@user-center/next-better-auth 0.0.0-stage → 0.1.8

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 User Center contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,39 @@
-# Temporary Holding Version
+# User Center Next Better Auth SDK
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Candidate 0.1.8 for Next App Router on Node and Better Auth 1.7.12. This package creates a complete controlled authentication instance. You supply the database adapter, independent session secret and business mapping. It never edits your project or runs migrations.
+
+This is a public npm trial candidate, prepared with public access and the `next` tag. This package is licensed under MIT, with the complete notice in the included LICENSE. This preparation only performs a dry run and does not upload the package. Scope ownership, publisher authentication and registry version availability still require verification before a separately authorized publication.
+
+Install the verified local archive together with the exact Better Auth peer. If your host imports `server-only`, declare it directly too:
+
+```sh
+pnpm add better-auth@1.7.12 server-only@0.0.1 /path/to/user-center-next-better-auth-0.1.8.tgz
+```
+
+After the operator supplies a verified official publication record for this version, you can instead install `@user-center/next-better-auth@0.1.8` with the same Better Auth peer. Until then, use the supplied archive and do not guess-install a similarly named registry package. The `next` tag does not certify production readiness.
+
+Use the public entries below. Do not import private dist or workspace source paths.
+
+| Entry | Host use |
+| --- | --- |
+| root or `/public` | Public configuration validation and types |
+| `/config` | `describeRegistration`, `describeIntegration`, environment profile selection and PostgreSQL binding checks |
+| `/server` | `createUserCenterAuth`, with explicit adapter, secrets, user policy and business resolver |
+| `/client` | `createUserCenterClient`, for controlled login, safe session reads and local logout |
+
+You can calculate a registration before creating a Client:
+
+```js
+import { describeRegistration } from '@user-center/next-better-auth/config';
+const registration = describeRegistration({ issuer: 'https://auth.example.com/api/auth', platformOrigin: 'https://platform.example.test' });
+```
+
+Register the exact returned callback and origin in your center console. Create a Manifest v1, then import `createUserCenterAuth` from `/server` in your own server module. Mount only `instance.handlers.GET/POST`, never the raw Better Auth handler. Create a browser facade with `createUserCenterClient(instance.publicConfig)` from `/client`.
+
+The root and `/public` exports are safe configuration utilities. `/config` uses Node crypto without network or database access. `/server` is protected by `server-only`. Keep client and session secrets on the server. An authentication session does not authorize a business user: protect pages and APIs with `getPrincipal`, requiring `authenticated` and your own permissions.
+
+The complete guide, Manifest example, schema requirements, failure recovery and independent consumer are in `docs/integration/sdk/` and `examples/sdk-next-client/` in the corresponding source snapshot. The source repository is [ZXFTech/user-center](https://github.com/ZXFTech/user-center), with the [SDK guide](https://github.com/ZXFTech/user-center/blob/main/docs/integration/sdk/README.md). These are repository destinations; this dry run does not verify that uncommitted documentation has been pushed or that a reader has repository access. Keep the guide and sample with an offline delivery.
+
+No real production integration or runtime combination is certified by this candidate. Verify the release manifest and SHA256 before installation. Host storage migrations, global Account identity uniqueness, business user mapping and permissions need host implementation and actual acceptance. Platform logout does not promise global center logout. Blog integration is completed according to the user's confirmation, without being reverified here or implying that blog uses 0.1.8. Production mail, the independent real authentication chain and formal runtime combinations remain unverified.
+
+The `build` and `typecheck` scripts are for a source checkout with its workspace tools. The installed package is precompiled and does not execute these scripts during installation or authentication. In a source checkout, `pnpm toolkit:npm:dry-run` checks the sealed archives and invokes npm with fixed dry run, offline and ignore scripts options. It never uploads a package.

package/dist/integration-contracts/src/compatibility.d.ts

@@ -0,0 +1,9 @@
+export declare const MATRIX_VERSION = "2026-11-04.1";
+export interface RuntimeCombination {
+    node: string;
+    next: string;
+    react: string;
+    betterAuth: string;
+    evidence: string;
+}
+export declare const VERIFIED_COMBINATIONS: readonly RuntimeCombination[];

package/dist/integration-contracts/src/compatibility.js

@@ -0,0 +1,3 @@
+// Only a recorded real integration may add a verified runtime combination.
+export const MATRIX_VERSION = "2026-11-04.1";
+export const VERIFIED_COMBINATIONS = [];

package/dist/integration-contracts/src/config.d.ts

@@ -0,0 +1,15 @@
+import { type PublicConfig } from "./public.js";
+export { ENVIRONMENTS, resolveEnvironmentConfig, validateEnvironmentSelection, assertPostgresBinding } from "./environment.js";
+export type { EnvironmentName, EnvironmentSelection, PostgresBinding } from "./environment.js";
+export declare function describeRegistration(input: {
+    issuer: string;
+    platformOrigin: string;
+    authBasePath?: string;
+}): {
+    canonicalIssuer: string;
+    platformOrigin: string;
+    authBasePath: string;
+    providerId: string;
+    callbackUrl: string;
+};
+export declare function describeIntegration(input: unknown): PublicConfig;

package/dist/integration-contracts/src/config.js

@@ -0,0 +1,17 @@
+import { createHash } from "node:crypto";
+import { canonicalizeIssuer, parseManifest, validateOrigin, validateAuthBasePath, record, keys } from "./public.js";
+export { ENVIRONMENTS, resolveEnvironmentConfig, validateEnvironmentSelection, assertPostgresBinding } from "./environment.js";
+const digest = (s) => createHash("sha256").update(s, "utf8").digest("hex");
+export function describeRegistration(input) {
+    keys(record(input), ["issuer", "platformOrigin", "authBasePath"]);
+    const canonicalIssuer = canonicalizeIssuer(input.issuer);
+    const platformOrigin = validateOrigin(input.platformOrigin);
+    const authBasePath = validateAuthBasePath(input.authBasePath);
+    const providerId = "user-center-" + digest(canonicalIssuer);
+    return { canonicalIssuer, platformOrigin, authBasePath, providerId, callbackUrl: platformOrigin + authBasePath + "/callback/" + providerId };
+}
+export function describeIntegration(input) {
+    const manifest = parseManifest(input);
+    const registration = describeRegistration({ issuer: manifest.issuer, platformOrigin: manifest.platformOrigin, authBasePath: manifest.authBasePath });
+    return { ...manifest, ...registration, centerOrigin: new URL(registration.canonicalIssuer).origin, discoveryUrl: registration.canonicalIssuer + "/.well-known/openid-configuration", cookiePrefix: "uc_" + digest(manifest.platformOrigin + "\n" + registration.canonicalIssuer).slice(0, 24) };
+}

package/dist/integration-contracts/src/environment.d.ts

@@ -0,0 +1,25 @@
+import { type Manifest } from "./public.js";
+export declare const ENVIRONMENTS: readonly ["development", "staging", "production"];
+export type EnvironmentName = typeof ENVIRONMENTS[number];
+export interface EnvironmentSelection {
+    runtimeEnvironment: EnvironmentName;
+    targetEnvironment: EnvironmentName;
+}
+export interface PostgresBinding {
+    urlEnv: string;
+    hostname: string;
+    port: number;
+    database: string;
+    username: string;
+}
+export declare function validateEnvironmentSelection(input: unknown): Readonly<EnvironmentSelection>;
+export declare function assertPostgresBinding(url: string, input: unknown): void;
+/** Pure selection only. The host reads the selected secret variables on its server. */
+export declare function resolveEnvironmentConfig(input: unknown, selection: {
+    runtimeEnvironment: string;
+    targetEnvironment?: string;
+}): {
+    manifest: Manifest;
+    environment: Readonly<EnvironmentSelection>;
+    database?: PostgresBinding;
+};

package/dist/integration-contracts/src/environment.js

@@ -0,0 +1,108 @@
+import { IntegrationError, canonicalizeIssuer, keys, parseManifest, record, validateOrigin } from "./public.js";
+export const ENVIRONMENTS = ["development", "staging", "production"];
+const invalid = () => { throw new IntegrationError("ENVIRONMENT_MISMATCH"); };
+function environment(value) {
+    if (typeof value !== "string" || !ENVIRONMENTS.includes(value))
+        return invalid();
+    return value;
+}
+function reference(value) {
+    if (typeof value !== "string" || !/^[A-Z][A-Z0-9_]{1,127}$/.test(value))
+        return invalid();
+    return value;
+}
+const localHost = (hostname) => ["localhost", "[::1]"].includes(hostname) || /^127\./.test(hostname) || /\.(test|localhost|invalid)$/.test(hostname);
+export function validateEnvironmentSelection(input) {
+    const selection = record(input);
+    keys(selection, ["runtimeEnvironment", "targetEnvironment"]);
+    const runtimeEnvironment = environment(selection.runtimeEnvironment);
+    const targetEnvironment = selection.targetEnvironment === undefined ? runtimeEnvironment : environment(selection.targetEnvironment);
+    if (runtimeEnvironment !== "development" && targetEnvironment !== runtimeEnvironment)
+        invalid();
+    return Object.freeze({ runtimeEnvironment, targetEnvironment });
+}
+function postgresBinding(input) {
+    const binding = record(input);
+    keys(binding, ["urlEnv", "hostname", "port", "database", "username"]);
+    const urlEnv = reference(binding.urlEnv);
+    for (const key of ["hostname", "database", "username"])
+        if (typeof binding[key] !== "string" || !binding[key].trim())
+            invalid();
+    if (!Number.isInteger(binding.port) || Number(binding.port) < 1 || Number(binding.port) > 65535)
+        invalid();
+    return { urlEnv, hostname: binding.hostname, port: binding.port, database: binding.database, username: binding.username };
+}
+export function assertPostgresBinding(url, input) {
+    const binding = postgresBinding(input);
+    try {
+        const connection = new URL(url);
+        if (connection.hash || [...connection.searchParams.keys()].some(key => !["sslmode", "sslrootcert", "sslcert", "sslkey", "sslpassword", "connect_timeout", "application_name"].includes(key)))
+            invalid();
+        if (!["postgres:", "postgresql:"].includes(connection.protocol) || connection.hostname.toLowerCase() !== binding.hostname.toLowerCase() || Number(connection.port || 5432) !== binding.port || decodeURIComponent(connection.pathname.slice(1)) !== binding.database || decodeURIComponent(connection.username) !== binding.username)
+            invalid();
+    }
+    catch {
+        invalid();
+    }
+}
+/** Pure selection only. The host reads the selected secret variables on its server. */
+export function resolveEnvironmentConfig(input, selection) {
+    const selected = validateEnvironmentSelection(selection);
+    const config = record(input);
+    keys(config, ["schemaVersion", "centers", "runtimes", "authBasePath", "returnTo", "errorPath"]);
+    if (config.schemaVersion !== 1)
+        invalid();
+    const centers = record(config.centers), runtimes = record(config.runtimes);
+    keys(centers, ENVIRONMENTS);
+    keys(runtimes, ENVIRONMENTS);
+    const issuers = new Set(), origins = new Set(), secretRefs = new Set(), databaseRefs = new Set(), databaseIdentities = new Set(), clientIds = new Set();
+    const canonicalCenters = {};
+    for (const [name, issuer] of Object.entries(centers)) {
+        const canonical = canonicalizeIssuer(issuer);
+        if (issuers.has(canonical) || (name !== "development" && localHost(new URL(canonical).hostname)))
+            invalid();
+        issuers.add(canonical);
+        canonicalCenters[environment(name)] = canonical;
+    }
+    let result;
+    for (const [runtimeName, value] of Object.entries(runtimes)) {
+        const runtime = environment(runtimeName), profile = record(value);
+        keys(profile, ["platformOrigin", "sessionSecretEnv", "database", "clients"]);
+        const origin = validateOrigin(profile.platformOrigin), sessionSecretEnv = reference(profile.sessionSecretEnv);
+        if (origins.has(origin) || secretRefs.has(sessionSecretEnv) || (runtime !== "development" && localHost(new URL(origin).hostname)))
+            invalid();
+        origins.add(origin);
+        secretRefs.add(sessionSecretEnv);
+        const database = profile.database === undefined ? undefined : postgresBinding(profile.database);
+        if (database) {
+            const identity = JSON.stringify([database.hostname.toLowerCase(), database.port, database.database, database.username]);
+            if (databaseRefs.has(database.urlEnv) || secretRefs.has(database.urlEnv) || databaseIdentities.has(identity))
+                invalid();
+            databaseRefs.add(database.urlEnv);
+            secretRefs.add(database.urlEnv);
+            databaseIdentities.add(identity);
+        }
+        const clients = record(profile.clients);
+        keys(clients, ENVIRONMENTS);
+        for (const [targetName, value] of Object.entries(clients)) {
+            const target = environment(targetName);
+            validateEnvironmentSelection({ runtimeEnvironment: runtime, targetEnvironment: target });
+            const client = record(value);
+            keys(client, ["clientId", "clientSecretEnv"]);
+            const clientSecretEnv = reference(client.clientSecretEnv), issuer = canonicalCenters[target];
+            if (!issuer || secretRefs.has(clientSecretEnv))
+                invalid();
+            secretRefs.add(clientSecretEnv);
+            const clientKey = issuer + "\n" + client.clientId;
+            if (clientIds.has(clientKey))
+                invalid();
+            clientIds.add(clientKey);
+            const manifest = parseManifest({ schemaVersion: 1, issuer, platformOrigin: origin, clientId: client.clientId, clientSecretEnv, sessionSecretEnv, authBasePath: config.authBasePath, returnTo: config.returnTo, errorPath: config.errorPath });
+            if (runtime === selected.runtimeEnvironment && target === selected.targetEnvironment)
+                result = { manifest, environment: selected, ...(database ? { database } : {}) };
+        }
+    }
+    if (!result)
+        return invalid();
+    return result;
+}

package/dist/integration-contracts/src/metadata.d.ts

@@ -0,0 +1,4 @@
+import { type PublicConfig } from "./public.js";
+export declare function readPublicJson(url: string, maxBytes: number, failure?: "CENTER_UNAVAILABLE" | "UNTRUSTED_METADATA", headers?: Record<string, string>): Promise<Record<string, unknown>>;
+export declare function validateDiscovery(data: Record<string, unknown>, c: PublicConfig, expectedEnvironment?: string): Record<string, unknown>;
+export declare function validateJwks(data: Record<string, unknown>): void;

package/dist/integration-contracts/src/metadata.js

@@ -0,0 +1,71 @@
+import { IntegrationError } from "./public.js";
+export async function readPublicJson(url, maxBytes, failure = "CENTER_UNAVAILABLE", headers = {}) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), 5000);
+    try {
+        const response = await fetch(url, { method: "GET", redirect: "error", credentials: "omit", cache: "no-store", signal: controller.signal, headers: { Accept: "application/json", ...headers } });
+        if (!response.ok || !response.body)
+            throw new IntegrationError(failure);
+        const reader = response.body.getReader();
+        let size = 0;
+        const chunks = [];
+        try {
+            while (true) {
+                const chunk = await reader.read();
+                if (chunk.done)
+                    break;
+                size += chunk.value.length;
+                if (size > maxBytes)
+                    throw new IntegrationError("UNTRUSTED_METADATA");
+                chunks.push(chunk.value);
+            }
+        }
+        finally {
+            await reader.cancel();
+        }
+        const bytes = new Uint8Array(size);
+        let offset = 0;
+        for (const chunk of chunks) {
+            bytes.set(chunk, offset);
+            offset += chunk.length;
+        }
+        let data;
+        try {
+            data = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+        }
+        catch {
+            throw new IntegrationError("UNTRUSTED_METADATA");
+        }
+        if (!data || typeof data !== "object" || Array.isArray(data))
+            throw new IntegrationError("UNTRUSTED_METADATA");
+        return data;
+    }
+    catch (e) {
+        throw e instanceof IntegrationError ? e : new IntegrationError(failure);
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+export function validateDiscovery(data, c, expectedEnvironment) {
+    if (expectedEnvironment !== undefined && data.user_center_environment !== expectedEnvironment)
+        throw new IntegrationError("ENVIRONMENT_MISMATCH");
+    const invalid = () => { throw new IntegrationError("UNTRUSTED_METADATA"); };
+    if (data.issuer !== c.canonicalIssuer)
+        invalid();
+    for (const [key, path] of Object.entries({ authorization_endpoint: "/oauth2/authorize", token_endpoint: "/oauth2/token", userinfo_endpoint: "/oauth2/userinfo", jwks_uri: "/jwks" }))
+        if (data[key] !== c.canonicalIssuer + path)
+            invalid();
+    for (const [key, values] of Object.entries({ response_types_supported: ["code"], grant_types_supported: ["authorization_code"], code_challenge_methods_supported: ["S256"], scopes_supported: ["openid", "profile", "email"] }))
+        if (!Array.isArray(data[key]) || values.some(x => !data[key].includes(x)))
+            invalid();
+    if (!Array.isArray(data.id_token_signing_alg_values_supported) || !data.id_token_signing_alg_values_supported.length || data.id_token_signing_alg_values_supported.some(a => typeof a !== "string" || !/^(?:RS(?:256|384|512)|PS(?:256|384|512)|ES(?:256|384|512)|EdDSA|Ed25519)$/.test(a)))
+        invalid();
+    if (data.token_endpoint_auth_methods_supported !== undefined && (!Array.isArray(data.token_endpoint_auth_methods_supported) || !data.token_endpoint_auth_methods_supported.includes("client_secret_basic")))
+        invalid();
+    return data;
+}
+export function validateJwks(data) {
+    if (!Array.isArray(data.keys) || !data.keys.length || data.keys.some(k => !k || typeof k !== "object" || Array.isArray(k) || typeof k.kty !== "string" || ["d", "p", "q", "dp", "dq", "qi", "oth", "k"].some(p => p in k) || !((k.kty === "RSA" && typeof k.n === "string" && k.n && typeof k.e === "string" && k.e) || ((k.kty === "EC" || k.kty === "OKP") && typeof k.crv === "string" && k.crv && typeof k.x === "string" && k.x && (k.kty === "OKP" || (typeof k.y === "string" && k.y))))))
+        throw new IntegrationError("UNTRUSTED_METADATA");
+}

package/dist/integration-contracts/src/public.d.ts

@@ -0,0 +1,51 @@
+export declare const TOOL_VERSION = "0.1.8";
+export declare const ERROR_CODES: readonly ["INVALID_CONFIG", "ENVIRONMENT_MISMATCH", "INVALID_RETURN_TO", "INVALID_LOGIN_REQUEST", "LOGIN_UNAVAILABLE", "SIGN_OUT_UNCONFIRMED", "CENTER_UNAVAILABLE", "UNTRUSTED_METADATA", "DEPENDENCY_UNSUPPORTED", "IDENTITY_CONFLICT", "ACCOUNT_CONFLICT", "BUSINESS_RESOLUTION_FAILED"];
+export type ErrorCode = typeof ERROR_CODES[number];
+export declare class IntegrationError extends Error {
+    readonly code: ErrorCode;
+    constructor(code: ErrorCode);
+}
+export interface ReturnPolicy {
+    fallback: string;
+    allowedPaths: string[];
+    allowedPathPrefixes: string[];
+    allowedQueryKeys: string[];
+}
+export interface Manifest {
+    schemaVersion: 1;
+    issuer: string;
+    platformOrigin: string;
+    clientId: string;
+    authBasePath: string;
+    clientSecretEnv: string;
+    sessionSecretEnv: string;
+    returnTo: ReturnPolicy;
+    errorPath: string;
+}
+export interface PublicConfig extends Manifest {
+    canonicalIssuer: string;
+    centerOrigin: string;
+    providerId: string;
+    callbackUrl: string;
+    discoveryUrl: string;
+    cookiePrefix: string;
+}
+export interface SafeSession {
+    user: {
+        id: string;
+        name: string;
+        email: string;
+        emailVerified: boolean;
+    };
+    expiresAt: string;
+}
+export declare function record(value: unknown): Record<string, unknown>;
+export declare function keys(value: Record<string, unknown>, allowed: readonly string[]): void;
+export declare function canonicalizeIssuer(input: unknown): string;
+export declare function validateOrigin(input: unknown): string;
+export declare function validateAuthBasePath(input?: unknown): string;
+export declare function validateReturnTo(value: unknown, config: Pick<Manifest, "returnTo" | "authBasePath">): string;
+export declare function parseManifest(input: unknown): Manifest;
+export declare function parseLoginRequest(input: unknown, config: Manifest): {
+    returnTo: string;
+};

package/dist/integration-contracts/src/public.js

@@ -0,0 +1,134 @@
+export const TOOL_VERSION = "0.1.8";
+export const ERROR_CODES = ["INVALID_CONFIG", "ENVIRONMENT_MISMATCH", "INVALID_RETURN_TO", "INVALID_LOGIN_REQUEST", "LOGIN_UNAVAILABLE", "SIGN_OUT_UNCONFIRMED", "CENTER_UNAVAILABLE", "UNTRUSTED_METADATA", "DEPENDENCY_UNSUPPORTED", "IDENTITY_CONFLICT", "ACCOUNT_CONFLICT", "BUSINESS_RESOLUTION_FAILED"];
+export class IntegrationError extends Error {
+    code;
+    constructor(code) {
+        super(code);
+        this.code = code;
+        this.name = "IntegrationError";
+    }
+}
+const bad = () => { throw new IntegrationError("INVALID_CONFIG"); };
+export function record(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return bad();
+    return value;
+}
+export function keys(value, allowed) { if (Object.keys(value).some(k => !allowed.includes(k)))
+    bad(); }
+const clean = (s, max) => typeof s === "string" && s.length > 0 && s.length <= max && !/[\s\u0000-\u001f\u007f\\]/u.test(s);
+export function canonicalizeIssuer(input) {
+    if (!clean(input, 2048) || /[?#]/.test(input))
+        return bad();
+    const match = /^https:\/\/([^/]+)(.*)$/i.exec(input);
+    if (!match || match[1].includes("@"))
+        return bad();
+    const path = match[2];
+    if (path && path !== "/" && (!/^\/[A-Za-z0-9._~-]+(?:\/[A-Za-z0-9._~-]+)*$/.test(path) || path.split("/").some(x => x === "." || x === "..")))
+        return bad();
+    try {
+        const u = new URL(input);
+        if (u.protocol !== "https:" || !u.hostname || u.username || u.password)
+            return bad();
+        return u.origin + (path === "/" ? "" : path);
+    }
+    catch {
+        return bad();
+    }
+}
+export function validateOrigin(input) {
+    if (!clean(input, 2048))
+        return bad();
+    try {
+        const u = new URL(input);
+        if (u.protocol !== "https:" || input !== u.origin || u.hostname === "localhost" || u.hostname.endsWith(".localhost") || /^127\./.test(u.hostname) || u.hostname === "[::1]")
+            return bad();
+        return input;
+    }
+    catch {
+        return bad();
+    }
+}
+function localPath(input) {
+    if (!clean(input, 2048) || !input.startsWith("/") || input.includes("//") || /[?#]/.test(input) || /%(?:2f|5c|25)/i.test(input))
+        return false;
+    try {
+        return !input.split("/").some(s => { const p = decodeURIComponent(s); return p === "." || p === ".." || /[\u0000-\u001f\u007f\\/]/.test(p); });
+    }
+    catch {
+        return false;
+    }
+}
+export function validateAuthBasePath(input = "/api/auth") {
+    if (!localPath(input) || input.length > 256 || input.endsWith("/"))
+        return bad();
+    return input;
+}
+const reserved = /^(?:code|state|token|secret|password|flow|authorization|cookie|session|nonce|access_token|refresh_token|id_token|client_secret|code_verifier|code_challenge|sessiontoken)$/i;
+function strings(value) {
+    if (!Array.isArray(value) || value.some(s => typeof s !== "string") || new Set(value).size !== value.length)
+        return bad();
+    return [...value];
+}
+export function validateReturnTo(value, config) {
+    const fail = () => { throw new IntegrationError("INVALID_RETURN_TO"); };
+    if (value === undefined)
+        value = config.returnTo.fallback;
+    if (!clean(value, 2048) || value.includes("#"))
+        return fail();
+    const split = value.indexOf("?");
+    const path = split < 0 ? value : value.slice(0, split);
+    if (!localPath(path) || path === config.authBasePath || path.startsWith(config.authBasePath + "/"))
+        return fail();
+    const p = config.returnTo;
+    if (!p.allowedPaths.includes(path) && !p.allowedPathPrefixes.some(prefix => prefix === "/" || path === prefix || path.startsWith(prefix + "/")))
+        return fail();
+    const query = new URLSearchParams(split < 0 ? "" : value.slice(split + 1));
+    const seen = new Set();
+    for (const [k, v] of query) {
+        if (seen.has(k) || reserved.test(k) || !p.allowedQueryKeys.includes(k) || /[\u0000-\u001f\u007f]/.test(k + v))
+            return fail();
+        seen.add(k);
+    }
+    return value;
+}
+export function parseManifest(input) {
+    const m = record(input);
+    keys(m, ["schemaVersion", "issuer", "platformOrigin", "clientId", "authBasePath", "clientSecretEnv", "sessionSecretEnv", "returnTo", "errorPath"]);
+    if (m.schemaVersion !== 1 || typeof m.clientId !== "string" || m.clientId.length < 1 || m.clientId.length > 256 || /[\u0000-\u001f\u007f]/.test(m.clientId) || !m.clientId.trim())
+        return bad();
+    const issuer = canonicalizeIssuer(m.issuer);
+    const platformOrigin = validateOrigin(m.platformOrigin);
+    const authBasePath = validateAuthBasePath(m.authBasePath);
+    for (const field of [m.clientSecretEnv, m.sessionSecretEnv])
+        if (typeof field !== "string" || !/^[A-Za-z_][A-Za-z0-9_]*$/.test(field))
+            return bad();
+    if (m.clientSecretEnv === m.sessionSecretEnv)
+        return bad();
+    const r = record(m.returnTo);
+    keys(r, ["fallback", "allowedPaths", "allowedPathPrefixes", "allowedQueryKeys"]);
+    const returnTo = { fallback: r.fallback, allowedPaths: strings(r.allowedPaths ?? []), allowedPathPrefixes: strings(r.allowedPathPrefixes ?? []), allowedQueryKeys: strings(r.allowedQueryKeys ?? []) };
+    if (!returnTo.allowedPaths.length && !returnTo.allowedPathPrefixes.length)
+        return bad();
+    for (const path of [...returnTo.allowedPaths, ...returnTo.allowedPathPrefixes])
+        if (!localPath(path) || (path !== "/" && path.endsWith("/")))
+            return bad();
+    for (const key of returnTo.allowedQueryKeys)
+        if (!/^[A-Za-z_][A-Za-z0-9_.-]*$/.test(key) || reserved.test(key))
+            return bad();
+    if (!localPath(m.errorPath) || m.errorPath === authBasePath || m.errorPath.startsWith(authBasePath + "/"))
+        return bad();
+    const manifest = { schemaVersion: 1, issuer, platformOrigin, clientId: m.clientId, authBasePath, clientSecretEnv: m.clientSecretEnv, sessionSecretEnv: m.sessionSecretEnv, returnTo, errorPath: m.errorPath };
+    try {
+        validateReturnTo(returnTo.fallback, manifest);
+    }
+    catch {
+        return bad();
+    }
+    return manifest;
+}
+export function parseLoginRequest(input, config) {
+    if (!input || typeof input !== "object" || Array.isArray(input) || Object.keys(input).some(k => k !== "returnTo") || ("returnTo" in input && typeof input.returnTo !== "string"))
+        throw new IntegrationError("INVALID_LOGIN_REQUEST");
+    return { returnTo: validateReturnTo(input.returnTo, config) };
+}

package/dist/next-better-auth/src/client.d.ts

@@ -0,0 +1,10 @@
+import { type PublicConfig, type SafeSession } from "../../integration-contracts/src/public.js";
+export declare function createUserCenterClient(publicConfig: PublicConfig): {
+    startLogin(input?: {
+        returnTo?: string;
+    }): Promise<{
+        url: string;
+    }>;
+    getSession(): Promise<SafeSession | null>;
+    signOut(): Promise<void>;
+};

package/dist/next-better-auth/src/client.js

@@ -0,0 +1,36 @@
+import { IntegrationError, parseManifest, parseLoginRequest } from "../../integration-contracts/src/public.js";
+export function createUserCenterClient(publicConfig) {
+    const config = parseManifest({ schemaVersion: publicConfig.schemaVersion, issuer: publicConfig.issuer, platformOrigin: publicConfig.platformOrigin, clientId: publicConfig.clientId, authBasePath: publicConfig.authBasePath, clientSecretEnv: publicConfig.clientSecretEnv, sessionSecretEnv: publicConfig.sessionSecretEnv, returnTo: publicConfig.returnTo, errorPath: publicConfig.errorPath });
+    async function call(path, method, code, body) {
+        if (globalThis.location?.origin !== config.platformOrigin)
+            throw new IntegrationError(code);
+        try {
+            const r = await fetch(config.authBasePath + path, { method, credentials: "same-origin", cache: "no-store", redirect: "error", headers: body === undefined ? {} : { "Content-Type": "application/json" }, ...(body === undefined ? {} : { body: JSON.stringify(body) }) });
+            if (!r.ok)
+                throw new IntegrationError(code);
+            return await r.json();
+        }
+        catch {
+            throw new IntegrationError(code);
+        }
+    }
+    return {
+        async startLogin(input = {}) {
+            const body = parseLoginRequest(input, config);
+            const data = await call("/sign-in/social", "POST", "LOGIN_UNAVAILABLE", body);
+            try {
+                const url = new URL(data.url);
+                const issuer = new URL(config.issuer);
+                if (url.origin !== issuer.origin || url.pathname !== issuer.pathname.replace(/\/$/, "") + "/oauth2/authorize")
+                    throw new Error();
+                return { url: url.href };
+            }
+            catch {
+                throw new IntegrationError("LOGIN_UNAVAILABLE");
+            }
+        },
+        async getSession() { return await call("/get-session", "GET", "CENTER_UNAVAILABLE"); },
+        async signOut() { const data = await call("/sign-out", "POST", "SIGN_OUT_UNCONFIRMED", {}); if (data?.success !== true)
+            throw new IntegrationError("SIGN_OUT_UNCONFIRMED"); },
+    };
+}

package/dist/next-better-auth/src/config.d.ts

@@ -0,0 +1,2 @@
+export * from "../../integration-contracts/src/config.js";
+export type { Manifest, PublicConfig } from "../../integration-contracts/src/public.js";

package/dist/next-better-auth/src/config.js

@@ -0,0 +1 @@
+export * from "../../integration-contracts/src/config.js";

package/dist/next-better-auth/src/public.d.ts

@@ -0,0 +1 @@
+export * from "../../integration-contracts/src/public.js";

package/dist/next-better-auth/src/public.js

@@ -0,0 +1 @@
+export * from "../../integration-contracts/src/public.js";

package/dist/next-better-auth/src/server.d.ts

@@ -0,0 +1,142 @@
+import "server-only";
+import { type BetterAuthOptions } from "better-auth";
+import type { OAuthProvider } from "better-auth/oauth2";
+import { type EnvironmentSelection } from "../../integration-contracts/src/environment.js";
+import { type ErrorCode, type PublicConfig } from "../../integration-contracts/src/public.js";
+export interface Identity {
+    issuer: string;
+    subject: string;
+    authUserId: string;
+    profile: {
+        name: string;
+        email: string;
+        emailVerified: boolean;
+    };
+}
+export type { SafeSession } from "../../integration-contracts/src/public.js";
+export type Principal<T> = {
+    status: "anonymous";
+} | {
+    status: "mapping-required";
+    identity: Identity;
+} | {
+    status: "authenticated";
+    identity: Identity;
+    user: T;
+};
+export type ResolutionContext = Readonly<{
+    requestId: string;
+    signal: AbortSignal;
+}>;
+export type Event = Readonly<{
+    code: ErrorCode | "OK";
+    phase: "ready" | "identity" | "business" | "login" | "callback" | "logout";
+    at: string;
+    requestId: string;
+    version: string;
+}>;
+export interface AuthOptions<T extends {
+    id: string;
+}> {
+    manifest: unknown;
+    database: NonNullable<BetterAuthOptions["database"]>;
+    clientSecret: string;
+    sessionSecret: string;
+    environment?: EnvironmentSelection;
+    authUserPolicy: "allow-new" | "existing-only";
+    sessionTtlSeconds?: number;
+    resolveBusinessUser: (identity: Identity, context: ResolutionContext) => Promise<{
+        status: "ready";
+        user: T;
+    } | {
+        status: "unmapped";
+    }>;
+    onEvent?: (event: Event) => unknown;
+}
+export declare function createUserCenterAuth<T extends {
+    id: string;
+}>(options: AuthOptions<T>): {
+    publicConfig: PublicConfig;
+    ready: () => Promise<void>;
+    getAuth: () => Promise<import("better-auth").Auth<{
+        baseURL: string;
+        basePath: string;
+        secret: string;
+        database: any;
+        trustedOrigins: string[];
+        emailAndPassword: {
+            enabled: false;
+        };
+        user: {
+            deleteUser: {
+                enabled: false;
+            };
+        };
+        session: {
+            expiresIn: number;
+            disableSessionRefresh: true;
+            cookieCache: {
+                enabled: false;
+            };
+        };
+        account: {
+            accountLinking: {
+                enabled: false;
+            };
+            encryptOAuthTokens: true;
+        };
+        advanced: {
+            cookiePrefix: string;
+            useSecureCookies: true;
+            crossSubDomainCookies: {
+                enabled: false;
+            };
+            defaultCookieAttributes: {
+                secure: true;
+                httpOnly: true;
+                sameSite: "lax";
+                path: string;
+            };
+        };
+        onAPIError: {
+            errorURL: string;
+        };
+        logger: {
+            disabled: true;
+        };
+        rateLimit: {
+            enabled: true;
+            storage: "memory";
+        };
+        plugins: [{
+            init: (ctx: import("better-auth").AuthContext) => Promise<{
+                context: {
+                    socialProviders: OAuthProvider<object, Partial<import("better-auth").ProviderOptions<object>>>[];
+                    genericOAuthPendingDiscovery: Map<string, {
+                        config: import("better-auth/plugins/generic-oauth").GenericOAuthConfig;
+                        attempt?: Promise<void> | undefined;
+                    }>;
+                };
+            }>;
+            hooks: {
+                before: {
+                    matcher: (context: import("better-auth").HookEndpointContext) => boolean;
+                    handler: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<void>>;
+                }[];
+            };
+            id: "generic-oauth";
+            version: string;
+            options: import("better-auth/plugins/generic-oauth").GenericOAuthOptions<string>;
+            $ERROR_CODES: {
+                INVALID_OAUTH_CONFIGURATION: import("better-auth").RawError<"INVALID_OAUTH_CONFIGURATION">;
+                TOKEN_URL_NOT_FOUND: import("better-auth").RawError<"TOKEN_URL_NOT_FOUND">;
+            };
+        }];
+    }>>;
+    getIdentity: (headers: Headers) => Promise<Identity | null>;
+    getPrincipal: (headers: Headers) => Promise<Principal<T>>;
+    handlers: {
+        GET: (request: Request) => Promise<Response>;
+        POST: (request: Request) => Promise<Response>;
+    };
+};

package/dist/next-better-auth/src/server.js

@@ -0,0 +1,298 @@
+import "server-only";
+import { randomUUID } from "node:crypto";
+import { betterAuth } from "better-auth";
+import { genericOAuth } from "better-auth/plugins/generic-oauth";
+import { createAuthMiddleware } from "better-auth/api";
+import { createRemoteJWKSet, customFetch } from "jose";
+import { describeIntegration } from "../../integration-contracts/src/config.js";
+import { validateEnvironmentSelection } from "../../integration-contracts/src/environment.js";
+import { IntegrationError, TOOL_VERSION, parseLoginRequest, validateReturnTo } from "../../integration-contracts/src/public.js";
+import { readPublicJson, validateDiscovery, validateJwks } from "../../integration-contracts/src/metadata.js";
+const safeHeaders = { "Cache-Control": "no-store", "Referrer-Policy": "no-referrer" };
+const json = (data, status = 200, extra = {}) => Response.json(data, { status, headers: { ...safeHeaders, ...extra } });
+function bounded(work, ms, code, onTimeout) {
+    let timer;
+    return Promise.race([work, new Promise((_, reject) => { timer = setTimeout(() => { onTimeout?.(); reject(new IntegrationError(code)); }, ms); })]).finally(() => clearTimeout(timer));
+}
+function claims(idToken, c) {
+    try {
+        const data = JSON.parse(Buffer.from(idToken.split(".")[1], "base64url").toString("utf8"));
+        if (data.iss !== c.canonicalIssuer || typeof data.sub !== "string" || !data.sub.trim())
+            return null;
+        return data;
+    }
+    catch {
+        return null;
+    }
+}
+export function createUserCenterAuth(options) {
+    const c = describeIntegration(options.manifest);
+    const environment = options.environment === undefined ? undefined : validateEnvironmentSelection(options.environment);
+    if (!options.database || typeof options.clientSecret !== "string" || !options.clientSecret.trim() || typeof options.sessionSecret !== "string" || !options.sessionSecret.trim() || options.sessionSecret.length < 32 || options.sessionSecret === options.clientSecret || !["allow-new", "existing-only"].includes(options.authUserPolicy) || typeof options.resolveBusinessUser !== "function")
+        throw new IntegrationError("INVALID_CONFIG");
+    const ttl = options.sessionTtlSeconds ?? 86400;
+    if (!Number.isInteger(ttl) || ttl < 300 || ttl > 86400)
+        throw new IntegrationError("INVALID_CONFIG");
+    // Capture explicit server values. Mutating the caller's object cannot change policy later.
+    const { database, clientSecret, sessionSecret, resolveBusinessUser, onEvent } = options;
+    const existingOnly = options.authUserPolicy === "existing-only";
+    function emit(phase, code, requestId = randomUUID()) {
+        try {
+            void Promise.resolve(onEvent?.(Object.freeze({ phase, code, requestId, at: new Date().toISOString(), version: TOOL_VERSION }))).catch(() => { });
+        }
+        catch { /* Observation must not change authentication. */ }
+    }
+    function buildAuth(metadata, state) {
+        const algorithms = metadata.id_token_signing_alg_values_supported;
+        const jwksUrl = c.canonicalIssuer + "/jwks";
+        const jwks = createRemoteJWKSet(new URL(jwksUrl), { timeoutDuration: 5000, [customFetch]: async (url) => {
+                if (url !== jwksUrl)
+                    throw new IntegrationError("UNTRUSTED_METADATA");
+                const data = await readPublicJson(jwksUrl, 1048576);
+                validateJwks(data);
+                return Response.json(data);
+            } });
+        function guardProviders(providers) {
+            if (state.failure)
+                throw state.failure;
+            function reject(code) {
+                const error = new IntegrationError(code);
+                state.invalidate(error);
+                throw error;
+            }
+            const matching = providers.filter(p => p.id === c.providerId);
+            // A partial official initialization must never become a reusable instance.
+            if (!matching.length)
+                reject("CENTER_UNAVAILABLE");
+            if (matching.length !== 1)
+                reject("UNTRUSTED_METADATA");
+            for (const provider of matching) {
+                if (provider.issuer !== c.canonicalIssuer || !provider.idToken || !("jwks" in provider.idToken) || provider.requiresIdTokenNonce !== true || !provider.idToken.algorithms || provider.idToken.algorithms.length !== algorithms.length || provider.idToken.algorithms.some(a => !algorithms.includes(a)))
+                    reject("UNTRUSTED_METADATA");
+                // Mutate the public provider object in place: its official verifier closes over it.
+                provider.idToken.jwks = jwks;
+            }
+        }
+        const plugin = genericOAuth({ config: [{
+                    providerId: c.providerId, name: "User Center", clientId: c.clientId, clientSecret,
+                    discoveryUrl: c.discoveryUrl, authorizationUrl: c.canonicalIssuer + "/oauth2/authorize", tokenUrl: c.canonicalIssuer + "/oauth2/token", userInfoUrl: c.canonicalIssuer + "/oauth2/userinfo",
+                    scopes: ["openid", "profile", "email"], responseType: "code", responseMode: "query", pkce: true, requireIdTokenVerification: true, disableIdTokenNonceBinding: false,
+                    tokenEndpointAuth: { method: "client_secret_basic" }, allowIdpInitiated: false, disableProviderLogout: true, disableSignUp: existingOnly, disableImplicitSignUp: existingOnly,
+                    async getUserInfo(tokens) {
+                        // This official extension runs only after the provider verifies signature and nonce.
+                        const verified = claims(tokens.idToken, c);
+                        if (!verified || !tokens.accessToken)
+                            return null;
+                        try {
+                            const data = await readPublicJson(c.canonicalIssuer + "/oauth2/userinfo", 65536, "CENTER_UNAVAILABLE", { Authorization: `Bearer ${tokens.accessToken}` });
+                            if (data.sub !== verified.sub || data.email_verified !== true || typeof data.email !== "string" || !data.email.trim() || typeof data.name !== "string")
+                                return null;
+                            return { sub: verified.sub, id: verified.sub, email: data.email, emailVerified: true, name: data.name };
+                        }
+                        catch {
+                            return null;
+                        }
+                    },
+                    accountSubject({ tokens, profile }) { const verified = claims(tokens.idToken, c); return verified && verified.sub === profile.sub ? verified.sub : ""; },
+                }] });
+        // Guard every API call, including retained auth objects, before and after official hooks.
+        const providerGuard = { matcher: () => true, handler: createAuthMiddleware(async (ctx) => { guardProviders(ctx.context.socialProviders); }) };
+        const guardedPlugin = { ...plugin, init: async (...args) => {
+                const result = await plugin.init(...args);
+                guardProviders(result.context.socialProviders);
+                return result;
+            }, hooks: { ...plugin.hooks, before: [providerGuard, ...plugin.hooks.before, providerGuard] } };
+        const auth = betterAuth({
+            baseURL: c.platformOrigin, basePath: c.authBasePath, secret: sessionSecret, database, trustedOrigins: [c.platformOrigin],
+            emailAndPassword: { enabled: false }, user: { deleteUser: { enabled: false } },
+            session: { expiresIn: ttl, disableSessionRefresh: true, cookieCache: { enabled: false } },
+            account: { accountLinking: { enabled: false }, encryptOAuthTokens: true },
+            advanced: { cookiePrefix: c.cookiePrefix, useSecureCookies: true, crossSubDomainCookies: { enabled: false }, defaultCookieAttributes: { secure: true, httpOnly: true, sameSite: "lax", path: "/" } },
+            onAPIError: { errorURL: c.platformOrigin + c.errorPath }, logger: { disabled: true }, rateLimit: { enabled: true, storage: "memory" }, plugins: [guardedPlugin],
+        });
+        return { auth, assertTrusted: async () => { guardProviders((await auth.$context).socialProviders); } };
+    }
+    let preparation;
+    async function loadAuth() {
+        if (!preparation) {
+            const state = { invalidate(error) {
+                    state.failure ??= error;
+                    if (preparation === attempt)
+                        preparation = undefined;
+                } };
+            const work = (async () => {
+                const metadata = validateDiscovery(await readPublicJson(c.discoveryUrl, 1048576), c, environment?.targetEnvironment);
+                if (state.failure)
+                    throw state.failure;
+                const prepared = buildAuth(metadata, state);
+                await prepared.assertTrusted();
+                return prepared;
+            })();
+            // All callers share one deadline; an expired generation cannot poison a later one.
+            const attempt = bounded(work, 10000, "CENTER_UNAVAILABLE", () => state.invalidate(new IntegrationError("CENTER_UNAVAILABLE")));
+            preparation = attempt;
+            void attempt.catch(error => state.invalidate(error instanceof IntegrationError ? error : new IntegrationError("CENTER_UNAVAILABLE")));
+        }
+        try {
+            const prepared = await preparation;
+            await prepared.assertTrusted();
+            return prepared.auth;
+        }
+        catch (e) {
+            const error = e instanceof IntegrationError ? e : new IntegrationError("CENTER_UNAVAILABLE");
+            emit("ready", error.code);
+            throw error;
+        }
+    }
+    async function getAuth() {
+        return loadAuth();
+    }
+    async function getIdentity(headers) {
+        try {
+            const auth = await getAuth();
+            const session = await auth.api.getSession({ headers });
+            if (!session)
+                return null;
+            const accounts = await auth.api.listUserAccounts({ headers });
+            const matches = accounts.filter(a => a.providerId === c.providerId);
+            if (!matches.length)
+                return null;
+            if (matches.length !== 1 || matches[0].userId !== session.user.id || typeof matches[0].accountId !== "string" || !matches[0].accountId.trim())
+                throw new IntegrationError("IDENTITY_CONFLICT");
+            return { issuer: c.canonicalIssuer, subject: matches[0].accountId, authUserId: session.user.id, profile: { name: session.user.name, email: session.user.email, emailVerified: session.user.emailVerified } };
+        }
+        catch (e) {
+            throw e instanceof IntegrationError ? e : new IntegrationError("CENTER_UNAVAILABLE");
+        }
+    }
+    async function getPrincipal(headers) {
+        const identity = await getIdentity(headers);
+        if (!identity)
+            return { status: "anonymous" };
+        const requestId = randomUUID();
+        const controller = new AbortController();
+        try {
+            const result = await bounded(Promise.resolve().then(() => resolveBusinessUser(identity, Object.freeze({ requestId, signal: controller.signal }))), 5000, "BUSINESS_RESOLUTION_FAILED", () => controller.abort());
+            if (result?.status === "unmapped")
+                return { status: "mapping-required", identity };
+            if (result?.status !== "ready" || typeof result.user?.id !== "string" || !result.user.id.trim())
+                throw new IntegrationError("BUSINESS_RESOLUTION_FAILED");
+            emit("business", "OK", requestId);
+            return { status: "authenticated", identity, user: result.user };
+        }
+        catch {
+            emit("business", "BUSINESS_RESOLUTION_FAILED", requestId);
+            throw new IntegrationError("BUSINESS_RESOLUTION_FAILED");
+        }
+    }
+    async function safeSession(headers) {
+        const auth = await getAuth();
+        const session = await auth.api.getSession({ headers });
+        return session ? { user: { id: session.user.id, name: session.user.name, email: session.user.email, emailVerified: session.user.emailVerified }, expiresAt: session.session.expiresAt.toISOString() } : null;
+    }
+    function redirectError(code, response) {
+        const headers = new Headers(safeHeaders);
+        headers.set("Location", c.platformOrigin + c.errorPath + "?code=" + code);
+        // Preserve state cleanup, but never deliver a session on a rejected redirect.
+        if (response)
+            for (const cookie of response.headers.getSetCookie())
+                if (!cookie.includes("session_token="))
+                    headers.append("Set-Cookie", cookie);
+        return new Response(null, { status: 302, headers });
+    }
+    async function handle(request) {
+        const url = new URL(request.url);
+        const path = url.pathname.slice(c.authBasePath.length);
+        if (url.origin !== c.platformOrigin || !url.pathname.startsWith(c.authBasePath + "/"))
+            return json({ code: "NOT_FOUND" }, 404);
+        const methods = { "/sign-in/social": "POST", "/get-session": "GET", "/sign-out": "POST", ["/callback/" + c.providerId]: "GET" };
+        if (!methods[path])
+            return json({ code: "NOT_FOUND" }, 404);
+        if (request.method !== methods[path])
+            return json({ code: "METHOD_NOT_ALLOWED" }, 405, { Allow: methods[path] });
+        if (request.method === "POST" && (request.headers.get("Origin") !== c.platformOrigin || request.headers.get("Sec-Fetch-Site") === "cross-site"))
+            return json({ code: "FORBIDDEN" }, 403);
+        try {
+            if (path === "/sign-in/social") {
+                if (url.search || !/^application\/json(?:;|$)/i.test(request.headers.get("Content-Type") ?? ""))
+                    return json({ code: "INVALID_LOGIN_REQUEST" }, 400);
+                const text = await request.text();
+                if (text.length > 4096)
+                    return json({ code: "INVALID_LOGIN_REQUEST" }, 400);
+                let body;
+                try {
+                    body = JSON.parse(text);
+                }
+                catch {
+                    return json({ code: "INVALID_LOGIN_REQUEST" }, 400);
+                }
+                const { returnTo } = parseLoginRequest(body, c);
+                const rebuilt = JSON.stringify({ provider: c.providerId, callbackURL: c.platformOrigin + returnTo, newUserCallbackURL: c.platformOrigin + returnTo, errorCallbackURL: c.platformOrigin + c.errorPath, disableRedirect: true });
+                const headers = new Headers(request.headers);
+                headers.delete("Content-Length");
+                headers.delete("Transfer-Encoding");
+                headers.set("Content-Type", "application/json");
+                const response = await (await loadAuth()).handler(new Request(request.url, { method: "POST", headers, body: rebuilt }));
+                if (!response.ok)
+                    return json({ code: "LOGIN_UNAVAILABLE" }, response.status >= 500 ? 503 : 400);
+                const data = await response.json();
+                const target = new URL(data.url);
+                if (target.origin !== c.centerOrigin || target.pathname !== new URL(c.canonicalIssuer + "/oauth2/authorize").pathname || target.username || target.password || target.hash)
+                    throw new IntegrationError("LOGIN_UNAVAILABLE");
+                const out = json({ url: target.href });
+                for (const cookie of response.headers.getSetCookie())
+                    out.headers.append("Set-Cookie", cookie);
+                emit("login", "OK");
+                return out;
+            }
+            if (path === "/get-session")
+                return json(await safeSession(request.headers));
+            if (path.startsWith("/callback/")) {
+                if (["code", "state", "error"].some(k => url.searchParams.getAll(k).length > 1))
+                    return redirectError("LOGIN_UNAVAILABLE");
+                const response = await (await loadAuth()).handler(request);
+                const location = response.headers.get("Location");
+                if (!location)
+                    return redirectError("LOGIN_UNAVAILABLE", response);
+                const target = new URL(location, c.platformOrigin);
+                if (target.origin !== c.platformOrigin || target.username || target.password || target.hash)
+                    return redirectError("LOGIN_UNAVAILABLE", response);
+                if (target.pathname === c.errorPath)
+                    return redirectError(target.searchParams.get("error") === "account_not_linked" ? "ACCOUNT_CONFLICT" : "LOGIN_UNAVAILABLE", response);
+                try {
+                    validateReturnTo(target.pathname + target.search, c);
+                    if (target.hash)
+                        throw new Error();
+                }
+                catch {
+                    return redirectError("INVALID_RETURN_TO", response);
+                }
+                const headers = new Headers(response.headers);
+                for (const [k, v] of Object.entries(safeHeaders))
+                    headers.set(k, v);
+                emit("callback", "OK");
+                return new Response(null, { status: response.status, headers });
+            }
+            const auth = await getAuth();
+            const response = await auth.handler(request);
+            let confirmed = false;
+            if (response.ok)
+                try {
+                    confirmed = await auth.api.getSession({ headers: request.headers, query: { disableCookieCache: true, disableRefresh: true } }) === null;
+                }
+                catch { /* A failed confirmation read must not declare revocation. */ }
+            const out = confirmed ? json({ success: true }) : json({ code: "SIGN_OUT_UNCONFIRMED" }, 503);
+            for (const cookie of response.headers.getSetCookie())
+                out.headers.append("Set-Cookie", cookie);
+            emit("logout", confirmed ? "OK" : "SIGN_OUT_UNCONFIRMED");
+            return out;
+        }
+        catch (e) {
+            const code = e instanceof IntegrationError ? e.code : "CENTER_UNAVAILABLE";
+            if (path.startsWith("/callback/"))
+                return redirectError(code);
+            return json({ code }, ["INVALID_LOGIN_REQUEST", "INVALID_RETURN_TO"].includes(code) ? 400 : code === "IDENTITY_CONFLICT" ? 409 : 503);
+        }
+    }
+    return { publicConfig: describeIntegration(options.manifest), ready: async () => { await getAuth(); emit("ready", "OK"); }, getAuth, getIdentity, getPrincipal, handlers: { GET: handle, POST: handle } };
+}

package/package.json

@@ -1,6 +1,67 @@
 {
   "name": "@user-center/next-better-auth",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.1.8",
+  "type": "module",
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=22"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/next-better-auth/src/public.d.ts",
+      "import": "./dist/next-better-auth/src/public.js"
+    },
+    "./public": {
+      "types": "./dist/next-better-auth/src/public.d.ts",
+      "import": "./dist/next-better-auth/src/public.js"
+    },
+    "./config": {
+      "types": "./dist/next-better-auth/src/config.d.ts",
+      "import": "./dist/next-better-auth/src/config.js"
+    },
+    "./server": {
+      "types": "./dist/next-better-auth/src/server.d.ts",
+      "import": "./dist/next-better-auth/src/server.js"
+    },
+    "./client": {
+      "types": "./dist/next-better-auth/src/client.d.ts",
+      "import": "./dist/next-better-auth/src/client.js"
+    }
+  },
+  "dependencies": {
+    "server-only": "0.0.1",
+    "jose": "6.2.13"
+  },
+  "peerDependencies": {
+    "better-auth": "1.7.12"
+  },
+  "devDependencies": {
+    "better-auth": "1.7.12",
+    "typescript": "^5",
+    "@types/node": "^24"
+  },
+  "description": "Controlled User Center authentication integration for Next App Router and Better Auth.",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/ZXFTech/user-center.git",
+    "directory": "packages/next-better-auth"
+  },
+  "homepage": "https://github.com/ZXFTech/user-center#readme",
+  "bugs": {
+    "url": "https://github.com/ZXFTech/user-center/issues"
+  },
+  "publishConfig": {
+    "registry": "https://registry.npmjs.org/",
+    "access": "public",
+    "tag": "next"
+  },
+  "scripts": {
+    "build": "node ../../scripts/build-integration.mjs next-better-auth",
+    "typecheck": "tsc -p tsconfig.json --noEmit"
+  }
 }