@lalternative/auth 0.10.5 → 0.11.0

package/dist/client.d.ts

@@ -1,5 +1,5 @@
 import { createAuthClient } from 'better-auth/react';
-import { d as AuthClientSurface, j as MagicLinkClientSurface, P as PlatformAuthClientConfig } from './types-CxpBvjn9.js';
+import { f as AuthClientSurface, l as MagicLinkClientSurface, d as AdminClientSurface, T as TwoFactorClientSurface, P as PlatformAuthClientConfig } from './types-Ct0Kt36S.js';
 import 'better-auth';
 
 /**
@@ -13,10 +13,16 @@ import 'better-auth';
  * signIn carries both halves: the client always mounts magicLinkClient, since
  * which methods exist client-side costs nothing — whether the route answers is
  * decided server-side by passing `magicLink` to createPlatformAuth.
+ *
+ * admin is optional on AuthClientSurface, whose job is to type the prop the
+ * forms take, and required here: this client always mounts adminClient(), so a
+ * back-office calling admin.listUsers() off it must not have to widen the type.
  */
-type PlatformAuthClient = Omit<AuthClientSurface, "signIn"> & {
+type PlatformAuthClient = Omit<AuthClientSurface, "signIn" | "admin"> & {
     signIn: AuthClientSurface["signIn"] & MagicLinkClientSurface["signIn"];
-} & Omit<ReturnType<typeof createAuthClient>, keyof AuthClientSurface | keyof MagicLinkClientSurface>;
+    admin: AdminClientSurface;
+    twoFactor: TwoFactorClientSurface;
+} & Omit<ReturnType<typeof createAuthClient>, keyof AuthClientSurface | keyof MagicLinkClientSurface | "twoFactor">;
 /**
  * Creates a Better Auth client for React usage.
  * Provides useSession() and the email-OTP / magic-link / admin plugin methods.

package/dist/client.js

@@ -3,7 +3,8 @@ import { createAuthClient } from "better-auth/react";
 import {
   emailOTPClient,
   adminClient,
-  magicLinkClient
+  magicLinkClient,
+  twoFactorClient
 } from "better-auth/client/plugins";
 function createPlatformAuthClient(config) {
   return createAuthClient({
@@ -12,6 +13,7 @@ function createPlatformAuthClient(config) {
       emailOTPClient(),
       magicLinkClient(),
       adminClient(),
+      twoFactorClient(),
       ...config?.plugins ?? []
     ]
   });

package/dist/client.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/client.ts"],"sourcesContent":["import { createAuthClient } from \"better-auth/react\"\nimport {\n  emailOTPClient,\n  adminClient,\n  magicLinkClient,\n} from \"better-auth/client/plugins\"\nimport type {\n  AuthClientSurface,\n  MagicLinkClientSurface,\n  PlatformAuthClientConfig,\n} from \"./types\"\n\n/**\n * A Better Auth React client carrying the platform plugins.\n *\n * The concrete inferred type cannot be named in a published .d.ts (TS2742 — it\n * reaches into zod's internals), so the surface the auth screens call is\n * declared by hand in AuthClientSurface and intersected with the rest of the\n * client. Keep it in sync with the plugins enabled below.\n *\n * signIn carries both halves: the client always mounts magicLinkClient, since\n * which methods exist client-side costs nothing — whether the route answers is\n * decided server-side by passing `magicLink` to createPlatformAuth.\n */\nexport type PlatformAuthClient = Omit<AuthClientSurface, \"signIn\"> & {\n  signIn: AuthClientSurface[\"signIn\"] & MagicLinkClientSurface[\"signIn\"]\n} & Omit<\n    ReturnType<typeof createAuthClient>,\n    keyof AuthClientSurface | keyof MagicLinkClientSurface\n  >\n\n/**\n * Creates a Better Auth client for React usage.\n * Provides useSession() and the email-OTP / magic-link / admin plugin methods.\n */\nexport function createPlatformAuthClient(\n  config?: PlatformAuthClientConfig,\n): PlatformAuthClient {\n  return createAuthClient({\n    baseURL:\n      config?.baseURL ??\n      (typeof window !== \"undefined\"\n        ? window.location.origin\n        : \"http://localhost:3000\"),\n    plugins: [\n      emailOTPClient(),\n      magicLinkClient(),\n      adminClient(),\n      ...(config?.plugins ?? []),\n    ],\n  }) as unknown as PlatformAuthClient\n}\n"],"mappings":";AAAA,SAAS,wBAAwB;AACjC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AA8BA,SAAS,yBACd,QACoB;AACpB,SAAO,iBAAiB;AAAA,IACtB,SACE,QAAQ,YACP,OAAO,WAAW,cACf,OAAO,SAAS,SAChB;AAAA,IACN,SAAS;AAAA,MACP,eAAe;AAAA,MACf,gBAAgB;AAAA,MAChB,YAAY;AAAA,MACZ,GAAI,QAAQ,WAAW,CAAC;AAAA,IAC1B;AAAA,EACF,CAAC;AACH;","names":[]}
+{"version":3,"sources":["../src/client.ts"],"sourcesContent":["import { createAuthClient } from \"better-auth/react\"\nimport {\n  emailOTPClient,\n  adminClient,\n  magicLinkClient,\n  twoFactorClient,\n} from \"better-auth/client/plugins\"\nimport type {\n  AdminClientSurface,\n  AuthClientSurface,\n  MagicLinkClientSurface,\n  PlatformAuthClientConfig,\n  TwoFactorClientSurface,\n} from \"./types\"\n\n/**\n * A Better Auth React client carrying the platform plugins.\n *\n * The concrete inferred type cannot be named in a published .d.ts (TS2742 — it\n * reaches into zod's internals), so the surface the auth screens call is\n * declared by hand in AuthClientSurface and intersected with the rest of the\n * client. Keep it in sync with the plugins enabled below.\n *\n * signIn carries both halves: the client always mounts magicLinkClient, since\n * which methods exist client-side costs nothing — whether the route answers is\n * decided server-side by passing `magicLink` to createPlatformAuth.\n *\n * admin is optional on AuthClientSurface, whose job is to type the prop the\n * forms take, and required here: this client always mounts adminClient(), so a\n * back-office calling admin.listUsers() off it must not have to widen the type.\n */\nexport type PlatformAuthClient = Omit<AuthClientSurface, \"signIn\" | \"admin\"> & {\n  signIn: AuthClientSurface[\"signIn\"] & MagicLinkClientSurface[\"signIn\"]\n  admin: AdminClientSurface\n  twoFactor: TwoFactorClientSurface\n} & Omit<\n    ReturnType<typeof createAuthClient>,\n    | keyof AuthClientSurface\n    | keyof MagicLinkClientSurface\n    | \"twoFactor\"\n  >\n\n/**\n * Creates a Better Auth client for React usage.\n * Provides useSession() and the email-OTP / magic-link / admin plugin methods.\n */\nexport function createPlatformAuthClient(\n  config?: PlatformAuthClientConfig,\n): PlatformAuthClient {\n  return createAuthClient({\n    baseURL:\n      config?.baseURL ??\n      (typeof window !== \"undefined\"\n        ? window.location.origin\n        : \"http://localhost:3000\"),\n    plugins: [\n      emailOTPClient(),\n      magicLinkClient(),\n      adminClient(),\n      twoFactorClient(),\n      ...(config?.plugins ?? []),\n    ],\n  }) as unknown as PlatformAuthClient\n}\n"],"mappings":";AAAA,SAAS,wBAAwB;AACjC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAwCA,SAAS,yBACd,QACoB;AACpB,SAAO,iBAAiB;AAAA,IACtB,SACE,QAAQ,YACP,OAAO,WAAW,cACf,OAAO,SAAS,SAChB;AAAA,IACN,SAAS;AAAA,MACP,eAAe;AAAA,MACf,gBAAgB;AAAA,MAChB,YAAY;AAAA,MACZ,gBAAgB;AAAA,MAChB,GAAI,QAAQ,WAAW,CAAC;AAAA,IAC1B;AAAA,EACF,CAAC;AACH;","names":[]}

package/dist/index.d.ts

@@ -1,11 +1,11 @@
-import { L as LoginFormProps, R as RegisterFormProps, V as VerifyEmailFormProps, F as ForgotPasswordFormProps, M as MagicLinkFormProps, a as ResetPasswordFormProps, A as AuthLayoutProps, I as InvitationNoticeProps, b as AuthClientResult, c as LinkComponent } from './types-CxpBvjn9.js';
-export { d as AuthClientSurface, e as AuthInviteProps, f as AuthNavProps, g as AuthThemeProps, h as InvitationFailure, i as LoginFormLabels, j as MagicLinkClientSurface, k as MagicLinkConfig, l as MagicLinkFormLabels, P as PlatformAuthClientConfig, m as PlatformAuthConfig, n as PlatformAuthMailer, o as PlatformAuthMailerArgs, p as PlatformAuthMailerType, q as PlatformSession, r as PlatformSessionData, s as PlatformUser, t as RegisterFormLabels } from './types-CxpBvjn9.js';
+import { L as LoginFormProps, R as RegisterFormProps, V as VerifyEmailFormProps, F as ForgotPasswordFormProps, M as MagicLinkFormProps, a as ResetPasswordFormProps, A as AuthLayoutProps, I as InvitationNoticeProps, b as AuthClientResult, c as LinkComponent } from './types-Ct0Kt36S.js';
+export { d as AdminClientSurface, e as AuthClientDataResult, f as AuthClientSurface, g as AuthInviteProps, h as AuthNavProps, i as AuthThemeProps, j as InvitationFailure, k as LoginFormLabels, l as MagicLinkClientSurface, m as MagicLinkConfig, n as MagicLinkFormLabels, P as PlatformAuthClientConfig, o as PlatformAuthConfig, p as PlatformAuthMailer, q as PlatformAuthMailerArgs, r as PlatformAuthMailerType, s as PlatformRateLimitConfig, t as PlatformRateLimitRule, u as PlatformSession, v as PlatformSessionData, w as PlatformTwoFactorConfig, x as PlatformUser, y as RegisterFormLabels, T as TwoFactorClientSurface } from './types-Ct0Kt36S.js';
 import * as better_auth_react from 'better-auth/react';
 import * as better_auth from 'better-auth';
 import { PlatformAuthClient } from './client.js';
 import * as react from 'react';
 import { InputHTMLAttributes, ReactNode } from 'react';
-export { C as ClaimOutcome, i as isInvitationFailure } from './invitation-DQL5hv6t.js';
+export { C as ClaimOutcome, i as isInvitationFailure } from './invitation-miBKXoxz.js';
 
 /**
  * Returns a useSession hook bound to the given auth client.

package/dist/{invitation-DQL5hv6t.d.ts → invitation-miBKXoxz.d.ts}

@@ -1,4 +1,4 @@
-import { h as InvitationFailure } from './types-CxpBvjn9.js';
+import { j as InvitationFailure } from './types-Ct0Kt36S.js';
 
 /**
  * What became of a claim, in terms the invitee can be told.

package/dist/server.d.ts

@@ -1,7 +1,7 @@
 import { Auth, BetterAuthOptions } from 'better-auth';
-import { m as PlatformAuthConfig } from './types-CxpBvjn9.js';
-export { q as PlatformSession, r as PlatformSessionData, s as PlatformUser } from './types-CxpBvjn9.js';
-export { a as ClaimInvitationOptions, C as ClaimOutcome, c as claimInvitation, b as completesSignup, h as holdInviteTokenCookie, d as invitationOutcomeCookie, e as inviteTokenFrom, i as isInvitationFailure, p as pinInviteToken, r as releaseInviteTokenCookie } from './invitation-DQL5hv6t.js';
+import { o as PlatformAuthConfig } from './types-Ct0Kt36S.js';
+export { s as PlatformRateLimitConfig, t as PlatformRateLimitRule, u as PlatformSession, v as PlatformSessionData, w as PlatformTwoFactorConfig, x as PlatformUser } from './types-Ct0Kt36S.js';
+export { a as ClaimInvitationOptions, C as ClaimOutcome, c as claimInvitation, b as completesSignup, h as holdInviteTokenCookie, d as invitationOutcomeCookie, e as inviteTokenFrom, i as isInvitationFailure, p as pinInviteToken, r as releaseInviteTokenCookie } from './invitation-miBKXoxz.js';
 
 /**
  * Creates a Better Auth instance with platform defaults.

package/dist/server.js

@@ -12,7 +12,7 @@ import {
 
 // src/server.ts
 import { betterAuth, APIError } from "better-auth";
-import { emailOTP, admin, magicLink } from "better-auth/plugins";
+import { emailOTP, admin, magicLink, twoFactor } from "better-auth/plugins";
 
 // src/google-defaults.ts
 function withGoogleDefaults(google) {
@@ -24,6 +24,32 @@ function withGoogleDefaults(google) {
   };
 }
 
+// src/rate-limit.ts
+var PLATFORM_RULES = {
+  "/sign-in/email": { window: 60, max: 5 },
+  "/sign-up/email": { window: 60, max: 5 },
+  "/email-otp/send-verification-otp": { window: 60, max: 3 },
+  "/email-otp/verify-email": { window: 60, max: 5 },
+  "/email-otp/reset-password": { window: 60, max: 5 },
+  "/forget-password": { window: 60, max: 3 },
+  "/reset-password": { window: 60, max: 5 },
+  "/sign-in/magic-link": { window: 60, max: 3 },
+  "/two-factor/verify-totp": { window: 60, max: 5 },
+  "/two-factor/verify-otp": { window: 60, max: 5 },
+  "/two-factor/verify-backup-code": { window: 60, max: 5 },
+  "/two-factor/send-otp": { window: 60, max: 3 }
+};
+function resolveRateLimit(config) {
+  return {
+    enabled: config?.enabled ?? true,
+    window: config?.window ?? 10,
+    max: config?.max ?? 100,
+    ...config?.storage ? { storage: config.storage } : {},
+    ...config?.modelName ? { modelName: config.modelName } : {},
+    customRules: { ...PLATFORM_RULES, ...config?.customRules }
+  };
+}
+
 // src/server.ts
 var DEFAULT_EMAIL_SUBJECTS = {
   "email-verification": "Verify your account",
@@ -68,7 +94,10 @@ function createPlatformAuth(config) {
     isInvited,
     emailSubjects,
     renderOtpEmail,
-    magicLink: magicLinkConfig
+    magicLink: magicLinkConfig,
+    rateLimit,
+    twoFactor: twoFactorConfig,
+    trustedOrigins
   } = config;
   const subjects = { ...DEFAULT_EMAIL_SUBJECTS, ...emailSubjects };
   const renderEmail = renderOtpEmail ?? defaultRenderOtpEmail;
@@ -76,6 +105,8 @@ function createPlatformAuth(config) {
     database,
     baseURL,
     secret,
+    ...trustedOrigins ? { trustedOrigins } : {},
+    rateLimit: resolveRateLimit(rateLimit),
     emailAndPassword: {
       enabled: true,
       requireEmailVerification: true
@@ -179,6 +210,12 @@ function createPlatformAuth(config) {
         })
       ] : [],
       admin(),
+      ...twoFactorConfig?.enabled ? [
+        twoFactor({
+          issuer: twoFactorConfig.issuer ?? appName,
+          skipVerificationOnEnable: twoFactorConfig.skipVerificationOnEnable ?? false
+        })
+      ] : [],
       ...plugins
       // app-specific plugins (e.g. tanstackStartCookies)
     ],

package/dist/server.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/server.ts","../src/google-defaults.ts"],"sourcesContent":["import { betterAuth, APIError, type Auth, type BetterAuthOptions } from \"better-auth\"\nimport { emailOTP, admin, magicLink } from \"better-auth/plugins\"\nimport type { PlatformAuthConfig, PlatformAuthMailerType } from \"./types\"\nimport { withGoogleDefaults } from \"./google-defaults\"\nimport { withSignUpName } from \"./signup-name\"\n\nconst DEFAULT_EMAIL_SUBJECTS: Record<string, string> = {\n  \"email-verification\": \"Verify your account\",\n  \"forget-password\": \"Reset your password\",\n  \"sign-in\": \"Your sign-in code\",\n}\n\nfunction defaultRenderOtpEmail(otp: string): string {\n  return `\n              <div style=\"font-family:sans-serif;max-width:480px;margin:0 auto;padding:32px\">\n                <h2 style=\"font-size:20px;font-weight:600;margin-bottom:16px\">Your verification code</h2>\n                <p style=\"color:#555;margin-bottom:24px\">Use the code below to continue. It expires in 5 minutes.</p>\n                <div style=\"background:#f5f5f5;border-radius:8px;padding:24px;text-align:center;letter-spacing:8px;font-size:32px;font-weight:700\">\n                  ${otp}\n                </div>\n                <p style=\"color:#999;font-size:12px;margin-top:24px\">If you didn't request this, you can safely ignore this email.</p>\n              </div>\n            `\n}\n\nfunction defaultRenderMagicLinkEmail(url: string): string {\n  return `\n              <div style=\"font-family:sans-serif;max-width:480px;margin:0 auto;padding:32px\">\n                <h2 style=\"font-size:20px;font-weight:600;margin-bottom:16px\">Your sign-in link</h2>\n                <p style=\"color:#555;margin-bottom:24px\">Click the button below to sign in. The link expires in 5 minutes and works once.</p>\n                <a href=\"${url}\" style=\"display:inline-block;background:#111;color:#fff;text-decoration:none;border-radius:8px;padding:14px 28px;font-weight:600\">Sign in</a>\n                <p style=\"color:#999;font-size:12px;margin-top:24px;word-break:break-all\">Or paste this address into your browser:<br>${url}</p>\n                <p style=\"color:#999;font-size:12px;margin-top:16px\">If you didn't request this, you can safely ignore this email.</p>\n              </div>\n            `\n}\n\n/**\n * Creates a Better Auth instance with platform defaults.\n * Each app calls this with its own config (DB, secret, providers, plugins).\n */\nexport function createPlatformAuth(\n  config: PlatformAuthConfig,\n): Auth<BetterAuthOptions> {\n  const {\n    database,\n    baseURL,\n    secret,\n    appName,\n    mailer,\n    google,\n    github,\n    plugins = [],\n    databaseHooks,\n    betaMode = false,\n    isInvited,\n    emailSubjects,\n    renderOtpEmail,\n    magicLink: magicLinkConfig,\n  } = config\n\n  const subjects = { ...DEFAULT_EMAIL_SUBJECTS, ...emailSubjects }\n  const renderEmail = renderOtpEmail ?? defaultRenderOtpEmail\n\n  // The concrete instance type (with email-otp/admin plugins) is widened to\n  // the base Auth type so the published .d.ts stays portable (inferring the\n  // full plugin type triggers TS2742 — it can't be named without a zod ref).\n  // The admin() plugin's user.role field is re-exposed via module augmentation\n  // below, so consumers (e.g. transcript-web me.ts) still see session.user.role.\n  return betterAuth({\n    database,\n    baseURL,\n    secret,\n    emailAndPassword: {\n      enabled: true,\n      requireEmailVerification: true,\n    },\n    // Never auto-merge a social identity into an existing account by matching\n    // email. Better Auth links by default (email-verified providers are trusted),\n    // so signing in with Google/GitHub on an email already registered would fold\n    // that identity into the existing account. We keep each sign-in method its\n    // own account: a social login on a taken email is refused, not linked.\n    account: {\n      accountLinking: {\n        enabled: false,\n      },\n    },\n    // Naming happens here rather than on /sign-up/email so that every way in\n    // is covered: a magic link that signs up bypasses the endpoint entirely\n    // and calls createUser straight, with `name: name || \"\"`.\n    databaseHooks: {\n      ...databaseHooks,\n      user: {\n        ...databaseHooks?.user,\n        create: {\n          ...databaseHooks?.user?.create,\n          before: async (user: Record<string, unknown>, ctx: unknown) => {\n            const named = withSignUpName(user)\n            const appHook = databaseHooks?.user?.create?.before\n            // eslint-disable-next-line @typescript-eslint/no-explicit-any\n            const applied = await appHook?.(named as any, ctx as any)\n            if (applied === false) return false\n            if (applied && typeof applied === \"object\" && \"data\" in applied) {\n              return { data: withSignUpName(applied.data) }\n            }\n            return { data: named }\n          },\n        },\n      },\n    },\n    hooks: {\n      // eslint-disable-next-line @typescript-eslint/no-explicit-any\n      before: async (ctx: any) => {\n        if (!betaMode) return\n        if (ctx.path !== \"/sign-up/email\") return\n        const body = ctx.body as { email?: string; inviteToken?: string } | undefined\n        const email = body?.email\n        const inviteToken = body?.inviteToken\n        if (email && inviteToken && isInvited) {\n          const ok = await isInvited(email, inviteToken)\n          if (ok) return\n        }\n        throw new APIError(\"FORBIDDEN\", {\n          message: \"Registration is invite-only during the private beta.\",\n        })\n      },\n    },\n    plugins: [\n      emailOTP({\n        async sendVerificationOTP({ email, otp, type }) {\n          const subject = subjects[type]\n            ? `${subjects[type]} - ${appName}`\n            : `Your ${appName} code`\n          const html = renderEmail(otp, type as PlatformAuthMailerType)\n\n          if (mailer) {\n            await mailer({\n              to: email,\n              subject,\n              html,\n              type: type as PlatformAuthMailerType,\n              otp,\n            })\n            return\n          }\n\n          console.warn(\n            `[EMAIL] No mailer configured — logging OTP to stdout for ${email} (${type}): ${otp}`,\n          )\n        },\n        otpLength: 6,\n        expiresIn: 300,\n        overrideDefaultEmailVerification: true,\n      }),\n      ...(magicLinkConfig\n        ? [\n            magicLink({\n              expiresIn: magicLinkConfig.expiresIn ?? 300,\n              // A magic link that signs up walks past both gates the platform\n              // puts on the front door: requireEmailVerification, and the\n              // invite-only hook, which only guards /sign-up/email.\n              disableSignUp: !magicLinkConfig.allowSignUp,\n              async sendMagicLink({ email, url }) {\n                const subject =\n                  magicLinkConfig.subject ?? `Your sign-in link - ${appName}`\n                const html = (\n                  magicLinkConfig.render ?? defaultRenderMagicLinkEmail\n                )(url, email)\n\n                if (mailer) {\n                  await mailer({\n                    to: email,\n                    subject,\n                    html,\n                    type: \"magic-link\",\n                    url,\n                  })\n                  return\n                }\n\n                console.warn(\n                  `[EMAIL] No mailer configured — logging magic link to stdout for ${email}: ${url}`,\n                )\n              },\n            }),\n          ]\n        : []),\n      admin(),\n      ...plugins, // app-specific plugins (e.g. tanstackStartCookies)\n    ],\n    socialProviders: {\n      // Spread as given rather than rebuilt field by field: anything Better\n      // Auth accepts belongs to the app, and a config silently dropped on the\n      // way through is how an app ends up writing a plugin to put it back.\n      //\n      // The two defaults below are the platform's, not Google's: without\n      // accessType 'offline' Google never mints a refresh token, and without\n      // 'consent' it stops minting one for an account that already consented.\n      // A NULL refreshToken means deleting an account can revoke the access\n      // token but cannot remove the app from myaccount.google.com/permissions,\n      // so the grant outlives the account it belonged to.\n      ...(google ? { google: withGoogleDefaults(google) } : {}),\n      ...(github ? { github } : {}),\n    },\n  }) as unknown as Auth<BetterAuthOptions>\n}\n\nexport type PlatformAuth = ReturnType<typeof createPlatformAuth>\n\n// Re-export the session contract from /server so consumers that import the\n// auth factory can type api.getSession() without a second import path.\nexport type {\n  PlatformUser,\n  PlatformSession,\n  PlatformSessionData,\n} from \"./types\"\n\n// Invitation claiming runs on the auth callback, where the session is\n// established — the one place every sign-up flow passes through.\nexport {\n  claimInvitation,\n  completesSignup,\n  holdInviteTokenCookie,\n  invitationOutcomeCookie,\n  inviteTokenFrom,\n  isInvitationFailure,\n  pinInviteToken,\n  releaseInviteTokenCookie,\n} from \"./invitation\"\nexport type { ClaimOutcome, ClaimInvitationOptions } from \"./invitation\"\n","import type { PlatformAuthConfig } from \"./types\"\n\n/**\n * Applies the platform's Google defaults without touching what the app set.\n *\n * Better Auth also accepts a function returning the options, which cannot be\n * amended without calling it — such a config is passed straight through and\n * owns its own defaults.\n */\nexport function withGoogleDefaults(\n  google: NonNullable<PlatformAuthConfig[\"google\"]>,\n): NonNullable<PlatformAuthConfig[\"google\"]> {\n  if (typeof google === \"function\") return google\n  return {\n    ...google,\n    accessType: google.accessType ?? \"offline\",\n    prompt: google.prompt ?? \"select_account consent\",\n  }\n}\n\n"],"mappings":";;;;;;;;;;;;;AAAA,SAAS,YAAY,gBAAmD;AACxE,SAAS,UAAU,OAAO,iBAAiB;;;ACQpC,SAAS,mBACd,QAC2C;AAC3C,MAAI,OAAO,WAAW,WAAY,QAAO;AACzC,SAAO;AAAA,IACL,GAAG;AAAA,IACH,YAAY,OAAO,cAAc;AAAA,IACjC,QAAQ,OAAO,UAAU;AAAA,EAC3B;AACF;;;ADZA,IAAM,yBAAiD;AAAA,EACrD,sBAAsB;AAAA,EACtB,mBAAmB;AAAA,EACnB,WAAW;AACb;AAEA,SAAS,sBAAsB,KAAqB;AAClD,SAAO;AAAA;AAAA;AAAA;AAAA;AAAA,oBAKW,GAAG;AAAA;AAAA;AAAA;AAAA;AAKvB;AAEA,SAAS,4BAA4B,KAAqB;AACxD,SAAO;AAAA;AAAA;AAAA;AAAA,2BAIkB,GAAG;AAAA,wIAC0G,GAAG;AAAA;AAAA;AAAA;AAI3I;AAMO,SAAS,mBACd,QACyB;AACzB,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,UAAU,CAAC;AAAA,IACX;AAAA,IACA,WAAW;AAAA,IACX;AAAA,IACA;AAAA,IACA;AAAA,IACA,WAAW;AAAA,EACb,IAAI;AAEJ,QAAM,WAAW,EAAE,GAAG,wBAAwB,GAAG,cAAc;AAC/D,QAAM,cAAc,kBAAkB;AAOtC,SAAO,WAAW;AAAA,IAChB;AAAA,IACA;AAAA,IACA;AAAA,IACA,kBAAkB;AAAA,MAChB,SAAS;AAAA,MACT,0BAA0B;AAAA,IAC5B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMA,SAAS;AAAA,MACP,gBAAgB;AAAA,QACd,SAAS;AAAA,MACX;AAAA,IACF;AAAA;AAAA;AAAA;AAAA,IAIA,eAAe;AAAA,MACb,GAAG;AAAA,MACH,MAAM;AAAA,QACJ,GAAG,eAAe;AAAA,QAClB,QAAQ;AAAA,UACN,GAAG,eAAe,MAAM;AAAA,UACxB,QAAQ,OAAO,MAA+B,QAAiB;AAC7D,kBAAM,QAAQ,eAAe,IAAI;AACjC,kBAAM,UAAU,eAAe,MAAM,QAAQ;AAE7C,kBAAM,UAAU,MAAM,UAAU,OAAc,GAAU;AACxD,gBAAI,YAAY,MAAO,QAAO;AAC9B,gBAAI,WAAW,OAAO,YAAY,YAAY,UAAU,SAAS;AAC/D,qBAAO,EAAE,MAAM,eAAe,QAAQ,IAAI,EAAE;AAAA,YAC9C;AACA,mBAAO,EAAE,MAAM,MAAM;AAAA,UACvB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,IACA,OAAO;AAAA;AAAA,MAEL,QAAQ,OAAO,QAAa;AAC1B,YAAI,CAAC,SAAU;AACf,YAAI,IAAI,SAAS,iBAAkB;AACnC,cAAM,OAAO,IAAI;AACjB,cAAM,QAAQ,MAAM;AACpB,cAAM,cAAc,MAAM;AAC1B,YAAI,SAAS,eAAe,WAAW;AACrC,gBAAM,KAAK,MAAM,UAAU,OAAO,WAAW;AAC7C,cAAI,GAAI;AAAA,QACV;AACA,cAAM,IAAI,SAAS,aAAa;AAAA,UAC9B,SAAS;AAAA,QACX,CAAC;AAAA,MACH;AAAA,IACF;AAAA,IACA,SAAS;AAAA,MACP,SAAS;AAAA,QACP,MAAM,oBAAoB,EAAE,OAAO,KAAK,KAAK,GAAG;AAC9C,gBAAM,UAAU,SAAS,IAAI,IACzB,GAAG,SAAS,IAAI,CAAC,MAAM,OAAO,KAC9B,QAAQ,OAAO;AACnB,gBAAM,OAAO,YAAY,KAAK,IAA8B;AAE5D,cAAI,QAAQ;AACV,kBAAM,OAAO;AAAA,cACX,IAAI;AAAA,cACJ;AAAA,cACA;AAAA,cACA;AAAA,cACA;AAAA,YACF,CAAC;AACD;AAAA,UACF;AAEA,kBAAQ;AAAA,YACN,iEAA4D,KAAK,KAAK,IAAI,MAAM,GAAG;AAAA,UACrF;AAAA,QACF;AAAA,QACA,WAAW;AAAA,QACX,WAAW;AAAA,QACX,kCAAkC;AAAA,MACpC,CAAC;AAAA,MACD,GAAI,kBACA;AAAA,QACE,UAAU;AAAA,UACR,WAAW,gBAAgB,aAAa;AAAA;AAAA;AAAA;AAAA,UAIxC,eAAe,CAAC,gBAAgB;AAAA,UAChC,MAAM,cAAc,EAAE,OAAO,IAAI,GAAG;AAClC,kBAAM,UACJ,gBAAgB,WAAW,uBAAuB,OAAO;AAC3D,kBAAM,QACJ,gBAAgB,UAAU,6BAC1B,KAAK,KAAK;AAEZ,gBAAI,QAAQ;AACV,oBAAM,OAAO;AAAA,gBACX,IAAI;AAAA,gBACJ;AAAA,gBACA;AAAA,gBACA,MAAM;AAAA,gBACN;AAAA,cACF,CAAC;AACD;AAAA,YACF;AAEA,oBAAQ;AAAA,cACN,wEAAmE,KAAK,KAAK,GAAG;AAAA,YAClF;AAAA,UACF;AAAA,QACF,CAAC;AAAA,MACH,IACA,CAAC;AAAA,MACL,MAAM;AAAA,MACN,GAAG;AAAA;AAAA,IACL;AAAA,IACA,iBAAiB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWf,GAAI,SAAS,EAAE,QAAQ,mBAAmB,MAAM,EAAE,IAAI,CAAC;AAAA,MACvD,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;AAAA,IAC7B;AAAA,EACF,CAAC;AACH;","names":[]}
+{"version":3,"sources":["../src/server.ts","../src/google-defaults.ts","../src/rate-limit.ts"],"sourcesContent":["import { betterAuth, APIError, type Auth, type BetterAuthOptions } from \"better-auth\"\nimport { emailOTP, admin, magicLink, twoFactor } from \"better-auth/plugins\"\nimport type { PlatformAuthConfig, PlatformAuthMailerType } from \"./types\"\nimport { withGoogleDefaults } from \"./google-defaults\"\nimport { withSignUpName } from \"./signup-name\"\nimport { resolveRateLimit } from \"./rate-limit\"\n\nconst DEFAULT_EMAIL_SUBJECTS: Record<string, string> = {\n  \"email-verification\": \"Verify your account\",\n  \"forget-password\": \"Reset your password\",\n  \"sign-in\": \"Your sign-in code\",\n}\n\nfunction defaultRenderOtpEmail(otp: string): string {\n  return `\n              <div style=\"font-family:sans-serif;max-width:480px;margin:0 auto;padding:32px\">\n                <h2 style=\"font-size:20px;font-weight:600;margin-bottom:16px\">Your verification code</h2>\n                <p style=\"color:#555;margin-bottom:24px\">Use the code below to continue. It expires in 5 minutes.</p>\n                <div style=\"background:#f5f5f5;border-radius:8px;padding:24px;text-align:center;letter-spacing:8px;font-size:32px;font-weight:700\">\n                  ${otp}\n                </div>\n                <p style=\"color:#999;font-size:12px;margin-top:24px\">If you didn't request this, you can safely ignore this email.</p>\n              </div>\n            `\n}\n\nfunction defaultRenderMagicLinkEmail(url: string): string {\n  return `\n              <div style=\"font-family:sans-serif;max-width:480px;margin:0 auto;padding:32px\">\n                <h2 style=\"font-size:20px;font-weight:600;margin-bottom:16px\">Your sign-in link</h2>\n                <p style=\"color:#555;margin-bottom:24px\">Click the button below to sign in. The link expires in 5 minutes and works once.</p>\n                <a href=\"${url}\" style=\"display:inline-block;background:#111;color:#fff;text-decoration:none;border-radius:8px;padding:14px 28px;font-weight:600\">Sign in</a>\n                <p style=\"color:#999;font-size:12px;margin-top:24px;word-break:break-all\">Or paste this address into your browser:<br>${url}</p>\n                <p style=\"color:#999;font-size:12px;margin-top:16px\">If you didn't request this, you can safely ignore this email.</p>\n              </div>\n            `\n}\n\n/**\n * Creates a Better Auth instance with platform defaults.\n * Each app calls this with its own config (DB, secret, providers, plugins).\n */\nexport function createPlatformAuth(\n  config: PlatformAuthConfig,\n): Auth<BetterAuthOptions> {\n  const {\n    database,\n    baseURL,\n    secret,\n    appName,\n    mailer,\n    google,\n    github,\n    plugins = [],\n    databaseHooks,\n    betaMode = false,\n    isInvited,\n    emailSubjects,\n    renderOtpEmail,\n    magicLink: magicLinkConfig,\n    rateLimit,\n    twoFactor: twoFactorConfig,\n    trustedOrigins,\n  } = config\n\n  const subjects = { ...DEFAULT_EMAIL_SUBJECTS, ...emailSubjects }\n  const renderEmail = renderOtpEmail ?? defaultRenderOtpEmail\n\n  // The concrete instance type (with email-otp/admin plugins) is widened to\n  // the base Auth type so the published .d.ts stays portable (inferring the\n  // full plugin type triggers TS2742 — it can't be named without a zod ref).\n  // The admin() plugin's user.role field is re-exposed via module augmentation\n  // below, so consumers (e.g. transcript-web me.ts) still see session.user.role.\n  return betterAuth({\n    database,\n    baseURL,\n    secret,\n    ...(trustedOrigins ? { trustedOrigins } : {}),\n    rateLimit: resolveRateLimit(rateLimit),\n    emailAndPassword: {\n      enabled: true,\n      requireEmailVerification: true,\n    },\n    // Never auto-merge a social identity into an existing account by matching\n    // email. Better Auth links by default (email-verified providers are trusted),\n    // so signing in with Google/GitHub on an email already registered would fold\n    // that identity into the existing account. We keep each sign-in method its\n    // own account: a social login on a taken email is refused, not linked.\n    account: {\n      accountLinking: {\n        enabled: false,\n      },\n    },\n    // Naming happens here rather than on /sign-up/email so that every way in\n    // is covered: a magic link that signs up bypasses the endpoint entirely\n    // and calls createUser straight, with `name: name || \"\"`.\n    databaseHooks: {\n      ...databaseHooks,\n      user: {\n        ...databaseHooks?.user,\n        create: {\n          ...databaseHooks?.user?.create,\n          before: async (user: Record<string, unknown>, ctx: unknown) => {\n            const named = withSignUpName(user)\n            const appHook = databaseHooks?.user?.create?.before\n            // eslint-disable-next-line @typescript-eslint/no-explicit-any\n            const applied = await appHook?.(named as any, ctx as any)\n            if (applied === false) return false\n            if (applied && typeof applied === \"object\" && \"data\" in applied) {\n              return { data: withSignUpName(applied.data) }\n            }\n            return { data: named }\n          },\n        },\n      },\n    },\n    hooks: {\n      // eslint-disable-next-line @typescript-eslint/no-explicit-any\n      before: async (ctx: any) => {\n        if (!betaMode) return\n        if (ctx.path !== \"/sign-up/email\") return\n        const body = ctx.body as { email?: string; inviteToken?: string } | undefined\n        const email = body?.email\n        const inviteToken = body?.inviteToken\n        if (email && inviteToken && isInvited) {\n          const ok = await isInvited(email, inviteToken)\n          if (ok) return\n        }\n        throw new APIError(\"FORBIDDEN\", {\n          message: \"Registration is invite-only during the private beta.\",\n        })\n      },\n    },\n    plugins: [\n      emailOTP({\n        async sendVerificationOTP({ email, otp, type }) {\n          const subject = subjects[type]\n            ? `${subjects[type]} - ${appName}`\n            : `Your ${appName} code`\n          const html = renderEmail(otp, type as PlatformAuthMailerType)\n\n          if (mailer) {\n            await mailer({\n              to: email,\n              subject,\n              html,\n              type: type as PlatformAuthMailerType,\n              otp,\n            })\n            return\n          }\n\n          console.warn(\n            `[EMAIL] No mailer configured — logging OTP to stdout for ${email} (${type}): ${otp}`,\n          )\n        },\n        otpLength: 6,\n        expiresIn: 300,\n        overrideDefaultEmailVerification: true,\n      }),\n      ...(magicLinkConfig\n        ? [\n            magicLink({\n              expiresIn: magicLinkConfig.expiresIn ?? 300,\n              // A magic link that signs up walks past both gates the platform\n              // puts on the front door: requireEmailVerification, and the\n              // invite-only hook, which only guards /sign-up/email.\n              disableSignUp: !magicLinkConfig.allowSignUp,\n              async sendMagicLink({ email, url }) {\n                const subject =\n                  magicLinkConfig.subject ?? `Your sign-in link - ${appName}`\n                const html = (\n                  magicLinkConfig.render ?? defaultRenderMagicLinkEmail\n                )(url, email)\n\n                if (mailer) {\n                  await mailer({\n                    to: email,\n                    subject,\n                    html,\n                    type: \"magic-link\",\n                    url,\n                  })\n                  return\n                }\n\n                console.warn(\n                  `[EMAIL] No mailer configured — logging magic link to stdout for ${email}: ${url}`,\n                )\n              },\n            }),\n          ]\n        : []),\n      admin(),\n      ...(twoFactorConfig?.enabled\n        ? [\n            twoFactor({\n              issuer: twoFactorConfig.issuer ?? appName,\n              skipVerificationOnEnable:\n                twoFactorConfig.skipVerificationOnEnable ?? false,\n            }),\n          ]\n        : []),\n      ...plugins, // app-specific plugins (e.g. tanstackStartCookies)\n    ],\n    socialProviders: {\n      // Spread as given rather than rebuilt field by field: anything Better\n      // Auth accepts belongs to the app, and a config silently dropped on the\n      // way through is how an app ends up writing a plugin to put it back.\n      //\n      // The two defaults below are the platform's, not Google's: without\n      // accessType 'offline' Google never mints a refresh token, and without\n      // 'consent' it stops minting one for an account that already consented.\n      // A NULL refreshToken means deleting an account can revoke the access\n      // token but cannot remove the app from myaccount.google.com/permissions,\n      // so the grant outlives the account it belonged to.\n      ...(google ? { google: withGoogleDefaults(google) } : {}),\n      ...(github ? { github } : {}),\n    },\n  }) as unknown as Auth<BetterAuthOptions>\n}\n\nexport type PlatformAuth = ReturnType<typeof createPlatformAuth>\n\n// Re-export the session contract from /server so consumers that import the\n// auth factory can type api.getSession() without a second import path.\nexport type {\n  PlatformUser,\n  PlatformSession,\n  PlatformSessionData,\n  PlatformRateLimitConfig,\n  PlatformRateLimitRule,\n  PlatformTwoFactorConfig,\n} from \"./types\"\n\n// Invitation claiming runs on the auth callback, where the session is\n// established — the one place every sign-up flow passes through.\nexport {\n  claimInvitation,\n  completesSignup,\n  holdInviteTokenCookie,\n  invitationOutcomeCookie,\n  inviteTokenFrom,\n  isInvitationFailure,\n  pinInviteToken,\n  releaseInviteTokenCookie,\n} from \"./invitation\"\nexport type { ClaimOutcome, ClaimInvitationOptions } from \"./invitation\"\n","import type { PlatformAuthConfig } from \"./types\"\n\n/**\n * Applies the platform's Google defaults without touching what the app set.\n *\n * Better Auth also accepts a function returning the options, which cannot be\n * amended without calling it — such a config is passed straight through and\n * owns its own defaults.\n */\nexport function withGoogleDefaults(\n  google: NonNullable<PlatformAuthConfig[\"google\"]>,\n): NonNullable<PlatformAuthConfig[\"google\"]> {\n  if (typeof google === \"function\") return google\n  return {\n    ...google,\n    accessType: google.accessType ?? \"offline\",\n    prompt: google.prompt ?? \"select_account consent\",\n  }\n}\n\n","import type { PlatformRateLimitConfig, PlatformRateLimitRule } from \"./types\"\n\n// Better Auth keys its own rate limiter on NODE_ENV === \"production\", so a\n// deployment that forgets the variable serves sign-in with no brute-force\n// protection and nothing reports it. These are the platform's rules, applied\n// regardless of the environment.\nconst PLATFORM_RULES: Record<string, PlatformRateLimitRule> = {\n  \"/sign-in/email\": { window: 60, max: 5 },\n  \"/sign-up/email\": { window: 60, max: 5 },\n  \"/email-otp/send-verification-otp\": { window: 60, max: 3 },\n  \"/email-otp/verify-email\": { window: 60, max: 5 },\n  \"/email-otp/reset-password\": { window: 60, max: 5 },\n  \"/forget-password\": { window: 60, max: 3 },\n  \"/reset-password\": { window: 60, max: 5 },\n  \"/sign-in/magic-link\": { window: 60, max: 3 },\n  \"/two-factor/verify-totp\": { window: 60, max: 5 },\n  \"/two-factor/verify-otp\": { window: 60, max: 5 },\n  \"/two-factor/verify-backup-code\": { window: 60, max: 5 },\n  \"/two-factor/send-otp\": { window: 60, max: 3 },\n}\n\nexport interface ResolvedRateLimit {\n  enabled: boolean\n  window: number\n  max: number\n  storage?: \"memory\" | \"database\" | \"secondary-storage\"\n  modelName?: string\n  customRules: Record<string, PlatformRateLimitRule>\n}\n\nexport function resolveRateLimit(\n  config?: PlatformRateLimitConfig,\n): ResolvedRateLimit {\n  return {\n    enabled: config?.enabled ?? true,\n    window: config?.window ?? 10,\n    max: config?.max ?? 100,\n    ...(config?.storage ? { storage: config.storage } : {}),\n    ...(config?.modelName ? { modelName: config.modelName } : {}),\n    customRules: { ...PLATFORM_RULES, ...config?.customRules },\n  }\n}\n\nexport { PLATFORM_RULES }\n"],"mappings":";;;;;;;;;;;;;AAAA,SAAS,YAAY,gBAAmD;AACxE,SAAS,UAAU,OAAO,WAAW,iBAAiB;;;ACQ/C,SAAS,mBACd,QAC2C;AAC3C,MAAI,OAAO,WAAW,WAAY,QAAO;AACzC,SAAO;AAAA,IACL,GAAG;AAAA,IACH,YAAY,OAAO,cAAc;AAAA,IACjC,QAAQ,OAAO,UAAU;AAAA,EAC3B;AACF;;;ACZA,IAAM,iBAAwD;AAAA,EAC5D,kBAAkB,EAAE,QAAQ,IAAI,KAAK,EAAE;AAAA,EACvC,kBAAkB,EAAE,QAAQ,IAAI,KAAK,EAAE;AAAA,EACvC,oCAAoC,EAAE,QAAQ,IAAI,KAAK,EAAE;AAAA,EACzD,2BAA2B,EAAE,QAAQ,IAAI,KAAK,EAAE;AAAA,EAChD,6BAA6B,EAAE,QAAQ,IAAI,KAAK,EAAE;AAAA,EAClD,oBAAoB,EAAE,QAAQ,IAAI,KAAK,EAAE;AAAA,EACzC,mBAAmB,EAAE,QAAQ,IAAI,KAAK,EAAE;AAAA,EACxC,uBAAuB,EAAE,QAAQ,IAAI,KAAK,EAAE;AAAA,EAC5C,2BAA2B,EAAE,QAAQ,IAAI,KAAK,EAAE;AAAA,EAChD,0BAA0B,EAAE,QAAQ,IAAI,KAAK,EAAE;AAAA,EAC/C,kCAAkC,EAAE,QAAQ,IAAI,KAAK,EAAE;AAAA,EACvD,wBAAwB,EAAE,QAAQ,IAAI,KAAK,EAAE;AAC/C;AAWO,SAAS,iBACd,QACmB;AACnB,SAAO;AAAA,IACL,SAAS,QAAQ,WAAW;AAAA,IAC5B,QAAQ,QAAQ,UAAU;AAAA,IAC1B,KAAK,QAAQ,OAAO;AAAA,IACpB,GAAI,QAAQ,UAAU,EAAE,SAAS,OAAO,QAAQ,IAAI,CAAC;AAAA,IACrD,GAAI,QAAQ,YAAY,EAAE,WAAW,OAAO,UAAU,IAAI,CAAC;AAAA,IAC3D,aAAa,EAAE,GAAG,gBAAgB,GAAG,QAAQ,YAAY;AAAA,EAC3D;AACF;;;AFlCA,IAAM,yBAAiD;AAAA,EACrD,sBAAsB;AAAA,EACtB,mBAAmB;AAAA,EACnB,WAAW;AACb;AAEA,SAAS,sBAAsB,KAAqB;AAClD,SAAO;AAAA;AAAA;AAAA;AAAA;AAAA,oBAKW,GAAG;AAAA;AAAA;AAAA;AAAA;AAKvB;AAEA,SAAS,4BAA4B,KAAqB;AACxD,SAAO;AAAA;AAAA;AAAA;AAAA,2BAIkB,GAAG;AAAA,wIAC0G,GAAG;AAAA;AAAA;AAAA;AAI3I;AAMO,SAAS,mBACd,QACyB;AACzB,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,UAAU,CAAC;AAAA,IACX;AAAA,IACA,WAAW;AAAA,IACX;AAAA,IACA;AAAA,IACA;AAAA,IACA,WAAW;AAAA,IACX;AAAA,IACA,WAAW;AAAA,IACX;AAAA,EACF,IAAI;AAEJ,QAAM,WAAW,EAAE,GAAG,wBAAwB,GAAG,cAAc;AAC/D,QAAM,cAAc,kBAAkB;AAOtC,SAAO,WAAW;AAAA,IAChB;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAI,iBAAiB,EAAE,eAAe,IAAI,CAAC;AAAA,IAC3C,WAAW,iBAAiB,SAAS;AAAA,IACrC,kBAAkB;AAAA,MAChB,SAAS;AAAA,MACT,0BAA0B;AAAA,IAC5B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMA,SAAS;AAAA,MACP,gBAAgB;AAAA,QACd,SAAS;AAAA,MACX;AAAA,IACF;AAAA;AAAA;AAAA;AAAA,IAIA,eAAe;AAAA,MACb,GAAG;AAAA,MACH,MAAM;AAAA,QACJ,GAAG,eAAe;AAAA,QAClB,QAAQ;AAAA,UACN,GAAG,eAAe,MAAM;AAAA,UACxB,QAAQ,OAAO,MAA+B,QAAiB;AAC7D,kBAAM,QAAQ,eAAe,IAAI;AACjC,kBAAM,UAAU,eAAe,MAAM,QAAQ;AAE7C,kBAAM,UAAU,MAAM,UAAU,OAAc,GAAU;AACxD,gBAAI,YAAY,MAAO,QAAO;AAC9B,gBAAI,WAAW,OAAO,YAAY,YAAY,UAAU,SAAS;AAC/D,qBAAO,EAAE,MAAM,eAAe,QAAQ,IAAI,EAAE;AAAA,YAC9C;AACA,mBAAO,EAAE,MAAM,MAAM;AAAA,UACvB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,IACA,OAAO;AAAA;AAAA,MAEL,QAAQ,OAAO,QAAa;AAC1B,YAAI,CAAC,SAAU;AACf,YAAI,IAAI,SAAS,iBAAkB;AACnC,cAAM,OAAO,IAAI;AACjB,cAAM,QAAQ,MAAM;AACpB,cAAM,cAAc,MAAM;AAC1B,YAAI,SAAS,eAAe,WAAW;AACrC,gBAAM,KAAK,MAAM,UAAU,OAAO,WAAW;AAC7C,cAAI,GAAI;AAAA,QACV;AACA,cAAM,IAAI,SAAS,aAAa;AAAA,UAC9B,SAAS;AAAA,QACX,CAAC;AAAA,MACH;AAAA,IACF;AAAA,IACA,SAAS;AAAA,MACP,SAAS;AAAA,QACP,MAAM,oBAAoB,EAAE,OAAO,KAAK,KAAK,GAAG;AAC9C,gBAAM,UAAU,SAAS,IAAI,IACzB,GAAG,SAAS,IAAI,CAAC,MAAM,OAAO,KAC9B,QAAQ,OAAO;AACnB,gBAAM,OAAO,YAAY,KAAK,IAA8B;AAE5D,cAAI,QAAQ;AACV,kBAAM,OAAO;AAAA,cACX,IAAI;AAAA,cACJ;AAAA,cACA;AAAA,cACA;AAAA,cACA;AAAA,YACF,CAAC;AACD;AAAA,UACF;AAEA,kBAAQ;AAAA,YACN,iEAA4D,KAAK,KAAK,IAAI,MAAM,GAAG;AAAA,UACrF;AAAA,QACF;AAAA,QACA,WAAW;AAAA,QACX,WAAW;AAAA,QACX,kCAAkC;AAAA,MACpC,CAAC;AAAA,MACD,GAAI,kBACA;AAAA,QACE,UAAU;AAAA,UACR,WAAW,gBAAgB,aAAa;AAAA;AAAA;AAAA;AAAA,UAIxC,eAAe,CAAC,gBAAgB;AAAA,UAChC,MAAM,cAAc,EAAE,OAAO,IAAI,GAAG;AAClC,kBAAM,UACJ,gBAAgB,WAAW,uBAAuB,OAAO;AAC3D,kBAAM,QACJ,gBAAgB,UAAU,6BAC1B,KAAK,KAAK;AAEZ,gBAAI,QAAQ;AACV,oBAAM,OAAO;AAAA,gBACX,IAAI;AAAA,gBACJ;AAAA,gBACA;AAAA,gBACA,MAAM;AAAA,gBACN;AAAA,cACF,CAAC;AACD;AAAA,YACF;AAEA,oBAAQ;AAAA,cACN,wEAAmE,KAAK,KAAK,GAAG;AAAA,YAClF;AAAA,UACF;AAAA,QACF,CAAC;AAAA,MACH,IACA,CAAC;AAAA,MACL,MAAM;AAAA,MACN,GAAI,iBAAiB,UACjB;AAAA,QACE,UAAU;AAAA,UACR,QAAQ,gBAAgB,UAAU;AAAA,UAClC,0BACE,gBAAgB,4BAA4B;AAAA,QAChD,CAAC;AAAA,MACH,IACA,CAAC;AAAA,MACL,GAAG;AAAA;AAAA,IACL;AAAA,IACA,iBAAiB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWf,GAAI,SAAS,EAAE,QAAQ,mBAAmB,MAAM,EAAE,IAAI,CAAC;AAAA,MACvD,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;AAAA,IAC7B;AAAA,EACF,CAAC;AACH;","names":[]}

package/dist/{types-CxpBvjn9.d.ts → types-Ct0Kt36S.d.ts}

@@ -25,6 +25,8 @@ interface PlatformUser {
     role?: string | null;
     /** From the admin() plugin. */
     banned?: boolean | null;
+    /** From the twoFactor() plugin, when enabled. */
+    twoFactorEnabled?: boolean | null;
 }
 interface PlatformSessionData {
     id: string;
@@ -82,6 +84,51 @@ interface MagicLinkConfig {
      */
     render?: (url: string, email: string) => string;
 }
+interface PlatformRateLimitRule {
+    /** Length of the window, in seconds. */
+    window: number;
+    /** Requests allowed per window, per client. */
+    max: number;
+}
+interface PlatformRateLimitConfig {
+    /**
+     * Off only when an app is certain something in front of it already limits
+     * the auth endpoints. Defaults to true, deliberately: Better Auth keys its
+     * own default on NODE_ENV, so a deployment missing the variable would serve
+     * sign-in with no brute-force protection and nothing would say so.
+     */
+    enabled?: boolean;
+    /** Global window in seconds for paths without a rule. Defaults to 10. */
+    window?: number;
+    /** Global max per window for paths without a rule. Defaults to 100. */
+    max?: number;
+    /**
+     * Where counters live. "memory" (the default) is per-process, so it does not
+     * hold across replicas — an app running more than one must pass "database"
+     * or wire secondaryStorage.
+     */
+    storage?: "memory" | "database" | "secondary-storage";
+    /** Table name when storage is "database". */
+    modelName?: string;
+    /**
+     * Per-path overrides, merged over the platform's. The platform already
+     * tightens sign-in, sign-up, OTP send/verify, password reset, magic link
+     * and two-factor verification; use this to go further, not to loosen.
+     */
+    customRules?: Record<string, PlatformRateLimitRule>;
+}
+interface PlatformTwoFactorConfig {
+    /** Mounts the two-factor endpoints. Off unless set. */
+    enabled: boolean;
+    /** Label shown in the authenticator app. Defaults to appName. */
+    issuer?: string;
+    /**
+     * Trust an enrolment before a first code is verified. Leave false: enabling
+     * on an unverified secret locks the account out when the authenticator was
+     * mis-scanned.
+     */
+    skipVerificationOnEnable?: boolean;
+}
 interface PlatformAuthConfig {
     /** PostgreSQL connection pool or connection string */
     database: BetterAuthOptions["database"];
@@ -143,6 +190,22 @@ interface PlatformAuthConfig {
     betaMode?: boolean;
     /** Check if an email+token pair has been invited (required when betaMode is true) */
     isInvited?: (email: string, inviteToken: string) => Promise<boolean>;
+    /**
+     * Brute-force limits on the auth endpoints. The platform enables them with
+     * tightened per-path rules; pass this only to adjust.
+     */
+    rateLimit?: PlatformRateLimitConfig;
+    /**
+     * TOTP second factor with backup codes. Requires the `twoFactor` table and
+     * the `user.twoFactorEnabled` column.
+     */
+    twoFactor?: PlatformTwoFactorConfig;
+    /**
+     * Origins allowed to drive the auth endpoints, beyond baseURL. Better Auth
+     * checks Origin against this list, so it is what stands between a session
+     * cookie and a cross-site request that spends it.
+     */
+    trustedOrigins?: string[];
 }
 interface PlatformAuthClientConfig {
     /** Base URL override (defaults to window.location.origin in browser) */
@@ -271,6 +334,36 @@ interface AuthClientResult {
         status?: number;
     } | null;
 }
+interface AuthClientDataResult<T> extends AuthClientResult {
+    data?: T | null;
+}
+/**
+ * The admin() plugin's client half. Part of {@link AuthClientSurface} rather
+ * than kept apart like {@link MagicLinkClientSurface}: createPlatformAuthClient
+ * always mounts adminClient(), so a client built by it always answers here.
+ *
+ * The user shape is left open — each app stores its own columns, and this
+ * surface exists to type the calls, not the rows they return.
+ */
+interface AdminClientSurface {
+    listUsers(input: {
+        query?: Record<string, unknown>;
+    }): Promise<AuthClientDataResult<{
+        users?: unknown[];
+        total?: number;
+    }>>;
+    banUser(input: {
+        userId: string;
+        banReason?: string;
+    }): Promise<AuthClientResult>;
+    unbanUser(input: {
+        userId: string;
+    }): Promise<AuthClientResult>;
+    setRole(input: {
+        userId: string;
+        role: "admin" | "user";
+    }): Promise<AuthClientResult>;
+}
 interface AuthClientSurface {
     signIn: {
         email(input: {
@@ -289,6 +382,7 @@ interface AuthClientSurface {
             name?: string;
             email: string;
             password: string;
+            callbackURL?: string;
         }): Promise<AuthClientResult>;
     };
     emailOtp: {
@@ -306,6 +400,12 @@ interface AuthClientSurface {
             password: string;
         }): Promise<AuthClientResult>;
     };
+    /**
+     * Optional: the forms take an AuthClientSurface as a prop, and a client built
+     * by hand for a login screen has no reason to mount adminClient(). Required
+     * on PlatformAuthClient, which always does.
+     */
+    admin?: AdminClientSurface;
 }
 /**
  * The magic-link half of the client surface, kept apart from
@@ -322,6 +422,45 @@ interface MagicLinkClientSurface {
         }): Promise<AuthClientResult>;
     };
 }
+/**
+ * The twoFactor() plugin's client half. Always mounted by
+ * createPlatformAuthClient — which methods exist client-side costs nothing;
+ * whether the routes answer is decided server-side by passing `twoFactor` to
+ * createPlatformAuth.
+ *
+ * A sign-in against an account with 2FA on returns `twoFactorRedirect: true`
+ * instead of a session, and the second factor is what completes it.
+ */
+interface TwoFactorClientSurface {
+    enable(input: {
+        password: string;
+        issuer?: string;
+    }): Promise<AuthClientDataResult<{
+        totpURI: string;
+        backupCodes: string[];
+    }>>;
+    disable(input: {
+        password: string;
+    }): Promise<AuthClientResult>;
+    getTotpUri(input: {
+        password: string;
+    }): Promise<AuthClientDataResult<{
+        totpURI: string;
+    }>>;
+    verifyTotp(input: {
+        code: string;
+        trustDevice?: boolean;
+    }): Promise<AuthClientResult>;
+    verifyBackupCode(input: {
+        code: string;
+        trustDevice?: boolean;
+    }): Promise<AuthClientResult>;
+    generateBackupCodes(input: {
+        password: string;
+    }): Promise<AuthClientDataResult<{
+        backupCodes: string[];
+    }>>;
+}
 interface AuthThemeProps {
     /** Replaces the submit button's `bg-primary text-primary-foreground` */
     submitClassName?: string;
@@ -563,4 +702,4 @@ interface AuthLayoutProps extends AuthHeadingProps {
     footer?: React.ReactNode;
 }
 
-export type { AuthLayoutProps as A, ForgotPasswordFormProps as F, InvitationNoticeProps as I, LoginFormProps as L, MagicLinkFormProps as M, PlatformAuthClientConfig as P, RegisterFormProps as R, VerifyEmailFormProps as V, ResetPasswordFormProps as a, AuthClientResult as b, LinkComponent as c, AuthClientSurface as d, AuthInviteProps as e, AuthNavProps as f, AuthThemeProps as g, InvitationFailure as h, LoginFormLabels as i, MagicLinkClientSurface as j, MagicLinkConfig as k, MagicLinkFormLabels as l, PlatformAuthConfig as m, PlatformAuthMailer as n, PlatformAuthMailerArgs as o, PlatformAuthMailerType as p, PlatformSession as q, PlatformSessionData as r, PlatformUser as s, RegisterFormLabels as t };
+export type { AuthLayoutProps as A, ForgotPasswordFormProps as F, InvitationNoticeProps as I, LoginFormProps as L, MagicLinkFormProps as M, PlatformAuthClientConfig as P, RegisterFormProps as R, TwoFactorClientSurface as T, VerifyEmailFormProps as V, ResetPasswordFormProps as a, AuthClientResult as b, LinkComponent as c, AdminClientSurface as d, AuthClientDataResult as e, AuthClientSurface as f, AuthInviteProps as g, AuthNavProps as h, AuthThemeProps as i, InvitationFailure as j, LoginFormLabels as k, MagicLinkClientSurface as l, MagicLinkConfig as m, MagicLinkFormLabels as n, PlatformAuthConfig as o, PlatformAuthMailer as p, PlatformAuthMailerArgs as q, PlatformAuthMailerType as r, PlatformRateLimitConfig as s, PlatformRateLimitRule as t, PlatformSession as u, PlatformSessionData as v, PlatformTwoFactorConfig as w, PlatformUser as x, RegisterFormLabels as y };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lalternative/auth",
-  "version": "0.10.5",
+  "version": "0.11.0",
   "description": "Shared Better Auth wrapper for L'Alternative apps (server + React client + auth UI)",
   "type": "module",
   "main": "./dist/index.js",