kitcn 0.12.27 → 0.13.1

package/dist/aggregate/index.d.ts

@@ -1,4 +1,4 @@
-import { C as ConvexNumberBuilderInitial, E as ConvexIdBuilderInitial, N as ConvexCustomBuilderInitial, dn as ConvexTableWithColumns, tr as ConvexTextBuilderInitial } from "../where-clause-compiler-DdjN63Io.js";
+import { C as ConvexNumberBuilderInitial, E as ConvexIdBuilderInitial, N as ConvexCustomBuilderInitial, dn as ConvexTableWithColumns, tr as ConvexTextBuilderInitial } from "../where-clause-compiler-TMppDl9g.js";
 import * as convex_values0 from "convex/values";
 import { GenericId, Infer, Value } from "convex/values";
 import { DocumentByName, GenericDataModel, GenericDatabaseReader, GenericDatabaseWriter, TableNamesInDataModel } from "convex/server";

package/dist/aggregate/index.js

@@ -1,4 +1,4 @@
-import { n as TableAggregate$1, r as aggregateStorageTables, t as DirectAggregate$1 } from "../runtime-CtvJPkur.js";
+import { n as TableAggregate$1, r as aggregateStorageTables, t as DirectAggregate$1 } from "../runtime-i6t-HoZn.js";
 
 //#region src/aggregate/index.ts
 const wrapTriggerFactory = (methodName, factory) => ((...args) => {

package/dist/auth/client/index.d.ts

@@ -1,15 +1,323 @@
 'use client';
-import { convexClient } from "@convex-dev/better-auth/client/plugins";
 import { ConvexReactClient } from "convex/react";
 import { ReactNode } from "react";
 import * as react_jsx_runtime0 from "react/jsx-runtime";
-import { AuthClient, AuthClient as AuthClient$1 } from "@convex-dev/better-auth/react";
+import { AuthConfig } from "convex/server";
+import * as better_auth0 from "better-auth";
+import { BetterAuthClientPlugin, Session, User } from "better-auth";
+import * as better_auth_api0 from "better-auth/api";
+import * as better_auth_plugins_oidc_provider0 from "better-auth/plugins/oidc-provider";
+import * as jose from "jose";
+import { BetterAuthOptions } from "better-auth/minimal";
+import { createAuthClient } from "better-auth/react";
 
+//#region src/auth/internal/convex-plugin.d.ts
+declare const convex: (opts: {
+  authConfig: AuthConfig;
+  jwks?: string;
+  jwksRotateOnTokenGenerationError?: boolean;
+  jwt?: {
+    definePayload?: (session: {
+      session: Session & Record<string, any>;
+      user: User & Record<string, any>;
+    }) => Promise<Record<string, any>> | Record<string, any> | undefined;
+    expirationSeconds?: number;
+  };
+  /**
+   * @deprecated Use jwt.expirationSeconds instead.
+   */
+  jwtExpirationSeconds?: number;
+  options?: BetterAuthOptions;
+}) => {
+  id: "convex";
+  init: (ctx: better_auth0.AuthContext) => void;
+  hooks: {
+    before: ({
+      matcher(context: better_auth0.HookEndpointContext): boolean;
+      handler: (inputContext: better_auth0.MiddlewareInputContext<better_auth0.MiddlewareOptions>) => Promise<{
+        context: {
+          headers: Headers;
+        };
+      } | undefined>;
+    } | {
+      matcher: (ctx: better_auth0.HookEndpointContext) => boolean;
+      handler: (inputContext: better_auth0.MiddlewareInputContext<better_auth0.MiddlewareOptions>) => Promise<{
+        context: better_auth0.MiddlewareContext<better_auth0.MiddlewareOptions, {
+          returned?: unknown | undefined;
+          responseHeaders?: Headers | undefined;
+        } & better_auth0.PluginContext<BetterAuthOptions> & better_auth0.InfoContext & {
+          options: BetterAuthOptions;
+          trustedOrigins: string[];
+          trustedProviders: string[];
+          isTrustedOrigin: (url: string, settings?: {
+            allowRelativePaths: boolean;
+          }) => boolean;
+          oauthConfig: {
+            skipStateCookieCheck?: boolean | undefined;
+            storeStateStrategy: "database" | "cookie";
+          };
+          newSession: {
+            session: {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              userId: string;
+              expiresAt: Date;
+              token: string;
+              ipAddress?: string | null | undefined;
+              userAgent?: string | null | undefined;
+            } & Record<string, any>;
+            user: {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              email: string;
+              emailVerified: boolean;
+              name: string;
+              image?: string | null | undefined;
+            } & Record<string, any>;
+          } | null;
+          session: {
+            session: {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              userId: string;
+              expiresAt: Date;
+              token: string;
+              ipAddress?: string | null | undefined;
+              userAgent?: string | null | undefined;
+            } & Record<string, any>;
+            user: {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              email: string;
+              emailVerified: boolean;
+              name: string;
+              image?: string | null | undefined;
+            } & Record<string, any>;
+          } | null;
+          setNewSession: (session: {
+            session: {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              userId: string;
+              expiresAt: Date;
+              token: string;
+              ipAddress?: string | null | undefined;
+              userAgent?: string | null | undefined;
+            } & Record<string, any>;
+            user: {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              email: string;
+              emailVerified: boolean;
+              name: string;
+              image?: string | null | undefined;
+            } & Record<string, any>;
+          } | null) => void;
+          socialProviders: better_auth0.OAuthProvider[];
+          authCookies: better_auth0.BetterAuthCookies;
+          logger: ReturnType<(options?: better_auth0.Logger | undefined) => better_auth0.InternalLogger>;
+          rateLimit: {
+            enabled: boolean;
+            window: number;
+            max: number;
+            storage: "memory" | "database" | "secondary-storage";
+          } & Omit<better_auth0.BetterAuthRateLimitOptions, "enabled" | "window" | "max" | "storage">;
+          adapter: better_auth0.DBAdapter<BetterAuthOptions>;
+          internalAdapter: better_auth0.InternalAdapter<BetterAuthOptions>;
+          createAuthCookie: (cookieName: string, overrideAttributes?: Partial<better_auth0.CookieOptions> | undefined) => better_auth0.BetterAuthCookie;
+          secret: string;
+          secretConfig: string | better_auth0.SecretConfig;
+          sessionConfig: {
+            updateAge: number;
+            expiresIn: number;
+            freshAge: number;
+            cookieRefreshCache: false | {
+              enabled: true;
+              updateAge: number;
+            };
+          };
+          generateId: (options: {
+            model: better_auth0.ModelNames;
+            size?: number | undefined;
+          }) => string | false;
+          secondaryStorage: better_auth0.SecondaryStorage | undefined;
+          password: {
+            hash: (password: string) => Promise<string>;
+            verify: (data: {
+              password: string;
+              hash: string;
+            }) => Promise<boolean>;
+            config: {
+              minPasswordLength: number;
+              maxPasswordLength: number;
+            };
+            checkPassword: (userId: string, ctx: better_auth0.GenericEndpointContext<BetterAuthOptions>) => Promise<boolean>;
+          };
+          tables: better_auth0.BetterAuthDBSchema;
+          runMigrations: () => Promise<void>;
+          publishTelemetry: (event: {
+            type: string;
+            anonymousId?: string | undefined;
+            payload: Record<string, any>;
+          }) => Promise<void>;
+          skipOriginCheck: boolean | string[];
+          skipCSRFCheck: boolean;
+          runInBackground: (promise: Promise<unknown>) => void;
+          runInBackgroundOrAwait: (promise: Promise<unknown> | void) => better_auth0.Awaitable<unknown>;
+        }>;
+      }>;
+    })[];
+    after: {
+      matcher: (context: better_auth0.HookEndpointContext) => boolean;
+      handler: better_auth_api0.AuthMiddleware;
+    }[];
+  };
+  endpoints: {
+    getOpenIdConfig: better_auth0.StrictEndpoint<"/convex/.well-known/openid-configuration", {
+      method: "GET";
+      metadata: {
+        isAction: false;
+      };
+    }, better_auth_plugins_oidc_provider0.OIDCMetadata>;
+    getJwks: better_auth0.StrictEndpoint<"/convex/jwks", {
+      method: "GET";
+      metadata: {
+        openapi: {
+          description: string;
+          responses: {
+            '200': {
+              description: string;
+            };
+          };
+        };
+      };
+    }, jose.JSONWebKeySet>;
+    getLatestJwks: better_auth0.StrictEndpoint<"/convex/latest-jwks", {
+      isAction: boolean;
+      method: "POST";
+      metadata: {
+        SERVER_ONLY: true;
+        openapi: {
+          description: string;
+        };
+      };
+    }, any[]>;
+    rotateKeys: better_auth0.StrictEndpoint<"/convex/rotate-keys", {
+      isAction: boolean;
+      method: "POST";
+      metadata: {
+        SERVER_ONLY: true;
+        openapi: {
+          description: string;
+        };
+      };
+    }, any[]>;
+    getToken: better_auth0.StrictEndpoint<"/convex/token", {
+      method: "GET";
+      requireHeaders: true;
+      use: ((inputContext: better_auth0.MiddlewareInputContext<better_auth0.MiddlewareOptions>) => Promise<{
+        session: {
+          session: Record<string, any> & {
+            id: string;
+            createdAt: Date;
+            updatedAt: Date;
+            userId: string;
+            expiresAt: Date;
+            token: string;
+            ipAddress?: string | null | undefined;
+            userAgent?: string | null | undefined;
+          };
+          user: Record<string, any> & {
+            id: string;
+            createdAt: Date;
+            updatedAt: Date;
+            email: string;
+            emailVerified: boolean;
+            name: string;
+            image?: string | null | undefined;
+          };
+        };
+      }>)[];
+      metadata: {
+        openapi: {
+          description: string;
+        };
+      };
+    }, {
+      token: string;
+    }>;
+  };
+  schema: {
+    jwks: {
+      fields: {
+        publicKey: {
+          type: "string";
+          required: true;
+        };
+        privateKey: {
+          type: "string";
+          required: true;
+        };
+        createdAt: {
+          type: "date";
+          required: true;
+        };
+        expiresAt: {
+          type: "date";
+          required: false;
+        };
+      };
+    };
+    user: {
+      readonly fields: {
+        readonly userId: {
+          readonly type: "string";
+          readonly required: false;
+          readonly input: false;
+        };
+      };
+    };
+  };
+};
+//#endregion
+//#region src/auth/internal/convex-client.d.ts
+declare const convexClient: () => {
+  id: "convex";
+  $InferServerPlugin: ReturnType<typeof convex>;
+};
+//#endregion
+//#region src/auth-client/types.d.ts
+type ConvexClient = ReturnType<typeof convexClient>;
+type CrossDomainClient = BetterAuthClientPlugin & {
+  id: 'cross-domain';
+  getActions: (...args: never[]) => {
+    crossDomain: {
+      oneTimeToken: {
+        verify: (args: unknown) => Promise<unknown>;
+      };
+    };
+    getCookie: () => string;
+    notifySessionSignal: () => void;
+  };
+};
+type PluginsWithCrossDomain = (CrossDomainClient | ConvexClient | BetterAuthClientPlugin)[];
+type PluginsWithoutCrossDomain = (ConvexClient | BetterAuthClientPlugin)[];
+type AuthClientWithPlugins<Plugins extends PluginsWithCrossDomain | PluginsWithoutCrossDomain> = ReturnType<typeof createAuthClient<BetterAuthClientPlugin & {
+  plugins: Plugins;
+}>>;
+type AuthClient = AuthClientWithPlugins<PluginsWithCrossDomain> | AuthClientWithPlugins<PluginsWithoutCrossDomain>;
+//#endregion
 //#region src/auth-client/convex-auth-provider.d.ts
 type ConvexAuthProviderProps = {
   children: ReactNode; /** Convex client instance */
   client: ConvexReactClient; /** Better Auth client instance */
-  authClient: AuthClient$1; /** Initial session token (from SSR) */
+  authClient: AuthClient; /** Initial session token (from SSR) */
   initialToken?: string; /** Callback when mutation called while unauthorized */
   onMutationUnauthorized?: () => void; /** Callback when query called while unauthorized */
   onQueryUnauthorized?: (info: {
@@ -34,4 +342,4 @@ declare function ConvexAuthProvider({
   isUnauthorized
 }: ConvexAuthProviderProps): react_jsx_runtime0.JSX.Element;
 //#endregion
-export { type AuthClient, ConvexAuthProvider, ConvexAuthProviderProps, convexClient };
+export { type AuthClient, type AuthClientWithPlugins, ConvexAuthProvider, ConvexAuthProviderProps, type PluginsWithCrossDomain, type PluginsWithoutCrossDomain, convexClient };

package/dist/auth/client/index.js

@@ -1,10 +1,18 @@
 'use client';
 import { C as readAuthSessionFallbackData, D as CRPCClientError, O as defaultIsUnauthorized, S as clearAuthSessionFallback, T as writeAuthSessionFallbackData, d as isSessionSyncGraceActive, g as useAuthValue, h as useAuthStore, n as AuthProvider, o as FetchAccessTokenContext, t as AUTH_SESSION_SYNC_GRACE_MS, u as decodeJwtExp, w as readAuthSessionFallbackToken } from "../../auth-store-CwGbvP_s.js";
-import { convexClient } from "@convex-dev/better-auth/client/plugins";
 import { ConvexProviderWithAuth, useConvexAuth } from "convex/react";
 import { useCallback, useEffect, useMemo, useRef } from "react";
 import { jsx } from "react/jsx-runtime";
 
+//#region src/auth/internal/convex-client.ts
+const convexClient = () => {
+	return {
+		id: "convex",
+		$InferServerPlugin: {}
+	};
+};
+
+//#endregion
 //#region src/auth-client/convex-auth-provider.tsx
 const defaultMutationHandler = () => {
 	throw new CRPCClientError({
@@ -19,17 +27,21 @@ const hasActiveSessionData = (session) => {
 const wait = (ms) => new Promise((resolve) => {
 	setTimeout(resolve, ms);
 });
+const readAuthResultData = (result) => {
+	if (!result || typeof result !== "object") return;
+	return result.data;
+};
 const getSessionFromPersistedToken = async (authClient, token) => {
 	await wait(250);
 	for (let attempt = 0; attempt < 10; attempt += 1) {
-		const result = authClient.$fetch ? await authClient.$fetch("/get-session", {
+		const data = readAuthResultData(authClient.$fetch ? await authClient.$fetch("/get-session", {
 			credentials: "omit",
 			headers: { Authorization: `Bearer ${token}` }
 		}) : await authClient.getSession?.({ fetchOptions: {
 			credentials: "omit",
 			headers: { Authorization: `Bearer ${token}` }
-		} });
-		if (result?.data) return result.data;
+		} }));
+		if (data) return data;
 		if (attempt < 9) await wait(100);
 	}
 	return null;
@@ -306,7 +318,7 @@ function useOTTHandler(authClient) {
 				url.searchParams.delete("ott");
 				window.history.replaceState({}, "", url);
 				const session = (await authClientWithCrossDomain.crossDomain.oneTimeToken.verify({ token })).data?.session;
-				if (session) {
+				if (session && typeof authClient.getSession === "function") {
 					await authClient.getSession({ fetchOptions: {
 						credentials: "omit",
 						headers: { Authorization: `Bearer ${session.token}` }

package/dist/auth/config/index.d.ts

@@ -1,4 +1,4 @@
-import { JwtOptions } from "better-auth/plugins";
+import { JwtOptions } from "better-auth/plugins/jwt";
 
 //#region src/auth/auth-config.d.ts
 type JwksDoc = {

package/dist/auth/generated/index.d.ts

@@ -1,2 +1,2 @@
-import { S as defineAuth, _ as GenericAuthBeforeResult, b as GenericAuthTriggerHandlers, g as BetterAuthOptionsWithoutDatabase, i as getGeneratedAuthDisabledReason, n as GeneratedAuthDisabledReasonKind, r as createDisabledAuthRuntime, t as AuthRuntime, v as GenericAuthDefinition, x as GenericAuthTriggers, y as GenericAuthTriggerChange } from "../../generated-contract-disabled-21YxPk5W.js";
+import { S as defineAuth, _ as GenericAuthBeforeResult, b as GenericAuthTriggerHandlers, g as BetterAuthOptionsWithoutDatabase, i as getGeneratedAuthDisabledReason, n as GeneratedAuthDisabledReasonKind, r as createDisabledAuthRuntime, t as AuthRuntime, v as GenericAuthDefinition, x as GenericAuthTriggers, y as GenericAuthTriggerChange } from "../../generated-contract-disabled-C_-KWRfT.js";
 export { type AuthRuntime, BetterAuthOptionsWithoutDatabase, type GeneratedAuthDisabledReasonKind, GenericAuthBeforeResult, GenericAuthDefinition, GenericAuthTriggerChange, GenericAuthTriggerHandlers, GenericAuthTriggers, createDisabledAuthRuntime, defineAuth, getGeneratedAuthDisabledReason };

package/dist/auth/generated/index.js

@@ -1,3 +1,3 @@
-import { i as defineAuth, n as createDisabledAuthRuntime, r as getGeneratedAuthDisabledReason } from "../../generated-contract-disabled-Cih4eITO.js";
+import { i as defineAuth, n as createDisabledAuthRuntime, r as getGeneratedAuthDisabledReason } from "../../generated-contract-disabled-BXaz7JCE.js";
 
 export { createDisabledAuthRuntime, defineAuth, getGeneratedAuthDisabledReason };

package/dist/auth/http/index.d.ts

@@ -1,4 +1,4 @@
-import { t as GetAuth } from "../../types-BiJE7qxR.js";
+import { t as GetAuth } from "../../types-BCl8gfGy.js";
 import { HttpRouter } from "convex/server";
 import { MiddlewareHandler } from "hono";
 import { BaseURLConfig, BetterAuthOptions } from "better-auth";
@@ -33,6 +33,16 @@ declare function authMiddleware<Ctx = unknown>(getAuth: GetAuth<Ctx, {
 //#endregion
 //#region src/auth/registerRoutes.d.ts
 type TrustedOriginsOption = BetterAuthOptions['trustedOrigins'];
+type RouteCorsOptions = {
+  allowedHeaders?: string[];
+  allowedOrigins?: string[];
+  exposedHeaders?: string[];
+} | boolean;
+type RegisterRoutesOptions = {
+  basePath?: string;
+  cors?: RouteCorsOptions;
+  verbose?: boolean;
+};
 type AuthRouteContract = {
   $context: Promise<{
     options: {
@@ -46,14 +56,7 @@ type AuthRouteContract = {
     trustedOrigins?: TrustedOriginsOption;
   };
 };
-declare const registerRoutes: <Ctx>(http: HttpRouter, getAuth: GetAuth<Ctx, AuthRouteContract>, opts?: {
-  cors?: {
-    allowedHeaders?: string[];
-    allowedOrigins?: string[];
-    exposedHeaders?: string[];
-  } | boolean;
-  verbose?: boolean;
-}) => void;
+declare const registerRoutes: <Ctx>(http: HttpRouter, getAuth: GetAuth<Ctx, AuthRouteContract>, opts?: RegisterRoutesOptions) => void;
 //#endregion
 //#region src/auth-http/index.d.ts
 /**

package/dist/auth/http/index.js

@@ -328,6 +328,23 @@ const LOCAL_CONVEX_AUTH_IP_PATHS = new Set([
 	"/convex/jwks",
 	"/convex/token"
 ]);
+const restoreOriginalForwardedHeaders = (request) => {
+	const originalHost = request.headers.get("x-better-auth-forwarded-host");
+	const originalProto = request.headers.get("x-better-auth-forwarded-proto");
+	if (!originalHost && !originalProto) return request;
+	const headers = new Headers(request.headers);
+	if (originalHost) headers.set("x-forwarded-host", originalHost);
+	if (originalProto) headers.set("x-forwarded-proto", originalProto);
+	const init = {
+		headers,
+		method: request.method
+	};
+	if (request.method !== "GET" && request.method !== "HEAD") {
+		init.body = request.body;
+		init.duplex = "half";
+	}
+	return new Request(request.url, init);
+};
 const withLocalConvexAuthIp = (request, basePath) => {
 	if (request.headers.get("x-forwarded-for")) return request;
 	let url;
@@ -348,16 +365,15 @@ const withLocalConvexAuthIp = (request, basePath) => {
 		method: request.method
 	});
 };
-const registerRoutes = (http, getAuth, opts = {}) => {
-	const staticAuth = getAuth({});
-	const path = staticAuth.options.basePath ?? "/api/auth";
+const registerAuthRoutes = (http, registration, opts = {}) => {
+	const { getAuth, getRegistrationAuth, path } = registration;
 	const authRequestHandler = httpActionGeneric(async (ctx, request) => {
 		if (opts?.verbose) {
-			console.log("options.baseURL", staticAuth.options.baseURL);
+			console.log("options.baseURL", getRegistrationAuth().options.baseURL);
 			console.log("request headers", request.headers);
 		}
 		const auth = getAuth(ctx);
-		const authRequest = withLocalConvexAuthIp(request, path);
+		const authRequest = restoreOriginalForwardedHeaders(withLocalConvexAuthIp(request, path));
 		let response;
 		try {
 			response = await auth.handler(authRequest);
@@ -407,7 +423,7 @@ const registerRoutes = (http, getAuth, opts = {}) => {
 		enforceAllowOrigins: false,
 		exposedHeaders: ["Set-Better-Auth-Cookie"].concat(corsOpts.exposedHeaders ?? []),
 		allowedOrigins: async (request) => {
-			const resolvedTrustedOrigins = trustedOriginsOption ?? (await staticAuth.$context).options.trustedOrigins ?? [];
+			const resolvedTrustedOrigins = trustedOriginsOption ?? (await getRegistrationAuth().$context).options.trustedOrigins ?? [];
 			trustedOriginsOption = resolvedTrustedOrigins;
 			return (Array.isArray(resolvedTrustedOrigins) ? resolvedTrustedOrigins : await resolvedTrustedOrigins(request) ?? []).filter((origin) => typeof origin === "string").map((origin) => origin.endsWith("*") && origin.length > 1 ? origin.slice(0, -1) : origin).concat(corsOpts.allowedOrigins ?? []);
 		}
@@ -423,6 +439,19 @@ const registerRoutes = (http, getAuth, opts = {}) => {
 		pathPrefix: `${path}/`
 	});
 };
+const registerRoutes = (http, getAuth, opts = {}) => {
+	return registerAuthRoutes(http, {
+		getAuth,
+		getRegistrationAuth: (() => {
+			let registrationAuth;
+			return () => {
+				registrationAuth ??= getAuth({});
+				return registrationAuth;
+			};
+		})(),
+		path: opts.basePath ?? "/api/auth"
+	}, opts);
+};
 
 //#endregion
 //#region src/auth-http/index.ts