@gauts/auth 0.9.0 → 0.10.1

package/README.md

@@ -12,7 +12,7 @@ Database-backed password authentication, opaque browser sessions, and optional s
 | bcrypt password hashing        |   ✅    | Opt-in              |
 | Opaque server-side sessions    |   ✅    | Enabled             |
 | Database-backed validation     |   ✅    | Enabled             |
-| Sliding session renewal        |   ✅    | Every 24 hours      |
+| Automatic sliding renewal      |   ✅    | Every 24 hours      |
 | Absolute session lifetime      |   ✅    | 30 days             |
 | Signed browser cache           |   ✅    | Disabled            |
 | Full User-Agent validation     |   ✅    | Enabled             |
@@ -35,11 +35,11 @@ Database-backed password authentication, opaque browser sessions, and optional s
 | OTP and transactional email    |   ❌    | Application-owned   |
 | Route roles and permissions    |   ❌    | Application-owned   |
 
-“Session renewal” extends the existing session expiry when activity continues. It is not a refresh-token flow and does not rotate the opaque browser token.
+“Session renewal” extends the existing session expiry when authenticated activity continues. Framework middleware performs it inline when due. It is not a refresh-token flow and does not rotate the opaque browser token.
 
 ## Quick start
 
-The application defines its credential login, renewal, logout, and protected endpoints. Optional addons are configured separately after this base setup.
+The application defines its credential login, logout, protected endpoints, and the optional explicit renewal endpoint used by server-rendered frontends. Optional addons are configured separately after this base setup.
 
 ### 1. Install the package
 
@@ -147,6 +147,14 @@ export const authDb = createDrizzleAdapter({
 
 This Hono example is identical for Prisma and Drizzle:
 
+Generate one high-entropy API secret and keep it server-side:
+
+```bash
+openssl rand -base64 48
+```
+
+Store the result as `AUTH_SECRET` in the API environment. Do not expose it through a public frontend variable.
+
 ```ts
 import { createHonoAuth } from "@gauts/auth/hono";
 
@@ -154,6 +162,7 @@ import { authDb } from "./authDb.js";
 
 export const auth = createHonoAuth({
     db: authDb,
+    secret: process.env.AUTH_SECRET!,
 });
 ```
 
@@ -166,7 +175,7 @@ renewal        every 24 hours
 max lifetime   30 days
 validation     User-Agent
 cache          disabled
-cookies        __ses, __cac, __ren
+cookies        __ses, __ctx
 ```
 
 Mount the application-owned login routes and the package middleware:
@@ -274,7 +283,7 @@ export const proxy = async (request: NextRequest) => {
 };
 ```
 
-The application owns the redirect URL. When `unauthorizedUrl` is provided, the adapter creates the redirect and copies every API `Set-Cookie` header to it before returning the final response. The frontend does not receive `AUTH_SECRET`; the API remains responsible for session validation.
+The application owns the redirect URL. When `unauthorizedUrl` is provided, the adapter creates the redirect and copies every API `Set-Cookie` header to it before returning the final response. The frontend does not receive `AUTH_SECRET`; it reads only untrusted scheduling dates from `__ctx`. The API verifies the signature and remains responsible for session validation.
 
 ## Requirements and package entry points
 
@@ -297,6 +306,7 @@ The application owns the redirect URL. When `unauthorizedUrl` is provided, the a
 | `@gauts/auth/express`   | Express cookies, methods, and middleware.                 |
 | `@gauts/auth/fastify`   | Fastify cookies, methods, decorators, and hooks.          |
 | `@gauts/auth/next`      | Next.js renewal scheduling and `Set-Cookie` forwarding.   |
+| `@gauts/auth/headers`   | Browser-safe controlled header forwarding helpers.        |
 | `@gauts/auth/providers` | Google, GitHub, and X OAuth providers.                    |
 
 ## Configuration reference
@@ -311,7 +321,7 @@ The application owns the redirect URL. When `unauthorizedUrl` is provided, the a
 | `session`  | `SessionConfig`       |            ❌            | Session defaults  | Expiry, renewal, and client validation configuration.                                               |
 | `cookie`   | `HonoCookieConfig`    |            ❌            | Cookie defaults   | Names, domain, path, SameSite, and Secure settings.                                                 |
 | `cache`    | `{ ttl: number }`     |            ❌            | Disabled          | Enables the short signed browser cache.                                                             |
-| `secret`   | `string`              | With `cache` or `social` | —                 | HMAC secret for signed authentication data. Minimum 32 UTF-8 bytes.                                 |
+| `secret`   | `string`              |            ✅            | —                 | HMAC secret for signed session context and optional social data. Minimum 32 UTF-8 bytes.             |
 | `social`   | `SocialConfig`        |            ❌            | Disabled          | Enables configured social providers, redirects, and optional registration.                          |
 
 ```ts
@@ -404,17 +414,16 @@ renew_at     = min((updated_at ?? created_at) + renewInterval, maxExpiresAt)
 
 ### Cookies
 
-| Property      | Type / allowed values         | Default           | Description                                                               |
-| ------------- | ----------------------------- | ----------------- | ------------------------------------------------------------------------- |
-| `sessionName` | Valid cookie name             | `"__ses"`         | Contains the opaque token. This is the only authenticating cookie.        |
-| `cacheName`   | Valid cookie name             | `"__cac"`         | Contains the optional signed short cache.                                 |
-| `renewName`   | Valid cookie name             | `"__ren"`         | Contains the untrusted `renew_at` Unix timestamp.                         |
-| `domain`      | `string`                      | Browser host only | Optional cookie domain.                                                   |
-| `path`        | String beginning with `/`     | `"/"`             | Cookie path.                                                              |
-| `sameSite`    | `"Strict" \| "Lax" \| "None"` | `"Lax"`           | Browser SameSite policy.                                                  |
-| `secure`      | `boolean`                     | `true`            | Requires HTTPS when enabled. Set `false` only for local HTTP development. |
+| Property      | Type / allowed values         | Default           | Description                                                                                   |
+| ------------- | ----------------------------- | ----------------- | --------------------------------------------------------------------------------------------- |
+| `sessionName` | Valid cookie name             | `"__ses"`         | Contains the opaque token. This is the only authenticating cookie.                            |
+| `contextName` | Valid cookie name             | `"__ctx"`         | Contains signed renewal scheduling and the optional short cache. It never authenticates alone. |
+| `domain`      | `string`                      | Browser host only | Optional cookie domain.                                                                       |
+| `path`        | String beginning with `/`     | `"/"`             | Cookie path.                                                                                  |
+| `sameSite`    | `"Strict" \| "Lax" \| "None"` | `"Lax"`           | Browser SameSite policy.                                                                      |
+| `secure`      | `boolean`                     | `true`            | Requires HTTPS when enabled. Set `false` only for local HTTP development.                     |
 
-All three cookies are always `HttpOnly` and expire with their respective server-side purpose. Their names must be unique.
+Both cookies are always `HttpOnly`, expire with the authoritative session, and must use unique names. Deleting `__ctx` does not log the user out: the next authenticated API request validates `__ses` through the database and rebuilds the signed context. Deleting `__ses` ends browser authentication because `__ctx` is never accepted on its own.
 
 Cookie prefix rules are enforced:
 
@@ -434,53 +443,50 @@ The resolved names are available through:
 
 ```ts
 auth.cookie.sessionName; // "__ses"
-auth.cookie.cacheName; // "__cac"
-auth.cookie.renewName; // "__ren"
+auth.cookie.contextName; // "__ctx"
 ```
 
-### Signed cache
+### Signed session context
 
-| Property    | Type / allowed values               | Default  | Description                                               |
-| ----------- | ----------------------------------- | -------- | --------------------------------------------------------- |
-| `cache.ttl` | Integer `1` to `session.ttl`        | Disabled | Maximum cache lifetime in seconds.                        |
-| `secret`    | String with at least 32 UTF-8 bytes | —        | Signs the cache with HMAC-SHA-256. Required with `cache`. |
+| Property    | Type / allowed values               | Default  | Description                                                        |
+| ----------- | ----------------------------------- | -------- | ------------------------------------------------------------------ |
+| `secret`    | String with at least 32 UTF-8 bytes | Required | Signs `__ctx` with HMAC-SHA-256 and binds it to the opaque token.  |
+| `cache.ttl` | Integer `1` to `session.ttl`        | Disabled | Enables cached account/session data for at most this many seconds. |
 
-The cache:
+The signed context always contains the session expiry and next renewal time. When caching is configured, it may also contain the selected account and session data. The context:
 
-- is cryptographically bound to the opaque token and client identity;
-- is accepted only for `GET` and `HEAD`;
-- never extends the authoritative database session;
-- is bypassed for unsafe methods, renewal, logout, WebSockets, and core calls;
-- falls back to normal database authentication when absent, expired, malformed, or altered.
+- is cryptographically bound to `__ses` and cannot authenticate without it;
+- is verified by the API before any cached data is trusted;
+- exposes untrusted `renew` and `exp` scheduling values to the Next.js adapter without exposing `AUTH_SECRET`;
+- uses cached data only for `GET` and `HEAD`;
+- never extends the authoritative database session by itself;
+- bypasses cached data for unsafe methods, renewal, logout, WebSockets, and core calls;
+- triggers normal database authentication and a fresh signed context when absent, expired, malformed, altered, or bound to another token.
 
-The cache is signed but not encrypted. Do not place passwords, password hashes, raw session tokens, or application secrets in account/session data.
+The context is signed but not encrypted. Do not place passwords, password hashes, raw session tokens, or application secrets in selected account/session data.
 
 <details>
-<summary>Internal compact cache payload</summary>
+<summary>Internal signed context payload</summary>
 
 ```ts
 {
-    exp: cacheExpiresAt,
-    acc: {
-        id,
-        email,
-        name,
-        role,
-        status,
-        timezone,
-        user: { id, role, status },
-    },
-    ses: {
-        id,
-        client: { ip, agent, platform },
-        created_at,
-        exp: expiresAt,
-        ren: renewAt,
-    },
+    cache: {
+        data: {
+            account,
+            session: {
+                client,
+                created,
+                id,
+            },
+        },
+        exp: cacheExpiresAt,
+    } | null,
+    exp: sessionExpiresAt,
+    renew: renewAt,
 }
 ```
 
-`session.account_id` is reconstructed from `acc.id` after signature validation.
+The payload is encoded as `base64url(payload).signature`. The Next.js adapter may decode `exp` and `renew` only as scheduling hints. The API verifies the signature against the current opaque token before using any value. `session.account_id` is reconstructed from `account.id` after verification.
 
 </details>
 
@@ -623,6 +629,7 @@ export const auth = createHonoAuth({
             users: { table: users },
         },
     }),
+    secret: process.env.AUTH_SECRET!,
 });
 ```
 
@@ -678,11 +685,11 @@ export const nextAuth = createNextAuth({
 });
 ```
 
-| Property             | Type / allowed values            | Required | Default   | Description                                   |
-| -------------------- | -------------------------------- | :------: | --------- | --------------------------------------------- |
-| `renewUrl`           | Absolute `http:` or `https:` URL |    ✅    | —         | Trusted private API renewal endpoint.         |
-| `cookie.sessionName` | Valid cookie name                |    ❌    | `"__ses"` | Session cookie read and forwarded to the API. |
-| `cookie.renewName`   | Valid cookie name                |    ❌    | `"__ren"` | Renewal scheduling cookie read by Next.js.    |
+| Property             | Type / allowed values            | Required | Default   | Description                                              |
+| -------------------- | -------------------------------- | :------: | --------- | -------------------------------------------------------- |
+| `renewUrl`           | Absolute `http:` or `https:` URL |    ✅    | —         | Trusted private API renewal endpoint.                    |
+| `cookie.sessionName` | Valid cookie name                |    ❌    | `"__ses"` | Session cookie read and forwarded to the API.            |
+| `cookie.contextName` | Valid cookie name                |    ❌    | `"__ctx"` | Signed context decoded only to schedule SSR renewal.     |
 
 ## Session flow
 
@@ -695,8 +702,8 @@ credentials accepted
     -> load current account and owning user
     -> apply configured account/user access rules
     -> write __ses
-    -> write __ren
-    -> optionally write __cac
+    -> write signed __ctx with renewal schedule
+    -> optionally include short cached data inside __ctx
 ```
 
 Only the raw browser token authenticates. The database stores only its SHA-256 hash.
@@ -704,12 +711,16 @@ Only the raw browser token authenticates. The database stores only its SHA-256 h
 ### Protected `GET` or `HEAD`
 
 ```text
-session token
-    -> valid signed cache?
-        -> yes: expose cached account and session
-        -> no: validate through DB and create a fresh cache
+__ses + __ctx
+    -> renewal due?
+        -> yes: validate and renew through DB, then write both cookies
+        -> no: valid signed cache?
+            -> yes: expose cached account and session
+            -> no: validate through DB and write a fresh signed context
 ```
 
+Renewal happens inside the same protected API request. A client-side fetch does not need a second renewal request.
+
 ### Unsafe request
 
 ```text
@@ -717,22 +728,22 @@ session token
     -> SHA-256 hash
     -> indexed DB lookup
     -> validate expiry, revocation, account/user access, and client
-    -> clear short cache
+    -> write signed context without cached account data
     -> continue
 ```
 
-### Renewal
+### Next.js SSR renewal
 
 ```text
-Next reads __ren
-    -> future timestamp: no API request
+Next decodes renew and exp from __ctx as untrusted hints
+    -> future timestamps: no renewal request
     -> missing, invalid, or due: POST /auth/renew
     -> API validates through DB
     -> update expires_at when renewal is due
-    -> Set-Cookie with the same token, new renewAt, and fresh cache
+    -> Set-Cookie with the same token and fresh signed context
 ```
 
-`auth.session.resolve()` is always DB-backed and read-only. Only explicit renewal updates database expiry.
+`auth.session.resolve()` is always DB-backed and read-only. `auth.session.renew()` performs the authoritative renewal. Framework `requireSession` calls it automatically when the verified context says renewal is due; the explicit endpoint gives Next.js the same behavior during SSR navigation.
 
 ## Hono adapter
 
@@ -793,7 +804,7 @@ await auth.createSession({
 | Method                                                  | Purpose                                                                                           |
 | ------------------------------------------------------- | ------------------------------------------------------------------------------------------------- |
 | `auth.createSession({ account_id, context, country? })` | Creates the DB session and writes the browser cookies. `country` is optional login-time metadata. |
-| `auth.resolveSession(context)`                          | Resolves a request and returns the selected account and session.                                  |
+| `auth.resolveSession(context)`                          | Resolves a request, renews inline when due, and returns the selected account and session.          |
 | `auth.renewSession(context)`                            | Performs DB validation, renews when due, and writes authoritative cookies.                        |
 | `auth.revokeSession(context)`                           | Revokes the current DB session and clears cookies.                                                |
 | `auth.clearSession(context)`                            | Clears browser cookies without revoking the DB session.                                           |
@@ -807,7 +818,7 @@ await auth.createSession({
 ```ts
 import { createExpressAuth, type ExpressAuthLocals } from "@gauts/auth/express";
 
-const auth = createExpressAuth({ db });
+const auth = createExpressAuth({ db, secret: process.env.AUTH_SECRET! });
 
 app.get("/account", auth.requireSession, (_request, response) => {
     const { account, session, user } = response.locals as ExpressAuthLocals;
@@ -818,7 +829,7 @@ app.get("/account", auth.requireSession, (_request, response) => {
 | Method                                                            | Purpose                                              |
 | ----------------------------------------------------------------- | ---------------------------------------------------- |
 | `auth.createSession({ account_id, request, response, country? })` | Creates the DB session and writes cookies.           |
-| `auth.resolveSession({ request, response })`                      | Resolves the selected account and session.           |
+| `auth.resolveSession({ request, response })`                      | Resolves and automatically renews when due.           |
 | `auth.renewSession({ request, response })`                        | Renews when due and writes authoritative cookies.    |
 | `auth.revokeSession({ request, response })`                       | Revokes the current session and clears cookies.      |
 | `auth.clearSession(response)`                                     | Clears cookies without revoking the DB session.      |
@@ -834,7 +845,7 @@ Register the request decorators once before declaring routes:
 ```ts
 import { createFastifyAuth } from "@gauts/auth/fastify";
 
-const auth = createFastifyAuth({ db });
+const auth = createFastifyAuth({ db, secret: process.env.AUTH_SECRET! });
 
 auth.decorate(app);
 
@@ -849,7 +860,7 @@ app.get("/account", { preHandler: auth.requireSession }, (request) => ({
 | -------------------------------------------------------------- | -------------------------------------------------------------- |
 | `auth.decorate(app)`                                           | Declares the native request decorators once at startup.        |
 | `auth.createSession({ account_id, request, reply, country? })` | Creates the DB session and writes cookies.                     |
-| `auth.resolveSession({ request, reply })`                      | Resolves the selected account and session.                     |
+| `auth.resolveSession({ request, reply })`                      | Resolves and automatically renews when due.                     |
 | `auth.renewSession({ request, reply })`                        | Renews when due and writes authoritative cookies.              |
 | `auth.revokeSession({ request, reply })`                       | Revokes the current session and clears cookies.                |
 | `auth.clearSession(reply)`                                     | Clears cookies without revoking the DB session.                |
@@ -1187,12 +1198,13 @@ import { createHonoAdapter } from "@gauts/auth/hono";
 const core = createAuth({ db });
 const hono = createHonoAdapter({
     auth: core,
+    secret: process.env.AUTH_SECRET!,
 });
 ```
 
 ## Next.js adapter
 
-The Next.js adapter schedules renewal; it does not authenticate pages or API requests.
+The Next.js adapter schedules SSR renewal; it does not authenticate pages or API requests. Normal API middleware independently verifies `__ctx` and renews inline, including requests made directly by client-side SWR or `fetch`.
 
 ```ts
 import type { NextRequest } from "next/server";
@@ -1218,18 +1230,18 @@ Result values:
 
 | `attempted` |    `status` | Meaning                                                         |
 | :---------: | ----------: | --------------------------------------------------------------- |
-|   `false`   |      `null` | Session token exists and renewal is not due.                    |
+|   `false`   |      `null` | Session token and context schedule exist; renewal is not due.   |
 |   `false`   |       `401` | Session token is missing or malformed; no API request occurred. |
 |   `true`    | HTTP status | The renewal endpoint was called and returned this status.       |
 
 `unauthorizedUrl` is optional. When provided, the adapter redirects a `401` to that relative or absolute URL and transfers every returned `Set-Cookie` header to the redirect. Without it, the original response is returned with `status: 401` as before.
 
-The adapter forwards only the session cookie and controlled client/origin headers required by the private API. Other cookies, authorization headers, and arbitrary headers are not forwarded.
+The adapter forwards only the session cookie and controlled client/origin headers required by the private API. `__ctx` is not forwarded because the API renewal endpoint always validates the opaque token through the database and returns a new signed context. Other cookies, authorization headers, and arbitrary headers are not forwarded.
 
-`buildForwardHeaders()` and `FORWARD_HEADERS` are exported from `@gauts/auth/next` for application fetchers that need the same controlled forwarding rules:
+`buildForwardHeaders()` and `FORWARD_HEADERS` are exported from the browser-safe `@gauts/auth/headers` entrypoint for application fetchers that need the same controlled forwarding rules:
 
 ```ts
-import { buildForwardHeaders } from "@gauts/auth/next";
+import { buildForwardHeaders } from "@gauts/auth/headers";
 
 const headers = buildForwardHeaders({
     headers: incoming,
@@ -1241,7 +1253,7 @@ Safe client and proxy metadata is copied by default. Credentials such as `cookie
 
 When `Origin` is absent and trusted `X-Forwarded-Proto` and `X-Forwarded-Host` headers exist, the adapter reconstructs the public origin from them. It never derives a public origin from the internal Next.js request URL. The deployment proxy must overwrite forwarded headers received from untrusted clients.
 
-Apply renewal only to protected routes or skip public routes before calling `nextAuth.renew()`.
+Apply renewal only to protected routes or skip public routes before calling `nextAuth.renew()`. The adapter calls the API only when `__ctx` is missing, malformed, expired, or its decoded renewal time is due. Those decoded dates are untrusted scheduling hints; they never authenticate the request.
 
 ## Core session API
 
@@ -1306,9 +1318,9 @@ The Prisma and Drizzle adapters implement both `DbAdapter` and `SocialDbAdapter`
 
 The package contains no Redis or in-process cache.
 
-Without the optional browser cache, each `requireSession` performs an indexed database lookup through `account_sessions.token_hash`.
+Without the optional browser cache, each `requireSession` performs an indexed database lookup through `account_sessions.token_hash`. When renewal is due, that same request also updates the authoritative expiry and returns refreshed cookies; there is no additional client-side API call.
 
-With a valid cache, `GET` and `HEAD` skip the lookup until `cache.ttl` expires. Unsafe methods always use current database state.
+With valid cached data inside `__ctx`, `GET` and `HEAD` skip the lookup until `cache.ttl` expires. Unsafe methods always use current database state. Renewal still validates through the database even if cached data is present.
 
 The tradeoff is explicit: revocation and selected account or relation changes made elsewhere may remain visible to safe cached requests until the short TTL expires. A 60-second TTL limits this stale-read window to one minute. Disable cache when immediate read revocation is required.
 
@@ -1360,7 +1372,6 @@ The package provides authentication primitives, not a complete application secur
 - TLS and trusted-proxy configuration;
 - CSRF, CORS, host, and origin validation;
 - login and renewal rate limiting;
-- equivalent password verification work for unknown accounts;
 - route roles and authorization;
 - re-authentication for sensitive operations;
 - database migrations and session cleanup;

package/SECURITY.md

@@ -29,20 +29,24 @@ Security reports may cover the password service, session core, database adapters
 
 Application-specific authorization, rate limiting, CSRF, CORS, proxy trust, deployment, and database access policies remain the consuming application's responsibility unless the vulnerability is caused by package behavior.
 
-## Signed session cache
+## Signed session context
 
-The optional browser cache is disabled when omitted. When configured, it is accepted only for `GET` and `HEAD` requests and is signed with HMAC-SHA-256 using an application-provided secret of at least 32 bytes.
+Browser integration uses an opaque session-token cookie and a signed context cookie. The context is signed with HMAC-SHA-256 using an API-only application secret of at least 32 bytes and is cryptographically bound to the opaque token. It contains session expiry and renewal scheduling plus optional short cached account/session data. It never authenticates without the opaque token.
 
-The cache is bound to the opaque session token, its own expiry, the authoritative session expiry, and the configured client fields. Invalid cache data never authenticates a request; it causes normal database validation.
+The API verifies the context signature before trusting any cached value. Missing, malformed, expired, altered, or incorrectly bound context data causes normal database validation and a new context cookie. It does not revoke an otherwise valid opaque session. The Next.js adapter may decode the expiry and renewal values without the secret, but treats them only as untrusted scheduling hints.
+
+The optional browser cache is disabled when omitted. When configured, it is accepted only for `GET` and `HEAD` requests and remains bound to its own expiry, the authoritative session expiry, and the configured client fields.
 
 Cookie caching introduces a bounded consistency window. A session revoked on another device, or selected account or relation access changed in the database, may remain readable until the cache TTL expires. Unsafe methods, renewal, logout, WebSockets, and direct core calls always validate through the database. Applications requiring immediate cross-device read revocation must leave the cache disabled or provide shared server-side enforcement outside this package.
 
-Keep `AUTH_SECRET` in the API environment. Do not expose it to browser code or share it with a frontend merely to inspect the renewal timestamp. The timestamp is intentionally untrusted and never authenticates or renews a session by itself.
+Keep `AUTH_SECRET` in the API environment. Do not expose it to browser code or share it with a frontend merely to inspect scheduling values. Those values are intentionally untrusted and never authenticate or renew a session by themselves.
 
 ## Session lifetime
 
 Sliding renewal is limited by `session.maxLifetime`, which defaults to 30 days from the original login. The maximum expiry is derived from the immutable session `created_at` value and enforced by the core during resolution and renewal. Browser cookies and cached session data never outlive the authoritative session expiry.
 
+Framework middleware renews inline when the verified context says renewal is due. The explicit renewal endpoint performs the same database-backed operation for server-rendered navigation. Both paths retain the same opaque token and rewrite the session and context cookie expiries.
+
 Activity and possession of the session token cannot extend this absolute limit. After it is reached, the user must authenticate again and receive a new session token.
 
 ## Social authentication

package/dist/adapters/express/index.d.ts

@@ -1,12 +1,12 @@
 import type { Request, RequestHandler, Response } from "express";
 import { type Auth, type AuthDeps } from "../../auth.js";
-import type { SessionCacheConfig } from "../../session/cache.js";
 import type { SessionCookieNames } from "../../session/cookie.js";
+import type { SessionCacheConfig } from "../../session/state.js";
 import type { AuthAccount, DbAdapter, ResolvedSession, Session } from "../../session/types.js";
 import type { SocialConfig, SocialDbAdapter } from "../../social/types.js";
 import type { HttpCookieConfig } from "../utils/types.js";
 import { type ExpressSocial } from "./social.js";
-export type { SessionCacheConfig } from "../../session/cache.js";
+export type { SessionCacheConfig } from "../../session/state.js";
 export type { ExpressSocial, ExpressSocialLocals } from "./social.js";
 export type ExpressAuthLocals<TAccount extends AuthAccount = AuthAccount> = {
     account: TAccount;
@@ -15,35 +15,29 @@ export type ExpressAuthLocals<TAccount extends AuthAccount = AuthAccount> = {
 };
 export type ExpressCookieConfig = HttpCookieConfig;
 export type ExpressGetIp = (request: Request) => Promise<string | null | undefined> | string | null | undefined;
-type ExpressCacheOptions = {
-    cache: SessionCacheConfig;
-    secret: string;
-} | {
-    cache?: undefined;
-    secret?: string;
-};
 export type ExpressAdapterConfig<TAccount extends AuthAccount = AuthAccount> = {
     auth: Auth<TAccount>;
     cache?: SessionCacheConfig;
     cookie?: ExpressCookieConfig;
     getIp?: ExpressGetIp;
-    secret?: string;
+    secret: string;
 };
 type ExpressAuthBase<TAccount extends AuthAccount> = Omit<AuthDeps<TAccount>, "db"> & {
+    cache?: SessionCacheConfig;
     cookie?: ExpressCookieConfig;
     db: DbAdapter<TAccount>;
     getIp?: ExpressGetIp;
+    secret: string;
 };
 type ExpressSocialOptions<TAccount extends AuthAccount, TData> = {
     db: DbAdapter<TAccount> & SocialDbAdapter<TAccount>;
-    secret: string;
     social: SocialConfig<TData>;
 } | {
     db: DbAdapter<TAccount>;
     social?: undefined;
 };
-export type ExpressAuthConfig<TAccount extends AuthAccount = AuthAccount, TData = undefined> = Omit<ExpressAuthBase<TAccount>, "db"> & ExpressCacheOptions & ExpressSocialOptions<TAccount, TData>;
-type ExpressAuthOptions<TAccount extends AuthAccount> = Omit<ExpressAuthBase<TAccount>, "db"> & ExpressCacheOptions;
+export type ExpressAuthConfig<TAccount extends AuthAccount = AuthAccount, TData = undefined> = Omit<ExpressAuthBase<TAccount>, "db"> & ExpressSocialOptions<TAccount, TData>;
+type ExpressAuthOptions<TAccount extends AuthAccount> = Omit<ExpressAuthBase<TAccount>, "db">;
 type DbAccount<TDb> = TDb extends DbAdapter<infer TAccount> ? TAccount : never;
 type ExpressRequestInput = {
     request: Request;

package/dist/adapters/express/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/adapters/express/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACjE,OAAO,EAAc,KAAK,IAAI,EAAE,KAAK,QAAQ,EAAE,MAAM,eAAe,CAAC;AACrE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAClE,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AAC/F,OAAO,KAAK,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAI3E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AAEtE,YAAY,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AACjE,YAAY,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAEtE,MAAM,MAAM,iBAAiB,CAAC,QAAQ,SAAS,WAAW,GAAG,WAAW,IAAI;IACxE,OAAO,EAAE,QAAQ,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG,gBAAgB,CAAC;AAEnD,MAAM,MAAM,YAAY,GAAG,CACvB,OAAO,EAAE,OAAO,KACf,OAAO,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;AAEpE,KAAK,mBAAmB,GAClB;IACI,KAAK,EAAE,kBAAkB,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;CAClB,GACD;IACI,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAER,MAAM,MAAM,oBAAoB,CAAC,QAAQ,SAAS,WAAW,GAAG,WAAW,IAAI;IAC3E,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IACrB,KAAK,CAAC,EAAE,kBAAkB,CAAC;IAC3B,MAAM,CAAC,EAAE,mBAAmB,CAAC;IAC7B,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,KAAK,eAAe,CAAC,QAAQ,SAAS,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,GAAG;IAClF,MAAM,CAAC,EAAE,mBAAmB,CAAC;IAC7B,EAAE,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC;IACxB,KAAK,CAAC,EAAE,YAAY,CAAC;CACxB,CAAC;AAEF,KAAK,oBAAoB,CAAC,QAAQ,SAAS,WAAW,EAAE,KAAK,IACvD;IACI,EAAE,EAAE,SAAS,CAAC,QAAQ,CAAC,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IACpD,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC;CAC/B,GACD;IACI,EAAE,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC;IACxB,MAAM,CAAC,EAAE,SAAS,CAAC;CACtB,CAAC;AAER,MAAM,MAAM,iBAAiB,CAAC,QAAQ,SAAS,WAAW,GAAG,WAAW,EAAE,KAAK,GAAG,SAAS,IAAI,IAAI,CAC/F,eAAe,CAAC,QAAQ,CAAC,EACzB,IAAI,CACP,GACG,mBAAmB,GACnB,oBAAoB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;AAE1C,KAAK,kBAAkB,CAAC,QAAQ,SAAS,WAAW,IAAI,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,GACzF,mBAAmB,CAAC;AAExB,KAAK,SAAS,CAAC,GAAG,IAAI,GAAG,SAAS,SAAS,CAAC,MAAM,QAAQ,CAAC,GAAG,QAAQ,GAAG,KAAK,CAAC;AAE/E,KAAK,mBAAmB,GAAG;IACvB,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,QAAQ,CAAC;CACtB,CAAC;AAEF,KAAK,kBAAkB,GAAG,mBAAmB,GAAG;IAC5C,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,cAAc,CAAC,QAAQ,SAAS,WAAW,GAAG,WAAW,IAAI;IACrE,YAAY,CAAC,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAC;IACvC,MAAM,EAAE,QAAQ,CAAC,kBAAkB,CAAC,CAAC;IACrC,aAAa,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3D,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAAC;IAC1C,YAAY,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3D,cAAc,EAAE,cAAc,CAAC;IAC/B,cAAc,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC/E,aAAa,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CAChE,CAAC;AAEF,MAAM,MAAM,WAAW,CAAC,QAAQ,SAAS,WAAW,GAAG,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,GAChF,cAAc,CAAC,QAAQ,CAAC,CAAC;AAE7B,MAAM,MAAM,iBAAiB,CACzB,QAAQ,SAAS,WAAW,GAAG,WAAW,EAC1C,KAAK,GAAG,SAAS,IACjB,IAAI,CAAC,QAAQ,CAAC,GACd,cAAc,CAAC,QAAQ,CAAC,GAAG;IACvB,MAAM,EAAE,aAAa,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;CAC1C,CAAC;AAEN,eAAO,MAAM,oBAAoB,GAAI,QAAQ,SAAS,WAAW,EAAE,yCAMhE,oBAAoB,CAAC,QAAQ,CAAC,KAAG,cAAc,CAAC,QAAQ,CAuC1D,CAAC;AAEF,KAAK,iBAAiB,GAAG;IACrB,CAAC,GAAG,SAAS,SAAS,EAAE,KAAK,EACzB,KAAK,EAAE,kBAAkB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG;QACxC,EAAE,EAAE,GAAG,GAAG,eAAe,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1C,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC;KAC/B,GACF,iBAAiB,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;IAC5C,CAAC,GAAG,SAAS,SAAS,EAClB,KAAK,EAAE,kBAAkB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG;QACxC,EAAE,EAAE,GAAG,CAAC;QACR,MAAM,CAAC,EAAE,SAAS,CAAC;KACtB,GACF,WAAW,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;CAClC,CAAC;AA6CF,eAAO,MAAM,iBAAiB,EAA4B,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/adapters/express/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACjE,OAAO,EAAc,KAAK,IAAI,EAAE,KAAK,QAAQ,EAAE,MAAM,eAAe,CAAC;AACrE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAClE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AAC/F,OAAO,KAAK,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAI3E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AAEtE,YAAY,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AACjE,YAAY,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAEtE,MAAM,MAAM,iBAAiB,CAAC,QAAQ,SAAS,WAAW,GAAG,WAAW,IAAI;IACxE,OAAO,EAAE,QAAQ,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG,gBAAgB,CAAC;AAEnD,MAAM,MAAM,YAAY,GAAG,CACvB,OAAO,EAAE,OAAO,KACf,OAAO,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;AAEpE,MAAM,MAAM,oBAAoB,CAAC,QAAQ,SAAS,WAAW,GAAG,WAAW,IAAI;IAC3E,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IACrB,KAAK,CAAC,EAAE,kBAAkB,CAAC;IAC3B,MAAM,CAAC,EAAE,mBAAmB,CAAC;IAC7B,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,KAAK,eAAe,CAAC,QAAQ,SAAS,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,GAAG;IAClF,KAAK,CAAC,EAAE,kBAAkB,CAAC;IAC3B,MAAM,CAAC,EAAE,mBAAmB,CAAC;IAC7B,EAAE,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC;IACxB,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,KAAK,oBAAoB,CAAC,QAAQ,SAAS,WAAW,EAAE,KAAK,IACvD;IACI,EAAE,EAAE,SAAS,CAAC,QAAQ,CAAC,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IACpD,MAAM,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC;CAC/B,GACD;IACI,EAAE,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC;IACxB,MAAM,CAAC,EAAE,SAAS,CAAC;CACtB,CAAC;AAER,MAAM,MAAM,iBAAiB,CAAC,QAAQ,SAAS,WAAW,GAAG,WAAW,EAAE,KAAK,GAAG,SAAS,IAAI,IAAI,CAC/F,eAAe,CAAC,QAAQ,CAAC,EACzB,IAAI,CACP,GACG,oBAAoB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;AAE1C,KAAK,kBAAkB,CAAC,QAAQ,SAAS,WAAW,IAAI,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC;AAE9F,KAAK,SAAS,CAAC,GAAG,IAAI,GAAG,SAAS,SAAS,CAAC,MAAM,QAAQ,CAAC,GAAG,QAAQ,GAAG,KAAK,CAAC;AAE/E,KAAK,mBAAmB,GAAG;IACvB,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,QAAQ,CAAC;CACtB,CAAC;AAEF,KAAK,kBAAkB,GAAG,mBAAmB,GAAG;IAC5C,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,cAAc,CAAC,QAAQ,SAAS,WAAW,GAAG,WAAW,IAAI;IACrE,YAAY,CAAC,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAC;IACvC,MAAM,EAAE,QAAQ,CAAC,kBAAkB,CAAC,CAAC;IACrC,aAAa,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3D,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAAC;IAC1C,YAAY,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3D,cAAc,EAAE,cAAc,CAAC;IAC/B,cAAc,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC/E,aAAa,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CAChE,CAAC;AAEF,MAAM,MAAM,WAAW,CAAC,QAAQ,SAAS,WAAW,GAAG,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,GAChF,cAAc,CAAC,QAAQ,CAAC,CAAC;AAE7B,MAAM,MAAM,iBAAiB,CACzB,QAAQ,SAAS,WAAW,GAAG,WAAW,EAC1C,KAAK,GAAG,SAAS,IACjB,IAAI,CAAC,QAAQ,CAAC,GACd,cAAc,CAAC,QAAQ,CAAC,GAAG;IACvB,MAAM,EAAE,aAAa,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;CAC1C,CAAC;AAEN,eAAO,MAAM,oBAAoB,GAAI,QAAQ,SAAS,WAAW,EAAE,yCAMhE,oBAAoB,CAAC,QAAQ,CAAC,KAAG,cAAc,CAAC,QAAQ,CAuC1D,CAAC;AAEF,KAAK,iBAAiB,GAAG;IACrB,CAAC,GAAG,SAAS,SAAS,EAAE,KAAK,EACzB,KAAK,EAAE,kBAAkB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG;QACxC,EAAE,EAAE,GAAG,GAAG,eAAe,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1C,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC;KAC/B,GACF,iBAAiB,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;IAC5C,CAAC,GAAG,SAAS,SAAS,EAClB,KAAK,EAAE,kBAAkB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG;QACxC,EAAE,EAAE,GAAG,CAAC;QACR,MAAM,CAAC,EAAE,SAAS,CAAC;KACtB,GACF,WAAW,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;CAClC,CAAC;AA6CF,eAAO,MAAM,iBAAiB,EAA4B,iBAAiB,CAAC"}

package/dist/adapters/express/index.js

@@ -5,17 +5,17 @@ import { createHttpSession } from "../utils/session.js";
 import { createExpressSocial } from "./social.js";
 export const createExpressAdapter = ({ auth, cache, cookie, getIp, secret, }) => {
     const session = createHttpSession({
+        auth,
+        secret,
+        framework: "Express",
         appendSetCookie: ({ response, value }) => {
             response.append("Set-Cookie", value);
         },
-        auth,
+        getHeader: ({ name, request }) => request.get(name),
+        getMethod: (request) => request.method,
         ...(cache === undefined ? {} : { cache }),
         ...(cookie === undefined ? {} : { cookie }),
-        framework: "Express",
-        getHeader: ({ name, request }) => request.get(name),
         ...(getIp === undefined ? {} : { getIp }),
-        getMethod: (request) => request.method,
-        ...(secret === undefined ? {} : { secret }),
     });
     const resolveSession = (input) => {
         return session.resolveSession(input);
@@ -47,10 +47,10 @@ const createExpressAuthImpl = ({ cache, cookie, db, getIp, password, secret, ses
     });
     const adapter = createExpressAdapter({
         auth,
+        secret,
         ...(cache === undefined ? {} : { cache }),
         ...(cookie === undefined ? {} : { cookie }),
         ...(getIp === undefined ? {} : { getIp }),
-        ...(secret === undefined ? {} : { secret }),
     });
     if (social === undefined) {
         return { ...auth, ...adapter };

package/dist/adapters/express/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/adapters/express/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAA4B,MAAM,eAAe,CAAC;AAKrE,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD,OAAO,EAAE,mBAAmB,EAAsB,MAAM,aAAa,CAAC;AAgGtE,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAA+B,EAC/D,IAAI,EACJ,KAAK,EACL,MAAM,EACN,KAAK,EACL,MAAM,GACuB,EAA4B,EAAE;IAC3D,MAAM,OAAO,GAAG,iBAAiB,CAA8B;QAC3D,eAAe,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE;YACrC,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;QACzC,CAAC;QACD,IAAI;QACJ,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;QACzC,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;QAC3C,SAAS,EAAE,SAAS;QACpB,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;QACnD,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;QACzC,SAAS,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM;QACtC,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;KAC9C,CAAC,CAAC;IAEH,MAAM,cAAc,GAAG,CAAC,KAA0B,EAAsC,EAAE;QACtF,OAAO,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC,CAAC;IAEF,MAAM,cAAc,GAAmB,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE;QACrE,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC1D,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAqC,CAAC;QAE9D,MAAM,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;QAC/B,MAAM,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;QAC/B,MAAM,CAAC,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QACjC,IAAI,EAAE,CAAC;IACX,CAAC,CAAC;IAEF,OAAO;QACH,YAAY,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC;QAC1D,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,aAAa,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC;QACtD,QAAQ,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;QAChD,YAAY,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC;QACpD,cAAc;QACd,cAAc;QACd,aAAa,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC;KACzD,CAAC;AACN,CAAC,CAAC;AAkBF,MAAM,qBAAqB,GAAG,CAAkD,EAC5E,KAAK,EACL,MAAM,EACN,EAAE,EACF,KAAK,EACL,QAAQ,EACR,MAAM,EACN,OAAO,EACP,MAAM,GAC2B,EAC0B,EAAE;IAC7D,MAAM,IAAI,GAAG,UAAU,CAAC;QACpB,EAAE;QACF,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;QAC/C,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;KAChD,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,oBAAoB,CAAC;QACjC,IAAI;QACJ,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;QACzC,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;QAC3C,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;QACzC,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;KAC9C,CAAC,CAAC;IAEH,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,EAAE,CAAC;IACnC,CAAC;IAED,MAAM,cAAc,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAEjD,OAAO;QACH,GAAG,IAAI;QACP,GAAG,OAAO;QACV,MAAM,EAAE,mBAAmB,CAAC;YACxB,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,cAAc,CAAC,OAAO;YAC9B,EAAE,EAAE,eAAe,CAAC,EAAE,CAAC;YACvB,kBAAkB,EAAE,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC;YACvD,MAAM;SACT,CAAC;KACL,CAAC;AACN,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,qBAA0C,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/adapters/express/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAA4B,MAAM,eAAe,CAAC;AAKrE,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD,OAAO,EAAE,mBAAmB,EAAsB,MAAM,aAAa,CAAC;AAqFtE,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAA+B,EAC/D,IAAI,EACJ,KAAK,EACL,MAAM,EACN,KAAK,EACL,MAAM,GACuB,EAA4B,EAAE;IAC3D,MAAM,OAAO,GAAG,iBAAiB,CAA8B;QAC3D,IAAI;QACJ,MAAM;QACN,SAAS,EAAE,SAAS;QACpB,eAAe,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE;YACrC,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;QACzC,CAAC;QACD,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;QACnD,SAAS,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM;QACtC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;QACzC,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;QAC3C,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;KAC5C,CAAC,CAAC;IAEH,MAAM,cAAc,GAAG,CAAC,KAA0B,EAAsC,EAAE;QACtF,OAAO,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC,CAAC;IAEF,MAAM,cAAc,GAAmB,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE;QACrE,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC1D,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAqC,CAAC;QAE9D,MAAM,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;QAC/B,MAAM,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;QAC/B,MAAM,CAAC,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QACjC,IAAI,EAAE,CAAC;IACX,CAAC,CAAC;IAEF,OAAO;QACH,YAAY,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC;QAC1D,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,aAAa,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC;QACtD,QAAQ,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;QAChD,YAAY,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC;QACpD,cAAc;QACd,cAAc;QACd,aAAa,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC;KACzD,CAAC;AACN,CAAC,CAAC;AAkBF,MAAM,qBAAqB,GAAG,CAAkD,EAC5E,KAAK,EACL,MAAM,EACN,EAAE,EACF,KAAK,EACL,QAAQ,EACR,MAAM,EACN,OAAO,EACP,MAAM,GAC2B,EAC0B,EAAE;IAC7D,MAAM,IAAI,GAAG,UAAU,CAAC;QACpB,EAAE;QACF,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;QAC/C,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;KAChD,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,oBAAoB,CAAC;QACjC,IAAI;QACJ,MAAM;QACN,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;QACzC,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;QAC3C,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;KAC5C,CAAC,CAAC;IAEH,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,EAAE,CAAC;IACnC,CAAC;IAED,MAAM,cAAc,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAEjD,OAAO;QACH,GAAG,IAAI;QACP,GAAG,OAAO;QACV,MAAM,EAAE,mBAAmB,CAAC;YACxB,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,cAAc,CAAC,OAAO;YAC9B,EAAE,EAAE,eAAe,CAAC,EAAE,CAAC;YACvB,kBAAkB,EAAE,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC;YACvD,MAAM;SACT,CAAC;KACL,CAAC;AACN,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,qBAA0C,CAAC"}

package/dist/adapters/fastify/index.d.ts

@@ -1,12 +1,12 @@
 import type { FastifyInstance, FastifyReply, FastifyRequest } from "fastify";
 import { type Auth, type AuthDeps } from "../../auth.js";
-import type { SessionCacheConfig } from "../../session/cache.js";
 import type { SessionCookieNames } from "../../session/cookie.js";
+import type { SessionCacheConfig } from "../../session/state.js";
 import type { AuthAccount, DbAdapter, ResolvedSession, Session } from "../../session/types.js";
 import type { SocialConfig, SocialDbAdapter } from "../../social/types.js";
 import type { HttpCookieConfig } from "../utils/types.js";
 import { type FastifySocial } from "./social.js";
-export type { SessionCacheConfig } from "../../session/cache.js";
+export type { SessionCacheConfig } from "../../session/state.js";
 export type { FastifySocial, FastifySocialHandler } from "./social.js";
 export type FastifyAuthContext<TAccount extends AuthAccount = AuthAccount> = {
     account: TAccount;
@@ -15,35 +15,29 @@ export type FastifyAuthContext<TAccount extends AuthAccount = AuthAccount> = {
 };
 export type FastifyCookieConfig = HttpCookieConfig;
 export type FastifyGetIp = (request: FastifyRequest) => Promise<string | null | undefined> | string | null | undefined;
-type FastifyCacheOptions = {
-    cache: SessionCacheConfig;
-    secret: string;
-} | {
-    cache?: undefined;
-    secret?: string;
-};
 export type FastifyAdapterConfig<TAccount extends AuthAccount = AuthAccount> = {
     auth: Auth<TAccount>;
     cache?: SessionCacheConfig;
     cookie?: FastifyCookieConfig;
     getIp?: FastifyGetIp;
-    secret?: string;
+    secret: string;
 };
 type FastifyAuthBase<TAccount extends AuthAccount> = Omit<AuthDeps<TAccount>, "db"> & {
+    cache?: SessionCacheConfig;
     cookie?: FastifyCookieConfig;
     db: DbAdapter<TAccount>;
     getIp?: FastifyGetIp;
+    secret: string;
 };
 type FastifySocialOptions<TAccount extends AuthAccount, TData> = {
     db: DbAdapter<TAccount> & SocialDbAdapter<TAccount>;
-    secret: string;
     social: SocialConfig<TData>;
 } | {
     db: DbAdapter<TAccount>;
     social?: undefined;
 };
-export type FastifyAuthConfig<TAccount extends AuthAccount = AuthAccount, TData = undefined> = Omit<FastifyAuthBase<TAccount>, "db"> & FastifyCacheOptions & FastifySocialOptions<TAccount, TData>;
-type FastifyAuthOptions<TAccount extends AuthAccount> = Omit<FastifyAuthBase<TAccount>, "db"> & FastifyCacheOptions;
+export type FastifyAuthConfig<TAccount extends AuthAccount = AuthAccount, TData = undefined> = Omit<FastifyAuthBase<TAccount>, "db"> & FastifySocialOptions<TAccount, TData>;
+type FastifyAuthOptions<TAccount extends AuthAccount> = Omit<FastifyAuthBase<TAccount>, "db">;
 type DbAccount<TDb> = TDb extends DbAdapter<infer TAccount> ? TAccount : never;
 type FastifyRequestInput = {
     reply: FastifyReply;