@fluixi/auth 1.0.0-alpha.91 → 1.0.0-alpha.93

package/dist/server.d.ts

@@ -8,7 +8,7 @@
  * AND server functions (same request context).
  */
 import type { Middleware } from '@fluixi/start';
-import { type AuthUser, type BetterAuthServer, type SessionData } from './types.js';
+import { type AuthSession, type AuthUser, type BetterAuthServer, type SessionData } from './types.js';
 export interface FluixiAuth<U = AuthUser> {
     /** The underlying Better Auth instance. */
     raw: BetterAuthServer;
@@ -27,11 +27,15 @@ export declare function mountAuthRoutes(): (request: Request) => Promise<Respons
  * Place it in `src/middleware.ts`: `export default defineMiddleware([ authMiddleware() ])`.
  */
 export declare function authMiddleware(): Middleware;
-/** Thrown by the require* helpers; carries the HTTP status + optional redirect target. */
+/**
+ * Thrown by the require* helpers and the guards; carries the HTTP status, an optional redirect
+ * target, and a `code` when the refusal is more precise than 401 or 403 alone.
+ */
 export declare class AuthError extends Error {
     status: 401 | 403;
     redirectTo?: string | undefined;
-    constructor(status: 401 | 403, redirectTo?: string | undefined, message?: string);
+    code?: string | undefined;
+    constructor(status: 401 | 403, redirectTo?: string | undefined, message?: string, code?: string | undefined);
 }
 /** The current user or null: never throws. */
 export declare function optionalUser<U = AuthUser>(): Promise<U | null>;
@@ -52,6 +56,76 @@ export declare function requireRole<U extends {
 export declare function requirePermission(check: boolean | (() => boolean), opts?: {
     redirectTo?: string;
 }): Promise<void>;
+export interface GuardOptions {
+    /** The security scheme the API description gives, when the cookie is renamed or a token is used. */
+    scheme?: Record<string, unknown>;
+}
+/** A signed-in caller's session, as a guard hands it to the handler. */
+export interface SignedIn<U = AuthUser> {
+    user: U;
+    session: AuthSession;
+}
+/** The caller's membership of the organisation their session has active. */
+export interface ActiveMember {
+    id: string;
+    organizationId: string;
+    userId: string;
+    /** One role, or several comma-separated, as Better Auth stores them. */
+    role: string;
+}
+/**
+ * An `@fluixi/api` guard: the caller must be signed in. The handler gets `auth.user` and
+ * `auth.session`. Refuses with 401.
+ *
+ * ```ts
+ * export const GET = route({ guard: signedIn(), handler: ({ auth }) => auth.user });
+ * ```
+ */
+export declare function signedIn<U = AuthUser>(options?: GuardOptions): {
+    check(request: Request): Promise<SignedIn<U>>;
+    security: {
+        name: string;
+        scheme: {
+            type: string;
+            in: string;
+            name: string;
+            description: string;
+        } | Record<string, unknown>;
+    };
+    refuses: readonly [401];
+};
+/**
+ * An `@fluixi/api` guard: the caller must be a member of the organisation their session has
+ * active, with one of `roles` if given, and every one of `permissions` if given (checked by
+ * Better Auth's access control). The handler gets `auth.member.organizationId`, which is the
+ * tenant every query of that route is scoped to.
+ *
+ * Refuses with 401 when signed out, else 403: `no_active_organization` when none is active,
+ * `not_a_member` when the membership is gone, `forbidden` for a role or permission.
+ *
+ * ```ts
+ * export const DELETE = route({ guard: member({ roles: ['owner', 'admin'] }), handler });
+ * ```
+ */
+export declare function member<U = AuthUser>(options?: GuardOptions & {
+    roles?: readonly string[];
+    permissions?: Record<string, string[]>;
+}): {
+    check(request: Request): Promise<SignedIn<U> & {
+        member: ActiveMember;
+    }>;
+    security: {
+        name: string;
+        scheme: {
+            type: string;
+            in: string;
+            name: string;
+            description: string;
+        } | Record<string, unknown>;
+    };
+    refuses: readonly [401, 403];
+};
 export { parseCookies, serializeCookie, deleteCookie, getCookie, getCookies, type CookieOptions, } from './cookies.js';
-export type { SessionData, AuthUser, BetterAuthServer } from './types.js';
+export { remoteAuth, type RemoteAuthOptions } from './remote.js';
+export type { SessionData, AuthSession, AuthUser, BetterAuthServer } from './types.js';
 //# sourceMappingURL=server.d.ts.map

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAEhD,OAAO,EAEL,KAAK,QAAQ,EACb,KAAK,gBAAgB,EACrB,KAAK,WAAW,EACjB,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,UAAU,CAAC,CAAC,GAAG,QAAQ;IACtC,2CAA2C;IAC3C,GAAG,EAAE,gBAAgB,CAAC;IACtB,8BAA8B;IAC9B,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjD,kEAAkE;IAClE,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;CAC3D;AAMD,wBAAgB,UAAU,CAAC,CAAC,GAAG,QAAQ,EAAE,QAAQ,EAAE,gBAAgB,GAAG,UAAU,CAAC,CAAC,CAAC,CAWlF;AAED,wBAAgB,OAAO,CAAC,CAAC,GAAG,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,CAKrD;AAED,6EAA6E;AAC7E,wBAAgB,eAAe,IAAI,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAEzE;AAED;;;;GAIG;AACH,wBAAgB,cAAc,IAAI,UAAU,CAM3C;AAED,0FAA0F;AAC1F,qBAAa,SAAU,SAAQ,KAAK;IAEzB,MAAM,EAAE,GAAG,GAAG,GAAG;IACjB,UAAU,CAAC,EAAE,MAAM;gBADnB,MAAM,EAAE,GAAG,GAAG,GAAG,EACjB,UAAU,CAAC,EAAE,MAAM,YAAA,EAC1B,OAAO,CAAC,EAAE,MAAM;CAKnB;AAMD,8CAA8C;AAC9C,wBAAsB,YAAY,CAAC,CAAC,GAAG,QAAQ,KAAK,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAEpE;AAED,+DAA+D;AAC/D,wBAAsB,WAAW,CAAC,CAAC,GAAG,QAAQ,EAAE,IAAI,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAI1F;AAED,0DAA0D;AAC1D,wBAAsB,WAAW,CAAC,CAAC,SAAS;IAAE,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,QAAQ,EACtE,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAC7B,OAAO,CAAC,CAAC,CAAC,CAIZ;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,OAAO,GAAG,CAAC,MAAM,OAAO,CAAC,EAChC,IAAI,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAC7B,OAAO,CAAC,IAAI,CAAC,CAIf;AAGD,OAAO,EACL,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,SAAS,EACT,UAAU,EACV,KAAK,aAAa,GACnB,MAAM,cAAc,CAAC;AAEtB,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAEhD,OAAO,EAEL,KAAK,WAAW,EAChB,KAAK,QAAQ,EACb,KAAK,gBAAgB,EACrB,KAAK,WAAW,EACjB,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,UAAU,CAAC,CAAC,GAAG,QAAQ;IACtC,2CAA2C;IAC3C,GAAG,EAAE,gBAAgB,CAAC;IACtB,8BAA8B;IAC9B,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjD,kEAAkE;IAClE,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;CAC3D;AAMD,wBAAgB,UAAU,CAAC,CAAC,GAAG,QAAQ,EAAE,QAAQ,EAAE,gBAAgB,GAAG,UAAU,CAAC,CAAC,CAAC,CAWlF;AAED,wBAAgB,OAAO,CAAC,CAAC,GAAG,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,CAKrD;AAED,6EAA6E;AAC7E,wBAAgB,eAAe,IAAI,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAEzE;AAED;;;;GAIG;AACH,wBAAgB,cAAc,IAAI,UAAU,CAM3C;AAED;;;GAGG;AACH,qBAAa,SAAU,SAAQ,KAAK;IAEzB,MAAM,EAAE,GAAG,GAAG,GAAG;IACjB,UAAU,CAAC,EAAE,MAAM;IAEnB,IAAI,CAAC,EAAE,MAAM;gBAHb,MAAM,EAAE,GAAG,GAAG,GAAG,EACjB,UAAU,CAAC,EAAE,MAAM,YAAA,EAC1B,OAAO,CAAC,EAAE,MAAM,EACT,IAAI,CAAC,EAAE,MAAM,YAAA;CAKvB;AAMD,8CAA8C;AAC9C,wBAAsB,YAAY,CAAC,CAAC,GAAG,QAAQ,KAAK,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAEpE;AAED,+DAA+D;AAC/D,wBAAsB,WAAW,CAAC,CAAC,GAAG,QAAQ,EAAE,IAAI,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAI1F;AAED,0DAA0D;AAC1D,wBAAsB,WAAW,CAAC,CAAC,SAAS;IAAE,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,QAAQ,EACtE,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAC7B,OAAO,CAAC,CAAC,CAAC,CAIZ;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,OAAO,GAAG,CAAC,MAAM,OAAO,CAAC,EAChC,IAAI,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAC7B,OAAO,CAAC,IAAI,CAAC,CAIf;AAUD,MAAM,WAAW,YAAY;IAC3B,oGAAoG;IACpG,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,wEAAwE;AACxE,MAAM,WAAW,QAAQ,CAAC,CAAC,GAAG,QAAQ;IACpC,IAAI,EAAE,CAAC,CAAC;IACR,OAAO,EAAE,WAAW,CAAC;CACtB;AAED,4EAA4E;AAC5E,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,wEAAwE;IACxE,IAAI,EAAE,MAAM,CAAC;CACd;AAcD;;;;;;;GAOG;AACH,wBAAgB,QAAQ,CAAC,CAAC,GAAG,QAAQ,EAAE,OAAO,GAAE,YAAiB;mBAExC,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;;;;;;;;;;;EAQtD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,MAAM,CAAC,CAAC,GAAG,QAAQ,EACjC,OAAO,GAAE,YAAY,GAAG;IAAE,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;CAAO;mBAI3E,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG;QAAE,MAAM,EAAE,YAAY,CAAA;KAAE,CAAC;;;;;;;;;;;EA2BjF;AAGD,OAAO,EACL,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,SAAS,EACT,UAAU,EACV,KAAK,aAAa,GACnB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,UAAU,EAAE,KAAK,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEjE,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC"}

package/dist/server.js

@@ -37,14 +37,19 @@ export function authMiddleware() {
         return next();
     };
 }
-/** Thrown by the require* helpers; carries the HTTP status + optional redirect target. */
+/**
+ * Thrown by the require* helpers and the guards; carries the HTTP status, an optional redirect
+ * target, and a `code` when the refusal is more precise than 401 or 403 alone.
+ */
 export class AuthError extends Error {
     status;
     redirectTo;
-    constructor(status, redirectTo, message) {
+    code;
+    constructor(status, redirectTo, message, code) {
         super(message ?? (status === 401 ? 'Unauthorized' : 'Forbidden'));
         this.status = status;
         this.redirectTo = redirectTo;
+        this.code = code;
         this.name = 'AuthError';
     }
 }
@@ -79,5 +84,84 @@ export async function requirePermission(check, opts) {
     if (!ok)
         throw new AuthError(403, opts?.redirectTo);
 }
+/** Better Auth's session cookie, as an API description names it. */
+const SESSION_COOKIE = {
+    type: 'apiKey',
+    in: 'cookie',
+    name: 'better-auth.session_token',
+    description: 'Set by sign-in. Named `__Secure-better-auth.session_token` over HTTPS.',
+};
+/** The session for this request: from `authMiddleware()` when it ran, else resolved here. */
+async function sessionFor(request) {
+    const resolved = getLocals()[AUTH_LOCALS_KEY];
+    return resolved ?? getAuth().getSession(request);
+}
+/**
+ * An `@fluixi/api` guard: the caller must be signed in. The handler gets `auth.user` and
+ * `auth.session`. Refuses with 401.
+ *
+ * ```ts
+ * export const GET = route({ guard: signedIn(), handler: ({ auth }) => auth.user });
+ * ```
+ */
+export function signedIn(options = {}) {
+    return {
+        async check(request) {
+            const { user, session } = await sessionFor(request);
+            if (!user || !session)
+                throw new AuthError(401);
+            return { user, session };
+        },
+        security: { name: 'session', scheme: options.scheme ?? SESSION_COOKIE },
+        refuses: [401],
+    };
+}
+/**
+ * An `@fluixi/api` guard: the caller must be a member of the organisation their session has
+ * active, with one of `roles` if given, and every one of `permissions` if given (checked by
+ * Better Auth's access control). The handler gets `auth.member.organizationId`, which is the
+ * tenant every query of that route is scoped to.
+ *
+ * Refuses with 401 when signed out, else 403: `no_active_organization` when none is active,
+ * `not_a_member` when the membership is gone, `forbidden` for a role or permission.
+ *
+ * ```ts
+ * export const DELETE = route({ guard: member({ roles: ['owner', 'admin'] }), handler });
+ * ```
+ */
+export function member(options = {}) {
+    const signed = signedIn(options);
+    return {
+        async check(request) {
+            const auth = await signed.check(request);
+            if (!auth.session.activeOrganizationId) {
+                throw new AuthError(403, undefined, 'Choose an organisation first.', 'no_active_organization');
+            }
+            const api = getAuth().raw.api;
+            if (!api.getActiveMember || !api.hasPermission) {
+                throw new Error("[@fluixi/auth] member() needs Better Auth's organization() plugin.");
+            }
+            const membership = await api.getActiveMember({ headers: request.headers });
+            if (!membership) {
+                throw new AuthError(403, undefined, 'You are not a member of this organisation.', 'not_a_member');
+            }
+            if (options.roles) {
+                const held = membership.role.split(',').map((role) => role.trim());
+                if (!options.roles.some((role) => held.includes(role)))
+                    throw new AuthError(403);
+            }
+            if (options.permissions) {
+                const { success } = await api.hasPermission({ headers: request.headers, body: { permissions: options.permissions } });
+                if (!success)
+                    throw new AuthError(403);
+            }
+            const { id, organizationId, userId, role } = membership;
+            return { ...auth, member: { id, organizationId, userId, role } };
+        },
+        security: signed.security,
+        refuses: [401, 403],
+    };
+}
 // Cookie API: proper, secure-by-default cookie management (parse/serialize/request reads).
 export { parseCookies, serializeCookie, deleteCookie, getCookie, getCookies, } from './cookies.js';
+export { remoteAuth } from './remote.js';

package/dist/server.mjs

@@ -1,4 +1,4 @@
-/*! @fluixi/auth v1.0.0-alpha.91 | (c) 2026 Ibrahima Touré and Fluixi contributors | MIT */
+/*! @fluixi/auth v1.0.0-alpha.93 | (c) 2026 Ibrahima Touré and Fluixi contributors | MIT */
 
 // src/server.ts
 import { getLocals, getRequestLocals } from "@fluixi/server";
@@ -8,38 +8,8 @@ var AUTH_LOCALS_KEY = "auth";
 
 // src/cookies.ts
 import { getRequestEvent } from "@fluixi/server";
-function parseCookies(header) {
-  const out = {};
-  if (!header) return out;
-  for (const part of header.split(";")) {
-    const eq = part.indexOf("=");
-    if (eq < 0) continue;
-    const k = part.slice(0, eq).trim();
-    if (k) out[k] = decodeURIComponent(part.slice(eq + 1).trim());
-  }
-  return out;
-}
-function serializeCookie(name, value, opts = {}) {
-  const o = {
-    path: "/",
-    httpOnly: true,
-    secure: true,
-    sameSite: "lax",
-    ...opts
-  };
-  let s = `${name}=${encodeURIComponent(value)}`;
-  if (o.maxAge != null) s += `; Max-Age=${Math.floor(o.maxAge)}`;
-  if (o.expires) s += `; Expires=${o.expires.toUTCString()}`;
-  if (o.domain) s += `; Domain=${o.domain}`;
-  s += `; Path=${o.path}`;
-  if (o.httpOnly) s += "; HttpOnly";
-  if (o.secure) s += "; Secure";
-  s += `; SameSite=${o.sameSite[0].toUpperCase()}${o.sameSite.slice(1)}`;
-  return s;
-}
-function deleteCookie(name, opts = {}) {
-  return serializeCookie(name, "", { ...opts, maxAge: 0 });
-}
+import { parseCookies } from "@fluixi/utils/cookie";
+import { parseCookies as parseCookies2, serializeCookie, deleteCookie, isValidCookieName } from "@fluixi/utils/cookie";
 function requestHeaders() {
   const req = getRequestEvent()?.request;
   return req?.headers ?? null;
@@ -51,6 +21,35 @@ function getCookies() {
   return parseCookies(requestHeaders()?.get("cookie"));
 }
 
+// src/remote.ts
+function remoteAuth(options) {
+  const base = new URL((options.basePath ?? "/api/auth").replace(/\/$/, "") + "/", options.url);
+  const call = (input, init) => (options.fetch ?? globalThis.fetch)(input, init);
+  return {
+    async handler(request) {
+      const url = new URL(request.url);
+      const hasBody = request.method !== "GET" && request.method !== "HEAD";
+      return call(new URL(url.pathname + url.search, base), {
+        method: request.method,
+        headers: request.headers,
+        body: hasBody ? request.body : void 0,
+        redirect: "manual",
+        ...hasBody ? { duplex: "half" } : {}
+      });
+    },
+    api: {
+      async getSession({ headers }) {
+        const cookie = headers.get("cookie");
+        if (!cookie) return null;
+        const response = await call(new URL("get-session", base), { headers: { cookie, accept: "application/json" } });
+        if (!response.ok) return null;
+        const body = await response.json().catch(() => null);
+        return body && body.user ? { user: body.user, session: body.session ?? null } : null;
+      }
+    }
+  };
+}
+
 // src/server.ts
 var _auth = null;
 function defineAuth(instance) {
@@ -82,10 +81,11 @@ function authMiddleware() {
   };
 }
 var AuthError = class extends Error {
-  constructor(status, redirectTo, message) {
+  constructor(status, redirectTo, message, code) {
     super(message ?? (status === 401 ? "Unauthorized" : "Forbidden"));
     this.status = status;
     this.redirectTo = redirectTo;
+    this.code = code;
     this.name = "AuthError";
   }
 };
@@ -110,6 +110,58 @@ async function requirePermission(check, opts) {
   const ok = typeof check === "function" ? check() : check;
   if (!ok) throw new AuthError(403, opts?.redirectTo);
 }
+var SESSION_COOKIE = {
+  type: "apiKey",
+  in: "cookie",
+  name: "better-auth.session_token",
+  description: "Set by sign-in. Named `__Secure-better-auth.session_token` over HTTPS."
+};
+async function sessionFor(request) {
+  const resolved = getLocals()[AUTH_LOCALS_KEY];
+  return resolved ?? getAuth().getSession(request);
+}
+function signedIn(options = {}) {
+  return {
+    async check(request) {
+      const { user, session } = await sessionFor(request);
+      if (!user || !session) throw new AuthError(401);
+      return { user, session };
+    },
+    security: { name: "session", scheme: options.scheme ?? SESSION_COOKIE },
+    refuses: [401]
+  };
+}
+function member(options = {}) {
+  const signed = signedIn(options);
+  return {
+    async check(request) {
+      const auth = await signed.check(request);
+      if (!auth.session.activeOrganizationId) {
+        throw new AuthError(403, void 0, "Choose an organisation first.", "no_active_organization");
+      }
+      const api = getAuth().raw.api;
+      if (!api.getActiveMember || !api.hasPermission) {
+        throw new Error("[@fluixi/auth] member() needs Better Auth's organization() plugin.");
+      }
+      const membership = await api.getActiveMember({ headers: request.headers });
+      if (!membership) {
+        throw new AuthError(403, void 0, "You are not a member of this organisation.", "not_a_member");
+      }
+      if (options.roles) {
+        const held = membership.role.split(",").map((role2) => role2.trim());
+        if (!options.roles.some((role2) => held.includes(role2))) throw new AuthError(403);
+      }
+      if (options.permissions) {
+        const { success } = await api.hasPermission({ headers: request.headers, body: { permissions: options.permissions } });
+        if (!success) throw new AuthError(403);
+      }
+      const { id, organizationId, userId, role } = membership;
+      return { ...auth, member: { id, organizationId, userId, role } };
+    },
+    security: signed.security,
+    refuses: [401, 403]
+  };
+}
 export {
   AuthError,
   authMiddleware,
@@ -118,11 +170,14 @@ export {
   getAuth,
   getCookie,
   getCookies,
+  member,
   mountAuthRoutes,
   optionalUser,
-  parseCookies,
+  parseCookies2 as parseCookies,
+  remoteAuth,
   requirePermission,
   requireRole,
   requireUser,
-  serializeCookie
+  serializeCookie,
+  signedIn
 };