@dunx/auth 0.9.0 → 1.0.0

package/dist/index.js

@@ -237,10 +237,12 @@ import {
   RequestContext as RequestContext2
 } from "@dunx/core";
 import { betterAuth } from "better-auth";
-var build = (options, mountAt) => {
+var build = (options, mountAt, imports) => {
   const auth = Auth;
   return {
     module: AuthModule,
+    ...imports === undefined ? {} : { imports },
+    exports: [AuthOptions, auth, AuthContext, SessionGuard],
     controllers: [mountHandler(mountAt)],
     providers: [
       options,
@@ -276,7 +278,7 @@ class AuthModule {
         return resolved;
       },
       inject: provider.inject ?? []
-    }), mounted);
+    }), mounted, provider.imports);
   }
 }
 // src/redis.ts
@@ -336,5 +338,5 @@ export {
   Auth
 };
 
-//# debugId=C71E69B1B354D64764756E2164756E21
+//# debugId=7A1AF5AF26CBCB1E64756E2164756E21
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -9,11 +9,11 @@
     "import { inject, type Ctor } from '@dunx/core';\nimport {\n  ApiHidden,\n  Controller,\n  Delete,\n  Get,\n  Patch,\n  Post,\n  Public,\n  Put,\n  type Input,\n  type RouteSchemas,\n} from '@dunx/http';\nimport type { BunRequest } from 'bun';\nimport { Auth } from './auth.js';\nimport { AuthError } from './errors.js';\nimport { DEFAULT_BASE_PATH } from './options.js';\n\n/**\n * better-auth's handler is a plain `(request: Request) => Promise<Response>`, so\n * mounting it is five one-line routes and nothing else. Every endpoint the library\n * and its plugins declare lives under one wildcard - dunx does not restate, wrap or\n * re-dispatch a single one of them.\n *\n * `Bun.serve` matches `<basePath>/*` natively (verified on Bun 1.3.14), so Bun is\n * still the router. All five verbs are mounted because a plugin may declare any of\n * them; better-auth's own endpoints are `GET` and `POST`.\n *\n * The `Response` is returned untouched - `buildRoutes` passes one straight through,\n * which is what keeps better-auth's `Set-Cookie` headers and redirects intact.\n *\n * `@Public()` at class scope, so all five inherit it - `mergeMeta` reads the class's\n * record under the handler's. Without it a globally installed `SessionGuard` would\n * demand a session from the sign-in endpoint, and no session could ever be created.\n *\n * `inject(Auth)` in a field rather than a constructor parameter, because a bare\n * class in `controllers` is bound as a class provider and would then need\n * `@dunx/transform`'s transform to have run. This way mounting works in an app that\n * never added the preload.\n */\n@Public()\nexport class AuthHandler {\n  readonly #auth = inject(Auth);\n  #verified = false;\n\n  @Get('/*') get({ req }: Input<RouteSchemas>): Promise<Response> {\n    return this.#dispatch(req);\n  }\n\n  @Post('/*') post({ req }: Input<RouteSchemas>): Promise<Response> {\n    return this.#dispatch(req);\n  }\n\n  @Put('/*') put({ req }: Input<RouteSchemas>): Promise<Response> {\n    return this.#dispatch(req);\n  }\n\n  @Patch('/*') patch({ req }: Input<RouteSchemas>): Promise<Response> {\n    return this.#dispatch(req);\n  }\n\n  @Delete('/*') delete({ req }: Input<RouteSchemas>): Promise<Response> {\n    return this.#dispatch(req);\n  }\n\n  /**\n   * better-auth resolves an endpoint by comparing the whole pathname to its own\n   * `basePath`, so a handler mounted somewhere else answers 404 to everything with no\n   * hint as to why. The final path is only knowable once `listen()` has applied the\n   * global prefix, which is after this module was configured - so it is checked on\n   * the **first** request and never again.\n   */\n  #dispatch(req: BunRequest): Promise<Response> {\n    if (!this.#verified) {\n      this.#verified = true;\n      const basePath = this.#auth.options.basePath ?? DEFAULT_BASE_PATH;\n      const { pathname } = new URL(req.url);\n      if (!pathname.startsWith(`${basePath}/`)) {\n        throw new AuthError(\n          `${pathname} reached the auth handler, but better-auth is configured with ` +\n            `basePath ${basePath} and would answer 404 to everything under it. A ` +\n            'global prefix is the usual cause: mount the handler at the path without ' +\n            'the prefix and give better-auth the full one - see AuthOptions.mountAt.',\n        );\n      }\n    }\n    return this.#auth.handler(req);\n  }\n}\n\n/**\n * The controller `AuthModule` registers, prefixed with `AuthOptions.mountAt`.\n *\n * A subclass rather than `@Controller(...)` on {@link AuthHandler} itself: the prefix\n * is only known once the module is configured, and mutating the shared class from a\n * factory would make two configurations fight over one prefix. The subclass declares\n * nothing of its own and inherits everything - `discoverRoutes` walks the prototype\n * chain for the routes, and `metaOf` and `prefixOf` are plain lookups, so `@Public()`\n * comes down from the base while the prefix stays own to the subclass.\n *\n * `@ApiHidden()` because the mount is a wildcard. The route is real and has to be\n * served, but `*` is not an OpenAPI path template, so documenting it produced an\n * invalid entry tagged with this class's internal name - alongside the paths\n * `betterAuthDocument` describes properly, which is where the auth surface should\n * be read from.\n */\nexport const mountHandler = (mountAt: string): Ctor<AuthHandler> =>\n  ApiHidden()(\n    Controller(mountAt)(class MountedAuthHandler extends AuthHandler {}),\n  );\n",
     "/**\n * better-auth's `emailAndPassword.password`, backed by `Bun.password`.\n *\n * Applied by `AuthModule` whenever `emailAndPassword` is enabled and no `password`\n * of your own is given. better-auth's default is a **pure-JavaScript scrypt**;\n * `Bun.password` is native bcrypt, and the rule is simple - if Bun ships it,\n * use Bun.\n *\n * Bun pre-hashes the input, so bcrypt's 72-byte cap is a non-issue even for a\n * maximum-length multibyte password.\n *\n * `verify` swallows Bun's `UnsupportedAlgorithm` throw, so a hash produced by a\n * *different* algorithm - a scrypt hash written before this was in place - is a\n * clean authentication failure rather than a 500. Those users must reset their\n * password to get a bcrypt hash; pass your own `password` implementation instead\n * if you are migrating an existing user table and cannot.\n */\nexport const bunPassword = {\n  hash: (password: string): Promise<string> =>\n    Bun.password.hash(password, { algorithm: 'bcrypt', cost: 10 }),\n  verify: async ({\n    hash,\n    password,\n  }: {\n    hash: string;\n    password: string;\n  }): Promise<boolean> => {\n    try {\n      return await Bun.password.verify(password, hash);\n    } catch {\n      return false;\n    }\n  },\n};\n",
     "import type { BetterAuthOptions } from 'better-auth';\nimport { AuthError } from './errors.js';\nimport { bunPassword } from './password.js';\n\n/** better-auth's own default, and where `AuthHandler` mounts unless told otherwise. */\nexport const DEFAULT_BASE_PATH = '/api/auth';\n\n/**\n * One leading slash, no trailing one - the shape `@dunx/http`'s route paths take,\n * so the mount and better-auth's own URL building agree character for character.\n *\n * The root is rejected: the mount is `<basePath>/*`, and at `/` that wildcard would\n * claim every path in the app.\n */\nexport const normalizeBasePath = (basePath: string): string => {\n  const normalized = `/${basePath}`.replace(/\\/{2,}/g, '/').replace(/\\/$/, '');\n\n  if (normalized.length < 2) {\n    throw new AuthError(\n      `\"${basePath}\" is not a usable basePath. The handler mounts at ` +\n        '<basePath>/*, so at the root it would claim every route in the app. ' +\n        `Use something like ${DEFAULT_BASE_PATH}.`,\n    );\n  }\n  return normalized;\n};\n\n/**\n * Bun's native bcrypt in place of better-auth's pure-JavaScript scrypt, unless a\n * `password` of your own is already there. See {@link bunPassword} for the\n * migration caveat.\n */\nconst withBunPassword = <O extends BetterAuthOptions>(options: O): O => {\n  const email = options.emailAndPassword;\n  if (!email?.enabled || email.password) return options;\n\n  // The one cast in the package: TypeScript cannot prove a spread of a generic with\n  // one key replaced is still that generic, and widening the return to\n  // `BetterAuthOptions` would lose the plugin types `betterAuth()` infers from it.\n  return {\n    ...options,\n    emailAndPassword: { ...email, password: bunPassword },\n  } as O;\n};\n\n/**\n * What `betterAuth()` gets called with, where the handler mounts, and the difference\n * between the two. Bound in the container so all of it is readable, and constructed\n * by `AuthModule` rather than by the app.\n */\nexport class AuthOptions<O extends BetterAuthOptions = BetterAuthOptions> {\n  readonly options: O;\n\n  /**\n   * What better-auth matches an incoming pathname against, and builds its URLs from.\n   * Normalized here and written back into `options`, so the two cannot drift.\n   */\n  readonly basePath: string;\n\n  /**\n   * The **route** path `AuthHandler` is mounted at, which is `basePath` unless the\n   * app calls `setGlobalPrefix`. better-auth compares the whole pathname to\n   * `basePath`, so with `setGlobalPrefix('api')` the two are different strings for\n   * the same URL: mount at `/auth`, and tell better-auth `basePath: '/api/auth'`.\n   */\n  readonly mountAt: string;\n\n  constructor(init: O, mountAt?: string) {\n    this.basePath = normalizeBasePath(init.basePath ?? DEFAULT_BASE_PATH);\n    this.mountAt =\n      mountAt === undefined ? this.basePath : normalizeBasePath(mountAt);\n    this.options = withBunPassword({ ...init, basePath: this.basePath });\n  }\n}\nObject.defineProperty(AuthOptions, Symbol.for('dunx.deps'), {\n  value: () => [{ unresolved: \"init: O\" }, { unresolved: \"mountAt?: string\" }],\n});\n",
-    "import {\n  provide,\n  type AbstractCtor,\n  type Deps,\n  type DynamicModule,\n  type FactoryProvider,\n  type Registration,\n  RequestContext,\n} from '@dunx/core';\nimport { betterAuth, type BetterAuthOptions } from 'better-auth';\nimport { Auth } from './auth.js';\nimport { AuthContext } from './context.js';\nimport { AuthError } from './errors.js';\nimport { SessionGuard } from './guard.js';\nimport { mountHandler } from './handler.js';\nimport {\n  AuthOptions,\n  DEFAULT_BASE_PATH,\n  normalizeBasePath,\n} from './options.js';\n\nconst build = (options: Registration, mountAt: string): DynamicModule => {\n  // Instantiated to the token type rather than left as `typeof Auth`, which is what\n  // lets the factory below hand back a plain better-auth instance with no cast.\n  const auth: AbstractCtor<Auth> = Auth;\n\n  return {\n    module: AuthModule,\n    controllers: [mountHandler(mountAt)],\n    // Every binding declares its own `inject`, so nothing here needs\n    // `@dunx/transform`'s transform to have run - the same reason\n    // `RequestLoggingMiddleware` and `@dunx/infra/redis`'s `Redis` are bound this way.\n    providers: [\n      options,\n      provide(auth, {\n        useFactory: (resolved: AuthOptions) => betterAuth(resolved.options),\n        inject: [AuthOptions] as const,\n      }),\n      provide(AuthContext, {\n        useFactory: (context: RequestContext) => new AuthContext(context),\n        inject: [RequestContext] as const,\n      }),\n      provide(SessionGuard, {\n        useFactory: (instance: Auth, context: AuthContext) =>\n          new SessionGuard(instance, context),\n        inject: [auth, AuthContext] as const,\n      }),\n    ],\n  };\n};\n\n/**\n * Binds three tokens and one controller:\n *\n * - `AuthOptions` - what `betterAuth()` was called with, and where it is mounted.\n * - `Auth` - the better-auth instance itself.\n * - `AuthContext` - the authenticated caller, per request.\n * - a prefixed `AuthHandler`, serving every better-auth endpoint under `basePath`.\n *\n * `SessionGuard` is registered as a provider rather than installed as global\n * middleware, because whether it guards the whole app or one controller is the app's\n * decision - pass it to `HttpFactory.create(root, { middleware: [SessionGuard] })`\n * or to `@UseGuards(SessionGuard)`.\n */\nexport class AuthModule {\n  /**\n   * ```ts\n   * AuthModule.forRoot({\n   *   secret: process.env.BETTER_AUTH_SECRET,\n   *   baseURL: 'http://localhost:3000',\n   *   database: drizzleDatabase(connection),\n   *   emailAndPassword: { enabled: true },\n   *   plugins: [admin(), bearer()],\n   * });\n   * ```\n   *\n   * `const O` is load-bearing: it keeps the literal `plugins` tuple, which is what\n   * `betterAuth()` infers the plugin endpoints from - and therefore what\n   * `Auth<typeof options>` resolves to at an injection site.\n   *\n   * `mountAt` only matters under a global prefix - see {@link AuthOptions.mountAt}.\n   */\n  static forRoot<const O extends BetterAuthOptions>(\n    options: O,\n    mountAt?: string,\n  ): DynamicModule {\n    const resolved = new AuthOptions(options, mountAt);\n    return build(\n      provide(AuthOptions, { useValue: resolved }),\n      resolved.mountAt,\n    );\n  }\n\n  /**\n   * `forRoot` with the options behind a factory that may await and may inject -\n   * which is the only way the secret, the base URL and the database can come from\n   * `ConfigService` rather than from module scope:\n   *\n   * ```ts\n   * AuthModule.forRootAsync({\n   *   useFactory: (config: AppConfigService, connection: DbConnection) => ({\n   *     secret: config.get('authSecret'),\n   *     baseURL: config.get('appUrl'),\n   *     database: drizzleDatabase(connection),\n   *     emailAndPassword: { enabled: true },\n   *   }),\n   *   inject: [AppConfigService, DbConnection],\n   * });\n   * ```\n   *\n   * `mountAt` is a second, **synchronous** argument for the same reason\n   * `DbModule.forRootAsync` takes its token positionally: the mount is a route in\n   * Bun's table, and that table is built before any factory has run. It is only\n   * needed under a global prefix - see {@link AuthOptions.mountAt}. Omitting it while\n   * the factory returns a non-default `basePath` is a boot error, because that\n   * combination could only ever have mounted the handler where better-auth is not\n   * looking.\n   */\n  static forRootAsync<const D extends Deps>(\n    provider: FactoryProvider<BetterAuthOptions, D>,\n    mountAt?: string,\n  ): DynamicModule;\n  static forRootAsync(\n    provider: FactoryProvider<BetterAuthOptions, Deps>,\n    mountAt?: string,\n  ): DynamicModule {\n    const mounted = normalizeBasePath(mountAt ?? DEFAULT_BASE_PATH);\n\n    return build(\n      provide(AuthOptions, {\n        useFactory: async (\n          ...deps: readonly unknown[]\n        ): Promise<AuthOptions> => {\n          const resolved = new AuthOptions(\n            await provider.useFactory(...deps),\n            mounted,\n          );\n          if (mountAt === undefined && resolved.basePath !== mounted) {\n            throw new AuthError(\n              `The factory returned basePath ${resolved.basePath}, but the handler ` +\n                `is mounted at ${mounted} - the table was built before the factory ` +\n                'ran, so it could not follow. Pass the route path as ' +\n                \"forRootAsync's second argument.\",\n            );\n          }\n          return resolved;\n        },\n        inject: provider.inject ?? [],\n      }),\n      mounted,\n    );\n  }\n}\n",
+    "import {\n  provide,\n  type AbstractCtor,\n  type Deps,\n  type DynamicModule,\n  type AsyncModuleConfig,\n  type ModuleRef,\n  type Registration,\n  RequestContext,\n} from '@dunx/core';\nimport { betterAuth, type BetterAuthOptions } from 'better-auth';\nimport { Auth } from './auth.js';\nimport { AuthContext } from './context.js';\nimport { AuthError } from './errors.js';\nimport { SessionGuard } from './guard.js';\nimport { mountHandler } from './handler.js';\nimport {\n  AuthOptions,\n  DEFAULT_BASE_PATH,\n  normalizeBasePath,\n} from './options.js';\n\nconst build = (\n  options: Registration,\n  mountAt: string,\n  imports?: readonly ModuleRef[],\n): DynamicModule => {\n  // Instantiated to the token type rather than left as `typeof Auth`, which is what\n  // lets the factory below hand back a plain better-auth instance with no cast.\n  const auth: AbstractCtor<Auth> = Auth;\n\n  return {\n    module: AuthModule,\n    ...(imports === undefined ? {} : { imports }),\n    /**\n     * The public surface. `AuthOptions` is how an app reports where the handler is\n     * mounted, `Auth` is better-auth itself, `AuthContext` is the caller per request\n     * and `SessionGuard` is what an app lists in its middleware or `@UseGuards`.\n     */\n    exports: [AuthOptions, auth, AuthContext, SessionGuard],\n    controllers: [mountHandler(mountAt)],\n    // Every binding declares its own `inject`, so nothing here needs\n    // `@dunx/transform`'s transform to have run - the same reason\n    // `RequestLoggingMiddleware` and `@dunx/infra/redis`'s `Redis` are bound this way.\n    providers: [\n      options,\n      provide(auth, {\n        useFactory: (resolved: AuthOptions) => betterAuth(resolved.options),\n        inject: [AuthOptions] as const,\n      }),\n      provide(AuthContext, {\n        useFactory: (context: RequestContext) => new AuthContext(context),\n        inject: [RequestContext] as const,\n      }),\n      provide(SessionGuard, {\n        useFactory: (instance: Auth, context: AuthContext) =>\n          new SessionGuard(instance, context),\n        inject: [auth, AuthContext] as const,\n      }),\n    ],\n  };\n};\n\n/**\n * Binds three tokens and one controller:\n *\n * - `AuthOptions` - what `betterAuth()` was called with, and where it is mounted.\n * - `Auth` - the better-auth instance itself.\n * - `AuthContext` - the authenticated caller, per request.\n * - a prefixed `AuthHandler`, serving every better-auth endpoint under `basePath`.\n *\n * `SessionGuard` is registered as a provider rather than installed as global\n * middleware, because whether it guards the whole app or one controller is the app's\n * decision - pass it to `HttpFactory.create(root, { middleware: [SessionGuard] })`\n * or to `@UseGuards(SessionGuard)`.\n */\nexport class AuthModule {\n  /**\n   * ```ts\n   * AuthModule.forRoot({\n   *   secret: process.env.BETTER_AUTH_SECRET,\n   *   baseURL: 'http://localhost:3000',\n   *   database: drizzleDatabase(connection),\n   *   emailAndPassword: { enabled: true },\n   *   plugins: [admin(), bearer()],\n   * });\n   * ```\n   *\n   * `const O` is load-bearing: it keeps the literal `plugins` tuple, which is what\n   * `betterAuth()` infers the plugin endpoints from - and therefore what\n   * `Auth<typeof options>` resolves to at an injection site.\n   *\n   * `mountAt` only matters under a global prefix - see {@link AuthOptions.mountAt}.\n   */\n  static forRoot<const O extends BetterAuthOptions>(\n    options: O,\n    mountAt?: string,\n  ): DynamicModule {\n    const resolved = new AuthOptions(options, mountAt);\n    return build(\n      provide(AuthOptions, { useValue: resolved }),\n      resolved.mountAt,\n    );\n  }\n\n  /**\n   * `forRoot` with the options behind a factory that may await and may inject -\n   * which is the only way the secret, the base URL and the database can come from\n   * `ConfigService` rather than from module scope:\n   *\n   * ```ts\n   * AuthModule.forRootAsync({\n   *   useFactory: (config: AppConfigService, connection: DbConnection) => ({\n   *     secret: config.get('authSecret'),\n   *     baseURL: config.get('appUrl'),\n   *     database: drizzleDatabase(connection),\n   *     emailAndPassword: { enabled: true },\n   *   }),\n   *   inject: [AppConfigService, DbConnection],\n   * });\n   * ```\n   *\n   * `mountAt` is a second, **synchronous** argument for the same reason\n   * `DbModule.forRootAsync` takes its token positionally: the mount is a route in\n   * Bun's table, and that table is built before any factory has run. It is only\n   * needed under a global prefix - see {@link AuthOptions.mountAt}. Omitting it while\n   * the factory returns a non-default `basePath` is a boot error, because that\n   * combination could only ever have mounted the handler where better-auth is not\n   * looking.\n   */\n  static forRootAsync<const D extends Deps>(\n    provider: AsyncModuleConfig<BetterAuthOptions, D>,\n    mountAt?: string,\n  ): DynamicModule;\n  static forRootAsync(\n    provider: AsyncModuleConfig<BetterAuthOptions, Deps>,\n    mountAt?: string,\n  ): DynamicModule {\n    const mounted = normalizeBasePath(mountAt ?? DEFAULT_BASE_PATH);\n\n    return build(\n      provide(AuthOptions, {\n        useFactory: async (\n          ...deps: readonly unknown[]\n        ): Promise<AuthOptions> => {\n          const resolved = new AuthOptions(\n            await provider.useFactory(...deps),\n            mounted,\n          );\n          if (mountAt === undefined && resolved.basePath !== mounted) {\n            throw new AuthError(\n              `The factory returned basePath ${resolved.basePath}, but the handler ` +\n                `is mounted at ${mounted} - the table was built before the factory ` +\n                'ran, so it could not follow. Pass the route path as ' +\n                \"forRootAsync's second argument.\",\n            );\n          }\n          return resolved;\n        },\n        inject: provider.inject ?? [],\n      }),\n      mounted,\n      provider.imports,\n    );\n  }\n}\n",
     "import type { BetterAuthOptions } from 'better-auth';\n\ntype SecondaryStorage = NonNullable<BetterAuthOptions['secondaryStorage']>;\n\n/**\n * The six commands this needs, restated rather than imported from\n * `@dunx/infra/redis` - same reasoning as {@link DrizzleSource}. A `RedisConnection`\n * satisfies it structurally (its parameters are wider, which is the assignable\n * direction), and a test double is six methods instead of the whole surface.\n */\nexport interface RedisStore {\n  get(key: string): Promise<string | null>;\n  getdel(key: string): Promise<string | null>;\n  incr(key: string): Promise<number>;\n  expire(key: string, seconds: number): Promise<boolean>;\n  set(\n    key: string,\n    value: string,\n    options?: { readonly ex?: number },\n  ): Promise<string | null>;\n  del(key: string): Promise<number>;\n}\n\n/**\n * better-auth's `secondaryStorage` over `Bun.RedisClient`, so sessions, verification\n * values and rate-limit counters live in Redis instead of costing a database round\n * trip on every request.\n *\n * All five methods are implemented, not the three that are mandatory.\n * `getAndDelete` and `increment` are optional in better-auth's interface because most\n * clients cannot do them atomically - `Bun.RedisClient` can, through `GETDEL` and\n * `INCR`, both already on `@dunx/infra/redis`'s contract. Without them better-auth\n * falls back to read-then-delete for single-use credentials, which is a race, and to\n * a non-atomic rate-limit counter.\n *\n * `increment`'s TTL applies on creation only, which is what makes the counter expire\n * a fixed window after the first hit rather than sliding forever: `INCR` returning\n * `1` is the signal that this call created the key.\n *\n * Redis being unreachable is deliberately **not** softened here. Bun's client\n * connects lazily and queues, so a command against a down server rejects and\n * better-auth's own error path is what should see it - a swallowed `null` from `get`\n * would read as \"no session\" and sign every user out.\n */\nexport const redisStorage = (connection: RedisStore): SecondaryStorage => ({\n  get: (key) => connection.get(key),\n  getAndDelete: (key) => connection.getdel(key),\n  increment: async (key, ttl) => {\n    const value = await connection.incr(key);\n    if (value === 1) await connection.expire(key, ttl);\n    return value;\n  },\n  set: (key, value, ttl) =>\n    connection.set(key, value, ttl === undefined ? {} : { ex: ttl }),\n  delete: async (key) => {\n    await connection.del(key);\n  },\n});\n",
     "import { normalizeBasePath } from './options.js';\n\n/**\n * The shape `@dunx/openapi` accepts as a contribution. Restated here rather than\n * imported, for the same reason `DrizzleSource` restates `DbConnection`:\n * `@dunx/auth` must not depend on `@dunx/openapi`. An app that documents nothing\n * still uses this package, and an app that never mounts auth still uses that one.\n */\nexport interface AuthDocumentFragment {\n  readonly paths: Readonly<Record<string, Record<string, unknown>>>;\n  readonly schemas: Readonly<Record<string, unknown>>;\n  readonly tags: readonly {\n    readonly name: string;\n    readonly description?: string;\n  }[];\n}\n\n/**\n * Just enough of a Better Auth instance to ask it for its schema.\n *\n * `api` is `object` with the method optional on top, rather than an interface\n * whose only member is optional. Every-property-optional triggers TypeScript's\n * weak-type check, which rejects any argument sharing no property with it - so an\n * instance built without the `openAPI()` plugin failed to compile, and the doc\n * below promising it \"contributes nothing rather than throwing\" described a path\n * that could not be written.\n */\nexport interface OpenApiCapableAuth {\n  readonly api: object & {\n    generateOpenAPISchema?: () => Promise<unknown>;\n  };\n}\n\nexport interface AuthDocumentOptions {\n  /**\n   * Where the handler is mounted. Matches `AuthOptions.basePath`, including the\n   * global prefix if there is one: these paths go into the document as-is and\n   * are not moved again by `setGlobalPrefix()`.\n   */\n  readonly basePath: string;\n  /** Tag every contributed operation carries. Default `auth`. */\n  readonly tag?: string;\n}\n\nconst METHODS = ['get', 'post', 'put', 'patch', 'delete', 'options', 'head'];\n\ninterface RawSchema {\n  paths?: Record<string, Record<string, unknown>>;\n  components?: { schemas?: Record<string, unknown> };\n}\n\n/**\n * Better Auth's own endpoints, as a contribution to the app's OpenAPI document.\n *\n * Better Auth serves `<basePath>/*` from its own handler rather than from dunx\n * controllers, so route discovery cannot see any of it and the document would\n * describe an API missing its entire authentication surface. This asks the\n * library for its schema and hands it over:\n *\n * **`forRootAsync`, not `forRoot`.** `forRoot` is evaluated while the module graph\n * is being described, before there is a container, so there is nowhere for the\n * `Auth` instance to come from. The async pair injects it:\n *\n * ```ts\n * OpenApiModule.forRootAsync({\n *   root: AppModule,\n *   useFactory: (auth: Auth) => ({\n *     title: 'API',\n *     version: '1.0.0',\n *     contribute: [betterAuthDocument(auth, { basePath: '/api/auth' })],\n *   }),\n *   inject: [Auth],\n * });\n * ```\n *\n * Building a second `betterAuth()` purely to generate the schema is the workaround\n * this replaces, and it is not needed.\n *\n * **Better Auth only generates a schema when the `openAPI()` plugin is enabled.**\n * Without it `generateOpenAPISchema` is absent and this contributes nothing rather\n * than throwing, because a missing plugin should cost documentation and not boot.\n * Pass `openAPI({ disableDefaultReference: true })` if you want the schema without\n * Better Auth also mounting its own reference page next to the dunx one.\n *\n * Paths are rewritten to sit under `basePath`, since the library reports them\n * relative to its own mount.\n */\nexport const betterAuthDocument =\n  (auth: OpenApiCapableAuth, options: AuthDocumentOptions) =>\n  async (): Promise<AuthDocumentFragment> => {\n    const empty: AuthDocumentFragment = { paths: {}, schemas: {}, tags: [] };\n    if (typeof auth.api.generateOpenAPISchema !== 'function') return empty;\n\n    const raw = (await auth.api.generateOpenAPISchema()) as RawSchema;\n    const prefix = normalizeBasePath(options.basePath);\n    const tag = options.tag ?? 'auth';\n\n    const paths: Record<string, Record<string, unknown>> = {};\n    for (const [path, item] of Object.entries(raw.paths ?? {})) {\n      // Tagged so the explorer groups them, instead of scattering a dozen auth\n      // endpoints through the rest of the API.\n      for (const method of METHODS) {\n        const operation = item[method];\n        if (operation && typeof operation === 'object') {\n          (operation as { tags?: string[] }).tags = [tag];\n        }\n      }\n      paths[path.startsWith(prefix) ? path : `${prefix}${path}`] = item;\n    }\n\n    return {\n      paths,\n      schemas: raw.components?.schemas ?? {},\n      tags: [{ name: tag, description: 'Served by Better Auth' }],\n    };\n  };\n"
   ],
-  "mappings": ";;;;;;;;;;;;;AAAA;AAAA;AAMO,MAAM,kBAAkB,SAAS;AAAA,EAC7B,OAAO;AAClB;;;ACYO,MAAe,KAAsD;AAAA,EAO1E,WAAW,GAAG;AAAA,IACZ,IAAI,eAAe,MAAM;AAAA,MACvB,MAAM,IAAI,UACR,8DACE,yEACJ;AAAA,IACF;AAAA;AAYJ;;AC7CA;AACA;AACA;AAAA;AAqBO,MAAM,YAAY;AAAA,EAGM;AAAA,EAFpB,WAAW,IAAI;AAAA,EAExB,WAAW,CAAkB,SAAyB;AAAA,IAAzB;AAAA;AAAA,EAW7B,OAAwD,GAE1C;AAAA,IACZ,OAAO,KAAK,SAAS,SAAS;AAAA;AAAA,EAIhC,OAAwD,GAAiB;AAAA,IACvE,MAAM,YAAY,KAAK,QAAW;AAAA,IAClC,IAAI,CAAC,WAAW;AAAA,MACd,MAAM,IAAI,UAAU,eAAe,cAAc,iBAAiB;AAAA,IACpE;AAAA,IACA,OAAO;AAAA;AAAA,EAUT,GAAM,CAAC,WAAsB,UAAsB;AAAA,IACjD,KAAK,QAAQ,cAAc,EAAE,QAAQ,UAAU,KAAK,GAAG,CAAC;AAAA,IACxD,OAAO,KAAK,SAAS,IAAI,WAAW,QAAQ;AAAA;AAEhD;AACA,OAAO,eAAe,aAAa,OAAO,IAAI,WAAW,GAAG;AAAA,EAC1D,OAAO,MAAM,CAAC,cAAc;AAC9B,CAAC;;AClED;AAAA,eACE;AAAA,oBACA;AAAA;AAAA;AAAA;AAqBK,IAAM,UAAU,CAAC,SAAoC;AAAA,EAC1D,MAAM,OAAQ,KAAe;AAAA,EAE7B,IAAI,OAAO,SAAS,UAAU;AAAA,IAC5B,OAAO,KACJ,MAAM,GAAG,EACT,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAC3B,OAAO,CAAC,UAAU,MAAM,SAAS,CAAC;AAAA,EACvC;AAAA,EACA,IAAI,MAAM,QAAQ,IAAI,GAAG;AAAA,IACvB,OAAO,KAAK,OAAO,CAAC,UAA2B,OAAO,UAAU,QAAQ;AAAA,EAC1E;AAAA,EACA,OAAO,CAAC;AAAA;AAAA;AAmBH,MAAM,aAAmC;AAAA,EAE3B;AAAA,EACA;AAAA,EAFnB,WAAW,CACQ,MACA,SACjB;AAAA,IAFiB;AAAA,IACA;AAAA;AAAA,OAGb,OAAM,CACV,KACA,KACA,MACmB;AAAA,IACnB,IAAI,IAAI,IAAI,MAAM;AAAA,MAAG,OAAO,KAAK;AAAA,IAEjC,MAAM,YAA8B,MAAM,KAAK,KAAK,IAAI,WAAW;AAAA,MACjE,SAAS,IAAI;AAAA,IACf,CAAC;AAAA,IACD,IAAI,CAAC,WAAW;AAAA,MACd,MAAM,IAAI,WAAU,gBAAe,cAAc,iBAAiB;AAAA,IACpE;AAAA,IAEA,MAAM,WAAW,IAAI,IAAI,KAAK;AAAA,IAC9B,IAAI,aAAa,aAAa,SAAS,SAAS,GAAG;AAAA,MACjD,MAAM,OAAO,QAAQ,UAAU,IAAI;AAAA,MACnC,IAAI,CAAC,SAAS,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,GAAG;AAAA,QACjD,MAAM,IAAI,WACR,gBAAe,WACf,oBAAoB,SAAS,KAAK,IAAI,GACxC;AAAA,MACF;AAAA,IACF;AAAA,IAEA,OAAO,KAAK,QAAQ,IAAI,WAAW,IAAI;AAAA;AAE3C;AACA,OAAO,eAAe,cAAc,OAAO,IAAI,WAAW,GAAG;AAAA,EAC3D,OAAO,MAAM,CAAC,MAAM,WAAW;AACjC,CAAC;;AC1FD;AACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACgBO,IAAM,cAAc;AAAA,EACzB,MAAM,CAAC,aACL,IAAI,SAAS,KAAK,UAAU,EAAE,WAAW,UAAU,MAAM,GAAG,CAAC;AAAA,EAC/D,QAAQ;AAAA,IACN;AAAA,IACA;AAAA,QAIsB;AAAA,IACtB,IAAI;AAAA,MACF,OAAO,MAAM,IAAI,SAAS,OAAO,UAAU,IAAI;AAAA,MAC/C,MAAM;AAAA,MACN,OAAO;AAAA;AAAA;AAGb;;;AC5BO,IAAM,oBAAoB;AAS1B,IAAM,oBAAoB,CAAC,aAA6B;AAAA,EAC7D,MAAM,aAAa,IAAI,WAAW,QAAQ,WAAW,GAAG,EAAE,QAAQ,OAAO,EAAE;AAAA,EAE3E,IAAI,WAAW,SAAS,GAAG;AAAA,IACzB,MAAM,IAAI,UACR,IAAI,+DACF,yEACA,sBAAsB,oBAC1B;AAAA,EACF;AAAA,EACA,OAAO;AAAA;AAQT,IAAM,kBAAkB,CAA8B,YAAkB;AAAA,EACtE,MAAM,QAAQ,QAAQ;AAAA,EACtB,IAAI,CAAC,OAAO,WAAW,MAAM;AAAA,IAAU,OAAO;AAAA,EAK9C,OAAO;AAAA,OACF;AAAA,IACH,kBAAkB,KAAK,OAAO,UAAU,YAAY;AAAA,EACtD;AAAA;AAAA;AAQK,MAAM,YAA6D;AAAA,EAC/D;AAAA,EAMA;AAAA,EAQA;AAAA,EAET,WAAW,CAAC,MAAS,SAAkB;AAAA,IACrC,KAAK,WAAW,kBAAkB,KAAK,YAAY,iBAAiB;AAAA,IACpE,KAAK,UACH,YAAY,YAAY,KAAK,WAAW,kBAAkB,OAAO;AAAA,IACnE,KAAK,UAAU,gBAAgB,KAAK,MAAM,UAAU,KAAK,SAAS,CAAC;AAAA;AAEvE;AACA,OAAO,eAAe,aAAa,OAAO,IAAI,WAAW,GAAG;AAAA,EAC1D,OAAO,MAAM,CAAC,EAAE,YAAY,UAAU,GAAG,EAAE,YAAY,mBAAmB,CAAC;AAC7E,CAAC;;;AFnCM;AAAA,EADN,OAAO;AAAA;AACD;AAAA,EAIJ,IAAI,IAAI;AAAA;AAJJ;AAAA,EAQJ,KAAK,IAAI;AAAA;AARL;AAAA,EAYJ,IAAI,IAAI;AAAA;AAZJ;AAAA,EAgBJ,MAAM,IAAI;AAAA;AAhBN;AAAA,EAoBJ,OAAO,IAAI;AAAA;AApBP;AAAA;AAAA;AAAA,eA+BI,SAAC,KAAoC;AAAA,EAC5C,IAAI,CAAC,+BAAgB;AAAA,IACnB,8BAAiB;AAAA,IACjB,MAAM,WAAW,0BAAW,QAAQ,YAAY;AAAA,IAChD,QAAQ,aAAa,IAAI,IAAI,IAAI,GAAG;AAAA,IACpC,IAAI,CAAC,SAAS,WAAW,GAAG,WAAW,GAAG;AAAA,MACxC,MAAM,IAAI,UACR,GAAG,2EACD,YAAY,6DACZ,6EACA,yEACJ;AAAA,IACF;AAAA,EACF;AAAA,EACA,OAAO,0BAAW,QAAQ,GAAG;AAAA;AA7C1B;AAAA;AAAA,MAAM,YAAY;AAAA,EAAlB;AAAA,8BACY,OAAO,IAAI;AAAA,IADvB,8BAEO;AAAA,IAFP;AAAA;AAAA;AAAA,EAIM,GAAG,GAAG,OAA+C;AAAA,IAC9D,OAAO,0DAAe,GAAG;AAAA;AAAA,EAGf,IAAI,GAAG,OAA+C;AAAA,IAChE,OAAO,0DAAe,GAAG;AAAA;AAAA,EAGhB,GAAG,GAAG,OAA+C;AAAA,IAC9D,OAAO,0DAAe,GAAG;AAAA;AAAA,EAGd,KAAK,GAAG,OAA+C;AAAA,IAClE,OAAO,0DAAe,GAAG;AAAA;AAAA,EAGb,MAAM,GAAG,OAA+C;AAAA,IACpE,OAAO,0DAAe,GAAG;AAAA;AA0B7B;AA/CO,4BAIM,OAJN,OAAM;AAAN,4BAQO,QARP,OAAM;AAAN,4BAYM,OAZN,OAAM;AAAN,4BAgBQ,SAhBR,OAAM;AAAN,4BAoBS,UApBT,OAAM;AAAA,cAAN,iDAAM;AAAN,4BAAM;AAAN,2BAAM;AAAN,mBAAM;AAiEN,IAAM,eAAe,CAAC,YAC3B,UAAU,EACR,WAAW,OAAO,EAAE,MAAM,2BAA2B,YAAY;AAAC,CAAC,CACrE;;AG7GF;AAAA;AAAA,oBAOE;AAAA;AAEF;AAYA,IAAM,QAAQ,CAAC,SAAuB,YAAmC;AAAA,EAGvE,MAAM,OAA2B;AAAA,EAEjC,OAAO;AAAA,IACL,QAAQ;AAAA,IACR,aAAa,CAAC,aAAa,OAAO,CAAC;AAAA,IAInC,WAAW;AAAA,MACT;AAAA,MACA,QAAQ,MAAM;AAAA,QACZ,YAAY,CAAC,aAA0B,WAAW,SAAS,OAAO;AAAA,QAClE,QAAQ,CAAC,WAAW;AAAA,MACtB,CAAC;AAAA,MACD,QAAQ,aAAa;AAAA,QACnB,YAAY,CAAC,YAA4B,IAAI,YAAY,OAAO;AAAA,QAChE,QAAQ,CAAC,eAAc;AAAA,MACzB,CAAC;AAAA,MACD,QAAQ,cAAc;AAAA,QACpB,YAAY,CAAC,UAAgB,YAC3B,IAAI,aAAa,UAAU,OAAO;AAAA,QACpC,QAAQ,CAAC,MAAM,WAAW;AAAA,MAC5B,CAAC;AAAA,IACH;AAAA,EACF;AAAA;AAAA;AAgBK,MAAM,WAAW;AAAA,SAkBf,OAA0C,CAC/C,SACA,SACe;AAAA,IACf,MAAM,WAAW,IAAI,YAAY,SAAS,OAAO;AAAA,IACjD,OAAO,MACL,QAAQ,aAAa,EAAE,UAAU,SAAS,CAAC,GAC3C,SAAS,OACX;AAAA;AAAA,SAgCK,YAAY,CACjB,UACA,SACe;AAAA,IACf,MAAM,UAAU,kBAAkB,WAAW,iBAAiB;AAAA,IAE9D,OAAO,MACL,QAAQ,aAAa;AAAA,MACnB,YAAY,UACP,SACsB;AAAA,QACzB,MAAM,WAAW,IAAI,YACnB,MAAM,SAAS,WAAW,GAAG,IAAI,GACjC,OACF;AAAA,QACA,IAAI,YAAY,aAAa,SAAS,aAAa,SAAS;AAAA,UAC1D,MAAM,IAAI,UACR,iCAAiC,SAAS,+BACxC,iBAAiB,sDACjB,yDACA,iCACJ;AAAA,QACF;AAAA,QACA,OAAO;AAAA;AAAA,MAET,QAAQ,SAAS,UAAU,CAAC;AAAA,IAC9B,CAAC,GACD,OACF;AAAA;AAEJ;;AC5GO,IAAM,eAAe,CAAC,gBAA8C;AAAA,EACzE,KAAK,CAAC,QAAQ,WAAW,IAAI,GAAG;AAAA,EAChC,cAAc,CAAC,QAAQ,WAAW,OAAO,GAAG;AAAA,EAC5C,WAAW,OAAO,KAAK,QAAQ;AAAA,IAC7B,MAAM,QAAQ,MAAM,WAAW,KAAK,GAAG;AAAA,IACvC,IAAI,UAAU;AAAA,MAAG,MAAM,WAAW,OAAO,KAAK,GAAG;AAAA,IACjD,OAAO;AAAA;AAAA,EAET,KAAK,CAAC,KAAK,OAAO,QAChB,WAAW,IAAI,KAAK,OAAO,QAAQ,YAAY,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;AAAA,EACjE,QAAQ,OAAO,QAAQ;AAAA,IACrB,MAAM,WAAW,IAAI,GAAG;AAAA;AAE5B;;ACbA,IAAM,UAAU,CAAC,OAAO,QAAQ,OAAO,SAAS,UAAU,WAAW,MAAM;AA2CpE,IAAM,qBACX,CAAC,MAA0B,YAC3B,YAA2C;AAAA,EACzC,MAAM,QAA8B,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,GAAG,MAAM,CAAC,EAAE;AAAA,EACvE,IAAI,OAAO,KAAK,IAAI,0BAA0B;AAAA,IAAY,OAAO;AAAA,EAEjE,MAAM,MAAO,MAAM,KAAK,IAAI,sBAAsB;AAAA,EAClD,MAAM,SAAS,kBAAkB,QAAQ,QAAQ;AAAA,EACjD,MAAM,MAAM,QAAQ,OAAO;AAAA,EAE3B,MAAM,QAAiD,CAAC;AAAA,EACxD,YAAY,MAAM,SAAS,OAAO,QAAQ,IAAI,SAAS,CAAC,CAAC,GAAG;AAAA,IAG1D,WAAW,UAAU,SAAS;AAAA,MAC5B,MAAM,YAAY,KAAK;AAAA,MACvB,IAAI,aAAa,OAAO,cAAc,UAAU;AAAA,QAC7C,UAAkC,OAAO,CAAC,GAAG;AAAA,MAChD;AAAA,IACF;AAAA,IACA,MAAM,KAAK,WAAW,MAAM,IAAI,OAAO,GAAG,SAAS,UAAU;AAAA,EAC/D;AAAA,EAEA,OAAO;AAAA,IACL;AAAA,IACA,SAAS,IAAI,YAAY,WAAW,CAAC;AAAA,IACrC,MAAM,CAAC,EAAE,MAAM,KAAK,aAAa,wBAAwB,CAAC;AAAA,EAC5D;AAAA;",
-  "debugId": "C71E69B1B354D64764756E2164756E21",
+  "mappings": ";;;;;;;;;;;;;AAAA;AAAA;AAMO,MAAM,kBAAkB,SAAS;AAAA,EAC7B,OAAO;AAClB;;;ACYO,MAAe,KAAsD;AAAA,EAO1E,WAAW,GAAG;AAAA,IACZ,IAAI,eAAe,MAAM;AAAA,MACvB,MAAM,IAAI,UACR,8DACE,yEACJ;AAAA,IACF;AAAA;AAYJ;;AC7CA;AACA;AACA;AAAA;AAqBO,MAAM,YAAY;AAAA,EAGM;AAAA,EAFpB,WAAW,IAAI;AAAA,EAExB,WAAW,CAAkB,SAAyB;AAAA,IAAzB;AAAA;AAAA,EAW7B,OAAwD,GAE1C;AAAA,IACZ,OAAO,KAAK,SAAS,SAAS;AAAA;AAAA,EAIhC,OAAwD,GAAiB;AAAA,IACvE,MAAM,YAAY,KAAK,QAAW;AAAA,IAClC,IAAI,CAAC,WAAW;AAAA,MACd,MAAM,IAAI,UAAU,eAAe,cAAc,iBAAiB;AAAA,IACpE;AAAA,IACA,OAAO;AAAA;AAAA,EAUT,GAAM,CAAC,WAAsB,UAAsB;AAAA,IACjD,KAAK,QAAQ,cAAc,EAAE,QAAQ,UAAU,KAAK,GAAG,CAAC;AAAA,IACxD,OAAO,KAAK,SAAS,IAAI,WAAW,QAAQ;AAAA;AAEhD;AACA,OAAO,eAAe,aAAa,OAAO,IAAI,WAAW,GAAG;AAAA,EAC1D,OAAO,MAAM,CAAC,cAAc;AAC9B,CAAC;;AClED;AAAA,eACE;AAAA,oBACA;AAAA;AAAA;AAAA;AAqBK,IAAM,UAAU,CAAC,SAAoC;AAAA,EAC1D,MAAM,OAAQ,KAAe;AAAA,EAE7B,IAAI,OAAO,SAAS,UAAU;AAAA,IAC5B,OAAO,KACJ,MAAM,GAAG,EACT,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAC3B,OAAO,CAAC,UAAU,MAAM,SAAS,CAAC;AAAA,EACvC;AAAA,EACA,IAAI,MAAM,QAAQ,IAAI,GAAG;AAAA,IACvB,OAAO,KAAK,OAAO,CAAC,UAA2B,OAAO,UAAU,QAAQ;AAAA,EAC1E;AAAA,EACA,OAAO,CAAC;AAAA;AAAA;AAmBH,MAAM,aAAmC;AAAA,EAE3B;AAAA,EACA;AAAA,EAFnB,WAAW,CACQ,MACA,SACjB;AAAA,IAFiB;AAAA,IACA;AAAA;AAAA,OAGb,OAAM,CACV,KACA,KACA,MACmB;AAAA,IACnB,IAAI,IAAI,IAAI,MAAM;AAAA,MAAG,OAAO,KAAK;AAAA,IAEjC,MAAM,YAA8B,MAAM,KAAK,KAAK,IAAI,WAAW;AAAA,MACjE,SAAS,IAAI;AAAA,IACf,CAAC;AAAA,IACD,IAAI,CAAC,WAAW;AAAA,MACd,MAAM,IAAI,WAAU,gBAAe,cAAc,iBAAiB;AAAA,IACpE;AAAA,IAEA,MAAM,WAAW,IAAI,IAAI,KAAK;AAAA,IAC9B,IAAI,aAAa,aAAa,SAAS,SAAS,GAAG;AAAA,MACjD,MAAM,OAAO,QAAQ,UAAU,IAAI;AAAA,MACnC,IAAI,CAAC,SAAS,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,GAAG;AAAA,QACjD,MAAM,IAAI,WACR,gBAAe,WACf,oBAAoB,SAAS,KAAK,IAAI,GACxC;AAAA,MACF;AAAA,IACF;AAAA,IAEA,OAAO,KAAK,QAAQ,IAAI,WAAW,IAAI;AAAA;AAE3C;AACA,OAAO,eAAe,cAAc,OAAO,IAAI,WAAW,GAAG;AAAA,EAC3D,OAAO,MAAM,CAAC,MAAM,WAAW;AACjC,CAAC;;AC1FD;AACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACgBO,IAAM,cAAc;AAAA,EACzB,MAAM,CAAC,aACL,IAAI,SAAS,KAAK,UAAU,EAAE,WAAW,UAAU,MAAM,GAAG,CAAC;AAAA,EAC/D,QAAQ;AAAA,IACN;AAAA,IACA;AAAA,QAIsB;AAAA,IACtB,IAAI;AAAA,MACF,OAAO,MAAM,IAAI,SAAS,OAAO,UAAU,IAAI;AAAA,MAC/C,MAAM;AAAA,MACN,OAAO;AAAA;AAAA;AAGb;;;AC5BO,IAAM,oBAAoB;AAS1B,IAAM,oBAAoB,CAAC,aAA6B;AAAA,EAC7D,MAAM,aAAa,IAAI,WAAW,QAAQ,WAAW,GAAG,EAAE,QAAQ,OAAO,EAAE;AAAA,EAE3E,IAAI,WAAW,SAAS,GAAG;AAAA,IACzB,MAAM,IAAI,UACR,IAAI,+DACF,yEACA,sBAAsB,oBAC1B;AAAA,EACF;AAAA,EACA,OAAO;AAAA;AAQT,IAAM,kBAAkB,CAA8B,YAAkB;AAAA,EACtE,MAAM,QAAQ,QAAQ;AAAA,EACtB,IAAI,CAAC,OAAO,WAAW,MAAM;AAAA,IAAU,OAAO;AAAA,EAK9C,OAAO;AAAA,OACF;AAAA,IACH,kBAAkB,KAAK,OAAO,UAAU,YAAY;AAAA,EACtD;AAAA;AAAA;AAQK,MAAM,YAA6D;AAAA,EAC/D;AAAA,EAMA;AAAA,EAQA;AAAA,EAET,WAAW,CAAC,MAAS,SAAkB;AAAA,IACrC,KAAK,WAAW,kBAAkB,KAAK,YAAY,iBAAiB;AAAA,IACpE,KAAK,UACH,YAAY,YAAY,KAAK,WAAW,kBAAkB,OAAO;AAAA,IACnE,KAAK,UAAU,gBAAgB,KAAK,MAAM,UAAU,KAAK,SAAS,CAAC;AAAA;AAEvE;AACA,OAAO,eAAe,aAAa,OAAO,IAAI,WAAW,GAAG;AAAA,EAC1D,OAAO,MAAM,CAAC,EAAE,YAAY,UAAU,GAAG,EAAE,YAAY,mBAAmB,CAAC;AAC7E,CAAC;;;AFnCM;AAAA,EADN,OAAO;AAAA;AACD;AAAA,EAIJ,IAAI,IAAI;AAAA;AAJJ;AAAA,EAQJ,KAAK,IAAI;AAAA;AARL;AAAA,EAYJ,IAAI,IAAI;AAAA;AAZJ;AAAA,EAgBJ,MAAM,IAAI;AAAA;AAhBN;AAAA,EAoBJ,OAAO,IAAI;AAAA;AApBP;AAAA;AAAA;AAAA,eA+BI,SAAC,KAAoC;AAAA,EAC5C,IAAI,CAAC,+BAAgB;AAAA,IACnB,8BAAiB;AAAA,IACjB,MAAM,WAAW,0BAAW,QAAQ,YAAY;AAAA,IAChD,QAAQ,aAAa,IAAI,IAAI,IAAI,GAAG;AAAA,IACpC,IAAI,CAAC,SAAS,WAAW,GAAG,WAAW,GAAG;AAAA,MACxC,MAAM,IAAI,UACR,GAAG,2EACD,YAAY,6DACZ,6EACA,yEACJ;AAAA,IACF;AAAA,EACF;AAAA,EACA,OAAO,0BAAW,QAAQ,GAAG;AAAA;AA7C1B;AAAA;AAAA,MAAM,YAAY;AAAA,EAAlB;AAAA,8BACY,OAAO,IAAI;AAAA,IADvB,8BAEO;AAAA,IAFP;AAAA;AAAA;AAAA,EAIM,GAAG,GAAG,OAA+C;AAAA,IAC9D,OAAO,0DAAe,GAAG;AAAA;AAAA,EAGf,IAAI,GAAG,OAA+C;AAAA,IAChE,OAAO,0DAAe,GAAG;AAAA;AAAA,EAGhB,GAAG,GAAG,OAA+C;AAAA,IAC9D,OAAO,0DAAe,GAAG;AAAA;AAAA,EAGd,KAAK,GAAG,OAA+C;AAAA,IAClE,OAAO,0DAAe,GAAG;AAAA;AAAA,EAGb,MAAM,GAAG,OAA+C;AAAA,IACpE,OAAO,0DAAe,GAAG;AAAA;AA0B7B;AA/CO,4BAIM,OAJN,OAAM;AAAN,4BAQO,QARP,OAAM;AAAN,4BAYM,OAZN,OAAM;AAAN,4BAgBQ,SAhBR,OAAM;AAAN,4BAoBS,UApBT,OAAM;AAAA,cAAN,iDAAM;AAAN,4BAAM;AAAN,2BAAM;AAAN,mBAAM;AAiEN,IAAM,eAAe,CAAC,YAC3B,UAAU,EACR,WAAW,OAAO,EAAE,MAAM,2BAA2B,YAAY;AAAC,CAAC,CACrE;;AG7GF;AAAA;AAAA,oBAQE;AAAA;AAEF;AAYA,IAAM,QAAQ,CACZ,SACA,SACA,YACkB;AAAA,EAGlB,MAAM,OAA2B;AAAA,EAEjC,OAAO;AAAA,IACL,QAAQ;AAAA,OACJ,YAAY,YAAY,CAAC,IAAI,EAAE,QAAQ;AAAA,IAM3C,SAAS,CAAC,aAAa,MAAM,aAAa,YAAY;AAAA,IACtD,aAAa,CAAC,aAAa,OAAO,CAAC;AAAA,IAInC,WAAW;AAAA,MACT;AAAA,MACA,QAAQ,MAAM;AAAA,QACZ,YAAY,CAAC,aAA0B,WAAW,SAAS,OAAO;AAAA,QAClE,QAAQ,CAAC,WAAW;AAAA,MACtB,CAAC;AAAA,MACD,QAAQ,aAAa;AAAA,QACnB,YAAY,CAAC,YAA4B,IAAI,YAAY,OAAO;AAAA,QAChE,QAAQ,CAAC,eAAc;AAAA,MACzB,CAAC;AAAA,MACD,QAAQ,cAAc;AAAA,QACpB,YAAY,CAAC,UAAgB,YAC3B,IAAI,aAAa,UAAU,OAAO;AAAA,QACpC,QAAQ,CAAC,MAAM,WAAW;AAAA,MAC5B,CAAC;AAAA,IACH;AAAA,EACF;AAAA;AAAA;AAgBK,MAAM,WAAW;AAAA,SAkBf,OAA0C,CAC/C,SACA,SACe;AAAA,IACf,MAAM,WAAW,IAAI,YAAY,SAAS,OAAO;AAAA,IACjD,OAAO,MACL,QAAQ,aAAa,EAAE,UAAU,SAAS,CAAC,GAC3C,SAAS,OACX;AAAA;AAAA,SAgCK,YAAY,CACjB,UACA,SACe;AAAA,IACf,MAAM,UAAU,kBAAkB,WAAW,iBAAiB;AAAA,IAE9D,OAAO,MACL,QAAQ,aAAa;AAAA,MACnB,YAAY,UACP,SACsB;AAAA,QACzB,MAAM,WAAW,IAAI,YACnB,MAAM,SAAS,WAAW,GAAG,IAAI,GACjC,OACF;AAAA,QACA,IAAI,YAAY,aAAa,SAAS,aAAa,SAAS;AAAA,UAC1D,MAAM,IAAI,UACR,iCAAiC,SAAS,+BACxC,iBAAiB,sDACjB,yDACA,iCACJ;AAAA,QACF;AAAA,QACA,OAAO;AAAA;AAAA,MAET,QAAQ,SAAS,UAAU,CAAC;AAAA,IAC9B,CAAC,GACD,SACA,SAAS,OACX;AAAA;AAEJ;;ACzHO,IAAM,eAAe,CAAC,gBAA8C;AAAA,EACzE,KAAK,CAAC,QAAQ,WAAW,IAAI,GAAG;AAAA,EAChC,cAAc,CAAC,QAAQ,WAAW,OAAO,GAAG;AAAA,EAC5C,WAAW,OAAO,KAAK,QAAQ;AAAA,IAC7B,MAAM,QAAQ,MAAM,WAAW,KAAK,GAAG;AAAA,IACvC,IAAI,UAAU;AAAA,MAAG,MAAM,WAAW,OAAO,KAAK,GAAG;AAAA,IACjD,OAAO;AAAA;AAAA,EAET,KAAK,CAAC,KAAK,OAAO,QAChB,WAAW,IAAI,KAAK,OAAO,QAAQ,YAAY,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;AAAA,EACjE,QAAQ,OAAO,QAAQ;AAAA,IACrB,MAAM,WAAW,IAAI,GAAG;AAAA;AAE5B;;ACbA,IAAM,UAAU,CAAC,OAAO,QAAQ,OAAO,SAAS,UAAU,WAAW,MAAM;AA2CpE,IAAM,qBACX,CAAC,MAA0B,YAC3B,YAA2C;AAAA,EACzC,MAAM,QAA8B,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,GAAG,MAAM,CAAC,EAAE;AAAA,EACvE,IAAI,OAAO,KAAK,IAAI,0BAA0B;AAAA,IAAY,OAAO;AAAA,EAEjE,MAAM,MAAO,MAAM,KAAK,IAAI,sBAAsB;AAAA,EAClD,MAAM,SAAS,kBAAkB,QAAQ,QAAQ;AAAA,EACjD,MAAM,MAAM,QAAQ,OAAO;AAAA,EAE3B,MAAM,QAAiD,CAAC;AAAA,EACxD,YAAY,MAAM,SAAS,OAAO,QAAQ,IAAI,SAAS,CAAC,CAAC,GAAG;AAAA,IAG1D,WAAW,UAAU,SAAS;AAAA,MAC5B,MAAM,YAAY,KAAK;AAAA,MACvB,IAAI,aAAa,OAAO,cAAc,UAAU;AAAA,QAC7C,UAAkC,OAAO,CAAC,GAAG;AAAA,MAChD;AAAA,IACF;AAAA,IACA,MAAM,KAAK,WAAW,MAAM,IAAI,OAAO,GAAG,SAAS,UAAU;AAAA,EAC/D;AAAA,EAEA,OAAO;AAAA,IACL;AAAA,IACA,SAAS,IAAI,YAAY,WAAW,CAAC;AAAA,IACrC,MAAM,CAAC,EAAE,MAAM,KAAK,aAAa,wBAAwB,CAAC;AAAA,EAC5D;AAAA;",
+  "debugId": "7A1AF5AF26CBCB1E64756E2164756E21",
   "names": []
 }

package/dist/module.d.ts

@@ -1,4 +1,4 @@
-import { type Deps, type DynamicModule, type FactoryProvider } from '@dunx/core';
+import { type Deps, type DynamicModule, type AsyncModuleConfig } from '@dunx/core';
 import { type BetterAuthOptions } from 'better-auth';
 /**
  * Binds three tokens and one controller:
@@ -57,5 +57,5 @@ export declare class AuthModule {
      * combination could only ever have mounted the handler where better-auth is not
      * looking.
      */
-    static forRootAsync<const D extends Deps>(provider: FactoryProvider<BetterAuthOptions, D>, mountAt?: string): DynamicModule;
+    static forRootAsync<const D extends Deps>(provider: AsyncModuleConfig<BetterAuthOptions, D>, mountAt?: string): DynamicModule;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dunx/auth",
-  "version": "0.9.0",
+  "version": "1.0.0",
   "description": "Better Auth for dunx: its handler mounted on Bun.serve, a session guard reading @Public() and @Roles(), the caller in async context, and Bun.password hashing",
   "keywords": [
     "auth",
@@ -58,8 +58,8 @@
     "drizzle-orm": "^0.45.2"
   },
   "peerDependencies": {
-    "@dunx/core": "^0.9.0",
-    "@dunx/http": "^0.9.0",
+    "@dunx/core": "^1.0.0",
+    "@dunx/http": "^1.0.0",
     "@types/bun": ">=1.3.0",
     "better-auth": "^1.6.25",
     "drizzle-orm": "^0.45.2"