@zeyolabs/kit 2026.11.5 → 2026.11.6

package/auth/sveltekit/routes.ts

@@ -0,0 +1,264 @@
+import type { RequestEvent, RequestHandler } from '@sveltejs/kit';
+
+import { json, redirect } from '@sveltejs/kit';
+import { eq } from 'drizzle-orm';
+import { z } from 'zod';
+
+import type { AuthUser } from '../sessions/sessions';
+import type { LoginError } from './login';
+
+import { logger } from '../../server/logger';
+import { ServiceError } from '../../utils/errors';
+import { Schema } from '../../utils/schema';
+import { Invites } from '../accounts/invites';
+import { Auth } from '../config';
+import { AuthEmails } from '../emails';
+import { users } from '../schema';
+import { AuthHandle } from '../sessions/handle';
+import { MagicLink } from '../sessions/magic-link/magic-link';
+import {
+	AuthenticationResponse,
+	PasskeyError,
+	RegistrationResponse,
+	type RelyingParty,
+} from '../sessions/passkeys/passkeys';
+import { Passkeys } from '../sessions/passkeys/passkeys';
+import { Sessions } from '../sessions/sessions';
+import { Users } from '../users';
+import { Login } from './login';
+
+// The auth endpoints, mounted by the app with one file:
+//   src/routes/auth/[...path]/+server.ts:  export { POST } from '@zeyolabs/kit/auth/sveltekit/routes';
+//
+//   POST /auth/email                  form {email, next}  -> emails a link, 303 login?sent=1
+//   POST /auth/verify                 form {token, next}  -> uses the link, signs in, 303 next
+//   POST /auth/logout                 form                -> 303 login
+//   POST /auth/passkey/login-options  json                -> request options
+//   POST /auth/passkey/login          json {credential, next} -> signs in, {redirect}
+//   POST /auth/passkey/register-options json              -> creation options (fresh session)
+//   POST /auth/passkey/register       json {credential, name} -> {ok}
+//   POST /auth/passkey/delete         form {id, next}     -> 303 next
+//   POST /auth/invite/accept          form {token}        -> joins the account, 303 its home
+//
+// The emailed link opens the login page (`?token=`), which posts it here from a button: mail
+// scanners that prefetch links can't burn the token or sign anyone in.
+
+const CHALLENGE_MAX_AGE = 5 * 60;
+
+const challengeCookie = () => `${Auth.config().cookieName}_challenge`;
+
+function relyingParty(event: RequestEvent): RelyingParty {
+	const { appName, passkeyRpId } = Auth.config();
+	return { id: passkeyRpId ?? event.url.hostname, name: appName, origin: event.url.origin };
+}
+
+function toLogin(error: LoginError | null, next: string, sent = false): never {
+	const params = new URLSearchParams();
+	if (error) params.set('error', error);
+	if (sent) params.set('sent', '1');
+	if (next !== '/') params.set('next', next);
+	const query = params.toString();
+	redirect(303, `${Auth.config().loginPath}${query ? `?${query}` : ''}`);
+}
+
+/** Checks a would-be session user against the allowlist and the Access identity. */
+async function refusal(event: RequestEvent, email: string): Promise<LoginError | null> {
+	if (!(await Auth.config().isAllowed(email))) return 'not_allowed';
+	const { accessEmail } = AuthHandle.locals(event);
+	if (accessEmail && !Users.emailsMatch(accessEmail, email)) return 'mismatch';
+	return null;
+}
+
+async function signIn(event: RequestEvent, user: AuthUser): Promise<void> {
+	const { expiresAt, token } = await Sessions.create(Auth.config().db(), user.id);
+	event.cookies.set(Auth.config().cookieName, token, {
+		...Sessions.cookieAttributes,
+		expires: new Date(expiresAt),
+	});
+	await Auth.config().onSignIn?.(user);
+}
+
+function setChallenge(event: RequestEvent): string {
+	const challenge = Passkeys.newChallenge();
+	event.cookies.set(challengeCookie(), challenge, {
+		...Sessions.cookieAttributes,
+		maxAge: CHALLENGE_MAX_AGE,
+		path: '/auth/passkey',
+		sameSite: 'strict',
+	});
+	return challenge;
+}
+
+/** The pending challenge, used up: each one answers exactly one ceremony. */
+function takeChallenge(event: RequestEvent): string {
+	const challenge = event.cookies.get(challengeCookie());
+	event.cookies.delete(challengeCookie(), { path: '/auth/passkey' });
+	if (!challenge) throw new PasskeyError('No pending challenge');
+	return challenge;
+}
+
+/** Adding or removing a passkey needs a session, and adding one needs a recent sign-in. */
+function sessionUser(event: RequestEvent, fresh: boolean): AuthUser | Response {
+	const { session, user } = AuthHandle.locals(event);
+	if (!session || !user) return json({ message: 'Sign in first' }, { status: 401 });
+	if (fresh && Date.now() - session.createdAt > Passkeys.FRESH_SESSION_MS) {
+		return json(
+			{ message: 'For security, sign in again before adding a passkey', reauth: true },
+			{ status: 403 }
+		);
+	}
+	return user;
+}
+
+async function emailLink(event: RequestEvent): Promise<never> {
+	const form = await event.request.formData();
+	const next = Login.safeNext(form.get('next'));
+	const parsed = Schema.Email.safeParse(form.get('email'));
+	if (!parsed.success) toLogin('send', next);
+	const email = parsed.data;
+
+	const refused = await refusal(event, email);
+	// Unknown emails get the same answer as known ones, so the form can't probe the allowlist.
+	if (refused === 'not_allowed') toLogin(null, next, true);
+	if (refused) toLogin(refused, next);
+
+	const token = await MagicLink.issue(Auth.config().db(), email);
+	if (token) {
+		const url = new URL(Auth.config().loginPath, event.url.origin);
+		url.searchParams.set('token', token);
+		if (next !== '/') url.searchParams.set('next', next);
+		try {
+			const message = { email, expiresInMinutes: MagicLink.TTL_MS / 60_000, url: url.href };
+			await Auth.config()
+				.email()
+				.deliver({ to: email, ...AuthEmails.magicLink(Auth.config().emailBrand, message) });
+		} catch (err) {
+			logger.error(err, { op: 'auth.magic-link.send' });
+			toLogin('send', next);
+		}
+	}
+	toLogin(null, next, true);
+}
+
+async function verifyLink(event: RequestEvent): Promise<never> {
+	const form = await event.request.formData();
+	const next = Login.safeNext(form.get('next'));
+	const email = await MagicLink.consume(Auth.config().db(), String(form.get('token') ?? ''));
+	if (!email) toLogin('expired', next);
+	const refused = await refusal(event, email);
+	if (refused) toLogin(refused, next);
+	await signIn(event, await Users.findOrCreate(Auth.config().db(), email));
+	redirect(303, next);
+}
+
+async function logout(event: RequestEvent): Promise<never> {
+	const { session } = AuthHandle.locals(event);
+	if (session) await Sessions.delete(Auth.config().db(), session.id);
+	event.cookies.delete(Auth.config().cookieName, { path: '/' });
+	redirect(303, Auth.config().loginPath);
+}
+
+async function passkeyLogin(event: RequestEvent): Promise<Response> {
+	const body = z
+		.object({ credential: AuthenticationResponse, next: z.string().optional() })
+		.safeParse(await event.request.json().catch(() => null));
+	if (!body.success) return json({ message: 'Malformed request' }, { status: 400 });
+	const db = Auth.config().db();
+	try {
+		const challenge = takeChallenge(event);
+		const passkey = await Passkeys.find(db, body.data.credential.rawId);
+		if (!passkey) throw new PasskeyError('Unknown passkey');
+		const signCount = Passkeys.verifyAuthentication(
+			body.data.credential,
+			challenge,
+			relyingParty(event),
+			passkey
+		);
+		const [user] = await db.select().from(users).where(eq(users.id, passkey.userId)).limit(1);
+		const refused = await refusal(event, user.email);
+		if (refused) return json({ code: refused, message: 'Not allowed' }, { status: 403 });
+		await Passkeys.recordUse(db, passkey.id, signCount);
+		await signIn(event, user);
+		return json({ redirect: Login.safeNext(body.data.next) });
+	} catch (err) {
+		if (!(err instanceof PasskeyError)) throw err;
+		logger.warn(`passkey sign-in refused: ${err.message}`);
+		return json({ message: 'That passkey could not be verified' }, { status: 400 });
+	}
+}
+
+async function passkeyRegisterOptions(event: RequestEvent): Promise<Response> {
+	const user = sessionUser(event, true);
+	if (user instanceof Response) return user;
+	const existing = await Passkeys.list(Auth.config().db(), user.id);
+	const ids = existing.map((p) => p.id);
+	return json(Passkeys.registrationOptions(relyingParty(event), user, setChallenge(event), ids));
+}
+
+async function passkeyRegister(event: RequestEvent): Promise<Response> {
+	const user = sessionUser(event, true);
+	if (user instanceof Response) return user;
+	const body = z
+		.object({ credential: RegistrationResponse, name: z.string().trim().max(60).optional() })
+		.safeParse(await event.request.json().catch(() => null));
+	if (!body.success) return json({ message: 'Malformed request' }, { status: 400 });
+	try {
+		const credential = Passkeys.verifyRegistration(
+			body.data.credential,
+			takeChallenge(event),
+			relyingParty(event)
+		);
+		await Passkeys.save(Auth.config().db(), user.id, body.data.name || 'Passkey', credential);
+		return json({ ok: true });
+	} catch (err) {
+		if (!(err instanceof PasskeyError)) throw err;
+		logger.warn(`passkey registration refused: ${err.message}`);
+		return json({ message: 'That passkey could not be added' }, { status: 400 });
+	}
+}
+
+async function passkeyDelete(event: RequestEvent): Promise<never> {
+	const form = await event.request.formData();
+	const next = Login.safeNext(form.get('next'));
+	const user = sessionUser(event, false);
+	if (user instanceof Response) toLogin(null, next);
+	await Passkeys.delete(Auth.config().db(), user.id, String(form.get('id') ?? ''));
+	redirect(303, next);
+}
+
+/** Accepts an invite for the signed-in user (the invite page posts here) and opens the account. */
+async function invite(event: RequestEvent): Promise<never> {
+	const form = await event.request.formData();
+	const token = String(form.get('token') ?? '');
+	const { user } = AuthHandle.locals(event);
+	const invitePage = `${Auth.config().invitePath}?token=${encodeURIComponent(token)}`;
+	if (!user) toLogin(null, invitePage);
+	const account = await Invites.accept(Auth.config().db(), token, user).catch((err: unknown) => {
+		if (err instanceof ServiceError) redirect(303, `${invitePage}&error=${err.status}`);
+		throw err;
+	});
+	redirect(303, Auth.config().accountHome(account.slug));
+}
+
+const handlers: Record<string, (event: RequestEvent) => Promise<Response>> = {
+	email: emailLink,
+	'invite/accept': invite,
+	logout,
+	'passkey/delete': passkeyDelete,
+	'passkey/login': passkeyLogin,
+	'passkey/login-options': async (event) =>
+		json(Passkeys.authenticationOptions(relyingParty(event), setChallenge(event))),
+	'passkey/register': passkeyRegister,
+	'passkey/register-options': passkeyRegisterOptions,
+	verify: verifyLink,
+};
+
+export const POST: RequestHandler = async (event) => {
+	// SvelteKit's CSRF check only covers form posts; the JSON endpoints need the same guard.
+	if (event.request.headers.get('origin') !== event.url.origin) {
+		return new Response('Cross-site request refused', { status: 403 });
+	}
+	const handler = handlers[event.params.path ?? ''];
+	if (!handler) return new Response('Not found', { status: 404 });
+	return handler(event);
+};

package/auth/users.ts

@@ -0,0 +1,49 @@
+import { eq } from 'drizzle-orm';
+
+import type { AuthDb } from './config';
+import type { AuthUser } from './sessions/sessions';
+
+import { users } from './schema';
+
+/** Parses a comma-separated allowlist (e.g. an `ALLOWED_EMAILS` var) into lower-cased emails. */
+function parseAllowlist(raw: string | undefined): string[] {
+	return (raw ?? '')
+		.split(',')
+		.map((email) => email.trim().toLowerCase())
+		.filter(Boolean);
+}
+
+/** Case-insensitive allowlist check. An empty list allows nobody (fail closed). */
+function isEmailAllowed(email: string, allowlist: readonly string[] | string | undefined) {
+	const list =
+		typeof allowlist === 'string' || allowlist === undefined
+			? parseAllowlist(allowlist)
+			: allowlist.map((e) => e.trim().toLowerCase());
+	return list.includes(email.trim().toLowerCase());
+}
+
+function emailsMatch(a: string, b: string): boolean {
+	return a.trim().toLowerCase() === b.trim().toLowerCase();
+}
+
+/** The user for `email`, created on first sign-in with the email's local part as their name. */
+async function findOrCreateUser(db: AuthDb, email: string): Promise<AuthUser> {
+	const normalized = email.trim().toLowerCase();
+	await db
+		.insert(users)
+		.values({ email: normalized, name: normalized.split('@')[0] })
+		.onConflictDoNothing({ target: users.email });
+	const [user] = await db.select().from(users).where(eq(users.email, normalized)).limit(1);
+	const { avatarUrl, id, name } = user;
+	return { avatarUrl, email: normalized, id, name };
+}
+
+export const Allowlist = {
+	includes: isEmailAllowed,
+	parse: parseAllowlist,
+};
+
+export const Users = {
+	emailsMatch,
+	findOrCreate: findOrCreateUser,
+};

package/cloudflare/email/base.ts

@@ -0,0 +1,59 @@
+import { logger as defaultLogger, type LoggerClient } from '../../monitoring/logger/client';
+
+// What every email client shares: the message shape, the `IEmailClient` contract, and
+// `BaseEmailClient`, which owns the sender and the log-and-return-false `send`. A transport
+// (Workers `send_email` binding, SMTP, ...) only implements `deliver`.
+
+export type EmailAttachment = { base64Data: string; contentType: string; filename: string };
+
+export type EmailInput = {
+	attachments?: EmailAttachment[];
+	/** Display name for this message, overriding the client's `fromName`. */
+	fromName?: string;
+	html?: string;
+	replyTo?: { email: string; name?: string };
+	subject: string;
+	/** Plain-text body (or alternative to `html`). Give at least one of the two. */
+	text?: string;
+	to: string;
+};
+
+export interface IEmailClient {
+	/** Sends one message; throws on failure, for callers that retry (queue consumers). */
+	deliver(input: EmailInput): Promise<void>;
+	/** Sends one message. Logs and returns `false` on failure instead of throwing. */
+	send(input: EmailInput): Promise<boolean>;
+}
+
+export type EmailSender = {
+	/** Envelope and header sender. */
+	from: string;
+	/** Display name next to `from`. */
+	fromName?: string;
+	logger?: LoggerClient;
+};
+
+export abstract class BaseEmailClient implements IEmailClient {
+	constructor(protected readonly sender: EmailSender) {}
+
+	abstract deliver(input: EmailInput): Promise<void>;
+
+	async send(input: EmailInput): Promise<boolean> {
+		try {
+			await this.deliver(input);
+			return true;
+		} catch (err) {
+			await (this.sender.logger ?? defaultLogger).error(err, {
+				from: this.sender.from,
+				subject: input.subject,
+				to: input.to,
+			});
+			return false;
+		}
+	}
+
+	/** The display name for one message: its own, else the client's. */
+	protected nameFor(input: EmailInput): string | undefined {
+		return input.fromName ?? this.sender.fromName;
+	}
+}

package/cloudflare/email/client.ts

@@ -1,35 +1,27 @@
 import { createMimeMessage } from 'mimetext/browser';
 
-import { logger as defaultLogger, type LoggerClient } from '../../monitoring/logger/client';
+import { BaseEmailClient, type EmailInput, type EmailSender } from './base';
 
-export type EmailAttachment = { base64Data: string; contentType: string; filename: string };
-
-export type EmailInput = {
-	attachments?: EmailAttachment[];
-	html: string;
-	subject: string;
-	to: string;
-};
+export {
+	BaseEmailClient,
+	type EmailAttachment,
+	type EmailInput,
+	type EmailSender,
+	type IEmailClient,
+} from './base';
 
 /** The shape of a Workers `send_email` binding. */
 export type EmailBinding = { send(message: unknown): Promise<unknown> };
 
-export interface IEmailClient {
-	/** Sends one message. Logs and returns `false` on failure instead of throwing. */
-	send(input: EmailInput): Promise<boolean>;
-}
-
-function buildRawEmail(
-	from: string,
-	fromName: string | undefined,
-	{ attachments, html, subject, to }: EmailInput
-): string {
+function buildRawEmail(from: string, fromName: string | undefined, input: EmailInput): string {
 	const msg = createMimeMessage();
 	msg.setSender(fromName ? { addr: from, name: fromName } : { addr: from });
-	msg.setRecipient(to);
-	msg.setSubject(subject);
-	msg.addMessage({ contentType: 'text/html', data: html });
-	for (const attachment of attachments ?? []) {
+	msg.setRecipient(input.to);
+	msg.setSubject(input.subject);
+	if (input.replyTo) msg.setHeader('Reply-To', input.replyTo.email);
+	if (input.text) msg.addMessage({ contentType: 'text/plain', data: input.text });
+	if (input.html) msg.addMessage({ contentType: 'text/html', data: input.html });
+	for (const attachment of input.attachments ?? []) {
 		msg.addAttachment({
 			contentType: attachment.contentType,
 			data: attachment.base64Data,
@@ -41,37 +33,19 @@ function buildRawEmail(
 
 /** Sends transactional email over a Workers `send_email` binding (Cloudflare Email Routing).
  *  Use `DevEmailClient` where there's no binding. */
-export class EmailClient implements IEmailClient {
-	constructor(
-		private readonly config: {
-			binding: EmailBinding;
-			/** Envelope and header sender. */
-			from: string;
-			/** Display name next to `from`. */
-			fromName?: string;
-			logger?: LoggerClient;
-		}
-	) {}
+export class EmailClient extends BaseEmailClient {
+	private readonly binding: EmailBinding;
+
+	constructor(config: EmailSender & { binding: EmailBinding }) {
+		super(config);
+		this.binding = config.binding;
+	}
 
-	/** Like `send`, but throws on failure — for callers that retry (queue consumers). */
 	async deliver(input: EmailInput): Promise<void> {
-		const { binding, from, fromName } = this.config;
+		const { from } = this.sender;
 		// Dynamic: `cloudflare:email` only resolves inside the Workers runtime.
 		const { EmailMessage } = await import('cloudflare:email');
-		await binding.send(new EmailMessage(from, input.to, buildRawEmail(from, fromName, input)));
-	}
-
-	async send(input: EmailInput): Promise<boolean> {
-		try {
-			await this.deliver(input);
-			return true;
-		} catch (err) {
-			await (this.config.logger ?? defaultLogger).error(err, {
-				from: this.config.from,
-				subject: input.subject,
-				to: input.to,
-			});
-			return false;
-		}
+		const raw = buildRawEmail(from, this.nameFor(input), input);
+		await this.binding.send(new EmailMessage(from, input.to, raw));
 	}
 }

package/cloudflare/email/dev.ts

@@ -1,10 +1,14 @@
-import type { EmailInput, IEmailClient } from './client';
+import type { EmailInput, IEmailClient } from './base';
 
-/** Stands in for `EmailClient` where there's no `send_email` binding (local dev) — logs instead of
- *  sending, so the message is still visible. */
+/** Stands in for a real client where there's no transport (local dev): logs instead of sending,
+ *  so the message is still visible. */
 export class DevEmailClient implements IEmailClient {
-	async send({ subject, to }: EmailInput): Promise<boolean> {
-		console.log(`[email:dev] to=${to} subject=${subject}`);
+	async deliver({ subject, text, to }: EmailInput): Promise<void> {
+		console.log(`[email:dev] to=${to} subject=${subject}${text ? `\n${text}` : ''}`);
+	}
+
+	async send(input: EmailInput): Promise<boolean> {
+		await this.deliver(input);
 		return true;
 	}
 }

package/cloudflare/email/smtp.ts

@@ -0,0 +1,65 @@
+import { envStore } from '../../utils/env';
+import { BaseEmailClient, type EmailInput, type EmailSender } from './base';
+
+// Email over SMTP (e.g. Amazon SES) with `worker-mailer`, which speaks SMTP over
+// `cloudflare:sockets`: for sending to any recipient, where a `send_email` binding
+// (`EmailClient`) can't. Same `IEmailClient` contract, so `DevEmailClient` and `FakeEmailClient`
+// stand in for it too.
+
+export type SmtpSettings = { host: string; password: string; port: number; username: string };
+
+/** The wrangler names of the SMTP settings: three vars and one Secrets Store secret. */
+export type SmtpKeys = { host: string; password: string; port: string; username: string };
+
+/** Connection options for worker-mailer: port 465 is implicit TLS, anything else STARTTLS. */
+export function smtpConnection({ host, password, port, username }: SmtpSettings) {
+	const implicitTls = port === 465;
+	return {
+		authType: 'plain' as const,
+		credentials: { password, username },
+		host,
+		port,
+		secure: implicitTls,
+		startTls: !implicitTls,
+	};
+}
+
+export class SmtpClient extends BaseEmailClient {
+	private readonly settings: SmtpSettings;
+
+	constructor(config: EmailSender & SmtpSettings) {
+		super(config);
+		this.settings = config;
+	}
+
+	/** A client whose settings come from `envStore()` under the names in `keys` (so the password's
+	 *  name must be among the request context's `secretNames`). */
+	static fromEnv(keys: SmtpKeys, sender: EmailSender): SmtpClient {
+		const store = envStore();
+		return new SmtpClient({
+			...sender,
+			host: store.string(keys.host),
+			password: store.secret(keys.password),
+			port: store.int(keys.port),
+			username: store.string(keys.username),
+		});
+	}
+
+	async deliver(input: EmailInput): Promise<void> {
+		// Loaded lazily: it imports cloudflare:sockets, which only exists on Workers.
+		const { WorkerMailer } = await import('worker-mailer');
+		await WorkerMailer.send(smtpConnection(this.settings), {
+			attachments: input.attachments?.map((a) => ({
+				content: a.base64Data,
+				filename: a.filename,
+				mimeType: a.contentType,
+			})),
+			from: { email: this.sender.from, name: this.nameFor(input) },
+			html: input.html,
+			reply: input.replyTo,
+			subject: input.subject,
+			text: input.text,
+			to: input.to,
+		});
+	}
+}

package/cloudflare/email/testing.ts

@@ -1,11 +1,16 @@
-import type { EmailInput, IEmailClient } from './client';
+import type { EmailInput, IEmailClient } from './base';
 
-/** Records every message passed to `send` instead of sending anything — for asserting what a
- *  service emailed, without a mock binding. Set `succeeds = false` to simulate a delivery failure. */
+/** Records every message instead of sending anything — for asserting what a service emailed,
+ *  without a mock transport. Set `succeeds = false` to simulate a delivery failure. */
 export class FakeEmailClient implements IEmailClient {
 	readonly sent: EmailInput[] = [];
 	succeeds = true;
 
+	async deliver(input: EmailInput): Promise<void> {
+		this.sent.push(input);
+		if (!this.succeeds) throw new Error('delivery failed');
+	}
+
 	async send(input: EmailInput): Promise<boolean> {
 		this.sent.push(input);
 		return this.succeeds;

package/package.json

@@ -1,7 +1,7 @@
 {
 	"name": "@zeyolabs/kit",
-	"version": "2026.11.5",
-	"description": "Shared SvelteKit-on-Cloudflare server toolkit: remote-function wrappers, Cloudflare context, monitoring, storage clients, utils and the ESLint config.",
+	"version": "2026.11.6",
+	"description": "Shared SvelteKit-on-Cloudflare server toolkit: remote-function wrappers, passwordless auth (magic link + passkeys), email over a send_email binding or SMTP, Cloudflare context, monitoring, storage clients, utils and the ESLint config.",
 	"type": "module",
 	"repository": {
 		"type": "git",
@@ -18,6 +18,7 @@
 	},
 	"files": [
 		"eslint-config.js",
+		"auth",
 		"cloudflare",
 		"monitoring",
 		"server",
@@ -43,6 +44,7 @@
 	"exports": {
 		"./eslint-config": "./eslint-config.js",
 		"./utils/*": "./utils/*.ts",
+		"./auth/*": "./auth/*.ts",
 		"./server/*": "./server/*.ts",
 		"./cloudflare/*": "./cloudflare/*.ts",
 		"./cloudflare/context": "./cloudflare/context.ts",
@@ -50,6 +52,7 @@
 		"./cloudflare/dispatch": "./cloudflare/dispatch/client.ts",
 		"./cloudflare/email": "./cloudflare/email/client.ts",
 		"./cloudflare/email/dev": "./cloudflare/email/dev.ts",
+		"./cloudflare/email/smtp": "./cloudflare/email/smtp.ts",
 		"./cloudflare/email/testing": "./cloudflare/email/testing.ts",
 		"./cloudflare/r2": "./cloudflare/r2/client.ts",
 		"./cloudflare/r2/testing": "./cloudflare/r2/testing.ts",
@@ -92,6 +95,7 @@
 		"@internationalized/date": "3.12.4",
 		"@oslojs/crypto": "1.0.1",
 		"@oslojs/encoding": "1.1.0",
+		"@oslojs/webauthn": "1.0.0",
 		"@sentry/cloudflare": "11.4.0",
 		"aws4fetch": "1.0.20",
 		"eslint-config-prettier": "10.1.8",
@@ -105,7 +109,8 @@
 		"snappyjs": "0.7.0",
 		"svelte-eslint-parser": "1.8.1",
 		"tldts": "7.4.16",
-		"typescript-eslint": "8.71.0"
+		"typescript-eslint": "8.71.0",
+		"worker-mailer": "1.3.1"
 	},
 	"peerDependencies": {
 		"@cloudflare/workers-types": "*",
@@ -136,6 +141,7 @@
 		"@bufbuild/protoc-gen-es": "2.16.0",
 		"@cloudflare/workers-types": "5.20261005.1",
 		"@electric-sql/pglite": "0.5.8",
+		"@libsql/client": "0.18.0",
 		"@sentry/sveltekit": "11.4.0",
 		"@sveltejs/kit": "3.1.1",
 		"@types/pg": "8.23.1",

package/server/remote-functions.ts

@@ -97,7 +97,7 @@ function remoteForm<S extends z.ZodType, O>(
 		try {
 			return await run(data);
 		} catch (e) {
-			// A ServiceError (wrong password, email in use, ...), a soft Fail, or a directly-thrown
+			// A ServiceError (expired link, email in use, ...), a soft Fail, or a directly-thrown
 			// HttpError becomes an inline form error; anything else is unexpected but still becomes an
 			// inline error, because throwing here would break `<Form>`.
 			if (e instanceof ServiceError) return FormResult.err(e.message);