> : <CircleIcon className="size-4.5 text-muted-foreground" />}
+                <span className={step.done ? "text-muted-foreground line-through" : "font-medium"}>{step.label}</span>
+              </Link>
+            ))}
+          </CardContent>
+        </Card>
+      </div>
+    </>
+  );
+}

package/templates/next/components/dashboard/resource-chart.tsx

@@ -0,0 +1,86 @@
+import type { Resource } from "@flaredev/core";
+import { Card, CardContent, CardDescription, CardHeader, CardTitle } from "@/components/ui/card";
+import { prisma } from "@/lib/db";
+import { resourceTables } from "@/resources/server";
+import { cached, resourceTag, TTL } from "@/lib/cache";
+
+export interface DayCount {
+  /** "2026-09-23" */
+  date: string;
+  total: number;
+}
+
+/**
+ * How many records were created a day, grouped in SQL rather than by reading rows: one
+ * query over the created_at index, whatever the table's size.
+ */
+export function createdPerDay(name: string, days = 30): Promise<DayCount[]> {
+  const counts = cached(
+    async (resourceName: string, window: number) => {
+      const entry = (resourceTables as unknown as Record<string, { resource: { table: string; fields: object } } | undefined>)[resourceName];
+      if (!entry) return [];
+      const since = new Date(Date.now() - window * 86_400_000).toISOString();
+      // Grouped in Postgres rather than by reading rows: one pass over the created_at
+      // index whatever the table's size. The table name comes from the descriptor.
+      const rows = (await prisma.$queryRawUnsafe(
+        `select to_char("created_at", 'YYYY-MM-DD') as date, count(*)::int as total
+         from "${entry.resource.table}" where "created_at" >= '${since}' group by 1 order by 1`,
+      )) as DayCount[];
+      return rows.map((row) => ({ date: String(row.date), total: Number(row.total) }));
+    },
+    ["flare", "created-per-day"],
+    { tags: [resourceTag(name)], revalidate: TTL.short },
+  );
+  return counts(name, days);
+}
+
+/** Fill the gaps: a day with nothing created still needs a column. */
+function series(rows: DayCount[], days: number): DayCount[] {
+  const found = new Map(rows.map((row) => [row.date, row.total]));
+  return Array.from({ length: days }, (_, index) => {
+    const date = new Date(Date.now() - (days - 1 - index) * 86_400_000).toISOString().slice(0, 10);
+    return { date, total: found.get(date) ?? 0 };
+  });
+}
+
+/**
+ * New records a day for the last month, above the table.
+ *
+ * Drawn with CSS rather than a charting library: thirty numbers don't justify shipping
+ * one to the browser, and this renders on the server with the rest of the page.
+ */
+export async function ResourceChart({ resource, days = 30 }: { resource: Resource; days?: number }) {
+  const rows = series(await createdPerDay(resource.name, days), days);
+  const total = rows.reduce((sum, row) => sum + row.total, 0);
+  if (total === 0) return null;
+
+  const peak = Math.max(1, ...rows.map((row) => row.total));
+  const month = new Intl.DateTimeFormat(undefined, { day: "numeric", month: "short" });
+
+  return (
+    <Card>
+      <CardHeader>
+        <CardTitle className="text-base">New {resource.pluralLabel.toLowerCase()}</CardTitle>
+        <CardDescription>
+          {total.toLocaleString()} in the last {days} days.
+        </CardDescription>
+      </CardHeader>
+      <CardContent>
+        <div className="flex h-28 items-end gap-0.5" role="img" aria-label={`New ${resource.pluralLabel.toLowerCase()} a day for the last ${days} days`}>
+          {rows.map((row) => (
+            <div
+              key={row.date}
+              title={`${row.date}: ${row.total}`}
+              style={{ height: `${Math.max(2, Math.round((row.total / peak) * 100))}%` }}
+              className="flex-1 rounded-t-sm bg-primary/70 transition-colors hover:bg-primary"
+            />
+          ))}
+        </div>
+        <div className="mt-2 flex justify-between text-xs text-muted-foreground">
+          <span>{month.format(new Date(`${rows[0]!.date}T00:00:00Z`))}</span>
+          <span>{month.format(new Date(`${rows[rows.length - 1]!.date}T00:00:00Z`))}</span>
+        </div>
+      </CardContent>
+    </Card>
+  );
+}

package/templates/next/lib/analytics.ts

@@ -0,0 +1,71 @@
+/**
+ * Traffic, errors and latency — on Vercel, not from here.
+ *
+ * The Cloudflare stack reads these from Cloudflare's GraphQL Analytics API. Vercel's
+ * equivalent needs a team token and a different shape of query, and an app shouldn't
+ * hold a token that can read the whole account, so this reports "unconfigured" and the
+ * observability page says where the numbers actually are.
+ *
+ * The types are kept identical so the page doesn't need two versions.
+ */
+
+export interface RequestPoint {
+  /** "2026-09-22" */
+  date: string;
+  requests: number;
+  errors: number;
+  /** Median CPU time in milliseconds. */
+  medianCpuMs: number;
+}
+
+export interface WorkerAnalytics {
+  points: RequestPoint[];
+  requests: number;
+  errors: number;
+  /** Errors as a percentage of requests. */
+  errorRate: number;
+  medianCpuMs: number;
+}
+
+/** Why there's nothing to show, when there's nothing to show. */
+export type AnalyticsResult = { ok: true; data: WorkerAnalytics } | { ok: false; reason: "unconfigured" | "failed"; message: string };
+
+interface GraphQlResponse {
+  data?: {
+    viewer?: {
+      accounts?: {
+        workersInvocationsAdaptive?: {
+          dimensions: { date: string };
+          sum: { requests: number; errors: number };
+          quantiles: { cpuTimeP50: number };
+        }[];
+      }[];
+    };
+  };
+  errors?: { message: string }[];
+}
+
+const QUERY = `query WorkerTraffic($accountTag: String!, $scriptName: String!, $since: Date!, $until: Date!) {
+  viewer {
+    accounts(filter: { accountTag: $accountTag }) {
+      workersInvocationsAdaptive(
+        limit: 100
+        filter: { scriptName: $scriptName, date_geq: $since, date_leq: $until }
+        orderBy: [date_ASC]
+      ) {
+        dimensions { date }
+        sum { requests errors }
+        quantiles { cpuTimeP50 }
+      }
+    }
+  }
+}`;
+
+/** Traffic for the last `days` days, a point per day. */
+export async function workerAnalytics(_scriptName: string, _days = 7): Promise<AnalyticsResult> {
+  return {
+    ok: false,
+    reason: "unconfigured",
+    message: "Traffic and error rates for this app are in your Vercel dashboard, under Observability.",
+  };
+}

package/templates/next/lib/audit.ts

@@ -0,0 +1,80 @@
+import { headers } from "next/headers";
+import { prisma } from "@/lib/db";
+import { dashboardSession } from "./dashboard";
+
+export type AuditAction = "create" | "update" | "delete" | "import" | "bulk-delete";
+
+export interface AuditEntry {
+  action: AuditAction;
+  resource: string;
+  recordId?: string | null;
+  recordLabel?: string | null;
+  changes?: Record<string, unknown> | null;
+}
+
+/**
+ * Record a change in the audit log.
+ *
+ * Never throws: an audit trail that can take the write down with it is worse than one
+ * with a gap, and the caller has already changed the database by the time we're here.
+ */
+export async function recordAudit(entry: AuditEntry): Promise<void> {
+  try {
+    const { session } = await dashboardSession();
+    const headerList = await headers();
+    await prisma.auditLog.create({
+      data: {
+        action: entry.action,
+        resource: entry.resource,
+        recordId: entry.recordId ?? null,
+        recordLabel: entry.recordLabel ?? null,
+        userId: session?.user.id ?? null,
+        userEmail: session?.user.email ?? null,
+        changes: (entry.changes ?? null) as never,
+        // Vercel puts the caller's address here; Cloudflare uses cf-connecting-ip.
+        ip: headerList.get("x-forwarded-for")?.split(",")[0]?.trim() ?? null,
+      },
+    });
+  } catch {
+    // Deliberately quiet.
+  }
+}
+
+/** Which fields moved, and from what to what. Only the differences, never the whole record. */
+export function diffFields(before: Record<string, unknown> | null | undefined, after: Record<string, unknown>): Record<string, { from: unknown; to: unknown }> {
+  const changes: Record<string, { from: unknown; to: unknown }> = {};
+  for (const [key, value] of Object.entries(after)) {
+    if (key === "updatedAt" || key === "createdAt") continue;
+    const previous = before?.[key];
+    const same = JSON.stringify(previous ?? null) === JSON.stringify(value ?? null);
+    if (!same) changes[key] = { from: previous ?? null, to: value ?? null };
+  }
+  return changes;
+}
+
+export interface AuditRow {
+  id: string;
+  action: string;
+  resource: string;
+  recordId: string | null;
+  recordLabel: string | null;
+  userEmail: string | null;
+  changes: Record<string, unknown> | null;
+  createdAt: Date;
+}
+
+/** The most recent entries, newest first. */
+export async function recentAudit(limit = 25, resource?: string): Promise<AuditRow[]> {
+  const rows = await prisma.auditLog.findMany({
+    where: resource ? { resource } : undefined,
+    orderBy: { createdAt: "desc" },
+    take: limit,
+  });
+  return rows as unknown as AuditRow[];
+}
+
+/** How many changes were recorded in the last `days` days, for the observability summary. */
+export async function auditCount(days = 7): Promise<number> {
+  const since = new Date(Date.now() - days * 86_400_000);
+  return prisma.auditLog.count({ where: { createdAt: { gte: since } } });
+}

package/templates/next/lib/auth-emails.ts

@@ -0,0 +1,92 @@
+import { prisma } from "@/lib/db";
+import { sendTransactionalEmail } from "./mail";
+
+/**
+ * Every email the sign-in flows send. Change the wording here; the layout comes from
+ * lib/mail.ts. Without RESEND_API_KEY these print to the console, links and codes included.
+ */
+
+const ignore = "If you didn't ask for this, you can ignore this email.";
+
+/** Accounts with two-factor sign-in never get a one-step email sign-in (it would skip the second factor). */
+async function usesTwoFactor(email: string): Promise<boolean> {
+  const row = await prisma.user.findUnique({ where: { email: email.toLowerCase() }, select: { twoFactorEnabled: true } });
+  return Boolean(row?.twoFactorEnabled);
+}
+
+async function sendTwoFactorNotice(email: string) {
+  await sendTransactionalEmail({
+    to: email,
+    subject: "Sign in with your password or a passkey",
+    heading: "Email sign-in is off for your account",
+    paragraphs: [
+      "Someone asked to sign in to your account by email. Your account uses two-factor authentication, so we don't send sign-in links or codes.",
+      "Sign in with your password and second factor, or with a passkey.",
+    ],
+    footer: ignore,
+  });
+}
+
+export async function sendMagicLink({ email, url }: { email: string; url: string }) {
+  if (await usesTwoFactor(email)) return sendTwoFactorNotice(email);
+  await sendTransactionalEmail({
+    to: email,
+    subject: "Your sign-in link",
+    heading: "Sign in",
+    paragraphs: ["Use this link to sign in. It works once and expires in 5 minutes."],
+    action: { label: "Sign in", url },
+    footer: ignore,
+    preheader: "Your sign-in link",
+  });
+}
+
+export async function sendEmailCode({ email, otp, type }: { email: string; otp: string; type: "sign-in" | "email-verification" | "forget-password" | "change-email" }) {
+  if (type === "sign-in" && (await usesTwoFactor(email))) return sendTwoFactorNotice(email);
+  const purpose = {
+    "sign-in": ["Your sign-in code", "Enter this code to sign in."],
+    "email-verification": ["Verify your email", "Enter this code to verify your email address."],
+    "forget-password": ["Reset your password", "Enter this code to choose a new password."],
+    "change-email": ["Confirm your new email", "Enter this code to confirm your new email address."],
+  }[type];
+  await sendTransactionalEmail({
+    to: email,
+    subject: `${purpose[0]}: ${otp}`,
+    heading: otp,
+    paragraphs: [purpose[1], "It expires in 5 minutes."],
+    footer: ignore,
+    preheader: purpose[0],
+  });
+}
+
+export async function sendTwoFactorCode({ user, otp }: { user: { email: string }; otp: string }) {
+  await sendTransactionalEmail({
+    to: user.email,
+    subject: `Your verification code: ${otp}`,
+    heading: otp,
+    paragraphs: ["Enter this code to finish signing in. It expires in 5 minutes."],
+    footer: "If you didn't just sign in, change your password: someone else knows it.",
+    preheader: "Your verification code",
+  });
+}
+
+export async function sendPasswordReset({ user, url }: { user: { email: string }; url: string }) {
+  await sendTransactionalEmail({
+    to: user.email,
+    subject: "Reset your password",
+    heading: "Reset your password",
+    paragraphs: ["Use this link to choose a new password. It expires in 1 hour."],
+    action: { label: "Choose a new password", url },
+    footer: ignore,
+  });
+}
+
+export async function sendVerificationEmail({ user, url }: { user: { email: string }; url: string }) {
+  await sendTransactionalEmail({
+    to: user.email,
+    subject: "Verify your email",
+    heading: "Verify your email",
+    paragraphs: ["Confirm this is your email address."],
+    action: { label: "Verify email", url },
+    footer: ignore,
+  });
+}

package/templates/next/lib/auth.ts

@@ -0,0 +1,156 @@
+import { after } from "next/server";
+import { passkey } from "@better-auth/passkey";
+import { prismaAdapter } from "@better-auth/prisma-adapter";
+import { betterAuth } from "better-auth";
+import { APIError, createAuthMiddleware } from "better-auth/api";
+import { nextCookies } from "better-auth/next-js";
+import { admin } from "better-auth/plugins/admin";
+import { emailOTP } from "better-auth/plugins/email-otp";
+import { magicLink } from "better-auth/plugins/magic-link";
+import { twoFactor } from "better-auth/plugins/two-factor";
+import { hashPassword, verifyPassword } from "@flaredev/core";
+import { prisma } from "@/lib/db";
+import { authConfig, type SocialProvider } from "./auth-config";
+import { checkPassword, isBreachedPassword, PASSWORD_MAX_LENGTH } from "./password-rules";
+import { sendEmailCode, sendMagicLink, sendPasswordReset, sendTwoFactorCode, sendVerificationEmail } from "./auth-emails";
+
+const vars = process.env as Record<string, string | undefined>;
+
+/** Optional: set when serving from a custom domain (e.g. https://example.com). */
+const configuredURL = vars.BETTER_AUTH_URL;
+
+/** A provider's credentials from the environment, when both are set. */
+function credentials(prefix: string) {
+  const clientId = vars[`${prefix}_CLIENT_ID`];
+  const clientSecret = vars[`${prefix}_CLIENT_SECRET`];
+  return clientId && clientSecret ? { clientId, clientSecret } : undefined;
+}
+
+const providerSettings: Record<SocialProvider, Record<string, string> | undefined> = {
+  google: credentials("GOOGLE"),
+  github: credentials("GITHUB"),
+  // Apple's client secret is a JWT you generate from your key (see the auth guide).
+  apple: credentials("APPLE") && { ...credentials("APPLE")!, ...(vars.APPLE_APP_BUNDLE_ID ? { appBundleIdentifier: vars.APPLE_APP_BUNDLE_ID } : {}) },
+  // "common" accepts personal and work accounts; set a tenant id to allow only your organisation.
+  microsoft: credentials("MICROSOFT") && { ...credentials("MICROSOFT")!, tenantId: vars.MICROSOFT_TENANT_ID || "common" },
+};
+
+/** Social providers switched on in lib/auth-config.ts that also have credentials. */
+const socialProviders = Object.fromEntries(
+  authConfig.social.flatMap((provider) => (providerSettings[provider] ? [[provider, providerSettings[provider]]] : [])),
+);
+
+/** Endpoints of methods switched off in lib/auth-config.ts: refused, not just hidden. */
+function disabledPath(path: string): boolean {
+  if (!authConfig.magicLink && (path === "/sign-in/magic-link" || path === "/magic-link/verify")) return true;
+  if (!authConfig.emailOtp && (path.startsWith("/email-otp/") || path === "/sign-in/email-otp" || path === "/forget-password/email-otp")) return true;
+  if (!authConfig.passkeys && path.startsWith("/passkey/")) return true;
+  const { authenticator, email } = authConfig.twoFactor;
+  if (!authenticator && !email && path.startsWith("/two-factor/")) return true;
+  if (!authenticator && (path === "/two-factor/get-totp-uri" || path === "/two-factor/verify-totp")) return true;
+  if (!email && (path === "/two-factor/send-otp" || path === "/two-factor/verify-otp")) return true;
+  return false;
+}
+
+/** Where a new password arrives, and what it's called in the body. */
+const NEW_PASSWORD_FIELDS: Record<string, string> = {
+  "/sign-up/email": "password",
+  "/reset-password": "newPassword",
+  "/change-password": "newPassword",
+};
+
+/**
+ * The same password rules the sign-up and reset forms show as you type
+ * (lib/password-rules.ts), enforced here so the API agrees with the screens.
+ * Checked on the way in, before the password is hashed or stored.
+ */
+async function guardPassword(path: string, body: Record<string, unknown> | undefined) {
+  const field = NEW_PASSWORD_FIELDS[path];
+  if (!field) return;
+  const password = body?.[field];
+  if (typeof password !== "string") return;
+
+  if (password.length > PASSWORD_MAX_LENGTH) {
+    throw new APIError("BAD_REQUEST", { message: `Passwords can be at most ${PASSWORD_MAX_LENGTH} characters.` });
+  }
+  const check = checkPassword(password, [body?.email as string | undefined, body?.name as string | undefined]);
+  if (!check.valid) throw new APIError("BAD_REQUEST", { message: check.advice ?? "That password is too short." });
+
+  // A password in a public breach list is already guessed, however strong it looks.
+  if (authConfig.checkBreachedPasswords && (await isBreachedPassword(password))) {
+    throw new APIError("BAD_REQUEST", {
+      message: "That password has appeared in a data breach, so it isn't safe to use here. Pick a different one.",
+    });
+  }
+}
+
+export const auth = betterAuth({
+  appName: "__APP_NAME__",
+  secret: process.env.BETTER_AUTH_SECRET,
+  // Without BETTER_AUTH_URL, accept local dev on any port, a `flare dev --tunnel` URL and
+  // this app's workers.dev host. Cloudflare only routes hosts this Worker serves, so a
+  // deployed app never sees a trycloudflare.com host and the allowlist can't be spoofed.
+  baseURL: configuredURL || {
+    allowedHosts: ["localhost:*", "127.0.0.1:*", "*.trycloudflare.com", "__APP_NAME__.*.workers.dev"],
+  },
+  // Sign in with Apple posts back from Apple's own origin.
+  trustedOrigins: authConfig.social.includes("apple") ? ["https://appleid.apple.com"] : [],
+  database: prismaAdapter(prisma, { provider: "postgresql" }),
+  socialProviders,
+  account: {
+    // Signing in with Google as ada@example.com joins Ada's existing account (the provider has verified the address).
+    accountLinking: { enabled: true, trustedProviders: ["google", "github", "apple", "microsoft"] },
+  },
+  emailAndPassword: {
+    enabled: true,
+    requireEmailVerification: authConfig.requireEmailVerification,
+    // PBKDF2 via WebCrypto: the default scrypt exceeds Workers CPU limits.
+    password: { hash: hashPassword, verify: verifyPassword },
+    sendResetPassword: ({ user, url }) => sendPasswordReset({ user, url }),
+    resetPasswordTokenExpiresIn: 60 * 60,
+    // A password reset signs every other device out.
+    revokeSessionsOnPasswordReset: true,
+  },
+  emailVerification: {
+    sendVerificationEmail: ({ user, url }) => sendVerificationEmail({ user, url }),
+    sendOnSignUp: true,
+    autoSignInAfterVerification: true,
+  },
+  advanced: {
+    // Let emails and other deferred work finish after the response is sent.
+    // Next's equivalent of waitUntil: work that outlives the response, so sending a
+    // verification email doesn't hold the sign-up request open.
+    backgroundTasks: { handler: (promise: Promise<unknown>) => after(() => promise) },
+  },
+  hooks: {
+    before: createAuthMiddleware(async (ctx) => {
+      if (disabledPath(ctx.path)) throw new APIError("NOT_FOUND", { message: "This sign-in method isn't enabled." });
+      await guardPassword(ctx.path, ctx.body as Record<string, unknown> | undefined);
+    }),
+  },
+  plugins: [
+    // Adds user.role (default "user") and admin APIs. The /admin area allows ADMIN_ROLES (lib/admin.ts).
+    admin({ defaultRole: "user", adminRoles: ["admin"] }),
+    magicLink({ sendMagicLink: ({ email, url }) => sendMagicLink({ email, url }), expiresIn: 5 * 60, disableSignUp: false }),
+    emailOTP({ sendVerificationOTP: (data) => sendEmailCode(data), otpLength: 6, expiresIn: 5 * 60, allowedAttempts: 5 }),
+    twoFactor({
+      issuer: "__APP_NAME__",
+      otpOptions: { sendOTP: ({ user, otp }) => sendTwoFactorCode({ user, otp }), allowedAttempts: 5 },
+      // With only email codes switched on there's no authenticator app to confirm first.
+      skipVerificationOnEnable: !authConfig.twoFactor.authenticator,
+      // People who signed up with a social account have no password to confirm with;
+      // accounts that do have one must still give it.
+      allowPasswordless: true,
+    }),
+    passkey({ rpName: "__APP_NAME__" }),
+    // Must stay last: lets server actions set auth cookies.
+    nextCookies(),
+  ],
+});
+
+export type Session = typeof auth.$Infer.Session;
+
+/** OAuth providers switched on and configured, e.g. ["github"], for the sign-in buttons. */
+export function enabledSocialProviders(): SocialProvider[] {
+  return Object.keys(socialProviders) as SocialProvider[];
+}