@webtwizz/cloud 0.0.0-stage → 0.2.0

package/AI_GUIDE.md

@@ -0,0 +1,118 @@
+# @webtwizz/cloud: building on WebTwizz Cloud
+
+Read this before writing sign-ins, database code or file uploads on a site with WebTwizz Cloud. It matches the version installed next to it. Call all of it WebTwizz Cloud (sign-ins, database, files) and never name any company behind it.
+
+Every setting is already in the site's environment (`WEBTWIZZ_AUTH_URL`, `WEBTWIZZ_AUTH_SECRET`, `DATABASE_URL`, `WEBTWIZZ_STORAGE_*`, `WEBTWIZZ_FILES_URL`). Never add, rename or print them.
+
+## Sign-ins
+
+1. `src/lib/auth/server.ts`
+
+```ts
+import { createAuth } from '@webtwizz/cloud/server';
+
+export const auth = createAuth();
+```
+
+2. `src/app/api/auth/[...path]/route.ts`
+
+```ts
+import { auth } from '@/lib/auth/server';
+
+export const { GET, POST, PUT, DELETE, PATCH } = auth.handler();
+```
+
+3. `src/lib/auth/client.ts`, the browser client. It takes no arguments and talks to the route above.
+
+```ts
+import { createAuthClient } from '@webtwizz/cloud/client';
+
+export const authClient = createAuthClient();
+```
+
+4. In client components: `authClient.signUp.email({ email, password, name })`, `authClient.signIn.email({ email, password })`, `authClient.signOut()`. Each returns `{ data, error }`. Never show `error.message`. Keep what they typed, `console.error(error)`, and show `authMessage(error)`:
+
+```ts
+import { authMessage } from '@webtwizz/cloud';
+
+const { error } = await authClient.signIn.email({ email, password });
+if (error) setMessage(authMessage(error));
+```
+
+For wording that fits the site, pass overrides: `authMessage(error, { USER_ALREADY_EXISTS: 'You already have a booking account.' })`.
+
+5. Protect pages in `src/proxy.ts`, listing only the protected routes in the matcher (a matcher over every path blocks the sign-in page's own scripts):
+
+```ts
+import { auth } from '@/lib/auth/server';
+
+export default auth.middleware({ loginUrl: '/sign-in' });
+
+export const config = { matcher: ['/account/:path*'] };
+```
+
+6. On the server, check the session before protected data or any write, in the route handler or server action itself:
+
+```ts
+const { data: session } = await auth.getSession();
+if (!session?.user) return Response.json({ error: 'Sign in first' }, { status: 401 });
+```
+
+Never destructure `{ user }` from the top level.
+
+7. Signed-up users are rows in the `webtwizz.users` view (`id`, `name`, `email`, `email_verified`, `image`, `role`, `created_at`), kept by sign-ins. Read it, never write to it, never create a users or passwords table. Your own tables keep a plain `user_id uuid` column (no foreign key) set from `session.user.id`.
+
+8. Every sign-in page gets a "Forgot password?" link to `/reset-password`, a client page in two steps: their email, then `authClient.forgetPassword.emailOtp({ email })`, which emails a 6-digit code; then the code and a new password, then `authClient.emailOtp.resetPassword({ email, otp, password })`, then send them to sign in. Leave `/reset-password` out of the proxy matcher. The owner can also send a reset code from the Data panel, and it lands on this page.
+
+Sign-ins are email and password only. Sign-in emails (reset codes, confirmations) are sent for the site automatically; never build email sending or add an email service for them. If the user asks for another way to sign in, say WebTwizz Cloud sign-ins are email and password for now and build that.
+
+Sites built before this package import sign-ins from another package in `src/lib/auth/`. When you work on their sign-ins, move `server.ts`, `client.ts` and the auth route to the files above (same sign-ins, same users) and remove the old package.
+
+## Database
+
+One shared client, server-side only (route handlers, server components, server actions):
+
+```ts
+// src/lib/db.ts
+import { createDb } from '@webtwizz/cloud/db';
+
+export const sql = createDb();
+```
+
+It is the `postgres` package with pooler-safe settings, so queries look like ``await sql`select * from notes where user_id = ${session.user.id}` ``. Schema and data changes go through the `database` tool.
+
+The database can pause or fill up on the owner's plan. Wrap reads and saves in try/catch and show `MESSAGES.unavailable` on a page or `MESSAGES.saveFailed` on a form (`import { MESSAGES } from '@webtwizz/cloud'`). Visitors never see WebTwizz, plans or limits.
+
+Pages that only show data set `export const revalidate = 60`, and the server action that saves calls `revalidatePath` for them. Pages for a signed-in user stay dynamic.
+
+## Files
+
+Two buckets: `public` (anyone can view, for images shown on the site) and `private` (documents, opened through short-lived links). Images you place on pages yourself keep using the usual image tools; this is for what visitors or the site's features upload.
+
+```ts
+// src/app/api/uploads/route.ts
+import { MESSAGES } from '@webtwizz/cloud';
+import { FileError, createFiles } from '@webtwizz/cloud/files';
+import { auth } from '@/lib/auth/server';
+
+export async function POST(request: Request) {
+  const { data: session } = await auth.getSession();
+  if (!session?.user) return Response.json({ error: 'Sign in first' }, { status: 401 });
+  const { name, type, size } = await request.json();
+  try {
+    const upload = await createFiles().uploadUrl({ bucket: 'public', name, type, size, folder: session.user.id, accept: ['image/*'] });
+    return Response.json(upload);
+  } catch (error) {
+    if (error instanceof FileError) return Response.json({ error: error.message }, { status: 400 });
+    return Response.json({ error: MESSAGES.uploadsPaused }, { status: 503 });
+  }
+}
+```
+
+The browser then sends the file with exactly the returned headers: `fetch(upload.url, { method: 'PUT', headers: upload.headers, body: file })`. The link holds the file's size, so send the same file you described. If the PUT fails with an access error, storage is full: show `MESSAGES.uploadsPaused`. Save `upload.key` in your table.
+
+Show files with `createFiles().publicUrl(key)` in a plain `<img>` or link, or `await createFiles().privateUrl(key)` (5 minutes; pass `{ download: 'name.pdf' }` to download) after checking the visitor may see it. Remove with `createFiles().remove(bucket, key)`. Never reuse a key.
+
+## Owner tools
+
+The owner manages users under Users in the Data panel (password reset, block, delete with their rows, export), sets who can sign up and the sign-in emails in Settings > Cloud > Users, and downloads everything from Settings > Cloud > Database. Point them there when they ask.

package/CHANGELOG.md

@@ -0,0 +1,11 @@
+# @webtwizz/cloud
+
+## 0.2.0
+
+### Minor Changes
+
+- 038e061: Visitors only see WebTwizz names: session cookies are `__Secure-webtwizz-auth.*`, the sign-in route drops the sign-in service's own response headers, sign-in log lines say `[webtwizz-auth]`, and uploads go through the site's files address like every other file link. Visitors signed in on 0.1.0 sign in again once.
+
+## 0.1.0
+
+- Sign-ins (`createAuth`, `createAuthClient`), plain words for every sign-in error (`authMessage`), a pooler-safe database client (`createDb`) and file uploads and links (`createFiles`).

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 WebTwizz
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,55 @@
-# Temporary Holding Version
+# @webtwizz/cloud
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Sign-ins, database and file storage for sites built on [WebTwizz](https://webtwizz.com) Cloud.
+
+```sh
+npm install @webtwizz/cloud
+```
+
+WebTwizz puts every setting in the site's environment, so each module works with no arguments.
+
+| Import | What it gives you |
+| --- | --- |
+| `@webtwizz/cloud` | `authMessage(error)` plain words for sign-in errors, `MESSAGES` for unavailable and failed saves |
+| `@webtwizz/cloud/server` | `createAuth()` with `.handler()`, `.middleware()`, `.getSession()` and the server sign-in methods |
+| `@webtwizz/cloud/client` | `createAuthClient()` for client components |
+| `@webtwizz/cloud/db` | `createDb()`, a `postgres` client with pooler-safe settings |
+| `@webtwizz/cloud/files` | `createFiles()` with `uploadUrl`, `publicUrl`, `privateUrl`, `remove` |
+
+`server`, `db` and `files` are server-only. [AI_GUIDE.md](AI_GUIDE.md) has the full walkthrough and ships with each version.
+
+## Environment
+
+| Variable | Used by |
+| --- | --- |
+| `WEBTWIZZ_AUTH_URL`, `WEBTWIZZ_AUTH_SECRET` | `server` |
+| `DATABASE_URL` | `db` |
+| `WEBTWIZZ_STORAGE_ENDPOINT`, `WEBTWIZZ_STORAGE_REGION`, `WEBTWIZZ_STORAGE_KEY`, `WEBTWIZZ_STORAGE_SECRET` | `files` |
+| `WEBTWIZZ_STORAGE_READ_KEY`, `WEBTWIZZ_STORAGE_READ_SECRET` | `files` private links |
+| `WEBTWIZZ_FILES_URL`, `WEBTWIZZ_STORAGE_MAX_FILE_MB` | `files`, optional |
+
+## Development
+
+```sh
+npm ci
+npm test                 # unit tests
+npm run test:integration # real throwaway project, needs NEON_API_KEY
+npm run build
+```
+
+`test/fixture` is a small Next app that CI builds against the packed tarball.
+
+## Releases
+
+- Add a changeset (`npx changeset`) to any PR that changes what sites get.
+- When CI passes on `main`, the Release workflow versions, tags and publishes to npm with provenance (trusted publishing, no token).
+- Dependency updates merged by Renovate ship as a patch on their own.
+- Run the Release workflow by hand to publish the current commit under the `next` tag and try it on a test site first.
+
+Sites pin an exact version, so a release never changes a live site until WebTwizz upgrades it.
+
+The WebTwizz AI builds from its own copy of AI_GUIDE.md. After a release, run `npm run cloud:sync <version>` in the ai-service so new sites get that version and its guide.
+
+## License
+
+MIT

package/dist/chunk-7EXXDRMF.js

@@ -0,0 +1,376 @@
+// node_modules/@neondatabase/auth/dist/better-auth-helpers-DlzEQzcv.mjs
+import { AuthApiError, AuthError, isAuthApiError, isAuthError } from "@supabase/auth-js";
+var SESSION_CACHE_TTL_MS = 6e4;
+var CLOCK_SKEW_BUFFER_MS = 1e4;
+var NEON_AUTH_SESSION_VERIFIER_PARAM_NAME = "neon_auth_session_verifier";
+var NEON_AUTH_POPUP_PARAM_NAME = "neon_popup";
+var NEON_AUTH_POPUP_CALLBACK_PARAM_NAME = "neon_popup_callback";
+var NEON_AUTH_POPUP_CALLBACK_ROUTE = "/auth/callback";
+var OAUTH_POPUP_MESSAGE_TYPE = "neon-auth:oauth-complete";
+var AuthErrorCode = {
+  BadJwt: "bad_jwt",
+  InvalidCredentials: "invalid_credentials",
+  SessionExpired: "session_expired",
+  SessionNotFound: "session_not_found",
+  InvalidGrant: "invalid_grant",
+  UserNotFound: "user_not_found",
+  UserAlreadyExists: "user_already_exists",
+  EmailExists: "email_exists",
+  PhoneExists: "phone_exists",
+  EmailNotConfirmed: "email_not_confirmed",
+  PhoneNotConfirmed: "phone_not_confirmed",
+  ValidationFailed: "validation_failed",
+  BadJson: "bad_json",
+  WeakPassword: "weak_password",
+  EmailAddressInvalid: "email_address_invalid",
+  FeatureNotSupported: "feature_not_supported",
+  NotImplemented: "not_implemented",
+  OAuthProviderNotSupported: "oauth_provider_not_supported",
+  PhoneProviderDisabled: "phone_provider_disabled",
+  MagicLinkNotSupported: "magic_link_not_supported",
+  SsoProviderDisabled: "sso_provider_disabled",
+  AnonymousProviderDisabled: "anonymous_provider_disabled",
+  Web3ProviderDisabled: "web3_provider_disabled",
+  BadOAuthCallback: "bad_oauth_callback",
+  OAuthCallbackFailed: "oauth_callback_failed",
+  OverRequestRateLimit: "over_request_rate_limit",
+  OverEmailSendRateLimit: "over_email_send_rate_limit",
+  OverSmsSendRateLimit: "over_sms_send_rate_limit",
+  UnexpectedFailure: "unexpected_failure",
+  InternalError: "internal_error",
+  IdentityNotFound: "identity_not_found",
+  UnknownError: "unknown_error"
+};
+var ERROR_DEFINITIONS = {
+  [AuthErrorCode.BadJwt]: {
+    code: AuthErrorCode.BadJwt,
+    status: 401,
+    message: "Invalid or expired session token",
+    description: "The JWT token is malformed, expired, or has an invalid signature"
+  },
+  [AuthErrorCode.InvalidCredentials]: {
+    code: AuthErrorCode.InvalidCredentials,
+    status: 401,
+    message: "Invalid email or password",
+    description: "The provided credentials do not match any user account"
+  },
+  [AuthErrorCode.SessionExpired]: {
+    code: AuthErrorCode.SessionExpired,
+    status: 401,
+    message: "Session has expired",
+    description: "The user session has exceeded its timeout period"
+  },
+  [AuthErrorCode.SessionNotFound]: {
+    code: AuthErrorCode.SessionNotFound,
+    status: 401,
+    message: "No active session found",
+    description: "The user does not have an active session or the session was invalidated"
+  },
+  [AuthErrorCode.InvalidGrant]: {
+    code: AuthErrorCode.InvalidGrant,
+    status: 401,
+    message: "Invalid authorization grant",
+    description: "OAuth/OIDC grant validation failed"
+  },
+  [AuthErrorCode.UserNotFound]: {
+    code: AuthErrorCode.UserNotFound,
+    status: 404,
+    message: "User not found",
+    description: "No user exists with the provided identifier"
+  },
+  [AuthErrorCode.UserAlreadyExists]: {
+    code: AuthErrorCode.UserAlreadyExists,
+    status: 409,
+    message: "User already exists",
+    description: "A user with this email or phone number is already registered"
+  },
+  [AuthErrorCode.EmailExists]: {
+    code: AuthErrorCode.EmailExists,
+    status: 409,
+    message: "Email address already registered",
+    description: "This email address is already associated with an account"
+  },
+  [AuthErrorCode.PhoneExists]: {
+    code: AuthErrorCode.PhoneExists,
+    status: 409,
+    message: "Phone number already registered",
+    description: "This phone number is already associated with an account"
+  },
+  [AuthErrorCode.EmailNotConfirmed]: {
+    code: AuthErrorCode.EmailNotConfirmed,
+    status: 422,
+    message: "Email verification required",
+    description: "The user must verify their email before signing in"
+  },
+  [AuthErrorCode.PhoneNotConfirmed]: {
+    code: AuthErrorCode.PhoneNotConfirmed,
+    status: 422,
+    message: "Phone verification required",
+    description: "The user must verify their phone number before signing in"
+  },
+  [AuthErrorCode.ValidationFailed]: {
+    code: AuthErrorCode.ValidationFailed,
+    status: 400,
+    message: "Invalid request parameters",
+    description: "One or more request parameters are invalid or missing"
+  },
+  [AuthErrorCode.BadJson]: {
+    code: AuthErrorCode.BadJson,
+    status: 400,
+    message: "Invalid JSON in request body",
+    description: "The request body contains malformed JSON"
+  },
+  [AuthErrorCode.WeakPassword]: {
+    code: AuthErrorCode.WeakPassword,
+    status: 400,
+    message: "Password does not meet security requirements",
+    description: "The password is too weak or does not meet complexity requirements"
+  },
+  [AuthErrorCode.EmailAddressInvalid]: {
+    code: AuthErrorCode.EmailAddressInvalid,
+    status: 400,
+    message: "Invalid email address format",
+    description: "The provided email address is not in a valid format"
+  },
+  [AuthErrorCode.FeatureNotSupported]: {
+    code: AuthErrorCode.FeatureNotSupported,
+    status: 403,
+    message: "Feature not available",
+    description: "This feature is not supported in the current configuration"
+  },
+  [AuthErrorCode.NotImplemented]: {
+    code: AuthErrorCode.NotImplemented,
+    status: 501,
+    message: "Feature not implemented",
+    description: "This feature has not been implemented yet"
+  },
+  [AuthErrorCode.OAuthProviderNotSupported]: {
+    code: AuthErrorCode.OAuthProviderNotSupported,
+    status: 403,
+    message: "OAuth provider not supported",
+    description: "The requested OAuth provider is not enabled"
+  },
+  [AuthErrorCode.PhoneProviderDisabled]: {
+    code: AuthErrorCode.PhoneProviderDisabled,
+    status: 403,
+    message: "Phone authentication not available",
+    description: "Phone number authentication is not enabled"
+  },
+  [AuthErrorCode.MagicLinkNotSupported]: {
+    code: AuthErrorCode.MagicLinkNotSupported,
+    status: 403,
+    message: "Magic link authentication not available",
+    description: "Magic link authentication is not supported"
+  },
+  [AuthErrorCode.SsoProviderDisabled]: {
+    code: AuthErrorCode.SsoProviderDisabled,
+    status: 403,
+    message: "SSO not supported",
+    description: "Enterprise SSO authentication is not available"
+  },
+  [AuthErrorCode.AnonymousProviderDisabled]: {
+    code: AuthErrorCode.AnonymousProviderDisabled,
+    status: 403,
+    message: "Anonymous authentication not available",
+    description: "Anonymous sign-in is not enabled"
+  },
+  [AuthErrorCode.Web3ProviderDisabled]: {
+    code: AuthErrorCode.Web3ProviderDisabled,
+    status: 403,
+    message: "Web3 authentication not supported",
+    description: "Web3/blockchain authentication is not available"
+  },
+  [AuthErrorCode.BadOAuthCallback]: {
+    code: AuthErrorCode.BadOAuthCallback,
+    status: 400,
+    message: "Invalid OAuth callback",
+    description: "The OAuth callback request is missing required parameters"
+  },
+  [AuthErrorCode.OAuthCallbackFailed]: {
+    code: AuthErrorCode.OAuthCallbackFailed,
+    status: 500,
+    message: "OAuth authentication failed",
+    description: "The OAuth callback completed but no session was created"
+  },
+  [AuthErrorCode.OverRequestRateLimit]: {
+    code: AuthErrorCode.OverRequestRateLimit,
+    status: 429,
+    message: "Too many requests",
+    description: "Rate limit exceeded. Please try again later"
+  },
+  [AuthErrorCode.OverEmailSendRateLimit]: {
+    code: AuthErrorCode.OverEmailSendRateLimit,
+    status: 429,
+    message: "Too many email requests",
+    description: "Too many emails sent. Please wait before trying again"
+  },
+  [AuthErrorCode.OverSmsSendRateLimit]: {
+    code: AuthErrorCode.OverSmsSendRateLimit,
+    status: 429,
+    message: "Too many SMS requests",
+    description: "Too many SMS messages sent. Please wait before trying again"
+  },
+  [AuthErrorCode.UnexpectedFailure]: {
+    code: AuthErrorCode.UnexpectedFailure,
+    status: 500,
+    message: "An unexpected error occurred",
+    description: "The server encountered an unexpected condition"
+  },
+  [AuthErrorCode.InternalError]: {
+    code: AuthErrorCode.InternalError,
+    status: 500,
+    message: "Internal server error",
+    description: "An internal error occurred while processing the request"
+  },
+  [AuthErrorCode.IdentityNotFound]: {
+    code: AuthErrorCode.IdentityNotFound,
+    status: 404,
+    message: "Identity not found",
+    description: "The requested user identity does not exist"
+  },
+  [AuthErrorCode.UnknownError]: {
+    code: AuthErrorCode.UnknownError,
+    status: 500,
+    message: "An unknown error occurred",
+    description: "The error could not be categorized"
+  }
+};
+function getErrorDefinition(code) {
+  return ERROR_DEFINITIONS[code];
+}
+var BETTER_AUTH_ERROR_MAP = {
+  "INVALID_EMAIL_OR_PASSWORD": AuthErrorCode.InvalidCredentials,
+  "INVALID_PASSWORD": AuthErrorCode.InvalidCredentials,
+  "INVALID_EMAIL": AuthErrorCode.EmailAddressInvalid,
+  "USER_NOT_FOUND": AuthErrorCode.UserNotFound,
+  "INVALID_TOKEN": AuthErrorCode.BadJwt,
+  "SESSION_EXPIRED": AuthErrorCode.SessionExpired,
+  "FAILED_TO_GET_SESSION": AuthErrorCode.SessionNotFound,
+  "USER_ALREADY_EXISTS": AuthErrorCode.UserAlreadyExists,
+  "EMAIL_NOT_VERIFIED": AuthErrorCode.EmailNotConfirmed,
+  "USER_EMAIL_NOT_FOUND": AuthErrorCode.UserNotFound,
+  "PASSWORD_TOO_SHORT": AuthErrorCode.WeakPassword,
+  "PASSWORD_TOO_LONG": AuthErrorCode.WeakPassword,
+  "USER_ALREADY_HAS_PASSWORD": AuthErrorCode.ValidationFailed,
+  "CREDENTIAL_ACCOUNT_NOT_FOUND": AuthErrorCode.IdentityNotFound,
+  "FAILED_TO_UNLINK_LAST_ACCOUNT": AuthErrorCode.ValidationFailed,
+  "ACCOUNT_NOT_FOUND": AuthErrorCode.IdentityNotFound,
+  "SOCIAL_ACCOUNT_ALREADY_LINKED": AuthErrorCode.ValidationFailed,
+  "PROVIDER_NOT_FOUND": AuthErrorCode.OAuthProviderNotSupported,
+  "ID_TOKEN_NOT_SUPPORTED": AuthErrorCode.FeatureNotSupported,
+  "FAILED_TO_CREATE_USER": AuthErrorCode.InternalError,
+  "FAILED_TO_CREATE_SESSION": AuthErrorCode.InternalError,
+  "FAILED_TO_UPDATE_USER": AuthErrorCode.InternalError,
+  "EMAIL_CAN_NOT_BE_UPDATED": AuthErrorCode.FeatureNotSupported
+};
+var STATUS_CODE_ERROR_MAP = {
+  400: AuthErrorCode.ValidationFailed,
+  401: AuthErrorCode.BadJwt,
+  403: AuthErrorCode.FeatureNotSupported,
+  404: AuthErrorCode.UserNotFound,
+  409: AuthErrorCode.UserAlreadyExists,
+  422: AuthErrorCode.ValidationFailed,
+  429: AuthErrorCode.OverRequestRateLimit,
+  500: AuthErrorCode.UnexpectedFailure,
+  501: AuthErrorCode.NotImplemented,
+  503: AuthErrorCode.FeatureNotSupported
+};
+function normalizeBetterAuthError(error) {
+  if (error !== null && error !== void 0 && typeof error === "object" && "status" in error && "statusText" in error) {
+    const betterError = error;
+    const status = betterError.status;
+    if ("code" in betterError && betterError.code && typeof betterError.code === "string") {
+      const mappedCode = BETTER_AUTH_ERROR_MAP[betterError.code];
+      if (mappedCode) {
+        const def$2 = getErrorDefinition(mappedCode);
+        return createNormalizedError(def$2.message, def$2.status, def$2.code, status);
+      }
+    }
+    const def$1 = getErrorDefinition(mapStatusCodeToErrorCode(status, betterError.message || betterError.statusText));
+    return createNormalizedError(betterError.message || def$1.message, status, def$1.code, status);
+  }
+  if (error instanceof Error) {
+    const def$1 = getErrorDefinition(mapMessageToErrorCode(error.message));
+    return createNormalizedError(error.message || def$1.message, def$1.status, def$1.code, def$1.status);
+  }
+  const def = getErrorDefinition(AuthErrorCode.UnknownError);
+  return new AuthError(def.message, def.status, def.code);
+}
+function mapStatusCodeToErrorCode(status, message) {
+  const lowerMessage = message?.toLowerCase() || "";
+  switch (status) {
+    case 401:
+      if (lowerMessage.includes("token") || lowerMessage.includes("jwt")) return AuthErrorCode.BadJwt;
+      if (lowerMessage.includes("session")) return AuthErrorCode.SessionNotFound;
+      if (lowerMessage.includes("expired")) return AuthErrorCode.SessionExpired;
+      return AuthErrorCode.InvalidCredentials;
+    case 404:
+      if (lowerMessage.includes("identity") || lowerMessage.includes("account")) return AuthErrorCode.IdentityNotFound;
+      if (lowerMessage.includes("session")) return AuthErrorCode.SessionNotFound;
+      return AuthErrorCode.UserNotFound;
+    case 409:
+      if (lowerMessage.includes("email")) return AuthErrorCode.EmailExists;
+      if (lowerMessage.includes("phone")) return AuthErrorCode.PhoneExists;
+      return AuthErrorCode.UserAlreadyExists;
+    case 422:
+      if (lowerMessage.includes("email") && lowerMessage.includes("confirm")) return AuthErrorCode.EmailNotConfirmed;
+      if (lowerMessage.includes("phone") && lowerMessage.includes("confirm")) return AuthErrorCode.PhoneNotConfirmed;
+      return AuthErrorCode.ValidationFailed;
+    case 429:
+      if (lowerMessage.includes("email")) return AuthErrorCode.OverEmailSendRateLimit;
+      if (lowerMessage.includes("sms") || lowerMessage.includes("phone")) return AuthErrorCode.OverSmsSendRateLimit;
+      return AuthErrorCode.OverRequestRateLimit;
+    case 400:
+      if (lowerMessage.includes("password") && lowerMessage.includes("weak")) return AuthErrorCode.WeakPassword;
+      if (lowerMessage.includes("email") && lowerMessage.includes("invalid")) return AuthErrorCode.EmailAddressInvalid;
+      if (lowerMessage.includes("json")) return AuthErrorCode.BadJson;
+      if (lowerMessage.includes("oauth") || lowerMessage.includes("callback")) return AuthErrorCode.BadOAuthCallback;
+      return AuthErrorCode.ValidationFailed;
+    case 403:
+      if (lowerMessage.includes("provider") || lowerMessage.includes("oauth")) return AuthErrorCode.OAuthProviderNotSupported;
+      if (lowerMessage.includes("phone")) return AuthErrorCode.PhoneProviderDisabled;
+      if (lowerMessage.includes("sso")) return AuthErrorCode.SsoProviderDisabled;
+      return AuthErrorCode.FeatureNotSupported;
+    case 501:
+      return AuthErrorCode.NotImplemented;
+    case 503:
+      return AuthErrorCode.FeatureNotSupported;
+    default:
+      if (lowerMessage.includes("oauth")) return AuthErrorCode.OAuthCallbackFailed;
+      return AuthErrorCode.UnexpectedFailure;
+  }
+}
+function mapMessageToErrorCode(message) {
+  const lower = message.toLowerCase();
+  if (lower.includes("invalid login") || lower.includes("incorrect") || lower.includes("wrong password")) return AuthErrorCode.InvalidCredentials;
+  if (lower.includes("token") && (lower.includes("invalid") || lower.includes("expired"))) return AuthErrorCode.BadJwt;
+  if (lower.includes("session") && lower.includes("expired")) return AuthErrorCode.SessionExpired;
+  if (lower.includes("session") && lower.includes("not found")) return AuthErrorCode.SessionNotFound;
+  if (lower.includes("already exists") || lower.includes("already registered")) return AuthErrorCode.UserAlreadyExists;
+  if (lower.includes("not found") && lower.includes("user")) return AuthErrorCode.UserNotFound;
+  if (lower.includes("not found") && lower.includes("identity")) return AuthErrorCode.IdentityNotFound;
+  if (lower.includes("email") && lower.includes("not confirmed")) return AuthErrorCode.EmailNotConfirmed;
+  if (lower.includes("phone") && lower.includes("not confirmed")) return AuthErrorCode.PhoneNotConfirmed;
+  if (lower.includes("weak password") || lower.includes("password") && lower.includes("requirements")) return AuthErrorCode.WeakPassword;
+  if (lower.includes("email") && lower.includes("invalid")) return AuthErrorCode.EmailAddressInvalid;
+  if (lower.includes("rate limit") || lower.includes("too many requests")) return AuthErrorCode.OverRequestRateLimit;
+  if (lower.includes("oauth") && lower.includes("failed")) return AuthErrorCode.OAuthCallbackFailed;
+  if (lower.includes("provider") && lower.includes("not supported")) return AuthErrorCode.OAuthProviderNotSupported;
+  return AuthErrorCode.UnexpectedFailure;
+}
+function createNormalizedError(message, targetStatus, code, _originalStatus) {
+  const status = targetStatus;
+  if (status !== 500 && status !== 501 && status !== 503) return new AuthApiError(message, status, code);
+  return new AuthError(message, status, code);
+}
+
+export {
+  SESSION_CACHE_TTL_MS,
+  CLOCK_SKEW_BUFFER_MS,
+  NEON_AUTH_SESSION_VERIFIER_PARAM_NAME,
+  NEON_AUTH_POPUP_PARAM_NAME,
+  NEON_AUTH_POPUP_CALLBACK_PARAM_NAME,
+  NEON_AUTH_POPUP_CALLBACK_ROUTE,
+  OAUTH_POPUP_MESSAGE_TYPE,
+  normalizeBetterAuthError
+};

package/dist/chunk-ESAV545E.js

@@ -0,0 +1,12 @@
+// src/env.ts
+function env(name) {
+  const value = process.env[name];
+  if (!value) {
+    throw new Error(`${name} is not set. WebTwizz sets it on sites that have WebTwizz Cloud (Settings > Cloud).`);
+  }
+  return value;
+}
+
+export {
+  env
+};

package/dist/chunk-G54JBUO3.js

@@ -0,0 +1,53 @@
+// src/errors.ts
+var TRY_LATER = "Sign-in isn't working right now. Please try again in a minute.";
+var TOO_MANY = "Too many tries. Wait a minute and try again.";
+var AUTH_MESSAGES = {
+  INVALID_EMAIL_OR_PASSWORD: "That email or password doesn't match.",
+  INVALID_PASSWORD: "That password doesn't match.",
+  INVALID_EMAIL: "That email doesn't look right.",
+  USER_NOT_FOUND: "There's no account with that email.",
+  USER_ALREADY_EXISTS: "There's already an account with that email.",
+  USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL: "There's already an account with that email.",
+  PASSWORD_TOO_SHORT: "Use at least 8 characters for the password.",
+  PASSWORD_TOO_LONG: "That password is too long.",
+  EMAIL_NOT_VERIFIED: "Confirm your email first: check your inbox for the code.",
+  EMAIL_ALREADY_VERIFIED: "Your email is already confirmed. You can sign in.",
+  EMAIL_MISMATCH: "That email doesn't match this account.",
+  EMAIL_CAN_NOT_BE_UPDATED: "The email on this account can't be changed.",
+  CHANGE_EMAIL_DISABLED: "The email on this account can't be changed.",
+  INVALID_OTP: "That code isn't right. Check it and try again.",
+  OTP_EXPIRED: "That code has expired. Ask for a new one.",
+  INVALID_TOKEN: "That link isn't valid anymore. Ask for a new one.",
+  TOKEN_EXPIRED: "That link has expired. Ask for a new one.",
+  TOO_MANY_ATTEMPTS: TOO_MANY,
+  BANNED_USER: "This account can't sign in.",
+  SESSION_EXPIRED: "You were signed out. Please sign in again.",
+  SESSION_NOT_FRESH: "For your security, sign in again to do this.",
+  CREDENTIAL_ACCOUNT_NOT_FOUND: "This account doesn't have a password yet.",
+  USER_ALREADY_HAS_PASSWORD: "This account already has a password.",
+  PASSWORD_ALREADY_SET: "This account already has a password.",
+  FAILED_TO_UNLINK_LAST_ACCOUNT: "You can't remove your only way to sign in.",
+  SOCIAL_ACCOUNT_ALREADY_LINKED: "That account is already connected.",
+  LINKED_ACCOUNT_ALREADY_EXISTS: "That account is already connected.",
+  MISSING_FIELD: "Fill in every field and try again.",
+  VALIDATION_ERROR: "Check what you entered and try again.",
+  FIELD_NOT_ALLOWED: "Check what you entered and try again."
+};
+function authMessage(error, overrides = {}) {
+  if (error?.status === 429) return overrides.TOO_MANY_ATTEMPTS ?? TOO_MANY;
+  const code = error?.code;
+  return code && (overrides[code] ?? AUTH_MESSAGES[code]) || TRY_LATER;
+}
+var MESSAGES = {
+  unavailable: "This isn't available right now. Please try again later.",
+  saveFailed: "Couldn't save right now. Please try again later.",
+  uploadsPaused: "Uploads are paused right now. Please try again later.",
+  fileType: "That type of file can't be uploaded here.",
+  fileTooLarge: (mb) => `That file is too big. The limit is ${mb} MB.`
+};
+
+export {
+  AUTH_MESSAGES,
+  authMessage,
+  MESSAGES
+};

package/dist/client.d.ts

@@ -0,0 +1,6 @@
+import { createAuthClient as createAuthClient$1 } from '@neondatabase/auth/next';
+
+type AuthClient = ReturnType<typeof createAuthClient$1>;
+declare function createAuthClient(): AuthClient;
+
+export { type AuthClient, createAuthClient };