@sanoma-ai/connector-better-auth 0.2.3 → 0.2.5

package/README.md

@@ -35,7 +35,7 @@ It has no credential. Better Auth signs its cookies with a key the app derives f
 
 ### The schema
 
-The tables (`user`, `session`, `account`, `verification`) are in the schema `better_auth` on the company's database (`SANOMA_DATABASE_URL`), beside the runtime's own, in queries that name the schema (no `search_path`, which the URL's own `options` could change). The login runs Better Auth's migrations when the app starts, before it serves the site: once per database in a process, under a Postgres advisory lock, so several processes starting at once do not race. A second start changes nothing.
+The tables (`user`, `session`, `account`, `verification`, and `rateLimit`, the rate limit's counts) are in the schema `better_auth` on the company's database (`SANOMA_DATABASE_URL`), beside the runtime's own, in queries that name the schema (no `search_path`, which the URL's own `options` could change), reached through the pool the app gives the login (`LoginContext.database`: the app's one pool on Node, the request's own on a Worker, with one Better Auth instance per pool and nothing else kept across requests). The worker makes them at its start, as it makes the runtime's own tables: `prepareBetterAuth`, the connector's `prepare`, runs Better Auth's migrations on the database's direct URL under a Postgres advisory lock, so two workers starting at once do not race, and a second run changes nothing; the `sanoma` bin's worker runs `prepareBetterAuthStaff` the same way for the staff sign-in's schema, which no config names. The app never migrates: a login whose first request finds a database the worker has not prepared yet, or has prepared for an older version, waits a minute for a worker starting beside the app, then refuses, saying so (start the worker first, or with it). Nothing of the session is cached in the cookie: every request reads its session row, so a revoked session is gone at once.
 
 ### The routes
 
@@ -58,7 +58,7 @@ const response = await fetch("/auth/better-auth/sign-in/email", {
 if (response.ok) window.location.reload(); // the app reads the new session cookie
 ```
 
-The session is one cookie, `better-auth.session_token` (`__Secure-better-auth.session_token`, and `Secure`, when the site is served over https): HttpOnly, SameSite=Lax, for the site's host only (no `Domain`), for seven days from sign-in. A request for a host that is not the site's is answered 421. Sign-in and sign-up are rate limited per visitor address (three tries in ten seconds), which the app gives the login in its own header, never from `X-Forwarded-For`. A site never imports `better-auth`: its pages only post to these routes.
+The session is one cookie, `better-auth.session_token` (`__Secure-better-auth.session_token`, and `Secure`, when the site is served over https): HttpOnly, SameSite=Lax, for the site's host only (no `Domain`), for seven days from sign-in. A request for a host that is not the site's is answered 421. Sign-in and sign-up are rate limited per visitor address (three tries in ten seconds), which the app gives the login in its own header, never from `X-Forwarded-For`; the counts are rows in the schema's `rateLimit` table, so the limit holds across processes and requests. A site never imports `better-auth`: its pages only post to these routes.
 
 ### An email code
 
@@ -100,16 +100,16 @@ Each `callbackURL` (and `errorCallbackURL`, where an error goes as `?error=<code
 
 ## The staff sign-in
 
-`betterAuthStaffLogin` is the app's sign-in for the company's own people on a host, which the `sanoma` bin uses off this machine (`staffLogin(betterAuthStaffLogin, { github })` from `@sanoma-ai/app`). Unlike the visitor login, nobody signs up: a code is sent, and an account made, only for an email the people file declares (anyone else gets the same answer, and nothing is stored or sent), or a GitHub login it declares. Its tables are in the schema `better_auth_staff`, migrated under the advisory lock `sanoma.login.better-auth.better_auth_staff`; its cookie is `sanoma.session_token`, for seven days, on whatever host the app answers on. Its ways in, under `/auth/better-auth/`:
+`betterAuthStaffLogin` is the app's sign-in for the company's own people on a host, which the `sanoma` bin uses off this machine (`staffLogin(betterAuthStaffLogin, { github })` from `@sanoma-ai/app`). Unlike the visitor login, nobody signs up: a code is sent, and an account made, only for an email the people file declares (anyone else gets the same answer, and nothing is stored or sent), or a GitHub login it declares. Its tables are in the schema `better_auth_staff`, which the worker makes beside `better_auth` ([the schema](#the-schema)); its cookie is `sanoma.session_token`, for seven days, on whatever host the app answers on. Its ways in, under `/auth/better-auth/`:
 
 - an email code (`/email-otp/send-verification-otp`, `/sign-in/email-otp`), with a sender;
-- GitHub (`/sign-in/social`, back at `/callback/github`), with the company's GitHub App's client, matched by the verified email GitHub gives, else the login;
+- GitHub (`/sign-in/social`, back at `/callback/github`), with the company's GitHub App's client, matched by the verified email GitHub gives, else the login (GitHub's `/user` for the sign-in's own token, which is then dropped; the App needs the account permission "Email addresses: read", or a private email ends in Better Auth's `?error=email_not_found`); a GitHub account the files declare by neither is refused as `?error=not_declared` (or, when its unverified email is a row's, Better Auth's `account_not_linked`), with no row left, as is a new GitHub account under a login a row already carries, since GitHub frees a renamed login; declare people by email where you can;
 - an invite (`/magic-link/verify`), a one-use magic link valid 24 hours that the app mints server-side (`invite`), a new one replacing the person's last; Better Auth's own `/sign-in/magic-link` is not served.
 
-Every other Better Auth route is a 404, a POST whose `Origin` is not the request's own host is a 403, and a `callbackURL`, `errorCallbackURL` or `newUserCallbackURL` that is not a path on the request's host is a 400. Invites are minted one at a time. Each sign-in is told to the app (`signin.recorded` in the ledger, with how).
+Every other Better Auth route is a 404, a POST whose `Origin` is not the request's own host is a 403, and a `callbackURL`, `errorCallbackURL` or `newUserCallbackURL` that is not a path on the request's host is a 400. Invites for one email are minted one at a time, whichever process asks (a lock on the database). Each sign-in is told to the app (`signin.recorded` in the ledger, with how).
 
 ### Later
 
-Password reset for visitors, more social providers (Google), and the rate limit kept in the database for several processes.
+Password reset for visitors, and more social providers (Google).
 
 The logo the app shows is Better Auth's mark, from the [Better Auth repository](https://github.com/better-auth/better-auth) (`demo/nextjs/components/logo.tsx`), in black or white. It is there only to identify the service.

package/dist/index.d.ts

@@ -1,3 +1,4 @@
+export { prepareBetterAuth, prepareBetterAuthStaff } from "./instance.ts";
 export { betterAuthLogin } from "./login.ts";
 export { betterAuthStaffLogin } from "./staff.ts";
 /**

package/dist/index.js

@@ -1,6 +1,8 @@
 import { withSetup } from "@sanoma-ai/workflows";
 import { betterAuthOps } from "./connector.js";
+import { prepareBetterAuth } from "./instance.js";
 import { betterAuthLogin } from "./login.js";
+export { prepareBetterAuth, prepareBetterAuthStaff } from "./instance.js";
 export { betterAuthLogin } from "./login.js";
 export { betterAuthStaffLogin } from "./staff.js";
 /**
@@ -10,5 +12,5 @@ export { betterAuthStaffLogin } from "./staff.js";
  * signed with the key the app derives for it. The staff login is `betterAuthStaffLogin`, which the
  * `sanoma` launcher runs on a host.
  */
-export const betterAuth = withSetup(betterAuthOps, { login: betterAuthLogin });
+export const betterAuth = withSetup(betterAuthOps, { prepare: prepareBetterAuth, login: betterAuthLogin });
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAE7C,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAElD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,SAAS,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAE7C,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AAC1E,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAElD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,SAAS,CAAC,aAAa,EAAE,EAAE,OAAO,EAAE,iBAAiB,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC"}

package/dist/instance.d.ts

@@ -2,14 +2,21 @@ import { type BetterAuthOptions } from "better-auth";
 import { PostgresDialect } from "kysely";
 import { Pool } from "pg";
 export type Protocol = "http" | "https";
-/** What each login sets on top of what every instance shares. */
-export type ExtraOptions = Omit<BetterAuthOptions, "database" | "secret" | "secrets" | "basePath" | "baseURL">;
+/** What each login sets on top of what every instance shares; the rate limit is the tables' (`TABLE_OPTIONS`). */
+export type ExtraOptions = Omit<BetterAuthOptions, "database" | "secret" | "secrets" | "basePath" | "baseURL" | "rateLimit">;
+/** The schema each login's tables are in, on the company's database. */
+export declare const SCHEMAS: {
+    readonly visitors: "better_auth";
+    readonly staff: "better_auth_staff";
+};
+type Schema = (typeof SCHEMAS)[keyof typeof SCHEMAS];
 export interface BetterAuthSetup<O extends ExtraOptions> {
-    databaseUrl: string;
+    /** The pool the app's client runs on (`LoginContext.database`): one instance per pool it gives. */
+    database(): Promise<Pool>;
     /** The app's key for this login, 32 bytes as hex (`LoginContext.key`). */
     key: string;
-    /** The schema its tables are in: `better_auth` for visitors, `better_auth_staff` for staff. */
-    schema: string;
+    /** The schema its tables are in (`SCHEMAS`). */
+    schema: Schema;
     /** Where its routes are: `/auth/better-auth`. */
     basePath: string;
     /** The hosts each protocol's instance answers, as Better Auth's `allowedHosts` takes them. */
@@ -18,77 +25,121 @@ export interface BetterAuthSetup<O extends ExtraOptions> {
     options: O;
 }
 /**
- * Opens one Better Auth per protocol on the company's database, after its migrations: `auths` by
- * protocol, the `pool` they share, and `close`, which ends it. Throws, the pool ended, when the
- * key is not one the app derived or the migrations fail.
+ * Better Auth on the company's database, as a function of the request's protocol: the instance
+ * for that protocol on the pool `database` gives now, made on its first use (one per pool and
+ * protocol, kept as long as the pool is). Throws when the key is not one the app derived; its
+ * first use on a pool throws when the schema's tables are still not there, or behind this
+ * version's, a minute after a worker starting beside the app should have made them
+ * (`prepareBetterAuth`).
  */
-export declare function openBetterAuth<O extends ExtraOptions>({ databaseUrl, key, schema, basePath, hosts, options, }: BetterAuthSetup<O>): Promise<{
-    auths: Map<Protocol, import("better-auth").Auth<{
-        rateLimit: {
+export declare function openBetterAuth<O extends ExtraOptions>({ database, key, schema, basePath, hosts, options, }: BetterAuthSetup<O>): (protocol: Protocol) => Promise<import("better-auth").Auth<{
+    rateLimit: {
+        storage: "database";
+        enabled: boolean;
+    };
+    logger: {
+        level: "warn";
+    };
+} & O & {
+    user: {
+        modelName?: "user" | import("better-auth").LiteralString | undefined;
+        fields?: Partial<Record<"createdAt" | "email" | "emailVerified" | "image" | "name" | "updatedAt", string>> | undefined;
+        validateUserInfo?: (data: {
+            user: Partial<import("better-auth").User> & Record<string, unknown>;
+            source: import("better-auth").ValidateUserInfoSource;
+        }, context: import("better-auth").GenericEndpointContext) => import("better-auth").Awaitable<void | import("better-auth").ValidateUserInfoResult>;
+        changeEmail?: {
             enabled: boolean;
+            sendChangeEmailConfirmation?: (data: {
+                user: import("better-auth").User;
+                newEmail: string;
+                url: string;
+                token: string;
+            }, request?: Request) => Promise<void>;
+            updateEmailWithoutVerification?: boolean;
         };
-        logger: {
-            level: "warn";
+        deleteUser?: {
+            enabled?: boolean;
+            sendDeleteAccountVerification?: (data: {
+                user: import("better-auth").User;
+                url: string;
+                token: string;
+            }, request?: Request) => Promise<void>;
+            beforeDelete?: (user: import("better-auth").User, request?: Request) => Promise<void>;
+            afterDelete?: (user: import("better-auth").User, request?: Request) => Promise<void>;
+            deleteTokenExpiresIn?: number;
         };
-    } & O & {
-        database: {
-            dialect: PostgresDialect;
-            type: "postgres";
-            schemaName: string;
-            transaction: boolean;
-        };
-        secrets: {
-            version: number;
-            value: string;
-        }[];
-        secret: string;
-        basePath: string;
-        baseURL: {
-            allowedHosts: string[];
-            protocol: Protocol;
+        additionalFields: {
+            github: {
+                type: "string";
+                required: boolean;
+                input: boolean;
+            };
         };
-        telemetry: {
+    };
+    database: {
+        dialect: PostgresDialect;
+        type: "postgres";
+        schemaName: Schema;
+        transaction: boolean;
+    };
+    secrets: {
+        version: number;
+        value: string;
+    }[];
+    secret: string;
+    basePath: string;
+    baseURL: {
+        allowedHosts: string[];
+        protocol: Protocol;
+    };
+    telemetry: {
+        enabled: boolean;
+    };
+    advanced: {
+        disableCSRFCheck?: boolean | undefined;
+        crossSubDomainCookies?: {
             enabled: boolean;
-        };
-        advanced: {
-            disableCSRFCheck?: boolean | undefined;
-            crossSubDomainCookies?: {
-                enabled: boolean;
-                additionalCookies?: string[];
-                domain?: string;
-            } | undefined;
-            cookies?: {
-                [key: string]: {
-                    name?: string;
-                    attributes?: import("better-auth").CookieOptions;
-                };
-            } | undefined;
-            defaultCookieAttributes?: import("better-auth").CookieOptions | undefined;
-            cookiePrefix?: string | undefined;
-            database?: {
-                defaultFindManyLimit?: number;
-                generateId?: import("better-auth").GenerateIdFn | false | "serial" | "uuid";
-                joins?: boolean;
-                validateSchema?: boolean;
-            } | undefined;
-            trustedProxyHeaders?: boolean | undefined;
-            backgroundTasks?: {
-                handler: (promise: Promise<unknown>) => void;
+            additionalCookies?: string[];
+            domain?: string;
+        } | undefined;
+        cookies?: {
+            [key: string]: {
+                name?: string;
+                attributes?: import("better-auth").CookieOptions;
             };
-            skipTrailingSlashes?: boolean;
-            ipAddress: {
-                ipAddressHeaders?: string[];
-                disableIpTracking?: boolean;
-                ipv6Subnet?: number;
-                trustedProxies?: string[];
-            };
-            useSecureCookies: boolean;
-            disableOriginCheck: boolean;
+        } | undefined;
+        defaultCookieAttributes?: import("better-auth").CookieOptions | undefined;
+        cookiePrefix?: string | undefined;
+        database?: {
+            defaultFindManyLimit?: number;
+            generateId?: import("better-auth").GenerateIdFn | false | "serial" | "uuid";
+            joins?: boolean;
+            validateSchema?: boolean;
+        } | undefined;
+        trustedProxyHeaders?: boolean | undefined;
+        backgroundTasks?: {
+            handler: (promise: Promise<unknown>) => void;
+        };
+        skipTrailingSlashes?: boolean;
+        ipAddress: {
+            ipAddressHeaders?: string[];
+            disableIpTracking?: boolean;
+            ipv6Subnet?: number;
+            trustedProxies?: string[];
         };
-    }>>;
-    pool: Pool;
-    close: () => Promise<void>;
-}>;
+        useSecureCookies: boolean;
+        disableOriginCheck: boolean;
+    };
+}>>;
+/**
+ * Makes the visitor login's tables (`better_auth`) on the company's database: the connector's
+ * `prepare`, which the worker runs at its start on the database's direct URL. Idempotent: a
+ * second run changes nothing.
+ */
+export declare const prepareBetterAuth: (databaseUrl: string) => Promise<void>;
+/** Makes the staff login's tables (`better_auth_staff`), as `prepareBetterAuth` the visitors': the launcher's worker runs it, since no config names that login. */
+export declare const prepareBetterAuthStaff: (databaseUrl: string) => Promise<void>;
 /** A request's protocol: https when it came over TLS or through a proxy that says so (`x-forwarded-proto`). */
 export declare const protocolOf: (request: Request) => Protocol;
 /**
@@ -636,14 +687,6 @@ export declare const emailCode: (sendCode?: (email: string, code: string) => Pro
 };
 /** Whether each redirect a request names is a path on its own host: `/x`, never `//x` or another origin. */
 export declare const localRedirects: (url: URL) => boolean;
-/** The user's `github` column, the GitHub login: never a person's input, so only the login sets it. */
-export declare const GITHUB_FIELD: {
-    github: {
-        type: "string";
-        required: boolean;
-        input: boolean;
-    };
-};
 /** A user row, as far as who it vouches for reads it. */
 export interface User {
     email: string;
@@ -655,3 +698,4 @@ export declare const identityOf: (user: User) => {
     email?: string | undefined;
     github?: string | undefined;
 };
+export {};

package/dist/instance.js

@@ -5,31 +5,60 @@ import { emailOTP } from "better-auth/plugins/email-otp";
 import { PostgresDialect } from "kysely";
 import { setTimeout as delay } from "node:timers/promises";
 import { Client, Pool } from "pg";
-/** Each database and schema's migration, once per process however many logins run on it. */
-const migrated = new Map();
+/** The schema each login's tables are in, on the company's database. */
+export const SCHEMAS = { visitors: "better_auth", staff: "better_auth_staff" };
+/**
+ * What shapes the tables, the same for both logins and laid over theirs: the user's `github`
+ * column (the GitHub login: never a person's input, so only the login sets it), and the rate
+ * limit's table (`rateLimit.storage: "database"`, so a limit holds across processes and
+ * requests). The plugins they run (the email code, magic links) keep no tables of their own.
+ */
+const TABLE_OPTIONS = {
+    user: { additionalFields: { github: { type: "string", required: false, input: false } } },
+    rateLimit: { storage: "database" },
+};
+/** Better Auth's database options for `schema`, on `pool`: the migrations' and the instances' the same. */
+const databaseOn = (pool, schema) => ({
+    dialect: new PostgresDialect({ pool }),
+    type: "postgres",
+    // Schema-qualified queries, not a search_path, which the URL's own `options` could undo.
+    schemaName: schema,
+    transaction: true,
+});
 /**
- * Opens one Better Auth per protocol on the company's database, after its migrations: `auths` by
- * protocol, the `pool` they share, and `close`, which ends it. Throws, the pool ended, when the
- * key is not one the app derived or the migrations fail.
+ * Each database and schema found prepared, for the process's life: a pool that finds its schema
+ * prepared spares every pool on that database the check after it. A check in flight is its own
+ * pool's and no one else's (on a Worker a request's pool goes with the request), so nothing waits
+ * on another request's work, and a failed check leaves nothing behind.
  */
-export async function openBetterAuth({ databaseUrl, key, schema, basePath, hosts, options, }) {
+const prepared = new Set();
+/** What a pool connects to, as the key a check is remembered by: its connection string, else its host and database. */
+function databaseOf(pool) {
+    const { connectionString, host, port, database } = pool.options;
+    return connectionString ?? `${host}:${port}/${database}`;
+}
+/** How long an opening login waits for a worker starting beside it to prepare the schema, and how often it looks. */
+const PREPARED_WAIT_MS = 60_000;
+const PREPARED_POLL_MS = 1_000;
+/**
+ * Better Auth on the company's database, as a function of the request's protocol: the instance
+ * for that protocol on the pool `database` gives now, made on its first use (one per pool and
+ * protocol, kept as long as the pool is). Throws when the key is not one the app derived; its
+ * first use on a pool throws when the schema's tables are still not there, or behind this
+ * version's, a minute after a worker starting beside the app should have made them
+ * (`prepareBetterAuth`).
+ */
+export function openBetterAuth({ database, key, schema, basePath, hosts, options, }) {
     // Never Better Auth's own fallback (an environment variable, or its default secret).
     if (!/^[0-9a-f]{64}$/.test(key))
         throw new Error("better-auth: the app gives no key to sign cookies with");
-    const pool = new Pool({ connectionString: databaseUrl });
-    pool.on("error", (err) => console.warn(`better-auth: a database connection failed: ${err.message}`));
-    const optionsFor = (protocol) => ({
-        // On only in production by default; in memory, per process.
-        rateLimit: { enabled: true },
+    const optionsFor = (pool, protocol) => ({
+        // On only in production by default; its counts in the schema's table, never in memory.
+        rateLimit: { enabled: true, ...TABLE_OPTIONS.rateLimit },
         logger: { level: "warn" },
         ...options,
-        // Schema-qualified queries, not a search_path, which the URL's own `options` could undo.
-        database: {
-            dialect: new PostgresDialect({ pool }),
-            type: "postgres",
-            schemaName: schema,
-            transaction: true,
-        },
+        user: { ...options.user, ...TABLE_OPTIONS.user },
+        database: databaseOn(pool, schema),
         // `secrets` over `secret`, else BETTER_AUTH_SECRETS in the environment would win.
         secrets: [{ version: 1, value: key }],
         secret: key,
@@ -38,7 +67,8 @@ export async function openBetterAuth({ databaseUrl, key, schema, basePath, hosts
         baseURL: { allowedHosts: [...(hosts.get(protocol) ?? [])], protocol },
         telemetry: { enabled: false },
         advanced: {
-            // The app sets it from the socket; Better Auth would otherwise believe a client's X-Forwarded-For.
+            // The app sets it from the socket, or from its host's own header; Better Auth would
+            // otherwise believe a client's X-Forwarded-For.
             ipAddress: { ipAddressHeaders: [CLIENT_IP_HEADER] },
             useSecureCookies: protocol === "https",
             // Its default under NODE_ENV=test is off: the same check everywhere.
@@ -46,48 +76,83 @@ export async function openBetterAuth({ databaseUrl, key, schema, basePath, hosts
             ...options.advanced,
         },
     });
-    try {
-        const protocols = [...hosts.keys()];
-        await migrateOnce(databaseUrl, schema, optionsFor(protocols[0]));
-        // After the migrations: its start checks the tables, and says the schema is out of date otherwise.
-        const auths = new Map(protocols.map((protocol) => [protocol, betterAuth(optionsFor(protocol))]));
-        return { auths, pool, close: () => pool.end() };
-    }
-    catch (err) {
-        await pool.end();
-        throw err;
+    /** Each pool's instances, by protocol, for as long as the pool is referenced. */
+    const made = new WeakMap();
+    return async (protocol) => {
+        const pool = await database();
+        const found = `${databaseOf(pool)}#${schema}`;
+        if (!prepared.has(found)) {
+            await checkPrepared(pool, schema);
+            prepared.add(found);
+        }
+        let auths = made.get(pool);
+        if (!auths)
+            made.set(pool, (auths = new Map()));
+        let auth = auths.get(protocol);
+        if (!auth)
+            auths.set(protocol, (auth = betterAuth(optionsFor(pool, protocol))));
+        return auth;
+    };
+}
+/**
+ * Waits for `schema` to hold every table and column this version's migrations would make (Better
+ * Auth's own migration plan, read and never run), looking every second for a minute, since a
+ * deployment's worker starts beside its app; then refuses: the worker makes them, and the app
+ * never does.
+ */
+async function checkPrepared(pool, schema) {
+    const database = databaseOn(pool, schema);
+    for (const deadline = Date.now() + PREPARED_WAIT_MS;; await delay(PREPARED_POLL_MS)) {
+        const { toBeCreated, toBeAdded } = await getMigrations({ ...TABLE_OPTIONS, database });
+        if (toBeCreated.length === 0 && toBeAdded.length === 0)
+            return;
+        if (Date.now() >= deadline)
+            throw new Error(`better-auth: the database's ${schema} tables are missing or behind this version's: the worker makes them at its start, and the app never does`);
     }
 }
-/** Better Auth's migrations, once per database and schema in this process, under the advisory lock across processes. */
-function migrateOnce(databaseUrl, schema, options) {
-    const at = `${databaseUrl}#${schema}`;
-    let done = migrated.get(at);
+/** `run` once per `key` in this process, again after it fails. */
+function once(memo, key, run) {
+    let done = memo.get(key);
     if (!done) {
-        done = migrate(databaseUrl, schema, options).catch((err) => {
-            migrated.delete(at);
+        done = run().catch((err) => {
+            memo.delete(key);
             throw err;
         });
-        migrated.set(at, done);
+        memo.set(key, done);
     }
     return done;
 }
+/** Each database and schema's migration, once per process however many workers run on it. */
+const migrated = new Map();
+/** The preparation of one login's `schema`: its migrations, once per process, under an advisory lock across processes. */
+const preparing = (schema) => (databaseUrl) => once(migrated, `${databaseUrl}#${schema}`, () => migrate(databaseUrl, schema));
+/**
+ * Makes the visitor login's tables (`better_auth`) on the company's database: the connector's
+ * `prepare`, which the worker runs at its start on the database's direct URL. Idempotent: a
+ * second run changes nothing.
+ */
+export const prepareBetterAuth = preparing(SCHEMAS.visitors);
+/** Makes the staff login's tables (`better_auth_staff`), as `prepareBetterAuth` the visitors': the launcher's worker runs it, since no config names that login. */
+export const prepareBetterAuthStaff = preparing(SCHEMAS.staff);
 /**
  * Holds the lock on a session of its own until that ends, whatever fails; polled, never waited
- * for by a blocked statement, as the runtime's own preparation does. The migrations make the schema.
+ * for by a blocked statement, as the runtime's own preparation does. The migrations make the
+ * schema, on a pool of their own, ended after.
  */
-async function migrate(databaseUrl, schema, options) {
+async function migrate(databaseUrl, schema) {
     const conn = new Client({ connectionString: databaseUrl, connectionTimeoutMillis: 10_000 });
     // An error nobody listens for ends the process; the query in flight fails with it.
     conn.on("error", (err) => console.warn(`better-auth: the migration's connection failed: ${err.message}`));
     await conn.connect();
+    const pool = new Pool({ connectionString: databaseUrl, max: 1 });
     try {
         const ask = "SELECT pg_try_advisory_lock(hashtext($1)) AS locked";
         while (!(await conn.query(ask, [`sanoma.login.better-auth.${schema}`])).rows[0].locked)
             await delay(50);
-        await (await getMigrations(options)).runMigrations();
+        await (await getMigrations({ ...TABLE_OPTIONS, database: databaseOn(pool, schema) })).runMigrations();
     }
     finally {
-        await conn.end().catch(() => undefined);
+        await Promise.allSettled([conn.end(), pool.end()]);
     }
 }
 /** A request's protocol: https when it came over TLS or through a proxy that says so (`x-forwarded-proto`). */
@@ -126,8 +191,6 @@ export const localRedirects = (url) => REDIRECTS.every((name) => {
     const to = url.searchParams.get(name);
     return to === null || (to.startsWith("/") && !to.startsWith("//") && !to.startsWith("/\\"));
 });
-/** The user's `github` column, the GitHub login: never a person's input, so only the login sets it. */
-export const GITHUB_FIELD = { github: { type: "string", required: false, input: false } };
 /** What a user row vouches for: the email when verified, the GitHub login when GitHub said it. */
 export const identityOf = (user) => ({
     ...(user.emailVerified && { email: user.email }),

package/dist/instance.js.map

@@ -1 +1 @@
-{"version":3,"file":"instance.js","sourceRoot":"","sources":["../src/instance.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACvE,OAAO,EAA0B,UAAU,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,QAAQ,EAAE,MAAM,+BAA+B,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AACzC,OAAO,EAAE,UAAU,IAAI,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;AA0BlC,4FAA4F;AAC5F,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAyB,CAAC;AAElD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAyB,EAC3D,WAAW,EACX,GAAG,EACH,MAAM,EACN,QAAQ,EACR,KAAK,EACL,OAAO,GACY;IACnB,qFAAqF;IACrF,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC3G,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,EAAE,gBAAgB,EAAE,WAAW,EAAE,CAAC,CAAC;IACzD,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,8CAA8C,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACrG,MAAM,UAAU,GAAG,CAAC,QAAkB,EAAE,EAAE,CAAC,CAAC;QAC1C,4DAA4D;QAC5D,SAAS,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;QAC5B,MAAM,EAAE,EAAE,KAAK,EAAE,MAAe,EAAE;QAClC,GAAG,OAAO;QACV,yFAAyF;QACzF,QAAQ,EAAE;YACR,OAAO,EAAE,IAAI,eAAe,CAAC,EAAE,IAAI,EAAE,CAAC;YACtC,IAAI,EAAE,UAAmB;YACzB,UAAU,EAAE,MAAM;YAClB,WAAW,EAAE,IAAI;SAClB;QACD,kFAAkF;QAClF,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;QACrC,MAAM,EAAE,GAAG;QACX,QAAQ;QACR,oEAAoE;QACpE,OAAO,EAAE,EAAE,YAAY,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE;QACrE,SAAS,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;QAC7B,QAAQ,EAAE;YACR,mGAAmG;YACnG,SAAS,EAAE,EAAE,gBAAgB,EAAE,CAAC,gBAAgB,CAAC,EAAE;YACnD,gBAAgB,EAAE,QAAQ,KAAK,OAAO;YACtC,qEAAqE;YACrE,kBAAkB,EAAE,KAAK;YACzB,GAAG,OAAO,CAAC,QAAQ;SACpB;KACF,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACpC,MAAM,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC;QAClE,mGAAmG;QACnG,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACjG,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;IAClD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC;QACjB,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,wHAAwH;AACxH,SAAS,WAAW,CAAC,WAAmB,EAAE,MAAc,EAAE,OAA0B;IAClF,MAAM,EAAE,GAAG,GAAG,WAAW,IAAI,MAAM,EAAE,CAAC;IACtC,IAAI,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC5B,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,IAAI,GAAG,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;YAClE,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACpB,MAAM,GAAG,CAAC;QACZ,CAAC,CAAC,CAAC;QACH,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,OAAO,CAAC,WAAmB,EAAE,MAAc,EAAE,OAA0B;IACpF,MAAM,IAAI,GAAG,IAAI,MAAM,CAAC,EAAE,gBAAgB,EAAE,WAAW,EAAE,uBAAuB,EAAE,MAAM,EAAE,CAAC,CAAC;IAC5F,mFAAmF;IACnF,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,mDAAmD,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAC1G,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;IACrB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,qDAAqD,CAAC;QAClE,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAsB,GAAG,EAAE,CAAC,4BAA4B,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,MAAM;YAC1G,MAAM,KAAK,CAAC,EAAE,CAAC,CAAC;QAClB,MAAM,CAAC,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;IACvD,CAAC;YAAS,CAAC;QACT,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC1C,CAAC;AACH,CAAC;AAED,+GAA+G;AAC/G,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,OAAgB,EAAY,EAAE,CACvD,aAAa,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;AAEjE;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,OAAgB,EAAE,OAAe;IAC/D,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;QAC/G,OAAO,OAAO,CAAC;IACjB,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7C,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;IAChD,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACjC,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;AAC3E,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,QAAyD,EAAE,EAAE,CACrF,QAAQ,CAAC;IACP,SAAS,EAAE,CAAC;IACZ,SAAS,EAAE,GAAG;IACd,QAAQ,EAAE,QAAQ;IAClB,eAAe,EAAE,CAAC;IAClB,KAAK,CAAC,mBAAmB,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE;QAC5C,IAAI,IAAI,KAAK,SAAS;YAAE,MAAM,QAAQ,EAAE,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACvD,CAAC;CACF,CAAC,CAAC;AAEL,qDAAqD;AACrD,MAAM,SAAS,GAAG,CAAC,aAAa,EAAE,kBAAkB,EAAE,oBAAoB,CAAC,CAAC;AAE5E,4GAA4G;AAC5G,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,GAAQ,EAAE,EAAE,CACzC,SAAS,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE;IACvB,MAAM,EAAE,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACtC,OAAO,EAAE,KAAK,IAAI,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;AAC9F,CAAC,CAAC,CAAC;AAEL,uGAAuG;AACvG,MAAM,CAAC,MAAM,YAAY,GAAG,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAiB,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC;AASnG,kGAAkG;AAClG,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,IAAU,EAAE,EAAE,CAAC,CAAC;IACzC,GAAG,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;IAChD,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;CAC5C,CAAC,CAAC"}
+{"version":3,"file":"instance.js","sourceRoot":"","sources":["../src/instance.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACvE,OAAO,EAA0B,UAAU,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,QAAQ,EAAE,MAAM,+BAA+B,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AACzC,OAAO,EAAE,UAAU,IAAI,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;AAoBlC,wEAAwE;AACxE,MAAM,CAAC,MAAM,OAAO,GAAG,EAAE,QAAQ,EAAE,aAAa,EAAE,KAAK,EAAE,mBAAmB,EAAW,CAAC;AAkBxF;;;;;GAKG;AACH,MAAM,aAAa,GAAG;IACpB,IAAI,EAAE,EAAE,gBAAgB,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAiB,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE;IAClG,SAAS,EAAE,EAAE,OAAO,EAAE,UAAmB,EAAE;CAC5C,CAAC;AAEF,2GAA2G;AAC3G,MAAM,UAAU,GAAG,CAAC,IAAU,EAAE,MAAc,EAAE,EAAE,CAAC,CAAC;IAClD,OAAO,EAAE,IAAI,eAAe,CAAC,EAAE,IAAI,EAAE,CAAC;IACtC,IAAI,EAAE,UAAmB;IACzB,yFAAyF;IACzF,UAAU,EAAE,MAAM;IAClB,WAAW,EAAE,IAAI;CAClB,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;AAEnC,uHAAuH;AACvH,SAAS,UAAU,CAAC,IAAU;IAC5B,MAAM,EAAE,gBAAgB,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;IAChE,OAAO,gBAAgB,IAAI,GAAG,IAAI,IAAI,IAAI,IAAI,QAAQ,EAAE,CAAC;AAC3D,CAAC;AAED,qHAAqH;AACrH,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAChC,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAE/B;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAyB,EACrD,QAAQ,EACR,GAAG,EACH,MAAM,EACN,QAAQ,EACR,KAAK,EACL,OAAO,GACY;IACnB,qFAAqF;IACrF,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC3G,MAAM,UAAU,GAAG,CAAC,IAAU,EAAE,QAAkB,EAAE,EAAE,CAAC,CAAC;QACtD,uFAAuF;QACvF,SAAS,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,aAAa,CAAC,SAAS,EAAE;QACxD,MAAM,EAAE,EAAE,KAAK,EAAE,MAAe,EAAE;QAClC,GAAG,OAAO;QACV,IAAI,EAAE,EAAE,GAAG,OAAO,CAAC,IAAI,EAAE,GAAG,aAAa,CAAC,IAAI,EAAE;QAChD,QAAQ,EAAE,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC;QAClC,kFAAkF;QAClF,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;QACrC,MAAM,EAAE,GAAG;QACX,QAAQ;QACR,oEAAoE;QACpE,OAAO,EAAE,EAAE,YAAY,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE;QACrE,SAAS,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;QAC7B,QAAQ,EAAE;YACR,oFAAoF;YACpF,gDAAgD;YAChD,SAAS,EAAE,EAAE,gBAAgB,EAAE,CAAC,gBAAgB,CAAC,EAAE;YACnD,gBAAgB,EAAE,QAAQ,KAAK,OAAO;YACtC,qEAAqE;YACrE,kBAAkB,EAAE,KAAK;YACzB,GAAG,OAAO,CAAC,QAAQ;SACpB;KACF,CAAC,CAAC;IAEH,iFAAiF;IACjF,MAAM,IAAI,GAAG,IAAI,OAAO,EAA6B,CAAC;IACtD,OAAO,KAAK,EAAE,QAAkB,EAAiB,EAAE;QACjD,MAAM,IAAI,GAAG,MAAM,QAAQ,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,MAAM,EAAE,CAAC;QAC9C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAClC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;QACD,IAAI,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,CAAC,KAAK;YAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,GAAG,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC;QAChD,IAAI,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/B,IAAI,CAAC,IAAI;YAAE,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,IAAI,GAAG,UAAU,CAAC,UAAU,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAChF,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,aAAa,CAAC,IAAU,EAAE,MAAc;IACrD,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC1C,KAAK,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,gBAAgB,GAAI,MAAM,KAAK,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACrF,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,MAAM,aAAa,CAAC,EAAE,GAAG,aAAa,EAAE,QAAQ,EAAE,CAAC,CAAC;QACvF,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAC/D,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ;YACxB,MAAM,IAAI,KAAK,CACb,+BAA+B,MAAM,0GAA0G,CAChJ,CAAC;IACN,CAAC;AACH,CAAC;AAED,kEAAkE;AAClE,SAAS,IAAI,CAAC,IAAgC,EAAE,GAAW,EAAE,GAAwB;IACnF,IAAI,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACzB,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,IAAI,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;YAClC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjB,MAAM,GAAG,CAAC;QACZ,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,6FAA6F;AAC7F,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAyB,CAAC;AAElD,0HAA0H;AAC1H,MAAM,SAAS,GACb,CAAC,MAAc,EAAE,EAAE,CACnB,CAAC,WAAmB,EAAiB,EAAE,CACrC,IAAI,CAAC,QAAQ,EAAE,GAAG,WAAW,IAAI,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;AAEnF;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;AAE7D,mKAAmK;AACnK,MAAM,CAAC,MAAM,sBAAsB,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAE/D;;;;GAIG;AACH,KAAK,UAAU,OAAO,CAAC,WAAmB,EAAE,MAAc;IACxD,MAAM,IAAI,GAAG,IAAI,MAAM,CAAC,EAAE,gBAAgB,EAAE,WAAW,EAAE,uBAAuB,EAAE,MAAM,EAAE,CAAC,CAAC;IAC5F,mFAAmF;IACnF,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,mDAAmD,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAC1G,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;IACrB,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,EAAE,gBAAgB,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IACjE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,qDAAqD,CAAC;QAClE,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAsB,GAAG,EAAE,CAAC,4BAA4B,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,MAAM;YAC1G,MAAM,KAAK,CAAC,EAAE,CAAC,CAAC;QAClB,MAAM,CAAC,MAAM,aAAa,CAAC,EAAE,GAAG,aAAa,EAAE,QAAQ,EAAE,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;IACxG,CAAC;YAAS,CAAC;QACT,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACrD,CAAC;AACH,CAAC;AAED,+GAA+G;AAC/G,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,OAAgB,EAAY,EAAE,CACvD,aAAa,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;AAEjE;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,OAAgB,EAAE,OAAe;IAC/D,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;QAC/G,OAAO,OAAO,CAAC;IACjB,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7C,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;IAChD,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACjC,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;AAC3E,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,QAAyD,EAAE,EAAE,CACrF,QAAQ,CAAC;IACP,SAAS,EAAE,CAAC;IACZ,SAAS,EAAE,GAAG;IACd,QAAQ,EAAE,QAAQ;IAClB,eAAe,EAAE,CAAC;IAClB,KAAK,CAAC,mBAAmB,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE;QAC5C,IAAI,IAAI,KAAK,SAAS;YAAE,MAAM,QAAQ,EAAE,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACvD,CAAC;CACF,CAAC,CAAC;AAEL,qDAAqD;AACrD,MAAM,SAAS,GAAG,CAAC,aAAa,EAAE,kBAAkB,EAAE,oBAAoB,CAAC,CAAC;AAE5E,4GAA4G;AAC5G,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,GAAQ,EAAE,EAAE,CACzC,SAAS,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE;IACvB,MAAM,EAAE,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACtC,OAAO,EAAE,KAAK,IAAI,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;AAC9F,CAAC,CAAC,CAAC;AASL,kGAAkG;AAClG,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,IAAU,EAAE,EAAE,CAAC,CAAC;IACzC,GAAG,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;IAChD,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;CAC5C,CAAC,CAAC"}

package/dist/login.d.ts

@@ -5,9 +5,9 @@ import type { LoginContext, LoginHalf } from "@sanoma-ai/workflows";
  * (`context.social.github`), a visitor also signs up and in with GitHub (`/sign-in/social`, which
  * joins the account of GitHub's verified email), or links it once signed in (`/link-social`), and
  * is then said to be that GitHub login (`verify`'s `github`). Its tables are in schema
- * `better_auth` on the company's database, migrated here before the first site starts, its
- * cookies signed with the app's key for it (`context.key`). The site's origins are its allowed
- * hosts (a request for another host is refused) and set the cookie's `Secure` flag: an `https`
- * origin's is.
+ * `better_auth` on the company's database, which the worker makes (`prepareBetterAuth`), reached
+ * through the pool the app gives each request (`context.database`), its cookies signed with the
+ * app's key for it (`context.key`). The site's origins are its allowed hosts (a request for
+ * another host is refused) and set the cookie's `Secure` flag: an `https` origin's is.
  */
-export declare function betterAuthLogin({ databaseUrl, key, origins, sendCode, social, }: LoginContext): Promise<LoginHalf>;
+export declare function betterAuthLogin({ database, key, origins, sendCode, social }: LoginContext): LoginHalf;

package/dist/login.js

@@ -1,7 +1,7 @@
 import { getHostFromSource, matchesHostPattern } from "better-auth";
-import { emailCode, GITHUB_FIELD, identityOf, localRedirects, openBetterAuth, withSignOutBody, } from "./instance.js";
-/** The schema Better Auth's tables (`user`, `session`, `account`, `verification`) live in, on the company's database. */
-const SCHEMA = "better_auth";
+import { emailCode, identityOf, localRedirects, openBetterAuth, SCHEMAS, withSignOutBody, } from "./instance.js";
+/** The schema Better Auth's tables (`user`, `session`, `account`, `verification`, `rateLimit`) live in, on the company's database. */
+const SCHEMA = SCHEMAS.visitors;
 /** Where its routes are: a site's pages POST to `<BASE_PATH>/sign-up/email`, `/sign-in/email`, `/sign-in/email-otp`… */
 const BASE_PATH = "/auth/better-auth";
 const SIGN_OUT = `${BASE_PATH}/sign-out`;
@@ -11,19 +11,19 @@ const SIGN_OUT = `${BASE_PATH}/sign-out`;
  * (`context.social.github`), a visitor also signs up and in with GitHub (`/sign-in/social`, which
  * joins the account of GitHub's verified email), or links it once signed in (`/link-social`), and
  * is then said to be that GitHub login (`verify`'s `github`). Its tables are in schema
- * `better_auth` on the company's database, migrated here before the first site starts, its
- * cookies signed with the app's key for it (`context.key`). The site's origins are its allowed
- * hosts (a request for another host is refused) and set the cookie's `Secure` flag: an `https`
- * origin's is.
+ * `better_auth` on the company's database, which the worker makes (`prepareBetterAuth`), reached
+ * through the pool the app gives each request (`context.database`), its cookies signed with the
+ * app's key for it (`context.key`). The site's origins are its allowed hosts (a request for
+ * another host is refused) and set the cookie's `Secure` flag: an `https` origin's is.
  */
-export async function betterAuthLogin({ databaseUrl, key, origins, sendCode, social, }) {
+export function betterAuthLogin({ database, key, origins, sendCode, social }) {
     const github = social?.github;
     const sites = sitesOf(origins);
     const hosts = new Map();
     for (const { protocol, host } of sites)
         hosts.set(protocol, [...(hosts.get(protocol) ?? []), host]);
-    const { auths, close } = await openBetterAuth({
-        databaseUrl,
+    const auth = openBetterAuth({
+        database,
         key,
         schema: SCHEMA,
         basePath: BASE_PATH,
@@ -31,7 +31,6 @@ export async function betterAuthLogin({ databaseUrl, key, origins, sendCode, soc
         options: {
             emailAndPassword: { enabled: true },
             plugins: sendCode ? [emailCode(sendCode)] : [],
-            user: { additionalFields: GITHUB_FIELD },
             ...(github && {
                 socialProviders: { github: { clientId: github.clientId, clientSecret: github.clientSecret } },
                 // GitHub stays untrusted, and the account's own email must be verified (Better Auth's
@@ -52,7 +51,7 @@ export async function betterAuthLogin({ databaseUrl, key, origins, sendCode, soc
     const authFor = (request) => {
         const host = getHostFromSource(request, false) ?? "";
         const site = sites.find((s) => matchesHostPattern(host, s.host));
-        return site && auths.get(site.protocol);
+        return site && auth(site.protocol);
     };
     const methods = [
         "password",
@@ -61,11 +60,11 @@ export async function betterAuthLogin({ databaseUrl, key, origins, sendCode, soc
     ];
     return {
         async verify(request) {
-            const auth = authFor(request);
-            if (!auth)
+            const own = authFor(request);
+            if (!own)
                 throw new Error(`better-auth: ${request.headers.get("host")} is not one of the site's hosts`);
             // Null for a missing, bad or signed-out cookie.
-            const session = await auth.api.getSession({ headers: request.headers });
+            const session = await (await own).api.getSession({ headers: request.headers });
             if (!session)
                 return null;
             return { subject: session.user.id, ...identityOf(session.user) };
@@ -74,18 +73,17 @@ export async function betterAuthLogin({ databaseUrl, key, origins, sendCode, soc
             const { pathname } = new URL(request.url);
             if (pathname !== BASE_PATH && !pathname.startsWith(`${BASE_PATH}/`))
                 return undefined;
-            // Better Auth throws for a host it does not allow, which would be a 500.
-            const auth = authFor(request);
-            if (!auth)
-                return new Response("Misdirected Request", { status: 421 });
             // Better Auth checks a redirect in a body against the site's hosts; one in the query must be a path here.
             if (!localRedirects(new URL(request.url)))
                 return new Response("Bad Request", { status: 400 });
-            return auth.handler(withSignOutBody(request, SIGN_OUT));
+            // Better Auth throws for a host it does not allow, which would be a 500.
+            const own = authFor(request);
+            if (!own)
+                return new Response("Misdirected Request", { status: 421 });
+            return (await own).handler(withSignOutBody(request, SIGN_OUT));
         },
         signOut: SIGN_OUT,
         methods,
-        close,
     };
 }
 /** A visitor has one GitHub account at most: another is refused (Better Auth's `unable_to_link_account`). */

package/dist/login.js.map

@@ -1 +1 @@
-{"version":3,"file":"login.js","sourceRoot":"","sources":["../src/login.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACpE,OAAO,EACL,SAAS,EACT,YAAY,EACZ,UAAU,EACV,cAAc,EACd,cAAc,EAGd,eAAe,GAChB,MAAM,eAAe,CAAC;AAEvB,yHAAyH;AACzH,MAAM,MAAM,GAAG,aAAa,CAAC;AAC7B,wHAAwH;AACxH,MAAM,SAAS,GAAG,mBAAmB,CAAC;AACtC,MAAM,QAAQ,GAAG,GAAG,SAAS,WAAW,CAAC;AAoBzC;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EACpC,WAAW,EACX,GAAG,EACH,OAAO,EACP,QAAQ,EACR,MAAM,GACO;IACb,MAAM,MAAM,GAAG,MAAM,EAAE,MAAM,CAAC;IAC9B,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC5C,KAAK,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,KAAK;QAAE,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IACpG,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,cAAc,CAAC;QAC5C,WAAW;QACX,GAAG;QACH,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE,SAAS;QACnB,KAAK;QACL,OAAO,EAAE;YACP,gBAAgB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;YACnC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE;YAC9C,IAAI,EAAE,EAAE,gBAAgB,EAAE,YAAY,EAAE;YACxC,GAAG,CAAC,MAAM,IAAI;gBACZ,eAAe,EAAE,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,EAAE;gBAC7F,sFAAsF;gBACtF,oFAAoF;gBACpF,oCAAoC;gBACpC,OAAO,EAAE,EAAE,cAAc,EAAE,EAAE,oBAAoB,EAAE,IAAI,EAAE,yBAAyB,EAAE,IAAI,EAAE,EAAE;gBAC5F,aAAa,EAAE;oBACb,OAAO,EAAE;wBACP,MAAM,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE;wBAC/C,MAAM,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE;wBAC5B,MAAM,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE;qBAC/B;iBACF;aACF,CAAC;SACH;KACF,CAAC,CAAC;IACH,sFAAsF;IACtF,MAAM,OAAO,GAAG,CAAC,OAAgB,EAAE,EAAE;QACnC,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;QACrD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACjE,OAAO,IAAI,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC1C,CAAC,CAAC;IACF,MAAM,OAAO,GAAkB;QAC7B,UAAU;QACV,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,MAAM,CAAW,CAAC,CAAC,CAAC,EAAE,CAAC;QACxC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,QAAQ,CAAW,CAAC,CAAC,CAAC,EAAE,CAAC;KACzC,CAAC;IACF,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,OAAO;YAClB,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;YAC9B,IAAI,CAAC,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,iCAAiC,CAAC,CAAC;YACzG,gDAAgD;YAChD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;YACxE,IAAI,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC;YAC1B,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,UAAU,CAAC,OAAO,CAAC,IAAY,CAAC,EAAE,CAAC;QAC3E,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,OAAO;YAClB,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC1C,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,SAAS,GAAG,CAAC;gBAAE,OAAO,SAAS,CAAC;YACtF,yEAAyE;YACzE,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;YAC9B,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,QAAQ,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YACvE,0GAA0G;YAC1G,IAAI,CAAC,cAAc,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBAAE,OAAO,IAAI,QAAQ,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAC/F,OAAO,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC1D,CAAC;QACD,OAAO,EAAE,QAAQ;QACjB,OAAO;QACP,KAAK;KACN,CAAC;AACJ,CAAC;AAED,6GAA6G;AAC7G,KAAK,UAAU,SAAS,CAAC,OAAsB,EAAE,GAAuB;IACtE,IAAI,OAAO,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,GAAG;QAAE,OAAO;IACpD,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAChF,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;AACpE,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,SAAS,CAAC,OAA6B,EAAE,GAAuB;IAC7E,IAAI,OAAO,EAAE,UAAU,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,GAAG,EAAE,IAAI,KAAK,eAAe;QAAE,OAAO;IACtG,MAAM,EAAE,eAAe,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,6BAA6B,EAAE;YACxD,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,OAAO,CAAC,WAAW,EAAE,EAAE,YAAY,EAAE,QAAQ,EAAE;SACpF,CAAC,CAAC;QACH,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAwB,CAAC;QAChF,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACtG,MAAM,eAAe,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACtE,CAAC;YAAS,CAAC;QACT,MAAM,eAAe,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5G,CAAC;AACH,CAAC;AAED,mEAAmE;AACnE,KAAK,UAAU,WAAW,CAAC,OAA6B,EAAE,GAAuB;IAC/E,IAAI,OAAO,EAAE,UAAU,KAAK,QAAQ,IAAI,GAAG;QACzC,MAAM,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;AACnF,CAAC;AAED,4GAA4G;AAC5G,SAAS,OAAO,CAAC,OAA0B;IACzC,IAAI,CAAC,OAAO,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IAC5E,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;QAC5B,MAAM,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,wBAAwB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACvE,IAAI,CAAC,IAAI;YACP,MAAM,IAAI,KAAK,CACb,yFAAyF,MAAM,EAAE,CAClG,CAAC;QACJ,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAoB,EAAE,CAAC;IAClD,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"login.js","sourceRoot":"","sources":["../src/login.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACpE,OAAO,EACL,SAAS,EACT,UAAU,EACV,cAAc,EACd,cAAc,EAEd,OAAO,EAEP,eAAe,GAChB,MAAM,eAAe,CAAC;AAEvB,sIAAsI;AACtI,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;AAChC,wHAAwH;AACxH,MAAM,SAAS,GAAG,mBAAmB,CAAC;AACtC,MAAM,QAAQ,GAAG,GAAG,SAAS,WAAW,CAAC;AAoBzC;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAgB;IACxF,MAAM,MAAM,GAAG,MAAM,EAAE,MAAM,CAAC;IAC9B,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC5C,KAAK,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,KAAK;QAAE,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IACpG,MAAM,IAAI,GAAG,cAAc,CAAC;QAC1B,QAAQ;QACR,GAAG;QACH,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE,SAAS;QACnB,KAAK;QACL,OAAO,EAAE;YACP,gBAAgB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;YACnC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE;YAC9C,GAAG,CAAC,MAAM,IAAI;gBACZ,eAAe,EAAE,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,EAAE;gBAC7F,sFAAsF;gBACtF,oFAAoF;gBACpF,oCAAoC;gBACpC,OAAO,EAAE,EAAE,cAAc,EAAE,EAAE,oBAAoB,EAAE,IAAI,EAAE,yBAAyB,EAAE,IAAI,EAAE,EAAE;gBAC5F,aAAa,EAAE;oBACb,OAAO,EAAE;wBACP,MAAM,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE;wBAC/C,MAAM,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE;wBAC5B,MAAM,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE;qBAC/B;iBACF;aACF,CAAC;SACH;KACF,CAAC,CAAC;IACH,sFAAsF;IACtF,MAAM,OAAO,GAAG,CAAC,OAAgB,EAAE,EAAE;QACnC,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;QACrD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACjE,OAAO,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACrC,CAAC,CAAC;IACF,MAAM,OAAO,GAAkB;QAC7B,UAAU;QACV,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,MAAM,CAAW,CAAC,CAAC,CAAC,EAAE,CAAC;QACxC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,QAAQ,CAAW,CAAC,CAAC,CAAC,EAAE,CAAC;KACzC,CAAC;IACF,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,OAAO;YAClB,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;YAC7B,IAAI,CAAC,GAAG;gBAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,iCAAiC,CAAC,CAAC;YACxG,gDAAgD;YAChD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;YAC/E,IAAI,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC;YAC1B,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,UAAU,CAAC,OAAO,CAAC,IAAY,CAAC,EAAE,CAAC;QAC3E,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,OAAO;YAClB,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC1C,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,SAAS,GAAG,CAAC;gBAAE,OAAO,SAAS,CAAC;YACtF,0GAA0G;YAC1G,IAAI,CAAC,cAAc,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBAAE,OAAO,IAAI,QAAQ,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAC/F,yEAAyE;YACzE,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;YAC7B,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,QAAQ,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YACtE,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;QACjE,CAAC;QACD,OAAO,EAAE,QAAQ;QACjB,OAAO;KACR,CAAC;AACJ,CAAC;AAED,6GAA6G;AAC7G,KAAK,UAAU,SAAS,CAAC,OAAsB,EAAE,GAAuB;IACtE,IAAI,OAAO,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,GAAG;QAAE,OAAO;IACpD,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAChF,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;AACpE,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,SAAS,CAAC,OAA6B,EAAE,GAAuB;IAC7E,IAAI,OAAO,EAAE,UAAU,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,GAAG,EAAE,IAAI,KAAK,eAAe;QAAE,OAAO;IACtG,MAAM,EAAE,eAAe,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,6BAA6B,EAAE;YACxD,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,OAAO,CAAC,WAAW,EAAE,EAAE,YAAY,EAAE,QAAQ,EAAE;SACpF,CAAC,CAAC;QACH,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAwB,CAAC;QAChF,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACtG,MAAM,eAAe,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACtE,CAAC;YAAS,CAAC;QACT,MAAM,eAAe,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5G,CAAC;AACH,CAAC;AAED,mEAAmE;AACnE,KAAK,UAAU,WAAW,CAAC,OAA6B,EAAE,GAAuB;IAC/E,IAAI,OAAO,EAAE,UAAU,KAAK,QAAQ,IAAI,GAAG;QACzC,MAAM,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;AACnF,CAAC;AAED,4GAA4G;AAC5G,SAAS,OAAO,CAAC,OAA0B;IACzC,IAAI,CAAC,OAAO,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IAC5E,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;QAC5B,MAAM,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,wBAAwB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACvE,IAAI,CAAC,IAAI;YACP,MAAM,IAAI,KAAK,CACb,yFAAyF,MAAM,EAAE,CAClG,CAAC;QACJ,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAoB,EAAE,CAAC;IAClD,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/staff.d.ts

@@ -6,6 +6,7 @@ import { type LoginContext, type LoginHalf } from "@sanoma-ai/workflows";
  * cookie, `sanoma.session_token`, for the host, seven days. A code is sent, and a user made, only
  * for a person `staff.admits`: an undeclared email gets the same answer and leaves nothing.
  * Each sign-in is told to `staff.record`. It answers on any host the app does, so a change
- * (any POST) to its routes must come from the page's own origin.
+ * (any POST) to its routes must come from the page's own origin. It runs on the pool the app
+ * gives each request (`database`), and keeps nothing between requests.
  */
-export declare function betterAuthStaffLogin({ databaseUrl, key, sendCode, staff }: LoginContext): Promise<LoginHalf>;
+export declare function betterAuthStaffLogin({ database, key, sendCode, staff }: LoginContext): LoginHalf;

package/dist/staff.js

@@ -2,14 +2,16 @@ import { INVITE_SECONDS, sameOrigin, } from "@sanoma-ai/workflows";
 import { createAuthMiddleware } from "better-auth/api";
 import { magicLink } from "better-auth/plugins/magic-link";
 import { createHash } from "node:crypto";
-import { emailCode, GITHUB_FIELD, identityOf, localRedirects, openBetterAuth, protocolOf, withSignOutBody, } from "./instance.js";
+import { emailCode, identityOf, localRedirects, openBetterAuth, protocolOf, SCHEMAS, withSignOutBody, } from "./instance.js";
+/** Says nothing: a listener for a checked-out client's `error`, whose query fails on its own. */
+const quiet = () => undefined;
 // The staff login: Better Auth again, as a second instance in a schema of its own, signing in only
 // the people the files declare. An email code to a declared email, GitHub through the company's
 // own client, and invites (one-use magic links the app mints for a declared email); no password.
 // A code or a user row is never made for anyone else: the declared-email check is in Better Auth's
 // hooks, not its `disableSignUp`, which would send no code until a user row exists.
 /** The schema the staff login's tables are in, beside the visitors' `better_auth`. */
-const SCHEMA = "better_auth_staff";
+const SCHEMA = SCHEMAS.staff;
 const BASE_PATH = "/auth/better-auth";
 const SIGN_OUT = `${BASE_PATH}/sign-out`;
 const SEND_CODE = "/email-otp/send-verification-otp";
@@ -27,6 +29,13 @@ const ROUTES = new Set([
 ]);
 /** The routes of the email code, which answer only when the app can send one. */
 const CODE_ROUTES = new Set([SEND_CODE, "/sign-in/email-otp"]);
+/** GitHub's tokens are never kept: a GitHub App's user token reaches what the App and the person both reach. */
+const dropTokens = async () => ({ data: { accessToken: null, refreshToken: null, idToken: null } });
+/** A GitHub account gone (a code proves an email its unverified row had, and drops its accounts): its user is no longer that login. */
+const forgetLogin = async (account, ctx) => {
+    if (account?.providerId === "github" && ctx)
+        await ctx.context.internalAdapter.updateUser(account.userId, { github: null });
+};
 /** How a session was made, by the route that made it. */
 const METHOD_OF = {
     "/sign-in/email-otp": "code",
@@ -40,16 +49,25 @@ const METHOD_OF = {
  * cookie, `sanoma.session_token`, for the host, seven days. A code is sent, and a user made, only
  * for a person `staff.admits`: an undeclared email gets the same answer and leaves nothing.
  * Each sign-in is told to `staff.record`. It answers on any host the app does, so a change
- * (any POST) to its routes must come from the page's own origin.
+ * (any POST) to its routes must come from the page's own origin. It runs on the pool the app
+ * gives each request (`database`), and keeps nothing between requests.
  */
-export async function betterAuthStaffLogin({ databaseUrl, key, sendCode, staff }) {
+export function betterAuthStaffLogin({ database, key, sendCode, staff }) {
     if (!staff)
         throw new Error("better-auth: the staff login needs the app's staff context");
     const github = staff.social.github;
     /** Each invite's token as Better Auth hands it over, by email, until `invite` takes it. */
     const minted = new Map();
-    const { auths, close } = await openBetterAuth({
-        databaseUrl,
+    /** The login GitHub's profile names, by the request it came in, until `keepLogin` writes it. */
+    const logins = new WeakMap();
+    /** Keeps the login GitHub named for this request on the account's user, once the account is made or refreshed. */
+    const keepLogin = async (account, ctx) => {
+        const login = account?.providerId === "github" && ctx ? logins.get(ctx) : undefined;
+        if (login)
+            await ctx.context.internalAdapter.updateUser(account.userId, { github: login });
+    };
+    const auth = openBetterAuth({
+        database,
         key,
         schema: SCHEMA,
         basePath: BASE_PATH,
@@ -60,14 +78,44 @@ export async function betterAuthStaffLogin({ databaseUrl, key, sendCode, staff }
         ]),
         options: {
             session: { expiresIn: SESSION_SECONDS },
-            user: { additionalFields: GITHUB_FIELD },
+            user: {
+                // Nobody the files do not declare gets a row, whatever the route: by the verified email
+                // the route proved, or by the login GitHub's own profile names (Better Auth sets no field
+                // from a profile that a person may not set, so the login is kept by `keepLogin`), before
+                // anything is written. A GitHub sign-in is checked again each time, with the fresh profile.
+                validateUserInfo: async ({ user, source }, ctx) => {
+                    const refused = {
+                        error: "not_declared",
+                        errorDescription: "This company's files declare nobody with that account",
+                    };
+                    const said = source.oauth?.providerId === "github" ? source.oauth.profile?.login : undefined;
+                    const login = typeof said === "string" ? said : undefined;
+                    if (login)
+                        logins.set(ctx, login);
+                    const { adapter, internalAdapter } = ctx.context;
+                    // A new GitHub account under a login a row already carries is another account (GitHub
+                    // frees a renamed login): it is not the declared person, whatever the files say.
+                    if (login && source.action === "create-user") {
+                        const holder = await adapter.findOne({ model: "user", where: [{ field: "github", value: login }] });
+                        if (holder)
+                            return refused;
+                    }
+                    // Signing in again, or linking: GitHub's email may have moved; the row's verified one still vouches.
+                    const row = typeof user.id === "string" ? await internalAdapter.findUserById(user.id) : null;
+                    const identity = {
+                        ...identityOf(user),
+                        ...(row && row.emailVerified && { email: row.email }),
+                        ...(login && { github: login }),
+                    };
+                    return staff.admits(identity) ? undefined : refused;
+                },
+            },
             advanced: { cookiePrefix: "sanoma" },
             ...(github && {
                 socialProviders: {
                     github: {
                         clientId: github.clientId,
                         clientSecret: github.clientSecret,
-                        mapProfileToUser: (profile) => ({ github: profile.login }),
                     },
                 },
             }),
@@ -91,11 +139,10 @@ export async function betterAuthStaffLogin({ databaseUrl, key, sendCode, staff }
                 }),
             },
             databaseHooks: {
-                user: {
-                    create: {
-                        // Nobody the files do not declare gets a row, whatever the route.
-                        before: async (user) => (staff.admits(identityOf(user)) ? undefined : false),
-                    },
+                account: {
+                    create: { before: dropTokens, after: keepLogin },
+                    update: { before: dropTokens, after: keepLogin },
+                    delete: { after: forgetLogin },
                 },
                 session: {
                     create: {
@@ -112,34 +159,63 @@ export async function betterAuthStaffLogin({ databaseUrl, key, sendCode, staff }
             },
         },
     });
-    const authFor = (request) => auths.get(protocolOf(request));
+    const authFor = (request) => auth(protocolOf(request));
     const methods = [
         ...(sendCode ? ["code"] : []),
         ...(github ? ["github"] : []),
         "invite",
     ];
-    /** Mints `email`'s invite, server-side, its token from `minted`; a new one replaces the last. */
-    async function mint(email, request) {
-        const auth = authFor(request);
+    /** The mints of this process, one after another. */
+    let mints = Promise.resolve();
+    /**
+     * Mints `email`'s invite, server-side, its token from `minted`; a new one replaces the last. One
+     * at a time per email, whichever process asks: a transaction of its own holds Postgres's lock
+     * for the email while the old row goes and the new one is written on the pool's other
+     * connections (a transaction's lock is one connection's for the transaction, safe through a
+     * pooler), so two mints at once leave one invite, and `minted` hands over the right token. One
+     * at a time in the process as well (`mints`): the lock's connection is one of the pool's, and
+     * many held at once, each waiting for another of the pool's, would leave none for Better Auth.
+     */
+    function mint(email, request) {
+        const minting = mints.then(() => mintNow(email, request));
+        mints = minting.catch(() => undefined);
+        return minting;
+    }
+    async function mintNow(email, request) {
+        const own = await authFor(request);
         const normalized = email.toLowerCase();
-        // A new invite replaces the last: the old one's row goes.
-        const { adapter } = await auth.$context;
-        await adapter.deleteMany({
-            model: "verification",
-            where: [{ field: "value", value: JSON.stringify({ type: "magic-link", email: normalized }) }],
-        });
-        await auth.api.signInMagicLink({ body: { email: normalized, callbackURL: "/" }, headers: request.headers });
+        const lock = await (await database()).connect();
+        // A checked-out client with no listener would throw its connection's error as uncaught; the query fails instead.
+        lock.on("error", quiet);
+        try {
+            await lock.query("BEGIN");
+            await lock.query("SELECT pg_advisory_xact_lock(hashtext($1))", [`sanoma.login.invite.${normalized}`]);
+            // A new invite replaces the last: the old one's row goes.
+            const { adapter } = await own.$context;
+            await adapter.deleteMany({
+                model: "verification",
+                where: [{ field: "value", value: JSON.stringify({ type: "magic-link", email: normalized }) }],
+            });
+            await own.api.signInMagicLink({ body: { email: normalized, callbackURL: "/" }, headers: request.headers });
+            await lock.query("COMMIT");
+        }
+        catch (err) {
+            await lock.query("ROLLBACK").catch(() => undefined);
+            throw err;
+        }
+        finally {
+            lock.off("error", quiet);
+            lock.release();
+        }
         const token = minted.get(normalized);
         minted.delete(normalized);
         if (!token)
             throw new Error("better-auth: the invite was not minted");
         return token;
     }
-    /** The invite being minted, which the next waits for. */
-    let invites = Promise.resolve();
     return {
         async verify(request) {
-            const session = await authFor(request).api.getSession({ headers: request.headers });
+            const session = await (await authFor(request)).api.getSession({ headers: request.headers });
             return session ? { subject: session.user.id, ...identityOf(session.user) } : null;
         },
         async handle(request) {
@@ -154,20 +230,14 @@ export async function betterAuthStaffLogin({ databaseUrl, key, sendCode, staff }
             // Any host is allowed, so Better Auth trusts any redirect: only a path on this host is taken.
             if (!localRedirects(new URL(request.url)))
                 return new Response("Bad Request", { status: 400 });
-            return authFor(request).handler(withSignOutBody(request, SIGN_OUT));
+            return (await authFor(request)).handler(withSignOutBody(request, SIGN_OUT));
         },
         signOut: SIGN_OUT,
         methods,
-        invite(email, request) {
-            // One at a time: each takes its token from `minted` and replaces the last invite's row.
-            const next = invites.then(() => mint(email, request));
-            invites = next.catch(() => undefined);
-            return next;
-        },
+        invite: mint,
         async invitation(token) {
-            // The first of the instances: they share the tables.
-            const auth = auths.values().next().value;
-            const { internalAdapter } = await auth.$context;
+            // Either protocol's instance: they share the tables.
+            const { internalAdapter } = await (await auth("https")).$context;
             const found = await internalAdapter.findVerificationValue(`magic-link:${hashed(token)}`);
             if (!found || found.expiresAt < new Date())
                 return undefined;
@@ -177,7 +247,6 @@ export async function betterAuthStaffLogin({ databaseUrl, key, sendCode, staff }
             const query = new URLSearchParams({ token, callbackURL: "/" });
             return { email, path: `${BASE_PATH}/magic-link/verify?${query}` };
         },
-        close,
     };
 }
 /** A token as the magic link plugin stores it (`storeToken: "hashed"`): SHA-256, base64url without padding. */

package/dist/staff.js.map

@@ -1 +1 @@
-{"version":3,"file":"staff.js","sourceRoot":"","sources":["../src/staff.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EAId,UAAU,GAEX,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,SAAS,EACT,YAAY,EACZ,UAAU,EACV,cAAc,EACd,cAAc,EAEd,UAAU,EAEV,eAAe,GAChB,MAAM,eAAe,CAAC;AAEvB,mGAAmG;AACnG,gGAAgG;AAChG,iGAAiG;AACjG,mGAAmG;AACnG,oFAAoF;AAEpF,sFAAsF;AACtF,MAAM,MAAM,GAAG,mBAAmB,CAAC;AACnC,MAAM,SAAS,GAAG,mBAAmB,CAAC;AACtC,MAAM,QAAQ,GAAG,GAAG,SAAS,WAAW,CAAC;AACzC,MAAM,SAAS,GAAG,kCAAkC,CAAC;AACrD,sIAAsI;AACtI,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAEzC,+HAA+H;AAC/H,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC;IACrB,SAAS;IACT,oBAAoB;IACpB,iBAAiB;IACjB,kBAAkB;IAClB,oBAAoB;IACpB,WAAW;IACX,cAAc;CACf,CAAC,CAAC;AAEH,iFAAiF;AACjF,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC,CAAC;AAQ/D,yDAAyD;AACzD,MAAM,SAAS,GAAiC;IAC9C,oBAAoB,EAAE,MAAM;IAC5B,eAAe,EAAE,QAAQ;IACzB,oBAAoB,EAAE,QAAQ;CAC/B,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAgB;IAC5F,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAC1F,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC;IACnC,2FAA2F;IAC3F,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,cAAc,CAAC;QAC5C,WAAW;QACX,GAAG;QACH,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE,SAAS;QACnB,iGAAiG;QACjG,KAAK,EAAE,IAAI,GAAG,CAAqB;YACjC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC;YACf,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC;SACjB,CAAC;QACF,OAAO,EAAE;YACP,OAAO,EAAE,EAAE,SAAS,EAAE,eAAe,EAAE;YACvC,IAAI,EAAE,EAAE,gBAAgB,EAAE,YAAY,EAAE;YACxC,QAAQ,EAAE,EAAE,YAAY,EAAE,QAAQ,EAAE;YACpC,GAAG,CAAC,MAAM,IAAI;gBACZ,eAAe,EAAE;oBACf,MAAM,EAAE;wBACN,QAAQ,EAAE,MAAM,CAAC,QAAQ;wBACzB,YAAY,EAAE,MAAM,CAAC,YAAY;wBACjC,gBAAgB,EAAE,CAAC,OAA0B,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;qBAC9E;iBACF;aACF,CAAC;YACF,OAAO,EAAE;gBACP,SAAS,CAAC;oBACR,SAAS,EAAE,cAAc;oBACzB,UAAU,EAAE,QAAQ;oBACpB,aAAa,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC;iBACzE,CAAC;gBACF,yFAAyF;gBACzF,SAAS,CAAC,QAAQ,CAAC;aACpB;YACD,KAAK,EAAE;gBACL,uFAAuF;gBACvF,MAAM,EAAE,oBAAoB,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;oBACzC,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS;wBAAE,OAAO;oBACnC,MAAM,KAAK,GAAI,GAAG,CAAC,IAAwC,EAAE,KAAK,CAAC;oBACnE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC;wBAAE,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;gBAChG,CAAC,CAAC;aACH;YACD,aAAa,EAAE;gBACb,IAAI,EAAE;oBACJ,MAAM,EAAE;wBACN,kEAAkE;wBAClE,MAAM,EAAE,KAAK,EAAE,IAAU,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;qBACnF;iBACF;gBACD,OAAO,EAAE;oBACP,MAAM,EAAE;wBACN,KAAK,EAAE,KAAK,EAAE,OAA2B,EAAE,GAA0B,EAAE,EAAE;4BACvE,MAAM,MAAM,GAAG,GAAG,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;4BACzE,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG;gCAAE,OAAO;4BAC5B,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;4BAC5E,IAAI,IAAI;gCAAE,MAAM,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;wBACzD,CAAC;qBACF;iBACF;aACF;SACF;KACF,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,CAAC,OAAgB,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,CAAE,CAAC;IACtE,MAAM,OAAO,GAAkB;QAC7B,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,MAAM,CAAW,CAAC,CAAC,CAAC,EAAE,CAAC;QACxC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,QAAQ,CAAW,CAAC,CAAC,CAAC,EAAE,CAAC;QACxC,QAAQ;KACT,CAAC;IAEF,iGAAiG;IACjG,KAAK,UAAU,IAAI,CAAC,KAAa,EAAE,OAAgB;QACjD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAC9B,MAAM,UAAU,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;QACvC,0DAA0D;QAC1D,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC;QACxC,MAAM,OAAO,CAAC,UAAU,CAAC;YACvB,KAAK,EAAE,cAAc;YACrB,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;SAC9F,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5G,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACrC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC1B,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QACtE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,yDAAyD;IACzD,IAAI,OAAO,GAAqB,OAAO,CAAC,OAAO,EAAE,CAAC;IAElD,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,OAAO;YAClB,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;YACpF,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACpF,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,OAAO;YAClB,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC1C,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,SAAS,GAAG,CAAC;gBAAE,OAAO,SAAS,CAAC;YACtF,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAC/C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,IAAI,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBAC7D,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YACpD,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;gBAAE,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YACxG,8FAA8F;YAC9F,IAAI,CAAC,cAAc,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBAAE,OAAO,IAAI,QAAQ,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAC/F,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;QACtE,CAAC;QACD,OAAO,EAAE,QAAQ;QACjB,OAAO;QACP,MAAM,CAAC,KAAK,EAAE,OAAO;YACnB,wFAAwF;YACxF,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;YACtD,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YACtC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,KAAK;YACpB,qDAAqD;YACrD,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAM,CAAC;YAC1C,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC;YAChD,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,qBAAqB,CAAC,cAAc,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACzF,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE;gBAAE,OAAO,SAAS,CAAC;YAC7D,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAuB,CAAC;YAChE,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,OAAO,SAAS,CAAC;YAChD,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC;YAC/D,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,SAAS,sBAAsB,KAAK,EAAE,EAAE,CAAC;QACpE,CAAC;QACD,KAAK;KACN,CAAC;AACJ,CAAC;AAED,+GAA+G;AAC/G,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC"}
+{"version":3,"file":"staff.js","sourceRoot":"","sources":["../src/staff.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EAId,UAAU,GAEX,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,SAAS,EACT,UAAU,EACV,cAAc,EACd,cAAc,EAEd,UAAU,EACV,OAAO,EAEP,eAAe,GAChB,MAAM,eAAe,CAAC;AAEvB,iGAAiG;AACjG,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,SAAS,CAAC;AAE9B,mGAAmG;AACnG,gGAAgG;AAChG,iGAAiG;AACjG,mGAAmG;AACnG,oFAAoF;AAEpF,sFAAsF;AACtF,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;AAC7B,MAAM,SAAS,GAAG,mBAAmB,CAAC;AACtC,MAAM,QAAQ,GAAG,GAAG,SAAS,WAAW,CAAC;AACzC,MAAM,SAAS,GAAG,kCAAkC,CAAC;AACrD,sIAAsI;AACtI,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAEzC,+HAA+H;AAC/H,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC;IACrB,SAAS;IACT,oBAAoB;IACpB,iBAAiB;IACjB,kBAAkB;IAClB,oBAAoB;IACpB,WAAW;IACX,cAAc;CACf,CAAC,CAAC;AAEH,iFAAiF;AACjF,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC,CAAC;AAmB/D,gHAAgH;AAChH,MAAM,UAAU,GAAG,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;AACpG,uIAAuI;AACvI,MAAM,WAAW,GAAG,KAAK,EAAE,OAAuB,EAAE,GAAuB,EAAE,EAAE;IAC7E,IAAI,OAAO,EAAE,UAAU,KAAK,QAAQ,IAAI,GAAG;QACzC,MAAM,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;AACnF,CAAC,CAAC;AAEF,yDAAyD;AACzD,MAAM,SAAS,GAAiC;IAC9C,oBAAoB,EAAE,MAAM;IAC5B,eAAe,EAAE,QAAQ;IACzB,oBAAoB,EAAE,QAAQ;CAC/B,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAgB;IACnF,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAC1F,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC;IACnC,2FAA2F;IAC3F,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,gGAAgG;IAChG,MAAM,MAAM,GAAG,IAAI,OAAO,EAAkB,CAAC;IAC7C,kHAAkH;IAClH,MAAM,SAAS,GAAG,KAAK,EAAE,OAAuB,EAAE,GAAuB,EAAE,EAAE;QAC3E,MAAM,KAAK,GAAG,OAAO,EAAE,UAAU,KAAK,QAAQ,IAAI,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACpF,IAAI,KAAK;YAAE,MAAM,GAAI,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC,OAAQ,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/F,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,cAAc,CAAC;QAC1B,QAAQ;QACR,GAAG;QACH,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE,SAAS;QACnB,iGAAiG;QACjG,KAAK,EAAE,IAAI,GAAG,CAAqB;YACjC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC;YACf,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC;SACjB,CAAC;QACF,OAAO,EAAE;YACP,OAAO,EAAE,EAAE,SAAS,EAAE,eAAe,EAAE;YACvC,IAAI,EAAE;gBACJ,wFAAwF;gBACxF,0FAA0F;gBAC1F,yFAAyF;gBACzF,4FAA4F;gBAC5F,gBAAgB,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,EAAE;oBAChD,MAAM,OAAO,GAAG;wBACd,KAAK,EAAE,cAAc;wBACrB,gBAAgB,EAAE,uDAAuD;qBAC1E,CAAC;oBACF,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,EAAE,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;oBAC7F,MAAM,KAAK,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;oBAC1D,IAAI,KAAK;wBAAE,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;oBAClC,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC;oBACjD,sFAAsF;oBACtF,iFAAiF;oBACjF,IAAI,KAAK,IAAI,MAAM,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;wBAC7C,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;wBACpG,IAAI,MAAM;4BAAE,OAAO,OAAO,CAAC;oBAC7B,CAAC;oBACD,qGAAqG;oBACrG,MAAM,GAAG,GAAG,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,eAAe,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;oBAC7F,MAAM,QAAQ,GAAG;wBACf,GAAG,UAAU,CAAC,IAAY,CAAC;wBAC3B,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,aAAa,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC;wBACrD,GAAG,CAAC,KAAK,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;qBAChC,CAAC;oBACF,OAAO,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;gBACtD,CAAC;aACF;YACD,QAAQ,EAAE,EAAE,YAAY,EAAE,QAAQ,EAAE;YACpC,GAAG,CAAC,MAAM,IAAI;gBACZ,eAAe,EAAE;oBACf,MAAM,EAAE;wBACN,QAAQ,EAAE,MAAM,CAAC,QAAQ;wBACzB,YAAY,EAAE,MAAM,CAAC,YAAY;qBAClC;iBACF;aACF,CAAC;YACF,OAAO,EAAE;gBACP,SAAS,CAAC;oBACR,SAAS,EAAE,cAAc;oBACzB,UAAU,EAAE,QAAQ;oBACpB,aAAa,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC;iBACzE,CAAC;gBACF,yFAAyF;gBACzF,SAAS,CAAC,QAAQ,CAAC;aACpB;YACD,KAAK,EAAE;gBACL,uFAAuF;gBACvF,MAAM,EAAE,oBAAoB,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;oBACzC,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS;wBAAE,OAAO;oBACnC,MAAM,KAAK,GAAI,GAAG,CAAC,IAAwC,EAAE,KAAK,CAAC;oBACnE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC;wBAAE,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;gBAChG,CAAC,CAAC;aACH;YACD,aAAa,EAAE;gBACb,OAAO,EAAE;oBACP,MAAM,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE;oBAChD,MAAM,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE;oBAChD,MAAM,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE;iBAC/B;gBACD,OAAO,EAAE;oBACP,MAAM,EAAE;wBACN,KAAK,EAAE,KAAK,EAAE,OAA2B,EAAE,GAAuB,EAAE,EAAE;4BACpE,MAAM,MAAM,GAAG,GAAG,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;4BACzE,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG;gCAAE,OAAO;4BAC5B,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;4BAC5E,IAAI,IAAI;gCAAE,MAAM,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;wBACzD,CAAC;qBACF;iBACF;aACF;SACF;KACF,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,CAAC,OAAgB,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;IAChE,MAAM,OAAO,GAAkB;QAC7B,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,MAAM,CAAW,CAAC,CAAC,CAAC,EAAE,CAAC;QACxC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,QAAQ,CAAW,CAAC,CAAC,CAAC,EAAE,CAAC;QACxC,QAAQ;KACT,CAAC;IAEF,oDAAoD;IACpD,IAAI,KAAK,GAAqB,OAAO,CAAC,OAAO,EAAE,CAAC;IAEhD;;;;;;;;OAQG;IACH,SAAS,IAAI,CAAC,KAAa,EAAE,OAAgB;QAC3C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;QAC1D,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACvC,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,UAAU,OAAO,CAAC,KAAa,EAAE,OAAgB;QACpD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;QACnC,MAAM,UAAU,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;QAChD,iHAAiH;QACjH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC1B,MAAM,IAAI,CAAC,KAAK,CAAC,4CAA4C,EAAE,CAAC,uBAAuB,UAAU,EAAE,CAAC,CAAC,CAAC;YACtG,0DAA0D;YAC1D,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC;YACvC,MAAM,OAAO,CAAC,UAAU,CAAC;gBACvB,KAAK,EAAE,cAAc;gBACrB,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;aAC9F,CAAC,CAAC;YACH,MAAM,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;YAC3G,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YACpD,MAAM,GAAG,CAAC;QACZ,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACzB,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACrC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC1B,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QACtE,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,OAAO;YAClB,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;YAC5F,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACpF,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,OAAO;YAClB,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC1C,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,SAAS,GAAG,CAAC;gBAAE,OAAO,SAAS,CAAC;YACtF,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAC/C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,IAAI,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBAC7D,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YACpD,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;gBAAE,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YACxG,8FAA8F;YAC9F,IAAI,CAAC,cAAc,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBAAE,OAAO,IAAI,QAAQ,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAC/F,OAAO,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC9E,CAAC;QACD,OAAO,EAAE,QAAQ;QACjB,OAAO;QACP,MAAM,EAAE,IAAI;QACZ,KAAK,CAAC,UAAU,CAAC,KAAK;YACpB,qDAAqD;YACrD,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;YACjE,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,qBAAqB,CAAC,cAAc,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACzF,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE;gBAAE,OAAO,SAAS,CAAC;YAC7D,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAuB,CAAC;YAChE,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,OAAO,SAAS,CAAC;YAChD,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC;YAC/D,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,SAAS,sBAAsB,KAAK,EAAE,EAAE,CAAC;QACpE,CAAC;KACF,CAAC;AACJ,CAAC;AAED,+GAA+G;AAC/G,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sanoma-ai/connector-better-auth",
-  "version": "0.2.3",
+  "version": "0.2.5",
   "description": "Better Auth for Sanoma: the visitor login of public sites (email and password, or an email code) and the staff sign-in on a host (email code, invite links, GitHub), on the company's own database",
   "keywords": [
     "auth",
@@ -44,13 +44,12 @@
     "pg": "^8.23.1"
   },
   "devDependencies": {
-    "@sanoma-ai/app": "0.10.8",
     "@sanoma-ai/testing": "0.1.1",
-    "@sanoma-ai/workflows": "0.11.4",
+    "@sanoma-ai/workflows": "0.11.13",
     "@types/pg": "^8.23.1"
   },
   "peerDependencies": {
-    "@sanoma-ai/workflows": "^0.11.4"
+    "@sanoma-ai/workflows": "^0.11.13"
   },
   "engines": {
     "node": ">=26"