@somewhatintelligent/guestlist 0.0.1-beta.1783705886.297c5be

package/package.json

@@ -0,0 +1,54 @@
+{
+  "name": "@somewhatintelligent/guestlist",
+  "version": "0.0.1-beta.1783705886.297c5be",
+  "type": "module",
+  "sideEffects": false,
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/apostolos-geyer/platform.git",
+    "directory": "packages/guestlist"
+  },
+  "exports": {
+    ".": "./src/index.ts",
+    "./client": "./src/client/index.ts",
+    "./client/react": "./src/client/react.ts",
+    "./schema": "./src/schema.ts"
+  },
+  "files": [
+    "src"
+  ],
+  "scripts": {
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run"
+  },
+  "dependencies": {
+    "@better-auth/api-key": "^1.6.0",
+    "@better-auth/core": "^1.6.9",
+    "@better-auth/oauth-provider": "^1.6.0",
+    "@better-auth/passkey": "^1.6.0",
+    "@somewhatintelligent/auth": "^0.0.0",
+    "@somewhatintelligent/kit": "^0.0.0",
+    "better-auth": "^1.6.0",
+    "cookie-es": "^3.1.1",
+    "drizzle-orm": "^0.45.2",
+    "ulidx": "^2.4.1"
+  },
+  "devDependencies": {
+    "@cloudflare/workers-types": "^4",
+    "@types/react": "^19.2.14",
+    "react": "19.2.4",
+    "typescript": "5.9.2",
+    "vitest": "^4.1.10"
+  },
+  "peerDependencies": {
+    "react": "19.2.4"
+  },
+  "peerDependenciesMeta": {
+    "react": {
+      "optional": true
+    }
+  }
+}

package/src/__tests__/email.test.ts

@@ -0,0 +1,85 @@
+import { describe, expect, test } from "vitest";
+import {
+  defineEmailHandlers,
+  toPlatformAuthSendEmail,
+  type GuestlistEmail,
+} from "../email";
+import { originPattern } from "../cors";
+
+describe("toPlatformAuthSendEmail", () => {
+  test("maps every better-auth callback onto the event union", async () => {
+    const seen: GuestlistEmail[] = [];
+    const sendEmail = async (msg: GuestlistEmail) => {
+      seen.push(msg);
+    };
+    const ba = toPlatformAuthSendEmail(sendEmail);
+
+    await ba.verification({ user: { email: "a@x.com", name: "A" }, url: "u1" });
+    await ba.resetPassword({ user: { email: "a@x.com", name: "A" }, url: "u2" });
+    await ba.changeEmail({ user: { email: "a@x.com", name: "A" }, newEmail: "b@x.com", url: "u3" });
+    await ba.deleteAccount({ user: { email: "a@x.com", name: "A" }, url: "u4" });
+    await ba.magicLink({ email: "a@x.com", url: "u5" });
+    await ba.invitation({
+      invitationId: "inv1",
+      email: "c@x.com",
+      inviterName: "A",
+      inviterEmail: "a@x.com",
+      organizationName: "Acme",
+      role: "member",
+      inviteUrl: "u6",
+    });
+
+    expect(seen.map((m) => m.kind)).toEqual([
+      "verification",
+      "reset-password",
+      "email-change",
+      "delete-account",
+      "magic-link",
+      "org-invitation",
+    ]);
+    const invite = seen[5]!;
+    if (invite.kind !== "org-invitation") throw new Error("expected org-invitation");
+    expect(invite.inviter).toEqual({ name: "A", email: "a@x.com" });
+    expect(invite.url).toBe("u6");
+  });
+
+  test("send failures propagate (BA hooks must see rejections)", async () => {
+    const ba = toPlatformAuthSendEmail(async () => {
+      throw new Error("smtp down");
+    });
+    await expect(
+      ba.verification({ user: { email: "a@x.com", name: "A" }, url: "u" }),
+    ).rejects.toThrow("smtp down");
+  });
+});
+
+describe("defineEmailHandlers", () => {
+  test("dispatches to the matching kind handler", async () => {
+    const calls: string[] = [];
+    const send = defineEmailHandlers({
+      verification: async (m) => void calls.push(`v:${m.url}`),
+      "reset-password": async () => void calls.push("r"),
+      "email-change": async () => void calls.push("c"),
+      "delete-account": async () => void calls.push("d"),
+      "magic-link": async () => void calls.push("m"),
+      "org-invitation": async () => void calls.push("o"),
+    });
+    await send({ kind: "verification", to: { email: "a@x.com" }, url: "u9" });
+    expect(calls).toEqual(["v:u9"]);
+  });
+});
+
+describe("cors originPattern", () => {
+  const p = originPattern("acme.example");
+  test("matches the bare apex (the suffix-only footgun this guards)", () => {
+    expect(p.test("https://acme.example")).toBe(true);
+  });
+  test("matches subdomains, both schemes", () => {
+    expect(p.test("https://app.acme.example")).toBe(true);
+    expect(p.test("http://deep.dev.acme.example")).toBe(true);
+  });
+  test("rejects lookalike and suffixed hosts", () => {
+    expect(p.test("https://evilacme.example")).toBe(false);
+    expect(p.test("https://acme.example.attacker.com")).toBe(false);
+  });
+});

package/src/blobs.ts

@@ -0,0 +1,56 @@
+/**
+ * Blob-storage capability for the avatar surface. Injected by the consumer
+ * (`GuestlistConfig.blobs`); when absent, the avatar routes are not mounted
+ * and `/u/avatar/*` 404s — the feature is off, not broken.
+ *
+ * The expected implementation is presigned browser-direct upload against
+ * R2/S3: `register` returns a presigned PUT the browser uses directly, so
+ * guestlist never streams bytes. Dedup by content hash is the
+ * implementation's choice — returning `upload: { status: "ready" }` from
+ * `register` signals a dedup hit (blob already stored; skip the PUT).
+ *
+ * Avatars are capped at 8 MiB, so single-part upload is always sufficient;
+ * multipart is deliberately not part of this interface.
+ */
+export interface BlobRegisterInput {
+  /** sha-256 of the bytes, lowercase hex. */
+  hash: string;
+  size: number;
+  contentType: string;
+  /** The authenticated user the blob will belong to. */
+  ownerUserId: string;
+}
+
+export type BlobUploadPlan =
+  | { status: "ready" }
+  | { status: "single-part"; uploadUrl: string; requiredHeaders: Record<string, string> };
+
+export type BlobRegisterResult =
+  | { ok: true; referenceId: string; upload: BlobUploadPlan }
+  | { ok: false; error: string };
+
+export type BlobReferenceState = "pending" | "stored" | "deleted";
+
+export interface GuestlistBlobStore {
+  /** Reserve a reference + presigned upload for the given content. */
+  register(input: BlobRegisterInput): Promise<BlobRegisterResult>;
+  /**
+   * Look up a reference the confirm flow is about to finalize. Returns
+   * `null` for unknown refs. `ownerUserId` is who the ref was registered
+   * for — the route enforces that the confirming user matches.
+   */
+  getReference(refId: string): Promise<{ state: BlobReferenceState; ownerUserId: string } | null>;
+  /** Finalize a pending reference after the browser PUT completed. */
+  finalize(refId: string): Promise<{ ok: true } | { ok: false; error: string }>;
+  /**
+   * Release a reference (replaced or removed avatar). Fire-and-forget from
+   * the caller's perspective; implementations should tolerate double
+   * release and unknown refs.
+   */
+  release(refId: string): Promise<void>;
+  /**
+   * Short-lived public read URL for a stored blob, or `null` if the ref is
+   * unknown/deleted. Backs the 302 on `/u/avatar/:refId`.
+   */
+  readUrl(refId: string, opts: { lifetimeSeconds: number }): Promise<string | null>;
+}

package/src/client/avatar.ts

@@ -0,0 +1,125 @@
+/**
+ * Browser-side avatar upload driver — transport-agnostic.
+ *
+ * Avatar mutations are WorkerEntrypoint RPC (no HTTP spelling), so the
+ * browser cannot call guestlist directly. The consuming app fronts
+ * register/confirm with its own endpoints or server fns (each a one-line
+ * forward to `env.GUESTLIST.registerAvatarUpload(...)` /
+ * `.confirmAvatar(...)` with the user's Cookie header) and injects them
+ * here. This driver owns the browser-only mechanics: sha-256 hashing, the
+ * presigned direct PUT with progress, and error normalization.
+ */
+import type { BlobUploadPlan } from "../blobs";
+import type { AvatarContentType } from "../ops/avatar";
+
+export type { AvatarContentType };
+
+export class AvatarError extends Error {
+  override name = "AvatarError" as const;
+  constructor(
+    public code: string,
+    message: string,
+    public status?: number,
+  ) {
+    super(message);
+  }
+}
+
+export interface AvatarTransport {
+  /** App-provided forward to the `registerAvatarUpload` RPC. */
+  register(input: {
+    hash: string;
+    size: number;
+    contentType: AvatarContentType;
+  }): Promise<
+    | { ok: true; referenceId: string; upload: BlobUploadPlan }
+    | { ok: false; error: string; message?: string }
+  >;
+  /** App-provided forward to the `confirmAvatar` RPC. */
+  confirm(input: {
+    referenceId: string;
+  }): Promise<{ ok: true; image: string } | { ok: false; error: string; message?: string }>;
+}
+
+export interface SetAvatarOpts {
+  contentType: AvatarContentType;
+  onProgress?: (loaded: number, total: number) => void;
+  signal?: AbortSignal;
+}
+
+/**
+ * Three-step presigned upload of a new avatar:
+ *   1. `transport.register` — reserve a reference + presigned PUT
+ *   2. direct PUT of the bytes to storage (skipped on dedup hit)
+ *   3. `transport.confirm` — finalize + write the URL onto `user.image`
+ *
+ * Returns the new image URL. Throws `AvatarError` if any sub-step fails;
+ * guestlist's confirm op handles its own rollback so a failure doesn't
+ * leak orphan blobs.
+ */
+export async function setAvatar(
+  transport: AvatarTransport,
+  blob: Blob,
+  opts: SetAvatarOpts,
+): Promise<string> {
+  const hash = await sha256Hex(blob);
+  const reg = await transport.register({
+    hash,
+    size: blob.size,
+    contentType: opts.contentType,
+  });
+  if (!reg.ok) throw new AvatarError(reg.error, reg.message ?? "avatar register failed");
+
+  if (reg.upload.status === "single-part") {
+    await putWithProgress(reg.upload.uploadUrl, reg.upload.requiredHeaders, blob, opts);
+  }
+  // status "ready" = dedup hit; the blob is already stored.
+
+  const conf = await transport.confirm({ referenceId: reg.referenceId });
+  if (!conf.ok) throw new AvatarError(conf.error, conf.message ?? "avatar confirm failed");
+  return conf.image;
+}
+
+/** sha-256 of the blob, lowercase hex — what `register` expects. */
+export async function sha256Hex(blob: Blob): Promise<string> {
+  const digest = await crypto.subtle.digest("SHA-256", await blob.arrayBuffer());
+  return Array.from(new Uint8Array(digest))
+    .map((b) => b.toString(16).padStart(2, "0"))
+    .join("");
+}
+
+/**
+ * Direct PUT via XHR (fetch has no upload-progress events). Presigned URLs
+ * are method+header bound, so `requiredHeaders` must be set verbatim.
+ */
+function putWithProgress(
+  url: string,
+  requiredHeaders: Record<string, string>,
+  blob: Blob,
+  opts: Pick<SetAvatarOpts, "onProgress" | "signal">,
+): Promise<void> {
+  return new Promise((resolve, reject) => {
+    const xhr = new XMLHttpRequest();
+    xhr.open("PUT", url);
+    for (const [k, v] of Object.entries(requiredHeaders)) xhr.setRequestHeader(k, v);
+    if (opts.onProgress) {
+      xhr.upload.onprogress = (e) => {
+        if (e.lengthComputable) opts.onProgress!(e.loaded, e.total);
+      };
+    }
+    if (opts.signal) {
+      const abort = () => {
+        xhr.abort();
+        reject(new AvatarError("aborted", "avatar upload aborted"));
+      };
+      if (opts.signal.aborted) return abort();
+      opts.signal.addEventListener("abort", abort, { once: true });
+    }
+    xhr.onload = () => {
+      if (xhr.status >= 200 && xhr.status < 300) resolve();
+      else reject(new AvatarError("upload_failed", `storage PUT returned ${xhr.status}`, xhr.status));
+    };
+    xhr.onerror = () => reject(new AvatarError("upload_failed", "storage PUT network error"));
+    xhr.send(blob);
+  });
+}

package/src/client/guestlist.ts

@@ -0,0 +1,189 @@
+/**
+ * Server-side guestlist client: the better-auth client (whose routes are
+ * HTTP on guestlist) plus the cookie/correlation plumbing that makes it
+ * safe from SSR. Custom operations (admin, orgs, directory, avatar
+ * mutations) are NOT here — call them directly off the service binding
+ * RPC (`env.GUESTLIST.adminListOrgs({ cookie, ... })`).
+ */
+import { createAuthClient } from "better-auth/client";
+import type { ClientFetchOption } from "@better-auth/core";
+import { parseSetCookie, splitSetCookieString, type CookieSerializeOptions } from "cookie-es";
+import type { Actor } from "@somewhatintelligent/kit/request-context";
+import type { PlatformSession } from "@somewhatintelligent/auth";
+import { guestlistClientPlugins } from "./plugins";
+
+/**
+ * Framework-agnostic cookie adapter. Matches the shape popularized by
+ * `@supabase/ssr`, `@clerk/nextjs`, and `@auth/core` server helpers:
+ * consumer apps provide a `getAll` that reads the incoming request's cookie
+ * jar and a `setAll` that writes forwarded cookies onto the outgoing
+ * response. Both callbacks may be sync or async.
+ */
+export interface GuestlistCookieAdapter {
+  /** Called before every call. Cookies from the incoming request. */
+  getAll: () =>
+    | ReadonlyArray<{ name: string; value: string }>
+    | Promise<ReadonlyArray<{ name: string; value: string }>>;
+  /**
+   * Called after every call with any `Set-Cookie` guestlist emitted,
+   * parsed into structured form; consumer forwards them onto its outgoing
+   * SSR response. Without this, guestlist-emitted cookie refreshes
+   * (notably the 5-min session-cache JWT) are silently dropped and the
+   * fast-path session reader returns `null` on the next SSR request even
+   * when the underlying DB session is valid.
+   */
+  setAll: (
+    cookies: ReadonlyArray<{ name: string; value: string; options?: CookieSerializeOptions }>,
+  ) => void | Promise<void>;
+}
+
+export interface GuestlistClientOptions {
+  /**
+   * Guestlist service URL. When calling via a Cloudflare service binding,
+   * this host is ignored — any placeholder (e.g. `"http://guestlist.internal"`)
+   * works as long as `fetchOptions.customFetchImpl` routes through the binding.
+   */
+  baseURL: string;
+  /**
+   * Fetch options passed through to better-auth's client verbatim.
+   * `customFetchImpl` is typically `env.GUESTLIST.fetch.bind(env.GUESTLIST)`.
+   */
+  fetchOptions?: ClientFetchOption;
+  /** Cookie adapter — see GuestlistCookieAdapter. */
+  cookies?: GuestlistCookieAdapter;
+  /** Correlation id resolver; forwarded as `cf-request-id`. */
+  getRequestId?: () => string;
+  /** Calling app/service name; forwarded as `x-caller-app` (log correlation only). */
+  callerApp?: string;
+  /**
+   * Active actor resolver; forwarded as `x-actor-kind`/`x-actor-id`.
+   * LOG CORRELATION ONLY — guestlist never uses these for authz; its
+   * authoritative identity flows through cookies → BA get-session → DB.
+   */
+  getActor?: () => Actor | null | Promise<Actor | null>;
+}
+
+export function createGuestlistClient(options: GuestlistClientOptions) {
+  if ("window" in globalThis) {
+    throw new Error(
+      "createGuestlistClient is server-only. " +
+        "Use createGuestlistAuthClient from @somewhatintelligent/guestlist/client/react instead.",
+    );
+  }
+
+  const { baseURL, fetchOptions, cookies, getRequestId, callerApp, getActor } = options;
+
+  const baseFetch =
+    (fetchOptions?.customFetchImpl as typeof fetch | undefined) ??
+    (globalThis.fetch as typeof fetch);
+  const cookieWrapped = cookies ? wrapFetchWithCookieAdapter(baseFetch, cookies) : baseFetch;
+  const wrappedFetch =
+    getRequestId || callerApp || getActor
+      ? wrapFetchWithCorrelation(cookieWrapped, { getRequestId, callerApp, getActor })
+      : cookieWrapped;
+
+  const auth = createAuthClient({
+    baseURL,
+    fetchOptions: { ...fetchOptions, customFetchImpl: wrappedFetch },
+    plugins: guestlistClientPlugins(),
+  });
+
+  return {
+    /** Full better-auth client with guestlist's plugin set. */
+    auth,
+
+    async getSession(): Promise<PlatformSession | null> {
+      const res = await auth.getSession();
+      return res.data ?? null;
+    },
+  };
+}
+
+export type GuestlistClient = ReturnType<typeof createGuestlistClient>;
+
+/**
+ * Wraps a fetch impl to inject correlation headers on every outgoing
+ * request — adopted by guestlist at its fetch boundary so the same context
+ * threads through every canonical-log line on either side. Caller-set
+ * values on `init.headers` win. Actor headers are omitted when
+ * `getActor()` returns null (auth flows, anonymous page loads).
+ */
+function wrapFetchWithCorrelation(
+  realFetch: typeof fetch,
+  opts: {
+    getRequestId?: () => string;
+    callerApp?: string;
+    getActor?: () => Actor | null | Promise<Actor | null>;
+  },
+): typeof fetch {
+  const wrapped = async (input: RequestInfo | URL, init?: RequestInit): Promise<Response> => {
+    const headers = new Headers(init?.headers ?? undefined);
+    if (opts.getRequestId && !headers.has("cf-request-id")) {
+      headers.set("cf-request-id", opts.getRequestId());
+    }
+    if (opts.callerApp && !headers.has("x-caller-app")) {
+      headers.set("x-caller-app", opts.callerApp);
+    }
+    if (opts.getActor && !headers.has("x-actor-kind")) {
+      const actor = await opts.getActor();
+      if (actor) {
+        headers.set("x-actor-kind", actor.kind);
+        headers.set("x-actor-id", actor.kind === "user" ? actor.userId : actor.serviceName);
+      }
+    }
+    return realFetch(input, { ...init, headers });
+  };
+  return wrapped as unknown as typeof fetch;
+}
+
+/**
+ * Wraps a fetch impl with two responsibilities:
+ *   1. Before the call: fold `cookies.getAll()` into the `Cookie:` header.
+ *   2. After: parse every `Set-Cookie` on the response into `cookies.setAll()`.
+ */
+function wrapFetchWithCookieAdapter(
+  realFetch: typeof fetch,
+  cookies: GuestlistCookieAdapter,
+): typeof fetch {
+  const wrapped = async (input: RequestInfo | URL, init?: RequestInit): Promise<Response> => {
+    const headers = new Headers(init?.headers ?? undefined);
+    const incoming = await cookies.getAll();
+    if (incoming.length > 0) {
+      const folded = incoming.map((c) => `${c.name}=${c.value}`).join("; ");
+      const existing = headers.get("cookie");
+      headers.set("cookie", existing ? `${existing}; ${folded}` : folded);
+    }
+
+    const response = await realFetch(input, { ...init, headers });
+
+    const rawSetCookies = readSetCookies(response.headers);
+    if (rawSetCookies.length > 0) {
+      const parsed: Array<{ name: string; value: string; options?: CookieSerializeOptions }> = [];
+      for (const raw of rawSetCookies) {
+        const sc = parseSetCookie(raw);
+        if (!sc) continue;
+        const { name, value, ...rest } = sc;
+        parsed.push({ name, value, options: rest as CookieSerializeOptions });
+      }
+      if (parsed.length > 0) await cookies.setAll(parsed);
+    }
+
+    return response;
+  };
+  return wrapped as unknown as typeof fetch;
+}
+
+/**
+ * Reads `Set-Cookie` values off a Headers instance, handling runtimes with
+ * `getSetCookie()` (modern Node, CF Workers) and legacy comma-folded
+ * strings (split via `splitSetCookieString`, which doesn't choke on commas
+ * inside `Expires=` attribute values).
+ */
+function readSetCookies(headers: Headers): string[] {
+  const maybeGetSetCookie = (headers as Headers & { getSetCookie?: () => string[] }).getSetCookie;
+  if (typeof maybeGetSetCookie === "function") {
+    return maybeGetSetCookie.call(headers);
+  }
+  const raw = headers.get("set-cookie");
+  return raw ? splitSetCookieString(raw) : [];
+}

package/src/client/index.ts

@@ -0,0 +1,17 @@
+export {
+  createGuestlistClient,
+  type GuestlistClient,
+  type GuestlistClientOptions,
+  type GuestlistCookieAdapter,
+} from "./guestlist";
+export { guestlistClientPlugins } from "./plugins";
+// Browser avatar driver — the app injects transports that forward to the
+// `registerAvatarUpload` / `confirmAvatar` WorkerEntrypoint RPC methods.
+export {
+  setAvatar,
+  sha256Hex,
+  AvatarError,
+  type AvatarTransport,
+  type SetAvatarOpts,
+  type AvatarContentType,
+} from "./avatar";

package/src/client/plugins.ts

@@ -0,0 +1,24 @@
+import {
+  adminClient,
+  twoFactorClient,
+  deviceAuthorizationClient,
+  usernameClient,
+  magicLinkClient,
+  organizationClient,
+} from "better-auth/client/plugins";
+import { oauthProviderClient } from "@better-auth/oauth-provider/client";
+import { passkeyClient } from "@better-auth/passkey/client";
+import { apiKeyClient } from "@better-auth/api-key/client";
+
+/** Client plugins matching guestlist's server plugin set. */
+export const guestlistClientPlugins = () => [
+  usernameClient(),
+  adminClient(),
+  twoFactorClient(),
+  oauthProviderClient(),
+  passkeyClient(),
+  apiKeyClient(),
+  deviceAuthorizationClient(),
+  magicLinkClient(),
+  organizationClient(),
+];

package/src/client/react.ts

@@ -0,0 +1,32 @@
+"use client";
+
+/**
+ * Browser-side better-auth client with guestlist's plugin set.
+ *
+ * `baseURL` is the app-root URL the browser should call — typically
+ * `window.location.origin` when the consumer app (or bouncer) proxies
+ * `/api/auth/*` to guestlist. Avatar uploads are a separate concern: see
+ * `setAvatar` in ./avatar.ts (the app injects its register/confirm
+ * endpoints, which forward to the WorkerEntrypoint RPC).
+ */
+import { createAuthClient } from "better-auth/react";
+import type { ClientFetchOption } from "@better-auth/core";
+import { guestlistClientPlugins } from "./plugins";
+
+export interface GuestlistAuthClientOptions {
+  baseURL: string;
+  fetchOptions?: ClientFetchOption;
+}
+
+export function createGuestlistAuthClient(options: GuestlistAuthClientOptions) {
+  return createAuthClient({
+    baseURL: options.baseURL,
+    fetchOptions: {
+      credentials: "include",
+      ...options.fetchOptions,
+    },
+    plugins: guestlistClientPlugins(),
+  });
+}
+
+export type GuestlistAuthClient = ReturnType<typeof createGuestlistAuthClient>;

package/src/codegen.ts

@@ -0,0 +1,57 @@
+/**
+ * Schema-codegen entry for consumers.
+ *
+ * Migrations are CONSUMER-OWNED, derived from the consumer's config:
+ * better-auth's CLI generates the drizzle schema from the configured
+ * instance's plugin set, so which tables exist follows from which
+ * features the consumer enables. The package ships no migrations.
+ *
+ * Consumer flow (in the consumer repo):
+ *
+ * ```ts
+ * // guestlist.codegen.ts
+ * import { createCodegenAuth } from "@somewhatintelligent/guestlist";
+ * import { guestlistConfig } from "./guestlist.config";
+ * export const auth = createCodegenAuth(guestlistConfig);
+ * ```
+ *
+ * ```sh
+ * bunx @better-auth/cli generate --config guestlist.codegen.ts  # schema
+ * bunx drizzle-kit generate                                     # migrations (consumer journal)
+ * ```
+ *
+ * Every option that doesn't affect the plugin set / schema is stubbed —
+ * this instance must never serve traffic.
+ */
+import { drizzleAdapter } from "better-auth/adapters/drizzle";
+import { createPlatformAuth } from "@somewhatintelligent/auth";
+
+import type { GuestlistEnv } from "./env";
+import type { GuestlistConfig } from "./config";
+import { consoleEmail, toPlatformAuthSendEmail } from "./email";
+
+export function createCodegenAuth<TEnv extends GuestlistEnv>(config: GuestlistConfig<TEnv>) {
+  return createPlatformAuth({
+    baseURL: "http://codegen.invalid",
+    secret: "codegen-only-never-serves-traffic",
+    authDomain: ".codegen.invalid",
+    identityUrl: "http://codegen.invalid",
+    requireEmailVerification: false,
+    cookiePrefix: config.cookiePrefix,
+    passkeyRpName: config.passkeyRpName,
+    twoFactorIssuer: config.twoFactorIssuer,
+    // Adapter construction never touches the db; the CLI only introspects.
+    database: drizzleAdapter({} as never, { provider: "sqlite", schema: {} }),
+    sendEmail: toPlatformAuthSendEmail(consoleEmail()),
+    // Billing present ⇒ the stripe plugin joins the set, so its tables
+    // land in the generated schema. Plan CONTENT is schema-neutral (same
+    // subscription table for any plan list); keys are stubs; see module doc.
+    stripe: config.billing
+      ? {
+          secretKey: "sk_codegen",
+          webhookSecret: "whsec_codegen",
+          plans: config.billing.plans,
+        }
+      : undefined,
+  });
+}