@pleaseai/agent 0.1.16 → 0.1.18

package/.output/server/node_modules/better-auth/dist/api/index.mjs

@@ -0,0 +1,208 @@
+import { isAPIError } from "../utils/is-api-error.mjs";
+import { formCsrfMiddleware, originCheck, originCheckMiddleware } from "./middlewares/origin-check.mjs";
+import "./middlewares/index.mjs";
+import { getIp } from "../utils/get-request-ip.mjs";
+import { onRequestRateLimit, onResponseRateLimit } from "./rate-limiter/index.mjs";
+import { getOAuthState } from "./state/oauth.mjs";
+import { getShouldSkipSessionRefresh, setShouldSkipSessionRefresh } from "./state/should-session-refresh.mjs";
+import { freshSessionMiddleware, getSession, getSessionFromCtx, listSessions, requestOnlySessionMiddleware, revokeOtherSessions, revokeSession, revokeSessions, sensitiveSessionMiddleware, sessionMiddleware } from "./routes/session.mjs";
+import { accountInfo, getAccessToken, linkSocialAccount, listUserAccounts, refreshToken, unlinkAccount } from "./routes/account.mjs";
+import { callbackOAuth } from "./routes/callback.mjs";
+import { createEmailVerificationToken, sendVerificationEmail, sendVerificationEmailFn, verifyEmail } from "./routes/email-verification.mjs";
+import { error } from "./routes/error.mjs";
+import { ok } from "./routes/ok.mjs";
+import { requestPasswordReset, requestPasswordResetCallback, resetPassword, verifyPassword } from "./routes/password.mjs";
+import { signInEmail, signInSocial } from "./routes/sign-in.mjs";
+import { signOut } from "./routes/sign-out.mjs";
+import { signUpEmail } from "./routes/sign-up.mjs";
+import { updateSession } from "./routes/update-session.mjs";
+import { changeEmail, changePassword, deleteUser, deleteUserCallback, setPassword, updateUser } from "./routes/update-user.mjs";
+import "./routes/index.mjs";
+import { toAuthEndpoints } from "./to-auth-endpoints.mjs";
+import { logger } from "@better-auth/core/env";
+import { APIError } from "@better-auth/core/error";
+import { normalizePathname } from "@better-auth/core/utils/url";
+import { createRouter } from "better-call";
+import { createAuthEndpoint, createAuthMiddleware, optionsMiddleware } from "@better-auth/core/api";
+
+//#region src/api/index.ts
+function checkEndpointConflicts(options, logger) {
+	const endpointRegistry = /* @__PURE__ */ new Map();
+	options.plugins?.forEach((plugin) => {
+		if (plugin.endpoints) {
+			for (const [key, endpoint] of Object.entries(plugin.endpoints)) if (endpoint && "path" in endpoint && typeof endpoint.path === "string") {
+				const path = endpoint.path;
+				let methods = [];
+				if (endpoint.options && "method" in endpoint.options) {
+					if (Array.isArray(endpoint.options.method)) methods = endpoint.options.method;
+					else if (typeof endpoint.options.method === "string") methods = [endpoint.options.method];
+				}
+				if (methods.length === 0) methods = ["*"];
+				if (!endpointRegistry.has(path)) endpointRegistry.set(path, []);
+				endpointRegistry.get(path).push({
+					pluginId: plugin.id,
+					endpointKey: key,
+					methods
+				});
+			}
+		}
+	});
+	const conflicts = [];
+	for (const [path, entries] of endpointRegistry.entries()) if (entries.length > 1) {
+		const methodMap = /* @__PURE__ */ new Map();
+		let hasConflict = false;
+		for (const entry of entries) for (const method of entry.methods) {
+			if (!methodMap.has(method)) methodMap.set(method, []);
+			methodMap.get(method).push(entry.pluginId);
+			if (methodMap.get(method).length > 1) hasConflict = true;
+			if (method === "*" && entries.length > 1) hasConflict = true;
+			else if (method !== "*" && methodMap.has("*")) hasConflict = true;
+		}
+		if (hasConflict) {
+			const uniquePlugins = [...new Set(entries.map((e) => e.pluginId))];
+			const conflictingMethods = [];
+			for (const [method, plugins] of methodMap.entries()) if (plugins.length > 1 || method === "*" && entries.length > 1 || method !== "*" && methodMap.has("*")) conflictingMethods.push(method);
+			conflicts.push({
+				path,
+				plugins: uniquePlugins,
+				conflictingMethods
+			});
+		}
+	}
+	if (conflicts.length > 0) {
+		const conflictMessages = conflicts.map((conflict) => `  - "${conflict.path}" [${conflict.conflictingMethods.join(", ")}] used by plugins: ${conflict.plugins.join(", ")}`).join("\n");
+		logger.error(`Endpoint path conflicts detected! Multiple plugins are trying to use the same endpoint paths with conflicting HTTP methods:
+${conflictMessages}
+
+To resolve this, you can:
+	1. Use only one of the conflicting plugins
+	2. Configure the plugins to use different paths (if supported)
+	3. Ensure plugins use different HTTP methods for the same path
+`);
+	}
+}
+function getEndpoints(ctx, options) {
+	const pluginEndpoints = options.plugins?.reduce((acc, plugin) => {
+		return {
+			...acc,
+			...plugin.endpoints
+		};
+	}, {}) ?? {};
+	const middlewares = options.plugins?.map((plugin) => plugin.middlewares?.map((m) => {
+		const middleware = (async (context) => {
+			const authContext = await ctx;
+			return m.middleware({
+				...context,
+				context: {
+					...authContext,
+					...context.context
+				}
+			});
+		});
+		middleware.options = m.middleware.options;
+		return {
+			path: m.path,
+			middleware
+		};
+	})).filter((plugin) => plugin !== void 0).flat() || [];
+	return {
+		api: toAuthEndpoints({
+			signInSocial: signInSocial(),
+			callbackOAuth,
+			getSession: getSession(),
+			signOut,
+			signUpEmail: signUpEmail(),
+			signInEmail: signInEmail(),
+			resetPassword,
+			verifyPassword,
+			verifyEmail,
+			sendVerificationEmail,
+			changeEmail,
+			changePassword,
+			setPassword,
+			updateSession: updateSession(),
+			updateUser: updateUser(),
+			deleteUser,
+			requestPasswordReset,
+			requestPasswordResetCallback,
+			listSessions: listSessions(),
+			revokeSession,
+			revokeSessions,
+			revokeOtherSessions,
+			linkSocialAccount,
+			listUserAccounts,
+			deleteUserCallback,
+			unlinkAccount,
+			refreshToken,
+			getAccessToken,
+			accountInfo,
+			...pluginEndpoints,
+			ok,
+			error
+		}, ctx),
+		middlewares
+	};
+}
+const router = (ctx, options) => {
+	const { api, middlewares } = getEndpoints(ctx, options);
+	const basePath = new URL(ctx.baseURL).pathname;
+	return createRouter(api, {
+		routerContext: ctx,
+		openapi: { disabled: true },
+		basePath,
+		routerMiddleware: [{
+			path: "/**",
+			middleware: originCheckMiddleware
+		}, ...middlewares],
+		allowedMediaTypes: ["application/json"],
+		skipTrailingSlashes: options.advanced?.skipTrailingSlashes ?? false,
+		async onRequest(req) {
+			const disabledPaths = ctx.options.disabledPaths || [];
+			const normalizedPath = normalizePathname(req.url, basePath);
+			if (disabledPaths.includes(normalizedPath)) return new Response("Not Found", { status: 404 });
+			let currentRequest = req;
+			for (const plugin of ctx.options.plugins || []) if (plugin.onRequest) {
+				const response = await plugin.onRequest(currentRequest, ctx);
+				if (response && "response" in response) return response.response;
+				if (response && "request" in response) currentRequest = response.request;
+			}
+			const rateLimitResponse = await onRequestRateLimit(currentRequest, ctx);
+			if (rateLimitResponse) return rateLimitResponse;
+			return currentRequest;
+		},
+		async onResponse(res, req) {
+			await onResponseRateLimit(req, ctx);
+			for (const plugin of ctx.options.plugins || []) if (plugin.onResponse) {
+				const response = await plugin.onResponse(res, ctx);
+				if (response) return response.response;
+			}
+			return res;
+		},
+		onError(e) {
+			if (isAPIError(e) && e.status === "FOUND") return;
+			if (options.onAPIError?.throw) throw e;
+			if (options.onAPIError?.onError) {
+				options.onAPIError.onError(e, ctx);
+				return;
+			}
+			const optLogLevel = options.logger?.level;
+			const log = optLogLevel === "error" || optLogLevel === "warn" || optLogLevel === "debug" ? logger : void 0;
+			if (options.logger?.disabled !== true) {
+				if (e && typeof e === "object" && "message" in e && typeof e.message === "string") {
+					if (e.message.includes("no column") || e.message.includes("column") || e.message.includes("relation") || e.message.includes("table") || e.message.includes("does not exist")) {
+						ctx.logger?.error(e.message);
+						return;
+					}
+				}
+				if (isAPIError(e)) {
+					if (e.status === "INTERNAL_SERVER_ERROR") ctx.logger.error(e.status, e);
+					log?.error(e.message);
+				} else ctx.logger?.error(e && typeof e === "object" && "name" in e ? e.name : "", e);
+			}
+		}
+	});
+};
+
+//#endregion
+export { APIError, accountInfo, callbackOAuth, changeEmail, changePassword, checkEndpointConflicts, createAuthEndpoint, createAuthMiddleware, createEmailVerificationToken, deleteUser, deleteUserCallback, error, formCsrfMiddleware, freshSessionMiddleware, getAccessToken, getEndpoints, getIp, getOAuthState, getSession, getSessionFromCtx, getShouldSkipSessionRefresh, isAPIError, linkSocialAccount, listSessions, listUserAccounts, ok, optionsMiddleware, originCheck, originCheckMiddleware, refreshToken, requestOnlySessionMiddleware, requestPasswordReset, requestPasswordResetCallback, resetPassword, revokeOtherSessions, revokeSession, revokeSessions, router, sendVerificationEmail, sendVerificationEmailFn, sensitiveSessionMiddleware, sessionMiddleware, setPassword, setShouldSkipSessionRefresh, signInEmail, signInSocial, signOut, signUpEmail, unlinkAccount, updateSession, updateUser, verifyEmail, verifyPassword };
+//# sourceMappingURL=index.mjs.map

package/.output/server/node_modules/better-auth/dist/api/middlewares/index.mjs

@@ -0,0 +1,3 @@
+import { formCsrfMiddleware, originCheck, originCheckMiddleware } from "./origin-check.mjs";
+
+export {  };

package/.output/server/node_modules/better-auth/dist/api/middlewares/origin-check.mjs

@@ -0,0 +1,140 @@
+import { matchesOriginPattern } from "../../auth/trusted-origins.mjs";
+import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
+import { normalizePathname } from "@better-auth/core/utils/url";
+import { createAuthMiddleware } from "@better-auth/core/api";
+import { deprecate } from "@better-auth/core/utils/deprecate";
+
+//#region src/api/middlewares/origin-check.ts
+/**
+* Checks if CSRF should be skipped for backward compatibility.
+* Previously, disableOriginCheck also disabled CSRF checks.
+* This maintains that behavior when disableCSRFCheck isn't explicitly set.
+* Only triggers for skipOriginCheck === true, not for path arrays.
+*/
+function shouldSkipCSRFForBackwardCompat(ctx) {
+	return ctx.context.skipOriginCheck === true && ctx.context.options.advanced?.disableCSRFCheck === void 0;
+}
+/**
+* Logs deprecation warning for users relying on coupled behavior.
+* Only logs if user explicitly set disableOriginCheck (not test environment default).
+*/
+const logBackwardCompatWarning = deprecate(function logBackwardCompatWarning() {}, "disableOriginCheck: true currently also disables CSRF checks. In a future version, disableOriginCheck will ONLY disable URL validation. To keep CSRF disabled, add disableCSRFCheck: true to your config.");
+/**
+* A middleware to validate callbackURL and origin against trustedOrigins.
+* Also handles CSRF protection using Fetch Metadata for first-login scenarios.
+*/
+const originCheckMiddleware = createAuthMiddleware(async (ctx) => {
+	if (ctx.request?.method === "GET" || ctx.request?.method === "OPTIONS" || ctx.request?.method === "HEAD" || !ctx.request) return;
+	await validateOrigin(ctx);
+	if (ctx.context.skipOriginCheck) return;
+	const { body, query } = ctx;
+	const callbackURL = body?.callbackURL || query?.callbackURL;
+	const redirectURL = body?.redirectTo;
+	const errorCallbackURL = body?.errorCallbackURL;
+	const newUserCallbackURL = body?.newUserCallbackURL;
+	const validateURL = (url, label) => {
+		if (!url) return;
+		if (!ctx.context.isTrustedOrigin(url, { allowRelativePaths: label !== "origin" })) {
+			ctx.context.logger.error(`Invalid ${label}: ${url}`);
+			ctx.context.logger.info(`If it's a valid URL, please add ${url} to trustedOrigins in your auth config\n`, `Current list of trustedOrigins: ${ctx.context.trustedOrigins}`);
+			if (label === "origin") throw APIError.from("FORBIDDEN", BASE_ERROR_CODES.INVALID_ORIGIN);
+			if (label === "callbackURL") throw APIError.from("FORBIDDEN", BASE_ERROR_CODES.INVALID_CALLBACK_URL);
+			if (label === "redirectURL") throw APIError.from("FORBIDDEN", BASE_ERROR_CODES.INVALID_REDIRECT_URL);
+			if (label === "errorCallbackURL") throw APIError.from("FORBIDDEN", BASE_ERROR_CODES.INVALID_ERROR_CALLBACK_URL);
+			if (label === "newUserCallbackURL") throw APIError.from("FORBIDDEN", BASE_ERROR_CODES.INVALID_NEW_USER_CALLBACK_URL);
+			throw APIError.fromStatus("FORBIDDEN", { message: `Invalid ${label}` });
+		}
+	};
+	callbackURL && validateURL(callbackURL, "callbackURL");
+	redirectURL && validateURL(redirectURL, "redirectURL");
+	errorCallbackURL && validateURL(errorCallbackURL, "errorCallbackURL");
+	newUserCallbackURL && validateURL(newUserCallbackURL, "newUserCallbackURL");
+});
+const originCheck = (getValue) => createAuthMiddleware(async (ctx) => {
+	if (!ctx.request) return;
+	if (ctx.context.skipOriginCheck) return;
+	const callbackURL = getValue(ctx);
+	const validateURL = (url, label) => {
+		if (!url) return;
+		if (!ctx.context.isTrustedOrigin(url, { allowRelativePaths: label !== "origin" })) {
+			ctx.context.logger.error(`Invalid ${label}: ${url}`);
+			ctx.context.logger.info(`If it's a valid URL, please add ${url} to trustedOrigins in your auth config\n`, `Current list of trustedOrigins: ${ctx.context.trustedOrigins}`);
+			if (label === "origin") throw APIError.from("FORBIDDEN", BASE_ERROR_CODES.INVALID_ORIGIN);
+			if (label === "callbackURL") throw APIError.from("FORBIDDEN", BASE_ERROR_CODES.INVALID_CALLBACK_URL);
+			if (label === "redirectURL") throw APIError.from("FORBIDDEN", BASE_ERROR_CODES.INVALID_REDIRECT_URL);
+			if (label === "errorCallbackURL") throw APIError.from("FORBIDDEN", BASE_ERROR_CODES.INVALID_ERROR_CALLBACK_URL);
+			if (label === "newUserCallbackURL") throw APIError.from("FORBIDDEN", BASE_ERROR_CODES.INVALID_NEW_USER_CALLBACK_URL);
+			throw APIError.fromStatus("FORBIDDEN", { message: `Invalid ${label}` });
+		}
+	};
+	const callbacks = Array.isArray(callbackURL) ? callbackURL : [callbackURL];
+	for (const url of callbacks) validateURL(url, "callbackURL");
+});
+/**
+* Validates origin header against trusted origins.
+* @param ctx - The endpoint context
+* @param forceValidate - If true, always validate origin regardless of cookies/skip flags
+*/
+async function validateOrigin(ctx, forceValidate = false) {
+	const headers = ctx.request?.headers;
+	if (!headers || !ctx.request) return;
+	const originHeader = headers.get("origin") || headers.get("referer") || "";
+	const useCookies = headers.has("cookie");
+	if (ctx.context.skipCSRFCheck) return;
+	if (shouldSkipCSRFForBackwardCompat(ctx)) {
+		ctx.context.options.advanced?.disableOriginCheck === true && logBackwardCompatWarning();
+		return;
+	}
+	const skipOriginCheck = ctx.context.skipOriginCheck;
+	if (Array.isArray(skipOriginCheck)) try {
+		const basePath = new URL(ctx.context.baseURL).pathname;
+		const currentPath = normalizePathname(ctx.request.url, basePath);
+		if (skipOriginCheck.some((skipPath) => currentPath.startsWith(skipPath))) return;
+	} catch {}
+	if (!(forceValidate || useCookies)) return;
+	if (!originHeader || originHeader === "null") throw APIError.from("FORBIDDEN", BASE_ERROR_CODES.MISSING_OR_NULL_ORIGIN);
+	const trustedOrigins = Array.isArray(ctx.context.options.trustedOrigins) ? ctx.context.trustedOrigins : [...ctx.context.trustedOrigins, ...(await ctx.context.options.trustedOrigins?.(ctx.request))?.filter((v) => Boolean(v)) || []];
+	if (!trustedOrigins.some((origin) => matchesOriginPattern(originHeader, origin))) {
+		ctx.context.logger.error(`Invalid origin: ${originHeader}`);
+		ctx.context.logger.info(`If it's a valid URL, please add ${originHeader} to trustedOrigins in your auth config\n`, `Current list of trustedOrigins: ${trustedOrigins}`);
+		throw APIError.from("FORBIDDEN", BASE_ERROR_CODES.INVALID_ORIGIN);
+	}
+}
+/**
+* Middleware for CSRF protection using Fetch Metadata headers.
+* This prevents cross-site navigation login attacks while supporting progressive enhancement.
+*/
+const formCsrfMiddleware = createAuthMiddleware(async (ctx) => {
+	if (!ctx.request) return;
+	await validateFormCsrf(ctx);
+});
+/**
+* Validates CSRF protection for first-login scenarios using Fetch Metadata headers.
+* This prevents cross-site form submission attacks while supporting progressive enhancement.
+*/
+async function validateFormCsrf(ctx) {
+	const req = ctx.request;
+	if (!req) return;
+	if (ctx.context.skipCSRFCheck) return;
+	if (shouldSkipCSRFForBackwardCompat(ctx)) return;
+	const headers = req.headers;
+	if (headers.has("cookie")) return await validateOrigin(ctx);
+	const site = headers.get("Sec-Fetch-Site");
+	const mode = headers.get("Sec-Fetch-Mode");
+	const dest = headers.get("Sec-Fetch-Dest");
+	if (Boolean(site && site.trim() || mode && mode.trim() || dest && dest.trim())) {
+		if (site === "cross-site" && mode === "navigate") {
+			ctx.context.logger.error("Blocked cross-site navigation login attempt (CSRF protection)", {
+				secFetchSite: site,
+				secFetchMode: mode,
+				secFetchDest: dest
+			});
+			throw APIError.from("FORBIDDEN", BASE_ERROR_CODES.CROSS_SITE_NAVIGATION_LOGIN_BLOCKED);
+		}
+		return await validateOrigin(ctx, true);
+	}
+}
+
+//#endregion
+export { formCsrfMiddleware, originCheck, originCheckMiddleware };
+//# sourceMappingURL=origin-check.mjs.map

package/.output/server/node_modules/better-auth/dist/api/rate-limiter/index.mjs

@@ -0,0 +1,204 @@
+import { wildcardMatch } from "../../utils/wildcard.mjs";
+import { getIp } from "../../utils/get-request-ip.mjs";
+import { safeJSONParse } from "@better-auth/core/utils/json";
+import { normalizePathname } from "@better-auth/core/utils/url";
+import { createRateLimitKey } from "@better-auth/core/utils/ip";
+
+//#region src/api/rate-limiter/index.ts
+const memory = /* @__PURE__ */ new Map();
+function shouldRateLimit(max, window, rateLimitData) {
+	const now = Date.now();
+	const windowInMs = window * 1e3;
+	return now - rateLimitData.lastRequest < windowInMs && rateLimitData.count >= max;
+}
+function rateLimitResponse(retryAfter) {
+	return new Response(JSON.stringify({ message: "Too many requests. Please try again later." }), {
+		status: 429,
+		statusText: "Too Many Requests",
+		headers: { "X-Retry-After": retryAfter.toString() }
+	});
+}
+function getRetryAfter(lastRequest, window) {
+	const now = Date.now();
+	const windowInMs = window * 1e3;
+	return Math.ceil((lastRequest + windowInMs - now) / 1e3);
+}
+function createDatabaseStorageWrapper(ctx) {
+	const model = "rateLimit";
+	const db = ctx.adapter;
+	return {
+		get: async (key) => {
+			const data = (await db.findMany({
+				model,
+				where: [{
+					field: "key",
+					value: key
+				}]
+			}))[0];
+			if (typeof data?.lastRequest === "bigint") data.lastRequest = Number(data.lastRequest);
+			return data;
+		},
+		set: async (key, value, _update) => {
+			try {
+				if (_update) await db.updateMany({
+					model,
+					where: [{
+						field: "key",
+						value: key
+					}],
+					update: {
+						count: value.count,
+						lastRequest: value.lastRequest
+					}
+				});
+				else await db.create({
+					model,
+					data: {
+						key,
+						count: value.count,
+						lastRequest: value.lastRequest
+					}
+				});
+			} catch (e) {
+				ctx.logger.error("Error setting rate limit", e);
+			}
+		}
+	};
+}
+function getRateLimitStorage(ctx, rateLimitSettings) {
+	if (ctx.options.rateLimit?.customStorage) return ctx.options.rateLimit.customStorage;
+	const storage = ctx.rateLimit.storage;
+	if (storage === "secondary-storage") return {
+		get: async (key) => {
+			const data = await ctx.options.secondaryStorage?.get(key);
+			return data ? safeJSONParse(data) : null;
+		},
+		set: async (key, value, _update) => {
+			const ttl = rateLimitSettings?.window ?? ctx.options.rateLimit?.window ?? 10;
+			await ctx.options.secondaryStorage?.set?.(key, JSON.stringify(value), ttl);
+		}
+	};
+	else if (storage === "memory") return {
+		async get(key) {
+			const entry = memory.get(key);
+			if (!entry) return null;
+			if (Date.now() >= entry.expiresAt) {
+				memory.delete(key);
+				return null;
+			}
+			return entry.data;
+		},
+		async set(key, value, _update) {
+			const ttl = rateLimitSettings?.window ?? ctx.options.rateLimit?.window ?? 10;
+			const expiresAt = Date.now() + ttl * 1e3;
+			memory.set(key, {
+				data: value,
+				expiresAt
+			});
+		}
+	};
+	return createDatabaseStorageWrapper(ctx);
+}
+let ipWarningLogged = false;
+async function resolveRateLimitConfig(req, ctx) {
+	const basePath = new URL(ctx.baseURL).pathname;
+	const path = normalizePathname(req.url, basePath);
+	let currentWindow = ctx.rateLimit.window;
+	let currentMax = ctx.rateLimit.max;
+	const ip = getIp(req, ctx.options);
+	if (!ip) {
+		if (!ipWarningLogged) {
+			ctx.logger.warn("Rate limiting skipped: could not determine client IP address. If you're behind a reverse proxy, make sure to configure `trustedProxies` in your auth config.");
+			ipWarningLogged = true;
+		}
+		return null;
+	}
+	const key = createRateLimitKey(ip, path);
+	const specialRule = getDefaultSpecialRules().find((rule) => rule.pathMatcher(path));
+	if (specialRule) {
+		currentWindow = specialRule.window;
+		currentMax = specialRule.max;
+	}
+	for (const plugin of ctx.options.plugins || []) if (plugin.rateLimit) {
+		const matchedRule = plugin.rateLimit.find((rule) => rule.pathMatcher(path));
+		if (matchedRule) {
+			currentWindow = matchedRule.window;
+			currentMax = matchedRule.max;
+			break;
+		}
+	}
+	if (ctx.rateLimit.customRules) {
+		const _path = Object.keys(ctx.rateLimit.customRules).find((p) => {
+			if (p.includes("*")) return wildcardMatch(p)(path);
+			return p === path;
+		});
+		if (_path) {
+			const customRule = ctx.rateLimit.customRules[_path];
+			const resolved = typeof customRule === "function" ? await customRule(req, {
+				window: currentWindow,
+				max: currentMax
+			}) : customRule;
+			if (resolved) {
+				currentWindow = resolved.window;
+				currentMax = resolved.max;
+			}
+			if (resolved === false) return null;
+		}
+	}
+	return {
+		key,
+		currentWindow,
+		currentMax
+	};
+}
+async function onRequestRateLimit(req, ctx) {
+	if (!ctx.rateLimit.enabled) return;
+	const config = await resolveRateLimitConfig(req, ctx);
+	if (!config) return;
+	const { key, currentWindow, currentMax } = config;
+	const data = await getRateLimitStorage(ctx, { window: currentWindow }).get(key);
+	if (data && shouldRateLimit(currentMax, currentWindow, data)) return rateLimitResponse(getRetryAfter(data.lastRequest, currentWindow));
+}
+async function onResponseRateLimit(req, ctx) {
+	if (!ctx.rateLimit.enabled) return;
+	const config = await resolveRateLimitConfig(req, ctx);
+	if (!config) return;
+	const { key, currentWindow } = config;
+	const storage = getRateLimitStorage(ctx, { window: currentWindow });
+	const data = await storage.get(key);
+	const now = Date.now();
+	if (!data) await storage.set(key, {
+		key,
+		count: 1,
+		lastRequest: now
+	});
+	else if (now - data.lastRequest > currentWindow * 1e3) await storage.set(key, {
+		...data,
+		count: 1,
+		lastRequest: now
+	}, true);
+	else await storage.set(key, {
+		...data,
+		count: data.count + 1,
+		lastRequest: now
+	}, true);
+}
+function getDefaultSpecialRules() {
+	return [{
+		pathMatcher(path) {
+			return path.startsWith("/sign-in") || path.startsWith("/sign-up") || path.startsWith("/change-password") || path.startsWith("/change-email");
+		},
+		window: 10,
+		max: 3
+	}, {
+		pathMatcher(path) {
+			return path === "/request-password-reset" || path === "/send-verification-email" || path.startsWith("/forget-password") || path === "/email-otp/send-verification-otp" || path === "/email-otp/request-password-reset";
+		},
+		window: 60,
+		max: 3
+	}];
+}
+
+//#endregion
+export { onRequestRateLimit, onResponseRateLimit };
+//# sourceMappingURL=index.mjs.map