vinextauth 0.1.0 → 0.2.0

package/dist/index.js

@@ -84,14 +84,15 @@ function resolveConfig(config) {
       "[VinextAuth] No secret provided. Set NEXTAUTH_SECRET or VINEXTAUTH_SECRET env var, or pass `secret` to VinextAuth()."
     );
   }
-  const baseUrl = (typeof process !== "undefined" ? process.env.NEXTAUTH_URL ?? process.env.VINEXTAUTH_URL ?? process.env.VERCEL_URL : void 0) ?? "http://localhost:3000";
-  const normalizedBaseUrl = baseUrl.startsWith("http") ? baseUrl : `https://${baseUrl}`;
-  const useSecureCookies = config.useSecureCookies ?? normalizedBaseUrl.startsWith("https://");
+  const baseUrl = config.baseUrl ?? (typeof process !== "undefined" ? process.env.NEXTAUTH_URL ?? process.env.VINEXTAUTH_URL ?? process.env.VERCEL_URL : void 0) ?? "http://localhost:3000";
+  const resolvedBaseUrl = typeof baseUrl === "string" ? baseUrl.startsWith("http") ? baseUrl : `https://${baseUrl}` : baseUrl;
+  const staticBaseUrl = typeof resolvedBaseUrl === "string" ? resolvedBaseUrl : "http://localhost:3000";
+  const useSecureCookies = config.useSecureCookies ?? staticBaseUrl.startsWith("https://");
   const sessionMaxAge = config.session?.maxAge ?? DEFAULT_MAX_AGE;
   return {
     providers: config.providers,
     secret,
-    baseUrl: normalizedBaseUrl,
+    baseUrl: resolvedBaseUrl,
     basePath: "/api/auth",
     callbacks: config.callbacks ?? {},
     pages: {
@@ -119,9 +120,21 @@ function resolveConfig(config) {
       ...buildCookieNames(useSecureCookies),
       ...config.cookies
     },
-    adapter: config.adapter
+    adapter: config.adapter,
+    accountLinking: {
+      enabled: config.accountLinking?.enabled ?? false,
+      requireVerification: config.accountLinking?.requireVerification ?? true
+    },
+    credentials: config.credentials ?? {}
   };
 }
+async function resolveBaseUrl(config, request) {
+  if (typeof config.baseUrl === "function") {
+    const resolved = await config.baseUrl(request);
+    return resolved.startsWith("http") ? resolved : `https://${resolved}`;
+  }
+  return config.baseUrl;
+}
 
 // src/cookies/index.ts
 function getSessionToken(request, config) {
@@ -165,10 +178,6 @@ function applyStateCookie(headers, state, config) {
   const { name, options } = config.cookies.state;
   headers.append("Set-Cookie", serializeCookie(name, state, options));
 }
-function clearSessionCookie(headers, config) {
-  const { name, options } = config.cookies.sessionToken;
-  headers.append("Set-Cookie", deleteCookieString(name, options));
-}
 function clearStateCookie(headers, config) {
   const { name, options } = config.cookies.state;
   headers.append("Set-Cookie", deleteCookieString(name, options));
@@ -303,6 +312,26 @@ async function verify(token, secret) {
   }
 }
 
+// src/core/refresh-lock.ts
+var locks = /* @__PURE__ */ new Map();
+async function withRefreshLock(tokenId, fn) {
+  const existing = locks.get(tokenId);
+  if (existing) {
+    await existing;
+  }
+  let resolve;
+  const lock = new Promise((r) => {
+    resolve = r;
+  });
+  locks.set(tokenId, lock);
+  try {
+    return await fn();
+  } finally {
+    resolve();
+    locks.delete(tokenId);
+  }
+}
+
 // src/core/session.ts
 async function encodeSession(payload, config) {
   if (config.jwt.encode) {
@@ -327,7 +356,7 @@ async function buildSession(jwt, config) {
   }
   return baseSession;
 }
-async function buildJWT(user, account, profile, config) {
+async function buildJWT(user, account, profile, config, trigger = "signIn") {
   const now = Math.floor(Date.now() / 1e3);
   let token = {
     sub: user.id,
@@ -344,11 +373,30 @@ async function buildJWT(user, account, profile, config) {
       user,
       account,
       profile,
-      trigger: "signIn"
+      trigger
     });
   }
   return token;
 }
+async function refreshTokenIfNeeded(jwt, config) {
+  if (!config.callbacks.refreshToken) return jwt;
+  const accessTokenExpires = jwt.accessTokenExpires;
+  const now = Date.now();
+  if (!accessTokenExpires || now < accessTokenExpires - 6e4) {
+    return jwt;
+  }
+  const tokenId = jwt.jti ?? jwt.sub ?? "unknown";
+  return withRefreshLock(tokenId, async () => {
+    const result = await config.callbacks.refreshToken({ token: jwt });
+    if (result.error) {
+      if (config.debug) {
+        console.warn("[VinextAuth] Token refresh failed:", result.error);
+      }
+      return { ...result.token, refreshError: result.error };
+    }
+    return result.token;
+  });
+}
 function generateId() {
   const bytes = new Uint8Array(16);
   crypto.getRandomValues(bytes);
@@ -357,16 +405,18 @@ function generateId() {
 
 // src/handlers/callback.ts
 async function handleCallback(request, providerId, config) {
-  const provider = config.providers.find((p) => p.id === providerId);
+  const provider = config.providers.find(
+    (p) => p.id === providerId && p.type === "oauth"
+  );
   if (!provider) return new Response("Unknown provider", { status: 404 });
+  const baseUrl = await resolveBaseUrl(config, request);
   const url = new URL(request.url);
   const code = url.searchParams.get("code");
   const stateParam = url.searchParams.get("state");
   const error = url.searchParams.get("error");
+  const errorBase = `${baseUrl}${config.pages.error}`;
   if (error) {
-    const errorUrl = new URL(`${config.baseUrl}${config.pages.error}`);
-    errorUrl.searchParams.set("error", error);
-    return Response.redirect(errorUrl.toString(), 302);
+    return Response.redirect(`${errorBase}?error=${encodeURIComponent(error)}`, 302);
   }
   if (!code) {
     return new Response("Missing code", { status: 400 });
@@ -374,12 +424,10 @@ async function handleCallback(request, providerId, config) {
   const storedState = getStateCookie(request, config);
   if (provider.checks?.includes("state")) {
     if (!storedState || storedState !== stateParam) {
-      const errorUrl = new URL(`${config.baseUrl}${config.pages.error}`);
-      errorUrl.searchParams.set("error", "OAuthStateError");
-      return Response.redirect(errorUrl.toString(), 302);
+      return Response.redirect(`${errorBase}?error=OAuthStateError`, 302);
     }
   }
-  const redirectUri = `${config.baseUrl}${config.basePath}/callback/${providerId}`;
+  const redirectUri = `${baseUrl}${config.basePath}/callback/${providerId}`;
   let tokenData;
   try {
     const tokenResponse = await fetch(provider.token.url, {
@@ -402,27 +450,23 @@ async function handleCallback(request, providerId, config) {
     tokenData = await tokenResponse.json();
   } catch (err) {
     if (config.debug) console.error("[VinextAuth] Token exchange error:", err);
-    const errorUrl = new URL(`${config.baseUrl}${config.pages.error}`);
-    errorUrl.searchParams.set("error", "OAuthCallbackError");
-    return Response.redirect(errorUrl.toString(), 302);
+    return Response.redirect(`${errorBase}?error=OAuthCallbackError`, 302);
   }
   let rawProfile;
   try {
     const userInfoResponse = await fetch(provider.userinfo.url, {
       headers: {
         Authorization: `Bearer ${tokenData.access_token}`,
-        Accept: "application/json"
+        Accept: "application/json",
+        // GitHub needs this header
+        "User-Agent": "VinextAuth/0.2"
       }
     });
-    if (!userInfoResponse.ok) {
-      throw new Error(`UserInfo fetch failed: ${userInfoResponse.status}`);
-    }
+    if (!userInfoResponse.ok) throw new Error(`UserInfo failed: ${userInfoResponse.status}`);
     rawProfile = await userInfoResponse.json();
   } catch (err) {
     if (config.debug) console.error("[VinextAuth] UserInfo error:", err);
-    const errorUrl = new URL(`${config.baseUrl}${config.pages.error}`);
-    errorUrl.searchParams.set("error", "OAuthCallbackError");
-    return Response.redirect(errorUrl.toString(), 302);
+    return Response.redirect(`${errorBase}?error=OAuthCallbackError`, 302);
   }
   const user = provider.profile(rawProfile);
   const account = {
@@ -436,12 +480,30 @@ async function handleCallback(request, providerId, config) {
     scope: tokenData.scope,
     id_token: tokenData.id_token
   };
+  if (config.adapter?.getAccountByProvider) {
+    const existingAccount = await config.adapter.getAccountByProvider(providerId, user.id);
+    if (!existingAccount && user.email && config.adapter.getUserByEmail) {
+      const existingUser = await config.adapter.getUserByEmail(user.email);
+      if (existingUser) {
+        if (!config.accountLinking.enabled) {
+          return Response.redirect(
+            `${errorBase}?error=OAuthAccountNotLinked&provider=${providerId}&hint=enableAccountLinking`,
+            302
+          );
+        }
+        if (config.adapter.linkAccount) {
+          await config.adapter.linkAccount(existingUser.id, providerId, user.id);
+        }
+        user.id = existingUser.id;
+        user.name = user.name ?? existingUser.name;
+        user.image = user.image ?? existingUser.image;
+      }
+    }
+  }
   if (config.callbacks.signIn) {
     const result = await config.callbacks.signIn({ user, account, profile: rawProfile });
     if (result === false) {
-      const errorUrl = new URL(`${config.baseUrl}${config.pages.error}`);
-      errorUrl.searchParams.set("error", "AccessDenied");
-      return Response.redirect(errorUrl.toString(), 302);
+      return Response.redirect(`${errorBase}?error=AccessDenied`, 302);
     }
     if (typeof result === "string") {
       return Response.redirect(result, 302);
@@ -449,22 +511,24 @@ async function handleCallback(request, providerId, config) {
   }
   const jwtPayload = await buildJWT(user, account, rawProfile, config);
   const sessionToken = await encodeSession(jwtPayload, config);
-  const session = await buildSession(jwtPayload, config);
   const callbackUrl = getCallbackUrl(request, config) ?? config.pages.newUser ?? "/";
-  const redirectUrl = isAbsoluteUrl(callbackUrl) ? callbackUrl : `${config.baseUrl}${callbackUrl}`;
+  const redirectUrl = isAbsoluteUrl(callbackUrl) ? callbackUrl : `${baseUrl}${callbackUrl}`;
   const headers = new Headers();
   applySessionCookie(headers, sessionToken, config);
   clearStateCookie(headers, config);
   clearCallbackUrlCookie(headers, config);
   headers.set("Location", redirectUrl);
   if (config.debug) {
-    console.log("[VinextAuth] Signed in:", session.user.email);
+    console.log("[VinextAuth] Signed in:", session(jwtPayload));
   }
   return new Response(null, { status: 302, headers });
 }
 function isAbsoluteUrl(url) {
   return url.startsWith("http://") || url.startsWith("https://");
 }
+function session(jwt, _config) {
+  return `${jwt.email ?? jwt.sub ?? "unknown"}`;
+}
 
 // src/core/csrf.ts
 function bytesToHex(bytes) {
@@ -500,7 +564,13 @@ async function verifyCsrfToken(submittedToken, cookieValue, secret) {
 
 // src/handlers/signout.ts
 async function handleSignOut(request, config) {
-  let callbackUrl = config.baseUrl;
+  let callbackUrl;
+  if (typeof config.baseUrl === "function") {
+    const resolved = await config.baseUrl(request);
+    callbackUrl = resolved.startsWith("http") ? resolved : `https://${resolved}`;
+  } else {
+    callbackUrl = config.baseUrl;
+  }
   if (request.method === "POST") {
     let body = {};
     try {
@@ -515,18 +585,26 @@ async function handleSignOut(request, config) {
     }
     const csrfCookie = getCsrfCookie(request, config);
     const submittedToken = body.csrfToken ?? "";
-    if (csrfCookie) {
+    if (csrfCookie && submittedToken) {
       const valid = await verifyCsrfToken(submittedToken, csrfCookie, config.secret);
       if (!valid && config.debug) {
         console.warn("[VinextAuth] CSRF verification failed on signout");
       }
     }
-    callbackUrl = body.callbackUrl ?? config.baseUrl;
+    if (body.callbackUrl) {
+      callbackUrl = body.callbackUrl;
+    }
   }
+  const redirectUrl = isAbsoluteUrl2(callbackUrl) ? callbackUrl : `${typeof config.baseUrl === "string" ? config.baseUrl : ""}${callbackUrl}`;
   const headers = new Headers();
-  clearSessionCookie(headers, config);
-  clearCallbackUrlCookie(headers, config);
-  const redirectUrl = isAbsoluteUrl2(callbackUrl) ? callbackUrl : `${config.baseUrl}${callbackUrl}`;
+  const { sessionToken, callbackUrl: cbCookie, csrfToken, state, nonce } = config.cookies;
+  for (const cookie of [sessionToken, cbCookie, csrfToken, state, nonce]) {
+    headers.append("Set-Cookie", deleteCookieString(cookie.name, cookie.options));
+    const unprefixed = cookie.name.replace("__Secure-", "");
+    if (unprefixed !== cookie.name) {
+      headers.append("Set-Cookie", deleteCookieString(unprefixed, { ...cookie.options, secure: false }));
+    }
+  }
   headers.set("Location", redirectUrl);
   return new Response(null, { status: 302, headers });
 }
@@ -538,18 +616,26 @@ function isAbsoluteUrl2(url) {
 async function handleSessionRoute(request, config) {
   const token = getSessionToken(request, config);
   if (!token) {
-    return Response.json({});
+    return Response.json({}, { headers: noCacheHeaders() });
   }
-  const jwt = await decodeSession(token, config);
+  let jwt = await decodeSession(token, config);
   if (!jwt) {
-    return Response.json({});
+    return Response.json({}, { headers: noCacheHeaders() });
   }
-  const session = await buildSession(jwt, config);
-  return Response.json(session, {
-    headers: {
-      "Cache-Control": "no-store, max-age=0"
-    }
-  });
+  const refreshed = await refreshTokenIfNeeded(jwt, config);
+  const headers = new Headers(noCacheHeaders());
+  if (refreshed !== jwt) {
+    const newToken = await encodeSession(refreshed, config);
+    applySessionCookie(headers, newToken, config);
+    jwt = refreshed;
+  }
+  const session2 = await buildSession(jwt, config);
+  const refreshError = jwt.refreshError;
+  const responseBody = refreshError ? { ...session2, refreshError } : session2;
+  return Response.json(responseBody, { headers });
+}
+function noCacheHeaders() {
+  return { "Cache-Control": "no-store, max-age=0" };
 }
 
 // src/handlers/csrf-route.ts
@@ -564,6 +650,140 @@ async function handleCsrfRoute(request, config) {
   applyCsrfCookie(headers, cookieValue, config);
   return Response.json({ csrfToken: token }, { headers });
 }
+
+// src/core/rate-limiter.ts
+var InMemoryRateLimiter = class {
+  store = /* @__PURE__ */ new Map();
+  maxAttempts;
+  windowMs;
+  constructor(maxAttempts = 5, windowMs = 15 * 60 * 1e3) {
+    this.maxAttempts = maxAttempts;
+    this.windowMs = windowMs;
+    if (typeof setInterval !== "undefined") {
+      setInterval(() => this.cleanup(), 5 * 60 * 1e3);
+    }
+  }
+  async check(key) {
+    const now = Date.now();
+    const attempt = this.store.get(key);
+    if (!attempt || now > attempt.resetAt) {
+      this.store.set(key, { count: 1, resetAt: now + this.windowMs });
+      return { allowed: true };
+    }
+    if (attempt.count >= this.maxAttempts) {
+      const retryAfter = Math.ceil((attempt.resetAt - now) / 1e3);
+      return { allowed: false, retryAfter };
+    }
+    attempt.count++;
+    return { allowed: true };
+  }
+  async reset(key) {
+    this.store.delete(key);
+  }
+  cleanup() {
+    const now = Date.now();
+    for (const [key, attempt] of this.store) {
+      if (now > attempt.resetAt) this.store.delete(key);
+    }
+  }
+};
+var defaultLimiter = null;
+function getDefaultRateLimiter(maxAttempts = 5, windowMs = 15 * 60 * 1e3) {
+  if (!defaultLimiter) {
+    defaultLimiter = new InMemoryRateLimiter(maxAttempts, windowMs);
+  }
+  return defaultLimiter;
+}
+function getClientIp(request) {
+  return request.headers.get("cf-connecting-ip") ?? request.headers.get("x-real-ip") ?? request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ?? "unknown";
+}
+
+// src/handlers/credentials.ts
+async function handleCredentials(request, provider, config) {
+  if (request.method !== "POST") {
+    return new Response("Method Not Allowed", { status: 405 });
+  }
+  const rateLimitConfig = config.credentials.rateLimit;
+  const limiter = rateLimitConfig?.store ?? getDefaultRateLimiter(
+    rateLimitConfig?.maxAttempts ?? 5,
+    rateLimitConfig?.windowMs ?? 15 * 60 * 1e3
+  );
+  const ip = getClientIp(request);
+  const rateLimitKey = `credentials:${provider.id}:${ip}`;
+  const { allowed, retryAfter } = await limiter.check(rateLimitKey);
+  if (!allowed) {
+    const errorUrl = new URL(`${await resolveBase(config, request)}${config.pages.error}`);
+    errorUrl.searchParams.set("error", "RateLimitExceeded");
+    if (retryAfter) errorUrl.searchParams.set("retryAfter", String(retryAfter));
+    return Response.redirect(errorUrl.toString(), 302);
+  }
+  let body = {};
+  try {
+    const contentType = request.headers.get("content-type") ?? "";
+    if (contentType.includes("application/json")) {
+      body = await request.json();
+    } else {
+      const text = await request.text();
+      body = Object.fromEntries(new URLSearchParams(text));
+    }
+  } catch {
+    return new Response("Bad Request", { status: 400 });
+  }
+  const callbackUrl = body.callbackUrl ?? config.pages.newUser ?? "/";
+  delete body.callbackUrl;
+  delete body.csrfToken;
+  let user;
+  try {
+    user = await provider.authorize(body, request);
+  } catch (err) {
+    if (config.debug) console.error("[VinextAuth] Credentials authorize error:", err);
+    const errorUrl = new URL(`${await resolveBase(config, request)}${config.pages.error}`);
+    errorUrl.searchParams.set("error", "InvalidCredentials");
+    return Response.redirect(errorUrl.toString(), 302);
+  }
+  if (!user) {
+    const errorUrl = new URL(`${await resolveBase(config, request)}${config.pages.error}`);
+    errorUrl.searchParams.set("error", "InvalidCredentials");
+    return Response.redirect(errorUrl.toString(), 302);
+  }
+  await limiter.reset(rateLimitKey);
+  const account = {
+    provider: provider.id,
+    type: "credentials",
+    providerAccountId: user.id
+  };
+  if (config.callbacks.signIn) {
+    const result = await config.callbacks.signIn({ user, account, profile: void 0 });
+    if (result === false) {
+      const errorUrl = new URL(`${await resolveBase(config, request)}${config.pages.error}`);
+      errorUrl.searchParams.set("error", "AccessDenied");
+      return Response.redirect(errorUrl.toString(), 302);
+    }
+    if (typeof result === "string") {
+      return Response.redirect(result, 302);
+    }
+  }
+  const jwtPayload = await buildJWT(user, account, void 0, config);
+  const sessionToken = await encodeSession(jwtPayload, config);
+  const baseUrl = await resolveBase(config, request);
+  const redirectUrl = isAbsoluteUrl3(callbackUrl) ? callbackUrl : `${baseUrl}${callbackUrl}`;
+  const headers = new Headers();
+  applySessionCookie(headers, sessionToken, config);
+  clearStateCookie(headers, config);
+  clearCallbackUrlCookie(headers, config);
+  headers.set("Location", redirectUrl);
+  return new Response(null, { status: 302, headers });
+}
+async function resolveBase(config, request) {
+  if (typeof config.baseUrl === "function") {
+    const r = await config.baseUrl(request);
+    return r.startsWith("http") ? r : `https://${r}`;
+  }
+  return config.baseUrl;
+}
+function isAbsoluteUrl3(url) {
+  return url.startsWith("http://") || url.startsWith("https://");
+}
 function VinextAuth(config) {
   const resolved = resolveConfig(config);
   async function handler(request) {
@@ -577,19 +797,23 @@ function VinextAuth(config) {
     const parts = action.split("/");
     const verb = parts[0];
     const param = parts[1];
+    if (resolved.debug) {
+      console.log(`[VinextAuth] ${request.method} ${pathname} \u2192 ${verb}/${param ?? ""}`);
+    }
     if (verb === "signin" && param) {
+      const provider = resolved.providers.find((p) => p.id === param);
+      if (provider?.type === "credentials") {
+        return handleCredentials(request, provider, resolved);
+      }
       return handleSignIn(request, param, resolved);
     }
     if (verb === "signin" && !param) {
-      return handleSignInPage(resolved);
+      return handleSignInPage(resolved, request);
     }
     if (verb === "callback" && param) {
       return handleCallback(request, param, resolved);
     }
     if (verb === "signout") {
-      if (request.method === "POST") {
-        return handleSignOut(request, resolved);
-      }
       return handleSignOut(request, resolved);
     }
     if (verb === "session") {
@@ -598,31 +822,117 @@ function VinextAuth(config) {
     if (verb === "csrf") {
       return handleCsrfRoute(request, resolved);
     }
+    if (verb === "providers") {
+      const providers = resolved.providers.map((p) => ({
+        id: p.id,
+        name: p.name,
+        type: p.type,
+        signinUrl: `${resolved.basePath}/signin/${p.id}`,
+        callbackUrl: p.type === "oauth" ? `${resolved.basePath}/callback/${p.id}` : null
+      }));
+      return Response.json(providers);
+    }
     if (verb === "error") {
-      const error = url.searchParams.get("error") ?? "Unknown";
-      return new Response(
-        `<!DOCTYPE html><html><body><h1>Authentication Error</h1><p>${error}</p><a href="${resolved.pages.signIn}">Try again</a></body></html>`,
-        { status: 400, headers: { "Content-Type": "text/html" } }
-      );
+      return handleErrorPage(url, resolved);
     }
     return new Response("Not Found", { status: 404 });
   }
   return { GET: handler, POST: handler };
 }
-function handleSignInPage(config) {
-  const providers = config.providers.map((p) => `
-    <a href="${config.basePath}/signin/${p.id}" style="display:block;margin:8px 0;padding:12px 24px;border:1px solid #ccc;border-radius:6px;text-decoration:none;color:#000;">
+async function handleSignInPage(config, request) {
+  const baseUrl = await resolveBaseUrl(config, request);
+  const callbackUrl = new URL(request.url).searchParams.get("callbackUrl") ?? "/";
+  const providers = config.providers.map(
+    (p) => `
+    <a href="${baseUrl}${config.basePath}/signin/${p.id}?callbackUrl=${encodeURIComponent(callbackUrl)}"
+       style="display:flex;align-items:center;gap:8px;margin:8px 0;padding:12px 20px;
+              border:1px solid #e2e8f0;border-radius:8px;text-decoration:none;color:#1a202c;
+              font-weight:500;transition:background 0.15s;"
+       onmouseover="this.style.background='#f7fafc'" onmouseout="this.style.background=''">
       Sign in with ${p.name}
-    </a>
-  `).join("");
+    </a>`
+  ).join("");
   return new Response(
-    `<!DOCTYPE html><html><body style="font-family:sans-serif;max-width:400px;margin:80px auto;padding:24px">
-      <h1>Sign In</h1>${providers}
-    </body></html>`,
+    `<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width,initial-scale=1">
+  <title>Sign In</title>
+  <style>
+    body { font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif;
+           background: #f7fafc; display: flex; align-items: center;
+           justify-content: center; min-height: 100vh; margin: 0; }
+    .card { background: white; border-radius: 12px; padding: 32px 40px;
+            box-shadow: 0 1px 3px rgba(0,0,0,.1); width: 100%; max-width: 380px; }
+    h1 { margin: 0 0 24px; font-size: 24px; text-align: center; }
+  </style>
+</head>
+<body>
+  <div class="card">
+    <h1>Sign In</h1>
+    ${providers}
+  </div>
+</body>
+</html>`,
     { headers: { "Content-Type": "text/html" } }
   );
 }
+function handleErrorPage(url, config) {
+  const error = url.searchParams.get("error") ?? "Unknown";
+  const retryAfter = url.searchParams.get("retryAfter");
+  const messages = {
+    OAuthAccountNotLinked: "This email is already associated with another account. Enable account linking or sign in with your original provider.",
+    OAuthCallbackError: "Authentication failed. Please try again.",
+    OAuthStateError: "Authentication state mismatch. Please try again.",
+    AccessDenied: "You do not have permission to sign in.",
+    RateLimitExceeded: `Too many sign-in attempts. Please wait${retryAfter ? ` ${retryAfter} seconds` : ""} before trying again.`,
+    InvalidCredentials: "Invalid email or password.",
+    SessionExpired: "Your session has expired. Please sign in again.",
+    Configuration: "Server configuration error.",
+    Unknown: "An unexpected error occurred."
+  };
+  const message = messages[error] ?? messages.Unknown;
+  return new Response(
+    `<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8">
+  <title>Authentication Error</title>
+  <style>
+    body { font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif;
+           background: #f7fafc; display: flex; align-items: center;
+           justify-content: center; min-height: 100vh; margin: 0; }
+    .card { background: white; border-radius: 12px; padding: 32px 40px;
+            box-shadow: 0 1px 3px rgba(0,0,0,.1); width: 100%; max-width: 420px; text-align: center; }
+    h1 { color: #e53e3e; margin-bottom: 12px; }
+    p { color: #4a5568; line-height: 1.6; }
+    a { display:inline-block; margin-top:20px; padding:10px 24px;
+        background:#3182ce; color:white; border-radius:6px; text-decoration:none; }
+  </style>
+</head>
+<body>
+  <div class="card">
+    <h1>Authentication Error</h1>
+    <p>${message}</p>
+    <a href="${config.pages.signIn}">Try again</a>
+  </div>
+</body>
+</html>`,
+    { status: 400, headers: { "Content-Type": "text/html" } }
+  );
+}
+
+// src/types.ts
+var VinextAuthError = class extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.name = "VinextAuthError";
+    this.code = code;
+  }
+};
 
-export { VinextAuth, VinextAuth as default };
+export { InMemoryRateLimiter, VinextAuth, VinextAuthError, VinextAuth as default };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map