@sirketio/auth 0.0.1

package/dist/cookies/session-store.mjs

@@ -0,0 +1,200 @@
+import { symmetricDecodeJWT, symmetricEncodeJWT } from "../crypto/jwt.mjs";
+import "../crypto/index.mjs";
+import { safeJSONParse } from "@better-auth/core/utils/json";
+import * as z from "zod";
+
+//#region src/cookies/session-store.ts
+const ALLOWED_COOKIE_SIZE = 4096;
+const ESTIMATED_EMPTY_COOKIE_SIZE = 200;
+const CHUNK_SIZE = ALLOWED_COOKIE_SIZE - ESTIMATED_EMPTY_COOKIE_SIZE;
+/**
+* Parse cookies from the request headers
+*/
+function parseCookiesFromContext(ctx) {
+	const cookieHeader = ctx.headers?.get("cookie");
+	if (!cookieHeader) return {};
+	const cookies = {};
+	const pairs = cookieHeader.split("; ");
+	for (const pair of pairs) {
+		const [name, ...valueParts] = pair.split("=");
+		if (name && valueParts.length > 0) cookies[name] = valueParts.join("=");
+	}
+	return cookies;
+}
+/**
+* Extract the chunk index from a cookie name
+*/
+function getChunkIndex(cookieName) {
+	const parts = cookieName.split(".");
+	const lastPart = parts[parts.length - 1];
+	const index = parseInt(lastPart || "0", 10);
+	return isNaN(index) ? 0 : index;
+}
+/**
+* Read all existing chunks from cookies
+*/
+function readExistingChunks(cookieName, ctx) {
+	const chunks = {};
+	const cookies = parseCookiesFromContext(ctx);
+	for (const [name, value] of Object.entries(cookies)) if (name.startsWith(cookieName)) chunks[name] = value;
+	return chunks;
+}
+/**
+* Get the full session data by joining all chunks
+*/
+function joinChunks(chunks) {
+	return Object.keys(chunks).sort((a, b) => {
+		return getChunkIndex(a) - getChunkIndex(b);
+	}).map((key) => chunks[key]).join("");
+}
+/**
+* Split a cookie value into chunks if needed
+*/
+function chunkCookie(storeName, cookie, chunks, logger) {
+	const chunkCount = Math.ceil(cookie.value.length / CHUNK_SIZE);
+	if (chunkCount === 1) {
+		chunks[cookie.name] = cookie.value;
+		return [cookie];
+	}
+	const cookies = [];
+	for (let i = 0; i < chunkCount; i++) {
+		const name = `${cookie.name}.${i}`;
+		const start = i * CHUNK_SIZE;
+		const value = cookie.value.substring(start, start + CHUNK_SIZE);
+		cookies.push({
+			...cookie,
+			name,
+			value
+		});
+		chunks[name] = value;
+	}
+	logger.debug(`CHUNKING_${storeName.toUpperCase()}_COOKIE`, {
+		message: `${storeName} cookie exceeds allowed ${ALLOWED_COOKIE_SIZE} bytes.`,
+		emptyCookieSize: ESTIMATED_EMPTY_COOKIE_SIZE,
+		valueSize: cookie.value.length,
+		chunkCount,
+		chunks: cookies.map((c) => c.value.length + ESTIMATED_EMPTY_COOKIE_SIZE)
+	});
+	return cookies;
+}
+/**
+* Get all cookies that should be cleaned (removed)
+*/
+function getCleanCookies(chunks, cookieOptions) {
+	const cleanedChunks = {};
+	for (const name in chunks) cleanedChunks[name] = {
+		name,
+		value: "",
+		attributes: {
+			...cookieOptions,
+			maxAge: 0
+		}
+	};
+	return cleanedChunks;
+}
+/**
+* Create a session store for handling cookie chunking.
+* When session data exceeds 4KB, it automatically splits it into multiple cookies.
+*
+* Based on next-auth's SessionStore implementation.
+* @see https://github.com/nextauthjs/next-auth/blob/27b2519b84b8eb9cf053775dea29d577d2aa0098/packages/next-auth/src/core/lib/cookie.ts
+*/
+const storeFactory = (storeName) => (cookieName, cookieOptions, ctx) => {
+	const chunks = readExistingChunks(cookieName, ctx);
+	const logger = ctx.context.logger;
+	return {
+		getValue() {
+			return joinChunks(chunks);
+		},
+		hasChunks() {
+			return Object.keys(chunks).length > 0;
+		},
+		chunk(value, options) {
+			const cleanedChunks = getCleanCookies(chunks, cookieOptions);
+			for (const name in chunks) delete chunks[name];
+			const cookies = cleanedChunks;
+			const chunked = chunkCookie(storeName, {
+				name: cookieName,
+				value,
+				attributes: {
+					...cookieOptions,
+					...options
+				}
+			}, chunks, logger);
+			for (const chunk of chunked) cookies[chunk.name] = chunk;
+			return Object.values(cookies);
+		},
+		clean() {
+			const cleanedChunks = getCleanCookies(chunks, cookieOptions);
+			for (const name in chunks) delete chunks[name];
+			return Object.values(cleanedChunks);
+		},
+		setCookies(cookies) {
+			for (const cookie of cookies) ctx.setCookie(cookie.name, cookie.value, cookie.attributes);
+		}
+	};
+};
+const createSessionStore = storeFactory("Session");
+const createAccountStore = storeFactory("Account");
+function getChunkedCookie(ctx, cookieName) {
+	const value = ctx.getCookie(cookieName);
+	if (value) return value;
+	const chunks = [];
+	const cookieHeader = ctx.headers?.get("cookie");
+	if (!cookieHeader) return null;
+	const cookies = {};
+	const pairs = cookieHeader.split("; ");
+	for (const pair of pairs) {
+		const [name, ...valueParts] = pair.split("=");
+		if (name && valueParts.length > 0) cookies[name] = valueParts.join("=");
+	}
+	for (const [name, val] of Object.entries(cookies)) if (name.startsWith(cookieName + ".")) {
+		const indexStr = name.split(".").at(-1);
+		const index = parseInt(indexStr || "0", 10);
+		if (!isNaN(index)) chunks.push({
+			index,
+			value: val
+		});
+	}
+	if (chunks.length > 0) {
+		chunks.sort((a, b) => a.index - b.index);
+		return chunks.map((c) => c.value).join("");
+	}
+	return null;
+}
+async function setAccountCookie(c, accountData) {
+	const accountDataCookie = c.context.authCookies.accountData;
+	const options = {
+		maxAge: 300,
+		...accountDataCookie.attributes
+	};
+	const data = await symmetricEncodeJWT(accountData, c.context.secret, "better-auth-account", options.maxAge);
+	if (data.length > ALLOWED_COOKIE_SIZE) {
+		const accountStore = createAccountStore(accountDataCookie.name, options, c);
+		const cookies = accountStore.chunk(data, options);
+		accountStore.setCookies(cookies);
+	} else {
+		const accountStore = createAccountStore(accountDataCookie.name, options, c);
+		if (accountStore.hasChunks()) {
+			const cleanCookies = accountStore.clean();
+			accountStore.setCookies(cleanCookies);
+		}
+		c.setCookie(accountDataCookie.name, data, options);
+	}
+}
+async function getAccountCookie(c) {
+	const accountCookie = getChunkedCookie(c, c.context.authCookies.accountData.name);
+	if (accountCookie) {
+		const accountData = safeJSONParse(await symmetricDecodeJWT(accountCookie, c.context.secret, "better-auth-account"));
+		if (accountData) return accountData;
+	}
+	return null;
+}
+const getSessionQuerySchema = z.optional(z.object({
+	disableCookieCache: z.coerce.boolean().meta({ description: "Disable cookie cache and fetch session from database" }).optional(),
+	disableRefresh: z.coerce.boolean().meta({ description: "Disable session refresh. Useful for checking session status, without updating the session" }).optional()
+}));
+
+//#endregion
+export { createAccountStore, createSessionStore, getAccountCookie, getChunkedCookie, getSessionQuerySchema, setAccountCookie };
+//# sourceMappingURL=session-store.mjs.map

package/dist/cookies/session-store.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-store.mjs","names":[],"sources":["../../src/cookies/session-store.ts"],"sourcesContent":["import type { GenericEndpointContext } from \"@better-auth/core\";\nimport type { Account } from \"@better-auth/core/db\";\nimport type { InternalLogger } from \"@better-auth/core/env\";\nimport { safeJSONParse } from \"@better-auth/core/utils/json\";\nimport type { CookieOptions } from \"better-call\";\nimport * as z from \"zod\";\nimport { symmetricDecodeJWT, symmetricEncodeJWT } from \"../crypto\";\n\n// Cookie size constants based on browser limits\nconst ALLOWED_COOKIE_SIZE = 4096;\n// Estimated size of an empty cookie with all attributes\n// (name, path, domain, secure, httpOnly, sameSite, expires/maxAge)\nconst ESTIMATED_EMPTY_COOKIE_SIZE = 200;\nconst CHUNK_SIZE = ALLOWED_COOKIE_SIZE - ESTIMATED_EMPTY_COOKIE_SIZE;\n\ninterface Cookie {\n\tname: string;\n\tvalue: string;\n\tattributes: CookieOptions;\n}\n\ntype Chunks = Record<string, string>;\n\n/**\n * Parse cookies from the request headers\n */\nfunction parseCookiesFromContext(\n\tctx: GenericEndpointContext,\n): Record<string, string> {\n\tconst cookieHeader = ctx.headers?.get(\"cookie\");\n\tif (!cookieHeader) {\n\t\treturn {};\n\t}\n\n\tconst cookies: Record<string, string> = {};\n\tconst pairs = cookieHeader.split(\"; \");\n\n\tfor (const pair of pairs) {\n\t\tconst [name, ...valueParts] = pair.split(\"=\");\n\t\tif (name && valueParts.length > 0) {\n\t\t\tcookies[name] = valueParts.join(\"=\");\n\t\t}\n\t}\n\n\treturn cookies;\n}\n\n/**\n * Extract the chunk index from a cookie name\n */\nfunction getChunkIndex(cookieName: string): number {\n\tconst parts = cookieName.split(\".\");\n\tconst lastPart = parts[parts.length - 1];\n\tconst index = parseInt(lastPart || \"0\", 10);\n\treturn isNaN(index) ? 0 : index;\n}\n\n/**\n * Read all existing chunks from cookies\n */\nfunction readExistingChunks(\n\tcookieName: string,\n\tctx: GenericEndpointContext,\n): Chunks {\n\tconst chunks: Chunks = {};\n\tconst cookies = parseCookiesFromContext(ctx);\n\n\tfor (const [name, value] of Object.entries(cookies)) {\n\t\tif (name.startsWith(cookieName)) {\n\t\t\tchunks[name] = value;\n\t\t}\n\t}\n\n\treturn chunks;\n}\n\n/**\n * Get the full session data by joining all chunks\n */\nfunction joinChunks(chunks: Chunks): string {\n\tconst sortedKeys = Object.keys(chunks).sort((a, b) => {\n\t\tconst aIndex = getChunkIndex(a);\n\t\tconst bIndex = getChunkIndex(b);\n\t\treturn aIndex - bIndex;\n\t});\n\n\treturn sortedKeys.map((key) => chunks[key]).join(\"\");\n}\n\n/**\n * Split a cookie value into chunks if needed\n */\nfunction chunkCookie(\n\tstoreName: string,\n\tcookie: Cookie,\n\tchunks: Chunks,\n\tlogger: InternalLogger,\n): Cookie[] {\n\tconst chunkCount = Math.ceil(cookie.value.length / CHUNK_SIZE);\n\n\tif (chunkCount === 1) {\n\t\tchunks[cookie.name] = cookie.value;\n\t\treturn [cookie];\n\t}\n\n\tconst cookies: Cookie[] = [];\n\tfor (let i = 0; i < chunkCount; i++) {\n\t\tconst name = `${cookie.name}.${i}`;\n\t\tconst start = i * CHUNK_SIZE;\n\t\tconst value = cookie.value.substring(start, start + CHUNK_SIZE);\n\t\tcookies.push({ ...cookie, name, value });\n\t\tchunks[name] = value;\n\t}\n\n\tlogger.debug(`CHUNKING_${storeName.toUpperCase()}_COOKIE`, {\n\t\tmessage: `${storeName} cookie exceeds allowed ${ALLOWED_COOKIE_SIZE} bytes.`,\n\t\temptyCookieSize: ESTIMATED_EMPTY_COOKIE_SIZE,\n\t\tvalueSize: cookie.value.length,\n\t\tchunkCount,\n\t\tchunks: cookies.map((c) => c.value.length + ESTIMATED_EMPTY_COOKIE_SIZE),\n\t});\n\n\treturn cookies;\n}\n\n/**\n * Get all cookies that should be cleaned (removed)\n */\nfunction getCleanCookies(\n\tchunks: Chunks,\n\tcookieOptions: CookieOptions,\n): Record<string, Cookie> {\n\tconst cleanedChunks: Record<string, Cookie> = {};\n\tfor (const name in chunks) {\n\t\tcleanedChunks[name] = {\n\t\t\tname,\n\t\t\tvalue: \"\",\n\t\t\tattributes: { ...cookieOptions, maxAge: 0 },\n\t\t};\n\t}\n\treturn cleanedChunks;\n}\n\n/**\n * Create a session store for handling cookie chunking.\n * When session data exceeds 4KB, it automatically splits it into multiple cookies.\n *\n * Based on next-auth's SessionStore implementation.\n * @see https://github.com/nextauthjs/next-auth/blob/27b2519b84b8eb9cf053775dea29d577d2aa0098/packages/next-auth/src/core/lib/cookie.ts\n */\nconst storeFactory =\n\t(storeName: string) =>\n\t(\n\t\tcookieName: string,\n\t\tcookieOptions: CookieOptions,\n\t\tctx: GenericEndpointContext,\n\t) => {\n\t\tconst chunks = readExistingChunks(cookieName, ctx);\n\t\tconst logger = ctx.context.logger;\n\n\t\treturn {\n\t\t\t/**\n\t\t\t * Get the full session data by joining all chunks\n\t\t\t */\n\t\t\tgetValue(): string {\n\t\t\t\treturn joinChunks(chunks);\n\t\t\t},\n\n\t\t\t/**\n\t\t\t * Check if there are existing chunks\n\t\t\t */\n\t\t\thasChunks(): boolean {\n\t\t\t\treturn Object.keys(chunks).length > 0;\n\t\t\t},\n\n\t\t\t/**\n\t\t\t * Chunk a cookie value and return all cookies to set (including cleanup cookies)\n\t\t\t */\n\t\t\tchunk(value: string, options?: Partial<CookieOptions>): Cookie[] {\n\t\t\t\t// Start by cleaning all existing chunks\n\t\t\t\tconst cleanedChunks = getCleanCookies(chunks, cookieOptions);\n\t\t\t\t// Clear the chunks object\n\t\t\t\tfor (const name in chunks) {\n\t\t\t\t\tdelete chunks[name];\n\t\t\t\t}\n\t\t\t\tconst cookies: Record<string, Cookie> = cleanedChunks;\n\n\t\t\t\t// Create new chunks\n\t\t\t\tconst chunked = chunkCookie(\n\t\t\t\t\tstoreName,\n\t\t\t\t\t{\n\t\t\t\t\t\tname: cookieName,\n\t\t\t\t\t\tvalue,\n\t\t\t\t\t\tattributes: { ...cookieOptions, ...options },\n\t\t\t\t\t},\n\t\t\t\t\tchunks,\n\t\t\t\t\tlogger,\n\t\t\t\t);\n\n\t\t\t\t// Update with new chunks\n\t\t\t\tfor (const chunk of chunked) {\n\t\t\t\t\tcookies[chunk.name] = chunk;\n\t\t\t\t}\n\n\t\t\t\treturn Object.values(cookies);\n\t\t\t},\n\n\t\t\t/**\n\t\t\t * Get cookies to clean up all chunks\n\t\t\t */\n\t\t\tclean(): Cookie[] {\n\t\t\t\tconst cleanedChunks = getCleanCookies(chunks, cookieOptions);\n\t\t\t\t// Clear the chunks object\n\t\t\t\tfor (const name in chunks) {\n\t\t\t\t\tdelete chunks[name];\n\t\t\t\t}\n\t\t\t\treturn Object.values(cleanedChunks);\n\t\t\t},\n\n\t\t\t/**\n\t\t\t * Set all cookies in the context\n\t\t\t */\n\t\t\tsetCookies(cookies: Cookie[]): void {\n\t\t\t\tfor (const cookie of cookies) {\n\t\t\t\t\tctx.setCookie(cookie.name, cookie.value, cookie.attributes);\n\t\t\t\t}\n\t\t\t},\n\t\t};\n\t};\n\nexport const createSessionStore = storeFactory(\"Session\");\nexport const createAccountStore = storeFactory(\"Account\");\n\nexport function getChunkedCookie(\n\tctx: GenericEndpointContext,\n\tcookieName: string,\n): string | null {\n\tconst value = ctx.getCookie(cookieName);\n\tif (value) {\n\t\treturn value;\n\t}\n\n\tconst chunks: Array<{ index: number; value: string }> = [];\n\n\tconst cookieHeader = ctx.headers?.get(\"cookie\");\n\tif (!cookieHeader) {\n\t\treturn null;\n\t}\n\n\tconst cookies: Record<string, string> = {};\n\tconst pairs = cookieHeader.split(\"; \");\n\tfor (const pair of pairs) {\n\t\tconst [name, ...valueParts] = pair.split(\"=\");\n\t\tif (name && valueParts.length > 0) {\n\t\t\tcookies[name] = valueParts.join(\"=\");\n\t\t}\n\t}\n\n\tfor (const [name, val] of Object.entries(cookies)) {\n\t\tif (name.startsWith(cookieName + \".\")) {\n\t\t\tconst parts = name.split(\".\");\n\t\t\tconst indexStr = parts.at(-1);\n\t\t\tconst index = parseInt(indexStr || \"0\", 10);\n\t\t\tif (!isNaN(index)) {\n\t\t\t\tchunks.push({ index, value: val });\n\t\t\t}\n\t\t}\n\t}\n\n\tif (chunks.length > 0) {\n\t\tchunks.sort((a, b) => a.index - b.index);\n\t\treturn chunks.map((c) => c.value).join(\"\");\n\t}\n\n\treturn null;\n}\n\nexport async function setAccountCookie(\n\tc: GenericEndpointContext,\n\taccountData: Record<string, any>,\n) {\n\tconst accountDataCookie = c.context.authCookies.accountData;\n\tconst options = {\n\t\tmaxAge: 60 * 5,\n\t\t...accountDataCookie.attributes,\n\t};\n\tconst data = await symmetricEncodeJWT(\n\t\taccountData,\n\t\tc.context.secret,\n\t\t\"better-auth-account\",\n\t\toptions.maxAge,\n\t);\n\n\tif (data.length > ALLOWED_COOKIE_SIZE) {\n\t\tconst accountStore = createAccountStore(accountDataCookie.name, options, c);\n\n\t\tconst cookies = accountStore.chunk(data, options);\n\t\taccountStore.setCookies(cookies);\n\t} else {\n\t\tconst accountStore = createAccountStore(accountDataCookie.name, options, c);\n\t\tif (accountStore.hasChunks()) {\n\t\t\tconst cleanCookies = accountStore.clean();\n\t\t\taccountStore.setCookies(cleanCookies);\n\t\t}\n\t\tc.setCookie(accountDataCookie.name, data, options);\n\t}\n}\n\nexport async function getAccountCookie(c: GenericEndpointContext) {\n\tconst accountCookie = getChunkedCookie(\n\t\tc,\n\t\tc.context.authCookies.accountData.name,\n\t);\n\tif (accountCookie) {\n\t\tconst accountData = safeJSONParse<Account>(\n\t\t\tawait symmetricDecodeJWT(\n\t\t\t\taccountCookie,\n\t\t\t\tc.context.secret,\n\t\t\t\t\"better-auth-account\",\n\t\t\t),\n\t\t);\n\t\tif (accountData) {\n\t\t\treturn accountData;\n\t\t}\n\t}\n\n\treturn null;\n}\n\nexport const getSessionQuerySchema = z.optional(\n\tz.object({\n\t\t/**\n\t\t * If cookie cache is enabled, it will disable the cache\n\t\t * and fetch the session from the database\n\t\t */\n\t\tdisableCookieCache: z.coerce\n\t\t\t.boolean()\n\t\t\t.meta({\n\t\t\t\tdescription: \"Disable cookie cache and fetch session from database\",\n\t\t\t})\n\t\t\t.optional(),\n\t\tdisableRefresh: z.coerce\n\t\t\t.boolean()\n\t\t\t.meta({\n\t\t\t\tdescription:\n\t\t\t\t\t\"Disable session refresh. Useful for checking session status, without updating the session\",\n\t\t\t})\n\t\t\t.optional(),\n\t}),\n);\n"],"mappings":";;;;;;AASA,MAAM,sBAAsB;AAG5B,MAAM,8BAA8B;AACpC,MAAM,aAAa,sBAAsB;;;;AAazC,SAAS,wBACR,KACyB;CACzB,MAAM,eAAe,IAAI,SAAS,IAAI,SAAS;AAC/C,KAAI,CAAC,aACJ,QAAO,EAAE;CAGV,MAAM,UAAkC,EAAE;CAC1C,MAAM,QAAQ,aAAa,MAAM,KAAK;AAEtC,MAAK,MAAM,QAAQ,OAAO;EACzB,MAAM,CAAC,MAAM,GAAG,cAAc,KAAK,MAAM,IAAI;AAC7C,MAAI,QAAQ,WAAW,SAAS,EAC/B,SAAQ,QAAQ,WAAW,KAAK,IAAI;;AAItC,QAAO;;;;;AAMR,SAAS,cAAc,YAA4B;CAClD,MAAM,QAAQ,WAAW,MAAM,IAAI;CACnC,MAAM,WAAW,MAAM,MAAM,SAAS;CACtC,MAAM,QAAQ,SAAS,YAAY,KAAK,GAAG;AAC3C,QAAO,MAAM,MAAM,GAAG,IAAI;;;;;AAM3B,SAAS,mBACR,YACA,KACS;CACT,MAAM,SAAiB,EAAE;CACzB,MAAM,UAAU,wBAAwB,IAAI;AAE5C,MAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,QAAQ,CAClD,KAAI,KAAK,WAAW,WAAW,CAC9B,QAAO,QAAQ;AAIjB,QAAO;;;;;AAMR,SAAS,WAAW,QAAwB;AAO3C,QANmB,OAAO,KAAK,OAAO,CAAC,MAAM,GAAG,MAAM;AAGrD,SAFe,cAAc,EAAE,GAChB,cAAc,EAAE;GAE9B,CAEgB,KAAK,QAAQ,OAAO,KAAK,CAAC,KAAK,GAAG;;;;;AAMrD,SAAS,YACR,WACA,QACA,QACA,QACW;CACX,MAAM,aAAa,KAAK,KAAK,OAAO,MAAM,SAAS,WAAW;AAE9D,KAAI,eAAe,GAAG;AACrB,SAAO,OAAO,QAAQ,OAAO;AAC7B,SAAO,CAAC,OAAO;;CAGhB,MAAM,UAAoB,EAAE;AAC5B,MAAK,IAAI,IAAI,GAAG,IAAI,YAAY,KAAK;EACpC,MAAM,OAAO,GAAG,OAAO,KAAK,GAAG;EAC/B,MAAM,QAAQ,IAAI;EAClB,MAAM,QAAQ,OAAO,MAAM,UAAU,OAAO,QAAQ,WAAW;AAC/D,UAAQ,KAAK;GAAE,GAAG;GAAQ;GAAM;GAAO,CAAC;AACxC,SAAO,QAAQ;;AAGhB,QAAO,MAAM,YAAY,UAAU,aAAa,CAAC,UAAU;EAC1D,SAAS,GAAG,UAAU,0BAA0B,oBAAoB;EACpE,iBAAiB;EACjB,WAAW,OAAO,MAAM;EACxB;EACA,QAAQ,QAAQ,KAAK,MAAM,EAAE,MAAM,SAAS,4BAA4B;EACxE,CAAC;AAEF,QAAO;;;;;AAMR,SAAS,gBACR,QACA,eACyB;CACzB,MAAM,gBAAwC,EAAE;AAChD,MAAK,MAAM,QAAQ,OAClB,eAAc,QAAQ;EACrB;EACA,OAAO;EACP,YAAY;GAAE,GAAG;GAAe,QAAQ;GAAG;EAC3C;AAEF,QAAO;;;;;;;;;AAUR,MAAM,gBACJ,eAEA,YACA,eACA,QACI;CACJ,MAAM,SAAS,mBAAmB,YAAY,IAAI;CAClD,MAAM,SAAS,IAAI,QAAQ;AAE3B,QAAO;EAIN,WAAmB;AAClB,UAAO,WAAW,OAAO;;EAM1B,YAAqB;AACpB,UAAO,OAAO,KAAK,OAAO,CAAC,SAAS;;EAMrC,MAAM,OAAe,SAA4C;GAEhE,MAAM,gBAAgB,gBAAgB,QAAQ,cAAc;AAE5D,QAAK,MAAM,QAAQ,OAClB,QAAO,OAAO;GAEf,MAAM,UAAkC;GAGxC,MAAM,UAAU,YACf,WACA;IACC,MAAM;IACN;IACA,YAAY;KAAE,GAAG;KAAe,GAAG;KAAS;IAC5C,EACD,QACA,OACA;AAGD,QAAK,MAAM,SAAS,QACnB,SAAQ,MAAM,QAAQ;AAGvB,UAAO,OAAO,OAAO,QAAQ;;EAM9B,QAAkB;GACjB,MAAM,gBAAgB,gBAAgB,QAAQ,cAAc;AAE5D,QAAK,MAAM,QAAQ,OAClB,QAAO,OAAO;AAEf,UAAO,OAAO,OAAO,cAAc;;EAMpC,WAAW,SAAyB;AACnC,QAAK,MAAM,UAAU,QACpB,KAAI,UAAU,OAAO,MAAM,OAAO,OAAO,OAAO,WAAW;;EAG7D;;AAGH,MAAa,qBAAqB,aAAa,UAAU;AACzD,MAAa,qBAAqB,aAAa,UAAU;AAEzD,SAAgB,iBACf,KACA,YACgB;CAChB,MAAM,QAAQ,IAAI,UAAU,WAAW;AACvC,KAAI,MACH,QAAO;CAGR,MAAM,SAAkD,EAAE;CAE1D,MAAM,eAAe,IAAI,SAAS,IAAI,SAAS;AAC/C,KAAI,CAAC,aACJ,QAAO;CAGR,MAAM,UAAkC,EAAE;CAC1C,MAAM,QAAQ,aAAa,MAAM,KAAK;AACtC,MAAK,MAAM,QAAQ,OAAO;EACzB,MAAM,CAAC,MAAM,GAAG,cAAc,KAAK,MAAM,IAAI;AAC7C,MAAI,QAAQ,WAAW,SAAS,EAC/B,SAAQ,QAAQ,WAAW,KAAK,IAAI;;AAItC,MAAK,MAAM,CAAC,MAAM,QAAQ,OAAO,QAAQ,QAAQ,CAChD,KAAI,KAAK,WAAW,aAAa,IAAI,EAAE;EAEtC,MAAM,WADQ,KAAK,MAAM,IAAI,CACN,GAAG,GAAG;EAC7B,MAAM,QAAQ,SAAS,YAAY,KAAK,GAAG;AAC3C,MAAI,CAAC,MAAM,MAAM,CAChB,QAAO,KAAK;GAAE;GAAO,OAAO;GAAK,CAAC;;AAKrC,KAAI,OAAO,SAAS,GAAG;AACtB,SAAO,MAAM,GAAG,MAAM,EAAE,QAAQ,EAAE,MAAM;AACxC,SAAO,OAAO,KAAK,MAAM,EAAE,MAAM,CAAC,KAAK,GAAG;;AAG3C,QAAO;;AAGR,eAAsB,iBACrB,GACA,aACC;CACD,MAAM,oBAAoB,EAAE,QAAQ,YAAY;CAChD,MAAM,UAAU;EACf,QAAQ;EACR,GAAG,kBAAkB;EACrB;CACD,MAAM,OAAO,MAAM,mBAClB,aACA,EAAE,QAAQ,QACV,uBACA,QAAQ,OACR;AAED,KAAI,KAAK,SAAS,qBAAqB;EACtC,MAAM,eAAe,mBAAmB,kBAAkB,MAAM,SAAS,EAAE;EAE3E,MAAM,UAAU,aAAa,MAAM,MAAM,QAAQ;AACjD,eAAa,WAAW,QAAQ;QAC1B;EACN,MAAM,eAAe,mBAAmB,kBAAkB,MAAM,SAAS,EAAE;AAC3E,MAAI,aAAa,WAAW,EAAE;GAC7B,MAAM,eAAe,aAAa,OAAO;AACzC,gBAAa,WAAW,aAAa;;AAEtC,IAAE,UAAU,kBAAkB,MAAM,MAAM,QAAQ;;;AAIpD,eAAsB,iBAAiB,GAA2B;CACjE,MAAM,gBAAgB,iBACrB,GACA,EAAE,QAAQ,YAAY,YAAY,KAClC;AACD,KAAI,eAAe;EAClB,MAAM,cAAc,cACnB,MAAM,mBACL,eACA,EAAE,QAAQ,QACV,sBACA,CACD;AACD,MAAI,YACH,QAAO;;AAIT,QAAO;;AAGR,MAAa,wBAAwB,EAAE,SACtC,EAAE,OAAO;CAKR,oBAAoB,EAAE,OACpB,SAAS,CACT,KAAK,EACL,aAAa,wDACb,CAAC,CACD,UAAU;CACZ,gBAAgB,EAAE,OAChB,SAAS,CACT,KAAK,EACL,aACC,6FACD,CAAC,CACD,UAAU;CACZ,CAAC,CACF"}

package/dist/crypto/buffer.d.mts

@@ -0,0 +1,8 @@
+//#region src/crypto/buffer.d.ts
+/**
+ * Compare two buffers in constant time.
+ */
+declare function constantTimeEqual(a: ArrayBuffer | Uint8Array | string, b: ArrayBuffer | Uint8Array | string): boolean;
+//#endregion
+export { constantTimeEqual };
+//# sourceMappingURL=buffer.d.mts.map

package/dist/crypto/buffer.mjs

@@ -0,0 +1,18 @@
+//#region src/crypto/buffer.ts
+/**
+* Compare two buffers in constant time.
+*/
+function constantTimeEqual(a, b) {
+	if (typeof a === "string") a = new TextEncoder().encode(a);
+	if (typeof b === "string") b = new TextEncoder().encode(b);
+	const aBuffer = new Uint8Array(a);
+	const bBuffer = new Uint8Array(b);
+	let c = aBuffer.length ^ bBuffer.length;
+	const length = Math.max(aBuffer.length, bBuffer.length);
+	for (let i = 0; i < length; i++) c |= (i < aBuffer.length ? aBuffer[i] : 0) ^ (i < bBuffer.length ? bBuffer[i] : 0);
+	return c === 0;
+}
+
+//#endregion
+export { constantTimeEqual };
+//# sourceMappingURL=buffer.mjs.map

package/dist/crypto/buffer.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"buffer.mjs","names":[],"sources":["../../src/crypto/buffer.ts"],"sourcesContent":["/**\n * Compare two buffers in constant time.\n */\nexport function constantTimeEqual(\n\ta: ArrayBuffer | Uint8Array | string,\n\tb: ArrayBuffer | Uint8Array | string,\n): boolean {\n\tif (typeof a === \"string\") {\n\t\ta = new TextEncoder().encode(a);\n\t}\n\tif (typeof b === \"string\") {\n\t\tb = new TextEncoder().encode(b);\n\t}\n\tconst aBuffer = new Uint8Array(a);\n\tconst bBuffer = new Uint8Array(b);\n\tlet c = aBuffer.length ^ bBuffer.length;\n\tconst length = Math.max(aBuffer.length, bBuffer.length);\n\tfor (let i = 0; i < length; i++) {\n\t\tc |=\n\t\t\t(i < aBuffer.length ? aBuffer[i]! : 0) ^\n\t\t\t(i < bBuffer.length ? bBuffer[i]! : 0);\n\t}\n\treturn c === 0;\n}\n"],"mappings":";;;;AAGA,SAAgB,kBACf,GACA,GACU;AACV,KAAI,OAAO,MAAM,SAChB,KAAI,IAAI,aAAa,CAAC,OAAO,EAAE;AAEhC,KAAI,OAAO,MAAM,SAChB,KAAI,IAAI,aAAa,CAAC,OAAO,EAAE;CAEhC,MAAM,UAAU,IAAI,WAAW,EAAE;CACjC,MAAM,UAAU,IAAI,WAAW,EAAE;CACjC,IAAI,IAAI,QAAQ,SAAS,QAAQ;CACjC,MAAM,SAAS,KAAK,IAAI,QAAQ,QAAQ,QAAQ,OAAO;AACvD,MAAK,IAAI,IAAI,GAAG,IAAI,QAAQ,IAC3B,OACE,IAAI,QAAQ,SAAS,QAAQ,KAAM,MACnC,IAAI,QAAQ,SAAS,QAAQ,KAAM;AAEtC,QAAO,MAAM"}

package/dist/crypto/index.d.mts

@@ -0,0 +1,27 @@
+import { constantTimeEqual } from "./buffer.mjs";
+import { signJWT, symmetricDecodeJWT, symmetricEncodeJWT, verifyJWT } from "./jwt.mjs";
+import { hashPassword, verifyPassword } from "./password.mjs";
+import { generateRandomString } from "./random.mjs";
+
+//#region src/crypto/index.d.ts
+type SymmetricEncryptOptions = {
+  key: string;
+  data: string;
+};
+declare const symmetricEncrypt: ({
+  key,
+  data
+}: SymmetricEncryptOptions) => Promise<string>;
+type SymmetricDecryptOptions = {
+  key: string;
+  data: string;
+};
+declare const symmetricDecrypt: ({
+  key,
+  data
+}: SymmetricDecryptOptions) => Promise<string>;
+declare const getCryptoKey: (secret: string | BufferSource) => Promise<CryptoKey>;
+declare const makeSignature: (value: string, secret: string | BufferSource) => Promise<string>;
+//#endregion
+export { SymmetricDecryptOptions, SymmetricEncryptOptions, constantTimeEqual, generateRandomString, getCryptoKey, hashPassword, makeSignature, signJWT, symmetricDecodeJWT, symmetricDecrypt, symmetricEncodeJWT, symmetricEncrypt, verifyJWT, verifyPassword };
+//# sourceMappingURL=index.d.mts.map

package/dist/crypto/index.mjs

@@ -0,0 +1,38 @@
+import { constantTimeEqual } from "./buffer.mjs";
+import { signJWT, symmetricDecodeJWT, symmetricEncodeJWT, verifyJWT } from "./jwt.mjs";
+import { hashPassword, verifyPassword } from "./password.mjs";
+import { generateRandomString } from "./random.mjs";
+import { createHash } from "@better-auth/utils/hash";
+import { getWebcryptoSubtle } from "@better-auth/utils";
+import { xchacha20poly1305 } from "@noble/ciphers/chacha.js";
+import { bytesToHex, hexToBytes, managedNonce, utf8ToBytes } from "@noble/ciphers/utils.js";
+
+//#region src/crypto/index.ts
+const algorithm = {
+	name: "HMAC",
+	hash: "SHA-256"
+};
+const symmetricEncrypt = async ({ key, data }) => {
+	const keyAsBytes = await createHash("SHA-256").digest(key);
+	const dataAsBytes = utf8ToBytes(data);
+	return bytesToHex(managedNonce(xchacha20poly1305)(new Uint8Array(keyAsBytes)).encrypt(dataAsBytes));
+};
+const symmetricDecrypt = async ({ key, data }) => {
+	const keyAsBytes = await createHash("SHA-256").digest(key);
+	const dataAsBytes = hexToBytes(data);
+	const chacha = managedNonce(xchacha20poly1305)(new Uint8Array(keyAsBytes));
+	return new TextDecoder().decode(chacha.decrypt(dataAsBytes));
+};
+const getCryptoKey = async (secret) => {
+	const secretBuf = typeof secret === "string" ? new TextEncoder().encode(secret) : secret;
+	return await getWebcryptoSubtle().importKey("raw", secretBuf, algorithm, false, ["sign", "verify"]);
+};
+const makeSignature = async (value, secret) => {
+	const key = await getCryptoKey(secret);
+	const signature = await getWebcryptoSubtle().sign(algorithm.name, key, new TextEncoder().encode(value));
+	return btoa(String.fromCharCode(...new Uint8Array(signature)));
+};
+
+//#endregion
+export { constantTimeEqual, generateRandomString, getCryptoKey, hashPassword, makeSignature, signJWT, symmetricDecodeJWT, symmetricDecrypt, symmetricEncodeJWT, symmetricEncrypt, verifyJWT, verifyPassword };
+//# sourceMappingURL=index.mjs.map

package/dist/crypto/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":[],"sources":["../../src/crypto/index.ts"],"sourcesContent":["import { getWebcryptoSubtle } from \"@better-auth/utils\";\nimport { createHash } from \"@better-auth/utils/hash\";\nimport { xchacha20poly1305 } from \"@noble/ciphers/chacha.js\";\nimport {\n\tbytesToHex,\n\thexToBytes,\n\tmanagedNonce,\n\tutf8ToBytes,\n} from \"@noble/ciphers/utils.js\";\n\nconst algorithm = { name: \"HMAC\", hash: \"SHA-256\" };\n\nexport type SymmetricEncryptOptions = {\n\tkey: string;\n\tdata: string;\n};\n\nexport const symmetricEncrypt = async ({\n\tkey,\n\tdata,\n}: SymmetricEncryptOptions) => {\n\tconst keyAsBytes = await createHash(\"SHA-256\").digest(key);\n\tconst dataAsBytes = utf8ToBytes(data);\n\tconst chacha = managedNonce(xchacha20poly1305)(new Uint8Array(keyAsBytes));\n\treturn bytesToHex(chacha.encrypt(dataAsBytes));\n};\n\nexport type SymmetricDecryptOptions = {\n\tkey: string;\n\tdata: string;\n};\n\nexport const symmetricDecrypt = async ({\n\tkey,\n\tdata,\n}: SymmetricDecryptOptions) => {\n\tconst keyAsBytes = await createHash(\"SHA-256\").digest(key);\n\tconst dataAsBytes = hexToBytes(data);\n\tconst chacha = managedNonce(xchacha20poly1305)(new Uint8Array(keyAsBytes));\n\treturn new TextDecoder().decode(chacha.decrypt(dataAsBytes));\n};\n\nexport const getCryptoKey = async (secret: string | BufferSource) => {\n\tconst secretBuf =\n\t\ttypeof secret === \"string\" ? new TextEncoder().encode(secret) : secret;\n\treturn await getWebcryptoSubtle().importKey(\n\t\t\"raw\",\n\t\tsecretBuf,\n\t\talgorithm,\n\t\tfalse,\n\t\t[\"sign\", \"verify\"],\n\t);\n};\n\nexport const makeSignature = async (\n\tvalue: string,\n\tsecret: string | BufferSource,\n): Promise<string> => {\n\tconst key = await getCryptoKey(secret);\n\tconst signature = await getWebcryptoSubtle().sign(\n\t\talgorithm.name,\n\t\tkey,\n\t\tnew TextEncoder().encode(value),\n\t);\n\t// the returned base64 encoded signature will always be 44 characters long and end with one or two equal signs\n\treturn btoa(String.fromCharCode(...new Uint8Array(signature)));\n};\n\nexport * from \"./buffer\";\nexport * from \"./jwt\";\nexport * from \"./password\";\nexport * from \"./random\";\n"],"mappings":";;;;;;;;;;AAUA,MAAM,YAAY;CAAE,MAAM;CAAQ,MAAM;CAAW;AAOnD,MAAa,mBAAmB,OAAO,EACtC,KACA,WAC8B;CAC9B,MAAM,aAAa,MAAM,WAAW,UAAU,CAAC,OAAO,IAAI;CAC1D,MAAM,cAAc,YAAY,KAAK;AAErC,QAAO,WADQ,aAAa,kBAAkB,CAAC,IAAI,WAAW,WAAW,CAAC,CACjD,QAAQ,YAAY,CAAC;;AAQ/C,MAAa,mBAAmB,OAAO,EACtC,KACA,WAC8B;CAC9B,MAAM,aAAa,MAAM,WAAW,UAAU,CAAC,OAAO,IAAI;CAC1D,MAAM,cAAc,WAAW,KAAK;CACpC,MAAM,SAAS,aAAa,kBAAkB,CAAC,IAAI,WAAW,WAAW,CAAC;AAC1E,QAAO,IAAI,aAAa,CAAC,OAAO,OAAO,QAAQ,YAAY,CAAC;;AAG7D,MAAa,eAAe,OAAO,WAAkC;CACpE,MAAM,YACL,OAAO,WAAW,WAAW,IAAI,aAAa,CAAC,OAAO,OAAO,GAAG;AACjE,QAAO,MAAM,oBAAoB,CAAC,UACjC,OACA,WACA,WACA,OACA,CAAC,QAAQ,SAAS,CAClB;;AAGF,MAAa,gBAAgB,OAC5B,OACA,WACqB;CACrB,MAAM,MAAM,MAAM,aAAa,OAAO;CACtC,MAAM,YAAY,MAAM,oBAAoB,CAAC,KAC5C,UAAU,MACV,KACA,IAAI,aAAa,CAAC,OAAO,MAAM,CAC/B;AAED,QAAO,KAAK,OAAO,aAAa,GAAG,IAAI,WAAW,UAAU,CAAC,CAAC"}

package/dist/crypto/jwt.d.mts

@@ -0,0 +1,8 @@
+//#region src/crypto/jwt.d.ts
+declare function signJWT(payload: any, secret: string, expiresIn?: number): Promise<string>;
+declare function verifyJWT<T = any>(token: string, secret: string): Promise<T | null>;
+declare function symmetricEncodeJWT<T extends Record<string, any>>(payload: T, secret: string, salt: string, expiresIn?: number): Promise<string>;
+declare function symmetricDecodeJWT<T = any>(token: string, secret: string, salt: string): Promise<T | null>;
+//#endregion
+export { signJWT, symmetricDecodeJWT, symmetricEncodeJWT, verifyJWT };
+//# sourceMappingURL=jwt.d.mts.map

package/dist/crypto/jwt.mjs

@@ -0,0 +1,95 @@
+import { hkdf } from "@noble/hashes/hkdf.js";
+import { sha256 } from "@noble/hashes/sha2.js";
+import { EncryptJWT, SignJWT, base64url, calculateJwkThumbprint, jwtDecrypt, jwtVerify } from "jose";
+
+//#region src/crypto/jwt.ts
+async function signJWT(payload, secret, expiresIn = 3600) {
+	return await new SignJWT(payload).setProtectedHeader({ alg: "HS256" }).setIssuedAt().setExpirationTime(Math.floor(Date.now() / 1e3) + expiresIn).sign(new TextEncoder().encode(secret));
+}
+async function verifyJWT(token, secret) {
+	try {
+		return (await jwtVerify(token, new TextEncoder().encode(secret))).payload;
+	} catch {
+		return null;
+	}
+}
+const info = new Uint8Array([
+	66,
+	101,
+	116,
+	116,
+	101,
+	114,
+	65,
+	117,
+	116,
+	104,
+	46,
+	106,
+	115,
+	32,
+	71,
+	101,
+	110,
+	101,
+	114,
+	97,
+	116,
+	101,
+	100,
+	32,
+	69,
+	110,
+	99,
+	114,
+	121,
+	112,
+	116,
+	105,
+	111,
+	110,
+	32,
+	75,
+	101,
+	121
+]);
+const now = () => Date.now() / 1e3 | 0;
+const alg = "dir";
+const enc = "A256CBC-HS512";
+async function symmetricEncodeJWT(payload, secret, salt, expiresIn = 3600) {
+	const encryptionSecret = hkdf(sha256, new TextEncoder().encode(secret), new TextEncoder().encode(salt), info, 64);
+	const thumbprint = await calculateJwkThumbprint({
+		kty: "oct",
+		k: base64url.encode(encryptionSecret)
+	}, "sha256");
+	return await new EncryptJWT(payload).setProtectedHeader({
+		alg,
+		enc,
+		kid: thumbprint
+	}).setIssuedAt().setExpirationTime(now() + expiresIn).setJti(crypto.randomUUID()).encrypt(encryptionSecret);
+}
+async function symmetricDecodeJWT(token, secret, salt) {
+	if (!token) return null;
+	try {
+		const { payload } = await jwtDecrypt(token, async ({ kid }) => {
+			const encryptionSecret = hkdf(sha256, new TextEncoder().encode(secret), new TextEncoder().encode(salt), info, 64);
+			if (kid === void 0) return encryptionSecret;
+			if (kid === await calculateJwkThumbprint({
+				kty: "oct",
+				k: base64url.encode(encryptionSecret)
+			}, "sha256")) return encryptionSecret;
+			throw new Error("no matching decryption secret");
+		}, {
+			clockTolerance: 15,
+			keyManagementAlgorithms: [alg],
+			contentEncryptionAlgorithms: [enc, "A256GCM"]
+		});
+		return payload;
+	} catch {
+		return null;
+	}
+}
+
+//#endregion
+export { signJWT, symmetricDecodeJWT, symmetricEncodeJWT, verifyJWT };
+//# sourceMappingURL=jwt.mjs.map

package/dist/crypto/jwt.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.mjs","names":[],"sources":["../../src/crypto/jwt.ts"],"sourcesContent":["import { hkdf } from \"@noble/hashes/hkdf.js\";\nimport { sha256 } from \"@noble/hashes/sha2.js\";\nimport {\n\tbase64url,\n\tcalculateJwkThumbprint,\n\tEncryptJWT,\n\tjwtDecrypt,\n\tjwtVerify,\n\tSignJWT,\n} from \"jose\";\n\nexport async function signJWT(\n\tpayload: any,\n\tsecret: string,\n\texpiresIn: number = 3600,\n): Promise<string> {\n\tconst jwt = await new SignJWT(payload)\n\t\t.setProtectedHeader({ alg: \"HS256\" })\n\t\t.setIssuedAt()\n\t\t.setExpirationTime(Math.floor(Date.now() / 1000) + expiresIn)\n\t\t.sign(new TextEncoder().encode(secret));\n\n\treturn jwt;\n}\n\nexport async function verifyJWT<T = any>(\n\ttoken: string,\n\tsecret: string,\n): Promise<T | null> {\n\ttry {\n\t\tconst verified = await jwtVerify(token, new TextEncoder().encode(secret));\n\t\treturn verified.payload as T;\n\t} catch {\n\t\treturn null;\n\t}\n}\n\n// \"BetterAuth.js Generated Encryption Key\"\nconst info: Uint8Array = new Uint8Array([\n\t66, 101, 116, 116, 101, 114, 65, 117, 116, 104, 46, 106, 115, 32, 71, 101,\n\t110, 101, 114, 97, 116, 101, 100, 32, 69, 110, 99, 114, 121, 112, 116, 105,\n\t111, 110, 32, 75, 101, 121,\n]);\n\nconst now = () => (Date.now() / 1000) | 0;\n\nconst alg = \"dir\";\nconst enc = \"A256CBC-HS512\"; // 64 bytes key\n\nexport async function symmetricEncodeJWT<T extends Record<string, any>>(\n\tpayload: T,\n\tsecret: string,\n\tsalt: string,\n\texpiresIn: number = 3600,\n): Promise<string> {\n\tconst encryptionSecret = hkdf(\n\t\tsha256,\n\t\tnew TextEncoder().encode(secret),\n\t\tnew TextEncoder().encode(salt),\n\t\tinfo,\n\t\t64,\n\t);\n\n\tconst thumbprint = await calculateJwkThumbprint(\n\t\t{ kty: \"oct\", k: base64url.encode(encryptionSecret) },\n\t\t\"sha256\",\n\t);\n\n\treturn await new EncryptJWT(payload)\n\t\t.setProtectedHeader({ alg, enc, kid: thumbprint })\n\t\t.setIssuedAt()\n\t\t.setExpirationTime(now() + expiresIn)\n\t\t.setJti(crypto.randomUUID())\n\t\t.encrypt(encryptionSecret);\n}\n\nexport async function symmetricDecodeJWT<T = any>(\n\ttoken: string,\n\tsecret: string,\n\tsalt: string,\n): Promise<T | null> {\n\tif (!token) return null;\n\ttry {\n\t\tconst { payload } = await jwtDecrypt(\n\t\t\ttoken,\n\t\t\tasync ({ kid }) => {\n\t\t\t\tconst encryptionSecret = hkdf(\n\t\t\t\t\tsha256,\n\t\t\t\t\tnew TextEncoder().encode(secret),\n\t\t\t\t\tnew TextEncoder().encode(salt),\n\t\t\t\t\tinfo,\n\t\t\t\t\t64,\n\t\t\t\t);\n\t\t\t\tif (kid === undefined) return encryptionSecret;\n\n\t\t\t\tconst thumbprint = await calculateJwkThumbprint(\n\t\t\t\t\t{ kty: \"oct\", k: base64url.encode(encryptionSecret) },\n\t\t\t\t\t\"sha256\",\n\t\t\t\t);\n\t\t\t\tif (kid === thumbprint) return encryptionSecret;\n\n\t\t\t\tthrow new Error(\"no matching decryption secret\");\n\t\t\t},\n\t\t\t{\n\t\t\t\tclockTolerance: 15,\n\t\t\t\tkeyManagementAlgorithms: [alg],\n\t\t\t\tcontentEncryptionAlgorithms: [enc, \"A256GCM\"],\n\t\t\t},\n\t\t);\n\t\treturn payload as T;\n\t} catch {\n\t\treturn null;\n\t}\n}\n"],"mappings":";;;;;AAWA,eAAsB,QACrB,SACA,QACA,YAAoB,MACF;AAOlB,QANY,MAAM,IAAI,QAAQ,QAAQ,CACpC,mBAAmB,EAAE,KAAK,SAAS,CAAC,CACpC,aAAa,CACb,kBAAkB,KAAK,MAAM,KAAK,KAAK,GAAG,IAAK,GAAG,UAAU,CAC5D,KAAK,IAAI,aAAa,CAAC,OAAO,OAAO,CAAC;;AAKzC,eAAsB,UACrB,OACA,QACoB;AACpB,KAAI;AAEH,UADiB,MAAM,UAAU,OAAO,IAAI,aAAa,CAAC,OAAO,OAAO,CAAC,EACzD;SACT;AACP,SAAO;;;AAKT,MAAM,OAAmB,IAAI,WAAW;CACvC;CAAI;CAAK;CAAK;CAAK;CAAK;CAAK;CAAI;CAAK;CAAK;CAAK;CAAI;CAAK;CAAK;CAAI;CAAI;CACtE;CAAK;CAAK;CAAK;CAAI;CAAK;CAAK;CAAK;CAAI;CAAI;CAAK;CAAI;CAAK;CAAK;CAAK;CAAK;CACvE;CAAK;CAAK;CAAI;CAAI;CAAK;CACvB,CAAC;AAEF,MAAM,YAAa,KAAK,KAAK,GAAG,MAAQ;AAExC,MAAM,MAAM;AACZ,MAAM,MAAM;AAEZ,eAAsB,mBACrB,SACA,QACA,MACA,YAAoB,MACF;CAClB,MAAM,mBAAmB,KACxB,QACA,IAAI,aAAa,CAAC,OAAO,OAAO,EAChC,IAAI,aAAa,CAAC,OAAO,KAAK,EAC9B,MACA,GACA;CAED,MAAM,aAAa,MAAM,uBACxB;EAAE,KAAK;EAAO,GAAG,UAAU,OAAO,iBAAiB;EAAE,EACrD,SACA;AAED,QAAO,MAAM,IAAI,WAAW,QAAQ,CAClC,mBAAmB;EAAE;EAAK;EAAK,KAAK;EAAY,CAAC,CACjD,aAAa,CACb,kBAAkB,KAAK,GAAG,UAAU,CACpC,OAAO,OAAO,YAAY,CAAC,CAC3B,QAAQ,iBAAiB;;AAG5B,eAAsB,mBACrB,OACA,QACA,MACoB;AACpB,KAAI,CAAC,MAAO,QAAO;AACnB,KAAI;EACH,MAAM,EAAE,YAAY,MAAM,WACzB,OACA,OAAO,EAAE,UAAU;GAClB,MAAM,mBAAmB,KACxB,QACA,IAAI,aAAa,CAAC,OAAO,OAAO,EAChC,IAAI,aAAa,CAAC,OAAO,KAAK,EAC9B,MACA,GACA;AACD,OAAI,QAAQ,OAAW,QAAO;AAM9B,OAAI,QAJe,MAAM,uBACxB;IAAE,KAAK;IAAO,GAAG,UAAU,OAAO,iBAAiB;IAAE,EACrD,SACA,CACuB,QAAO;AAE/B,SAAM,IAAI,MAAM,gCAAgC;KAEjD;GACC,gBAAgB;GAChB,yBAAyB,CAAC,IAAI;GAC9B,6BAA6B,CAAC,KAAK,UAAU;GAC7C,CACD;AACD,SAAO;SACA;AACP,SAAO"}

package/dist/crypto/password.d.mts

@@ -0,0 +1,12 @@
+//#region src/crypto/password.d.ts
+declare const hashPassword: (password: string) => Promise<string>;
+declare const verifyPassword: ({
+  hash,
+  password
+}: {
+  hash: string;
+  password: string;
+}) => Promise<boolean>;
+//#endregion
+export { hashPassword, verifyPassword };
+//# sourceMappingURL=password.d.mts.map

package/dist/crypto/password.mjs

@@ -0,0 +1,36 @@
+import { constantTimeEqual } from "./buffer.mjs";
+import { BetterAuthError } from "@better-auth/core/error";
+import { hex } from "@better-auth/utils/hex";
+import { scryptAsync } from "@noble/hashes/scrypt.js";
+import { hexToBytes } from "@noble/hashes/utils.js";
+
+//#region src/crypto/password.ts
+const config = {
+	N: 16384,
+	r: 16,
+	p: 1,
+	dkLen: 64
+};
+async function generateKey(password, salt) {
+	return await scryptAsync(password.normalize("NFKC"), salt, {
+		N: config.N,
+		p: config.p,
+		r: config.r,
+		dkLen: config.dkLen,
+		maxmem: 128 * config.N * config.r * 2
+	});
+}
+const hashPassword = async (password) => {
+	const salt = hex.encode(crypto.getRandomValues(new Uint8Array(16)));
+	const key = await generateKey(password, salt);
+	return `${salt}:${hex.encode(key)}`;
+};
+const verifyPassword = async ({ hash, password }) => {
+	const [salt, key] = hash.split(":");
+	if (!salt || !key) throw new BetterAuthError("Invalid password hash");
+	return constantTimeEqual(await generateKey(password, salt), hexToBytes(key));
+};
+
+//#endregion
+export { hashPassword, verifyPassword };
+//# sourceMappingURL=password.mjs.map

package/dist/crypto/password.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"password.mjs","names":[],"sources":["../../src/crypto/password.ts"],"sourcesContent":["import { BetterAuthError } from \"@better-auth/core/error\";\nimport { hex } from \"@better-auth/utils/hex\";\nimport { scryptAsync } from \"@noble/hashes/scrypt.js\";\nimport { hexToBytes } from \"@noble/hashes/utils.js\";\nimport { constantTimeEqual } from \"./buffer\";\n\nconst config = {\n\tN: 16384,\n\tr: 16,\n\tp: 1,\n\tdkLen: 64,\n};\n\nasync function generateKey(password: string, salt: string) {\n\treturn await scryptAsync(password.normalize(\"NFKC\"), salt, {\n\t\tN: config.N,\n\t\tp: config.p,\n\t\tr: config.r,\n\t\tdkLen: config.dkLen,\n\t\tmaxmem: 128 * config.N * config.r * 2,\n\t});\n}\n\nexport const hashPassword = async (password: string) => {\n\tconst salt = hex.encode(crypto.getRandomValues(new Uint8Array(16)));\n\tconst key = await generateKey(password, salt);\n\treturn `${salt}:${hex.encode(key)}`;\n};\n\nexport const verifyPassword = async ({\n\thash,\n\tpassword,\n}: {\n\thash: string;\n\tpassword: string;\n}) => {\n\tconst [salt, key] = hash.split(\":\");\n\tif (!salt || !key) {\n\t\tthrow new BetterAuthError(\"Invalid password hash\");\n\t}\n\tconst targetKey = await generateKey(password, salt!);\n\treturn constantTimeEqual(targetKey, hexToBytes(key));\n};\n"],"mappings":";;;;;;;AAMA,MAAM,SAAS;CACd,GAAG;CACH,GAAG;CACH,GAAG;CACH,OAAO;CACP;AAED,eAAe,YAAY,UAAkB,MAAc;AAC1D,QAAO,MAAM,YAAY,SAAS,UAAU,OAAO,EAAE,MAAM;EAC1D,GAAG,OAAO;EACV,GAAG,OAAO;EACV,GAAG,OAAO;EACV,OAAO,OAAO;EACd,QAAQ,MAAM,OAAO,IAAI,OAAO,IAAI;EACpC,CAAC;;AAGH,MAAa,eAAe,OAAO,aAAqB;CACvD,MAAM,OAAO,IAAI,OAAO,OAAO,gBAAgB,IAAI,WAAW,GAAG,CAAC,CAAC;CACnE,MAAM,MAAM,MAAM,YAAY,UAAU,KAAK;AAC7C,QAAO,GAAG,KAAK,GAAG,IAAI,OAAO,IAAI;;AAGlC,MAAa,iBAAiB,OAAO,EACpC,MACA,eAIK;CACL,MAAM,CAAC,MAAM,OAAO,KAAK,MAAM,IAAI;AACnC,KAAI,CAAC,QAAQ,CAAC,IACb,OAAM,IAAI,gBAAgB,wBAAwB;AAGnD,QAAO,kBADW,MAAM,YAAY,UAAU,KAAM,EAChB,WAAW,IAAI,CAAC"}

package/dist/crypto/random.d.mts

@@ -0,0 +1,5 @@
+//#region src/crypto/random.d.ts
+declare const generateRandomString: <SubA extends "a-z" | "A-Z" | "0-9" | "-_">(length: number, ...alphabets: SubA[]) => string;
+//#endregion
+export { generateRandomString };
+//# sourceMappingURL=random.d.mts.map

package/dist/crypto/random.mjs

@@ -0,0 +1,8 @@
+import { createRandomStringGenerator } from "@better-auth/utils/random";
+
+//#region src/crypto/random.ts
+const generateRandomString = createRandomStringGenerator("a-z", "0-9", "A-Z", "-_");
+
+//#endregion
+export { generateRandomString };
+//# sourceMappingURL=random.mjs.map

package/dist/crypto/random.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"random.mjs","names":[],"sources":["../../src/crypto/random.ts"],"sourcesContent":["import { createRandomStringGenerator } from \"@better-auth/utils/random\";\nexport const generateRandomString = createRandomStringGenerator(\n\t\"a-z\",\n\t\"0-9\",\n\t\"A-Z\",\n\t\"-_\",\n);\n"],"mappings":";;;AACA,MAAa,uBAAuB,4BACnC,OACA,OACA,OACA,KACA"}

package/dist/db/adapter-base.d.mts

@@ -0,0 +1,8 @@
+import { BetterAuthOptions } from "@better-auth/core";
+import { DBAdapter } from "@better-auth/core/db/adapter";
+
+//#region src/db/adapter-base.d.ts
+declare function getBaseAdapter(options: BetterAuthOptions, handleDirectDatabase: (options: BetterAuthOptions) => Promise<DBAdapter<BetterAuthOptions>>): Promise<DBAdapter<BetterAuthOptions>>;
+//#endregion
+export { getBaseAdapter };
+//# sourceMappingURL=adapter-base.d.mts.map

package/dist/db/adapter-base.mjs

@@ -0,0 +1,19 @@
+import { logger } from "@better-auth/core/env";
+
+//#region src/db/adapter-base.ts
+async function getBaseAdapter(options, handleDirectDatabase) {
+	let adapter;
+	if (typeof options.database === "function") adapter = options.database(options);
+	else adapter = await handleDirectDatabase(options);
+	if (!adapter.transaction) {
+		logger.warn("Adapter does not correctly implement transaction function, patching it automatically. Please update your adapter implementation.");
+		adapter.transaction = async (cb) => {
+			return cb(adapter);
+		};
+	}
+	return adapter;
+}
+
+//#endregion
+export { getBaseAdapter };
+//# sourceMappingURL=adapter-base.mjs.map

package/dist/db/adapter-base.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapter-base.mjs","names":[],"sources":["../../src/db/adapter-base.ts"],"sourcesContent":["import type { BetterAuthOptions } from \"@better-auth/core\"\nimport type { DBAdapter } from \"@better-auth/core/db/adapter\"\nimport { logger } from \"@better-auth/core/env\"\n\nexport async function getBaseAdapter(\n\toptions: BetterAuthOptions,\n\thandleDirectDatabase: (\n\t\toptions: BetterAuthOptions,\n\t) => Promise<DBAdapter<BetterAuthOptions>>,\n): Promise<DBAdapter<BetterAuthOptions>> {\n\tlet adapter: DBAdapter<BetterAuthOptions>;\n\n\tif (typeof options.database === \"function\") {\n\t\tadapter = options.database(options);\n\t} else {\n\t\tadapter = await handleDirectDatabase(options);\n\t}\n\n\t// patch for 1.3.x to ensure we have a transaction function in the adapter\n\tif (!adapter.transaction) {\n\t\tlogger.warn(\n\t\t\t\"Adapter does not correctly implement transaction function, patching it automatically. Please update your adapter implementation.\",\n\t\t);\n\t\tadapter.transaction = async (cb) => {\n\t\t\treturn cb(adapter);\n\t\t};\n\t}\n\n\treturn adapter;\n}\n"],"mappings":";;;AAIA,eAAsB,eACrB,SACA,sBAGwC;CACxC,IAAI;AAEJ,KAAI,OAAO,QAAQ,aAAa,WAC/B,WAAU,QAAQ,SAAS,QAAQ;KAEnC,WAAU,MAAM,qBAAqB,QAAQ;AAI9C,KAAI,CAAC,QAAQ,aAAa;AACzB,SAAO,KACN,mIACA;AACD,UAAQ,cAAc,OAAO,OAAO;AACnC,UAAO,GAAG,QAAQ;;;AAIpB,QAAO"}

package/dist/db/field-converter.d.mts

@@ -0,0 +1,8 @@
+import { DBFieldAttribute } from "@better-auth/core/db";
+
+//#region src/db/field-converter.d.ts
+declare function convertToDB<T extends Record<string, any>>(fields: Record<string, DBFieldAttribute>, values: T): T;
+declare function convertFromDB<T extends Record<string, any>>(fields: Record<string, DBFieldAttribute>, values: T | null): T | null;
+//#endregion
+export { convertFromDB, convertToDB };
+//# sourceMappingURL=field-converter.d.mts.map

package/dist/db/field-converter.mjs

@@ -0,0 +1,21 @@
+//#region src/db/field-converter.ts
+function convertToDB(fields, values) {
+	const result = values.id ? { id: values.id } : {};
+	for (const key in fields) {
+		const field = fields[key];
+		const value = values[key];
+		if (value === void 0) continue;
+		result[field.fieldName || key] = value;
+	}
+	return result;
+}
+function convertFromDB(fields, values) {
+	if (!values) return null;
+	const result = { id: values.id };
+	for (const [key, value] of Object.entries(fields)) result[key] = values[value.fieldName || key];
+	return result;
+}
+
+//#endregion
+export { convertFromDB, convertToDB };
+//# sourceMappingURL=field-converter.mjs.map

package/dist/db/field-converter.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"field-converter.mjs","names":[],"sources":["../../src/db/field-converter.ts"],"sourcesContent":["import type { DBFieldAttribute } from \"@better-auth/core/db\";\n\nexport function convertToDB<T extends Record<string, any>>(\n\tfields: Record<string, DBFieldAttribute>,\n\tvalues: T,\n) {\n\tconst result: Record<string, any> = values.id\n\t\t? {\n\t\t\t\tid: values.id,\n\t\t\t}\n\t\t: {};\n\tfor (const key in fields) {\n\t\tconst field = fields[key]!;\n\t\tconst value = values[key];\n\t\tif (value === undefined) {\n\t\t\tcontinue;\n\t\t}\n\t\tresult[field.fieldName || key] = value;\n\t}\n\treturn result as T;\n}\n\nexport function convertFromDB<T extends Record<string, any>>(\n\tfields: Record<string, DBFieldAttribute>,\n\tvalues: T | null,\n) {\n\tif (!values) {\n\t\treturn null;\n\t}\n\tconst result: Record<string, any> = {\n\t\tid: values.id,\n\t};\n\tfor (const [key, value] of Object.entries(fields)) {\n\t\tresult[key] = values[value.fieldName || key];\n\t}\n\treturn result as T;\n}\n"],"mappings":";AAEA,SAAgB,YACf,QACA,QACC;CACD,MAAM,SAA8B,OAAO,KACxC,EACA,IAAI,OAAO,IACX,GACA,EAAE;AACL,MAAK,MAAM,OAAO,QAAQ;EACzB,MAAM,QAAQ,OAAO;EACrB,MAAM,QAAQ,OAAO;AACrB,MAAI,UAAU,OACb;AAED,SAAO,MAAM,aAAa,OAAO;;AAElC,QAAO;;AAGR,SAAgB,cACf,QACA,QACC;AACD,KAAI,CAAC,OACJ,QAAO;CAER,MAAM,SAA8B,EACnC,IAAI,OAAO,IACX;AACD,MAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,OAAO,CAChD,QAAO,OAAO,OAAO,MAAM,aAAa;AAEzC,QAAO"}