@user-center/next-better-auth 0.0.0-stage → 0.1.10

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 User Center contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,53 @@
-# Temporary Holding Version
+# User Center authentication SDK
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Version 0.1.10 is a public trial for Node, Next App Router and Better Auth 1.7.12. Distributed package contents use MIT, with the complete notice in LICENSE. The intended npm access is public and the distribution tag is next. Production authentication, mail, host storage and formal runtime combinations still require acceptance.
+
+## Install a fixed version
+
+```sh
+pnpm add --save-exact better-auth@1.7.12 server-only@0.0.1 @user-center/next-better-auth@0.1.10
+pnpm add -D --save-exact @user-center/cli@0.1.10
+```
+
+For a candidate delivered as a tgz, replace the package specifiers with the verified SDK and CLI archive paths. A local candidate or dry run does not prove that a version is available on npm. Check the exact version and keep your lockfile. npm tags, including latest, do not certify production readiness.
+
+## Complete guide and copyable example
+
+Both packages include the same self contained reference material. No access to the center source repository is needed to obtain it.
+
+| Material | Path inside this installed package |
+| --- | --- |
+| Start here | dist/reference/README.md |
+| Full registration, storage, routing and acceptance guide | dist/reference/guide/index.md |
+| Environment profiles and local to remote setup | dist/reference/guide/environments.md |
+| Read only doctor, output and exit codes | dist/reference/guide/doctor.md |
+| Supported targets and pending acceptance | dist/reference/guide/support.md |
+| Prompt for your project Agent | dist/reference/guide/agent-prompt.md |
+| Copyable independent Next application | dist/reference/example-next/ |
+
+After installation, open `node_modules/@user-center/next-better-auth/dist/reference/README.md`. You can also extract the verified tgz and read `package/dist/reference/README.md`. Once this exact version has been published, its files can also be browsed through the Code tab on this [npm version page](https://www.npmjs.com/package/@user-center/next-better-auth/v/0.1.10). A candidate archive already provides all materials locally; it does not create the remote page. Repository visibility does not control these package contents.
+
+Copy the example directory yourself into a new empty project, then follow its README. Its dependencies use fixed registry versions; for an unpublished candidate, explicitly substitute the verified tgz paths before installing. The SDK and doctor do not copy files, install dependencies or execute migrations. The example is reference source, not a preconfigured authentication service.
+
+## Register and wire your host
+
+```js
+import { describeRegistration } from '@user-center/next-better-auth/config';
+const registration = describeRegistration({
+  issuer: 'https://auth.example.com/api/auth',
+  platformOrigin: 'https://platform.example.test',
+});
+```
+
+Register the exact returned callback and origin, obtain a dedicated confidential Web Client, then create a Manifest v1. Provide your own database adapter, independent session secret, explicit authUserPolicy and business identity resolver to createUserCenterAuth. Mount its handlers.GET/POST in your own route and protect pages and APIs with getPrincipal. The complete working wiring, migration planning and validation steps are included in the example and guide above.
+
+| Public module | Purpose |
+| --- | --- |
+| root or /public | Public configuration and types |
+| /config | Registration, environment selection and storage binding helpers |
+| /server | createUserCenterAuth and protected server operations |
+| /client | createUserCenterClient for controlled login, session reads and local logout |
+
+Import runtime code only through these public modules. The reference directory is documentation and host example source, not another SDK runtime API. Server code is protected by server-only. Secrets stay in your host server configuration. An authentication session does not grant business permissions; your host owns user mapping, roles and authorization.
+
+Blog integration is completed according to the user's confirmation, without certifying its SDK version or a formal runtime combination. Real production authentication and storage acceptance remain pending. Source checkout build scripts need workspace tools; installed code is precompiled and has no install or publish lifecycle hooks.

package/dist/integration-contracts/src/compatibility.d.ts

@@ -0,0 +1,9 @@
+export declare const MATRIX_VERSION = "2026-11-04.1";
+export interface RuntimeCombination {
+    node: string;
+    next: string;
+    react: string;
+    betterAuth: string;
+    evidence: string;
+}
+export declare const VERIFIED_COMBINATIONS: readonly RuntimeCombination[];

package/dist/integration-contracts/src/compatibility.js

@@ -0,0 +1,3 @@
+// Only a recorded real integration may add a verified runtime combination.
+export const MATRIX_VERSION = "2026-11-04.1";
+export const VERIFIED_COMBINATIONS = [];

package/dist/integration-contracts/src/config.d.ts

@@ -0,0 +1,15 @@
+import { type PublicConfig } from "./public.js";
+export { ENVIRONMENTS, resolveEnvironmentConfig, validateEnvironmentSelection, assertPostgresBinding } from "./environment.js";
+export type { EnvironmentName, EnvironmentSelection, PostgresBinding } from "./environment.js";
+export declare function describeRegistration(input: {
+    issuer: string;
+    platformOrigin: string;
+    authBasePath?: string;
+}): {
+    canonicalIssuer: string;
+    platformOrigin: string;
+    authBasePath: string;
+    providerId: string;
+    callbackUrl: string;
+};
+export declare function describeIntegration(input: unknown): PublicConfig;

package/dist/integration-contracts/src/config.js

@@ -0,0 +1,17 @@
+import { createHash } from "node:crypto";
+import { canonicalizeIssuer, parseManifest, validateOrigin, validateAuthBasePath, record, keys } from "./public.js";
+export { ENVIRONMENTS, resolveEnvironmentConfig, validateEnvironmentSelection, assertPostgresBinding } from "./environment.js";
+const digest = (s) => createHash("sha256").update(s, "utf8").digest("hex");
+export function describeRegistration(input) {
+    keys(record(input), ["issuer", "platformOrigin", "authBasePath"]);
+    const canonicalIssuer = canonicalizeIssuer(input.issuer);
+    const platformOrigin = validateOrigin(input.platformOrigin);
+    const authBasePath = validateAuthBasePath(input.authBasePath);
+    const providerId = "user-center-" + digest(canonicalIssuer);
+    return { canonicalIssuer, platformOrigin, authBasePath, providerId, callbackUrl: platformOrigin + authBasePath + "/callback/" + providerId };
+}
+export function describeIntegration(input) {
+    const manifest = parseManifest(input);
+    const registration = describeRegistration({ issuer: manifest.issuer, platformOrigin: manifest.platformOrigin, authBasePath: manifest.authBasePath });
+    return { ...manifest, ...registration, centerOrigin: new URL(registration.canonicalIssuer).origin, discoveryUrl: registration.canonicalIssuer + "/.well-known/openid-configuration", cookiePrefix: "uc_" + digest(manifest.platformOrigin + "\n" + registration.canonicalIssuer).slice(0, 24) };
+}

package/dist/integration-contracts/src/environment.d.ts

@@ -0,0 +1,25 @@
+import { type Manifest } from "./public.js";
+export declare const ENVIRONMENTS: readonly ["development", "staging", "production"];
+export type EnvironmentName = typeof ENVIRONMENTS[number];
+export interface EnvironmentSelection {
+    runtimeEnvironment: EnvironmentName;
+    targetEnvironment: EnvironmentName;
+}
+export interface PostgresBinding {
+    urlEnv: string;
+    hostname: string;
+    port: number;
+    database: string;
+    username: string;
+}
+export declare function validateEnvironmentSelection(input: unknown): Readonly<EnvironmentSelection>;
+export declare function assertPostgresBinding(url: string, input: unknown): void;
+/** Pure selection only. The host reads the selected secret variables on its server. */
+export declare function resolveEnvironmentConfig(input: unknown, selection: {
+    runtimeEnvironment: string;
+    targetEnvironment?: string;
+}): {
+    manifest: Manifest;
+    environment: Readonly<EnvironmentSelection>;
+    database?: PostgresBinding;
+};

package/dist/integration-contracts/src/environment.js

@@ -0,0 +1,108 @@
+import { IntegrationError, canonicalizeIssuer, keys, parseManifest, record, validateOrigin } from "./public.js";
+export const ENVIRONMENTS = ["development", "staging", "production"];
+const invalid = () => { throw new IntegrationError("ENVIRONMENT_MISMATCH"); };
+function environment(value) {
+    if (typeof value !== "string" || !ENVIRONMENTS.includes(value))
+        return invalid();
+    return value;
+}
+function reference(value) {
+    if (typeof value !== "string" || !/^[A-Z][A-Z0-9_]{1,127}$/.test(value))
+        return invalid();
+    return value;
+}
+const localHost = (hostname) => ["localhost", "[::1]"].includes(hostname) || /^127\./.test(hostname) || /\.(test|localhost|invalid)$/.test(hostname);
+export function validateEnvironmentSelection(input) {
+    const selection = record(input);
+    keys(selection, ["runtimeEnvironment", "targetEnvironment"]);
+    const runtimeEnvironment = environment(selection.runtimeEnvironment);
+    const targetEnvironment = selection.targetEnvironment === undefined ? runtimeEnvironment : environment(selection.targetEnvironment);
+    if (runtimeEnvironment !== "development" && targetEnvironment !== runtimeEnvironment)
+        invalid();
+    return Object.freeze({ runtimeEnvironment, targetEnvironment });
+}
+function postgresBinding(input) {
+    const binding = record(input);
+    keys(binding, ["urlEnv", "hostname", "port", "database", "username"]);
+    const urlEnv = reference(binding.urlEnv);
+    for (const key of ["hostname", "database", "username"])
+        if (typeof binding[key] !== "string" || !binding[key].trim())
+            invalid();
+    if (!Number.isInteger(binding.port) || Number(binding.port) < 1 || Number(binding.port) > 65535)
+        invalid();
+    return { urlEnv, hostname: binding.hostname, port: binding.port, database: binding.database, username: binding.username };
+}
+export function assertPostgresBinding(url, input) {
+    const binding = postgresBinding(input);
+    try {
+        const connection = new URL(url);
+        if (connection.hash || [...connection.searchParams.keys()].some(key => !["sslmode", "sslrootcert", "sslcert", "sslkey", "sslpassword", "connect_timeout", "application_name"].includes(key)))
+            invalid();
+        if (!["postgres:", "postgresql:"].includes(connection.protocol) || connection.hostname.toLowerCase() !== binding.hostname.toLowerCase() || Number(connection.port || 5432) !== binding.port || decodeURIComponent(connection.pathname.slice(1)) !== binding.database || decodeURIComponent(connection.username) !== binding.username)
+            invalid();
+    }
+    catch {
+        invalid();
+    }
+}
+/** Pure selection only. The host reads the selected secret variables on its server. */
+export function resolveEnvironmentConfig(input, selection) {
+    const selected = validateEnvironmentSelection(selection);
+    const config = record(input);
+    keys(config, ["schemaVersion", "centers", "runtimes", "authBasePath", "returnTo", "errorPath"]);
+    if (config.schemaVersion !== 1)
+        invalid();
+    const centers = record(config.centers), runtimes = record(config.runtimes);
+    keys(centers, ENVIRONMENTS);
+    keys(runtimes, ENVIRONMENTS);
+    const issuers = new Set(), origins = new Set(), secretRefs = new Set(), databaseRefs = new Set(), databaseIdentities = new Set(), clientIds = new Set();
+    const canonicalCenters = {};
+    for (const [name, issuer] of Object.entries(centers)) {
+        const canonical = canonicalizeIssuer(issuer);
+        if (issuers.has(canonical) || (name !== "development" && localHost(new URL(canonical).hostname)))
+            invalid();
+        issuers.add(canonical);
+        canonicalCenters[environment(name)] = canonical;
+    }
+    let result;
+    for (const [runtimeName, value] of Object.entries(runtimes)) {
+        const runtime = environment(runtimeName), profile = record(value);
+        keys(profile, ["platformOrigin", "sessionSecretEnv", "database", "clients"]);
+        const origin = validateOrigin(profile.platformOrigin), sessionSecretEnv = reference(profile.sessionSecretEnv);
+        if (origins.has(origin) || secretRefs.has(sessionSecretEnv) || (runtime !== "development" && localHost(new URL(origin).hostname)))
+            invalid();
+        origins.add(origin);
+        secretRefs.add(sessionSecretEnv);
+        const database = profile.database === undefined ? undefined : postgresBinding(profile.database);
+        if (database) {
+            const identity = JSON.stringify([database.hostname.toLowerCase(), database.port, database.database, database.username]);
+            if (databaseRefs.has(database.urlEnv) || secretRefs.has(database.urlEnv) || databaseIdentities.has(identity))
+                invalid();
+            databaseRefs.add(database.urlEnv);
+            secretRefs.add(database.urlEnv);
+            databaseIdentities.add(identity);
+        }
+        const clients = record(profile.clients);
+        keys(clients, ENVIRONMENTS);
+        for (const [targetName, value] of Object.entries(clients)) {
+            const target = environment(targetName);
+            validateEnvironmentSelection({ runtimeEnvironment: runtime, targetEnvironment: target });
+            const client = record(value);
+            keys(client, ["clientId", "clientSecretEnv"]);
+            const clientSecretEnv = reference(client.clientSecretEnv), issuer = canonicalCenters[target];
+            if (!issuer || secretRefs.has(clientSecretEnv))
+                invalid();
+            secretRefs.add(clientSecretEnv);
+            const clientKey = issuer + "\n" + client.clientId;
+            if (clientIds.has(clientKey))
+                invalid();
+            clientIds.add(clientKey);
+            const manifest = parseManifest({ schemaVersion: 1, issuer, platformOrigin: origin, clientId: client.clientId, clientSecretEnv, sessionSecretEnv, authBasePath: config.authBasePath, returnTo: config.returnTo, errorPath: config.errorPath });
+            if (runtime === selected.runtimeEnvironment && target === selected.targetEnvironment)
+                result = { manifest, environment: selected, ...(database ? { database } : {}) };
+        }
+    }
+    if (!result)
+        return invalid();
+    return result;
+}

package/dist/integration-contracts/src/metadata.d.ts

@@ -0,0 +1,4 @@
+import { type PublicConfig } from "./public.js";
+export declare function readPublicJson(url: string, maxBytes: number, failure?: "CENTER_UNAVAILABLE" | "UNTRUSTED_METADATA", headers?: Record<string, string>): Promise<Record<string, unknown>>;
+export declare function validateDiscovery(data: Record<string, unknown>, c: PublicConfig, expectedEnvironment?: string): Record<string, unknown>;
+export declare function validateJwks(data: Record<string, unknown>): void;

package/dist/integration-contracts/src/metadata.js

@@ -0,0 +1,71 @@
+import { IntegrationError } from "./public.js";
+export async function readPublicJson(url, maxBytes, failure = "CENTER_UNAVAILABLE", headers = {}) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), 5000);
+    try {
+        const response = await fetch(url, { method: "GET", redirect: "error", credentials: "omit", cache: "no-store", signal: controller.signal, headers: { Accept: "application/json", ...headers } });
+        if (!response.ok || !response.body)
+            throw new IntegrationError(failure);
+        const reader = response.body.getReader();
+        let size = 0;
+        const chunks = [];
+        try {
+            while (true) {
+                const chunk = await reader.read();
+                if (chunk.done)
+                    break;
+                size += chunk.value.length;
+                if (size > maxBytes)
+                    throw new IntegrationError("UNTRUSTED_METADATA");
+                chunks.push(chunk.value);
+            }
+        }
+        finally {
+            await reader.cancel();
+        }
+        const bytes = new Uint8Array(size);
+        let offset = 0;
+        for (const chunk of chunks) {
+            bytes.set(chunk, offset);
+            offset += chunk.length;
+        }
+        let data;
+        try {
+            data = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+        }
+        catch {
+            throw new IntegrationError("UNTRUSTED_METADATA");
+        }
+        if (!data || typeof data !== "object" || Array.isArray(data))
+            throw new IntegrationError("UNTRUSTED_METADATA");
+        return data;
+    }
+    catch (e) {
+        throw e instanceof IntegrationError ? e : new IntegrationError(failure);
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+export function validateDiscovery(data, c, expectedEnvironment) {
+    if (expectedEnvironment !== undefined && data.user_center_environment !== expectedEnvironment)
+        throw new IntegrationError("ENVIRONMENT_MISMATCH");
+    const invalid = () => { throw new IntegrationError("UNTRUSTED_METADATA"); };
+    if (data.issuer !== c.canonicalIssuer)
+        invalid();
+    for (const [key, path] of Object.entries({ authorization_endpoint: "/oauth2/authorize", token_endpoint: "/oauth2/token", userinfo_endpoint: "/oauth2/userinfo", jwks_uri: "/jwks" }))
+        if (data[key] !== c.canonicalIssuer + path)
+            invalid();
+    for (const [key, values] of Object.entries({ response_types_supported: ["code"], grant_types_supported: ["authorization_code"], code_challenge_methods_supported: ["S256"], scopes_supported: ["openid", "profile", "email"] }))
+        if (!Array.isArray(data[key]) || values.some(x => !data[key].includes(x)))
+            invalid();
+    if (!Array.isArray(data.id_token_signing_alg_values_supported) || !data.id_token_signing_alg_values_supported.length || data.id_token_signing_alg_values_supported.some(a => typeof a !== "string" || !/^(?:RS(?:256|384|512)|PS(?:256|384|512)|ES(?:256|384|512)|EdDSA|Ed25519)$/.test(a)))
+        invalid();
+    if (data.token_endpoint_auth_methods_supported !== undefined && (!Array.isArray(data.token_endpoint_auth_methods_supported) || !data.token_endpoint_auth_methods_supported.includes("client_secret_basic")))
+        invalid();
+    return data;
+}
+export function validateJwks(data) {
+    if (!Array.isArray(data.keys) || !data.keys.length || data.keys.some(k => !k || typeof k !== "object" || Array.isArray(k) || typeof k.kty !== "string" || ["d", "p", "q", "dp", "dq", "qi", "oth", "k"].some(p => p in k) || !((k.kty === "RSA" && typeof k.n === "string" && k.n && typeof k.e === "string" && k.e) || ((k.kty === "EC" || k.kty === "OKP") && typeof k.crv === "string" && k.crv && typeof k.x === "string" && k.x && (k.kty === "OKP" || (typeof k.y === "string" && k.y))))))
+        throw new IntegrationError("UNTRUSTED_METADATA");
+}

package/dist/integration-contracts/src/public.d.ts

@@ -0,0 +1,51 @@
+export declare const TOOL_VERSION = "0.1.10";
+export declare const ERROR_CODES: readonly ["INVALID_CONFIG", "ENVIRONMENT_MISMATCH", "INVALID_RETURN_TO", "INVALID_LOGIN_REQUEST", "LOGIN_UNAVAILABLE", "SIGN_OUT_UNCONFIRMED", "CENTER_UNAVAILABLE", "UNTRUSTED_METADATA", "DEPENDENCY_UNSUPPORTED", "IDENTITY_CONFLICT", "ACCOUNT_CONFLICT", "BUSINESS_RESOLUTION_FAILED"];
+export type ErrorCode = typeof ERROR_CODES[number];
+export declare class IntegrationError extends Error {
+    readonly code: ErrorCode;
+    constructor(code: ErrorCode);
+}
+export interface ReturnPolicy {
+    fallback: string;
+    allowedPaths: string[];
+    allowedPathPrefixes: string[];
+    allowedQueryKeys: string[];
+}
+export interface Manifest {
+    schemaVersion: 1;
+    issuer: string;
+    platformOrigin: string;
+    clientId: string;
+    authBasePath: string;
+    clientSecretEnv: string;
+    sessionSecretEnv: string;
+    returnTo: ReturnPolicy;
+    errorPath: string;
+}
+export interface PublicConfig extends Manifest {
+    canonicalIssuer: string;
+    centerOrigin: string;
+    providerId: string;
+    callbackUrl: string;
+    discoveryUrl: string;
+    cookiePrefix: string;
+}
+export interface SafeSession {
+    user: {
+        id: string;
+        name: string;
+        email: string;
+        emailVerified: boolean;
+    };
+    expiresAt: string;
+}
+export declare function record(value: unknown): Record<string, unknown>;
+export declare function keys(value: Record<string, unknown>, allowed: readonly string[]): void;
+export declare function canonicalizeIssuer(input: unknown): string;
+export declare function validateOrigin(input: unknown): string;
+export declare function validateAuthBasePath(input?: unknown): string;
+export declare function validateReturnTo(value: unknown, config: Pick<Manifest, "returnTo" | "authBasePath">): string;
+export declare function parseManifest(input: unknown): Manifest;
+export declare function parseLoginRequest(input: unknown, config: Manifest): {
+    returnTo: string;
+};

package/dist/integration-contracts/src/public.js

@@ -0,0 +1,134 @@
+export const TOOL_VERSION = "0.1.10";
+export const ERROR_CODES = ["INVALID_CONFIG", "ENVIRONMENT_MISMATCH", "INVALID_RETURN_TO", "INVALID_LOGIN_REQUEST", "LOGIN_UNAVAILABLE", "SIGN_OUT_UNCONFIRMED", "CENTER_UNAVAILABLE", "UNTRUSTED_METADATA", "DEPENDENCY_UNSUPPORTED", "IDENTITY_CONFLICT", "ACCOUNT_CONFLICT", "BUSINESS_RESOLUTION_FAILED"];
+export class IntegrationError extends Error {
+    code;
+    constructor(code) {
+        super(code);
+        this.code = code;
+        this.name = "IntegrationError";
+    }
+}
+const bad = () => { throw new IntegrationError("INVALID_CONFIG"); };
+export function record(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return bad();
+    return value;
+}
+export function keys(value, allowed) { if (Object.keys(value).some(k => !allowed.includes(k)))
+    bad(); }
+const clean = (s, max) => typeof s === "string" && s.length > 0 && s.length <= max && !/[\s\u0000-\u001f\u007f\\]/u.test(s);
+export function canonicalizeIssuer(input) {
+    if (!clean(input, 2048) || /[?#]/.test(input))
+        return bad();
+    const match = /^https:\/\/([^/]+)(.*)$/i.exec(input);
+    if (!match || match[1].includes("@"))
+        return bad();
+    const path = match[2];
+    if (path && path !== "/" && (!/^\/[A-Za-z0-9._~-]+(?:\/[A-Za-z0-9._~-]+)*$/.test(path) || path.split("/").some(x => x === "." || x === "..")))
+        return bad();
+    try {
+        const u = new URL(input);
+        if (u.protocol !== "https:" || !u.hostname || u.username || u.password)
+            return bad();
+        return u.origin + (path === "/" ? "" : path);
+    }
+    catch {
+        return bad();
+    }
+}
+export function validateOrigin(input) {
+    if (!clean(input, 2048))
+        return bad();
+    try {
+        const u = new URL(input);
+        if (u.protocol !== "https:" || input !== u.origin || u.hostname === "localhost" || u.hostname.endsWith(".localhost") || /^127\./.test(u.hostname) || u.hostname === "[::1]")
+            return bad();
+        return input;
+    }
+    catch {
+        return bad();
+    }
+}
+function localPath(input) {
+    if (!clean(input, 2048) || !input.startsWith("/") || input.includes("//") || /[?#]/.test(input) || /%(?:2f|5c|25)/i.test(input))
+        return false;
+    try {
+        return !input.split("/").some(s => { const p = decodeURIComponent(s); return p === "." || p === ".." || /[\u0000-\u001f\u007f\\/]/.test(p); });
+    }
+    catch {
+        return false;
+    }
+}
+export function validateAuthBasePath(input = "/api/auth") {
+    if (!localPath(input) || input.length > 256 || input.endsWith("/"))
+        return bad();
+    return input;
+}
+const reserved = /^(?:code|state|token|secret|password|flow|authorization|cookie|session|nonce|access_token|refresh_token|id_token|client_secret|code_verifier|code_challenge|sessiontoken)$/i;
+function strings(value) {
+    if (!Array.isArray(value) || value.some(s => typeof s !== "string") || new Set(value).size !== value.length)
+        return bad();
+    return [...value];
+}
+export function validateReturnTo(value, config) {
+    const fail = () => { throw new IntegrationError("INVALID_RETURN_TO"); };
+    if (value === undefined)
+        value = config.returnTo.fallback;
+    if (!clean(value, 2048) || value.includes("#"))
+        return fail();
+    const split = value.indexOf("?");
+    const path = split < 0 ? value : value.slice(0, split);
+    if (!localPath(path) || path === config.authBasePath || path.startsWith(config.authBasePath + "/"))
+        return fail();
+    const p = config.returnTo;
+    if (!p.allowedPaths.includes(path) && !p.allowedPathPrefixes.some(prefix => prefix === "/" || path === prefix || path.startsWith(prefix + "/")))
+        return fail();
+    const query = new URLSearchParams(split < 0 ? "" : value.slice(split + 1));
+    const seen = new Set();
+    for (const [k, v] of query) {
+        if (seen.has(k) || reserved.test(k) || !p.allowedQueryKeys.includes(k) || /[\u0000-\u001f\u007f]/.test(k + v))
+            return fail();
+        seen.add(k);
+    }
+    return value;
+}
+export function parseManifest(input) {
+    const m = record(input);
+    keys(m, ["schemaVersion", "issuer", "platformOrigin", "clientId", "authBasePath", "clientSecretEnv", "sessionSecretEnv", "returnTo", "errorPath"]);
+    if (m.schemaVersion !== 1 || typeof m.clientId !== "string" || m.clientId.length < 1 || m.clientId.length > 256 || /[\u0000-\u001f\u007f]/.test(m.clientId) || !m.clientId.trim())
+        return bad();
+    const issuer = canonicalizeIssuer(m.issuer);
+    const platformOrigin = validateOrigin(m.platformOrigin);
+    const authBasePath = validateAuthBasePath(m.authBasePath);
+    for (const field of [m.clientSecretEnv, m.sessionSecretEnv])
+        if (typeof field !== "string" || !/^[A-Za-z_][A-Za-z0-9_]*$/.test(field))
+            return bad();
+    if (m.clientSecretEnv === m.sessionSecretEnv)
+        return bad();
+    const r = record(m.returnTo);
+    keys(r, ["fallback", "allowedPaths", "allowedPathPrefixes", "allowedQueryKeys"]);
+    const returnTo = { fallback: r.fallback, allowedPaths: strings(r.allowedPaths ?? []), allowedPathPrefixes: strings(r.allowedPathPrefixes ?? []), allowedQueryKeys: strings(r.allowedQueryKeys ?? []) };
+    if (!returnTo.allowedPaths.length && !returnTo.allowedPathPrefixes.length)
+        return bad();
+    for (const path of [...returnTo.allowedPaths, ...returnTo.allowedPathPrefixes])
+        if (!localPath(path) || (path !== "/" && path.endsWith("/")))
+            return bad();
+    for (const key of returnTo.allowedQueryKeys)
+        if (!/^[A-Za-z_][A-Za-z0-9_.-]*$/.test(key) || reserved.test(key))
+            return bad();
+    if (!localPath(m.errorPath) || m.errorPath === authBasePath || m.errorPath.startsWith(authBasePath + "/"))
+        return bad();
+    const manifest = { schemaVersion: 1, issuer, platformOrigin, clientId: m.clientId, authBasePath, clientSecretEnv: m.clientSecretEnv, sessionSecretEnv: m.sessionSecretEnv, returnTo, errorPath: m.errorPath };
+    try {
+        validateReturnTo(returnTo.fallback, manifest);
+    }
+    catch {
+        return bad();
+    }
+    return manifest;
+}
+export function parseLoginRequest(input, config) {
+    if (!input || typeof input !== "object" || Array.isArray(input) || Object.keys(input).some(k => k !== "returnTo") || ("returnTo" in input && typeof input.returnTo !== "string"))
+        throw new IntegrationError("INVALID_LOGIN_REQUEST");
+    return { returnTo: validateReturnTo(input.returnTo, config) };
+}

package/dist/next-better-auth/src/client.d.ts

@@ -0,0 +1,10 @@
+import { type PublicConfig, type SafeSession } from "../../integration-contracts/src/public.js";
+export declare function createUserCenterClient(publicConfig: PublicConfig): {
+    startLogin(input?: {
+        returnTo?: string;
+    }): Promise<{
+        url: string;
+    }>;
+    getSession(): Promise<SafeSession | null>;
+    signOut(): Promise<void>;
+};

package/dist/next-better-auth/src/client.js

@@ -0,0 +1,36 @@
+import { IntegrationError, parseManifest, parseLoginRequest } from "../../integration-contracts/src/public.js";
+export function createUserCenterClient(publicConfig) {
+    const config = parseManifest({ schemaVersion: publicConfig.schemaVersion, issuer: publicConfig.issuer, platformOrigin: publicConfig.platformOrigin, clientId: publicConfig.clientId, authBasePath: publicConfig.authBasePath, clientSecretEnv: publicConfig.clientSecretEnv, sessionSecretEnv: publicConfig.sessionSecretEnv, returnTo: publicConfig.returnTo, errorPath: publicConfig.errorPath });
+    async function call(path, method, code, body) {
+        if (globalThis.location?.origin !== config.platformOrigin)
+            throw new IntegrationError(code);
+        try {
+            const r = await fetch(config.authBasePath + path, { method, credentials: "same-origin", cache: "no-store", redirect: "error", headers: body === undefined ? {} : { "Content-Type": "application/json" }, ...(body === undefined ? {} : { body: JSON.stringify(body) }) });
+            if (!r.ok)
+                throw new IntegrationError(code);
+            return await r.json();
+        }
+        catch {
+            throw new IntegrationError(code);
+        }
+    }
+    return {
+        async startLogin(input = {}) {
+            const body = parseLoginRequest(input, config);
+            const data = await call("/sign-in/social", "POST", "LOGIN_UNAVAILABLE", body);
+            try {
+                const url = new URL(data.url);
+                const issuer = new URL(config.issuer);
+                if (url.origin !== issuer.origin || url.pathname !== issuer.pathname.replace(/\/$/, "") + "/oauth2/authorize")
+                    throw new Error();
+                return { url: url.href };
+            }
+            catch {
+                throw new IntegrationError("LOGIN_UNAVAILABLE");
+            }
+        },
+        async getSession() { return await call("/get-session", "GET", "CENTER_UNAVAILABLE"); },
+        async signOut() { const data = await call("/sign-out", "POST", "SIGN_OUT_UNCONFIRMED", {}); if (data?.success !== true)
+            throw new IntegrationError("SIGN_OUT_UNCONFIRMED"); },
+    };
+}

package/dist/next-better-auth/src/config.d.ts

@@ -0,0 +1,2 @@
+export * from "../../integration-contracts/src/config.js";
+export type { Manifest, PublicConfig } from "../../integration-contracts/src/public.js";

package/dist/next-better-auth/src/config.js

@@ -0,0 +1 @@
+export * from "../../integration-contracts/src/config.js";

package/dist/next-better-auth/src/public.d.ts

@@ -0,0 +1 @@
+export * from "../../integration-contracts/src/public.js";

package/dist/next-better-auth/src/public.js

@@ -0,0 +1 @@
+export * from "../../integration-contracts/src/public.js";