@xk2800/nextjs-template 0.5.3

package/dist/chunk-2FW7C3KS.mjs

@@ -0,0 +1,556 @@
+import { logActivity } from './chunk-K6OJCSJS.mjs';
+import { getClientIp, parseUserAgent, lookupGeoLocation, formatLocation, formatDeviceInfo, WINDOW_MS, isOverLimit, MAX_IP } from './chunk-N6ECRCHY.mjs';
+import { getEffectiveAuthFlags } from './chunk-JIYHBWAU.mjs';
+import { db } from './chunk-HYKUB3A2.mjs';
+import { users, sessions, passkeys, twoFactors, verifications, accounts, authThrottle } from './chunk-ENGYO4K7.mjs';
+import { config } from './chunk-GTPTVNY2.mjs';
+import { __spreadValues, __spreadProps, __require } from './chunk-YN4436PK.mjs';
+import 'server-only';
+import { betterAuth } from 'better-auth';
+import { drizzleAdapter } from 'better-auth/adapters/drizzle';
+import { eq, sql } from 'drizzle-orm';
+import bcrypt from 'bcrypt';
+import { oneTap, admin, twoFactor } from 'better-auth/plugins';
+import { passkey } from 'better-auth/plugins/passkey';
+import { createAuthMiddleware, APIError, getSessionFromCtx } from 'better-auth/api';
+import { Resend } from 'resend';
+import { Html, Head, Tailwind, Body, Container, Section, Heading, Text, Button, Link } from '@react-email/components';
+import { jsxs, jsx } from 'react/jsx-runtime';
+
+// lib/cookie-names.ts
+var LOGIN_REFERRER_COOKIE = "login_referrer";
+var DEVICE_FINGERPRINT_HEADER = "x-device-fingerprint";
+async function isDeviceThrottled(fingerprint, max) {
+  try {
+    const [row] = await db.select({ count: authThrottle.count, windowStart: authThrottle.windowStart }).from(authThrottle).where(eq(authThrottle.fingerprint, fingerprint)).limit(1);
+    return isOverLimit(row, Date.now(), max);
+  } catch (error) {
+    console.error("auth-throttle read failed, allowing request", error);
+    return false;
+  }
+}
+async function recordDeviceAttempt(fingerprint, meta) {
+  const now = /* @__PURE__ */ new Date();
+  const cutoff = new Date(now.getTime() - WINDOW_MS);
+  const seen = {
+    lastAttemptAt: now,
+    ipAddress: meta.ipAddress,
+    userAgent: meta.userAgent,
+    lastEmail: meta.email,
+    lastKind: meta.kind
+  };
+  try {
+    await db.insert(authThrottle).values(__spreadValues({ fingerprint, count: 1, windowStart: now }, seen)).onConflictDoUpdate({
+      target: authThrottle.fingerprint,
+      set: __spreadValues({
+        count: sql`case when ${authThrottle.windowStart} < ${cutoff} then 1 else ${authThrottle.count} + 1 end`,
+        windowStart: sql`case when ${authThrottle.windowStart} < ${cutoff} then ${now} else ${authThrottle.windowStart} end`
+      }, seen)
+    });
+  } catch (error) {
+    console.error("auth-throttle write failed", error);
+  }
+}
+async function clearDeviceThrottle(fingerprint) {
+  try {
+    await db.delete(authThrottle).where(eq(authThrottle.fingerprint, fingerprint));
+  } catch (error) {
+    console.error("auth-throttle clear failed", error);
+  }
+}
+var EMAIL_FROM = "Acme <onboarding@xavierkhew.xyz>";
+var resend;
+function getResend() {
+  if (!resend) resend = new Resend(config.RESEND_API_KEY);
+  return resend;
+}
+function EmailTemplateResetPassword({ firstName, url }) {
+  return /* @__PURE__ */ jsxs(Html, { children: [
+    /* @__PURE__ */ jsx(Head, {}),
+    /* @__PURE__ */ jsx(Body, { style: { backgroundColor: "#ffffff", fontFamily: "Arial, sans-serif" }, children: /* @__PURE__ */ jsx(Container, { style: { margin: "0 auto", padding: "20px 0 48px", maxWidth: "560px" }, children: /* @__PURE__ */ jsxs(Section, { style: { backgroundColor: "#f8f9fa", borderRadius: "12px", padding: "40px", textAlign: "center" }, children: [
+      /* @__PURE__ */ jsx(Heading, { style: { fontSize: "28px", fontWeight: "bold", marginBottom: "12px", color: "#1a1a1a" }, children: "Reset your password" }),
+      /* @__PURE__ */ jsxs(Text, { style: { fontSize: "16px", color: "#666666", marginBottom: "32px", lineHeight: "24px" }, children: [
+        "Hi ",
+        firstName,
+        ", we got a request to reset your password. This link expires in an hour \u2014 if you didn't ask for this, you can safely ignore this email."
+      ] }),
+      /* @__PURE__ */ jsx(Section, { style: { marginBottom: "32px" }, children: /* @__PURE__ */ jsx(
+        Button,
+        {
+          href: url,
+          style: {
+            backgroundColor: "#000000",
+            color: "#ffffff",
+            padding: "12px 32px",
+            borderRadius: "6px",
+            textDecoration: "none",
+            fontSize: "16px",
+            fontWeight: "bold"
+          },
+          children: "Reset password"
+        }
+      ) }),
+      /* @__PURE__ */ jsxs(Text, { style: { fontSize: "13px", color: "#999999", lineHeight: "20px", wordBreak: "break-all" }, children: [
+        "Or paste this link into your browser:",
+        /* @__PURE__ */ jsx("br", {}),
+        /* @__PURE__ */ jsx("a", { href: url, style: { color: "#000000", textDecoration: "underline" }, children: url })
+      ] })
+    ] }) }) })
+  ] });
+}
+function EmailTemplateVerifyEmail({ firstName, url }) {
+  return /* @__PURE__ */ jsxs(Html, { children: [
+    /* @__PURE__ */ jsx(Head, {}),
+    /* @__PURE__ */ jsx(Tailwind, { children: /* @__PURE__ */ jsx(Body, { className: "bg-white font-sans", children: /* @__PURE__ */ jsx(Container, { className: "mx-auto max-w-[560px] px-0 pt-5 pb-12", children: /* @__PURE__ */ jsxs(Section, { className: "rounded-xl bg-[#f8f9fa] p-10 text-center", children: [
+      /* @__PURE__ */ jsx(Heading, { className: "mb-3 text-[28px] font-bold text-[#1a1a1a]", children: "Confirm your email" }),
+      /* @__PURE__ */ jsxs(Text, { className: "mb-8 text-base leading-6 text-[#666666]", children: [
+        "Hi ",
+        firstName,
+        ", click the button below to verify this email address. If you didn't create an account, you can safely ignore this email."
+      ] }),
+      /* @__PURE__ */ jsx(Section, { className: "mb-8", children: /* @__PURE__ */ jsx(
+        Button,
+        {
+          href: url,
+          className: "rounded-md bg-black px-8 py-3 text-base font-bold text-white no-underline",
+          children: "Verify email"
+        }
+      ) }),
+      /* @__PURE__ */ jsxs(Text, { className: "text-[13px] leading-5 break-all text-[#999999]", children: [
+        "Or paste this link into your browser:",
+        /* @__PURE__ */ jsx("br", {}),
+        /* @__PURE__ */ jsx(Link, { href: url, className: "text-black underline", children: url })
+      ] })
+    ] }) }) }) })
+  ] });
+}
+function EmailTemplatePasskeyChange({
+  firstName,
+  action,
+  device,
+  location,
+  ipAddress,
+  when,
+  manageUrl
+}) {
+  const verb = action === "added" ? "added to" : "removed from";
+  return /* @__PURE__ */ jsxs(Html, { children: [
+    /* @__PURE__ */ jsx(Head, {}),
+    /* @__PURE__ */ jsx(Tailwind, { children: /* @__PURE__ */ jsx(Body, { className: "bg-white font-sans", children: /* @__PURE__ */ jsx(Container, { className: "mx-auto max-w-[560px] px-0 pt-5 pb-12", children: /* @__PURE__ */ jsxs(Section, { className: "rounded-xl bg-[#f8f9fa] p-10", children: [
+      /* @__PURE__ */ jsxs(Heading, { className: "mb-3 text-center text-2xl font-bold text-[#1a1a1a]", children: [
+        "A passkey was ",
+        action
+      ] }),
+      /* @__PURE__ */ jsxs(Text, { className: "mb-6 text-base leading-6 text-[#666666]", children: [
+        "Hi ",
+        firstName,
+        ", a passkey was just ",
+        verb,
+        " your account."
+      ] }),
+      /* @__PURE__ */ jsxs(Section, { className: "mb-6 rounded-lg bg-white p-5", children: [
+        /* @__PURE__ */ jsxs(Text, { className: "m-0 mb-2 text-sm leading-5 text-[#1a1a1a]", children: [
+          /* @__PURE__ */ jsx("strong", { children: "Device:" }),
+          " ",
+          device
+        ] }),
+        /* @__PURE__ */ jsxs(Text, { className: "m-0 mb-2 text-sm leading-5 text-[#1a1a1a]", children: [
+          /* @__PURE__ */ jsx("strong", { children: "Approx. location:" }),
+          " ",
+          location
+        ] }),
+        /* @__PURE__ */ jsxs(Text, { className: "m-0 mb-2 text-sm leading-5 text-[#1a1a1a]", children: [
+          /* @__PURE__ */ jsx("strong", { children: "IP address:" }),
+          " ",
+          ipAddress
+        ] }),
+        /* @__PURE__ */ jsxs(Text, { className: "m-0 text-sm leading-5 text-[#1a1a1a]", children: [
+          /* @__PURE__ */ jsx("strong", { children: "When:" }),
+          " ",
+          when
+        ] })
+      ] }),
+      manageUrl && /* @__PURE__ */ jsx(Section, { className: "mb-6 text-center", children: /* @__PURE__ */ jsx(
+        Button,
+        {
+          href: manageUrl,
+          className: "rounded-lg bg-[#1a1a1a] px-6 py-3 text-sm font-bold text-white no-underline",
+          children: "Review your passkeys"
+        }
+      ) }),
+      /* @__PURE__ */ jsx(Text, { className: "text-sm leading-[22px] text-[#666666]", children: "If this was you, no action is needed. If you don't recognize it, change your password now and review your passkeys and active sessions." })
+    ] }) }) }) })
+  ] });
+}
+
+// server/auth.ts
+async function logFailedLogin(ctx) {
+  var _a, _b, _c;
+  try {
+    const raw = (_a = ctx.body) == null ? void 0 : _a.email;
+    const email = typeof raw === "string" ? raw.toLowerCase() : null;
+    if (!email) return;
+    const [user] = await db.select({ id: users.id }).from(users).where(eq(users.email, email)).limit(1);
+    if (!user) return;
+    await logActivity({
+      userId: user.id,
+      action: "login_failed",
+      description: "Failed login attempt",
+      ipAddress: getClientIp(ctx.headers),
+      userAgent: (_c = (_b = ctx.headers) == null ? void 0 : _b.get("user-agent")) != null ? _c : null
+    });
+  } catch (error) {
+    console.error("Failed to log login_failed activity", error);
+  }
+}
+async function notifyPasskeyChange(ctx, action) {
+  var _a, _b, _c, _d;
+  try {
+    const session = await getSessionFromCtx(ctx);
+    const user = session == null ? void 0 : session.user;
+    if (!user) return;
+    const ip = getClientIp(ctx.headers);
+    await logActivity({
+      userId: user.id,
+      action: action === "added" ? "passkey_added" : "passkey_removed",
+      description: `Passkey ${action}`,
+      ipAddress: ip,
+      userAgent: (_b = (_a = ctx.headers) == null ? void 0 : _a.get("user-agent")) != null ? _b : null
+    });
+    if (!config.RESEND_API_KEY) return;
+    await getResend().emails.send({
+      from: EMAIL_FROM,
+      to: [user.email],
+      subject: action === "added" ? "A passkey was added to your account" : "A passkey was removed from your account",
+      react: EmailTemplatePasskeyChange({
+        firstName: user.name || "there",
+        action,
+        device: formatDeviceInfo(parseUserAgent((_d = (_c = ctx.headers) == null ? void 0 : _c.get("user-agent")) != null ? _d : null)),
+        location: formatLocation(lookupGeoLocation(ip)),
+        ipAddress: ip || "Unknown",
+        when: (/* @__PURE__ */ new Date()).toUTCString(),
+        manageUrl: `${process.env.BETTER_AUTH_URL || process.env.NEXTAUTH_URL || process.env.NEXT_PUBLIC_APP_URL || ""}/dashboard/settings`
+      })
+    });
+  } catch (error) {
+    console.error("Failed to send passkey-change notification", error);
+  }
+}
+function createAuth(overrides = {}) {
+  const socialProviders = __spreadValues(__spreadValues({}, config.AUTH_ENABLE_GOOGLE ? {
+    google: {
+      clientId: process.env.AUTH_GOOGLE_ID || process.env.GOOGLE_CLIENT_ID || "",
+      clientSecret: process.env.AUTH_GOOGLE_SECRET || process.env.GOOGLE_CLIENT_SECRET || ""
+    }
+  } : {}), overrides.socialProviders);
+  const emailAndPasswordEnabled = config.AUTH_ENABLE_EMAIL_PASSWORD;
+  const hasEnabledSocialProvider = Object.values(socialProviders).some(Boolean);
+  if (!hasEnabledSocialProvider && !emailAndPasswordEnabled) {
+    throw new Error(
+      "No auth provider is enabled \u2014 every social provider is off and emailAndPassword.enabled is false. Enable AUTH_ENABLE_GOOGLE / AUTH_ENABLE_EMAIL_PASSWORD, or pass your own provider via createAuth({ socialProviders: {...} })."
+    );
+  }
+  const baseURL = process.env.NEXTAUTH_URL || process.env.BETTER_AUTH_URL || "http://localhost:3000";
+  return betterAuth({
+    database: drizzleAdapter(db, {
+      provider: "pg",
+      schema: {
+        user: users,
+        account: accounts,
+        session: sessions,
+        verification: verifications,
+        twoFactor: twoFactors,
+        passkey: passkeys
+      }
+    }),
+    // Session configuration (30 days expiration matching previous NextAuth setup)
+    session: {
+      expiresIn: 60 * 60 * 24 * 30,
+      // 30 days
+      updateAge: 60 * 60 * 24,
+      // Update session every 24 hours
+      cookieCache: {
+        enabled: true,
+        // Enable hybrid session caching for performance
+        maxAge: 5 * 60
+        // 5 minutes
+      }
+    },
+    // Email & Password Authentication (replaces Credentials provider)
+    // Toggle per-project via AUTH_ENABLE_EMAIL_PASSWORD in that project's own .env.*
+    emailAndPassword: {
+      enabled: emailAndPasswordEnabled,
+      requireEmailVerification: false,
+      // Use bcrypt to maintain compatibility with existing user passwords
+      async hash(password) {
+        return await bcrypt.hash(password, 10);
+      },
+      async verify({ hash, password }) {
+        return await bcrypt.compare(password, hash);
+      },
+      // `url` is fully composed by better-auth (baseURL + verification token +
+      // callbackURL) — see app/(auth)/forgot-password and reset-password for
+      // the pages this points at.
+      async sendResetPassword({ user, url }) {
+        await getResend().emails.send({
+          from: EMAIL_FROM,
+          to: [user.email],
+          subject: "Reset your password",
+          react: EmailTemplateResetPassword({ firstName: user.name || "there", url })
+        });
+      }
+    },
+    // Email verification. `requireEmailVerification` above stays false, so this
+    // is opt-in: users trigger it from the dashboard via
+    // authClient.sendVerificationEmail(). better-auth composes `url`
+    // (baseURL + token + callbackURL) and serves the /api/auth/verify-email
+    // callback that flips users.emailVerified on click.
+    emailVerification: {
+      autoSignInAfterVerification: true,
+      async sendVerificationEmail({ user, url }) {
+        await getResend().emails.send({
+          from: EMAIL_FROM,
+          to: [user.email],
+          subject: "Confirm your email",
+          react: EmailTemplateVerifyEmail({ firstName: user.name || "there", url })
+        });
+      }
+    },
+    // Social Providers — google is included by default; toggle per-project via
+    // AUTH_ENABLE_GOOGLE. overrides.socialProviders can still add more (or replace it).
+    socialProviders,
+    // User schema configuration
+    user: {
+      additionalFields: {
+        role: {
+          type: "string",
+          required: false,
+          defaultValue: "user",
+          input: false
+          // Prevent users from setting their own role
+        }
+      }
+    },
+    // Advanced options
+    advanced: {
+      generateId: () => __require("@paralleldrive/cuid2").createId()
+    },
+    // Every new session row corresponds to a sign-in (credential or OAuth) —
+    // use that as the "last logged in" signal rather than session updates,
+    // which also fire on cookie-cache refresh / expiry extension.
+    databaseHooks: {
+      session: {
+        create: {
+          async after(session, context) {
+            var _a, _b, _c, _d;
+            const impersonatedBy = session.impersonatedBy;
+            if (impersonatedBy) {
+              const target = await db.select({ email: users.email }).from(users).where(eq(users.id, session.userId)).limit(1);
+              await logActivity({
+                userId: impersonatedBy,
+                action: "impersonation_started",
+                description: `Admin started impersonating ${(_b = (_a = target[0]) == null ? void 0 : _a.email) != null ? _b : session.userId}`,
+                metadata: { impersonatedUserId: session.userId }
+              });
+              return;
+            }
+            try {
+              await db.update(users).set({ lastLoginAt: /* @__PURE__ */ new Date() }).where(eq(users.id, session.userId));
+            } catch (error) {
+              console.error("Failed to update lastLoginAt", error);
+            }
+            try {
+              const headers = context == null ? void 0 : context.headers;
+              const ipAddress = getClientIp(headers);
+              const userAgent = (_c = headers == null ? void 0 : headers.get("user-agent")) != null ? _c : null;
+              const referrerUrl = ((_d = context == null ? void 0 : context.getCookie) == null ? void 0 : _d.call(context, LOGIN_REFERRER_COOKIE)) || (headers == null ? void 0 : headers.get("referer")) || null;
+              const device = parseUserAgent(userAgent);
+              const geo = lookupGeoLocation(ipAddress);
+              const [{ count }] = await db.select({ count: sql`count(*)` }).from(sessions).where(eq(sessions.userId, session.userId));
+              const isFirstSession = Number(count) <= 1;
+              await logActivity({
+                userId: session.userId,
+                action: "login",
+                description: isFirstSession ? "New account registered and signed in" : "User logged in",
+                ipAddress,
+                userAgent,
+                referrerUrl,
+                os: device.os,
+                browser: device.browser,
+                deviceType: device.deviceType,
+                country: geo.country,
+                city: geo.city
+              });
+            } catch (error) {
+              console.error("Failed to log login activity", error);
+            }
+          }
+        }
+      }
+    },
+    // better-auth's admin plugin ends impersonation by deleting the
+    // impersonation session and restoring the admin's original session
+    // straight from a signed cookie — it never runs session.create, so
+    // there's no databaseHooks entry point to log the stop event from.
+    // Reading the session here (before the endpoint deletes it) is the only
+    // point where both the admin id and the impersonated user id are still
+    // available together.
+    hooks: {
+      before: createAuthMiddleware(async (ctx) => {
+        var _a, _b, _c, _d;
+        if (ctx.path === "/sign-in/email" || ctx.path === "/sign-up/email") {
+          const fingerprint = (_a = ctx.headers) == null ? void 0 : _a.get(DEVICE_FINGERPRINT_HEADER);
+          const ip = getClientIp(ctx.headers);
+          const throttled = fingerprint && await isDeviceThrottled(fingerprint) || ip && await isDeviceThrottled(`ip:${ip}`, MAX_IP);
+          if (throttled) {
+            throw new APIError("TOO_MANY_REQUESTS", {
+              message: "Too many attempts from this device. Try again in a few minutes."
+            });
+          }
+        }
+        if (ctx.path === "/sign-in/social") {
+          if (((_b = ctx.body) == null ? void 0 : _b.provider) === "google") {
+            const flags = await getEffectiveAuthFlags();
+            if (!flags.google) {
+              throw new APIError("FORBIDDEN", { message: "Google sign-in is currently disabled." });
+            }
+          }
+          return;
+        }
+        if (ctx.path === "/sign-in/email") {
+          const flags = await getEffectiveAuthFlags();
+          if (!flags.emailPassword) {
+            throw new APIError("FORBIDDEN", { message: "Email/password sign-in is currently disabled." });
+          }
+          return;
+        }
+        if (ctx.path === "/one-tap/callback") {
+          const flags = await getEffectiveAuthFlags();
+          if (!flags.google || !flags.oneTap) {
+            throw new APIError("FORBIDDEN", { message: "Google One Tap is currently disabled." });
+          }
+          return;
+        }
+        if (ctx.path !== "/admin/stop-impersonating") return;
+        const current = await getSessionFromCtx(ctx, { disableCookieCache: true });
+        if (current == null ? void 0 : current.session.impersonatedBy) {
+          const target = await db.select({ email: users.email }).from(users).where(eq(users.id, current.session.userId)).limit(1);
+          await logActivity({
+            userId: current.session.impersonatedBy,
+            action: "impersonation_stopped",
+            description: `Admin stopped impersonating ${(_d = (_c = target[0]) == null ? void 0 : _c.email) != null ? _d : current.session.userId}`,
+            metadata: { impersonatedUserId: current.session.userId }
+          });
+        }
+      }),
+      after: createAuthMiddleware(async (ctx) => {
+        var _a, _b, _c, _d;
+        if (ctx.path === "/passkey/verify-registration" || ctx.path === "/passkey/delete-passkey") {
+          if (ctx.context.returned instanceof APIError) return;
+          await notifyPasskeyChange(
+            ctx,
+            ctx.path === "/passkey/verify-registration" ? "added" : "removed"
+          );
+          return;
+        }
+        if (ctx.path !== "/sign-in/email" && ctx.path !== "/sign-up/email") return;
+        const fingerprint = (_a = ctx.headers) == null ? void 0 : _a.get(DEVICE_FINGERPRINT_HEADER);
+        const ip = getClientIp(ctx.headers);
+        const ipKey = ip ? `ip:${ip}` : null;
+        if (!fingerprint && !ipKey) return;
+        const failed = ctx.context.returned instanceof APIError;
+        const rawEmail = (_b = ctx.body) == null ? void 0 : _b.email;
+        const meta = {
+          ipAddress: ip,
+          userAgent: (_d = (_c = ctx.headers) == null ? void 0 : _c.get("user-agent")) != null ? _d : null,
+          email: typeof rawEmail === "string" ? rawEmail.toLowerCase() : null
+        };
+        const keys = [fingerprint, ipKey].filter((k) => !!k);
+        if (ctx.path === "/sign-up/email") {
+          await Promise.all(keys.map((key) => recordDeviceAttempt(key, __spreadProps(__spreadValues({}, meta), { kind: "signup" }))));
+          return;
+        }
+        if (failed) {
+          await Promise.all(keys.map((key) => recordDeviceAttempt(key, __spreadProps(__spreadValues({}, meta), { kind: "signin" }))));
+          await logFailedLogin(ctx);
+        } else {
+          await Promise.all(keys.map((key) => clearDeviceThrottle(key)));
+        }
+      })
+    },
+    // Base URL for callbacks
+    baseURL,
+    // Secret for signing cookies and tokens
+    secret: process.env.AUTH_SECRET,
+    // The OAuth `state` is a one-time verification row: the callback consumes
+    // and deletes it. When the same callback URL gets hit twice (browser
+    // prefetch / bfcache / double nav — common on a repeat Google sign-in
+    // where Google auto-redirects with no consent screen), the first hit
+    // logs the user in and the second finds no `state` row and throws
+    // `please_restart_the_process`. Default sends that to better-auth's bare
+    // error page; point it at /login instead, which already bounces an
+    // authenticated user straight to their callbackUrl — so the losing race
+    // just lands them logged in. See better-auth#5658 / #6544.
+    onAPIError: {
+      errorURL: "/login"
+    },
+    plugins: [
+      // checks to see if oneTap is enabled and if google provider is available, then add the oneTap plugin
+      ...config.AUTH_ENABLE_ONE_TAP && Boolean(socialProviders.google) ? [oneTap()] : [],
+      // Registered for impersonation (auth.api.impersonateUser / stopImpersonating)
+      // only — role/ban/delete stay on our own custom routes above. adminRoles
+      // matches our existing role column so the plugin's own permission checks
+      // line up with hasRole(role, 'admin'). banReason is remapped onto our
+      // existing bannedReason column instead of adding a duplicate field.
+      admin({
+        adminRoles: ["admin"],
+        schema: {
+          user: {
+            fields: {
+              banReason: "bannedReason"
+            }
+          }
+        }
+      }),
+      // TOTP second factor + encrypted backup codes. `issuer` is the label
+      // shown in the user's authenticator app.
+      twoFactor({ issuer: config.APP_NAME }),
+      // WebAuthn passkeys (Touch ID / Windows Hello / security keys) as a
+      // passwordless sign-in method. rpID must be the bare host and origin
+      // the full URL — both derived from baseURL above.
+      passkey({
+        rpID: new URL(baseURL).hostname,
+        rpName: config.APP_NAME,
+        origin: baseURL
+      })
+    ]
+  });
+}
+var _auth;
+function getDefaultAuth() {
+  if (!_auth) _auth = createAuth();
+  return _auth;
+}
+var auth = new Proxy({}, {
+  get(_target, prop) {
+    const instance = getDefaultAuth();
+    const value = Reflect.get(instance, prop);
+    return typeof value === "function" ? value.bind(instance) : value;
+  },
+  // "prop" in auth (e.g. better-auth's toNextJsHandler does `"handler" in auth`)
+  // must also see the real instance — without this it checks the empty
+  // placeholder target and always reports false.
+  has(_target, prop) {
+    return Reflect.has(getDefaultAuth(), prop);
+  },
+  ownKeys(_target) {
+    return Reflect.ownKeys(getDefaultAuth());
+  },
+  getOwnPropertyDescriptor(_target, prop) {
+    return Reflect.getOwnPropertyDescriptor(getDefaultAuth(), prop);
+  }
+});
+
+export { auth, createAuth };
+//# sourceMappingURL=chunk-2FW7C3KS.mjs.map
+//# sourceMappingURL=chunk-2FW7C3KS.mjs.map