workerstack 0.1.0-beta.0

package/dist/auth-password.js

@@ -0,0 +1,60 @@
+// src/auth-password.ts — BetterAuth's scrypt password format, with a plain-JS
+// fallback. BetterAuth picks node:crypto scrypt through its `workerd` and
+// `node` export conditions; celld implements neither, so we choose at runtime.
+import { scryptAsync } from '@noble/hashes/scrypt.js';
+import * as nodeCrypto from 'node:crypto';
+// Must match @better-auth/utils/password: existing hashes stay valid.
+const PARAMS = { N: 16384, r: 16, p: 1 };
+const KEY_LENGTH = 64;
+const MAXMEM = 128 * PARAMS.N * PARAMS.r * 2;
+function toHex(bytes) {
+    return Array.from(bytes, (b) => b.toString(16).padStart(2, '0')).join('');
+}
+const nodeScrypt = typeof nodeCrypto.scrypt === 'function'
+    ? (password, salt, keylen, options) => new Promise((resolve, reject) => nodeCrypto.scrypt(password, salt, keylen, options, (error, key) => error ? reject(error) : resolve(new Uint8Array(key))))
+    : null;
+const pureScrypt = (password, salt, keylen, options) => scryptAsync(password, salt, { ...options, dkLen: keylen });
+export function createPasswordHasher(options = {}) {
+    let native = options.nativeScrypt === undefined ? nodeScrypt : options.nativeScrypt;
+    async function derive(password, salt) {
+        const input = password.normalize('NFKC');
+        const opts = { ...PARAMS, maxmem: MAXMEM };
+        if (native) {
+            try {
+                return await native(input, salt, KEY_LENGTH, opts);
+            }
+            catch {
+                // celld: "The scrypt method is not implemented". Stop trying.
+                native = null;
+            }
+        }
+        return pureScrypt(input, salt, KEY_LENGTH, opts);
+    }
+    return {
+        async hash(password) {
+            const salt = toHex(crypto.getRandomValues(new Uint8Array(16)));
+            return `${salt}:${toHex(await derive(password, salt))}`;
+        },
+        async verify({ hash, password, }) {
+            const [salt, key] = hash.split(':');
+            if (!salt || !key)
+                throw new Error('Invalid password hash');
+            return toHex(await derive(password, salt)) === key;
+        },
+    };
+}
+export const passwordHasher = createPasswordHasher();
+/** Only fills a gap: a user-supplied password hasher always wins. */
+export function withPasswordDefaults(cfg) {
+    if (!cfg.emailAndPassword?.enabled || cfg.emailAndPassword.password) {
+        return cfg;
+    }
+    return {
+        ...cfg,
+        emailAndPassword: {
+            ...cfg.emailAndPassword,
+            password: { hash: passwordHasher.hash, verify: passwordHasher.verify },
+        },
+    };
+}
+//# sourceMappingURL=auth-password.js.map

package/dist/auth-password.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-password.js","sourceRoot":"","sources":["../src/auth-password.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,0EAA0E;AAC1E,+EAA+E;AAC/E,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AACrD,OAAO,KAAK,UAAU,MAAM,aAAa,CAAA;AAWzC,sEAAsE;AACtE,MAAM,MAAM,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAW,CAAA;AACjD,MAAM,UAAU,GAAG,EAAE,CAAA;AACrB,MAAM,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAA;AAE5C,SAAS,KAAK,CAAC,KAAiB;IAC9B,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;AAC3E,CAAC;AAED,MAAM,UAAU,GACd,OAAO,UAAU,CAAC,MAAM,KAAK,UAAU;IACrC,CAAC,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,CAClC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAC9B,UAAU,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAChE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CACrD,CACF;IACL,CAAC,CAAC,IAAI,CAAA;AAEV,MAAM,UAAU,GAAa,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,CAC/D,WAAW,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;AAE5D,MAAM,UAAU,oBAAoB,CAClC,UAA8C,EAAE;IAEhD,IAAI,MAAM,GACR,OAAO,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAA;IAExE,KAAK,UAAU,MAAM,CAAC,QAAgB,EAAE,IAAY;QAClD,MAAM,KAAK,GAAG,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;QACxC,MAAM,IAAI,GAAG,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAA;QAC1C,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC;gBACH,OAAO,MAAM,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,CAAA;YACpD,CAAC;YAAC,MAAM,CAAC;gBACP,8DAA8D;gBAC9D,MAAM,GAAG,IAAI,CAAA;YACf,CAAC;QACH,CAAC;QACD,OAAO,UAAU,CAAC,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,CAAA;IAClD,CAAC;IAED,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,QAAgB;YACzB,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;YAC9D,OAAO,GAAG,IAAI,IAAI,KAAK,CAAC,MAAM,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,EAAE,CAAA;QACzD,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,EACX,IAAI,EACJ,QAAQ,GAIT;YACC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YACnC,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG;gBAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAA;YAC3D,OAAO,KAAK,CAAC,MAAM,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,KAAK,GAAG,CAAA;QACpD,CAAC;KACF,CAAA;AACH,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAG,oBAAoB,EAAE,CAAA;AAEpD,qEAAqE;AACrE,MAAM,UAAU,oBAAoB,CAElC,GAAM;IACN,IAAI,CAAC,GAAG,CAAC,gBAAgB,EAAE,OAAO,IAAI,GAAG,CAAC,gBAAgB,CAAC,QAAQ,EAAE,CAAC;QACpE,OAAO,GAAG,CAAA;IACZ,CAAC;IACD,OAAO;QACL,GAAG,GAAG;QACN,gBAAgB,EAAE;YAChB,GAAG,GAAG,CAAC,gBAAgB;YACvB,QAAQ,EAAE,EAAE,IAAI,EAAE,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,cAAc,CAAC,MAAM,EAAE;SACvE;KACF,CAAA;AACH,CAAC","sourcesContent":["// src/auth-password.ts — BetterAuth's scrypt password format, with a plain-JS\n// fallback. BetterAuth picks node:crypto scrypt through its `workerd` and\n// `node` export conditions; celld implements neither, so we choose at runtime.\nimport { scryptAsync } from '@noble/hashes/scrypt.js'\nimport * as nodeCrypto from 'node:crypto'\n\nimport type { BetterAuthConfig } from './config'\n\ntype ScryptFn = (\n  password: string,\n  salt: string,\n  keylen: number,\n  options: { N: number; r: number; p: number; maxmem: number },\n) => Promise<Uint8Array>\n\n// Must match @better-auth/utils/password: existing hashes stay valid.\nconst PARAMS = { N: 16384, r: 16, p: 1 } as const\nconst KEY_LENGTH = 64\nconst MAXMEM = 128 * PARAMS.N * PARAMS.r * 2\n\nfunction toHex(bytes: Uint8Array): string {\n  return Array.from(bytes, (b) => b.toString(16).padStart(2, '0')).join('')\n}\n\nconst nodeScrypt: ScryptFn | null =\n  typeof nodeCrypto.scrypt === 'function'\n    ? (password, salt, keylen, options) =>\n        new Promise((resolve, reject) =>\n          nodeCrypto.scrypt(password, salt, keylen, options, (error, key) =>\n            error ? reject(error) : resolve(new Uint8Array(key)),\n          ),\n        )\n    : null\n\nconst pureScrypt: ScryptFn = (password, salt, keylen, options) =>\n  scryptAsync(password, salt, { ...options, dkLen: keylen })\n\nexport function createPasswordHasher(\n  options: { nativeScrypt?: ScryptFn | null } = {},\n) {\n  let native =\n    options.nativeScrypt === undefined ? nodeScrypt : options.nativeScrypt\n\n  async function derive(password: string, salt: string): Promise<Uint8Array> {\n    const input = password.normalize('NFKC')\n    const opts = { ...PARAMS, maxmem: MAXMEM }\n    if (native) {\n      try {\n        return await native(input, salt, KEY_LENGTH, opts)\n      } catch {\n        // celld: \"The scrypt method is not implemented\". Stop trying.\n        native = null\n      }\n    }\n    return pureScrypt(input, salt, KEY_LENGTH, opts)\n  }\n\n  return {\n    async hash(password: string): Promise<string> {\n      const salt = toHex(crypto.getRandomValues(new Uint8Array(16)))\n      return `${salt}:${toHex(await derive(password, salt))}`\n    },\n    async verify({\n      hash,\n      password,\n    }: {\n      hash: string\n      password: string\n    }): Promise<boolean> {\n      const [salt, key] = hash.split(':')\n      if (!salt || !key) throw new Error('Invalid password hash')\n      return toHex(await derive(password, salt)) === key\n    },\n  }\n}\n\nexport const passwordHasher = createPasswordHasher()\n\n/** Only fills a gap: a user-supplied password hasher always wins. */\nexport function withPasswordDefaults<\n  T extends Pick<BetterAuthConfig, 'emailAndPassword'>,\n>(cfg: T): T {\n  if (!cfg.emailAndPassword?.enabled || cfg.emailAndPassword.password) {\n    return cfg\n  }\n  return {\n    ...cfg,\n    emailAndPassword: {\n      ...cfg.emailAndPassword,\n      password: { hash: passwordHasher.hash, verify: passwordHasher.verify },\n    },\n  }\n}\n"]}

package/dist/auth.d.ts

@@ -0,0 +1,59 @@
+import { type Auth, type BetterAuthPlugin } from 'better-auth';
+import { openAPI } from 'better-auth/plugins';
+import type { AccessUserBase, AuthSessionResolver, SessionUserConfig } from './access.js';
+import type { BetterAuthConfig } from './config.js';
+import type { AnyDb } from './dialect.js';
+import type { EmailFacade } from './email.js';
+type ConfiguredAuthPlugins<TConfig extends BetterAuthConfig> = TConfig extends {
+    plugins: infer TPlugins extends readonly BetterAuthPlugin[];
+} ? TPlugins : [];
+type WithWorkerstackAuthDefaults<TConfig extends BetterAuthConfig> = Omit<BetterAuthConfig, 'plugins'> & Omit<TConfig, 'plugins'> & {
+    plugins: [...ConfiguredAuthPlugins<TConfig>, ReturnType<typeof openAPI>];
+};
+/**
+ * The public Better Auth instance retains every endpoint and model field from
+ * the declared config. Workerstack always installs OpenAPI at runtime, so its
+ * endpoints are part of the public type even when the app omitted the plugin.
+ */
+export type WorkerstackAuth<TConfig extends BetterAuthConfig = BetterAuthConfig> = Auth<WithWorkerstackAuthDefaults<TConfig>>;
+/**
+ * Build Better Auth while exposing its named plugin-aware public type. The
+ * implementation accepts the resolved runtime config, while `TConfig` carries
+ * the declaration that produced it; their relationship is asserted once here.
+ */
+export declare function createAuth<TConfig extends BetterAuthConfig = BetterAuthConfig>(db: AnyDb, cfg: BetterAuthConfig, userSchema?: Record<string, unknown>): WorkerstackAuth<TConfig>;
+/**
+ * better-auth resolves its models out of the app's own schema, so an app that
+ * declares none has no auth at all. Session resolution must then short-circuit
+ * to null: the drizzle adapter throws on a missing model, and any session
+ * cookie for the host — a browser keeps those per host, not per port, so one
+ * minted by another local app arrives here too — would break every request.
+ */
+export declare function missingAuthModels(schema: Record<string, unknown>, cfg: BetterAuthConfig): string[];
+/**
+ * Defer building better-auth until someone touches the instance. From 1.7.6 on,
+ * constructing it starts a schema check that logs, and every `auth.api` call
+ * throws, when the auth tables are missing. An app without auth models never
+ * builds one, yet `app.auth` / `ctx.auth` still work for code that reaches for
+ * it on purpose. A proxy, not a getter: oRPC middleware and access scopes
+ * spread the context, which would read a getter on every request.
+ */
+export declare function lazyAuth<TAuth extends object>(create: () => TAuth): TAuth;
+/**
+ * Adapt the raw better-auth instance to our internal {@link AuthSessionResolver}
+ * contract. better-auth's `getSession` has a union return (a bare session, or a
+ * `{ headers, response }` wrapper when `returnHeaders` is set); we only ever
+ * call the bare form, so we narrow on `'user' in result` and map to our shape.
+ * Keeping this adapter here means internal modules never depend on better-auth's
+ * evolving types.
+ */
+export declare function toAuthSessionResolver<TExtra extends Record<string, unknown> = Record<never, never>>(auth: Auth, sessionUser?: SessionUserConfig<TExtra>): AuthSessionResolver<Omit<TExtra, keyof AccessUserBase>>;
+/**
+ * Fill better-auth's email hooks from the workerstack email facade. Only fills
+ * gaps: user-supplied handlers always win, and nothing is injected when email
+ * isn't configured. emailAndPassword is only touched when the user enabled it
+ * (injecting it unasked would enable the feature).
+ */
+export declare function withEmailAuthDefaults(cfg: BetterAuthConfig, email: EmailFacade, emailConfigured: boolean): BetterAuthConfig;
+export { withPasswordDefaults } from './auth-password.js';
+//# sourceMappingURL=auth.d.ts.map

package/dist/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AACA,OAAO,EAAc,KAAK,IAAI,EAAE,KAAK,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAE1E,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAE7C,OAAO,KAAK,EACV,cAAc,EACd,mBAAmB,EACnB,iBAAiB,EAElB,MAAM,UAAU,CAAA;AACjB,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAA;AAChD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,WAAW,CAAA;AACtC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAA;AAE1C,KAAK,qBAAqB,CAAC,OAAO,SAAS,gBAAgB,IAAI,OAAO,SAAS;IAC7E,OAAO,EAAE,MAAM,QAAQ,SAAS,SAAS,gBAAgB,EAAE,CAAA;CAC5D,GACG,QAAQ,GACR,EAAE,CAAA;AAEN,KAAK,2BAA2B,CAAC,OAAO,SAAS,gBAAgB,IAAI,IAAI,CACvE,gBAAgB,EAChB,SAAS,CACV,GACC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,GAAG;IACzB,OAAO,EAAE,CAAC,GAAG,qBAAqB,CAAC,OAAO,CAAC,EAAE,UAAU,CAAC,OAAO,OAAO,CAAC,CAAC,CAAA;CACzE,CAAA;AAEH;;;;GAIG;AACH,MAAM,MAAM,eAAe,CACzB,OAAO,SAAS,gBAAgB,GAAG,gBAAgB,IACjD,IAAI,CAAC,2BAA2B,CAAC,OAAO,CAAC,CAAC,CAAA;AAE9C;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,OAAO,SAAS,gBAAgB,GAAG,gBAAgB,EAC5E,EAAE,EAAE,KAAK,EACT,GAAG,EAAE,gBAAgB,EACrB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACnC,eAAe,CAAC,OAAO,CAAC,CAY1B;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,GAAG,EAAE,gBAAgB,GACpB,MAAM,EAAE,CAMV;AAED;;;;;;;GAOG;AACH,wBAAgB,QAAQ,CAAC,KAAK,SAAS,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,GAAG,KAAK,CAezE;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,EAE7D,IAAI,EAAE,IAAI,EACV,WAAW,CAAC,EAAE,iBAAiB,CAAC,MAAM,CAAC,GACtC,mBAAmB,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,cAAc,CAAC,CAAC,CA4CzD;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,gBAAgB,EACrB,KAAK,EAAE,WAAW,EAClB,eAAe,EAAE,OAAO,GACvB,gBAAgB,CAkClB;AAED,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAA"}

package/dist/auth.js

@@ -0,0 +1,146 @@
+// src/auth.ts
+import { betterAuth } from 'better-auth';
+import { drizzleAdapter } from 'better-auth/adapters/drizzle';
+import { openAPI } from 'better-auth/plugins';
+/**
+ * Build Better Auth while exposing its named plugin-aware public type. The
+ * implementation accepts the resolved runtime config, while `TConfig` carries
+ * the declaration that produced it; their relationship is asserted once here.
+ */
+export function createAuth(db, cfg, userSchema) {
+    const hasOpenApi = cfg.plugins?.some((p) => p.id === 'open-api');
+    const plugins = hasOpenApi ? cfg.plugins : [...(cfg.plugins || []), openAPI()];
+    return betterAuth({
+        ...cfg,
+        plugins,
+        database: drizzleAdapter(db, {
+            provider: 'sqlite',
+            ...(userSchema ? { schema: userSchema } : {}),
+        }),
+    });
+}
+/**
+ * better-auth resolves its models out of the app's own schema, so an app that
+ * declares none has no auth at all. Session resolution must then short-circuit
+ * to null: the drizzle adapter throws on a missing model, and any session
+ * cookie for the host — a browser keeps those per host, not per port, so one
+ * minted by another local app arrives here too — would break every request.
+ */
+export function missingAuthModels(schema, cfg) {
+    const models = [
+        cfg.user?.modelName ?? 'user',
+        cfg.session?.modelName ?? 'session',
+    ];
+    return models.filter((model) => !schema[model]);
+}
+/**
+ * Defer building better-auth until someone touches the instance. From 1.7.6 on,
+ * constructing it starts a schema check that logs, and every `auth.api` call
+ * throws, when the auth tables are missing. An app without auth models never
+ * builds one, yet `app.auth` / `ctx.auth` still work for code that reaches for
+ * it on purpose. A proxy, not a getter: oRPC middleware and access scopes
+ * spread the context, which would read a getter on every request.
+ */
+export function lazyAuth(create) {
+    let instance;
+    const resolve = () => {
+        instance ??= create();
+        return instance;
+    };
+    return new Proxy({}, {
+        get: (_, key) => Reflect.get(resolve(), key),
+        has: (_, key) => Reflect.has(resolve(), key),
+        ownKeys: () => Reflect.ownKeys(resolve()),
+        getOwnPropertyDescriptor: (_, key) => {
+            const descriptor = Reflect.getOwnPropertyDescriptor(resolve(), key);
+            return descriptor ? { ...descriptor, configurable: true } : undefined;
+        },
+    });
+}
+/**
+ * Adapt the raw better-auth instance to our internal {@link AuthSessionResolver}
+ * contract. better-auth's `getSession` has a union return (a bare session, or a
+ * `{ headers, response }` wrapper when `returnHeaders` is set); we only ever
+ * call the bare form, so we narrow on `'user' in result` and map to our shape.
+ * Keeping this adapter here means internal modules never depend on better-auth's
+ * evolving types.
+ */
+export function toAuthSessionResolver(auth, sessionUser) {
+    return {
+        api: {
+            async getSession({ headers }) {
+                const result = await auth.api.getSession({ headers });
+                if (result && 'user' in result && result.user) {
+                    const session = 'session' in result ? result.session : null;
+                    const activeOrganizationId = session &&
+                        'activeOrganizationId' in session &&
+                        typeof session.activeOrganizationId === 'string'
+                        ? session.activeOrganizationId
+                        : null;
+                    const role = 'role' in result.user && typeof result.user.role === 'string'
+                        ? result.user.role
+                        : undefined;
+                    const emailVerified = 'emailVerified' in result.user && result.user.emailVerified === true;
+                    const mapped = sessionUser?.mapUser(result.user);
+                    const extras = { ...mapped };
+                    delete extras.id;
+                    delete extras.email;
+                    delete extras.emailVerified;
+                    delete extras.name;
+                    delete extras.role;
+                    return {
+                        user: {
+                            ...extras,
+                            id: result.user.id,
+                            email: result.user.email,
+                            emailVerified,
+                            name: result.user.name,
+                            ...(role ? { role } : {}),
+                        },
+                        session: session ? { activeOrganizationId } : null,
+                    };
+                }
+                return null;
+            },
+        },
+    };
+}
+/**
+ * Fill better-auth's email hooks from the workerstack email facade. Only fills
+ * gaps: user-supplied handlers always win, and nothing is injected when email
+ * isn't configured. emailAndPassword is only touched when the user enabled it
+ * (injecting it unasked would enable the feature).
+ */
+export function withEmailAuthDefaults(cfg, email, emailConfigured) {
+    if (!emailConfigured)
+        return cfg;
+    const out = { ...cfg };
+    if (cfg.emailAndPassword?.enabled &&
+        !cfg.emailAndPassword.sendResetPassword) {
+        out.emailAndPassword = {
+            ...cfg.emailAndPassword,
+            sendResetPassword: async ({ user, url }) => {
+                await email.send({
+                    to: user.email,
+                    subject: 'Reset your password',
+                    text: `Click the link to reset your password:\n\n${url}\n\nIf you didn't request this, you can ignore this email.`,
+                });
+            },
+        };
+    }
+    if (!cfg.emailVerification?.sendVerificationEmail) {
+        out.emailVerification = {
+            ...cfg.emailVerification,
+            sendVerificationEmail: async ({ user, url }) => {
+                await email.send({
+                    to: user.email,
+                    subject: 'Verify your email',
+                    text: `Click the link to verify your email address:\n\n${url}`,
+                });
+            },
+        };
+    }
+    return out;
+}
+export { withPasswordDefaults } from './auth-password.js';
+//# sourceMappingURL=auth.js.map

package/dist/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,cAAc;AACd,OAAO,EAAE,UAAU,EAAoC,MAAM,aAAa,CAAA;AAC1E,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAC7D,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAmC7C;;;;GAIG;AACH,MAAM,UAAU,UAAU,CACxB,EAAS,EACT,GAAqB,EACrB,UAAoC;IAEpC,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,UAAU,CAAC,CAAA;IACrE,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,CAAA;IAE9E,OAAO,UAAU,CAAC;QAChB,GAAG,GAAG;QACN,OAAO;QACP,QAAQ,EAAE,cAAc,CAAC,EAA0C,EAAE;YACnE,QAAQ,EAAE,QAAQ;YAClB,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9C,CAAC;KACH,CAAwC,CAAA;AAC3C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAC/B,MAA+B,EAC/B,GAAqB;IAErB,MAAM,MAAM,GAAG;QACb,GAAG,CAAC,IAAI,EAAE,SAAS,IAAI,MAAM;QAC7B,GAAG,CAAC,OAAO,EAAE,SAAS,IAAI,SAAS;KACpC,CAAA;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;AACjD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,QAAQ,CAAuB,MAAmB;IAChE,IAAI,QAA2B,CAAA;IAC/B,MAAM,OAAO,GAAG,GAAG,EAAE;QACnB,QAAQ,KAAK,MAAM,EAAE,CAAA;QACrB,OAAO,QAAQ,CAAA;IACjB,CAAC,CAAA;IACD,OAAO,IAAI,KAAK,CAAC,EAAW,EAAE;QAC5B,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC;QAC5C,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC;QAC5C,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACzC,wBAAwB,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;YACnC,MAAM,UAAU,GAAG,OAAO,CAAC,wBAAwB,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,CAAA;YACnE,OAAO,UAAU,CAAC,CAAC,CAAC,EAAE,GAAG,UAAU,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;QACvE,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAGnC,IAAU,EACV,WAAuC;IAEvC,OAAO;QACL,GAAG,EAAE;YACH,KAAK,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE;gBAC1B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,CAAA;gBACrD,IAAI,MAAM,IAAI,MAAM,IAAI,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;oBAC9C,MAAM,OAAO,GAAG,SAAS,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAA;oBAC3D,MAAM,oBAAoB,GACxB,OAAO;wBACP,sBAAsB,IAAI,OAAO;wBACjC,OAAO,OAAO,CAAC,oBAAoB,KAAK,QAAQ;wBAC9C,CAAC,CAAC,OAAO,CAAC,oBAAoB;wBAC9B,CAAC,CAAC,IAAI,CAAA;oBACV,MAAM,IAAI,GACR,MAAM,IAAI,MAAM,CAAC,IAAI,IAAI,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ;wBAC3D,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI;wBAClB,CAAC,CAAC,SAAS,CAAA;oBACf,MAAM,aAAa,GACjB,eAAe,IAAI,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,aAAa,KAAK,IAAI,CAAA;oBACtE,MAAM,MAAM,GAAG,WAAW,EAAE,OAAO,CACjC,MAAM,CAAC,IAAyB,CACM,CAAA;oBACxC,MAAM,MAAM,GAAG,EAAE,GAAG,MAAM,EAAE,CAAA;oBAC5B,OAAO,MAAM,CAAC,EAAE,CAAA;oBAChB,OAAO,MAAM,CAAC,KAAK,CAAA;oBACnB,OAAO,MAAM,CAAC,aAAa,CAAA;oBAC3B,OAAO,MAAM,CAAC,IAAI,CAAA;oBAClB,OAAO,MAAM,CAAC,IAAI,CAAA;oBAClB,OAAO;wBACL,IAAI,EAAE;4BACJ,GAAG,MAAM;4BACT,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE;4BAClB,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK;4BACxB,aAAa;4BACb,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI;4BACtB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;yBAC1B;wBACD,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC,IAAI;qBACnD,CAAA;gBACH,CAAC;gBACD,OAAO,IAAI,CAAA;YACb,CAAC;SACF;KACyD,CAAA;AAC9D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CACnC,GAAqB,EACrB,KAAkB,EAClB,eAAwB;IAExB,IAAI,CAAC,eAAe;QAAE,OAAO,GAAG,CAAA;IAChC,MAAM,GAAG,GAAqB,EAAE,GAAG,GAAG,EAAE,CAAA;IAExC,IACE,GAAG,CAAC,gBAAgB,EAAE,OAAO;QAC7B,CAAC,GAAG,CAAC,gBAAgB,CAAC,iBAAiB,EACvC,CAAC;QACD,GAAG,CAAC,gBAAgB,GAAG;YACrB,GAAG,GAAG,CAAC,gBAAgB;YACvB,iBAAiB,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE;gBACzC,MAAM,KAAK,CAAC,IAAI,CAAC;oBACf,EAAE,EAAE,IAAI,CAAC,KAAK;oBACd,OAAO,EAAE,qBAAqB;oBAC9B,IAAI,EAAE,6CAA6C,GAAG,4DAA4D;iBACnH,CAAC,CAAA;YACJ,CAAC;SACF,CAAA;IACH,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,iBAAiB,EAAE,qBAAqB,EAAE,CAAC;QAClD,GAAG,CAAC,iBAAiB,GAAG;YACtB,GAAG,GAAG,CAAC,iBAAiB;YACxB,qBAAqB,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE;gBAC7C,MAAM,KAAK,CAAC,IAAI,CAAC;oBACf,EAAE,EAAE,IAAI,CAAC,KAAK;oBACd,OAAO,EAAE,mBAAmB;oBAC5B,IAAI,EAAE,mDAAmD,GAAG,EAAE;iBAC/D,CAAC,CAAA;YACJ,CAAC;SACF,CAAA;IACH,CAAC;IAED,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAA","sourcesContent":["// src/auth.ts\nimport { betterAuth, type Auth, type BetterAuthPlugin } from 'better-auth'\nimport { drizzleAdapter } from 'better-auth/adapters/drizzle'\nimport { openAPI } from 'better-auth/plugins'\n\nimport type {\n  AccessUserBase,\n  AuthSessionResolver,\n  SessionUserConfig,\n  SessionUserSource,\n} from './access'\nimport type { BetterAuthConfig } from './config'\nimport type { AnyDb } from './dialect'\nimport type { EmailFacade } from './email'\n\ntype ConfiguredAuthPlugins<TConfig extends BetterAuthConfig> = TConfig extends {\n  plugins: infer TPlugins extends readonly BetterAuthPlugin[]\n}\n  ? TPlugins\n  : []\n\ntype WithWorkerstackAuthDefaults<TConfig extends BetterAuthConfig> = Omit<\n  BetterAuthConfig,\n  'plugins'\n> &\n  Omit<TConfig, 'plugins'> & {\n    plugins: [...ConfiguredAuthPlugins<TConfig>, ReturnType<typeof openAPI>]\n  }\n\n/**\n * The public Better Auth instance retains every endpoint and model field from\n * the declared config. Workerstack always installs OpenAPI at runtime, so its\n * endpoints are part of the public type even when the app omitted the plugin.\n */\nexport type WorkerstackAuth<\n  TConfig extends BetterAuthConfig = BetterAuthConfig,\n> = Auth<WithWorkerstackAuthDefaults<TConfig>>\n\n/**\n * Build Better Auth while exposing its named plugin-aware public type. The\n * implementation accepts the resolved runtime config, while `TConfig` carries\n * the declaration that produced it; their relationship is asserted once here.\n */\nexport function createAuth<TConfig extends BetterAuthConfig = BetterAuthConfig>(\n  db: AnyDb,\n  cfg: BetterAuthConfig,\n  userSchema?: Record<string, unknown>,\n): WorkerstackAuth<TConfig> {\n  const hasOpenApi = cfg.plugins?.some((p: any) => p.id === 'open-api')\n  const plugins = hasOpenApi ? cfg.plugins : [...(cfg.plugins || []), openAPI()]\n\n  return betterAuth({\n    ...cfg,\n    plugins,\n    database: drizzleAdapter(db as Parameters<typeof drizzleAdapter>[0], {\n      provider: 'sqlite',\n      ...(userSchema ? { schema: userSchema } : {}),\n    }),\n  }) as unknown as WorkerstackAuth<TConfig>\n}\n\n/**\n * better-auth resolves its models out of the app's own schema, so an app that\n * declares none has no auth at all. Session resolution must then short-circuit\n * to null: the drizzle adapter throws on a missing model, and any session\n * cookie for the host — a browser keeps those per host, not per port, so one\n * minted by another local app arrives here too — would break every request.\n */\nexport function missingAuthModels(\n  schema: Record<string, unknown>,\n  cfg: BetterAuthConfig,\n): string[] {\n  const models = [\n    cfg.user?.modelName ?? 'user',\n    cfg.session?.modelName ?? 'session',\n  ]\n  return models.filter((model) => !schema[model])\n}\n\n/**\n * Defer building better-auth until someone touches the instance. From 1.7.6 on,\n * constructing it starts a schema check that logs, and every `auth.api` call\n * throws, when the auth tables are missing. An app without auth models never\n * builds one, yet `app.auth` / `ctx.auth` still work for code that reaches for\n * it on purpose. A proxy, not a getter: oRPC middleware and access scopes\n * spread the context, which would read a getter on every request.\n */\nexport function lazyAuth<TAuth extends object>(create: () => TAuth): TAuth {\n  let instance: TAuth | undefined\n  const resolve = () => {\n    instance ??= create()\n    return instance\n  }\n  return new Proxy({} as TAuth, {\n    get: (_, key) => Reflect.get(resolve(), key),\n    has: (_, key) => Reflect.has(resolve(), key),\n    ownKeys: () => Reflect.ownKeys(resolve()),\n    getOwnPropertyDescriptor: (_, key) => {\n      const descriptor = Reflect.getOwnPropertyDescriptor(resolve(), key)\n      return descriptor ? { ...descriptor, configurable: true } : undefined\n    },\n  })\n}\n\n/**\n * Adapt the raw better-auth instance to our internal {@link AuthSessionResolver}\n * contract. better-auth's `getSession` has a union return (a bare session, or a\n * `{ headers, response }` wrapper when `returnHeaders` is set); we only ever\n * call the bare form, so we narrow on `'user' in result` and map to our shape.\n * Keeping this adapter here means internal modules never depend on better-auth's\n * evolving types.\n */\nexport function toAuthSessionResolver<\n  TExtra extends Record<string, unknown> = Record<never, never>,\n>(\n  auth: Auth,\n  sessionUser?: SessionUserConfig<TExtra>,\n): AuthSessionResolver<Omit<TExtra, keyof AccessUserBase>> {\n  return {\n    api: {\n      async getSession({ headers }) {\n        const result = await auth.api.getSession({ headers })\n        if (result && 'user' in result && result.user) {\n          const session = 'session' in result ? result.session : null\n          const activeOrganizationId =\n            session &&\n            'activeOrganizationId' in session &&\n            typeof session.activeOrganizationId === 'string'\n              ? session.activeOrganizationId\n              : null\n          const role =\n            'role' in result.user && typeof result.user.role === 'string'\n              ? result.user.role\n              : undefined\n          const emailVerified =\n            'emailVerified' in result.user && result.user.emailVerified === true\n          const mapped = sessionUser?.mapUser(\n            result.user as SessionUserSource,\n          ) as Record<string, unknown> | undefined\n          const extras = { ...mapped }\n          delete extras.id\n          delete extras.email\n          delete extras.emailVerified\n          delete extras.name\n          delete extras.role\n          return {\n            user: {\n              ...extras,\n              id: result.user.id,\n              email: result.user.email,\n              emailVerified,\n              name: result.user.name,\n              ...(role ? { role } : {}),\n            },\n            session: session ? { activeOrganizationId } : null,\n          }\n        }\n        return null\n      },\n    },\n  } as AuthSessionResolver<Omit<TExtra, keyof AccessUserBase>>\n}\n\n/**\n * Fill better-auth's email hooks from the workerstack email facade. Only fills\n * gaps: user-supplied handlers always win, and nothing is injected when email\n * isn't configured. emailAndPassword is only touched when the user enabled it\n * (injecting it unasked would enable the feature).\n */\nexport function withEmailAuthDefaults(\n  cfg: BetterAuthConfig,\n  email: EmailFacade,\n  emailConfigured: boolean,\n): BetterAuthConfig {\n  if (!emailConfigured) return cfg\n  const out: BetterAuthConfig = { ...cfg }\n\n  if (\n    cfg.emailAndPassword?.enabled &&\n    !cfg.emailAndPassword.sendResetPassword\n  ) {\n    out.emailAndPassword = {\n      ...cfg.emailAndPassword,\n      sendResetPassword: async ({ user, url }) => {\n        await email.send({\n          to: user.email,\n          subject: 'Reset your password',\n          text: `Click the link to reset your password:\\n\\n${url}\\n\\nIf you didn't request this, you can ignore this email.`,\n        })\n      },\n    }\n  }\n\n  if (!cfg.emailVerification?.sendVerificationEmail) {\n    out.emailVerification = {\n      ...cfg.emailVerification,\n      sendVerificationEmail: async ({ user, url }) => {\n        await email.send({\n          to: user.email,\n          subject: 'Verify your email',\n          text: `Click the link to verify your email address:\\n\\n${url}`,\n        })\n      },\n    }\n  }\n\n  return out\n}\n\nexport { withPasswordDefaults } from './auth-password'\n"]}

package/dist/backend-internals.d.ts

@@ -0,0 +1,35 @@
+import type { EnvConfigInput } from './env.js';
+import type { InspectedDefinition } from './inspect.js';
+import type { TickResult } from './jobs/index.js';
+import type { RuntimeOverrides } from './runtime.js';
+export declare const BACKEND_INTERNALS: unique symbol;
+export type RuntimeJobFailure = {
+    id: string;
+    name: string;
+    attempts: number;
+    lastError: string | null;
+};
+export type RuntimeTestJob = {
+    id: string;
+    name: string;
+    kind: 'job' | 'cron';
+    status: 'pending' | 'running' | 'succeeded' | 'failed';
+    attempts: number;
+    runAt: number;
+    dedupeKey: string | null;
+    lastError: string | null;
+};
+export type RuntimeTestingHandle = {
+    tick(now: number): Promise<TickResult>;
+    inspect(now: number): Promise<{
+        runnable: number;
+        failed: RuntimeJobFailure[];
+        jobs: RuntimeTestJob[];
+    }>;
+};
+export type BackendInternals<TApp> = {
+    readonly envSchema: EnvConfigInput | undefined;
+    inspect(source: Record<string, string | undefined>): InspectedDefinition;
+    start(source: Record<string, string | undefined>, overrides?: RuntimeOverrides, inspected?: InspectedDefinition): Promise<TApp>;
+};
+//# sourceMappingURL=backend-internals.d.ts.map

package/dist/backend-internals.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backend-internals.d.ts","sourceRoot":"","sources":["../src/backend-internals.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,OAAO,CAAA;AAC3C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAA;AACpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAA;AACxC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AAEjD,eAAO,MAAM,iBAAiB,EAAE,OAAO,MAEtC,CAAA;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC9B,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CACzB,CAAA;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,KAAK,GAAG,MAAM,CAAA;IACpB,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,CAAA;IACtD,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CACzB,CAAA;AAED,MAAM,MAAM,oBAAoB,GAAG;IACjC,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;IACtC,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QAC5B,QAAQ,EAAE,MAAM,CAAA;QAChB,MAAM,EAAE,iBAAiB,EAAE,CAAA;QAC3B,IAAI,EAAE,cAAc,EAAE,CAAA;KACvB,CAAC,CAAA;CACH,CAAA;AAED,MAAM,MAAM,gBAAgB,CAAC,IAAI,IAAI;IACnC,QAAQ,CAAC,SAAS,EAAE,cAAc,GAAG,SAAS,CAAA;IAC9C,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAAG,mBAAmB,CAAA;IACxE,KAAK,CACH,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,EAC1C,SAAS,CAAC,EAAE,gBAAgB,EAC5B,SAAS,CAAC,EAAE,mBAAmB,GAC9B,OAAO,CAAC,IAAI,CAAC,CAAA;CACjB,CAAA"}

package/dist/backend-internals.js

@@ -0,0 +1,2 @@
+export const BACKEND_INTERNALS = Symbol.for('workerstack.backend-internals');
+//# sourceMappingURL=backend-internals.js.map

package/dist/backend-internals.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"backend-internals.js","sourceRoot":"","sources":["../src/backend-internals.ts"],"names":[],"mappings":"AAKA,MAAM,CAAC,MAAM,iBAAiB,GAAkB,MAAM,CAAC,GAAG,CACxD,+BAA+B,CAChC,CAAA","sourcesContent":["import type { EnvConfigInput } from './env'\nimport type { InspectedDefinition } from './inspect'\nimport type { TickResult } from './jobs'\nimport type { RuntimeOverrides } from './runtime'\n\nexport const BACKEND_INTERNALS: unique symbol = Symbol.for(\n  'workerstack.backend-internals',\n)\n\nexport type RuntimeJobFailure = {\n  id: string\n  name: string\n  attempts: number\n  lastError: string | null\n}\n\nexport type RuntimeTestJob = {\n  id: string\n  name: string\n  kind: 'job' | 'cron'\n  status: 'pending' | 'running' | 'succeeded' | 'failed'\n  attempts: number\n  runAt: number\n  dedupeKey: string | null\n  lastError: string | null\n}\n\nexport type RuntimeTestingHandle = {\n  tick(now: number): Promise<TickResult>\n  inspect(now: number): Promise<{\n    runnable: number\n    failed: RuntimeJobFailure[]\n    jobs: RuntimeTestJob[]\n  }>\n}\n\nexport type BackendInternals<TApp> = {\n  readonly envSchema: EnvConfigInput | undefined\n  inspect(source: Record<string, string | undefined>): InspectedDefinition\n  start(\n    source: Record<string, string | undefined>,\n    overrides?: RuntimeOverrides,\n    inspected?: InspectedDefinition,\n  ): Promise<TApp>\n}\n"]}

package/dist/backend.d.ts

@@ -0,0 +1,63 @@
+import type { AnyRouter as AnyORPCRouter } from '@orpc/server';
+import type { SessionUserConfig, SessionUserExtraOf, TableAccessInput } from './access.js';
+import type { BetterAuthConfig, WorkerstackConfig, RealtimeConfigInput } from './config.js';
+import type { EnvConfigInput, ValidatedEnv } from './env.js';
+import type { WorkerstackJobsBuilder, JobsDefs } from './jobs/index.js';
+import type { WorkerstackManifest } from './manifest.js';
+import type { MessagingConfig } from './messaging/index.js';
+import type { Platform } from './platform.js';
+import type { WorkerstackApp, BucketNamesOf } from './runtime.js';
+import type { StorageConfigInput } from './storage/buckets.js';
+import type { TestMethod } from './testing/fixture.js';
+import { BACKEND_INTERNALS, type BackendInternals } from './backend-internals.js';
+export type StartOptions = {
+    env?: Record<string, string | undefined>;
+    /** Host services. Missing ones use in-memory defaults. */
+    platform?: Partial<Platform>;
+};
+export type WorkerstackBackend<TApp> = {
+    inspect(options?: StartOptions): WorkerstackManifest;
+    start(options?: StartOptions): Promise<TApp>;
+    test: TestMethod<TApp>;
+    readonly [BACKEND_INTERNALS]: BackendInternals<TApp>;
+};
+export type WorkerstackDefinitionConfig<TSchema extends Record<string, unknown>, TAccess extends Record<string, TableAccessInput> | undefined = undefined, TStorage extends StorageConfigInput | undefined = undefined, TEnv extends EnvConfigInput | undefined = undefined, TJobsDefs extends JobsDefs | undefined = undefined, TCustomApiRouter extends AnyORPCRouter | undefined = undefined, TRealtime = undefined, TMessaging extends MessagingConfig | undefined = undefined, TAuthConfig extends BetterAuthConfig = BetterAuthConfig, TSession extends SessionUserConfig<Record<string, unknown>> | undefined = undefined> = Omit<WorkerstackConfig<TSchema, TAccess, TStorage, TEnv, TCustomApiRouter, TAuthConfig, TSession>, 'realtime' | 'messaging' | 'api'> & {
+    /**
+     * An inline `api` or `jobs` builder receives the open `MessagingConfig`, not
+     * `TMessaging`. Naming `TMessaging` in a callback parameter makes TypeScript
+     * fix it before it reads the sibling `messaging` property, and the whole
+     * declaration then loses its inferred channels. Declare the builder in its
+     * own module with an annotated parameter to type `ctx.messaging` exactly —
+     * `defineApi({ schema, env, messaging })` and `WorkerstackJobsBuilder` both
+     * take the channel record.
+     */
+    realtime?: TRealtime;
+    messaging?: TMessaging;
+    api?: TCustomApiRouter | ((builder: import('./api/builder.js').WorkerstackApiBuilder<TSchema, ValidatedEnv<TEnv>, MessagingConfig, SessionUserExtraOf<TSession>>) => TCustomApiRouter);
+    jobs?: TJobsDefs | ((builder: WorkerstackJobsBuilder<TSchema, ValidatedEnv<TEnv>, MessagingConfig>) => TJobsDefs);
+};
+export declare function isWorkerstackBackend(value: unknown): value is WorkerstackBackend<unknown>;
+/**
+ * A configuration slot that may read validated environment values. The shape a
+ * slot produces reaches the manifest, so a callback belongs here to supply a
+ * key, a URL, or a sender — never to change which channels, buckets, or tables
+ * exist. Blueprint generation resolves the declaration against two accepted
+ * environments and rejects a shape that differs between them.
+ */
+export type EnvAware<TEnv extends EnvConfigInput | undefined, T> = T | ((env: ValidatedEnv<NoInfer<TEnv>>) => T);
+export type DatabaseSlot = WorkerstackConfig<Record<string, unknown>, undefined, undefined, undefined, undefined>['database'];
+/**
+ * The whole application in one object. `schema`, `access`, and the routers are
+ * plain data; the slots that hold credentials also accept a function of the
+ * validated environment.
+ */
+export type WorkerstackDeclaration<TSchema extends Record<string, unknown>, TEnv extends EnvConfigInput | undefined = undefined, TAccess extends Record<string, TableAccessInput> | undefined = undefined, TStorage extends StorageConfigInput | undefined = undefined, TJobsDefs extends JobsDefs | undefined = undefined, TCustomApiRouter extends AnyORPCRouter | undefined = undefined, TRealtime = undefined, TMessaging extends MessagingConfig | undefined = undefined, TAuthConfig extends BetterAuthConfig = BetterAuthConfig, TSession extends SessionUserConfig<Record<string, unknown>> | undefined = undefined> = Omit<WorkerstackDefinitionConfig<TSchema, TAccess, TStorage, TEnv, TJobsDefs, TCustomApiRouter, TRealtime, TMessaging, TAuthConfig, TSession>, 'database' | 'storage' | 'messaging' | 'realtime'> & {
+    /** Declared environment. Its names reach the blueprint; its values never do. */
+    env?: TEnv;
+    database: EnvAware<TEnv, DatabaseSlot>;
+    storage?: EnvAware<TEnv, TStorage>;
+    messaging?: EnvAware<TEnv, TMessaging>;
+    realtime?: EnvAware<TEnv, TRealtime>;
+};
+export declare function workerstack<TSchema extends Record<string, unknown>, const TEnv extends EnvConfigInput | undefined = undefined, const TAccess extends Record<string, TableAccessInput> | undefined = undefined, const TStorage extends StorageConfigInput | undefined = undefined, const TJobsDefs extends JobsDefs | undefined = undefined, TCustomApiRouter extends AnyORPCRouter | undefined = undefined, const TRealtime extends RealtimeConfigInput | undefined = undefined, const TMessaging extends MessagingConfig | undefined = undefined, const TAuthConfig extends BetterAuthConfig = BetterAuthConfig, const TSession extends SessionUserConfig<Record<string, unknown>> | undefined = undefined>(declaration: WorkerstackDeclaration<TSchema, TEnv, TAccess, TStorage, TJobsDefs, TCustomApiRouter, TRealtime, TMessaging, TAuthConfig, TSession>): WorkerstackBackend<WorkerstackApp<TSchema, TAccess, BucketNamesOf<TStorage>, TEnv, TJobsDefs, TCustomApiRouter, TRealtime, TMessaging, TAuthConfig>>;
+//# sourceMappingURL=backend.d.ts.map

package/dist/backend.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backend.d.ts","sourceRoot":"","sources":["../src/backend.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,IAAI,aAAa,EAAE,MAAM,cAAc,CAAA;AAE9D,OAAO,KAAK,EACV,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EACjB,MAAM,UAAU,CAAA;AACjB,OAAO,KAAK,EACV,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACpB,MAAM,UAAU,CAAA;AACjB,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,OAAO,CAAA;AACzD,OAAO,KAAK,EAAE,sBAAsB,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAA;AAC9D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAA;AACrD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAClD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAC1C,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAoB,MAAM,WAAW,CAAA;AAChF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AAC3D,OAAO,KAAK,EAAE,UAAU,EAAe,MAAM,mBAAmB,CAAA;AAEhE,OAAO,EAAE,iBAAiB,EAAE,KAAK,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAM9E,MAAM,MAAM,YAAY,GAAG;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAA;IACxC,0DAA0D;IAC1D,QAAQ,CAAC,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAA;CAC7B,CAAA;AAED,MAAM,MAAM,kBAAkB,CAAC,IAAI,IAAI;IACrC,OAAO,CAAC,OAAO,CAAC,EAAE,YAAY,GAAG,mBAAmB,CAAA;IACpD,KAAK,CAAC,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC5C,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,CAAA;IACtB,QAAQ,CAAC,CAAC,iBAAiB,CAAC,EAAE,gBAAgB,CAAC,IAAI,CAAC,CAAA;CACrD,CAAA;AAED,MAAM,MAAM,2BAA2B,CACrC,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACvC,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,GAAG,SAAS,GAAG,SAAS,EACxE,QAAQ,SAAS,kBAAkB,GAAG,SAAS,GAAG,SAAS,EAC3D,IAAI,SAAS,cAAc,GAAG,SAAS,GAAG,SAAS,EACnD,SAAS,SAAS,QAAQ,GAAG,SAAS,GAAG,SAAS,EAClD,gBAAgB,SAAS,aAAa,GAAG,SAAS,GAAG,SAAS,EAC9D,SAAS,GAAG,SAAS,EACrB,UAAU,SAAS,eAAe,GAAG,SAAS,GAAG,SAAS,EAC1D,WAAW,SAAS,gBAAgB,GAAG,gBAAgB,EACvD,QAAQ,SAAS,iBAAiB,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,GACrE,SAAS,IACT,IAAI,CACN,iBAAiB,CACf,OAAO,EACP,OAAO,EACP,QAAQ,EACR,IAAI,EACJ,gBAAgB,EAChB,WAAW,EACX,QAAQ,CACT,EACD,UAAU,GAAG,WAAW,GAAG,KAAK,CACjC,GAAG;IACF;;;;;;;;OAQG;IACH,QAAQ,CAAC,EAAE,SAAS,CAAA;IACpB,SAAS,CAAC,EAAE,UAAU,CAAA;IACtB,GAAG,CAAC,EACA,gBAAgB,GAChB,CAAC,CACC,OAAO,EAAE,OAAO,eAAe,EAAE,qBAAqB,CACpD,OAAO,EACP,YAAY,CAAC,IAAI,CAAC,EAClB,eAAe,EACf,kBAAkB,CAAC,QAAQ,CAAC,CAC7B,KACE,gBAAgB,CAAC,CAAA;IAC1B,IAAI,CAAC,EACD,SAAS,GACT,CAAC,CACC,OAAO,EAAE,sBAAsB,CAC7B,OAAO,EACP,YAAY,CAAC,IAAI,CAAC,EAClB,eAAe,CAChB,KACE,SAAS,CAAC,CAAA;CACpB,CAAA;AAED,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,OAAO,GACb,KAAK,IAAI,kBAAkB,CAAC,OAAO,CAAC,CAItC;AAED;;;;;;GAMG;AACH,MAAM,MAAM,QAAQ,CAAC,IAAI,SAAS,cAAc,GAAG,SAAS,EAAE,CAAC,IAC3D,CAAC,GACD,CAAC,CAAC,GAAG,EAAE,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAA;AAE7C,MAAM,MAAM,YAAY,GAAG,iBAAiB,CAC1C,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACvB,SAAS,EACT,SAAS,EACT,SAAS,EACT,SAAS,CACV,CAAC,UAAU,CAAC,CAAA;AAEb;;;;GAIG;AACH,MAAM,MAAM,sBAAsB,CAChC,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACvC,IAAI,SAAS,cAAc,GAAG,SAAS,GAAG,SAAS,EACnD,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,GAAG,SAAS,GAAG,SAAS,EACxE,QAAQ,SAAS,kBAAkB,GAAG,SAAS,GAAG,SAAS,EAC3D,SAAS,SAAS,QAAQ,GAAG,SAAS,GAAG,SAAS,EAClD,gBAAgB,SAAS,aAAa,GAAG,SAAS,GAAG,SAAS,EAC9D,SAAS,GAAG,SAAS,EACrB,UAAU,SAAS,eAAe,GAAG,SAAS,GAAG,SAAS,EAC1D,WAAW,SAAS,gBAAgB,GAAG,gBAAgB,EACvD,QAAQ,SAAS,iBAAiB,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,GACrE,SAAS,IACT,IAAI,CACN,2BAA2B,CACzB,OAAO,EACP,OAAO,EACP,QAAQ,EACR,IAAI,EACJ,SAAS,EACT,gBAAgB,EAChB,SAAS,EACT,UAAU,EACV,WAAW,EACX,QAAQ,CACT,EACD,UAAU,GAAG,SAAS,GAAG,WAAW,GAAG,UAAU,CAClD,GAAG;IACF,gFAAgF;IAChF,GAAG,CAAC,EAAE,IAAI,CAAA;IACV,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC,CAAA;IACtC,OAAO,CAAC,EAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IAClC,SAAS,CAAC,EAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC,CAAA;IACtC,QAAQ,CAAC,EAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;CACrC,CAAA;AAED,wBAAgB,WAAW,CACzB,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACvC,KAAK,CAAC,IAAI,SAAS,cAAc,GAAG,SAAS,GAAG,SAAS,EACzD,KAAK,CAAC,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,GAAG,SAAS,GAChE,SAAS,EACX,KAAK,CAAC,QAAQ,SAAS,kBAAkB,GAAG,SAAS,GAAG,SAAS,EACjE,KAAK,CAAC,SAAS,SAAS,QAAQ,GAAG,SAAS,GAAG,SAAS,EACxD,gBAAgB,SAAS,aAAa,GAAG,SAAS,GAAG,SAAS,EAC9D,KAAK,CAAC,SAAS,SAAS,mBAAmB,GAAG,SAAS,GAAG,SAAS,EACnE,KAAK,CAAC,UAAU,SAAS,eAAe,GAAG,SAAS,GAAG,SAAS,EAChE,KAAK,CAAC,WAAW,SAAS,gBAAgB,GAAG,gBAAgB,EAC7D,KAAK,CAAC,QAAQ,SACV,iBAAiB,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAC1C,SAAS,GAAG,SAAS,EAEzB,WAAW,EAAE,sBAAsB,CACjC,OAAO,EACP,IAAI,EACJ,OAAO,EACP,QAAQ,EACR,SAAS,EACT,gBAAgB,EAChB,SAAS,EACT,UAAU,EACV,WAAW,EACX,QAAQ,CACT,GACA,kBAAkB,CACnB,cAAc,CACZ,OAAO,EACP,OAAO,EACP,aAAa,CAAC,QAAQ,CAAC,EACvB,IAAI,EACJ,SAAS,EACT,gBAAgB,EAChB,SAAS,EACT,UAAU,EACV,WAAW,CACZ,CACF,CAAA"}

package/dist/backend.js

@@ -0,0 +1,59 @@
+import { BACKEND_INTERNALS } from './backend-internals.js';
+import { validateEnv } from './env.js';
+import { assertHostedBlueprintFile } from './hosted-contract.js';
+import { inspectConfig } from './inspect.js';
+import { materializeWorkerstack } from './runtime.js';
+export function isWorkerstackBackend(value) {
+    return (typeof value === 'object' && value !== null && BACKEND_INTERNALS in value);
+}
+export function workerstack(declaration) {
+    const { env: envSchema, ...slots } = declaration;
+    const inspect = (source) => {
+        const env = validateEnv(envSchema, { source });
+        const resolve = (value) => typeof value === 'function'
+            ? value(env)
+            : value;
+        const config = {
+            ...slots,
+            database: resolve(slots.database),
+            storage: resolve(slots.storage),
+            messaging: resolve(slots.messaging),
+            realtime: resolve(slots.realtime),
+        };
+        return inspectConfig(config, envSchema, env);
+    };
+    const start = async (source, overrides = {}, inspected = inspect(source)) => {
+        if (source.WORKERSTACK_BLUEPRINT_PATH) {
+            await assertHostedBlueprintFile(inspected.manifest, source.WORKERSTACK_BLUEPRINT_PATH);
+        }
+        return materializeWorkerstack({
+            ...inspected.config,
+            jobs: inspected.jobsDefs,
+            api: inspected.customApiRouter,
+        }, source, overrides, inspected.env);
+    };
+    let backend;
+    const test = (async (options) => {
+        const testing = await import('./testing.js');
+        return testing.createTestApp(backend, options);
+    });
+    test.configure = (options) => (async (overrides = {}) => {
+        const testing = await import('./testing.js');
+        return testing.configureTestApp(backend, options)(overrides);
+    });
+    backend = {
+        inspect: ({ env } = {}) => inspect(env ?? process.env)
+            .manifest,
+        start: async ({ env, platform } = {}) => await start(env ?? process.env, {
+            platform,
+        }),
+        test,
+        [BACKEND_INTERNALS]: {
+            envSchema,
+            inspect,
+            start,
+        },
+    };
+    return backend;
+}
+//# sourceMappingURL=backend.js.map

package/dist/backend.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"backend.js","sourceRoot":"","sources":["../src/backend.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,iBAAiB,EAAyB,MAAM,qBAAqB,CAAA;AAC9E,OAAO,EAAE,WAAW,EAAE,MAAM,OAAO,CAAA;AACnC,OAAO,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAA;AAC7D,OAAO,EAAE,aAAa,EAA4B,MAAM,WAAW,CAAA;AACnE,OAAO,EAAE,sBAAsB,EAAE,MAAM,WAAW,CAAA;AAuElD,MAAM,UAAU,oBAAoB,CAClC,KAAc;IAEd,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,iBAAiB,IAAI,KAAK,CAC1E,CAAA;AACH,CAAC;AAqGD,MAAM,UAAU,WAAW,CACzB,WAAiE;IAEjE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,KAAK,EAAE,GAAG,WAKpC,CAAA;IACD,MAAM,OAAO,GAAG,CAAC,MAA0C,EAAE,EAAE;QAC7D,MAAM,GAAG,GAAG,WAAW,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;QAC9C,MAAM,OAAO,GAAG,CAAC,KAAc,EAAE,EAAE,CACjC,OAAO,KAAK,KAAK,UAAU;YACzB,CAAC,CAAE,KAAwC,CAAC,GAAG,CAAC;YAChD,CAAC,CAAC,KAAK,CAAA;QACX,MAAM,MAAM,GAAG;YACb,GAAG,KAAK;YACR,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC;YACjC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;YAC/B,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC;YACnC,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC;SAClC,CAAA;QACD,OAAO,aAAa,CAAC,MAAe,EAAE,SAAS,EAAE,GAAG,CAAC,CAAA;IACvD,CAAC,CAAA;IAID,MAAM,KAAK,GAAG,KAAK,EACjB,MAA0C,EAC1C,YAA8B,EAAE,EAChC,YAAiC,OAAO,CAAC,MAAM,CAAC,EAClC,EAAE;QAChB,IAAI,MAAM,CAAC,0BAA0B,EAAE,CAAC;YACtC,MAAM,yBAAyB,CAC7B,SAAS,CAAC,QAAQ,EAClB,MAAM,CAAC,0BAA0B,CAClC,CAAA;QACH,CAAC;QACD,OAAO,sBAAsB,CAC3B;YACE,GAAG,SAAS,CAAC,MAAM;YACnB,IAAI,EAAE,SAAS,CAAC,QAAQ;YACxB,GAAG,EAAE,SAAS,CAAC,eAAe;SACtB,EACV,MAAM,EACN,SAAS,EACT,SAAS,CAAC,GAAG,CACE,CAAA;IACnB,CAAC,CAAA;IAED,IAAI,OAAgC,CAAA;IACpC,MAAM,IAAI,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;QAC9B,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAA;QACzC,OAAO,OAAO,CAAC,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;IAChD,CAAC,CAAoB,CAAA;IACrB,IAAI,CAAC,SAAS,GAAG,CAAC,OAAO,EAAE,EAAE,CAC3B,CAAC,KAAK,EAAE,YAAyB,EAAE,EAAE,EAAE;QACrC,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAA;QACzC,OAAO,OAAO,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,CAAA;IAC9D,CAAC,CAAU,CAAA;IACb,OAAO,GAAG;QACR,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,CACxB,OAAO,CAAC,GAAG,IAAK,OAAO,CAAC,GAA0C,CAAC;aAChE,QAAQ;QACb,KAAK,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,EAAE,CACtC,MAAM,KAAK,CAAC,GAAG,IAAK,OAAO,CAAC,GAA0C,EAAE;YACtE,QAAQ;SACT,CAAC;QACJ,IAAI;QACJ,CAAC,iBAAiB,CAAC,EAAE;YACnB,SAAS;YACT,OAAO;YACP,KAAK;SACN;KACF,CAAA;IACD,OAAO,OAAO,CAAA;AAChB,CAAC","sourcesContent":["import type { AnyRouter as AnyORPCRouter } from '@orpc/server'\n\nimport type {\n  SessionUserConfig,\n  SessionUserExtraOf,\n  TableAccessInput,\n} from './access'\nimport type {\n  BetterAuthConfig,\n  WorkerstackConfig,\n  RealtimeConfigInput,\n} from './config'\nimport type { EnvConfigInput, ValidatedEnv } from './env'\nimport type { WorkerstackJobsBuilder, JobsDefs } from './jobs'\nimport type { WorkerstackManifest } from './manifest'\nimport type { MessagingConfig } from './messaging'\nimport type { Platform } from './platform'\nimport type { WorkerstackApp, BucketNamesOf, RuntimeOverrides } from './runtime'\nimport type { StorageConfigInput } from './storage/buckets'\nimport type { TestMethod, TestOptions } from './testing/fixture'\n\nimport { BACKEND_INTERNALS, type BackendInternals } from './backend-internals'\nimport { validateEnv } from './env'\nimport { assertHostedBlueprintFile } from './hosted-contract'\nimport { inspectConfig, type InspectedDefinition } from './inspect'\nimport { materializeWorkerstack } from './runtime'\n\nexport type StartOptions = {\n  env?: Record<string, string | undefined>\n  /** Host services. Missing ones use in-memory defaults. */\n  platform?: Partial<Platform>\n}\n\nexport type WorkerstackBackend<TApp> = {\n  inspect(options?: StartOptions): WorkerstackManifest\n  start(options?: StartOptions): Promise<TApp>\n  test: TestMethod<TApp>\n  readonly [BACKEND_INTERNALS]: BackendInternals<TApp>\n}\n\nexport type WorkerstackDefinitionConfig<\n  TSchema extends Record<string, unknown>,\n  TAccess extends Record<string, TableAccessInput> | undefined = undefined,\n  TStorage extends StorageConfigInput | undefined = undefined,\n  TEnv extends EnvConfigInput | undefined = undefined,\n  TJobsDefs extends JobsDefs | undefined = undefined,\n  TCustomApiRouter extends AnyORPCRouter | undefined = undefined,\n  TRealtime = undefined,\n  TMessaging extends MessagingConfig | undefined = undefined,\n  TAuthConfig extends BetterAuthConfig = BetterAuthConfig,\n  TSession extends SessionUserConfig<Record<string, unknown>> | undefined =\n    undefined,\n> = Omit<\n  WorkerstackConfig<\n    TSchema,\n    TAccess,\n    TStorage,\n    TEnv,\n    TCustomApiRouter,\n    TAuthConfig,\n    TSession\n  >,\n  'realtime' | 'messaging' | 'api'\n> & {\n  /**\n   * An inline `api` or `jobs` builder receives the open `MessagingConfig`, not\n   * `TMessaging`. Naming `TMessaging` in a callback parameter makes TypeScript\n   * fix it before it reads the sibling `messaging` property, and the whole\n   * declaration then loses its inferred channels. Declare the builder in its\n   * own module with an annotated parameter to type `ctx.messaging` exactly —\n   * `defineApi({ schema, env, messaging })` and `WorkerstackJobsBuilder` both\n   * take the channel record.\n   */\n  realtime?: TRealtime\n  messaging?: TMessaging\n  api?:\n    | TCustomApiRouter\n    | ((\n        builder: import('./api/builder').WorkerstackApiBuilder<\n          TSchema,\n          ValidatedEnv<TEnv>,\n          MessagingConfig,\n          SessionUserExtraOf<TSession>\n        >,\n      ) => TCustomApiRouter)\n  jobs?:\n    | TJobsDefs\n    | ((\n        builder: WorkerstackJobsBuilder<\n          TSchema,\n          ValidatedEnv<TEnv>,\n          MessagingConfig\n        >,\n      ) => TJobsDefs)\n}\n\nexport function isWorkerstackBackend(\n  value: unknown,\n): value is WorkerstackBackend<unknown> {\n  return (\n    typeof value === 'object' && value !== null && BACKEND_INTERNALS in value\n  )\n}\n\n/**\n * A configuration slot that may read validated environment values. The shape a\n * slot produces reaches the manifest, so a callback belongs here to supply a\n * key, a URL, or a sender — never to change which channels, buckets, or tables\n * exist. Blueprint generation resolves the declaration against two accepted\n * environments and rejects a shape that differs between them.\n */\nexport type EnvAware<TEnv extends EnvConfigInput | undefined, T> =\n  | T\n  | ((env: ValidatedEnv<NoInfer<TEnv>>) => T)\n\nexport type DatabaseSlot = WorkerstackConfig<\n  Record<string, unknown>,\n  undefined,\n  undefined,\n  undefined,\n  undefined\n>['database']\n\n/**\n * The whole application in one object. `schema`, `access`, and the routers are\n * plain data; the slots that hold credentials also accept a function of the\n * validated environment.\n */\nexport type WorkerstackDeclaration<\n  TSchema extends Record<string, unknown>,\n  TEnv extends EnvConfigInput | undefined = undefined,\n  TAccess extends Record<string, TableAccessInput> | undefined = undefined,\n  TStorage extends StorageConfigInput | undefined = undefined,\n  TJobsDefs extends JobsDefs | undefined = undefined,\n  TCustomApiRouter extends AnyORPCRouter | undefined = undefined,\n  TRealtime = undefined,\n  TMessaging extends MessagingConfig | undefined = undefined,\n  TAuthConfig extends BetterAuthConfig = BetterAuthConfig,\n  TSession extends SessionUserConfig<Record<string, unknown>> | undefined =\n    undefined,\n> = Omit<\n  WorkerstackDefinitionConfig<\n    TSchema,\n    TAccess,\n    TStorage,\n    TEnv,\n    TJobsDefs,\n    TCustomApiRouter,\n    TRealtime,\n    TMessaging,\n    TAuthConfig,\n    TSession\n  >,\n  'database' | 'storage' | 'messaging' | 'realtime'\n> & {\n  /** Declared environment. Its names reach the blueprint; its values never do. */\n  env?: TEnv\n  database: EnvAware<TEnv, DatabaseSlot>\n  storage?: EnvAware<TEnv, TStorage>\n  messaging?: EnvAware<TEnv, TMessaging>\n  realtime?: EnvAware<TEnv, TRealtime>\n}\n\nexport function workerstack<\n  TSchema extends Record<string, unknown>,\n  const TEnv extends EnvConfigInput | undefined = undefined,\n  const TAccess extends Record<string, TableAccessInput> | undefined =\n    undefined,\n  const TStorage extends StorageConfigInput | undefined = undefined,\n  const TJobsDefs extends JobsDefs | undefined = undefined,\n  TCustomApiRouter extends AnyORPCRouter | undefined = undefined,\n  const TRealtime extends RealtimeConfigInput | undefined = undefined,\n  const TMessaging extends MessagingConfig | undefined = undefined,\n  const TAuthConfig extends BetterAuthConfig = BetterAuthConfig,\n  const TSession extends\n    | SessionUserConfig<Record<string, unknown>>\n    | undefined = undefined,\n>(\n  declaration: WorkerstackDeclaration<\n    TSchema,\n    TEnv,\n    TAccess,\n    TStorage,\n    TJobsDefs,\n    TCustomApiRouter,\n    TRealtime,\n    TMessaging,\n    TAuthConfig,\n    TSession\n  >,\n): WorkerstackBackend<\n  WorkerstackApp<\n    TSchema,\n    TAccess,\n    BucketNamesOf<TStorage>,\n    TEnv,\n    TJobsDefs,\n    TCustomApiRouter,\n    TRealtime,\n    TMessaging,\n    TAuthConfig\n  >\n>\nexport function workerstack(\n  declaration: WorkerstackDeclaration<Record<string, unknown>, any>,\n): WorkerstackBackend<any> {\n  const { env: envSchema, ...slots } = declaration as Record<\n    string,\n    unknown\n  > & {\n    env?: EnvConfigInput\n  }\n  const inspect = (source: Record<string, string | undefined>) => {\n    const env = validateEnv(envSchema, { source })\n    const resolve = (value: unknown) =>\n      typeof value === 'function'\n        ? (value as (given: typeof env) => unknown)(env)\n        : value\n    const config = {\n      ...slots,\n      database: resolve(slots.database),\n      storage: resolve(slots.storage),\n      messaging: resolve(slots.messaging),\n      realtime: resolve(slots.realtime),\n    }\n    return inspectConfig(config as never, envSchema, env)\n  }\n\n  type App = WorkerstackApp<any, any, any, any, any, any, any, any, any>\n\n  const start = async (\n    source: Record<string, string | undefined>,\n    overrides: RuntimeOverrides = {},\n    inspected: InspectedDefinition = inspect(source),\n  ): Promise<App> => {\n    if (source.WORKERSTACK_BLUEPRINT_PATH) {\n      await assertHostedBlueprintFile(\n        inspected.manifest,\n        source.WORKERSTACK_BLUEPRINT_PATH,\n      )\n    }\n    return materializeWorkerstack(\n      {\n        ...inspected.config,\n        jobs: inspected.jobsDefs,\n        api: inspected.customApiRouter,\n      } as never,\n      source,\n      overrides,\n      inspected.env,\n    ) as Promise<App>\n  }\n\n  let backend: WorkerstackBackend<App>\n  const test = (async (options) => {\n    const testing = await import('./testing')\n    return testing.createTestApp(backend, options)\n  }) as TestMethod<App>\n  test.configure = (options) =>\n    (async (overrides: TestOptions = {}) => {\n      const testing = await import('./testing')\n      return testing.configureTestApp(backend, options)(overrides)\n    }) as never\n  backend = {\n    inspect: ({ env } = {}) =>\n      inspect(env ?? (process.env as Record<string, string | undefined>))\n        .manifest,\n    start: async ({ env, platform } = {}) =>\n      await start(env ?? (process.env as Record<string, string | undefined>), {\n        platform,\n      }),\n    test,\n    [BACKEND_INTERNALS]: {\n      envSchema,\n      inspect,\n      start,\n    },\n  }\n  return backend\n}\n"]}

package/dist/blueprint-generator.d.ts

@@ -0,0 +1,21 @@
+import { type WorkerBlueprint } from './blueprint.js';
+export type GenerateBlueprintOptions = {
+    directory: string;
+    entry?: string;
+    output?: string;
+    check?: boolean;
+    hostedCheck?: boolean;
+    /** UTC date for a new compatibilityDate; tests pin it. */
+    today?: string;
+};
+export type GenerateBlueprintResult = {
+    path: string;
+    blueprint: WorkerBlueprint;
+    source: string;
+    changed: boolean;
+};
+export declare class BlueprintCheckError extends Error {
+    constructor();
+}
+export declare function generateBlueprint(options: GenerateBlueprintOptions): Promise<GenerateBlueprintResult>;
+//# sourceMappingURL=blueprint-generator.d.ts.map

package/dist/blueprint-generator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"blueprint-generator.d.ts","sourceRoot":"","sources":["../src/blueprint-generator.ts"],"names":[],"mappings":"AAeA,OAAO,EAKL,KAAK,eAAe,EAGrB,MAAM,aAAa,CAAA;AAMpB,MAAM,MAAM,wBAAwB,GAAG;IACrC,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB,0DAA0D;IAC1D,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,CAAA;AAED,MAAM,MAAM,uBAAuB,GAAG;IACpC,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,eAAe,CAAA;IAC1B,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,OAAO,CAAA;CACjB,CAAA;AAED,qBAAa,mBAAoB,SAAQ,KAAK;;CAO7C;AAiJD,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,uBAAuB,CAAC,CAwHlC"}