@dunx/auth 0.1.1 → 0.2.1

package/dist/index.d.ts

@@ -7,3 +7,4 @@ export { AuthModule } from './module.js';
 export { AuthOptions, DEFAULT_BASE_PATH, normalizeBasePath, } from './options.js';
 export { bunPassword } from './password.js';
 export { redisStorage, type RedisStore } from './redis.js';
+export { betterAuthDocument, type AuthDocumentFragment, type AuthDocumentOptions, type OpenApiCapableAuth, } from './openapi.js';

package/dist/index.js

@@ -353,12 +353,38 @@ var redisStorage = (connection) => ({
     await connection.del(key);
   }
 });
+// src/openapi.ts
+var METHODS = ["get", "post", "put", "patch", "delete", "options", "head"];
+var betterAuthDocument = (auth, options) => async () => {
+  const empty = { paths: {}, schemas: {}, tags: [] };
+  if (typeof auth.api.generateOpenAPISchema !== "function")
+    return empty;
+  const raw = await auth.api.generateOpenAPISchema();
+  const prefix = normalizeBasePath(options.basePath);
+  const tag = options.tag ?? "auth";
+  const paths = {};
+  for (const [path, item] of Object.entries(raw.paths ?? {})) {
+    for (const method of METHODS) {
+      const operation = item[method];
+      if (operation && typeof operation === "object") {
+        operation.tags = [tag];
+      }
+    }
+    paths[path.startsWith(prefix) ? path : `${prefix}${path}`] = item;
+  }
+  return {
+    paths,
+    schemas: raw.components?.schemas ?? {},
+    tags: [{ name: tag, description: "Served by Better Auth" }]
+  };
+};
 export {
   rolesOf,
   redisStorage,
   normalizeBasePath,
   mountHandler,
   bunPassword,
+  betterAuthDocument,
   SessionGuard,
   DEFAULT_BASE_PATH,
   AuthOptions,
@@ -369,5 +395,5 @@ export {
   Auth
 };
 
-//# debugId=0637629E506E689864756E2164756E21
+//# debugId=8234AC9581E74BE264756E2164756E21
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1,6 +1,6 @@
 {
   "version": 3,
-  "sources": ["../src/errors.ts", "../src/auth.ts", "../src/context.ts", "../src/guard.ts", "../src/handler.ts", "../src/password.ts", "../src/options.ts", "../src/module.ts", "../src/redis.ts"],
+  "sources": ["../src/errors.ts", "../src/auth.ts", "../src/context.ts", "../src/guard.ts", "../src/handler.ts", "../src/password.ts", "../src/options.ts", "../src/module.ts", "../src/redis.ts", "../src/openapi.ts"],
   "sourcesContent": [
     "import { AppError } from '@dunx/core';\n\n/**\n * Raised by `@dunx/auth`'s own wiring. better-auth's failures propagate as its\n * `APIError`, and a rejected request is an `HttpError` from `@dunx/http`.\n */\nexport class AuthError extends AppError {\n  override name = 'AuthError';\n}\n",
     "import type { Auth as Instance, BetterAuthOptions } from 'better-auth';\nimport { AuthError } from './errors.js';\n\n/**\n * The injection token for the better-auth instance, and the whole of dunx's\n * contract with the library.\n *\n * `betterAuth()` returns a plain object, so there is no class to use as a token.\n * This is the same trick `Logger` and `RequestContext` use in `@dunx/core`: an\n * abstract class whose members are **aliases of better-auth's own** - not\n * restatements - which a real instance satisfies structurally. That is what makes\n * `constructor(private readonly auth: Auth)` work, since `@dunx/transform` records\n * the bare type name and the container resolves it.\n *\n * The type argument is the `DbModule` trick from `@dunx/infra/db`: the token is the\n * erased class, so `Auth<typeof authOptions>` at an injection site keeps the\n * plugin-widened `api` while still resolving the one binding. Written bare, `Auth`\n * carries better-auth's core endpoints only - a plugin's endpoints are on the\n * annotation, not on the token.\n */\nexport abstract class Auth<O extends BetterAuthOptions = BetterAuthOptions> {\n  /**\n   * `abstract` stops TypeScript constructing this, but the container works on\n   * runtime values and every class self-binds - so `get(Auth)` with nothing bound\n   * would hand back a bare instance whose every member is `undefined`, and the\n   * first symptom would be `auth.handler is not a function` deep in a request.\n   */\n  constructor() {\n    if (new.target === Auth) {\n      throw new AuthError(\n        'Auth is a contract, not an implementation. Bind one with ' +\n          'AuthModule.forRoot({ ... }) or AuthModule.forRootAsync({ useFactory }).',\n      );\n    }\n  }\n\n  /** better-auth's framework-agnostic handler. `AuthHandler` mounts it. */\n  abstract readonly handler: Instance<O>['handler'];\n  /** Every endpoint as a callable - `api.getSession`, `api.signUpEmail`, ... */\n  abstract readonly api: Instance<O>['api'];\n  /** The options `betterAuth()` was called with, dunx's defaults already applied. */\n  abstract readonly options: Instance<O>['options'];\n  abstract readonly $ERROR_CODES: Instance<O>['$ERROR_CODES'];\n  abstract readonly $context: Instance<O>['$context'];\n  abstract readonly $Infer: Instance<O>['$Infer'];\n}\n\n/**\n * `{ session, user }` for an authenticated caller - better-auth's own inferred\n * session type, so a plugin's extra user fields (the `admin` plugin's `role` and\n * `banned`, say) are typed without dunx naming a single one of them.\n */\nexport type Principal<O extends BetterAuthOptions = BetterAuthOptions> =\n  Instance<O>['$Infer']['Session'];\n",
@@ -10,9 +10,10 @@
     "/**\n * better-auth's `emailAndPassword.password`, backed by `Bun.password`.\n *\n * Applied by `AuthModule` whenever `emailAndPassword` is enabled and no `password`\n * of your own is given. better-auth's default is a **pure-JavaScript scrypt**;\n * `Bun.password` is native bcrypt, which is Rule 1's first half - if Bun ships it,\n * use Bun.\n *\n * Bun pre-hashes the input, so bcrypt's 72-byte cap is a non-issue even for a\n * maximum-length multibyte password.\n *\n * `verify` swallows Bun's `UnsupportedAlgorithm` throw, so a hash produced by a\n * *different* algorithm - a scrypt hash written before this was in place - is a\n * clean authentication failure rather than a 500. Those users must reset their\n * password to get a bcrypt hash; pass your own `password` implementation instead\n * if you are migrating an existing user table and cannot.\n */\nexport const bunPassword = {\n  hash: (password: string): Promise<string> =>\n    Bun.password.hash(password, { algorithm: 'bcrypt', cost: 10 }),\n  verify: async ({\n    hash,\n    password,\n  }: {\n    hash: string;\n    password: string;\n  }): Promise<boolean> => {\n    try {\n      return await Bun.password.verify(password, hash);\n    } catch {\n      return false;\n    }\n  },\n};\n",
     "import type { BetterAuthOptions } from 'better-auth';\nimport { AuthError } from './errors.js';\nimport { bunPassword } from './password.js';\n\n/** better-auth's own default, and where `AuthHandler` mounts unless told otherwise. */\nexport const DEFAULT_BASE_PATH = '/api/auth';\n\n/**\n * One leading slash, no trailing one - the shape `@dunx/http`'s route paths take,\n * so the mount and better-auth's own URL building agree character for character.\n *\n * The root is rejected: the mount is `<basePath>/*`, and at `/` that wildcard would\n * claim every path in the app.\n */\nexport const normalizeBasePath = (basePath: string): string => {\n  const normalized = `/${basePath}`.replace(/\\/{2,}/g, '/').replace(/\\/$/, '');\n\n  if (normalized.length < 2) {\n    throw new AuthError(\n      `\"${basePath}\" is not a usable basePath. The handler mounts at ` +\n        '<basePath>/*, so at the root it would claim every route in the app. ' +\n        `Use something like ${DEFAULT_BASE_PATH}.`,\n    );\n  }\n  return normalized;\n};\n\n/**\n * Bun's native bcrypt in place of better-auth's pure-JavaScript scrypt, unless a\n * `password` of your own is already there. See {@link bunPassword} for the\n * migration caveat.\n */\nconst withBunPassword = <O extends BetterAuthOptions>(options: O): O => {\n  const email = options.emailAndPassword;\n  if (!email?.enabled || email.password) return options;\n\n  // The one cast in the package: TypeScript cannot prove a spread of a generic with\n  // one key replaced is still that generic, and widening the return to\n  // `BetterAuthOptions` would lose the plugin types `betterAuth()` infers from it.\n  return {\n    ...options,\n    emailAndPassword: { ...email, password: bunPassword },\n  } as O;\n};\n\n/**\n * What `betterAuth()` gets called with, where the handler mounts, and the difference\n * between the two. Bound in the container so all of it is readable, and constructed\n * by `AuthModule` rather than by the app.\n */\nexport class AuthOptions<O extends BetterAuthOptions = BetterAuthOptions> {\n  readonly options: O;\n\n  /**\n   * What better-auth matches an incoming pathname against, and builds its URLs from.\n   * Normalized here and written back into `options`, so the two cannot drift.\n   */\n  readonly basePath: string;\n\n  /**\n   * The **route** path `AuthHandler` is mounted at, which is `basePath` unless the\n   * app calls `setGlobalPrefix`. better-auth compares the whole pathname to\n   * `basePath`, so with `setGlobalPrefix('api')` the two are different strings for\n   * the same URL: mount at `/auth`, and tell better-auth `basePath: '/api/auth'`.\n   */\n  readonly mountAt: string;\n\n  constructor(init: O, mountAt?: string) {\n    this.basePath = normalizeBasePath(init.basePath ?? DEFAULT_BASE_PATH);\n    this.mountAt =\n      mountAt === undefined ? this.basePath : normalizeBasePath(mountAt);\n    this.options = withBunPassword({ ...init, basePath: this.basePath });\n  }\n}\nObject.defineProperty(AuthOptions, Symbol.for('dunx.deps'), {\n  value: () => [{ unresolved: \"init: O\" }, { unresolved: \"mountAt?: string\" }],\n});\n",
     "import {\n  provide,\n  type AbstractCtor,\n  type Deps,\n  type DynamicModule,\n  type FactoryProvider,\n  type Registration,\n  RequestContext,\n} from '@dunx/core';\nimport { betterAuth, type BetterAuthOptions } from 'better-auth';\nimport { Auth } from './auth.js';\nimport { AuthContext } from './context.js';\nimport { AuthError } from './errors.js';\nimport { SessionGuard } from './guard.js';\nimport { mountHandler } from './handler.js';\nimport {\n  AuthOptions,\n  DEFAULT_BASE_PATH,\n  normalizeBasePath,\n} from './options.js';\n\nconst build = (options: Registration, mountAt: string): DynamicModule => {\n  // Instantiated to the token type rather than left as `typeof Auth`, which is what\n  // lets the factory below hand back a plain better-auth instance with no cast.\n  const auth: AbstractCtor<Auth> = Auth;\n\n  return {\n    module: AuthModule,\n    controllers: [mountHandler(mountAt)],\n    // Every binding declares its own `inject`, so nothing here needs\n    // `@dunx/transform`'s transform to have run - the same reason\n    // `RequestLoggingMiddleware` and `@dunx/infra/redis`'s `Redis` are bound this way.\n    providers: [\n      options,\n      provide(auth, {\n        useFactory: (resolved: AuthOptions) => betterAuth(resolved.options),\n        inject: [AuthOptions] as const,\n      }),\n      provide(AuthContext, {\n        useFactory: (context: RequestContext) => new AuthContext(context),\n        inject: [RequestContext] as const,\n      }),\n      provide(SessionGuard, {\n        useFactory: (instance: Auth, context: AuthContext) =>\n          new SessionGuard(instance, context),\n        inject: [auth, AuthContext] as const,\n      }),\n    ],\n  };\n};\n\n/**\n * Binds three tokens and one controller:\n *\n * - `AuthOptions` - what `betterAuth()` was called with, and where it is mounted.\n * - `Auth` - the better-auth instance itself.\n * - `AuthContext` - the authenticated caller, per request.\n * - a prefixed `AuthHandler`, serving every better-auth endpoint under `basePath`.\n *\n * `SessionGuard` is registered as a provider rather than installed as global\n * middleware, because whether it guards the whole app or one controller is the app's\n * decision - pass it to `HttpFactory.create(root, { middleware: [SessionGuard] })`\n * or to `@UseGuards(SessionGuard)`.\n */\nexport class AuthModule {\n  /**\n   * ```ts\n   * AuthModule.forRoot({\n   *   secret: process.env.BETTER_AUTH_SECRET,\n   *   baseURL: 'http://localhost:3000',\n   *   database: drizzleDatabase(connection),\n   *   emailAndPassword: { enabled: true },\n   *   plugins: [admin(), bearer()],\n   * });\n   * ```\n   *\n   * `const O` is load-bearing: it keeps the literal `plugins` tuple, which is what\n   * `betterAuth()` infers the plugin endpoints from - and therefore what\n   * `Auth<typeof options>` resolves to at an injection site.\n   *\n   * `mountAt` only matters under a global prefix - see {@link AuthOptions.mountAt}.\n   */\n  static forRoot<const O extends BetterAuthOptions>(\n    options: O,\n    mountAt?: string,\n  ): DynamicModule {\n    const resolved = new AuthOptions(options, mountAt);\n    return build(\n      provide(AuthOptions, { useValue: resolved }),\n      resolved.mountAt,\n    );\n  }\n\n  /**\n   * `forRoot` with the options behind a factory that may await and may inject -\n   * which is the only way the secret, the base URL and the database can come from\n   * `ConfigService` rather than from module scope:\n   *\n   * ```ts\n   * AuthModule.forRootAsync({\n   *   useFactory: (config: AppConfigService, connection: DbConnection) => ({\n   *     secret: config.get('authSecret'),\n   *     baseURL: config.get('appUrl'),\n   *     database: drizzleDatabase(connection),\n   *     emailAndPassword: { enabled: true },\n   *   }),\n   *   inject: [AppConfigService, DbConnection],\n   * });\n   * ```\n   *\n   * `mountAt` is a second, **synchronous** argument for the same reason\n   * `DbModule.forRootAsync` takes its token positionally: the mount is a route in\n   * Bun's table, and that table is built before any factory has run. It is only\n   * needed under a global prefix - see {@link AuthOptions.mountAt}. Omitting it while\n   * the factory returns a non-default `basePath` is a boot error, because that\n   * combination could only ever have mounted the handler where better-auth is not\n   * looking.\n   */\n  static forRootAsync<const D extends Deps>(\n    provider: FactoryProvider<BetterAuthOptions, D>,\n    mountAt?: string,\n  ): DynamicModule;\n  static forRootAsync(\n    provider: FactoryProvider<BetterAuthOptions, Deps>,\n    mountAt?: string,\n  ): DynamicModule {\n    const mounted = normalizeBasePath(mountAt ?? DEFAULT_BASE_PATH);\n\n    return build(\n      provide(AuthOptions, {\n        useFactory: async (\n          ...deps: readonly unknown[]\n        ): Promise<AuthOptions> => {\n          const resolved = new AuthOptions(\n            await provider.useFactory(...deps),\n            mounted,\n          );\n          if (mountAt === undefined && resolved.basePath !== mounted) {\n            throw new AuthError(\n              `The factory returned basePath ${resolved.basePath}, but the handler ` +\n                `is mounted at ${mounted} - the table was built before the factory ` +\n                'ran, so it could not follow. Pass the route path as ' +\n                \"forRootAsync's second argument.\",\n            );\n          }\n          return resolved;\n        },\n        inject: provider.inject ?? [],\n      }),\n      mounted,\n    );\n  }\n}\n",
-    "import type { BetterAuthOptions } from 'better-auth';\n\ntype SecondaryStorage = NonNullable<BetterAuthOptions['secondaryStorage']>;\n\n/**\n * The six commands this needs, restated rather than imported from\n * `@dunx/infra/redis` - same reasoning as {@link DrizzleSource}. A `RedisConnection`\n * satisfies it structurally (its parameters are wider, which is the assignable\n * direction), and a test double is six methods instead of the whole surface.\n */\nexport interface RedisStore {\n  get(key: string): Promise<string | null>;\n  getdel(key: string): Promise<string | null>;\n  incr(key: string): Promise<number>;\n  expire(key: string, seconds: number): Promise<boolean>;\n  set(\n    key: string,\n    value: string,\n    options?: { readonly ex?: number },\n  ): Promise<string | null>;\n  del(key: string): Promise<number>;\n}\n\n/**\n * better-auth's `secondaryStorage` over `Bun.RedisClient`, so sessions, verification\n * values and rate-limit counters live in Redis instead of costing a database round\n * trip on every request.\n *\n * All five methods are implemented, not the three that are mandatory.\n * `getAndDelete` and `increment` are optional in better-auth's interface because most\n * clients cannot do them atomically - `Bun.RedisClient` can, through `GETDEL` and\n * `INCR`, both already on `@dunx/infra/redis`'s contract. Without them better-auth\n * falls back to read-then-delete for single-use credentials, which is a race, and to\n * a non-atomic rate-limit counter.\n *\n * `increment`'s TTL applies on creation only, which is what makes the counter expire\n * a fixed window after the first hit rather than sliding forever: `INCR` returning\n * `1` is the signal that this call created the key.\n *\n * Redis being unreachable is deliberately **not** softened here. Bun's client\n * connects lazily and queues, so a command against a down server rejects and\n * better-auth's own error path is what should see it - a swallowed `null` from `get`\n * would read as \"no session\" and sign every user out.\n */\nexport const redisStorage = (connection: RedisStore): SecondaryStorage => ({\n  get: (key) => connection.get(key),\n  getAndDelete: (key) => connection.getdel(key),\n  increment: async (key, ttl) => {\n    const value = await connection.incr(key);\n    if (value === 1) await connection.expire(key, ttl);\n    return value;\n  },\n  set: (key, value, ttl) =>\n    connection.set(key, value, ttl === undefined ? {} : { ex: ttl }),\n  delete: async (key) => {\n    await connection.del(key);\n  },\n});\n"
+    "import type { BetterAuthOptions } from 'better-auth';\n\ntype SecondaryStorage = NonNullable<BetterAuthOptions['secondaryStorage']>;\n\n/**\n * The six commands this needs, restated rather than imported from\n * `@dunx/infra/redis` - same reasoning as {@link DrizzleSource}. A `RedisConnection`\n * satisfies it structurally (its parameters are wider, which is the assignable\n * direction), and a test double is six methods instead of the whole surface.\n */\nexport interface RedisStore {\n  get(key: string): Promise<string | null>;\n  getdel(key: string): Promise<string | null>;\n  incr(key: string): Promise<number>;\n  expire(key: string, seconds: number): Promise<boolean>;\n  set(\n    key: string,\n    value: string,\n    options?: { readonly ex?: number },\n  ): Promise<string | null>;\n  del(key: string): Promise<number>;\n}\n\n/**\n * better-auth's `secondaryStorage` over `Bun.RedisClient`, so sessions, verification\n * values and rate-limit counters live in Redis instead of costing a database round\n * trip on every request.\n *\n * All five methods are implemented, not the three that are mandatory.\n * `getAndDelete` and `increment` are optional in better-auth's interface because most\n * clients cannot do them atomically - `Bun.RedisClient` can, through `GETDEL` and\n * `INCR`, both already on `@dunx/infra/redis`'s contract. Without them better-auth\n * falls back to read-then-delete for single-use credentials, which is a race, and to\n * a non-atomic rate-limit counter.\n *\n * `increment`'s TTL applies on creation only, which is what makes the counter expire\n * a fixed window after the first hit rather than sliding forever: `INCR` returning\n * `1` is the signal that this call created the key.\n *\n * Redis being unreachable is deliberately **not** softened here. Bun's client\n * connects lazily and queues, so a command against a down server rejects and\n * better-auth's own error path is what should see it - a swallowed `null` from `get`\n * would read as \"no session\" and sign every user out.\n */\nexport const redisStorage = (connection: RedisStore): SecondaryStorage => ({\n  get: (key) => connection.get(key),\n  getAndDelete: (key) => connection.getdel(key),\n  increment: async (key, ttl) => {\n    const value = await connection.incr(key);\n    if (value === 1) await connection.expire(key, ttl);\n    return value;\n  },\n  set: (key, value, ttl) =>\n    connection.set(key, value, ttl === undefined ? {} : { ex: ttl }),\n  delete: async (key) => {\n    await connection.del(key);\n  },\n});\n",
+    "import { normalizeBasePath } from './options.js';\n\n/**\n * The shape `@dunx/openapi` accepts as a contribution. Restated here rather than\n * imported, for the same reason `DrizzleSource` restates `DbConnection`:\n * `@dunx/auth` must not depend on `@dunx/openapi`. An app that documents nothing\n * still uses this package, and an app that never mounts auth still uses that one.\n */\nexport interface AuthDocumentFragment {\n  readonly paths: Readonly<Record<string, Record<string, unknown>>>;\n  readonly schemas: Readonly<Record<string, unknown>>;\n  readonly tags: readonly {\n    readonly name: string;\n    readonly description?: string;\n  }[];\n}\n\n/** Just enough of a Better Auth instance to ask it for its schema. */\nexport interface OpenApiCapableAuth {\n  readonly api: {\n    generateOpenAPISchema?: () => Promise<unknown>;\n  };\n}\n\nexport interface AuthDocumentOptions {\n  /** Where the handler is mounted. Matches `AuthOptions.basePath`. */\n  readonly basePath: string;\n  /** Tag every contributed operation carries. Default `auth`. */\n  readonly tag?: string;\n}\n\nconst METHODS = ['get', 'post', 'put', 'patch', 'delete', 'options', 'head'];\n\ninterface RawSchema {\n  paths?: Record<string, Record<string, unknown>>;\n  components?: { schemas?: Record<string, unknown> };\n}\n\n/**\n * Better Auth's own endpoints, as a contribution to the app's OpenAPI document.\n *\n * Better Auth serves `<basePath>/*` from its own handler rather than from dunx\n * controllers, so route discovery cannot see any of it and the document would\n * describe an API missing its entire authentication surface. This asks the\n * library for its schema and hands it over:\n *\n * ```ts\n * OpenApiModule.forRoot({\n *   title: 'API',\n *   version: '1.0.0',\n *   root: AppModule,\n *   contribute: [betterAuthDocument(auth, { basePath: '/api/auth' })],\n * });\n * ```\n *\n * **Better Auth only generates a schema when the `openAPI()` plugin is enabled.**\n * Without it `generateOpenAPISchema` is absent and this contributes nothing rather\n * than throwing, because a missing plugin should cost documentation and not boot.\n * Pass `openAPI({ disableDefaultReference: true })` if you want the schema without\n * Better Auth also mounting its own reference page next to the dunx one.\n *\n * Paths are rewritten to sit under `basePath`, since the library reports them\n * relative to its own mount.\n */\nexport const betterAuthDocument =\n  (auth: OpenApiCapableAuth, options: AuthDocumentOptions) =>\n  async (): Promise<AuthDocumentFragment> => {\n    const empty: AuthDocumentFragment = { paths: {}, schemas: {}, tags: [] };\n    if (typeof auth.api.generateOpenAPISchema !== 'function') return empty;\n\n    const raw = (await auth.api.generateOpenAPISchema()) as RawSchema;\n    const prefix = normalizeBasePath(options.basePath);\n    const tag = options.tag ?? 'auth';\n\n    const paths: Record<string, Record<string, unknown>> = {};\n    for (const [path, item] of Object.entries(raw.paths ?? {})) {\n      // Tagged so the explorer groups them, instead of scattering a dozen auth\n      // endpoints through the rest of the API.\n      for (const method of METHODS) {\n        const operation = item[method];\n        if (operation && typeof operation === 'object') {\n          (operation as { tags?: string[] }).tags = [tag];\n        }\n      }\n      paths[path.startsWith(prefix) ? path : `${prefix}${path}`] = item;\n    }\n\n    return {\n      paths,\n      schemas: raw.components?.schemas ?? {},\n      tags: [{ name: tag, description: 'Served by Better Auth' }],\n    };\n  };\n"
   ],
-  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAMO,MAAM,kBAAkB,SAAS;AAAA,EAC7B,OAAO;AAClB;;;ACYO,MAAe,KAAsD;AAAA,EAO1E,WAAW,GAAG;AAAA,IACZ,IAAI,eAAe,MAAM;AAAA,MACvB,MAAM,IAAI,UACR,8DACE,yEACJ;AAAA,IACF;AAAA;AAYJ;;AC7CA;AACA;AACA;AAAA;AAqBO,MAAM,YAAY;AAAA,EAGM;AAAA,EAFpB,WAAW,IAAI;AAAA,EAExB,WAAW,CAAkB,SAAyB;AAAA,IAAzB;AAAA;AAAA,EAW7B,OAAwD,GAE1C;AAAA,IACZ,OAAO,KAAK,SAAS,SAAS;AAAA;AAAA,EAIhC,OAAwD,GAAiB;AAAA,IACvE,MAAM,YAAY,KAAK,QAAW;AAAA,IAClC,IAAI,CAAC,WAAW;AAAA,MACd,MAAM,IAAI,UAAU,eAAe,cAAc,iBAAiB;AAAA,IACpE;AAAA,IACA,OAAO;AAAA;AAAA,EAUT,GAAM,CAAC,WAAsB,UAAsB;AAAA,IACjD,KAAK,QAAQ,cAAc,EAAE,QAAQ,UAAU,KAAK,GAAG,CAAC;AAAA,IACxD,OAAO,KAAK,SAAS,IAAI,WAAW,QAAQ;AAAA;AAEhD;AACA,OAAO,eAAe,aAAa,OAAO,IAAI,WAAW,GAAG;AAAA,EAC1D,OAAO,MAAM,CAAC,cAAc;AAC9B,CAAC;;AClED;AAAA,eACE;AAAA,oBACA;AAAA;AAAA;AAAA;AAqBK,IAAM,UAAU,CAAC,SAAoC;AAAA,EAC1D,MAAM,OAAQ,KAAe;AAAA,EAE7B,IAAI,OAAO,SAAS,UAAU;AAAA,IAC5B,OAAO,KACJ,MAAM,GAAG,EACT,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAC3B,OAAO,CAAC,UAAU,MAAM,SAAS,CAAC;AAAA,EACvC;AAAA,EACA,IAAI,MAAM,QAAQ,IAAI,GAAG;AAAA,IACvB,OAAO,KAAK,OAAO,CAAC,UAA2B,OAAO,UAAU,QAAQ;AAAA,EAC1E;AAAA,EACA,OAAO,CAAC;AAAA;AAAA;AAmBH,MAAM,aAAmC;AAAA,EAE3B;AAAA,EACA;AAAA,EAFnB,WAAW,CACQ,MACA,SACjB;AAAA,IAFiB;AAAA,IACA;AAAA;AAAA,OAGb,OAAM,CACV,KACA,KACA,MACmB;AAAA,IACnB,IAAI,IAAI,IAAI,MAAM;AAAA,MAAG,OAAO,KAAK;AAAA,IAEjC,MAAM,YAA8B,MAAM,KAAK,KAAK,IAAI,WAAW;AAAA,MACjE,SAAS,IAAI;AAAA,IACf,CAAC;AAAA,IACD,IAAI,CAAC,WAAW;AAAA,MACd,MAAM,IAAI,WAAU,gBAAe,cAAc,iBAAiB;AAAA,IACpE;AAAA,IAEA,MAAM,WAAW,IAAI,IAAI,KAAK;AAAA,IAC9B,IAAI,aAAa,aAAa,SAAS,SAAS,GAAG;AAAA,MACjD,MAAM,OAAO,QAAQ,UAAU,IAAI;AAAA,MACnC,IAAI,CAAC,SAAS,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,GAAG;AAAA,QACjD,MAAM,IAAI,WACR,gBAAe,WACf,oBAAoB,SAAS,KAAK,IAAI,GACxC;AAAA,MACF;AAAA,IACF;AAAA,IAEA,OAAO,KAAK,QAAQ,IAAI,WAAW,IAAI;AAAA;AAE3C;AACA,OAAO,eAAe,cAAc,OAAO,IAAI,WAAW,GAAG;AAAA,EAC3D,OAAO,MAAM,CAAC,MAAM,WAAW;AACjC,CAAC;;AC1FD;AACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACgBO,IAAM,cAAc;AAAA,EACzB,MAAM,CAAC,aACL,IAAI,SAAS,KAAK,UAAU,EAAE,WAAW,UAAU,MAAM,GAAG,CAAC;AAAA,EAC/D,QAAQ;AAAA,IACN;AAAA,IACA;AAAA,QAIsB;AAAA,IACtB,IAAI;AAAA,MACF,OAAO,MAAM,IAAI,SAAS,OAAO,UAAU,IAAI;AAAA,MAC/C,MAAM;AAAA,MACN,OAAO;AAAA;AAAA;AAGb;;;AC5BO,IAAM,oBAAoB;AAS1B,IAAM,oBAAoB,CAAC,aAA6B;AAAA,EAC7D,MAAM,aAAa,IAAI,WAAW,QAAQ,WAAW,GAAG,EAAE,QAAQ,OAAO,EAAE;AAAA,EAE3E,IAAI,WAAW,SAAS,GAAG;AAAA,IACzB,MAAM,IAAI,UACR,IAAI,+DACF,yEACA,sBAAsB,oBAC1B;AAAA,EACF;AAAA,EACA,OAAO;AAAA;AAQT,IAAM,kBAAkB,CAA8B,YAAkB;AAAA,EACtE,MAAM,QAAQ,QAAQ;AAAA,EACtB,IAAI,CAAC,OAAO,WAAW,MAAM;AAAA,IAAU,OAAO;AAAA,EAK9C,OAAO;AAAA,OACF;AAAA,IACH,kBAAkB,KAAK,OAAO,UAAU,YAAY;AAAA,EACtD;AAAA;AAAA;AAQK,MAAM,YAA6D;AAAA,EAC/D;AAAA,EAMA;AAAA,EAQA;AAAA,EAET,WAAW,CAAC,MAAS,SAAkB;AAAA,IACrC,KAAK,WAAW,kBAAkB,KAAK,YAAY,iBAAiB;AAAA,IACpE,KAAK,UACH,YAAY,YAAY,KAAK,WAAW,kBAAkB,OAAO;AAAA,IACnE,KAAK,UAAU,gBAAgB,KAAK,MAAM,UAAU,KAAK,SAAS,CAAC;AAAA;AAEvE;AACA,OAAO,eAAe,aAAa,OAAO,IAAI,WAAW,GAAG;AAAA,EAC1D,OAAO,MAAM,CAAC,EAAE,YAAY,UAAU,GAAG,EAAE,YAAY,mBAAmB,CAAC;AAC7E,CAAC;;;AFpCM;AAAA,EADN,OAAO;AAAA;AACD;AAAA,EAIJ,IAAI,IAAI;AAAA;AAJJ;AAAA,EAQJ,KAAK,IAAI;AAAA;AARL;AAAA,EAYJ,IAAI,IAAI;AAAA;AAZJ;AAAA,EAgBJ,MAAM,IAAI;AAAA;AAhBN;AAAA,EAoBJ,OAAO,IAAI;AAAA;AApBP;AAAA;AAAA;AAAA,eA+BI,SAAC,KAAoC;AAAA,EAC5C,IAAI,CAAC,+BAAgB;AAAA,IACnB,8BAAiB;AAAA,IACjB,MAAM,WAAW,0BAAW,QAAQ,YAAY;AAAA,IAChD,QAAQ,aAAa,IAAI,IAAI,IAAI,GAAG;AAAA,IACpC,IAAI,CAAC,SAAS,WAAW,GAAG,WAAW,GAAG;AAAA,MACxC,MAAM,IAAI,UACR,GAAG,2EACD,YAAY,6DACZ,6EACA,yEACJ;AAAA,IACF;AAAA,EACF;AAAA,EACA,OAAO,0BAAW,QAAQ,GAAG;AAAA;AA7C1B;AAAA;AAAA,MAAM,YAAY;AAAA,EAAlB;AAAA,8BACY,OAAO,IAAI;AAAA,IADvB,8BAEO;AAAA,IAFP;AAAA;AAAA;AAAA,EAIM,GAAG,GAAG,OAA+C;AAAA,IAC9D,OAAO,0DAAe,GAAG;AAAA;AAAA,EAGf,IAAI,GAAG,OAA+C;AAAA,IAChE,OAAO,0DAAe,GAAG;AAAA;AAAA,EAGhB,GAAG,GAAG,OAA+C;AAAA,IAC9D,OAAO,0DAAe,GAAG;AAAA;AAAA,EAGd,KAAK,GAAG,OAA+C;AAAA,IAClE,OAAO,0DAAe,GAAG;AAAA;AAAA,EAGb,MAAM,GAAG,OAA+C;AAAA,IACpE,OAAO,0DAAe,GAAG;AAAA;AA0B7B;AA/CO,4BAIM,OAJN,OAAM;AAAN,4BAQO,QARP,OAAM;AAAN,4BAYM,OAZN,OAAM;AAAN,4BAgBQ,SAhBR,OAAM;AAAN,4BAoBS,UApBT,OAAM;AAAA,cAAN,iDAAM;AAAN,4BAAM;AAAN,2BAAM;AAAN,mBAAM;AA2DN,IAAM,eAAe,CAAC,YAC3B,WAAW,OAAO,EAAE,MAAM,2BAA2B,YAAY;AAAC,CAAC;;AGpGrE;AAAA;AAAA,oBAOE;AAAA;AAEF;AAYA,IAAM,QAAQ,CAAC,SAAuB,YAAmC;AAAA,EAGvE,MAAM,OAA2B;AAAA,EAEjC,OAAO;AAAA,IACL,QAAQ;AAAA,IACR,aAAa,CAAC,aAAa,OAAO,CAAC;AAAA,IAInC,WAAW;AAAA,MACT;AAAA,MACA,QAAQ,MAAM;AAAA,QACZ,YAAY,CAAC,aAA0B,WAAW,SAAS,OAAO;AAAA,QAClE,QAAQ,CAAC,WAAW;AAAA,MACtB,CAAC;AAAA,MACD,QAAQ,aAAa;AAAA,QACnB,YAAY,CAAC,YAA4B,IAAI,YAAY,OAAO;AAAA,QAChE,QAAQ,CAAC,eAAc;AAAA,MACzB,CAAC;AAAA,MACD,QAAQ,cAAc;AAAA,QACpB,YAAY,CAAC,UAAgB,YAC3B,IAAI,aAAa,UAAU,OAAO;AAAA,QACpC,QAAQ,CAAC,MAAM,WAAW;AAAA,MAC5B,CAAC;AAAA,IACH;AAAA,EACF;AAAA;AAAA;AAgBK,MAAM,WAAW;AAAA,SAkBf,OAA0C,CAC/C,SACA,SACe;AAAA,IACf,MAAM,WAAW,IAAI,YAAY,SAAS,OAAO;AAAA,IACjD,OAAO,MACL,QAAQ,aAAa,EAAE,UAAU,SAAS,CAAC,GAC3C,SAAS,OACX;AAAA;AAAA,SAgCK,YAAY,CACjB,UACA,SACe;AAAA,IACf,MAAM,UAAU,kBAAkB,WAAW,iBAAiB;AAAA,IAE9D,OAAO,MACL,QAAQ,aAAa;AAAA,MACnB,YAAY,UACP,SACsB;AAAA,QACzB,MAAM,WAAW,IAAI,YACnB,MAAM,SAAS,WAAW,GAAG,IAAI,GACjC,OACF;AAAA,QACA,IAAI,YAAY,aAAa,SAAS,aAAa,SAAS;AAAA,UAC1D,MAAM,IAAI,UACR,iCAAiC,SAAS,+BACxC,iBAAiB,sDACjB,yDACA,iCACJ;AAAA,QACF;AAAA,QACA,OAAO;AAAA;AAAA,MAET,QAAQ,SAAS,UAAU,CAAC;AAAA,IAC9B,CAAC,GACD,OACF;AAAA;AAEJ;;AC5GO,IAAM,eAAe,CAAC,gBAA8C;AAAA,EACzE,KAAK,CAAC,QAAQ,WAAW,IAAI,GAAG;AAAA,EAChC,cAAc,CAAC,QAAQ,WAAW,OAAO,GAAG;AAAA,EAC5C,WAAW,OAAO,KAAK,QAAQ;AAAA,IAC7B,MAAM,QAAQ,MAAM,WAAW,KAAK,GAAG;AAAA,IACvC,IAAI,UAAU;AAAA,MAAG,MAAM,WAAW,OAAO,KAAK,GAAG;AAAA,IACjD,OAAO;AAAA;AAAA,EAET,KAAK,CAAC,KAAK,OAAO,QAChB,WAAW,IAAI,KAAK,OAAO,QAAQ,YAAY,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;AAAA,EACjE,QAAQ,OAAO,QAAQ;AAAA,IACrB,MAAM,WAAW,IAAI,GAAG;AAAA;AAE5B;",
-  "debugId": "0637629E506E689864756E2164756E21",
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAMO,MAAM,kBAAkB,SAAS;AAAA,EAC7B,OAAO;AAClB;;;ACYO,MAAe,KAAsD;AAAA,EAO1E,WAAW,GAAG;AAAA,IACZ,IAAI,eAAe,MAAM;AAAA,MACvB,MAAM,IAAI,UACR,8DACE,yEACJ;AAAA,IACF;AAAA;AAYJ;;AC7CA;AACA;AACA;AAAA;AAqBO,MAAM,YAAY;AAAA,EAGM;AAAA,EAFpB,WAAW,IAAI;AAAA,EAExB,WAAW,CAAkB,SAAyB;AAAA,IAAzB;AAAA;AAAA,EAW7B,OAAwD,GAE1C;AAAA,IACZ,OAAO,KAAK,SAAS,SAAS;AAAA;AAAA,EAIhC,OAAwD,GAAiB;AAAA,IACvE,MAAM,YAAY,KAAK,QAAW;AAAA,IAClC,IAAI,CAAC,WAAW;AAAA,MACd,MAAM,IAAI,UAAU,eAAe,cAAc,iBAAiB;AAAA,IACpE;AAAA,IACA,OAAO;AAAA;AAAA,EAUT,GAAM,CAAC,WAAsB,UAAsB;AAAA,IACjD,KAAK,QAAQ,cAAc,EAAE,QAAQ,UAAU,KAAK,GAAG,CAAC;AAAA,IACxD,OAAO,KAAK,SAAS,IAAI,WAAW,QAAQ;AAAA;AAEhD;AACA,OAAO,eAAe,aAAa,OAAO,IAAI,WAAW,GAAG;AAAA,EAC1D,OAAO,MAAM,CAAC,cAAc;AAC9B,CAAC;;AClED;AAAA,eACE;AAAA,oBACA;AAAA;AAAA;AAAA;AAqBK,IAAM,UAAU,CAAC,SAAoC;AAAA,EAC1D,MAAM,OAAQ,KAAe;AAAA,EAE7B,IAAI,OAAO,SAAS,UAAU;AAAA,IAC5B,OAAO,KACJ,MAAM,GAAG,EACT,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAC3B,OAAO,CAAC,UAAU,MAAM,SAAS,CAAC;AAAA,EACvC;AAAA,EACA,IAAI,MAAM,QAAQ,IAAI,GAAG;AAAA,IACvB,OAAO,KAAK,OAAO,CAAC,UAA2B,OAAO,UAAU,QAAQ;AAAA,EAC1E;AAAA,EACA,OAAO,CAAC;AAAA;AAAA;AAmBH,MAAM,aAAmC;AAAA,EAE3B;AAAA,EACA;AAAA,EAFnB,WAAW,CACQ,MACA,SACjB;AAAA,IAFiB;AAAA,IACA;AAAA;AAAA,OAGb,OAAM,CACV,KACA,KACA,MACmB;AAAA,IACnB,IAAI,IAAI,IAAI,MAAM;AAAA,MAAG,OAAO,KAAK;AAAA,IAEjC,MAAM,YAA8B,MAAM,KAAK,KAAK,IAAI,WAAW;AAAA,MACjE,SAAS,IAAI;AAAA,IACf,CAAC;AAAA,IACD,IAAI,CAAC,WAAW;AAAA,MACd,MAAM,IAAI,WAAU,gBAAe,cAAc,iBAAiB;AAAA,IACpE;AAAA,IAEA,MAAM,WAAW,IAAI,IAAI,KAAK;AAAA,IAC9B,IAAI,aAAa,aAAa,SAAS,SAAS,GAAG;AAAA,MACjD,MAAM,OAAO,QAAQ,UAAU,IAAI;AAAA,MACnC,IAAI,CAAC,SAAS,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,GAAG;AAAA,QACjD,MAAM,IAAI,WACR,gBAAe,WACf,oBAAoB,SAAS,KAAK,IAAI,GACxC;AAAA,MACF;AAAA,IACF;AAAA,IAEA,OAAO,KAAK,QAAQ,IAAI,WAAW,IAAI;AAAA;AAE3C;AACA,OAAO,eAAe,cAAc,OAAO,IAAI,WAAW,GAAG;AAAA,EAC3D,OAAO,MAAM,CAAC,MAAM,WAAW;AACjC,CAAC;;AC1FD;AACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACgBO,IAAM,cAAc;AAAA,EACzB,MAAM,CAAC,aACL,IAAI,SAAS,KAAK,UAAU,EAAE,WAAW,UAAU,MAAM,GAAG,CAAC;AAAA,EAC/D,QAAQ;AAAA,IACN;AAAA,IACA;AAAA,QAIsB;AAAA,IACtB,IAAI;AAAA,MACF,OAAO,MAAM,IAAI,SAAS,OAAO,UAAU,IAAI;AAAA,MAC/C,MAAM;AAAA,MACN,OAAO;AAAA;AAAA;AAGb;;;AC5BO,IAAM,oBAAoB;AAS1B,IAAM,oBAAoB,CAAC,aAA6B;AAAA,EAC7D,MAAM,aAAa,IAAI,WAAW,QAAQ,WAAW,GAAG,EAAE,QAAQ,OAAO,EAAE;AAAA,EAE3E,IAAI,WAAW,SAAS,GAAG;AAAA,IACzB,MAAM,IAAI,UACR,IAAI,+DACF,yEACA,sBAAsB,oBAC1B;AAAA,EACF;AAAA,EACA,OAAO;AAAA;AAQT,IAAM,kBAAkB,CAA8B,YAAkB;AAAA,EACtE,MAAM,QAAQ,QAAQ;AAAA,EACtB,IAAI,CAAC,OAAO,WAAW,MAAM;AAAA,IAAU,OAAO;AAAA,EAK9C,OAAO;AAAA,OACF;AAAA,IACH,kBAAkB,KAAK,OAAO,UAAU,YAAY;AAAA,EACtD;AAAA;AAAA;AAQK,MAAM,YAA6D;AAAA,EAC/D;AAAA,EAMA;AAAA,EAQA;AAAA,EAET,WAAW,CAAC,MAAS,SAAkB;AAAA,IACrC,KAAK,WAAW,kBAAkB,KAAK,YAAY,iBAAiB;AAAA,IACpE,KAAK,UACH,YAAY,YAAY,KAAK,WAAW,kBAAkB,OAAO;AAAA,IACnE,KAAK,UAAU,gBAAgB,KAAK,MAAM,UAAU,KAAK,SAAS,CAAC;AAAA;AAEvE;AACA,OAAO,eAAe,aAAa,OAAO,IAAI,WAAW,GAAG;AAAA,EAC1D,OAAO,MAAM,CAAC,EAAE,YAAY,UAAU,GAAG,EAAE,YAAY,mBAAmB,CAAC;AAC7E,CAAC;;;AFpCM;AAAA,EADN,OAAO;AAAA;AACD;AAAA,EAIJ,IAAI,IAAI;AAAA;AAJJ;AAAA,EAQJ,KAAK,IAAI;AAAA;AARL;AAAA,EAYJ,IAAI,IAAI;AAAA;AAZJ;AAAA,EAgBJ,MAAM,IAAI;AAAA;AAhBN;AAAA,EAoBJ,OAAO,IAAI;AAAA;AApBP;AAAA;AAAA;AAAA,eA+BI,SAAC,KAAoC;AAAA,EAC5C,IAAI,CAAC,+BAAgB;AAAA,IACnB,8BAAiB;AAAA,IACjB,MAAM,WAAW,0BAAW,QAAQ,YAAY;AAAA,IAChD,QAAQ,aAAa,IAAI,IAAI,IAAI,GAAG;AAAA,IACpC,IAAI,CAAC,SAAS,WAAW,GAAG,WAAW,GAAG;AAAA,MACxC,MAAM,IAAI,UACR,GAAG,2EACD,YAAY,6DACZ,6EACA,yEACJ;AAAA,IACF;AAAA,EACF;AAAA,EACA,OAAO,0BAAW,QAAQ,GAAG;AAAA;AA7C1B;AAAA;AAAA,MAAM,YAAY;AAAA,EAAlB;AAAA,8BACY,OAAO,IAAI;AAAA,IADvB,8BAEO;AAAA,IAFP;AAAA;AAAA;AAAA,EAIM,GAAG,GAAG,OAA+C;AAAA,IAC9D,OAAO,0DAAe,GAAG;AAAA;AAAA,EAGf,IAAI,GAAG,OAA+C;AAAA,IAChE,OAAO,0DAAe,GAAG;AAAA;AAAA,EAGhB,GAAG,GAAG,OAA+C;AAAA,IAC9D,OAAO,0DAAe,GAAG;AAAA;AAAA,EAGd,KAAK,GAAG,OAA+C;AAAA,IAClE,OAAO,0DAAe,GAAG;AAAA;AAAA,EAGb,MAAM,GAAG,OAA+C;AAAA,IACpE,OAAO,0DAAe,GAAG;AAAA;AA0B7B;AA/CO,4BAIM,OAJN,OAAM;AAAN,4BAQO,QARP,OAAM;AAAN,4BAYM,OAZN,OAAM;AAAN,4BAgBQ,SAhBR,OAAM;AAAN,4BAoBS,UApBT,OAAM;AAAA,cAAN,iDAAM;AAAN,4BAAM;AAAN,2BAAM;AAAN,mBAAM;AA2DN,IAAM,eAAe,CAAC,YAC3B,WAAW,OAAO,EAAE,MAAM,2BAA2B,YAAY;AAAC,CAAC;;AGpGrE;AAAA;AAAA,oBAOE;AAAA;AAEF;AAYA,IAAM,QAAQ,CAAC,SAAuB,YAAmC;AAAA,EAGvE,MAAM,OAA2B;AAAA,EAEjC,OAAO;AAAA,IACL,QAAQ;AAAA,IACR,aAAa,CAAC,aAAa,OAAO,CAAC;AAAA,IAInC,WAAW;AAAA,MACT;AAAA,MACA,QAAQ,MAAM;AAAA,QACZ,YAAY,CAAC,aAA0B,WAAW,SAAS,OAAO;AAAA,QAClE,QAAQ,CAAC,WAAW;AAAA,MACtB,CAAC;AAAA,MACD,QAAQ,aAAa;AAAA,QACnB,YAAY,CAAC,YAA4B,IAAI,YAAY,OAAO;AAAA,QAChE,QAAQ,CAAC,eAAc;AAAA,MACzB,CAAC;AAAA,MACD,QAAQ,cAAc;AAAA,QACpB,YAAY,CAAC,UAAgB,YAC3B,IAAI,aAAa,UAAU,OAAO;AAAA,QACpC,QAAQ,CAAC,MAAM,WAAW;AAAA,MAC5B,CAAC;AAAA,IACH;AAAA,EACF;AAAA;AAAA;AAgBK,MAAM,WAAW;AAAA,SAkBf,OAA0C,CAC/C,SACA,SACe;AAAA,IACf,MAAM,WAAW,IAAI,YAAY,SAAS,OAAO;AAAA,IACjD,OAAO,MACL,QAAQ,aAAa,EAAE,UAAU,SAAS,CAAC,GAC3C,SAAS,OACX;AAAA;AAAA,SAgCK,YAAY,CACjB,UACA,SACe;AAAA,IACf,MAAM,UAAU,kBAAkB,WAAW,iBAAiB;AAAA,IAE9D,OAAO,MACL,QAAQ,aAAa;AAAA,MACnB,YAAY,UACP,SACsB;AAAA,QACzB,MAAM,WAAW,IAAI,YACnB,MAAM,SAAS,WAAW,GAAG,IAAI,GACjC,OACF;AAAA,QACA,IAAI,YAAY,aAAa,SAAS,aAAa,SAAS;AAAA,UAC1D,MAAM,IAAI,UACR,iCAAiC,SAAS,+BACxC,iBAAiB,sDACjB,yDACA,iCACJ;AAAA,QACF;AAAA,QACA,OAAO;AAAA;AAAA,MAET,QAAQ,SAAS,UAAU,CAAC;AAAA,IAC9B,CAAC,GACD,OACF;AAAA;AAEJ;;AC5GO,IAAM,eAAe,CAAC,gBAA8C;AAAA,EACzE,KAAK,CAAC,QAAQ,WAAW,IAAI,GAAG;AAAA,EAChC,cAAc,CAAC,QAAQ,WAAW,OAAO,GAAG;AAAA,EAC5C,WAAW,OAAO,KAAK,QAAQ;AAAA,IAC7B,MAAM,QAAQ,MAAM,WAAW,KAAK,GAAG;AAAA,IACvC,IAAI,UAAU;AAAA,MAAG,MAAM,WAAW,OAAO,KAAK,GAAG;AAAA,IACjD,OAAO;AAAA;AAAA,EAET,KAAK,CAAC,KAAK,OAAO,QAChB,WAAW,IAAI,KAAK,OAAO,QAAQ,YAAY,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;AAAA,EACjE,QAAQ,OAAO,QAAQ;AAAA,IACrB,MAAM,WAAW,IAAI,GAAG;AAAA;AAE5B;;AC1BA,IAAM,UAAU,CAAC,OAAO,QAAQ,OAAO,SAAS,UAAU,WAAW,MAAM;AAiCpE,IAAM,qBACX,CAAC,MAA0B,YAC3B,YAA2C;AAAA,EACzC,MAAM,QAA8B,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,GAAG,MAAM,CAAC,EAAE;AAAA,EACvE,IAAI,OAAO,KAAK,IAAI,0BAA0B;AAAA,IAAY,OAAO;AAAA,EAEjE,MAAM,MAAO,MAAM,KAAK,IAAI,sBAAsB;AAAA,EAClD,MAAM,SAAS,kBAAkB,QAAQ,QAAQ;AAAA,EACjD,MAAM,MAAM,QAAQ,OAAO;AAAA,EAE3B,MAAM,QAAiD,CAAC;AAAA,EACxD,YAAY,MAAM,SAAS,OAAO,QAAQ,IAAI,SAAS,CAAC,CAAC,GAAG;AAAA,IAG1D,WAAW,UAAU,SAAS;AAAA,MAC5B,MAAM,YAAY,KAAK;AAAA,MACvB,IAAI,aAAa,OAAO,cAAc,UAAU;AAAA,QAC7C,UAAkC,OAAO,CAAC,GAAG;AAAA,MAChD;AAAA,IACF;AAAA,IACA,MAAM,KAAK,WAAW,MAAM,IAAI,OAAO,GAAG,SAAS,UAAU;AAAA,EAC/D;AAAA,EAEA,OAAO;AAAA,IACL;AAAA,IACA,SAAS,IAAI,YAAY,WAAW,CAAC;AAAA,IACrC,MAAM,CAAC,EAAE,MAAM,KAAK,aAAa,wBAAwB,CAAC;AAAA,EAC5D;AAAA;",
+  "debugId": "8234AC9581E74BE264756E2164756E21",
   "names": []
 }

package/dist/openapi.d.ts

@@ -0,0 +1,53 @@
+/**
+ * The shape `@dunx/openapi` accepts as a contribution. Restated here rather than
+ * imported, for the same reason `DrizzleSource` restates `DbConnection`:
+ * `@dunx/auth` must not depend on `@dunx/openapi`. An app that documents nothing
+ * still uses this package, and an app that never mounts auth still uses that one.
+ */
+export interface AuthDocumentFragment {
+    readonly paths: Readonly<Record<string, Record<string, unknown>>>;
+    readonly schemas: Readonly<Record<string, unknown>>;
+    readonly tags: readonly {
+        readonly name: string;
+        readonly description?: string;
+    }[];
+}
+/** Just enough of a Better Auth instance to ask it for its schema. */
+export interface OpenApiCapableAuth {
+    readonly api: {
+        generateOpenAPISchema?: () => Promise<unknown>;
+    };
+}
+export interface AuthDocumentOptions {
+    /** Where the handler is mounted. Matches `AuthOptions.basePath`. */
+    readonly basePath: string;
+    /** Tag every contributed operation carries. Default `auth`. */
+    readonly tag?: string;
+}
+/**
+ * Better Auth's own endpoints, as a contribution to the app's OpenAPI document.
+ *
+ * Better Auth serves `<basePath>/*` from its own handler rather than from dunx
+ * controllers, so route discovery cannot see any of it and the document would
+ * describe an API missing its entire authentication surface. This asks the
+ * library for its schema and hands it over:
+ *
+ * ```ts
+ * OpenApiModule.forRoot({
+ *   title: 'API',
+ *   version: '1.0.0',
+ *   root: AppModule,
+ *   contribute: [betterAuthDocument(auth, { basePath: '/api/auth' })],
+ * });
+ * ```
+ *
+ * **Better Auth only generates a schema when the `openAPI()` plugin is enabled.**
+ * Without it `generateOpenAPISchema` is absent and this contributes nothing rather
+ * than throwing, because a missing plugin should cost documentation and not boot.
+ * Pass `openAPI({ disableDefaultReference: true })` if you want the schema without
+ * Better Auth also mounting its own reference page next to the dunx one.
+ *
+ * Paths are rewritten to sit under `basePath`, since the library reports them
+ * relative to its own mount.
+ */
+export declare const betterAuthDocument: (auth: OpenApiCapableAuth, options: AuthDocumentOptions) => () => Promise<AuthDocumentFragment>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dunx/auth",
-  "version": "0.1.1",
+  "version": "0.2.1",
   "description": "Better Auth for dunx: its handler mounted on Bun.serve, a session guard reading @Public() and @Roles(), the caller in async context, and Bun.password hashing",
   "keywords": [
     "auth",
@@ -58,8 +58,8 @@
     "drizzle-orm": "^0.45.2"
   },
   "peerDependencies": {
-    "@dunx/core": "0.1.1",
-    "@dunx/http": "0.1.1",
+    "@dunx/core": "^0.2.1",
+    "@dunx/http": "^0.2.1",
     "@types/bun": ">=1.3.0",
     "better-auth": "^1.6.25",
     "drizzle-orm": "^0.45.2"