@fougere/auth-better 0.12.2-alpha.0 → 0.12.5-alpha.0

package/README.md

@@ -2,7 +2,9 @@
 > Fougere's auth
 A translation layer onto [better-auth](https://better-auth.com): its writes go through
 Fougere's storage, and the application's `User` stays its own — Session and Account are
-built against it.
+built against it. `betterAuth()` is a frond, `fronds: { auth: betterAuth({ … }) }`: it holds
+those rows, and carries the extension that registers the runtime under `AUTH` wherever the
+frond is served.
 
 ## Installation
 ```bash

package/dist/entity/AuthUser.d.ts

@@ -1,4 +1,4 @@
-declare const AuthUser_base: import("@fougere/schema").SchemaConstructor<{
+declare const User_base: import("@fougere/schema").SchemaConstructor<{
     id: import("@fougere/schema").Field<string>;
     name: import("@fougere/schema").Field<string>;
     email: import("@fougere/schema").Field<string>;
@@ -7,8 +7,8 @@ declare const AuthUser_base: import("@fougere/schema").SchemaConstructor<{
     createdAt: import("@fougere/schema").Field<Date>;
     updatedAt: import("@fougere/schema").Field<Date>;
 }>;
-/** Default User entity — shipped as a fallback. */
-export declare class AuthUser extends AuthUser_base {
+/** The user better-auth writes when the app names none — `User`, since the model is `user`. */
+declare class User extends User_base {
 }
-export {};
+export { User as AuthUser };
 //# sourceMappingURL=AuthUser.d.ts.map

package/dist/entity/AuthUser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AuthUser.d.ts","sourceRoot":"","sources":["../../src/entity/AuthUser.ts"],"names":[],"mappings":";;;;;;;;;AAEA,mDAAmD;AACnD,qBAAa,QAAS,SAAQ,aAQ5B;CAAG"}
+{"version":3,"file":"AuthUser.d.ts","sourceRoot":"","sources":["../../src/entity/AuthUser.ts"],"names":[],"mappings":";;;;;;;;;AAEA,+FAA+F;AAC/F,cAAM,IAAK,SAAQ,SAQjB;CAAG;AAEL,OAAO,EAAE,IAAI,IAAI,QAAQ,EAAE,CAAC"}

package/dist/entity/AuthUser.js

@@ -1,6 +1,6 @@
 import { entity, primary, text, bool, created, optional } from '@fougere/schema';
-/** Default User entity — shipped as a fallback. */
-export class AuthUser extends entity({
+/** The user better-auth writes when the app names none — `User`, since the model is `user`. */
+class User extends entity({
     id: primary(),
     name: text(),
     email: text(),
@@ -10,4 +10,5 @@ export class AuthUser extends entity({
     updatedAt: created(),
 }) {
 }
+export { User as AuthUser };
 //# sourceMappingURL=AuthUser.js.map

package/dist/entity/AuthUser.js.map

@@ -1 +1 @@
-{"version":3,"file":"AuthUser.js","sourceRoot":"","sources":["../../src/entity/AuthUser.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAEjF,mDAAmD;AACnD,MAAM,OAAO,QAAS,SAAQ,MAAM,CAAC;IACnC,EAAE,EAAE,OAAO,EAAE;IACb,IAAI,EAAE,IAAI,EAAE;IACZ,KAAK,EAAE,IAAI,EAAE;IACb,aAAa,EAAE,IAAI,EAAE;IACrB,KAAK,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;IACvB,SAAS,EAAE,OAAO,EAAE;IACpB,SAAS,EAAE,OAAO,EAAE;CACrB,CAAC;CAAG"}
+{"version":3,"file":"AuthUser.js","sourceRoot":"","sources":["../../src/entity/AuthUser.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAEjF,+FAA+F;AAC/F,MAAM,IAAK,SAAQ,MAAM,CAAC;IACxB,EAAE,EAAE,OAAO,EAAE;IACb,IAAI,EAAE,IAAI,EAAE;IACZ,KAAK,EAAE,IAAI,EAAE;IACb,aAAa,EAAE,IAAI,EAAE;IACrB,KAAK,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;IACvB,SAAS,EAAE,OAAO,EAAE;IACpB,SAAS,EAAE,OAAO,EAAE;CACrB,CAAC;CAAG;AAEL,OAAO,EAAE,IAAI,IAAI,QAAQ,EAAE,CAAC"}

package/dist/entity/AuthVerification.d.ts

@@ -1,4 +1,4 @@
-declare const AuthVerification_base: import("@fougere/schema").SchemaConstructor<{
+declare const Verification_base: import("@fougere/schema").SchemaConstructor<{
     id: import("@fougere/schema").Field<string>;
     identifier: import("@fougere/schema").Field<string>;
     value: import("@fougere/schema").Field<string>;
@@ -10,7 +10,7 @@ declare const AuthVerification_base: import("@fougere/schema").SchemaConstructor
  * Default Verification entity — better-auth shape.
  * Used for email verification, password reset, magic links, etc.
  */
-export declare class AuthVerification extends AuthVerification_base {
+declare class Verification extends Verification_base {
 }
-export {};
+export { Verification as AuthVerification };
 //# sourceMappingURL=AuthVerification.d.ts.map

package/dist/entity/AuthVerification.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AuthVerification.d.ts","sourceRoot":"","sources":["../../src/entity/AuthVerification.ts"],"names":[],"mappings":";;;;;;;;AAEA;;;GAGG;AACH,qBAAa,gBAAiB,SAAQ,qBAOpC;CAAG"}
+{"version":3,"file":"AuthVerification.d.ts","sourceRoot":"","sources":["../../src/entity/AuthVerification.ts"],"names":[],"mappings":";;;;;;;;AAEA;;;GAGG;AACH,cAAM,YAAa,SAAQ,iBAOzB;CAAG;AAEL,OAAO,EAAE,YAAY,IAAI,gBAAgB,EAAE,CAAC"}

package/dist/entity/AuthVerification.js

@@ -3,7 +3,7 @@ import { entity, primary, text, date, created } from '@fougere/schema';
  * Default Verification entity — better-auth shape.
  * Used for email verification, password reset, magic links, etc.
  */
-export class AuthVerification extends entity({
+class Verification extends entity({
     id: primary(),
     identifier: text(),
     value: text(),
@@ -12,4 +12,5 @@ export class AuthVerification extends entity({
     updatedAt: created(),
 }) {
 }
+export { Verification as AuthVerification };
 //# sourceMappingURL=AuthVerification.js.map

package/dist/entity/AuthVerification.js.map

@@ -1 +1 @@
-{"version":3,"file":"AuthVerification.js","sourceRoot":"","sources":["../../src/entity/AuthVerification.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAEvE;;;GAGG;AACH,MAAM,OAAO,gBAAiB,SAAQ,MAAM,CAAC;IAC3C,EAAE,EAAE,OAAO,EAAE;IACb,UAAU,EAAE,IAAI,EAAE;IAClB,KAAK,EAAE,IAAI,EAAE;IACb,SAAS,EAAE,IAAI,EAAE;IACjB,SAAS,EAAE,OAAO,EAAE;IACpB,SAAS,EAAE,OAAO,EAAE;CACrB,CAAC;CAAG"}
+{"version":3,"file":"AuthVerification.js","sourceRoot":"","sources":["../../src/entity/AuthVerification.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAEvE;;;GAGG;AACH,MAAM,YAAa,SAAQ,MAAM,CAAC;IAChC,EAAE,EAAE,OAAO,EAAE;IACb,UAAU,EAAE,IAAI,EAAE;IAClB,KAAK,EAAE,IAAI,EAAE;IACb,SAAS,EAAE,IAAI,EAAE;IACjB,SAAS,EAAE,OAAO,EAAE;IACpB,SAAS,EAAE,OAAO,EAAE;CACrB,CAAC;CAAG;AAEL,OAAO,EAAE,YAAY,IAAI,gBAAgB,EAAE,CAAC"}

package/dist/entity/authEntities.js

@@ -5,7 +5,7 @@ export function authEntities(User) {
      * Session entity — better-auth shape.
      * `token` carries the opaque session secret (cookie value).
      */
-    class AuthSession extends entity({
+    class Session extends entity({
         id: primary(),
         userId: ref(target),
         token: text(),
@@ -20,7 +20,7 @@ export function authEntities(User) {
      * Account entity — better-auth shape (single PK, accountId/providerId pair,
      * separate token columns instead of a JSON blob).
      */
-    class AuthAccount extends entity({
+    class Account extends entity({
         id: primary(),
         accountId: text(),
         providerId: text(),
@@ -36,6 +36,6 @@ export function authEntities(User) {
         updatedAt: created(),
     }) {
     }
-    return { AuthSession, AuthAccount };
+    return { AuthSession: Session, AuthAccount: Account };
 }
 //# sourceMappingURL=authEntities.js.map

package/dist/entity/authEntities.js.map

@@ -1 +1 @@
-{"version":3,"file":"authEntities.js","sourceRoot":"","sources":["../../src/entity/authEntities.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAmB,MAAM,iBAAiB,CAAC;AAKvG,MAAM,UAAU,YAAY,CAAC,IAAgB;IAI3C,MAAM,MAAM,GAAG,IAA6B,CAAC;IAE7C;;;OAGG;IACH,MAAM,WAAY,SAAQ,MAAM,CAAC;QAC/B,EAAE,EAAE,OAAO,EAAE;QACb,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC;QACnB,KAAK,EAAE,IAAI,EAAE;QACb,SAAS,EAAE,IAAI,EAAE;QACjB,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC3B,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC3B,SAAS,EAAE,OAAO,EAAE;QACpB,SAAS,EAAE,OAAO,EAAE;KACrB,CAAC;KAAG;IAEL;;;OAGG;IACH,MAAM,WAAY,SAAQ,MAAM,CAAC;QAC/B,EAAE,EAAE,OAAO,EAAE;QACb,SAAS,EAAE,IAAI,EAAE;QACjB,UAAU,EAAE,IAAI,EAAE;QAClB,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC;QACnB,WAAW,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC7B,YAAY,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC9B,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;QACzB,oBAAoB,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;QACtC,qBAAqB,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;QACvC,KAAK,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;QACvB,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC1B,SAAS,EAAE,OAAO,EAAE;QACpB,SAAS,EAAE,OAAO,EAAE;KACrB,CAAC;KAAG;IAEL,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC;AACtC,CAAC"}
+{"version":3,"file":"authEntities.js","sourceRoot":"","sources":["../../src/entity/authEntities.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAmB,MAAM,iBAAiB,CAAC;AAKvG,MAAM,UAAU,YAAY,CAAC,IAAgB;IAI3C,MAAM,MAAM,GAAG,IAA6B,CAAC;IAE7C;;;OAGG;IACH,MAAM,OAAQ,SAAQ,MAAM,CAAC;QAC3B,EAAE,EAAE,OAAO,EAAE;QACb,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC;QACnB,KAAK,EAAE,IAAI,EAAE;QACb,SAAS,EAAE,IAAI,EAAE;QACjB,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC3B,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC3B,SAAS,EAAE,OAAO,EAAE;QACpB,SAAS,EAAE,OAAO,EAAE;KACrB,CAAC;KAAG;IAEL;;;OAGG;IACH,MAAM,OAAQ,SAAQ,MAAM,CAAC;QAC3B,EAAE,EAAE,OAAO,EAAE;QACb,SAAS,EAAE,IAAI,EAAE;QACjB,UAAU,EAAE,IAAI,EAAE;QAClB,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC;QACnB,WAAW,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC7B,YAAY,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC9B,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;QACzB,oBAAoB,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;QACtC,qBAAqB,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;QACvC,KAAK,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;QACvB,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC1B,SAAS,EAAE,OAAO,EAAE;QACpB,SAAS,EAAE,OAAO,EAAE;KACrB,CAAC;KAAG;IAEL,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC;AACxD,CAAC"}

package/dist/index.d.ts

@@ -1,8 +1,8 @@
-import type { AuthConfig } from '@fougere/core';
-import type { SchemaView } from '@fougere/schema';
+import { type FrondDescriptor } from '@fougere/core';
+import { type SchemaView } from '@fougere/schema';
 import { type FougereProviders } from './FougereProviders.js';
 export { AuthUser } from './entity/AuthUser.js';
-/** Options accepted by the betterAuth() factory in fougere.config.ts. */
+/** What `fronds: { '@fougere/auth-better': { … } }` hands the factory in fougere.config.ts. */
 export interface BetterAuthOptions {
     user?: SchemaView;
     secret: string;
@@ -15,6 +15,13 @@ export interface BetterAuthOptions {
     account?: SchemaView;
     verification?: SchemaView;
 }
-/** Factory used in fougere.config.ts. */
-export declare function betterAuth(opts: BetterAuthOptions): AuthConfig;
+/**
+ * The auth provider, as a frond: its rows — the user too, when the app names none — and the
+ * extension that rises where it is served, declaring what a signed-in call carries and
+ * registering the runtime under `AUTH`. Placed like any frond: a process whose `only:` leaves it
+ * out starts no engine and migrates no session table. The session travels without its
+ * `token`: a process trusts the one that called it, never the cookie of whoever is behind it.
+ */
+export declare function betterAuth(opts: BetterAuthOptions): FrondDescriptor;
+export default betterAuth;
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAA4B,MAAM,eAAe,CAAC;AAC1E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAKlD,OAAO,EAA0D,KAAK,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAEtH,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAEhD,yEAAyE;AACzE,MAAM,WAAW,iBAAiB;IAChC,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,gBAAgB,CAAC;IAC7B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,UAAU,CAAC;IACrB,OAAO,CAAC,EAAE,UAAU,CAAC;IACrB,YAAY,CAAC,EAAE,UAAU,CAAC;CAC3B;AAED,yCAAyC;AACzC,wBAAgB,UAAU,CAAC,IAAI,EAAE,iBAAiB,GAAG,UAAU,CAmD9D"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAA2C,KAAK,eAAe,EAAgB,MAAM,eAAe,CAAC;AAC5G,OAAO,EAAiC,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAKjF,OAAO,EAA0D,KAAK,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAEtH,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAEhD,+FAA+F;AAC/F,MAAM,WAAW,iBAAiB;IAChC,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,gBAAgB,CAAC;IAC7B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,UAAU,CAAC;IACrB,OAAO,CAAC,EAAE,UAAU,CAAC;IACrB,YAAY,CAAC,EAAE,UAAU,CAAC;CAC3B;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,iBAAiB,GAAG,eAAe,CAqCnE;eAEc,UAAU"}

package/dist/index.js

@@ -1,59 +1,64 @@
 import { betterAuth as betterAuthLib } from 'better-auth';
 import { createId } from '@paralleldrive/cuid2';
+import { AUTH, frond } from '@fougere/core';
+import { json, lowerFirst } from '@fougere/schema';
 import { AuthUser } from './entity/AuthUser.js';
 import { AuthVerification } from './entity/AuthVerification.js';
 import { authEntities } from './entity/authEntities.js';
 import { fougereAdapter } from './adapter.js';
 import { translateCredential, translatePlugins, translateSocial } from './FougereProviders.js';
 export { AuthUser } from './entity/AuthUser.js';
-/** Factory used in fougere.config.ts. */
+/**
+ * The auth provider, as a frond: its rows — the user too, when the app names none — and the
+ * extension that rises where it is served, declaring what a signed-in call carries and
+ * registering the runtime under `AUTH`. Placed like any frond: a process whose `only:` leaves it
+ * out starts no engine and migrates no session table. The session travels without its
+ * `token`: a process trusts the one that called it, never the cookie of whoever is behind it.
+ */
 export function betterAuth(opts) {
-    const userSchema = opts.user ?? AuthUser;
-    const { AuthSession, AuthAccount } = authEntities(userSchema);
-    const sessionSchema = opts.session ?? AuthSession;
-    const accountSchema = opts.account ?? AuthAccount;
-    const verificationSchema = opts.verification ?? AuthVerification;
+    const user = opts.user ?? AuthUser;
+    const { AuthSession, AuthAccount } = authEntities(user);
+    const models = {
+        user,
+        session: opts.session ?? AuthSession,
+        account: opts.account ?? AuthAccount,
+        verification: opts.verification ?? AuthVerification,
+    };
+    const brought = Object.values(models).filter((schema) => schema !== opts.user);
     const providers = opts.providers ?? {};
     const basePath = opts.basePath ?? '/auth';
-    return {
-        entities: {
-            user: userSchema,
-            session: sessionSchema,
-            account: accountSchema,
-            verification: verificationSchema,
-        },
-        create({ storageFactory }) {
-            const storageMap = new Map([
-                ['user', storageFactory(userSchema, 'user')],
-                ['session', storageFactory(sessionSchema, 'session')],
-                ['account', storageFactory(accountSchema, 'account')],
-                ['verification', storageFactory(verificationSchema, 'verification')],
-            ]);
-            const engine = betterAuthLib({
-                database: fougereAdapter(storageMap),
-                secret: opts.secret,
-                baseURL: opts.baseUrl,
-                basePath,
-                trustedOrigins: opts.trustedOrigins,
-                advanced: { database: { generateId: () => createId() } },
-                session: opts.sessionTtl ? { expiresIn: opts.sessionTtl / 1000 } : undefined,
-                emailAndPassword: translateCredential(providers),
-                socialProviders: translateSocial(providers),
-                plugins: translatePlugins(providers),
-            });
-            return {
-                entities: {
-                    user: userSchema,
-                    session: sessionSchema,
-                    account: accountSchema,
-                    verification: verificationSchema,
+    return frond('auth', {
+        entities: brought,
+        extensions: [{
+                name: 'auth',
+                state: { user: json(user), session: json(models.session.omit('token')) },
+                up(app) {
+                    const engine = betterAuthLib({
+                        database: fougereAdapter(storagesOf(app, models)),
+                        secret: opts.secret,
+                        baseURL: opts.baseUrl,
+                        basePath,
+                        trustedOrigins: opts.trustedOrigins,
+                        advanced: { database: { generateId: () => createId() } },
+                        session: opts.sessionTtl ? { expiresIn: opts.sessionTtl / 1000 } : undefined,
+                        emailAndPassword: translateCredential(providers),
+                        socialProviders: translateSocial(providers),
+                        plugins: translatePlugins(providers),
+                    });
+                    const runtime = { handler: engine.handler, api: engine.api, basePath };
+                    app.container.registerValue(AUTH, runtime);
                 },
-                storages: Object.fromEntries(storageMap),
-                handler: engine.handler,
-                api: engine.api,
-                basePath,
-            };
-        },
-    };
+            }],
+    });
+}
+export default betterAuth;
+function storagesOf(app, models) {
+    return new Map(Object.entries(models).map(([model, schema]) => {
+        const entity = lowerFirst(schema.name);
+        const storage = app.storageFor(entity);
+        if (!storage)
+            throw new Error(`[auth] no frond in this process holds '${entity}', the ${model} better-auth writes.`);
+        return [model, storage];
+    }));
 }
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,IAAI,aAAa,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAGhD,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,cAAc,EAAmB,MAAM,cAAc,CAAC;AAC/D,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,eAAe,EAAyB,MAAM,uBAAuB,CAAC;AAEtH,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAgBhD,yCAAyC;AACzC,MAAM,UAAU,UAAU,CAAC,IAAuB;IAChD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,IAAI,QAAQ,CAAC;IACzC,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;IAC9D,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,IAAI,WAAW,CAAC;IAClD,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,IAAI,WAAW,CAAC;IAClD,MAAM,kBAAkB,GAAG,IAAI,CAAC,YAAY,IAAI,gBAAgB,CAAC;IACjE,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC;IACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC;IAE1C,OAAO;QACL,QAAQ,EAAE;YACR,IAAI,EAAE,UAAU;YAChB,OAAO,EAAE,aAAa;YACtB,OAAO,EAAE,aAAa;YACtB,YAAY,EAAE,kBAAkB;SACjC;QACD,MAAM,CAAC,EAAE,cAAc,EAAe;YACpC,MAAM,UAAU,GAAe,IAAI,GAAG,CAAC;gBACrC,CAAC,MAAM,EAAE,cAAc,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;gBAC5C,CAAC,SAAS,EAAE,cAAc,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;gBACrD,CAAC,SAAS,EAAE,cAAc,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;gBACrD,CAAC,cAAc,EAAE,cAAc,CAAC,kBAAkB,EAAE,cAAc,CAAC,CAAC;aACrE,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,aAAa,CAAC;gBAC3B,QAAQ,EAAE,cAAc,CAAC,UAAU,CAAC;gBACpC,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,QAAQ;gBACR,cAAc,EAAE,IAAI,CAAC,cAAc;gBACnC,QAAQ,EAAE,EAAE,QAAQ,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE,EAAE;gBACxD,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,UAAU,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS;gBAC5E,gBAAgB,EAAE,mBAAmB,CAAC,SAAS,CAAC;gBAChD,eAAe,EAAE,eAAe,CAAC,SAAS,CAAC;gBAC3C,OAAO,EAAE,gBAAgB,CAAC,SAAS,CAAC;aACrC,CAAC,CAAC;YAEH,OAAO;gBACL,QAAQ,EAAE;oBACR,IAAI,EAAE,UAAU;oBAChB,OAAO,EAAE,aAAa;oBACtB,OAAO,EAAE,aAAa;oBACtB,YAAY,EAAE,kBAAkB;iBACjC;gBACD,QAAQ,EAAE,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC;gBACxC,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,GAAG,EAAE,MAAM,CAAC,GAA8B;gBAC1C,QAAQ;aACT,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,IAAI,aAAa,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAkE,MAAM,eAAe,CAAC;AAC5G,OAAO,EAAE,IAAI,EAAE,UAAU,EAAgC,MAAM,iBAAiB,CAAC;AACjF,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,cAAc,EAAmB,MAAM,cAAc,CAAC;AAC/D,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,eAAe,EAAyB,MAAM,uBAAuB,CAAC;AAEtH,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAgBhD;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CAAC,IAAuB;IAChD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,QAAQ,CAAC;IACnC,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACxD,MAAM,MAAM,GAA+B;QACzC,IAAI;QACJ,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,WAAW;QACpC,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,WAAW;QACpC,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,gBAAgB;KACpD,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/E,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC;IACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC;IAE1C,OAAO,KAAK,CAAC,MAAM,EAAE;QACnB,QAAQ,EAAE,OAAO;QACjB,UAAU,EAAE,CAAC;gBACX,IAAI,EAAE,MAAM;gBACZ,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAqB,CAAC,EAAE,OAAO,EAAE,IAAI,CAAE,MAAM,CAAC,OAAyB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE;gBAC5G,EAAE,CAAC,GAAQ;oBACT,MAAM,MAAM,GAAG,aAAa,CAAC;wBAC3B,QAAQ,EAAE,cAAc,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;wBACjD,MAAM,EAAE,IAAI,CAAC,MAAM;wBACnB,OAAO,EAAE,IAAI,CAAC,OAAO;wBACrB,QAAQ;wBACR,cAAc,EAAE,IAAI,CAAC,cAAc;wBACnC,QAAQ,EAAE,EAAE,QAAQ,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE,EAAE;wBACxD,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,UAAU,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS;wBAC5E,gBAAgB,EAAE,mBAAmB,CAAC,SAAS,CAAC;wBAChD,eAAe,EAAE,eAAe,CAAC,SAAS,CAAC;wBAC3C,OAAO,EAAE,gBAAgB,CAAC,SAAS,CAAC;qBACrC,CAAC,CAAC;oBACH,MAAM,OAAO,GAAgB,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,GAA8B,EAAE,QAAQ,EAAE,CAAC;oBAE/G,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;gBAC7C,CAAC;aACF,CAAC;KACH,CAAC,CAAC;AACL,CAAC;AAED,eAAe,UAAU,CAAC;AAE1B,SAAS,UAAU,CAAC,GAAQ,EAAE,MAAkC;IAC9D,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,EAAE;QAC5D,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,OAAO,GAAwB,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAC5D,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,MAAM,UAAU,KAAK,sBAAsB,CAAC,CAAC;QAErH,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC,CAAC;AACN,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fougere/auth-better",
-  "version": "0.12.2-alpha.0",
+  "version": "0.12.5-alpha.0",
   "description": "Fougere's auth — a translation layer onto better-auth.",
   "keywords": [
     "fougere",
@@ -31,12 +31,12 @@
   "dependencies": {
     "@paralleldrive/cuid2": "^3.3.0",
     "better-auth": "^1.6.11",
-    "@fougere/schema": "0.12.2-alpha.0",
-    "@fougere/core": "0.12.2-alpha.0"
+    "@fougere/core": "0.12.5-alpha.0",
+    "@fougere/schema": "0.12.5-alpha.0"
   },
   "devDependencies": {
     "vitest": "^4.1.0",
-    "@fougere/adapter-sql": "0.12.2-alpha.0"
+    "@fougere/adapter-sql": "0.12.5-alpha.0"
   },
   "publishConfig": {
     "access": "public"

package/src/entity/AuthUser.ts

@@ -1,7 +1,7 @@
 import { entity, primary, text, bool, created, optional } from '@fougere/schema';
 
-/** Default User entity — shipped as a fallback. */
-export class AuthUser extends entity({
+/** The user better-auth writes when the app names none — `User`, since the model is `user`. */
+class User extends entity({
   id: primary(),
   name: text(),
   email: text(),
@@ -10,3 +10,5 @@ export class AuthUser extends entity({
   createdAt: created(),
   updatedAt: created(),
 }) {}
+
+export { User as AuthUser };

package/src/entity/AuthVerification.ts

@@ -4,7 +4,7 @@ import { entity, primary, text, date, created } from '@fougere/schema';
  * Default Verification entity — better-auth shape.
  * Used for email verification, password reset, magic links, etc.
  */
-export class AuthVerification extends entity({
+class Verification extends entity({
   id: primary(),
   identifier: text(),
   value: text(),
@@ -12,3 +12,5 @@ export class AuthVerification extends entity({
   createdAt: created(),
   updatedAt: created(),
 }) {}
+
+export { Verification as AuthVerification };

package/src/entity/authEntities.ts

@@ -13,7 +13,7 @@ export function authEntities(User: SchemaView): {
    * Session entity — better-auth shape.
    * `token` carries the opaque session secret (cookie value).
    */
-  class AuthSession extends entity({
+  class Session extends entity({
     id: primary(),
     userId: ref(target),
     token: text(),
@@ -28,7 +28,7 @@ export function authEntities(User: SchemaView): {
    * Account entity — better-auth shape (single PK, accountId/providerId pair,
    * separate token columns instead of a JSON blob).
    */
-  class AuthAccount extends entity({
+  class Account extends entity({
     id: primary(),
     accountId: text(),
     providerId: text(),
@@ -44,5 +44,5 @@ export function authEntities(User: SchemaView): {
     updatedAt: created(),
   }) {}
 
-  return { AuthSession, AuthAccount };
+  return { AuthSession: Session, AuthAccount: Account };
 }

package/src/index.ts

@@ -1,7 +1,7 @@
 import { betterAuth as betterAuthLib } from 'better-auth';
 import { createId } from '@paralleldrive/cuid2';
-import type { AuthConfig, AuthContext, AuthRuntime } from '@fougere/core';
-import type { SchemaView } from '@fougere/schema';
+import { AUTH, frond, type App, type AuthRuntime, type FrondDescriptor, type Storage } from '@fougere/core';
+import { json, lowerFirst, type Schema, type SchemaView } from '@fougere/schema';
 import { AuthUser } from './entity/AuthUser.js';
 import { AuthVerification } from './entity/AuthVerification.js';
 import { authEntities } from './entity/authEntities.js';
@@ -10,7 +10,7 @@ import { translateCredential, translatePlugins, translateSocial, type FougerePro
 
 export { AuthUser } from './entity/AuthUser.js';
 
-/** Options accepted by the betterAuth() factory in fougere.config.ts. */
+/** What `fronds: { '@fougere/auth-better': { … } }` hands the factory in fougere.config.ts. */
 export interface BetterAuthOptions {
   user?: SchemaView;
   secret: string;
@@ -24,56 +24,60 @@ export interface BetterAuthOptions {
   verification?: SchemaView;
 }
 
-/** Factory used in fougere.config.ts. */
-export function betterAuth(opts: BetterAuthOptions): AuthConfig {
-  const userSchema = opts.user ?? AuthUser;
-  const { AuthSession, AuthAccount } = authEntities(userSchema);
-  const sessionSchema = opts.session ?? AuthSession;
-  const accountSchema = opts.account ?? AuthAccount;
-  const verificationSchema = opts.verification ?? AuthVerification;
+/**
+ * The auth provider, as a frond: its rows — the user too, when the app names none — and the
+ * extension that rises where it is served, declaring what a signed-in call carries and
+ * registering the runtime under `AUTH`. Placed like any frond: a process whose `only:` leaves it
+ * out starts no engine and migrates no session table. The session travels without its
+ * `token`: a process trusts the one that called it, never the cookie of whoever is behind it.
+ */
+export function betterAuth(opts: BetterAuthOptions): FrondDescriptor {
+  const user = opts.user ?? AuthUser;
+  const { AuthSession, AuthAccount } = authEntities(user);
+  const models: Record<string, SchemaView> = {
+    user,
+    session: opts.session ?? AuthSession,
+    account: opts.account ?? AuthAccount,
+    verification: opts.verification ?? AuthVerification,
+  };
+  const brought = Object.values(models).filter((schema) => schema !== opts.user);
   const providers = opts.providers ?? {};
   const basePath = opts.basePath ?? '/auth';
 
-  return {
-    entities: {
-      user: userSchema,
-      session: sessionSchema,
-      account: accountSchema,
-      verification: verificationSchema,
-    },
-    create({ storageFactory }: AuthContext): AuthRuntime {
-      const storageMap: StorageMap = new Map([
-        ['user', storageFactory(userSchema, 'user')],
-        ['session', storageFactory(sessionSchema, 'session')],
-        ['account', storageFactory(accountSchema, 'account')],
-        ['verification', storageFactory(verificationSchema, 'verification')],
-      ]);
+  return frond('auth', {
+    entities: brought,
+    extensions: [{
+      name: 'auth',
+      state: { user: json(user as typeof Schema), session: json((models.session as typeof Schema).omit('token')) },
+      up(app: App) {
+        const engine = betterAuthLib({
+          database: fougereAdapter(storagesOf(app, models)),
+          secret: opts.secret,
+          baseURL: opts.baseUrl,
+          basePath,
+          trustedOrigins: opts.trustedOrigins,
+          advanced: { database: { generateId: () => createId() } },
+          session: opts.sessionTtl ? { expiresIn: opts.sessionTtl / 1000 } : undefined,
+          emailAndPassword: translateCredential(providers),
+          socialProviders: translateSocial(providers),
+          plugins: translatePlugins(providers),
+        });
+        const runtime: AuthRuntime = { handler: engine.handler, api: engine.api as Record<string, unknown>, basePath };
 
-      const engine = betterAuthLib({
-        database: fougereAdapter(storageMap),
-        secret: opts.secret,
-        baseURL: opts.baseUrl,
-        basePath,
-        trustedOrigins: opts.trustedOrigins,
-        advanced: { database: { generateId: () => createId() } },
-        session: opts.sessionTtl ? { expiresIn: opts.sessionTtl / 1000 } : undefined,
-        emailAndPassword: translateCredential(providers),
-        socialProviders: translateSocial(providers),
-        plugins: translatePlugins(providers),
-      });
+        app.container.registerValue(AUTH, runtime);
+      },
+    }],
+  });
+}
 
-      return {
-        entities: {
-          user: userSchema,
-          session: sessionSchema,
-          account: accountSchema,
-          verification: verificationSchema,
-        },
-        storages: Object.fromEntries(storageMap),
-        handler: engine.handler,
-        api: engine.api as Record<string, unknown>,
-        basePath,
-      };
-    },
-  };
+export default betterAuth;
+
+function storagesOf(app: App, models: Record<string, SchemaView>): StorageMap {
+  return new Map(Object.entries(models).map(([model, schema]) => {
+    const entity = lowerFirst(schema.name);
+    const storage: Storage | undefined = app.storageFor(entity);
+    if (!storage) throw new Error(`[auth] no frond in this process holds '${entity}', the ${model} better-auth writes.`);
+
+    return [model, storage];
+  }));
 }