@raybase/core 0.0.2 → 0.3.4

package/dist/auth.js

@@ -0,0 +1,1562 @@
+import { passkey } from "@better-auth/passkey";
+import { genericOAuth } from "better-auth/plugins/generic-oauth";
+import { createAdapter } from "better-auth/adapters";
+import { createAuthMiddleware } from "better-auth/api";
+import { betterAuth, APIError } from "better-auth";
+import { assertNotHostUser, withHostUserRoleCeiling } from "./host-user.js";
+import { emailOTP, magicLink } from "better-auth/plugins";
+import { isRaybaseAdminRole, normalizeStoredAdminRole } from "./admin-role.js";
+import { actorAuditRef, recordAudit } from "./audit.js";
+import { raybaseBetterAuthLogger } from "./auth-logger.js";
+import { runRaybasePasswordSecretLifecycle } from "./auth-password-secret.js";
+import { betterAuthSchema, raybaseSystemTableSql, systemTableSql } from "./auth-schema.js";
+import { doExecutor } from "./db.js";
+import { appUrlForEmail, isRaybaseAuthEmailFeatureEnabled, redactedEmailError, resolveRaybaseAuthEmailConfig, rewriteEmailUrl, sendRaybaseAuthEmail } from "./email.js";
+import { raybaseDevPersonaOperatorRole, resolveRaybaseDevPersonas, resolveRequestedRaybaseDevPersona } from "./local-dev-personas.js";
+import { principalId, principalOnBehalfOf } from "./principal.js";
+import { publicSignupEnabled, raybaseSchema } from "./schema.js";
+import { q, randomId } from "./sql.js";
+import { wallNowIso as nowIso, wallNowMs } from "./clock.js";
+export { raybaseSystemTableSql, systemTableSql };
+const encoder = new TextEncoder();
+const decoder = new TextDecoder();
+export const betterAuthSecretName = "BETTER_AUTH_SECRET";
+export const internalSignupHeader = "x-raybase-internal-signup";
+export const raybaseSignInLinkDefaultExpiresIn = 10 * 60;
+export const raybaseSignInLinkMaximumExpiresIn = 60 * 60;
+const emptySchema = raybaseSchema({});
+const externalProviderIdPattern = /^[a-z0-9][a-z0-9_-]{0,63}$/;
+const pendingExternalAuthCookieName = "raybase.external_auth";
+const pendingExternalAuthTtlSeconds = 10 * 60;
+const passwordSecretLifecycleByAuth = new WeakMap();
+function authDb(env) {
+    return doExecutor(env, emptySchema, []);
+}
+export function resolveRaybaseSignInLinksConfig(config) {
+    const configured = config.auth?.signInLinks;
+    const expiresIn = configured?.expiresIn ?? raybaseSignInLinkDefaultExpiresIn;
+    if (!Number.isInteger(expiresIn) || expiresIn <= 0 || expiresIn > raybaseSignInLinkMaximumExpiresIn) {
+        throw new Error(`auth.signInLinks.expiresIn must be a positive integer no greater than ${raybaseSignInLinkMaximumExpiresIn} seconds`);
+    }
+    return { enabled: configured?.enabled === true, expiresIn };
+}
+export function assertRaybaseExternalProviderId(id) {
+    const normalized = String(id ?? "").trim();
+    if (!externalProviderIdPattern.test(normalized) ||
+        normalized.includes("/") ||
+        normalized.includes("\\") ||
+        normalized.includes(".") ||
+        /\s/.test(normalized) ||
+        /^[a-z][a-z0-9+.-]*:\/\//i.test(normalized)) {
+        throw new Error(`Invalid external auth provider id: ${id}`);
+    }
+    return normalized;
+}
+export function normalizeRaybaseExternalProviderMetadata(providers, runtimeProviders = []) {
+    const runtimeLabels = new Map(runtimeProviders.map((provider) => [assertRaybaseExternalProviderId(provider.id), provider.label]));
+    const seen = new Set();
+    const normalized = [];
+    for (const provider of providers ?? []) {
+        const id = assertRaybaseExternalProviderId(provider.id);
+        if (seen.has(id))
+            throw new Error(`Duplicate external auth provider id: ${id}`);
+        seen.add(id);
+        if (provider.enabled === false)
+            continue;
+        normalized.push({
+            ...provider,
+            id,
+            label: provider.label || runtimeLabels.get(id) || id
+        });
+    }
+    return normalized;
+}
+export function defineRaybaseExternalAuth(runtime) {
+    return runtime;
+}
+function genericOAuthConfig(input) {
+    if (!input)
+        return [];
+    return Array.isArray(input) ? input : input.config;
+}
+function runtimeProviderIds(config) {
+    const ids = new Set();
+    for (const provider of config.providers ?? [])
+        ids.add(assertRaybaseExternalProviderId(provider.id));
+    for (const id of Object.keys(config.socialProviders ?? {}))
+        ids.add(assertRaybaseExternalProviderId(id));
+    for (const provider of genericOAuthConfig(config.genericOAuth))
+        ids.add(assertRaybaseExternalProviderId(String(provider.providerId)));
+    return Array.from(ids);
+}
+export async function resolveRaybaseExternalAuth(env, runtime, request) {
+    if (!runtime)
+        return undefined;
+    const configured = runtime.configure ? await runtime.configure({ env, request }) : {};
+    const providers = [...(runtime.providers ?? []), ...(configured.providers ?? [])];
+    const merged = {
+        ...configured,
+        providers,
+        socialProviders: configured.socialProviders,
+        genericOAuth: configured.genericOAuth
+    };
+    return { ...merged, providerIds: runtimeProviderIds(merged) };
+}
+export function raybaseExternalProviderMetadata(config, externalAuth) {
+    return normalizeRaybaseExternalProviderMetadata(config.auth?.externalProviders, externalAuth?.providers);
+}
+export function isRaybaseExternalProviderConfigured(config, providerId, externalAuth) {
+    const id = assertRaybaseExternalProviderId(providerId);
+    const metadataIds = new Set(raybaseExternalProviderMetadata(config, externalAuth).map((provider) => provider.id));
+    const runtimeIds = new Set(externalAuth?.providerIds ?? []);
+    return metadataIds.has(id) && runtimeIds.has(id);
+}
+// What an account created by public signup starts with, whether it arrived
+// through the email+password form or through an external provider. Roles for a
+// public account are never taken from the provider; a provider only asserts an
+// identity, never an entitlement.
+export function defaultPublicAppRoles() {
+    return normalizeRoles(["user"]);
+}
+/**
+ * Decides whether an external provider may create a brand-new user, and with
+ * what access, for the `user.create.before` database hook.
+ *
+ * Two paths, in this order:
+ *
+ * 1. A pending row (owner setup or invite) minted by
+ *    `/api/auth/raybase/provider/setup`. It carries the roles, the expected
+ *    email and a single-use token, so it always decides when its cookie is
+ *    present — including in public signup mode. A present-but-invalid pending
+ *    cookie still fails as an invite rather than quietly downgrading to a plain
+ *    public account, which also keeps the account-create hook's
+ *    `finalizePendingExternalAuth` from ever meeting a broken pending row.
+ * 2. Public signup, when `auth.signupMode` is `"public"` or
+ *    `"provider-only"`. The visitor arrives with no pending cookie at all and
+ *    gets exactly what `signUpPublicUser` grants: no operator role and the
+ *    default app roles. The provider must be one this app configured, and
+ *    must assert a verified email — the same invariant the pending path
+ *    enforces.
+ */
+export async function resolveProviderUserCreation(input) {
+    const providerId = assertRaybaseExternalProviderId(input.providerId);
+    if (await parsePendingExternalAuthCookie(input.secret, input.request)) {
+        const pending = await validatePendingExternalAuth(input.db, input.secret, input.request, providerId, input.user);
+        return { operatorRole: parsePendingOperatorRole(pending.operatorRole), appRoles: pending.appRolesList, source: "pending" };
+    }
+    if (!publicSignupEnabled(input.config))
+        throw new Error("Provider setup or invite is required");
+    if (!isRaybaseExternalProviderConfigured(input.config, providerId, input.externalAuth)) {
+        throw new Error("External auth provider is not configured");
+    }
+    if (input.user.emailVerified !== true && input.user.emailVerified !== 1)
+        throw new Error("Provider did not verify the email address");
+    if (!String(input.user.email ?? "").trim())
+        throw new Error("Provider email is required");
+    return { operatorRole: null, appRoles: defaultPublicAppRoles(), source: "public" };
+}
+function sqlLikePattern(value, mode) {
+    const text = String(value ?? "").replace(/[\\%_]/g, (char) => `\\${char}`);
+    if (mode === "starts_with")
+        return `${text}%`;
+    if (mode === "ends_with")
+        return `%${text}`;
+    return `%${text}%`;
+}
+function whereSql(where = []) {
+    if (!where.length)
+        return { sql: "", params: [] };
+    const parts = [];
+    const params = [];
+    where.forEach((condition, index) => {
+        const connector = index === 0 ? "" : ` ${condition.connector} `;
+        const field = condition.mode === "insensitive" && typeof condition.value === "string" ? `LOWER(${q(condition.field)})` : q(condition.field);
+        const value = condition.mode === "insensitive" && typeof condition.value === "string" ? condition.value.toLowerCase() : condition.value;
+        switch (condition.operator) {
+            case "eq":
+                if (value === null) {
+                    parts.push(`${connector}${q(condition.field)} IS NULL`);
+                }
+                else {
+                    parts.push(`${connector}${field} = ?`);
+                    params.push(value);
+                }
+                break;
+            case "ne":
+                if (value === null) {
+                    parts.push(`${connector}${q(condition.field)} IS NOT NULL`);
+                }
+                else {
+                    parts.push(`${connector}${field} IS NOT ?`);
+                    params.push(value);
+                }
+                break;
+            case "lt":
+            case "lte":
+            case "gt":
+            case "gte": {
+                const op = condition.operator === "lt" ? "<" : condition.operator === "lte" ? "<=" : condition.operator === "gt" ? ">" : ">=";
+                parts.push(`${connector}${field} ${op} ?`);
+                params.push(value);
+                break;
+            }
+            case "in":
+            case "not_in": {
+                const values = Array.isArray(value) ? value : [];
+                if (!values.length) {
+                    parts.push(`${connector}${condition.operator === "in" ? "0 = 1" : "1 = 1"}`);
+                    break;
+                }
+                parts.push(`${connector}${field} ${condition.operator === "in" ? "IN" : "NOT IN"} (${values.map(() => "?").join(", ")})`);
+                params.push(...values);
+                break;
+            }
+            case "contains":
+            case "starts_with":
+            case "ends_with":
+                parts.push(`${connector}${field} LIKE ? ESCAPE '\\'`);
+                params.push(sqlLikePattern(value, condition.operator));
+                break;
+            default:
+                throw new Error(`Unsupported Better Auth where operator: ${String(condition.operator)}`);
+        }
+    });
+    return { sql: ` WHERE ${parts.join("")}`, params };
+}
+function selectedColumns(select) {
+    return select?.length ? select.map(q).join(", ") : "*";
+}
+function orderSql(sortBy) {
+    if (!sortBy?.field)
+        return "";
+    return ` ORDER BY ${q(sortBy.field)} ${sortBy.direction === "desc" ? "DESC" : "ASC"}`;
+}
+function raybaseBetterAuthAdapter(db) {
+    const findOne = ({ model, where, select }) => {
+        const compiled = whereSql(where);
+        return db.first(`SELECT ${selectedColumns(select)} FROM ${q(model)}${compiled.sql} LIMIT 1`, compiled.params);
+    };
+    const countRows = async ({ model, where }) => {
+        const compiled = whereSql(where);
+        const row = await db.first(`SELECT COUNT(*) AS "count" FROM ${q(model)}${compiled.sql}`, compiled.params);
+        return Number(row?.count ?? 0);
+    };
+    const custom = {
+        async create({ model, data }) {
+            const columns = Object.keys(data);
+            if (!columns.length) {
+                await db.run(`INSERT INTO ${q(model)} DEFAULT VALUES`);
+                return data;
+            }
+            await db.run(`INSERT INTO ${q(model)} (${columns.map(q).join(", ")}) VALUES (${columns.map(() => "?").join(", ")})`, columns.map((column) => data[column]));
+            if (typeof data.id === "string") {
+                return ((await db.first(`SELECT * FROM ${q(model)} WHERE "id" = ?`, [data.id])) ?? data);
+            }
+            return data;
+        },
+        async update({ model, where, update }) {
+            const columns = Object.keys(update);
+            if (!columns.length)
+                return findOne({ model, where });
+            const compiled = whereSql(where);
+            await db.run(`UPDATE ${q(model)} SET ${columns.map((column) => `${q(column)} = ?`).join(", ")}${compiled.sql}`, [
+                ...columns.map((column) => update[column]),
+                ...compiled.params
+            ]);
+            return findOne({ model, where });
+        },
+        async updateMany({ model, where, update }) {
+            const before = await countRows({ model, where });
+            const columns = Object.keys(update);
+            if (!columns.length)
+                return before;
+            const compiled = whereSql(where);
+            await db.run(`UPDATE ${q(model)} SET ${columns.map((column) => `${q(column)} = ?`).join(", ")}${compiled.sql}`, [
+                ...columns.map((column) => update[column]),
+                ...compiled.params
+            ]);
+            return before;
+        },
+        async findOne({ model, where, select }) {
+            return findOne({ model, where, select });
+        },
+        async findMany({ model, where, limit, select, sortBy, offset }) {
+            const compiled = whereSql(where);
+            const params = [...compiled.params, Math.max(1, Math.min(limit ?? 100, 500)), Math.max(offset ?? 0, 0)];
+            return db.all(`SELECT ${selectedColumns(select)} FROM ${q(model)}${compiled.sql}${orderSql(sortBy)} LIMIT ? OFFSET ?`, params);
+        },
+        async delete({ model, where }) {
+            const compiled = whereSql(where);
+            await db.run(`DELETE FROM ${q(model)}${compiled.sql}`, compiled.params);
+        },
+        async deleteMany({ model, where }) {
+            const before = await countRows({ model, where });
+            const compiled = whereSql(where);
+            await db.run(`DELETE FROM ${q(model)}${compiled.sql}`, compiled.params);
+            return before;
+        },
+        async consumeOne({ model, where }) {
+            const compiled = whereSql(where);
+            const row = await db.first(`SELECT rowid AS "__raybaseRowid", * FROM ${q(model)}${compiled.sql} LIMIT 1`, compiled.params);
+            if (!row)
+                return null;
+            await db.run(`DELETE FROM ${q(model)} WHERE rowid = ?`, [row.__raybaseRowid]);
+            delete row.__raybaseRowid;
+            return row;
+        },
+        async count({ model, where }) {
+            return countRows({ model, where });
+        }
+    };
+    return createAdapter({
+        config: {
+            adapterId: "raybase-do",
+            adapterName: "Raybase Durable Object",
+            supportsNumericIds: false,
+            supportsBooleans: false,
+            supportsDates: false,
+            supportsJSON: false,
+            supportsArrays: false,
+            transaction: false
+        },
+        adapter: () => custom
+    });
+}
+export function authSecret(env) {
+    if (env.BETTER_AUTH_SECRET)
+        return env.BETTER_AUTH_SECRET;
+    if (env.RAYBASE_AUTH_SECRET)
+        return env.RAYBASE_AUTH_SECRET;
+    if (env.RAYBASE_ENV === "production") {
+        throw new Error(`${betterAuthSecretName} is required in production`);
+    }
+    return "raybase-local-dev-secret";
+}
+function absoluteBaseUrl(value) {
+    const trimmed = value?.trim();
+    if (!trimmed)
+        return undefined;
+    return trimmed.startsWith("http://") || trimmed.startsWith("https://") ? trimmed : undefined;
+}
+function authBaseUrl(env) {
+    const candidates = [
+        env.BETTER_AUTH_URL,
+        env.PUBLIC_BETTER_AUTH_URL,
+        absoluteBaseUrl(env.BASE_URL)
+    ];
+    for (const candidate of candidates) {
+        const value = candidate?.trim();
+        if (value)
+            return value;
+    }
+    return undefined;
+}
+function secureSocialProviders(providers) {
+    if (!providers)
+        return undefined;
+    return Object.fromEntries(Object.entries(providers).map(([rawId, value]) => {
+        const id = assertRaybaseExternalProviderId(rawId);
+        const secureValue = async () => {
+            const resolved = typeof value === "function" ? await value() : value;
+            if (!resolved)
+                return resolved;
+            return {
+                ...resolved,
+                disableImplicitSignUp: true,
+                disableSignUp: resolved.disableSignUp === true
+            };
+        };
+        return [id, secureValue];
+    }));
+}
+function secureGenericOAuth(config) {
+    return genericOAuthConfig(config).map((provider) => ({
+        ...provider,
+        providerId: assertRaybaseExternalProviderId(String(provider.providerId)),
+        disableImplicitSignUp: true,
+        disableSignUp: provider.disableSignUp === true
+    }));
+}
+function requestFromAuthContext(context) {
+    const candidate = context;
+    return candidate?.request instanceof Request ? candidate.request : undefined;
+}
+function authContextPath(context) {
+    const candidate = context;
+    if (typeof candidate?.path === "string")
+        return candidate.path;
+    const request = requestFromAuthContext(context);
+    return request ? new URL(request.url).pathname.replace(/^\/api\/auth/, "") : "";
+}
+function authContextBody(context) {
+    const candidate = context;
+    return candidate?.body && typeof candidate.body === "object" ? candidate.body : {};
+}
+function authContextParams(context) {
+    const candidate = context;
+    return candidate?.params && typeof candidate.params === "object" ? candidate.params : {};
+}
+function providerIdFromAuthContext(context, account) {
+    if (typeof account?.providerId === "string" && account.providerId !== "credential")
+        return account.providerId;
+    const params = authContextParams(context);
+    const body = authContextBody(context);
+    const path = authContextPath(context);
+    const id = (typeof params.id === "string" && params.id) ||
+        (typeof params.providerId === "string" && params.providerId) ||
+        (typeof body.provider === "string" && body.provider) ||
+        (typeof body.providerId === "string" && body.providerId) ||
+        path.match(/^\/callback\/([^/?#]+)/)?.[1] ||
+        path.match(/^\/oauth2\/callback\/([^/?#]+)/)?.[1] ||
+        null;
+    return id ? assertRaybaseExternalProviderId(id) : null;
+}
+function isProviderUserCreationContext(context) {
+    const path = authContextPath(context);
+    return path.startsWith("/callback/") || path.startsWith("/oauth2/callback/") || path === "/sign-in/social" || path === "/sign-in/oauth2";
+}
+function authForbidden(message) {
+    throw new APIError("FORBIDDEN", { message });
+}
+function raybaseProviderDatabaseHooks(options) {
+    const { env, secret, config, externalAuth } = options;
+    return {
+        user: {
+            create: {
+                before: async (user, context) => {
+                    if (!isProviderUserCreationContext(context))
+                        return;
+                    const providerId = providerIdFromAuthContext(context);
+                    if (!providerId)
+                        return authForbidden("Provider is required");
+                    try {
+                        const creation = await resolveProviderUserCreation({
+                            db: authDb(env),
+                            secret,
+                            config,
+                            externalAuth,
+                            request: requestFromAuthContext(context),
+                            providerId,
+                            user
+                        });
+                        return {
+                            data: {
+                                operatorRole: creation.operatorRole,
+                                appRoles: JSON.stringify(creation.appRoles),
+                                emailVerified: true
+                            }
+                        };
+                    }
+                    catch (error) {
+                        return authForbidden(error instanceof Error ? error.message : "Provider setup or invite is required");
+                    }
+                },
+                // Better Auth's adapter only writes the fields it knows about, so the
+                // roles asked for above never reach the row: the pending path writes
+                // them in `finalizePendingExternalAuth`, and public signup writes them
+                // here. This is also the first place the new user's id exists, so it is
+                // where the public-signup counterpart of `auth.signup.public` is
+                // recorded — the pending path has its own `owner.setup.provider` /
+                // `invite.accept.provider` event.
+                after: async (user, context) => {
+                    if (!isProviderUserCreationContext(context))
+                        return;
+                    const providerId = providerIdFromAuthContext(context);
+                    if (!providerId)
+                        return;
+                    if (await parsePendingExternalAuthCookie(secret, requestFromAuthContext(context)))
+                        return;
+                    const userId = String(user.id ?? "");
+                    if (!userId)
+                        return;
+                    const db = authDb(env);
+                    await setUserAccessRoles(db, userId, null, defaultPublicAppRoles());
+                    await audit(db, userId, "auth.signup.public.provider", "user", userId, { providerId });
+                }
+            }
+        },
+        account: {
+            create: {
+                after: async (account, context) => {
+                    const providerId = providerIdFromAuthContext(context, account);
+                    if (!providerId || providerId === "credential")
+                        return;
+                    const request = requestFromAuthContext(context);
+                    const db = authDb(env);
+                    const userId = String(account.userId ?? "");
+                    if (!userId)
+                        return;
+                    const user = await db.first(`SELECT "id", "email", "emailVerified" FROM "_auth_users" WHERE "id" = ?`, [userId]);
+                    if (!user)
+                        return;
+                    const pending = await finalizePendingExternalAuth(db, secret, request, providerId, user, { existingUser: true });
+                    if (!pending) {
+                        await audit(db, user.id, "auth.provider.link", "user", user.id, { providerId });
+                    }
+                }
+            }
+        },
+        session: {
+            create: {
+                before: async (session) => {
+                    const userId = String(session.userId ?? "");
+                    if (!userId)
+                        return;
+                    const row = await authDb(env).first(`SELECT "banned" FROM "_auth_users" WHERE "id" = ?`, [userId]);
+                    if (row?.banned)
+                        return authForbidden("Account disabled");
+                }
+            }
+        }
+    };
+}
+async function passwordLifecycleRequest(auth, request, env, registration) {
+    if (request.method !== "POST")
+        return auth.handler(request);
+    const path = new URL(request.url).pathname.replace(/^\/api\/auth/, "");
+    if (path !== "/change-password" && path !== "/reset-password")
+        return auth.handler(request);
+    let body = {};
+    try {
+        body = await request.clone().json();
+    }
+    catch {
+        return auth.handler(request);
+    }
+    const newPassword = typeof body.newPassword === "string" ? body.newPassword : "";
+    if (!newPassword)
+        return auth.handler(request);
+    let userId = "";
+    let previousPassword;
+    if (path === "/change-password") {
+        previousPassword = typeof body.currentPassword === "string" ? body.currentPassword : undefined;
+        const session = await auth.api.getSession({
+            headers: new Headers(request.headers),
+            query: { disableCookieCache: true }
+        }).catch(() => null);
+        userId = typeof session?.user?.id === "string" ? session.user.id : "";
+    }
+    else {
+        const token = (typeof body.token === "string" && body.token) ||
+            new URL(request.url).searchParams.get("token") ||
+            "";
+        if (token) {
+            const verification = await authDb(env).first(`SELECT "value" FROM "_auth_verifications" WHERE "identifier" = ?`, [`reset-password:${token}`]);
+            userId = verification?.value ?? "";
+        }
+    }
+    const response = await auth.handler(request);
+    if (response.ok && userId) {
+        await runRaybasePasswordSecretLifecycle({
+            db: authDb(env),
+            registration,
+            event: path === "/change-password" ? "password-change" : "password-reset",
+            userId,
+            password: newPassword,
+            ...(path === "/change-password" && previousPassword !== undefined ? { previousPassword } : {}),
+            environment: env.RAYBASE_ENV,
+            signal: request.signal
+        });
+    }
+    return response;
+}
+export function createRaybaseAuth(env, config, options = {}) {
+    const secret = authSecret(env);
+    const baseURL = authBaseUrl(env);
+    const genericOAuthProviders = secureGenericOAuth(options.externalAuth?.genericOAuth);
+    const authEmail = resolveRaybaseAuthEmailConfig(config);
+    const signInLinks = resolveRaybaseSignInLinksConfig(config);
+    const magicLinkEnabled = authEmail?.magicLink.enabled === true || signInLinks.enabled;
+    const emailCodeEnabled = authEmail?.emailCode.enabled === true;
+    const requireEmailVerification = authEmail?.emailVerification.enabled === true && options.skipEmailVerification !== true;
+    const emailAndPassword = {
+        enabled: true,
+        minPasswordLength: 10,
+        requireEmailVerification,
+        ...(authEmail?.passwordReset.enabled
+            ? {
+                async sendResetPassword(input, request) {
+                    const email = String(input.user.email ?? "").toLowerCase();
+                    const resetUrl = `${appUrlForEmail(config, request)}/reset-password?token=${encodeURIComponent(input.token)}`;
+                    queueAuthEmail(sendRaybaseAuthEmail(env, config, "passwordReset", { to: email, resetUrl }, { isLocal: options.isLocal, request }), options, authEmailAuditCallback(env, "auth.email.password_reset", null, "user", userIdFromRecord(input.user)));
+                }
+            }
+            : {})
+    };
+    const emailVerification = authEmail?.emailVerification.enabled === true && options.skipEmailVerification !== true
+        ? {
+            sendOnSignUp: true,
+            sendOnSignIn: true,
+            autoSignInAfterVerification: true,
+            expiresIn: authEmail.emailVerification.expiresIn,
+            async sendVerificationEmail(input, request) {
+                const email = String(input.user.email ?? "").toLowerCase();
+                const verifyUrl = `${appUrlForEmail(config, request)}/verify-email?token=${encodeURIComponent(input.token)}`;
+                queueAuthEmail(sendRaybaseAuthEmail(env, config, "emailVerification", { to: email, verifyUrl }, { isLocal: options.isLocal, request }), options, authEmailAuditCallback(env, "auth.email.verification", null, "user", userIdFromRecord(input.user)));
+            }
+        }
+        : undefined;
+    const plugins = [
+        raybaseSignupGuard(secret),
+        ...(magicLinkEnabled ? [raybaseMagicLinkExistingUserGuard(env)] : []),
+        ...(signInLinks.enabled && authEmail?.magicLink.enabled !== true ? [raybaseRuntimeMagicLinkCreationGuard()] : []),
+        ...(emailCodeEnabled ? [raybaseEmailCodeSignInOnlyGuard()] : []),
+        passkey({
+            rpName: config.appName,
+            schema: {
+                passkey: {
+                    modelName: betterAuthSchema.passkey
+                }
+            },
+            authenticatorSelection: {
+                residentKey: "preferred",
+                userVerification: "preferred"
+            }
+        })
+    ];
+    if (magicLinkEnabled) {
+        plugins.push(magicLink({
+            disableSignUp: true,
+            expiresIn: authEmail?.magicLink.enabled === true ? authEmail.magicLink.expiresIn : signInLinks.expiresIn,
+            async sendMagicLink(input, ctx) {
+                if (authEmail?.magicLink.enabled !== true)
+                    return;
+                const user = await getUserByEmail(authDb(env), input.email);
+                if (!user || user.disabled)
+                    return;
+                queueAuthEmail(sendRaybaseAuthEmail(env, config, "magicLink", { to: user.email, signInUrl: rewriteEmailUrl(input.url, config, ctx?.request) }, { isLocal: options.isLocal, request: ctx?.request }), options, authEmailAuditCallback(env, "auth.email.magic_link", null, "user", user.id));
+            }
+        }));
+    }
+    if (emailCodeEnabled) {
+        plugins.push(emailOTP({
+            // Core has no guest concept: a code signs in an account that already
+            // exists, exactly as the magic link does.
+            disableSignUp: true,
+            ...(authEmail?.emailCode.expiresIn !== undefined ? { expiresIn: authEmail.emailCode.expiresIn } : {}),
+            async sendVerificationOTP(input, ctx) {
+                if (input.type !== "sign-in")
+                    return;
+                const user = await getUserByEmail(authDb(env), input.email);
+                if (!user || user.disabled)
+                    return;
+                queueAuthEmail(sendRaybaseAuthEmail(env, config, "emailCode", { to: user.email, code: input.otp }, { isLocal: options.isLocal, request: ctx?.request }), options, authEmailAuditCallback(env, "auth.email.email_code", null, "user", user.id));
+            }
+        }));
+    }
+    if (genericOAuthProviders.length)
+        plugins.push(genericOAuth({ config: genericOAuthProviders }));
+    const auth = betterAuth({
+        appName: config.appName,
+        secret,
+        // The env arrives with the request, so this instance is rebuilt per request.
+        // This logger prints Better Auth's boot diagnostics once per isolate instead
+        // of once per request; everything else passes through untouched.
+        logger: raybaseBetterAuthLogger,
+        ...(baseURL ? { baseURL } : {}),
+        database: raybaseBetterAuthAdapter(authDb(env)),
+        user: {
+            modelName: betterAuthSchema.user
+        },
+        session: {
+            modelName: betterAuthSchema.session
+        },
+        verification: {
+            modelName: betterAuthSchema.verification
+        },
+        emailAndPassword,
+        ...(emailVerification ? { emailVerification } : {}),
+        socialProviders: secureSocialProviders(options.externalAuth?.socialProviders),
+        account: {
+            modelName: betterAuthSchema.account,
+            accountLinking: {
+                enabled: true,
+                disableImplicitLinking: false,
+                requireLocalEmailVerified: true,
+                allowDifferentEmails: false,
+                updateUserInfoOnLink: false
+            }
+        },
+        databaseHooks: raybaseProviderDatabaseHooks({ env, secret, config, externalAuth: options.externalAuth }),
+        plugins: plugins
+    });
+    if (!options.passwordSecretLifecycle)
+        return auth;
+    const wrapped = {
+        api: auth.api,
+        handler: (request) => passwordLifecycleRequest(auth, request, env, options.passwordSecretLifecycle)
+    };
+    passwordSecretLifecycleByAuth.set(wrapped, options.passwordSecretLifecycle);
+    return wrapped;
+}
+export function authEmailConfigured(config) {
+    return Boolean(resolveRaybaseAuthEmailConfig(config));
+}
+export function authEmailFeatureEnabled(config, feature) {
+    return isRaybaseAuthEmailFeatureEnabled(config, feature);
+}
+function raybaseSignupGuard(secret) {
+    return {
+        id: "raybase-signup-guard",
+        version: "0.1.0",
+        hooks: {
+            before: [
+                {
+                    matcher: (ctx) => ctx.path === "/sign-up/email",
+                    handler: createAuthMiddleware(async (ctx) => {
+                        const header = ctx.headers?.get(internalSignupHeader) ?? ctx.request?.headers.get(internalSignupHeader);
+                        if (header === secret)
+                            return;
+                        throw new APIError("FORBIDDEN", { message: "Invite required" });
+                    })
+                }
+            ]
+        }
+    };
+}
+function raybaseMagicLinkExistingUserGuard(env) {
+    return {
+        id: "raybase-magic-link-existing-user-guard",
+        version: "0.1.0",
+        hooks: {
+            before: [
+                {
+                    matcher: (ctx) => ctx.path === "/magic-link/verify",
+                    handler: createAuthMiddleware(async (ctx) => {
+                        const requestUrl = ctx.request?.url;
+                        if (!requestUrl)
+                            return;
+                        const token = new URL(requestUrl).searchParams.get("token");
+                        if (!token)
+                            return;
+                        const db = authDb(env);
+                        const verification = await db.first(`SELECT "value" FROM "_auth_verifications" WHERE "identifier" = ?`, [token]);
+                        if (!verification?.value)
+                            return;
+                        const value = JSON.parse(verification.value);
+                        if (!value.email)
+                            return;
+                        const user = await getUserByEmail(db, value.email);
+                        if (!user || user.disabled) {
+                            throw new APIError("FORBIDDEN", { message: "Magic link sign-in requires an existing invited user" });
+                        }
+                    })
+                }
+            ]
+        }
+    };
+}
+// Better Auth's emailOTP plugin also mounts code-based password reset, email
+// change and email verification. `auth.email.emailCode` promises one thing —
+// signing in with a code — so the rest of the plugin's surface is closed rather
+// than left half-wired to templates that do not exist. The deprecated
+// `/forget-password/email-otp` alias sits outside the `/email-otp/` prefix, so
+// the prefix alone would leave one way in.
+function raybaseEmailCodeSignInOnlyGuard() {
+    return {
+        id: "raybase-email-code-sign-in-only-guard",
+        version: "0.1.0",
+        hooks: {
+            before: [
+                {
+                    matcher: (ctx) => ctx.path?.startsWith("/email-otp/") === true || ctx.path === "/forget-password/email-otp",
+                    handler: createAuthMiddleware(async (ctx) => {
+                        const type = ctx.body?.type;
+                        if (ctx.path === "/email-otp/send-verification-otp" && type === "sign-in")
+                            return;
+                        throw new APIError("FORBIDDEN", { message: "Email codes are only for signing in" });
+                    })
+                }
+            ]
+        }
+    };
+}
+function raybaseRuntimeMagicLinkCreationGuard() {
+    return {
+        id: "raybase-runtime-magic-link-creation-guard",
+        version: "0.1.0",
+        hooks: {
+            before: [
+                {
+                    matcher: (ctx) => ctx.path === "/sign-in/magic-link",
+                    handler: createAuthMiddleware(async () => {
+                        throw new APIError("FORBIDDEN", { message: "Email magic-link sign-in is not enabled" });
+                    })
+                }
+            ]
+        }
+    };
+}
+function authEmailAuditCallback(env, baseAction, actorId, targetType, targetId, metadata = {}) {
+    return async (outcome) => {
+        const details = outcome.status === "failed"
+            ? { error: redactedEmailError(outcome.error) }
+            : outcome.result.status === "skipped"
+                ? { skippedLocal: true, request: outcome.result.requestSummary }
+                : { request: outcome.result.requestSummary, response: outcome.result.responseSummary };
+        await audit(authDb(env), actorId, `${baseAction}.${outcome.status}`, targetType, targetId ?? undefined, {
+            provider: outcome.status === "failed" ? "unknown" : String(outcome.result.requestSummary.provider ?? "cloudflare"),
+            ...metadata,
+            ...details
+        }).catch(() => undefined);
+    };
+}
+function userIdFromRecord(user) {
+    return typeof user.id === "string" && user.id ? user.id : null;
+}
+function queueAuthEmail(task, options, onSettled) {
+    const queued = { task, onSettled };
+    if (options.emailQueue) {
+        options.emailQueue.push(queued);
+    }
+    else {
+        void settleQueuedAuthEmail(queued);
+    }
+}
+export async function settleQueuedAuthEmail(queued) {
+    try {
+        const result = await queued.task;
+        await queued.onSettled?.({ status: result.status === "skipped" ? "skipped" : "sent", result });
+    }
+    catch (error) {
+        console.warn("Raybase email delivery failed.", redactedEmailError(error));
+        await queued.onSettled?.({ status: "failed", error });
+    }
+}
+export async function getRaybaseSession(request, env, config) {
+    const auth = createRaybaseAuth(env, config);
+    const session = await auth.api.getSession({
+        headers: new Headers(request.headers),
+        query: { disableCookieCache: true }
+    });
+    if (!session?.user || !session.session)
+        return null;
+    const user = await resolveUser(authDb(env), toRaybaseUser(session.user));
+    if (user.disabled)
+        return null;
+    return { user, principal: { identity: user }, session: session.session };
+}
+export function toRaybaseUser(user) {
+    return withHostUserRoleCeiling({
+        id: String(user.id),
+        email: String(user.email ?? ""),
+        name: String(user.name ?? user.email ?? ""),
+        operatorRole: null,
+        appRoles: parseStoredAppRoles(user.appRoles),
+        emailVerified: user.emailVerified === true || user.emailVerified === 1,
+        disabled: Boolean(user.banned)
+    });
+}
+export function normalizeRoles(roles) {
+    const normalized = roles.map((role) => String(role ?? "").trim()).filter(Boolean);
+    return Array.from(new Set(["user", ...normalized]));
+}
+export function defaultOwnerAppRoles(config) {
+    return normalizeRoles(["owner", ...(config.roles ?? [])]);
+}
+export function parseStoredAppRoles(value) {
+    if (Array.isArray(value))
+        return normalizeRoles(value);
+    if (typeof value !== "string" || !value.trim())
+        return ["user"];
+    try {
+        const parsed = JSON.parse(value);
+        if (Array.isArray(parsed))
+            return normalizeRoles(parsed);
+    }
+    catch {
+        return normalizeRoles(value.split(","));
+    }
+    return normalizeRoles([value]);
+}
+async function resolveUser(db, identity) {
+    const row = await db.first(`SELECT "id", "email", "name", "emailVerified", "operatorRole", "appRoles", "banned" FROM "_auth_users" WHERE "id" = ?`, [identity.id]);
+    if (!row)
+        return identity;
+    const operatorRole = normalizeStoredAdminRole(row.operatorRole);
+    const appRoles = row.appRoles ? parseStoredAppRoles(row.appRoles) : normalizeRoles(["user"]);
+    return withHostUserRoleCeiling({
+        id: row.id,
+        email: row.email,
+        name: row.name,
+        operatorRole,
+        appRoles,
+        emailVerified: row.emailVerified === true || row.emailVerified === 1,
+        disabled: Boolean(row.banned)
+    });
+}
+export function userFromPrincipal(principal) {
+    return principal.identity;
+}
+export async function audit(db, actorId, action, targetType, targetId, metadata) {
+    await recordAudit(db, {
+        actor: actorAuditRef(actorId),
+        action,
+        target: { type: targetType, id: targetId },
+        metadata
+    });
+}
+export function base64url(bytes) {
+    let binary = "";
+    for (const byte of bytes)
+        binary += String.fromCharCode(byte);
+    return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+}
+export function fromBase64url(value) {
+    const padded = value.replace(/-/g, "+").replace(/_/g, "/").padEnd(Math.ceil(value.length / 4) * 4, "=");
+    const binary = atob(padded);
+    const bytes = new Uint8Array(binary.length);
+    for (let index = 0; index < binary.length; index += 1)
+        bytes[index] = binary.charCodeAt(index);
+    return bytes;
+}
+async function hmac(secret, data) {
+    const key = await crypto.subtle.importKey("raw", encoder.encode(secret), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+    const signature = await crypto.subtle.sign("HMAC", key, encoder.encode(data));
+    return base64url(new Uint8Array(signature));
+}
+export async function signToken(secret, payload) {
+    const body = {
+        purpose: payload.purpose,
+        email: payload.email,
+        role: payload.role,
+        operatorRole: isRaybaseAdminRole(payload.operatorRole) ? payload.operatorRole : undefined,
+        roles: payload.roles,
+        recovery: payload.recovery === true ? true : undefined,
+        jti: randomId("token"),
+        exp: Math.floor(wallNowMs() / 1000) + payload.ttlSeconds
+    };
+    const encoded = base64url(encoder.encode(JSON.stringify(body)));
+    return `${encoded}.${await hmac(secret, encoded)}`;
+}
+export async function verifySignedToken(secret, token, purpose) {
+    const [encoded, signature] = token.split(".");
+    if (!encoded || !signature)
+        throw new Error("Invalid token format");
+    const expected = await hmac(secret, encoded);
+    if (signature !== expected)
+        throw new Error("Invalid token signature");
+    const payload = JSON.parse(decoder.decode(fromBase64url(encoded)));
+    if (payload.purpose !== purpose)
+        throw new Error("Wrong token purpose");
+    if (payload.exp < Math.floor(wallNowMs() / 1000))
+        throw new Error("Token expired");
+    return payload;
+}
+export async function ownerConfigured(db) {
+    // Host users never hold a role, whatever their row says.
+    const row = await db.first(`SELECT "id" FROM "_auth_users" WHERE "operatorRole" = 'owner' AND "id" NOT LIKE 'hostuser\\_%' ESCAPE '\\' LIMIT 1`);
+    return Boolean(row);
+}
+export async function consumeSignedToken(db, secret, token, purpose) {
+    const payload = await verifySignedToken(secret, token, purpose);
+    await assertSignedTokenAvailable(db, token, payload, purpose);
+    try {
+        await db.run(`INSERT INTO "_used_tokens" ("jti", "purpose", "usedAt") VALUES (?, ?, ?)`, [payload.jti, purpose, nowIso()]);
+    }
+    catch (error) {
+        // The primary key is what decides a race between two redemptions of the
+        // same token; the loser gets the same answer as a late arrival.
+        if (String(error?.message ?? error).includes("UNIQUE constraint failed")) {
+            throw new Error("Token already used");
+        }
+        throw error;
+    }
+    return payload;
+}
+/**
+ * Undo a `consumeSignedToken` claim. A single-use token is claimed before the
+ * work it authorizes, so two concurrent redemptions cannot both succeed; when
+ * that work then fails before anything durable exists, the claim has to come
+ * back or a mistyped password would permanently destroy the invitation.
+ */
+export async function releaseSignedToken(db, jti, purpose) {
+    await db.run(`DELETE FROM "_used_tokens" WHERE "jti" = ? AND "purpose" = ?`, [jti, purpose]);
+}
+export async function previewSignedToken(db, secret, token, purpose) {
+    const payload = await verifySignedToken(secret, token, purpose);
+    await assertSignedTokenAvailable(db, token, payload, purpose);
+    return payload;
+}
+async function assertSignedTokenAvailable(db, token, payload, purpose) {
+    const used = await db.first(`SELECT "jti" FROM "_used_tokens" WHERE "jti" = ?`, [payload.jti]);
+    if (used)
+        throw new Error("Token already used");
+    if (purpose === "invite") {
+        const invite = await db.first(`SELECT "id", "usedAt", "expiresAt", "status" FROM "_invites" WHERE "tokenHash" = ?`, [await sha256(token)]);
+        if (!invite)
+            throw new Error("Invite not found");
+        if (invite.usedAt)
+            throw new Error("Invite already used");
+        if (invite.status === "cancelled")
+            throw new Error("Invite cancelled");
+        if (invite.status === "accepted")
+            throw new Error("Invite already used");
+        if (new Date(invite.expiresAt).getTime() < wallNowMs()) {
+            await db.run(`UPDATE "_invites" SET "status" = 'expired' WHERE "id" = ? AND "status" = 'pending'`, [invite.id]);
+            throw new Error("Invite expired");
+        }
+    }
+}
+export async function sha256(value) {
+    return base64url(new Uint8Array(await crypto.subtle.digest("SHA-256", encoder.encode(value))));
+}
+function cookieExpires(expiresAt) {
+    return new Date(expiresAt).toUTCString();
+}
+function cookieMaxAge(expiresAt) {
+    return Math.max(0, Math.floor((new Date(expiresAt).getTime() - wallNowMs()) / 1000));
+}
+async function pendingCookieValue(secret, pendingId, nonce) {
+    const body = `${pendingId}.${nonce}`;
+    return `${body}.${await hmac(secret, body)}`;
+}
+export async function createPendingExternalAuthCookie(secret, pendingId, nonce, expiresAt) {
+    const value = await pendingCookieValue(secret, pendingId, nonce);
+    return `${pendingExternalAuthCookieName}=${value}; Path=/api/auth; HttpOnly; SameSite=Lax; Secure; Max-Age=${cookieMaxAge(expiresAt)}; Expires=${cookieExpires(expiresAt)}`;
+}
+export function clearPendingExternalAuthCookie() {
+    return `${pendingExternalAuthCookieName}=; Path=/api/auth; HttpOnly; SameSite=Lax; Secure; Max-Age=0`;
+}
+function readCookie(request, name) {
+    const header = request?.headers.get("cookie");
+    if (!header)
+        return null;
+    for (const part of header.split(";")) {
+        const [rawName, ...rawValue] = part.trim().split("=");
+        if (rawName === name)
+            return rawValue.join("=") || "";
+    }
+    return null;
+}
+async function parsePendingExternalAuthCookie(secret, request) {
+    const value = readCookie(request, pendingExternalAuthCookieName);
+    if (!value)
+        return null;
+    const [id, nonce, signature] = value.split(".");
+    if (!id || !nonce || !signature)
+        return null;
+    const expected = await hmac(secret, `${id}.${nonce}`);
+    if (signature !== expected)
+        return null;
+    return { id, nonce };
+}
+function parsePendingRoles(value) {
+    try {
+        const parsed = JSON.parse(value);
+        if (Array.isArray(parsed))
+            return normalizeRoles(parsed);
+    }
+    catch { }
+    return normalizeRoles(["user"]);
+}
+export async function createPendingExternalAuth(db, secret, config, input) {
+    const providerId = assertRaybaseExternalProviderId(input.providerId);
+    const payload = await verifySignedToken(secret, input.token, input.purpose);
+    await assertSignedTokenAvailable(db, input.token, payload, input.purpose);
+    const tokenHash = await sha256(input.token);
+    const now = wallNowMs();
+    const expiresAt = new Date(now + (input.ttlSeconds ?? pendingExternalAuthTtlSeconds) * 1000).toISOString();
+    const id = randomId("pending_auth");
+    const nonce = randomId("nonce");
+    const appRoles = input.purpose === "owner-setup" ? defaultOwnerAppRoles(config) : normalizeRoles(payload.roles ?? [payload.role ?? "user"]);
+    const operatorRole = input.purpose === "owner-setup" ? "owner" : parsePendingOperatorRole(payload.operatorRole ?? null);
+    await db.run(`UPDATE "_auth_pending"
+     SET "status" = 'expired', "error" = 'replaced', "consumedAt" = ?
+     WHERE "tokenJti" = ? AND "status" = 'started'`, [nowIso(), payload.jti]);
+    await db.run(`INSERT INTO "_auth_pending" (
+      "id",
+      "purpose",
+      "tokenJti",
+      "tokenHash",
+      "providerId",
+      "expectedEmail",
+      "operatorRole",
+      "appRoles",
+      "nonceHash",
+      "status",
+      "updatesChoice",
+      "expiresAt"
+    ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, 'started', ?, ?)`, [
+        id,
+        input.purpose,
+        payload.jti,
+        tokenHash,
+        providerId,
+        payload.email?.toLowerCase() ?? null,
+        operatorRole,
+        JSON.stringify(appRoles),
+        await sha256(nonce),
+        input.updatesChoice ?? null,
+        expiresAt
+    ]);
+    const pending = await db.first(`SELECT * FROM "_auth_pending" WHERE "id" = ?`, [id]);
+    if (!pending)
+        throw new Error("Unable to create provider auth state");
+    return { pending, cookie: await createPendingExternalAuthCookie(secret, id, nonce, expiresAt) };
+}
+function parsePendingOperatorRole(value) {
+    return isRaybaseAdminRole(value) ? value : null;
+}
+export async function expirePendingExternalAuth(db, pendingId, reason = "expired") {
+    await db.run(`UPDATE "_auth_pending"
+     SET "status" = 'expired', "error" = ?, "consumedAt" = ?
+     WHERE "id" = ? AND "status" = 'started'`, [reason, nowIso(), pendingId]);
+}
+async function validateInviteHashAvailable(db, tokenHash) {
+    const invite = await db.first(`SELECT "id", "usedAt", "expiresAt", "status" FROM "_invites" WHERE "tokenHash" = ?`, [tokenHash]);
+    if (!invite)
+        throw new Error("Invite not found");
+    if (invite.usedAt)
+        throw new Error("Invite already used");
+    if (invite.status === "cancelled")
+        throw new Error("Invite cancelled");
+    if (invite.status === "accepted")
+        throw new Error("Invite already used");
+    if (new Date(invite.expiresAt).getTime() < wallNowMs()) {
+        await db.run(`UPDATE "_invites" SET "status" = 'expired' WHERE "id" = ? AND "status" = 'pending'`, [invite.id]);
+        throw new Error("Invite expired");
+    }
+}
+export async function validatePendingExternalAuth(db, secret, request, providerId, user) {
+    const id = assertRaybaseExternalProviderId(providerId);
+    const cookie = await parsePendingExternalAuthCookie(secret, request);
+    if (!cookie)
+        throw new Error("Provider setup or invite is required");
+    const pending = await db.first(`SELECT * FROM "_auth_pending" WHERE "id" = ? AND "status" = 'started'`, [cookie.id]);
+    if (!pending)
+        throw new Error("Provider setup or invite is required");
+    if (pending.providerId !== id)
+        throw new Error("Provider does not match pending setup");
+    if ((await sha256(cookie.nonce)) !== pending.nonceHash)
+        throw new Error("Provider setup state is invalid");
+    if (new Date(pending.expiresAt).getTime() < wallNowMs()) {
+        await expirePendingExternalAuth(db, pending.id);
+        throw new Error("Provider setup expired");
+    }
+    const used = await db.first(`SELECT "jti" FROM "_used_tokens" WHERE "jti" = ?`, [pending.tokenJti]);
+    if (used)
+        throw new Error("Token already used");
+    if (pending.purpose === "invite")
+        await validateInviteHashAvailable(db, pending.tokenHash);
+    if (user.emailVerified !== true && user.emailVerified !== 1)
+        throw new Error("Provider did not verify the email address");
+    const email = String(user.email ?? "").toLowerCase();
+    if (!email)
+        throw new Error("Provider email is required");
+    if (pending.expectedEmail && pending.expectedEmail.toLowerCase() !== email)
+        throw new Error("Provider email does not match this invite");
+    return { ...pending, appRolesList: parsePendingRoles(pending.appRoles) };
+}
+export async function finalizePendingExternalAuth(db, secret, request, providerId, user, options = {}) {
+    const cookie = await parsePendingExternalAuthCookie(secret, request);
+    if (!cookie)
+        return null;
+    const pending = await validatePendingExternalAuth(db, secret, request, providerId, user);
+    await setUserAccessRoles(db, user.id, parsePendingOperatorRole(pending.operatorRole), pending.appRolesList);
+    await db.run(`INSERT INTO "_used_tokens" ("jti", "purpose", "usedAt") VALUES (?, ?, ?)`, [pending.tokenJti, pending.purpose, nowIso()]);
+    if (pending.purpose === "invite") {
+        await db.run(`UPDATE "_invites" SET "usedAt" = ?, "status" = 'accepted' WHERE "tokenHash" = ?`, [nowIso(), pending.tokenHash]);
+    }
+    await db.run(`UPDATE "_auth_pending" SET "status" = 'consumed', "consumedAt" = ? WHERE "id" = ?`, [nowIso(), pending.id]);
+    await audit(db, user.id, pending.purpose === "owner-setup" ? "owner.setup.provider" : "invite.accept.provider", "user", user.id, { providerId, purpose: pending.purpose, existingUser: options.existingUser === true });
+    return pending;
+}
+export async function createInvite(db, secret, input) {
+    const ttlSeconds = input.ttlSeconds ?? 7 * 24 * 60 * 60;
+    const roles = normalizeRoles(input.roles?.length ? input.roles : [input.role]);
+    const requestedRole = String(input.role ?? "").trim();
+    const primaryRole = requestedRole && roles.includes(requestedRole) ? requestedRole : roles[0];
+    const token = await signToken(secret, {
+        purpose: "invite",
+        email: input.email,
+        role: primaryRole,
+        operatorRole: input.operatorRole ?? undefined,
+        roles,
+        ttlSeconds
+    });
+    const payload = await verifySignedToken(secret, token, "invite");
+    const expiresAt = new Date(payload.exp * 1000).toISOString();
+    const id = randomId("invite");
+    await db.run(`INSERT INTO "_invites" ("id", "tokenHash", "email", "role", "roles", "status", "createdBy", "note", "expiresAt")
+     VALUES (?, ?, ?, ?, ?, 'pending', ?, ?, ?)`, [
+        id,
+        await sha256(token),
+        input.email?.trim().toLowerCase() || null,
+        primaryRole,
+        JSON.stringify(roles),
+        input.createdBy ?? null,
+        input.note?.trim() || null,
+        expiresAt
+    ]);
+    return { id, token, expiresAt };
+}
+function parseInviteRoles(value) {
+    if (Array.isArray(value))
+        return value.map(String);
+    if (typeof value !== "string")
+        return [];
+    try {
+        const parsed = JSON.parse(value);
+        return Array.isArray(parsed) ? parsed.map(String) : [];
+    }
+    catch {
+        return [];
+    }
+}
+export async function listInvites(db, options = {}) {
+    const where = options.status ? ` WHERE "status" = ?` : "";
+    const whereParams = options.status ? [options.status] : [];
+    const limit = Math.min(Math.max(options.limit ?? 100, 1), 500);
+    const offset = Math.max(options.offset ?? 0, 0);
+    const rows = await db.all(`SELECT "id", "email", "roles", "status", "note", "expiresAt", "usedAt", "createdAt"
+     FROM "_invites"${where} ORDER BY "createdAt" DESC LIMIT ? OFFSET ?`, [...whereParams, limit, offset]);
+    const total = await db.first(`SELECT COUNT(*) AS "count" FROM "_invites"${where}`, whereParams);
+    return {
+        invites: rows.map((row) => ({
+            id: String(row.id),
+            email: row.email === null ? null : String(row.email),
+            appRoles: normalizeRoles(parseInviteRoles(row.roles)),
+            status: String(row.status),
+            note: row.note === null ? null : String(row.note),
+            expiresAt: String(row.expiresAt),
+            usedAt: row.usedAt === null ? null : String(row.usedAt),
+            createdAt: String(row.createdAt)
+        })),
+        total: Number(total?.count ?? 0)
+    };
+}
+export async function markInviteUsed(db, token) {
+    await db.run(`UPDATE "_invites" SET "usedAt" = ?, "status" = 'accepted' WHERE "tokenHash" = ?`, [nowIso(), await sha256(token)]);
+}
+export async function cancelInvite(db, inviteId) {
+    await db.run(`UPDATE "_invites" SET "status" = 'cancelled' WHERE "id" = ? AND "status" = 'pending'`, [inviteId]);
+}
+async function createRaybaseSignInLinkVerification(db, user, expiresIn) {
+    const tokenBytes = new Uint8Array(32);
+    crypto.getRandomValues(tokenBytes);
+    const token = base64url(tokenBytes);
+    const createdAt = wallNowMs();
+    const expiresAtMs = createdAt + expiresIn * 1_000;
+    await db.run(`INSERT INTO "_auth_verifications" ("id", "identifier", "value", "expiresAt", "createdAt", "updatedAt")
+     VALUES (?, ?, ?, ?, ?, ?)`, [randomId("verification"), token, JSON.stringify({ email: user.email, name: user.name }), expiresAtMs, createdAt, createdAt]);
+    return { token, expiresAt: new Date(expiresAtMs).toISOString() };
+}
+function normalizeRaybaseSignInLinkRedirect(redirectTo) {
+    if (typeof redirectTo !== "string" || !redirectTo.startsWith("/") || redirectTo.startsWith("//") || redirectTo.includes("\\")) {
+        throw new Error("ctx.auth.signInLinks.create redirectTo must be a root-relative path on the current origin");
+    }
+    try {
+        const base = new URL("https://raybase-sign-in-link.invalid/");
+        const resolved = new URL(redirectTo, base);
+        if (resolved.origin !== base.origin || resolved.pathname.startsWith("//"))
+            throw new Error("origin changed");
+        return `${resolved.pathname}${resolved.search}${resolved.hash}`;
+    }
+    catch {
+        throw new Error("ctx.auth.signInLinks.create redirectTo must be a valid root-relative path on the current origin");
+    }
+}
+export function createRaybaseAuthContextRuntime(input) {
+    // Invites and sign-in links are issued for the person an agent runs on
+    // behalf of, never for the agent itself.
+    const actingPrincipal = principalOnBehalfOf(input.principal);
+    const audit = input.audit ?? (async (event) => {
+        await recordAudit(input.db, {
+            actor: input.principal,
+            action: event.action,
+            target: event.target,
+            metadata: event.metadata,
+            source: event.source
+        });
+    });
+    return {
+        invites: {
+            async create(options = {}) {
+                if (options.expiresIn !== undefined && (!Number.isInteger(options.expiresIn) || options.expiresIn <= 0)) {
+                    throw new Error("ctx.auth.invites.create expiresIn must be a positive integer number of seconds");
+                }
+                const note = options.note?.trim();
+                if (note && note.length > 1_000)
+                    throw new Error("ctx.auth.invites.create note must be at most 1000 characters");
+                const roles = normalizeRoles(options.appRoles?.length ? options.appRoles : ["user"]);
+                const invite = await createInvite(input.db, input.secret, {
+                    email: options.email,
+                    role: roles.find((role) => role !== "user") ?? roles[0],
+                    roles,
+                    createdBy: actingPrincipal.kind === "user" || actingPrincipal.kind === "operator"
+                        ? principalId(actingPrincipal)
+                        : null,
+                    ttlSeconds: options.expiresIn,
+                    note
+                });
+                const path = `/invite/${invite.token}`;
+                const url = input.request ? new URL(path, input.request.url).toString() : undefined;
+                await audit({
+                    action: "invite.create",
+                    target: { type: "_invites", id: invite.id },
+                    metadata: {
+                        email: options.email?.trim().toLowerCase() || null,
+                        appRoles: roles,
+                        note: note || null,
+                        runtimeMinted: true
+                    }
+                });
+                return { ...invite, path, ...(url ? { url } : {}) };
+            },
+            list: (options) => listInvites(input.db, options),
+            async revoke(inviteId) {
+                const id = inviteId.trim();
+                if (!id)
+                    throw new Error("Invite id is required");
+                const existing = await input.db.first(`SELECT "status" FROM "_invites" WHERE "id" = ?`, [id]);
+                const revoked = existing?.status === "pending";
+                if (revoked)
+                    await cancelInvite(input.db, id);
+                await audit({
+                    action: "invite.cancel",
+                    target: { type: "_invites", id },
+                    metadata: { runtimeMinted: true, revoked }
+                });
+                return { revoked };
+            }
+        },
+        signInLinks: {
+            async create(options = {}) {
+                const configured = input.config.auth?.signInLinks;
+                if (configured?.enabled !== true)
+                    throw new Error("ctx.auth.signInLinks is not enabled");
+                if (!input.sessionAuthenticated || !input.request) {
+                    throw new Error("ctx.auth.signInLinks.create requires a cookie-session-authenticated app request");
+                }
+                if (actingPrincipal.kind !== "user") {
+                    throw new Error("ctx.auth.signInLinks.create requires a user principal");
+                }
+                const resolved = resolveRaybaseSignInLinksConfig(input.config);
+                const expiresIn = options.expiresIn ?? resolved.expiresIn;
+                if (!Number.isInteger(expiresIn) || expiresIn <= 0 || expiresIn > raybaseSignInLinkMaximumExpiresIn) {
+                    throw new Error(`ctx.auth.signInLinks.create expiresIn must be a positive integer no greater than ${raybaseSignInLinkMaximumExpiresIn} seconds`);
+                }
+                const redirectTo = normalizeRaybaseSignInLinkRedirect(options.redirectTo ?? "/");
+                const userId = actingPrincipal.user.identityId ?? actingPrincipal.userId ?? actingPrincipal.user.id;
+                const user = await input.db.first(`SELECT "id", "email", "name", "emailVerified", "operatorRole", "appRoles", "banned" FROM "_auth_users" WHERE "id" = ?`, [userId]);
+                if (!user)
+                    throw new Error("ctx.auth.signInLinks.create requires a current auth user");
+                if (user.banned === true || user.banned === 1)
+                    throw new Error("ctx.auth.signInLinks.create is unavailable for a disabled account");
+                const email = typeof user.email === "string" ? user.email.trim().toLowerCase() : "";
+                if (!email)
+                    throw new Error("ctx.auth.signInLinks.create requires a current auth user email");
+                if (user.emailVerified !== true && user.emailVerified !== 1) {
+                    throw new Error("ctx.auth.signInLinks.create requires an already-verified email address");
+                }
+                const verification = await createRaybaseSignInLinkVerification(input.db, { email, name: user.name }, expiresIn);
+                // Better Auth 1.6 rejects hashes in relative callback URLs even though
+                // they are valid same-origin navigation targets. Supplying the already
+                // validated current-origin absolute URL preserves pathname/query/hash
+                // while keeping its verifier and origin check in charge.
+                const callbackURL = new URL(redirectTo, input.request.url).toString();
+                const query = new URLSearchParams({ token: verification.token, callbackURL });
+                const path = `/api/auth/magic-link/verify?${query.toString()}`;
+                const url = new URL(path, input.request.url).toString();
+                await audit({
+                    action: "auth.sign_in_link.create",
+                    target: { type: "_auth_users", id: userId },
+                    metadata: { expiresIn, redirectTo, runtimeMinted: true }
+                });
+                return { path, url, expiresAt: verification.expiresAt };
+            }
+        }
+    };
+}
+export const unsupportedRaybaseAuthContextRuntime = {
+    invites: {
+        async create() {
+            throw new Error("ctx.auth.invites is not available from this Raybase adapter");
+        },
+        async list() {
+            throw new Error("ctx.auth.invites is not available from this Raybase adapter");
+        },
+        async revoke() {
+            throw new Error("ctx.auth.invites is not available from this Raybase adapter");
+        }
+    },
+    signInLinks: {
+        async create() {
+            throw new Error("ctx.auth.signInLinks is not available from this Raybase adapter");
+        }
+    }
+};
+export function csrfAllowed(request) {
+    if (request.method === "GET" || request.method === "HEAD" || request.method === "OPTIONS")
+        return true;
+    const url = new URL(request.url);
+    const origin = request.headers.get("Origin");
+    if (origin)
+        return new URL(origin).host === url.host;
+    const referer = request.headers.get("Referer");
+    return referer ? new URL(referer).host === url.host : false;
+}
+export function headersForInternalAuth(request, env) {
+    const headers = new Headers(request.headers);
+    headers.set(internalSignupHeader, authSecret(env));
+    return headers;
+}
+export async function signUpWithRaybaseToken(auth, request, env, input) {
+    const result = await auth.api.signUpEmail({
+        body: {
+            email: input.email.toLowerCase(),
+            name: input.name,
+            password: input.password,
+            rememberMe: true
+        },
+        headers: headersForInternalAuth(request, env),
+        returnHeaders: true
+    });
+    const user = toRaybaseUser(result.response.user);
+    const db = authDb(env);
+    await setUserAdminRole(db, user.id, input.operatorRole);
+    await setUserAppRoles(db, user.id, input.appRoles ?? ["user"]);
+    if (input.emailVerified !== false)
+        await setUserEmailVerified(db, user.id, true);
+    const appRoles = normalizeRoles(input.appRoles ?? ["user"]);
+    await runRaybasePasswordSecretLifecycle({
+        db,
+        registration: passwordSecretLifecycleByAuth.get(auth),
+        event: "signup",
+        userId: user.id,
+        password: input.password,
+        environment: env.RAYBASE_ENV,
+        signal: request.signal
+    });
+    return {
+        headers: result.headers,
+        user: { ...user, operatorRole: input.operatorRole, appRoles, emailVerified: input.emailVerified !== false }
+    };
+}
+export async function signUpPublicUser(auth, request, env, input) {
+    return signUpWithRaybaseToken(auth, request, env, {
+        email: input.email,
+        name: input.name,
+        password: input.password,
+        operatorRole: null,
+        appRoles: defaultPublicAppRoles(),
+        emailVerified: false
+    });
+}
+export async function signInWithPassword(auth, request, env, config, input) {
+    const db = authDb(env);
+    const existing = await getUserByEmail(db, input.email);
+    if (existing?.disabled)
+        throw new Error("Account disabled");
+    const result = await auth.api.signInEmail({
+        body: {
+            email: input.email.toLowerCase(),
+            password: input.password,
+            rememberMe: true
+        },
+        headers: new Headers(request.headers),
+        returnHeaders: true
+    });
+    const identity = toRaybaseUser(result.response.user);
+    const user = await resolveUser(db, identity);
+    if (user.disabled)
+        throw new Error("Account disabled");
+    await runRaybasePasswordSecretLifecycle({
+        db,
+        registration: passwordSecretLifecycleByAuth.get(auth),
+        event: "login",
+        userId: user.id,
+        password: input.password,
+        environment: env.RAYBASE_ENV,
+        signal: request.signal
+    });
+    return {
+        headers: result.headers,
+        user
+    };
+}
+export async function signOut(auth, request) {
+    const result = await auth.api.signOut({
+        headers: new Headers(request.headers),
+        returnHeaders: true
+    });
+    return result.headers;
+}
+export async function setUserAdminRole(db, userId, role) {
+    assertNotHostUser(userId, "Changing the admin role");
+    await db.run(`UPDATE "_auth_users" SET "operatorRole" = ?, "updatedAt" = ? WHERE "id" = ?`, [role, wallNowMs(), userId]);
+}
+export async function setUserAppRoles(db, userId, appRoles) {
+    assertNotHostUser(userId, "Changing app roles");
+    await db.run(`UPDATE "_auth_users" SET "appRoles" = ?, "updatedAt" = ? WHERE "id" = ?`, [JSON.stringify(normalizeRoles(appRoles)), wallNowMs(), userId]);
+}
+export async function setUserEmailVerified(db, userId, verified) {
+    assertNotHostUser(userId, "Verifying the email address");
+    await db.run(`UPDATE "_auth_users" SET "emailVerified" = ?, "updatedAt" = ? WHERE "id" = ?`, [verified ? 1 : 0, wallNowMs(), userId]);
+}
+async function setUserAccessRoles(db, userId, operatorRole, appRoles) {
+    assertNotHostUser(userId, "Changing roles");
+    await db.run(`UPDATE "_auth_users" SET "operatorRole" = ?, "appRoles" = ?, "updatedAt" = ? WHERE "id" = ?`, [
+        operatorRole,
+        JSON.stringify(normalizeRoles(appRoles)),
+        wallNowMs(),
+        userId
+    ]);
+}
+export async function getUserByEmail(db, email) {
+    const row = await db.first(`SELECT "id", "email", "name", "emailVerified", "operatorRole", "appRoles", "banned" FROM "_auth_users" WHERE lower("email") = lower(?)`, [email]);
+    return row ? rowToRaybaseUser(row) : null;
+}
+export async function getUserById(db, id) {
+    const row = await db.first(`SELECT "id", "email", "name", "emailVerified", "operatorRole", "appRoles", "banned" FROM "_auth_users" WHERE "id" = ?`, [id]);
+    return row ? rowToRaybaseUser(row) : null;
+}
+function devPersonaRoles(persona) {
+    const operatorRole = raybaseDevPersonaOperatorRole(persona);
+    const appRoles = normalizeRoles(operatorRole ? ["user"] : ["user", persona.role]);
+    return { operatorRole, appRoles };
+}
+export async function getOrCreateDevUser(auth, request, env, config, persona = resolveRaybaseDevPersonas(config)[0]) {
+    const { operatorRole, appRoles } = devPersonaRoles(persona);
+    const db = authDb(env);
+    const existing = await getUserByEmail(db, persona.email);
+    if (existing) {
+        await setUserAdminRole(db, existing.id, operatorRole);
+        await setUserAppRoles(db, existing.id, appRoles);
+        return { ...existing, operatorRole, appRoles };
+    }
+    const created = await signUpWithRaybaseToken(auth, request, env, {
+        email: persona.email,
+        name: persona.name,
+        password: "raybase-dev-password",
+        operatorRole,
+        appRoles
+    });
+    return created.user;
+}
+function rowToRaybaseUser(row) {
+    return withHostUserRoleCeiling({
+        id: row.id,
+        email: row.email,
+        name: row.name,
+        operatorRole: normalizeStoredAdminRole(row.operatorRole),
+        appRoles: row.appRoles ? parseStoredAppRoles(row.appRoles) : normalizeRoles(["user"]),
+        emailVerified: row.emailVerified === true || row.emailVerified === 1,
+        disabled: Boolean(row.banned)
+    });
+}
+export async function createDevSession(auth, request, env, config) {
+    const persona = await resolveRequestedRaybaseDevPersona(request, config);
+    await getOrCreateDevUser(auth, request, env, config, persona);
+    const signin = await signInWithPassword(auth, request, env, config, {
+        email: persona.email,
+        password: "raybase-dev-password"
+    });
+    const user = await resolveUser(authDb(env), signin.user);
+    return { headers: signin.headers, user };
+}
+export function raybaseAuthExecutor(env) {
+    return authDb(env);
+}
+//# sourceMappingURL=auth.js.map