@protobase/server 0.25.11 → 0.26.0

package/dist/better-auth/staff-plugin.js

@@ -1,5 +1,5 @@
-import { isRefusedForStaff, isStaffSession, staffCannotChange } from "./staff-checks.js";
 import { adminOnly } from "./admin-only.js";
+import { isRefusedForStaff, isStaffSession, staffCannotChange } from "./staff-checks.js";
 import { endStaffSignIn, listStaffSignIns, staffSignInOfSession, staffSignInSchema } from "./staff-log.js";
 import { staffSignInEndpoints } from "./staff-sign-in-endpoints.js";
 import { APIError, createAuthEndpoint, createAuthMiddleware, getSessionFromCtx, sessionMiddleware } from "better-auth/api";

package/dist/better-auth/staff-sign-in-endpoints.js

@@ -1,9 +1,9 @@
-import { reasonProblem, staffClaimsRefusal, staffLabel } from "./staff-checks.js";
-import { operatorClient, randomValue } from "./operator-provider.js";
-import { sendAuthEmail } from "./auth-mail/send-auth-email.js";
 import { effectiveSignInPolicy } from "./sign-in-policy.js";
 import { readSignInPolicy } from "./policy-store.js";
 import { policyRefusal, staffSignInPath } from "./sign-in-enforcement.js";
+import { reasonProblem, staffClaimsRefusal, staffLabel } from "./staff-checks.js";
+import { operatorClient, randomValue } from "./operator-provider.js";
+import { sendAuthEmail } from "./auth-mail/send-auth-email.js";
 import { logStaffSignIn } from "./staff-log.js";
 import * as z$1 from "zod";
 import { APIError, createAuthEndpoint } from "better-auth/api";

package/dist/better-auth/status-route.js

@@ -1,6 +1,6 @@
-import { signInPasskeyDomains } from "./passkey-domain.js";
 import { effectiveSignInPolicy } from "./sign-in-policy.js";
 import { readSignInPolicy } from "./policy-store.js";
+import { signInPasskeyDomains } from "./passkey-domain.js";
 import { roleLabels } from "./roles/role-labels.js";
 import { hasUsers } from "./users.js";
 import { Hono } from "hono";

package/dist/better-auth/user-table.d.ts

@@ -5,6 +5,7 @@ declare const userFields: {
   readonly name: "name";
   readonly email: "email";
   readonly email_verified: "emailVerified";
+  readonly email_confirmed_at: "emailConfirmedAt";
   readonly image: "image";
   readonly created_at: "createdAt";
   readonly updated_at: "updatedAt";

package/dist/better-auth/user-table.js

@@ -4,6 +4,7 @@ const userFields = {
 	name: "name",
 	email: "email",
 	email_verified: "emailVerified",
+	email_confirmed_at: "emailConfirmedAt",
 	image: "image",
 	created_at: "createdAt",
 	updated_at: "updatedAt",

package/dist/better-auth/users/user-endpoints.js

@@ -1,6 +1,6 @@
+import { adminOnly } from "../admin-only.js";
 import { invitationLink, invitationToken } from "../invitations/invitation-token.js";
 import { sendAuthEmail } from "../auth-mail/send-auth-email.js";
-import { adminOnly } from "../admin-only.js";
 import { createAppInvitation, deleteAppInvitation, listAppInvitations } from "./app-invitation-store.js";
 import { roleLabels } from "../roles/role-labels.js";
 import * as z$1 from "zod";

package/dist/create-admin.d.ts

@@ -13,6 +13,8 @@ import { FunctionSource } from "./functions/define-function.js";
 import { AdminOptions } from "./admin-options.js";
 import { BottomBarSource, UserMenuSource } from "@protobase/schema";
 import { Db } from "@protobase/query";
+import { JWTPayload } from "jose";
+import { UpgradeWebSocket } from "hono/ws";
 //#region src/create-admin.d.ts
 export type CreateAdminInput = {
   resources: ResourceSource[];
@@ -58,7 +60,14 @@ export type CreateAdminInput = {
   formsDifficulty?: Difficulty;
   /** @internal The users comments name, mention and mail, which tests fake; from `auth` otherwise. */
   commentUsers?: CommentUsers;
+  /** @internal Verifies a user's token on `/realtime/v1` and gives its claims, which tests fake; `auth`'s tokens otherwise. */
+  verifyToken?: (token: string) => Promise<JWTPayload>;
+  /**
+   * The host's WebSocket upgrade, such as `@hono/node-server`'s, with which an app with keys and live resources serves
+   * supabase-js's Realtime at `/realtime/v1/websocket`; without it, the app serves none.
+   */
+  upgradeWebSocket?: UpgradeWebSocket;
 };
 /** The admin REST API as a Hono app. It uses only Web APIs, so it runs on Node, Workers and anywhere else Hono does. */
-export declare const createAdmin: ({ resources: appResources, views: appViews, pages, userMenu, bottomBars, db, authenticate, auth, functions, files: filesOptions, events, history: historyOptions, jobs, subscriptions, webhooks: webhooksOptions, bundlePlugins, fieldTypes, options, formsDifficulty, commentUsers: givenCommentUsers }: CreateAdminInput) => Admin;
+export declare const createAdmin: ({ resources: appResources, views: appViews, pages, userMenu, bottomBars, db, authenticate, auth, functions, files: filesOptions, events, history: historyOptions, jobs, subscriptions, webhooks: webhooksOptions, bundlePlugins, fieldTypes, options, formsDifficulty, commentUsers: givenCommentUsers, verifyToken, upgradeWebSocket }: CreateAdminInput) => Admin;
 //#endregion

package/dist/create-admin.js

@@ -1,5 +1,6 @@
 import { aiModel } from "./ai/ai-model.js";
 import { hasAiActions, hasAiFields } from "./ai/ai-fields.js";
+import { unauthorized } from "./problem.js";
 import { fillHook } from "./ai/fill-hook.js";
 import { createErrorHandler } from "./error-handler.js";
 import { isCaptured } from "./changes/capture-sql.js";
@@ -10,10 +11,17 @@ import { builtInAssistant } from "./assistant/built-in-assistant.js";
 import { consoleAuditQueue } from "./audit/console-queue.js";
 import { webauthnPath } from "./better-auth/origins.js";
 import { apiCors, readCorsOrigins } from "./api-cors.js";
+import { apiKeySettings } from "./api-keys/api-key-settings.js";
+import { apiKeyCaller } from "./api-keys/resolve-caller.js";
+import { jwtVerifier } from "./auth/jwt.js";
 import { readAppName } from "./app-name.js";
+import { goTruePath } from "./gotrue/keys.js";
 import { authBasePath } from "./better-auth/auth-base-path.js";
+import { betterAuthTokens } from "./better-auth/authenticator.js";
+import { realtimeApp } from "./realtime/realtime-app.js";
 import { organizationRoutes } from "./better-auth/organizations/admin-routes.js";
 import { statusRoute } from "./better-auth/status-route.js";
+import { goTrueRoutes } from "./gotrue/routes.js";
 import { changesSchema } from "./changes/events-options.js";
 import { appOrigin } from "./comments/app-origin.js";
 import { betterAuthActorNames } from "./history/actor-names.js";
@@ -66,7 +74,7 @@ const declaredRoles = (auth, roles) => {
 	return names.length > 0 ? [...new Set(names)] : void 0;
 };
 /** The admin REST API as a Hono app. It uses only Web APIs, so it runs on Node, Workers and anywhere else Hono does. */
-const createAdmin = ({ resources: appResources, views: appViews = [], pages = [], userMenu, bottomBars = [], db, authenticate, auth, functions = {}, files: filesOptions, events, history: historyOptions, jobs = [], subscriptions = [], webhooks: webhooksOptions, bundlePlugins = [], fieldTypes = {}, options = {}, formsDifficulty, commentUsers: givenCommentUsers }) => {
+const createAdmin = ({ resources: appResources, views: appViews = [], pages = [], userMenu, bottomBars = [], db, authenticate, auth, functions = {}, files: filesOptions, events, history: historyOptions, jobs = [], subscriptions = [], webhooks: webhooksOptions, bundlePlugins = [], fieldTypes = {}, options = {}, formsDifficulty, commentUsers: givenCommentUsers, verifyToken, upgradeWebSocket }) => {
 	const basePath = options.basePath ?? "/api/v1";
 	const appModels = appResources.map((resource) => resource.toModel());
 	const withComments = appModels.some((model) => model.comments);
@@ -125,6 +133,7 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 		resources: registry.entries.map((entry) => entry.name),
 		pages: pageModels.map((entry) => entry.name)
 	});
+	const apiKeys = apiKeySettings(options.apiKeys, globalThis.process?.env ?? {});
 	const files = createFilesRuntime({
 		...filesOptions && { options: filesOptions },
 		env: globalThis.process?.env ?? {},
@@ -233,6 +242,7 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 			db
 		}));
 		app.on(["GET", "POST"], `${authBasePath}/*`, (c) => auth.handler(c.req.raw));
+		app.route(goTruePath, goTrueRoutes(auth));
 		if (auth.origins.length > 1) app.get(webauthnPath, (c) => c.json({ origins: auth.origins }));
 	}
 	if (assistant?.kind === "built-in") {
@@ -261,12 +271,26 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 	app.route("/", fileRoutes(deps, authenticate));
 	if (forms) app.route(`${systemPath}/forms`, formRoutes(deps, forms));
 	if (appModels.some((model) => model.live)) {
+		const report = options.onUnhandledError ?? ((error) => console.error(error));
 		const feed = tableFeed({
 			db,
 			schema: changes,
-			report: options.onUnhandledError ?? ((error) => console.error(error))
+			report
 		});
 		app.route(systemPath || "/", guarded((live) => void live.route("/", liveRoutes(feed, (session) => visibleNotices(deps, session))), withAnonymous(authenticate, options.roles)));
+		if (upgradeWebSocket && (apiKeys.publishable || apiKeys.secret)) {
+			const verify = verifyToken ?? (auth ? jwtVerifier(betterAuthTokens({ auth })) : () => Promise.reject(unauthorized("This app signs no user tokens")));
+			app.route("/realtime/v1", realtimeApp({
+				deps,
+				feed,
+				upgradeWebSocket,
+				caller: apiKeyCaller({
+					keys: apiKeys,
+					verify
+				}),
+				report
+			}));
+		}
 	}
 	app.route(basePath, api);
 	app.route(`${deps.systemPath}/meta`, metaApp);

package/dist/gotrue/access-tokens.js

@@ -0,0 +1,15 @@
+import { goTrueAlgorithm, goTrueAudience, goTrueIssuer, goTrueKeys } from "./keys.js";
+import { cachedKeys } from "../better-auth/jwks-cache.js";
+//#region src/gotrue/access-tokens.ts
+/**
+* How the tokens of the GoTrue-compatible endpoints verify, read from the auth instance: for `jwtVerifier`, such as
+* `apiKeyCaller({ keys, verify: jwtVerifier(goTrueTokens({ auth })) })`.
+*/
+const goTrueTokens = ({ auth, cache }) => ({
+	keys: cachedKeys(async () => goTrueKeys(await auth.api.getJwks()), cache),
+	issuer: goTrueIssuer(auth.issuer),
+	audience: goTrueAudience,
+	algorithms: [goTrueAlgorithm]
+});
+//#endregion
+export { goTrueTokens };

package/dist/gotrue/auth-codes.js

@@ -0,0 +1,33 @@
+import { hashOf } from "../better-auth/sign-up/sign-up-code.js";
+import { GoTrueError } from "./errors.js";
+import { generateRandomString } from "better-auth/crypto";
+//#region src/gotrue/auth-codes.ts
+const codeSeconds = 300;
+const identifierOf = async (code) => `gotrue-auth-code-${await hashOf(code)}`;
+const base64url = (bytes) => btoa(String.fromCharCode(...new Uint8Array(bytes))).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
+/** Whether `verifier` is the one `challenge` was made from: its SHA-256 in base64url for `s256`, itself for `plain`. */
+const matchesChallenge = async (verifier, { challenge, method }) => method === "plain" ? verifier === challenge : base64url(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier))) === challenge;
+/** A new code that signs in `userId` for whoever holds the verifier of `challenge`. */
+const issueAuthCode = async (context, userId, challenge) => {
+	const code = generateRandomString(32);
+	await context.internalAdapter.createVerificationValue({
+		identifier: await identifierOf(code),
+		value: JSON.stringify({
+			userId,
+			...challenge
+		}),
+		expiresAt: new Date(Date.now() + codeSeconds * 1e3)
+	});
+	return code;
+};
+const invalidGrant = () => new GoTrueError(400, "flow_state_not_found", "invalid flow state, no valid flow state found");
+/** Takes `code`, so it works once, and answers its user when `verifier` matches its challenge. */
+const takeAuthCode = async (context, code, verifier) => {
+	const consumed = await context.internalAdapter.consumeVerificationValue(await identifierOf(code));
+	if (!consumed || new Date(consumed.expiresAt) < /* @__PURE__ */ new Date()) throw invalidGrant();
+	const { userId, ...challenge } = JSON.parse(consumed.value);
+	if (!await matchesChallenge(verifier, challenge)) throw new GoTrueError(400, "bad_code_verifier", "code challenge does not match previously saved code verifier");
+	return userId;
+};
+//#endregion
+export { issueAuthCode, matchesChallenge, takeAuthCode };

package/dist/gotrue/bearer.js

@@ -0,0 +1,22 @@
+import { GoTrueError } from "./errors.js";
+import { errors, jwtVerify } from "jose";
+//#region src/gotrue/bearer.ts
+/**
+* Reads the signed-in user's access token from `Authorization: Bearer`, verified with the keys, issuer and audience of `goTrueTokens`:
+* its user and session. Without one, GoTrue's `no_authorization`; one that does not verify is `bad_jwt`.
+*/
+const accessClaimsOf = ({ keys, ...expected }) => async (request) => {
+	const [scheme, token] = (request.headers.get("authorization") ?? "").split(" ");
+	if (scheme?.toLowerCase() !== "bearer" || !token) throw new GoTrueError(401, "no_authorization", "This endpoint requires a valid Bearer token");
+	const { payload } = await jwtVerify(token, keys, expected).catch((error) => {
+		if (error instanceof errors.JOSEError) throw new GoTrueError(403, "bad_jwt", "invalid JWT: unable to parse or verify signature, token is invalid or expired");
+		throw error;
+	});
+	if (typeof payload.sub !== "string" || typeof payload.session_id !== "string") throw new GoTrueError(403, "bad_jwt", "invalid JWT: it names no user and session");
+	return {
+		sub: payload.sub,
+		session_id: payload.session_id
+	};
+};
+//#endregion
+export { accessClaimsOf };

package/dist/gotrue/deps.js

@@ -0,0 +1,8 @@
+//#region src/gotrue/deps.ts
+const goTrueDeps = (auth) => ({
+	auth,
+	context: () => auth.$context,
+	sessionOf: (sessionToken) => auth.api.goTrueSession({ body: { sessionToken } })
+});
+//#endregion
+export { goTrueDeps };

package/dist/gotrue/email-code-routes.js

@@ -0,0 +1,121 @@
+import { effectiveSignInPolicy } from "../better-auth/sign-in-policy.js";
+import { readSignInPolicy } from "../better-auth/policy-store.js";
+import { checkNewAccountPassword } from "../better-auth/new-account-password.js";
+import { createSignedUpAccount } from "../better-auth/sign-up/sign-up-account.js";
+import { consumeSignUpTicket } from "../better-auth/sign-up/sign-up-ticket.js";
+import { GoTrueError } from "./errors.js";
+import { callBetterAuth, signedInToken } from "./forward.js";
+import { hasPendingSignUp, savePendingSignUp, takePendingSignUp } from "./pending-sign-up.js";
+import { address, readBody } from "./request-body.js";
+import { Hono } from "hono";
+import * as z$1 from "zod";
+//#region src/gotrue/email-code-routes.ts
+const metadata = z$1.record(z$1.string(), z$1.unknown()).default({});
+const signUpBody = z$1.object({
+	email: address,
+	password: z$1.string(),
+	data: metadata
+});
+const otpBody = z$1.object({
+	email: address,
+	create_user: z$1.boolean().default(true),
+	data: metadata
+});
+const verifyBody = z$1.object({
+	email: address.optional(),
+	token: z$1.string().trim().optional(),
+	token_hash: z$1.string().optional(),
+	type: z$1.string()
+});
+const emailBody = z$1.object({ email: address });
+const resendBody = z$1.object({
+	email: address,
+	type: z$1.string()
+});
+const signUpDisabled = () => new GoTrueError(422, "signup_disabled", "Signups not allowed for this instance");
+const nameOf = (email, data) => {
+	const given = data.name ?? data.full_name;
+	return typeof given === "string" && given.trim() ? given.trim() : email.split("@")[0];
+};
+const emailCodeRoutes = ({ auth, context, sessionOf }) => {
+	const checkMetadata = (data) => {
+		if (Object.keys(data).length > 0 && !auth.userMetadata) throw new GoTrueError(400, "validation_failed", "This app keeps no user metadata: leave data out");
+	};
+	const signUpPolicy = async () => effectiveSignInPolicy((await readSignInPolicy((await context()).adapter)).policy, { mail: true });
+	const sendSignUpCode = (request, email) => callBetterAuth(auth, request, "/sign-up/send-code", { email });
+	const sendSignInCode = (request, email) => callBetterAuth(auth, request, "/email-otp/send-verification-otp", {
+		email,
+		type: "sign-in"
+	});
+	const signInWithCode = async (request, email, code) => {
+		const { json } = await callBetterAuth(auth, request, "/sign-in/email-otp", {
+			email,
+			otp: code
+		});
+		return sessionOf(signedInToken(json));
+	};
+	const signUpWithCode = async (request, email, code) => {
+		const ctx = await context();
+		if (!auth.signUpRole || !await hasPendingSignUp(ctx, email)) throw new GoTrueError(403, "otp_expired", "Token has expired or is invalid");
+		const { json } = await callBetterAuth(auth, request, "/sign-up/verify-code", {
+			email,
+			code
+		});
+		await consumeSignUpTicket(ctx, String(json.ticket));
+		const pending = await takePendingSignUp(ctx, email);
+		if (!pending) throw new GoTrueError(403, "otp_expired", "Token has expired or is invalid");
+		const { passwordHash, metadata } = pending;
+		const user = await createSignedUpAccount(ctx, {
+			email,
+			name: nameOf(email, metadata),
+			role: auth.signUpRole,
+			...passwordHash !== void 0 && { passwordHash },
+			...Object.keys(metadata).length > 0 && { metadata }
+		});
+		return sessionOf((await ctx.internalAdapter.createSession(user.id)).token);
+	};
+	return new Hono().post("/signup", async (c) => {
+		const { email, password, data } = await readBody(c.req.raw, signUpBody);
+		if (!auth.signUp) throw signUpDisabled();
+		checkMetadata(data);
+		checkNewAccountPassword(await signUpPolicy(), password);
+		await sendSignUpCode(c.req.raw, email);
+		await savePendingSignUp(await context(), email, {
+			passwordHash: await (await context()).password.hash(password),
+			metadata: data
+		});
+		return c.json({});
+	}).post("/otp", async (c) => {
+		const { email, create_user, data } = await readBody(c.req.raw, otpBody);
+		if (!(create_user && auth.signUp && !await (await context()).internalAdapter.findUserByEmail(email))) {
+			await sendSignInCode(c.req.raw, email);
+			return c.json({});
+		}
+		checkMetadata(data);
+		checkNewAccountPassword(await signUpPolicy(), void 0);
+		await sendSignUpCode(c.req.raw, email);
+		await savePendingSignUp(await context(), email, { metadata: data });
+		return c.json({});
+	}).post("/verify", async (c) => {
+		const { email, token, token_hash, type } = await readBody(c.req.raw, verifyBody);
+		if (token_hash !== void 0 || email === void 0 || !token) throw new GoTrueError(400, "validation_failed", "Send the email address and the code mailed to it: links are not offered");
+		if (type === "signup") return c.json(await signUpWithCode(c.req.raw, email, token));
+		if (type === "recovery") return c.json(await signInWithCode(c.req.raw, email, token));
+		if (type === "email" || type === "magiclink") {
+			const known = await (await context()).internalAdapter.findUserByEmail(email);
+			return c.json(await (known ? signInWithCode(c.req.raw, email, token) : signUpWithCode(c.req.raw, email, token)));
+		}
+		throw new GoTrueError(400, "validation_failed", `Verify type ${type} is not offered: use email, signup or recovery`);
+	}).post("/recover", async (c) => {
+		const { email } = await readBody(c.req.raw, emailBody);
+		await sendSignInCode(c.req.raw, email);
+		return c.json({});
+	}).post("/resend", async (c) => {
+		const { email, type } = await readBody(c.req.raw, resendBody);
+		if (type !== "signup") throw new GoTrueError(400, "validation_failed", `Resend type ${type} is not offered: use signup`);
+		if (auth.signUp && await hasPendingSignUp(await context(), email)) await sendSignUpCode(c.req.raw, email);
+		return c.json({});
+	});
+};
+//#endregion
+export { emailCodeRoutes };

package/dist/gotrue/errors.js

@@ -0,0 +1,52 @@
+import { APIError } from "better-auth/api";
+//#region src/gotrue/errors.ts
+/** A refusal as GoTrue words it: an HTTP status, one of its error codes, and a message for people. */
+var GoTrueError = class extends Error {
+	status;
+	errorCode;
+	constructor(status, errorCode, message) {
+		super(message);
+		this.status = status;
+		this.errorCode = errorCode;
+	}
+};
+/** The JSON GoTrue answers a refusal with; supabase-js reads `error_code` and `msg` from it. */
+const errorBody = (error) => ({
+	code: error.status,
+	error_code: error.errorCode,
+	msg: error.message
+});
+const invalidCode = [
+	403,
+	"otp_expired",
+	"Token has expired or is invalid"
+];
+const known = {
+	INVALID_EMAIL_OR_PASSWORD: [
+		400,
+		"invalid_credentials",
+		"Invalid login credentials"
+	],
+	INVALID_OTP: invalidCode,
+	OTP_EXPIRED: invalidCode,
+	TOO_MANY_ATTEMPTS: invalidCode,
+	SIGN_UP_CODE_INVALID: invalidCode,
+	SIGN_UP_TICKET_INVALID: invalidCode,
+	BANNED_USER: [403, "user_banned"],
+	NO_ADMIN_YET: [422, "signup_disabled"],
+	PASSWORD_LENGTH: [422, "weak_password"],
+	PASSWORD_REQUIRED: [422, "weak_password"]
+};
+/** A refusal of Better Auth, by its status and body, as GoTrue's: a known code becomes GoTrue's, any other its own in lower case. */
+const fromBetterAuth = (status, body) => {
+	const code = typeof body?.code === "string" ? body.code : void 0;
+	const message = typeof body?.message === "string" ? body.message : "The request was refused";
+	if (status === 429) return new GoTrueError(429, "over_request_rate_limit", message);
+	const mapped = code === void 0 ? void 0 : known[code];
+	if (mapped) return new GoTrueError(mapped[0], mapped[1], mapped[2] ?? message);
+	return new GoTrueError(status, code?.toLowerCase() ?? (status >= 500 ? "unexpected_failure" : "bad_request"), message);
+};
+/** A Better Auth `APIError` as GoTrue's refusal; any other error as it is. */
+const asGoTrueError = (error) => error instanceof APIError ? fromBetterAuth(error.statusCode, error.body) : error;
+//#endregion
+export { GoTrueError, asGoTrueError, errorBody, fromBetterAuth };

package/dist/gotrue/forward.js

@@ -0,0 +1,45 @@
+import { authBasePath } from "../better-auth/auth-base-path.js";
+import { GoTrueError, fromBetterAuth } from "./errors.js";
+//#region src/gotrue/forward.ts
+const withheld = [
+	"cookie",
+	"authorization",
+	"origin",
+	"referer",
+	"content-length",
+	"content-type"
+];
+const parsed = (text) => text ? JSON.parse(text) : void 0;
+/**
+* Posts `body` to Better Auth's endpoint at `path`, such as `/sign-in/email`, for the client's `request`: with its
+* other headers, so the rate limits and the session made count the client's address and agent. Answers the endpoint's
+* JSON and headers; a refusal is thrown as GoTrue's.
+*/
+const callBetterAuth = async (auth, request, path, body) => {
+	const headers = new Headers(request.headers);
+	for (const name of withheld) headers.delete(name);
+	const origin = new URL(request.url).origin;
+	headers.set("content-type", "application/json");
+	headers.set("origin", origin);
+	const response = await auth.handler(new Request(`${origin}${authBasePath}${path}`, {
+		method: "POST",
+		headers,
+		body: JSON.stringify(body)
+	}));
+	const json = parsed(await response.text());
+	if (!response.ok) throw fromBetterAuth(response.status, json);
+	return {
+		json: json ?? {},
+		headers: response.headers
+	};
+};
+/**
+* The session token a Better Auth sign-in answers. Someone with two-factor authentication gets none yet, only the
+* second step, which is not offered here: GoTrue's `insufficient_aal`.
+*/
+const signedInToken = (json) => {
+	if (typeof json.token !== "string") throw new GoTrueError(403, "insufficient_aal", "This account signs in with a second factor, which is not offered here");
+	return json.token;
+};
+//#endregion
+export { callBetterAuth, signedInToken };

package/dist/gotrue/keys.js

@@ -0,0 +1,14 @@
+//#region src/gotrue/keys.ts
+/** Where the GoTrue-compatible endpoints are served, below the app's origin. */
+const goTruePath = "/auth/v1";
+/** The key pair the JWT plugin keeps beside its EdDSA one for these tokens; it makes it on the first token. */
+const goTrueKeyPair = { alg: "ES256" };
+const goTrueAlgorithm = goTrueKeyPair.alg;
+/** The audience of every such token: the database role a signed-in user's requests run as. */
+const goTrueAudience = "authenticated";
+/** The issuer of the tokens of the app at `baseURL`. */
+const goTrueIssuer = (baseURL) => `${baseURL.replace(/\/+$/, "")}${goTruePath}`;
+/** The keys of the JWT plugin's key set that sign these tokens. */
+const goTrueKeys = (set) => ({ keys: set.keys.filter((key) => key.alg === goTrueAlgorithm) });
+//#endregion
+export { goTrueAlgorithm, goTrueAudience, goTrueIssuer, goTrueKeyPair, goTrueKeys, goTruePath };

package/dist/gotrue/pending-sign-up.js

@@ -0,0 +1,26 @@
+//#region src/gotrue/pending-sign-up.ts
+const pendingSeconds = 3600;
+const identifierOf = (email) => `gotrue-sign-up-${email}`;
+/** Keeps what `email` signs up with, replacing what an earlier sign-up with it gave. */
+const savePendingSignUp = async (context, email, pending) => {
+	const identifier = identifierOf(email);
+	await context.internalAdapter.deleteVerificationByIdentifier(identifier);
+	await context.internalAdapter.createVerificationValue({
+		identifier,
+		value: JSON.stringify(pending),
+		expiresAt: new Date(Date.now() + pendingSeconds * 1e3)
+	});
+};
+/** Whether a sign-up with `email` waits for its code. */
+const hasPendingSignUp = async (context, email) => {
+	const found = await context.internalAdapter.findVerificationValue(identifierOf(email));
+	return found !== null && new Date(found.expiresAt) > /* @__PURE__ */ new Date();
+};
+/** Takes what `email` signed up with, so it is used once; `undefined` when nothing waits, or it waited too long. */
+const takePendingSignUp = async (context, email) => {
+	const consumed = await context.internalAdapter.consumeVerificationValue(identifierOf(email));
+	if (!consumed || new Date(consumed.expiresAt) < /* @__PURE__ */ new Date()) return void 0;
+	return JSON.parse(consumed.value);
+};
+//#endregion
+export { hasPendingSignUp, savePendingSignUp, takePendingSignUp };

package/dist/gotrue/provider-routes.js

@@ -0,0 +1,79 @@
+import { goTruePath } from "./keys.js";
+import { GoTrueError } from "./errors.js";
+import { callBetterAuth } from "./forward.js";
+import { issueAuthCode } from "./auth-codes.js";
+import { Hono } from "hono";
+//#region src/gotrue/provider-routes.ts
+const challengeOf = (query) => {
+	const challenge = query.code_challenge;
+	if (!challenge) return void 0;
+	const method = (query.code_challenge_method ?? "s256").toLowerCase();
+	if (method !== "s256" && method !== "plain") throw new GoTrueError(400, "validation_failed", "code_challenge_method must be s256 or plain");
+	return {
+		challenge,
+		method
+	};
+};
+const withParams = (url, params, where) => {
+	const target = new URL(url);
+	const values = new URLSearchParams(where === "hash" ? target.hash.slice(1) : target.search);
+	for (const [name, value] of Object.entries(params)) values.set(name, value);
+	target[where] = values.toString();
+	return target.toString();
+};
+const providerRoutes = ({ auth, context, sessionOf }) => {
+	const destination = async (requested, request) => {
+		const own = new URL(request.url).origin;
+		if (requested && URL.canParse(requested) && (await context()).isTrustedOrigin(requested)) return requested;
+		return own;
+	};
+	return new Hono().get("/authorize", async (c) => {
+		const query = c.req.query();
+		const provider = query.provider ?? "";
+		if (!auth.socialProviders.includes(provider)) throw new GoTrueError(400, "validation_failed", `Unsupported provider: ${provider || "none"} is not one of this app's`);
+		const challenge = challengeOf(query);
+		const callback = new URL(`${goTruePath}/callback`, c.req.url);
+		callback.searchParams.set("redirect_to", await destination(query.redirect_to, c.req.raw));
+		if (challenge) {
+			callback.searchParams.set("code_challenge", challenge.challenge);
+			callback.searchParams.set("code_challenge_method", challenge.method);
+		}
+		const { json, headers } = await callBetterAuth(auth, c.req.raw, "/sign-in/social", {
+			provider,
+			callbackURL: callback.toString(),
+			errorCallbackURL: callback.toString(),
+			disableRedirect: true,
+			...query.scopes && { scopes: query.scopes.split(/[\s,]+/).filter(Boolean) }
+		});
+		const response = c.redirect(String(json.url), 302);
+		for (const cookie of headers.getSetCookie()) response.headers.append("set-cookie", cookie);
+		return response;
+	}).get("/callback", async (c) => {
+		const query = c.req.query();
+		const target = await destination(query.redirect_to, c.req.raw);
+		const challenge = challengeOf(query);
+		const where = challenge ? "search" : "hash";
+		const signedIn = !query.error && await auth.api.getSession({ headers: c.req.raw.headers });
+		if (!signedIn) {
+			const error = query.error ?? "access_denied";
+			return c.redirect(withParams(target, {
+				error,
+				error_code: error,
+				error_description: query.error_description ?? "The sign-in with the provider did not complete"
+			}, where), 302);
+		}
+		const ctx = await context();
+		if (challenge) return c.redirect(withParams(target, { code: await issueAuthCode(ctx, signedIn.user.id, challenge) }, "search"), 302);
+		const session = await sessionOf((await ctx.internalAdapter.createSession(signedIn.user.id)).token);
+		const fragment = {
+			access_token: session.access_token,
+			token_type: "bearer",
+			expires_in: String(session.expires_in),
+			expires_at: String(session.expires_at),
+			refresh_token: session.refresh_token
+		};
+		return c.redirect(withParams(target, fragment, "hash"), 302);
+	});
+};
+//#endregion
+export { providerRoutes };

package/dist/gotrue/request-body.js

@@ -0,0 +1,22 @@
+import { GoTrueError } from "./errors.js";
+import * as z$1 from "zod";
+//#region src/gotrue/request-body.ts
+/** An address as GoTrue takes it: trimmed and in lower case. */
+const address = z$1.string().trim().toLowerCase().pipe(z$1.email());
+const parsedJson = (text) => {
+	try {
+		return text ? JSON.parse(text) : {};
+	} catch (error) {
+		if (error instanceof SyntaxError) throw new GoTrueError(400, "bad_json", "Could not parse request body as JSON");
+		throw error;
+	}
+};
+/** The request's JSON body as `schema` reads it; anything else is GoTrue's `validation_failed`, naming the field. */
+const readBody = async (request, schema) => {
+	const result = schema.safeParse(parsedJson(await request.text()));
+	if (result.success) return result.data;
+	const [issue] = result.error.issues;
+	throw new GoTrueError(400, "validation_failed", issue ? `${issue.path.join(".") || "body"}: ${issue.message}` : "The request body is not valid");
+};
+//#endregion
+export { address, readBody };

package/dist/gotrue/routes.js

@@ -0,0 +1,32 @@
+import { goTrueKeys } from "./keys.js";
+import { goTrueDeps } from "./deps.js";
+import { GoTrueError, asGoTrueError, errorBody } from "./errors.js";
+import { emailCodeRoutes } from "./email-code-routes.js";
+import { providerRoutes } from "./provider-routes.js";
+import { tokenRoute } from "./token-route.js";
+import { userRoutes } from "./user-routes.js";
+import { Hono } from "hono";
+//#region src/gotrue/routes.ts
+/**
+* GoTrue's endpoints over Better Auth, for `supabase.auth` and `@supabase/ssr`, to mount at `goTruePath`: sign-in by
+* password, emailed code or a sign-in provider, sign-up with an emailed code, refresh, the user and sign-out, and the
+* keys of the access tokens at `/.well-known/jwks.json`. Every step is Better Auth's own, with its rate limits and the
+* app's sign-in policy; refusals are GoTrue's JSON.
+*/
+const goTrueRoutes = (auth) => {
+	const deps = goTrueDeps(auth);
+	const app = new Hono();
+	app.onError((error, c) => {
+		const refusal = asGoTrueError(error);
+		if (!(refusal instanceof GoTrueError)) throw error;
+		return c.json(errorBody(refusal), refusal.status);
+	});
+	app.get("/.well-known/jwks.json", async (c) => c.json(goTrueKeys(await auth.api.getJwks())));
+	app.route("/", tokenRoute(deps));
+	app.route("/", emailCodeRoutes(deps));
+	app.route("/", userRoutes(deps));
+	app.route("/", providerRoutes(deps));
+	return app;
+};
+//#endregion
+export { goTrueRoutes };