@fluixi/auth 1.0.0-alpha.100

package/dist/remote.js

@@ -0,0 +1,30 @@
+export function remoteAuth(options) {
+    const base = new URL((options.basePath ?? '/api/auth').replace(/\/$/, '') + '/', options.url);
+    const call = (input, init) => (options.fetch ?? globalThis.fetch)(input, init);
+    return {
+        async handler(request) {
+            const url = new URL(request.url);
+            const hasBody = request.method !== 'GET' && request.method !== 'HEAD';
+            return call(new URL(url.pathname + url.search, base), {
+                method: request.method,
+                headers: request.headers,
+                body: hasBody ? request.body : undefined,
+                redirect: 'manual',
+                ...(hasBody ? { duplex: 'half' } : {}),
+            });
+        },
+        api: {
+            async getSession({ headers }) {
+                const cookie = headers.get('cookie');
+                // No cookie, no session: spare the API a request from every visitor.
+                if (!cookie)
+                    return null;
+                const response = await call(new URL('get-session', base), { headers: { cookie, accept: 'application/json' } });
+                if (!response.ok)
+                    return null;
+                const body = (await response.json().catch(() => null));
+                return body && body.user ? { user: body.user, session: body.session ?? null } : null;
+            },
+        },
+    };
+}

package/dist/remote.mjs

@@ -0,0 +1,31 @@
+// src/remote.ts
+function remoteAuth(options) {
+  const base = new URL((options.basePath ?? "/api/auth").replace(/\/$/, "") + "/", options.url);
+  const call = (input, init) => (options.fetch ?? globalThis.fetch)(input, init);
+  return {
+    async handler(request) {
+      const url = new URL(request.url);
+      const hasBody = request.method !== "GET" && request.method !== "HEAD";
+      return call(new URL(url.pathname + url.search, base), {
+        method: request.method,
+        headers: request.headers,
+        body: hasBody ? request.body : void 0,
+        redirect: "manual",
+        ...hasBody ? { duplex: "half" } : {}
+      });
+    },
+    api: {
+      async getSession({ headers }) {
+        const cookie = headers.get("cookie");
+        if (!cookie) return null;
+        const response = await call(new URL("get-session", base), { headers: { cookie, accept: "application/json" } });
+        if (!response.ok) return null;
+        const body = await response.json().catch(() => null);
+        return body && body.user ? { user: body.user, session: body.session ?? null } : null;
+      }
+    }
+  };
+}
+export {
+  remoteAuth
+};

package/dist/server.cjs

@@ -0,0 +1,203 @@
+/*! @fluixi/auth v1.0.0-alpha.100 | (c) 2026 Ibrahima Touré and Fluixi contributors | MIT */
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/server.ts
+var server_exports = {};
+__export(server_exports, {
+  AuthError: () => AuthError,
+  authMiddleware: () => authMiddleware,
+  defineAuth: () => defineAuth,
+  deleteCookie: () => import_cookie2.deleteCookie,
+  getAuth: () => getAuth,
+  getCookie: () => getCookie,
+  getCookies: () => getCookies,
+  member: () => member,
+  mountAuthRoutes: () => mountAuthRoutes,
+  optionalUser: () => optionalUser,
+  parseCookies: () => import_cookie2.parseCookies,
+  remoteAuth: () => remoteAuth,
+  requirePermission: () => requirePermission,
+  requireRole: () => requireRole,
+  requireUser: () => requireUser,
+  serializeCookie: () => import_cookie2.serializeCookie,
+  signedIn: () => signedIn
+});
+module.exports = __toCommonJS(server_exports);
+var import_server2 = require("@fluixi/server");
+
+// src/types.ts
+var AUTH_LOCALS_KEY = "auth";
+
+// src/cookies.ts
+var import_server = require("@fluixi/server");
+var import_cookie = require("@fluixi/utils/cookie");
+var import_cookie2 = require("@fluixi/utils/cookie");
+function requestHeaders() {
+  const req = (0, import_server.getRequestEvent)()?.request;
+  return req?.headers ?? null;
+}
+function getCookie(name) {
+  return (0, import_cookie.parseCookies)(requestHeaders()?.get("cookie"))[name] ?? null;
+}
+function getCookies() {
+  return (0, import_cookie.parseCookies)(requestHeaders()?.get("cookie"));
+}
+
+// src/remote.ts
+function remoteAuth(options) {
+  const base = new URL((options.basePath ?? "/api/auth").replace(/\/$/, "") + "/", options.url);
+  const call = (input, init) => (options.fetch ?? globalThis.fetch)(input, init);
+  return {
+    async handler(request) {
+      const url = new URL(request.url);
+      const hasBody = request.method !== "GET" && request.method !== "HEAD";
+      return call(new URL(url.pathname + url.search, base), {
+        method: request.method,
+        headers: request.headers,
+        body: hasBody ? request.body : void 0,
+        redirect: "manual",
+        ...hasBody ? { duplex: "half" } : {}
+      });
+    },
+    api: {
+      async getSession({ headers }) {
+        const cookie = headers.get("cookie");
+        if (!cookie) return null;
+        const response = await call(new URL("get-session", base), { headers: { cookie, accept: "application/json" } });
+        if (!response.ok) return null;
+        const body = await response.json().catch(() => null);
+        return body && body.user ? { user: body.user, session: body.session ?? null } : null;
+      }
+    }
+  };
+}
+
+// src/server.ts
+var _auth = null;
+function defineAuth(instance) {
+  const auth = {
+    raw: instance,
+    handler: (request) => instance.handler(request),
+    getSession: async (request) => {
+      const res = await instance.api.getSession({ headers: request.headers });
+      return { user: res?.user ?? null, session: res?.session ?? null };
+    }
+  };
+  _auth = auth;
+  return auth;
+}
+function getAuth() {
+  if (!_auth) {
+    throw new Error("[@fluixi/auth] defineAuth() was not called — no auth instance registered.");
+  }
+  return _auth;
+}
+function mountAuthRoutes() {
+  return (request) => getAuth().handler(request);
+}
+function authMiddleware() {
+  return async (request, next) => {
+    const session = await getAuth().getSession(request);
+    (0, import_server2.getRequestLocals)(request)[AUTH_LOCALS_KEY] = session;
+    return next();
+  };
+}
+var AuthError = class extends Error {
+  constructor(status, redirectTo, message, code) {
+    super(message ?? (status === 401 ? "Unauthorized" : "Forbidden"));
+    this.status = status;
+    this.redirectTo = redirectTo;
+    this.code = code;
+    this.name = "AuthError";
+  }
+};
+function current() {
+  return (0, import_server2.getLocals)()[AUTH_LOCALS_KEY] ?? { user: null, session: null };
+}
+async function optionalUser() {
+  return current().user;
+}
+async function requireUser(opts) {
+  const user = current().user;
+  if (!user) throw new AuthError(401, opts?.redirectTo ?? "/login");
+  return user;
+}
+async function requireRole(role, opts) {
+  const user = await requireUser(opts);
+  if (user.role !== role) throw new AuthError(403, opts?.redirectTo);
+  return user;
+}
+async function requirePermission(check, opts) {
+  await requireUser(opts);
+  const ok = typeof check === "function" ? check() : check;
+  if (!ok) throw new AuthError(403, opts?.redirectTo);
+}
+var SESSION_COOKIE = {
+  type: "apiKey",
+  in: "cookie",
+  name: "better-auth.session_token",
+  description: "Set by sign-in. Named `__Secure-better-auth.session_token` over HTTPS."
+};
+async function sessionFor(request) {
+  const resolved = (0, import_server2.getLocals)()[AUTH_LOCALS_KEY];
+  return resolved ?? getAuth().getSession(request);
+}
+function signedIn(options = {}) {
+  return {
+    async check(request) {
+      const { user, session } = await sessionFor(request);
+      if (!user || !session) throw new AuthError(401);
+      return { user, session };
+    },
+    security: { name: "session", scheme: options.scheme ?? SESSION_COOKIE },
+    refuses: [401]
+  };
+}
+function member(options = {}) {
+  const signed = signedIn(options);
+  return {
+    async check(request) {
+      const auth = await signed.check(request);
+      if (!auth.session.activeOrganizationId) {
+        throw new AuthError(403, void 0, "Choose an organisation first.", "no_active_organization");
+      }
+      const api = getAuth().raw.api;
+      if (!api.getActiveMember || !api.hasPermission) {
+        throw new Error("[@fluixi/auth] member() needs Better Auth's organization() plugin.");
+      }
+      const membership = await api.getActiveMember({ headers: request.headers });
+      if (!membership) {
+        throw new AuthError(403, void 0, "You are not a member of this organisation.", "not_a_member");
+      }
+      if (options.roles) {
+        const held = membership.role.split(",").map((role2) => role2.trim());
+        if (!options.roles.some((role2) => held.includes(role2))) throw new AuthError(403);
+      }
+      if (options.permissions) {
+        const { success } = await api.hasPermission({ headers: request.headers, body: { permissions: options.permissions } });
+        if (!success) throw new AuthError(403);
+      }
+      const { id, organizationId, userId, role } = membership;
+      return { ...auth, member: { id, organizationId, userId, role } };
+    },
+    security: signed.security,
+    refuses: [401, 403]
+  };
+}

package/dist/server.d.ts

@@ -0,0 +1,131 @@
+/**
+ * @fluixi/auth/server: the server-side bindings.
+ *
+ * `defineAuth(betterAuth(...))` registers the engine; `authMiddleware()` resolves the
+ * session once per request and writes it to `locals.auth` (via the @fluixi/start locals
+ * bridge), so the server helpers: `requireUser`, `requireRole`, `requirePermission` ,
+ * are pure reads of request-scoped state. No manual token parsing; works inside loaders
+ * AND server functions (same request context).
+ */
+import type { Middleware } from '@fluixi/start';
+import { type AuthSession, type AuthUser, type BetterAuthServer, type SessionData } from './types.js';
+export interface FluixiAuth<U = AuthUser> {
+    /** The underlying Better Auth instance. */
+    raw: BetterAuthServer;
+    /** Mount at `/api/auth/*`. */
+    handler: (request: Request) => Promise<Response>;
+    /** Resolve the session for a request (used by the middleware). */
+    getSession: (request: Request) => Promise<SessionData<U>>;
+}
+export declare function defineAuth<U = AuthUser>(instance: BetterAuthServer): FluixiAuth<U>;
+export declare function getAuth<U = AuthUser>(): FluixiAuth<U>;
+/** Catch-all route handler for `/api/auth/*` (sugar over `auth.handler`). */
+export declare function mountAuthRoutes(): (request: Request) => Promise<Response>;
+/**
+ * Resolve the session ONCE per request and stash it on `locals.auth`. Runs before the
+ * render (and before server functions), so every helper below is a pure locals read.
+ * Place it in `src/middleware.ts`: `export default defineMiddleware([ authMiddleware() ])`.
+ */
+export declare function authMiddleware(): Middleware;
+/**
+ * Thrown by the require* helpers and the guards; carries the HTTP status, an optional redirect
+ * target, and a `code` when the refusal is more precise than 401 or 403 alone.
+ */
+export declare class AuthError extends Error {
+    status: 401 | 403;
+    redirectTo?: string | undefined;
+    code?: string | undefined;
+    constructor(status: 401 | 403, redirectTo?: string | undefined, message?: string, code?: string | undefined);
+}
+/** The current user or null: never throws. */
+export declare function optionalUser<U = AuthUser>(): Promise<U | null>;
+/** The current user, or throw `AuthError(401, redirectTo)`. */
+export declare function requireUser<U = AuthUser>(opts?: {
+    redirectTo?: string;
+}): Promise<U>;
+/** Require a specific role, or throw `AuthError(403)`. */
+export declare function requireRole<U extends {
+    role?: string;
+} = AuthUser>(role: string, opts?: {
+    redirectTo?: string;
+}): Promise<U>;
+/**
+ * Require a permission. Pass a boolean or a predicate (e.g. your RBAC/ABAC `can(user, …)`):
+ * `await requirePermission(() => can(user, 'edit', post))`. Throws `AuthError(403)` if false.
+ */
+export declare function requirePermission(check: boolean | (() => boolean), opts?: {
+    redirectTo?: string;
+}): Promise<void>;
+export interface GuardOptions {
+    /** The security scheme the API description gives, when the cookie is renamed or a token is used. */
+    scheme?: Record<string, unknown>;
+}
+/** A signed-in caller's session, as a guard hands it to the handler. */
+export interface SignedIn<U = AuthUser> {
+    user: U;
+    session: AuthSession;
+}
+/** The caller's membership of the organisation their session has active. */
+export interface ActiveMember {
+    id: string;
+    organizationId: string;
+    userId: string;
+    /** One role, or several comma-separated, as Better Auth stores them. */
+    role: string;
+}
+/**
+ * An `@fluixi/api` guard: the caller must be signed in. The handler gets `auth.user` and
+ * `auth.session`. Refuses with 401.
+ *
+ * ```ts
+ * export const GET = route({ guard: signedIn(), handler: ({ auth }) => auth.user });
+ * ```
+ */
+export declare function signedIn<U = AuthUser>(options?: GuardOptions): {
+    check(request: Request): Promise<SignedIn<U>>;
+    security: {
+        name: string;
+        scheme: {
+            type: string;
+            in: string;
+            name: string;
+            description: string;
+        } | Record<string, unknown>;
+    };
+    refuses: readonly [401];
+};
+/**
+ * An `@fluixi/api` guard: the caller must be a member of the organisation their session has
+ * active, with one of `roles` if given, and every one of `permissions` if given (checked by
+ * Better Auth's access control). The handler gets `auth.member.organizationId`, which is the
+ * tenant every query of that route is scoped to.
+ *
+ * Refuses with 401 when signed out, else 403: `no_active_organization` when none is active,
+ * `not_a_member` when the membership is gone, `forbidden` for a role or permission.
+ *
+ * ```ts
+ * export const DELETE = route({ guard: member({ roles: ['owner', 'admin'] }), handler });
+ * ```
+ */
+export declare function member<U = AuthUser>(options?: GuardOptions & {
+    roles?: readonly string[];
+    permissions?: Record<string, string[]>;
+}): {
+    check(request: Request): Promise<SignedIn<U> & {
+        member: ActiveMember;
+    }>;
+    security: {
+        name: string;
+        scheme: {
+            type: string;
+            in: string;
+            name: string;
+            description: string;
+        } | Record<string, unknown>;
+    };
+    refuses: readonly [401, 403];
+};
+export { parseCookies, serializeCookie, deleteCookie, getCookie, getCookies, type CookieOptions, } from './cookies.js';
+export { remoteAuth, type RemoteAuthOptions } from './remote.js';
+export type { SessionData, AuthSession, AuthUser, BetterAuthServer } from './types.js';
+//# sourceMappingURL=server.d.ts.map

package/dist/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAEhD,OAAO,EAEL,KAAK,WAAW,EAChB,KAAK,QAAQ,EACb,KAAK,gBAAgB,EACrB,KAAK,WAAW,EACjB,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,UAAU,CAAC,CAAC,GAAG,QAAQ;IACtC,2CAA2C;IAC3C,GAAG,EAAE,gBAAgB,CAAC;IACtB,8BAA8B;IAC9B,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjD,kEAAkE;IAClE,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;CAC3D;AAMD,wBAAgB,UAAU,CAAC,CAAC,GAAG,QAAQ,EAAE,QAAQ,EAAE,gBAAgB,GAAG,UAAU,CAAC,CAAC,CAAC,CAWlF;AAED,wBAAgB,OAAO,CAAC,CAAC,GAAG,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,CAKrD;AAED,6EAA6E;AAC7E,wBAAgB,eAAe,IAAI,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAEzE;AAED;;;;GAIG;AACH,wBAAgB,cAAc,IAAI,UAAU,CAM3C;AAED;;;GAGG;AACH,qBAAa,SAAU,SAAQ,KAAK;IAEzB,MAAM,EAAE,GAAG,GAAG,GAAG;IACjB,UAAU,CAAC,EAAE,MAAM;IAEnB,IAAI,CAAC,EAAE,MAAM;gBAHb,MAAM,EAAE,GAAG,GAAG,GAAG,EACjB,UAAU,CAAC,EAAE,MAAM,YAAA,EAC1B,OAAO,CAAC,EAAE,MAAM,EACT,IAAI,CAAC,EAAE,MAAM,YAAA;CAKvB;AAMD,8CAA8C;AAC9C,wBAAsB,YAAY,CAAC,CAAC,GAAG,QAAQ,KAAK,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAEpE;AAED,+DAA+D;AAC/D,wBAAsB,WAAW,CAAC,CAAC,GAAG,QAAQ,EAAE,IAAI,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAI1F;AAED,0DAA0D;AAC1D,wBAAsB,WAAW,CAAC,CAAC,SAAS;IAAE,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,QAAQ,EACtE,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAC7B,OAAO,CAAC,CAAC,CAAC,CAIZ;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,OAAO,GAAG,CAAC,MAAM,OAAO,CAAC,EAChC,IAAI,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAC7B,OAAO,CAAC,IAAI,CAAC,CAIf;AAUD,MAAM,WAAW,YAAY;IAC3B,oGAAoG;IACpG,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,wEAAwE;AACxE,MAAM,WAAW,QAAQ,CAAC,CAAC,GAAG,QAAQ;IACpC,IAAI,EAAE,CAAC,CAAC;IACR,OAAO,EAAE,WAAW,CAAC;CACtB;AAED,4EAA4E;AAC5E,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,wEAAwE;IACxE,IAAI,EAAE,MAAM,CAAC;CACd;AAcD;;;;;;;GAOG;AACH,wBAAgB,QAAQ,CAAC,CAAC,GAAG,QAAQ,EAAE,OAAO,GAAE,YAAiB;mBAExC,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;;;;;;;;;;;EAQtD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,MAAM,CAAC,CAAC,GAAG,QAAQ,EACjC,OAAO,GAAE,YAAY,GAAG;IAAE,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;CAAO;mBAI3E,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG;QAAE,MAAM,EAAE,YAAY,CAAA;KAAE,CAAC;;;;;;;;;;;EA2BjF;AAGD,OAAO,EACL,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,SAAS,EACT,UAAU,EACV,KAAK,aAAa,GACnB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,UAAU,EAAE,KAAK,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEjE,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC"}

package/dist/server.js

@@ -0,0 +1,167 @@
+import { getLocals, getRequestLocals } from '@fluixi/server';
+import { AUTH_LOCALS_KEY, } from './types.js';
+// Registered instance: so the helpers/middleware find "the" auth without the app
+// threading it through every call. defineAuth sets it; getAuth reads it.
+let _auth = null;
+export function defineAuth(instance) {
+    const auth = {
+        raw: instance,
+        handler: (request) => instance.handler(request),
+        getSession: async (request) => {
+            const res = await instance.api.getSession({ headers: request.headers });
+            return { user: res?.user ?? null, session: res?.session ?? null };
+        },
+    };
+    _auth = auth;
+    return auth;
+}
+export function getAuth() {
+    if (!_auth) {
+        throw new Error('[@fluixi/auth] defineAuth() was not called — no auth instance registered.');
+    }
+    return _auth;
+}
+/** Catch-all route handler for `/api/auth/*` (sugar over `auth.handler`). */
+export function mountAuthRoutes() {
+    return (request) => getAuth().handler(request);
+}
+/**
+ * Resolve the session ONCE per request and stash it on `locals.auth`. Runs before the
+ * render (and before server functions), so every helper below is a pure locals read.
+ * Place it in `src/middleware.ts`: `export default defineMiddleware([ authMiddleware() ])`.
+ */
+export function authMiddleware() {
+    return async (request, next) => {
+        const session = await getAuth().getSession(request);
+        getRequestLocals(request)[AUTH_LOCALS_KEY] = session;
+        return next();
+    };
+}
+/**
+ * Thrown by the require* helpers and the guards; carries the HTTP status, an optional redirect
+ * target, and a `code` when the refusal is more precise than 401 or 403 alone.
+ */
+export class AuthError extends Error {
+    status;
+    redirectTo;
+    code;
+    constructor(status, redirectTo, message, code) {
+        super(message ?? (status === 401 ? 'Unauthorized' : 'Forbidden'));
+        this.status = status;
+        this.redirectTo = redirectTo;
+        this.code = code;
+        this.name = 'AuthError';
+    }
+}
+function current() {
+    return getLocals()[AUTH_LOCALS_KEY] ?? { user: null, session: null };
+}
+/** The current user or null: never throws. */
+export async function optionalUser() {
+    return current().user;
+}
+/** The current user, or throw `AuthError(401, redirectTo)`. */
+export async function requireUser(opts) {
+    const user = current().user;
+    if (!user)
+        throw new AuthError(401, opts?.redirectTo ?? '/login');
+    return user;
+}
+/** Require a specific role, or throw `AuthError(403)`. */
+export async function requireRole(role, opts) {
+    const user = await requireUser(opts);
+    if (user.role !== role)
+        throw new AuthError(403, opts?.redirectTo);
+    return user;
+}
+/**
+ * Require a permission. Pass a boolean or a predicate (e.g. your RBAC/ABAC `can(user, …)`):
+ * `await requirePermission(() => can(user, 'edit', post))`. Throws `AuthError(403)` if false.
+ */
+export async function requirePermission(check, opts) {
+    await requireUser(opts);
+    const ok = typeof check === 'function' ? check() : check;
+    if (!ok)
+        throw new AuthError(403, opts?.redirectTo);
+}
+/** Better Auth's session cookie, as an API description names it. */
+const SESSION_COOKIE = {
+    type: 'apiKey',
+    in: 'cookie',
+    name: 'better-auth.session_token',
+    description: 'Set by sign-in. Named `__Secure-better-auth.session_token` over HTTPS.',
+};
+/** The session for this request: from `authMiddleware()` when it ran, else resolved here. */
+async function sessionFor(request) {
+    const resolved = getLocals()[AUTH_LOCALS_KEY];
+    return resolved ?? getAuth().getSession(request);
+}
+/**
+ * An `@fluixi/api` guard: the caller must be signed in. The handler gets `auth.user` and
+ * `auth.session`. Refuses with 401.
+ *
+ * ```ts
+ * export const GET = route({ guard: signedIn(), handler: ({ auth }) => auth.user });
+ * ```
+ */
+export function signedIn(options = {}) {
+    return {
+        async check(request) {
+            const { user, session } = await sessionFor(request);
+            if (!user || !session)
+                throw new AuthError(401);
+            return { user, session };
+        },
+        security: { name: 'session', scheme: options.scheme ?? SESSION_COOKIE },
+        refuses: [401],
+    };
+}
+/**
+ * An `@fluixi/api` guard: the caller must be a member of the organisation their session has
+ * active, with one of `roles` if given, and every one of `permissions` if given (checked by
+ * Better Auth's access control). The handler gets `auth.member.organizationId`, which is the
+ * tenant every query of that route is scoped to.
+ *
+ * Refuses with 401 when signed out, else 403: `no_active_organization` when none is active,
+ * `not_a_member` when the membership is gone, `forbidden` for a role or permission.
+ *
+ * ```ts
+ * export const DELETE = route({ guard: member({ roles: ['owner', 'admin'] }), handler });
+ * ```
+ */
+export function member(options = {}) {
+    const signed = signedIn(options);
+    return {
+        async check(request) {
+            const auth = await signed.check(request);
+            if (!auth.session.activeOrganizationId) {
+                throw new AuthError(403, undefined, 'Choose an organisation first.', 'no_active_organization');
+            }
+            const api = getAuth().raw.api;
+            if (!api.getActiveMember || !api.hasPermission) {
+                throw new Error("[@fluixi/auth] member() needs Better Auth's organization() plugin.");
+            }
+            const membership = await api.getActiveMember({ headers: request.headers });
+            if (!membership) {
+                throw new AuthError(403, undefined, 'You are not a member of this organisation.', 'not_a_member');
+            }
+            if (options.roles) {
+                const held = membership.role.split(',').map((role) => role.trim());
+                if (!options.roles.some((role) => held.includes(role)))
+                    throw new AuthError(403);
+            }
+            if (options.permissions) {
+                const { success } = await api.hasPermission({ headers: request.headers, body: { permissions: options.permissions } });
+                if (!success)
+                    throw new AuthError(403);
+            }
+            const { id, organizationId, userId, role } = membership;
+            return { ...auth, member: { id, organizationId, userId, role } };
+        },
+        security: signed.security,
+        refuses: [401, 403],
+    };
+}
+// Cookie API: proper, secure-by-default cookie management (parse/serialize/request reads).
+export { parseCookies, serializeCookie, deleteCookie, getCookie, getCookies, } from './cookies.js';
+export { remoteAuth } from './remote.js';