@webtwizz/cloud 0.0.0-stage → 0.2.0

package/dist/client.js

@@ -0,0 +1,793 @@
+import {
+  CLOCK_SKEW_BUFFER_MS,
+  NEON_AUTH_POPUP_CALLBACK_PARAM_NAME,
+  NEON_AUTH_POPUP_CALLBACK_ROUTE,
+  NEON_AUTH_POPUP_PARAM_NAME,
+  NEON_AUTH_SESSION_VERIFIER_PARAM_NAME,
+  OAUTH_POPUP_MESSAGE_TYPE,
+  SESSION_CACHE_TTL_MS,
+  normalizeBetterAuthError
+} from "./chunk-7EXXDRMF.js";
+
+// node_modules/@neondatabase/auth/dist/adapter-core-CZ8saNEY.mjs
+import { getGlobalBroadcastChannel } from "better-auth/client";
+import { adminClient, emailOTPClient, jwtClient, magicLinkClient, organizationClient, phoneNumberClient } from "better-auth/client/plugins";
+import z from "zod";
+var InFlightRequestManager = class {
+  /**
+  * Map of request keys to in-flight Promises.
+  * Automatically cleared after Promise resolution (success or error).
+  */
+  inFlightRequests = /* @__PURE__ */ new Map();
+  /**
+  * Execute function with deduplication.
+  *
+  * If request with same key is in-flight, returns existing Promise.
+  * Otherwise, executes fn and tracks the Promise.
+  *
+  * @param key - Unique identifier for this request (e.g., "getSession")
+  * @param fn - Async function to execute (only called if no in-flight request exists)
+  * @returns Promise that resolves to the function result
+  *
+  * @example
+  * ```typescript
+  * // First call: Executes fetchSession(), tracks Promise
+  * const result1 = await manager.deduplicate('getSession', fetchSession);
+  *
+  * // Concurrent call: Returns existing Promise (no fetchSession() call)
+  * const result2 = await manager.deduplicate('getSession', fetchSession);
+  *
+  * // Both results are identical (same object reference)
+  * console.log(result1 === result2); // true
+  * ```
+  */
+  async deduplicate(key, fn) {
+    const existing = this.inFlightRequests.get(key);
+    if (existing) return existing;
+    const promise = fn().finally(() => {
+      this.inFlightRequests.delete(key);
+    });
+    this.inFlightRequests.set(key, promise);
+    return promise;
+  }
+  /**
+  * Clear specific in-flight request.
+  *
+  * Useful for forced refresh or cache invalidation scenarios.
+  * Next call with same key will execute fresh request.
+  *
+  * @param key - Request key to clear
+  */
+  clear(key) {
+    this.inFlightRequests.delete(key);
+  }
+  /**
+  * Clear all in-flight requests.
+  *
+  * Useful for cleanup on sign-out or reset scenarios.
+  */
+  clearAll() {
+    this.inFlightRequests.clear();
+  }
+  /**
+  * Check if request is in-flight.
+  *
+  * @param key - Request key to check
+  * @returns True if request is currently in-flight
+  */
+  has(key) {
+    return this.inFlightRequests.has(key);
+  }
+  /**
+  * Get count of in-flight requests (for debugging/testing).
+  *
+  * @returns Number of currently tracked requests
+  */
+  size() {
+    return this.inFlightRequests.size;
+  }
+};
+function getJwtExpiration(jwt) {
+  try {
+    const parts = jwt.split(".");
+    if (parts.length !== 3) return null;
+    const exp = JSON.parse(atob(parts[1])).exp;
+    return typeof exp === "number" ? exp : null;
+  } catch {
+    return null;
+  }
+}
+var TokenCache = class {
+  cache = null;
+  /**
+  * Get cached data if not expired.
+  * Returns null if cache is empty or expired.
+  */
+  get() {
+    if (!this.cache) return null;
+    if (Date.now() > this.cache.expiresAt) {
+      this.cache = null;
+      return null;
+    }
+    return this.cache.data;
+  }
+  /**
+  * Set cached data with TTL.
+  * If jwt is provided, TTL is calculated from its expiration.
+  * Otherwise, uses default SESSION_CACHE_TTL_MS.
+  */
+  set(data, jwt) {
+    const ttl = this.calculateTTL(jwt);
+    this.cache = {
+      data,
+      expiresAt: Date.now() + ttl
+    };
+  }
+  /**
+  * Clear the cache.
+  */
+  clear() {
+    this.cache = null;
+  }
+  /**
+  * Check if cache has valid (non-expired) data.
+  */
+  has() {
+    return this.get() !== null;
+  }
+  /**
+  * Calculate cache TTL from JWT expiration.
+  * Falls back to default TTL if JWT is invalid or missing.
+  */
+  calculateTTL(jwt) {
+    if (!jwt) return SESSION_CACHE_TTL_MS;
+    const exp = getJwtExpiration(jwt);
+    if (!exp) return SESSION_CACHE_TTL_MS;
+    const now = Date.now();
+    const ttl = exp * 1e3 - now - CLOCK_SKEW_BUFFER_MS;
+    return Math.max(ttl, 1e3);
+  }
+};
+var SessionCacheManager = class {
+  cache = new TokenCache();
+  lastSessionData = null;
+  invalidated = false;
+  /**
+  * Get cached session if valid and not expired.
+  * Returns null if cache is invalid, expired, or doesn't exist.
+  */
+  getCachedSession() {
+    if (this.invalidated) return null;
+    return this.cache.get();
+  }
+  /**
+  * Set cached session with JWT-based TTL.
+  * Skips caching if cache was invalidated (sign-out scenario).
+  */
+  setCachedSession(data) {
+    if (this.invalidated) return;
+    this.lastSessionData = this.cache.get();
+    this.cache.set(data, data.session.token);
+  }
+  /**
+  * Invalidate cache (marks as invalid but doesn't clear).
+  * Useful for sign-out scenarios where in-flight requests should not cache.
+  */
+  invalidateSessionCache() {
+    this.invalidated = true;
+  }
+  /**
+  * Clear cache completely.
+  */
+  clearSessionCache() {
+    this.cache.clear();
+    this.lastSessionData = null;
+    this.invalidated = false;
+  }
+  /**
+  * Check if token was refreshed by comparing tokens with previous session.
+  * Returns true if tokens differ (token was refreshed), false otherwise.
+  */
+  wasTokenRefreshed(data) {
+    if (!this.lastSessionData?.session?.token || !data?.session?.token) return false;
+    return this.lastSessionData.session.token !== data.session.token;
+  }
+};
+var AnonymousTokenCacheManager = class {
+  cache = new TokenCache();
+  /**
+  * Get cached anonymous token response if not expired.
+  * Returns null if cache is empty or expired.
+  */
+  getCachedResponse() {
+    return this.cache.get();
+  }
+  /**
+  * Set cached anonymous token response with JWT-based TTL.
+  * TTL is automatically calculated from the JWT expiration.
+  */
+  setCachedResponse(data) {
+    this.cache.set(data, data.token);
+  }
+  /**
+  * Clear the cache.
+  */
+  clearCache() {
+    this.cache.clear();
+  }
+  /**
+  * Check if cache has a valid (non-expired) response.
+  */
+  hasCachedResponse() {
+    return this.cache.has();
+  }
+};
+async function openOAuthPopup(url) {
+  const timeout = 12e4;
+  const pollInterval = 500;
+  return new Promise((resolve, reject) => {
+    const popup = globalThis.open(url, "neon_oauth_popup", "width=500,height=700,popup=yes");
+    if (!popup || popup.closed) {
+      reject(/* @__PURE__ */ new Error("Popup blocked. Please allow popups for this site."));
+      return;
+    }
+    const timeoutId = setTimeout(() => {
+      cleanup();
+      try {
+        popup.close();
+      } catch {
+      }
+      reject(/* @__PURE__ */ new Error("OAuth popup timed out. Please try again."));
+    }, timeout);
+    const pollId = setInterval(() => {
+      try {
+        if (popup.closed) {
+          cleanup();
+          reject(/* @__PURE__ */ new Error("OAuth popup was closed. Please try again."));
+        }
+      } catch {
+      }
+    }, pollInterval);
+    function cleanup() {
+      clearTimeout(timeoutId);
+      clearInterval(pollId);
+      globalThis.removeEventListener("message", handleMessage);
+    }
+    function handleMessage(event) {
+      if (event.origin !== globalThis.location.origin) return;
+      if (event.data?.type !== OAUTH_POPUP_MESSAGE_TYPE) return;
+      cleanup();
+      resolve({ verifier: event.data.verifier || null });
+    }
+    globalThis.addEventListener("message", handleMessage);
+  });
+}
+var isBrowser = () => {
+  return globalThis.window !== void 0 && typeof document !== "undefined";
+};
+var isIframe = () => {
+  if (!isBrowser()) return false;
+  try {
+    return globalThis.self !== globalThis.top;
+  } catch {
+    return true;
+  }
+};
+var ANONYMOUS_TOKEN_ENDPOINT = "/token/anonymous";
+var anonymousTokenResponseSchema = z.object({
+  token: z.string(),
+  expires_at: z.number()
+});
+var anonymousTokenClient = () => {
+  return {
+    id: "anonymous-token",
+    pathMethods: { [ANONYMOUS_TOKEN_ENDPOINT]: "GET" },
+    getActions: ($fetch) => {
+      return { getAnonymousToken: async (fetchOptions) => {
+        return await $fetch(ANONYMOUS_TOKEN_ENDPOINT, {
+          method: "GET",
+          ...fetchOptions
+        });
+      } };
+    }
+  };
+};
+var CURRENT_TAB_CLIENT_ID = crypto.randomUUID();
+var BETTER_AUTH_METHODS_IN_FLIGHT_REQUESTS = new InFlightRequestManager();
+var BETTER_AUTH_METHODS_CACHE = new SessionCacheManager();
+var BETTER_AUTH_ANONYMOUS_TOKEN_CACHE = new AnonymousTokenCacheManager();
+var BETTER_AUTH_ENDPOINTS = {
+  signUp: "/sign-up",
+  signIn: "/sign-in",
+  signOut: "/sign-out",
+  updateUser: "/update-user",
+  getSession: "/get-session",
+  token: "/token",
+  anonymousSignIn: "/sign-in/anonymous",
+  anonymousToken: "/token/anonymous"
+};
+async function handleSocialSignInViaPopup(input, init) {
+  const body = JSON.parse(init?.body || "{}");
+  const originalCallbackURL = body.callbackURL || "/";
+  const popupCallbackUrl = new URL(NEON_AUTH_POPUP_CALLBACK_ROUTE, globalThis.location.origin);
+  popupCallbackUrl.searchParams.set(NEON_AUTH_POPUP_PARAM_NAME, "1");
+  popupCallbackUrl.searchParams.set(NEON_AUTH_POPUP_CALLBACK_PARAM_NAME, originalCallbackURL);
+  body.callbackURL = popupCallbackUrl.toString();
+  body.disableRedirect = true;
+  const response = await fetch(input, {
+    ...init,
+    body: JSON.stringify(body)
+  });
+  const data = await response.json();
+  const oauthUrl = data.url;
+  if (!oauthUrl) throw new Error("Failed to get OAuth URL");
+  const popupResult = await openOAuthPopup(oauthUrl);
+  if (!popupResult.verifier) throw new Error("OAuth completed but no session verifier received");
+  const navigationUrl = new URL(originalCallbackURL, globalThis.location.origin);
+  navigationUrl.searchParams.set(NEON_AUTH_SESSION_VERIFIER_PARAM_NAME, popupResult.verifier);
+  globalThis.location.href = navigationUrl.toString();
+  return Response.json(data, { status: response.status });
+}
+var BETTER_AUTH_METHODS_HOOKS = {
+  signUp: {
+    onRequest: () => {
+    },
+    onSuccess: (responseData) => {
+      if (isSessionResponseData(responseData)) {
+        const sessionData = {
+          session: responseData.session,
+          user: responseData.user
+        };
+        BETTER_AUTH_METHODS_CACHE.setCachedSession(sessionData);
+        emitAuthEvent({
+          type: "SIGN_IN",
+          data: sessionData
+        });
+      }
+    }
+  },
+  signIn: {
+    beforeFetch: (input, init) => {
+      if (!(typeof input === "string" ? input : input.toString()).includes("/sign-in/social") || !isIframe()) return null;
+      return handleSocialSignInViaPopup(input, init);
+    },
+    onRequest: () => {
+    },
+    onSuccess: (responseData) => {
+      if (isSessionResponseData(responseData)) {
+        const sessionData = {
+          session: responseData.session,
+          user: responseData.user
+        };
+        BETTER_AUTH_METHODS_CACHE.setCachedSession(sessionData);
+        emitAuthEvent({
+          type: "SIGN_IN",
+          data: sessionData
+        });
+      }
+    }
+  },
+  signOut: {
+    onRequest: () => {
+      BETTER_AUTH_METHODS_CACHE.invalidateSessionCache();
+      BETTER_AUTH_METHODS_IN_FLIGHT_REQUESTS.clearAll();
+    },
+    onSuccess: () => {
+      BETTER_AUTH_METHODS_CACHE.clearSessionCache();
+      emitAuthEvent({ type: "SIGN_OUT" });
+    }
+  },
+  updateUser: {
+    onRequest: () => {
+    },
+    onSuccess: (responseData) => {
+      if (isSessionResponseData(responseData)) {
+        const sessionData = {
+          session: responseData.session,
+          user: responseData.user
+        };
+        BETTER_AUTH_METHODS_CACHE.setCachedSession(sessionData);
+        emitAuthEvent({
+          type: "USER_UPDATE",
+          data: sessionData
+        });
+      } else {
+        BETTER_AUTH_METHODS_CACHE.clearSessionCache();
+        emitAuthEvent({ type: "USER_UPDATE" });
+      }
+    }
+  },
+  getSession: {
+    beforeFetch: () => {
+      if (isBrowser()) {
+        if (new URLSearchParams(globalThis.window.location.search).has(NEON_AUTH_SESSION_VERIFIER_PARAM_NAME)) return null;
+      }
+      const cachedData = BETTER_AUTH_METHODS_CACHE.getCachedSession();
+      if (!cachedData) return null;
+      return Response.json(cachedData, { status: 200 });
+    },
+    onRequest: (ctx) => {
+      if (!isBrowser()) return;
+      const neonAuthSessionVerifierParam = new URLSearchParams(globalThis.window.location.search).get(NEON_AUTH_SESSION_VERIFIER_PARAM_NAME);
+      if (neonAuthSessionVerifierParam) {
+        const url = typeof ctx.url === "string" ? new URL(ctx.url) : ctx.url;
+        url.searchParams.set(NEON_AUTH_SESSION_VERIFIER_PARAM_NAME, neonAuthSessionVerifierParam);
+        return {
+          ...ctx,
+          url
+        };
+      }
+    },
+    onSuccess: (responseData) => {
+      if (isSessionResponseData(responseData)) {
+        const sessionData = {
+          session: responseData.session,
+          user: responseData.user
+        };
+        const wasRefreshed = BETTER_AUTH_METHODS_CACHE.wasTokenRefreshed(sessionData);
+        BETTER_AUTH_METHODS_CACHE.setCachedSession(sessionData);
+        if (wasRefreshed) emitAuthEvent({
+          type: "TOKEN_REFRESH",
+          data: sessionData
+        });
+        if (isBrowser()) {
+          const url = new URL(globalThis.window.location.href);
+          if (url.searchParams.get(NEON_AUTH_SESSION_VERIFIER_PARAM_NAME)) {
+            url.searchParams.delete(NEON_AUTH_SESSION_VERIFIER_PARAM_NAME);
+            history.replaceState(history.state, "", url.href);
+          }
+        }
+      }
+    }
+  },
+  anonymousToken: {
+    beforeFetch: () => {
+      const cachedResponse = BETTER_AUTH_ANONYMOUS_TOKEN_CACHE.getCachedResponse();
+      if (!cachedResponse) return null;
+      return Response.json(cachedResponse, { status: 200 });
+    },
+    onRequest: () => {
+    },
+    onSuccess: (responseData) => {
+      const parsed = anonymousTokenResponseSchema.safeParse(responseData);
+      if (parsed.success) BETTER_AUTH_ANONYMOUS_TOKEN_CACHE.setCachedResponse(parsed.data);
+    }
+  }
+};
+async function emitAuthEvent(event) {
+  const eventType = mapToEventType(event);
+  const sessionData = "data" in event ? event.data : null;
+  const trigger = mapToTrigger(event);
+  if (trigger) getGlobalBroadcastChannel().post({
+    event: "session",
+    data: { trigger },
+    clientId: CURRENT_TAB_CLIENT_ID
+  });
+  getGlobalBroadcastChannel().post({
+    event: "session",
+    data: {
+      trigger: eventType,
+      sessionData
+    },
+    clientId: CURRENT_TAB_CLIENT_ID
+  });
+}
+function mapToEventType(event) {
+  switch (event.type) {
+    case "SIGN_IN":
+      return "SIGNED_IN";
+    case "SIGN_OUT":
+      return "SIGNED_OUT";
+    case "TOKEN_REFRESH":
+      return "TOKEN_REFRESHED";
+    case "USER_UPDATE":
+      return "USER_UPDATED";
+  }
+}
+function mapToTrigger(event) {
+  switch (event.type) {
+    case "SIGN_OUT":
+      return "signout";
+    case "TOKEN_REFRESH":
+      return null;
+    case "USER_UPDATE":
+      return "updateUser";
+    case "SIGN_IN":
+      return null;
+  }
+}
+function isSessionResponseData(responseData) {
+  return Boolean(responseData && typeof responseData === "object" && "session" in responseData && "user" in responseData && responseData.session !== null && responseData.user !== null);
+}
+function deriveBetterAuthMethodFromUrl(url) {
+  if (url.includes("/sign-in/anonymous")) return "anonymousSignIn";
+  if (url.includes(BETTER_AUTH_ENDPOINTS.anonymousToken)) return "anonymousToken";
+  if (url.includes(BETTER_AUTH_ENDPOINTS.signIn)) return "signIn";
+  if (url.includes(BETTER_AUTH_ENDPOINTS.signUp)) return "signUp";
+  if (url.includes(BETTER_AUTH_ENDPOINTS.signOut)) return "signOut";
+  if (url.includes(BETTER_AUTH_ENDPOINTS.updateUser)) return "updateUser";
+  if (url.includes(BETTER_AUTH_ENDPOINTS.getSession) || url.includes(BETTER_AUTH_ENDPOINTS.token)) return "getSession";
+}
+function initBroadcastChannel() {
+  if (isBrowser() && globalThis.opener && globalThis.opener !== globalThis) {
+    const params = new URLSearchParams(globalThis.location.search);
+    if (params.has(NEON_AUTH_POPUP_PARAM_NAME)) {
+      const verifier = params.get(NEON_AUTH_SESSION_VERIFIER_PARAM_NAME);
+      const originalCallback = params.get(NEON_AUTH_POPUP_CALLBACK_PARAM_NAME);
+      globalThis.opener.postMessage({
+        type: OAUTH_POPUP_MESSAGE_TYPE,
+        verifier,
+        originalCallback
+      }, "*");
+      globalThis.close();
+      return;
+    }
+  }
+  getGlobalBroadcastChannel().subscribe((message) => {
+    if (message.clientId === CURRENT_TAB_CLIENT_ID) return;
+    const trigger = message.data?.trigger;
+    if (trigger === "signout" || trigger === "updateUser" || trigger === "getSession") BETTER_AUTH_METHODS_CACHE.clearSessionCache();
+  });
+}
+var name = "@webtwizz/cloud";
+var version = "0.5.0-beta";
+var X_NEON_CLIENT_INFO_HEADER = "X-WebTwizz-Client-Info";
+function hasGlobalProperty(key) {
+  return key in globalThis;
+}
+function detectFramework() {
+  if (typeof process !== "undefined" && process.env && (process.env.NEXT_RUNTIME || process.env.__NEXT_PRIVATE_ORIGIN)) return "next";
+  if (typeof globalThis.window !== "undefined") {
+    if (hasGlobalProperty("__NEXT_DATA__")) return "next";
+    if (hasGlobalProperty("__remixContext")) return "remix";
+    if (hasGlobalProperty("__REACT_DEVTOOLS_GLOBAL_HOOK__")) return "react";
+    if (hasGlobalProperty("__VUE__")) return "vue";
+    if (hasGlobalProperty("Zone")) return "angular";
+  }
+}
+function getClientInfo(sdkName, sdkVersion) {
+  const base = {
+    sdk: sdkName,
+    version: sdkVersion,
+    runtime: "unknown",
+    runtimeVersion: "unknown",
+    platform: "unknown",
+    arch: "unknown"
+  };
+  let result;
+  if (typeof process !== "undefined" && process.versions?.node) result = {
+    ...base,
+    runtime: "node",
+    runtimeVersion: process.versions.node,
+    platform: process.platform,
+    arch: process.arch
+  };
+  else if (typeof Deno !== "undefined") result = {
+    ...base,
+    runtime: "deno",
+    runtimeVersion: Deno.version?.deno ?? "unknown",
+    platform: Deno.build?.os ?? "unknown",
+    arch: Deno.build?.arch ?? "unknown"
+  };
+  else if (typeof Bun !== "undefined") result = {
+    ...base,
+    runtime: "bun",
+    runtimeVersion: Bun.version ?? "unknown",
+    platform: process?.platform ?? "unknown",
+    arch: process?.arch ?? "unknown"
+  };
+  else if (typeof EdgeRuntime !== "undefined" || typeof process !== "undefined" && !process.versions?.node && typeof globalThis.window === "undefined" && typeof document === "undefined") result = {
+    ...base,
+    runtime: "edge"
+  };
+  else if (globalThis.window !== void 0 && typeof document !== "undefined") result = {
+    ...base,
+    runtime: "browser",
+    runtimeVersion: "unknown",
+    platform: "web",
+    arch: "unknown"
+  };
+  else result = base;
+  const framework = detectFramework();
+  if (framework) result.framework = framework;
+  return result;
+}
+function createClientInfoInjector(defaultSdkName, defaultSdkVersion) {
+  const cachedClientInfo = JSON.stringify(getClientInfo(defaultSdkName, defaultSdkVersion));
+  return function injectClientInfo$1(headers, sdkOverride) {
+    const result = new Headers(headers);
+    if (result.has(X_NEON_CLIENT_INFO_HEADER)) return result;
+    const clientInfoString = sdkOverride ? JSON.stringify(getClientInfo(sdkOverride.name, sdkOverride.version)) : cachedClientInfo;
+    result.set(X_NEON_CLIENT_INFO_HEADER, clientInfoString);
+    return result;
+  };
+}
+var injectClientInfo = createClientInfoInjector(name, version);
+var FORCE_FETCH_HEADER = "X-Force-Fetch";
+var supportedBetterAuthClientPlugins = [
+  jwtClient(),
+  adminClient(),
+  organizationClient(),
+  emailOTPClient(),
+  magicLinkClient(),
+  phoneNumberClient(),
+  anonymousTokenClient()
+];
+var NeonAuthAdapterCore = class {
+  betterAuthOptions;
+  /**
+  * Better Auth adapter implementing the NeonAuthClient interface.
+  * See CLAUDE.md for architecture details and API mappings.
+  */
+  constructor(betterAuthClientOptions) {
+    const userOnSuccess = betterAuthClientOptions.fetchOptions?.onSuccess;
+    const userOnRequest = betterAuthClientOptions.fetchOptions?.onRequest;
+    this.betterAuthOptions = {
+      ...betterAuthClientOptions,
+      plugins: supportedBetterAuthClientPlugins,
+      fetchOptions: {
+        ...betterAuthClientOptions.fetchOptions,
+        throw: false,
+        onRequest: (request) => {
+          const url = request.url;
+          const method = deriveBetterAuthMethodFromUrl(url.toString());
+          if (method) BETTER_AUTH_METHODS_HOOKS[method].onRequest(request);
+          userOnRequest?.(request);
+        },
+        customFetchImpl: async (url, init) => {
+          const headers = injectClientInfo(init?.headers);
+          if (headers.has(FORCE_FETCH_HEADER)) {
+            headers.delete(FORCE_FETCH_HEADER);
+            const response$1 = await fetch(url, {
+              ...init,
+              headers
+            });
+            if (!response$1.ok) {
+              const body = await response$1.clone().json().catch(() => ({}));
+              throw normalizeBetterAuthError({
+                status: response$1.status,
+                statusText: response$1.statusText,
+                message: body.message || `HTTP ${response$1.status} ${response$1.statusText}`,
+                code: body.code,
+                body
+              });
+            }
+            return response$1;
+          }
+          const betterAuthMethod = deriveBetterAuthMethodFromUrl(url.toString());
+          if (betterAuthMethod) {
+            const response$1 = await BETTER_AUTH_METHODS_HOOKS[betterAuthMethod].beforeFetch?.(url, init);
+            if (response$1) return response$1;
+          }
+          const key = `${init?.method || "GET"}:${url}:${init?.body || ""}`;
+          const response = await BETTER_AUTH_METHODS_IN_FLIGHT_REQUESTS.deduplicate(key, () => fetch(url, {
+            ...init,
+            headers
+          }));
+          if (!response.ok) {
+            const errorBody = await response.clone().json().catch(() => ({}));
+            throw normalizeBetterAuthError({
+              status: response.status,
+              statusText: response.statusText,
+              message: errorBody.message || `HTTP ${response.status} ${response.statusText}`,
+              code: errorBody.code,
+              body: errorBody
+            });
+          }
+          return response.clone();
+        },
+        onSuccess: async (ctx) => {
+          const jwt = ctx.response.headers.get("set-auth-jwt");
+          if (jwt) if (ctx.data?.session) ctx.data.session.token = jwt;
+          else console.warn("[onSuccess] JWT found but no session data to inject into!");
+          const url = ctx.request.url.toString();
+          const responseData = ctx.data;
+          const method = deriveBetterAuthMethodFromUrl(url);
+          if (method) BETTER_AUTH_METHODS_HOOKS[method].onSuccess(responseData);
+          await userOnSuccess?.(ctx);
+        }
+      }
+    };
+    initBroadcastChannel();
+  }
+  /**
+  * Get JWT token for authenticated or anonymous access.
+  * Single source of truth for token retrieval logic.
+  *
+  * @param allowAnonymous - When true, fetches anonymous token if no session exists
+  * @returns JWT token string or null if unavailable
+  */
+  async getJWTToken(allowAnonymous) {
+    const client = this.getBetterAuthInstance();
+    const session = await client.getSession();
+    if (session.data?.session?.token) return session.data.session.token;
+    if (allowAnonymous) return (await client.getAnonymousToken()).data?.token ?? null;
+    return null;
+  }
+};
+
+// node_modules/@neondatabase/auth/dist/better-auth-react-adapter-DMizSZtB.mjs
+import { createAuthClient } from "better-auth/react";
+var BetterAuthReactAdapterImpl = class extends NeonAuthAdapterCore {
+  _betterAuth;
+  constructor(betterAuthClientOptions) {
+    super(betterAuthClientOptions);
+    this._betterAuth = createAuthClient(this.betterAuthOptions);
+  }
+  getBetterAuthInstance() {
+    return this._betterAuth;
+  }
+};
+function BetterAuthReactAdapter(options) {
+  return (url, fetchOptions) => new BetterAuthReactAdapterImpl({
+    baseURL: url,
+    ...options,
+    fetchOptions: {
+      ...options?.fetchOptions,
+      headers: {
+        ...options?.fetchOptions?.headers,
+        ...fetchOptions?.headers
+      }
+    }
+  });
+}
+
+// node_modules/@neondatabase/auth/dist/supabase-adapter-CKXlmI3i.mjs
+import { createAuthClient as createAuthClient2, getGlobalBroadcastChannel as getGlobalBroadcastChannel2 } from "better-auth/client";
+import "@supabase/auth-js";
+import { base64url, decodeJwt, decodeProtectedHeader } from "jose";
+var BetterAuthVanillaAdapterImpl = class extends NeonAuthAdapterCore {
+  _betterAuth;
+  constructor(betterAuthClientOptions) {
+    super(betterAuthClientOptions);
+    this._betterAuth = createAuthClient2(this.betterAuthOptions);
+  }
+  getBetterAuthInstance() {
+    return this._betterAuth;
+  }
+};
+function BetterAuthVanillaAdapter(options) {
+  return (url, fetchOptions) => new BetterAuthVanillaAdapterImpl({
+    baseURL: url,
+    ...options,
+    fetchOptions: {
+      ...options?.fetchOptions,
+      headers: {
+        ...options?.fetchOptions?.headers,
+        ...fetchOptions?.headers
+      }
+    }
+  });
+}
+
+// node_modules/@neondatabase/auth/dist/neon-auth-BLCDc-bu.mjs
+function createInternalNeonAuth(url, config) {
+  const adapterBuilder = config?.adapter ?? BetterAuthVanillaAdapter();
+  const { fetchOptions } = config ?? {};
+  const adapter = adapterBuilder(url, fetchOptions);
+  const allowAnonymous = config?.allowAnonymous ?? false;
+  if (!(typeof adapter.initialize === "function")) return {
+    getJWTToken: () => adapter.getJWTToken(allowAnonymous),
+    adapter: adapter.getBetterAuthInstance()
+  };
+  return {
+    getJWTToken: () => adapter.getJWTToken(allowAnonymous),
+    adapter
+  };
+}
+function createAuthClient3(url, config) {
+  return createInternalNeonAuth(url, config).adapter;
+}
+
+// node_modules/@neondatabase/auth/dist/next/index.mjs
+function createAuthClient4() {
+  return createAuthClient3(void 0, { adapter: BetterAuthReactAdapter() });
+}
+
+// src/client.ts
+function createAuthClient5() {
+  return createAuthClient4();
+}
+export {
+  createAuthClient5 as createAuthClient
+};