better-ship 0.4.0 → 0.5.0

package/dist/{application-BpSwCKJ5.js → application-DEerezCl.js}

@@ -1,4 +1,4 @@
-import { a as createLogger, f as unreachable, m as AppError, p as DatabaseError } from "./core-D3G-2gIx.js";
+import { A as AppError, a as createLogger, f as unreachable, p as DatabaseError } from "./core-CnwWj4MY.js";
 import { panic } from "better-result";
 
 //#region src/application/message-already-processed.error.ts
@@ -128,4 +128,4 @@ var UnitOfWorkAlreadyActiveError = class extends AppError {
 
 //#endregion
 export { MessageAlreadyProcessedError as i, UnitOfWork as n, MessageBus as r, UnitOfWorkAlreadyActiveError as t };
-//# sourceMappingURL=application-BpSwCKJ5.js.map
+//# sourceMappingURL=application-DEerezCl.js.map

package/dist/{application-BpSwCKJ5.js.map → application-DEerezCl.js.map}

@@ -1 +1 @@
-{"version":3,"file":"application-BpSwCKJ5.js","names":[],"sources":["../src/application/message-already-processed.error.ts","../src/application/message-bus.ts","../src/application/unit-of-work.ts","../src/application/unit-of-work.errors.ts"],"sourcesContent":["import { AppError, DatabaseError } from '@/core'\n\nimport type { MessageId } from './messages.ts'\n\n/** The message's effects already committed. A caller can skip duplicate delivery without repeating those effects. */\nexport class MessageAlreadyProcessedError extends AppError {\n  readonly _tag = 'MessageAlreadyProcessedError'\n  readonly classification = 'terminal'\n\n  constructor(\n    readonly messageId: MessageId,\n    options?: { readonly cause: unknown },\n  ) {\n    super(`message ${messageId} already processed`, options)\n  }\n\n  /** Recognize only the processed-message primary key; preserve other failures unchanged at the call site. */\n  static from(cause: unknown, messageId: MessageId): MessageAlreadyProcessedError | undefined {\n    if (cause instanceof MessageAlreadyProcessedError) return cause\n    if (!(cause instanceof DatabaseError)) return undefined\n    const details = cause.details\n    const duplicate =\n      details.database === 'd1'\n        ? details.kind === 'unique' &&\n          details.table === 'processed_messages' &&\n          details.column === 'message_id'\n        : details.code === '23505' &&\n          details.table_name === 'processed_messages' &&\n          details.constraint_name === 'processed_messages_pkey'\n    if (!duplicate) return undefined\n    return new MessageAlreadyProcessedError(messageId, { cause })\n  }\n}\n","import { panic } from 'better-result'\n\nimport { createLogger, unreachable } from '@/core'\n\nimport { MessageAlreadyProcessedError } from './message-already-processed.error.ts'\nimport type { Command, Event, Message, Query } from './messages.ts'\nimport type { Handlers, MessageResult, RegistryMessage } from './registry.ts'\n\nconst logger = createLogger('message-bus')\n\n/** The port an entrypoint dispatches through. `AppDeps` names this as `IMessageBus<typeof registry>`. */\nexport interface IMessageBus<TRegistry extends Handlers<never>> {\n  handle<TMessage extends Message & RegistryMessage<TRegistry>>(\n    message: TMessage,\n  ): Promise<MessageResult<TMessage, TRegistry>>\n}\n\n/**\n * Routes one message to its slot. The bus opens no transaction and keeps no outbox:\n * a handler that writes opens the unit of work itself.\n */\nexport class MessageBus<Deps, TRegistry extends Handlers<Deps>> implements IMessageBus<TRegistry> {\n  constructor(\n    private readonly deps: Deps,\n    private readonly registry: TRegistry,\n  ) {}\n\n  /** Resolves to the handler's own value for a command or query, and to void for an event. */\n  async handle<TMessage extends Message & RegistryMessage<TRegistry>>(\n    message: TMessage,\n  ): Promise<MessageResult<TMessage, TRegistry>> {\n    // SAFETY: the slot for this name is what `MessageResult` names, and dispatch returns its value.\n    return (await this.dispatch(message)) as MessageResult<TMessage, TRegistry>\n  }\n\n  // oxlint-disable-next-line anti-slop/no-unknown-returns -- one table holds every slot's value; `handle` names it.\n  private dispatch(message: Message): Promise<unknown> {\n    if (message.type === 'command') return this.handleCommand(message)\n    if (message.type === 'query') return this.handleQuery(message)\n    if (message.type === 'event') return this.handleEvent(message)\n    // A message parsed at a boundary cannot reach here; one that does must not resolve silently.\n    return unreachable(message)\n  }\n\n  // oxlint-disable-next-line anti-slop/no-unknown-returns -- see dispatch.\n  private handleCommand(command: Command): Promise<unknown> {\n    // `satisfies` proved the registry complete, so a missing slot is a broken registry object.\n    const handler = this.registry.commands[command.name]\n    if (handler === undefined) return panic(`No handler for command ${command.name}`)\n    logger.debug('handling_command', { name: command.name, id: command.id })\n    return handler(command, this.deps)\n  }\n\n  // oxlint-disable-next-line anti-slop/no-unknown-returns -- see dispatch.\n  private handleQuery(query: Query): Promise<unknown> {\n    const handler = this.registry.queries[query.name]\n    if (handler === undefined) return panic(`No handler for query ${query.name}`)\n    return handler(query, this.deps)\n  }\n\n  /**\n   * Every subscriber runs to completion. One failure is rethrown as is. Several are thrown as\n   * one `AggregateError`. A `MessageAlreadyProcessedError` means that subscriber already committed on\n   * an earlier delivery, so it counts as delivered.\n   */\n  private async handleEvent(event: Event): Promise<void> {\n    const subscriptions = this.registry.events[event.name] ?? []\n    const outcomes = await Promise.allSettled(\n      subscriptions.map((subscription) => subscription(event, this.deps)),\n    )\n    const failures: unknown[] = []\n    for (const [subscriber, outcome] of outcomes.entries()) {\n      if (outcome.status === 'fulfilled') continue\n      if (outcome.reason instanceof MessageAlreadyProcessedError) {\n        // The bus swallows this error, so this line is the only record that the skip happened.\n        logger.info('duplicate_subscriber_ignored', { event: event.name, id: event.id, subscriber })\n        continue\n      }\n      failures.push(outcome.reason)\n    }\n    if (failures.length === 1) throw failures[0]\n    if (failures.length > 1) {\n      throw new AggregateError(failures, `${event.name}: ${failures.length} subscribers failed`)\n    }\n  }\n}\n","import type { IEventCollector } from './event-collector.ts'\nimport { MessageAlreadyProcessedError } from './message-already-processed.error.ts'\nimport type { IMessageStore } from './message-store.ts'\nimport type { MessageId } from './messages.ts'\nimport type { IOutboxRelay } from './outbox-relay.ts'\nimport type { ITransaction } from './transaction.ts'\n\n/**\n * Commits the processed-message record, repository writes, and emitted events together before resolving.\n * An existing record rejects with `MessageAlreadyProcessedError`; external effects must run through the outbox after commit.\n * Nested calls reject with `UnitOfWorkAlreadyActiveError`; independent concurrent calls are allowed.\n */\nexport interface IUnitOfWork<Repos> {\n  run<T>(messageId: MessageId, work: (repos: Repos) => Promise<T>): Promise<T>\n}\n\nexport type UnitOfWorkDeps<Tx, Repos> = {\n  readonly transaction: ITransaction<Tx>\n  /** The processed-messages and outbox repository for this transaction. */\n  readonly messageStore: (tx: Tx) => IMessageStore\n  /** Repositories participate in the current transaction. */\n  readonly createRepositories: (tx: Tx) => Repos\n  readonly eventCollector: IEventCollector\n  readonly relay: IOutboxRelay\n}\n\n/** The unit of work: the boundary, the repositories, the events. Every database call is a port. */\nexport class UnitOfWork<Tx, Repos> implements IUnitOfWork<Repos> {\n  constructor(private readonly deps: UnitOfWorkDeps<Tx, Repos>) {}\n\n  async run<T>(messageId: MessageId, work: (repos: Repos) => Promise<T>): Promise<T> {\n    const { transaction, messageStore, createRepositories, eventCollector, relay } = this.deps\n    let written = 0\n\n    let value: T\n    try {\n      value = await transaction.transaction(async (tx) => {\n        const store = messageStore(tx)\n        await store.claim(messageId)\n        const repos = createRepositories(tx)\n        const result = await work(repos)\n        const pending = eventCollector.collect()\n        await store.persistEvents(pending)\n        written = pending.length\n        return result\n      })\n    } catch (error) {\n      throw MessageAlreadyProcessedError.from(error, messageId) ?? error\n    }\n\n    if (written > 0) relay.wake()\n    return value\n  }\n}\n","import { AppError } from '@/core'\n\n/** A boundary was opened inside another. One message, one atomic scope. */\nexport class UnitOfWorkAlreadyActiveError extends AppError {\n  readonly _tag = 'UnitOfWorkAlreadyActiveError'\n  readonly classification = 'terminal'\n\n  constructor() {\n    super('a unit of work is already active')\n  }\n}\n"],"mappings":";;;;;AAKA,IAAa,+BAAb,MAAa,qCAAqC,SAAS;CAK9C;CAJX,AAAS,OAAO;CAChB,AAAS,iBAAiB;CAE1B,YACE,AAAS,WACT,SACA;EACA,MAAM,WAAW,UAAU,qBAAqB,OAAO;EAH9C;CAIX;;CAGA,OAAO,KAAK,OAAgB,WAAgE;EAC1F,IAAI,iBAAiB,8BAA8B,OAAO;EAC1D,IAAI,EAAE,iBAAiB,gBAAgB,OAAO;EAC9C,MAAM,UAAU,MAAM;EAStB,IAAI,EAPF,QAAQ,aAAa,OACjB,QAAQ,SAAS,YACjB,QAAQ,UAAU,wBAClB,QAAQ,WAAW,eACnB,QAAQ,SAAS,WACjB,QAAQ,eAAe,wBACvB,QAAQ,oBAAoB,4BAClB,OAAO;EACvB,OAAO,IAAI,6BAA6B,WAAW,EAAE,MAAM,CAAC;CAC9D;AACF;;;;ACxBA,MAAM,SAAS,aAAa,aAAa;;;;;AAazC,IAAa,aAAb,MAAkG;CAE7E;CACA;CAFnB,YACE,AAAiB,MACjB,AAAiB,UACjB;EAFiB;EACA;CAChB;;CAGH,MAAM,OACJ,SAC6C;EAE7C,OAAQ,MAAM,KAAK,SAAS,OAAO;CACrC;CAGA,AAAQ,SAAS,SAAoC;EACnD,IAAI,QAAQ,SAAS,WAAW,OAAO,KAAK,cAAc,OAAO;EACjE,IAAI,QAAQ,SAAS,SAAS,OAAO,KAAK,YAAY,OAAO;EAC7D,IAAI,QAAQ,SAAS,SAAS,OAAO,KAAK,YAAY,OAAO;EAE7D,OAAO,YAAY,OAAO;CAC5B;CAGA,AAAQ,cAAc,SAAoC;EAExD,MAAM,UAAU,KAAK,SAAS,SAAS,QAAQ;EAC/C,IAAI,YAAY,QAAW,OAAO,MAAM,0BAA0B,QAAQ,MAAM;EAChF,OAAO,MAAM,oBAAoB;GAAE,MAAM,QAAQ;GAAM,IAAI,QAAQ;EAAG,CAAC;EACvE,OAAO,QAAQ,SAAS,KAAK,IAAI;CACnC;CAGA,AAAQ,YAAY,OAAgC;EAClD,MAAM,UAAU,KAAK,SAAS,QAAQ,MAAM;EAC5C,IAAI,YAAY,QAAW,OAAO,MAAM,wBAAwB,MAAM,MAAM;EAC5E,OAAO,QAAQ,OAAO,KAAK,IAAI;CACjC;;;;;;CAOA,MAAc,YAAY,OAA6B;EACrD,MAAM,gBAAgB,KAAK,SAAS,OAAO,MAAM,SAAS,CAAC;EAC3D,MAAM,WAAW,MAAM,QAAQ,WAC7B,cAAc,KAAK,iBAAiB,aAAa,OAAO,KAAK,IAAI,CAAC,CACpE;EACA,MAAM,WAAsB,CAAC;EAC7B,KAAK,MAAM,CAAC,YAAY,YAAY,SAAS,QAAQ,GAAG;GACtD,IAAI,QAAQ,WAAW,aAAa;GACpC,IAAI,QAAQ,kBAAkB,8BAA8B;IAE1D,OAAO,KAAK,gCAAgC;KAAE,OAAO,MAAM;KAAM,IAAI,MAAM;KAAI;IAAW,CAAC;IAC3F;GACF;GACA,SAAS,KAAK,QAAQ,MAAM;EAC9B;EACA,IAAI,SAAS,WAAW,GAAG,MAAM,SAAS;EAC1C,IAAI,SAAS,SAAS,GACpB,MAAM,IAAI,eAAe,UAAU,GAAG,MAAM,KAAK,IAAI,SAAS,OAAO,oBAAoB;CAE7F;AACF;;;;;AC1DA,IAAa,aAAb,MAAiE;CAClC;CAA7B,YAAY,AAAiB,MAAiC;EAAjC;CAAkC;CAE/D,MAAM,IAAO,WAAsB,MAAgD;EACjF,MAAM,EAAE,aAAa,cAAc,oBAAoB,gBAAgB,UAAU,KAAK;EACtF,IAAI,UAAU;EAEd,IAAI;EACJ,IAAI;GACF,QAAQ,MAAM,YAAY,YAAY,OAAO,OAAO;IAClD,MAAM,QAAQ,aAAa,EAAE;IAC7B,MAAM,MAAM,MAAM,SAAS;IAE3B,MAAM,SAAS,MAAM,KADP,mBAAmB,EACH,CAAC;IAC/B,MAAM,UAAU,eAAe,QAAQ;IACvC,MAAM,MAAM,cAAc,OAAO;IACjC,UAAU,QAAQ;IAClB,OAAO;GACT,CAAC;EACH,SAAS,OAAO;GACd,MAAM,6BAA6B,KAAK,OAAO,SAAS,KAAK;EAC/D;EAEA,IAAI,UAAU,GAAG,MAAM,KAAK;EAC5B,OAAO;CACT;AACF;;;;;AClDA,IAAa,+BAAb,cAAkD,SAAS;CACzD,AAAS,OAAO;CAChB,AAAS,iBAAiB;CAE1B,cAAc;EACZ,MAAM,kCAAkC;CAC1C;AACF"}
+{"version":3,"file":"application-DEerezCl.js","names":[],"sources":["../src/application/message-already-processed.error.ts","../src/application/message-bus.ts","../src/application/unit-of-work.ts","../src/application/unit-of-work.errors.ts"],"sourcesContent":["import { AppError, DatabaseError } from '@/core'\n\nimport type { MessageId } from './messages.ts'\n\n/** The message's effects already committed. A caller can skip duplicate delivery without repeating those effects. */\nexport class MessageAlreadyProcessedError extends AppError {\n  readonly _tag = 'MessageAlreadyProcessedError'\n  readonly classification = 'terminal'\n\n  constructor(\n    readonly messageId: MessageId,\n    options?: { readonly cause: unknown },\n  ) {\n    super(`message ${messageId} already processed`, options)\n  }\n\n  /** Recognize only the processed-message primary key; preserve other failures unchanged at the call site. */\n  static from(cause: unknown, messageId: MessageId): MessageAlreadyProcessedError | undefined {\n    if (cause instanceof MessageAlreadyProcessedError) return cause\n    if (!(cause instanceof DatabaseError)) return undefined\n    const details = cause.details\n    const duplicate =\n      details.database === 'd1'\n        ? details.kind === 'unique' &&\n          details.table === 'processed_messages' &&\n          details.column === 'message_id'\n        : details.code === '23505' &&\n          details.table_name === 'processed_messages' &&\n          details.constraint_name === 'processed_messages_pkey'\n    if (!duplicate) return undefined\n    return new MessageAlreadyProcessedError(messageId, { cause })\n  }\n}\n","import { panic } from 'better-result'\n\nimport { createLogger, unreachable } from '@/core'\n\nimport { MessageAlreadyProcessedError } from './message-already-processed.error.ts'\nimport type { Command, Event, Message, Query } from './messages.ts'\nimport type { Handlers, MessageResult, RegistryMessage } from './registry.ts'\n\nconst logger = createLogger('message-bus')\n\n/** The port an entrypoint dispatches through. `AppDeps` names this as `IMessageBus<typeof registry>`. */\nexport interface IMessageBus<TRegistry extends Handlers<never>> {\n  handle<TMessage extends Message & RegistryMessage<TRegistry>>(\n    message: TMessage,\n  ): Promise<MessageResult<TMessage, TRegistry>>\n}\n\n/**\n * Routes one message to its slot. The bus opens no transaction and keeps no outbox:\n * a handler that writes opens the unit of work itself.\n */\nexport class MessageBus<Deps, TRegistry extends Handlers<Deps>> implements IMessageBus<TRegistry> {\n  constructor(\n    private readonly deps: Deps,\n    private readonly registry: TRegistry,\n  ) {}\n\n  /** Resolves to the handler's own value for a command or query, and to void for an event. */\n  async handle<TMessage extends Message & RegistryMessage<TRegistry>>(\n    message: TMessage,\n  ): Promise<MessageResult<TMessage, TRegistry>> {\n    // SAFETY: the slot for this name is what `MessageResult` names, and dispatch returns its value.\n    return (await this.dispatch(message)) as MessageResult<TMessage, TRegistry>\n  }\n\n  // oxlint-disable-next-line anti-slop/no-unknown-returns -- one table holds every slot's value; `handle` names it.\n  private dispatch(message: Message): Promise<unknown> {\n    if (message.type === 'command') return this.handleCommand(message)\n    if (message.type === 'query') return this.handleQuery(message)\n    if (message.type === 'event') return this.handleEvent(message)\n    // A message parsed at a boundary cannot reach here; one that does must not resolve silently.\n    return unreachable(message)\n  }\n\n  // oxlint-disable-next-line anti-slop/no-unknown-returns -- see dispatch.\n  private handleCommand(command: Command): Promise<unknown> {\n    // `satisfies` proved the registry complete, so a missing slot is a broken registry object.\n    const handler = this.registry.commands[command.name]\n    if (handler === undefined) return panic(`No handler for command ${command.name}`)\n    logger.debug('handling_command', { name: command.name, id: command.id })\n    return handler(command, this.deps)\n  }\n\n  // oxlint-disable-next-line anti-slop/no-unknown-returns -- see dispatch.\n  private handleQuery(query: Query): Promise<unknown> {\n    const handler = this.registry.queries[query.name]\n    if (handler === undefined) return panic(`No handler for query ${query.name}`)\n    return handler(query, this.deps)\n  }\n\n  /**\n   * Every subscriber runs to completion. One failure is rethrown as is. Several are thrown as\n   * one `AggregateError`. A `MessageAlreadyProcessedError` means that subscriber already committed on\n   * an earlier delivery, so it counts as delivered.\n   */\n  private async handleEvent(event: Event): Promise<void> {\n    const subscriptions = this.registry.events[event.name] ?? []\n    const outcomes = await Promise.allSettled(\n      subscriptions.map((subscription) => subscription(event, this.deps)),\n    )\n    const failures: unknown[] = []\n    for (const [subscriber, outcome] of outcomes.entries()) {\n      if (outcome.status === 'fulfilled') continue\n      if (outcome.reason instanceof MessageAlreadyProcessedError) {\n        // The bus swallows this error, so this line is the only record that the skip happened.\n        logger.info('duplicate_subscriber_ignored', { event: event.name, id: event.id, subscriber })\n        continue\n      }\n      failures.push(outcome.reason)\n    }\n    if (failures.length === 1) throw failures[0]\n    if (failures.length > 1) {\n      throw new AggregateError(failures, `${event.name}: ${failures.length} subscribers failed`)\n    }\n  }\n}\n","import type { IEventCollector } from './event-collector.ts'\nimport { MessageAlreadyProcessedError } from './message-already-processed.error.ts'\nimport type { IMessageStore } from './message-store.ts'\nimport type { MessageId } from './messages.ts'\nimport type { IOutboxRelay } from './outbox-relay.ts'\nimport type { ITransaction } from './transaction.ts'\n\n/**\n * Commits the processed-message record, repository writes, and emitted events together before resolving.\n * An existing record rejects with `MessageAlreadyProcessedError`; external effects must run through the outbox after commit.\n * Nested calls reject with `UnitOfWorkAlreadyActiveError`; independent concurrent calls are allowed.\n */\nexport interface IUnitOfWork<Repos> {\n  run<T>(messageId: MessageId, work: (repos: Repos) => Promise<T>): Promise<T>\n}\n\nexport type UnitOfWorkDeps<Tx, Repos> = {\n  readonly transaction: ITransaction<Tx>\n  /** The processed-messages and outbox repository for this transaction. */\n  readonly messageStore: (tx: Tx) => IMessageStore\n  /** Repositories participate in the current transaction. */\n  readonly createRepositories: (tx: Tx) => Repos\n  readonly eventCollector: IEventCollector\n  readonly relay: IOutboxRelay\n}\n\n/** The unit of work: the boundary, the repositories, the events. Every database call is a port. */\nexport class UnitOfWork<Tx, Repos> implements IUnitOfWork<Repos> {\n  constructor(private readonly deps: UnitOfWorkDeps<Tx, Repos>) {}\n\n  async run<T>(messageId: MessageId, work: (repos: Repos) => Promise<T>): Promise<T> {\n    const { transaction, messageStore, createRepositories, eventCollector, relay } = this.deps\n    let written = 0\n\n    let value: T\n    try {\n      value = await transaction.transaction(async (tx) => {\n        const store = messageStore(tx)\n        await store.claim(messageId)\n        const repos = createRepositories(tx)\n        const result = await work(repos)\n        const pending = eventCollector.collect()\n        await store.persistEvents(pending)\n        written = pending.length\n        return result\n      })\n    } catch (error) {\n      throw MessageAlreadyProcessedError.from(error, messageId) ?? error\n    }\n\n    if (written > 0) relay.wake()\n    return value\n  }\n}\n","import { AppError } from '@/core'\n\n/** A boundary was opened inside another. One message, one atomic scope. */\nexport class UnitOfWorkAlreadyActiveError extends AppError {\n  readonly _tag = 'UnitOfWorkAlreadyActiveError'\n  readonly classification = 'terminal'\n\n  constructor() {\n    super('a unit of work is already active')\n  }\n}\n"],"mappings":";;;;;AAKA,IAAa,+BAAb,MAAa,qCAAqC,SAAS;CAK9C;CAJX,AAAS,OAAO;CAChB,AAAS,iBAAiB;CAE1B,YACE,AAAS,WACT,SACA;EACA,MAAM,WAAW,UAAU,qBAAqB,OAAO;EAH9C;CAIX;;CAGA,OAAO,KAAK,OAAgB,WAAgE;EAC1F,IAAI,iBAAiB,8BAA8B,OAAO;EAC1D,IAAI,EAAE,iBAAiB,gBAAgB,OAAO;EAC9C,MAAM,UAAU,MAAM;EAStB,IAAI,EAPF,QAAQ,aAAa,OACjB,QAAQ,SAAS,YACjB,QAAQ,UAAU,wBAClB,QAAQ,WAAW,eACnB,QAAQ,SAAS,WACjB,QAAQ,eAAe,wBACvB,QAAQ,oBAAoB,4BAClB,OAAO;EACvB,OAAO,IAAI,6BAA6B,WAAW,EAAE,MAAM,CAAC;CAC9D;AACF;;;;ACxBA,MAAM,SAAS,aAAa,aAAa;;;;;AAazC,IAAa,aAAb,MAAkG;CAE7E;CACA;CAFnB,YACE,AAAiB,MACjB,AAAiB,UACjB;EAFiB;EACA;CAChB;;CAGH,MAAM,OACJ,SAC6C;EAE7C,OAAQ,MAAM,KAAK,SAAS,OAAO;CACrC;CAGA,AAAQ,SAAS,SAAoC;EACnD,IAAI,QAAQ,SAAS,WAAW,OAAO,KAAK,cAAc,OAAO;EACjE,IAAI,QAAQ,SAAS,SAAS,OAAO,KAAK,YAAY,OAAO;EAC7D,IAAI,QAAQ,SAAS,SAAS,OAAO,KAAK,YAAY,OAAO;EAE7D,OAAO,YAAY,OAAO;CAC5B;CAGA,AAAQ,cAAc,SAAoC;EAExD,MAAM,UAAU,KAAK,SAAS,SAAS,QAAQ;EAC/C,IAAI,YAAY,QAAW,OAAO,MAAM,0BAA0B,QAAQ,MAAM;EAChF,OAAO,MAAM,oBAAoB;GAAE,MAAM,QAAQ;GAAM,IAAI,QAAQ;EAAG,CAAC;EACvE,OAAO,QAAQ,SAAS,KAAK,IAAI;CACnC;CAGA,AAAQ,YAAY,OAAgC;EAClD,MAAM,UAAU,KAAK,SAAS,QAAQ,MAAM;EAC5C,IAAI,YAAY,QAAW,OAAO,MAAM,wBAAwB,MAAM,MAAM;EAC5E,OAAO,QAAQ,OAAO,KAAK,IAAI;CACjC;;;;;;CAOA,MAAc,YAAY,OAA6B;EACrD,MAAM,gBAAgB,KAAK,SAAS,OAAO,MAAM,SAAS,CAAC;EAC3D,MAAM,WAAW,MAAM,QAAQ,WAC7B,cAAc,KAAK,iBAAiB,aAAa,OAAO,KAAK,IAAI,CAAC,CACpE;EACA,MAAM,WAAsB,CAAC;EAC7B,KAAK,MAAM,CAAC,YAAY,YAAY,SAAS,QAAQ,GAAG;GACtD,IAAI,QAAQ,WAAW,aAAa;GACpC,IAAI,QAAQ,kBAAkB,8BAA8B;IAE1D,OAAO,KAAK,gCAAgC;KAAE,OAAO,MAAM;KAAM,IAAI,MAAM;KAAI;IAAW,CAAC;IAC3F;GACF;GACA,SAAS,KAAK,QAAQ,MAAM;EAC9B;EACA,IAAI,SAAS,WAAW,GAAG,MAAM,SAAS;EAC1C,IAAI,SAAS,SAAS,GACpB,MAAM,IAAI,eAAe,UAAU,GAAG,MAAM,KAAK,IAAI,SAAS,OAAO,oBAAoB;CAE7F;AACF;;;;;AC1DA,IAAa,aAAb,MAAiE;CAClC;CAA7B,YAAY,AAAiB,MAAiC;EAAjC;CAAkC;CAE/D,MAAM,IAAO,WAAsB,MAAgD;EACjF,MAAM,EAAE,aAAa,cAAc,oBAAoB,gBAAgB,UAAU,KAAK;EACtF,IAAI,UAAU;EAEd,IAAI;EACJ,IAAI;GACF,QAAQ,MAAM,YAAY,YAAY,OAAO,OAAO;IAClD,MAAM,QAAQ,aAAa,EAAE;IAC7B,MAAM,MAAM,MAAM,SAAS;IAE3B,MAAM,SAAS,MAAM,KADP,mBAAmB,EACH,CAAC;IAC/B,MAAM,UAAU,eAAe,QAAQ;IACvC,MAAM,MAAM,cAAc,OAAO;IACjC,UAAU,QAAQ;IAClB,OAAO;GACT,CAAC;EACH,SAAS,OAAO;GACd,MAAM,6BAA6B,KAAK,OAAO,SAAS,KAAK;EAC/D;EAEA,IAAI,UAAU,GAAG,MAAM,KAAK;EAC5B,OAAO;CACT;AACF;;;;;AClDA,IAAa,+BAAb,cAAkD,SAAS;CACzD,AAAS,OAAO;CAChB,AAAS,iBAAiB;CAE1B,cAAc;EACZ,MAAM,kCAAkC;CAC1C;AACF"}

package/dist/application.d.ts

@@ -1,2 +1,2 @@
-import { C as Event, E as Query, S as Command, T as MessageId, _ as RegistryMessage, a as UnitOfWorkDeps, b as EventHandler, c as IOutboxRelay, d as CommandRegistry, f as EventRegistry, g as QueryRegistry, h as MessageResult, i as UnitOfWork, l as IMessageBus, m as MessageRegistry, n as MessageAlreadyProcessedError, o as IEventCollector, p as Handlers, r as IUnitOfWork, s as ITransaction, t as UnitOfWorkAlreadyActiveError, u as MessageBus, v as IMessageStore, w as Message, x as QueryHandler, y as CommandHandler } from "./index-CkaFqbbV.js";
+import { C as Event, E as Query, S as Command, T as MessageId, _ as RegistryMessage, a as UnitOfWorkDeps, b as EventHandler, c as IOutboxRelay, d as CommandRegistry, f as EventRegistry, g as QueryRegistry, h as MessageResult, i as UnitOfWork, l as IMessageBus, m as MessageRegistry, n as MessageAlreadyProcessedError, o as IEventCollector, p as Handlers, r as IUnitOfWork, s as ITransaction, t as UnitOfWorkAlreadyActiveError, u as MessageBus, v as IMessageStore, w as Message, x as QueryHandler, y as CommandHandler } from "./index-Bdyh3_xC.js";
 export { type Command, type CommandHandler, type CommandRegistry, type Event, type EventHandler, type EventRegistry, type Handlers, type IEventCollector, type IMessageBus, type IMessageStore, type IOutboxRelay, type ITransaction, type IUnitOfWork, type Message, MessageAlreadyProcessedError, MessageBus, type MessageId, type MessageRegistry, type MessageResult, type Query, type QueryHandler, type QueryRegistry, type RegistryMessage, UnitOfWork, UnitOfWorkAlreadyActiveError, type UnitOfWorkDeps };

package/dist/application.js

@@ -1,3 +1,3 @@
-import { i as MessageAlreadyProcessedError, n as UnitOfWork, r as MessageBus, t as UnitOfWorkAlreadyActiveError } from "./application-BpSwCKJ5.js";
+import { i as MessageAlreadyProcessedError, n as UnitOfWork, r as MessageBus, t as UnitOfWorkAlreadyActiveError } from "./application-DEerezCl.js";
 
 export { MessageAlreadyProcessedError, MessageBus, UnitOfWork, UnitOfWorkAlreadyActiveError };

package/dist/better-auth/apple-client-secret.d.ts

@@ -0,0 +1,21 @@
+import { $ as AppError } from "../index-B9Y1hVh6.js";
+//#region src/infrastructure/better-auth/apple-client-secret.d.ts
+/** Apple sends its OAuth callback from this origin. Include it in trustedOrigins when enabling Apple. */
+export declare const APPLE_ORIGIN = "https://appleid.apple.com";
+/** Apple credentials used to sign a client secret. Ported from Porte's apple-client-secret.ts. */
+export type AppleKeyConfig = {
+  readonly appleClientId: string;
+  readonly appleTeamId: string;
+  readonly appleKeyId: string;
+  readonly applePrivateKey: string;
+};
+/** Apple signing failed. The application's error boundary owns reporting. */
+export declare class AppleClientSecretError extends AppError {
+  readonly _tag = "AppleClientSecretError";
+  readonly classification = "terminal";
+  constructor(cause: unknown);
+}
+/** Sign Apple's six-month client secret. Invalid private keys return an empty secret and log once per isolate, as in Typist. */
+export declare function generateAppleClientSecret(config: AppleKeyConfig): Promise<string>;
+//#endregion
+//# sourceMappingURL=apple-client-secret.d.ts.map

package/dist/better-auth/apple-client-secret.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apple-client-secret.d.ts","names":[],"sources":["../../src/infrastructure/better-auth/apple-client-secret.ts"],"mappings":";;;qBASa;;YAGD;WACD;WACA;WACA;WACA;;;qBAIE,+BAA+B;WACjC;WACA;EAET,YAAY;;;wBAMQ,0BAA0B,QAAQ,iBAAiB"}

package/dist/better-auth/apple-client-secret.js

@@ -0,0 +1,44 @@
+import { A as AppError, a as createLogger } from "../core-CnwWj4MY.js";
+import { SignJWT, importPKCS8 } from "jose";
+
+//#region src/infrastructure/better-auth/apple-client-secret.ts
+const logger = createLogger("auth");
+let appleKeyFailureLogged = false;
+/** Apple sends its OAuth callback from this origin. Include it in trustedOrigins when enabling Apple. */
+const APPLE_ORIGIN = "https://appleid.apple.com";
+/** Apple signing failed. The application's error boundary owns reporting. */
+var AppleClientSecretError = class extends AppError {
+	_tag = "AppleClientSecretError";
+	classification = "terminal";
+	constructor(cause) {
+		super("Apple client secret signing failed", { cause });
+	}
+};
+/** Sign Apple's six-month client secret. Invalid private keys return an empty secret and log once per isolate, as in Typist. */
+async function generateAppleClientSecret(config) {
+	let key;
+	try {
+		key = await importPKCS8(config.applePrivateKey.replace(/\\n/g, "\n"), "ES256");
+	} catch (error) {
+		if (!appleKeyFailureLogged) {
+			appleKeyFailureLogged = true;
+			logger.error("apple_private_key_invalid", {
+				error,
+				details: { keyId: config.appleKeyId }
+			});
+		}
+		return "";
+	}
+	try {
+		return await new SignJWT({}).setProtectedHeader({
+			alg: "ES256",
+			kid: config.appleKeyId
+		}).setIssuer(config.appleTeamId).setSubject(config.appleClientId).setAudience(APPLE_ORIGIN).setIssuedAt().setExpirationTime("180d").sign(key);
+	} catch (cause) {
+		throw new AppleClientSecretError(cause);
+	}
+}
+
+//#endregion
+export { APPLE_ORIGIN, AppleClientSecretError, generateAppleClientSecret };
+//# sourceMappingURL=apple-client-secret.js.map

package/dist/better-auth/apple-client-secret.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apple-client-secret.js","names":[],"sources":["../../src/infrastructure/better-auth/apple-client-secret.ts"],"sourcesContent":["import { importPKCS8, SignJWT } from 'jose'\n\nimport { AppError, createLogger } from '@/core'\n\nconst logger = createLogger('auth')\n// Typist reports an invalid key once per isolate because session checks repeatedly construct auth options.\nlet appleKeyFailureLogged = false\n\n/** Apple sends its OAuth callback from this origin. Include it in trustedOrigins when enabling Apple. */\nexport const APPLE_ORIGIN = 'https://appleid.apple.com'\n\n/** Apple credentials used to sign a client secret. Ported from Porte's apple-client-secret.ts. */\nexport type AppleKeyConfig = {\n  readonly appleClientId: string\n  readonly appleTeamId: string\n  readonly appleKeyId: string\n  readonly applePrivateKey: string\n}\n\n/** Apple signing failed. The application's error boundary owns reporting. */\nexport class AppleClientSecretError extends AppError {\n  readonly _tag = 'AppleClientSecretError'\n  readonly classification = 'terminal'\n\n  constructor(cause: unknown) {\n    super('Apple client secret signing failed', { cause })\n  }\n}\n\n/** Sign Apple's six-month client secret. Invalid private keys return an empty secret and log once per isolate, as in Typist. */\nexport async function generateAppleClientSecret(config: AppleKeyConfig): Promise<string> {\n  let key: Awaited<ReturnType<typeof importPKCS8>>\n  try {\n    key = await importPKCS8(config.applePrivateKey.replace(/\\\\n/g, '\\n'), 'ES256')\n  } catch (error) {\n    if (!appleKeyFailureLogged) {\n      appleKeyFailureLogged = true\n      logger.error('apple_private_key_invalid', { error, details: { keyId: config.appleKeyId } })\n    }\n    return ''\n  }\n  try {\n    return await new SignJWT({})\n      .setProtectedHeader({ alg: 'ES256', kid: config.appleKeyId })\n      .setIssuer(config.appleTeamId)\n      .setSubject(config.appleClientId)\n      .setAudience(APPLE_ORIGIN)\n      .setIssuedAt()\n      .setExpirationTime('180d')\n      .sign(key)\n  } catch (cause) {\n    throw new AppleClientSecretError(cause)\n  }\n}\n"],"mappings":";;;;AAIA,MAAM,SAAS,aAAa,MAAM;AAElC,IAAI,wBAAwB;;AAG5B,MAAa,eAAe;;AAW5B,IAAa,yBAAb,cAA4C,SAAS;CACnD,AAAS,OAAO;CAChB,AAAS,iBAAiB;CAE1B,YAAY,OAAgB;EAC1B,MAAM,sCAAsC,EAAE,MAAM,CAAC;CACvD;AACF;;AAGA,eAAsB,0BAA0B,QAAyC;CACvF,IAAI;CACJ,IAAI;EACF,MAAM,MAAM,YAAY,OAAO,gBAAgB,QAAQ,QAAQ,IAAI,GAAG,OAAO;CAC/E,SAAS,OAAO;EACd,IAAI,CAAC,uBAAuB;GAC1B,wBAAwB;GACxB,OAAO,MAAM,6BAA6B;IAAE;IAAO,SAAS,EAAE,OAAO,OAAO,WAAW;GAAE,CAAC;EAC5F;EACA,OAAO;CACT;CACA,IAAI;EACF,OAAO,MAAM,IAAI,QAAQ,CAAC,CAAC,CAAC,CACzB,mBAAmB;GAAE,KAAK;GAAS,KAAK,OAAO;EAAW,CAAC,CAAC,CAC5D,UAAU,OAAO,WAAW,CAAC,CAC7B,WAAW,OAAO,aAAa,CAAC,CAChC,YAAY,YAAY,CAAC,CACzB,YAAY,CAAC,CACb,kBAAkB,MAAM,CAAC,CACzB,KAAK,GAAG;CACb,SAAS,OAAO;EACd,MAAM,IAAI,uBAAuB,KAAK;CACxC;AACF"}

package/dist/better-auth/auth-client.d.ts

@@ -0,0 +1,16 @@
+import { BetterAuthClientOptions } from "better-auth/client";
+//#region src/infrastructure/better-auth/auth-client.d.ts
+type AuthErrorHandler = NonNullable<NonNullable<BetterAuthClientOptions['fetchOptions']>['onError']>;
+/**
+ * Pass to native fetchOptions.onError to reject HTTP 429 with RateLimitError.
+ * Other errors remain in the native result. This handler does not schedule retries or log errors.
+ */
+export declare const handleAuthError: AuthErrorHandler;
+/** Native client for same-origin /api/auth requests. HTTP 429 rejects with RateLimitError. */
+export declare const authClient: import("better-auth/client").AuthClient<{
+  fetchOptions: {
+    onError: (context: import("better-auth/client").ErrorContext) => Promise<void> | void;
+  };
+}>;
+//#endregion
+//# sourceMappingURL=auth-client.d.ts.map

package/dist/better-auth/auth-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-client.d.ts","names":[],"sources":["../../src/infrastructure/better-auth/auth-client.ts"],"mappings":";;KAIK,mBAAmB,YAAY,YAAY;;;;;qBAMnC,iBAAiB;;qBAMjB,yCAAU;;IACL,UAAO,sCAAA,iBAAA"}

package/dist/better-auth/auth-client.js

@@ -0,0 +1,24 @@
+import { O as RateLimitError } from "../core-CnwWj4MY.js";
+import { createAuthClient } from "better-auth/client";
+
+//#region src/infrastructure/better-auth/auth-client.ts
+/**
+* Pass to native fetchOptions.onError to reject HTTP 429 with RateLimitError.
+* Other errors remain in the native result. This handler does not schedule retries or log errors.
+*/
+const handleAuthError = ({ response }) => {
+	if (response.status !== 429) return;
+	throw new RateLimitError(retryAfterSeconds(response.headers));
+};
+/** Native client for same-origin /api/auth requests. HTTP 429 rejects with RateLimitError. */
+const authClient = createAuthClient({ fetchOptions: { onError: handleAuthError } });
+function retryAfterSeconds(headers) {
+	const value = headers.get("X-Retry-After");
+	if (value === null || !/^\d+$/.test(value)) return null;
+	const seconds = Number(value);
+	return Number.isSafeInteger(seconds) ? seconds : null;
+}
+
+//#endregion
+export { authClient, handleAuthError };
+//# sourceMappingURL=auth-client.js.map

package/dist/better-auth/auth-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-client.js","names":[],"sources":["../../src/infrastructure/better-auth/auth-client.ts"],"sourcesContent":["import { createAuthClient, type BetterAuthClientOptions } from 'better-auth/client'\n\nimport { RateLimitError } from '@/core'\n\ntype AuthErrorHandler = NonNullable<NonNullable<BetterAuthClientOptions['fetchOptions']>['onError']>\n\n/**\n * Pass to native fetchOptions.onError to reject HTTP 429 with RateLimitError.\n * Other errors remain in the native result. This handler does not schedule retries or log errors.\n */\nexport const handleAuthError: AuthErrorHandler = ({ response }) => {\n  if (response.status !== 429) return\n  throw new RateLimitError(retryAfterSeconds(response.headers))\n}\n\n/** Native client for same-origin /api/auth requests. HTTP 429 rejects with RateLimitError. */\nexport const authClient = createAuthClient({\n  fetchOptions: { onError: handleAuthError },\n})\n\nfunction retryAfterSeconds(headers: Headers): number | null {\n  const value = headers.get('X-Retry-After')\n  if (value === null || !/^\\d+$/.test(value)) return null\n  const seconds = Number(value)\n  return Number.isSafeInteger(seconds) ? seconds : null\n}\n"],"mappings":";;;;;;;;AAUA,MAAa,mBAAqC,EAAE,eAAe;CACjE,IAAI,SAAS,WAAW,KAAK;CAC7B,MAAM,IAAI,eAAe,kBAAkB,SAAS,OAAO,CAAC;AAC9D;;AAGA,MAAa,aAAa,iBAAiB,EACzC,cAAc,EAAE,SAAS,gBAAgB,EAC3C,CAAC;AAED,SAAS,kBAAkB,SAAiC;CAC1D,MAAM,QAAQ,QAAQ,IAAI,eAAe;CACzC,IAAI,UAAU,QAAQ,CAAC,QAAQ,KAAK,KAAK,GAAG,OAAO;CACnD,MAAM,UAAU,OAAO,KAAK;CAC5B,OAAO,OAAO,cAAc,OAAO,IAAI,UAAU;AACnD"}

package/dist/better-auth/rate-limit.d.ts

@@ -0,0 +1,34 @@
+import { $ as AppError } from "../index-B9Y1hVh6.js";
+import { BetterAuthRateLimitStorage } from "better-auth";
+//#region src/infrastructure/better-auth/rate-limit.d.ts
+/** Each rule must match its binding's deployed limit and period. Cloudflare accepts only 10 or 60 seconds. */
+export type AuthRateLimitBinding = {
+  readonly binding: Pick<RateLimit, 'limit'>;
+  readonly window: 10 | 60;
+  readonly max: number;
+};
+/** A binding failure with no known retry classification. The cause preserves the original failure. */
+export declare class AuthRateLimitError extends AppError {
+  readonly _tag = "AuthRateLimitError";
+  readonly classification = "unknown";
+  constructor(cause: unknown);
+}
+/** No configured binding matches this Better Auth rule. Outage policy cannot bypass a configuration error. */
+export declare class UnsupportedAuthRateLimitRuleError extends AppError {
+  readonly window: number;
+  readonly max: number;
+  readonly _tag = "UnsupportedAuthRateLimitRuleError";
+  readonly classification = "terminal";
+  constructor(window: number, max: number);
+}
+/** Typist allows requests during binding outages. Select block to propagate an error instead. */
+export type AuthRateLimitOptions = {
+  readonly failureMode?: 'allow' | 'block';
+};
+/**
+ * Port Typist and Porte's binding adapters with explicit rule matching and configurable outage behavior.
+ * Bindings enforce approximate limits per Cloudflare location; retryAfter is a conservative full window.
+ */
+export declare function createAuthRateLimitStorage(bindings: readonly AuthRateLimitBinding[], { failureMode }?: AuthRateLimitOptions): BetterAuthRateLimitStorage;
+//#endregion
+//# sourceMappingURL=rate-limit.d.ts.map

package/dist/better-auth/rate-limit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.d.ts","names":[],"sources":["../../src/infrastructure/better-auth/rate-limit.ts"],"mappings":";;;;YAKY;WACD,SAAS,KAAK;WACd;WACA;;;qBAIE,2BAA2B;WAC7B;WACA;EAET,YAAY;;;qBAMD,0CAA0C;WAK1C;WACA;WALF;WACA;EAET,YACW,gBACA;;;YAOD;WACD;;;;;;wBAOK,2BACd,mBAAmB,0BACjB,gBAAyB,uBAC1B"}

package/dist/better-auth/rate-limit.js

@@ -0,0 +1,59 @@
+import { A as AppError, a as createLogger } from "../core-CnwWj4MY.js";
+
+//#region src/infrastructure/better-auth/rate-limit.ts
+/** A binding failure with no known retry classification. The cause preserves the original failure. */
+var AuthRateLimitError = class extends AppError {
+	_tag = "AuthRateLimitError";
+	classification = "unknown";
+	constructor(cause) {
+		super("Authentication rate limiter is unavailable", { cause });
+	}
+};
+/** No configured binding matches this Better Auth rule. Outage policy cannot bypass a configuration error. */
+var UnsupportedAuthRateLimitRuleError = class extends AppError {
+	window;
+	max;
+	_tag = "UnsupportedAuthRateLimitRuleError";
+	classification = "terminal";
+	constructor(window, max) {
+		super("No Cloudflare binding supports the authentication rate limit rule");
+		this.window = window;
+		this.max = max;
+	}
+};
+/**
+* Port Typist and Porte's binding adapters with explicit rule matching and configurable outage behavior.
+* Bindings enforce approximate limits per Cloudflare location; retryAfter is a conservative full window.
+*/
+function createAuthRateLimitStorage(bindings, { failureMode = "allow" } = {}) {
+	const logger = createLogger("auth-rate-limit");
+	return { async consume(key, rule) {
+		const configured = bindings.find((entry) => entry.window === rule.window && entry.max === rule.max);
+		if (configured === void 0) throw new UnsupportedAuthRateLimitRuleError(rule.window, rule.max);
+		try {
+			const { success } = await configured.binding.limit({ key });
+			return {
+				allowed: success,
+				retryAfter: success ? null : rule.window
+			};
+		} catch (cause) {
+			if (failureMode === "block") throw new AuthRateLimitError(cause);
+			logger.error("rate_limit_binding_failed", {
+				error: cause,
+				details: {
+					window: rule.window,
+					max: rule.max,
+					failureMode
+				}
+			});
+			return {
+				allowed: true,
+				retryAfter: null
+			};
+		}
+	} };
+}
+
+//#endregion
+export { AuthRateLimitError, UnsupportedAuthRateLimitRuleError, createAuthRateLimitStorage };
+//# sourceMappingURL=rate-limit.js.map

package/dist/better-auth/rate-limit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.js","names":[],"sources":["../../src/infrastructure/better-auth/rate-limit.ts"],"sourcesContent":["import type { BetterAuthRateLimitStorage } from 'better-auth'\n\nimport { AppError, createLogger } from '@/core'\n\n/** Each rule must match its binding's deployed limit and period. Cloudflare accepts only 10 or 60 seconds. */\nexport type AuthRateLimitBinding = {\n  readonly binding: Pick<RateLimit, 'limit'>\n  readonly window: 10 | 60\n  readonly max: number\n}\n\n/** A binding failure with no known retry classification. The cause preserves the original failure. */\nexport class AuthRateLimitError extends AppError {\n  readonly _tag = 'AuthRateLimitError'\n  readonly classification = 'unknown'\n\n  constructor(cause: unknown) {\n    super('Authentication rate limiter is unavailable', { cause })\n  }\n}\n\n/** No configured binding matches this Better Auth rule. Outage policy cannot bypass a configuration error. */\nexport class UnsupportedAuthRateLimitRuleError extends AppError {\n  readonly _tag = 'UnsupportedAuthRateLimitRuleError'\n  readonly classification = 'terminal'\n\n  constructor(\n    readonly window: number,\n    readonly max: number,\n  ) {\n    super('No Cloudflare binding supports the authentication rate limit rule')\n  }\n}\n\n/** Typist allows requests during binding outages. Select block to propagate an error instead. */\nexport type AuthRateLimitOptions = {\n  readonly failureMode?: 'allow' | 'block'\n}\n\n/**\n * Port Typist and Porte's binding adapters with explicit rule matching and configurable outage behavior.\n * Bindings enforce approximate limits per Cloudflare location; retryAfter is a conservative full window.\n */\nexport function createAuthRateLimitStorage(\n  bindings: readonly AuthRateLimitBinding[],\n  { failureMode = 'allow' }: AuthRateLimitOptions = {},\n): BetterAuthRateLimitStorage {\n  const logger = createLogger('auth-rate-limit')\n  return {\n    async consume(key, rule) {\n      const configured = bindings.find(\n        (entry) => entry.window === rule.window && entry.max === rule.max,\n      )\n      if (configured === undefined)\n        throw new UnsupportedAuthRateLimitRuleError(rule.window, rule.max)\n      try {\n        const { success } = await configured.binding.limit({ key })\n        return { allowed: success, retryAfter: success ? null : rule.window }\n      } catch (cause) {\n        if (failureMode === 'block') throw new AuthRateLimitError(cause)\n        logger.error('rate_limit_binding_failed', {\n          error: cause,\n          details: { window: rule.window, max: rule.max, failureMode },\n        })\n        return { allowed: true, retryAfter: null }\n      }\n    },\n  }\n}\n"],"mappings":";;;;AAYA,IAAa,qBAAb,cAAwC,SAAS;CAC/C,AAAS,OAAO;CAChB,AAAS,iBAAiB;CAE1B,YAAY,OAAgB;EAC1B,MAAM,8CAA8C,EAAE,MAAM,CAAC;CAC/D;AACF;;AAGA,IAAa,oCAAb,cAAuD,SAAS;CAKnD;CACA;CALX,AAAS,OAAO;CAChB,AAAS,iBAAiB;CAE1B,YACE,AAAS,QACT,AAAS,KACT;EACA,MAAM,mEAAmE;EAHhE;EACA;CAGX;AACF;;;;;AAWA,SAAgB,2BACd,UACA,EAAE,cAAc,YAAkC,CAAC,GACvB;CAC5B,MAAM,SAAS,aAAa,iBAAiB;CAC7C,OAAO,EACL,MAAM,QAAQ,KAAK,MAAM;EACvB,MAAM,aAAa,SAAS,MACzB,UAAU,MAAM,WAAW,KAAK,UAAU,MAAM,QAAQ,KAAK,GAChE;EACA,IAAI,eAAe,QACjB,MAAM,IAAI,kCAAkC,KAAK,QAAQ,KAAK,GAAG;EACnE,IAAI;GACF,MAAM,EAAE,YAAY,MAAM,WAAW,QAAQ,MAAM,EAAE,IAAI,CAAC;GAC1D,OAAO;IAAE,SAAS;IAAS,YAAY,UAAU,OAAO,KAAK;GAAO;EACtE,SAAS,OAAO;GACd,IAAI,gBAAgB,SAAS,MAAM,IAAI,mBAAmB,KAAK;GAC/D,OAAO,MAAM,6BAA6B;IACxC,OAAO;IACP,SAAS;KAAE,QAAQ,KAAK;KAAQ,KAAK,KAAK;KAAK;IAAY;GAC7D,CAAC;GACD,OAAO;IAAE,SAAS;IAAM,YAAY;GAAK;EAC3C;CACF,EACF;AACF"}

package/dist/better-auth/secondary-storage.d.ts

@@ -0,0 +1,11 @@
+import { AuthSecondaryStorage } from "../cloudflare/auth-secondary-storage.js";
+import { BetterAuthOptions } from "better-auth";
+//#region src/infrastructure/better-auth/secondary-storage.d.ts
+type SecondaryStorage = NonNullable<BetterAuthOptions['secondaryStorage']>;
+/**
+ * Implement Better Auth's SecondaryStorage interface through the application's AuthSecondaryStorage binding.
+ * Operations preserve TTL and atomic semantics; failures propagate without logging or retries.
+ */
+export declare function createAuthSecondaryStorage(binding: Pick<DurableObjectNamespace<AuthSecondaryStorage>, 'getByName'>): SecondaryStorage;
+//#endregion
+//# sourceMappingURL=secondary-storage.d.ts.map

package/dist/better-auth/secondary-storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secondary-storage.d.ts","names":[],"sources":["../../src/infrastructure/better-auth/secondary-storage.ts"],"mappings":";;;KAIK,mBAAmB,YAAY;;;;;wBAMpB,2BACd,SAAS,KAAK,uBAAuB,sCACpC"}

package/dist/better-auth/secondary-storage.js

@@ -0,0 +1,18 @@
+//#region src/infrastructure/better-auth/secondary-storage.ts
+/**
+* Implement Better Auth's SecondaryStorage interface through the application's AuthSecondaryStorage binding.
+* Operations preserve TTL and atomic semantics; failures propagate without logging or retries.
+*/
+function createAuthSecondaryStorage(binding) {
+	return {
+		get: (key) => binding.getByName(key).get(),
+		set: (key, value, ttl) => binding.getByName(key).set(value, ttl),
+		delete: (key) => binding.getByName(key).delete(),
+		getAndDelete: (key) => binding.getByName(key).getAndDelete(),
+		increment: (key, ttl) => binding.getByName(key).increment(ttl)
+	};
+}
+
+//#endregion
+export { createAuthSecondaryStorage };
+//# sourceMappingURL=secondary-storage.js.map

package/dist/better-auth/secondary-storage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secondary-storage.js","names":[],"sources":["../../src/infrastructure/better-auth/secondary-storage.ts"],"sourcesContent":["import type { BetterAuthOptions } from 'better-auth'\n\nimport type { AuthSecondaryStorage } from '../cloudflare/auth-secondary-storage.ts'\n\ntype SecondaryStorage = NonNullable<BetterAuthOptions['secondaryStorage']>\n\n/**\n * Implement Better Auth's SecondaryStorage interface through the application's AuthSecondaryStorage binding.\n * Operations preserve TTL and atomic semantics; failures propagate without logging or retries.\n */\nexport function createAuthSecondaryStorage(\n  binding: Pick<DurableObjectNamespace<AuthSecondaryStorage>, 'getByName'>,\n): SecondaryStorage {\n  return {\n    get: (key) => binding.getByName(key).get(),\n    set: (key, value, ttl) => binding.getByName(key).set(value, ttl),\n    delete: (key) => binding.getByName(key).delete(),\n    getAndDelete: (key) => binding.getByName(key).getAndDelete(),\n    increment: (key, ttl) => binding.getByName(key).increment(ttl),\n  }\n}\n"],"mappings":";;;;;AAUA,SAAgB,2BACd,SACkB;CAClB,OAAO;EACL,MAAM,QAAQ,QAAQ,UAAU,GAAG,CAAC,CAAC,IAAI;EACzC,MAAM,KAAK,OAAO,QAAQ,QAAQ,UAAU,GAAG,CAAC,CAAC,IAAI,OAAO,GAAG;EAC/D,SAAS,QAAQ,QAAQ,UAAU,GAAG,CAAC,CAAC,OAAO;EAC/C,eAAe,QAAQ,QAAQ,UAAU,GAAG,CAAC,CAAC,aAAa;EAC3D,YAAY,KAAK,QAAQ,QAAQ,UAAU,GAAG,CAAC,CAAC,UAAU,GAAG;CAC/D;AACF"}

package/dist/better-auth/stripe.d.ts

@@ -0,0 +1,9 @@
+import { stripe } from "@better-auth/stripe";
+//#region src/infrastructure/better-auth/stripe.d.ts
+/**
+ * Configure the official Stripe plugin with Typist's customer creation policy.
+ * Customers are created at checkout by default. Native plans, callbacks, and overrides remain available.
+ */
+export declare function createStripePlugin<const Options extends Parameters<typeof stripe>[0]>(options: Options): ReturnType<typeof stripe<Options>>;
+//#endregion
+//# sourceMappingURL=stripe.d.ts.map

package/dist/better-auth/stripe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stripe.d.ts","names":[],"sources":["../../src/infrastructure/better-auth/stripe.ts"],"mappings":";;;;;;wBAMgB,yBAAyB,gBAAgB,kBAAkB,YACzE,SAAS,UACR,kBAAkB,OAAO"}

package/dist/better-auth/stripe.js

@@ -0,0 +1,17 @@
+import { stripe } from "@better-auth/stripe";
+
+//#region src/infrastructure/better-auth/stripe.ts
+/**
+* Configure the official Stripe plugin with Typist's customer creation policy.
+* Customers are created at checkout by default. Native plans, callbacks, and overrides remain available.
+*/
+function createStripePlugin(options) {
+	return stripe({
+		createCustomerOnSignUp: false,
+		...options
+	});
+}
+
+//#endregion
+export { createStripePlugin };
+//# sourceMappingURL=stripe.js.map

package/dist/better-auth/stripe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stripe.js","names":[],"sources":["../../src/infrastructure/better-auth/stripe.ts"],"sourcesContent":["import { stripe } from '@better-auth/stripe'\n\n/**\n * Configure the official Stripe plugin with Typist's customer creation policy.\n * Customers are created at checkout by default. Native plans, callbacks, and overrides remain available.\n */\nexport function createStripePlugin<const Options extends Parameters<typeof stripe>[0]>(\n  options: Options,\n): ReturnType<typeof stripe<Options>> {\n  return stripe({ createCustomerOnSignUp: false, ...options })\n}\n"],"mappings":";;;;;;;AAMA,SAAgB,mBACd,SACoC;CACpC,OAAO,OAAO;EAAE,wBAAwB;EAAO,GAAG;CAAQ,CAAC;AAC7D"}

package/dist/better-auth.d.ts

@@ -0,0 +1,100 @@
+import { CloudflareTurnstileOptions, LastLoginMethodOptions, anonymous, bearer, captcha, deviceAuthorization, lastLoginMethod, magicLink, openAPI } from "better-auth/plugins";
+import { BetterAuthOptions, BetterAuthPlugin, BetterAuthRateLimitStorage, DBAdapterInstance } from "better-auth";
+//#region src/infrastructure/better-auth/options.d.ts
+/**
+ * Shared policy from Porte and Typist. The factory merges application overrides into these defaults.
+ */
+export declare const authDefaults: {
+  onAPIError: {
+    throw: false;
+    onError(error: unknown): void;
+  };
+  rateLimit: {
+    window: number;
+    max: number;
+  };
+  session: {
+    expiresIn: number;
+    updateAge: number;
+    freshAge: number;
+    cookieCache: {
+      enabled: true;
+      maxAge: number;
+    };
+  };
+  advanced: {
+    database: {
+      generateId: () => string;
+      joins: true;
+    };
+    ipAddress: {
+      ipAddressHeaders: string[];
+    };
+  };
+};
+/** Configure built-in plugins with native options. Runtime auth requires captcha; lastLoginMethod is enabled unless explicitly disabled. */
+export type AuthPluginOptions = {
+  readonly magicLink?: Parameters<typeof magicLink>[0];
+  readonly anonymous?: NonNullable<Parameters<typeof anonymous>[0]>;
+  readonly captcha?: Omit<CloudflareTurnstileOptions, 'provider'>;
+  readonly lastLoginMethod?: false | NonNullable<Parameters<typeof lastLoginMethod>[0]>;
+  readonly openAPI?: NonNullable<Parameters<typeof openAPI>[0]>;
+  readonly bearer?: NonNullable<Parameters<typeof bearer>[0]>;
+  readonly deviceAuthorization?: NonNullable<Parameters<typeof deviceAuthorization>[0]>;
+};
+/**
+ * Runtime auth requires rate limiting and Turnstile credentials. Schema generation omits both.
+ * Both modes select plugins through `integrations`, so schema generation must repeat the runtime selection.
+ */
+export type AuthConfig = Omit<BetterAuthOptions, 'database' | 'plugins' | 'rateLimit'> & {
+  readonly rateLimit?: Omit<NonNullable<BetterAuthOptions['rateLimit']>, 'enabled' | 'storage' | 'customStorage'>;
+} & ({
+  readonly mode?: 'runtime';
+  readonly rateLimitStorage: BetterAuthRateLimitStorage;
+  readonly integrations: AuthPluginOptions & {
+    readonly captcha: Omit<CloudflareTurnstileOptions, 'provider'>;
+  };
+} | {
+  readonly mode: 'schema';
+  readonly rateLimitStorage?: never;
+  readonly integrations: AuthPluginOptions;
+});
+type PluginTypes = {
+  magicLink: ReturnType<typeof magicLink>;
+  anonymous: ReturnType<typeof anonymous>;
+  captcha: ReturnType<typeof captcha>;
+  lastLoginMethod: ReturnType<typeof lastLoginMethod<{}>>;
+  openAPI: ReturnType<typeof openAPI>;
+  bearer: ReturnType<typeof bearer>;
+  deviceAuthorization: ReturnType<typeof deviceAuthorization>;
+};
+type LastLoginPlugin<Options extends AuthPluginOptions> = Options extends {
+  readonly lastLoginMethod: infer Settings extends LastLoginMethodOptions;
+} ? ReturnType<typeof lastLoginMethod<Settings>> : PluginTypes['lastLoginMethod'];
+type SelectedPlugin<Options extends AuthPluginOptions, Key extends keyof PluginTypes> = Options extends Record<Key, false | undefined> ? [] : Options extends Record<Key, NonNullable<AuthPluginOptions[Key]>> ? [Key extends 'lastLoginMethod' ? LastLoginPlugin<Options> : PluginTypes[Key]] : Key extends 'lastLoginMethod' ? [PluginTypes[Key]] : [];
+type SelectedPlugins<Options extends AuthPluginOptions> = [...SelectedPlugin<Options, 'captcha'>, ...SelectedPlugin<Options, 'lastLoginMethod'>, ...SelectedPlugin<Options, 'openAPI'>, ...SelectedPlugin<Options, 'magicLink'>, ...SelectedPlugin<Options, 'anonymous'>, ...SelectedPlugin<Options, 'deviceAuthorization'>, ...SelectedPlugin<Options, 'bearer'>];
+type ConfiguredPlugins<Config extends AuthConfig> = SelectedPlugins<Config['integrations']>;
+type MergeOptions<Defaults, Overrides> = Omit<Defaults, keyof Overrides> & Overrides;
+type SessionOptions<Config extends AuthConfig> = MergeOptions<typeof authDefaults.session, NonNullable<Config['session']>>;
+type ConfiguredOptions<Config extends AuthConfig, Plugins extends BetterAuthPlugin[]> = Omit<Config, 'mode' | 'integrations' | 'rateLimitStorage' | 'rateLimit' | 'session' | 'advanced' | 'onAPIError'> & {
+  database: DBAdapterInstance;
+  onAPIError: MergeOptions<typeof authDefaults.onAPIError, NonNullable<Config['onAPIError']>>;
+  rateLimit: NonNullable<BetterAuthOptions['rateLimit']>;
+  session: Omit<SessionOptions<Config>, 'cookieCache'> & {
+    cookieCache: MergeOptions<typeof authDefaults.session.cookieCache, NonNullable<NonNullable<Config['session']>['cookieCache']>>;
+  };
+  advanced: MergeOptions<typeof authDefaults.advanced, NonNullable<Config['advanced']>> & {
+    database: MergeOptions<typeof authDefaults.advanced.database, NonNullable<NonNullable<Config['advanced']>['database']>>;
+    ipAddress: MergeOptions<typeof authDefaults.advanced.ipAddress, NonNullable<NonNullable<Config['advanced']>['ipAddress']>>;
+  };
+  plugins: [...ConfiguredPlugins<Config>, ...Plugins];
+};
+/** A required database adapter and application config produce options with inferred plugin and session types. */
+export type BetterAuthOptionsFactory = <const Config extends AuthConfig, const Plugins extends BetterAuthPlugin[] = []>(database: DBAdapterInstance, config: Config, additionalPlugins?: Plugins) => ConfiguredOptions<Config, Plugins>;
+/**
+ * Build native Better Auth options with shared defaults and configured plugins; both arguments are required.
+ * Pass Stripe and other plugins in the third argument. Put tanstackStartCookies() last.
+ */
+export declare const createBetterAuthOptions: BetterAuthOptionsFactory;
+//#endregion
+//# sourceMappingURL=better-auth.d.ts.map

package/dist/better-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"better-auth.d.ts","names":[],"sources":["../src/infrastructure/better-auth/options.ts"],"mappings":";;;;;;qBAmCa;;;;;;IAQE;IAAY;;;;;;;;;;;;;;;;;MASV;;;;;YAKL;WACD,YAAY,kBAAkB;WAC9B,YAAY,YAAY,kBAAkB;WAC1C,UAAU,KAAK;WACf,0BAA0B,YAAY,kBAAkB;WACxD,UAAU,YAAY,kBAAkB;WACxC,SAAS,YAAY,kBAAkB;WACvC,sBAAsB,YAAY,kBAAkB;;;;;;YAOnD,aAAa,KAAK;WACnB,YAAY,KACnB,YAAY;;WAKC;WACA,kBAAkB;WAClB,cAAc;aACZ,SAAS,KAAK;;;WAIhB;WACA;WACA,cAAc;;KAI1B;EACH,WAAW,kBAAkB;EAC7B,WAAW,kBAAkB;EAC7B,SAAS,kBAAkB;EAC3B,iBAAiB,kBAAkB;EACnC,SAAS,kBAAkB;EAC3B,QAAQ,kBAAkB;EAC1B,qBAAqB,kBAAkB;;KAGpC,gBAAgB,gBAAgB,qBAAqB;WAC/C,uBAAuB,iBAAiB;IAE/C,kBAAkB,gBAAgB,aAClC;KAEC,eAAe,gBAAgB,mBAAmB,kBAAkB,eACvE,gBAAgB,OAAO,+BAEnB,gBAAgB,OAAO,KAAK,YAAY,kBAAkB,UACvD,gCAAgC,gBAAgB,WAAW,YAAY,QACxE,iCACG,YAAY;KAGlB,gBAAgB,gBAAgB,yBAChC,eAAe,wBACf,eAAe,gCACf,eAAe,wBACf,eAAe,0BACf,eAAe,0BACf,eAAe,oCACf,eAAe;KAGf,kBAAkB,eAAe,cAAc,gBAAgB;KAE/D,aAAa,UAAU,aAAa,KAAK,gBAAgB,aAAa;KAEtE,eAAe,eAAe,cAAc,oBACxC,aAAa,SACpB,YAAY;KAGT,kBAAkB,eAAe,YAAY,gBAAgB,sBAAsB,KACtF;EAGA,UAAU;EACV,YAAY,oBAAoB,aAAa,YAAY,YAAY;EACrE,WAAW,YAAY;EACvB,SAAS,KAAK,eAAe;IAC3B,aAAa,oBACJ,aAAa,QAAQ,aAC5B,YAAY,YAAY;;EAG5B,UAAU,oBAAoB,aAAa,UAAU,YAAY;IAC/D,UAAU,oBACD,aAAa,SAAS,UAC7B,YAAY,YAAY;IAE1B,WAAW,oBACF,aAAa,SAAS,WAC7B,YAAY,YAAY;;EAG5B,aAAa,kBAAkB,YAAY;;;YAIjC,kCACJ,eAAe,kBACf,gBAAgB,yBAEtB,UAAU,mBACV,QAAQ,QACR,oBAAoB,YACjB,kBAAkB,QAAQ;;;;;qBA4BlB,yBAAyB"}

package/dist/better-auth.js

@@ -0,0 +1,112 @@
+import { a as createLogger } from "./core-CnwWj4MY.js";
+import { isAPIError } from "better-auth/api";
+import { anonymous, bearer, captcha, deviceAuthorization, lastLoginMethod, magicLink, openAPI } from "better-auth/plugins";
+import { v7 } from "uuid";
+
+//#region src/infrastructure/better-auth/options.ts
+const logger = createLogger("auth");
+const MAGIC_LINK_CAPTCHA_ENDPOINTS = [
+	"/sign-up/email",
+	"/sign-in/email",
+	"/request-password-reset",
+	"/sign-in/magic-link"
+];
+/**
+* Shared policy from Porte and Typist. The factory merges application overrides into these defaults.
+*/
+const authDefaults = {
+	onAPIError: {
+		throw: false,
+		onError(error) {
+			if (isAPIError(error) && error.statusCode < 500) return;
+			logger.error("auth_operation_failed", { error });
+		}
+	},
+	rateLimit: {
+		window: 60,
+		max: 100
+	},
+	session: {
+		expiresIn: 604800,
+		updateAge: 86400,
+		freshAge: 86400,
+		cookieCache: {
+			enabled: true,
+			maxAge: 300
+		}
+	},
+	advanced: {
+		database: {
+			generateId: () => v7(),
+			joins: true
+		},
+		ipAddress: { ipAddressHeaders: ["cf-connecting-ip", "x-forwarded-for"] }
+	}
+};
+function buildPlugins(options) {
+	const plugins = [];
+	if (options.captcha !== void 0) {
+		const captchaOptions = { ...options.captcha };
+		if (options.magicLink !== void 0 && captchaOptions.endpoints === void 0) captchaOptions.endpoints = [...MAGIC_LINK_CAPTCHA_ENDPOINTS];
+		plugins.push(captcha({
+			...captchaOptions,
+			provider: "cloudflare-turnstile"
+		}));
+	}
+	if (options.lastLoginMethod !== false) plugins.push(lastLoginMethod(options.lastLoginMethod));
+	if (options.openAPI !== void 0) plugins.push(openAPI(options.openAPI));
+	if (options.magicLink !== void 0) plugins.push(magicLink({
+		expiresIn: 300,
+		...options.magicLink
+	}));
+	if (options.anonymous !== void 0) plugins.push(anonymous(options.anonymous));
+	if (options.deviceAuthorization !== void 0) plugins.push(deviceAuthorization(options.deviceAuthorization));
+	if (options.bearer !== void 0) plugins.push(bearer(options.bearer));
+	return plugins;
+}
+/**
+* Build native Better Auth options with shared defaults and configured plugins; both arguments are required.
+* Pass Stripe and other plugins in the third argument. Put tanstackStartCookies() last.
+*/
+const createBetterAuthOptions = (database, config, additionalPlugins) => {
+	const { mode, integrations, rateLimitStorage, ...options } = config;
+	return {
+		...options,
+		database,
+		onAPIError: {
+			...authDefaults.onAPIError,
+			...options.onAPIError
+		},
+		rateLimit: mode === "schema" ? { enabled: false } : {
+			...authDefaults.rateLimit,
+			...options.rateLimit,
+			enabled: true,
+			customStorage: rateLimitStorage
+		},
+		session: {
+			...authDefaults.session,
+			...options.session,
+			cookieCache: {
+				...authDefaults.session.cookieCache,
+				...options.session?.cookieCache
+			}
+		},
+		advanced: {
+			...authDefaults.advanced,
+			...options.advanced,
+			database: {
+				...authDefaults.advanced.database,
+				...options.advanced?.database
+			},
+			ipAddress: {
+				...authDefaults.advanced.ipAddress,
+				...options.advanced?.ipAddress
+			}
+		},
+		plugins: [...buildPlugins(integrations), ...additionalPlugins ?? []]
+	};
+};
+
+//#endregion
+export { authDefaults, createBetterAuthOptions };
+//# sourceMappingURL=better-auth.js.map