@sanoma-ai/connector-better-auth 0.0.0-stage → 0.1.0

package/LICENSE

@@ -0,0 +1,105 @@
+# Functional Source License, Version 1.1, ALv2 Future License
+
+## Abbreviation
+
+FSL-1.1-ALv2
+
+## Notice
+
+Copyright 2026 Sanoma-AI
+
+## Terms and Conditions
+
+### Licensor ("We")
+
+The party offering the Software under these Terms and Conditions.
+
+### The Software
+
+The "Software" is each version of the software that we make available under
+these Terms and Conditions, as indicated by our inclusion of these Terms and
+Conditions with the Software.
+
+### License Grant
+
+Subject to your compliance with this License Grant and the Patents,
+Redistribution and Trademark clauses below, we hereby grant you the right to
+use, copy, modify, create derivative works, publicly perform, publicly display
+and redistribute the Software for any Permitted Purpose identified below.
+
+### Permitted Purpose
+
+A Permitted Purpose is any purpose other than a Competing Use. A Competing Use
+means making the Software available to others in a commercial product or
+service that:
+
+1. substitutes for the Software;
+
+2. substitutes for any other product or service we offer using the Software
+   that exists as of the date we make the Software available; or
+
+3. offers the same or substantially similar functionality as the Software.
+
+Permitted Purposes specifically include using the Software:
+
+1. for your internal use and access;
+
+2. for non-commercial education;
+
+3. for non-commercial research; and
+
+4. in connection with professional services that you provide to a licensee
+   using the Software in accordance with these Terms and Conditions.
+
+### Patents
+
+To the extent your use for a Permitted Purpose would necessarily infringe our
+patents, the license grant above includes a license under our patents. If you
+make a claim against any party that the Software infringes or contributes to
+the infringement of any patent, then your patent license to the Software ends
+immediately.
+
+### Redistribution
+
+The Terms and Conditions apply to all copies, modifications and derivatives of
+the Software.
+
+If you redistribute any copies, modifications or derivatives of the Software,
+you must include a copy of or a link to these Terms and Conditions and not
+remove any copyright notices provided in or with the Software.
+
+### Disclaimer
+
+THE SOFTWARE IS PROVIDED "AS IS" AND WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING WITHOUT LIMITATION WARRANTIES OF FITNESS FOR A PARTICULAR
+PURPOSE, MERCHANTABILITY, TITLE OR NON-INFRINGEMENT.
+
+IN NO EVENT WILL WE HAVE ANY LIABILITY TO YOU ARISING OUT OF OR RELATED TO THE
+SOFTWARE, INCLUDING INDIRECT, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES,
+EVEN IF WE HAVE BEEN INFORMED OF THEIR POSSIBILITY IN ADVANCE.
+
+### Trademarks
+
+Except for displaying the License Details and identifying us as the origin of
+the Software, you have no right under these Terms and Conditions to use our
+trademarks, trade names, service marks or product names.
+
+## Grant of Future License
+
+We hereby irrevocably grant you an additional license to use the Software under
+the Apache License, Version 2.0 that is effective on the second anniversary of
+the date we make the Software available. On or after that date, you may use the
+Software under the Apache License, Version 2.0, in which case the following
+will apply:
+
+Licensed under the Apache License, Version 2.0 (the "License"); you may not use
+this file except in compliance with the License.
+
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software distributed
+under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
+CONDITIONS OF ANY KIND, either express or implied. See the License for the
+specific language governing permissions and limitations under the License.

package/README.md

@@ -1,3 +1,65 @@
-# Temporary Holding Version
+# @sanoma-ai/connector-better-auth
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+[Better Auth](https://www.better-auth.com) as a visitor login for a [Sanoma](https://github.com/Sanoma-AI/sanoma) public site: visitors sign up and sign in with an email and a password, and their accounts live on the company's own database. It has no operations and no credential; it attaches a login half (`withSetup({ login })`, see [`@sanoma-ai/workflows`](https://www.npmjs.com/package/@sanoma-ai/workflows#usage)), which the app calls once for each public site that names it.
+
+## Usage
+
+```sh
+npm install @sanoma-ai/connector-better-auth
+```
+
+```ts
+// sanoma.config.ts
+import { betterAuth } from "@sanoma-ai/connector-better-auth";
+
+export default defineConfig({ workflows, connectors: [betterAuth] });
+```
+
+```ts
+// sites/account/site.ts
+import { defineSite } from "sanoma/site";
+
+export default defineSite({ title: "Account", public: true, login: "better-auth" });
+```
+
+A visitor who signs in is the principal `visitor:better-auth:<id>`, in the group `visitors`, where `<id>` is Better Auth's user id; the app makes the principal, never the connector. What a visitor may do is a Cedar `permit` naming that group:
+
+```cedar
+// policies/visitors.cedar
+permit (principal in Sanoma::Group::"visitors", action == Sanoma::Action::"workflow:hello", resource);
+```
+
+### No secret to set
+
+It has no credential. Better Auth signs its cookies with a key the app derives for this login from the deployment's `SANOMA_SECRETS_KEY` (HKDF-SHA256, purpose `login better-auth`), which `sanoma` already sets up; changing that key signs every visitor out.
+
+### The schema
+
+The tables (`user`, `session`, `account`, `verification`) are in the schema `better_auth` on the company's database (`SANOMA_DATABASE_URL`), beside the runtime's own, in queries that name the schema (no `search_path`, which the URL's own `options` could change). The login runs Better Auth's migrations when the app starts, before it serves the site: once per database in a process, under a Postgres advisory lock, so several processes starting at once do not race. A second start changes nothing.
+
+### The routes
+
+The login answers under `/auth/better-auth/` on the site's own host, and nothing else. A site's pages are its sign-in forms, drawn from the kit (`sanoma/ui`), that `fetch` JSON with a POST (the browser adds `Origin`, which Better Auth checks):
+
+| Route                                  | Body                          | What it does                                                             |
+| -------------------------------------- | ----------------------------- | ------------------------------------------------------------------------ |
+| `POST /auth/better-auth/sign-up/email` | `{ name, email, password }`   | Makes the account and signs the visitor in (8 characters or more).       |
+| `POST /auth/better-auth/sign-in/email` | `{ email, password }`         | Signs in; a wrong email or password is 401.                              |
+| `POST /auth/better-auth/sign-out`      | `{}`, or none (the app's own) | Ends the session; it is also `signOut`, which `useActor()` gives a page. |
+
+```ts
+const response = await fetch("/auth/better-auth/sign-in/email", {
+  method: "POST",
+  headers: { "content-type": "application/json" },
+  body: JSON.stringify({ email, password }),
+});
+if (response.ok) window.location.reload(); // the app reads the new session cookie
+```
+
+The session is one cookie, `better-auth.session_token` (`__Secure-better-auth.session_token`, and `Secure`, when the site is served over https): HttpOnly, SameSite=Lax, for the site's host only (no `Domain`), for seven days from sign-in. A request for a host that is not the site's is answered 421. Sign-in and sign-up are rate limited per visitor address (three tries in ten seconds), which the app gives the login in its own header, never from `X-Forwarded-For`. A site never imports `better-auth`: its pages only post to these routes.
+
+### Later
+
+Email verification and password reset (they need a sender, such as Resend), social providers (Google, GitHub), and the rate limit kept in the database for several processes.
+
+The logo the app shows is Better Auth's mark, from the [Better Auth repository](https://github.com/better-auth/better-auth) (`demo/nextjs/components/logo.tsx`), in black or white. It is there only to identify the service.

package/dist/connector.d.ts

@@ -0,0 +1,2 @@
+/** Better Auth: no operations, no driver and no credential; its login half is in `login.ts`. */
+export declare const betterAuthOps: import("@sanoma-ai/workflows").Connector<"better-auth", {}>;

package/dist/connector.js

@@ -0,0 +1,4 @@
+import { defineConnector, vendorInfo } from "@sanoma-ai/workflows";
+/** Better Auth: no operations, no driver and no credential; its login half is in `login.ts`. */
+export const betterAuthOps = defineConnector("better-auth", {}, vendorInfo(import.meta.url));
+//# sourceMappingURL=connector.js.map

package/dist/connector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connector.js","sourceRoot":"","sources":["../src/connector.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAEnE,gGAAgG;AAChG,MAAM,CAAC,MAAM,aAAa,GAAG,eAAe,CAAC,aAAa,EAAE,EAAE,EAAE,UAAU,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,7 @@
+export { betterAuthLogin } from "./login.ts";
+/**
+ * Better Auth, a visitor login for public sites (`defineSite({ public: true, login: "better-auth" })`):
+ * email and password, its users in schema `better_auth` on the company's database, its routes
+ * under `/auth/better-auth/`, its cookies signed with the key the app derives for it.
+ */
+export declare const betterAuth: import("@sanoma-ai/workflows").Connector<"better-auth", {}>;

package/dist/index.js

@@ -0,0 +1,11 @@
+import { withSetup } from "@sanoma-ai/workflows";
+import { betterAuthOps } from "./connector.js";
+import { betterAuthLogin } from "./login.js";
+export { betterAuthLogin } from "./login.js";
+/**
+ * Better Auth, a visitor login for public sites (`defineSite({ public: true, login: "better-auth" })`):
+ * email and password, its users in schema `better_auth` on the company's database, its routes
+ * under `/auth/better-auth/`, its cookies signed with the key the app derives for it.
+ */
+export const betterAuth = withSetup(betterAuthOps, { login: betterAuthLogin });
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAE7C,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAE7C;;;;GAIG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,SAAS,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC"}

package/dist/login.d.ts

@@ -0,0 +1,8 @@
+import { type LoginContext, type LoginHalf } from "@sanoma-ai/workflows";
+/**
+ * Better Auth's login half for one public site: email and password, its tables in schema
+ * `better_auth` on the company's database, migrated here before the first site starts, its cookies
+ * signed with the app's key for it (`context.key`). The site's origins are its allowed hosts (a
+ * request for another host is refused) and set the cookie's `Secure` flag: an `https` origin's is.
+ */
+export declare function betterAuthLogin({ databaseUrl, key, origins }: LoginContext): Promise<LoginHalf>;

package/dist/login.js

@@ -0,0 +1,140 @@
+import { CLIENT_IP_HEADER } from "@sanoma-ai/workflows";
+import { betterAuth, getHostFromSource, matchesHostPattern } from "better-auth";
+import { getMigrations } from "better-auth/db/migration";
+import { PostgresDialect } from "kysely";
+import { setTimeout as delay } from "node:timers/promises";
+import { Client, Pool } from "pg";
+/** The schema Better Auth's tables (`user`, `session`, `account`, `verification`) live in, on the company's database. */
+const SCHEMA = "better_auth";
+/** Where its routes are: a site's pages POST to `<BASE_PATH>/sign-up/email`, `/sign-in/email` and `/sign-out`. */
+const BASE_PATH = "/auth/better-auth";
+const SIGN_OUT = `${BASE_PATH}/sign-out`;
+/** The advisory lock every process takes around the migrations: concurrent cold starts race otherwise. */
+const LOCK = "sanoma.login.better-auth";
+/** Each database's migration, once per process however many sites sign in through it. */
+const migrated = new Map();
+/**
+ * Better Auth's login half for one public site: email and password, its tables in schema
+ * `better_auth` on the company's database, migrated here before the first site starts, its cookies
+ * signed with the app's key for it (`context.key`). The site's origins are its allowed hosts (a
+ * request for another host is refused) and set the cookie's `Secure` flag: an `https` origin's is.
+ */
+export async function betterAuthLogin({ databaseUrl, key, origins }) {
+    // Never Better Auth's own fallback (an environment variable, or its default secret).
+    if (!/^[0-9a-f]{64}$/.test(key ?? ""))
+        throw new Error("better-auth: the app gives no key to sign cookies with");
+    const sites = sitesOf(origins);
+    const pool = new Pool({ connectionString: databaseUrl });
+    pool.on("error", (err) => console.warn(`better-auth: a database connection failed: ${err.message}`));
+    // One Better Auth per protocol, since its cookies' `Secure` flag is one per instance.
+    const optionsFor = (protocol) => ({
+        // Schema-qualified queries, not a search_path, which the URL's own `options` could undo.
+        database: { dialect: new PostgresDialect({ pool }), type: "postgres", schemaName: SCHEMA, transaction: true },
+        // `secrets` over `secret`, else BETTER_AUTH_SECRETS in the environment would win.
+        secrets: [{ version: 1, value: key }],
+        secret: key,
+        basePath: BASE_PATH,
+        // A request's Host must be one of these, and its origin is trusted.
+        baseURL: { allowedHosts: sites.filter((site) => site.protocol === protocol).map((site) => site.host), protocol },
+        emailAndPassword: { enabled: true },
+        telemetry: { enabled: false },
+        advanced: {
+            // The app sets it from the socket; Better Auth would otherwise believe a client's X-Forwarded-For.
+            ipAddress: { ipAddressHeaders: [CLIENT_IP_HEADER] },
+            useSecureCookies: protocol === "https",
+            // Its default under NODE_ENV=test is off: the same check everywhere.
+            disableOriginCheck: false,
+        },
+        // On only in production by default; in memory, per process.
+        rateLimit: { enabled: true },
+        logger: { level: "warn" },
+    });
+    try {
+        const protocols = [...new Set(sites.map((site) => site.protocol))];
+        await migrateOnce(databaseUrl, optionsFor(protocols[0]));
+        // After the migrations: its start checks the tables, and says the schema is out of date otherwise.
+        const auths = new Map(protocols.map((protocol) => [protocol, betterAuth(optionsFor(protocol))]));
+        /** The instance for the request's host, or none for a host that is not the site's. */
+        const authFor = (request) => {
+            const host = getHostFromSource(request, false) ?? "";
+            const site = sites.find((s) => matchesHostPattern(host, s.host));
+            return site && auths.get(site.protocol);
+        };
+        return {
+            async verify(request) {
+                const auth = authFor(request);
+                if (!auth)
+                    throw new Error(`better-auth: ${request.headers.get("host")} is not one of the site's hosts`);
+                // Null for a missing, bad or signed-out cookie.
+                const session = await auth.api.getSession({ headers: request.headers });
+                return session ? { subject: session.user.id } : null;
+            },
+            async handle(request) {
+                const { pathname } = new URL(request.url);
+                if (pathname !== BASE_PATH && !pathname.startsWith(`${BASE_PATH}/`))
+                    return undefined;
+                // Better Auth throws for a host it does not allow, which would be a 500.
+                const auth = authFor(request);
+                if (!auth)
+                    return new Response("Misdirected Request", { status: 421 });
+                // The app's Sign out POSTs no body, which Better Auth's sign-out answers with 415.
+                if (pathname === SIGN_OUT && request.method === "POST" && !request.headers.has("content-type")) {
+                    const headers = new Headers(request.headers);
+                    headers.set("content-type", "application/json");
+                    headers.delete("content-length");
+                    return auth.handler(new Request(request.url, { method: "POST", headers, body: "{}" }));
+                }
+                return auth.handler(request);
+            },
+            signOut: SIGN_OUT,
+            close: () => pool.end(),
+        };
+    }
+    catch (err) {
+        await pool.end();
+        throw err;
+    }
+}
+/** Each origin's host, as Better Auth's `allowedHosts` has it (`account.localhost:*`), and its protocol. */
+function sitesOf(origins) {
+    if (!origins.length)
+        throw new Error("better-auth: a site needs an origin");
+    return origins.map((origin) => {
+        const [, protocol, host] = /^(https?):\/\/([^/]+)$/.exec(origin) ?? [];
+        if (!host)
+            throw new Error(`better-auth: an origin is a scheme and a host alone, such as https://example.com, not ${origin}`);
+        return { host, protocol: protocol };
+    });
+}
+/** Better Auth's migrations, once per database in this process, under the advisory lock across processes. */
+function migrateOnce(databaseUrl, options) {
+    let done = migrated.get(databaseUrl);
+    if (!done) {
+        done = migrate(databaseUrl, options).catch((err) => {
+            migrated.delete(databaseUrl);
+            throw err;
+        });
+        migrated.set(databaseUrl, done);
+    }
+    return done;
+}
+/**
+ * Holds the lock on a session of its own until that ends, whatever fails; polled, never waited
+ * for by a blocked statement, as the runtime's own preparation does. The migrations make the schema.
+ */
+async function migrate(databaseUrl, options) {
+    const conn = new Client({ connectionString: databaseUrl, connectionTimeoutMillis: 10_000 });
+    // An error nobody listens for ends the process; the query in flight fails with it.
+    conn.on("error", (err) => console.warn(`better-auth: the migration's connection failed: ${err.message}`));
+    await conn.connect();
+    try {
+        const ask = "SELECT pg_try_advisory_lock(hashtext($1)) AS locked";
+        while (!(await conn.query(ask, [LOCK])).rows[0].locked)
+            await delay(50);
+        await (await getMigrations(options)).runMigrations();
+    }
+    finally {
+        await conn.end().catch(() => undefined);
+    }
+}
+//# sourceMappingURL=login.js.map

package/dist/login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.js","sourceRoot":"","sources":["../src/login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAqC,MAAM,sBAAsB,CAAC;AAC3F,OAAO,EAA0B,UAAU,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACxG,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AACzC,OAAO,EAAE,UAAU,IAAI,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;AAElC,yHAAyH;AACzH,MAAM,MAAM,GAAG,aAAa,CAAC;AAC7B,kHAAkH;AAClH,MAAM,SAAS,GAAG,mBAAmB,CAAC;AACtC,MAAM,QAAQ,GAAG,GAAG,SAAS,WAAW,CAAC;AACzC,0GAA0G;AAC1G,MAAM,IAAI,GAAG,0BAA0B,CAAC;AAExC,yFAAyF;AACzF,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAyB,CAAC;AAElD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,OAAO,EAAgB;IAC/E,qFAAqF;IACrF,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IACjH,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/B,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,EAAE,gBAAgB,EAAE,WAAW,EAAE,CAAC,CAAC;IACzD,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,8CAA8C,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACrG,sFAAsF;IACtF,MAAM,UAAU,GAAG,CAAC,QAAkB,EAAE,EAAE,CACxC,CAAC;QACC,yFAAyF;QACzF,QAAQ,EAAE,EAAE,OAAO,EAAE,IAAI,eAAe,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE;QAC7G,kFAAkF;QAClF,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;QACrC,MAAM,EAAE,GAAG;QACX,QAAQ,EAAE,SAAS;QACnB,oEAAoE;QACpE,OAAO,EAAE,EAAE,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE;QAChH,gBAAgB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;QACnC,SAAS,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;QAC7B,QAAQ,EAAE;YACR,mGAAmG;YACnG,SAAS,EAAE,EAAE,gBAAgB,EAAE,CAAC,gBAAgB,CAAC,EAAE;YACnD,gBAAgB,EAAE,QAAQ,KAAK,OAAO;YACtC,qEAAqE;YACrE,kBAAkB,EAAE,KAAK;SAC1B;QACD,4DAA4D;QAC5D,SAAS,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;QAC5B,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE;KAC1B,CAA6B,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QACnE,MAAM,WAAW,CAAC,WAAW,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC;QAC1D,mGAAmG;QACnG,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACjG,sFAAsF;QACtF,MAAM,OAAO,GAAG,CAAC,OAAgB,EAAE,EAAE;YACnC,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;YACrD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YACjE,OAAO,IAAI,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC1C,CAAC,CAAC;QACF,OAAO;YACL,KAAK,CAAC,MAAM,CAAC,OAAO;gBAClB,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;gBAC9B,IAAI,CAAC,IAAI;oBAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,iCAAiC,CAAC,CAAC;gBACzG,gDAAgD;gBAChD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;gBACxE,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YACvD,CAAC;YACD,KAAK,CAAC,MAAM,CAAC,OAAO;gBAClB,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBAC1C,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,SAAS,GAAG,CAAC;oBAAE,OAAO,SAAS,CAAC;gBACtF,yEAAyE;gBACzE,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;gBAC9B,IAAI,CAAC,IAAI;oBAAE,OAAO,IAAI,QAAQ,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;gBACvE,mFAAmF;gBACnF,IAAI,QAAQ,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;oBAC/F,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;oBAC7C,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;oBAChD,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;oBACjC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;gBACzF,CAAC;gBACD,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAC/B,CAAC;YACD,OAAO,EAAE,QAAQ;YACjB,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;SACxB,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC;QACjB,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAID,4GAA4G;AAC5G,SAAS,OAAO,CAAC,OAA0B;IACzC,IAAI,CAAC,OAAO,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IAC5E,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;QAC5B,MAAM,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,wBAAwB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACvE,IAAI,CAAC,IAAI;YACP,MAAM,IAAI,KAAK,CACb,yFAAyF,MAAM,EAAE,CAClG,CAAC;QACJ,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAoB,EAAE,CAAC;IAClD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,6GAA6G;AAC7G,SAAS,WAAW,CAAC,WAAmB,EAAE,OAA0B;IAClE,IAAI,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACrC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,IAAI,GAAG,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;YAC1D,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YAC7B,MAAM,GAAG,CAAC;QACZ,CAAC,CAAC,CAAC;QACH,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,OAAO,CAAC,WAAmB,EAAE,OAA0B;IACpE,MAAM,IAAI,GAAG,IAAI,MAAM,CAAC,EAAE,gBAAgB,EAAE,WAAW,EAAE,uBAAuB,EAAE,MAAM,EAAE,CAAC,CAAC;IAC5F,mFAAmF;IACnF,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,mDAAmD,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAC1G,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;IACrB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,qDAAqD,CAAC;QAClE,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAsB,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,MAAM;YAAE,MAAM,KAAK,CAAC,EAAE,CAAC,CAAC;QAC9F,MAAM,CAAC,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;IACvD,CAAC;YAAS,CAAC;QACT,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC1C,CAAC;AACH,CAAC"}

package/logo-dark.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 60 45"><path fill="white" fill-rule="evenodd" d="M0 0H15V15H30V30H15V45H0V30V15V0ZM45 30V15H30V0H45H60V15V30V45H45H30V30H45Z"/></svg>

package/logo.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 60 45"><path fill="black" fill-rule="evenodd" d="M0 0H15V15H30V30H15V45H0V30V15V0ZM45 30V15H30V0H45H60V15V30V45H45H30V30H45Z"/></svg>

package/package.json

@@ -1,6 +1,68 @@
 {
   "name": "@sanoma-ai/connector-better-auth",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.1.0",
+  "description": "Better Auth as a visitor login for Sanoma's public sites: email and password, on the company's own database",
+  "keywords": [
+    "auth",
+    "better-auth",
+    "connector",
+    "login",
+    "sanoma",
+    "sanoma-connector"
+  ],
+  "homepage": "https://github.com/Sanoma-AI/sanoma/tree/main/connectors/better-auth#readme",
+  "bugs": "https://github.com/Sanoma-AI/sanoma/issues",
+  "license": "FSL-1.1-ALv2",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Sanoma-AI/sanoma.git",
+    "directory": "connectors/better-auth"
+  },
+  "files": [
+    "dist",
+    "logo.svg",
+    "logo-dark.svg",
+    "README.md",
+    "LICENSE"
+  ],
+  "type": "module",
+  "sideEffects": false,
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "better-auth": "~1.7.12",
+    "kysely": "^0.29.7",
+    "pg": "^8.23.1"
+  },
+  "devDependencies": {
+    "@sanoma-ai/app": "0.5.0",
+    "@sanoma-ai/testing": "0.1.0",
+    "@sanoma-ai/workflows": "0.5.0",
+    "@types/pg": "^8.23.1"
+  },
+  "peerDependencies": {
+    "@sanoma-ai/workflows": "^0.5.0"
+  },
+  "engines": {
+    "node": ">=24"
+  },
+  "sanoma": {
+    "title": "Better Auth",
+    "logo": "logo.svg",
+    "logoDark": "logo-dark.svg"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "clean": "rm -rf dist",
+    "watch": "tsc -p tsconfig.build.json --watch --preserveWatchOutput"
+  }
 }