@geekmidas/constructs 10.0.0-alpha.3 → 10.0.0-alpha.30

package/dist/auth-CJ5dp7T7.d.mts

@@ -0,0 +1,177 @@
+import { c as ServicesOf, n as Construct, r as Consumable, t as Authenticator } from "./construct-interface-D2gesxos.mjs";
+import { ConstructName, Declaration } from "@geekmidas/manifest";
+import { betterAuth } from "better-auth";
+import { EnvironmentParser } from "@geekmidas/envkit";
+import { Service, ServiceRecord, ServiceRegisterOptions } from "@geekmidas/services";
+import { Hono } from "hono";
+//#region src/auth.d.ts
+/** The server better-auth hands back. */
+type AuthServer = ReturnType<typeof betterAuth>;
+/** A signed-in session as better-auth hands it back: `{ user, session }`. */
+type AuthSession = AuthServer['$Infer']['Session'];
+/** Everything better-auth takes, minus what the construct owns. */
+type BetterAuthOptions = Omit<Parameters<typeof betterAuth>[0], 'database' | 'secret' | 'basePath' | 'baseURL'>;
+/**
+ * What an `options` callback is handed: the options this construct was
+ * registered with, and a client for each construct its `dependsOn` names —
+ * keyed by service name, exactly as an endpoint's handler receives them.
+ */
+type BetterAuthOptionsContext<TUses extends readonly Consumable[]> = ServiceRegisterOptions & {
+  services: ServiceRecord<[...ServicesOf<TUses>]>;
+};
+interface BetterAuthConfig<TDatabase extends Consumable, TUses extends readonly Consumable[] = readonly []> {
+  /**
+   * The schema tenant its tables live in.
+   *
+   * A construct rather than a URL: the tenant already declares its schema and
+   * its role, and taking the declaration is what puts the edge in the graph
+   * instead of a connection string in two places.
+   */
+  database: TDatabase;
+  /**
+   * The app that serves this auth server, relative to the workspace root —
+   * `'apps/auth'`.
+   *
+   * Required, for the reason `RestApi.path` is. Not to be confused with
+   * `basePath`, which is where its routes are mounted in a URL.
+   */
+  path: string;
+  /**
+   * Where the auth routes are mounted, e.g. `/api/auth`.
+   *
+   * Structural — it is part of the URL every client calls, so it cannot differ
+   * between stages the way the host can.
+   */
+  basePath?: string;
+  /**
+   * The constructs `options` uses — the mailer a magic link goes through,
+   * most often.
+   *
+   * One list, two jobs, the way an endpoint's `.dependsOn()` has: each is an
+   * edge on the server's handler, so whatever is composed from the edges (a
+   * container's environment, a deploy's grants) includes it; and each is
+   * handed to `options` as a client in `services`, so there is no other way
+   * for `options` to reach it — nothing to import and register by hand, and
+   * so nothing that can be used without being declared.
+   */
+  dependsOn?: TUses;
+  /**
+   * The rest of better-auth's options: providers, plugins, email settings.
+   *
+   * A function when they need another construct — a magic-link plugin has to
+   * *send* the link. It is handed the options this construct was registered
+   * with, and `services`: a client for each construct in `dependsOn`.
+   */
+  options?: BetterAuthOptions | ((context: BetterAuthOptionsContext<TUses>) => BetterAuthOptions | Promise<BetterAuthOptions>);
+}
+declare class BetterAuth<TName extends string = string, TDatabase extends Consumable = Consumable, const TUses extends readonly Consumable[] = readonly []> implements Construct<TName, AuthServer>, Authenticator<AuthSession> {
+  private readonly config;
+  readonly id: TName;
+  readonly service: Service<Uncapitalize<TName>, AuthServer>;
+  readonly basePath: string;
+  /**
+   * Declared once and read by both `declare()` and `connect()`, so the keys the
+   * target publishes and the keys the server reads cannot drift.
+   */
+  private readonly keys;
+  constructor(id: ConstructName<TName>, config: BetterAuthConfig<TDatabase, TUses>);
+  /**
+   * A signing secret and a surface.
+   *
+   * The database is *not* declared here — the tenant that was passed in
+   * declares it, and declaring it twice is the duplication the whole model
+   * removes. What is declared is what this construct owns: the key it signs
+   * with, and the routes it answers on.
+   *
+   * One endpoint, wildcarded. Better Auth routes internally and the set of
+   * paths depends on which capabilities are enabled, so enumerating them here
+   * would be a copy of its router that goes stale on its next release. The
+   * surface's job is to send everything under `basePath` to one handler, which
+   * is exactly what the declaration says.
+   */
+  declare(): Declaration[];
+  /**
+   * Whose request this is: the session for these headers, or `null`.
+   *
+   * Asked of the auth server over HTTP, at the URL the `.auth()` edge injects —
+   * so it is the same call whether the server runs in this process, beside
+   * it, or behind MSW in a test. Only the session headers are forwarded; the
+   * surface decides which.
+   */
+  verify(headers: Headers, envParser: EnvironmentParser<{}>): Promise<AuthSession | null>;
+  /**
+   * The tenant this server keeps its tables in — whose migrations folder,
+   * `db/<tenant>/`, Better Auth's schema is written into.
+   */
+  get databaseId(): string;
+  /**
+   * The SQL that brings the tenant up to Better Auth's schema, or `undefined`
+   * when it already matches.
+   *
+   * What `gkm migration` writes as the tenant's next migration, so Better
+   * Auth's tables are committed, reviewed and applied like any other — rather
+   * than diffed against the database at runtime, where a change nobody wrote
+   * down happens on whichever machine migrates first.
+   *
+   * Compared as the owner, against the tenant `gkm migrate` has already brought
+   * up to date: what comes back is only what the committed files are missing.
+   */
+  pendingMigration(options: ServiceRegisterOptions): Promise<string | undefined>;
+  /**
+   * The server this surface runs as, built from its own declaration.
+   *
+   * A surface is a deploy unit, so something has to serve it, and the thing
+   * that knows how is the construct — not a generator writing a mount into
+   * somebody else's entry point. That is how the auth server came to be
+   * mounted by a hook in the application it was supposed to be separate from,
+   * and then to be served by nothing at all when the hook was deleted.
+   *
+   * The routes come from {@link declare}: one wildcard under `basePath`, read
+   * off the same declaration the manifest carries, so the surface the graph
+   * describes and the surface that answers requests cannot disagree.
+   *
+   * ```ts
+   * // .gkm/server/app.ts — the whole generated entry
+   * import { auth } from '@acme/constructs/auth.js';
+   * export const { app } = await auth.server({ envParser });
+   * ```
+   */
+  server(options: ServiceRegisterOptions): Promise<{
+    app: Hono;
+  }>;
+  /**
+   * The ids of the better-auth plugins this server runs — what a client has
+   * to pair its own plugins with (`magic-link` with `magicLinkClient`).
+   * Resolved the way the server resolves them, options callback included.
+   */
+  pluginIds(options: ServiceRegisterOptions): Promise<string[]>;
+  /** Better-auth's options as given — a value, or a callback of the environment. */
+  private configured;
+  private connect;
+  /**
+   * Everything better-auth is given: the app's options, and what the construct
+   * owns — its secret, its URL, its tenant's connection, the origins and cookie
+   * domain its graph derives. One place, so the server and its migrations are
+   * built from the same options.
+   */
+  private optionsFor;
+}
+/** The auth server answered a session check with something other than 200. */
+declare class SessionCheckFailed extends Error {
+  readonly authenticator: string;
+  readonly status: number;
+  constructor(authenticator: string, status: number);
+}
+/**
+ * Better Auth's DDL, safe to run where its tables already exist.
+ *
+ * Its SQL is Kysely's, so its shape is known: `create table "…"`, `create index
+ * "…"`, `alter table "…" add column "…"`. A database that has been running
+ * already has those — Better Auth used to create them at runtime — and the
+ * first committed migration would fail on them rather than recording that they
+ * are there.
+ */
+declare function idempotent(statements: string): string;
+//#endregion
+export { BetterAuthOptions as a, idempotent as c, BetterAuthConfig as i, AuthSession as n, BetterAuthOptionsContext as o, BetterAuth as r, SessionCheckFailed as s, AuthServer as t };
+//# sourceMappingURL=auth-CJ5dp7T7.d.mts.map

package/dist/auth-CJ5dp7T7.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-CJ5dp7T7.d.mts","names":[],"sources":["../src/auth.ts"],"mappings":";;;;;;;;KAqDY,aAAa,kBAAkB;;KAG/B,cAAc;;KAGd,oBAAoB,KAC/B,kBAAkB;;;;;;KASP,yBAAyB,uBAAuB,gBAC3D;EACC,UAAU,kBAAkB,WAAW;;UAGxB,iBAChB,kBAAkB,YAClB,uBAAuB;;;;;;;;EASvB,UAAU;;;;;;;;EAQV;;;;;;;EAOA;;;;;;;;;;;;EAYA,YAAY;;;;;;;;EAQZ,UACG,sBAEA,SAAS,yBAAyB,WAC7B,oBAAoB,QAAQ;;cAKxB,WACZ,+BACA,kBAAkB,aAAa,kBACzB,uBAAuB,uCACjB,UAAU,OAAO,aAAa,cAAc;mBAoBtC;WAlBT,IAAI;WACJ,SAAS,QAAQ,aAAa,QAAQ;WACtC;;;;;mBAMQ;EAQjB,YACC,IAAI,cAAc,QACD,QAAQ,iBAAiB,WAAW;;;;;;;;;;;;;;;EAuCtD,WAAW;;;;;;;;;EA6CL,OACL,SAAS,SACT,WAAW,wBACT,QAAQ;;;;;MAuBP;;;;;;;;;;;;;EAgBE,iBACL,SAAS,yBACP;;;;;;;;;;;;;;;;;;;;EAiDG,OAAO,SAAS,yBAAyB;IAAU,KAAK;;;;;;;EAoDxD,UAAU,SAAS,yBAAyB;;UAMpC;UAuBA;;;;;;;UAkBA;;;cAqFF,2BAA2B;WAE7B;WACA;EAFV,YACU,uBACA;;;;;;;;;;;iBAoBK,WAAW"}

package/dist/auth.cjs

@@ -1,11 +1,11 @@
-const require_chunk = require('./chunk-DWy1uDak.cjs');
-const require_construct_interface = require('./construct-interface-BfjcOD_E.cjs');
-const __geekmidas_manifest = require_chunk.__toESM(require("@geekmidas/manifest"));
-const better_auth = require_chunk.__toESM(require("better-auth"));
-
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_construct_interface = require("./construct-interface.cjs");
+let _geekmidas_manifest = require("@geekmidas/manifest");
+let better_auth = require("better-auth");
 //#region src/auth.ts
 const DEFAULT_BASE_PATH = "/api/auth";
 var BetterAuth = class {
+	config;
 	id;
 	service;
 	basePath;
@@ -16,19 +16,19 @@ var BetterAuth = class {
 	keys;
 	constructor(id, config) {
 		this.config = config;
-		const canonical = (0, __geekmidas_manifest.canonicalId)(id);
+		const canonical = (0, _geekmidas_manifest.canonicalId)(id);
 		this.id = canonical;
 		this.basePath = config.basePath ?? DEFAULT_BASE_PATH;
 		const secretId = `${canonical}Secret`;
 		this.keys = {
 			secretId,
-			secret: (0, __geekmidas_manifest.environmentCase)(secretId),
-			url: (0, __geekmidas_manifest.provideKey)(canonical, "url"),
-			trustedOrigins: (0, __geekmidas_manifest.provideKey)(canonical, "trustedOrigins"),
-			cookieDomain: (0, __geekmidas_manifest.provideKey)(canonical, "cookieDomain")
+			secret: (0, _geekmidas_manifest.environmentCase)(secretId),
+			url: (0, _geekmidas_manifest.provideKey)(canonical, "url"),
+			trustedOrigins: (0, _geekmidas_manifest.provideKey)(canonical, "trustedOrigins"),
+			cookieDomain: (0, _geekmidas_manifest.provideKey)(canonical, "cookieDomain")
 		};
 		this.service = {
-			serviceName: (0, __geekmidas_manifest.serviceKey)(canonical),
+			serviceName: (0, _geekmidas_manifest.serviceKey)(canonical),
 			register: (options) => this.connect(options)
 		};
 	}
@@ -54,7 +54,7 @@ var BetterAuth = class {
 		}, {
 			kind: "rest-api",
 			id: this.id,
-			...this.config.app ? { app: this.config.app } : {},
+			path: this.config.path,
 			provides: [
 				this.keys.url,
 				this.keys.trustedOrigins,
@@ -65,22 +65,55 @@ var BetterAuth = class {
 				handler: `${this.id}.handler`,
 				method: "ANY",
 				path: `${this.basePath}/*`,
-				dependencies: [require_construct_interface.edgeTo(this.config.database)],
+				dependencies: [require_construct_interface.edgeTo(this.config.database), ...(this.config.dependsOn ?? []).map(require_construct_interface.edgeTo)],
 				requires: [this.keys.secret]
 			}]
 		}];
 	}
 	/**
-	* Better Auth's own migrations, for the app's migrate step.
+	* Whose request this is: the session for these headers, or `null`.
 	*
-	* It brings its own schema — users, sessions, accounts, verifications — so
-	* the app never writes those tables and never gets to drift from them.
+	* Asked of the auth server over HTTP, at the URL the `.auth()` edge injects —
+	* so it is the same call whether the server runs in this process, beside
+	* it, or behind MSW in a test. Only the session headers are forwarded; the
+	* surface decides which.
+	*/
+	async verify(headers, envParser) {
+		const { url } = envParser.create((get) => ({ url: get(this.keys.url).string() })).parse();
+		const response = await fetch(`${url}${this.basePath}/get-session`, { headers });
+		if (!response.ok) throw new SessionCheckFailed(this.id, response.status);
+		return await response.json();
+	}
+	/**
+	* The tenant this server keeps its tables in — whose migrations folder,
+	* `db/<tenant>/`, Better Auth's schema is written into.
 	*/
-	async migrations(options) {
-		const auth = await this.connect(options, { owner: true });
-		const { getMigrations } = await import("better-auth/db");
-		const { runMigrations } = await getMigrations(auth.options);
-		return runMigrations;
+	get databaseId() {
+		return this.config.database.id;
+	}
+	/**
+	* The SQL that brings the tenant up to Better Auth's schema, or `undefined`
+	* when it already matches.
+	*
+	* What `gkm migration` writes as the tenant's next migration, so Better
+	* Auth's tables are committed, reviewed and applied like any other — rather
+	* than diffed against the database at runtime, where a change nobody wrote
+	* down happens on whichever machine migrates first.
+	*
+	* Compared as the owner, against the tenant `gkm migrate` has already brought
+	* up to date: what comes back is only what the committed files are missing.
+	*/
+	async pendingMigration(options) {
+		const resolved = await this.optionsFor(options, { owner: true });
+		const db = resolved.database.db;
+		try {
+			const { getMigrations } = await import("better-auth/db/migration");
+			const { toBeCreated, toBeAdded, toBeAddedIndexes, compileMigrations } = await getMigrations(resolved);
+			if (toBeCreated.length === 0 && toBeAdded.length === 0 && toBeAddedIndexes.length === 0) return;
+			return idempotent(await compileMigrations());
+		} finally {
+			await db.destroy();
+		}
 	}
 	/**
 	* The server this surface runs as, built from its own declaration.
@@ -126,7 +159,36 @@ var BetterAuth = class {
 		}
 		return { app };
 	}
+	/**
+	* The ids of the better-auth plugins this server runs — what a client has
+	* to pair its own plugins with (`magic-link` with `magicLinkClient`).
+	* Resolved the way the server resolves them, options callback included.
+	*/
+	async pluginIds(options) {
+		const { plugins = [] } = await this.configured(options);
+		return plugins.map(({ id }) => id);
+	}
+	/** Better-auth's options as given — a value, or a callback of the environment. */
+	async configured(options) {
+		const configure = this.config.options;
+		if (typeof configure !== "function") return configure ?? {};
+		const services = {};
+		for (const construct of this.config.dependsOn ?? []) services[construct.service.serviceName] = await construct.service.register(options);
+		return configure({
+			...options,
+			services
+		});
+	}
 	async connect(options, as = {}) {
+		return (0, better_auth.betterAuth)(await this.optionsFor(options, as));
+	}
+	/**
+	* Everything better-auth is given: the app's options, and what the construct
+	* owns — its secret, its URL, its tenant's connection, the origins and cookie
+	* domain its graph derives. One place, so the server and its migrations are
+	* built from the same options.
+	*/
+	async optionsFor(options, as = {}) {
 		const { secret, baseUrl, trustedOrigins, cookieDomain } = options.envParser.create((get) => ({
 			secret: get(this.keys.secret).string(),
 			baseUrl: get(this.keys.url).string(),
@@ -134,11 +196,9 @@ var BetterAuth = class {
 			cookieDomain: get(this.keys.cookieDomain).string().optional()
 		})).parse();
 		const tenant = this.config.database;
-		const source = as.owner && tenant.owner ? tenant.owner : tenant.service;
-		const db = await source.register(options);
-		const configure = this.config.options;
-		const configured = typeof configure === "function" ? await configure(options) : configure ?? {};
-		return (0, better_auth.betterAuth)({
+		const db = await (as.owner && tenant.owner ? tenant.owner : tenant.service).register(options);
+		const configured = await this.configured(options);
+		return {
 			...configured,
 			secret,
 			baseURL: baseUrl,
@@ -156,10 +216,35 @@ var BetterAuth = class {
 					...configured.advanced?.crossSubDomainCookies
 				} } : {}
 			}
-		});
+		};
 	}
 };
-
+/** The auth server answered a session check with something other than 200. */
+var SessionCheckFailed = class extends Error {
+	authenticator;
+	status;
+	constructor(authenticator, status) {
+		super(`'${authenticator}' answered a session check with ${status}. A request with no session gets 200 and null; this is the server failing — check that it is running and reachable at its URL.`);
+		this.authenticator = authenticator;
+		this.status = status;
+		this.name = "SessionCheckFailed";
+	}
+};
+/**
+* Better Auth's DDL, safe to run where its tables already exist.
+*
+* Its SQL is Kysely's, so its shape is known: `create table "…"`, `create index
+* "…"`, `alter table "…" add column "…"`. A database that has been running
+* already has those — Better Auth used to create them at runtime — and the
+* first committed migration would fail on them rather than recording that they
+* are there.
+*/
+function idempotent(statements) {
+	return statements.replace(/\bcreate table "/gi, "create table if not exists \"").replace(/\bcreate (unique )?index "/gi, (_, unique = "") => `create ${unique}index if not exists "`).replace(/\badd column "/gi, "add column if not exists \"");
+}
 //#endregion
 exports.BetterAuth = BetterAuth;
+exports.SessionCheckFailed = SessionCheckFailed;
+exports.idempotent = idempotent;
+
 //# sourceMappingURL=auth.cjs.map

package/dist/auth.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"auth.cjs","names":["id: ConstructName<TName>","config: BetterAuthConfig<TDatabase>","options: ServiceRegisterOptions","value: string","as: { owner?: boolean }","configured: BetterAuthOptions"],"sources":["../src/auth.ts"],"sourcesContent":["/**\n * `BetterAuth` — a declared auth server.\n *\n * It is three things at once, which is what makes it the construct that\n * exercises most of the model: a consumer of a database, a producer of an\n * authorizer, and a set of endpoints. This lands the first two.\n *\n * Its tables live in a schema tenant it is *given* — `orders.schema('AuthDb')`\n * — rather than one it invents. The tenant declares the schema and the role;\n * this declares the one thing left, the signing secret, and reads back the keys\n * it needs.\n *\n * :::caution\n * The isolation that arrangement is *for* — the application's own role holding\n * no grant on these tables, so a compromised handler cannot read sessions — does\n * **not hold yet**. No target creates the per-schema role: both connect as the\n * database owner, so today the tenant is a `search_path`, which is a namespace\n * and not a privilege boundary. See \"Roles are declared and never created\" in\n * `docs/design/constructs-outstanding.md`.\n * :::\n *\n * It declares its own surface, so where it answers, who may call it, and the\n * domain its cookies are scoped to all arrive as environment resolved by the\n * target — none of them guessed from a port, and none of them listed by hand in\n * application config.\n */\n\nimport {\n\ttype AppSpec,\n\ttype ConstructName,\n\tcanonicalId,\n\ttype Declaration,\n\tenvironmentCase,\n\tprovideKey,\n\tserviceKey,\n} from '@geekmidas/manifest';\nimport type { Service, ServiceRegisterOptions } from '@geekmidas/services';\nimport { betterAuth } from 'better-auth';\nimport type { Hono } from 'hono';\nimport type { Kysely } from 'kysely';\nimport { type Construct, type Consumable, edgeTo } from './construct-interface';\n\n/** The server better-auth hands back. */\nexport type AuthServer = ReturnType<typeof betterAuth>;\n\n/** Everything better-auth takes, minus what the construct owns. */\nexport type BetterAuthOptions = Omit<\n\tParameters<typeof betterAuth>[0],\n\t'database' | 'secret' | 'basePath' | 'baseURL'\n>;\n\nexport interface BetterAuthConfig<TDatabase extends Consumable> {\n\t/**\n\t * The schema tenant its tables live in.\n\t *\n\t * A construct rather than a URL: the tenant already declares its schema and\n\t * its role, and taking the declaration is what puts the edge in the graph\n\t * instead of a connection string in two places.\n\t */\n\tdatabase: TDatabase;\n\t/**\n\t * Where the auth routes are mounted, e.g. `/api/auth`.\n\t *\n\t * Structural — it is part of the URL every client calls, so it cannot differ\n\t * between stages the way the host can.\n\t */\n\tbasePath?: string;\n\t/**\n\t * The app that serves this auth server — its own container.\n\t *\n\t * An auth server holds the session secret and reaches the identity tables.\n\t * Its own process is the default because sharing one means the surface it\n\t * shares with can read both.\n\t */\n\tapp?: AppSpec;\n\t/**\n\t * The rest of better-auth's options: providers, plugins, email settings.\n\t *\n\t * A function when they need another construct — a magic-link plugin has to\n\t * *send* the link, and the thing that sends mail is a construct whose client\n\t * has to be registered. It is handed the same `ServiceRegisterOptions` this\n\t * construct was, so the env parser flows through the graph rather than being\n\t * imported out of application config.\n\t */\n\toptions?:\n\t\t| BetterAuthOptions\n\t\t| ((\n\t\t\t\toptions: ServiceRegisterOptions,\n\t\t  ) => BetterAuthOptions | Promise<BetterAuthOptions>);\n}\n\nconst DEFAULT_BASE_PATH = '/api/auth';\n\nexport class BetterAuth<\n\tTName extends string = string,\n\tTDatabase extends Consumable = Consumable,\n> implements Construct<TName, AuthServer>\n{\n\treadonly id: TName;\n\treadonly service: Service<Uncapitalize<TName>, AuthServer>;\n\treadonly basePath: string;\n\n\t/**\n\t * Declared once and read by both `declare()` and `connect()`, so the keys the\n\t * target publishes and the keys the server reads cannot drift.\n\t */\n\tprivate readonly keys: {\n\t\tsecretId: string;\n\t\tsecret: string;\n\t\turl: string;\n\t\ttrustedOrigins: string;\n\t\tcookieDomain: string;\n\t};\n\n\tconstructor(\n\t\tid: ConstructName<TName>,\n\t\tprivate readonly config: BetterAuthConfig<TDatabase>,\n\t) {\n\t\tconst canonical = canonicalId(id as string);\n\n\t\tthis.id = canonical as TName;\n\t\tthis.basePath = config.basePath ?? DEFAULT_BASE_PATH;\n\n\t\t// A secret's name is its key: `Auth` signs with `AUTH_SECRET`, which is\n\t\t// also what better-auth's own tooling looks for.\n\t\tconst secretId = `${canonical}Secret`;\n\t\tthis.keys = {\n\t\t\tsecretId,\n\t\t\tsecret: environmentCase(secretId),\n\t\t\turl: provideKey(canonical, 'url'),\n\t\t\ttrustedOrigins: provideKey(canonical, 'trustedOrigins'),\n\t\t\tcookieDomain: provideKey(canonical, 'cookieDomain'),\n\t\t};\n\n\t\t// A field, not a getter: consumers cache services by object identity.\n\t\tthis.service = {\n\t\t\tserviceName: serviceKey(canonical) as Uncapitalize<TName>,\n\t\t\tregister: (options) => this.connect(options),\n\t\t};\n\t}\n\n\t/**\n\t * A signing secret and a surface.\n\t *\n\t * The database is *not* declared here — the tenant that was passed in\n\t * declares it, and declaring it twice is the duplication the whole model\n\t * removes. What is declared is what this construct owns: the key it signs\n\t * with, and the routes it answers on.\n\t *\n\t * One endpoint, wildcarded. Better Auth routes internally and the set of\n\t * paths depends on which capabilities are enabled, so enumerating them here\n\t * would be a copy of its router that goes stale on its next release. The\n\t * surface's job is to send everything under `basePath` to one handler, which\n\t * is exactly what the declaration says.\n\t */\n\tdeclare(): Declaration[] {\n\t\treturn [\n\t\t\t{\n\t\t\t\tkind: 'secret',\n\t\t\t\tid: this.keys.secretId,\n\t\t\t\tprovides: [this.keys.secret],\n\t\t\t},\n\t\t\t{\n\t\t\t\tkind: 'rest-api',\n\t\t\t\tid: this.id,\n\t\t\t\t...(this.config.app ? { app: this.config.app } : {}),\n\t\t\t\tprovides: [\n\t\t\t\t\tthis.keys.url,\n\t\t\t\t\tthis.keys.trustedOrigins,\n\t\t\t\t\tthis.keys.cookieDomain,\n\t\t\t\t],\n\t\t\t\tendpoints: [\n\t\t\t\t\t{\n\t\t\t\t\t\tid: `${this.id}Handler`,\n\t\t\t\t\t\thandler: `${this.id}.handler`,\n\t\t\t\t\t\tmethod: 'ANY',\n\t\t\t\t\t\tpath: `${this.basePath}/*`,\n\t\t\t\t\t\t// Read off the tenant rather than written down: this\n\t\t\t\t\t\t// construct takes whatever database it is given, and a\n\t\t\t\t\t\t// hardcoded kind is a second statement of a fact the\n\t\t\t\t\t\t// tenant already makes.\n\t\t\t\t\t\tdependencies: [edgeTo(this.config.database)],\n\t\t\t\t\t\trequires: [this.keys.secret],\n\t\t\t\t\t},\n\t\t\t\t],\n\t\t\t},\n\t\t];\n\t}\n\n\t/**\n\t * Better Auth's own migrations, for the app's migrate step.\n\t *\n\t * It brings its own schema — users, sessions, accounts, verifications — so\n\t * the app never writes those tables and never gets to drift from them.\n\t */\n\tasync migrations(\n\t\toptions: ServiceRegisterOptions,\n\t): Promise<() => Promise<void>> {\n\t\t// As the owner, not the runtime role. Creating tables is DDL, and the\n\t\t// whole point of the split is that a handler's role cannot do it — so a\n\t\t// migrator that connected the way a handler does would fail on the first\n\t\t// `CREATE TABLE` rather than working by accident.\n\t\tconst auth = await this.connect(options, { owner: true });\n\t\tconst { getMigrations } = await import('better-auth/db');\n\t\tconst { runMigrations } = await getMigrations(auth.options);\n\n\t\treturn runMigrations;\n\t}\n\n\t/**\n\t * The server this surface runs as, built from its own declaration.\n\t *\n\t * A surface is a deploy unit, so something has to serve it, and the thing\n\t * that knows how is the construct — not a generator writing a mount into\n\t * somebody else's entry point. That is how the auth server came to be\n\t * mounted by a hook in the application it was supposed to be separate from,\n\t * and then to be served by nothing at all when the hook was deleted.\n\t *\n\t * The routes come from {@link declare}: one wildcard under `basePath`, read\n\t * off the same declaration the manifest carries, so the surface the graph\n\t * describes and the surface that answers requests cannot disagree.\n\t *\n\t * ```ts\n\t * // .gkm/server/app.ts — the whole generated entry\n\t * import { auth } from '@acme/constructs/auth.js';\n\t * export const { app } = await auth.server({ envParser });\n\t * ```\n\t */\n\tasync server(options: ServiceRegisterOptions): Promise<{ app: Hono }> {\n\t\tconst { Hono } = await import('hono');\n\t\tconst { cors } = await import('hono/cors');\n\t\tconst app = new Hono();\n\t\tconst server = await this.connect(options);\n\n\t\t// Who may call this surface, read off the graph. The same list Better\n\t\t// Auth checks for CSRF — it arrives as `<ID>_TRUSTED_ORIGINS`, composed\n\t\t// by the target from whatever declared an edge to this construct, so a\n\t\t// site that depends on the auth server is allowed to reach it and\n\t\t// nothing else is. Nobody writes an origin down.\n\t\tconst { origins } = options.envParser\n\t\t\t.create((get) => ({\n\t\t\t\torigins: get(this.keys.trustedOrigins)\n\t\t\t\t\t.string()\n\t\t\t\t\t.default('')\n\t\t\t\t\t.transform((value: string) =>\n\t\t\t\t\t\tvalue\n\t\t\t\t\t\t\t.split(',')\n\t\t\t\t\t\t\t.map((origin) => origin.trim())\n\t\t\t\t\t\t\t.filter(Boolean),\n\t\t\t\t\t),\n\t\t\t}))\n\t\t\t.parse();\n\n\t\tapp.use('*', cors({ origin: origins, credentials: true, maxAge: 3600 }));\n\n\t\t// Read off the declaration rather than restated here. `ANY` is every\n\t\t// method Better Auth routes internally, which is the reason the\n\t\t// declaration wildcards rather than enumerating.\n\t\tconst [surface] = this.declare().filter(\n\t\t\t(d): d is Extract<Declaration, { kind: 'rest-api' }> =>\n\t\t\t\td.kind === 'rest-api',\n\t\t);\n\n\t\tfor (const endpoint of surface?.endpoints ?? []) {\n\t\t\tconst methods =\n\t\t\t\tendpoint.method === 'ANY'\n\t\t\t\t\t? (['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS'] as const)\n\t\t\t\t\t: ([endpoint.method] as const);\n\n\t\t\tapp.on([...methods], endpoint.path, (c) => server.handler(c.req.raw));\n\t\t}\n\n\t\treturn { app };\n\t}\n\n\tprivate async connect(\n\t\toptions: ServiceRegisterOptions,\n\t\tas: { owner?: boolean } = {},\n\t): Promise<AuthServer> {\n\t\tconst { secret, baseUrl, trustedOrigins, cookieDomain } = options.envParser\n\t\t\t.create((get) => ({\n\t\t\t\tsecret: get(this.keys.secret).string(),\n\t\t\t\t// The surface's own URL, resolved by the target — not guessed from\n\t\t\t\t// a port, which was wrong the moment the server moved to 3001.\n\t\t\t\tbaseUrl: get(this.keys.url).string(),\n\t\t\t\t// Better Auth's CSRF check applies to every caller, not just\n\t\t\t\t// browsers, so an API calling the auth server is rejected unless\n\t\t\t\t// its origin is trusted. The list is derived from the graph and\n\t\t\t\t// arrives as one comma-separated value, for the same reason every\n\t\t\t\t// other derived value arrives as a string: it crosses a process\n\t\t\t\t// boundary as env.\n\t\t\t\ttrustedOrigins: get(this.keys.trustedOrigins)\n\t\t\t\t\t.string()\n\t\t\t\t\t.default('')\n\t\t\t\t\t.transform((value) =>\n\t\t\t\t\t\tvalue\n\t\t\t\t\t\t\t.split(',')\n\t\t\t\t\t\t\t.map((origin) => origin.trim())\n\t\t\t\t\t\t\t.filter(Boolean),\n\t\t\t\t\t),\n\t\t\t\t// The domain a session cookie has to carry to be readable by a\n\t\t\t\t// frontend on a sibling host. Optional because there is often\n\t\t\t\t// nothing to widen to: locally everything shares `localhost`,\n\t\t\t\t// where cookies ignore the port and a `Domain` would only be a\n\t\t\t\t// value the browser refuses.\n\t\t\t\tcookieDomain: get(this.keys.cookieDomain).string().optional(),\n\t\t\t}))\n\t\t\t.parse();\n\n\t\t// The tenant's own client: one construct, one connection, so what auth\n\t\t// writes and what the browser inspects cannot be two different databases.\n\t\t// A migration asks the tenant for its owner connection, which the tenant\n\t\t// exposes as a `Service` and not as anything `.dependsOn()` would take.\n\t\tconst tenant = this.config.database as Consumable & {\n\t\t\towner?: Service<string, unknown>;\n\t\t};\n\t\tconst source = as.owner && tenant.owner ? tenant.owner : tenant.service;\n\n\t\tconst db = (await source.register(options)) as Kysely<\n\t\t\tRecord<string, never>\n\t\t>;\n\n\t\t// Hoisted: narrowing a property of `this` is not preserved across the\n\t\t// await, and the false branch is the plain-object form.\n\t\tconst configure = this.config.options;\n\t\tconst configured: BetterAuthOptions =\n\t\t\ttypeof configure === 'function'\n\t\t\t\t? await configure(options)\n\t\t\t\t: (configure ?? {});\n\n\t\treturn betterAuth({\n\t\t\t...configured,\n\t\t\tsecret,\n\t\t\tbaseURL: baseUrl,\n\t\t\tbasePath: this.basePath,\n\t\t\tdatabase: { db, type: 'postgres' },\n\t\t\t// Whatever the app added wins over the derived list rather than\n\t\t\t// replacing it: an origin nobody declared is still sometimes real.\n\t\t\ttrustedOrigins: [\n\t\t\t\t...trustedOrigins,\n\t\t\t\t...(configured.trustedOrigins &&\n\t\t\t\tArray.isArray(configured.trustedOrigins)\n\t\t\t\t\t? configured.trustedOrigins\n\t\t\t\t\t: []),\n\t\t\t],\n\t\t\tadvanced: {\n\t\t\t\t...configured.advanced,\n\t\t\t\t// Only when a domain was derived. Better Auth reads the presence\n\t\t\t\t// of this block as intent, so enabling it with no domain would\n\t\t\t\t// widen the cookie to whatever host happened to set it — and the\n\t\t\t\t// case with nothing to widen to is the common one, not an error.\n\t\t\t\t...(cookieDomain\n\t\t\t\t\t? {\n\t\t\t\t\t\t\tcrossSubDomainCookies: {\n\t\t\t\t\t\t\t\tenabled: true,\n\t\t\t\t\t\t\t\tdomain: cookieDomain,\n\t\t\t\t\t\t\t\t...configured.advanced?.crossSubDomainCookies,\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t}\n\t\t\t\t\t: {}),\n\t\t\t},\n\t\t});\n\t}\n}\n"],"mappings":";;;;;;AA2FA,MAAM,oBAAoB;AAE1B,IAAa,aAAb,MAIA;CACC,AAAS;CACT,AAAS;CACT,AAAS;;;;;CAMT,AAAiB;CAQjB,YACCA,IACiBC,QAChB;EADgB;EAEjB,MAAM,YAAY,sCAAY,GAAa;AAE3C,OAAK,KAAK;AACV,OAAK,WAAW,OAAO,YAAY;EAInC,MAAM,YAAY,EAAE,UAAU;AAC9B,OAAK,OAAO;GACX;GACA,QAAQ,0CAAgB,SAAS;GACjC,KAAK,qCAAW,WAAW,MAAM;GACjC,gBAAgB,qCAAW,WAAW,iBAAiB;GACvD,cAAc,qCAAW,WAAW,eAAe;EACnD;AAGD,OAAK,UAAU;GACd,aAAa,qCAAW,UAAU;GAClC,UAAU,CAAC,YAAY,KAAK,QAAQ,QAAQ;EAC5C;CACD;;;;;;;;;;;;;;;CAgBD,UAAyB;AACxB,SAAO,CACN;GACC,MAAM;GACN,IAAI,KAAK,KAAK;GACd,UAAU,CAAC,KAAK,KAAK,MAAO;EAC5B,GACD;GACC,MAAM;GACN,IAAI,KAAK;GACT,GAAI,KAAK,OAAO,MAAM,EAAE,KAAK,KAAK,OAAO,IAAK,IAAG,CAAE;GACnD,UAAU;IACT,KAAK,KAAK;IACV,KAAK,KAAK;IACV,KAAK,KAAK;GACV;GACD,WAAW,CACV;IACC,KAAK,EAAE,KAAK,GAAG;IACf,UAAU,EAAE,KAAK,GAAG;IACpB,QAAQ;IACR,OAAO,EAAE,KAAK,SAAS;IAKvB,cAAc,CAAC,mCAAO,KAAK,OAAO,SAAS,AAAC;IAC5C,UAAU,CAAC,KAAK,KAAK,MAAO;GAC5B,CACD;EACD,CACD;CACD;;;;;;;CAQD,MAAM,WACLC,SAC+B;EAK/B,MAAM,OAAO,MAAM,KAAK,QAAQ,SAAS,EAAE,OAAO,KAAM,EAAC;EACzD,MAAM,EAAE,eAAe,GAAG,MAAM,OAAO;EACvC,MAAM,EAAE,eAAe,GAAG,MAAM,cAAc,KAAK,QAAQ;AAE3D,SAAO;CACP;;;;;;;;;;;;;;;;;;;;CAqBD,MAAM,OAAOA,SAAyD;EACrE,MAAM,EAAE,MAAM,GAAG,MAAM,OAAO;EAC9B,MAAM,EAAE,MAAM,GAAG,MAAM,OAAO;EAC9B,MAAM,MAAM,IAAI;EAChB,MAAM,SAAS,MAAM,KAAK,QAAQ,QAAQ;EAO1C,MAAM,EAAE,SAAS,GAAG,QAAQ,UAC1B,OAAO,CAAC,SAAS,EACjB,SAAS,IAAI,KAAK,KAAK,eAAe,CACpC,QAAQ,CACR,QAAQ,GAAG,CACX,UAAU,CAACC,UACX,MACE,MAAM,IAAI,CACV,IAAI,CAAC,WAAW,OAAO,MAAM,CAAC,CAC9B,OAAO,QAAQ,CACjB,CACF,GAAE,CACF,OAAO;AAET,MAAI,IAAI,KAAK,KAAK;GAAE,QAAQ;GAAS,aAAa;GAAM,QAAQ;EAAM,EAAC,CAAC;EAKxE,MAAM,CAAC,QAAQ,GAAG,KAAK,SAAS,CAAC,OAChC,CAAC,MACA,EAAE,SAAS,WACZ;AAED,OAAK,MAAM,YAAY,SAAS,aAAa,CAAE,GAAE;GAChD,MAAM,UACL,SAAS,WAAW,QAChB;IAAC;IAAO;IAAQ;IAAO;IAAS;IAAU;GAAU,IACpD,CAAC,SAAS,MAAO;AAEtB,OAAI,GAAG,CAAC,GAAG,OAAQ,GAAE,SAAS,MAAM,CAAC,MAAM,OAAO,QAAQ,EAAE,IAAI,IAAI,CAAC;EACrE;AAED,SAAO,EAAE,IAAK;CACd;CAED,MAAc,QACbD,SACAE,KAA0B,CAAE,GACN;EACtB,MAAM,EAAE,QAAQ,SAAS,gBAAgB,cAAc,GAAG,QAAQ,UAChE,OAAO,CAAC,SAAS;GACjB,QAAQ,IAAI,KAAK,KAAK,OAAO,CAAC,QAAQ;GAGtC,SAAS,IAAI,KAAK,KAAK,IAAI,CAAC,QAAQ;GAOpC,gBAAgB,IAAI,KAAK,KAAK,eAAe,CAC3C,QAAQ,CACR,QAAQ,GAAG,CACX,UAAU,CAAC,UACX,MACE,MAAM,IAAI,CACV,IAAI,CAAC,WAAW,OAAO,MAAM,CAAC,CAC9B,OAAO,QAAQ,CACjB;GAMF,cAAc,IAAI,KAAK,KAAK,aAAa,CAAC,QAAQ,CAAC,UAAU;EAC7D,GAAE,CACF,OAAO;EAMT,MAAM,SAAS,KAAK,OAAO;EAG3B,MAAM,SAAS,GAAG,SAAS,OAAO,QAAQ,OAAO,QAAQ,OAAO;EAEhE,MAAM,KAAM,MAAM,OAAO,SAAS,QAAQ;EAM1C,MAAM,YAAY,KAAK,OAAO;EAC9B,MAAMC,oBACE,cAAc,aAClB,MAAM,UAAU,QAAQ,GACvB,aAAa,CAAE;AAEpB,SAAO,4BAAW;GACjB,GAAG;GACH;GACA,SAAS;GACT,UAAU,KAAK;GACf,UAAU;IAAE;IAAI,MAAM;GAAY;GAGlC,gBAAgB,CACf,GAAG,gBACH,GAAI,WAAW,kBACf,MAAM,QAAQ,WAAW,eAAe,GACrC,WAAW,iBACX,CAAE,CACL;GACD,UAAU;IACT,GAAG,WAAW;IAKd,GAAI,eACD,EACA,uBAAuB;KACtB,SAAS;KACT,QAAQ;KACR,GAAG,WAAW,UAAU;IACxB,EACD,IACA,CAAE;GACL;EACD,EAAC;CACF;AACD"}
+{"version":3,"file":"auth.cjs","names":["canonicalId","environmentCase","provideKey","serviceKey","edgeTo","betterAuth"],"sources":["../src/auth.ts"],"sourcesContent":["/**\n * `BetterAuth` — a declared auth server.\n *\n * It is three things at once, which is what makes it the construct that\n * exercises most of the model: a consumer of a database, a producer of an\n * authorizer, and a set of endpoints. This lands the first two.\n *\n * Its tables live in a schema tenant it is *given* — `orders.schema('AuthDb')`\n * — rather than one it invents. The tenant declares the schema and the role;\n * this declares the one thing left, the signing secret, and reads back the keys\n * it needs.\n *\n * :::caution\n * The isolation that arrangement is *for* — the application's own role holding\n * no grant on these tables, so a compromised handler cannot read sessions — does\n * **not hold yet**. No target creates the per-schema role: both connect as the\n * database owner, so today the tenant is a `search_path`, which is a namespace\n * and not a privilege boundary. See \"Roles are declared and never created\" in\n * `docs/design/constructs-outstanding.md`.\n * :::\n *\n * It declares its own surface, so where it answers, who may call it, and the\n * domain its cookies are scoped to all arrive as environment resolved by the\n * target — none of them guessed from a port, and none of them listed by hand in\n * application config.\n */\n\nimport type { EnvironmentParser } from '@geekmidas/envkit';\nimport {\n\ttype ConstructName,\n\tcanonicalId,\n\ttype Declaration,\n\tenvironmentCase,\n\tprovideKey,\n\tserviceKey,\n} from '@geekmidas/manifest';\nimport type {\n\tService,\n\tServiceRecord,\n\tServiceRegisterOptions,\n} from '@geekmidas/services';\nimport { betterAuth } from 'better-auth';\nimport type { Hono } from 'hono';\nimport type { Kysely } from 'kysely';\nimport {\n\ttype Authenticator,\n\ttype Construct,\n\ttype Consumable,\n\tedgeTo,\n\ttype ServicesOf,\n} from './construct-interface';\n\n/** The server better-auth hands back. */\nexport type AuthServer = ReturnType<typeof betterAuth>;\n\n/** A signed-in session as better-auth hands it back: `{ user, session }`. */\nexport type AuthSession = AuthServer['$Infer']['Session'];\n\n/** Everything better-auth takes, minus what the construct owns. */\nexport type BetterAuthOptions = Omit<\n\tParameters<typeof betterAuth>[0],\n\t'database' | 'secret' | 'basePath' | 'baseURL'\n>;\n\n/**\n * What an `options` callback is handed: the options this construct was\n * registered with, and a client for each construct its `dependsOn` names —\n * keyed by service name, exactly as an endpoint's handler receives them.\n */\nexport type BetterAuthOptionsContext<TUses extends readonly Consumable[]> =\n\tServiceRegisterOptions & {\n\t\tservices: ServiceRecord<[...ServicesOf<TUses>]>;\n\t};\n\nexport interface BetterAuthConfig<\n\tTDatabase extends Consumable,\n\tTUses extends readonly Consumable[] = readonly [],\n> {\n\t/**\n\t * The schema tenant its tables live in.\n\t *\n\t * A construct rather than a URL: the tenant already declares its schema and\n\t * its role, and taking the declaration is what puts the edge in the graph\n\t * instead of a connection string in two places.\n\t */\n\tdatabase: TDatabase;\n\t/**\n\t * The app that serves this auth server, relative to the workspace root —\n\t * `'apps/auth'`.\n\t *\n\t * Required, for the reason `RestApi.path` is. Not to be confused with\n\t * `basePath`, which is where its routes are mounted in a URL.\n\t */\n\tpath: string;\n\t/**\n\t * Where the auth routes are mounted, e.g. `/api/auth`.\n\t *\n\t * Structural — it is part of the URL every client calls, so it cannot differ\n\t * between stages the way the host can.\n\t */\n\tbasePath?: string;\n\t/**\n\t * The constructs `options` uses — the mailer a magic link goes through,\n\t * most often.\n\t *\n\t * One list, two jobs, the way an endpoint's `.dependsOn()` has: each is an\n\t * edge on the server's handler, so whatever is composed from the edges (a\n\t * container's environment, a deploy's grants) includes it; and each is\n\t * handed to `options` as a client in `services`, so there is no other way\n\t * for `options` to reach it — nothing to import and register by hand, and\n\t * so nothing that can be used without being declared.\n\t */\n\tdependsOn?: TUses;\n\t/**\n\t * The rest of better-auth's options: providers, plugins, email settings.\n\t *\n\t * A function when they need another construct — a magic-link plugin has to\n\t * *send* the link. It is handed the options this construct was registered\n\t * with, and `services`: a client for each construct in `dependsOn`.\n\t */\n\toptions?:\n\t\t| BetterAuthOptions\n\t\t| ((\n\t\t\t\tcontext: BetterAuthOptionsContext<TUses>,\n\t\t  ) => BetterAuthOptions | Promise<BetterAuthOptions>);\n}\n\nconst DEFAULT_BASE_PATH = '/api/auth';\n\nexport class BetterAuth<\n\tTName extends string = string,\n\tTDatabase extends Consumable = Consumable,\n\tconst TUses extends readonly Consumable[] = readonly [],\n> implements Construct<TName, AuthServer>, Authenticator<AuthSession>\n{\n\treadonly id: TName;\n\treadonly service: Service<Uncapitalize<TName>, AuthServer>;\n\treadonly basePath: string;\n\n\t/**\n\t * Declared once and read by both `declare()` and `connect()`, so the keys the\n\t * target publishes and the keys the server reads cannot drift.\n\t */\n\tprivate readonly keys: {\n\t\tsecretId: string;\n\t\tsecret: string;\n\t\turl: string;\n\t\ttrustedOrigins: string;\n\t\tcookieDomain: string;\n\t};\n\n\tconstructor(\n\t\tid: ConstructName<TName>,\n\t\tprivate readonly config: BetterAuthConfig<TDatabase, TUses>,\n\t) {\n\t\tconst canonical = canonicalId(id as string);\n\n\t\tthis.id = canonical as TName;\n\t\tthis.basePath = config.basePath ?? DEFAULT_BASE_PATH;\n\n\t\t// A secret's name is its key: `Auth` signs with `AUTH_SECRET`, which is\n\t\t// also what better-auth's own tooling looks for.\n\t\tconst secretId = `${canonical}Secret`;\n\t\tthis.keys = {\n\t\t\tsecretId,\n\t\t\tsecret: environmentCase(secretId),\n\t\t\turl: provideKey(canonical, 'url'),\n\t\t\ttrustedOrigins: provideKey(canonical, 'trustedOrigins'),\n\t\t\tcookieDomain: provideKey(canonical, 'cookieDomain'),\n\t\t};\n\n\t\t// A field, not a getter: consumers cache services by object identity.\n\t\tthis.service = {\n\t\t\tserviceName: serviceKey(canonical) as Uncapitalize<TName>,\n\t\t\tregister: (options) => this.connect(options),\n\t\t};\n\t}\n\n\t/**\n\t * A signing secret and a surface.\n\t *\n\t * The database is *not* declared here — the tenant that was passed in\n\t * declares it, and declaring it twice is the duplication the whole model\n\t * removes. What is declared is what this construct owns: the key it signs\n\t * with, and the routes it answers on.\n\t *\n\t * One endpoint, wildcarded. Better Auth routes internally and the set of\n\t * paths depends on which capabilities are enabled, so enumerating them here\n\t * would be a copy of its router that goes stale on its next release. The\n\t * surface's job is to send everything under `basePath` to one handler, which\n\t * is exactly what the declaration says.\n\t */\n\tdeclare(): Declaration[] {\n\t\treturn [\n\t\t\t{\n\t\t\t\tkind: 'secret',\n\t\t\t\tid: this.keys.secretId,\n\t\t\t\tprovides: [this.keys.secret],\n\t\t\t},\n\t\t\t{\n\t\t\t\tkind: 'rest-api',\n\t\t\t\tid: this.id,\n\t\t\t\tpath: this.config.path,\n\t\t\t\tprovides: [\n\t\t\t\t\tthis.keys.url,\n\t\t\t\t\tthis.keys.trustedOrigins,\n\t\t\t\t\tthis.keys.cookieDomain,\n\t\t\t\t],\n\t\t\t\tendpoints: [\n\t\t\t\t\t{\n\t\t\t\t\t\tid: `${this.id}Handler`,\n\t\t\t\t\t\thandler: `${this.id}.handler`,\n\t\t\t\t\t\tmethod: 'ANY',\n\t\t\t\t\t\tpath: `${this.basePath}/*`,\n\t\t\t\t\t\t// Read off the tenant rather than written down: this\n\t\t\t\t\t\t// construct takes whatever database it is given, and a\n\t\t\t\t\t\t// hardcoded kind is a second statement of a fact the\n\t\t\t\t\t\t// tenant already makes.\n\t\t\t\t\t\tdependencies: [\n\t\t\t\t\t\t\tedgeTo(this.config.database),\n\t\t\t\t\t\t\t...(this.config.dependsOn ?? []).map(edgeTo),\n\t\t\t\t\t\t],\n\t\t\t\t\t\trequires: [this.keys.secret],\n\t\t\t\t\t},\n\t\t\t\t],\n\t\t\t},\n\t\t];\n\t}\n\n\t/**\n\t * Whose request this is: the session for these headers, or `null`.\n\t *\n\t * Asked of the auth server over HTTP, at the URL the `.auth()` edge injects —\n\t * so it is the same call whether the server runs in this process, beside\n\t * it, or behind MSW in a test. Only the session headers are forwarded; the\n\t * surface decides which.\n\t */\n\tasync verify(\n\t\theaders: Headers,\n\t\tenvParser: EnvironmentParser<{}>,\n\t): Promise<AuthSession | null> {\n\t\tconst { url } = envParser\n\t\t\t.create((get) => ({ url: get(this.keys.url).string() }))\n\t\t\t.parse();\n\n\t\tconst response = await fetch(`${url}${this.basePath}/get-session`, {\n\t\t\theaders,\n\t\t});\n\n\t\t// Better Auth answers `null` for a request with no session. Anything\n\t\t// other than a 200 is the server failing, which is not the same thing as\n\t\t// \"signed out\" and must not be read as it.\n\t\tif (!response.ok) {\n\t\t\tthrow new SessionCheckFailed(this.id, response.status);\n\t\t}\n\n\t\treturn (await response.json()) as AuthSession | null;\n\t}\n\n\t/**\n\t * The tenant this server keeps its tables in — whose migrations folder,\n\t * `db/<tenant>/`, Better Auth's schema is written into.\n\t */\n\tget databaseId(): string {\n\t\treturn this.config.database.id;\n\t}\n\n\t/**\n\t * The SQL that brings the tenant up to Better Auth's schema, or `undefined`\n\t * when it already matches.\n\t *\n\t * What `gkm migration` writes as the tenant's next migration, so Better\n\t * Auth's tables are committed, reviewed and applied like any other — rather\n\t * than diffed against the database at runtime, where a change nobody wrote\n\t * down happens on whichever machine migrates first.\n\t *\n\t * Compared as the owner, against the tenant `gkm migrate` has already brought\n\t * up to date: what comes back is only what the committed files are missing.\n\t */\n\tasync pendingMigration(\n\t\toptions: ServiceRegisterOptions,\n\t): Promise<string | undefined> {\n\t\t// The options, not a server built from them: better-auth checks its\n\t\t// schema when a server starts, and before the migration that creates the\n\t\t// tables it can only report them missing.\n\t\tconst resolved = await this.optionsFor(options, { owner: true });\n\t\tconst db = (resolved.database as { db: Kysely<Record<string, never>> }).db;\n\n\t\ttry {\n\t\t\t// better-auth 1.7 split the migration builder out of `better-auth/db`\n\t\t\t// into its own entry, so importing it no longer drags the whole db\n\t\t\t// layer in behind it.\n\t\t\tconst { getMigrations } = await import('better-auth/db/migration');\n\t\t\tconst { toBeCreated, toBeAdded, toBeAddedIndexes, compileMigrations } =\n\t\t\t\tawait getMigrations(resolved);\n\n\t\t\tif (\n\t\t\t\ttoBeCreated.length === 0 &&\n\t\t\t\ttoBeAdded.length === 0 &&\n\t\t\t\ttoBeAddedIndexes.length === 0\n\t\t\t) {\n\t\t\t\treturn undefined;\n\t\t\t}\n\n\t\t\treturn idempotent(await compileMigrations());\n\t\t} finally {\n\t\t\t// Its own pool: left open, it keeps the process that asked alive.\n\t\t\tawait db.destroy();\n\t\t}\n\t}\n\n\t/**\n\t * The server this surface runs as, built from its own declaration.\n\t *\n\t * A surface is a deploy unit, so something has to serve it, and the thing\n\t * that knows how is the construct — not a generator writing a mount into\n\t * somebody else's entry point. That is how the auth server came to be\n\t * mounted by a hook in the application it was supposed to be separate from,\n\t * and then to be served by nothing at all when the hook was deleted.\n\t *\n\t * The routes come from {@link declare}: one wildcard under `basePath`, read\n\t * off the same declaration the manifest carries, so the surface the graph\n\t * describes and the surface that answers requests cannot disagree.\n\t *\n\t * ```ts\n\t * // .gkm/server/app.ts — the whole generated entry\n\t * import { auth } from '@acme/constructs/auth.js';\n\t * export const { app } = await auth.server({ envParser });\n\t * ```\n\t */\n\tasync server(options: ServiceRegisterOptions): Promise<{ app: Hono }> {\n\t\tconst { Hono } = await import('hono');\n\t\tconst { cors } = await import('hono/cors');\n\t\tconst app = new Hono();\n\t\tconst server = await this.connect(options);\n\n\t\t// Who may call this surface, read off the graph. The same list Better\n\t\t// Auth checks for CSRF — it arrives as `<ID>_TRUSTED_ORIGINS`, composed\n\t\t// by the target from whatever declared an edge to this construct, so a\n\t\t// site that depends on the auth server is allowed to reach it and\n\t\t// nothing else is. Nobody writes an origin down.\n\t\tconst { origins } = options.envParser\n\t\t\t.create((get) => ({\n\t\t\t\torigins: get(this.keys.trustedOrigins)\n\t\t\t\t\t.string()\n\t\t\t\t\t.default('')\n\t\t\t\t\t.transform((value: string) =>\n\t\t\t\t\t\tvalue\n\t\t\t\t\t\t\t.split(',')\n\t\t\t\t\t\t\t.map((origin) => origin.trim())\n\t\t\t\t\t\t\t.filter(Boolean),\n\t\t\t\t\t),\n\t\t\t}))\n\t\t\t.parse();\n\n\t\tapp.use('*', cors({ origin: origins, credentials: true, maxAge: 3600 }));\n\n\t\t// Read off the declaration rather than restated here. `ANY` is every\n\t\t// method Better Auth routes internally, which is the reason the\n\t\t// declaration wildcards rather than enumerating.\n\t\tconst [surface] = this.declare().filter(\n\t\t\t(d): d is Extract<Declaration, { kind: 'rest-api' }> =>\n\t\t\t\td.kind === 'rest-api',\n\t\t);\n\n\t\tfor (const endpoint of surface?.endpoints ?? []) {\n\t\t\tconst methods =\n\t\t\t\tendpoint.method === 'ANY'\n\t\t\t\t\t? (['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS'] as const)\n\t\t\t\t\t: ([endpoint.method] as const);\n\n\t\t\tapp.on([...methods], endpoint.path, (c) => server.handler(c.req.raw));\n\t\t}\n\n\t\treturn { app };\n\t}\n\n\t/**\n\t * The ids of the better-auth plugins this server runs — what a client has\n\t * to pair its own plugins with (`magic-link` with `magicLinkClient`).\n\t * Resolved the way the server resolves them, options callback included.\n\t */\n\tasync pluginIds(options: ServiceRegisterOptions): Promise<string[]> {\n\t\tconst { plugins = [] } = await this.configured(options);\n\t\treturn plugins.map(({ id }) => id);\n\t}\n\n\t/** Better-auth's options as given — a value, or a callback of the environment. */\n\tprivate async configured(\n\t\toptions: ServiceRegisterOptions,\n\t): Promise<BetterAuthOptions> {\n\t\t// Hoisted: narrowing a property of `this` is not preserved across the\n\t\t// await, and the false branch is the plain-object form.\n\t\tconst configure = this.config.options;\n\t\tif (typeof configure !== 'function') return configure ?? {};\n\n\t\t// A client for each declared construct, from the options this call was\n\t\t// given — not the process-wide discovery, which keeps whichever env\n\t\t// parser reached it first.\n\t\tconst services: Record<string, unknown> = {};\n\t\tfor (const construct of this.config.dependsOn ?? []) {\n\t\t\tservices[construct.service.serviceName] =\n\t\t\t\tawait construct.service.register(options);\n\t\t}\n\n\t\treturn configure({\n\t\t\t...options,\n\t\t\tservices,\n\t\t} as BetterAuthOptionsContext<TUses>);\n\t}\n\n\tprivate async connect(\n\t\toptions: ServiceRegisterOptions,\n\t\tas: { owner?: boolean } = {},\n\t): Promise<AuthServer> {\n\t\t// `Auth<O>` is invariant in its options in better-auth 1.7, so the value\n\t\t// built from a concrete literal is not assignable to the `AuthServer`\n\t\t// alias, which names the constraint. The runtime object is the same one\n\t\t// either way; the assertion keeps the variance where it happens instead\n\t\t// of spreading a generic through the construct's public type.\n\t\treturn betterAuth(await this.optionsFor(options, as)) as AuthServer;\n\t}\n\n\t/**\n\t * Everything better-auth is given: the app's options, and what the construct\n\t * owns — its secret, its URL, its tenant's connection, the origins and cookie\n\t * domain its graph derives. One place, so the server and its migrations are\n\t * built from the same options.\n\t */\n\tprivate async optionsFor(\n\t\toptions: ServiceRegisterOptions,\n\t\tas: { owner?: boolean } = {},\n\t): Promise<Parameters<typeof betterAuth>[0]> {\n\t\tconst { secret, baseUrl, trustedOrigins, cookieDomain } = options.envParser\n\t\t\t.create((get) => ({\n\t\t\t\tsecret: get(this.keys.secret).string(),\n\t\t\t\t// The surface's own URL, resolved by the target — not guessed from\n\t\t\t\t// a port, which was wrong the moment the server moved to 3001.\n\t\t\t\tbaseUrl: get(this.keys.url).string(),\n\t\t\t\t// Better Auth's CSRF check applies to every caller, not just\n\t\t\t\t// browsers, so an API calling the auth server is rejected unless\n\t\t\t\t// its origin is trusted. The list is derived from the graph and\n\t\t\t\t// arrives as one comma-separated value, for the same reason every\n\t\t\t\t// other derived value arrives as a string: it crosses a process\n\t\t\t\t// boundary as env.\n\t\t\t\ttrustedOrigins: get(this.keys.trustedOrigins)\n\t\t\t\t\t.string()\n\t\t\t\t\t.default('')\n\t\t\t\t\t.transform((value) =>\n\t\t\t\t\t\tvalue\n\t\t\t\t\t\t\t.split(',')\n\t\t\t\t\t\t\t.map((origin) => origin.trim())\n\t\t\t\t\t\t\t.filter(Boolean),\n\t\t\t\t\t),\n\t\t\t\t// The domain a session cookie has to carry to be readable by a\n\t\t\t\t// frontend on a sibling host. Optional because there is often\n\t\t\t\t// nothing to widen to: locally everything shares `localhost`,\n\t\t\t\t// where cookies ignore the port and a `Domain` would only be a\n\t\t\t\t// value the browser refuses.\n\t\t\t\tcookieDomain: get(this.keys.cookieDomain).string().optional(),\n\t\t\t}))\n\t\t\t.parse();\n\n\t\t// The tenant's own client: one construct, one connection, so what auth\n\t\t// writes and what the browser inspects cannot be two different databases.\n\t\t// A migration asks the tenant for its owner connection, which the tenant\n\t\t// exposes as a `Service` and not as anything `.dependsOn()` would take.\n\t\tconst tenant = this.config.database as Consumable & {\n\t\t\towner?: Service<string, unknown>;\n\t\t};\n\t\tconst source = as.owner && tenant.owner ? tenant.owner : tenant.service;\n\n\t\tconst db = (await source.register(options)) as Kysely<\n\t\t\tRecord<string, never>\n\t\t>;\n\n\t\tconst configured = await this.configured(options);\n\n\t\treturn {\n\t\t\t...configured,\n\t\t\tsecret,\n\t\t\tbaseURL: baseUrl,\n\t\t\tbasePath: this.basePath,\n\t\t\tdatabase: { db, type: 'postgres' },\n\t\t\t// Whatever the app added wins over the derived list rather than\n\t\t\t// replacing it: an origin nobody declared is still sometimes real.\n\t\t\ttrustedOrigins: [\n\t\t\t\t...trustedOrigins,\n\t\t\t\t...(configured.trustedOrigins &&\n\t\t\t\tArray.isArray(configured.trustedOrigins)\n\t\t\t\t\t? configured.trustedOrigins\n\t\t\t\t\t: []),\n\t\t\t],\n\t\t\tadvanced: {\n\t\t\t\t...configured.advanced,\n\t\t\t\t// Only when a domain was derived. Better Auth reads the presence\n\t\t\t\t// of this block as intent, so enabling it with no domain would\n\t\t\t\t// widen the cookie to whatever host happened to set it — and the\n\t\t\t\t// case with nothing to widen to is the common one, not an error.\n\t\t\t\t...(cookieDomain\n\t\t\t\t\t? {\n\t\t\t\t\t\t\tcrossSubDomainCookies: {\n\t\t\t\t\t\t\t\tenabled: true,\n\t\t\t\t\t\t\t\tdomain: cookieDomain,\n\t\t\t\t\t\t\t\t...configured.advanced?.crossSubDomainCookies,\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t}\n\t\t\t\t\t: {}),\n\t\t\t},\n\t\t};\n\t}\n}\n\n/** The auth server answered a session check with something other than 200. */\nexport class SessionCheckFailed extends Error {\n\tconstructor(\n\t\treadonly authenticator: string,\n\t\treadonly status: number,\n\t) {\n\t\tsuper(\n\t\t\t`'${authenticator}' answered a session check with ${status}. ` +\n\t\t\t\t`A request with no session gets 200 and null; this is the server ` +\n\t\t\t\t`failing — check that it is running and reachable at its URL.`,\n\t\t);\n\t\tthis.name = 'SessionCheckFailed';\n\t}\n}\n\n/**\n * Better Auth's DDL, safe to run where its tables already exist.\n *\n * Its SQL is Kysely's, so its shape is known: `create table \"…\"`, `create index\n * \"…\"`, `alter table \"…\" add column \"…\"`. A database that has been running\n * already has those — Better Auth used to create them at runtime — and the\n * first committed migration would fail on them rather than recording that they\n * are there.\n */\nexport function idempotent(statements: string): string {\n\treturn statements\n\t\t.replace(/\\bcreate table \"/gi, 'create table if not exists \"')\n\t\t.replace(\n\t\t\t/\\bcreate (unique )?index \"/gi,\n\t\t\t(_, unique = '') => `create ${unique}index if not exists \"`,\n\t\t)\n\t\t.replace(/\\badd column \"/gi, 'add column if not exists \"');\n}\n"],"mappings":";;;;;AA+HA,MAAM,oBAAoB;AAE1B,IAAa,aAAb,MAKA;CAmBmB;CAlBlB;CACA;CACA;;;;;CAMA;CAQA,YACC,IACA,QACC;EADgB,KAAA,SAAA;EAEjB,MAAM,aAAA,GAAYA,oBAAAA,YAAAA,CAAY,EAAY;EAE1C,KAAK,KAAK;EACV,KAAK,WAAW,OAAO,YAAY;EAInC,MAAM,WAAW,GAAG,UAAU;EAC9B,KAAK,OAAO;GACX;GACA,SAAA,GAAQC,oBAAAA,gBAAAA,CAAgB,QAAQ;GAChC,MAAA,GAAKC,oBAAAA,WAAAA,CAAW,WAAW,KAAK;GAChC,iBAAA,GAAgBA,oBAAAA,WAAAA,CAAW,WAAW,gBAAgB;GACtD,eAAA,GAAcA,oBAAAA,WAAAA,CAAW,WAAW,cAAc;EACnD;EAGA,KAAK,UAAU;GACd,cAAA,GAAaC,oBAAAA,WAAAA,CAAW,SAAS;GACjC,WAAW,YAAY,KAAK,QAAQ,OAAO;EAC5C;CACD;;;;;;;;;;;;;;;CAgBA,UAAyB;EACxB,OAAO,CACN;GACC,MAAM;GACN,IAAI,KAAK,KAAK;GACd,UAAU,CAAC,KAAK,KAAK,MAAM;EAC5B,GACA;GACC,MAAM;GACN,IAAI,KAAK;GACT,MAAM,KAAK,OAAO;GAClB,UAAU;IACT,KAAK,KAAK;IACV,KAAK,KAAK;IACV,KAAK,KAAK;GACX;GACA,WAAW,CACV;IACC,IAAI,GAAG,KAAK,GAAG;IACf,SAAS,GAAG,KAAK,GAAG;IACpB,QAAQ;IACR,MAAM,GAAG,KAAK,SAAS;IAKvB,cAAc,CACbC,4BAAAA,OAAO,KAAK,OAAO,QAAQ,GAC3B,IAAI,KAAK,OAAO,aAAa,CAAC,EAAA,CAAG,IAAIA,4BAAAA,MAAM,CAC5C;IACA,UAAU,CAAC,KAAK,KAAK,MAAM;GAC5B,CACD;EACD,CACD;CACD;;;;;;;;;CAUA,MAAM,OACL,SACA,WAC8B;EAC9B,MAAM,EAAE,QAAQ,UACd,QAAQ,SAAS,EAAE,KAAK,IAAI,KAAK,KAAK,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CACvD,MAAM;EAER,MAAM,WAAW,MAAM,MAAM,GAAG,MAAM,KAAK,SAAS,eAAe,EAClE,QACD,CAAC;EAKD,IAAI,CAAC,SAAS,IACb,MAAM,IAAI,mBAAmB,KAAK,IAAI,SAAS,MAAM;EAGtD,OAAQ,MAAM,SAAS,KAAK;CAC7B;;;;;CAMA,IAAI,aAAqB;EACxB,OAAO,KAAK,OAAO,SAAS;CAC7B;;;;;;;;;;;;;CAcA,MAAM,iBACL,SAC8B;EAI9B,MAAM,WAAW,MAAM,KAAK,WAAW,SAAS,EAAE,OAAO,KAAK,CAAC;EAC/D,MAAM,KAAM,SAAS,SAAmD;EAExE,IAAI;GAIH,MAAM,EAAE,kBAAkB,MAAM,OAAO;GACvC,MAAM,EAAE,aAAa,WAAW,kBAAkB,sBACjD,MAAM,cAAc,QAAQ;GAE7B,IACC,YAAY,WAAW,KACvB,UAAU,WAAW,KACrB,iBAAiB,WAAW,GAE5B;GAGD,OAAO,WAAW,MAAM,kBAAkB,CAAC;EAC5C,UAAU;GAET,MAAM,GAAG,QAAQ;EAClB;CACD;;;;;;;;;;;;;;;;;;;;CAqBA,MAAM,OAAO,SAAyD;EACrE,MAAM,EAAE,SAAS,MAAM,OAAO;EAC9B,MAAM,EAAE,SAAS,MAAM,OAAO;EAC9B,MAAM,MAAM,IAAI,KAAK;EACrB,MAAM,SAAS,MAAM,KAAK,QAAQ,OAAO;EAOzC,MAAM,EAAE,YAAY,QAAQ,UAC1B,QAAQ,SAAS,EACjB,SAAS,IAAI,KAAK,KAAK,cAAc,CAAC,CACpC,OAAO,CAAC,CACR,QAAQ,EAAE,CAAC,CACX,WAAW,UACX,MACE,MAAM,GAAG,CAAC,CACV,KAAK,WAAW,OAAO,KAAK,CAAC,CAAC,CAC9B,OAAO,OAAO,CACjB,EACF,EAAE,CAAC,CACF,MAAM;EAER,IAAI,IAAI,KAAK,KAAK;GAAE,QAAQ;GAAS,aAAa;GAAM,QAAQ;EAAK,CAAC,CAAC;EAKvE,MAAM,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,QAC/B,MACA,EAAE,SAAS,UACb;EAEA,KAAK,MAAM,YAAY,SAAS,aAAa,CAAC,GAAG;GAChD,MAAM,UACL,SAAS,WAAW,QAChB;IAAC;IAAO;IAAQ;IAAO;IAAS;IAAU;GAAS,IACnD,CAAC,SAAS,MAAM;GAErB,IAAI,GAAG,CAAC,GAAG,OAAO,GAAG,SAAS,OAAO,MAAM,OAAO,QAAQ,EAAE,IAAI,GAAG,CAAC;EACrE;EAEA,OAAO,EAAE,IAAI;CACd;;;;;;CAOA,MAAM,UAAU,SAAoD;EACnE,MAAM,EAAE,UAAU,CAAC,MAAM,MAAM,KAAK,WAAW,OAAO;EACtD,OAAO,QAAQ,KAAK,EAAE,SAAS,EAAE;CAClC;;CAGA,MAAc,WACb,SAC6B;EAG7B,MAAM,YAAY,KAAK,OAAO;EAC9B,IAAI,OAAO,cAAc,YAAY,OAAO,aAAa,CAAC;EAK1D,MAAM,WAAoC,CAAC;EAC3C,KAAK,MAAM,aAAa,KAAK,OAAO,aAAa,CAAC,GACjD,SAAS,UAAU,QAAQ,eAC1B,MAAM,UAAU,QAAQ,SAAS,OAAO;EAG1C,OAAO,UAAU;GAChB,GAAG;GACH;EACD,CAAoC;CACrC;CAEA,MAAc,QACb,SACA,KAA0B,CAAC,GACL;EAMtB,QAAA,GAAOC,YAAAA,WAAAA,CAAW,MAAM,KAAK,WAAW,SAAS,EAAE,CAAC;CACrD;;;;;;;CAQA,MAAc,WACb,SACA,KAA0B,CAAC,GACiB;EAC5C,MAAM,EAAE,QAAQ,SAAS,gBAAgB,iBAAiB,QAAQ,UAChE,QAAQ,SAAS;GACjB,QAAQ,IAAI,KAAK,KAAK,MAAM,CAAC,CAAC,OAAO;GAGrC,SAAS,IAAI,KAAK,KAAK,GAAG,CAAC,CAAC,OAAO;GAOnC,gBAAgB,IAAI,KAAK,KAAK,cAAc,CAAC,CAC3C,OAAO,CAAC,CACR,QAAQ,EAAE,CAAC,CACX,WAAW,UACX,MACE,MAAM,GAAG,CAAC,CACV,KAAK,WAAW,OAAO,KAAK,CAAC,CAAC,CAC9B,OAAO,OAAO,CACjB;GAMD,cAAc,IAAI,KAAK,KAAK,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS;EAC7D,EAAE,CAAC,CACF,MAAM;EAMR,MAAM,SAAS,KAAK,OAAO;EAK3B,MAAM,KAAM,OAFG,GAAG,SAAS,OAAO,QAAQ,OAAO,QAAQ,OAAO,QAAA,CAEvC,SAAS,OAAO;EAIzC,MAAM,aAAa,MAAM,KAAK,WAAW,OAAO;EAEhD,OAAO;GACN,GAAG;GACH;GACA,SAAS;GACT,UAAU,KAAK;GACf,UAAU;IAAE;IAAI,MAAM;GAAW;GAGjC,gBAAgB,CACf,GAAG,gBACH,GAAI,WAAW,kBACf,MAAM,QAAQ,WAAW,cAAc,IACpC,WAAW,iBACX,CAAC,CACL;GACA,UAAU;IACT,GAAG,WAAW;IAKd,GAAI,eACD,EACA,uBAAuB;KACtB,SAAS;KACT,QAAQ;KACR,GAAG,WAAW,UAAU;IACzB,EACD,IACC,CAAC;GACL;EACD;CACD;AACD;;AAGA,IAAa,qBAAb,cAAwC,MAAM;CAEnC;CACA;CAFV,YACC,eACA,QACC;EACD,MACC,IAAI,cAAc,kCAAkC,OAAO,+HAG5D;EAPS,KAAA,gBAAA;EACA,KAAA,SAAA;EAOT,KAAK,OAAO;CACb;AACD;;;;;;;;;;AAWA,SAAgB,WAAW,YAA4B;CACtD,OAAO,WACL,QAAQ,sBAAsB,+BAA8B,CAAC,CAC7D,QACA,iCACC,GAAG,SAAS,OAAO,UAAU,OAAO,sBACtC,CAAC,CACA,QAAQ,oBAAoB,6BAA4B;AAC3D"}

package/dist/auth.d.cts

@@ -1,108 +1,2 @@
-import { Construct, Consumable } from "./construct-interface-D9d4Gm4p.cjs";
-import { Service, ServiceRegisterOptions } from "@geekmidas/services";
-import { AppSpec, ConstructName, Declaration } from "@geekmidas/manifest";
-import { Hono } from "hono";
-import { betterAuth } from "better-auth";
-
-//#region src/auth.d.ts
-
-/** The server better-auth hands back. */
-type AuthServer = ReturnType<typeof betterAuth>;
-/** Everything better-auth takes, minus what the construct owns. */
-type BetterAuthOptions = Omit<Parameters<typeof betterAuth>[0], 'database' | 'secret' | 'basePath' | 'baseURL'>;
-interface BetterAuthConfig<TDatabase extends Consumable> {
-  /**
-   * The schema tenant its tables live in.
-   *
-   * A construct rather than a URL: the tenant already declares its schema and
-   * its role, and taking the declaration is what puts the edge in the graph
-   * instead of a connection string in two places.
-   */
-  database: TDatabase;
-  /**
-   * Where the auth routes are mounted, e.g. `/api/auth`.
-   *
-   * Structural — it is part of the URL every client calls, so it cannot differ
-   * between stages the way the host can.
-   */
-  basePath?: string;
-  /**
-   * The app that serves this auth server — its own container.
-   *
-   * An auth server holds the session secret and reaches the identity tables.
-   * Its own process is the default because sharing one means the surface it
-   * shares with can read both.
-   */
-  app?: AppSpec;
-  /**
-   * The rest of better-auth's options: providers, plugins, email settings.
-   *
-   * A function when they need another construct — a magic-link plugin has to
-   * *send* the link, and the thing that sends mail is a construct whose client
-   * has to be registered. It is handed the same `ServiceRegisterOptions` this
-   * construct was, so the env parser flows through the graph rather than being
-   * imported out of application config.
-   */
-  options?: BetterAuthOptions | ((options: ServiceRegisterOptions) => BetterAuthOptions | Promise<BetterAuthOptions>);
-}
-declare class BetterAuth<TName extends string = string, TDatabase extends Consumable = Consumable> implements Construct<TName, AuthServer> {
-  private readonly config;
-  readonly id: TName;
-  readonly service: Service<Uncapitalize<TName>, AuthServer>;
-  readonly basePath: string;
-  /**
-   * Declared once and read by both `declare()` and `connect()`, so the keys the
-   * target publishes and the keys the server reads cannot drift.
-   */
-  private readonly keys;
-  constructor(id: ConstructName<TName>, config: BetterAuthConfig<TDatabase>);
-  /**
-   * A signing secret and a surface.
-   *
-   * The database is *not* declared here — the tenant that was passed in
-   * declares it, and declaring it twice is the duplication the whole model
-   * removes. What is declared is what this construct owns: the key it signs
-   * with, and the routes it answers on.
-   *
-   * One endpoint, wildcarded. Better Auth routes internally and the set of
-   * paths depends on which capabilities are enabled, so enumerating them here
-   * would be a copy of its router that goes stale on its next release. The
-   * surface's job is to send everything under `basePath` to one handler, which
-   * is exactly what the declaration says.
-   */
-  declare(): Declaration[];
-  /**
-   * Better Auth's own migrations, for the app's migrate step.
-   *
-   * It brings its own schema — users, sessions, accounts, verifications — so
-   * the app never writes those tables and never gets to drift from them.
-   */
-  migrations(options: ServiceRegisterOptions): Promise<() => Promise<void>>;
-  /**
-   * The server this surface runs as, built from its own declaration.
-   *
-   * A surface is a deploy unit, so something has to serve it, and the thing
-   * that knows how is the construct — not a generator writing a mount into
-   * somebody else's entry point. That is how the auth server came to be
-   * mounted by a hook in the application it was supposed to be separate from,
-   * and then to be served by nothing at all when the hook was deleted.
-   *
-   * The routes come from {@link declare}: one wildcard under `basePath`, read
-   * off the same declaration the manifest carries, so the surface the graph
-   * describes and the surface that answers requests cannot disagree.
-   *
-   * ```ts
-   * // .gkm/server/app.ts — the whole generated entry
-   * import { auth } from '@acme/constructs/auth.js';
-   * export const { app } = await auth.server({ envParser });
-   * ```
-   */
-  server(options: ServiceRegisterOptions): Promise<{
-    app: Hono;
-  }>;
-  private connect;
-}
-//# sourceMappingURL=auth.d.ts.map
-//#endregion
-export { AuthServer, BetterAuth, BetterAuthConfig, BetterAuthOptions };
-//# sourceMappingURL=auth.d.cts.map
+import { a as BetterAuthOptions, c as idempotent, i as BetterAuthConfig, n as AuthSession, o as BetterAuthOptionsContext, r as BetterAuth, s as SessionCheckFailed, t as AuthServer } from "./auth-Bmo1wSQF.cjs";
+export { AuthServer, AuthSession, BetterAuth, BetterAuthConfig, BetterAuthOptions, BetterAuthOptionsContext, SessionCheckFailed, idempotent };