better-ship 0.38.0 → 0.39.1

package/dist/better-auth/apple-client-secret.d.ts

@@ -21,7 +21,7 @@ export declare class AppleClientSecretError extends AppError {
 /**
  * Sign Apple's six-month client secret synchronously, so Better Auth options can be built without awaiting it.
  * Signing uses `node:crypto` as Typist does, so the Worker needs the `nodejs_compat` flag.
- * Invalid private keys return an empty secret and log once per isolate, as in Typist.
+ * Invalid private keys return an empty secret and log once per key ID in each isolate, as in Typist.
  */
 export declare function generateAppleClientSecret(config: AppleKeyConfig): string;
 //#endregion

package/dist/better-auth/apple-client-secret.js

@@ -4,7 +4,7 @@ import { createPrivateKey, sign } from "node:crypto";
 
 //#region src/infrastructure/better-auth/apple-client-secret.ts
 const logger = createLogger("auth");
-let appleKeyFailureLogged = false;
+const loggedInvalidKeyIds = /* @__PURE__ */ new Set();
 /**
 * Apple caps `exp` at 15,777,000 seconds after `iat`; 180 days stays under it. Source:
 * https://developer.apple.com/documentation/accountorganizationaldatasharing/creating-a-client-secret
@@ -29,15 +29,15 @@ function base64UrlJson(segment) {
 /**
 * Sign Apple's six-month client secret synchronously, so Better Auth options can be built without awaiting it.
 * Signing uses `node:crypto` as Typist does, so the Worker needs the `nodejs_compat` flag.
-* Invalid private keys return an empty secret and log once per isolate, as in Typist.
+* Invalid private keys return an empty secret and log once per key ID in each isolate, as in Typist.
 */
 function generateAppleClientSecret(config) {
 	const key = config.applePrivateKey.replace(/\\n/g, "\n");
 	try {
 		createPrivateKey(key);
 	} catch (error) {
-		if (!appleKeyFailureLogged) {
-			appleKeyFailureLogged = true;
+		if (!loggedInvalidKeyIds.has(config.appleKeyId)) {
+			loggedInvalidKeyIds.add(config.appleKeyId);
 			logger.error("apple_private_key_invalid", {
 				error,
 				keyId: config.appleKeyId

package/dist/better-auth/apple-client-secret.js.map

@@ -1 +1 @@
-{"version":3,"file":"apple-client-secret.js","names":[],"sources":["../../src/infrastructure/better-auth/apple-client-secret.ts"],"sourcesContent":["import { Buffer } from 'node:buffer'\nimport { createPrivateKey, sign } from 'node:crypto'\n\nimport { AppError, createLogger } from '@/core'\n\nconst logger = createLogger('auth')\n// Typist reports an invalid key once per isolate because session checks repeatedly construct auth options.\nlet appleKeyFailureLogged = false\n/**\n * Apple caps `exp` at 15,777,000 seconds after `iat`; 180 days stays under it. Source:\n * https://developer.apple.com/documentation/accountorganizationaldatasharing/creating-a-client-secret\n */\nconst SECRET_LIFETIME_SECONDS = 180 * 24 * 60 * 60\n\n/**\n * Apple's issuer and OAuth callback origin, and the `aud` claim of the client secret. Include it in\n * trustedOrigins when enabling Apple. Source: the same Apple page as `SECRET_LIFETIME_SECONDS`.\n */\nexport const APPLE_ORIGIN = 'https://appleid.apple.com'\n\n/** Apple credentials used to sign a client secret. Ported from Porte's apple-client-secret.ts. */\nexport type AppleKeyConfig = {\n  readonly appleClientId: string\n  readonly appleTeamId: string\n  readonly appleKeyId: string\n  readonly applePrivateKey: string\n}\n\n/** Apple signing failed. The application's error boundary owns reporting. */\nexport class AppleClientSecretError extends AppError {\n  readonly _tag = 'AppleClientSecretError'\n  readonly classification = 'terminal'\n\n  constructor(cause: unknown) {\n    super('Apple client secret signing failed', { cause })\n  }\n}\n\n/** One JWS segment before encoding: the protected header or the claims. */\ntype JwsSegment = Readonly<Record<string, string | number>>\n\nfunction base64UrlJson(segment: JwsSegment): string {\n  return Buffer.from(JSON.stringify(segment)).toString('base64url')\n}\n\n/**\n * Sign Apple's six-month client secret synchronously, so Better Auth options can be built without awaiting it.\n * Signing uses `node:crypto` as Typist does, so the Worker needs the `nodejs_compat` flag.\n * Invalid private keys return an empty secret and log once per isolate, as in Typist.\n */\nexport function generateAppleClientSecret(config: AppleKeyConfig): string {\n  const key = config.applePrivateKey.replace(/\\\\n/g, '\\n')\n  // Validation only: workerd's sign() takes the PEM string, not the KeyObject.\n  try {\n    createPrivateKey(key)\n  } catch (error) {\n    if (!appleKeyFailureLogged) {\n      appleKeyFailureLogged = true\n      logger.error('apple_private_key_invalid', { error, keyId: config.appleKeyId })\n    }\n    return ''\n  }\n  const issuedAt = Math.floor(Date.now() / 1000)\n  const header = base64UrlJson({ alg: 'ES256', kid: config.appleKeyId })\n  const claims = base64UrlJson({\n    iss: config.appleTeamId,\n    sub: config.appleClientId,\n    aud: APPLE_ORIGIN,\n    iat: issuedAt,\n    exp: issuedAt + SECRET_LIFETIME_SECONDS,\n  })\n  const input = `${header}.${claims}`\n  try {\n    // A JWS carries the raw r||s signature; OpenSSL emits DER unless told otherwise.\n    const signature = sign('sha256', Buffer.from(input), { key, dsaEncoding: 'ieee-p1363' })\n    // TypeScript 7 types the returned buffer without an encoding parameter on toString.\n    return `${input}.${Buffer.from(signature).toString('base64url')}`\n  } catch (cause) {\n    throw new AppleClientSecretError(cause)\n  }\n}\n"],"mappings":";;;;;AAKA,MAAM,SAAS,aAAa,MAAM;AAElC,IAAI,wBAAwB;;;;;AAK5B,MAAM,0BAA0B;;;;;AAMhC,MAAa,eAAe;;AAW5B,IAAa,yBAAb,cAA4C,SAAS;CACnD,AAAS,OAAO;CAChB,AAAS,iBAAiB;CAE1B,YAAY,OAAgB;EAC1B,MAAM,sCAAsC,EAAE,MAAM,CAAC;CACvD;AACF;AAKA,SAAS,cAAc,SAA6B;CAClD,OAAO,OAAO,KAAK,KAAK,UAAU,OAAO,CAAC,CAAC,CAAC,SAAS,WAAW;AAClE;;;;;;AAOA,SAAgB,0BAA0B,QAAgC;CACxE,MAAM,MAAM,OAAO,gBAAgB,QAAQ,QAAQ,IAAI;CAEvD,IAAI;EACF,iBAAiB,GAAG;CACtB,SAAS,OAAO;EACd,IAAI,CAAC,uBAAuB;GAC1B,wBAAwB;GACxB,OAAO,MAAM,6BAA6B;IAAE;IAAO,OAAO,OAAO;GAAW,CAAC;EAC/E;EACA,OAAO;CACT;CACA,MAAM,WAAW,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;CAS7C,MAAM,QAAQ,GARC,cAAc;EAAE,KAAK;EAAS,KAAK,OAAO;CAAW,CAQ9C,EAAE,GAPT,cAAc;EAC3B,KAAK,OAAO;EACZ,KAAK,OAAO;EACZ,KAAK;EACL,KAAK;EACL,KAAK,WAAW;CAClB,CACgC;CAChC,IAAI;EAEF,MAAM,YAAY,KAAK,UAAU,OAAO,KAAK,KAAK,GAAG;GAAE;GAAK,aAAa;EAAa,CAAC;EAEvF,OAAO,GAAG,MAAM,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,SAAS,WAAW;CAChE,SAAS,OAAO;EACd,MAAM,IAAI,uBAAuB,KAAK;CACxC;AACF"}
+{"version":3,"file":"apple-client-secret.js","names":[],"sources":["../../src/infrastructure/better-auth/apple-client-secret.ts"],"sourcesContent":["import { Buffer } from 'node:buffer'\nimport { createPrivateKey, sign } from 'node:crypto'\n\nimport { AppError, createLogger } from '@/core'\n\nconst logger = createLogger('auth')\n// Typist reports an invalid key once per isolate because session checks repeatedly construct auth options.\nconst loggedInvalidKeyIds = new Set<string>()\n/**\n * Apple caps `exp` at 15,777,000 seconds after `iat`; 180 days stays under it. Source:\n * https://developer.apple.com/documentation/accountorganizationaldatasharing/creating-a-client-secret\n */\nconst SECRET_LIFETIME_SECONDS = 180 * 24 * 60 * 60\n\n/**\n * Apple's issuer and OAuth callback origin, and the `aud` claim of the client secret. Include it in\n * trustedOrigins when enabling Apple. Source: the same Apple page as `SECRET_LIFETIME_SECONDS`.\n */\nexport const APPLE_ORIGIN = 'https://appleid.apple.com'\n\n/** Apple credentials used to sign a client secret. Ported from Porte's apple-client-secret.ts. */\nexport type AppleKeyConfig = {\n  readonly appleClientId: string\n  readonly appleTeamId: string\n  readonly appleKeyId: string\n  readonly applePrivateKey: string\n}\n\n/** Apple signing failed. The application's error boundary owns reporting. */\nexport class AppleClientSecretError extends AppError {\n  readonly _tag = 'AppleClientSecretError'\n  readonly classification = 'terminal'\n\n  constructor(cause: unknown) {\n    super('Apple client secret signing failed', { cause })\n  }\n}\n\n/** One JWS segment before encoding: the protected header or the claims. */\ntype JwsSegment = Readonly<Record<string, string | number>>\n\nfunction base64UrlJson(segment: JwsSegment): string {\n  return Buffer.from(JSON.stringify(segment)).toString('base64url')\n}\n\n/**\n * Sign Apple's six-month client secret synchronously, so Better Auth options can be built without awaiting it.\n * Signing uses `node:crypto` as Typist does, so the Worker needs the `nodejs_compat` flag.\n * Invalid private keys return an empty secret and log once per key ID in each isolate, as in Typist.\n */\nexport function generateAppleClientSecret(config: AppleKeyConfig): string {\n  const key = config.applePrivateKey.replace(/\\\\n/g, '\\n')\n  // Validation only: workerd's sign() takes the PEM string, not the KeyObject.\n  try {\n    createPrivateKey(key)\n  } catch (error) {\n    if (!loggedInvalidKeyIds.has(config.appleKeyId)) {\n      loggedInvalidKeyIds.add(config.appleKeyId)\n      logger.error('apple_private_key_invalid', { error, keyId: config.appleKeyId })\n    }\n    return ''\n  }\n  const issuedAt = Math.floor(Date.now() / 1000)\n  const header = base64UrlJson({ alg: 'ES256', kid: config.appleKeyId })\n  const claims = base64UrlJson({\n    iss: config.appleTeamId,\n    sub: config.appleClientId,\n    aud: APPLE_ORIGIN,\n    iat: issuedAt,\n    exp: issuedAt + SECRET_LIFETIME_SECONDS,\n  })\n  const input = `${header}.${claims}`\n  try {\n    // A JWS carries the raw r||s signature; OpenSSL emits DER unless told otherwise.\n    const signature = sign('sha256', Buffer.from(input), { key, dsaEncoding: 'ieee-p1363' })\n    // TypeScript 7 types the returned buffer without an encoding parameter on toString.\n    return `${input}.${Buffer.from(signature).toString('base64url')}`\n  } catch (cause) {\n    throw new AppleClientSecretError(cause)\n  }\n}\n"],"mappings":";;;;;AAKA,MAAM,SAAS,aAAa,MAAM;AAElC,MAAM,sCAAsB,IAAI,IAAY;;;;;AAK5C,MAAM,0BAA0B;;;;;AAMhC,MAAa,eAAe;;AAW5B,IAAa,yBAAb,cAA4C,SAAS;CACnD,AAAS,OAAO;CAChB,AAAS,iBAAiB;CAE1B,YAAY,OAAgB;EAC1B,MAAM,sCAAsC,EAAE,MAAM,CAAC;CACvD;AACF;AAKA,SAAS,cAAc,SAA6B;CAClD,OAAO,OAAO,KAAK,KAAK,UAAU,OAAO,CAAC,CAAC,CAAC,SAAS,WAAW;AAClE;;;;;;AAOA,SAAgB,0BAA0B,QAAgC;CACxE,MAAM,MAAM,OAAO,gBAAgB,QAAQ,QAAQ,IAAI;CAEvD,IAAI;EACF,iBAAiB,GAAG;CACtB,SAAS,OAAO;EACd,IAAI,CAAC,oBAAoB,IAAI,OAAO,UAAU,GAAG;GAC/C,oBAAoB,IAAI,OAAO,UAAU;GACzC,OAAO,MAAM,6BAA6B;IAAE;IAAO,OAAO,OAAO;GAAW,CAAC;EAC/E;EACA,OAAO;CACT;CACA,MAAM,WAAW,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;CAS7C,MAAM,QAAQ,GARC,cAAc;EAAE,KAAK;EAAS,KAAK,OAAO;CAAW,CAQ9C,EAAE,GAPT,cAAc;EAC3B,KAAK,OAAO;EACZ,KAAK,OAAO;EACZ,KAAK;EACL,KAAK;EACL,KAAK,WAAW;CAClB,CACgC;CAChC,IAAI;EAEF,MAAM,YAAY,KAAK,UAAU,OAAO,KAAK,KAAK,GAAG;GAAE;GAAK,aAAa;EAAa,CAAC;EAEvF,OAAO,GAAG,MAAM,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,SAAS,WAAW;CAChE,SAAS,OAAO;EACd,MAAM,IAAI,uBAAuB,KAAK;CACxC;AACF"}

package/dist/better-auth/auth-client.d.ts

@@ -13,4 +13,5 @@ export declare const authClient: import("better-auth/client").AuthClient<{
   };
 }>;
 //#endregion
+export {};
 //# sourceMappingURL=auth-client.d.ts.map

package/dist/better-auth/secondary-storage.d.ts

@@ -8,4 +8,5 @@ type SecondaryStorage = NonNullable<BetterAuthOptions['secondaryStorage']>;
  */
 export declare function createAuthSecondaryStorage(binding: Pick<DurableObjectNamespace<AuthSecondaryStorage>, 'getByName'>): SecondaryStorage;
 //#endregion
+export {};
 //# sourceMappingURL=secondary-storage.d.ts.map

package/dist/better-auth.d.ts

@@ -99,4 +99,5 @@ export type BetterAuthOptionsFactory = <const Config extends AuthConfig, const P
  */
 export declare const createBetterAuthOptions: BetterAuthOptionsFactory;
 //#endregion
+export {};
 //# sourceMappingURL=better-auth.d.ts.map

package/dist/billing/client.d.ts

@@ -83,4 +83,5 @@ export declare class BillingService<const Options extends BillingOptions> implem
   constructor(options: Options);
 }
 //#endregion
+export {};
 //# sourceMappingURL=client.d.ts.map

package/dist/cloudflare/durable-object-client.d.ts

@@ -15,4 +15,5 @@ export declare abstract class DurableObjectClient<T extends Rpc.DurableObjectBra
   private run;
 }
 //#endregion
+export {};
 //# sourceMappingURL=durable-object-client.d.ts.map

package/dist/cloudflare/durable-object-errors.d.ts

@@ -37,4 +37,5 @@ export declare class DurableObjectCallError extends AppError {
   });
 }
 //#endregion
+export {};
 //# sourceMappingURL=durable-object-errors.d.ts.map

package/dist/cloudflare.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cloudflare.d.ts","names":[],"sources":["../src/infrastructure/cloudflare/d1-database-types.ts","../src/infrastructure/cloudflare/base-d1-repository.ts","../src/infrastructure/cloudflare/classify-d1-error.ts","../src/infrastructure/cloudflare/d1-message-store.ts","../src/infrastructure/cloudflare/d1-schema.ts","../src/infrastructure/cloudflare/d1-batch-transaction.ts","../src/infrastructure/cloudflare/d1-database-execution.ts","../src/infrastructure/cloudflare/d1-outbox-repository.ts"],"mappings":";;;;;;;KAKY,eAAe;;KAGf,KAAK,eAAe,iBAAiB,kBAAkB;;KAGvD,SAAS,eAAe,iBAAiB,KACnD,KAAK;;KAKK,KAAK,eAAe;WACrB,IAAI,KAAK;;;;;UCRH;EACf,iBAAiB,cAAc;EAC/B;;;;;;8BAOoB,iBAAiB,eAAe;qBACrB,IAAI,KAAK;EAAxC,YAA+B,IAAI,KAAK;;YAG9B,MAAM,WAAW;;YAKjB,KAAK,GAAG,mBAAmB,aAAa,YAAY,KAAK,QAAQ;;YAKjE,eAAe,WAAW;;;;;;;;wBCVtB,gBAAgB,gBAAgB,qBAAyB;;;;qBCb5D,eAAe,eAAe,uBACjC,iBAAiB,mBACd;EAEL,MAAM,WAAW,YAAY;EAc7B,cAAc,QAAQ,cAAc,eAAe;;;;;qBCtB9C,qDAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;YAAjB;;;;;;;;;;;;;;;;qBAYA,iDAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qBCPb,mBAAmB,eAAe,0BAA0B,aACvE,KAAK;mBAEwB;EAA7B,YAA6B,IAAI,KAAK;EAEhC,YAAY,GAAG,OAAO,IAAI,KAAK,YAAY,QAAQ,KAAK,QAAQ;;;;;;;;wBCNlD,gBAAgB,GACpC,mBACA,YAAY,YAAY,IACxB;WAAoB;IACnB,QAAQ;;;;;;;qBCIE,mBAAmB,eAAe,0BAA0B;mBAIpD;mBAEA;mBALF;EAEjB,YACmB,IAAI,KAAK,SAC1B,UAAS,yBACQ,YAAW;;EAMxB,aAAa,oBAAoB,QAAQ;;EAmDzC,cAAc,OAAO,aAAa,UAAU,cAAc,iBAAiB;;EAgB3E,aAAa,OAAO,aAAa,UAAU,cAAc,iBAAiB;;EA6B1E,WACJ,OAAO,aACP,UAAU,cAAc,gBACxB,QAAQ,kBACR,uBACC;;EAqBG,sBAAsB,QAAQ,MAAM,oBAAoB;;EAqBxD,mBAAmB,QAAQ,MAAM,oBAAoB;;EAqBrD,qBAAqB,QAAQ,MAAM,oBAAoB"}
+{"version":3,"file":"cloudflare.d.ts","names":[],"sources":["../src/infrastructure/cloudflare/d1-database-types.ts","../src/infrastructure/cloudflare/base-d1-repository.ts","../src/infrastructure/cloudflare/classify-d1-error.ts","../src/infrastructure/cloudflare/d1-message-store.ts","../src/infrastructure/cloudflare/d1-schema.ts","../src/infrastructure/cloudflare/d1-batch-transaction.ts","../src/infrastructure/cloudflare/d1-database-execution.ts","../src/infrastructure/cloudflare/d1-outbox-repository.ts"],"mappings":";;;;;;;KAKY,eAAe;;KAGf,KAAK,eAAe,iBAAiB,kBAAkB;;KAGvD,SAAS,eAAe,iBAAiB,KACnD,KAAK;;KAKK,KAAK,eAAe;WACrB,IAAI,KAAK;;;;;UCRH;EACf,iBAAiB,cAAc;EAC/B;;;;;;8BAOoB,iBAAiB,eAAe;qBACrB,IAAI,KAAK;EAAxC,YAA+B,IAAI,KAAK;;YAG9B,MAAM,WAAW;;YAKjB,KAAK,GAAG,mBAAmB,aAAa,YAAY,KAAK,QAAQ;;YAKjE,eAAe,WAAW;;;;;;;;wBCVtB,gBAAgB,gBAAgB,qBAAyB;;;;qBCb5D,eAAe,eAAe,uBACjC,iBAAiB,mBACd;EAEL,MAAM,WAAW,YAAY;EAc7B,cAAc,QAAQ,cAAc,eAAe;;;;;qBCtB9C,qDAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qBAYjB,iDAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qBCPb,mBAAmB,eAAe,0BAA0B,aACvE,KAAK;mBAEwB;EAA7B,YAA6B,IAAI,KAAK;EAEhC,YAAY,GAAG,OAAO,IAAI,KAAK,YAAY,QAAQ,KAAK,QAAQ;;;;;;;;wBCNlD,gBAAgB,GACpC,mBACA,YAAY,YAAY,IACxB;WAAoB;IACnB,QAAQ;;;;;;;qBCIE,mBAAmB,eAAe,0BAA0B;mBAIpD;mBAEA;mBALF;EAEjB,YACmB,IAAI,KAAK,SAC1B,UAAS,yBACQ,YAAW;;EAMxB,aAAa,oBAAoB,QAAQ;;EAmDzC,cAAc,OAAO,aAAa,UAAU,cAAc,iBAAiB;;EAgB3E,aAAa,OAAO,aAAa,UAAU,cAAc,iBAAiB;;EA6B1E,WACJ,OAAO,aACP,UAAU,cAAc,gBACxB,QAAQ,kBACR,uBACC;;EAqBG,sBAAsB,QAAQ,MAAM,oBAAoB;;EAqBxD,mBAAmB,QAAQ,MAAM,oBAAoB;;EAqBrD,qBAAqB,QAAQ,MAAM,oBAAoB"}

package/dist/postgres.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"postgres.d.ts","names":[],"sources":["../src/infrastructure/postgres/postgres-database-types.ts","../src/infrastructure/postgres/base-postgres-repository.ts","../src/infrastructure/postgres/postgres-message-store.ts","../src/infrastructure/postgres/postgres-schema.ts","../src/infrastructure/postgres/postgres-transaction.ts","../src/infrastructure/postgres/postgres-client.ts","../src/infrastructure/postgres/statement-outside-transaction.error.ts","../src/infrastructure/postgres/postgres-database-execution.ts","../src/infrastructure/postgres/classify-postgres-error.ts","../src/infrastructure/postgres/postgres-outbox-repository.ts"],"mappings":";;;;;;;;KAOY,qBAAqB;;KAGrB,WAAW,eAAe,iBAAiB,eAAe;;KAG1D,eAAe,eAAe,iBAAiB,KACzD,WAAW;;KAKD,sBAAsB,eAAe,iBAAiB,kBAChE,QACA,2BAA2B;;KAIjB,WAAW,eAAe;WAC3B,IAAI,sBAAsB;;;;;UClBpB;EACf,iBAAiB,cAAc;EAC/B;;;8BAIoB,uBAAuB,eAAe;qBAC3B,IAAI,sBAAsB;EAAzD,YAA+B,IAAI,sBAAsB;;YAG/C,KAAK,GAAG,mBAAmB,aAAa,YAAY,KAAK,QAAQ;;YAKjE,eAAe,WAAW;;;;;qBCfzB,qBAAqB,eAAe,0BAA0B;mBAC5C;EAA7B,YAA6B,IAAI,sBAAsB;EAEjD,MAAM,WAAW,YAAY;EAU7B,cAAc,QAAQ,cAAc,eAAe;;;;;qBCf9C,iDAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;YAAjB;;;;;;;;;;;;;;;;qBAMA,6CAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qBCAb,oBAAoB,eAAe,0BAA0B,aACxE,WAAW;mBAEkB;EAA7B,YAA6B,IAAI,WAAW;EAE5C,YAAY,GAAG,OAAO,IAAI,WAAW,YAAY,QAAQ,KAAK,QAAQ;;;;;;;;;;;;wBCFxD,gBAAgB,eAAe,eAC7C,0BACA,QAAQ,QACR,UAAU;EAqBR,wCAAE,eAAA;;;;EAEF,aAAK;;;;;;;;qBCnCI,yCAAyC;WAC3C;WACA;EAET;;;;;;;;;;wBCMoB,gBAAgB,GACpC,mBACA,YAAY,YAAY,IACxB;WAAoB;IACnB,QAAQ;;;;wBCkBK,sBACd,gBACA,oBACC;;;;;;;qBCvBU,oCAAoC;mBAI5B;mBAEA;mBALF;EAEjB,YACmB,IAAI,WAAW,gBAChC,UAAS,yBACQ,YAAW;;EAMxB,aAAa,oBAAoB,QAAQ;;EAoDzC,cAAc,OAAO,aAAa,UAAU,cAAc,iBAAiB;;EAmB3E,aAAa,OAAO,aAAa,UAAU,cAAc,iBAAiB;;EAwB1E,WACJ,OAAO,aACP,UAAU,cAAc,gBACxB,QAAQ,kBACR,uBACC;;EAwBG,sBAAsB,QAAQ,MAAM,oBAAoB;;EAqBxD,mBAAmB,QAAQ,MAAM,oBAAoB;;EAqBrD,qBAAqB,QAAQ,MAAM,oBAAoB"}
+{"version":3,"file":"postgres.d.ts","names":[],"sources":["../src/infrastructure/postgres/postgres-database-types.ts","../src/infrastructure/postgres/base-postgres-repository.ts","../src/infrastructure/postgres/postgres-message-store.ts","../src/infrastructure/postgres/postgres-schema.ts","../src/infrastructure/postgres/postgres-transaction.ts","../src/infrastructure/postgres/postgres-client.ts","../src/infrastructure/postgres/statement-outside-transaction.error.ts","../src/infrastructure/postgres/postgres-database-execution.ts","../src/infrastructure/postgres/classify-postgres-error.ts","../src/infrastructure/postgres/postgres-outbox-repository.ts"],"mappings":";;;;;;;;KAOY,qBAAqB;;KAGrB,WAAW,eAAe,iBAAiB,eAAe;;KAG1D,eAAe,eAAe,iBAAiB,KACzD,WAAW;;KAKD,sBAAsB,eAAe,iBAAiB,kBAChE,QACA,2BAA2B;;KAIjB,WAAW,eAAe;WAC3B,IAAI,sBAAsB;;;;;UClBpB;EACf,iBAAiB,cAAc;EAC/B;;;8BAIoB,uBAAuB,eAAe;qBAC3B,IAAI,sBAAsB;EAAzD,YAA+B,IAAI,sBAAsB;;YAG/C,KAAK,GAAG,mBAAmB,aAAa,YAAY,KAAK,QAAQ;;YAKjE,eAAe,WAAW;;;;;qBCfzB,qBAAqB,eAAe,0BAA0B;mBAC5C;EAA7B,YAA6B,IAAI,sBAAsB;EAEjD,MAAM,WAAW,YAAY;EAU7B,cAAc,QAAQ,cAAc,eAAe;;;;;qBCf9C,iDAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qBAMjB,6CAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qBCAb,oBAAoB,eAAe,0BAA0B,aACxE,WAAW;mBAEkB;EAA7B,YAA6B,IAAI,WAAW;EAE5C,YAAY,GAAG,OAAO,IAAI,WAAW,YAAY,QAAQ,KAAK,QAAQ;;;;;;;;;;;;wBCFxD,gBAAgB,eAAe,eAC7C,0BACA,QAAQ,QACR,UAAU;EAqBR,wCAAE,eAAA;;;;EAEF,aAAK;;;;;;;;qBCnCI,yCAAyC;WAC3C;WACA;EAET;;;;;;;;;;wBCMoB,gBAAgB,GACpC,mBACA,YAAY,YAAY,IACxB;WAAoB;IACnB,QAAQ;;;;wBCkBK,sBACd,gBACA,oBACC;;;;;;;qBCvBU,oCAAoC;mBAI5B;mBAEA;mBALF;EAEjB,YACmB,IAAI,WAAW,gBAChC,UAAS,yBACQ,YAAW;;EAMxB,aAAa,oBAAoB,QAAQ;;EAoDzC,cAAc,OAAO,aAAa,UAAU,cAAc,iBAAiB;;EAmB3E,aAAa,OAAO,aAAa,UAAU,cAAc,iBAAiB;;EAwB1E,WACJ,OAAO,aACP,UAAU,cAAc,gBACxB,QAAQ,kBACR,uBACC;;EAwBG,sBAAsB,QAAQ,MAAM,oBAAoB;;EAqBxD,mBAAmB,QAAQ,MAAM,oBAAoB;;EAqBrD,qBAAqB,QAAQ,MAAM,oBAAoB"}

package/dist/stripe/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","names":[],"sources":["../../src/infrastructure/stripe/client.ts"],"mappings":";;;qBAGa,wBAAsB;EAAA;;;;;;wBAMnB,mBAAmB,mBAAmB,UAAS,OAAO,eAAoB"}
+{"version":3,"file":"client.d.ts","names":[],"sources":["../../src/infrastructure/stripe/client.ts"],"mappings":";;;qBAGa,wBAAsB;;;;;;;wBAMnB,mBAAmB,mBAAmB,UAAS,OAAO,eAAoB"}

package/dist/stripe/event-map.d.ts

@@ -11,4 +11,5 @@ export declare function stripeEventMap<T>(map: { [K in Stripe.Event['type']]?: (
 /** Identify one Stripe event delivery; different events for one payment retain different IDs. */
 export declare function stripeEventId(event: Stripe.Event): string;
 //#endregion
+export {};
 //# sourceMappingURL=event-map.d.ts.map

package/dist/testing/stripe.d.ts

@@ -18,4 +18,5 @@ type StripeFixture = {
  */
 export declare function stripeFixture(respond: (request: Request) => Response | Promise<Response>): StripeFixture;
 //#endregion
+export {};
 //# sourceMappingURL=stripe.d.ts.map

package/package.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://www.schemastore.org/package.json",
   "name": "better-ship",
-  "version": "0.38.0",
+  "version": "0.39.1",
   "description": "Foundation for applications on Cloudflare Workers: logger, errors, message bus, infrastructure adapters, and UI primitives",
   "license": "Apache-2.0",
   "repository": {
@@ -79,64 +79,68 @@
   "dependencies": {
     "better-result": "^3.0.1",
     "http-status-codes": "^2.3.0",
-    "uuid": "^14.0.2",
-    "zod": "^4.6.5"
+    "uuid": "^14.0.3",
+    "zod": "^4.6.7"
   },
   "devDependencies": {
-    "@better-auth/stripe": "^1.7.7",
-    "@cloudflare/vitest-plugin": "^1.3.4",
-    "@cloudflare/workers-types": "5.20260930.2",
-    "@mdn/browser-compat-data": "^8.1.4",
-    "@oxlint/plugins": "^1.86.0",
+    "@better-auth/stripe": "^1.7.10",
+    "@cloudflare/vitest-plugin": "^1.4.4",
+    "@cloudflare/workers-types": "5.20261012.1",
+    "@fast-check/vitest": "^0.5.0",
+    "@mdn/browser-compat-data": "^8.1.6",
+    "@oxlint/plugins": "^1.88.0",
     "@posthog/react": "^1.11.3",
-    "@sentry/cloudflare": "^11.6.0",
-    "@sentry/tanstackstart-react": "^11.6.0",
+    "@sentry/cloudflare": "^11.8.0",
+    "@sentry/tanstackstart-react": "^11.8.0",
     "@tailwindcss/node": "^4.3.3",
     "@tanstack/react-form": "^1.33.5",
-    "@tanstack/react-query": "^5.104.1",
-    "@tanstack/react-router": "^1.170.41",
-    "@tanstack/react-start": "^1.168.60",
-    "@tanstack/start-client-core": "^1.170.34",
-    "@tanstack/start-storage-context": "^1.167.36",
-    "@types/node": "^26.6.3",
+    "@tanstack/react-query": "^5.104.3",
+    "@tanstack/react-router": "^1.170.44",
+    "@tanstack/react-start": "^1.169.2",
+    "@tanstack/start-client-core": "^1.170.37",
+    "@tanstack/start-storage-context": "^1.167.39",
+    "@types/node": "^26.6.5",
     "@types/pg": "^8.23.1",
     "@types/react": "^19.3.0",
-    "@vitest/browser-playwright": "^4.1.11",
-    "auth": "^1.7.7",
-    "better-auth": "^1.7.7",
+    "@vitest/browser-playwright": "^5.0.5",
+    "@vitest/coverage-istanbul": "^5.0.5",
+    "auth": "^1.7.10",
+    "better-auth": "^1.7.10",
     "browserslist": "^4.29.3",
     "drizzle-kit": "^0.31.11",
-    "drizzle-orm": "^0.45.3",
+    "drizzle-orm": "^0.45.4",
+    "fast-check": "^4.10.2",
+    "msw": "^3.0.3",
     "pg": "^8.23.1",
-    "playwright": "^1.63.0",
-    "posthog-js": "^1.435.6",
-    "posthog-node": "^5.55.0",
-    "react": "^19.3.0",
-    "resend": "^6.31.0",
+    "playwright": "^1.64.1",
+    "posthog-js": "^1.438.12",
+    "posthog-node": "^5.56.1",
+    "react": "^19.3.1",
+    "resend": "^6.33.0",
     "standardwebhooks": "^1.1.1",
     "stripe": "^22.6.2",
-    "tsdown": "^0.23.0",
+    "tsdown": "^0.23.1",
     "typescript": "^7.0.2",
-    "vitest": "^4.1.11",
-    "wrangler": "^4.145.0"
+    "vitest": "^5.0.5",
+    "wrangler": "^4.151.1"
   },
   "peerDependencies": {
-    "@better-auth/stripe": "^1.7.7",
-    "@mdn/browser-compat-data": "^8.1.4",
-    "@oxlint/plugins": "^1.86.0",
+    "@better-auth/stripe": "^1.7.10",
+    "@mdn/browser-compat-data": "^8.1.6",
+    "@oxlint/plugins": "^1.88.0",
     "@posthog/react": "^1.11.3",
-    "@sentry/cloudflare": "^11.6.0",
-    "@sentry/tanstackstart-react": "^11.6.0",
-    "@tanstack/react-router": "^1.170.41",
-    "@tanstack/react-start": "^1.168.60",
-    "better-auth": "^1.7.7",
+    "@sentry/cloudflare": "^11.8.0",
+    "@sentry/tanstackstart-react": "^11.8.0",
+    "@tanstack/react-router": "^1.170.44",
+    "@tanstack/react-start": "^1.169.2",
+    "better-auth": "^1.7.10",
     "browserslist": "^4.29.3",
-    "drizzle-orm": "^0.45.3",
+    "drizzle-orm": "^0.45.4",
     "pg": "^8.23.1",
-    "posthog-js": "^1.435.6",
-    "posthog-node": "^5.55.0",
-    "react": "^19.3.0",
-    "resend": "^6.31.0",
+    "posthog-js": "^1.438.12",
+    "posthog-node": "^5.56.1",
+    "react": "^19.3.1",
+    "resend": "^6.33.0",
     "stripe": "^22.6.2"
   },
   "peerDependenciesMeta": {
@@ -202,6 +206,8 @@
     "lint": "oxlint . --quiet",
     "lint:fix": "oxlint . --fix --quiet",
     "test": "vitest run",
+    "test:live": "TEST_LIVE=1 vitest run --tags-filter=live",
+    "test:coverage": "vitest run --coverage.enabled",
     "cf-typegen": "wrangler types tests/infrastructure/cloudflare/worker-configuration.d.ts --config tests/infrastructure/cloudflare/wrangler.jsonc --include-runtime=false",
     "db:generate:d1": "drizzle-kit generate --config drizzle.d1.config.ts",
     "db:generate:postgres": "drizzle-kit generate --config drizzle.postgres.config.ts"

package/src/infrastructure/better-auth/apple-client-secret.ts

@@ -5,7 +5,7 @@ import { AppError, createLogger } from '@/core'
 
 const logger = createLogger('auth')
 // Typist reports an invalid key once per isolate because session checks repeatedly construct auth options.
-let appleKeyFailureLogged = false
+const loggedInvalidKeyIds = new Set<string>()
 /**
  * Apple caps `exp` at 15,777,000 seconds after `iat`; 180 days stays under it. Source:
  * https://developer.apple.com/documentation/accountorganizationaldatasharing/creating-a-client-secret
@@ -46,7 +46,7 @@ function base64UrlJson(segment: JwsSegment): string {
 /**
  * Sign Apple's six-month client secret synchronously, so Better Auth options can be built without awaiting it.
  * Signing uses `node:crypto` as Typist does, so the Worker needs the `nodejs_compat` flag.
- * Invalid private keys return an empty secret and log once per isolate, as in Typist.
+ * Invalid private keys return an empty secret and log once per key ID in each isolate, as in Typist.
  */
 export function generateAppleClientSecret(config: AppleKeyConfig): string {
   const key = config.applePrivateKey.replace(/\\n/g, '\n')
@@ -54,8 +54,8 @@ export function generateAppleClientSecret(config: AppleKeyConfig): string {
   try {
     createPrivateKey(key)
   } catch (error) {
-    if (!appleKeyFailureLogged) {
-      appleKeyFailureLogged = true
+    if (!loggedInvalidKeyIds.has(config.appleKeyId)) {
+      loggedInvalidKeyIds.add(config.appleKeyId)
       logger.error('apple_private_key_invalid', { error, keyId: config.appleKeyId })
     }
     return ''