better-ship 0.17.0 → 0.19.0

package/dist/resend.js.map

@@ -1 +1 @@
-{"version":3,"file":"resend.js","names":[],"sources":["../src/infrastructure/resend/resend-email-service.ts","../src/infrastructure/resend/email-event.ts","../src/infrastructure/resend/resend-webhook.ts"],"sourcesContent":["import { Buffer } from 'node:buffer'\n\nimport type { Attachment, CreateEmailOptions, ErrorResponse, Resend } from 'resend'\n\nimport type { EmailAccepted, EmailAttachment, IEmailService, OutboundEmail } from '@/application'\nimport { EmailServiceError, type EmailSendFailureReason } from '@/core'\n\n// SDK additions must receive an explicit classification before the package builds.\nconst SDK_REASONS = {\n  invalid_idempotency_key: 'invalid_request',\n  validation_error: 'invalid_request',\n  missing_api_key: 'configuration',\n  restricted_api_key: 'configuration',\n  invalid_api_key: 'configuration',\n  not_found: 'invalid_request',\n  method_not_allowed: 'invalid_request',\n  invalid_idempotent_request: 'invalid_request',\n  concurrent_idempotent_requests: 'idempotency_conflict',\n  invalid_attachment: 'invalid_request',\n  invalid_from_address: 'invalid_request',\n  invalid_access: 'configuration',\n  invalid_parameter: 'invalid_request',\n  invalid_region: 'invalid_request',\n  missing_required_field: 'invalid_request',\n  monthly_quota_exceeded: 'quota_exceeded',\n  daily_quota_exceeded: 'quota_exceeded',\n  rate_limit_exceeded: 'rate_limited',\n  security_error: 'configuration',\n  application_error: 'provider_error',\n  internal_server_error: 'provider_error',\n} satisfies Record<ErrorResponse['name'], EmailSendFailureReason>\n\n// Resend documents these codes before its SDK includes them in ErrorResponse.\nconst DOCUMENTED_REASONS = new Map<string, EmailSendFailureReason>([\n  ['email_above_quota', 'quota_exceeded'],\n  ['invalid_permission', 'configuration'],\n  ['suspended_api_key', 'configuration'],\n  ['resource_locked', 'idempotency_conflict'],\n  ['service_unavailable', 'provider_error'],\n  ['missing_required_parameter', 'invalid_request'],\n])\n\nfunction reasonFromResend(error: ErrorResponse): EmailSendFailureReason {\n  if (Object.hasOwn(SDK_REASONS, error.name)) return SDK_REASONS[error.name]\n  const reason = DOCUMENTED_REASONS.get(error.name)\n  if (reason !== undefined) return reason\n  if (error.statusCode === 429) return 'rate_limited'\n  if (error.statusCode !== null && error.statusCode >= 400 && error.statusCode < 500)\n    return 'invalid_request'\n  return 'provider_error'\n}\n\nfunction retryAfterSeconds(value: string | undefined): number | null {\n  if (value === undefined || !/^\\d+$/.test(value)) return null\n  const seconds = Number(value)\n  return Number.isSafeInteger(seconds) ? seconds : null\n}\n\nfunction toAttachment(attachment: EmailAttachment): Attachment {\n  const result: Attachment = {\n    filename: attachment.filename,\n    content: ArrayBuffer.isView(attachment.content)\n      ? Buffer.from(attachment.content)\n      : attachment.content,\n  }\n  if (attachment.contentType !== undefined) result.contentType = attachment.contentType\n  return result\n}\n\n/** The SDK operations required by the adapter; a test factory can return a plain object. */\nexport type ResendEmailClient = { readonly emails: Pick<Resend['emails'], 'send'> }\n\n/**\n * Send without package retries or logs. Ported from Suparelay's resend-email-service.ts.\n * The Resend SDK itself logs API errors outside production.\n */\nexport class ResendEmailService implements IEmailService {\n  /** Load the SDK on the first send. Constructing the service does not load it. */\n  static create(apiKey: string, fromAddress: string): ResendEmailService {\n    return new ResendEmailService(\n      () => import('resend').then(({ Resend }) => new Resend(apiKey)),\n      fromAddress,\n    )\n  }\n\n  private client: Promise<ResendEmailClient> | undefined\n\n  /** Supply an async factory. The service calls it once, on the first send, and keeps its promise. */\n  constructor(\n    private readonly createClient: () => Promise<ResendEmailClient>,\n    private readonly fromAddress: string,\n  ) {}\n\n  /** Resolve after acceptance. Provider failures throw EmailServiceError; SDK defects retain their identity. */\n  async sendEmail(email: OutboundEmail): Promise<EmailAccepted> {\n    if (this.client === undefined) {\n      // Cache synchronous factory throws as rejections too, so later sends cannot initialize again.\n      this.client = Promise.resolve().then(this.createClient)\n    }\n    const client = await this.client\n    const payload: CreateEmailOptions = {\n      from: email.from ?? this.fromAddress,\n      to: [email.to].flat(),\n      subject: email.subject,\n      html: email.html,\n    }\n    if (email.text !== undefined) payload.text = email.text\n    if (email.replyTo !== undefined) payload.replyTo = email.replyTo\n    if (email.tags !== undefined)\n      payload.tags = Object.entries(email.tags).map(([name, value]) => ({ name, value }))\n    if (email.attachments !== undefined) payload.attachments = email.attachments.map(toAttachment)\n    const result = await client.emails.send(\n      payload,\n      email.idempotencyKey === undefined ? undefined : { idempotencyKey: email.idempotencyKey },\n    )\n    if (result.error !== null) {\n      throw new EmailServiceError({\n        reason: reasonFromResend(result.error),\n        provider: 'resend',\n        providerCode: result.error.name,\n        statusCode: result.error.statusCode,\n        retryAfter: retryAfterSeconds(result.headers?.['retry-after']),\n        cause: result.error,\n      })\n    }\n    return { providerId: result.data.id }\n  }\n}\n","import type { WebhookEventPayload } from 'resend'\nimport { z } from 'zod'\n\nimport { EmailAddressSchema, parseBounceType, type BounceType } from '@/core'\n\nconst SIMPLE_EMAIL_TYPES = [\n  'email.sent',\n  'email.scheduled',\n  'email.delivered',\n  'email.delivery_delayed',\n  'email.complained',\n  'email.opened',\n  'email.received',\n  'email.suppressed',\n] as const\n\n/** Resend email event names supported by this module. */\nexport type EmailEventType =\n  | (typeof SIMPLE_EMAIL_TYPES)[number]\n  | 'email.bounced'\n  | 'email.failed'\n  | 'email.clicked'\n\nconst EMAIL_TYPES = {\n  'email.sent': true,\n  'email.scheduled': true,\n  'email.delivered': true,\n  'email.delivery_delayed': true,\n  'email.complained': true,\n  'email.opened': true,\n  'email.received': true,\n  'email.suppressed': true,\n  'email.bounced': true,\n  'email.failed': true,\n  'email.clicked': true,\n} satisfies Record<Extract<WebhookEventPayload['type'], `email.${string}`>, true>\n\nconst BaseDataSchema = z.object({\n  email_id: z.string().min(1),\n  to: z.array(EmailAddressSchema).min(1),\n  subject: z.string(),\n  tags: z.record(z.string(), z.string()).default({}),\n})\n\nconst EmailPayloadSchema = z.discriminatedUnion('type', [\n  z.object({ type: z.enum(SIMPLE_EMAIL_TYPES), data: BaseDataSchema }),\n  z.object({\n    type: z.literal('email.bounced'),\n    data: BaseDataSchema.extend({\n      bounce: z.object({\n        type: z.string().optional(),\n        subType: z.string().nullable().optional(),\n        message: z.string(),\n      }),\n    }),\n  }),\n  z.object({\n    type: z.literal('email.failed'),\n    data: BaseDataSchema.extend({ failed: z.object({ reason: z.string() }) }),\n  }),\n  z.object({\n    type: z.literal('email.clicked'),\n    data: BaseDataSchema.extend({ click: z.object({ link: z.string() }) }),\n  }),\n])\n\ntype EmailEventBase = {\n  readonly id: string\n  readonly emailId: string\n  readonly recipients: readonly string[]\n  readonly subject: string\n  readonly tags: Readonly<Record<string, string>>\n  readonly occurredAt: string\n}\n\n/** A verified event. `id` is the Svix identity; use `resend:event:${id}` as the command id. */\nexport type EmailEvent =\n  | (EmailEventBase & {\n      readonly type: 'email.bounced'\n      readonly bounce: {\n        readonly type: BounceType\n        readonly subType: string | null\n        readonly message: string\n      }\n    })\n  | (EmailEventBase & { readonly type: 'email.failed'; readonly reason: string })\n  | (EmailEventBase & { readonly type: 'email.clicked'; readonly link: string })\n  | (EmailEventBase & { readonly type: (typeof SIMPLE_EMAIL_TYPES)[number] })\n\nconst EventHeaderSchema = z.object({\n  type: z.string(),\n  created_at: z.iso.datetime({ offset: true }),\n})\n\n/** Validate signed provider data before projecting it into the public event contract. */\nexport function parseEmailEvent(\n  payload: WebhookEventPayload,\n  id: string,\n):\n  | { readonly outcome: 'event'; readonly event: EmailEvent }\n  | { readonly outcome: 'ignored'; readonly type: string }\n  | { readonly outcome: 'invalid' } {\n  const header = EventHeaderSchema.safeParse(payload)\n  if (!header.success) return { outcome: 'invalid' }\n  if (!Object.hasOwn(EMAIL_TYPES, header.data.type))\n    return { outcome: 'ignored', type: header.data.type }\n  const parsed = EmailPayloadSchema.safeParse(payload)\n  if (!parsed.success) return { outcome: 'invalid' }\n  const event = parsed.data\n  const base: EmailEventBase = {\n    id,\n    emailId: event.data.email_id,\n    recipients: event.data.to,\n    subject: event.data.subject,\n    tags: event.data.tags,\n    occurredAt: header.data.created_at,\n  }\n  switch (event.type) {\n    case 'email.bounced':\n      return {\n        outcome: 'event',\n        event: {\n          ...base,\n          type: event.type,\n          bounce: {\n            type: parseBounceType(event.data.bounce.type),\n            subType: event.data.bounce.subType ?? null,\n            message: event.data.bounce.message,\n          },\n        },\n      }\n    case 'email.failed':\n      return {\n        outcome: 'event',\n        event: { ...base, type: event.type, reason: event.data.failed.reason },\n      }\n    case 'email.clicked':\n      return { outcome: 'event', event: { ...base, type: event.type, link: event.data.click.link } }\n    default:\n      return { outcome: 'event', event: { ...base, type: event.type } }\n  }\n}\n","import type { Resend } from 'resend'\nimport { z } from 'zod'\n\nimport {\n  WebhookVerificationError,\n  type WebhookVerification,\n  type WebhookVerifier,\n} from '../http/webhook-verification.ts'\nimport { parseEmailEvent, type EmailEvent } from './email-event.ts'\n\n// Separate standardwebhooks versions have different prototypes; its error name remains the same.\nconst SignatureErrorSchema = z\n  .instanceof(Error)\n  .refine((error) => error.name === 'WebhookVerificationError')\n\n/** The SDK's local signature verifier. It makes no API request. */\nexport type ResendWebhookClient = Pick<Resend['webhooks'], 'verify'>\n\n/** Verify Svix signatures and map Resend email events. Ported from Typist's Resend route. */\nexport class ResendWebhook implements WebhookVerifier<EmailEvent> {\n  /** Load the SDK on the first verification. Only the webhook secret is required. */\n  static create(webhookSecret: string): ResendWebhook {\n    return new ResendWebhook(webhookSecret, async () => {\n      const { Resend } = await import('resend')\n      // The SDK requires a nonempty key even though its local verifier never uses that key.\n      return new Resend('re_webhook_verification_only').webhooks\n    })\n  }\n\n  private client: Promise<ResendWebhookClient> | undefined\n\n  /** Inject the local SDK verifier when testing. */\n  constructor(\n    private readonly webhookSecret: string,\n    private readonly verifier: () => Promise<ResendWebhookClient>,\n  ) {}\n\n  /** Verify the raw body and Svix headers. Invalid requests return rejected; configuration and SDK defects propagate. */\n  async verify(body: string, headers: Headers): Promise<WebhookVerification<EmailEvent>> {\n    const id = headers.get('svix-id')\n    const timestamp = headers.get('svix-timestamp')\n    const signature = headers.get('svix-signature')\n    if (!id || !timestamp || !signature)\n      return { outcome: 'rejected', error: new WebhookVerificationError('missing_headers') }\n    const client = await (this.client ??= this.verifier())\n    let payload: ReturnType<ResendWebhookClient['verify']>\n    try {\n      payload = client.verify({\n        payload: body,\n        headers: { id, timestamp, signature },\n        webhookSecret: this.webhookSecret,\n      })\n    } catch (cause) {\n      if (cause instanceof SyntaxError)\n        return {\n          outcome: 'rejected',\n          error: new WebhookVerificationError('invalid_payload', cause),\n        }\n      if (!SignatureErrorSchema.safeParse(cause).success) throw cause\n      return {\n        outcome: 'rejected',\n        error: new WebhookVerificationError('invalid_signature', cause),\n      }\n    }\n    const result = parseEmailEvent(payload, id)\n    if (result.outcome === 'invalid')\n      return { outcome: 'rejected', error: new WebhookVerificationError('invalid_payload') }\n    return result\n  }\n}\n"],"mappings":";;;;;;AAQA,MAAM,cAAc;CAClB,yBAAyB;CACzB,kBAAkB;CAClB,iBAAiB;CACjB,oBAAoB;CACpB,iBAAiB;CACjB,WAAW;CACX,oBAAoB;CACpB,4BAA4B;CAC5B,gCAAgC;CAChC,oBAAoB;CACpB,sBAAsB;CACtB,gBAAgB;CAChB,mBAAmB;CACnB,gBAAgB;CAChB,wBAAwB;CACxB,wBAAwB;CACxB,sBAAsB;CACtB,qBAAqB;CACrB,gBAAgB;CAChB,mBAAmB;CACnB,uBAAuB;AACzB;AAGA,MAAM,qCAAqB,IAAI,IAAoC;CACjE,CAAC,qBAAqB,gBAAgB;CACtC,CAAC,sBAAsB,eAAe;CACtC,CAAC,qBAAqB,eAAe;CACrC,CAAC,mBAAmB,sBAAsB;CAC1C,CAAC,uBAAuB,gBAAgB;CACxC,CAAC,8BAA8B,iBAAiB;AAClD,CAAC;AAED,SAAS,iBAAiB,OAA8C;CACtE,IAAI,OAAO,OAAO,aAAa,MAAM,IAAI,GAAG,OAAO,YAAY,MAAM;CACrE,MAAM,SAAS,mBAAmB,IAAI,MAAM,IAAI;CAChD,IAAI,WAAW,QAAW,OAAO;CACjC,IAAI,MAAM,eAAe,KAAK,OAAO;CACrC,IAAI,MAAM,eAAe,QAAQ,MAAM,cAAc,OAAO,MAAM,aAAa,KAC7E,OAAO;CACT,OAAO;AACT;AAEA,SAAS,kBAAkB,OAA0C;CACnE,IAAI,UAAU,UAAa,CAAC,QAAQ,KAAK,KAAK,GAAG,OAAO;CACxD,MAAM,UAAU,OAAO,KAAK;CAC5B,OAAO,OAAO,cAAc,OAAO,IAAI,UAAU;AACnD;AAEA,SAAS,aAAa,YAAyC;CAC7D,MAAM,SAAqB;EACzB,UAAU,WAAW;EACrB,SAAS,YAAY,OAAO,WAAW,OAAO,IAC1C,OAAO,KAAK,WAAW,OAAO,IAC9B,WAAW;CACjB;CACA,IAAI,WAAW,gBAAgB,QAAW,OAAO,cAAc,WAAW;CAC1E,OAAO;AACT;;;;;AASA,IAAa,qBAAb,MAAa,mBAA4C;CAapC;CACA;;CAZnB,OAAO,OAAO,QAAgB,aAAyC;EACrE,OAAO,IAAI,yBACH,OAAO,SAAS,CAAC,MAAM,EAAE,aAAa,IAAI,OAAO,MAAM,CAAC,GAC9D,WACF;CACF;CAEA,AAAQ;;CAGR,YACE,AAAiB,cACjB,AAAiB,aACjB;EAFiB;EACA;CAChB;;CAGH,MAAM,UAAU,OAA8C;EAC5D,IAAI,KAAK,WAAW,QAElB,KAAK,SAAS,QAAQ,QAAQ,CAAC,CAAC,KAAK,KAAK,YAAY;EAExD,MAAM,SAAS,MAAM,KAAK;EAC1B,MAAM,UAA8B;GAClC,MAAM,MAAM,QAAQ,KAAK;GACzB,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK;GACpB,SAAS,MAAM;GACf,MAAM,MAAM;EACd;EACA,IAAI,MAAM,SAAS,QAAW,QAAQ,OAAO,MAAM;EACnD,IAAI,MAAM,YAAY,QAAW,QAAQ,UAAU,MAAM;EACzD,IAAI,MAAM,SAAS,QACjB,QAAQ,OAAO,OAAO,QAAQ,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,YAAY;GAAE;GAAM;EAAM,EAAE;EACpF,IAAI,MAAM,gBAAgB,QAAW,QAAQ,cAAc,MAAM,YAAY,IAAI,YAAY;EAC7F,MAAM,SAAS,MAAM,OAAO,OAAO,KACjC,SACA,MAAM,mBAAmB,SAAY,SAAY,EAAE,gBAAgB,MAAM,eAAe,CAC1F;EACA,IAAI,OAAO,UAAU,MACnB,MAAM,IAAI,kBAAkB;GAC1B,QAAQ,iBAAiB,OAAO,KAAK;GACrC,UAAU;GACV,cAAc,OAAO,MAAM;GAC3B,YAAY,OAAO,MAAM;GACzB,YAAY,kBAAkB,OAAO,UAAU,cAAc;GAC7D,OAAO,OAAO;EAChB,CAAC;EAEH,OAAO,EAAE,YAAY,OAAO,KAAK,GAAG;CACtC;AACF;;;;AC1HA,MAAM,qBAAqB;CACzB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;AASA,MAAM,cAAc;CAClB,cAAc;CACd,mBAAmB;CACnB,mBAAmB;CACnB,0BAA0B;CAC1B,oBAAoB;CACpB,gBAAgB;CAChB,kBAAkB;CAClB,oBAAoB;CACpB,iBAAiB;CACjB,gBAAgB;CAChB,iBAAiB;AACnB;AAEA,MAAM,iBAAiB,EAAE,OAAO;CAC9B,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CAC1B,IAAI,EAAE,MAAM,kBAAkB,CAAC,CAAC,IAAI,CAAC;CACrC,SAAS,EAAE,OAAO;CAClB,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,qBAAqB,EAAE,mBAAmB,QAAQ;CACtD,EAAE,OAAO;EAAE,MAAM,EAAE,KAAK,kBAAkB;EAAG,MAAM;CAAe,CAAC;CACnE,EAAE,OAAO;EACP,MAAM,EAAE,QAAQ,eAAe;EAC/B,MAAM,eAAe,OAAO,EAC1B,QAAQ,EAAE,OAAO;GACf,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS;GAC1B,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS;GACxC,SAAS,EAAE,OAAO;EACpB,CAAC,EACH,CAAC;CACH,CAAC;CACD,EAAE,OAAO;EACP,MAAM,EAAE,QAAQ,cAAc;EAC9B,MAAM,eAAe,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;CAC1E,CAAC;CACD,EAAE,OAAO;EACP,MAAM,EAAE,QAAQ,eAAe;EAC/B,MAAM,eAAe,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;CACvE,CAAC;AACH,CAAC;AAyBD,MAAM,oBAAoB,EAAE,OAAO;CACjC,MAAM,EAAE,OAAO;CACf,YAAY,EAAE,IAAI,SAAS,EAAE,QAAQ,KAAK,CAAC;AAC7C,CAAC;;AAGD,SAAgB,gBACd,SACA,IAIkC;CAClC,MAAM,SAAS,kBAAkB,UAAU,OAAO;CAClD,IAAI,CAAC,OAAO,SAAS,OAAO,EAAE,SAAS,UAAU;CACjD,IAAI,CAAC,OAAO,OAAO,aAAa,OAAO,KAAK,IAAI,GAC9C,OAAO;EAAE,SAAS;EAAW,MAAM,OAAO,KAAK;CAAK;CACtD,MAAM,SAAS,mBAAmB,UAAU,OAAO;CACnD,IAAI,CAAC,OAAO,SAAS,OAAO,EAAE,SAAS,UAAU;CACjD,MAAM,QAAQ,OAAO;CACrB,MAAM,OAAuB;EAC3B;EACA,SAAS,MAAM,KAAK;EACpB,YAAY,MAAM,KAAK;EACvB,SAAS,MAAM,KAAK;EACpB,MAAM,MAAM,KAAK;EACjB,YAAY,OAAO,KAAK;CAC1B;CACA,QAAQ,MAAM,MAAd;EACE,KAAK,iBACH,OAAO;GACL,SAAS;GACT,OAAO;IACL,GAAG;IACH,MAAM,MAAM;IACZ,QAAQ;KACN,MAAM,gBAAgB,MAAM,KAAK,OAAO,IAAI;KAC5C,SAAS,MAAM,KAAK,OAAO,WAAW;KACtC,SAAS,MAAM,KAAK,OAAO;IAC7B;GACF;EACF;EACF,KAAK,gBACH,OAAO;GACL,SAAS;GACT,OAAO;IAAE,GAAG;IAAM,MAAM,MAAM;IAAM,QAAQ,MAAM,KAAK,OAAO;GAAO;EACvE;EACF,KAAK,iBACH,OAAO;GAAE,SAAS;GAAS,OAAO;IAAE,GAAG;IAAM,MAAM,MAAM;IAAM,MAAM,MAAM,KAAK,MAAM;GAAK;EAAE;EAC/F,SACE,OAAO;GAAE,SAAS;GAAS,OAAO;IAAE,GAAG;IAAM,MAAM,MAAM;GAAK;EAAE;CACpE;AACF;;;;AClIA,MAAM,uBAAuB,EAC1B,WAAW,KAAK,CAAC,CACjB,QAAQ,UAAU,MAAM,SAAS,0BAA0B;;AAM9D,IAAa,gBAAb,MAAa,cAAqD;CAc7C;CACA;;CAbnB,OAAO,OAAO,eAAsC;EAClD,OAAO,IAAI,cAAc,eAAe,YAAY;GAClD,MAAM,EAAE,WAAW,MAAM,OAAO;GAEhC,OAAO,IAAI,OAAO,8BAA8B,CAAC,CAAC;EACpD,CAAC;CACH;CAEA,AAAQ;;CAGR,YACE,AAAiB,eACjB,AAAiB,UACjB;EAFiB;EACA;CAChB;;CAGH,MAAM,OAAO,MAAc,SAA4D;EACrF,MAAM,KAAK,QAAQ,IAAI,SAAS;EAChC,MAAM,YAAY,QAAQ,IAAI,gBAAgB;EAC9C,MAAM,YAAY,QAAQ,IAAI,gBAAgB;EAC9C,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,WACxB,OAAO;GAAE,SAAS;GAAY,OAAO,IAAI,yBAAyB,iBAAiB;EAAE;EACvF,MAAM,SAAS,OAAO,KAAK,WAAW,KAAK,SAAS;EACpD,IAAI;EACJ,IAAI;GACF,UAAU,OAAO,OAAO;IACtB,SAAS;IACT,SAAS;KAAE;KAAI;KAAW;IAAU;IACpC,eAAe,KAAK;GACtB,CAAC;EACH,SAAS,OAAO;GACd,IAAI,iBAAiB,aACnB,OAAO;IACL,SAAS;IACT,OAAO,IAAI,yBAAyB,mBAAmB,KAAK;GAC9D;GACF,IAAI,CAAC,qBAAqB,UAAU,KAAK,CAAC,CAAC,SAAS,MAAM;GAC1D,OAAO;IACL,SAAS;IACT,OAAO,IAAI,yBAAyB,qBAAqB,KAAK;GAChE;EACF;EACA,MAAM,SAAS,gBAAgB,SAAS,EAAE;EAC1C,IAAI,OAAO,YAAY,WACrB,OAAO;GAAE,SAAS;GAAY,OAAO,IAAI,yBAAyB,iBAAiB;EAAE;EACvF,OAAO;CACT;AACF"}
+{"version":3,"file":"resend.js","names":[],"sources":["../src/infrastructure/resend/resend-email-service.ts","../src/infrastructure/resend/email-event.ts","../src/infrastructure/resend/resend-webhook.ts"],"sourcesContent":["import { Buffer } from 'node:buffer'\n\nimport type { Attachment, CreateEmailOptions, ErrorResponse, Resend } from 'resend'\n\nimport type { EmailAccepted, EmailAttachment, IEmailService, OutboundEmail } from '@/application'\nimport { EmailServiceError, type EmailSendFailureReason } from '@/core'\n\n// SDK additions must receive an explicit classification before the package builds.\nconst SDK_REASONS = {\n  invalid_idempotency_key: 'invalid_request',\n  validation_error: 'invalid_request',\n  missing_api_key: 'configuration',\n  restricted_api_key: 'configuration',\n  invalid_api_key: 'configuration',\n  not_found: 'invalid_request',\n  method_not_allowed: 'invalid_request',\n  invalid_idempotent_request: 'invalid_request',\n  concurrent_idempotent_requests: 'idempotency_conflict',\n  invalid_attachment: 'invalid_request',\n  invalid_from_address: 'invalid_request',\n  invalid_access: 'configuration',\n  invalid_parameter: 'invalid_request',\n  invalid_region: 'invalid_request',\n  missing_required_field: 'invalid_request',\n  monthly_quota_exceeded: 'quota_exceeded',\n  daily_quota_exceeded: 'quota_exceeded',\n  rate_limit_exceeded: 'rate_limited',\n  security_error: 'configuration',\n  application_error: 'provider_error',\n  internal_server_error: 'provider_error',\n} satisfies Record<ErrorResponse['name'], EmailSendFailureReason>\n\n// Resend documents these codes before its SDK includes them in ErrorResponse.\nconst DOCUMENTED_REASONS = new Map<string, EmailSendFailureReason>([\n  ['email_above_quota', 'quota_exceeded'],\n  ['invalid_permission', 'configuration'],\n  ['suspended_api_key', 'configuration'],\n  ['resource_locked', 'idempotency_conflict'],\n  ['service_unavailable', 'provider_error'],\n  ['missing_required_parameter', 'invalid_request'],\n])\n\nfunction reasonFromResend(error: ErrorResponse): EmailSendFailureReason {\n  if (Object.hasOwn(SDK_REASONS, error.name)) return SDK_REASONS[error.name]\n  const reason = DOCUMENTED_REASONS.get(error.name)\n  if (reason !== undefined) return reason\n  if (error.statusCode === 429) return 'rate_limited'\n  if (error.statusCode !== null && error.statusCode >= 400 && error.statusCode < 500)\n    return 'invalid_request'\n  return 'provider_error'\n}\n\nfunction retryAfterSeconds(value: string | undefined): number | null {\n  if (value === undefined || !/^\\d+$/.test(value)) return null\n  const seconds = Number(value)\n  return Number.isSafeInteger(seconds) ? seconds : null\n}\n\nfunction toAttachment(attachment: EmailAttachment): Attachment {\n  const result: Attachment = {\n    filename: attachment.filename,\n    content: ArrayBuffer.isView(attachment.content)\n      ? Buffer.from(attachment.content)\n      : attachment.content,\n  }\n  if (attachment.contentType !== undefined) result.contentType = attachment.contentType\n  return result\n}\n\n/** The SDK operations required by the adapter; a test factory can return a plain object. */\nexport type ResendEmailClient = { readonly emails: Pick<Resend['emails'], 'send'> }\n\n/**\n * Send without package retries or logs. Ported from Suparelay's resend-email-service.ts.\n * The Resend SDK itself logs API errors outside production.\n */\nexport class ResendEmailService implements IEmailService {\n  /** Load the SDK on the first send. Constructing the service does not load it. */\n  static create(apiKey: string, fromAddress: string): ResendEmailService {\n    return new ResendEmailService(\n      () => import('resend').then(({ Resend }) => new Resend(apiKey)),\n      fromAddress,\n    )\n  }\n\n  private client: Promise<ResendEmailClient> | undefined\n\n  /** Supply an async factory. The service calls it once, on the first send, and keeps its promise. */\n  constructor(\n    private readonly createClient: () => Promise<ResendEmailClient>,\n    private readonly fromAddress: string,\n  ) {}\n\n  /** Resolve after acceptance. Provider failures throw EmailServiceError; SDK defects retain their identity. */\n  async sendEmail(email: OutboundEmail): Promise<EmailAccepted> {\n    if (this.client === undefined) {\n      // Cache synchronous factory throws as rejections too, so later sends cannot initialize again.\n      this.client = Promise.resolve().then(this.createClient)\n    }\n    const client = await this.client\n    const payload: CreateEmailOptions = {\n      from: email.from ?? this.fromAddress,\n      to: [email.to].flat(),\n      subject: email.subject,\n      html: email.html,\n    }\n    if (email.text !== undefined) payload.text = email.text\n    if (email.replyTo !== undefined) payload.replyTo = email.replyTo\n    if (email.tags !== undefined)\n      payload.tags = Object.entries(email.tags).map(([name, value]) => ({ name, value }))\n    if (email.attachments !== undefined) payload.attachments = email.attachments.map(toAttachment)\n    const result = await client.emails.send(\n      payload,\n      email.idempotencyKey === undefined ? undefined : { idempotencyKey: email.idempotencyKey },\n    )\n    if (result.error !== null) {\n      throw new EmailServiceError({\n        reason: reasonFromResend(result.error),\n        provider: 'resend',\n        providerCode: result.error.name,\n        statusCode: result.error.statusCode,\n        retryAfter: retryAfterSeconds(result.headers?.['retry-after']),\n        cause: result.error,\n      })\n    }\n    return { providerId: result.data.id }\n  }\n}\n","import type { WebhookEventPayload } from 'resend'\nimport { z } from 'zod'\n\nimport { EmailAddressSchema, parseBounceType, type BounceType } from '@/core'\n\nconst SIMPLE_EMAIL_TYPES = [\n  'email.sent',\n  'email.scheduled',\n  'email.delivered',\n  'email.delivery_delayed',\n  'email.complained',\n  'email.opened',\n  'email.received',\n  'email.suppressed',\n] as const\n\n/** Resend email event names supported by this module. */\nexport type EmailEventType =\n  | (typeof SIMPLE_EMAIL_TYPES)[number]\n  | 'email.bounced'\n  | 'email.failed'\n  | 'email.clicked'\n\nconst EMAIL_TYPES = {\n  'email.sent': true,\n  'email.scheduled': true,\n  'email.delivered': true,\n  'email.delivery_delayed': true,\n  'email.complained': true,\n  'email.opened': true,\n  'email.received': true,\n  'email.suppressed': true,\n  'email.bounced': true,\n  'email.failed': true,\n  'email.clicked': true,\n} satisfies Record<Extract<WebhookEventPayload['type'], `email.${string}`>, true>\n\nconst BaseDataSchema = z.object({\n  email_id: z.string().min(1),\n  to: z.array(EmailAddressSchema).min(1),\n  subject: z.string(),\n  tags: z.record(z.string(), z.string()).default({}),\n})\n\nconst EmailPayloadSchema = z.discriminatedUnion('type', [\n  z.object({ type: z.enum(SIMPLE_EMAIL_TYPES), data: BaseDataSchema }),\n  z.object({\n    type: z.literal('email.bounced'),\n    data: BaseDataSchema.extend({\n      bounce: z.object({\n        type: z.string().optional(),\n        subType: z.string().nullable().optional(),\n        message: z.string(),\n      }),\n    }),\n  }),\n  z.object({\n    type: z.literal('email.failed'),\n    data: BaseDataSchema.extend({ failed: z.object({ reason: z.string() }) }),\n  }),\n  z.object({\n    type: z.literal('email.clicked'),\n    data: BaseDataSchema.extend({ click: z.object({ link: z.string() }) }),\n  }),\n])\n\ntype EmailEventBase = {\n  readonly id: string\n  readonly emailId: string\n  readonly recipients: readonly string[]\n  readonly subject: string\n  readonly tags: Readonly<Record<string, string>>\n  readonly occurredAt: string\n}\n\n/** A verified event. `id` is the Svix identity; use `resend:event:${id}` as the command id. */\nexport type EmailEvent =\n  | (EmailEventBase & {\n      readonly type: 'email.bounced'\n      readonly bounce: {\n        readonly type: BounceType\n        readonly subType: string | null\n        readonly message: string\n      }\n    })\n  | (EmailEventBase & { readonly type: 'email.failed'; readonly reason: string })\n  | (EmailEventBase & { readonly type: 'email.clicked'; readonly link: string })\n  | (EmailEventBase & { readonly type: (typeof SIMPLE_EMAIL_TYPES)[number] })\n\nconst EventHeaderSchema = z.object({\n  type: z.string(),\n  created_at: z.iso.datetime({ offset: true }),\n})\n\n/** Validate signed provider data before projecting it into the public event contract. */\nexport function parseEmailEvent(payload: WebhookEventPayload, id: string): EmailEvent | null {\n  const header = EventHeaderSchema.parse(payload)\n  if (!Object.hasOwn(EMAIL_TYPES, header.type)) return null\n  const event = EmailPayloadSchema.parse(payload)\n  const base: EmailEventBase = {\n    id,\n    emailId: event.data.email_id,\n    recipients: event.data.to,\n    subject: event.data.subject,\n    tags: event.data.tags,\n    occurredAt: header.created_at,\n  }\n  switch (event.type) {\n    case 'email.bounced':\n      return {\n        ...base,\n        type: event.type,\n        bounce: {\n          type: parseBounceType(event.data.bounce.type),\n          subType: event.data.bounce.subType ?? null,\n          message: event.data.bounce.message,\n        },\n      }\n    case 'email.failed':\n      return { ...base, type: event.type, reason: event.data.failed.reason }\n    case 'email.clicked':\n      return { ...base, type: event.type, link: event.data.click.link }\n    default:\n      return { ...base, type: event.type }\n  }\n}\n","import type { Resend } from 'resend'\nimport { z } from 'zod'\n\nimport { WebhookVerificationError, type WebhookVerifier } from '../http/webhook-verification.ts'\nimport { parseEmailEvent, type EmailEvent } from './email-event.ts'\n\n// Separate standardwebhooks versions have different prototypes; its error name remains the same.\nconst SignatureErrorSchema = z\n  .instanceof(Error)\n  .refine((error) => error.name === 'WebhookVerificationError')\n\n/** The SDK's local signature verifier. It makes no API request. */\nexport type ResendWebhookClient = Pick<Resend['webhooks'], 'verify'>\n\n/** Verify Svix signatures and map Resend email events. Ported from Typist's Resend route. */\nexport class ResendWebhook implements WebhookVerifier<EmailEvent> {\n  /** Load the SDK on the first verification. Only the webhook secret is required. */\n  static create(webhookSecret: string): ResendWebhook {\n    return new ResendWebhook(webhookSecret, async () => {\n      const { Resend } = await import('resend')\n      // The SDK requires a nonempty key even though its local verifier never uses that key.\n      return new Resend('re_webhook_verification_only').webhooks\n    })\n  }\n\n  private client: Promise<ResendWebhookClient> | undefined\n\n  /** Inject the local SDK verifier when testing. */\n  constructor(\n    private readonly webhookSecret: string,\n    private readonly verifier: () => Promise<ResendWebhookClient>,\n  ) {}\n\n  /** Verify the raw body and Svix headers. Invalid requests throw typed errors; other failures propagate. */\n  async verify(body: string, headers: Headers): Promise<EmailEvent | null> {\n    const id = headers.get('svix-id')\n    const timestamp = headers.get('svix-timestamp')\n    const signature = headers.get('svix-signature')\n    if (!id || !timestamp || !signature) throw new WebhookVerificationError('missing_headers')\n    const client = await (this.client ??= this.verifier())\n    let payload: ReturnType<ResendWebhookClient['verify']>\n    try {\n      payload = client.verify({\n        payload: body,\n        headers: { id, timestamp, signature },\n        webhookSecret: this.webhookSecret,\n      })\n    } catch (cause) {\n      if (cause instanceof SyntaxError) throw new WebhookVerificationError('invalid_payload', cause)\n      if (!SignatureErrorSchema.safeParse(cause).success) throw cause\n      throw new WebhookVerificationError('invalid_signature', cause)\n    }\n    try {\n      return parseEmailEvent(payload, id)\n    } catch (cause) {\n      if (cause instanceof z.ZodError) throw new WebhookVerificationError('invalid_payload', cause)\n      throw cause\n    }\n  }\n}\n"],"mappings":";;;;;;AAQA,MAAM,cAAc;CAClB,yBAAyB;CACzB,kBAAkB;CAClB,iBAAiB;CACjB,oBAAoB;CACpB,iBAAiB;CACjB,WAAW;CACX,oBAAoB;CACpB,4BAA4B;CAC5B,gCAAgC;CAChC,oBAAoB;CACpB,sBAAsB;CACtB,gBAAgB;CAChB,mBAAmB;CACnB,gBAAgB;CAChB,wBAAwB;CACxB,wBAAwB;CACxB,sBAAsB;CACtB,qBAAqB;CACrB,gBAAgB;CAChB,mBAAmB;CACnB,uBAAuB;AACzB;AAGA,MAAM,qCAAqB,IAAI,IAAoC;CACjE,CAAC,qBAAqB,gBAAgB;CACtC,CAAC,sBAAsB,eAAe;CACtC,CAAC,qBAAqB,eAAe;CACrC,CAAC,mBAAmB,sBAAsB;CAC1C,CAAC,uBAAuB,gBAAgB;CACxC,CAAC,8BAA8B,iBAAiB;AAClD,CAAC;AAED,SAAS,iBAAiB,OAA8C;CACtE,IAAI,OAAO,OAAO,aAAa,MAAM,IAAI,GAAG,OAAO,YAAY,MAAM;CACrE,MAAM,SAAS,mBAAmB,IAAI,MAAM,IAAI;CAChD,IAAI,WAAW,QAAW,OAAO;CACjC,IAAI,MAAM,eAAe,KAAK,OAAO;CACrC,IAAI,MAAM,eAAe,QAAQ,MAAM,cAAc,OAAO,MAAM,aAAa,KAC7E,OAAO;CACT,OAAO;AACT;AAEA,SAAS,kBAAkB,OAA0C;CACnE,IAAI,UAAU,UAAa,CAAC,QAAQ,KAAK,KAAK,GAAG,OAAO;CACxD,MAAM,UAAU,OAAO,KAAK;CAC5B,OAAO,OAAO,cAAc,OAAO,IAAI,UAAU;AACnD;AAEA,SAAS,aAAa,YAAyC;CAC7D,MAAM,SAAqB;EACzB,UAAU,WAAW;EACrB,SAAS,YAAY,OAAO,WAAW,OAAO,IAC1C,OAAO,KAAK,WAAW,OAAO,IAC9B,WAAW;CACjB;CACA,IAAI,WAAW,gBAAgB,QAAW,OAAO,cAAc,WAAW;CAC1E,OAAO;AACT;;;;;AASA,IAAa,qBAAb,MAAa,mBAA4C;CAapC;CACA;;CAZnB,OAAO,OAAO,QAAgB,aAAyC;EACrE,OAAO,IAAI,yBACH,OAAO,SAAS,CAAC,MAAM,EAAE,aAAa,IAAI,OAAO,MAAM,CAAC,GAC9D,WACF;CACF;CAEA,AAAQ;;CAGR,YACE,AAAiB,cACjB,AAAiB,aACjB;EAFiB;EACA;CAChB;;CAGH,MAAM,UAAU,OAA8C;EAC5D,IAAI,KAAK,WAAW,QAElB,KAAK,SAAS,QAAQ,QAAQ,CAAC,CAAC,KAAK,KAAK,YAAY;EAExD,MAAM,SAAS,MAAM,KAAK;EAC1B,MAAM,UAA8B;GAClC,MAAM,MAAM,QAAQ,KAAK;GACzB,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK;GACpB,SAAS,MAAM;GACf,MAAM,MAAM;EACd;EACA,IAAI,MAAM,SAAS,QAAW,QAAQ,OAAO,MAAM;EACnD,IAAI,MAAM,YAAY,QAAW,QAAQ,UAAU,MAAM;EACzD,IAAI,MAAM,SAAS,QACjB,QAAQ,OAAO,OAAO,QAAQ,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,YAAY;GAAE;GAAM;EAAM,EAAE;EACpF,IAAI,MAAM,gBAAgB,QAAW,QAAQ,cAAc,MAAM,YAAY,IAAI,YAAY;EAC7F,MAAM,SAAS,MAAM,OAAO,OAAO,KACjC,SACA,MAAM,mBAAmB,SAAY,SAAY,EAAE,gBAAgB,MAAM,eAAe,CAC1F;EACA,IAAI,OAAO,UAAU,MACnB,MAAM,IAAI,kBAAkB;GAC1B,QAAQ,iBAAiB,OAAO,KAAK;GACrC,UAAU;GACV,cAAc,OAAO,MAAM;GAC3B,YAAY,OAAO,MAAM;GACzB,YAAY,kBAAkB,OAAO,UAAU,cAAc;GAC7D,OAAO,OAAO;EAChB,CAAC;EAEH,OAAO,EAAE,YAAY,OAAO,KAAK,GAAG;CACtC;AACF;;;;AC1HA,MAAM,qBAAqB;CACzB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;AASA,MAAM,cAAc;CAClB,cAAc;CACd,mBAAmB;CACnB,mBAAmB;CACnB,0BAA0B;CAC1B,oBAAoB;CACpB,gBAAgB;CAChB,kBAAkB;CAClB,oBAAoB;CACpB,iBAAiB;CACjB,gBAAgB;CAChB,iBAAiB;AACnB;AAEA,MAAM,iBAAiB,EAAE,OAAO;CAC9B,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CAC1B,IAAI,EAAE,MAAM,kBAAkB,CAAC,CAAC,IAAI,CAAC;CACrC,SAAS,EAAE,OAAO;CAClB,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,qBAAqB,EAAE,mBAAmB,QAAQ;CACtD,EAAE,OAAO;EAAE,MAAM,EAAE,KAAK,kBAAkB;EAAG,MAAM;CAAe,CAAC;CACnE,EAAE,OAAO;EACP,MAAM,EAAE,QAAQ,eAAe;EAC/B,MAAM,eAAe,OAAO,EAC1B,QAAQ,EAAE,OAAO;GACf,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS;GAC1B,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS;GACxC,SAAS,EAAE,OAAO;EACpB,CAAC,EACH,CAAC;CACH,CAAC;CACD,EAAE,OAAO;EACP,MAAM,EAAE,QAAQ,cAAc;EAC9B,MAAM,eAAe,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;CAC1E,CAAC;CACD,EAAE,OAAO;EACP,MAAM,EAAE,QAAQ,eAAe;EAC/B,MAAM,eAAe,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;CACvE,CAAC;AACH,CAAC;AAyBD,MAAM,oBAAoB,EAAE,OAAO;CACjC,MAAM,EAAE,OAAO;CACf,YAAY,EAAE,IAAI,SAAS,EAAE,QAAQ,KAAK,CAAC;AAC7C,CAAC;;AAGD,SAAgB,gBAAgB,SAA8B,IAA+B;CAC3F,MAAM,SAAS,kBAAkB,MAAM,OAAO;CAC9C,IAAI,CAAC,OAAO,OAAO,aAAa,OAAO,IAAI,GAAG,OAAO;CACrD,MAAM,QAAQ,mBAAmB,MAAM,OAAO;CAC9C,MAAM,OAAuB;EAC3B;EACA,SAAS,MAAM,KAAK;EACpB,YAAY,MAAM,KAAK;EACvB,SAAS,MAAM,KAAK;EACpB,MAAM,MAAM,KAAK;EACjB,YAAY,OAAO;CACrB;CACA,QAAQ,MAAM,MAAd;EACE,KAAK,iBACH,OAAO;GACL,GAAG;GACH,MAAM,MAAM;GACZ,QAAQ;IACN,MAAM,gBAAgB,MAAM,KAAK,OAAO,IAAI;IAC5C,SAAS,MAAM,KAAK,OAAO,WAAW;IACtC,SAAS,MAAM,KAAK,OAAO;GAC7B;EACF;EACF,KAAK,gBACH,OAAO;GAAE,GAAG;GAAM,MAAM,MAAM;GAAM,QAAQ,MAAM,KAAK,OAAO;EAAO;EACvE,KAAK,iBACH,OAAO;GAAE,GAAG;GAAM,MAAM,MAAM;GAAM,MAAM,MAAM,KAAK,MAAM;EAAK;EAClE,SACE,OAAO;GAAE,GAAG;GAAM,MAAM,MAAM;EAAK;CACvC;AACF;;;;ACtHA,MAAM,uBAAuB,EAC1B,WAAW,KAAK,CAAC,CACjB,QAAQ,UAAU,MAAM,SAAS,0BAA0B;;AAM9D,IAAa,gBAAb,MAAa,cAAqD;CAc7C;CACA;;CAbnB,OAAO,OAAO,eAAsC;EAClD,OAAO,IAAI,cAAc,eAAe,YAAY;GAClD,MAAM,EAAE,WAAW,MAAM,OAAO;GAEhC,OAAO,IAAI,OAAO,8BAA8B,CAAC,CAAC;EACpD,CAAC;CACH;CAEA,AAAQ;;CAGR,YACE,AAAiB,eACjB,AAAiB,UACjB;EAFiB;EACA;CAChB;;CAGH,MAAM,OAAO,MAAc,SAA8C;EACvE,MAAM,KAAK,QAAQ,IAAI,SAAS;EAChC,MAAM,YAAY,QAAQ,IAAI,gBAAgB;EAC9C,MAAM,YAAY,QAAQ,IAAI,gBAAgB;EAC9C,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,WAAW,MAAM,IAAI,yBAAyB,iBAAiB;EACzF,MAAM,SAAS,OAAO,KAAK,WAAW,KAAK,SAAS;EACpD,IAAI;EACJ,IAAI;GACF,UAAU,OAAO,OAAO;IACtB,SAAS;IACT,SAAS;KAAE;KAAI;KAAW;IAAU;IACpC,eAAe,KAAK;GACtB,CAAC;EACH,SAAS,OAAO;GACd,IAAI,iBAAiB,aAAa,MAAM,IAAI,yBAAyB,mBAAmB,KAAK;GAC7F,IAAI,CAAC,qBAAqB,UAAU,KAAK,CAAC,CAAC,SAAS,MAAM;GAC1D,MAAM,IAAI,yBAAyB,qBAAqB,KAAK;EAC/D;EACA,IAAI;GACF,OAAO,gBAAgB,SAAS,EAAE;EACpC,SAAS,OAAO;GACd,IAAI,iBAAiB,EAAE,UAAU,MAAM,IAAI,yBAAyB,mBAAmB,KAAK;GAC5F,MAAM;EACR;CACF;AACF"}

package/dist/sentry/client.d.ts

@@ -1,4 +1,4 @@
-import { f as LoggerErrorHook } from "../index-DvJUcSW1.js";
+import { u as LoggerErrorHook } from "../index-DUFS0SJ_.js";
 import * as Sentry from "@sentry/tanstackstart-react";
 //#region src/infrastructure/sentry/client.d.ts
 /** Application settings use Sentry's names; enablement and environment belong to the application. */

package/dist/sentry/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","names":[],"sources":["../../src/infrastructure/sentry/client.ts"],"mappings":";;;;YAMY,sBAAsB,OAAO;WAC9B;WACA;WACA;;;wBAIK,0BAA0B,SAAS,sBAAsB,OAAO;;wBAehE,+BAA+B;;wBAS/B,iBAAiB,SAAS,sBAAsB,kBAAkB,OAAO;;wBAOzE,uBACd,QAAQ,kBAAkB,OAAO;;qBAOtB,sBAAsB,OAAO"}
+{"version":3,"file":"client.d.ts","names":[],"sources":["../../src/infrastructure/sentry/client.ts"],"mappings":";;;;YAMY,sBAAsB,OAAO;WAC9B;WACA;WACA;;;wBAIK,0BAA0B,SAAS,sBAAsB,OAAO;;wBAehE,+BAA+B;;wBAY/B,iBAAiB,SAAS,sBAAsB,kBAAkB,OAAO;;wBAOzE,uBACd,QAAQ,kBAAkB,OAAO;;qBAOtB,sBAAsB,OAAO"}

package/dist/sentry/client.js

@@ -1,4 +1,4 @@
-import { s as setLoggerErrorHook } from "../core-ClSP5-V9.js";
+import { a as setLoggerErrorHook } from "../core-BT1dSEQI.js";
 import * as Sentry from "@sentry/tanstackstart-react";
 import { isNotFound, isRedirect } from "@tanstack/react-router";
 
@@ -23,10 +23,16 @@ function createSentryClientOptions(options) {
 }
 /** Forward logged browser errors once, excluding TanStack navigation control flow. */
 function createSentryLoggerErrorHook() {
-	return ({ error, context }) => {
+	return ({ error, userId, attributes }) => {
 		if (isNotFound(error) || isRedirect(error)) return;
-		const captured = error instanceof Error ? error : /* @__PURE__ */ new Error("Logger received a non-Error value");
-		Sentry.captureException(captured, { extra: context });
+		if (userId !== void 0) {
+			Sentry.captureException(error, {
+				extra: attributes,
+				user: { id: userId }
+			});
+			return;
+		}
+		Sentry.captureException(error, { extra: attributes });
 	};
 }
 /** Initialize once in the browser entrypoint before hydration; server imports have no side effects. */

package/dist/sentry/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","names":[],"sources":["../../src/infrastructure/sentry/client.ts"],"sourcesContent":["import * as Sentry from '@sentry/tanstackstart-react'\nimport { isNotFound, isRedirect } from '@tanstack/react-router'\n\nimport { setLoggerErrorHook, type LoggerErrorHook } from '@/core'\n\n/** Application settings use Sentry's names; enablement and environment belong to the application. */\nexport type SentryClientOptions = Sentry.BrowserOptions & {\n  readonly dsn: string\n  readonly environment: string\n  readonly enabled: boolean\n}\n\n/** Privacy defaults from Porte and browser noise filtering from Typist; explicit SDK options take precedence. */\nexport function createSentryClientOptions(options: SentryClientOptions): Sentry.BrowserOptions {\n  return {\n    enableLogs: true,\n    ignoreErrors: [/Failed to execute '(insertBefore|removeChild)' on 'Node'/],\n    ...options,\n    dataCollection: {\n      userInfo: false,\n      httpBodies: [],\n      ...options.dataCollection,\n      genAI: { inputs: false, outputs: false, ...options.dataCollection?.genAI },\n    },\n  }\n}\n\n/** Forward logged browser errors once, excluding TanStack navigation control flow. */\nexport function createSentryLoggerErrorHook(): LoggerErrorHook {\n  return ({ error, context }) => {\n    if (isNotFound(error) || isRedirect(error)) return\n    const captured = error instanceof Error ? error : new Error('Logger received a non-Error value')\n    Sentry.captureException(captured, { extra: context })\n  }\n}\n\n/** Initialize once in the browser entrypoint before hydration; server imports have no side effects. */\nexport function initializeSentry(options: SentryClientOptions): ReturnType<typeof Sentry.init> {\n  const client = Sentry.init(createSentryClientOptions(options))\n  setLoggerErrorHook(createSentryLoggerErrorHook())\n  return client\n}\n\n/** Attach tracing once after creating the browser router, as Porte does in getRouter. */\nexport function instrumentSentryRouter(\n  router: Parameters<typeof Sentry.tanstackRouterBrowserTracingIntegration>[0],\n): void {\n  if (router.isServer) return\n  Sentry.addIntegration(Sentry.tanstackRouterBrowserTracingIntegration(router))\n}\n\n/** The SDK error boundary; the application supplies its fallback component. */\nexport const ErrorBoundary: typeof Sentry.ErrorBoundary = Sentry.ErrorBoundary\n\nexport { Sentry }\n"],"mappings":";;;;;;AAaA,SAAgB,0BAA0B,SAAqD;CAC7F,OAAO;EACL,YAAY;EACZ,cAAc,CAAC,0DAA0D;EACzE,GAAG;EACH,gBAAgB;GACd,UAAU;GACV,YAAY,CAAC;GACb,GAAG,QAAQ;GACX,OAAO;IAAE,QAAQ;IAAO,SAAS;IAAO,GAAG,QAAQ,gBAAgB;GAAM;EAC3E;CACF;AACF;;AAGA,SAAgB,8BAA+C;CAC7D,QAAQ,EAAE,OAAO,cAAc;EAC7B,IAAI,WAAW,KAAK,KAAK,WAAW,KAAK,GAAG;EAC5C,MAAM,WAAW,iBAAiB,QAAQ,wBAAQ,IAAI,MAAM,mCAAmC;EAC/F,OAAO,iBAAiB,UAAU,EAAE,OAAO,QAAQ,CAAC;CACtD;AACF;;AAGA,SAAgB,iBAAiB,SAA8D;CAC7F,MAAM,SAAS,OAAO,KAAK,0BAA0B,OAAO,CAAC;CAC7D,mBAAmB,4BAA4B,CAAC;CAChD,OAAO;AACT;;AAGA,SAAgB,uBACd,QACM;CACN,IAAI,OAAO,UAAU;CACrB,OAAO,eAAe,OAAO,wCAAwC,MAAM,CAAC;AAC9E;;AAGA,MAAa,gBAA6C,OAAO"}
+{"version":3,"file":"client.js","names":[],"sources":["../../src/infrastructure/sentry/client.ts"],"sourcesContent":["import * as Sentry from '@sentry/tanstackstart-react'\nimport { isNotFound, isRedirect } from '@tanstack/react-router'\n\nimport { setLoggerErrorHook, type LoggerErrorHook } from '@/core'\n\n/** Application settings use Sentry's names; enablement and environment belong to the application. */\nexport type SentryClientOptions = Sentry.BrowserOptions & {\n  readonly dsn: string\n  readonly environment: string\n  readonly enabled: boolean\n}\n\n/** Privacy defaults from Porte and browser noise filtering from Typist; explicit SDK options take precedence. */\nexport function createSentryClientOptions(options: SentryClientOptions): Sentry.BrowserOptions {\n  return {\n    enableLogs: true,\n    ignoreErrors: [/Failed to execute '(insertBefore|removeChild)' on 'Node'/],\n    ...options,\n    dataCollection: {\n      userInfo: false,\n      httpBodies: [],\n      ...options.dataCollection,\n      genAI: { inputs: false, outputs: false, ...options.dataCollection?.genAI },\n    },\n  }\n}\n\n/** Forward logged browser errors once, excluding TanStack navigation control flow. */\nexport function createSentryLoggerErrorHook(): LoggerErrorHook {\n  return ({ error, userId, attributes }) => {\n    if (isNotFound(error) || isRedirect(error)) return\n    if (userId !== undefined) {\n      Sentry.captureException(error, { extra: attributes, user: { id: userId } })\n      return\n    }\n    Sentry.captureException(error, { extra: attributes })\n  }\n}\n\n/** Initialize once in the browser entrypoint before hydration; server imports have no side effects. */\nexport function initializeSentry(options: SentryClientOptions): ReturnType<typeof Sentry.init> {\n  const client = Sentry.init(createSentryClientOptions(options))\n  setLoggerErrorHook(createSentryLoggerErrorHook())\n  return client\n}\n\n/** Attach tracing once after creating the browser router, as Porte does in getRouter. */\nexport function instrumentSentryRouter(\n  router: Parameters<typeof Sentry.tanstackRouterBrowserTracingIntegration>[0],\n): void {\n  if (router.isServer) return\n  Sentry.addIntegration(Sentry.tanstackRouterBrowserTracingIntegration(router))\n}\n\n/** The SDK error boundary; the application supplies its fallback component. */\nexport const ErrorBoundary: typeof Sentry.ErrorBoundary = Sentry.ErrorBoundary\n\nexport { Sentry }\n"],"mappings":";;;;;;AAaA,SAAgB,0BAA0B,SAAqD;CAC7F,OAAO;EACL,YAAY;EACZ,cAAc,CAAC,0DAA0D;EACzE,GAAG;EACH,gBAAgB;GACd,UAAU;GACV,YAAY,CAAC;GACb,GAAG,QAAQ;GACX,OAAO;IAAE,QAAQ;IAAO,SAAS;IAAO,GAAG,QAAQ,gBAAgB;GAAM;EAC3E;CACF;AACF;;AAGA,SAAgB,8BAA+C;CAC7D,QAAQ,EAAE,OAAO,QAAQ,iBAAiB;EACxC,IAAI,WAAW,KAAK,KAAK,WAAW,KAAK,GAAG;EAC5C,IAAI,WAAW,QAAW;GACxB,OAAO,iBAAiB,OAAO;IAAE,OAAO;IAAY,MAAM,EAAE,IAAI,OAAO;GAAE,CAAC;GAC1E;EACF;EACA,OAAO,iBAAiB,OAAO,EAAE,OAAO,WAAW,CAAC;CACtD;AACF;;AAGA,SAAgB,iBAAiB,SAA8D;CAC7F,MAAM,SAAS,OAAO,KAAK,0BAA0B,OAAO,CAAC;CAC7D,mBAAmB,4BAA4B,CAAC;CAChD,OAAO;AACT;;AAGA,SAAgB,uBACd,QACM;CACN,IAAI,OAAO,UAAU;CACrB,OAAO,eAAe,OAAO,wCAAwC,MAAM,CAAC;AAC9E;;AAGA,MAAa,gBAA6C,OAAO"}

package/dist/sentry/server.d.ts

@@ -1,5 +1,5 @@
-import { f as LoggerErrorHook } from "../index-DvJUcSW1.js";
-import { H as ObservabilityScope, U as ObservabilityService, W as ObservabilityUser } from "../index-Cchdg2aQ.js";
+import { u as LoggerErrorHook } from "../index-DUFS0SJ_.js";
+import { H as ObservabilityScope, U as ObservabilityService, W as ObservabilityUser } from "../index-CYHXOH08.js";
 import * as Sentry from "@sentry/cloudflare";
 //#region src/infrastructure/sentry/server.d.ts
 /** Application-owned deployment settings with the full Cloudflare SDK option contract. */

package/dist/sentry/server.js

@@ -20,15 +20,15 @@ function createSentryOptions(options) {
 }
 /** Register with setLoggerErrorHook once at startup; an explicit user applies only to this report. */
 function createSentryLoggerErrorHook() {
-	return ({ error, distinctId, context }) => {
-		if (distinctId !== void 0) {
+	return ({ error, userId, attributes }) => {
+		if (userId !== void 0) {
 			Sentry.captureException(error, {
-				extra: context,
-				user: { id: distinctId }
+				extra: attributes,
+				user: { id: userId }
 			});
 			return;
 		}
-		Sentry.captureException(error, { extra: context });
+		Sentry.captureException(error, { extra: attributes });
 	};
 }
 /** Identity and scope adapter from Typist and Porte; call inside Sentry's instrumented runtime. */

package/dist/sentry/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","names":[],"sources":["../../src/infrastructure/sentry/server.ts"],"sourcesContent":["import * as Sentry from '@sentry/cloudflare'\n\nimport type { ObservabilityScope, ObservabilityService, ObservabilityUser } from '@/application'\nimport type { LoggerErrorHook } from '@/core'\n\n/** Application-owned deployment settings with the full Cloudflare SDK option contract. */\nexport type SentryServerOptions = Sentry.CloudflareOptions & {\n  readonly dsn: string\n  readonly environment: string\n  readonly enabled: boolean\n}\n\n/** Options for Workers, Durable Objects, and Workflows, ported from Typist and Porte. */\nexport function createSentryOptions(options: SentryServerOptions): Sentry.CloudflareOptions {\n  return {\n    enableLogs: true,\n    ...options,\n    dataCollection: {\n      userInfo: false,\n      httpBodies: [],\n      ...options.dataCollection,\n      genAI: { inputs: false, outputs: false, ...options.dataCollection?.genAI },\n    },\n  }\n}\n\n/** Register with setLoggerErrorHook once at startup; an explicit user applies only to this report. */\nexport function createSentryLoggerErrorHook(): LoggerErrorHook {\n  return ({ error, distinctId, context }) => {\n    if (distinctId !== undefined) {\n      Sentry.captureException(error, { extra: context, user: { id: distinctId } })\n      return\n    }\n    Sentry.captureException(error, { extra: context })\n  }\n}\n\n/** Identity and scope adapter from Typist and Porte; call inside Sentry's instrumented runtime. */\nexport class SentryObservabilityService implements ObservabilityService {\n  /** Attribute subsequent reports in the current isolation scope. */\n  setUser(user: ObservabilityUser): void {\n    Sentry.setUser(user)\n  }\n\n  /** Await work in a separate scope for each queue message or concurrent operation. */\n  async withIsolationScope<T>(callback: (scope: ObservabilityScope) => T | Promise<T>): Promise<T> {\n    return await Sentry.withIsolationScope(callback)\n  }\n}\n\nexport { Sentry }\n"],"mappings":";;;;AAaA,SAAgB,oBAAoB,SAAwD;CAC1F,OAAO;EACL,YAAY;EACZ,GAAG;EACH,gBAAgB;GACd,UAAU;GACV,YAAY,CAAC;GACb,GAAG,QAAQ;GACX,OAAO;IAAE,QAAQ;IAAO,SAAS;IAAO,GAAG,QAAQ,gBAAgB;GAAM;EAC3E;CACF;AACF;;AAGA,SAAgB,8BAA+C;CAC7D,QAAQ,EAAE,OAAO,YAAY,cAAc;EACzC,IAAI,eAAe,QAAW;GAC5B,OAAO,iBAAiB,OAAO;IAAE,OAAO;IAAS,MAAM,EAAE,IAAI,WAAW;GAAE,CAAC;GAC3E;EACF;EACA,OAAO,iBAAiB,OAAO,EAAE,OAAO,QAAQ,CAAC;CACnD;AACF;;AAGA,IAAa,6BAAb,MAAwE;;CAEtE,QAAQ,MAA+B;EACrC,OAAO,QAAQ,IAAI;CACrB;;CAGA,MAAM,mBAAsB,UAAqE;EAC/F,OAAO,MAAM,OAAO,mBAAmB,QAAQ;CACjD;AACF"}
+{"version":3,"file":"server.js","names":[],"sources":["../../src/infrastructure/sentry/server.ts"],"sourcesContent":["import * as Sentry from '@sentry/cloudflare'\n\nimport type { ObservabilityScope, ObservabilityService, ObservabilityUser } from '@/application'\nimport type { LoggerErrorHook } from '@/core'\n\n/** Application-owned deployment settings with the full Cloudflare SDK option contract. */\nexport type SentryServerOptions = Sentry.CloudflareOptions & {\n  readonly dsn: string\n  readonly environment: string\n  readonly enabled: boolean\n}\n\n/** Options for Workers, Durable Objects, and Workflows, ported from Typist and Porte. */\nexport function createSentryOptions(options: SentryServerOptions): Sentry.CloudflareOptions {\n  return {\n    enableLogs: true,\n    ...options,\n    dataCollection: {\n      userInfo: false,\n      httpBodies: [],\n      ...options.dataCollection,\n      genAI: { inputs: false, outputs: false, ...options.dataCollection?.genAI },\n    },\n  }\n}\n\n/** Register with setLoggerErrorHook once at startup; an explicit user applies only to this report. */\nexport function createSentryLoggerErrorHook(): LoggerErrorHook {\n  return ({ error, userId, attributes }) => {\n    if (userId !== undefined) {\n      Sentry.captureException(error, { extra: attributes, user: { id: userId } })\n      return\n    }\n    Sentry.captureException(error, { extra: attributes })\n  }\n}\n\n/** Identity and scope adapter from Typist and Porte; call inside Sentry's instrumented runtime. */\nexport class SentryObservabilityService implements ObservabilityService {\n  /** Attribute subsequent reports in the current isolation scope. */\n  setUser(user: ObservabilityUser): void {\n    Sentry.setUser(user)\n  }\n\n  /** Await work in a separate scope for each queue message or concurrent operation. */\n  async withIsolationScope<T>(callback: (scope: ObservabilityScope) => T | Promise<T>): Promise<T> {\n    return await Sentry.withIsolationScope(callback)\n  }\n}\n\nexport { Sentry }\n"],"mappings":";;;;AAaA,SAAgB,oBAAoB,SAAwD;CAC1F,OAAO;EACL,YAAY;EACZ,GAAG;EACH,gBAAgB;GACd,UAAU;GACV,YAAY,CAAC;GACb,GAAG,QAAQ;GACX,OAAO;IAAE,QAAQ;IAAO,SAAS;IAAO,GAAG,QAAQ,gBAAgB;GAAM;EAC3E;CACF;AACF;;AAGA,SAAgB,8BAA+C;CAC7D,QAAQ,EAAE,OAAO,QAAQ,iBAAiB;EACxC,IAAI,WAAW,QAAW;GACxB,OAAO,iBAAiB,OAAO;IAAE,OAAO;IAAY,MAAM,EAAE,IAAI,OAAO;GAAE,CAAC;GAC1E;EACF;EACA,OAAO,iBAAiB,OAAO,EAAE,OAAO,WAAW,CAAC;CACtD;AACF;;AAGA,IAAa,6BAAb,MAAwE;;CAEtE,QAAQ,MAA+B;EACrC,OAAO,QAAQ,IAAI;CACrB;;CAGA,MAAM,mBAAsB,UAAqE;EAC/F,OAAO,MAAM,OAAO,mBAAmB,QAAQ;CACjD;AACF"}

package/dist/stripe/payment-service.d.ts

@@ -0,0 +1,52 @@
+import Stripe from "stripe";
+//#region src/infrastructure/stripe/payment-service.d.ts
+/** Supply the same key and parameters when repeating one durable payment attempt. */
+export type PaymentRequestOptions = Stripe.RequestOptions & Required<Pick<Stripe.RequestOptions, 'idempotencyKey'>>;
+/** Native Checkout parameters; the service selects payment or setup mode. */
+export type CheckoutInput = Omit<Stripe.Checkout.SessionCreateParams, 'mode'>;
+/** A saved customer method; the service confirms the payment off-session. */
+export type SavedMethodCharge = Omit<Stripe.PaymentIntentCreateParams, 'confirm' | 'off_session'> & Required<Pick<Stripe.PaymentIntentCreateParams, 'customer' | 'payment_method'>>;
+/** Native customer response, including Stripe request metadata. */
+export type CustomerResult = Awaited<ReturnType<Stripe['customers']['create']>>;
+/** Native Checkout response. Its URL can be null; this does not confirm payment. */
+export type CheckoutResult = Awaited<ReturnType<Stripe['checkout']['sessions']['create']>>;
+/** Native PaymentIntent response. Applications decide what each status permits. */
+export type PaymentResult = Awaited<ReturnType<Stripe['paymentIntents']['create']>>;
+/**
+ * Stripe payment operations, with native types and stable keys for mutations.
+ * Rejects with PaymentServiceError or native StripeCardError; unexpected defects propagate.
+ */
+export interface IPaymentService {
+  /** Create a customer; the application owns persistence and reuse of the customer link. */
+  createCustomer(input: Stripe.CustomerCreateParams, options: PaymentRequestOptions): Promise<CustomerResult>;
+  /** Create one-time payment checkout; application fulfillment requires verified payment confirmation. */
+  createCheckout(input: CheckoutInput, options: PaymentRequestOptions): Promise<CheckoutResult>;
+  /** Create checkout in setup mode. The application records consent and verifies the saved method's owner. */
+  setupPaymentMethod(input: CheckoutInput, options: PaymentRequestOptions): Promise<CheckoutResult>;
+  /** Confirm a saved method off-session. Native card errors can require customer authentication. */
+  chargeSavedMethod(input: SavedMethodCharge, options: PaymentRequestOptions): Promise<PaymentResult>;
+  /** Retrieve an existing payment without starting another payment attempt. */
+  getPayment(paymentId: string, params?: Stripe.PaymentIntentRetrieveParams, options?: Stripe.RequestOptions): Promise<PaymentResult>;
+}
+/**
+ * Ported from Typist's StripeClient request boundary; the native SDK now owns retries.
+ * Each request defaults to two SDK retries. Native request options can override retries and timeout.
+ */
+export declare class StripePaymentService implements IPaymentService {
+  private readonly stripe;
+  /** Inject a native SDK instance; its transport, credentials, and API version remain caller-owned. */
+  constructor(stripe: Stripe);
+  /** Create a customer with a stable application key and preserve the native response. */
+  createCustomer(input: Stripe.CustomerCreateParams, options: PaymentRequestOptions): Promise<CustomerResult>;
+  /** Force payment mode after caller parameters; return the native Checkout Session. */
+  createCheckout(input: CheckoutInput, options: PaymentRequestOptions): Promise<CheckoutResult>;
+  /** Force setup mode after caller parameters; this operation does not charge the customer. */
+  setupPaymentMethod(input: CheckoutInput, options: PaymentRequestOptions): Promise<CheckoutResult>;
+  /** Force confirmation and off-session use; preserve native card failures for application handling. */
+  chargeSavedMethod(input: SavedMethodCharge, options: PaymentRequestOptions): Promise<PaymentResult>;
+  /** Preserve every native status and response field when reconciling an existing payment. */
+  getPayment(paymentId: string, params?: Stripe.PaymentIntentRetrieveParams, options?: Stripe.RequestOptions): Promise<PaymentResult>;
+  private request;
+}
+//#endregion
+//# sourceMappingURL=payment-service.d.ts.map

package/dist/stripe/payment-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"payment-service.d.ts","names":[],"sources":["../../src/infrastructure/stripe/payment-service.ts"],"mappings":";;;YAKY,wBAAwB,OAAO,iBACzC,SAAS,KAAK,OAAO;;YAGX,gBAAgB,KAAK,OAAO,SAAS;;YAGrC,oBAAoB,KAAK,OAAO,wDAC1C,SAAS,KAAK,OAAO;;YAGX,iBAAiB,QAAQ,WAAW;;YAGpC,iBAAiB,QAAQ,WAAW;;YAGpC,gBAAgB,QAAQ,WAAW;;;;;iBAM9B;;EAEf,eACE,OAAO,OAAO,sBACd,SAAS,wBACR,QAAQ;;EAEX,eAAe,OAAO,eAAe,SAAS,wBAAwB,QAAQ;;EAE9E,mBAAmB,OAAO,eAAe,SAAS,wBAAwB,QAAQ;;EAElF,kBACE,OAAO,mBACP,SAAS,wBACR,QAAQ;;EAEX,WACE,mBACA,SAAS,OAAO,6BAChB,UAAU,OAAO,iBAChB,QAAQ;;;;;;qBAOA,gCAAgC;mBAEd;;EAA7B,YAA6B,QAAQ;;EAGrC,eACE,OAAO,OAAO,sBACd,SAAS,wBACR,QAAQ;;EAOX,eAAe,OAAO,eAAe,SAAS,wBAAwB,QAAQ;;EAU9E,mBACE,OAAO,eACP,SAAS,wBACR,QAAQ;;EAUX,kBACE,OAAO,mBACP,SAAS,wBACR,QAAQ;;EAUX,WACE,mBACA,SAAS,OAAO,6BAChB,UAAU,OAAO,iBAChB,QAAQ;UAMG"}

package/dist/stripe/payment-service.error.d.ts

@@ -0,0 +1,13 @@
+import { Xt as AppError, Zt as FailureClassification } from "../index-DUFS0SJ_.js";
+import Stripe from "stripe";
+//#region src/infrastructure/stripe/payment-service.error.d.ts
+/** A final Stripe request failure. The caller logs once; native details remain in cause. */
+export declare class PaymentServiceError extends AppError {
+  readonly operation: string;
+  readonly _tag = "PaymentServiceError";
+  readonly classification: FailureClassification;
+  /** Classify the final SDK error without scheduling another payment attempt. */
+  constructor(operation: string, cause: Stripe.errors.StripeError);
+}
+//#endregion
+//# sourceMappingURL=payment-service.error.d.ts.map

package/dist/stripe/payment-service.error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"payment-service.error.d.ts","names":[],"sources":["../../src/infrastructure/stripe/payment-service.error.ts"],"mappings":";;;;qBAKa,4BAA4B;WAM5B;WALF;WACA,gBAAgB;;EAGzB,YACW,mBACT,OAAO,OAAO,OAAO"}

package/dist/stripe/payment-service.error.js

@@ -0,0 +1,30 @@
+import { nt as AppError } from "../core-BT1dSEQI.js";
+import Stripe from "stripe";
+
+//#region src/infrastructure/stripe/payment-service.error.ts
+/** A final Stripe request failure. The caller logs once; native details remain in cause. */
+var PaymentServiceError = class extends AppError {
+	operation;
+	_tag = "PaymentServiceError";
+	classification;
+	/** Classify the final SDK error without scheduling another payment attempt. */
+	constructor(operation, cause) {
+		super(`Stripe request failed: ${operation}`, { cause });
+		this.operation = operation;
+		this.classification = classifyStripeError(cause);
+	}
+};
+function classifyStripeError(error) {
+	if (error.headers?.["stripe-should-retry"] === "false") return "terminal";
+	const status = error.statusCode;
+	if (status !== void 0 && status >= 400 && status < 500 && status !== 409 && status !== 429) return "terminal";
+	if (error instanceof Stripe.errors.StripeAuthenticationError || error instanceof Stripe.errors.StripePermissionError || error instanceof Stripe.errors.StripeInvalidRequestError || error instanceof Stripe.errors.StripeIdempotencyError) return "terminal";
+	if (error.headers?.["stripe-should-retry"] === "true") return "transient";
+	if (status === 409 || status === 429 || status !== void 0 && status >= 500) return "transient";
+	if (error instanceof Stripe.errors.StripeConnectionError || error instanceof Stripe.errors.StripeAPIError || error instanceof Stripe.errors.StripeRateLimitError) return "transient";
+	return "unknown";
+}
+
+//#endregion
+export { PaymentServiceError };
+//# sourceMappingURL=payment-service.error.js.map

package/dist/stripe/payment-service.error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"payment-service.error.js","names":[],"sources":["../../src/infrastructure/stripe/payment-service.error.ts"],"sourcesContent":["import Stripe from 'stripe'\n\nimport { AppError, type FailureClassification } from '@/core'\n\n/** A final Stripe request failure. The caller logs once; native details remain in cause. */\nexport class PaymentServiceError extends AppError {\n  readonly _tag = 'PaymentServiceError'\n  readonly classification: FailureClassification\n\n  /** Classify the final SDK error without scheduling another payment attempt. */\n  constructor(\n    readonly operation: string,\n    cause: Stripe.errors.StripeError,\n  ) {\n    super(`Stripe request failed: ${operation}`, { cause })\n    this.classification = classifyStripeError(cause)\n  }\n}\n\nfunction classifyStripeError(error: Stripe.errors.StripeError): FailureClassification {\n  if (error.headers?.['stripe-should-retry'] === 'false') return 'terminal'\n  const status = error.statusCode\n  if (status !== undefined && status >= 400 && status < 500 && status !== 409 && status !== 429)\n    return 'terminal'\n  if (\n    error instanceof Stripe.errors.StripeAuthenticationError ||\n    error instanceof Stripe.errors.StripePermissionError ||\n    error instanceof Stripe.errors.StripeInvalidRequestError ||\n    error instanceof Stripe.errors.StripeIdempotencyError\n  )\n    return 'terminal'\n  if (error.headers?.['stripe-should-retry'] === 'true') return 'transient'\n  if (status === 409 || status === 429 || (status !== undefined && status >= 500))\n    return 'transient'\n  if (\n    error instanceof Stripe.errors.StripeConnectionError ||\n    error instanceof Stripe.errors.StripeAPIError ||\n    error instanceof Stripe.errors.StripeRateLimitError\n  )\n    return 'transient'\n  return 'unknown'\n}\n"],"mappings":";;;;;AAKA,IAAa,sBAAb,cAAyC,SAAS;CAMrC;CALX,AAAS,OAAO;CAChB,AAAS;;CAGT,YACE,AAAS,WACT,OACA;EACA,MAAM,0BAA0B,aAAa,EAAE,MAAM,CAAC;EAH7C;EAIT,KAAK,iBAAiB,oBAAoB,KAAK;CACjD;AACF;AAEA,SAAS,oBAAoB,OAAyD;CACpF,IAAI,MAAM,UAAU,2BAA2B,SAAS,OAAO;CAC/D,MAAM,SAAS,MAAM;CACrB,IAAI,WAAW,UAAa,UAAU,OAAO,SAAS,OAAO,WAAW,OAAO,WAAW,KACxF,OAAO;CACT,IACE,iBAAiB,OAAO,OAAO,6BAC/B,iBAAiB,OAAO,OAAO,yBAC/B,iBAAiB,OAAO,OAAO,6BAC/B,iBAAiB,OAAO,OAAO,wBAE/B,OAAO;CACT,IAAI,MAAM,UAAU,2BAA2B,QAAQ,OAAO;CAC9D,IAAI,WAAW,OAAO,WAAW,OAAQ,WAAW,UAAa,UAAU,KACzE,OAAO;CACT,IACE,iBAAiB,OAAO,OAAO,yBAC/B,iBAAiB,OAAO,OAAO,kBAC/B,iBAAiB,OAAO,OAAO,sBAE/B,OAAO;CACT,OAAO;AACT"}

package/dist/stripe/payment-service.js

@@ -0,0 +1,72 @@
+import { PaymentServiceError } from "./payment-service.error.js";
+import Stripe from "stripe";
+
+//#region src/infrastructure/stripe/payment-service.ts
+/**
+* Ported from Typist's StripeClient request boundary; the native SDK now owns retries.
+* Each request defaults to two SDK retries. Native request options can override retries and timeout.
+*/
+var StripePaymentService = class {
+	stripe;
+	/** Inject a native SDK instance; its transport, credentials, and API version remain caller-owned. */
+	constructor(stripe) {
+		this.stripe = stripe;
+	}
+	/** Create a customer with a stable application key and preserve the native response. */
+	createCustomer(input, options) {
+		return this.request("customers.create", () => this.stripe.customers.create(input, {
+			maxNetworkRetries: 2,
+			...options
+		}));
+	}
+	/** Force payment mode after caller parameters; return the native Checkout Session. */
+	createCheckout(input, options) {
+		return this.request("checkout.sessions.create", () => this.stripe.checkout.sessions.create({
+			...input,
+			mode: "payment"
+		}, {
+			maxNetworkRetries: 2,
+			...options
+		}));
+	}
+	/** Force setup mode after caller parameters; this operation does not charge the customer. */
+	setupPaymentMethod(input, options) {
+		return this.request("checkout.sessions.create", () => this.stripe.checkout.sessions.create({
+			...input,
+			mode: "setup"
+		}, {
+			maxNetworkRetries: 2,
+			...options
+		}));
+	}
+	/** Force confirmation and off-session use; preserve native card failures for application handling. */
+	chargeSavedMethod(input, options) {
+		return this.request("paymentIntents.create", () => this.stripe.paymentIntents.create({
+			...input,
+			confirm: true,
+			off_session: true
+		}, {
+			maxNetworkRetries: 2,
+			...options
+		}));
+	}
+	/** Preserve every native status and response field when reconciling an existing payment. */
+	getPayment(paymentId, params, options) {
+		return this.request("paymentIntents.retrieve", () => this.stripe.paymentIntents.retrieve(paymentId, params, {
+			maxNetworkRetries: 2,
+			...options
+		}));
+	}
+	async request(operation, work) {
+		try {
+			return await work();
+		} catch (cause) {
+			if (!(cause instanceof Stripe.errors.StripeError) || cause instanceof Stripe.errors.StripeCardError) throw cause;
+			throw new PaymentServiceError(operation, cause);
+		}
+	}
+};
+
+//#endregion
+export { StripePaymentService };
+//# sourceMappingURL=payment-service.js.map

package/dist/stripe/payment-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"payment-service.js","names":[],"sources":["../../src/infrastructure/stripe/payment-service.ts"],"sourcesContent":["import Stripe from 'stripe'\n\nimport { PaymentServiceError } from './payment-service.error.ts'\n\n/** Supply the same key and parameters when repeating one durable payment attempt. */\nexport type PaymentRequestOptions = Stripe.RequestOptions &\n  Required<Pick<Stripe.RequestOptions, 'idempotencyKey'>>\n\n/** Native Checkout parameters; the service selects payment or setup mode. */\nexport type CheckoutInput = Omit<Stripe.Checkout.SessionCreateParams, 'mode'>\n\n/** A saved customer method; the service confirms the payment off-session. */\nexport type SavedMethodCharge = Omit<Stripe.PaymentIntentCreateParams, 'confirm' | 'off_session'> &\n  Required<Pick<Stripe.PaymentIntentCreateParams, 'customer' | 'payment_method'>>\n\n/** Native customer response, including Stripe request metadata. */\nexport type CustomerResult = Awaited<ReturnType<Stripe['customers']['create']>>\n\n/** Native Checkout response. Its URL can be null; this does not confirm payment. */\nexport type CheckoutResult = Awaited<ReturnType<Stripe['checkout']['sessions']['create']>>\n\n/** Native PaymentIntent response. Applications decide what each status permits. */\nexport type PaymentResult = Awaited<ReturnType<Stripe['paymentIntents']['create']>>\n\n/**\n * Stripe payment operations, with native types and stable keys for mutations.\n * Rejects with PaymentServiceError or native StripeCardError; unexpected defects propagate.\n */\nexport interface IPaymentService {\n  /** Create a customer; the application owns persistence and reuse of the customer link. */\n  createCustomer(\n    input: Stripe.CustomerCreateParams,\n    options: PaymentRequestOptions,\n  ): Promise<CustomerResult>\n  /** Create one-time payment checkout; application fulfillment requires verified payment confirmation. */\n  createCheckout(input: CheckoutInput, options: PaymentRequestOptions): Promise<CheckoutResult>\n  /** Create checkout in setup mode. The application records consent and verifies the saved method's owner. */\n  setupPaymentMethod(input: CheckoutInput, options: PaymentRequestOptions): Promise<CheckoutResult>\n  /** Confirm a saved method off-session. Native card errors can require customer authentication. */\n  chargeSavedMethod(\n    input: SavedMethodCharge,\n    options: PaymentRequestOptions,\n  ): Promise<PaymentResult>\n  /** Retrieve an existing payment without starting another payment attempt. */\n  getPayment(\n    paymentId: string,\n    params?: Stripe.PaymentIntentRetrieveParams,\n    options?: Stripe.RequestOptions,\n  ): Promise<PaymentResult>\n}\n\n/**\n * Ported from Typist's StripeClient request boundary; the native SDK now owns retries.\n * Each request defaults to two SDK retries. Native request options can override retries and timeout.\n */\nexport class StripePaymentService implements IPaymentService {\n  /** Inject a native SDK instance; its transport, credentials, and API version remain caller-owned. */\n  constructor(private readonly stripe: Stripe) {}\n\n  /** Create a customer with a stable application key and preserve the native response. */\n  createCustomer(\n    input: Stripe.CustomerCreateParams,\n    options: PaymentRequestOptions,\n  ): Promise<CustomerResult> {\n    return this.request('customers.create', () =>\n      this.stripe.customers.create(input, { maxNetworkRetries: 2, ...options }),\n    )\n  }\n\n  /** Force payment mode after caller parameters; return the native Checkout Session. */\n  createCheckout(input: CheckoutInput, options: PaymentRequestOptions): Promise<CheckoutResult> {\n    return this.request('checkout.sessions.create', () =>\n      this.stripe.checkout.sessions.create(\n        { ...input, mode: 'payment' },\n        { maxNetworkRetries: 2, ...options },\n      ),\n    )\n  }\n\n  /** Force setup mode after caller parameters; this operation does not charge the customer. */\n  setupPaymentMethod(\n    input: CheckoutInput,\n    options: PaymentRequestOptions,\n  ): Promise<CheckoutResult> {\n    return this.request('checkout.sessions.create', () =>\n      this.stripe.checkout.sessions.create(\n        { ...input, mode: 'setup' },\n        { maxNetworkRetries: 2, ...options },\n      ),\n    )\n  }\n\n  /** Force confirmation and off-session use; preserve native card failures for application handling. */\n  chargeSavedMethod(\n    input: SavedMethodCharge,\n    options: PaymentRequestOptions,\n  ): Promise<PaymentResult> {\n    return this.request('paymentIntents.create', () =>\n      this.stripe.paymentIntents.create(\n        { ...input, confirm: true, off_session: true },\n        { maxNetworkRetries: 2, ...options },\n      ),\n    )\n  }\n\n  /** Preserve every native status and response field when reconciling an existing payment. */\n  getPayment(\n    paymentId: string,\n    params?: Stripe.PaymentIntentRetrieveParams,\n    options?: Stripe.RequestOptions,\n  ): Promise<PaymentResult> {\n    return this.request('paymentIntents.retrieve', () =>\n      this.stripe.paymentIntents.retrieve(paymentId, params, { maxNetworkRetries: 2, ...options }),\n    )\n  }\n\n  private async request<T>(operation: string, work: () => Promise<T>): Promise<T> {\n    try {\n      return await work()\n    } catch (cause) {\n      if (\n        !(cause instanceof Stripe.errors.StripeError) ||\n        cause instanceof Stripe.errors.StripeCardError\n      )\n        throw cause\n      throw new PaymentServiceError(operation, cause)\n    }\n  }\n}\n"],"mappings":";;;;;;;;AAuDA,IAAa,uBAAb,MAA6D;CAE9B;;CAA7B,YAAY,AAAiB,QAAgB;EAAhB;CAAiB;;CAG9C,eACE,OACA,SACyB;EACzB,OAAO,KAAK,QAAQ,0BAClB,KAAK,OAAO,UAAU,OAAO,OAAO;GAAE,mBAAmB;GAAG,GAAG;EAAQ,CAAC,CAC1E;CACF;;CAGA,eAAe,OAAsB,SAAyD;EAC5F,OAAO,KAAK,QAAQ,kCAClB,KAAK,OAAO,SAAS,SAAS,OAC5B;GAAE,GAAG;GAAO,MAAM;EAAU,GAC5B;GAAE,mBAAmB;GAAG,GAAG;EAAQ,CACrC,CACF;CACF;;CAGA,mBACE,OACA,SACyB;EACzB,OAAO,KAAK,QAAQ,kCAClB,KAAK,OAAO,SAAS,SAAS,OAC5B;GAAE,GAAG;GAAO,MAAM;EAAQ,GAC1B;GAAE,mBAAmB;GAAG,GAAG;EAAQ,CACrC,CACF;CACF;;CAGA,kBACE,OACA,SACwB;EACxB,OAAO,KAAK,QAAQ,+BAClB,KAAK,OAAO,eAAe,OACzB;GAAE,GAAG;GAAO,SAAS;GAAM,aAAa;EAAK,GAC7C;GAAE,mBAAmB;GAAG,GAAG;EAAQ,CACrC,CACF;CACF;;CAGA,WACE,WACA,QACA,SACwB;EACxB,OAAO,KAAK,QAAQ,iCAClB,KAAK,OAAO,eAAe,SAAS,WAAW,QAAQ;GAAE,mBAAmB;GAAG,GAAG;EAAQ,CAAC,CAC7F;CACF;CAEA,MAAc,QAAW,WAAmB,MAAoC;EAC9E,IAAI;GACF,OAAO,MAAM,KAAK;EACpB,SAAS,OAAO;GACd,IACE,EAAE,iBAAiB,OAAO,OAAO,gBACjC,iBAAiB,OAAO,OAAO,iBAE/B,MAAM;GACR,MAAM,IAAI,oBAAoB,WAAW,KAAK;EAChD;CACF;AACF"}

package/dist/stripe/payment-webhook.d.ts

@@ -0,0 +1,18 @@
+import { n as WebhookVerifier } from "../webhook-verification-D1c7BY4q.js";
+import Stripe from "stripe";
+//#region src/infrastructure/stripe/payment-webhook.d.ts
+/**
+ * Authenticate raw Stripe webhook bodies with the SDK's timestamp tolerance and Web Crypto.
+ * Returns native events; application conversion owns event selection and payload validation.
+ */
+export declare class StripeWebhookVerifier implements WebhookVerifier<Stripe.Event> {
+  private readonly stripe;
+  private readonly signingSecret;
+  private readonly tolerance?;
+  /** Supply the endpoint's signing secret. Tolerance defaults to Stripe's five-minute window. */
+  constructor(stripe: Stripe, signingSecret: string, tolerance?: number | undefined);
+  /** Throw typed signature and JSON failures. Operational failures propagate without logging. */
+  verify(body: string, headers: Headers): Promise<Stripe.Event>;
+}
+//#endregion
+//# sourceMappingURL=payment-webhook.d.ts.map

package/dist/stripe/payment-webhook.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"payment-webhook.d.ts","names":[],"sources":["../../src/infrastructure/stripe/payment-webhook.ts"],"mappings":";;;;;;;qBAQa,iCAAiC,gBAAgB,OAAO;mBAGhD;mBACA;mBACA;;EAHnB,YACmB,QAAQ,QACR,uBACA;;EAIb,OAAO,cAAc,SAAS,UAAU,QAAQ,OAAO"}

package/dist/stripe/payment-webhook.js

@@ -0,0 +1,35 @@
+import { t as WebhookVerificationError } from "../webhook-verification-qSFXv5H3.js";
+import Stripe from "stripe";
+
+//#region src/infrastructure/stripe/payment-webhook.ts
+/**
+* Authenticate raw Stripe webhook bodies with the SDK's timestamp tolerance and Web Crypto.
+* Returns native events; application conversion owns event selection and payload validation.
+*/
+var StripeWebhookVerifier = class {
+	stripe;
+	signingSecret;
+	tolerance;
+	/** Supply the endpoint's signing secret. Tolerance defaults to Stripe's five-minute window. */
+	constructor(stripe, signingSecret, tolerance) {
+		this.stripe = stripe;
+		this.signingSecret = signingSecret;
+		this.tolerance = tolerance;
+	}
+	/** Throw typed signature and JSON failures. Operational failures propagate without logging. */
+	async verify(body, headers) {
+		const signature = headers.get("stripe-signature");
+		if (!signature) throw new WebhookVerificationError("missing_headers");
+		try {
+			return await this.stripe.webhooks.constructEventAsync(body, signature, this.signingSecret, this.tolerance, Stripe.createSubtleCryptoProvider());
+		} catch (cause) {
+			if (cause instanceof Stripe.errors.StripeSignatureVerificationError) throw new WebhookVerificationError("invalid_signature", cause);
+			if (cause instanceof SyntaxError) throw new WebhookVerificationError("invalid_payload", cause);
+			throw cause;
+		}
+	}
+};
+
+//#endregion
+export { StripeWebhookVerifier };
+//# sourceMappingURL=payment-webhook.js.map

package/dist/stripe/payment-webhook.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"payment-webhook.js","names":[],"sources":["../../src/infrastructure/stripe/payment-webhook.ts"],"sourcesContent":["import Stripe from 'stripe'\n\nimport { WebhookVerificationError, type WebhookVerifier } from '../http/webhook-verification.ts'\n\n/**\n * Authenticate raw Stripe webhook bodies with the SDK's timestamp tolerance and Web Crypto.\n * Returns native events; application conversion owns event selection and payload validation.\n */\nexport class StripeWebhookVerifier implements WebhookVerifier<Stripe.Event> {\n  /** Supply the endpoint's signing secret. Tolerance defaults to Stripe's five-minute window. */\n  constructor(\n    private readonly stripe: Stripe,\n    private readonly signingSecret: string,\n    private readonly tolerance?: number,\n  ) {}\n\n  /** Throw typed signature and JSON failures. Operational failures propagate without logging. */\n  async verify(body: string, headers: Headers): Promise<Stripe.Event> {\n    const signature = headers.get('stripe-signature')\n    if (!signature) throw new WebhookVerificationError('missing_headers')\n    try {\n      return await this.stripe.webhooks.constructEventAsync(\n        body,\n        signature,\n        this.signingSecret,\n        this.tolerance,\n        Stripe.createSubtleCryptoProvider(),\n      )\n    } catch (cause) {\n      if (cause instanceof Stripe.errors.StripeSignatureVerificationError)\n        throw new WebhookVerificationError('invalid_signature', cause)\n      if (cause instanceof SyntaxError) throw new WebhookVerificationError('invalid_payload', cause)\n      throw cause\n    }\n  }\n}\n"],"mappings":";;;;;;;;AAQA,IAAa,wBAAb,MAA4E;CAGvD;CACA;CACA;;CAHnB,YACE,AAAiB,QACjB,AAAiB,eACjB,AAAiB,WACjB;EAHiB;EACA;EACA;CAChB;;CAGH,MAAM,OAAO,MAAc,SAAyC;EAClE,MAAM,YAAY,QAAQ,IAAI,kBAAkB;EAChD,IAAI,CAAC,WAAW,MAAM,IAAI,yBAAyB,iBAAiB;EACpE,IAAI;GACF,OAAO,MAAM,KAAK,OAAO,SAAS,oBAChC,MACA,WACA,KAAK,eACL,KAAK,WACL,OAAO,2BAA2B,CACpC;EACF,SAAS,OAAO;GACd,IAAI,iBAAiB,OAAO,OAAO,kCACjC,MAAM,IAAI,yBAAyB,qBAAqB,KAAK;GAC/D,IAAI,iBAAiB,aAAa,MAAM,IAAI,yBAAyB,mBAAmB,KAAK;GAC7F,MAAM;EACR;CACF;AACF"}

package/dist/tanstack.d.ts

@@ -1,4 +1,4 @@
-import { lt as ErrorTable } from "./index-DvJUcSW1.js";
+import { ot as ErrorTable } from "./index-DUFS0SJ_.js";
 import { Register } from "@tanstack/react-start";
 import { BetterAuthCookies } from "better-auth";
 //#region src/infrastructure/tanstack/request-context.d.ts

package/dist/tanstack.js

@@ -1,4 +1,4 @@
-import { G as AuthenticationError, U as StaleSessionError, a as createLogger, rt as AppError, z as ValidationError } from "./core-ClSP5-V9.js";
+import { H as StaleSessionError, R as ValidationError, W as AuthenticationError, nt as AppError, r as createLogger } from "./core-BT1dSEQI.js";
 import { z } from "zod";
 import { getReasonPhrase } from "http-status-codes";
 import { isNotFound, isRedirect, redirect } from "@tanstack/react-router";
@@ -71,16 +71,16 @@ const logger = createLogger("error-boundary");
 function resolveFailure(table, cause) {
 	const resolved = table.resolve(cause);
 	if (resolved !== null) {
-		logger.warn("handled_error", { details: {
+		logger.warn("handled_error", {
 			tag: resolved.payload._tag,
 			status: resolved.status
-		} });
+		});
 		return resolved;
 	}
 	const classification = cause instanceof AppError ? cause.classification : "unknown";
 	logger.error("unexpected_error", {
 		error: cause,
-		details: { classification }
+		classification
 	});
 	return table.fallback(cause);
 }

package/dist/tanstack.js.map

@@ -1 +1 @@
-{"version":3,"file":"tanstack.js","names":["logger"],"sources":["../src/infrastructure/tanstack/auth.middleware.ts","../src/infrastructure/tanstack/resolve-failure.ts","../src/infrastructure/tanstack/http-error-response.ts","../src/infrastructure/tanstack/session-cookies.ts","../src/infrastructure/tanstack/to-error-payload.ts","../src/infrastructure/tanstack/error.middleware.ts"],"sourcesContent":["import { createMiddleware } from '@tanstack/react-start'\nimport { getSessionCookie } from 'better-auth/cookies'\n\nimport { AuthenticationError, StaleSessionError, createLogger } from '@/core'\n\nimport type { RequestContext } from './request-context.ts'\n\nconst logger = createLogger('auth-middleware')\n\n/** The fields middleware reads; generic callers retain every additional session and user field. */\nexport type AuthSession = {\n  readonly user: { readonly id: string }\n  readonly session: { readonly id: string }\n}\n\n/** Authenticated context retains the application's complete user and session types. */\nexport type RequiredAuthContext<Session extends AuthSession> = {\n  readonly user: Session['user']\n  readonly session: Session['session']\n}\n\n/** Optional authentication supplies both fields together or neither field. */\nexport type AuthContext<Session extends AuthSession> =\n  | RequiredAuthContext<Session>\n  | {\n      readonly user: undefined\n      readonly session: undefined\n    }\n\n/** Select the current request's Better Auth instance from TanStack's registered context. */\nexport type AuthMiddlewareOptions<Session extends AuthSession> = {\n  readonly getAuth: (context: RequestContext) => {\n    readonly api: {\n      readonly getSession: (options: { headers: Headers }) => Promise<Session | null>\n    }\n  }\n}\n\n// The server entry loads react-dom/server; the browser evaluates this module, so it loads lazily inside `.server()`.\nconst requestHeaders = async () => {\n  const { getRequestHeaders } = await import('@tanstack/react-start/server')\n  return getRequestHeaders()\n}\n\n/**\n * Preserve Porte's function and request middleware contracts with application-owned services.\n * Optional lookup failures log once and continue as guests. Required lookup failures propagate.\n */\nexport function createAuthMiddleware<Session extends AuthSession>(\n  options: AuthMiddlewareOptions<Session>,\n) {\n  const extractAuth = createMiddleware({ type: 'function' }).server<AuthContext<Session>>(\n    async ({ next, context }) => {\n      let resolved: Session | null\n      try {\n        const headers = await requestHeaders()\n        resolved = await options.getAuth(context).api.getSession({ headers })\n      } catch (error) {\n        logger.error('get_session_failed', { error })\n        resolved = null\n      }\n      if (resolved === null)\n        return next<AuthContext<Session>>({ context: { user: undefined, session: undefined } })\n      return next<AuthContext<Session>>({\n        context: { user: resolved.user, session: resolved.session },\n      })\n    },\n  )\n\n  async function resolveRequiredSession(\n    context: RequestContext,\n    headers: Headers,\n  ): Promise<Session> {\n    const resolved = await options.getAuth(context).api.getSession({ headers })\n    if (resolved === null) {\n      if (getSessionCookie(headers)) throw new StaleSessionError()\n      throw new AuthenticationError()\n    }\n    return resolved\n  }\n\n  const requireAuth = createMiddleware({ type: 'function' }).server(async ({ next, context }) => {\n    const resolved = await resolveRequiredSession(context, await requestHeaders())\n    return next<RequiredAuthContext<Session>>({\n      context: { user: resolved.user, session: resolved.session },\n    })\n  })\n  const requireAuthRequest = createMiddleware({ type: 'request' }).server(\n    async ({ request, next, context }) => {\n      const resolved = await resolveRequiredSession(context, request.headers)\n      return next<RequiredAuthContext<Session>>({\n        context: { user: resolved.user, session: resolved.session },\n      })\n    },\n  )\n  return { extractAuth, requireAuth, requireAuthRequest }\n}\n","import { AppError, createLogger, type ErrorTable, type ResolvedError } from '@/core'\nimport type { ErrorPayloadOf } from '@/core'\n\nconst logger = createLogger('error-boundary')\n\n/**\n * Resolve one failure through the table or fall back to the generic replacement, and log it once.\n * Both transport converters call this, so one rule decides the log level: mapped is a warning, unmapped is an error with the cause.\n */\nexport function resolveFailure<Entries>(\n  table: ErrorTable<Entries>,\n  cause: unknown,\n): ResolvedError<ErrorPayloadOf<ErrorTable<Entries>>> {\n  const resolved = table.resolve(cause)\n  if (resolved !== null) {\n    logger.warn('handled_error', {\n      details: { tag: resolved.payload._tag, status: resolved.status },\n    })\n    return resolved\n  }\n  const classification = cause instanceof AppError ? cause.classification : 'unknown'\n  logger.error('unexpected_error', { error: cause, details: { classification } })\n  return table.fallback(cause)\n}\n","import { getReasonPhrase } from 'http-status-codes'\nimport { z } from 'zod'\n\nimport type { ErrorTable, ProblemDetails } from '@/core'\n\nimport { resolveFailure } from './resolve-failure.ts'\n\n// A known delay becomes the header; a null delay sends no header.\nconst RetryAfterSchema = z.object({ retryAfter: z.number() })\n\n/**\n * Build the API route converter for one error table.\n * The body is RFC 9457 problem details; public fields become extension members.\n */\nexport function createHttpErrorResponseConverter<Entries>(table: ErrorTable<Entries>) {\n  return function toHttpErrorResponse(cause: unknown): Response {\n    const { status, payload } = resolveFailure(table, cause)\n    const { _tag, message, ...fields } = payload\n    const body: ProblemDetails = {\n      type: 'about:blank',\n      title: getReasonPhrase(status),\n      detail: message,\n      ...fields,\n    }\n    const headers = new Headers({ 'Content-Type': 'application/problem+json' })\n    const retry = RetryAfterSchema.safeParse(payload)\n    if (retry.success) headers.set('Retry-After', String(retry.data.retryAfter))\n    return Response.json(body, { status, headers })\n  }\n}\n","import type { deleteCookie } from '@tanstack/react-start/server'\nimport type { BetterAuthCookies } from 'better-auth'\nimport { parseCookies } from 'better-auth/cookies'\n\ntype AuthCookie = BetterAuthCookies['sessionToken']\ntype DeleteCookieOptions = NonNullable<Parameters<typeof deleteCookie>[1]>\n\n/**\n * Delete the session, session cache, account cache, and remember-me cookies of one instance.\n * Chunks present on the request go too. Names and attributes come from the instance, so custom prefixes and domain cookies clear.\n */\nexport async function clearStaleSessionCookies(cookies: BetterAuthCookies): Promise<void> {\n  // The server entry loads react-dom/server; the browser evaluates this module, so it loads lazily here.\n  const server = await import('@tanstack/react-start/server')\n  const present = [...parseCookies(server.getRequestHeaders().get('cookie') ?? '').keys()]\n  const definitions = [\n    cookies.sessionToken,\n    cookies.sessionData,\n    cookies.accountData,\n    cookies.dontRememberToken,\n  ]\n  for (const cookie of definitions) {\n    // Better Auth names a chunk `${name}.${index}`, so a missed chunk would resurrect the value.\n    const chunks = present.filter((name) => name.startsWith(`${cookie.name}.`))\n    for (const name of new Set([cookie.name, ...chunks]))\n      server.deleteCookie(name, deletionOf(cookie.attributes))\n  }\n}\n\nfunction deletionOf(attributes: AuthCookie['attributes']): DeleteCookieOptions {\n  // Better Auth sets `/` and the secure flag at runtime; the types leave both optional.\n  const options: DeleteCookieOptions = {\n    path: attributes.path ?? '/',\n    secure: attributes.secure ?? false,\n  }\n  if (attributes.domain !== undefined) options.domain = attributes.domain\n  return options\n}\n","import { z } from 'zod'\n\nimport { ValidationError, type ErrorPayloadOf, type ErrorTable } from '@/core'\n\nimport { resolveFailure } from './resolve-failure.ts'\n\n// TanStack serializes a validator's issues into `Error.message` as JSON.\nconst SerializedIssuesSchema = z\n  .array(z.object({ message: z.string(), path: z.array(z.union([z.string(), z.number()])) }))\n  .min(1)\n\nfunction reconstructValidationError(cause: unknown): ValidationError | null {\n  if (!(cause instanceof Error)) return null\n  let message: unknown\n  try {\n    message = JSON.parse(cause.message)\n  } catch {\n    return null\n  }\n  const parsed = SerializedIssuesSchema.safeParse(message)\n  return parsed.success ? ValidationError.fromIssues(parsed.data) : null\n}\n\n/**\n * Build the server-function converter for one error table.\n * The result is a plain object, because only own data survives serialization.\n */\nexport function createErrorPayloadConverter<Entries>(table: ErrorTable<Entries>) {\n  return function toErrorPayload(cause: unknown): ErrorPayloadOf<ErrorTable<Entries>> {\n    return resolveFailure(table, reconstructValidationError(cause) ?? cause).payload\n  }\n}\n","import { isNotFound, isRedirect, redirect } from '@tanstack/react-router'\nimport { createMiddleware } from '@tanstack/react-start'\nimport type { BetterAuthCookies } from 'better-auth'\n\nimport { StaleSessionError, type ErrorTable } from '@/core'\n\nimport { createHttpErrorResponseConverter } from './http-error-response.ts'\nimport type { RequestContext } from './request-context.ts'\nimport { clearStaleSessionCookies } from './session-cookies.ts'\nimport { createErrorPayloadConverter } from './to-error-payload.ts'\n\n/** The part of a Better Auth instance the boundary reads: its computed cookie definitions. */\nexport type AuthCookieSource = {\n  readonly $context: Promise<{ readonly authCookies: BetterAuthCookies }>\n}\n\n/** The application's error table, its stale-session redirect, and its Better Auth instance. */\nexport type ErrorMiddlewareOptions<Entries> = {\n  readonly errors: ErrorTable<Entries>\n  /** The path a server function redirects to for a stale session, with any search string. */\n  readonly signIn: string\n  /** Select the request's Better Auth instance; its cookie definitions say what to clear. */\n  readonly getAuth: (context: RequestContext) => AuthCookieSource\n}\n\n/**\n * Build both transport boundaries from one error table.\n * Register `functionErrorMiddleware` globally. Put `routeErrorMiddleware` first in an API route's `server.middleware`.\n */\nexport function createErrorMiddleware<Entries>(options: ErrorMiddlewareOptions<Entries>) {\n  const toErrorPayload = createErrorPayloadConverter(options.errors)\n  const toHttpErrorResponse = createHttpErrorResponseConverter(options.errors)\n\n  async function clearSession(context: RequestContext): Promise<void> {\n    const { authCookies } = await options.getAuth(context).$context\n    await clearStaleSessionCookies(authCookies)\n  }\n\n  async function handleFunctionError(cause: unknown, context: RequestContext): Promise<never> {\n    // oxlint-disable-next-line typescript/only-throw-error -- TanStack uses throwable control-flow objects.\n    if (isNotFound(cause) || isRedirect(cause)) throw cause\n    if (cause instanceof StaleSessionError) {\n      await clearSession(context)\n      // oxlint-disable-next-line typescript/only-throw-error -- Router redirects by throwing this.\n      throw redirect({ href: options.signIn })\n    }\n    // oxlint-disable-next-line typescript/only-throw-error -- The client rejects with this and reads its tag.\n    throw toErrorPayload(cause)\n  }\n\n  // A route answers 401 instead of a redirect because fetch would follow it into the HTML shell.\n  async function handleRouteError(cause: unknown, context: RequestContext): Promise<Response> {\n    // oxlint-disable-next-line typescript/only-throw-error -- TanStack uses throwable control-flow objects.\n    if (isNotFound(cause) || isRedirect(cause)) throw cause\n    if (cause instanceof StaleSessionError) await clearSession(context)\n    return toHttpErrorResponse(cause)\n  }\n\n  const functionErrorMiddleware = createMiddleware({ type: 'function' }).server(\n    async ({ next, context }) => {\n      try {\n        return await next()\n      } catch (cause) {\n        return handleFunctionError(cause, context)\n      }\n    },\n  )\n\n  const routeErrorMiddleware = createMiddleware({ type: 'request' }).server(\n    async ({ next, context }) => {\n      try {\n        return await next()\n      } catch (cause) {\n        return handleRouteError(cause, context)\n      }\n    },\n  )\n\n  return { functionErrorMiddleware, routeErrorMiddleware, toErrorPayload, toHttpErrorResponse }\n}\n"],"mappings":";;;;;;;;AAOA,MAAMA,WAAS,aAAa,iBAAiB;AAgC7C,MAAM,iBAAiB,YAAY;CACjC,MAAM,EAAE,sBAAsB,MAAM,OAAO;CAC3C,OAAO,kBAAkB;AAC3B;;;;;AAMA,SAAgB,qBACd,SACA;CACA,MAAM,cAAc,iBAAiB,EAAE,MAAM,WAAW,CAAC,CAAC,CAAC,OACzD,OAAO,EAAE,MAAM,cAAc;EAC3B,IAAI;EACJ,IAAI;GACF,MAAM,UAAU,MAAM,eAAe;GACrC,WAAW,MAAM,QAAQ,QAAQ,OAAO,CAAC,CAAC,IAAI,WAAW,EAAE,QAAQ,CAAC;EACtE,SAAS,OAAO;GACd,SAAO,MAAM,sBAAsB,EAAE,MAAM,CAAC;GAC5C,WAAW;EACb;EACA,IAAI,aAAa,MACf,OAAO,KAA2B,EAAE,SAAS;GAAE,MAAM;GAAW,SAAS;EAAU,EAAE,CAAC;EACxF,OAAO,KAA2B,EAChC,SAAS;GAAE,MAAM,SAAS;GAAM,SAAS,SAAS;EAAQ,EAC5D,CAAC;CACH,CACF;CAEA,eAAe,uBACb,SACA,SACkB;EAClB,MAAM,WAAW,MAAM,QAAQ,QAAQ,OAAO,CAAC,CAAC,IAAI,WAAW,EAAE,QAAQ,CAAC;EAC1E,IAAI,aAAa,MAAM;GACrB,IAAI,iBAAiB,OAAO,GAAG,MAAM,IAAI,kBAAkB;GAC3D,MAAM,IAAI,oBAAoB;EAChC;EACA,OAAO;CACT;CAgBA,OAAO;EAAE;EAAa,aAdF,iBAAiB,EAAE,MAAM,WAAW,CAAC,CAAC,CAAC,OAAO,OAAO,EAAE,MAAM,cAAc;GAC7F,MAAM,WAAW,MAAM,uBAAuB,SAAS,MAAM,eAAe,CAAC;GAC7E,OAAO,KAAmC,EACxC,SAAS;IAAE,MAAM,SAAS;IAAM,SAAS,SAAS;GAAQ,EAC5D,CAAC;EACH,CASgC;EAAG,oBARR,iBAAiB,EAAE,MAAM,UAAU,CAAC,CAAC,CAAC,OAC/D,OAAO,EAAE,SAAS,MAAM,cAAc;GACpC,MAAM,WAAW,MAAM,uBAAuB,SAAS,QAAQ,OAAO;GACtE,OAAO,KAAmC,EACxC,SAAS;IAAE,MAAM,SAAS;IAAM,SAAS,SAAS;GAAQ,EAC5D,CAAC;EACH,CAEkD;CAAE;AACxD;;;;AC7FA,MAAM,SAAS,aAAa,gBAAgB;;;;;AAM5C,SAAgB,eACd,OACA,OACoD;CACpD,MAAM,WAAW,MAAM,QAAQ,KAAK;CACpC,IAAI,aAAa,MAAM;EACrB,OAAO,KAAK,iBAAiB,EAC3B,SAAS;GAAE,KAAK,SAAS,QAAQ;GAAM,QAAQ,SAAS;EAAO,EACjE,CAAC;EACD,OAAO;CACT;CACA,MAAM,iBAAiB,iBAAiB,WAAW,MAAM,iBAAiB;CAC1E,OAAO,MAAM,oBAAoB;EAAE,OAAO;EAAO,SAAS,EAAE,eAAe;CAAE,CAAC;CAC9E,OAAO,MAAM,SAAS,KAAK;AAC7B;;;;ACfA,MAAM,mBAAmB,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;;;;;AAM5D,SAAgB,iCAA0C,OAA4B;CACpF,OAAO,SAAS,oBAAoB,OAA0B;EAC5D,MAAM,EAAE,QAAQ,YAAY,eAAe,OAAO,KAAK;EACvD,MAAM,EAAE,MAAM,SAAS,GAAG,WAAW;EACrC,MAAM,OAAuB;GAC3B,MAAM;GACN,OAAO,gBAAgB,MAAM;GAC7B,QAAQ;GACR,GAAG;EACL;EACA,MAAM,UAAU,IAAI,QAAQ,EAAE,gBAAgB,2BAA2B,CAAC;EAC1E,MAAM,QAAQ,iBAAiB,UAAU,OAAO;EAChD,IAAI,MAAM,SAAS,QAAQ,IAAI,eAAe,OAAO,MAAM,KAAK,UAAU,CAAC;EAC3E,OAAO,SAAS,KAAK,MAAM;GAAE;GAAQ;EAAQ,CAAC;CAChD;AACF;;;;;;;;AClBA,eAAsB,yBAAyB,SAA2C;CAExF,MAAM,SAAS,MAAM,OAAO;CAC5B,MAAM,UAAU,CAAC,GAAG,aAAa,OAAO,kBAAkB,CAAC,CAAC,IAAI,QAAQ,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC;CACvF,MAAM,cAAc;EAClB,QAAQ;EACR,QAAQ;EACR,QAAQ;EACR,QAAQ;CACV;CACA,KAAK,MAAM,UAAU,aAAa;EAEhC,MAAM,SAAS,QAAQ,QAAQ,SAAS,KAAK,WAAW,GAAG,OAAO,KAAK,EAAE,CAAC;EAC1E,KAAK,MAAM,wBAAQ,IAAI,IAAI,CAAC,OAAO,MAAM,GAAG,MAAM,CAAC,GACjD,OAAO,aAAa,MAAM,WAAW,OAAO,UAAU,CAAC;CAC3D;AACF;AAEA,SAAS,WAAW,YAA2D;CAE7E,MAAM,UAA+B;EACnC,MAAM,WAAW,QAAQ;EACzB,QAAQ,WAAW,UAAU;CAC/B;CACA,IAAI,WAAW,WAAW,QAAW,QAAQ,SAAS,WAAW;CACjE,OAAO;AACT;;;;AC9BA,MAAM,yBAAyB,EAC5B,MAAM,EAAE,OAAO;CAAE,SAAS,EAAE,OAAO;CAAG,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;AAAE,CAAC,CAAC,CAAC,CAC1F,IAAI,CAAC;AAER,SAAS,2BAA2B,OAAwC;CAC1E,IAAI,EAAE,iBAAiB,QAAQ,OAAO;CACtC,IAAI;CACJ,IAAI;EACF,UAAU,KAAK,MAAM,MAAM,OAAO;CACpC,QAAQ;EACN,OAAO;CACT;CACA,MAAM,SAAS,uBAAuB,UAAU,OAAO;CACvD,OAAO,OAAO,UAAU,gBAAgB,WAAW,OAAO,IAAI,IAAI;AACpE;;;;;AAMA,SAAgB,4BAAqC,OAA4B;CAC/E,OAAO,SAAS,eAAe,OAAqD;EAClF,OAAO,eAAe,OAAO,2BAA2B,KAAK,KAAK,KAAK,CAAC,CAAC;CAC3E;AACF;;;;;;;;ACFA,SAAgB,sBAA+B,SAA0C;CACvF,MAAM,iBAAiB,4BAA4B,QAAQ,MAAM;CACjE,MAAM,sBAAsB,iCAAiC,QAAQ,MAAM;CAE3E,eAAe,aAAa,SAAwC;EAClE,MAAM,EAAE,gBAAgB,MAAM,QAAQ,QAAQ,OAAO,CAAC,CAAC;EACvD,MAAM,yBAAyB,WAAW;CAC5C;CAEA,eAAe,oBAAoB,OAAgB,SAAyC;EAE1F,IAAI,WAAW,KAAK,KAAK,WAAW,KAAK,GAAG,MAAM;EAClD,IAAI,iBAAiB,mBAAmB;GACtC,MAAM,aAAa,OAAO;GAE1B,MAAM,SAAS,EAAE,MAAM,QAAQ,OAAO,CAAC;EACzC;EAEA,MAAM,eAAe,KAAK;CAC5B;CAGA,eAAe,iBAAiB,OAAgB,SAA4C;EAE1F,IAAI,WAAW,KAAK,KAAK,WAAW,KAAK,GAAG,MAAM;EAClD,IAAI,iBAAiB,mBAAmB,MAAM,aAAa,OAAO;EAClE,OAAO,oBAAoB,KAAK;CAClC;CAsBA,OAAO;EAAE,yBApBuB,iBAAiB,EAAE,MAAM,WAAW,CAAC,CAAC,CAAC,OACrE,OAAO,EAAE,MAAM,cAAc;GAC3B,IAAI;IACF,OAAO,MAAM,KAAK;GACpB,SAAS,OAAO;IACd,OAAO,oBAAoB,OAAO,OAAO;GAC3C;EACF,CAa6B;EAAG,sBAVL,iBAAiB,EAAE,MAAM,UAAU,CAAC,CAAC,CAAC,OACjE,OAAO,EAAE,MAAM,cAAc;GAC3B,IAAI;IACF,OAAO,MAAM,KAAK;GACpB,SAAS,OAAO;IACd,OAAO,iBAAiB,OAAO,OAAO;GACxC;EACF,CAGmD;EAAG;EAAgB;CAAoB;AAC9F"}
+{"version":3,"file":"tanstack.js","names":["logger"],"sources":["../src/infrastructure/tanstack/auth.middleware.ts","../src/infrastructure/tanstack/resolve-failure.ts","../src/infrastructure/tanstack/http-error-response.ts","../src/infrastructure/tanstack/session-cookies.ts","../src/infrastructure/tanstack/to-error-payload.ts","../src/infrastructure/tanstack/error.middleware.ts"],"sourcesContent":["import { createMiddleware } from '@tanstack/react-start'\nimport { getSessionCookie } from 'better-auth/cookies'\n\nimport { AuthenticationError, StaleSessionError, createLogger } from '@/core'\n\nimport type { RequestContext } from './request-context.ts'\n\nconst logger = createLogger('auth-middleware')\n\n/** The fields middleware reads; generic callers retain every additional session and user field. */\nexport type AuthSession = {\n  readonly user: { readonly id: string }\n  readonly session: { readonly id: string }\n}\n\n/** Authenticated context retains the application's complete user and session types. */\nexport type RequiredAuthContext<Session extends AuthSession> = {\n  readonly user: Session['user']\n  readonly session: Session['session']\n}\n\n/** Optional authentication supplies both fields together or neither field. */\nexport type AuthContext<Session extends AuthSession> =\n  | RequiredAuthContext<Session>\n  | {\n      readonly user: undefined\n      readonly session: undefined\n    }\n\n/** Select the current request's Better Auth instance from TanStack's registered context. */\nexport type AuthMiddlewareOptions<Session extends AuthSession> = {\n  readonly getAuth: (context: RequestContext) => {\n    readonly api: {\n      readonly getSession: (options: { headers: Headers }) => Promise<Session | null>\n    }\n  }\n}\n\n// The server entry loads react-dom/server; the browser evaluates this module, so it loads lazily inside `.server()`.\nconst requestHeaders = async () => {\n  const { getRequestHeaders } = await import('@tanstack/react-start/server')\n  return getRequestHeaders()\n}\n\n/**\n * Preserve Porte's function and request middleware contracts with application-owned services.\n * Optional lookup failures log once and continue as guests. Required lookup failures propagate.\n */\nexport function createAuthMiddleware<Session extends AuthSession>(\n  options: AuthMiddlewareOptions<Session>,\n) {\n  const extractAuth = createMiddleware({ type: 'function' }).server<AuthContext<Session>>(\n    async ({ next, context }) => {\n      let resolved: Session | null\n      try {\n        const headers = await requestHeaders()\n        resolved = await options.getAuth(context).api.getSession({ headers })\n      } catch (error) {\n        logger.error('get_session_failed', { error })\n        resolved = null\n      }\n      if (resolved === null)\n        return next<AuthContext<Session>>({ context: { user: undefined, session: undefined } })\n      return next<AuthContext<Session>>({\n        context: { user: resolved.user, session: resolved.session },\n      })\n    },\n  )\n\n  async function resolveRequiredSession(\n    context: RequestContext,\n    headers: Headers,\n  ): Promise<Session> {\n    const resolved = await options.getAuth(context).api.getSession({ headers })\n    if (resolved === null) {\n      if (getSessionCookie(headers)) throw new StaleSessionError()\n      throw new AuthenticationError()\n    }\n    return resolved\n  }\n\n  const requireAuth = createMiddleware({ type: 'function' }).server(async ({ next, context }) => {\n    const resolved = await resolveRequiredSession(context, await requestHeaders())\n    return next<RequiredAuthContext<Session>>({\n      context: { user: resolved.user, session: resolved.session },\n    })\n  })\n  const requireAuthRequest = createMiddleware({ type: 'request' }).server(\n    async ({ request, next, context }) => {\n      const resolved = await resolveRequiredSession(context, request.headers)\n      return next<RequiredAuthContext<Session>>({\n        context: { user: resolved.user, session: resolved.session },\n      })\n    },\n  )\n  return { extractAuth, requireAuth, requireAuthRequest }\n}\n","import { AppError, createLogger, type ErrorTable, type ResolvedError } from '@/core'\nimport type { ErrorPayloadOf } from '@/core'\n\nconst logger = createLogger('error-boundary')\n\n/**\n * Resolve one failure through the table or fall back to the generic replacement, and log it once.\n * Both transport converters call this, so one rule decides the log level: mapped is a warning, unmapped is an error with the cause.\n */\nexport function resolveFailure<Entries>(\n  table: ErrorTable<Entries>,\n  cause: unknown,\n): ResolvedError<ErrorPayloadOf<ErrorTable<Entries>>> {\n  const resolved = table.resolve(cause)\n  if (resolved !== null) {\n    logger.warn('handled_error', {\n      tag: resolved.payload._tag,\n      status: resolved.status,\n    })\n    return resolved\n  }\n  const classification = cause instanceof AppError ? cause.classification : 'unknown'\n  logger.error('unexpected_error', { error: cause, classification })\n  return table.fallback(cause)\n}\n","import { getReasonPhrase } from 'http-status-codes'\nimport { z } from 'zod'\n\nimport type { ErrorTable, ProblemDetails } from '@/core'\n\nimport { resolveFailure } from './resolve-failure.ts'\n\n// A known delay becomes the header; a null delay sends no header.\nconst RetryAfterSchema = z.object({ retryAfter: z.number() })\n\n/**\n * Build the API route converter for one error table.\n * The body is RFC 9457 problem details; public fields become extension members.\n */\nexport function createHttpErrorResponseConverter<Entries>(table: ErrorTable<Entries>) {\n  return function toHttpErrorResponse(cause: unknown): Response {\n    const { status, payload } = resolveFailure(table, cause)\n    const { _tag, message, ...fields } = payload\n    const body: ProblemDetails = {\n      type: 'about:blank',\n      title: getReasonPhrase(status),\n      detail: message,\n      ...fields,\n    }\n    const headers = new Headers({ 'Content-Type': 'application/problem+json' })\n    const retry = RetryAfterSchema.safeParse(payload)\n    if (retry.success) headers.set('Retry-After', String(retry.data.retryAfter))\n    return Response.json(body, { status, headers })\n  }\n}\n","import type { deleteCookie } from '@tanstack/react-start/server'\nimport type { BetterAuthCookies } from 'better-auth'\nimport { parseCookies } from 'better-auth/cookies'\n\ntype AuthCookie = BetterAuthCookies['sessionToken']\ntype DeleteCookieOptions = NonNullable<Parameters<typeof deleteCookie>[1]>\n\n/**\n * Delete the session, session cache, account cache, and remember-me cookies of one instance.\n * Chunks present on the request go too. Names and attributes come from the instance, so custom prefixes and domain cookies clear.\n */\nexport async function clearStaleSessionCookies(cookies: BetterAuthCookies): Promise<void> {\n  // The server entry loads react-dom/server; the browser evaluates this module, so it loads lazily here.\n  const server = await import('@tanstack/react-start/server')\n  const present = [...parseCookies(server.getRequestHeaders().get('cookie') ?? '').keys()]\n  const definitions = [\n    cookies.sessionToken,\n    cookies.sessionData,\n    cookies.accountData,\n    cookies.dontRememberToken,\n  ]\n  for (const cookie of definitions) {\n    // Better Auth names a chunk `${name}.${index}`, so a missed chunk would resurrect the value.\n    const chunks = present.filter((name) => name.startsWith(`${cookie.name}.`))\n    for (const name of new Set([cookie.name, ...chunks]))\n      server.deleteCookie(name, deletionOf(cookie.attributes))\n  }\n}\n\nfunction deletionOf(attributes: AuthCookie['attributes']): DeleteCookieOptions {\n  // Better Auth sets `/` and the secure flag at runtime; the types leave both optional.\n  const options: DeleteCookieOptions = {\n    path: attributes.path ?? '/',\n    secure: attributes.secure ?? false,\n  }\n  if (attributes.domain !== undefined) options.domain = attributes.domain\n  return options\n}\n","import { z } from 'zod'\n\nimport { ValidationError, type ErrorPayloadOf, type ErrorTable } from '@/core'\n\nimport { resolveFailure } from './resolve-failure.ts'\n\n// TanStack serializes a validator's issues into `Error.message` as JSON.\nconst SerializedIssuesSchema = z\n  .array(z.object({ message: z.string(), path: z.array(z.union([z.string(), z.number()])) }))\n  .min(1)\n\nfunction reconstructValidationError(cause: unknown): ValidationError | null {\n  if (!(cause instanceof Error)) return null\n  let message: unknown\n  try {\n    message = JSON.parse(cause.message)\n  } catch {\n    return null\n  }\n  const parsed = SerializedIssuesSchema.safeParse(message)\n  return parsed.success ? ValidationError.fromIssues(parsed.data) : null\n}\n\n/**\n * Build the server-function converter for one error table.\n * The result is a plain object, because only own data survives serialization.\n */\nexport function createErrorPayloadConverter<Entries>(table: ErrorTable<Entries>) {\n  return function toErrorPayload(cause: unknown): ErrorPayloadOf<ErrorTable<Entries>> {\n    return resolveFailure(table, reconstructValidationError(cause) ?? cause).payload\n  }\n}\n","import { isNotFound, isRedirect, redirect } from '@tanstack/react-router'\nimport { createMiddleware } from '@tanstack/react-start'\nimport type { BetterAuthCookies } from 'better-auth'\n\nimport { StaleSessionError, type ErrorTable } from '@/core'\n\nimport { createHttpErrorResponseConverter } from './http-error-response.ts'\nimport type { RequestContext } from './request-context.ts'\nimport { clearStaleSessionCookies } from './session-cookies.ts'\nimport { createErrorPayloadConverter } from './to-error-payload.ts'\n\n/** The part of a Better Auth instance the boundary reads: its computed cookie definitions. */\nexport type AuthCookieSource = {\n  readonly $context: Promise<{ readonly authCookies: BetterAuthCookies }>\n}\n\n/** The application's error table, its stale-session redirect, and its Better Auth instance. */\nexport type ErrorMiddlewareOptions<Entries> = {\n  readonly errors: ErrorTable<Entries>\n  /** The path a server function redirects to for a stale session, with any search string. */\n  readonly signIn: string\n  /** Select the request's Better Auth instance; its cookie definitions say what to clear. */\n  readonly getAuth: (context: RequestContext) => AuthCookieSource\n}\n\n/**\n * Build both transport boundaries from one error table.\n * Register `functionErrorMiddleware` globally. Put `routeErrorMiddleware` first in an API route's `server.middleware`.\n */\nexport function createErrorMiddleware<Entries>(options: ErrorMiddlewareOptions<Entries>) {\n  const toErrorPayload = createErrorPayloadConverter(options.errors)\n  const toHttpErrorResponse = createHttpErrorResponseConverter(options.errors)\n\n  async function clearSession(context: RequestContext): Promise<void> {\n    const { authCookies } = await options.getAuth(context).$context\n    await clearStaleSessionCookies(authCookies)\n  }\n\n  async function handleFunctionError(cause: unknown, context: RequestContext): Promise<never> {\n    // oxlint-disable-next-line typescript/only-throw-error -- TanStack uses throwable control-flow objects.\n    if (isNotFound(cause) || isRedirect(cause)) throw cause\n    if (cause instanceof StaleSessionError) {\n      await clearSession(context)\n      // oxlint-disable-next-line typescript/only-throw-error -- Router redirects by throwing this.\n      throw redirect({ href: options.signIn })\n    }\n    // oxlint-disable-next-line typescript/only-throw-error -- The client rejects with this and reads its tag.\n    throw toErrorPayload(cause)\n  }\n\n  // A route answers 401 instead of a redirect because fetch would follow it into the HTML shell.\n  async function handleRouteError(cause: unknown, context: RequestContext): Promise<Response> {\n    // oxlint-disable-next-line typescript/only-throw-error -- TanStack uses throwable control-flow objects.\n    if (isNotFound(cause) || isRedirect(cause)) throw cause\n    if (cause instanceof StaleSessionError) await clearSession(context)\n    return toHttpErrorResponse(cause)\n  }\n\n  const functionErrorMiddleware = createMiddleware({ type: 'function' }).server(\n    async ({ next, context }) => {\n      try {\n        return await next()\n      } catch (cause) {\n        return handleFunctionError(cause, context)\n      }\n    },\n  )\n\n  const routeErrorMiddleware = createMiddleware({ type: 'request' }).server(\n    async ({ next, context }) => {\n      try {\n        return await next()\n      } catch (cause) {\n        return handleRouteError(cause, context)\n      }\n    },\n  )\n\n  return { functionErrorMiddleware, routeErrorMiddleware, toErrorPayload, toHttpErrorResponse }\n}\n"],"mappings":";;;;;;;;AAOA,MAAMA,WAAS,aAAa,iBAAiB;AAgC7C,MAAM,iBAAiB,YAAY;CACjC,MAAM,EAAE,sBAAsB,MAAM,OAAO;CAC3C,OAAO,kBAAkB;AAC3B;;;;;AAMA,SAAgB,qBACd,SACA;CACA,MAAM,cAAc,iBAAiB,EAAE,MAAM,WAAW,CAAC,CAAC,CAAC,OACzD,OAAO,EAAE,MAAM,cAAc;EAC3B,IAAI;EACJ,IAAI;GACF,MAAM,UAAU,MAAM,eAAe;GACrC,WAAW,MAAM,QAAQ,QAAQ,OAAO,CAAC,CAAC,IAAI,WAAW,EAAE,QAAQ,CAAC;EACtE,SAAS,OAAO;GACd,SAAO,MAAM,sBAAsB,EAAE,MAAM,CAAC;GAC5C,WAAW;EACb;EACA,IAAI,aAAa,MACf,OAAO,KAA2B,EAAE,SAAS;GAAE,MAAM;GAAW,SAAS;EAAU,EAAE,CAAC;EACxF,OAAO,KAA2B,EAChC,SAAS;GAAE,MAAM,SAAS;GAAM,SAAS,SAAS;EAAQ,EAC5D,CAAC;CACH,CACF;CAEA,eAAe,uBACb,SACA,SACkB;EAClB,MAAM,WAAW,MAAM,QAAQ,QAAQ,OAAO,CAAC,CAAC,IAAI,WAAW,EAAE,QAAQ,CAAC;EAC1E,IAAI,aAAa,MAAM;GACrB,IAAI,iBAAiB,OAAO,GAAG,MAAM,IAAI,kBAAkB;GAC3D,MAAM,IAAI,oBAAoB;EAChC;EACA,OAAO;CACT;CAgBA,OAAO;EAAE;EAAa,aAdF,iBAAiB,EAAE,MAAM,WAAW,CAAC,CAAC,CAAC,OAAO,OAAO,EAAE,MAAM,cAAc;GAC7F,MAAM,WAAW,MAAM,uBAAuB,SAAS,MAAM,eAAe,CAAC;GAC7E,OAAO,KAAmC,EACxC,SAAS;IAAE,MAAM,SAAS;IAAM,SAAS,SAAS;GAAQ,EAC5D,CAAC;EACH,CASgC;EAAG,oBARR,iBAAiB,EAAE,MAAM,UAAU,CAAC,CAAC,CAAC,OAC/D,OAAO,EAAE,SAAS,MAAM,cAAc;GACpC,MAAM,WAAW,MAAM,uBAAuB,SAAS,QAAQ,OAAO;GACtE,OAAO,KAAmC,EACxC,SAAS;IAAE,MAAM,SAAS;IAAM,SAAS,SAAS;GAAQ,EAC5D,CAAC;EACH,CAEkD;CAAE;AACxD;;;;AC7FA,MAAM,SAAS,aAAa,gBAAgB;;;;;AAM5C,SAAgB,eACd,OACA,OACoD;CACpD,MAAM,WAAW,MAAM,QAAQ,KAAK;CACpC,IAAI,aAAa,MAAM;EACrB,OAAO,KAAK,iBAAiB;GAC3B,KAAK,SAAS,QAAQ;GACtB,QAAQ,SAAS;EACnB,CAAC;EACD,OAAO;CACT;CACA,MAAM,iBAAiB,iBAAiB,WAAW,MAAM,iBAAiB;CAC1E,OAAO,MAAM,oBAAoB;EAAE,OAAO;EAAO;CAAe,CAAC;CACjE,OAAO,MAAM,SAAS,KAAK;AAC7B;;;;AChBA,MAAM,mBAAmB,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;;;;;AAM5D,SAAgB,iCAA0C,OAA4B;CACpF,OAAO,SAAS,oBAAoB,OAA0B;EAC5D,MAAM,EAAE,QAAQ,YAAY,eAAe,OAAO,KAAK;EACvD,MAAM,EAAE,MAAM,SAAS,GAAG,WAAW;EACrC,MAAM,OAAuB;GAC3B,MAAM;GACN,OAAO,gBAAgB,MAAM;GAC7B,QAAQ;GACR,GAAG;EACL;EACA,MAAM,UAAU,IAAI,QAAQ,EAAE,gBAAgB,2BAA2B,CAAC;EAC1E,MAAM,QAAQ,iBAAiB,UAAU,OAAO;EAChD,IAAI,MAAM,SAAS,QAAQ,IAAI,eAAe,OAAO,MAAM,KAAK,UAAU,CAAC;EAC3E,OAAO,SAAS,KAAK,MAAM;GAAE;GAAQ;EAAQ,CAAC;CAChD;AACF;;;;;;;;AClBA,eAAsB,yBAAyB,SAA2C;CAExF,MAAM,SAAS,MAAM,OAAO;CAC5B,MAAM,UAAU,CAAC,GAAG,aAAa,OAAO,kBAAkB,CAAC,CAAC,IAAI,QAAQ,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC;CACvF,MAAM,cAAc;EAClB,QAAQ;EACR,QAAQ;EACR,QAAQ;EACR,QAAQ;CACV;CACA,KAAK,MAAM,UAAU,aAAa;EAEhC,MAAM,SAAS,QAAQ,QAAQ,SAAS,KAAK,WAAW,GAAG,OAAO,KAAK,EAAE,CAAC;EAC1E,KAAK,MAAM,wBAAQ,IAAI,IAAI,CAAC,OAAO,MAAM,GAAG,MAAM,CAAC,GACjD,OAAO,aAAa,MAAM,WAAW,OAAO,UAAU,CAAC;CAC3D;AACF;AAEA,SAAS,WAAW,YAA2D;CAE7E,MAAM,UAA+B;EACnC,MAAM,WAAW,QAAQ;EACzB,QAAQ,WAAW,UAAU;CAC/B;CACA,IAAI,WAAW,WAAW,QAAW,QAAQ,SAAS,WAAW;CACjE,OAAO;AACT;;;;AC9BA,MAAM,yBAAyB,EAC5B,MAAM,EAAE,OAAO;CAAE,SAAS,EAAE,OAAO;CAAG,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;AAAE,CAAC,CAAC,CAAC,CAC1F,IAAI,CAAC;AAER,SAAS,2BAA2B,OAAwC;CAC1E,IAAI,EAAE,iBAAiB,QAAQ,OAAO;CACtC,IAAI;CACJ,IAAI;EACF,UAAU,KAAK,MAAM,MAAM,OAAO;CACpC,QAAQ;EACN,OAAO;CACT;CACA,MAAM,SAAS,uBAAuB,UAAU,OAAO;CACvD,OAAO,OAAO,UAAU,gBAAgB,WAAW,OAAO,IAAI,IAAI;AACpE;;;;;AAMA,SAAgB,4BAAqC,OAA4B;CAC/E,OAAO,SAAS,eAAe,OAAqD;EAClF,OAAO,eAAe,OAAO,2BAA2B,KAAK,KAAK,KAAK,CAAC,CAAC;CAC3E;AACF;;;;;;;;ACFA,SAAgB,sBAA+B,SAA0C;CACvF,MAAM,iBAAiB,4BAA4B,QAAQ,MAAM;CACjE,MAAM,sBAAsB,iCAAiC,QAAQ,MAAM;CAE3E,eAAe,aAAa,SAAwC;EAClE,MAAM,EAAE,gBAAgB,MAAM,QAAQ,QAAQ,OAAO,CAAC,CAAC;EACvD,MAAM,yBAAyB,WAAW;CAC5C;CAEA,eAAe,oBAAoB,OAAgB,SAAyC;EAE1F,IAAI,WAAW,KAAK,KAAK,WAAW,KAAK,GAAG,MAAM;EAClD,IAAI,iBAAiB,mBAAmB;GACtC,MAAM,aAAa,OAAO;GAE1B,MAAM,SAAS,EAAE,MAAM,QAAQ,OAAO,CAAC;EACzC;EAEA,MAAM,eAAe,KAAK;CAC5B;CAGA,eAAe,iBAAiB,OAAgB,SAA4C;EAE1F,IAAI,WAAW,KAAK,KAAK,WAAW,KAAK,GAAG,MAAM;EAClD,IAAI,iBAAiB,mBAAmB,MAAM,aAAa,OAAO;EAClE,OAAO,oBAAoB,KAAK;CAClC;CAsBA,OAAO;EAAE,yBApBuB,iBAAiB,EAAE,MAAM,WAAW,CAAC,CAAC,CAAC,OACrE,OAAO,EAAE,MAAM,cAAc;GAC3B,IAAI;IACF,OAAO,MAAM,KAAK;GACpB,SAAS,OAAO;IACd,OAAO,oBAAoB,OAAO,OAAO;GAC3C;EACF,CAa6B;EAAG,sBAVL,iBAAiB,EAAE,MAAM,UAAU,CAAC,CAAC,CAAC,OACjE,OAAO,EAAE,MAAM,cAAc;GAC3B,IAAI;IACF,OAAO,MAAM,KAAK;GACpB,SAAS,OAAO;IACd,OAAO,iBAAiB,OAAO,OAAO;GACxC;EACF,CAGmD;EAAG;EAAgB;CAAoB;AAC9F"}

package/dist/testing/outbox-repository.d.ts

@@ -1,5 +1,5 @@
-import { q as DomainEvent } from "../index-DvJUcSW1.js";
-import { A as IOutboxRepository } from "../index-Cchdg2aQ.js";
+import { W as DomainEvent } from "../index-DUFS0SJ_.js";
+import { A as IOutboxRepository } from "../index-CYHXOH08.js";
 //#region src/infrastructure/testing/outbox-repository-contract.d.ts
 /** Stored fields observed by the adapter contract, independent of a database library. */
 export type OutboxContractRow = {