@sanoma-ai/connector-better-auth 0.2.4 → 0.2.6

package/dist/index.js

@@ -1,6 +1,8 @@
 import { withSetup } from "@sanoma-ai/workflows";
 import { betterAuthOps } from "./connector.js";
+import { prepareBetterAuth } from "./instance.js";
 import { betterAuthLogin } from "./login.js";
+export { prepareBetterAuth, prepareBetterAuthStaff } from "./instance.js";
 export { betterAuthLogin } from "./login.js";
 export { betterAuthStaffLogin } from "./staff.js";
 /**
@@ -10,5 +12,5 @@ export { betterAuthStaffLogin } from "./staff.js";
  * signed with the key the app derives for it. The staff login is `betterAuthStaffLogin`, which the
  * `sanoma` launcher runs on a host.
  */
-export const betterAuth = withSetup(betterAuthOps, { login: betterAuthLogin });
+export const betterAuth = withSetup(betterAuthOps, { prepare: prepareBetterAuth, login: betterAuthLogin });
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAE7C,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAElD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,SAAS,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAE7C,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AAC1E,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAElD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,SAAS,CAAC,aAAa,EAAE,EAAE,OAAO,EAAE,iBAAiB,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC"}

package/dist/instance.d.ts

@@ -1,15 +1,21 @@
 import { type BetterAuthOptions } from "better-auth";
-import { PostgresDialect } from "kysely";
-import { Pool } from "pg";
+import type { Pool } from "pg";
 export type Protocol = "http" | "https";
-/** What each login sets on top of what every instance shares. */
-export type ExtraOptions = Omit<BetterAuthOptions, "database" | "secret" | "secrets" | "basePath" | "baseURL">;
+/** What each login sets on top of what every instance shares; the rate limit is the tables' (`TABLE_OPTIONS`). */
+export type ExtraOptions = Omit<BetterAuthOptions, "database" | "secret" | "secrets" | "basePath" | "baseURL" | "rateLimit">;
+/** The schema each login's tables are in, on the company's database (`db/visitors.ts`, `db/staff.ts`). */
+export declare const SCHEMAS: {
+    readonly visitors: "better_auth";
+    readonly staff: "better_auth_staff";
+};
+type Schema = (typeof SCHEMAS)[keyof typeof SCHEMAS];
 export interface BetterAuthSetup<O extends ExtraOptions> {
-    databaseUrl: string;
+    /** The pool the app's client runs on (`LoginContext.database`): one instance per pool it gives. */
+    database(): Promise<Pool>;
     /** The app's key for this login, 32 bytes as hex (`LoginContext.key`). */
     key: string;
-    /** The schema its tables are in: `better_auth` for visitors, `better_auth_staff` for staff. */
-    schema: string;
+    /** The schema its tables are in (`SCHEMAS`). */
+    schema: Schema;
     /** Where its routes are: `/auth/better-auth`. */
     basePath: string;
     /** The hosts each protocol's instance answers, as Better Auth's `allowedHosts` takes them. */
@@ -18,77 +24,137 @@ export interface BetterAuthSetup<O extends ExtraOptions> {
     options: O;
 }
 /**
- * Opens one Better Auth per protocol on the company's database, after its migrations: `auths` by
- * protocol, the `pool` they share, and `close`, which ends it. Throws, the pool ended, when the
- * key is not one the app derived or the migrations fail.
+ * What shapes the tables beyond Better Auth's own, the same for both logins and laid over theirs,
+ * as `db/tables.ts` declares them: the user's `github` column (the GitHub login: never a person's
+ * input, so only the login sets it), and the rate limit's table (`rateLimit.storage: "database"`,
+ * so a limit holds across processes and requests). The plugins they run (the email code, magic
+ * links) keep no tables of their own.
  */
-export declare function openBetterAuth<O extends ExtraOptions>({ databaseUrl, key, schema, basePath, hosts, options, }: BetterAuthSetup<O>): Promise<{
-    auths: Map<Protocol, import("better-auth").Auth<{
-        rateLimit: {
-            enabled: boolean;
+export declare const TABLE_OPTIONS: {
+    user: {
+        additionalFields: {
+            github: {
+                type: "string";
+                required: boolean;
+                input: boolean;
+            };
         };
-        logger: {
-            level: "warn";
+    };
+    rateLimit: {
+        storage: "database";
+    };
+};
+/**
+ * Better Auth on the company's database, as a function of the request's protocol: the instance
+ * for that protocol on the pool `database` gives now, made on its first use (one per pool and
+ * protocol, kept as long as the pool is). Throws when the key is not one the app derived; its
+ * first use on a pool throws when the schema's tables are still not there, or behind this
+ * version's, a minute after a worker starting beside the app should have made them
+ * (`prepareBetterAuth`).
+ */
+export declare function openBetterAuth<O extends ExtraOptions>({ database, key, schema, basePath, hosts, options, }: BetterAuthSetup<O>): (protocol: Protocol) => Promise<import("better-auth").Auth<{
+    rateLimit: {
+        storage: "database";
+        enabled: boolean;
+    };
+    logger: {
+        level: "warn";
+    };
+} & O & {
+    user: {
+        modelName?: "user" | import("better-auth").LiteralString | undefined;
+        fields?: Partial<Record<"createdAt" | "email" | "emailVerified" | "image" | "name" | "updatedAt", string>> | undefined;
+        validateUserInfo?: (data: {
+            user: Partial<import("better-auth").User> & Record<string, unknown>;
+            source: import("better-auth").ValidateUserInfoSource;
+        }, context: import("better-auth").GenericEndpointContext) => import("better-auth").Awaitable<void | import("better-auth").ValidateUserInfoResult>;
+        changeEmail?: {
+            enabled: boolean;
+            sendChangeEmailConfirmation?: (data: {
+                user: import("better-auth").User;
+                newEmail: string;
+                url: string;
+                token: string;
+            }, request?: Request) => Promise<void>;
+            updateEmailWithoutVerification?: boolean;
         };
-    } & O & {
-        database: {
-            dialect: PostgresDialect;
-            type: "postgres";
-            schemaName: string;
-            transaction: boolean;
+        deleteUser?: {
+            enabled?: boolean;
+            sendDeleteAccountVerification?: (data: {
+                user: import("better-auth").User;
+                url: string;
+                token: string;
+            }, request?: Request) => Promise<void>;
+            beforeDelete?: (user: import("better-auth").User, request?: Request) => Promise<void>;
+            afterDelete?: (user: import("better-auth").User, request?: Request) => Promise<void>;
+            deleteTokenExpiresIn?: number;
         };
-        secrets: {
-            version: number;
-            value: string;
-        }[];
-        secret: string;
-        basePath: string;
-        baseURL: {
-            allowedHosts: string[];
-            protocol: Protocol;
+        additionalFields: {
+            github: {
+                type: "string";
+                required: boolean;
+                input: boolean;
+            };
         };
-        telemetry: {
+    };
+    database: (options: BetterAuthOptions) => import("better-auth").DBAdapter<BetterAuthOptions>;
+    secrets: {
+        version: number;
+        value: string;
+    }[];
+    secret: string;
+    basePath: string;
+    baseURL: {
+        allowedHosts: string[];
+        protocol: Protocol;
+    };
+    telemetry: {
+        enabled: boolean;
+    };
+    advanced: {
+        disableCSRFCheck?: boolean | undefined;
+        crossSubDomainCookies?: {
             enabled: boolean;
-        };
-        advanced: {
-            disableCSRFCheck?: boolean | undefined;
-            crossSubDomainCookies?: {
-                enabled: boolean;
-                additionalCookies?: string[];
-                domain?: string;
-            } | undefined;
-            cookies?: {
-                [key: string]: {
-                    name?: string;
-                    attributes?: import("better-auth").CookieOptions;
-                };
-            } | undefined;
-            defaultCookieAttributes?: import("better-auth").CookieOptions | undefined;
-            cookiePrefix?: string | undefined;
-            database?: {
-                defaultFindManyLimit?: number;
-                generateId?: import("better-auth").GenerateIdFn | false | "serial" | "uuid";
-                joins?: boolean;
-                validateSchema?: boolean;
-            } | undefined;
-            trustedProxyHeaders?: boolean | undefined;
-            backgroundTasks?: {
-                handler: (promise: Promise<unknown>) => void;
-            };
-            skipTrailingSlashes?: boolean;
-            ipAddress: {
-                ipAddressHeaders?: string[];
-                disableIpTracking?: boolean;
-                ipv6Subnet?: number;
-                trustedProxies?: string[];
+            additionalCookies?: string[];
+            domain?: string;
+        } | undefined;
+        cookies?: {
+            [key: string]: {
+                name?: string;
+                attributes?: import("better-auth").CookieOptions;
             };
-            useSecureCookies: boolean;
-            disableOriginCheck: boolean;
+        } | undefined;
+        defaultCookieAttributes?: import("better-auth").CookieOptions | undefined;
+        cookiePrefix?: string | undefined;
+        database?: {
+            defaultFindManyLimit?: number;
+            generateId?: import("better-auth").GenerateIdFn | false | "serial" | "uuid";
+            joins?: boolean;
+            validateSchema?: boolean;
+        } | undefined;
+        trustedProxyHeaders?: boolean | undefined;
+        backgroundTasks?: {
+            handler: (promise: Promise<unknown>) => void;
         };
-    }>>;
-    pool: Pool;
-    close: () => Promise<void>;
-}>;
+        skipTrailingSlashes?: boolean;
+        ipAddress: {
+            ipAddressHeaders?: string[];
+            disableIpTracking?: boolean;
+            ipv6Subnet?: number;
+            trustedProxies?: string[];
+        };
+        useSecureCookies: boolean;
+        disableOriginCheck: boolean;
+    };
+}>>;
+/**
+ * Makes the visitor login's tables (`better_auth`) on the company's database: the connector's
+ * `prepare`, which the worker runs at its start on the database's direct URL. Idempotent: a
+ * second run changes nothing.
+ */
+export declare const prepareBetterAuth: (databaseUrl: string) => Promise<void>;
+/** Makes the staff login's tables (`better_auth_staff`), as `prepareBetterAuth` the visitors': the launcher's worker runs it, since no config names that login. */
+export declare const prepareBetterAuthStaff: (databaseUrl: string) => Promise<void>;
 /** A request's protocol: https when it came over TLS or through a proxy that says so (`x-forwarded-proto`). */
 export declare const protocolOf: (request: Request) => Protocol;
 /**
@@ -636,14 +702,6 @@ export declare const emailCode: (sendCode?: (email: string, code: string) => Pro
 };
 /** Whether each redirect a request names is a path on its own host: `/x`, never `//x` or another origin. */
 export declare const localRedirects: (url: URL) => boolean;
-/** The user's `github` column, the GitHub login: never a person's input, so only the login sets it. */
-export declare const GITHUB_FIELD: {
-    github: {
-        type: "string";
-        required: boolean;
-        input: boolean;
-    };
-};
 /** A user row, as far as who it vouches for reads it. */
 export interface User {
     email: string;
@@ -655,3 +713,4 @@ export declare const identityOf: (user: User) => {
     email?: string | undefined;
     github?: string | undefined;
 };
+export {};

package/dist/instance.js

@@ -1,35 +1,84 @@
-import { CLIENT_IP_HEADER, requestOrigin } from "@sanoma-ai/workflows";
+import { CLIENT_IP_HEADER, errorMessage, requestOrigin } from "@sanoma-ai/workflows";
+import { applyMigrations, databaseOn, migrationsApplied, pgCode, underPreparationLock } from "@sanoma-ai/workflows/db";
 import { betterAuth } from "better-auth";
-import { getMigrations } from "better-auth/db/migration";
+import { drizzleAdapter } from "better-auth/adapters/drizzle";
 import { emailOTP } from "better-auth/plugins/email-otp";
-import { PostgresDialect } from "kysely";
 import { setTimeout as delay } from "node:timers/promises";
-import { Client, Pool } from "pg";
-/** Each database and schema's migration, once per process however many logins run on it. */
-const migrated = new Map();
+import * as staff from "./db/staff.js";
+import * as visitors from "./db/visitors.js";
+import staffJournal from "../drizzle/staff/meta/_journal.json" with { type: "json" };
+import visitorsJournal from "../drizzle/visitors/meta/_journal.json" with { type: "json" };
+/** The schema each login's tables are in, on the company's database (`db/visitors.ts`, `db/staff.ts`). */
+export const SCHEMAS = { visitors: visitors.schema.schemaName, staff: staff.schema.schemaName };
+/**
+ * Each schema's login: its tables (its `db/` module, Better Auth's models by name, as its Drizzle
+ * adapter reads them) and their generated migrations, whose journal tables are the runtime's
+ * neighbours in the schema `drizzle`.
+ */
+const LOGINS = {
+    [SCHEMAS.visitors]: {
+        tables: visitors,
+        migrations: {
+            folder: () => new URL("../drizzle/visitors/", import.meta.url),
+            table: "__drizzle_migrations_better_auth",
+            journal: visitorsJournal,
+        },
+    },
+    [SCHEMAS.staff]: {
+        tables: staff,
+        migrations: {
+            folder: () => new URL("../drizzle/staff/", import.meta.url),
+            table: "__drizzle_migrations_better_auth_staff",
+            journal: staffJournal,
+        },
+    },
+};
+/**
+ * What shapes the tables beyond Better Auth's own, the same for both logins and laid over theirs,
+ * as `db/tables.ts` declares them: the user's `github` column (the GitHub login: never a person's
+ * input, so only the login sets it), and the rate limit's table (`rateLimit.storage: "database"`,
+ * so a limit holds across processes and requests). The plugins they run (the email code, magic
+ * links) keep no tables of their own.
+ */
+export const TABLE_OPTIONS = {
+    user: { additionalFields: { github: { type: "string", required: false, input: false } } },
+    rateLimit: { storage: "database" },
+};
+/**
+ * Each database and schema found prepared, for the process's life: a pool that finds its schema
+ * prepared spares every pool on that database the check after it. A check in flight is its own
+ * pool's and no one else's (on a Worker a request's pool goes with the request), so nothing waits
+ * on another request's work, and a failed check leaves nothing behind.
+ */
+const prepared = new Set();
+/** What a pool connects to, as the key a check is remembered by: its connection string, else its host and database. */
+function databaseOf(pool) {
+    const { connectionString, host, port, database } = pool.options;
+    return connectionString ?? `${host}:${port}/${database}`;
+}
+/** How long an opening login waits for a worker starting beside it to prepare the schema, and how often it looks. */
+const PREPARED_WAIT_MS = 60_000;
+const PREPARED_POLL_MS = 1_000;
 /**
- * Opens one Better Auth per protocol on the company's database, after its migrations: `auths` by
- * protocol, the `pool` they share, and `close`, which ends it. Throws, the pool ended, when the
- * key is not one the app derived or the migrations fail.
+ * Better Auth on the company's database, as a function of the request's protocol: the instance
+ * for that protocol on the pool `database` gives now, made on its first use (one per pool and
+ * protocol, kept as long as the pool is). Throws when the key is not one the app derived; its
+ * first use on a pool throws when the schema's tables are still not there, or behind this
+ * version's, a minute after a worker starting beside the app should have made them
+ * (`prepareBetterAuth`).
  */
-export async function openBetterAuth({ databaseUrl, key, schema, basePath, hosts, options, }) {
+export function openBetterAuth({ database, key, schema, basePath, hosts, options, }) {
     // Never Better Auth's own fallback (an environment variable, or its default secret).
     if (!/^[0-9a-f]{64}$/.test(key))
         throw new Error("better-auth: the app gives no key to sign cookies with");
-    const pool = new Pool({ connectionString: databaseUrl });
-    pool.on("error", (err) => console.warn(`better-auth: a database connection failed: ${err.message}`));
-    const optionsFor = (protocol) => ({
-        // On only in production by default; in memory, per process.
-        rateLimit: { enabled: true },
+    const optionsFor = (pool, protocol) => ({
+        // On only in production by default; its counts in the schema's table, never in memory.
+        rateLimit: { enabled: true, ...TABLE_OPTIONS.rateLimit },
         logger: { level: "warn" },
         ...options,
-        // Schema-qualified queries, not a search_path, which the URL's own `options` could undo.
-        database: {
-            dialect: new PostgresDialect({ pool }),
-            type: "postgres",
-            schemaName: schema,
-            transaction: true,
-        },
+        user: { ...options.user, ...TABLE_OPTIONS.user },
+        // The schema's own tables, so no search_path, which the URL's own `options` could undo.
+        database: drizzleAdapter(databaseOn(pool), { provider: "pg", schema: LOGINS[schema].tables, transaction: true }),
         // `secrets` over `secret`, else BETTER_AUTH_SECRETS in the environment would win.
         secrets: [{ version: 1, value: key }],
         secret: key,
@@ -38,7 +87,8 @@ export async function openBetterAuth({ databaseUrl, key, schema, basePath, hosts
         baseURL: { allowedHosts: [...(hosts.get(protocol) ?? [])], protocol },
         telemetry: { enabled: false },
         advanced: {
-            // The app sets it from the socket; Better Auth would otherwise believe a client's X-Forwarded-For.
+            // The app sets it from the socket, or from its host's own header; Better Auth would
+            // otherwise believe a client's X-Forwarded-For.
             ipAddress: { ipAddressHeaders: [CLIENT_IP_HEADER] },
             useSecureCookies: protocol === "https",
             // Its default under NODE_ENV=test is off: the same check everywhere.
@@ -46,50 +96,76 @@ export async function openBetterAuth({ databaseUrl, key, schema, basePath, hosts
             ...options.advanced,
         },
     });
-    try {
-        const protocols = [...hosts.keys()];
-        await migrateOnce(databaseUrl, schema, optionsFor(protocols[0]));
-        // After the migrations: its start checks the tables, and says the schema is out of date otherwise.
-        const auths = new Map(protocols.map((protocol) => [protocol, betterAuth(optionsFor(protocol))]));
-        return { auths, pool, close: () => pool.end() };
-    }
-    catch (err) {
-        await pool.end();
-        throw err;
+    /** Each pool's instances, by protocol, for as long as the pool is referenced. */
+    const made = new WeakMap();
+    return async (protocol) => {
+        const pool = await database();
+        const found = `${databaseOf(pool)}#${schema}`;
+        if (!prepared.has(found)) {
+            await checkPrepared(pool, schema);
+            prepared.add(found);
+        }
+        let auths = made.get(pool);
+        if (!auths)
+            made.set(pool, (auths = new Map()));
+        let auth = auths.get(protocol);
+        if (!auth)
+            auths.set(protocol, (auth = betterAuth(optionsFor(pool, protocol))));
+        return auth;
+    };
+}
+/**
+ * Waits for the database to have had every migration of `schema`'s tables (by its journal, as
+ * `prepareDatabase` checks the runtime's own), looking every second for a minute, since a
+ * deployment's worker starts beside its app; then refuses: the worker makes them, and the app
+ * never does.
+ */
+async function checkPrepared(pool, schema) {
+    const db = databaseOn(pool);
+    for (const deadline = Date.now() + PREPARED_WAIT_MS;; await delay(PREPARED_POLL_MS)) {
+        if (await migrationsApplied(db, LOGINS[schema].migrations))
+            return;
+        if (Date.now() >= deadline)
+            throw new Error(`better-auth: the database's ${schema} tables are missing or behind this version's: the worker makes them at its start, and the app never does`);
     }
 }
-/** Better Auth's migrations, once per database and schema in this process, under the advisory lock across processes. */
-function migrateOnce(databaseUrl, schema, options) {
-    const at = `${databaseUrl}#${schema}`;
-    let done = migrated.get(at);
+/** `run` once per `key` in this process, again after it fails. */
+function once(memo, key, run) {
+    let done = memo.get(key);
     if (!done) {
-        done = migrate(databaseUrl, schema, options).catch((err) => {
-            migrated.delete(at);
+        done = run().catch((err) => {
+            memo.delete(key);
             throw err;
         });
-        migrated.set(at, done);
+        memo.set(key, done);
     }
     return done;
 }
+/** Each database and schema's migration, once per process however many workers run on it. */
+const migrated = new Map();
+/** Postgres's code for a schema that is already there (`duplicate_schema`). */
+const SCHEMA_EXISTS = "42P06";
 /**
- * Holds the lock on a session of its own until that ends, whatever fails; polled, never waited
- * for by a blocked statement, as the runtime's own preparation does. The migrations make the schema.
+ * The preparation of one login's `schema`: the migrations its database has not had, once per
+ * process, under the preparation's lock across processes (the runtime's own, which makes the
+ * database first when missing): two workers starting at once both succeed, the second finding
+ * everything made. A schema with no journal is one a release before these migrations made, with
+ * Better Auth's own, of another shape: refused, naming the drop that resets it.
  */
-async function migrate(databaseUrl, schema, options) {
-    const conn = new Client({ connectionString: databaseUrl, connectionTimeoutMillis: 10_000 });
-    // An error nobody listens for ends the process; the query in flight fails with it.
-    conn.on("error", (err) => console.warn(`better-auth: the migration's connection failed: ${err.message}`));
-    await conn.connect();
-    try {
-        const ask = "SELECT pg_try_advisory_lock(hashtext($1)) AS locked";
-        while (!(await conn.query(ask, [`sanoma.login.better-auth.${schema}`])).rows[0].locked)
-            await delay(50);
-        await (await getMigrations(options)).runMigrations();
-    }
-    finally {
-        await conn.end().catch(() => undefined);
-    }
-}
+const preparing = (schema) => (databaseUrl) => once(migrated, `${databaseUrl}#${schema}`, () => underPreparationLock(databaseUrl, (db) => applyMigrations(db, LOGINS[schema].migrations)).catch((err) => {
+    const why = pgCode(err) === SCHEMA_EXISTS
+        ? `the schema ${schema} has no journal (drizzle.${LOGINS[schema].migrations.table}): a release before this one made it, or the journal table was lost; drop the schema (DROP SCHEMA ${schema} CASCADE; its users sign in again), or restore the journal, and start the worker again`
+        : errorMessage(err);
+    throw new Error(`better-auth: could not prepare ${schema}: ${why}`, { cause: err });
+}));
+/**
+ * Makes the visitor login's tables (`better_auth`) on the company's database: the connector's
+ * `prepare`, which the worker runs at its start on the database's direct URL. Idempotent: a
+ * second run changes nothing.
+ */
+export const prepareBetterAuth = preparing(SCHEMAS.visitors);
+/** Makes the staff login's tables (`better_auth_staff`), as `prepareBetterAuth` the visitors': the launcher's worker runs it, since no config names that login. */
+export const prepareBetterAuthStaff = preparing(SCHEMAS.staff);
 /** A request's protocol: https when it came over TLS or through a proxy that says so (`x-forwarded-proto`). */
 export const protocolOf = (request) => requestOrigin(request).startsWith("https:") ? "https" : "http";
 /**
@@ -126,8 +202,6 @@ export const localRedirects = (url) => REDIRECTS.every((name) => {
     const to = url.searchParams.get(name);
     return to === null || (to.startsWith("/") && !to.startsWith("//") && !to.startsWith("/\\"));
 });
-/** The user's `github` column, the GitHub login: never a person's input, so only the login sets it. */
-export const GITHUB_FIELD = { github: { type: "string", required: false, input: false } };
 /** What a user row vouches for: the email when verified, the GitHub login when GitHub said it. */
 export const identityOf = (user) => ({
     ...(user.emailVerified && { email: user.email }),

package/dist/instance.js.map

@@ -1 +1 @@
-{"version":3,"file":"instance.js","sourceRoot":"","sources":["../src/instance.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACvE,OAAO,EAA0B,UAAU,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,QAAQ,EAAE,MAAM,+BAA+B,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AACzC,OAAO,EAAE,UAAU,IAAI,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;AA0BlC,4FAA4F;AAC5F,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAyB,CAAC;AAElD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAyB,EAC3D,WAAW,EACX,GAAG,EACH,MAAM,EACN,QAAQ,EACR,KAAK,EACL,OAAO,GACY;IACnB,qFAAqF;IACrF,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC3G,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,EAAE,gBAAgB,EAAE,WAAW,EAAE,CAAC,CAAC;IACzD,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,8CAA8C,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACrG,MAAM,UAAU,GAAG,CAAC,QAAkB,EAAE,EAAE,CAAC,CAAC;QAC1C,4DAA4D;QAC5D,SAAS,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;QAC5B,MAAM,EAAE,EAAE,KAAK,EAAE,MAAe,EAAE;QAClC,GAAG,OAAO;QACV,yFAAyF;QACzF,QAAQ,EAAE;YACR,OAAO,EAAE,IAAI,eAAe,CAAC,EAAE,IAAI,EAAE,CAAC;YACtC,IAAI,EAAE,UAAmB;YACzB,UAAU,EAAE,MAAM;YAClB,WAAW,EAAE,IAAI;SAClB;QACD,kFAAkF;QAClF,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;QACrC,MAAM,EAAE,GAAG;QACX,QAAQ;QACR,oEAAoE;QACpE,OAAO,EAAE,EAAE,YAAY,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE;QACrE,SAAS,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;QAC7B,QAAQ,EAAE;YACR,mGAAmG;YACnG,SAAS,EAAE,EAAE,gBAAgB,EAAE,CAAC,gBAAgB,CAAC,EAAE;YACnD,gBAAgB,EAAE,QAAQ,KAAK,OAAO;YACtC,qEAAqE;YACrE,kBAAkB,EAAE,KAAK;YACzB,GAAG,OAAO,CAAC,QAAQ;SACpB;KACF,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACpC,MAAM,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC;QAClE,mGAAmG;QACnG,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACjG,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;IAClD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC;QACjB,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,wHAAwH;AACxH,SAAS,WAAW,CAAC,WAAmB,EAAE,MAAc,EAAE,OAA0B;IAClF,MAAM,EAAE,GAAG,GAAG,WAAW,IAAI,MAAM,EAAE,CAAC;IACtC,IAAI,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC5B,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,IAAI,GAAG,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;YAClE,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACpB,MAAM,GAAG,CAAC;QACZ,CAAC,CAAC,CAAC;QACH,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,OAAO,CAAC,WAAmB,EAAE,MAAc,EAAE,OAA0B;IACpF,MAAM,IAAI,GAAG,IAAI,MAAM,CAAC,EAAE,gBAAgB,EAAE,WAAW,EAAE,uBAAuB,EAAE,MAAM,EAAE,CAAC,CAAC;IAC5F,mFAAmF;IACnF,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,mDAAmD,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAC1G,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;IACrB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,qDAAqD,CAAC;QAClE,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAsB,GAAG,EAAE,CAAC,4BAA4B,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,MAAM;YAC1G,MAAM,KAAK,CAAC,EAAE,CAAC,CAAC;QAClB,MAAM,CAAC,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;IACvD,CAAC;YAAS,CAAC;QACT,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC1C,CAAC;AACH,CAAC;AAED,+GAA+G;AAC/G,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,OAAgB,EAAY,EAAE,CACvD,aAAa,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;AAEjE;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,OAAgB,EAAE,OAAe;IAC/D,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;QAC/G,OAAO,OAAO,CAAC;IACjB,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7C,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;IAChD,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACjC,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;AAC3E,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,QAAyD,EAAE,EAAE,CACrF,QAAQ,CAAC;IACP,SAAS,EAAE,CAAC;IACZ,SAAS,EAAE,GAAG;IACd,QAAQ,EAAE,QAAQ;IAClB,eAAe,EAAE,CAAC;IAClB,KAAK,CAAC,mBAAmB,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE;QAC5C,IAAI,IAAI,KAAK,SAAS;YAAE,MAAM,QAAQ,EAAE,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACvD,CAAC;CACF,CAAC,CAAC;AAEL,qDAAqD;AACrD,MAAM,SAAS,GAAG,CAAC,aAAa,EAAE,kBAAkB,EAAE,oBAAoB,CAAC,CAAC;AAE5E,4GAA4G;AAC5G,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,GAAQ,EAAE,EAAE,CACzC,SAAS,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE;IACvB,MAAM,EAAE,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACtC,OAAO,EAAE,KAAK,IAAI,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;AAC9F,CAAC,CAAC,CAAC;AAEL,uGAAuG;AACvG,MAAM,CAAC,MAAM,YAAY,GAAG,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAiB,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC;AASnG,kGAAkG;AAClG,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,IAAU,EAAE,EAAE,CAAC,CAAC;IACzC,GAAG,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;IAChD,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;CAC5C,CAAC,CAAC"}
+{"version":3,"file":"instance.js","sourceRoot":"","sources":["../src/instance.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrF,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AACvH,OAAO,EAA0B,UAAU,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,QAAQ,EAAE,MAAM,+BAA+B,CAAC;AACzD,OAAO,EAAE,UAAU,IAAI,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAE3D,OAAO,KAAK,KAAK,MAAM,eAAe,CAAC;AACvC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,YAAY,MAAM,qCAAqC,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAC;AACrF,OAAO,eAAe,MAAM,wCAAwC,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAC;AAoB3F,0GAA0G;AAC1G,MAAM,CAAC,MAAM,OAAO,GAAG,EAAE,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU,EAAW,CAAC;AAGzG;;;;GAIG;AACH,MAAM,MAAM,GAAG;IACb,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE;QAClB,MAAM,EAAE,QAAQ;QAChB,UAAU,EAAE;YACV,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,GAAG,CAAC,sBAAsB,EAAE,OAAO,IAAI,CAAC,GAAG,CAAC;YAC9D,KAAK,EAAE,kCAAkC;YACzC,OAAO,EAAE,eAAe;SACzB;KACF;IACD,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE;QACf,MAAM,EAAE,KAAK;QACb,UAAU,EAAE;YACV,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,GAAG,CAAC,mBAAmB,EAAE,OAAO,IAAI,CAAC,GAAG,CAAC;YAC3D,KAAK,EAAE,wCAAwC;YAC/C,OAAO,EAAE,YAAY;SACtB;KACF;CACF,CAAC;AAiBF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,IAAI,EAAE,EAAE,gBAAgB,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAiB,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE;IAClG,SAAS,EAAE,EAAE,OAAO,EAAE,UAAmB,EAAE;CAC5C,CAAC;AAEF;;;;;GAKG;AACH,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;AAEnC,uHAAuH;AACvH,SAAS,UAAU,CAAC,IAAU;IAC5B,MAAM,EAAE,gBAAgB,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;IAChE,OAAO,gBAAgB,IAAI,GAAG,IAAI,IAAI,IAAI,IAAI,QAAQ,EAAE,CAAC;AAC3D,CAAC;AAED,qHAAqH;AACrH,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAChC,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAE/B;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAyB,EACrD,QAAQ,EACR,GAAG,EACH,MAAM,EACN,QAAQ,EACR,KAAK,EACL,OAAO,GACY;IACnB,qFAAqF;IACrF,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC3G,MAAM,UAAU,GAAG,CAAC,IAAU,EAAE,QAAkB,EAAE,EAAE,CAAC,CAAC;QACtD,uFAAuF;QACvF,SAAS,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,aAAa,CAAC,SAAS,EAAE;QACxD,MAAM,EAAE,EAAE,KAAK,EAAE,MAAe,EAAE;QAClC,GAAG,OAAO;QACV,IAAI,EAAE,EAAE,GAAG,OAAO,CAAC,IAAI,EAAE,GAAG,aAAa,CAAC,IAAI,EAAE;QAChD,wFAAwF;QACxF,QAAQ,EAAE,cAAc,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;QAChH,kFAAkF;QAClF,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;QACrC,MAAM,EAAE,GAAG;QACX,QAAQ;QACR,oEAAoE;QACpE,OAAO,EAAE,EAAE,YAAY,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE;QACrE,SAAS,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;QAC7B,QAAQ,EAAE;YACR,oFAAoF;YACpF,gDAAgD;YAChD,SAAS,EAAE,EAAE,gBAAgB,EAAE,CAAC,gBAAgB,CAAC,EAAE;YACnD,gBAAgB,EAAE,QAAQ,KAAK,OAAO;YACtC,qEAAqE;YACrE,kBAAkB,EAAE,KAAK;YACzB,GAAG,OAAO,CAAC,QAAQ;SACpB;KACF,CAAC,CAAC;IAEH,iFAAiF;IACjF,MAAM,IAAI,GAAG,IAAI,OAAO,EAA6B,CAAC;IACtD,OAAO,KAAK,EAAE,QAAkB,EAAiB,EAAE;QACjD,MAAM,IAAI,GAAG,MAAM,QAAQ,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,MAAM,EAAE,CAAC;QAC9C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAClC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;QACD,IAAI,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,CAAC,KAAK;YAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,GAAG,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC;QAChD,IAAI,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/B,IAAI,CAAC,IAAI;YAAE,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,IAAI,GAAG,UAAU,CAAC,UAAU,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAChF,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,aAAa,CAAC,IAAU,EAAE,MAAc;IACrD,MAAM,EAAE,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAC5B,KAAK,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,gBAAgB,GAAI,MAAM,KAAK,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACrF,IAAI,MAAM,iBAAiB,CAAC,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC;YAAE,OAAO;QACnE,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ;YACxB,MAAM,IAAI,KAAK,CACb,+BAA+B,MAAM,0GAA0G,CAChJ,CAAC;IACN,CAAC;AACH,CAAC;AAED,kEAAkE;AAClE,SAAS,IAAI,CAAC,IAAgC,EAAE,GAAW,EAAE,GAAwB;IACnF,IAAI,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACzB,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,IAAI,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;YAClC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjB,MAAM,GAAG,CAAC;QACZ,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,6FAA6F;AAC7F,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAyB,CAAC;AAElD,+EAA+E;AAC/E,MAAM,aAAa,GAAG,OAAO,CAAC;AAE9B;;;;;;GAMG;AACH,MAAM,SAAS,GACb,CAAC,MAAc,EAAE,EAAE,CACnB,CAAC,WAAmB,EAAiB,EAAE,CACrC,IAAI,CAAC,QAAQ,EAAE,GAAG,WAAW,IAAI,MAAM,EAAE,EAAE,GAAG,EAAE,CAC9C,oBAAoB,CAAC,WAAW,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAC7F,CAAC,GAAY,EAAE,EAAE;IACf,MAAM,GAAG,GACP,MAAM,CAAC,GAAG,CAAC,KAAK,aAAa;QAC3B,CAAC,CAAC,cAAc,MAAM,4BAA4B,MAAM,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,KAAK,qGAAqG,MAAM,wFAAwF;QACpR,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;IACxB,MAAM,IAAI,KAAK,CAAC,kCAAkC,MAAM,KAAK,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;AACtF,CAAC,CACF,CACF,CAAC;AAEN;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;AAE7D,mKAAmK;AACnK,MAAM,CAAC,MAAM,sBAAsB,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAE/D,+GAA+G;AAC/G,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,OAAgB,EAAY,EAAE,CACvD,aAAa,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;AAEjE;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,OAAgB,EAAE,OAAe;IAC/D,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;QAC/G,OAAO,OAAO,CAAC;IACjB,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7C,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;IAChD,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACjC,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;AAC3E,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,QAAyD,EAAE,EAAE,CACrF,QAAQ,CAAC;IACP,SAAS,EAAE,CAAC;IACZ,SAAS,EAAE,GAAG;IACd,QAAQ,EAAE,QAAQ;IAClB,eAAe,EAAE,CAAC;IAClB,KAAK,CAAC,mBAAmB,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE;QAC5C,IAAI,IAAI,KAAK,SAAS;YAAE,MAAM,QAAQ,EAAE,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACvD,CAAC;CACF,CAAC,CAAC;AAEL,qDAAqD;AACrD,MAAM,SAAS,GAAG,CAAC,aAAa,EAAE,kBAAkB,EAAE,oBAAoB,CAAC,CAAC;AAE5E,4GAA4G;AAC5G,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,GAAQ,EAAE,EAAE,CACzC,SAAS,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE;IACvB,MAAM,EAAE,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACtC,OAAO,EAAE,KAAK,IAAI,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;AAC9F,CAAC,CAAC,CAAC;AASL,kGAAkG;AAClG,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,IAAU,EAAE,EAAE,CAAC,CAAC;IACzC,GAAG,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;IAChD,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;CAC5C,CAAC,CAAC"}

package/dist/login.d.ts

@@ -5,9 +5,9 @@ import type { LoginContext, LoginHalf } from "@sanoma-ai/workflows";
  * (`context.social.github`), a visitor also signs up and in with GitHub (`/sign-in/social`, which
  * joins the account of GitHub's verified email), or links it once signed in (`/link-social`), and
  * is then said to be that GitHub login (`verify`'s `github`). Its tables are in schema
- * `better_auth` on the company's database, migrated here before the first site starts, its
- * cookies signed with the app's key for it (`context.key`). The site's origins are its allowed
- * hosts (a request for another host is refused) and set the cookie's `Secure` flag: an `https`
- * origin's is.
+ * `better_auth` on the company's database, which the worker makes (`prepareBetterAuth`), reached
+ * through the pool the app gives each request (`context.database`), its cookies signed with the
+ * app's key for it (`context.key`). The site's origins are its allowed hosts (a request for
+ * another host is refused) and set the cookie's `Secure` flag: an `https` origin's is.
  */
-export declare function betterAuthLogin({ databaseUrl, key, origins, sendCode, social, }: LoginContext): Promise<LoginHalf>;
+export declare function betterAuthLogin({ database, key, origins, sendCode, social }: LoginContext): LoginHalf;