@dunx/auth 0.1.0

package/dist/drizzle.js

@@ -0,0 +1,92 @@
+// @bun
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __name = (target, name) => {
+  Object.defineProperty(target, "name", {
+    value: name,
+    enumerable: false,
+    configurable: true
+  });
+  return target;
+};
+var __knownSymbol = (name, symbol) => (symbol = Symbol[name]) ? symbol : Symbol.for("Symbol." + name);
+var __typeError = (msg) => {
+  throw TypeError(msg);
+};
+var __defNormalProp = (obj, key, value) => (key in obj) ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __accessCheck = (obj, member, msg) => member.has(obj) || __typeError("Cannot " + msg);
+var __privateIn = (member, obj) => Object(obj) !== obj ? __typeError('Cannot use the "in" operator on this value') : member.has(obj);
+var __privateGet = (obj, member, getter) => (__accessCheck(obj, member, "read from private field"), getter ? getter.call(obj) : member.get(obj));
+var __privateAdd = (obj, member, value) => member.has(obj) ? __typeError("Cannot add the same private member more than once") : member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
+var __privateSet = (obj, member, value, setter) => (__accessCheck(obj, member, "write to private field"), setter ? setter.call(obj, value) : member.set(obj, value), value);
+var __privateMethod = (obj, member, method) => (__accessCheck(obj, member, "access private method"), method);
+var __decoratorStart = (base) => [, , , __create(base?.[__knownSymbol("metadata")] ?? null)];
+var __decoratorStrings = ["class", "method", "getter", "setter", "accessor", "field", "value", "get", "set"];
+var __expectFn = (fn) => fn !== undefined && typeof fn !== "function" ? __typeError("Function expected") : fn;
+var __decoratorContext = (kind, name, done, metadata, fns) => ({
+  kind: __decoratorStrings[kind],
+  name,
+  metadata,
+  addInitializer: (fn) => done._ ? __typeError("Already initialized") : fns.push(__expectFn(fn || null))
+});
+var __decoratorMetadata = (array, target) => __defNormalProp(target, __knownSymbol("metadata"), array[3]);
+var __runInitializers = (array, flags, self, value) => {
+  for (var i = 0, fns = array[flags >> 1], n = fns && fns.length;i < n; i++)
+    flags & 1 ? fns[i].call(self) : value = fns[i].call(self, value);
+  return value;
+};
+var __decorateElement = (array, flags, name, decorators, target, extra) => {
+  var fn, it, done, ctx, access, k = flags & 7, s = !!(flags & 8), p = !!(flags & 16);
+  var j = k > 3 ? array.length + 1 : k ? s ? 1 : 2 : 0, key = __decoratorStrings[k + 5];
+  var initializers = k > 3 && (array[j - 1] = []), extraInitializers = array[j] || (array[j] = []);
+  var desc = k && (!p && !s && (target = target.prototype), k < 5 && (k > 3 || !p) && __getOwnPropDesc(k < 4 ? target : {
+    get [name]() {
+      return __privateGet(this, extra);
+    },
+    set [name](x) {
+      __privateSet(this, extra, x);
+    }
+  }, name));
+  k ? p && k < 4 && __name(extra, (k > 2 ? "set " : k > 1 ? "get " : "") + name) : __name(target, name);
+  for (var i = decorators.length - 1;i >= 0; i--) {
+    ctx = __decoratorContext(k, name, done = {}, array[3], extraInitializers);
+    if (k) {
+      ctx.static = s, ctx.private = p, access = ctx.access = { has: p ? (x) => __privateIn(target, x) : (x) => (name in x) };
+      if (k ^ 3)
+        access.get = p ? (x) => (k ^ 1 ? __privateGet : __privateMethod)(x, target, k ^ 4 ? extra : desc.get) : (x) => x[name];
+      if (k > 2)
+        access.set = p ? (x, y) => __privateSet(x, target, y, k ^ 4 ? extra : desc.set) : (x, y) => x[name] = y;
+    }
+    it = (0, decorators[i])(k ? k < 4 ? p ? extra : desc[key] : k > 4 ? undefined : { get: desc.get, set: desc.set } : target, ctx);
+    done._ = 1;
+    if (k ^ 4 || it === undefined)
+      __expectFn(it) && (k > 4 ? initializers.unshift(it) : k ? p ? extra = it : desc[key] = it : target = it);
+    else if (typeof it !== "object" || it === null)
+      __typeError("Object expected");
+    else
+      __expectFn(fn = it.get) && (desc.get = fn), __expectFn(fn = it.set) && (desc.set = fn), __expectFn(fn = it.init) && initializers.unshift(fn);
+  }
+  return k || __decoratorMetadata(array, target), desc && __defProp(target, name, desc), p ? k ^ 4 ? extra : desc : target;
+};
+
+// src/drizzle.ts
+import {
+  drizzleAdapter
+} from "better-auth/adapters/drizzle";
+var PROVIDERS = Object.freeze({
+  postgres: "pg",
+  mysql: "mysql",
+  mariadb: "mysql",
+  sqlite: "sqlite"
+});
+var drizzleDatabase = (connection, config = {}) => drizzleAdapter(connection.db, {
+  ...config,
+  provider: PROVIDERS[connection.dialect]
+});
+export {
+  drizzleDatabase
+};
+
+//# debugId=FE2DA2CE89A5EE9A64756E2164756E21
+//# sourceMappingURL=drizzle.js.map

package/dist/drizzle.js.map

@@ -0,0 +1,10 @@
+{
+  "version": 3,
+  "sources": ["../src/drizzle.ts"],
+  "sourcesContent": [
+    "import {\n  drizzleAdapter,\n  type DB,\n  type DrizzleAdapterConfig,\n} from 'better-auth/adapters/drizzle';\n\n/**\n * The two members of `@dunx/infra/db`'s `DbConnection` this reads.\n *\n * Restated structurally rather than imported, for the same reason `@dunx/http`\n * restates Standard Schema: it keeps `@dunx/auth`'s dependency list at `@dunx/core`\n * and `@dunx/http`, and it means a bare `drizzle({ client, schema })` handle works\n * here too. An `@dunx/infra/db` connection satisfies it with no adapter in between —\n * `dialect` is exactly that union and `db` is exactly `unknown`.\n */\nexport interface DrizzleSource {\n  readonly dialect: 'postgres' | 'mysql' | 'mariadb' | 'sqlite';\n  /** The drizzle handle — `BunSQLiteDatabase` or `BunSQLDatabase`. */\n  readonly db: unknown;\n}\n\n/** What better-auth's drizzle adapter calls each of the dialects `@dunx/infra/db` reports. */\nconst PROVIDERS: Readonly<\n  Record<DrizzleSource['dialect'], DrizzleAdapterConfig['provider']>\n> = Object.freeze({\n  postgres: 'pg',\n  mysql: 'mysql',\n  mariadb: 'mysql',\n  sqlite: 'sqlite',\n});\n\n/**\n * better-auth's `database` option over a connection the app already opened. Nothing\n * here connects: the point is that the app keeps **one** pool, one SQLite handle and\n * one shutdown path, instead of better-auth opening a second.\n *\n * ```ts\n * AuthModule.forRootAsync({\n *   useFactory: (connection: DbConnection) => ({\n *     database: drizzleDatabase(connection),\n *   }),\n *   inject: [DbConnection],\n * });\n * ```\n *\n * The `provider` comes from the connection's own dialect, so swapping `bun:sqlite`\n * for `Bun.SQL` needs no edit at the call site. The schema does not have to be passed\n * either — `@dunx/infra/db` builds its handle with `drizzle({ client, schema })` and\n * the adapter reads `db._.fullSchema`, so the better-auth tables being in the app's\n * schema object is the whole requirement.\n *\n * dunx ships **no** schema for those tables. They are better-auth's, they change with\n * its plugins, and its own CLI generates them: `bunx @better-auth/cli generate`. A\n * copy of them inside a framework is a copy that silently rots against the library\n * that reads it.\n */\nexport const drizzleDatabase = (\n  connection: DrizzleSource,\n  config: Omit<DrizzleAdapterConfig, 'provider'> = {},\n): ReturnType<typeof drizzleAdapter> =>\n  // `db` is `unknown` on the contract because it cannot promise either backend's\n  // handle. Narrowing it is what that contract documents.\n  drizzleAdapter(connection.db as DB, {\n    ...config,\n    provider: PROVIDERS[connection.dialect],\n  });\n"
+  ],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAsBA,IAAM,YAEF,OAAO,OAAO;AAAA,EAChB,UAAU;AAAA,EACV,OAAO;AAAA,EACP,SAAS;AAAA,EACT,QAAQ;AACV,CAAC;AA2BM,IAAM,kBAAkB,CAC7B,YACA,SAAiD,CAAC,MAIlD,eAAe,WAAW,IAAU;AAAA,KAC/B;AAAA,EACH,UAAU,UAAU,WAAW;AACjC,CAAC;",
+  "debugId": "FE2DA2CE89A5EE9A64756E2164756E21",
+  "names": []
+}

package/dist/errors.d.ts

@@ -0,0 +1,8 @@
+import { AppError } from '@dunx/core';
+/**
+ * Raised by `@dunx/auth`'s own wiring. better-auth's failures propagate as its
+ * `APIError`, and a rejected request is an `HttpError` from `@dunx/http`.
+ */
+export declare class AuthError extends AppError {
+    name: string;
+}

package/dist/guard.d.ts

@@ -0,0 +1,33 @@
+import { type Middleware, type Next, type RouteContext } from '@dunx/http';
+import type { BunRequest } from 'bun';
+import { Auth } from './auth.js';
+import { AuthContext } from './context.js';
+/**
+ * What roles a user holds. better-auth's `admin` plugin stores them in a single
+ * `role` column, comma-separated for more than one; a custom plugin may use an
+ * array. Both read the same here, and a user with none reads as `[]` rather than
+ * throwing — an app may well not use roles at all.
+ */
+export declare const rolesOf: (user: object) => readonly string[];
+/**
+ * Authenticates every request it sees through better-auth's own session lookup, and
+ * composes with the metadata `@dunx/http` already carries:
+ *
+ * - `@Public()` — skipped outright. No session lookup, no rejection, no role check.
+ *   That is what makes it safe to install globally: better-auth's own endpoints are
+ *   `@Public()`, and a sign-in route that needed a session could never be reached.
+ *   A public route that wants to *adapt* to an optional caller injects `Auth` and
+ *   calls `auth.api.getSession({ headers: req.headers })` itself — one line, and it
+ *   does not put a lookup on every public request in the app.
+ * - `@Roles('admin')` — a 403 unless the caller holds one of them.
+ *
+ * Install it globally with `HttpFactory.create(root, { middleware: [SessionGuard] })`
+ * and opt routes out with `@Public()`, or scope it with `@UseGuards(SessionGuard)`
+ * and leave the rest of the app open. `AuthModule` registers it either way.
+ */
+export declare class SessionGuard implements Middleware {
+    private readonly auth;
+    private readonly context;
+    constructor(auth: Auth, context: AuthContext);
+    handle(req: BunRequest, ctx: RouteContext, next: Next): Promise<Response>;
+}

package/dist/handler.d.ts

@@ -0,0 +1,43 @@
+import { type Ctor } from '@dunx/core';
+import { type Input, type RouteSchemas } from '@dunx/http';
+/**
+ * better-auth's handler is a plain `(request: Request) => Promise<Response>`, so
+ * mounting it is five one-line routes and nothing else. Every endpoint the library
+ * and its plugins declare lives under one wildcard — dunx does not restate, wrap or
+ * re-dispatch a single one of them.
+ *
+ * `Bun.serve` matches `<basePath>/*` natively (verified on Bun 1.3.14), so Bun is
+ * still the router. All five verbs are mounted because a plugin may declare any of
+ * them; better-auth's own endpoints are `GET` and `POST`.
+ *
+ * The `Response` is returned untouched — `buildRoutes` passes one straight through,
+ * which is what keeps better-auth's `Set-Cookie` headers and redirects intact.
+ *
+ * `@Public()` at class scope, so all five inherit it — `mergeMeta` reads the class's
+ * record under the handler's. Without it a globally installed `SessionGuard` would
+ * demand a session from the sign-in endpoint, and no session could ever be created.
+ *
+ * `inject(Auth)` in a field rather than a constructor parameter, because a bare
+ * class in `controllers` is bound as a class provider and would then need
+ * `@dunx/transform`'s transform to have run. This way mounting works in an app that
+ * never added the preload.
+ */
+export declare class AuthHandler {
+    #private;
+    get({ req }: Input<RouteSchemas>): Promise<Response>;
+    post({ req }: Input<RouteSchemas>): Promise<Response>;
+    put({ req }: Input<RouteSchemas>): Promise<Response>;
+    patch({ req }: Input<RouteSchemas>): Promise<Response>;
+    delete({ req }: Input<RouteSchemas>): Promise<Response>;
+}
+/**
+ * The controller `AuthModule` registers, prefixed with `AuthOptions.mountAt`.
+ *
+ * A subclass rather than `@Controller(...)` on {@link AuthHandler} itself: the prefix
+ * is only known once the module is configured, and mutating the shared class from a
+ * factory would make two configurations fight over one prefix. The subclass declares
+ * nothing of its own and inherits everything — `discoverRoutes` walks the prototype
+ * chain for the routes, and `metaOf` and `prefixOf` are plain lookups, so `@Public()`
+ * comes down from the base while the prefix stays own to the subclass.
+ */
+export declare const mountHandler: (mountAt: string) => Ctor<AuthHandler>;

package/dist/index.d.ts

@@ -0,0 +1,9 @@
+export { Auth, type Principal } from './auth.js';
+export { AuthContext } from './context.js';
+export { AuthError } from './errors.js';
+export { rolesOf, SessionGuard } from './guard.js';
+export { AuthHandler, mountHandler } from './handler.js';
+export { AuthModule } from './module.js';
+export { AuthOptions, DEFAULT_BASE_PATH, normalizeBasePath, } from './options.js';
+export { bunPassword } from './password.js';
+export { redisStorage, type RedisStore } from './redis.js';

package/dist/index.js

@@ -0,0 +1,373 @@
+// @bun
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __name = (target, name) => {
+  Object.defineProperty(target, "name", {
+    value: name,
+    enumerable: false,
+    configurable: true
+  });
+  return target;
+};
+var __knownSymbol = (name, symbol) => (symbol = Symbol[name]) ? symbol : Symbol.for("Symbol." + name);
+var __typeError = (msg) => {
+  throw TypeError(msg);
+};
+var __defNormalProp = (obj, key, value) => (key in obj) ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __accessCheck = (obj, member, msg) => member.has(obj) || __typeError("Cannot " + msg);
+var __privateIn = (member, obj) => Object(obj) !== obj ? __typeError('Cannot use the "in" operator on this value') : member.has(obj);
+var __privateGet = (obj, member, getter) => (__accessCheck(obj, member, "read from private field"), getter ? getter.call(obj) : member.get(obj));
+var __privateAdd = (obj, member, value) => member.has(obj) ? __typeError("Cannot add the same private member more than once") : member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
+var __privateSet = (obj, member, value, setter) => (__accessCheck(obj, member, "write to private field"), setter ? setter.call(obj, value) : member.set(obj, value), value);
+var __privateMethod = (obj, member, method) => (__accessCheck(obj, member, "access private method"), method);
+var __decoratorStart = (base) => [, , , __create(base?.[__knownSymbol("metadata")] ?? null)];
+var __decoratorStrings = ["class", "method", "getter", "setter", "accessor", "field", "value", "get", "set"];
+var __expectFn = (fn) => fn !== undefined && typeof fn !== "function" ? __typeError("Function expected") : fn;
+var __decoratorContext = (kind, name, done, metadata, fns) => ({
+  kind: __decoratorStrings[kind],
+  name,
+  metadata,
+  addInitializer: (fn) => done._ ? __typeError("Already initialized") : fns.push(__expectFn(fn || null))
+});
+var __decoratorMetadata = (array, target) => __defNormalProp(target, __knownSymbol("metadata"), array[3]);
+var __runInitializers = (array, flags, self, value) => {
+  for (var i = 0, fns = array[flags >> 1], n = fns && fns.length;i < n; i++)
+    flags & 1 ? fns[i].call(self) : value = fns[i].call(self, value);
+  return value;
+};
+var __decorateElement = (array, flags, name, decorators, target, extra) => {
+  var fn, it, done, ctx, access, k = flags & 7, s = !!(flags & 8), p = !!(flags & 16);
+  var j = k > 3 ? array.length + 1 : k ? s ? 1 : 2 : 0, key = __decoratorStrings[k + 5];
+  var initializers = k > 3 && (array[j - 1] = []), extraInitializers = array[j] || (array[j] = []);
+  var desc = k && (!p && !s && (target = target.prototype), k < 5 && (k > 3 || !p) && __getOwnPropDesc(k < 4 ? target : {
+    get [name]() {
+      return __privateGet(this, extra);
+    },
+    set [name](x) {
+      __privateSet(this, extra, x);
+    }
+  }, name));
+  k ? p && k < 4 && __name(extra, (k > 2 ? "set " : k > 1 ? "get " : "") + name) : __name(target, name);
+  for (var i = decorators.length - 1;i >= 0; i--) {
+    ctx = __decoratorContext(k, name, done = {}, array[3], extraInitializers);
+    if (k) {
+      ctx.static = s, ctx.private = p, access = ctx.access = { has: p ? (x) => __privateIn(target, x) : (x) => (name in x) };
+      if (k ^ 3)
+        access.get = p ? (x) => (k ^ 1 ? __privateGet : __privateMethod)(x, target, k ^ 4 ? extra : desc.get) : (x) => x[name];
+      if (k > 2)
+        access.set = p ? (x, y) => __privateSet(x, target, y, k ^ 4 ? extra : desc.set) : (x, y) => x[name] = y;
+    }
+    it = (0, decorators[i])(k ? k < 4 ? p ? extra : desc[key] : k > 4 ? undefined : { get: desc.get, set: desc.set } : target, ctx);
+    done._ = 1;
+    if (k ^ 4 || it === undefined)
+      __expectFn(it) && (k > 4 ? initializers.unshift(it) : k ? p ? extra = it : desc[key] = it : target = it);
+    else if (typeof it !== "object" || it === null)
+      __typeError("Object expected");
+    else
+      __expectFn(fn = it.get) && (desc.get = fn), __expectFn(fn = it.set) && (desc.set = fn), __expectFn(fn = it.init) && initializers.unshift(fn);
+  }
+  return k || __decoratorMetadata(array, target), desc && __defProp(target, name, desc), p ? k ^ 4 ? extra : desc : target;
+};
+
+// src/errors.ts
+import { AppError } from "@dunx/core";
+
+class AuthError extends AppError {
+  name = "AuthError";
+}
+
+// src/auth.ts
+class Auth {
+  constructor() {
+    if (new.target === Auth) {
+      throw new AuthError("Auth is a contract, not an implementation. Bind one with " + "AuthModule.forRoot({ ... }) or AuthModule.forRootAsync({ useFactory }).");
+    }
+  }
+}
+// src/context.ts
+import { AsyncLocalStorage } from "async_hooks";
+import { RequestContext } from "@dunx/core";
+import { HttpError, HttpStatusCode } from "@dunx/http";
+
+class AuthContext {
+  context;
+  #storage = new AsyncLocalStorage;
+  constructor(context) {
+    this.context = context;
+  }
+  current() {
+    return this.#storage.getStore();
+  }
+  require() {
+    const principal = this.current();
+    if (!principal) {
+      throw new HttpError(HttpStatusCode.UNAUTHORIZED, "UNAUTHENTICATED");
+    }
+    return principal;
+  }
+  run(principal, callback) {
+    this.context.updateContext({ userId: principal.user.id });
+    return this.#storage.run(principal, callback);
+  }
+}
+Object.defineProperty(AuthContext, Symbol.for("dunx.deps"), {
+  value: () => [RequestContext]
+});
+// src/guard.ts
+import {
+  HttpError as HttpError2,
+  HttpStatusCode as HttpStatusCode2,
+  PUBLIC,
+  ROLES
+} from "@dunx/http";
+var rolesOf = (user) => {
+  const role = user.role;
+  if (typeof role === "string") {
+    return role.split(",").map((entry) => entry.trim()).filter((entry) => entry.length > 0);
+  }
+  if (Array.isArray(role)) {
+    return role.filter((entry) => typeof entry === "string");
+  }
+  return [];
+};
+
+class SessionGuard {
+  auth;
+  context;
+  constructor(auth, context) {
+    this.auth = auth;
+    this.context = context;
+  }
+  async handle(req, ctx, next) {
+    if (ctx.get(PUBLIC))
+      return next();
+    const principal = await this.auth.api.getSession({
+      headers: req.headers
+    });
+    if (!principal) {
+      throw new HttpError2(HttpStatusCode2.UNAUTHORIZED, "UNAUTHENTICATED");
+    }
+    const required = ctx.get(ROLES);
+    if (required !== undefined && required.length > 0) {
+      const held = rolesOf(principal.user);
+      if (!required.some((role) => held.includes(role))) {
+        throw new HttpError2(HttpStatusCode2.FORBIDDEN, `Requires one of: ${required.join(", ")}`);
+      }
+    }
+    return this.context.run(principal, next);
+  }
+}
+Object.defineProperty(SessionGuard, Symbol.for("dunx.deps"), {
+  value: () => [Auth, AuthContext]
+});
+// src/handler.ts
+import { inject } from "@dunx/core";
+import {
+  Controller,
+  Delete,
+  Get,
+  Patch,
+  Post,
+  Public,
+  Put
+} from "@dunx/http";
+
+// src/password.ts
+var bunPassword = {
+  hash: (password) => Bun.password.hash(password, { algorithm: "bcrypt", cost: 10 }),
+  verify: async ({
+    hash,
+    password
+  }) => {
+    try {
+      return await Bun.password.verify(password, hash);
+    } catch {
+      return false;
+    }
+  }
+};
+
+// src/options.ts
+var DEFAULT_BASE_PATH = "/api/auth";
+var normalizeBasePath = (basePath) => {
+  const normalized = `/${basePath}`.replace(/\/{2,}/g, "/").replace(/\/$/, "");
+  if (normalized.length < 2) {
+    throw new AuthError(`"${basePath}" is not a usable basePath. The handler mounts at ` + "<basePath>/*, so at the root it would claim every route in the app. " + `Use something like ${DEFAULT_BASE_PATH}.`);
+  }
+  return normalized;
+};
+var withBunPassword = (options) => {
+  const email = options.emailAndPassword;
+  if (!email?.enabled || email.password)
+    return options;
+  return {
+    ...options,
+    emailAndPassword: { ...email, password: bunPassword }
+  };
+};
+
+class AuthOptions {
+  options;
+  basePath;
+  mountAt;
+  constructor(init, mountAt) {
+    this.basePath = normalizeBasePath(init.basePath ?? DEFAULT_BASE_PATH);
+    this.mountAt = mountAt === undefined ? this.basePath : normalizeBasePath(mountAt);
+    this.options = withBunPassword({ ...init, basePath: this.basePath });
+  }
+}
+Object.defineProperty(AuthOptions, Symbol.for("dunx.deps"), {
+  value: () => [{ unresolved: "init: O" }, { unresolved: "mountAt?: string" }]
+});
+
+// src/handler.ts
+var _dec = [
+  Public()
+];
+var _dec2 = [
+  Get("/*")
+];
+var _dec3 = [
+  Post("/*")
+];
+var _dec4 = [
+  Put("/*")
+];
+var _dec5 = [
+  Patch("/*")
+];
+var _dec6 = [
+  Delete("/*")
+];
+var _auth = new WeakMap;
+var _verified = new WeakMap;
+var _dispatch = new WeakSet, _dispatch_fn;
+_dispatch_fn = function(req) {
+  if (!__privateGet(this, _verified)) {
+    __privateSet(this, _verified, true);
+    const basePath = __privateGet(this, _auth).options.basePath ?? DEFAULT_BASE_PATH;
+    const { pathname } = new URL(req.url);
+    if (!pathname.startsWith(`${basePath}/`)) {
+      throw new AuthError(`${pathname} reached the auth handler, but better-auth is configured with ` + `basePath ${basePath} and would answer 404 to everything under it. A ` + "global prefix is the usual cause: mount the handler at the path without " + "the prefix and give better-auth the full one \u2014 see AuthOptions.mountAt.");
+    }
+  }
+  return __privateGet(this, _auth).handler(req);
+};
+var _init = __decoratorStart(undefined);
+
+class AuthHandler {
+  constructor() {
+    __privateAdd(this, _auth, inject(Auth));
+    __privateAdd(this, _verified, false);
+    __privateAdd(this, _dispatch);
+    __runInitializers(_init, 5, this);
+  }
+  get({ req }) {
+    return __privateMethod(this, _dispatch, _dispatch_fn).call(this, req);
+  }
+  post({ req }) {
+    return __privateMethod(this, _dispatch, _dispatch_fn).call(this, req);
+  }
+  put({ req }) {
+    return __privateMethod(this, _dispatch, _dispatch_fn).call(this, req);
+  }
+  patch({ req }) {
+    return __privateMethod(this, _dispatch, _dispatch_fn).call(this, req);
+  }
+  delete({ req }) {
+    return __privateMethod(this, _dispatch, _dispatch_fn).call(this, req);
+  }
+}
+__decorateElement(_init, 1, "get", _dec2, AuthHandler);
+__decorateElement(_init, 1, "post", _dec3, AuthHandler);
+__decorateElement(_init, 1, "put", _dec4, AuthHandler);
+__decorateElement(_init, 1, "patch", _dec5, AuthHandler);
+__decorateElement(_init, 1, "delete", _dec6, AuthHandler);
+AuthHandler = __decorateElement(_init, 0, "AuthHandler", _dec, AuthHandler);
+__runInitializers(_init, 1, AuthHandler);
+__decoratorMetadata(_init, AuthHandler);
+let _AuthHandler = AuthHandler;
+var mountHandler = (mountAt) => Controller(mountAt)(class MountedAuthHandler extends AuthHandler {
+});
+// src/module.ts
+import {
+  provide,
+  RequestContext as RequestContext2
+} from "@dunx/core";
+import { betterAuth } from "better-auth";
+var build = (options, mountAt) => {
+  const auth = Auth;
+  return {
+    module: AuthModule,
+    controllers: [mountHandler(mountAt)],
+    providers: [
+      options,
+      provide(auth, {
+        useFactory: (resolved) => betterAuth(resolved.options),
+        inject: [AuthOptions]
+      }),
+      provide(AuthContext, {
+        useFactory: (context) => new AuthContext(context),
+        inject: [RequestContext2]
+      }),
+      provide(SessionGuard, {
+        useFactory: (instance, context) => new SessionGuard(instance, context),
+        inject: [auth, AuthContext]
+      })
+    ]
+  };
+};
+
+class AuthModule {
+  static forRoot(options, mountAt) {
+    const resolved = new AuthOptions(options, mountAt);
+    return build(provide(AuthOptions, { useValue: resolved }), resolved.mountAt);
+  }
+  static forRootAsync(provider, mountAt) {
+    const mounted = normalizeBasePath(mountAt ?? DEFAULT_BASE_PATH);
+    return build(provide(AuthOptions, {
+      useFactory: async (...deps) => {
+        const resolved = new AuthOptions(await provider.useFactory(...deps), mounted);
+        if (mountAt === undefined && resolved.basePath !== mounted) {
+          throw new AuthError(`The factory returned basePath ${resolved.basePath}, but the handler ` + `is mounted at ${mounted} \u2014 the table was built before the factory ` + "ran, so it could not follow. Pass the route path as " + "forRootAsync's second argument.");
+        }
+        return resolved;
+      },
+      inject: provider.inject ?? []
+    }), mounted);
+  }
+}
+// src/redis.ts
+var redisStorage = (connection) => ({
+  get: (key) => connection.get(key),
+  getAndDelete: (key) => connection.getdel(key),
+  increment: async (key, ttl) => {
+    const value = await connection.incr(key);
+    if (value === 1)
+      await connection.expire(key, ttl);
+    return value;
+  },
+  set: (key, value, ttl) => connection.set(key, value, ttl === undefined ? {} : { ex: ttl }),
+  delete: async (key) => {
+    await connection.del(key);
+  }
+});
+export {
+  rolesOf,
+  redisStorage,
+  normalizeBasePath,
+  mountHandler,
+  bunPassword,
+  SessionGuard,
+  DEFAULT_BASE_PATH,
+  AuthOptions,
+  AuthModule,
+  AuthHandler,
+  AuthError,
+  AuthContext,
+  Auth
+};
+
+//# debugId=0D5B2BADC3F2673664756E2164756E21
+//# sourceMappingURL=index.js.map