better-ship 0.8.0 → 0.10.0

package/dist/better-auth/apple-client-secret.d.ts

@@ -1,6 +1,9 @@
 import { kt as AppError } from "../index-6XMPJu7u.js";
 //#region src/infrastructure/better-auth/apple-client-secret.d.ts
-/** Apple sends its OAuth callback from this origin. Include it in trustedOrigins when enabling Apple. */
+/**
+ * Apple's issuer and OAuth callback origin, and the `aud` claim of the client secret. Include it in
+ * trustedOrigins when enabling Apple. Source: the same Apple page as `SECRET_LIFETIME_SECONDS`.
+ */
 export declare const APPLE_ORIGIN = "https://appleid.apple.com";
 /** Apple credentials used to sign a client secret. Ported from Porte's apple-client-secret.ts. */
 export type AppleKeyConfig = {
@@ -15,7 +18,11 @@ export declare class AppleClientSecretError extends AppError {
   readonly classification = "terminal";
   constructor(cause: unknown);
 }
-/** Sign Apple's six-month client secret. Invalid private keys return an empty secret and log once per isolate, as in Typist. */
-export declare function generateAppleClientSecret(config: AppleKeyConfig): Promise<string>;
+/**
+ * Sign Apple's six-month client secret synchronously, so Better Auth options can be built without awaiting it.
+ * Signing uses `node:crypto` as Typist does, so the Worker needs the `nodejs_compat` flag.
+ * Invalid private keys return an empty secret and log once per isolate, as in Typist.
+ */
+export declare function generateAppleClientSecret(config: AppleKeyConfig): string;
 //#endregion
 //# sourceMappingURL=apple-client-secret.d.ts.map

package/dist/better-auth/apple-client-secret.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"apple-client-secret.d.ts","names":[],"sources":["../../src/infrastructure/better-auth/apple-client-secret.ts"],"mappings":";;;qBASa;;YAGD;WACD;WACA;WACA;WACA;;;qBAIE,+BAA+B;WACjC;WACA;EAET,YAAY;;;wBAMQ,0BAA0B,QAAQ,iBAAiB"}
+{"version":3,"file":"apple-client-secret.d.ts","names":[],"sources":["../../src/infrastructure/better-auth/apple-client-secret.ts"],"mappings":";;;;;;qBAkBa;;YAGD;WACD;WACA;WACA;WACA;;;qBAIE,+BAA+B;WACjC;WACA;EAET,YAAY;;;;;;;wBAiBE,0BAA0B,QAAQ"}

package/dist/better-auth/apple-client-secret.js

@@ -1,10 +1,19 @@
 import { U as AppError, a as createLogger } from "../core-DC_4pOrI.js";
-import { SignJWT, importPKCS8 } from "jose";
+import { Buffer } from "node:buffer";
+import { createPrivateKey, sign } from "node:crypto";
 
 //#region src/infrastructure/better-auth/apple-client-secret.ts
 const logger = createLogger("auth");
 let appleKeyFailureLogged = false;
-/** Apple sends its OAuth callback from this origin. Include it in trustedOrigins when enabling Apple. */
+/**
+* Apple caps `exp` at 15,777,000 seconds after `iat`; 180 days stays under it. Source:
+* https://developer.apple.com/documentation/accountorganizationaldatasharing/creating-a-client-secret
+*/
+const SECRET_LIFETIME_SECONDS = 15552e3;
+/**
+* Apple's issuer and OAuth callback origin, and the `aud` claim of the client secret. Include it in
+* trustedOrigins when enabling Apple. Source: the same Apple page as `SECRET_LIFETIME_SECONDS`.
+*/
 const APPLE_ORIGIN = "https://appleid.apple.com";
 /** Apple signing failed. The application's error boundary owns reporting. */
 var AppleClientSecretError = class extends AppError {
@@ -14,11 +23,18 @@ var AppleClientSecretError = class extends AppError {
 		super("Apple client secret signing failed", { cause });
 	}
 };
-/** Sign Apple's six-month client secret. Invalid private keys return an empty secret and log once per isolate, as in Typist. */
-async function generateAppleClientSecret(config) {
-	let key;
+function base64UrlJson(segment) {
+	return Buffer.from(JSON.stringify(segment)).toString("base64url");
+}
+/**
+* Sign Apple's six-month client secret synchronously, so Better Auth options can be built without awaiting it.
+* Signing uses `node:crypto` as Typist does, so the Worker needs the `nodejs_compat` flag.
+* Invalid private keys return an empty secret and log once per isolate, as in Typist.
+*/
+function generateAppleClientSecret(config) {
+	const key = config.applePrivateKey.replace(/\\n/g, "\n");
 	try {
-		key = await importPKCS8(config.applePrivateKey.replace(/\\n/g, "\n"), "ES256");
+		createPrivateKey(key);
 	} catch (error) {
 		if (!appleKeyFailureLogged) {
 			appleKeyFailureLogged = true;
@@ -29,11 +45,23 @@ async function generateAppleClientSecret(config) {
 		}
 		return "";
 	}
+	const issuedAt = Math.floor(Date.now() / 1e3);
+	const input = `${base64UrlJson({
+		alg: "ES256",
+		kid: config.appleKeyId
+	})}.${base64UrlJson({
+		iss: config.appleTeamId,
+		sub: config.appleClientId,
+		aud: APPLE_ORIGIN,
+		iat: issuedAt,
+		exp: issuedAt + SECRET_LIFETIME_SECONDS
+	})}`;
 	try {
-		return await new SignJWT({}).setProtectedHeader({
-			alg: "ES256",
-			kid: config.appleKeyId
-		}).setIssuer(config.appleTeamId).setSubject(config.appleClientId).setAudience(APPLE_ORIGIN).setIssuedAt().setExpirationTime("180d").sign(key);
+		const signature = sign("sha256", Buffer.from(input), {
+			key,
+			dsaEncoding: "ieee-p1363"
+		});
+		return `${input}.${Buffer.from(signature).toString("base64url")}`;
 	} catch (cause) {
 		throw new AppleClientSecretError(cause);
 	}

package/dist/better-auth/apple-client-secret.js.map

@@ -1 +1 @@
-{"version":3,"file":"apple-client-secret.js","names":[],"sources":["../../src/infrastructure/better-auth/apple-client-secret.ts"],"sourcesContent":["import { importPKCS8, SignJWT } from 'jose'\n\nimport { AppError, createLogger } from '@/core'\n\nconst logger = createLogger('auth')\n// Typist reports an invalid key once per isolate because session checks repeatedly construct auth options.\nlet appleKeyFailureLogged = false\n\n/** Apple sends its OAuth callback from this origin. Include it in trustedOrigins when enabling Apple. */\nexport const APPLE_ORIGIN = 'https://appleid.apple.com'\n\n/** Apple credentials used to sign a client secret. Ported from Porte's apple-client-secret.ts. */\nexport type AppleKeyConfig = {\n  readonly appleClientId: string\n  readonly appleTeamId: string\n  readonly appleKeyId: string\n  readonly applePrivateKey: string\n}\n\n/** Apple signing failed. The application's error boundary owns reporting. */\nexport class AppleClientSecretError extends AppError {\n  readonly _tag = 'AppleClientSecretError'\n  readonly classification = 'terminal'\n\n  constructor(cause: unknown) {\n    super('Apple client secret signing failed', { cause })\n  }\n}\n\n/** Sign Apple's six-month client secret. Invalid private keys return an empty secret and log once per isolate, as in Typist. */\nexport async function generateAppleClientSecret(config: AppleKeyConfig): Promise<string> {\n  let key: Awaited<ReturnType<typeof importPKCS8>>\n  try {\n    key = await importPKCS8(config.applePrivateKey.replace(/\\\\n/g, '\\n'), 'ES256')\n  } catch (error) {\n    if (!appleKeyFailureLogged) {\n      appleKeyFailureLogged = true\n      logger.error('apple_private_key_invalid', { error, details: { keyId: config.appleKeyId } })\n    }\n    return ''\n  }\n  try {\n    return await new SignJWT({})\n      .setProtectedHeader({ alg: 'ES256', kid: config.appleKeyId })\n      .setIssuer(config.appleTeamId)\n      .setSubject(config.appleClientId)\n      .setAudience(APPLE_ORIGIN)\n      .setIssuedAt()\n      .setExpirationTime('180d')\n      .sign(key)\n  } catch (cause) {\n    throw new AppleClientSecretError(cause)\n  }\n}\n"],"mappings":";;;;AAIA,MAAM,SAAS,aAAa,MAAM;AAElC,IAAI,wBAAwB;;AAG5B,MAAa,eAAe;;AAW5B,IAAa,yBAAb,cAA4C,SAAS;CACnD,AAAS,OAAO;CAChB,AAAS,iBAAiB;CAE1B,YAAY,OAAgB;EAC1B,MAAM,sCAAsC,EAAE,MAAM,CAAC;CACvD;AACF;;AAGA,eAAsB,0BAA0B,QAAyC;CACvF,IAAI;CACJ,IAAI;EACF,MAAM,MAAM,YAAY,OAAO,gBAAgB,QAAQ,QAAQ,IAAI,GAAG,OAAO;CAC/E,SAAS,OAAO;EACd,IAAI,CAAC,uBAAuB;GAC1B,wBAAwB;GACxB,OAAO,MAAM,6BAA6B;IAAE;IAAO,SAAS,EAAE,OAAO,OAAO,WAAW;GAAE,CAAC;EAC5F;EACA,OAAO;CACT;CACA,IAAI;EACF,OAAO,MAAM,IAAI,QAAQ,CAAC,CAAC,CAAC,CACzB,mBAAmB;GAAE,KAAK;GAAS,KAAK,OAAO;EAAW,CAAC,CAAC,CAC5D,UAAU,OAAO,WAAW,CAAC,CAC7B,WAAW,OAAO,aAAa,CAAC,CAChC,YAAY,YAAY,CAAC,CACzB,YAAY,CAAC,CACb,kBAAkB,MAAM,CAAC,CACzB,KAAK,GAAG;CACb,SAAS,OAAO;EACd,MAAM,IAAI,uBAAuB,KAAK;CACxC;AACF"}
+{"version":3,"file":"apple-client-secret.js","names":[],"sources":["../../src/infrastructure/better-auth/apple-client-secret.ts"],"sourcesContent":["import { Buffer } from 'node:buffer'\nimport { createPrivateKey, sign } from 'node:crypto'\n\nimport { AppError, createLogger } from '@/core'\n\nconst logger = createLogger('auth')\n// Typist reports an invalid key once per isolate because session checks repeatedly construct auth options.\nlet appleKeyFailureLogged = false\n/**\n * Apple caps `exp` at 15,777,000 seconds after `iat`; 180 days stays under it. Source:\n * https://developer.apple.com/documentation/accountorganizationaldatasharing/creating-a-client-secret\n */\nconst SECRET_LIFETIME_SECONDS = 180 * 24 * 60 * 60\n\n/**\n * Apple's issuer and OAuth callback origin, and the `aud` claim of the client secret. Include it in\n * trustedOrigins when enabling Apple. Source: the same Apple page as `SECRET_LIFETIME_SECONDS`.\n */\nexport const APPLE_ORIGIN = 'https://appleid.apple.com'\n\n/** Apple credentials used to sign a client secret. Ported from Porte's apple-client-secret.ts. */\nexport type AppleKeyConfig = {\n  readonly appleClientId: string\n  readonly appleTeamId: string\n  readonly appleKeyId: string\n  readonly applePrivateKey: string\n}\n\n/** Apple signing failed. The application's error boundary owns reporting. */\nexport class AppleClientSecretError extends AppError {\n  readonly _tag = 'AppleClientSecretError'\n  readonly classification = 'terminal'\n\n  constructor(cause: unknown) {\n    super('Apple client secret signing failed', { cause })\n  }\n}\n\n/** One JWS segment before encoding: the protected header or the claims. */\ntype JwsSegment = Readonly<Record<string, string | number>>\n\nfunction base64UrlJson(segment: JwsSegment): string {\n  return Buffer.from(JSON.stringify(segment)).toString('base64url')\n}\n\n/**\n * Sign Apple's six-month client secret synchronously, so Better Auth options can be built without awaiting it.\n * Signing uses `node:crypto` as Typist does, so the Worker needs the `nodejs_compat` flag.\n * Invalid private keys return an empty secret and log once per isolate, as in Typist.\n */\nexport function generateAppleClientSecret(config: AppleKeyConfig): string {\n  const key = config.applePrivateKey.replace(/\\\\n/g, '\\n')\n  // Validation only: workerd's sign() takes the PEM string, not the KeyObject.\n  try {\n    createPrivateKey(key)\n  } catch (error) {\n    if (!appleKeyFailureLogged) {\n      appleKeyFailureLogged = true\n      logger.error('apple_private_key_invalid', { error, details: { keyId: config.appleKeyId } })\n    }\n    return ''\n  }\n  const issuedAt = Math.floor(Date.now() / 1000)\n  const header = base64UrlJson({ alg: 'ES256', kid: config.appleKeyId })\n  const claims = base64UrlJson({\n    iss: config.appleTeamId,\n    sub: config.appleClientId,\n    aud: APPLE_ORIGIN,\n    iat: issuedAt,\n    exp: issuedAt + SECRET_LIFETIME_SECONDS,\n  })\n  const input = `${header}.${claims}`\n  try {\n    // A JWS carries the raw r||s signature; OpenSSL emits DER unless told otherwise.\n    const signature = sign('sha256', Buffer.from(input), { key, dsaEncoding: 'ieee-p1363' })\n    // TypeScript 7 types the returned buffer without an encoding parameter on toString.\n    return `${input}.${Buffer.from(signature).toString('base64url')}`\n  } catch (cause) {\n    throw new AppleClientSecretError(cause)\n  }\n}\n"],"mappings":";;;;;AAKA,MAAM,SAAS,aAAa,MAAM;AAElC,IAAI,wBAAwB;;;;;AAK5B,MAAM,0BAA0B;;;;;AAMhC,MAAa,eAAe;;AAW5B,IAAa,yBAAb,cAA4C,SAAS;CACnD,AAAS,OAAO;CAChB,AAAS,iBAAiB;CAE1B,YAAY,OAAgB;EAC1B,MAAM,sCAAsC,EAAE,MAAM,CAAC;CACvD;AACF;AAKA,SAAS,cAAc,SAA6B;CAClD,OAAO,OAAO,KAAK,KAAK,UAAU,OAAO,CAAC,CAAC,CAAC,SAAS,WAAW;AAClE;;;;;;AAOA,SAAgB,0BAA0B,QAAgC;CACxE,MAAM,MAAM,OAAO,gBAAgB,QAAQ,QAAQ,IAAI;CAEvD,IAAI;EACF,iBAAiB,GAAG;CACtB,SAAS,OAAO;EACd,IAAI,CAAC,uBAAuB;GAC1B,wBAAwB;GACxB,OAAO,MAAM,6BAA6B;IAAE;IAAO,SAAS,EAAE,OAAO,OAAO,WAAW;GAAE,CAAC;EAC5F;EACA,OAAO;CACT;CACA,MAAM,WAAW,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;CAS7C,MAAM,QAAQ,GARC,cAAc;EAAE,KAAK;EAAS,KAAK,OAAO;CAAW,CAQ9C,EAAE,GAPT,cAAc;EAC3B,KAAK,OAAO;EACZ,KAAK,OAAO;EACZ,KAAK;EACL,KAAK;EACL,KAAK,WAAW;CAClB,CACgC;CAChC,IAAI;EAEF,MAAM,YAAY,KAAK,UAAU,OAAO,KAAK,KAAK,GAAG;GAAE;GAAK,aAAa;EAAa,CAAC;EAEvF,OAAO,GAAG,MAAM,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,SAAS,WAAW;CAChE,SAAS,OAAO;EACd,MAAM,IAAI,uBAAuB,KAAK;CACxC;AACF"}

package/dist/better-auth/rate-limit.d.ts

@@ -1,12 +1,31 @@
 import { kt as AppError } from "../index-6XMPJu7u.js";
-import { BetterAuthRateLimitStorage } from "better-auth";
+import { BetterAuthOptions, BetterAuthRateLimitStorage } from "better-auth";
 //#region src/infrastructure/better-auth/rate-limit.d.ts
+/** A rule Better Auth passes to storage: a window in seconds and the requests it allows. */
+export type AuthRateLimitRule = {
+  readonly window: number;
+  readonly max: number;
+};
 /** Each rule must match its binding's deployed limit and period. Cloudflare accepts only 10 or 60 seconds. */
 export type AuthRateLimitBinding = {
   readonly binding: Pick<RateLimit, 'limit'>;
   readonly window: 10 | 60;
   readonly max: number;
 };
+/**
+ * Better Auth's built-in rules, which it does not export. Sign-in, sign-up, change-password, and
+ * change-email paths get 3 requests per 10 seconds. Password reset, verification email, forget-password,
+ * and email OTP send paths get 3 per 60 seconds. A package test pins both against the installed version.
+ * Source: `getDefaultSpecialRules` in
+ * https://github.com/better-auth/better-auth/blob/v1.7.4/packages/better-auth/src/api/rate-limiter/index.ts
+ */
+export declare const BUILT_IN_AUTH_RATE_LIMIT_RULES: readonly AuthRateLimitRule[];
+/**
+ * Every rule the configured instance can pass to storage, deduplicated: the general rule, the built-in
+ * rules, each plugin's rules, and static custom rules. Function-valued custom rules decide per request
+ * and are not listed. Disabled rate limiting returns no rules.
+ */
+export declare function authRateLimitRules(options: Pick<BetterAuthOptions, 'rateLimit' | 'plugins'>): readonly AuthRateLimitRule[];
 /** A binding failure with no known retry classification. The cause preserves the original failure. */
 export declare class AuthRateLimitError extends AppError {
   readonly _tag = "AuthRateLimitError";

package/dist/better-auth/rate-limit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rate-limit.d.ts","names":[],"sources":["../../src/infrastructure/better-auth/rate-limit.ts"],"mappings":";;;;YAKY;WACD,SAAS,KAAK;WACd;WACA;;;qBAIE,2BAA2B;WAC7B;WACA;EAET,YAAY;;;qBAMD,0CAA0C;WAK1C;WACA;WALF;WACA;EAET,YACW,gBACA;;;YAOD;WACD;;;;;;wBAOK,2BACd,mBAAmB,0BACjB,gBAAyB,uBAC1B"}
+{"version":3,"file":"rate-limit.d.ts","names":[],"sources":["../../src/infrastructure/better-auth/rate-limit.ts"],"mappings":";;;;YAKY;WACD;WACA;;;YAIC;WACD,SAAS,KAAK;WACd;WACA;;;;;;;;;qBAUE,yCAAyC;;;;;;wBAUtC,mBACd,SAAS,KAAK,uDACJ;;qBAmBC,2BAA2B;WAC7B;WACA;EAET,YAAY;;;qBAMD,0CAA0C;WAK1C;WACA;WALF;WACA;EAET,YACW,gBACA;;;YAOD;WACD;;;;;;wBAOK,2BACd,mBAAmB,0BACjB,gBAAyB,uBAC1B"}

package/dist/better-auth/rate-limit.js

@@ -1,6 +1,42 @@
 import { U as AppError, a as createLogger } from "../core-DC_4pOrI.js";
 
 //#region src/infrastructure/better-auth/rate-limit.ts
+/**
+* Better Auth's built-in rules, which it does not export. Sign-in, sign-up, change-password, and
+* change-email paths get 3 requests per 10 seconds. Password reset, verification email, forget-password,
+* and email OTP send paths get 3 per 60 seconds. A package test pins both against the installed version.
+* Source: `getDefaultSpecialRules` in
+* https://github.com/better-auth/better-auth/blob/v1.7.4/packages/better-auth/src/api/rate-limiter/index.ts
+*/
+const BUILT_IN_AUTH_RATE_LIMIT_RULES = [{
+	window: 10,
+	max: 3
+}, {
+	window: 60,
+	max: 3
+}];
+/**
+* Every rule the configured instance can pass to storage, deduplicated: the general rule, the built-in
+* rules, each plugin's rules, and static custom rules. Function-valued custom rules decide per request
+* and are not listed. Disabled rate limiting returns no rules.
+*/
+function authRateLimitRules(options) {
+	const rateLimit = options.rateLimit;
+	if (rateLimit?.enabled === false) return [];
+	const rules = [{
+		window: rateLimit?.window ?? 10,
+		max: rateLimit?.max ?? 100
+	}, ...BUILT_IN_AUTH_RATE_LIMIT_RULES];
+	for (const plugin of options.plugins ?? []) for (const rule of plugin.rateLimit ?? []) rules.push({
+		window: rule.window,
+		max: rule.max
+	});
+	for (const rule of Object.values(rateLimit?.customRules ?? {})) if (rule !== false && !(rule instanceof Function)) rules.push({
+		window: rule.window,
+		max: rule.max
+	});
+	return [...new Map(rules.map((rule) => [`${rule.window}:${rule.max}`, rule])).values()];
+}
 /** A binding failure with no known retry classification. The cause preserves the original failure. */
 var AuthRateLimitError = class extends AppError {
 	_tag = "AuthRateLimitError";
@@ -55,5 +91,5 @@ function createAuthRateLimitStorage(bindings, { failureMode = "allow" } = {}) {
 }
 
 //#endregion
-export { AuthRateLimitError, UnsupportedAuthRateLimitRuleError, createAuthRateLimitStorage };
+export { AuthRateLimitError, BUILT_IN_AUTH_RATE_LIMIT_RULES, UnsupportedAuthRateLimitRuleError, authRateLimitRules, createAuthRateLimitStorage };
 //# sourceMappingURL=rate-limit.js.map

package/dist/better-auth/rate-limit.js.map

@@ -1 +1 @@
-{"version":3,"file":"rate-limit.js","names":[],"sources":["../../src/infrastructure/better-auth/rate-limit.ts"],"sourcesContent":["import type { BetterAuthRateLimitStorage } from 'better-auth'\n\nimport { AppError, createLogger } from '@/core'\n\n/** Each rule must match its binding's deployed limit and period. Cloudflare accepts only 10 or 60 seconds. */\nexport type AuthRateLimitBinding = {\n  readonly binding: Pick<RateLimit, 'limit'>\n  readonly window: 10 | 60\n  readonly max: number\n}\n\n/** A binding failure with no known retry classification. The cause preserves the original failure. */\nexport class AuthRateLimitError extends AppError {\n  readonly _tag = 'AuthRateLimitError'\n  readonly classification = 'unknown'\n\n  constructor(cause: unknown) {\n    super('Authentication rate limiter is unavailable', { cause })\n  }\n}\n\n/** No configured binding matches this Better Auth rule. Outage policy cannot bypass a configuration error. */\nexport class UnsupportedAuthRateLimitRuleError extends AppError {\n  readonly _tag = 'UnsupportedAuthRateLimitRuleError'\n  readonly classification = 'terminal'\n\n  constructor(\n    readonly window: number,\n    readonly max: number,\n  ) {\n    super('No Cloudflare binding supports the authentication rate limit rule')\n  }\n}\n\n/** Typist allows requests during binding outages. Select block to propagate an error instead. */\nexport type AuthRateLimitOptions = {\n  readonly failureMode?: 'allow' | 'block'\n}\n\n/**\n * Port Typist and Porte's binding adapters with explicit rule matching and configurable outage behavior.\n * Bindings enforce approximate limits per Cloudflare location; retryAfter is a conservative full window.\n */\nexport function createAuthRateLimitStorage(\n  bindings: readonly AuthRateLimitBinding[],\n  { failureMode = 'allow' }: AuthRateLimitOptions = {},\n): BetterAuthRateLimitStorage {\n  const logger = createLogger('auth-rate-limit')\n  return {\n    async consume(key, rule) {\n      const configured = bindings.find(\n        (entry) => entry.window === rule.window && entry.max === rule.max,\n      )\n      if (configured === undefined)\n        throw new UnsupportedAuthRateLimitRuleError(rule.window, rule.max)\n      try {\n        const { success } = await configured.binding.limit({ key })\n        return { allowed: success, retryAfter: success ? null : rule.window }\n      } catch (cause) {\n        if (failureMode === 'block') throw new AuthRateLimitError(cause)\n        logger.error('rate_limit_binding_failed', {\n          error: cause,\n          details: { window: rule.window, max: rule.max, failureMode },\n        })\n        return { allowed: true, retryAfter: null }\n      }\n    },\n  }\n}\n"],"mappings":";;;;AAYA,IAAa,qBAAb,cAAwC,SAAS;CAC/C,AAAS,OAAO;CAChB,AAAS,iBAAiB;CAE1B,YAAY,OAAgB;EAC1B,MAAM,8CAA8C,EAAE,MAAM,CAAC;CAC/D;AACF;;AAGA,IAAa,oCAAb,cAAuD,SAAS;CAKnD;CACA;CALX,AAAS,OAAO;CAChB,AAAS,iBAAiB;CAE1B,YACE,AAAS,QACT,AAAS,KACT;EACA,MAAM,mEAAmE;EAHhE;EACA;CAGX;AACF;;;;;AAWA,SAAgB,2BACd,UACA,EAAE,cAAc,YAAkC,CAAC,GACvB;CAC5B,MAAM,SAAS,aAAa,iBAAiB;CAC7C,OAAO,EACL,MAAM,QAAQ,KAAK,MAAM;EACvB,MAAM,aAAa,SAAS,MACzB,UAAU,MAAM,WAAW,KAAK,UAAU,MAAM,QAAQ,KAAK,GAChE;EACA,IAAI,eAAe,QACjB,MAAM,IAAI,kCAAkC,KAAK,QAAQ,KAAK,GAAG;EACnE,IAAI;GACF,MAAM,EAAE,YAAY,MAAM,WAAW,QAAQ,MAAM,EAAE,IAAI,CAAC;GAC1D,OAAO;IAAE,SAAS;IAAS,YAAY,UAAU,OAAO,KAAK;GAAO;EACtE,SAAS,OAAO;GACd,IAAI,gBAAgB,SAAS,MAAM,IAAI,mBAAmB,KAAK;GAC/D,OAAO,MAAM,6BAA6B;IACxC,OAAO;IACP,SAAS;KAAE,QAAQ,KAAK;KAAQ,KAAK,KAAK;KAAK;IAAY;GAC7D,CAAC;GACD,OAAO;IAAE,SAAS;IAAM,YAAY;GAAK;EAC3C;CACF,EACF;AACF"}
+{"version":3,"file":"rate-limit.js","names":[],"sources":["../../src/infrastructure/better-auth/rate-limit.ts"],"sourcesContent":["import type { BetterAuthOptions, BetterAuthRateLimitStorage } from 'better-auth'\n\nimport { AppError, createLogger } from '@/core'\n\n/** A rule Better Auth passes to storage: a window in seconds and the requests it allows. */\nexport type AuthRateLimitRule = {\n  readonly window: number\n  readonly max: number\n}\n\n/** Each rule must match its binding's deployed limit and period. Cloudflare accepts only 10 or 60 seconds. */\nexport type AuthRateLimitBinding = {\n  readonly binding: Pick<RateLimit, 'limit'>\n  readonly window: 10 | 60\n  readonly max: number\n}\n\n/**\n * Better Auth's built-in rules, which it does not export. Sign-in, sign-up, change-password, and\n * change-email paths get 3 requests per 10 seconds. Password reset, verification email, forget-password,\n * and email OTP send paths get 3 per 60 seconds. A package test pins both against the installed version.\n * Source: `getDefaultSpecialRules` in\n * https://github.com/better-auth/better-auth/blob/v1.7.4/packages/better-auth/src/api/rate-limiter/index.ts\n */\nexport const BUILT_IN_AUTH_RATE_LIMIT_RULES: readonly AuthRateLimitRule[] = [\n  { window: 10, max: 3 },\n  { window: 60, max: 3 },\n]\n\n/**\n * Every rule the configured instance can pass to storage, deduplicated: the general rule, the built-in\n * rules, each plugin's rules, and static custom rules. Function-valued custom rules decide per request\n * and are not listed. Disabled rate limiting returns no rules.\n */\nexport function authRateLimitRules(\n  options: Pick<BetterAuthOptions, 'rateLimit' | 'plugins'>,\n): readonly AuthRateLimitRule[] {\n  const rateLimit = options.rateLimit\n  if (rateLimit?.enabled === false) return []\n  // Better Auth's own defaults when the general rule is not set: window 10, max 100. Source:\n  // https://github.com/better-auth/better-auth/blob/v1.7.4/packages/better-auth/src/context/create-context.ts\n  const rules: AuthRateLimitRule[] = [\n    { window: rateLimit?.window ?? 10, max: rateLimit?.max ?? 100 },\n    ...BUILT_IN_AUTH_RATE_LIMIT_RULES,\n  ]\n  for (const plugin of options.plugins ?? [])\n    for (const rule of plugin.rateLimit ?? []) rules.push({ window: rule.window, max: rule.max })\n  for (const rule of Object.values(rateLimit?.customRules ?? {}))\n    if (rule !== false && !(rule instanceof Function))\n      rules.push({ window: rule.window, max: rule.max })\n  const unique = new Map(rules.map((rule) => [`${rule.window}:${rule.max}`, rule]))\n  return [...unique.values()]\n}\n\n/** A binding failure with no known retry classification. The cause preserves the original failure. */\nexport class AuthRateLimitError extends AppError {\n  readonly _tag = 'AuthRateLimitError'\n  readonly classification = 'unknown'\n\n  constructor(cause: unknown) {\n    super('Authentication rate limiter is unavailable', { cause })\n  }\n}\n\n/** No configured binding matches this Better Auth rule. Outage policy cannot bypass a configuration error. */\nexport class UnsupportedAuthRateLimitRuleError extends AppError {\n  readonly _tag = 'UnsupportedAuthRateLimitRuleError'\n  readonly classification = 'terminal'\n\n  constructor(\n    readonly window: number,\n    readonly max: number,\n  ) {\n    super('No Cloudflare binding supports the authentication rate limit rule')\n  }\n}\n\n/** Typist allows requests during binding outages. Select block to propagate an error instead. */\nexport type AuthRateLimitOptions = {\n  readonly failureMode?: 'allow' | 'block'\n}\n\n/**\n * Port Typist and Porte's binding adapters with explicit rule matching and configurable outage behavior.\n * Bindings enforce approximate limits per Cloudflare location; retryAfter is a conservative full window.\n */\nexport function createAuthRateLimitStorage(\n  bindings: readonly AuthRateLimitBinding[],\n  { failureMode = 'allow' }: AuthRateLimitOptions = {},\n): BetterAuthRateLimitStorage {\n  const logger = createLogger('auth-rate-limit')\n  return {\n    async consume(key, rule) {\n      const configured = bindings.find(\n        (entry) => entry.window === rule.window && entry.max === rule.max,\n      )\n      if (configured === undefined)\n        throw new UnsupportedAuthRateLimitRuleError(rule.window, rule.max)\n      try {\n        const { success } = await configured.binding.limit({ key })\n        return { allowed: success, retryAfter: success ? null : rule.window }\n      } catch (cause) {\n        if (failureMode === 'block') throw new AuthRateLimitError(cause)\n        logger.error('rate_limit_binding_failed', {\n          error: cause,\n          details: { window: rule.window, max: rule.max, failureMode },\n        })\n        return { allowed: true, retryAfter: null }\n      }\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;AAwBA,MAAa,iCAA+D,CAC1E;CAAE,QAAQ;CAAI,KAAK;AAAE,GACrB;CAAE,QAAQ;CAAI,KAAK;AAAE,CACvB;;;;;;AAOA,SAAgB,mBACd,SAC8B;CAC9B,MAAM,YAAY,QAAQ;CAC1B,IAAI,WAAW,YAAY,OAAO,OAAO,CAAC;CAG1C,MAAM,QAA6B,CACjC;EAAE,QAAQ,WAAW,UAAU;EAAI,KAAK,WAAW,OAAO;CAAI,GAC9D,GAAG,8BACL;CACA,KAAK,MAAM,UAAU,QAAQ,WAAW,CAAC,GACvC,KAAK,MAAM,QAAQ,OAAO,aAAa,CAAC,GAAG,MAAM,KAAK;EAAE,QAAQ,KAAK;EAAQ,KAAK,KAAK;CAAI,CAAC;CAC9F,KAAK,MAAM,QAAQ,OAAO,OAAO,WAAW,eAAe,CAAC,CAAC,GAC3D,IAAI,SAAS,SAAS,EAAE,gBAAgB,WACtC,MAAM,KAAK;EAAE,QAAQ,KAAK;EAAQ,KAAK,KAAK;CAAI,CAAC;CAErD,OAAO,CAAC,GAAG,IADQ,IAAI,MAAM,KAAK,SAAS,CAAC,GAAG,KAAK,OAAO,GAAG,KAAK,OAAO,IAAI,CAAC,CAC/D,CAAC,CAAC,OAAO,CAAC;AAC5B;;AAGA,IAAa,qBAAb,cAAwC,SAAS;CAC/C,AAAS,OAAO;CAChB,AAAS,iBAAiB;CAE1B,YAAY,OAAgB;EAC1B,MAAM,8CAA8C,EAAE,MAAM,CAAC;CAC/D;AACF;;AAGA,IAAa,oCAAb,cAAuD,SAAS;CAKnD;CACA;CALX,AAAS,OAAO;CAChB,AAAS,iBAAiB;CAE1B,YACE,AAAS,QACT,AAAS,KACT;EACA,MAAM,mEAAmE;EAHhE;EACA;CAGX;AACF;;;;;AAWA,SAAgB,2BACd,UACA,EAAE,cAAc,YAAkC,CAAC,GACvB;CAC5B,MAAM,SAAS,aAAa,iBAAiB;CAC7C,OAAO,EACL,MAAM,QAAQ,KAAK,MAAM;EACvB,MAAM,aAAa,SAAS,MACzB,UAAU,MAAM,WAAW,KAAK,UAAU,MAAM,QAAQ,KAAK,GAChE;EACA,IAAI,eAAe,QACjB,MAAM,IAAI,kCAAkC,KAAK,QAAQ,KAAK,GAAG;EACnE,IAAI;GACF,MAAM,EAAE,YAAY,MAAM,WAAW,QAAQ,MAAM,EAAE,IAAI,CAAC;GAC1D,OAAO;IAAE,SAAS;IAAS,YAAY,UAAU,OAAO,KAAK;GAAO;EACtE,SAAS,OAAO;GACd,IAAI,gBAAgB,SAAS,MAAM,IAAI,mBAAmB,KAAK;GAC/D,OAAO,MAAM,6BAA6B;IACxC,OAAO;IACP,SAAS;KAAE,QAAQ,KAAK;KAAQ,KAAK,KAAK;KAAK;IAAY;GAC7D,CAAC;GACD,OAAO;IAAE,SAAS;IAAM,YAAY;GAAK;EAC3C;CACF,EACF;AACF"}

package/dist/cloudflare/scheduled.d.ts

@@ -0,0 +1,36 @@
+import { q as MessageId } from "../index-6XMPJu7u.js";
+import { z } from "zod";
+//#region src/infrastructure/cloudflare/scheduled/scheduled-handler.d.ts
+/** The work one schedule runs. Nothing returns to the platform, so each run reports its own outcome. */
+type ScheduledRun<Deps> = (deps: Deps, at: Date) => Promise<void>;
+/** The cron expressions of a schedule map, as literal types. */
+type ScheduleExpression<Schedules extends Readonly<Record<string, string>>> = Schedules[keyof Schedules];
+/** The Cloudflare `scheduled` export, with the application's dependencies as its second argument. */
+type ScheduledHandler<Deps> = (controller: ScheduledController, deps: Deps) => Promise<void>;
+/** What `defineSchedules` returns: the map, its parser, and the handler factory. */
+type AppSchedules<Schedules extends Readonly<Record<string, string>>> = {
+  readonly schedules: Schedules;
+  /** Parses `controller.cron`, a bare string from the platform, into a known expression. */
+  readonly schema: z.ZodType<ScheduleExpression<Schedules>>;
+  /**
+   * Route each schedule to its work. One run per expression, so a schedule added without
+   * work fails to compile. An expression Wrangler fires that the map does not know is logged
+   * once and ignored. A run that throws rejects, so Cloudflare marks the invocation failed.
+   */
+  handler<Deps>(runs: Readonly<Record<ScheduleExpression<Schedules>, ScheduledRun<Deps>>>): ScheduledHandler<Deps>;
+};
+/**
+ * Define the application's schedules once: `EVERY_MINUTE: '* * * * *'`. Keys name the time,
+ * not the work, because one schedule may drive several commands. Wrangler's `triggers.crons`
+ * must hold exactly these expressions. Cron does not retry: a run that sweeps many items
+ * catches each item's failure itself.
+ */
+export declare function defineSchedules<const Schedules extends Readonly<Record<string, string>>>(schedules: Schedules): AppSchedules<Schedules>;
+/**
+ * The id of a command a schedule issues: `cron:<Name>:<scheduledTime>`. A doubled trigger for
+ * the same time is then a duplicate by construction, and the unit of work skips it.
+ */
+export declare function scheduledMessageId(name: string, at: Date): MessageId;
+//#endregion
+export type { AppSchedules, ScheduleExpression, ScheduledHandler, ScheduledRun };
+//# sourceMappingURL=scheduled.d.ts.map

package/dist/cloudflare/scheduled.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scheduled.d.ts","names":[],"sources":["../../src/infrastructure/cloudflare/scheduled/scheduled-handler.ts"],"mappings":";;;;KAOY,aAAa,SAAS,MAAM,MAAM,IAAI,SAAS;;KAG/C,mBAAmB,kBAAkB,SAAS,2BACxD,gBAAgB;;KAGN,iBAAiB,SAAS,YAAY,qBAAqB,MAAM,SAAS;;KAG1E,aAAa,kBAAkB,SAAS;WACzC,WAAW;;WAEX,QAAQ,EAAE,QAAQ,mBAAmB;;;;;;EAM9C,QAAQ,MACN,MAAM,SAAS,OAAO,mBAAmB,YAAY,aAAa,UACjE,iBAAiB;;;;;;;;wBASN,sBAAsB,kBAAkB,SAAS,yBAC/D,WAAW,YACV,aAAa;;;;;wBAoBA,mBAAmB,cAAc,IAAI,OAAO"}

package/dist/cloudflare/scheduled.js

@@ -0,0 +1,37 @@
+import { a as createLogger } from "../core-DC_4pOrI.js";
+import { z } from "zod";
+
+//#region src/infrastructure/cloudflare/scheduled/scheduled-handler.ts
+const logger = createLogger("scheduled");
+/**
+* Define the application's schedules once: `EVERY_MINUTE: '* * * * *'`. Keys name the time,
+* not the work, because one schedule may drive several commands. Wrangler's `triggers.crons`
+* must hold exactly these expressions. Cron does not retry: a run that sweeps many items
+* catches each item's failure itself.
+*/
+function defineSchedules(schedules) {
+	const schema = z.enum(schedules);
+	return {
+		schedules,
+		schema,
+		handler: (runs) => async (controller, deps) => {
+			const { cron } = controller;
+			if (!schema.validate(cron)) {
+				logger.error("scheduled_unknown_cron", { details: { cron } });
+				return;
+			}
+			await runs[cron](deps, new Date(controller.scheduledTime));
+		}
+	};
+}
+/**
+* The id of a command a schedule issues: `cron:<Name>:<scheduledTime>`. A doubled trigger for
+* the same time is then a duplicate by construction, and the unit of work skips it.
+*/
+function scheduledMessageId(name, at) {
+	return `cron:${name}:${String(at.getTime())}`;
+}
+
+//#endregion
+export { defineSchedules, scheduledMessageId };
+//# sourceMappingURL=scheduled.js.map

package/dist/cloudflare/scheduled.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scheduled.js","names":[],"sources":["../../src/infrastructure/cloudflare/scheduled/scheduled-handler.ts"],"sourcesContent":["import { z } from 'zod'\n\nimport { createLogger, type MessageId } from '@/core'\n\nconst logger = createLogger('scheduled')\n\n/** The work one schedule runs. Nothing returns to the platform, so each run reports its own outcome. */\nexport type ScheduledRun<Deps> = (deps: Deps, at: Date) => Promise<void>\n\n/** The cron expressions of a schedule map, as literal types. */\nexport type ScheduleExpression<Schedules extends Readonly<Record<string, string>>> =\n  Schedules[keyof Schedules]\n\n/** The Cloudflare `scheduled` export, with the application's dependencies as its second argument. */\nexport type ScheduledHandler<Deps> = (controller: ScheduledController, deps: Deps) => Promise<void>\n\n/** What `defineSchedules` returns: the map, its parser, and the handler factory. */\nexport type AppSchedules<Schedules extends Readonly<Record<string, string>>> = {\n  readonly schedules: Schedules\n  /** Parses `controller.cron`, a bare string from the platform, into a known expression. */\n  readonly schema: z.ZodType<ScheduleExpression<Schedules>>\n  /**\n   * Route each schedule to its work. One run per expression, so a schedule added without\n   * work fails to compile. An expression Wrangler fires that the map does not know is logged\n   * once and ignored. A run that throws rejects, so Cloudflare marks the invocation failed.\n   */\n  handler<Deps>(\n    runs: Readonly<Record<ScheduleExpression<Schedules>, ScheduledRun<Deps>>>,\n  ): ScheduledHandler<Deps>\n}\n\n/**\n * Define the application's schedules once: `EVERY_MINUTE: '* * * * *'`. Keys name the time,\n * not the work, because one schedule may drive several commands. Wrangler's `triggers.crons`\n * must hold exactly these expressions. Cron does not retry: a run that sweeps many items\n * catches each item's failure itself.\n */\nexport function defineSchedules<const Schedules extends Readonly<Record<string, string>>>(\n  schedules: Schedules,\n): AppSchedules<Schedules> {\n  const schema = z.enum(schedules)\n  return {\n    schedules,\n    schema,\n    handler: (runs) => async (controller, deps) => {\n      const { cron } = controller\n      if (!schema.validate(cron)) {\n        logger.error('scheduled_unknown_cron', { details: { cron } })\n        return\n      }\n      await runs[cron](deps, new Date(controller.scheduledTime))\n    },\n  }\n}\n\n/**\n * The id of a command a schedule issues: `cron:<Name>:<scheduledTime>`. A doubled trigger for\n * the same time is then a duplicate by construction, and the unit of work skips it.\n */\nexport function scheduledMessageId(name: string, at: Date): MessageId {\n  return `cron:${name}:${String(at.getTime())}`\n}\n"],"mappings":";;;;AAIA,MAAM,SAAS,aAAa,WAAW;;;;;;;AAiCvC,SAAgB,gBACd,WACyB;CACzB,MAAM,SAAS,EAAE,KAAK,SAAS;CAC/B,OAAO;EACL;EACA;EACA,UAAU,SAAS,OAAO,YAAY,SAAS;GAC7C,MAAM,EAAE,SAAS;GACjB,IAAI,CAAC,OAAO,SAAS,IAAI,GAAG;IAC1B,OAAO,MAAM,0BAA0B,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC5D;GACF;GACA,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,KAAK,WAAW,aAAa,CAAC;EAC3D;CACF;AACF;;;;;AAMA,SAAgB,mBAAmB,MAAc,IAAqB;CACpE,OAAO,QAAQ,KAAK,GAAG,OAAO,GAAG,QAAQ,CAAC;AAC5C"}

package/dist/tanstack.d.ts

@@ -1,7 +1,19 @@
 import { ot as ErrorTable } from "./index-6XMPJu7u.js";
-import { Register, RequestServerOptions } from "@tanstack/react-start";
-import { AnyRedirect } from "@tanstack/react-router";
+import { Register } from "@tanstack/react-start";
 import { BetterAuthCookies } from "better-auth";
+//#region src/infrastructure/tanstack/request-context.d.ts
+/**
+ * The request context an application registers as `Register.server.requestContext`.
+ * TanStack's own request context type also reads `Register.config`, which lists the middleware
+ * whose options carry this type, so using it here would make every application's types circular.
+ * Without a registration TanStack passes no context, so the fallback is `undefined`.
+ */
+type RequestContext = Register extends {
+  server: {
+    requestContext: infer Context;
+  };
+} ? Context : undefined;
+//#endregion
 //#region src/infrastructure/tanstack/auth.middleware.d.ts
 /** The fields middleware reads; generic callers retain every additional session and user field. */
 type AuthSession = {
@@ -24,7 +36,7 @@ type AuthContext<Session extends AuthSession> = RequiredAuthContext<Session> | {
 };
 /** Select the current request's Better Auth instance from TanStack's registered context. */
 type AuthMiddlewareOptions<Session extends AuthSession> = {
-  readonly getAuth: (context: RequestServerOptions<Register, undefined>['context']) => {
+  readonly getAuth: (context: RequestContext) => {
     readonly api: {
       readonly getSession: (options: {
         headers: Headers;
@@ -43,7 +55,6 @@ export declare function createAuthMiddleware<Session extends AuthSession>(option
 };
 //#endregion
 //#region src/infrastructure/tanstack/error.middleware.d.ts
-type RequestContext = RequestServerOptions<Register, undefined>['context'];
 /** The part of a Better Auth instance the boundary reads: its computed cookie definitions. */
 type AuthCookieSource = {
   readonly $context: Promise<{
@@ -53,8 +64,8 @@ type AuthCookieSource = {
 /** The application's error table, its stale-session redirect, and its Better Auth instance. */
 type ErrorMiddlewareOptions<Entries> = {
   readonly errors: ErrorTable<Entries>;
-  /** Build the redirect a server function throws for a stale session. */
-  readonly signIn: () => AnyRedirect;
+  /** The path a server function redirects to for a stale session, with any search string. */
+  readonly signIn: string;
   /** Select the request's Better Auth instance; its cookie definitions say what to clear. */
   readonly getAuth: (context: RequestContext) => AuthCookieSource;
 };

package/dist/tanstack.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tanstack.d.ts","names":[],"sources":["../src/infrastructure/tanstack/auth.middleware.ts","../src/infrastructure/tanstack/error.middleware.ts","../src/infrastructure/tanstack/last-login-method.ts"],"mappings":";;;;;;KASY;WACD;aAAiB;;WACjB;aAAoB;;;;KAInB,oBAAoB,gBAAgB;WACrC,MAAM;WACN,SAAS;;;KAIR,YAAY,gBAAgB,eACpC,oBAAoB;WAET;WACA;;;KAIH,sBAAsB,gBAAgB;WACvC,UAAU,SAAS,qBAAqB;aACtC;eACE,aAAa;QAAW,SAAS;YAAc,QAAQ;;;;;;;;wBAStD,qBAAqB,gBAAgB,aACnD,SAAS,sBAAsB;;;;;;;KChC5B,iBAAiB,qBAAqB;;KAG/B;WACD,UAAU;aAAmB,aAAa;;;;KAIzC,uBAAuB;WACxB,QAAQ,WAAW;;WAEnB,cAAc;;WAEd,UAAU,SAAS,mBAAmB;;;;;;wBAOjC,sBAAsB,SAAS,SAAS,uBAAuB;;;;;;;;;;;;;;;;;;;;wBCpB/D,uBAAuB"}
+{"version":3,"file":"tanstack.d.ts","names":[],"sources":["../src/infrastructure/tanstack/request-context.ts","../src/infrastructure/tanstack/auth.middleware.ts","../src/infrastructure/tanstack/error.middleware.ts","../src/infrastructure/tanstack/last-login-method.ts"],"mappings":";;;;;;;;;;KAQY,iBAAiB;EAAmB;IAAU,sBAAsB;;IAC5E;;;;KCEQ;WACD;aAAiB;;WACjB;aAAoB;;;;KAInB,oBAAoB,gBAAgB;WACrC,MAAM;WACN,SAAS;;;KAIR,YAAY,gBAAgB,eACpC,oBAAoB;WAET;WACA;;;KAIH,sBAAsB,gBAAgB;WACvC,UAAU,SAAS;aACjB;eACE,aAAa;QAAW,SAAS;YAAc,QAAQ;;;;;;;;wBAStD,qBAAqB,gBAAgB,aACnD,SAAS,sBAAsB;;;;;;;;KChCrB;WACD,UAAU;aAAmB,aAAa;;;;KAIzC,uBAAuB;WACxB,QAAQ,WAAW;;WAEnB;;WAEA,UAAU,SAAS,mBAAmB;;;;;;wBAOjC,sBAAsB,SAAS,SAAS,uBAAuB;;;;;;;;;;;;;;;;;;;;wBCnB/D,uBAAuB"}

package/dist/tanstack.js

@@ -3,7 +3,7 @@ import { z } from "zod";
 import { createMiddleware } from "@tanstack/react-start";
 import { deleteCookie, getRequestHeaders } from "@tanstack/react-start/server";
 import { getSessionCookie, parseCookies } from "better-auth/cookies";
-import { isNotFound, isRedirect } from "@tanstack/react-router";
+import { isNotFound, isRedirect, redirect } from "@tanstack/react-router";
 import { getReasonPhrase } from "http-status-codes";
 
 //#region src/infrastructure/tanstack/auth.middleware.ts
@@ -180,7 +180,7 @@ function createErrorMiddleware(options) {
 		if (isNotFound(cause) || isRedirect(cause)) throw cause;
 		if (cause instanceof StaleSessionError) {
 			await clearSession(context);
-			throw options.signIn();
+			throw redirect({ href: options.signIn });
 		}
 		throw toErrorPayload(cause);
 	}

package/dist/tanstack.js.map

@@ -1 +1 @@
-{"version":3,"file":"tanstack.js","names":["logger"],"sources":["../src/infrastructure/tanstack/auth.middleware.ts","../src/infrastructure/tanstack/resolve-failure.ts","../src/infrastructure/tanstack/http-error-response.ts","../src/infrastructure/tanstack/session-cookies.ts","../src/infrastructure/tanstack/to-error-payload.ts","../src/infrastructure/tanstack/error.middleware.ts","../src/infrastructure/tanstack/last-login-method.ts"],"sourcesContent":["import { createMiddleware, type Register, type RequestServerOptions } from '@tanstack/react-start'\nimport { getRequestHeaders } from '@tanstack/react-start/server'\nimport { getSessionCookie } from 'better-auth/cookies'\n\nimport { AuthenticationError, StaleSessionError, createLogger } from '@/core'\n\nconst logger = createLogger('auth-middleware')\n\n/** The fields middleware reads; generic callers retain every additional session and user field. */\nexport type AuthSession = {\n  readonly user: { readonly id: string }\n  readonly session: { readonly id: string }\n}\n\n/** Authenticated context retains the application's complete user and session types. */\nexport type RequiredAuthContext<Session extends AuthSession> = {\n  readonly user: Session['user']\n  readonly session: Session['session']\n}\n\n/** Optional authentication supplies both fields together or neither field. */\nexport type AuthContext<Session extends AuthSession> =\n  | RequiredAuthContext<Session>\n  | {\n      readonly user: undefined\n      readonly session: undefined\n    }\n\n/** Select the current request's Better Auth instance from TanStack's registered context. */\nexport type AuthMiddlewareOptions<Session extends AuthSession> = {\n  readonly getAuth: (context: RequestServerOptions<Register, undefined>['context']) => {\n    readonly api: {\n      readonly getSession: (options: { headers: Headers }) => Promise<Session | null>\n    }\n  }\n}\n\n/**\n * Preserve Porte's function and request middleware contracts with application-owned services.\n * Optional lookup failures log once and continue as guests. Required lookup failures propagate.\n */\nexport function createAuthMiddleware<Session extends AuthSession>(\n  options: AuthMiddlewareOptions<Session>,\n) {\n  const extractAuth = createMiddleware({ type: 'function' }).server<AuthContext<Session>>(\n    async ({ next, context }) => {\n      let resolved: Session | null\n      try {\n        resolved = await options.getAuth(context).api.getSession({ headers: getRequestHeaders() })\n      } catch (error) {\n        logger.error('get_session_failed', { error })\n        resolved = null\n      }\n      if (resolved === null)\n        return next<AuthContext<Session>>({ context: { user: undefined, session: undefined } })\n      return next<AuthContext<Session>>({\n        context: { user: resolved.user, session: resolved.session },\n      })\n    },\n  )\n\n  async function resolveRequiredSession(\n    context: RequestServerOptions<Register, undefined>['context'],\n    headers: Headers,\n  ): Promise<Session> {\n    const resolved = await options.getAuth(context).api.getSession({ headers })\n    if (resolved === null) {\n      if (getSessionCookie(headers)) throw new StaleSessionError()\n      throw new AuthenticationError()\n    }\n    return resolved\n  }\n\n  const requireAuth = createMiddleware({ type: 'function' }).server(async ({ next, context }) => {\n    const resolved = await resolveRequiredSession(context, getRequestHeaders())\n    return next<RequiredAuthContext<Session>>({\n      context: { user: resolved.user, session: resolved.session },\n    })\n  })\n  const requireAuthRequest = createMiddleware({ type: 'request' }).server(\n    async ({ request, next, context }) => {\n      const resolved = await resolveRequiredSession(context, request.headers)\n      return next<RequiredAuthContext<Session>>({\n        context: { user: resolved.user, session: resolved.session },\n      })\n    },\n  )\n  return { extractAuth, requireAuth, requireAuthRequest }\n}\n","import { AppError, createLogger, type ErrorTable, type ResolvedError } from '@/core'\nimport type { ErrorPayloadOf } from '@/core'\n\nconst logger = createLogger('error-boundary')\n\n/**\n * Resolve one failure through the table or fall back to the generic replacement, and log it once.\n * Both transport converters call this, so one rule decides the log level: mapped is a warning, unmapped is an error with the cause.\n */\nexport function resolveFailure<Entries>(\n  table: ErrorTable<Entries>,\n  cause: unknown,\n): ResolvedError<ErrorPayloadOf<ErrorTable<Entries>>> {\n  const resolved = table.resolve(cause)\n  if (resolved !== null) {\n    logger.warn('handled_error', {\n      details: { tag: resolved.payload._tag, status: resolved.status },\n    })\n    return resolved\n  }\n  const classification = cause instanceof AppError ? cause.classification : 'unknown'\n  logger.error('unexpected_error', { error: cause, details: { classification } })\n  return table.fallback(cause)\n}\n","import { getReasonPhrase } from 'http-status-codes'\nimport { z } from 'zod'\n\nimport type { ErrorTable, ProblemDetails } from '@/core'\n\nimport { resolveFailure } from './resolve-failure.ts'\n\n// A known delay becomes the header; a null delay sends no header.\nconst RetryAfterSchema = z.object({ retryAfter: z.number() })\n\n/**\n * Build the API route converter for one error table.\n * The body is RFC 9457 problem details; public fields become extension members.\n */\nexport function createHttpErrorResponseConverter<Entries>(table: ErrorTable<Entries>) {\n  return function toHttpErrorResponse(cause: unknown): Response {\n    const { status, payload } = resolveFailure(table, cause)\n    const { _tag, message, ...fields } = payload\n    const body: ProblemDetails = {\n      type: 'about:blank',\n      title: getReasonPhrase(status),\n      detail: message,\n      ...fields,\n    }\n    const headers = new Headers({ 'Content-Type': 'application/problem+json' })\n    const retry = RetryAfterSchema.safeParse(payload)\n    if (retry.success) headers.set('Retry-After', String(retry.data.retryAfter))\n    return Response.json(body, { status, headers })\n  }\n}\n","import { deleteCookie, getRequestHeaders } from '@tanstack/react-start/server'\nimport type { BetterAuthCookies } from 'better-auth'\nimport { parseCookies } from 'better-auth/cookies'\n\ntype AuthCookie = BetterAuthCookies['sessionToken']\ntype DeleteCookieOptions = NonNullable<Parameters<typeof deleteCookie>[1]>\n\n/**\n * Delete the session, session cache, account cache, and remember-me cookies of one instance.\n * Chunks present on the request go too. Names and attributes come from the instance, so custom prefixes and domain cookies clear.\n */\nexport function clearStaleSessionCookies(cookies: BetterAuthCookies): void {\n  const present = [...parseCookies(getRequestHeaders().get('cookie') ?? '').keys()]\n  const definitions = [\n    cookies.sessionToken,\n    cookies.sessionData,\n    cookies.accountData,\n    cookies.dontRememberToken,\n  ]\n  for (const cookie of definitions) {\n    // Better Auth names a chunk `${name}.${index}`, so a missed chunk would resurrect the value.\n    const chunks = present.filter((name) => name.startsWith(`${cookie.name}.`))\n    for (const name of new Set([cookie.name, ...chunks]))\n      deleteCookie(name, deletionOf(cookie.attributes))\n  }\n}\n\nfunction deletionOf(attributes: AuthCookie['attributes']): DeleteCookieOptions {\n  // Better Auth sets `/` and the secure flag at runtime; the types leave both optional.\n  const options: DeleteCookieOptions = {\n    path: attributes.path ?? '/',\n    secure: attributes.secure ?? false,\n  }\n  if (attributes.domain !== undefined) options.domain = attributes.domain\n  return options\n}\n","import { z } from 'zod'\n\nimport { ValidationError, type ErrorPayloadOf, type ErrorTable } from '@/core'\n\nimport { resolveFailure } from './resolve-failure.ts'\n\n// TanStack serializes a validator's issues into `Error.message` as JSON.\nconst SerializedIssuesSchema = z\n  .array(z.object({ message: z.string(), path: z.array(z.union([z.string(), z.number()])) }))\n  .min(1)\n\nfunction reconstructValidationError(cause: unknown): ValidationError | null {\n  if (!(cause instanceof Error)) return null\n  let message: unknown\n  try {\n    message = JSON.parse(cause.message)\n  } catch {\n    return null\n  }\n  const parsed = SerializedIssuesSchema.safeParse(message)\n  return parsed.success ? ValidationError.fromIssues(parsed.data) : null\n}\n\n/**\n * Build the server-function converter for one error table.\n * The result is a plain object, because only own data survives serialization.\n */\nexport function createErrorPayloadConverter<Entries>(table: ErrorTable<Entries>) {\n  return function toErrorPayload(cause: unknown): ErrorPayloadOf<ErrorTable<Entries>> {\n    return resolveFailure(table, reconstructValidationError(cause) ?? cause).payload\n  }\n}\n","import { isNotFound, isRedirect, type AnyRedirect } from '@tanstack/react-router'\nimport { createMiddleware, type Register, type RequestServerOptions } from '@tanstack/react-start'\nimport type { BetterAuthCookies } from 'better-auth'\n\nimport { StaleSessionError, type ErrorTable } from '@/core'\n\nimport { createHttpErrorResponseConverter } from './http-error-response.ts'\nimport { clearStaleSessionCookies } from './session-cookies.ts'\nimport { createErrorPayloadConverter } from './to-error-payload.ts'\n\ntype RequestContext = RequestServerOptions<Register, undefined>['context']\n\n/** The part of a Better Auth instance the boundary reads: its computed cookie definitions. */\nexport type AuthCookieSource = {\n  readonly $context: Promise<{ readonly authCookies: BetterAuthCookies }>\n}\n\n/** The application's error table, its stale-session redirect, and its Better Auth instance. */\nexport type ErrorMiddlewareOptions<Entries> = {\n  readonly errors: ErrorTable<Entries>\n  /** Build the redirect a server function throws for a stale session. */\n  readonly signIn: () => AnyRedirect\n  /** Select the request's Better Auth instance; its cookie definitions say what to clear. */\n  readonly getAuth: (context: RequestContext) => AuthCookieSource\n}\n\n/**\n * Build both transport boundaries from one error table.\n * Register `functionErrorMiddleware` globally. Put `routeErrorMiddleware` first in an API route's `server.middleware`.\n */\nexport function createErrorMiddleware<Entries>(options: ErrorMiddlewareOptions<Entries>) {\n  const toErrorPayload = createErrorPayloadConverter(options.errors)\n  const toHttpErrorResponse = createHttpErrorResponseConverter(options.errors)\n\n  async function clearSession(context: RequestContext): Promise<void> {\n    const { authCookies } = await options.getAuth(context).$context\n    clearStaleSessionCookies(authCookies)\n  }\n\n  async function handleFunctionError(cause: unknown, context: RequestContext): Promise<never> {\n    // oxlint-disable-next-line typescript/only-throw-error -- TanStack uses throwable control-flow objects.\n    if (isNotFound(cause) || isRedirect(cause)) throw cause\n    if (cause instanceof StaleSessionError) {\n      await clearSession(context)\n      // oxlint-disable-next-line typescript/only-throw-error -- Router redirects by throwing this.\n      throw options.signIn()\n    }\n    // oxlint-disable-next-line typescript/only-throw-error -- The client rejects with this and reads its tag.\n    throw toErrorPayload(cause)\n  }\n\n  // A route answers 401 instead of a redirect because fetch would follow it into the HTML shell.\n  async function handleRouteError(cause: unknown, context: RequestContext): Promise<Response> {\n    // oxlint-disable-next-line typescript/only-throw-error -- TanStack uses throwable control-flow objects.\n    if (isNotFound(cause) || isRedirect(cause)) throw cause\n    if (cause instanceof StaleSessionError) await clearSession(context)\n    return toHttpErrorResponse(cause)\n  }\n\n  const functionErrorMiddleware = createMiddleware({ type: 'function' }).server(\n    async ({ next, context }) => {\n      try {\n        return await next()\n      } catch (cause) {\n        return handleFunctionError(cause, context)\n      }\n    },\n  )\n\n  const routeErrorMiddleware = createMiddleware({ type: 'request' }).server(\n    async ({ next, context }) => {\n      try {\n        return await next()\n      } catch (cause) {\n        return handleRouteError(cause, context)\n      }\n    },\n  )\n\n  return { functionErrorMiddleware, routeErrorMiddleware, toErrorPayload, toHttpErrorResponse }\n}\n","import { getRequestHeaders } from '@tanstack/react-start/server'\nimport { parseCookies } from 'better-auth/cookies'\n\n// Better Auth keeps the plugin default private; this is the value LastLoginMethodOptions.cookieName documents.\nconst DEFAULT_COOKIE_NAME = 'better-auth.last_used_login_method'\n\n/**\n * Read the method this browser last signed in with from the current request, for the sign-in loader on the server.\n * Pass `cookieName` only when `integrations.lastLoginMethod.cookieName` is set. Returns `null` when the cookie is absent.\n */\nexport function getLastUsedLoginMethod(cookieName = DEFAULT_COOKIE_NAME): string | null {\n  return parseCookies(getRequestHeaders().get('cookie') ?? '').get(cookieName) ?? null\n}\n"],"mappings":";;;;;;;;;AAMA,MAAMA,WAAS,aAAa,iBAAiB;;;;;AAmC7C,SAAgB,qBACd,SACA;CACA,MAAM,cAAc,iBAAiB,EAAE,MAAM,WAAW,CAAC,CAAC,CAAC,OACzD,OAAO,EAAE,MAAM,cAAc;EAC3B,IAAI;EACJ,IAAI;GACF,WAAW,MAAM,QAAQ,QAAQ,OAAO,CAAC,CAAC,IAAI,WAAW,EAAE,SAAS,kBAAkB,EAAE,CAAC;EAC3F,SAAS,OAAO;GACd,SAAO,MAAM,sBAAsB,EAAE,MAAM,CAAC;GAC5C,WAAW;EACb;EACA,IAAI,aAAa,MACf,OAAO,KAA2B,EAAE,SAAS;GAAE,MAAM;GAAW,SAAS;EAAU,EAAE,CAAC;EACxF,OAAO,KAA2B,EAChC,SAAS;GAAE,MAAM,SAAS;GAAM,SAAS,SAAS;EAAQ,EAC5D,CAAC;CACH,CACF;CAEA,eAAe,uBACb,SACA,SACkB;EAClB,MAAM,WAAW,MAAM,QAAQ,QAAQ,OAAO,CAAC,CAAC,IAAI,WAAW,EAAE,QAAQ,CAAC;EAC1E,IAAI,aAAa,MAAM;GACrB,IAAI,iBAAiB,OAAO,GAAG,MAAM,IAAI,kBAAkB;GAC3D,MAAM,IAAI,oBAAoB;EAChC;EACA,OAAO;CACT;CAgBA,OAAO;EAAE;EAAa,aAdF,iBAAiB,EAAE,MAAM,WAAW,CAAC,CAAC,CAAC,OAAO,OAAO,EAAE,MAAM,cAAc;GAC7F,MAAM,WAAW,MAAM,uBAAuB,SAAS,kBAAkB,CAAC;GAC1E,OAAO,KAAmC,EACxC,SAAS;IAAE,MAAM,SAAS;IAAM,SAAS,SAAS;GAAQ,EAC5D,CAAC;EACH,CASgC;EAAG,oBARR,iBAAiB,EAAE,MAAM,UAAU,CAAC,CAAC,CAAC,OAC/D,OAAO,EAAE,SAAS,MAAM,cAAc;GACpC,MAAM,WAAW,MAAM,uBAAuB,SAAS,QAAQ,OAAO;GACtE,OAAO,KAAmC,EACxC,SAAS;IAAE,MAAM,SAAS;IAAM,SAAS,SAAS;GAAQ,EAC5D,CAAC;EACH,CAEkD;CAAE;AACxD;;;;ACrFA,MAAM,SAAS,aAAa,gBAAgB;;;;;AAM5C,SAAgB,eACd,OACA,OACoD;CACpD,MAAM,WAAW,MAAM,QAAQ,KAAK;CACpC,IAAI,aAAa,MAAM;EACrB,OAAO,KAAK,iBAAiB,EAC3B,SAAS;GAAE,KAAK,SAAS,QAAQ;GAAM,QAAQ,SAAS;EAAO,EACjE,CAAC;EACD,OAAO;CACT;CACA,MAAM,iBAAiB,iBAAiB,WAAW,MAAM,iBAAiB;CAC1E,OAAO,MAAM,oBAAoB;EAAE,OAAO;EAAO,SAAS,EAAE,eAAe;CAAE,CAAC;CAC9E,OAAO,MAAM,SAAS,KAAK;AAC7B;;;;ACfA,MAAM,mBAAmB,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;;;;;AAM5D,SAAgB,iCAA0C,OAA4B;CACpF,OAAO,SAAS,oBAAoB,OAA0B;EAC5D,MAAM,EAAE,QAAQ,YAAY,eAAe,OAAO,KAAK;EACvD,MAAM,EAAE,MAAM,SAAS,GAAG,WAAW;EACrC,MAAM,OAAuB;GAC3B,MAAM;GACN,OAAO,gBAAgB,MAAM;GAC7B,QAAQ;GACR,GAAG;EACL;EACA,MAAM,UAAU,IAAI,QAAQ,EAAE,gBAAgB,2BAA2B,CAAC;EAC1E,MAAM,QAAQ,iBAAiB,UAAU,OAAO;EAChD,IAAI,MAAM,SAAS,QAAQ,IAAI,eAAe,OAAO,MAAM,KAAK,UAAU,CAAC;EAC3E,OAAO,SAAS,KAAK,MAAM;GAAE;GAAQ;EAAQ,CAAC;CAChD;AACF;;;;;;;;AClBA,SAAgB,yBAAyB,SAAkC;CACzE,MAAM,UAAU,CAAC,GAAG,aAAa,kBAAkB,CAAC,CAAC,IAAI,QAAQ,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC;CAChF,MAAM,cAAc;EAClB,QAAQ;EACR,QAAQ;EACR,QAAQ;EACR,QAAQ;CACV;CACA,KAAK,MAAM,UAAU,aAAa;EAEhC,MAAM,SAAS,QAAQ,QAAQ,SAAS,KAAK,WAAW,GAAG,OAAO,KAAK,EAAE,CAAC;EAC1E,KAAK,MAAM,wBAAQ,IAAI,IAAI,CAAC,OAAO,MAAM,GAAG,MAAM,CAAC,GACjD,aAAa,MAAM,WAAW,OAAO,UAAU,CAAC;CACpD;AACF;AAEA,SAAS,WAAW,YAA2D;CAE7E,MAAM,UAA+B;EACnC,MAAM,WAAW,QAAQ;EACzB,QAAQ,WAAW,UAAU;CAC/B;CACA,IAAI,WAAW,WAAW,QAAW,QAAQ,SAAS,WAAW;CACjE,OAAO;AACT;;;;AC5BA,MAAM,yBAAyB,EAC5B,MAAM,EAAE,OAAO;CAAE,SAAS,EAAE,OAAO;CAAG,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;AAAE,CAAC,CAAC,CAAC,CAC1F,IAAI,CAAC;AAER,SAAS,2BAA2B,OAAwC;CAC1E,IAAI,EAAE,iBAAiB,QAAQ,OAAO;CACtC,IAAI;CACJ,IAAI;EACF,UAAU,KAAK,MAAM,MAAM,OAAO;CACpC,QAAQ;EACN,OAAO;CACT;CACA,MAAM,SAAS,uBAAuB,UAAU,OAAO;CACvD,OAAO,OAAO,UAAU,gBAAgB,WAAW,OAAO,IAAI,IAAI;AACpE;;;;;AAMA,SAAgB,4BAAqC,OAA4B;CAC/E,OAAO,SAAS,eAAe,OAAqD;EAClF,OAAO,eAAe,OAAO,2BAA2B,KAAK,KAAK,KAAK,CAAC,CAAC;CAC3E;AACF;;;;;;;;ACDA,SAAgB,sBAA+B,SAA0C;CACvF,MAAM,iBAAiB,4BAA4B,QAAQ,MAAM;CACjE,MAAM,sBAAsB,iCAAiC,QAAQ,MAAM;CAE3E,eAAe,aAAa,SAAwC;EAClE,MAAM,EAAE,gBAAgB,MAAM,QAAQ,QAAQ,OAAO,CAAC,CAAC;EACvD,yBAAyB,WAAW;CACtC;CAEA,eAAe,oBAAoB,OAAgB,SAAyC;EAE1F,IAAI,WAAW,KAAK,KAAK,WAAW,KAAK,GAAG,MAAM;EAClD,IAAI,iBAAiB,mBAAmB;GACtC,MAAM,aAAa,OAAO;GAE1B,MAAM,QAAQ,OAAO;EACvB;EAEA,MAAM,eAAe,KAAK;CAC5B;CAGA,eAAe,iBAAiB,OAAgB,SAA4C;EAE1F,IAAI,WAAW,KAAK,KAAK,WAAW,KAAK,GAAG,MAAM;EAClD,IAAI,iBAAiB,mBAAmB,MAAM,aAAa,OAAO;EAClE,OAAO,oBAAoB,KAAK;CAClC;CAsBA,OAAO;EAAE,yBApBuB,iBAAiB,EAAE,MAAM,WAAW,CAAC,CAAC,CAAC,OACrE,OAAO,EAAE,MAAM,cAAc;GAC3B,IAAI;IACF,OAAO,MAAM,KAAK;GACpB,SAAS,OAAO;IACd,OAAO,oBAAoB,OAAO,OAAO;GAC3C;EACF,CAa6B;EAAG,sBAVL,iBAAiB,EAAE,MAAM,UAAU,CAAC,CAAC,CAAC,OACjE,OAAO,EAAE,MAAM,cAAc;GAC3B,IAAI;IACF,OAAO,MAAM,KAAK;GACpB,SAAS,OAAO;IACd,OAAO,iBAAiB,OAAO,OAAO;GACxC;EACF,CAGmD;EAAG;EAAgB;CAAoB;AAC9F;;;;AC5EA,MAAM,sBAAsB;;;;;AAM5B,SAAgB,uBAAuB,aAAa,qBAAoC;CACtF,OAAO,aAAa,kBAAkB,CAAC,CAAC,IAAI,QAAQ,KAAK,EAAE,CAAC,CAAC,IAAI,UAAU,KAAK;AAClF"}
+{"version":3,"file":"tanstack.js","names":["logger"],"sources":["../src/infrastructure/tanstack/auth.middleware.ts","../src/infrastructure/tanstack/resolve-failure.ts","../src/infrastructure/tanstack/http-error-response.ts","../src/infrastructure/tanstack/session-cookies.ts","../src/infrastructure/tanstack/to-error-payload.ts","../src/infrastructure/tanstack/error.middleware.ts","../src/infrastructure/tanstack/last-login-method.ts"],"sourcesContent":["import { createMiddleware } from '@tanstack/react-start'\nimport { getRequestHeaders } from '@tanstack/react-start/server'\nimport { getSessionCookie } from 'better-auth/cookies'\n\nimport { AuthenticationError, StaleSessionError, createLogger } from '@/core'\n\nimport type { RequestContext } from './request-context.ts'\n\nconst logger = createLogger('auth-middleware')\n\n/** The fields middleware reads; generic callers retain every additional session and user field. */\nexport type AuthSession = {\n  readonly user: { readonly id: string }\n  readonly session: { readonly id: string }\n}\n\n/** Authenticated context retains the application's complete user and session types. */\nexport type RequiredAuthContext<Session extends AuthSession> = {\n  readonly user: Session['user']\n  readonly session: Session['session']\n}\n\n/** Optional authentication supplies both fields together or neither field. */\nexport type AuthContext<Session extends AuthSession> =\n  | RequiredAuthContext<Session>\n  | {\n      readonly user: undefined\n      readonly session: undefined\n    }\n\n/** Select the current request's Better Auth instance from TanStack's registered context. */\nexport type AuthMiddlewareOptions<Session extends AuthSession> = {\n  readonly getAuth: (context: RequestContext) => {\n    readonly api: {\n      readonly getSession: (options: { headers: Headers }) => Promise<Session | null>\n    }\n  }\n}\n\n/**\n * Preserve Porte's function and request middleware contracts with application-owned services.\n * Optional lookup failures log once and continue as guests. Required lookup failures propagate.\n */\nexport function createAuthMiddleware<Session extends AuthSession>(\n  options: AuthMiddlewareOptions<Session>,\n) {\n  const extractAuth = createMiddleware({ type: 'function' }).server<AuthContext<Session>>(\n    async ({ next, context }) => {\n      let resolved: Session | null\n      try {\n        resolved = await options.getAuth(context).api.getSession({ headers: getRequestHeaders() })\n      } catch (error) {\n        logger.error('get_session_failed', { error })\n        resolved = null\n      }\n      if (resolved === null)\n        return next<AuthContext<Session>>({ context: { user: undefined, session: undefined } })\n      return next<AuthContext<Session>>({\n        context: { user: resolved.user, session: resolved.session },\n      })\n    },\n  )\n\n  async function resolveRequiredSession(\n    context: RequestContext,\n    headers: Headers,\n  ): Promise<Session> {\n    const resolved = await options.getAuth(context).api.getSession({ headers })\n    if (resolved === null) {\n      if (getSessionCookie(headers)) throw new StaleSessionError()\n      throw new AuthenticationError()\n    }\n    return resolved\n  }\n\n  const requireAuth = createMiddleware({ type: 'function' }).server(async ({ next, context }) => {\n    const resolved = await resolveRequiredSession(context, getRequestHeaders())\n    return next<RequiredAuthContext<Session>>({\n      context: { user: resolved.user, session: resolved.session },\n    })\n  })\n  const requireAuthRequest = createMiddleware({ type: 'request' }).server(\n    async ({ request, next, context }) => {\n      const resolved = await resolveRequiredSession(context, request.headers)\n      return next<RequiredAuthContext<Session>>({\n        context: { user: resolved.user, session: resolved.session },\n      })\n    },\n  )\n  return { extractAuth, requireAuth, requireAuthRequest }\n}\n","import { AppError, createLogger, type ErrorTable, type ResolvedError } from '@/core'\nimport type { ErrorPayloadOf } from '@/core'\n\nconst logger = createLogger('error-boundary')\n\n/**\n * Resolve one failure through the table or fall back to the generic replacement, and log it once.\n * Both transport converters call this, so one rule decides the log level: mapped is a warning, unmapped is an error with the cause.\n */\nexport function resolveFailure<Entries>(\n  table: ErrorTable<Entries>,\n  cause: unknown,\n): ResolvedError<ErrorPayloadOf<ErrorTable<Entries>>> {\n  const resolved = table.resolve(cause)\n  if (resolved !== null) {\n    logger.warn('handled_error', {\n      details: { tag: resolved.payload._tag, status: resolved.status },\n    })\n    return resolved\n  }\n  const classification = cause instanceof AppError ? cause.classification : 'unknown'\n  logger.error('unexpected_error', { error: cause, details: { classification } })\n  return table.fallback(cause)\n}\n","import { getReasonPhrase } from 'http-status-codes'\nimport { z } from 'zod'\n\nimport type { ErrorTable, ProblemDetails } from '@/core'\n\nimport { resolveFailure } from './resolve-failure.ts'\n\n// A known delay becomes the header; a null delay sends no header.\nconst RetryAfterSchema = z.object({ retryAfter: z.number() })\n\n/**\n * Build the API route converter for one error table.\n * The body is RFC 9457 problem details; public fields become extension members.\n */\nexport function createHttpErrorResponseConverter<Entries>(table: ErrorTable<Entries>) {\n  return function toHttpErrorResponse(cause: unknown): Response {\n    const { status, payload } = resolveFailure(table, cause)\n    const { _tag, message, ...fields } = payload\n    const body: ProblemDetails = {\n      type: 'about:blank',\n      title: getReasonPhrase(status),\n      detail: message,\n      ...fields,\n    }\n    const headers = new Headers({ 'Content-Type': 'application/problem+json' })\n    const retry = RetryAfterSchema.safeParse(payload)\n    if (retry.success) headers.set('Retry-After', String(retry.data.retryAfter))\n    return Response.json(body, { status, headers })\n  }\n}\n","import { deleteCookie, getRequestHeaders } from '@tanstack/react-start/server'\nimport type { BetterAuthCookies } from 'better-auth'\nimport { parseCookies } from 'better-auth/cookies'\n\ntype AuthCookie = BetterAuthCookies['sessionToken']\ntype DeleteCookieOptions = NonNullable<Parameters<typeof deleteCookie>[1]>\n\n/**\n * Delete the session, session cache, account cache, and remember-me cookies of one instance.\n * Chunks present on the request go too. Names and attributes come from the instance, so custom prefixes and domain cookies clear.\n */\nexport function clearStaleSessionCookies(cookies: BetterAuthCookies): void {\n  const present = [...parseCookies(getRequestHeaders().get('cookie') ?? '').keys()]\n  const definitions = [\n    cookies.sessionToken,\n    cookies.sessionData,\n    cookies.accountData,\n    cookies.dontRememberToken,\n  ]\n  for (const cookie of definitions) {\n    // Better Auth names a chunk `${name}.${index}`, so a missed chunk would resurrect the value.\n    const chunks = present.filter((name) => name.startsWith(`${cookie.name}.`))\n    for (const name of new Set([cookie.name, ...chunks]))\n      deleteCookie(name, deletionOf(cookie.attributes))\n  }\n}\n\nfunction deletionOf(attributes: AuthCookie['attributes']): DeleteCookieOptions {\n  // Better Auth sets `/` and the secure flag at runtime; the types leave both optional.\n  const options: DeleteCookieOptions = {\n    path: attributes.path ?? '/',\n    secure: attributes.secure ?? false,\n  }\n  if (attributes.domain !== undefined) options.domain = attributes.domain\n  return options\n}\n","import { z } from 'zod'\n\nimport { ValidationError, type ErrorPayloadOf, type ErrorTable } from '@/core'\n\nimport { resolveFailure } from './resolve-failure.ts'\n\n// TanStack serializes a validator's issues into `Error.message` as JSON.\nconst SerializedIssuesSchema = z\n  .array(z.object({ message: z.string(), path: z.array(z.union([z.string(), z.number()])) }))\n  .min(1)\n\nfunction reconstructValidationError(cause: unknown): ValidationError | null {\n  if (!(cause instanceof Error)) return null\n  let message: unknown\n  try {\n    message = JSON.parse(cause.message)\n  } catch {\n    return null\n  }\n  const parsed = SerializedIssuesSchema.safeParse(message)\n  return parsed.success ? ValidationError.fromIssues(parsed.data) : null\n}\n\n/**\n * Build the server-function converter for one error table.\n * The result is a plain object, because only own data survives serialization.\n */\nexport function createErrorPayloadConverter<Entries>(table: ErrorTable<Entries>) {\n  return function toErrorPayload(cause: unknown): ErrorPayloadOf<ErrorTable<Entries>> {\n    return resolveFailure(table, reconstructValidationError(cause) ?? cause).payload\n  }\n}\n","import { isNotFound, isRedirect, redirect } from '@tanstack/react-router'\nimport { createMiddleware } from '@tanstack/react-start'\nimport type { BetterAuthCookies } from 'better-auth'\n\nimport { StaleSessionError, type ErrorTable } from '@/core'\n\nimport { createHttpErrorResponseConverter } from './http-error-response.ts'\nimport type { RequestContext } from './request-context.ts'\nimport { clearStaleSessionCookies } from './session-cookies.ts'\nimport { createErrorPayloadConverter } from './to-error-payload.ts'\n\n/** The part of a Better Auth instance the boundary reads: its computed cookie definitions. */\nexport type AuthCookieSource = {\n  readonly $context: Promise<{ readonly authCookies: BetterAuthCookies }>\n}\n\n/** The application's error table, its stale-session redirect, and its Better Auth instance. */\nexport type ErrorMiddlewareOptions<Entries> = {\n  readonly errors: ErrorTable<Entries>\n  /** The path a server function redirects to for a stale session, with any search string. */\n  readonly signIn: string\n  /** Select the request's Better Auth instance; its cookie definitions say what to clear. */\n  readonly getAuth: (context: RequestContext) => AuthCookieSource\n}\n\n/**\n * Build both transport boundaries from one error table.\n * Register `functionErrorMiddleware` globally. Put `routeErrorMiddleware` first in an API route's `server.middleware`.\n */\nexport function createErrorMiddleware<Entries>(options: ErrorMiddlewareOptions<Entries>) {\n  const toErrorPayload = createErrorPayloadConverter(options.errors)\n  const toHttpErrorResponse = createHttpErrorResponseConverter(options.errors)\n\n  async function clearSession(context: RequestContext): Promise<void> {\n    const { authCookies } = await options.getAuth(context).$context\n    clearStaleSessionCookies(authCookies)\n  }\n\n  async function handleFunctionError(cause: unknown, context: RequestContext): Promise<never> {\n    // oxlint-disable-next-line typescript/only-throw-error -- TanStack uses throwable control-flow objects.\n    if (isNotFound(cause) || isRedirect(cause)) throw cause\n    if (cause instanceof StaleSessionError) {\n      await clearSession(context)\n      // oxlint-disable-next-line typescript/only-throw-error -- Router redirects by throwing this.\n      throw redirect({ href: options.signIn })\n    }\n    // oxlint-disable-next-line typescript/only-throw-error -- The client rejects with this and reads its tag.\n    throw toErrorPayload(cause)\n  }\n\n  // A route answers 401 instead of a redirect because fetch would follow it into the HTML shell.\n  async function handleRouteError(cause: unknown, context: RequestContext): Promise<Response> {\n    // oxlint-disable-next-line typescript/only-throw-error -- TanStack uses throwable control-flow objects.\n    if (isNotFound(cause) || isRedirect(cause)) throw cause\n    if (cause instanceof StaleSessionError) await clearSession(context)\n    return toHttpErrorResponse(cause)\n  }\n\n  const functionErrorMiddleware = createMiddleware({ type: 'function' }).server(\n    async ({ next, context }) => {\n      try {\n        return await next()\n      } catch (cause) {\n        return handleFunctionError(cause, context)\n      }\n    },\n  )\n\n  const routeErrorMiddleware = createMiddleware({ type: 'request' }).server(\n    async ({ next, context }) => {\n      try {\n        return await next()\n      } catch (cause) {\n        return handleRouteError(cause, context)\n      }\n    },\n  )\n\n  return { functionErrorMiddleware, routeErrorMiddleware, toErrorPayload, toHttpErrorResponse }\n}\n","import { getRequestHeaders } from '@tanstack/react-start/server'\nimport { parseCookies } from 'better-auth/cookies'\n\n// Better Auth keeps the plugin default private; this is the value LastLoginMethodOptions.cookieName documents.\nconst DEFAULT_COOKIE_NAME = 'better-auth.last_used_login_method'\n\n/**\n * Read the method this browser last signed in with from the current request, for the sign-in loader on the server.\n * Pass `cookieName` only when `integrations.lastLoginMethod.cookieName` is set. Returns `null` when the cookie is absent.\n */\nexport function getLastUsedLoginMethod(cookieName = DEFAULT_COOKIE_NAME): string | null {\n  return parseCookies(getRequestHeaders().get('cookie') ?? '').get(cookieName) ?? null\n}\n"],"mappings":";;;;;;;;;AAQA,MAAMA,WAAS,aAAa,iBAAiB;;;;;AAmC7C,SAAgB,qBACd,SACA;CACA,MAAM,cAAc,iBAAiB,EAAE,MAAM,WAAW,CAAC,CAAC,CAAC,OACzD,OAAO,EAAE,MAAM,cAAc;EAC3B,IAAI;EACJ,IAAI;GACF,WAAW,MAAM,QAAQ,QAAQ,OAAO,CAAC,CAAC,IAAI,WAAW,EAAE,SAAS,kBAAkB,EAAE,CAAC;EAC3F,SAAS,OAAO;GACd,SAAO,MAAM,sBAAsB,EAAE,MAAM,CAAC;GAC5C,WAAW;EACb;EACA,IAAI,aAAa,MACf,OAAO,KAA2B,EAAE,SAAS;GAAE,MAAM;GAAW,SAAS;EAAU,EAAE,CAAC;EACxF,OAAO,KAA2B,EAChC,SAAS;GAAE,MAAM,SAAS;GAAM,SAAS,SAAS;EAAQ,EAC5D,CAAC;CACH,CACF;CAEA,eAAe,uBACb,SACA,SACkB;EAClB,MAAM,WAAW,MAAM,QAAQ,QAAQ,OAAO,CAAC,CAAC,IAAI,WAAW,EAAE,QAAQ,CAAC;EAC1E,IAAI,aAAa,MAAM;GACrB,IAAI,iBAAiB,OAAO,GAAG,MAAM,IAAI,kBAAkB;GAC3D,MAAM,IAAI,oBAAoB;EAChC;EACA,OAAO;CACT;CAgBA,OAAO;EAAE;EAAa,aAdF,iBAAiB,EAAE,MAAM,WAAW,CAAC,CAAC,CAAC,OAAO,OAAO,EAAE,MAAM,cAAc;GAC7F,MAAM,WAAW,MAAM,uBAAuB,SAAS,kBAAkB,CAAC;GAC1E,OAAO,KAAmC,EACxC,SAAS;IAAE,MAAM,SAAS;IAAM,SAAS,SAAS;GAAQ,EAC5D,CAAC;EACH,CASgC;EAAG,oBARR,iBAAiB,EAAE,MAAM,UAAU,CAAC,CAAC,CAAC,OAC/D,OAAO,EAAE,SAAS,MAAM,cAAc;GACpC,MAAM,WAAW,MAAM,uBAAuB,SAAS,QAAQ,OAAO;GACtE,OAAO,KAAmC,EACxC,SAAS;IAAE,MAAM,SAAS;IAAM,SAAS,SAAS;GAAQ,EAC5D,CAAC;EACH,CAEkD;CAAE;AACxD;;;;ACvFA,MAAM,SAAS,aAAa,gBAAgB;;;;;AAM5C,SAAgB,eACd,OACA,OACoD;CACpD,MAAM,WAAW,MAAM,QAAQ,KAAK;CACpC,IAAI,aAAa,MAAM;EACrB,OAAO,KAAK,iBAAiB,EAC3B,SAAS;GAAE,KAAK,SAAS,QAAQ;GAAM,QAAQ,SAAS;EAAO,EACjE,CAAC;EACD,OAAO;CACT;CACA,MAAM,iBAAiB,iBAAiB,WAAW,MAAM,iBAAiB;CAC1E,OAAO,MAAM,oBAAoB;EAAE,OAAO;EAAO,SAAS,EAAE,eAAe;CAAE,CAAC;CAC9E,OAAO,MAAM,SAAS,KAAK;AAC7B;;;;ACfA,MAAM,mBAAmB,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;;;;;AAM5D,SAAgB,iCAA0C,OAA4B;CACpF,OAAO,SAAS,oBAAoB,OAA0B;EAC5D,MAAM,EAAE,QAAQ,YAAY,eAAe,OAAO,KAAK;EACvD,MAAM,EAAE,MAAM,SAAS,GAAG,WAAW;EACrC,MAAM,OAAuB;GAC3B,MAAM;GACN,OAAO,gBAAgB,MAAM;GAC7B,QAAQ;GACR,GAAG;EACL;EACA,MAAM,UAAU,IAAI,QAAQ,EAAE,gBAAgB,2BAA2B,CAAC;EAC1E,MAAM,QAAQ,iBAAiB,UAAU,OAAO;EAChD,IAAI,MAAM,SAAS,QAAQ,IAAI,eAAe,OAAO,MAAM,KAAK,UAAU,CAAC;EAC3E,OAAO,SAAS,KAAK,MAAM;GAAE;GAAQ;EAAQ,CAAC;CAChD;AACF;;;;;;;;AClBA,SAAgB,yBAAyB,SAAkC;CACzE,MAAM,UAAU,CAAC,GAAG,aAAa,kBAAkB,CAAC,CAAC,IAAI,QAAQ,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC;CAChF,MAAM,cAAc;EAClB,QAAQ;EACR,QAAQ;EACR,QAAQ;EACR,QAAQ;CACV;CACA,KAAK,MAAM,UAAU,aAAa;EAEhC,MAAM,SAAS,QAAQ,QAAQ,SAAS,KAAK,WAAW,GAAG,OAAO,KAAK,EAAE,CAAC;EAC1E,KAAK,MAAM,wBAAQ,IAAI,IAAI,CAAC,OAAO,MAAM,GAAG,MAAM,CAAC,GACjD,aAAa,MAAM,WAAW,OAAO,UAAU,CAAC;CACpD;AACF;AAEA,SAAS,WAAW,YAA2D;CAE7E,MAAM,UAA+B;EACnC,MAAM,WAAW,QAAQ;EACzB,QAAQ,WAAW,UAAU;CAC/B;CACA,IAAI,WAAW,WAAW,QAAW,QAAQ,SAAS,WAAW;CACjE,OAAO;AACT;;;;AC5BA,MAAM,yBAAyB,EAC5B,MAAM,EAAE,OAAO;CAAE,SAAS,EAAE,OAAO;CAAG,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;AAAE,CAAC,CAAC,CAAC,CAC1F,IAAI,CAAC;AAER,SAAS,2BAA2B,OAAwC;CAC1E,IAAI,EAAE,iBAAiB,QAAQ,OAAO;CACtC,IAAI;CACJ,IAAI;EACF,UAAU,KAAK,MAAM,MAAM,OAAO;CACpC,QAAQ;EACN,OAAO;CACT;CACA,MAAM,SAAS,uBAAuB,UAAU,OAAO;CACvD,OAAO,OAAO,UAAU,gBAAgB,WAAW,OAAO,IAAI,IAAI;AACpE;;;;;AAMA,SAAgB,4BAAqC,OAA4B;CAC/E,OAAO,SAAS,eAAe,OAAqD;EAClF,OAAO,eAAe,OAAO,2BAA2B,KAAK,KAAK,KAAK,CAAC,CAAC;CAC3E;AACF;;;;;;;;ACFA,SAAgB,sBAA+B,SAA0C;CACvF,MAAM,iBAAiB,4BAA4B,QAAQ,MAAM;CACjE,MAAM,sBAAsB,iCAAiC,QAAQ,MAAM;CAE3E,eAAe,aAAa,SAAwC;EAClE,MAAM,EAAE,gBAAgB,MAAM,QAAQ,QAAQ,OAAO,CAAC,CAAC;EACvD,yBAAyB,WAAW;CACtC;CAEA,eAAe,oBAAoB,OAAgB,SAAyC;EAE1F,IAAI,WAAW,KAAK,KAAK,WAAW,KAAK,GAAG,MAAM;EAClD,IAAI,iBAAiB,mBAAmB;GACtC,MAAM,aAAa,OAAO;GAE1B,MAAM,SAAS,EAAE,MAAM,QAAQ,OAAO,CAAC;EACzC;EAEA,MAAM,eAAe,KAAK;CAC5B;CAGA,eAAe,iBAAiB,OAAgB,SAA4C;EAE1F,IAAI,WAAW,KAAK,KAAK,WAAW,KAAK,GAAG,MAAM;EAClD,IAAI,iBAAiB,mBAAmB,MAAM,aAAa,OAAO;EAClE,OAAO,oBAAoB,KAAK;CAClC;CAsBA,OAAO;EAAE,yBApBuB,iBAAiB,EAAE,MAAM,WAAW,CAAC,CAAC,CAAC,OACrE,OAAO,EAAE,MAAM,cAAc;GAC3B,IAAI;IACF,OAAO,MAAM,KAAK;GACpB,SAAS,OAAO;IACd,OAAO,oBAAoB,OAAO,OAAO;GAC3C;EACF,CAa6B;EAAG,sBAVL,iBAAiB,EAAE,MAAM,UAAU,CAAC,CAAC,CAAC,OACjE,OAAO,EAAE,MAAM,cAAc;GAC3B,IAAI;IACF,OAAO,MAAM,KAAK;GACpB,SAAS,OAAO;IACd,OAAO,iBAAiB,OAAO,OAAO;GACxC;EACF,CAGmD;EAAG;EAAgB;CAAoB;AAC9F;;;;AC3EA,MAAM,sBAAsB;;;;;AAM5B,SAAgB,uBAAuB,aAAa,qBAAoC;CACtF,OAAO,aAAa,kBAAkB,CAAC,CAAC,IAAI,QAAQ,KAAK,EAAE,CAAC,CAAC,IAAI,UAAU,KAAK;AAClF"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://www.schemastore.org/package.json",
   "name": "better-ship",
-  "version": "0.8.0",
+  "version": "0.10.0",
   "description": "Foundation for applications on Cloudflare Workers: logger, errors, message bus, infrastructure adapters, and UI primitives",
   "license": "Apache-2.0",
   "repository": {
@@ -25,6 +25,7 @@
     "./cloudflare": "./dist/cloudflare.js",
     "./cloudflare/auth-secondary-storage": "./dist/cloudflare/auth-secondary-storage.js",
     "./cloudflare/queue": "./dist/cloudflare/queue.js",
+    "./cloudflare/scheduled": "./dist/cloudflare/scheduled.js",
     "./core": "./dist/core.js",
     "./postgres": "./dist/postgres.js",
     "./tanstack": "./dist/tanstack.js",
@@ -53,7 +54,6 @@
     "better-auth": "^1.7.4",
     "drizzle-kit": "^0.31.10",
     "drizzle-orm": "^0.45.2",
-    "jose": "^6.2.12",
     "postgres": "^3.4.9",
     "stripe": "^22.6.2",
     "tsdown": "^0.23.0",
@@ -67,7 +67,6 @@
     "@tanstack/react-start": "^1.168.52",
     "better-auth": "^1.7.4",
     "drizzle-orm": "^0.45.2",
-    "jose": "^6.2.12",
     "stripe": "^22.6.2"
   },
   "peerDependenciesMeta": {
@@ -77,9 +76,6 @@
     "stripe": {
       "optional": true
     },
-    "jose": {
-      "optional": true
-    },
     "better-auth": {
       "optional": true
     },

package/src/infrastructure/better-auth/apple-client-secret.ts

@@ -1,12 +1,21 @@
-import { importPKCS8, SignJWT } from 'jose'
+import { Buffer } from 'node:buffer'
+import { createPrivateKey, sign } from 'node:crypto'
 
 import { AppError, createLogger } from '@/core'
 
 const logger = createLogger('auth')
 // Typist reports an invalid key once per isolate because session checks repeatedly construct auth options.
 let appleKeyFailureLogged = false
+/**
+ * Apple caps `exp` at 15,777,000 seconds after `iat`; 180 days stays under it. Source:
+ * https://developer.apple.com/documentation/accountorganizationaldatasharing/creating-a-client-secret
+ */
+const SECRET_LIFETIME_SECONDS = 180 * 24 * 60 * 60
 
-/** Apple sends its OAuth callback from this origin. Include it in trustedOrigins when enabling Apple. */
+/**
+ * Apple's issuer and OAuth callback origin, and the `aud` claim of the client secret. Include it in
+ * trustedOrigins when enabling Apple. Source: the same Apple page as `SECRET_LIFETIME_SECONDS`.
+ */
 export const APPLE_ORIGIN = 'https://appleid.apple.com'
 
 /** Apple credentials used to sign a client secret. Ported from Porte's apple-client-secret.ts. */
@@ -27,11 +36,23 @@ export class AppleClientSecretError extends AppError {
   }
 }
 
-/** Sign Apple's six-month client secret. Invalid private keys return an empty secret and log once per isolate, as in Typist. */
-export async function generateAppleClientSecret(config: AppleKeyConfig): Promise<string> {
-  let key: Awaited<ReturnType<typeof importPKCS8>>
+/** One JWS segment before encoding: the protected header or the claims. */
+type JwsSegment = Readonly<Record<string, string | number>>
+
+function base64UrlJson(segment: JwsSegment): string {
+  return Buffer.from(JSON.stringify(segment)).toString('base64url')
+}
+
+/**
+ * Sign Apple's six-month client secret synchronously, so Better Auth options can be built without awaiting it.
+ * Signing uses `node:crypto` as Typist does, so the Worker needs the `nodejs_compat` flag.
+ * Invalid private keys return an empty secret and log once per isolate, as in Typist.
+ */
+export function generateAppleClientSecret(config: AppleKeyConfig): string {
+  const key = config.applePrivateKey.replace(/\\n/g, '\n')
+  // Validation only: workerd's sign() takes the PEM string, not the KeyObject.
   try {
-    key = await importPKCS8(config.applePrivateKey.replace(/\\n/g, '\n'), 'ES256')
+    createPrivateKey(key)
   } catch (error) {
     if (!appleKeyFailureLogged) {
       appleKeyFailureLogged = true
@@ -39,15 +60,21 @@ export async function generateAppleClientSecret(config: AppleKeyConfig): Promise
     }
     return ''
   }
+  const issuedAt = Math.floor(Date.now() / 1000)
+  const header = base64UrlJson({ alg: 'ES256', kid: config.appleKeyId })
+  const claims = base64UrlJson({
+    iss: config.appleTeamId,
+    sub: config.appleClientId,
+    aud: APPLE_ORIGIN,
+    iat: issuedAt,
+    exp: issuedAt + SECRET_LIFETIME_SECONDS,
+  })
+  const input = `${header}.${claims}`
   try {
-    return await new SignJWT({})
-      .setProtectedHeader({ alg: 'ES256', kid: config.appleKeyId })
-      .setIssuer(config.appleTeamId)
-      .setSubject(config.appleClientId)
-      .setAudience(APPLE_ORIGIN)
-      .setIssuedAt()
-      .setExpirationTime('180d')
-      .sign(key)
+    // A JWS carries the raw r||s signature; OpenSSL emits DER unless told otherwise.
+    const signature = sign('sha256', Buffer.from(input), { key, dsaEncoding: 'ieee-p1363' })
+    // TypeScript 7 types the returned buffer without an encoding parameter on toString.
+    return `${input}.${Buffer.from(signature).toString('base64url')}`
   } catch (cause) {
     throw new AppleClientSecretError(cause)
   }

package/src/infrastructure/better-auth/rate-limit.ts

@@ -1,7 +1,13 @@
-import type { BetterAuthRateLimitStorage } from 'better-auth'
+import type { BetterAuthOptions, BetterAuthRateLimitStorage } from 'better-auth'
 
 import { AppError, createLogger } from '@/core'
 
+/** A rule Better Auth passes to storage: a window in seconds and the requests it allows. */
+export type AuthRateLimitRule = {
+  readonly window: number
+  readonly max: number
+}
+
 /** Each rule must match its binding's deployed limit and period. Cloudflare accepts only 10 or 60 seconds. */
 export type AuthRateLimitBinding = {
   readonly binding: Pick<RateLimit, 'limit'>
@@ -9,6 +15,43 @@ export type AuthRateLimitBinding = {
   readonly max: number
 }
 
+/**
+ * Better Auth's built-in rules, which it does not export. Sign-in, sign-up, change-password, and
+ * change-email paths get 3 requests per 10 seconds. Password reset, verification email, forget-password,
+ * and email OTP send paths get 3 per 60 seconds. A package test pins both against the installed version.
+ * Source: `getDefaultSpecialRules` in
+ * https://github.com/better-auth/better-auth/blob/v1.7.4/packages/better-auth/src/api/rate-limiter/index.ts
+ */
+export const BUILT_IN_AUTH_RATE_LIMIT_RULES: readonly AuthRateLimitRule[] = [
+  { window: 10, max: 3 },
+  { window: 60, max: 3 },
+]
+
+/**
+ * Every rule the configured instance can pass to storage, deduplicated: the general rule, the built-in
+ * rules, each plugin's rules, and static custom rules. Function-valued custom rules decide per request
+ * and are not listed. Disabled rate limiting returns no rules.
+ */
+export function authRateLimitRules(
+  options: Pick<BetterAuthOptions, 'rateLimit' | 'plugins'>,
+): readonly AuthRateLimitRule[] {
+  const rateLimit = options.rateLimit
+  if (rateLimit?.enabled === false) return []
+  // Better Auth's own defaults when the general rule is not set: window 10, max 100. Source:
+  // https://github.com/better-auth/better-auth/blob/v1.7.4/packages/better-auth/src/context/create-context.ts
+  const rules: AuthRateLimitRule[] = [
+    { window: rateLimit?.window ?? 10, max: rateLimit?.max ?? 100 },
+    ...BUILT_IN_AUTH_RATE_LIMIT_RULES,
+  ]
+  for (const plugin of options.plugins ?? [])
+    for (const rule of plugin.rateLimit ?? []) rules.push({ window: rule.window, max: rule.max })
+  for (const rule of Object.values(rateLimit?.customRules ?? {}))
+    if (rule !== false && !(rule instanceof Function))
+      rules.push({ window: rule.window, max: rule.max })
+  const unique = new Map(rules.map((rule) => [`${rule.window}:${rule.max}`, rule]))
+  return [...unique.values()]
+}
+
 /** A binding failure with no known retry classification. The cause preserves the original failure. */
 export class AuthRateLimitError extends AppError {
   readonly _tag = 'AuthRateLimitError'

package/src/infrastructure/cloudflare/scheduled/index.ts

@@ -0,0 +1,8 @@
+export {
+  defineSchedules,
+  scheduledMessageId,
+  type AppSchedules,
+  type ScheduledHandler,
+  type ScheduledRun,
+  type ScheduleExpression,
+} from './scheduled-handler.ts'

package/src/infrastructure/cloudflare/scheduled/scheduled-handler.ts

@@ -0,0 +1,62 @@
+import { z } from 'zod'
+
+import { createLogger, type MessageId } from '@/core'
+
+const logger = createLogger('scheduled')
+
+/** The work one schedule runs. Nothing returns to the platform, so each run reports its own outcome. */
+export type ScheduledRun<Deps> = (deps: Deps, at: Date) => Promise<void>
+
+/** The cron expressions of a schedule map, as literal types. */
+export type ScheduleExpression<Schedules extends Readonly<Record<string, string>>> =
+  Schedules[keyof Schedules]
+
+/** The Cloudflare `scheduled` export, with the application's dependencies as its second argument. */
+export type ScheduledHandler<Deps> = (controller: ScheduledController, deps: Deps) => Promise<void>
+
+/** What `defineSchedules` returns: the map, its parser, and the handler factory. */
+export type AppSchedules<Schedules extends Readonly<Record<string, string>>> = {
+  readonly schedules: Schedules
+  /** Parses `controller.cron`, a bare string from the platform, into a known expression. */
+  readonly schema: z.ZodType<ScheduleExpression<Schedules>>
+  /**
+   * Route each schedule to its work. One run per expression, so a schedule added without
+   * work fails to compile. An expression Wrangler fires that the map does not know is logged
+   * once and ignored. A run that throws rejects, so Cloudflare marks the invocation failed.
+   */
+  handler<Deps>(
+    runs: Readonly<Record<ScheduleExpression<Schedules>, ScheduledRun<Deps>>>,
+  ): ScheduledHandler<Deps>
+}
+
+/**
+ * Define the application's schedules once: `EVERY_MINUTE: '* * * * *'`. Keys name the time,
+ * not the work, because one schedule may drive several commands. Wrangler's `triggers.crons`
+ * must hold exactly these expressions. Cron does not retry: a run that sweeps many items
+ * catches each item's failure itself.
+ */
+export function defineSchedules<const Schedules extends Readonly<Record<string, string>>>(
+  schedules: Schedules,
+): AppSchedules<Schedules> {
+  const schema = z.enum(schedules)
+  return {
+    schedules,
+    schema,
+    handler: (runs) => async (controller, deps) => {
+      const { cron } = controller
+      if (!schema.validate(cron)) {
+        logger.error('scheduled_unknown_cron', { details: { cron } })
+        return
+      }
+      await runs[cron](deps, new Date(controller.scheduledTime))
+    },
+  }
+}
+
+/**
+ * The id of a command a schedule issues: `cron:<Name>:<scheduledTime>`. A doubled trigger for
+ * the same time is then a duplicate by construction, and the unit of work skips it.
+ */
+export function scheduledMessageId(name: string, at: Date): MessageId {
+  return `cron:${name}:${String(at.getTime())}`
+}

package/src/infrastructure/tanstack/auth.middleware.ts

@@ -1,9 +1,11 @@
-import { createMiddleware, type Register, type RequestServerOptions } from '@tanstack/react-start'
+import { createMiddleware } from '@tanstack/react-start'
 import { getRequestHeaders } from '@tanstack/react-start/server'
 import { getSessionCookie } from 'better-auth/cookies'
 
 import { AuthenticationError, StaleSessionError, createLogger } from '@/core'
 
+import type { RequestContext } from './request-context.ts'
+
 const logger = createLogger('auth-middleware')
 
 /** The fields middleware reads; generic callers retain every additional session and user field. */
@@ -28,7 +30,7 @@ export type AuthContext<Session extends AuthSession> =
 
 /** Select the current request's Better Auth instance from TanStack's registered context. */
 export type AuthMiddlewareOptions<Session extends AuthSession> = {
-  readonly getAuth: (context: RequestServerOptions<Register, undefined>['context']) => {
+  readonly getAuth: (context: RequestContext) => {
     readonly api: {
       readonly getSession: (options: { headers: Headers }) => Promise<Session | null>
     }
@@ -60,7 +62,7 @@ export function createAuthMiddleware<Session extends AuthSession>(
   )
 
   async function resolveRequiredSession(
-    context: RequestServerOptions<Register, undefined>['context'],
+    context: RequestContext,
     headers: Headers,
   ): Promise<Session> {
     const resolved = await options.getAuth(context).api.getSession({ headers })

package/src/infrastructure/tanstack/error.middleware.ts

@@ -1,15 +1,14 @@
-import { isNotFound, isRedirect, type AnyRedirect } from '@tanstack/react-router'
-import { createMiddleware, type Register, type RequestServerOptions } from '@tanstack/react-start'
+import { isNotFound, isRedirect, redirect } from '@tanstack/react-router'
+import { createMiddleware } from '@tanstack/react-start'
 import type { BetterAuthCookies } from 'better-auth'
 
 import { StaleSessionError, type ErrorTable } from '@/core'
 
 import { createHttpErrorResponseConverter } from './http-error-response.ts'
+import type { RequestContext } from './request-context.ts'
 import { clearStaleSessionCookies } from './session-cookies.ts'
 import { createErrorPayloadConverter } from './to-error-payload.ts'
 
-type RequestContext = RequestServerOptions<Register, undefined>['context']
-
 /** The part of a Better Auth instance the boundary reads: its computed cookie definitions. */
 export type AuthCookieSource = {
   readonly $context: Promise<{ readonly authCookies: BetterAuthCookies }>
@@ -18,8 +17,8 @@ export type AuthCookieSource = {
 /** The application's error table, its stale-session redirect, and its Better Auth instance. */
 export type ErrorMiddlewareOptions<Entries> = {
   readonly errors: ErrorTable<Entries>
-  /** Build the redirect a server function throws for a stale session. */
-  readonly signIn: () => AnyRedirect
+  /** The path a server function redirects to for a stale session, with any search string. */
+  readonly signIn: string
   /** Select the request's Better Auth instance; its cookie definitions say what to clear. */
   readonly getAuth: (context: RequestContext) => AuthCookieSource
 }
@@ -43,7 +42,7 @@ export function createErrorMiddleware<Entries>(options: ErrorMiddlewareOptions<E
     if (cause instanceof StaleSessionError) {
       await clearSession(context)
       // oxlint-disable-next-line typescript/only-throw-error -- Router redirects by throwing this.
-      throw options.signIn()
+      throw redirect({ href: options.signIn })
     }
     // oxlint-disable-next-line typescript/only-throw-error -- The client rejects with this and reads its tag.
     throw toErrorPayload(cause)

package/src/infrastructure/tanstack/request-context.ts

@@ -0,0 +1,11 @@
+import type { Register } from '@tanstack/react-start'
+
+/**
+ * The request context an application registers as `Register.server.requestContext`.
+ * TanStack's own request context type also reads `Register.config`, which lists the middleware
+ * whose options carry this type, so using it here would make every application's types circular.
+ * Without a registration TanStack passes no context, so the fallback is `undefined`.
+ */
+export type RequestContext = Register extends { server: { requestContext: infer Context } }
+  ? Context
+  : undefined