@dreamshive/better-auth-tauri 0.1.0

package/dist/client.js

@@ -0,0 +1,377 @@
+import { parseSetCookieHeader, SECURE_COOKIE_PREFIX, stripSecureCookiePrefix, } from "better-auth/cookies";
+import { createSchemeURL, getOrigin, isTauriRuntime, safeJSONParse } from "./utils";
+import { setupTauriFocusManager } from "./focus-manager";
+import { setupTauriOnlineManager } from "./online-manager";
+import { PACKAGE_VERSION } from "./version";
+/* -------------------------------------------------------------------------- */
+/*  Cookie jar helpers                                                        */
+/* -------------------------------------------------------------------------- */
+function getSetCookie(header, prevCookie) {
+    const parsed = parseSetCookieHeader(header);
+    const toSetCookie = safeJSONParse(prevCookie) ?? {};
+    parsed.forEach((cookie, key) => {
+        const expiresAt = cookie["expires"];
+        const maxAge = cookie["max-age"];
+        if (maxAge !== undefined && Number(maxAge) <= 0) {
+            delete toSetCookie[key];
+            return;
+        }
+        const expires = maxAge
+            ? new Date(Date.now() + Number(maxAge) * 1000)
+            : expiresAt
+                ? new Date(String(expiresAt))
+                : null;
+        if (expires && expires.getTime() <= Date.now()) {
+            delete toSetCookie[key];
+            return;
+        }
+        toSetCookie[key] = {
+            value: cookie["value"],
+            expires: expires ? expires.toISOString() : null,
+        };
+    });
+    return JSON.stringify(toSetCookie);
+}
+function getCookie(cookie) {
+    const parsed = safeJSONParse(cookie) ?? {};
+    return Object.entries(parsed).reduce((acc, [key, value]) => {
+        if (value.expires && new Date(value.expires) < new Date())
+            return acc;
+        return acc ? `${acc}; ${key}=${value.value}` : `${key}=${value.value}`;
+    }, "");
+}
+function getOAuthStateValue(cookieJson, cookiePrefix) {
+    if (!cookieJson)
+        return null;
+    const parsed = safeJSONParse(cookieJson);
+    if (!parsed)
+        return null;
+    const prefixes = Array.isArray(cookiePrefix) ? cookiePrefix : [cookiePrefix];
+    for (const prefix of prefixes) {
+        for (const name of [
+            `${SECURE_COOKIE_PREFIX}${prefix}.oauth_state`,
+            `${prefix}.oauth_state`,
+        ]) {
+            const value = parsed?.[name]?.value;
+            if (value)
+                return value;
+        }
+    }
+    return null;
+}
+/** Only notify `$sessionSignal` when the session cookie values actually changed. */
+function hasSessionCookieChanged(prevCookie, newCookie) {
+    if (!prevCookie)
+        return true;
+    try {
+        const prev = JSON.parse(prevCookie);
+        const next = JSON.parse(newCookie);
+        const keys = new Set();
+        for (const k of Object.keys(prev)) {
+            if (k.includes("session_token") || k.includes("session_data"))
+                keys.add(k);
+        }
+        for (const k of Object.keys(next)) {
+            if (k.includes("session_token") || k.includes("session_data"))
+                keys.add(k);
+        }
+        for (const k of keys) {
+            if (prev[k]?.value !== next[k]?.value)
+                return true;
+        }
+        return false;
+    }
+    catch {
+        return true;
+    }
+}
+/** Is this Set-Cookie header ours, or third-party (Cloudflare, analytics)? */
+function hasBetterAuthCookies(setCookieHeader, cookiePrefix) {
+    const cookies = parseSetCookieHeader(setCookieHeader);
+    const prefixes = Array.isArray(cookiePrefix) ? cookiePrefix : [cookiePrefix];
+    const suffixes = ["session_token", "session_data"];
+    for (const name of cookies.keys()) {
+        const bare = stripSecureCookiePrefix(name);
+        for (const prefix of prefixes) {
+            if (prefix) {
+                if (bare.startsWith(prefix))
+                    return true;
+            }
+            else {
+                for (const s of suffixes)
+                    if (bare.endsWith(s))
+                        return true;
+            }
+        }
+    }
+    return false;
+}
+/** Some storage backends (keychains) reject `:` in keys. */
+function normalizeKey(name) {
+    return name.replace(/:/g, "_");
+}
+function wrapStorage(storage) {
+    return {
+        async getItem(name) {
+            const v = await storage.getItem(normalizeKey(name));
+            return v ?? null;
+        },
+        async setItem(name, value) {
+            await storage.setItem(normalizeKey(name), value);
+        },
+    };
+}
+/* -------------------------------------------------------------------------- */
+/*  Deep-link OAuth flow                                                      */
+/* -------------------------------------------------------------------------- */
+/**
+ * Open a URL in the user's default system browser and wait for the
+ * `{scheme}://` deep-link callback. Resolves with the full callback URL
+ * (which includes `?cookie=...` thanks to the server plugin's `after` hook).
+ */
+async function openAuthSession(urlToOpen, scheme) {
+    // Peer-deps are resolved lazily so the package can be imported in a
+    // non-Tauri context (e.g. `bun dev` in a browser) without a hard failure.
+    const [{ open: openShell }, { onOpenUrl }] = await Promise.all([
+        import("@tauri-apps/plugin-shell"),
+        import("@tauri-apps/plugin-deep-link"),
+    ]);
+    const callback = new Promise((resolve, reject) => {
+        let settled = false;
+        const timeout = setTimeout(() => {
+            if (settled)
+                return;
+            settled = true;
+            reject(new Error("OAuth timed out — no deep-link callback received"));
+        }, 5 * 60 * 1000);
+        // `onOpenUrl` returns a Promise<UnlistenFn>. We unlisten as soon as we get
+        // a URL that matches our scheme so we don't leak event subscriptions.
+        const unlistenPromise = onOpenUrl((urls) => {
+            const match = urls.find((u) => u.startsWith(`${scheme}://`));
+            if (!match)
+                return;
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timeout);
+            unlistenPromise.then((fn) => fn()).catch(() => { });
+            resolve(match);
+        });
+    });
+    await openShell(urlToOpen);
+    return callback;
+}
+/* -------------------------------------------------------------------------- */
+/*  Client plugin                                                             */
+/* -------------------------------------------------------------------------- */
+export const tauriClient = (opts) => {
+    if (!opts.scheme) {
+        throw new Error("[better-auth-tauri] `scheme` is required. Pass the custom URI scheme " +
+            "you registered in tauri.conf.json (e.g. 'sokudo').");
+    }
+    const storagePrefix = opts.storagePrefix || "better-auth";
+    const cookieName = `${storagePrefix}_cookie`;
+    const localCacheName = `${storagePrefix}_session_data`;
+    const cookiePrefix = opts.cookiePrefix || "better-auth";
+    const storage = wrapStorage(opts.storage);
+    const scheme = opts.scheme;
+    const refetchOnWindowFocus = opts.refetchOnWindowFocus !== false;
+    const refetchOnReconnect = opts.refetchOnReconnect !== false;
+    let store = null;
+    return {
+        id: "tauri",
+        getActions(_, $store) {
+            store = $store;
+            // Wire up focus + online refetch managers once the store is
+            // available. No-op outside Tauri runtime. These fire-and-forget —
+            // the subscriptions live for the process lifetime.
+            if (isTauriRuntime() && store) {
+                if (refetchOnWindowFocus) {
+                    setupTauriFocusManager(store).catch(() => { });
+                }
+                if (refetchOnReconnect) {
+                    setupTauriOnlineManager(store);
+                }
+            }
+            return {
+                /**
+                 * Returns the currently-stored cookie string in the standard
+                 * `key=value; key2=value2` format — useful if you need to attach it
+                 * to a custom fetch outside of the Better Auth client.
+                 */
+                getCookie: async () => {
+                    const raw = await storage.getItem(cookieName);
+                    return getCookie(raw || "{}");
+                },
+            };
+        },
+        fetchPlugins: [
+            {
+                id: "tauri",
+                name: "Tauri",
+                hooks: {
+                    async onSuccess(context) {
+                        // In a plain-browser dev environment the default cookie flow
+                        // works fine — skip the deep-link machinery.
+                        if (!isTauriRuntime())
+                            return;
+                        const setCookieHeader = context.response.headers.get("set-cookie");
+                        if (setCookieHeader) {
+                            if (hasBetterAuthCookies(setCookieHeader, cookiePrefix)) {
+                                const prev = await storage.getItem(cookieName);
+                                const next = getSetCookie(setCookieHeader, prev ?? undefined);
+                                await storage.setItem(cookieName, next);
+                                if (hasSessionCookieChanged(prev, next)) {
+                                    store?.notify("$sessionSignal");
+                                }
+                            }
+                        }
+                        if (context.request.url.toString().includes("/get-session") &&
+                            !opts.disableCache) {
+                            await storage.setItem(localCacheName, JSON.stringify(context.data));
+                        }
+                        // Detect social / generic-oauth sign-in responses that include
+                        // an authorization URL. We check the URL instead of the
+                        // `redirect` flag because our init hook sets
+                        // `disableRedirect: true` on these requests (to stop Better
+                        // Auth's Vue client from window.location-navigating the Tauri
+                        // webview), which causes the server to respond with
+                        // `redirect: false`. The presence of `url` is the reliable
+                        // signal that this is an OAuth start response.
+                        const requestURL = context.request.url.toString();
+                        const isSignInRedirect = typeof context.data?.url === "string" &&
+                            (requestURL.includes("/sign-in/social") ||
+                                requestURL.includes("/sign-in/oauth2") ||
+                                requestURL.includes("/link-social"));
+                        if (!isSignInRedirect)
+                            return;
+                        const bodyStr = typeof context.request?.body === "string"
+                            ? context.request.body
+                            : JSON.stringify(context.request?.body ?? {});
+                        if (bodyStr.includes("idToken"))
+                            return; // silent native flow
+                        const signInURL = context.data.url;
+                        // Prevent Better Auth's Vue/React client from auto-navigating
+                        // the Tauri webview to the OAuth URL via window.location.href.
+                        // On web this is the correct default; in a Tauri webview it
+                        // would take over the app's own window with the provider's
+                        // login page. We open the system browser ourselves below.
+                        context.data.redirect = false;
+                        context.data.url = undefined;
+                        // Route the system-browser navigation through the server-side
+                        // `tauriAuthorizationProxy` endpoint so the OAuth `state` cookie
+                        // gets planted in the browser's cookie jar before the provider
+                        // redirect. Without this, Better Auth's callback state check
+                        // fails because the state cookie was set on the /sign-in/social
+                        // response inside the Tauri webview — a different cookie jar.
+                        //
+                        // If we have a previously-stored `oauth_state` (from an earlier
+                        // sign-in attempt), forward it to the proxy so it can be
+                        // re-seeded instead of re-derived from the URL.
+                        const storedCookieJson = await storage.getItem(cookieName);
+                        const oauthStateValue = getOAuthStateValue(storedCookieJson, cookiePrefix);
+                        const params = new URLSearchParams({
+                            authorizationURL: signInURL,
+                        });
+                        if (oauthStateValue) {
+                            params.append("oauthState", oauthStateValue);
+                        }
+                        const proxyURL = `${context.request.baseURL}/tauri-authorization-proxy?${params.toString()}`;
+                        try {
+                            const callbackURL = await openAuthSession(proxyURL, scheme);
+                            const parsed = new URL(callbackURL);
+                            const cookie = parsed.searchParams.get("cookie");
+                            if (!cookie)
+                                return;
+                            const prev = await storage.getItem(cookieName);
+                            const next = getSetCookie(cookie, prev ?? undefined);
+                            await storage.setItem(cookieName, next);
+                            store?.notify("$sessionSignal");
+                        }
+                        catch (err) {
+                            // Re-throw so the caller of signIn.social() sees the failure.
+                            throw err;
+                        }
+                    },
+                },
+                async init(url, options) {
+                    if (!isTauriRuntime()) {
+                        return { url, options };
+                    }
+                    options = options || {};
+                    options.credentials = "omit";
+                    // Native ID-token flow (e.g. Sign in with Apple) doesn't need
+                    // cookie/origin handling — the token is verified server-side.
+                    const isIdTokenRequest = options.body?.idToken !==
+                        undefined;
+                    if (isIdTokenRequest) {
+                        options.headers = {
+                            ...options.headers,
+                            "x-skip-oauth-proxy": "true",
+                        };
+                    }
+                    else {
+                        const stored = await storage.getItem(cookieName);
+                        const cookie = getCookie(stored || "{}");
+                        options.headers = {
+                            ...options.headers,
+                            // "Cookie" is a forbidden header name per the Fetch spec
+                            // and gets silently dropped by the Headers constructor
+                            // (which runs inside `new Request(...)` before the request
+                            // ever reaches Rust / tauriFetch). Smuggle the value under
+                            // a custom header and let the server plugin rewrite it to
+                            // "Cookie" inside onRequest — round-trip equivalent.
+                            ...(cookie ? { "x-tauri-cookie": cookie } : {}),
+                            "tauri-origin": getOrigin(scheme),
+                            "x-skip-oauth-proxy": "true",
+                        };
+                        // Rewrite any relative callbackURL the caller passed as a path
+                        // (e.g. "/") to the Tauri-facing custom-scheme deep link, so
+                        // Better Auth's final redirect lands on our deep-link handler.
+                        const body = options.body;
+                        if (body) {
+                            for (const key of [
+                                "callbackURL",
+                                "newUserCallbackURL",
+                                "errorCallbackURL",
+                            ]) {
+                                const value = body[key];
+                                if (typeof value === "string" && value.startsWith("/")) {
+                                    body[key] = createSchemeURL(value, scheme);
+                                }
+                            }
+                            // For social/oauth sign-in routes, force `disableRedirect`
+                            // so Better Auth's Vue/React client does NOT navigate the
+                            // Tauri webview to the OAuth provider URL. We open the
+                            // system browser ourselves in the onSuccess hook below.
+                            // Without this, the webview takes over with the provider's
+                            // login page and the user's own app UI is lost.
+                            if (url.includes("/sign-in/social") ||
+                                url.includes("/sign-in/oauth2") ||
+                                url.includes("/link-social")) {
+                                body.disableRedirect = true;
+                            }
+                        }
+                        // Clear local state on sign-out so the app immediately reflects
+                        // the logged-out state.
+                        if (url.includes("/sign-out")) {
+                            await storage.setItem(cookieName, "{}");
+                            await storage.setItem(localCacheName, "{}");
+                            store?.atoms?.session?.set({
+                                ...store.atoms.session.get(),
+                                data: null,
+                                error: null,
+                                isPending: false,
+                            });
+                        }
+                    }
+                    return { url, options };
+                },
+            },
+        ],
+    };
+};
+export { PACKAGE_VERSION } from "./version";
+export { setupTauriFocusManager } from "./focus-manager";
+export { setupTauriOnlineManager } from "./online-manager";
+//# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACpF,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAkE5C,gFAAgF;AAChF,gFAAgF;AAChF,gFAAgF;AAEhF,SAAS,YAAY,CAAC,MAAc,EAAE,UAA+B;IACnE,MAAM,MAAM,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,WAAW,GAAG,aAAa,CAA+B,UAAU,CAAC,IAAI,EAAE,CAAC;IAClF,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;QAC7B,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;QACpC,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;QACjC,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YAChD,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC;YACxB,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,MAAM;YACpB,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;YAC9C,CAAC,CAAC,SAAS;gBACT,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBAC7B,CAAC,CAAC,IAAI,CAAC;QACX,IAAI,OAAO,IAAI,OAAO,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC/C,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC;YACxB,OAAO;QACT,CAAC;QACD,WAAW,CAAC,GAAG,CAAC,GAAG;YACjB,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC;YACtB,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI;SAChD,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,SAAS,CAAC,MAAc;IAC/B,MAAM,MAAM,GAAG,aAAa,CAA+B,MAAM,CAAC,IAAI,EAAE,CAAC;IACzE,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE;QACzD,IAAI,KAAK,CAAC,OAAO,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,EAAE;YAAE,OAAO,GAAG,CAAC;QACtE,OAAO,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,KAAK,GAAG,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;IACzE,CAAC,EAAE,EAAE,CAAC,CAAC;AACT,CAAC;AAED,SAAS,kBAAkB,CACzB,UAAyB,EACzB,YAA+B;IAE/B,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAC7B,MAAM,MAAM,GAAG,aAAa,CAA+B,UAAU,CAAC,CAAC;IACvE,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;IAC7E,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,KAAK,MAAM,IAAI,IAAI;YACjB,GAAG,oBAAoB,GAAG,MAAM,cAAc;YAC9C,GAAG,MAAM,cAAc;SACxB,EAAE,CAAC;YACF,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC;YACpC,IAAI,KAAK;gBAAE,OAAO,KAAK,CAAC;QAC1B,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,oFAAoF;AACpF,SAAS,uBAAuB,CAC9B,UAAyB,EACzB,SAAiB;IAEjB,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAC7B,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAiC,CAAC;QACpE,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAiC,CAAC;QACnE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAClC,IAAI,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC;gBAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC7E,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAClC,IAAI,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC;gBAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC7E,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK;gBAAE,OAAO,IAAI,CAAC;QACrD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,SAAS,oBAAoB,CAC3B,eAAuB,EACvB,YAA+B;IAE/B,MAAM,OAAO,GAAG,oBAAoB,CAAC,eAAe,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;IAC7E,MAAM,QAAQ,GAAG,CAAC,eAAe,EAAE,cAAc,CAAC,CAAC;IACnD,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;QAC3C,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;YAC9B,IAAI,MAAM,EAAE,CAAC;gBACX,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;oBAAE,OAAO,IAAI,CAAC;YAC3C,CAAC;iBAAM,CAAC;gBACN,KAAK,MAAM,CAAC,IAAI,QAAQ;oBAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;wBAAE,OAAO,IAAI,CAAC;YAC9D,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,4DAA4D;AAC5D,SAAS,YAAY,CAAC,IAAY;IAChC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,WAAW,CAAC,OAA2B;IAC9C,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,IAAY;YACxB,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;YACpD,OAAO,CAAC,IAAI,IAAI,CAAC;QACnB,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,IAAY,EAAE,KAAa;YACvC,MAAM,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;QACnD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,gFAAgF;AAChF,gFAAgF;AAEhF;;;;GAIG;AACH,KAAK,UAAU,eAAe,CAC5B,SAAiB,EACjB,MAAc;IAEd,oEAAoE;IACpE,0EAA0E;IAC1E,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC7D,MAAM,CAAC,0BAA0B,CAAC;QAClC,MAAM,CAAC,8BAA8B,CAAC;KACvC,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACvD,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,OAAO,GAAG,UAAU,CACxB,GAAG,EAAE;YACH,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,MAAM,CAAC,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC,CAAC;QACxE,CAAC,EACD,CAAC,GAAG,EAAE,GAAG,IAAI,CACd,CAAC;QAEF,2EAA2E;QAC3E,sEAAsE;QACtE,MAAM,eAAe,GAAG,SAAS,CAAC,CAAC,IAAc,EAAE,EAAE;YACnD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC;YAC7D,IAAI,CAAC,KAAK;gBAAE,OAAO;YACnB,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,YAAY,CAAC,OAAO,CAAC,CAAC;YACtB,eAAe,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACnD,OAAO,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,SAAS,CAAC,SAAS,CAAC,CAAC;IAC3B,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,gFAAgF;AAChF,gFAAgF;AAChF,gFAAgF;AAEhF,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,IAAwB,EAAE,EAAE;IACtD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,uEAAuE;YACrE,oDAAoD,CACvD,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,aAAa,CAAC;IAC1D,MAAM,UAAU,GAAG,GAAG,aAAa,SAAS,CAAC;IAC7C,MAAM,cAAc,GAAG,GAAG,aAAa,eAAe,CAAC;IACvD,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,aAAa,CAAC;IACxD,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAC3B,MAAM,oBAAoB,GAAG,IAAI,CAAC,oBAAoB,KAAK,KAAK,CAAC;IACjE,MAAM,kBAAkB,GAAG,IAAI,CAAC,kBAAkB,KAAK,KAAK,CAAC;IAE7D,IAAI,KAAK,GAAuB,IAAI,CAAC;IAErC,OAAO;QACL,EAAE,EAAE,OAAO;QACX,UAAU,CAAC,CAAC,EAAE,MAAM;YAClB,KAAK,GAAG,MAAM,CAAC;YAEf,4DAA4D;YAC5D,kEAAkE;YAClE,mDAAmD;YACnD,IAAI,cAAc,EAAE,IAAI,KAAK,EAAE,CAAC;gBAC9B,IAAI,oBAAoB,EAAE,CAAC;oBACzB,sBAAsB,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBAChD,CAAC;gBACD,IAAI,kBAAkB,EAAE,CAAC;oBACvB,uBAAuB,CAAC,KAAK,CAAC,CAAC;gBACjC,CAAC;YACH,CAAC;YACD,OAAO;gBACL;;;;mBAIG;gBACH,SAAS,EAAE,KAAK,IAAI,EAAE;oBACpB,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;oBAC9C,OAAO,SAAS,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;gBAChC,CAAC;aACF,CAAC;QACJ,CAAC;QACD,YAAY,EAAE;YACZ;gBACE,EAAE,EAAE,OAAO;gBACX,IAAI,EAAE,OAAO;gBACb,KAAK,EAAE;oBACL,KAAK,CAAC,SAAS,CAAC,OAAO;wBACrB,6DAA6D;wBAC7D,6CAA6C;wBAC7C,IAAI,CAAC,cAAc,EAAE;4BAAE,OAAO;wBAE9B,MAAM,eAAe,GAAG,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;wBACnE,IAAI,eAAe,EAAE,CAAC;4BACpB,IAAI,oBAAoB,CAAC,eAAe,EAAE,YAAY,CAAC,EAAE,CAAC;gCACxD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;gCAC/C,MAAM,IAAI,GAAG,YAAY,CAAC,eAAe,EAAE,IAAI,IAAI,SAAS,CAAC,CAAC;gCAC9D,MAAM,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;gCACxC,IAAI,uBAAuB,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;oCACxC,KAAK,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;gCAClC,CAAC;4BACH,CAAC;wBACH,CAAC;wBAED,IACE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC;4BACvD,CAAC,IAAI,CAAC,YAAY,EAClB,CAAC;4BACD,MAAM,OAAO,CAAC,OAAO,CAAC,cAAc,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;wBACtE,CAAC;wBAED,+DAA+D;wBAC/D,wDAAwD;wBACxD,6CAA6C;wBAC7C,4DAA4D;wBAC5D,8DAA8D;wBAC9D,oDAAoD;wBACpD,2DAA2D;wBAC3D,+CAA+C;wBAC/C,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;wBAClD,MAAM,gBAAgB,GACpB,OAAO,OAAO,CAAC,IAAI,EAAE,GAAG,KAAK,QAAQ;4BACrC,CAAC,UAAU,CAAC,QAAQ,CAAC,iBAAiB,CAAC;gCACrC,UAAU,CAAC,QAAQ,CAAC,iBAAiB,CAAC;gCACtC,UAAU,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;wBAEzC,IAAI,CAAC,gBAAgB;4BAAE,OAAO;wBAE9B,MAAM,OAAO,GACX,OAAO,OAAO,CAAC,OAAO,EAAE,IAAI,KAAK,QAAQ;4BACvC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI;4BACtB,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;wBAClD,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;4BAAE,OAAO,CAAC,qBAAqB;wBAE9D,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,GAAa,CAAC;wBAE7C,8DAA8D;wBAC9D,+DAA+D;wBAC/D,4DAA4D;wBAC5D,2DAA2D;wBAC3D,0DAA0D;wBAC1D,OAAO,CAAC,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC;wBAC9B,OAAO,CAAC,IAAI,CAAC,GAAG,GAAG,SAAS,CAAC;wBAE7B,8DAA8D;wBAC9D,iEAAiE;wBACjE,+DAA+D;wBAC/D,6DAA6D;wBAC7D,gEAAgE;wBAChE,8DAA8D;wBAC9D,EAAE;wBACF,gEAAgE;wBAChE,yDAAyD;wBACzD,gDAAgD;wBAChD,MAAM,gBAAgB,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;wBAC3D,MAAM,eAAe,GAAG,kBAAkB,CACxC,gBAAgB,EAChB,YAAY,CACb,CAAC;wBACF,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;4BACjC,gBAAgB,EAAE,SAAS;yBAC5B,CAAC,CAAC;wBACH,IAAI,eAAe,EAAE,CAAC;4BACpB,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;wBAC/C,CAAC;wBACD,MAAM,QAAQ,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,8BAA8B,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;wBAE7F,IAAI,CAAC;4BACH,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;4BAC5D,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;4BACpC,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;4BACjD,IAAI,CAAC,MAAM;gCAAE,OAAO;4BACpB,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;4BAC/C,MAAM,IAAI,GAAG,YAAY,CAAC,MAAM,EAAE,IAAI,IAAI,SAAS,CAAC,CAAC;4BACrD,MAAM,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;4BACxC,KAAK,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;wBAClC,CAAC;wBAAC,OAAO,GAAG,EAAE,CAAC;4BACb,8DAA8D;4BAC9D,MAAM,GAAG,CAAC;wBACZ,CAAC;oBACH,CAAC;iBACF;gBACD,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO;oBACrB,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;wBACtB,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;oBAC1B,CAAC;oBAED,OAAO,GAAG,OAAO,IAAI,EAAE,CAAC;oBACxB,OAAO,CAAC,WAAW,GAAG,MAAM,CAAC;oBAE7B,8DAA8D;oBAC9D,8DAA8D;oBAC9D,MAAM,gBAAgB,GACnB,OAAO,CAAC,IAA4C,EAAE,OAAO;wBAC9D,SAAS,CAAC;oBAEZ,IAAI,gBAAgB,EAAE,CAAC;wBACrB,OAAO,CAAC,OAAO,GAAG;4BAChB,GAAG,OAAO,CAAC,OAAO;4BAClB,oBAAoB,EAAE,MAAM;yBAC7B,CAAC;oBACJ,CAAC;yBAAM,CAAC;wBACN,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;wBACjD,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC;wBACzC,OAAO,CAAC,OAAO,GAAG;4BAChB,GAAG,OAAO,CAAC,OAAO;4BAClB,yDAAyD;4BACzD,uDAAuD;4BACvD,2DAA2D;4BAC3D,2DAA2D;4BAC3D,0DAA0D;4BAC1D,qDAAqD;4BACrD,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;4BAC/C,cAAc,EAAE,SAAS,CAAC,MAAM,CAAC;4BACjC,oBAAoB,EAAE,MAAM;yBAC7B,CAAC;wBAEF,+DAA+D;wBAC/D,6DAA6D;wBAC7D,+DAA+D;wBAC/D,MAAM,IAAI,GAAG,OAAO,CAAC,IAA2C,CAAC;wBACjE,IAAI,IAAI,EAAE,CAAC;4BACT,KAAK,MAAM,GAAG,IAAI;gCAChB,aAAa;gCACb,oBAAoB;gCACpB,kBAAkB;6BACV,EAAE,CAAC;gCACX,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;gCACxB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;oCACvD,IAAI,CAAC,GAAG,CAAC,GAAG,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;gCAC7C,CAAC;4BACH,CAAC;4BAED,2DAA2D;4BAC3D,0DAA0D;4BAC1D,uDAAuD;4BACvD,wDAAwD;4BACxD,2DAA2D;4BAC3D,gDAAgD;4BAChD,IACE,GAAG,CAAC,QAAQ,CAAC,iBAAiB,CAAC;gCAC/B,GAAG,CAAC,QAAQ,CAAC,iBAAiB,CAAC;gCAC/B,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,EAC5B,CAAC;gCACD,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;4BAC9B,CAAC;wBACH,CAAC;wBAED,gEAAgE;wBAChE,wBAAwB;wBACxB,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;4BAC9B,MAAM,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;4BACxC,MAAM,OAAO,CAAC,OAAO,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;4BAC5C,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC;gCACzB,GAAI,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,EAAa;gCACxC,IAAI,EAAE,IAAI;gCACV,KAAK,EAAE,IAAI;gCACX,SAAS,EAAE,KAAK;6BACR,CAAC,CAAC;wBACd,CAAC;oBACH,CAAC;oBAED,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;gBAC1B,CAAC;aACF;SACF;KAC+B,CAAC;AACrC,CAAC,CAAC;AAEF,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAE5C,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/focus-manager.d.ts

@@ -0,0 +1,19 @@
+import type { ClientStore } from "better-auth/client";
+/**
+ * Refetch Better Auth's session whenever the Tauri window regains focus.
+ *
+ * Rationale: if the user signs out in another window, or their session
+ * expires while the app is backgrounded, we want the next time they come
+ * back to the app to reflect reality. Without a focus listener the local
+ * session store stays stale until some other request triggers a refresh.
+ *
+ * Subscribes to `@tauri-apps/api/window#onFocusChanged`. On `focused ===
+ * true`, we notify `$sessionSignal` which every `useSession` subscriber
+ * listens for — causing them to refetch `/get-session`.
+ *
+ * Returns an unlisten function. Cleanup is the caller's responsibility
+ * (typically the plugin's lifecycle handles this implicitly — when the
+ * app quits, the listener dies with the process).
+ */
+export declare function setupTauriFocusManager(store: ClientStore): Promise<() => void>;
+//# sourceMappingURL=focus-manager.d.ts.map

package/dist/focus-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"focus-manager.d.ts","sourceRoot":"","sources":["../src/focus-manager.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEtD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,WAAW,GACjB,OAAO,CAAC,MAAM,IAAI,CAAC,CAerB"}

package/dist/focus-manager.js

@@ -0,0 +1,34 @@
+/**
+ * Refetch Better Auth's session whenever the Tauri window regains focus.
+ *
+ * Rationale: if the user signs out in another window, or their session
+ * expires while the app is backgrounded, we want the next time they come
+ * back to the app to reflect reality. Without a focus listener the local
+ * session store stays stale until some other request triggers a refresh.
+ *
+ * Subscribes to `@tauri-apps/api/window#onFocusChanged`. On `focused ===
+ * true`, we notify `$sessionSignal` which every `useSession` subscriber
+ * listens for — causing them to refetch `/get-session`.
+ *
+ * Returns an unlisten function. Cleanup is the caller's responsibility
+ * (typically the plugin's lifecycle handles this implicitly — when the
+ * app quits, the listener dies with the process).
+ */
+export async function setupTauriFocusManager(store) {
+    try {
+        const { getCurrentWindow } = await import("@tauri-apps/api/window");
+        const win = getCurrentWindow();
+        const unlisten = await win.onFocusChanged(({ payload: focused }) => {
+            if (focused) {
+                store.notify("$sessionSignal");
+            }
+        });
+        return unlisten;
+    }
+    catch {
+        // @tauri-apps/api/window isn't available (e.g. running in a plain
+        // browser during `bun dev`). Return a no-op cleanup.
+        return () => { };
+    }
+}
+//# sourceMappingURL=focus-manager.js.map

package/dist/focus-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"focus-manager.js","sourceRoot":"","sources":["../src/focus-manager.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAAkB;IAElB,IAAI,CAAC;QACH,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;QACpE,MAAM,GAAG,GAAG,gBAAgB,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE;YACjE,IAAI,OAAO,EAAE,CAAC;gBACZ,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;YACjC,CAAC;QACH,CAAC,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,MAAM,CAAC;QACP,kEAAkE;QAClE,qDAAqD;QACrD,OAAO,GAAG,EAAE,GAAE,CAAC,CAAC;IAClB,CAAC;AACH,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,31 @@
+import type { BetterAuthPlugin } from "better-auth";
+export interface TauriOptions {
+    /**
+     * Disable the origin header override for Tauri requests.
+     *
+     * Normally the plugin maps the `tauri-origin` header (sent by the client
+     * plugin) to the `origin` header so the server's trusted-origin checks
+     * accept the custom URI scheme. Set this to `true` if you want to handle
+     * origin validation yourself.
+     */
+    disableOriginOverride?: boolean | undefined;
+}
+/**
+ * Server-side Better Auth plugin for Tauri desktop apps.
+ *
+ * What it does:
+ * 1. Remaps `tauri-origin` → `origin` so the Better Auth CSRF / trusted-origin
+ *    check sees a value the server is configured to accept (e.g. `sokudo://`).
+ * 2. Intercepts OAuth callback redirects whose `location` targets a non-HTTP
+ *    custom scheme (the Tauri app's URI scheme). Before the 302 leaves the
+ *    server, it appends the freshly-set `Set-Cookie` header as a `cookie`
+ *    query parameter. The Tauri app then reads the cookie out of the
+ *    deep-link URL and stores it locally — bridging the browser ↔ app
+ *    cookie jars that the OS keeps isolated.
+ *
+ * Pair this with `tauriClient` from `@dreamshive/better-auth-tauri/client`.
+ */
+export declare const tauri: (options?: TauriOptions) => BetterAuthPlugin;
+export { PACKAGE_VERSION } from "./version";
+export { tauriAuthorizationProxy } from "./routes";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAGpD,MAAM,WAAW,YAAY;IAC3B;;;;;;;OAOG;IACH,qBAAqB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CAC7C;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,KAAK,GAAI,UAAU,YAAY,KAAG,gBAyG9C,CAAC;AAEF,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAC"}

package/dist/index.js

@@ -0,0 +1,119 @@
+import { createAuthMiddleware } from "better-auth/api";
+import { tauriAuthorizationProxy } from "./routes";
+/**
+ * Server-side Better Auth plugin for Tauri desktop apps.
+ *
+ * What it does:
+ * 1. Remaps `tauri-origin` → `origin` so the Better Auth CSRF / trusted-origin
+ *    check sees a value the server is configured to accept (e.g. `sokudo://`).
+ * 2. Intercepts OAuth callback redirects whose `location` targets a non-HTTP
+ *    custom scheme (the Tauri app's URI scheme). Before the 302 leaves the
+ *    server, it appends the freshly-set `Set-Cookie` header as a `cookie`
+ *    query parameter. The Tauri app then reads the cookie out of the
+ *    deep-link URL and stores it locally — bridging the browser ↔ app
+ *    cookie jars that the OS keeps isolated.
+ *
+ * Pair this with `tauriClient` from `@dreamshive/better-auth-tauri/client`.
+ */
+export const tauri = (options) => {
+    return {
+        id: "tauri",
+        init: () => {
+            // In development we trust the common tauri dev origin. The real app
+            // scheme (e.g. `sokudo://`) should be added explicitly by the host
+            // app in its `trustedOrigins` — we don't assume a scheme here.
+            const trustedOrigins = typeof process !== "undefined" &&
+                process.env?.NODE_ENV === "development"
+                ? ["tauri://localhost"]
+                : [];
+            return {
+                options: {
+                    trustedOrigins,
+                },
+            };
+        },
+        async onRequest(request, _ctx) {
+            const tauriOrigin = request.headers.get("tauri-origin");
+            // `Cookie` is a forbidden header name on the client side (browsers
+            // / WKWebView strip it before sending), so the client plugin
+            // smuggles it as `x-tauri-cookie`. We move it back to `Cookie`
+            // here so downstream Better Auth handlers see the session cookie.
+            const smuggledCookie = request.headers.get("x-tauri-cookie");
+            const shouldRewriteOrigin = !options?.disableOriginOverride &&
+                !request.headers.get("origin") &&
+                !!tauriOrigin;
+            if (!shouldRewriteOrigin && !smuggledCookie)
+                return;
+            const applyRewrites = (headers) => {
+                if (shouldRewriteOrigin && tauriOrigin) {
+                    headers.set("origin", tauriOrigin);
+                }
+                if (smuggledCookie) {
+                    headers.set("cookie", smuggledCookie);
+                    headers.delete("x-tauri-cookie");
+                }
+            };
+            try {
+                // Prefer in-place mutation (works on Bun, Node, Deno).
+                applyRewrites(request.headers);
+                return { request };
+            }
+            catch {
+                // Some runtimes (e.g. Cloudflare Workers) have immutable request
+                // headers — fall back to constructing a new Request.
+                const newHeaders = new Headers(request.headers);
+                applyRewrites(newHeaders);
+                return { request: new Request(request, { headers: newHeaders }) };
+            }
+        },
+        hooks: {
+            after: [
+                {
+                    matcher(context) {
+                        return !!(context.path?.startsWith("/callback") ||
+                            context.path?.startsWith("/oauth2/callback") ||
+                            context.path?.startsWith("/magic-link/verify") ||
+                            context.path?.startsWith("/verify-email"));
+                    },
+                    handler: createAuthMiddleware(async (ctx) => {
+                        const headers = ctx.context.responseHeaders;
+                        const location = headers?.get("location");
+                        if (!location)
+                            return;
+                        // Leave Better Auth's own oauth-proxy plugin redirects alone —
+                        // those go through a separate round-trip we shouldn't rewrite.
+                        if (location.includes("/oauth-proxy-callback"))
+                            return;
+                        let redirectURL;
+                        try {
+                            redirectURL = new URL(location);
+                        }
+                        catch {
+                            return;
+                        }
+                        // Only rewrite redirects going to custom schemes — leave HTTP(S)
+                        // redirects alone (those are the in-browser / web flow).
+                        const isHttpRedirect = redirectURL.protocol === "http:" ||
+                            redirectURL.protocol === "https:";
+                        if (isHttpRedirect)
+                            return;
+                        if (!ctx.context.isTrustedOrigin(location))
+                            return;
+                        const cookie = headers?.get("set-cookie");
+                        if (!cookie)
+                            return;
+                        redirectURL.searchParams.set("cookie", cookie);
+                        ctx.setHeader("location", redirectURL.toString());
+                    }),
+                },
+            ],
+        },
+        endpoints: {
+            tauriAuthorizationProxy,
+        },
+        options,
+    };
+};
+export { PACKAGE_VERSION } from "./version";
+export { tauriAuthorizationProxy } from "./routes";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAEvD,OAAO,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAC;AAcnD;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,OAAsB,EAAoB,EAAE;IAChE,OAAO;QACL,EAAE,EAAE,OAAO;QACX,IAAI,EAAE,GAAG,EAAE;YACT,oEAAoE;YACpE,mEAAmE;YACnE,+DAA+D;YAC/D,MAAM,cAAc,GAClB,OAAO,OAAO,KAAK,WAAW;gBAC9B,OAAO,CAAC,GAAG,EAAE,QAAQ,KAAK,aAAa;gBACrC,CAAC,CAAC,CAAC,mBAAmB,CAAC;gBACvB,CAAC,CAAC,EAAE,CAAC;YACT,OAAO;gBACL,OAAO,EAAE;oBACP,cAAc;iBACf;aACF,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI;YAC3B,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;YACxD,mEAAmE;YACnE,6DAA6D;YAC7D,+DAA+D;YAC/D,kEAAkE;YAClE,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;YAE7D,MAAM,mBAAmB,GACvB,CAAC,OAAO,EAAE,qBAAqB;gBAC/B,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAC9B,CAAC,CAAC,WAAW,CAAC;YAEhB,IAAI,CAAC,mBAAmB,IAAI,CAAC,cAAc;gBAAE,OAAO;YAEpD,MAAM,aAAa,GAAG,CAAC,OAAgB,EAAE,EAAE;gBACzC,IAAI,mBAAmB,IAAI,WAAW,EAAE,CAAC;oBACvC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;gBACrC,CAAC;gBACD,IAAI,cAAc,EAAE,CAAC;oBACnB,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;oBACtC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;gBACnC,CAAC;YACH,CAAC,CAAC;YAEF,IAAI,CAAC;gBACH,uDAAuD;gBACvD,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;gBAC/B,OAAO,EAAE,OAAO,EAAE,CAAC;YACrB,CAAC;YAAC,MAAM,CAAC;gBACP,iEAAiE;gBACjE,qDAAqD;gBACrD,MAAM,UAAU,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;gBAChD,aAAa,CAAC,UAAU,CAAC,CAAC;gBAC1B,OAAO,EAAE,OAAO,EAAE,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;YACpE,CAAC;QACH,CAAC;QACD,KAAK,EAAE;YACL,KAAK,EAAE;gBACL;oBACE,OAAO,CAAC,OAAO;wBACb,OAAO,CAAC,CAAC,CACP,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,WAAW,CAAC;4BACrC,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,kBAAkB,CAAC;4BAC5C,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,oBAAoB,CAAC;4BAC9C,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,eAAe,CAAC,CAC1C,CAAC;oBACJ,CAAC;oBACD,OAAO,EAAE,oBAAoB,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;wBAC1C,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC;wBAC5C,MAAM,QAAQ,GAAG,OAAO,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;wBAC1C,IAAI,CAAC,QAAQ;4BAAE,OAAO;wBAEtB,+DAA+D;wBAC/D,+DAA+D;wBAC/D,IAAI,QAAQ,CAAC,QAAQ,CAAC,uBAAuB,CAAC;4BAAE,OAAO;wBAEvD,IAAI,WAAgB,CAAC;wBACrB,IAAI,CAAC;4BACH,WAAW,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;wBAClC,CAAC;wBAAC,MAAM,CAAC;4BACP,OAAO;wBACT,CAAC;wBAED,iEAAiE;wBACjE,yDAAyD;wBACzD,MAAM,cAAc,GAClB,WAAW,CAAC,QAAQ,KAAK,OAAO;4BAChC,WAAW,CAAC,QAAQ,KAAK,QAAQ,CAAC;wBACpC,IAAI,cAAc;4BAAE,OAAO;wBAE3B,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC;4BAAE,OAAO;wBAEnD,MAAM,MAAM,GAAG,OAAO,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC;wBAC1C,IAAI,CAAC,MAAM;4BAAE,OAAO;wBAEpB,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;wBAC/C,GAAG,CAAC,SAAS,CAAC,UAAU,EAAE,WAAW,CAAC,QAAQ,EAAE,CAAC,CAAC;oBACpD,CAAC,CAAC;iBACH;aACF;SACF;QACD,SAAS,EAAE;YACT,uBAAuB;SACxB;QACD,OAAO;KACmB,CAAC;AAC/B,CAAC,CAAC;AAEF,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAC"}

package/dist/online-manager.d.ts

@@ -0,0 +1,15 @@
+import type { ClientStore } from "better-auth/client";
+/**
+ * Refetch the session when the network comes back online. Useful after
+ * suspend/resume or a flaky wifi transition — otherwise the session
+ * store would keep showing the cached pre-disconnect state until some
+ * other request tries (and fails) to reach the server.
+ *
+ * Uses the browser's standard `online` event, which the Tauri WebView
+ * exposes the same way Chrome/Safari do. No Tauri plugin needed — the
+ * OS-level network state flows through the webview's navigator.
+ *
+ * Returns an unlisten function.
+ */
+export declare function setupTauriOnlineManager(store: ClientStore): () => void;
+//# sourceMappingURL=online-manager.d.ts.map

package/dist/online-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"online-manager.d.ts","sourceRoot":"","sources":["../src/online-manager.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEtD;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,IAAI,CActE"}