@fluixi/auth 1.0.0-alpha.92 → 1.0.0-alpha.93

package/README.md

@@ -34,6 +34,18 @@ const admin = await requireRole('admin');     // throws AuthError(403)
 await requirePermission(() => can(user, 'edit', post));
 const maybe = await optionalUser();           // U | null
 ```
+```ts
+// API route contracts (@fluixi/api) take a guard instead: it runs before the input is read
+// and types `auth` in the handler.
+import { route } from '@fluixi/api';
+import { member, signedIn } from '@fluixi/auth/server';
+
+export const GET = route({ guard: signedIn(), handler: ({ auth }) => auth.user });
+export const DELETE = route({
+  guard: member({ roles: ['owner', 'admin'] }), // 403 no_active_organization, not_a_member, forbidden
+  handler: ({ auth }) => projects.remove(auth.member.organizationId),
+});
+```
 > The app entry must forward the request so middleware locals reach the render:
 > `export const render = (url, request) => renderRequestAsync(App, { url, request })`.
 

package/dist/client.cjs

@@ -1,4 +1,4 @@
-/*! @fluixi/auth v1.0.0-alpha.92 | (c) 2026 Ibrahima Touré and Fluixi contributors | MIT */
+/*! @fluixi/auth v1.0.0-alpha.93 | (c) 2026 Ibrahima Touré and Fluixi contributors | MIT */
 "use strict";
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
@@ -43,7 +43,7 @@ function createAuthHooks(options) {
   if (sess) {
     const apply = () => store.set({ user: sess.user(), session: null });
     apply();
-    (0, import_core.createRoot)(() => (0, import_core.createEffect)(apply));
+    (0, import_core.createRoot)(() => (0, import_core.createEffect)(apply, void 0, { name: "auth ← session" }));
   }
   const refresh = async () => {
     store.set(sess ? { user: sess.user(), session: null } : normalize(await options.client.getSession()));

package/dist/client.js

@@ -29,7 +29,7 @@ export function createAuthHooks(options) {
     if (sess) {
         const apply = () => store.set({ user: sess.user(), session: null });
         apply(); // immediate, so a first protectedRoute read isn't stale
-        createRoot(() => createEffect(apply));
+        createRoot(() => createEffect(apply, undefined, { name: 'auth ← session' }));
     }
     const refresh = async () => {
         store.set(sess ? { user: sess.user(), session: null } : normalize(await options.client.getSession()));

package/dist/client.mjs

@@ -1,4 +1,4 @@
-/*! @fluixi/auth v1.0.0-alpha.92 | (c) 2026 Ibrahima Touré and Fluixi contributors | MIT */
+/*! @fluixi/auth v1.0.0-alpha.93 | (c) 2026 Ibrahima Touré and Fluixi contributors | MIT */
 
 // src/client.ts
 import { createIsomorphicStore, createEffect, createRoot, env } from "@fluixi/core";
@@ -20,7 +20,7 @@ function createAuthHooks(options) {
   if (sess) {
     const apply = () => store.set({ user: sess.user(), session: null });
     apply();
-    createRoot(() => createEffect(apply));
+    createRoot(() => createEffect(apply, void 0, { name: "auth ← session" }));
   }
   const refresh = async () => {
     store.set(sess ? { user: sess.user(), session: null } : normalize(await options.client.getSession()));

package/dist/cookies.cjs

@@ -20,53 +20,24 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/cookies.ts
 var cookies_exports = {};
 __export(cookies_exports, {
-  deleteCookie: () => deleteCookie,
+  deleteCookie: () => import_cookie2.deleteCookie,
   getCookie: () => getCookie,
   getCookies: () => getCookies,
-  parseCookies: () => parseCookies,
-  serializeCookie: () => serializeCookie
+  isValidCookieName: () => import_cookie2.isValidCookieName,
+  parseCookies: () => import_cookie2.parseCookies,
+  serializeCookie: () => import_cookie2.serializeCookie
 });
 module.exports = __toCommonJS(cookies_exports);
 var import_server = require("@fluixi/server");
-function parseCookies(header) {
-  const out = {};
-  if (!header) return out;
-  for (const part of header.split(";")) {
-    const eq = part.indexOf("=");
-    if (eq < 0) continue;
-    const k = part.slice(0, eq).trim();
-    if (k) out[k] = decodeURIComponent(part.slice(eq + 1).trim());
-  }
-  return out;
-}
-function serializeCookie(name, value, opts = {}) {
-  const o = {
-    path: "/",
-    httpOnly: true,
-    secure: true,
-    sameSite: "lax",
-    ...opts
-  };
-  let s = `${name}=${encodeURIComponent(value)}`;
-  if (o.maxAge != null) s += `; Max-Age=${Math.floor(o.maxAge)}`;
-  if (o.expires) s += `; Expires=${o.expires.toUTCString()}`;
-  if (o.domain) s += `; Domain=${o.domain}`;
-  s += `; Path=${o.path}`;
-  if (o.httpOnly) s += "; HttpOnly";
-  if (o.secure) s += "; Secure";
-  s += `; SameSite=${o.sameSite[0].toUpperCase()}${o.sameSite.slice(1)}`;
-  return s;
-}
-function deleteCookie(name, opts = {}) {
-  return serializeCookie(name, "", { ...opts, maxAge: 0 });
-}
+var import_cookie = require("@fluixi/utils/cookie");
+var import_cookie2 = require("@fluixi/utils/cookie");
 function requestHeaders() {
   const req = (0, import_server.getRequestEvent)()?.request;
   return req?.headers ?? null;
 }
 function getCookie(name) {
-  return parseCookies(requestHeaders()?.get("cookie"))[name] ?? null;
+  return (0, import_cookie.parseCookies)(requestHeaders()?.get("cookie"))[name] ?? null;
 }
 function getCookies() {
-  return parseCookies(requestHeaders()?.get("cookie"));
+  return (0, import_cookie.parseCookies)(requestHeaders()?.get("cookie"));
 }

package/dist/cookies.d.ts

@@ -1,18 +1,5 @@
-export interface CookieOptions {
-    maxAge?: number;
-    expires?: Date;
-    path?: string;
-    domain?: string;
-    secure?: boolean;
-    httpOnly?: boolean;
-    sameSite?: 'strict' | 'lax' | 'none';
-}
-/** Parse a `Cookie:` header into a record. */
-export declare function parseCookies(header: string | null | undefined): Record<string, string>;
-/** Serialize a cookie into a `Set-Cookie` value. Secure by default. */
-export declare function serializeCookie(name: string, value: string, opts?: CookieOptions): string;
-/** A `Set-Cookie` string that deletes a cookie (Max-Age=0). */
-export declare function deleteCookie(name: string, opts?: Pick<CookieOptions, 'path' | 'domain'>): string;
+export { parseCookies, serializeCookie, deleteCookie, isValidCookieName } from '@fluixi/utils/cookie';
+export type { CookieOptions } from '@fluixi/utils/cookie';
 /** Read one cookie from the CURRENT request (request-scoped). */
 export declare function getCookie(name: string): string | null;
 /** All cookies on the current request. */

package/dist/cookies.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cookies.d.ts","sourceRoot":"","sources":["../src/cookies.ts"],"names":[],"mappings":"AAQA,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,IAAI,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,QAAQ,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;CACtC;AAED,8CAA8C;AAC9C,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAUtF;AAED,uEAAuE;AACvE,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,GAAE,aAAkB,GAAG,MAAM,CAiB7F;AAED,+DAA+D;AAC/D,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,IAAI,CAAC,aAAa,EAAE,MAAM,GAAG,QAAQ,CAAM,GAAG,MAAM,CAEpG;AAOD,iEAAiE;AACjE,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAErD;AAED,0CAA0C;AAC1C,wBAAgB,UAAU,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAEnD"}
+{"version":3,"file":"cookies.d.ts","sourceRoot":"","sources":["../src/cookies.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACtG,YAAY,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAO1D,iEAAiE;AACjE,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAErD;AAED,0CAA0C;AAC1C,wBAAgB,UAAU,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAEnD"}

package/dist/cookies.js

@@ -1,53 +1,10 @@
 /**
- * Cookie API: proper, secure-by-default cookie management for auth (and anything else).
- * Parsing + request-scoped reads work standalone; `serializeCookie` builds a spec-compliant
- * `Set-Cookie` string with safe defaults (HttpOnly, Secure, SameSite=Lax, Path=/) that
- * middleware appends to its Response (`response.headers.append('set-cookie', …)`).
+ * Request-scoped cookie reads. The codec lives in `@fluixi/utils/cookie` and is re-exported
+ * here; middleware appends `serializeCookie` output to its Response's `set-cookie` header.
  */
 import { getRequestEvent } from '@fluixi/server';
-/** Parse a `Cookie:` header into a record. */
-export function parseCookies(header) {
-    const out = {};
-    if (!header)
-        return out;
-    for (const part of header.split(';')) {
-        const eq = part.indexOf('=');
-        if (eq < 0)
-            continue;
-        const k = part.slice(0, eq).trim();
-        if (k)
-            out[k] = decodeURIComponent(part.slice(eq + 1).trim());
-    }
-    return out;
-}
-/** Serialize a cookie into a `Set-Cookie` value. Secure by default. */
-export function serializeCookie(name, value, opts = {}) {
-    const o = {
-        path: '/',
-        httpOnly: true,
-        secure: true,
-        sameSite: 'lax',
-        ...opts,
-    };
-    let s = `${name}=${encodeURIComponent(value)}`;
-    if (o.maxAge != null)
-        s += `; Max-Age=${Math.floor(o.maxAge)}`;
-    if (o.expires)
-        s += `; Expires=${o.expires.toUTCString()}`;
-    if (o.domain)
-        s += `; Domain=${o.domain}`;
-    s += `; Path=${o.path}`;
-    if (o.httpOnly)
-        s += '; HttpOnly';
-    if (o.secure)
-        s += '; Secure';
-    s += `; SameSite=${o.sameSite[0].toUpperCase()}${o.sameSite.slice(1)}`;
-    return s;
-}
-/** A `Set-Cookie` string that deletes a cookie (Max-Age=0). */
-export function deleteCookie(name, opts = {}) {
-    return serializeCookie(name, '', { ...opts, maxAge: 0 });
-}
+import { parseCookies } from '@fluixi/utils/cookie';
+export { parseCookies, serializeCookie, deleteCookie, isValidCookieName } from '@fluixi/utils/cookie';
 function requestHeaders() {
     const req = getRequestEvent()?.request;
     return req?.headers ?? null;

package/dist/cookies.mjs

@@ -1,37 +1,7 @@
 // src/cookies.ts
 import { getRequestEvent } from "@fluixi/server";
-function parseCookies(header) {
-  const out = {};
-  if (!header) return out;
-  for (const part of header.split(";")) {
-    const eq = part.indexOf("=");
-    if (eq < 0) continue;
-    const k = part.slice(0, eq).trim();
-    if (k) out[k] = decodeURIComponent(part.slice(eq + 1).trim());
-  }
-  return out;
-}
-function serializeCookie(name, value, opts = {}) {
-  const o = {
-    path: "/",
-    httpOnly: true,
-    secure: true,
-    sameSite: "lax",
-    ...opts
-  };
-  let s = `${name}=${encodeURIComponent(value)}`;
-  if (o.maxAge != null) s += `; Max-Age=${Math.floor(o.maxAge)}`;
-  if (o.expires) s += `; Expires=${o.expires.toUTCString()}`;
-  if (o.domain) s += `; Domain=${o.domain}`;
-  s += `; Path=${o.path}`;
-  if (o.httpOnly) s += "; HttpOnly";
-  if (o.secure) s += "; Secure";
-  s += `; SameSite=${o.sameSite[0].toUpperCase()}${o.sameSite.slice(1)}`;
-  return s;
-}
-function deleteCookie(name, opts = {}) {
-  return serializeCookie(name, "", { ...opts, maxAge: 0 });
-}
+import { parseCookies } from "@fluixi/utils/cookie";
+import { parseCookies as parseCookies2, serializeCookie, deleteCookie, isValidCookieName } from "@fluixi/utils/cookie";
 function requestHeaders() {
   const req = getRequestEvent()?.request;
   return req?.headers ?? null;
@@ -46,6 +16,7 @@ export {
   deleteCookie,
   getCookie,
   getCookies,
-  parseCookies,
+  isValidCookieName,
+  parseCookies2 as parseCookies,
   serializeCookie
 };

package/dist/remote.cjs

@@ -0,0 +1,52 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/remote.ts
+var remote_exports = {};
+__export(remote_exports, {
+  remoteAuth: () => remoteAuth
+});
+module.exports = __toCommonJS(remote_exports);
+function remoteAuth(options) {
+  const base = new URL((options.basePath ?? "/api/auth").replace(/\/$/, "") + "/", options.url);
+  const call = (input, init) => (options.fetch ?? globalThis.fetch)(input, init);
+  return {
+    async handler(request) {
+      const url = new URL(request.url);
+      const hasBody = request.method !== "GET" && request.method !== "HEAD";
+      return call(new URL(url.pathname + url.search, base), {
+        method: request.method,
+        headers: request.headers,
+        body: hasBody ? request.body : void 0,
+        redirect: "manual",
+        ...hasBody ? { duplex: "half" } : {}
+      });
+    },
+    api: {
+      async getSession({ headers }) {
+        const cookie = headers.get("cookie");
+        if (!cookie) return null;
+        const response = await call(new URL("get-session", base), { headers: { cookie, accept: "application/json" } });
+        if (!response.ok) return null;
+        const body = await response.json().catch(() => null);
+        return body && body.user ? { user: body.user, session: body.session ?? null } : null;
+      }
+    }
+  };
+}

package/dist/remote.d.ts

@@ -0,0 +1,20 @@
+/**
+ * An auth engine that lives in another service. A web app whose Better Auth runs in its API
+ * registers this with `defineAuth(remoteAuth({ url }))`; `authMiddleware()`, `requireUser()` and
+ * the client hooks then work as they would with the engine in-process, each session read being
+ * one request to the API with the visitor's cookie.
+ *
+ * The API's guards (`member()`, `hasPermission`) call the engine directly and stay there: a web
+ * app reads the session, the API decides what it may do.
+ */
+import type { BetterAuthServer } from './types.js';
+export interface RemoteAuthOptions {
+    /** The API's origin, `http://localhost:3301`. */
+    url: string;
+    /** Where the API mounts its auth routes. `/api/auth` by default. */
+    basePath?: string;
+    /** `globalThis.fetch` by default. */
+    fetch?: typeof fetch;
+}
+export declare function remoteAuth(options: RemoteAuthOptions): BetterAuthServer;
+//# sourceMappingURL=remote.d.ts.map

package/dist/remote.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote.d.ts","sourceRoot":"","sources":["../src/remote.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEnD,MAAM,WAAW,iBAAiB;IAChC,iDAAiD;IACjD,GAAG,EAAE,MAAM,CAAC;IACZ,oEAAoE;IACpE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qCAAqC;IACrC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACtB;AAED,wBAAgB,UAAU,CAAC,OAAO,EAAE,iBAAiB,GAAG,gBAAgB,CA4BvE"}

package/dist/remote.js

@@ -0,0 +1,30 @@
+export function remoteAuth(options) {
+    const base = new URL((options.basePath ?? '/api/auth').replace(/\/$/, '') + '/', options.url);
+    const call = (input, init) => (options.fetch ?? globalThis.fetch)(input, init);
+    return {
+        async handler(request) {
+            const url = new URL(request.url);
+            const hasBody = request.method !== 'GET' && request.method !== 'HEAD';
+            return call(new URL(url.pathname + url.search, base), {
+                method: request.method,
+                headers: request.headers,
+                body: hasBody ? request.body : undefined,
+                redirect: 'manual',
+                ...(hasBody ? { duplex: 'half' } : {}),
+            });
+        },
+        api: {
+            async getSession({ headers }) {
+                const cookie = headers.get('cookie');
+                // No cookie, no session: spare the API a request from every visitor.
+                if (!cookie)
+                    return null;
+                const response = await call(new URL('get-session', base), { headers: { cookie, accept: 'application/json' } });
+                if (!response.ok)
+                    return null;
+                const body = (await response.json().catch(() => null));
+                return body && body.user ? { user: body.user, session: body.session ?? null } : null;
+            },
+        },
+    };
+}

package/dist/remote.mjs

@@ -0,0 +1,31 @@
+// src/remote.ts
+function remoteAuth(options) {
+  const base = new URL((options.basePath ?? "/api/auth").replace(/\/$/, "") + "/", options.url);
+  const call = (input, init) => (options.fetch ?? globalThis.fetch)(input, init);
+  return {
+    async handler(request) {
+      const url = new URL(request.url);
+      const hasBody = request.method !== "GET" && request.method !== "HEAD";
+      return call(new URL(url.pathname + url.search, base), {
+        method: request.method,
+        headers: request.headers,
+        body: hasBody ? request.body : void 0,
+        redirect: "manual",
+        ...hasBody ? { duplex: "half" } : {}
+      });
+    },
+    api: {
+      async getSession({ headers }) {
+        const cookie = headers.get("cookie");
+        if (!cookie) return null;
+        const response = await call(new URL("get-session", base), { headers: { cookie, accept: "application/json" } });
+        if (!response.ok) return null;
+        const body = await response.json().catch(() => null);
+        return body && body.user ? { user: body.user, session: body.session ?? null } : null;
+      }
+    }
+  };
+}
+export {
+  remoteAuth
+};

package/dist/server.cjs

@@ -1,4 +1,4 @@
-/*! @fluixi/auth v1.0.0-alpha.92 | (c) 2026 Ibrahima Touré and Fluixi contributors | MIT */
+/*! @fluixi/auth v1.0.0-alpha.93 | (c) 2026 Ibrahima Touré and Fluixi contributors | MIT */
 "use strict";
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
@@ -24,17 +24,20 @@ __export(server_exports, {
   AuthError: () => AuthError,
   authMiddleware: () => authMiddleware,
   defineAuth: () => defineAuth,
-  deleteCookie: () => deleteCookie,
+  deleteCookie: () => import_cookie2.deleteCookie,
   getAuth: () => getAuth,
   getCookie: () => getCookie,
   getCookies: () => getCookies,
+  member: () => member,
   mountAuthRoutes: () => mountAuthRoutes,
   optionalUser: () => optionalUser,
-  parseCookies: () => parseCookies,
+  parseCookies: () => import_cookie2.parseCookies,
+  remoteAuth: () => remoteAuth,
   requirePermission: () => requirePermission,
   requireRole: () => requireRole,
   requireUser: () => requireUser,
-  serializeCookie: () => serializeCookie
+  serializeCookie: () => import_cookie2.serializeCookie,
+  signedIn: () => signedIn
 });
 module.exports = __toCommonJS(server_exports);
 var import_server2 = require("@fluixi/server");
@@ -44,47 +47,46 @@ var AUTH_LOCALS_KEY = "auth";
 
 // src/cookies.ts
 var import_server = require("@fluixi/server");
-function parseCookies(header) {
-  const out = {};
-  if (!header) return out;
-  for (const part of header.split(";")) {
-    const eq = part.indexOf("=");
-    if (eq < 0) continue;
-    const k = part.slice(0, eq).trim();
-    if (k) out[k] = decodeURIComponent(part.slice(eq + 1).trim());
-  }
-  return out;
-}
-function serializeCookie(name, value, opts = {}) {
-  const o = {
-    path: "/",
-    httpOnly: true,
-    secure: true,
-    sameSite: "lax",
-    ...opts
-  };
-  let s = `${name}=${encodeURIComponent(value)}`;
-  if (o.maxAge != null) s += `; Max-Age=${Math.floor(o.maxAge)}`;
-  if (o.expires) s += `; Expires=${o.expires.toUTCString()}`;
-  if (o.domain) s += `; Domain=${o.domain}`;
-  s += `; Path=${o.path}`;
-  if (o.httpOnly) s += "; HttpOnly";
-  if (o.secure) s += "; Secure";
-  s += `; SameSite=${o.sameSite[0].toUpperCase()}${o.sameSite.slice(1)}`;
-  return s;
-}
-function deleteCookie(name, opts = {}) {
-  return serializeCookie(name, "", { ...opts, maxAge: 0 });
-}
+var import_cookie = require("@fluixi/utils/cookie");
+var import_cookie2 = require("@fluixi/utils/cookie");
 function requestHeaders() {
   const req = (0, import_server.getRequestEvent)()?.request;
   return req?.headers ?? null;
 }
 function getCookie(name) {
-  return parseCookies(requestHeaders()?.get("cookie"))[name] ?? null;
+  return (0, import_cookie.parseCookies)(requestHeaders()?.get("cookie"))[name] ?? null;
 }
 function getCookies() {
-  return parseCookies(requestHeaders()?.get("cookie"));
+  return (0, import_cookie.parseCookies)(requestHeaders()?.get("cookie"));
+}
+
+// src/remote.ts
+function remoteAuth(options) {
+  const base = new URL((options.basePath ?? "/api/auth").replace(/\/$/, "") + "/", options.url);
+  const call = (input, init) => (options.fetch ?? globalThis.fetch)(input, init);
+  return {
+    async handler(request) {
+      const url = new URL(request.url);
+      const hasBody = request.method !== "GET" && request.method !== "HEAD";
+      return call(new URL(url.pathname + url.search, base), {
+        method: request.method,
+        headers: request.headers,
+        body: hasBody ? request.body : void 0,
+        redirect: "manual",
+        ...hasBody ? { duplex: "half" } : {}
+      });
+    },
+    api: {
+      async getSession({ headers }) {
+        const cookie = headers.get("cookie");
+        if (!cookie) return null;
+        const response = await call(new URL("get-session", base), { headers: { cookie, accept: "application/json" } });
+        if (!response.ok) return null;
+        const body = await response.json().catch(() => null);
+        return body && body.user ? { user: body.user, session: body.session ?? null } : null;
+      }
+    }
+  };
 }
 
 // src/server.ts
@@ -118,10 +120,11 @@ function authMiddleware() {
   };
 }
 var AuthError = class extends Error {
-  constructor(status, redirectTo, message) {
+  constructor(status, redirectTo, message, code) {
     super(message ?? (status === 401 ? "Unauthorized" : "Forbidden"));
     this.status = status;
     this.redirectTo = redirectTo;
+    this.code = code;
     this.name = "AuthError";
   }
 };
@@ -146,3 +149,55 @@ async function requirePermission(check, opts) {
   const ok = typeof check === "function" ? check() : check;
   if (!ok) throw new AuthError(403, opts?.redirectTo);
 }
+var SESSION_COOKIE = {
+  type: "apiKey",
+  in: "cookie",
+  name: "better-auth.session_token",
+  description: "Set by sign-in. Named `__Secure-better-auth.session_token` over HTTPS."
+};
+async function sessionFor(request) {
+  const resolved = (0, import_server2.getLocals)()[AUTH_LOCALS_KEY];
+  return resolved ?? getAuth().getSession(request);
+}
+function signedIn(options = {}) {
+  return {
+    async check(request) {
+      const { user, session } = await sessionFor(request);
+      if (!user || !session) throw new AuthError(401);
+      return { user, session };
+    },
+    security: { name: "session", scheme: options.scheme ?? SESSION_COOKIE },
+    refuses: [401]
+  };
+}
+function member(options = {}) {
+  const signed = signedIn(options);
+  return {
+    async check(request) {
+      const auth = await signed.check(request);
+      if (!auth.session.activeOrganizationId) {
+        throw new AuthError(403, void 0, "Choose an organisation first.", "no_active_organization");
+      }
+      const api = getAuth().raw.api;
+      if (!api.getActiveMember || !api.hasPermission) {
+        throw new Error("[@fluixi/auth] member() needs Better Auth's organization() plugin.");
+      }
+      const membership = await api.getActiveMember({ headers: request.headers });
+      if (!membership) {
+        throw new AuthError(403, void 0, "You are not a member of this organisation.", "not_a_member");
+      }
+      if (options.roles) {
+        const held = membership.role.split(",").map((role2) => role2.trim());
+        if (!options.roles.some((role2) => held.includes(role2))) throw new AuthError(403);
+      }
+      if (options.permissions) {
+        const { success } = await api.hasPermission({ headers: request.headers, body: { permissions: options.permissions } });
+        if (!success) throw new AuthError(403);
+      }
+      const { id, organizationId, userId, role } = membership;
+      return { ...auth, member: { id, organizationId, userId, role } };
+    },
+    security: signed.security,
+    refuses: [401, 403]
+  };
+}