@geekmidas/constructs 10.0.0-alpha.88 → 10.0.0-alpha.89

package/dist/{Endpoint-ViSuXwMB.d.mts → Endpoint-Du-NwPX2.d.mts}

@@ -5,7 +5,7 @@ import { t as Authenticator } from "./construct-interface-DluK3_da.mjs";
 import "./index-CTkKOer4.mjs";
 import { n as LowerHttpMethod, t as HttpMethod } from "./types-DMuSQeLL.mjs";
 import { t as EndpointTelemetry } from "./telemetry-DRtT1_0A.mjs";
-import { i as AuthSession } from "./auth-CYFghDZw.mjs";
+import { i as AuthSession } from "./auth-CcuceLYo.mjs";
 import { ComponentCollector, OpenApiSchemaOptions } from "@geekmidas/schema/openapi";
 import { EnvironmentParser } from "@geekmidas/envkit";
 import { Service, ServiceRecord } from "@geekmidas/services";
@@ -885,4 +885,4 @@ declare enum SuccessStatus {
 type EndpointOutput<T> = T extends Endpoint<any, any, any, infer OutSchema, any, any, any, any> ? InferStandardSchema<OutSchema> : never;
 //#endregion
 export { getSecurityScheme as A, Authorizer as C, OAuthFlows as D, OAuthFlow as E, SecurityScheme as O, MappedAudit as S, BuiltInSecuritySchemeId as T, RlsBypass as _, EndpointContext as a, RlsContextExtractor as b, EndpointSchemas as c, ResponseBuilder as d, SessionFn as f, RLS_BYPASS as g, SessionAuth as h, Endpoint as i, isBuiltInSecurityScheme as j, createAuthorizer as k, EndpointSurface as l, NoAuthenticator as m, ConvertRouteParams as n, EndpointHandler as o, SuccessStatus as p, CookieFn as r, EndpointOutput as s, AuthorizeFn as t, HeaderFn as u, RlsConfig as v, BUILT_IN_SECURITY_SCHEMES as w, ActorExtractor as x, RlsContext as y };
-//# sourceMappingURL=Endpoint-ViSuXwMB.d.mts.map
+//# sourceMappingURL=Endpoint-Du-NwPX2.d.mts.map

package/dist/{Endpoint-C4PZn_mD.d.cts.map → Endpoint-Du-NwPX2.d.mts.map}

@@ -1 +1 @@
-{"version":3,"file":"Endpoint-C4PZn_mD.d.cts","names":[],"sources":["../src/endpoints/Authorizer.ts","../src/endpoints/audit.ts","../src/endpoints/rls.ts","../src/endpoints/sessionAuth.ts","../src/endpoints/Endpoint.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;UAIiB;;EAEhB;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA,QAAQ;;EAER;;GAEC;;;;;UAMe;EAChB,WAAW;EACX,WAAW;EACX,oBAAoB;EACpB,oBAAoB;;UAGJ;EAChB;EACA;EACA;EACA,QAAQ;;;;;;cAOI;;aAEX;aACA;aACA;aACA;;;aAGA;aACA;aACA;;;aAGA;aACA;aACA;aACA;;;aAGA;aACA;aACA;;;aAGA;aACA;aACA;;;aAGA;aACA;aACA;aACA;aACA;;;;KAKU,uCAAuC;;;;UAKlC;;;;EAIhB;;;;EAIA,iBAAiB;;;;;EAKjB;;;;;EAKA;;;;;EAKA,WAAW;;;;;iBAMI,iBACf,cACA,UAAU,KAAK,sBACb;;;;iBAUa,wBACf,eACE,QAAQ;;;;iBAOK,kBACf,cACA,gBAAgB,eAAe,kBAC7B;;;;;;;;;;UC3Hc,YAChB,qBAAqB,kCACrB,gBAAgB,8BAChB,cAAc,iBAAiB,gBAAgB,iBAAiB;;EAGhE,MAAM;;EAEN,UACC,UAAU,gBAAgB,mBACvB,oBAAoB,uBAEnB,oBAAoB,cAAc;;EAEvC,QACC,UAAU,gBAAgB,mBACvB,oBAAoB;;EAIxB,YACC,UAAU,gBAAgB,mBACvB,oBAAoB,gCAEV;;EAEd;;;;;;;;;KAUW,eACX,kBAAkB,gBAClB,oBACA,gBAAgB,SAAS,WACrB;EACJ,UAAU,cAAc;EACxB,SAAS;EACT,QAAQ;EACR,QAAQ;EACR,QAAQ;MACH,aAAa,QAAQ;;;;;;;UC1DV;GACf;;;;;;;;;;;;;;;;;;KAmBU,oBACX,kBAAkB,gBAClB,oBACA,gBAAgB,SAAS,WACrB;EACJ,UAAU,cAAc;EACxB,SAAS;EACT,QAAQ;EACR,QAAQ;EACR,QAAQ;MACH,aAAa,QAAQ;;;;;;;;UASV,UAChB,kBAAkB,gBAClB,oBACA,gBAAgB,SAAS;;EAGzB,WAAW,oBAAoB,WAAW,UAAU;;EAEpD;;;;;cAMY;;;;KAKD,mBAAmB;;;;;;;;;UCzDd;;EAEhB,cAAc,QAAQ;;;cA0CV,wBAAwB;WACf;EAArB,YAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cCKT,SACZ,uBACA,gBAAgB,YAChB,eAAe,sBACf,kBAAkB,0CAClB,kBAAkB,gBAClB,gBAAgB,SAAS,QACzB,oBACA,sBAAsB,sCACtB,kDACA,qBAAqB,mCAAmC,kCAIxD,uBACA,sDACS,SACT,QACA,WACA,SACA,WACA,eACA,0BACA,WACA,sBACA,cACA,gBACC,QACA,WACA,SACA,WACA,WACA,eACA;EAGD;;EAEA,OAAO;;EAEP,QAAQ;;;;;;;;EAQR,SAAS;;EAET;;EAEA;;WAEgB,QAAQ;;;;;;WAMR;;;;;EAMT,YAAY;;WAEH,gBAAgB;;EAEzB,YAAY,UAAU,WAAW,SAAS,UAAU;;;;;;;WAQ3C;;EAET,WAAW,YACjB,WACA,SACA,UACA,QACA;;EAGM,YAAY;;EAEZ,aAAa;;EAEb,iBAAiB,eAAe,WAAW,UAAU;;EAErD,QAAQ,YAAY,cAAc;;EAE1B,kBAAkB,QAAQ,sBAAsB;;EAExD,YAAY,UAAU,WAAW,UAAU;;EAE3C;;UAEC;;;;;;;;;;;;;;;;;;;SA6BK,mBACZ,WAAW,0CACX,UAAU,uBAAoB;;;;;MAS3B,eAAQ,WAAA,mBAAA;;;;;;;;;EAYN,WAAW,gBAAgB,QAChC,gBACA,KAAK,IACH,QAAQ,8BAA8B,OAAO;;;;;;;;EAc1C,UAAU,gBAAgB,QAAQ,oBAAoB;SAMrD,gBAAgB;;;;;;;;;;;;;;SAiBhB,cAAc,SAAS,yBAAyB;;;;;;;;;;;;;;SAiChD,cAAc,mCAAmC;;;;;;;;;;;;;;;;;;;;SA+CjD,mBACN,cACA,eACA,UAAU;;;;;;;;EA2BX,YACC,KAAK,gBAAgB,QAAQ,WAAW,SAAS,YAC/C,8BAA8B;EAUjC,UAAO,KACD,gBACJ,QACA,WACA,SACA,UACA,cACA,WACA,gBACA,UACS,oBACR,kBAAkB,mBAGhB,yBAAyB,aACzB,qBAAqB,yBAAyB,cAC9C,QAAQ,yBAAyB,cACjC,QAAQ,qBAAqB,yBAAyB,qBAGtD,4BACA,eACA,QAAQ;;;;;;;SAoCN,WAAW,WAAW,OAAO;;;;SAW7B,YAAY,GAClB,UAAU,IAAI,qBAAqB,KACjC,YAAY,qBAAqB;;;;;;MAchC,SAC6C,mBAAmB;;;;;;EAQ9D,gBACL,qBAAqB,qBACnB,QAAQ,sBAAsB,QAAQ;;;;;;;;;;;;;;;;;;;EAuJzC,cACC,IACA,QACA,OACA,aACA,MACA,OACA,QACA,QAAQ,cACR,UACA,YACA,SACA,YACA,YACA,WACA,WACA,QACA,QACA,YACA,SACA,uBACA,gBACA,QACA,iBACA,WACA,WACA,cACA,aACE,gBACF,QACA,SACA,QACA,WACA,WACA,SACA,UACA,WACA,eACA,0BACA,cACA,WACA;;;;;;;;;;;;;;;;;;;UAkHe;;EAEhB;;;;;;;;EAQA,WAAW;;;;;EAKX,OAAO;;;;;;;;;;;;;UAcS,gBAChB,uBACA,gBAAgB,YAChB,eAAe,sBACf,gBAAgB,0CAChB,kBAAkB,gBAClB,gBAAgB,SAAS,QACzB,oBACA,kBAAkB,0CAClB,sBAAsB,sCACtB,kDACA,qBAAqB,mCAAmC,kCAIxD,uBACA;;EAGA,OAAO;;EAEP,QAAQ;;EAER,IAAI,gBACH,QACA,WACA,SACA,SACA,UACA,WACA,eACA;;EAGD,WACG,YAAY,WAAW,SAAS,UAAU,QAAQ;;EAGrD;;EAEA;;EAEA;;EAEA;;EAEA,OAAO;;EAEP,QAAQ;;EAER,UAAU;;;;;;;EAOV;;EAEA,QAAQ;;EAER,YAAY,UAAU,WAAW,SAAS,UAAU;;EAEpD,YAAY;;EAEZ,QAAQ;;EAER,SAAS;;EAET,aAAa;;EAEb,SAAS;;;;EAIT,wBAAwB,QAAQ,0BAA0B;;EAE1D,iBAAiB,eAAe,WAAW,UAAU;;EAErD,SAAS,YAAY,cAAc;;EAEnC,kBAAkB,QAAQ,sBAAsB;;EAEhD,YAAY,UAAU,WAAW,UAAU;;EAE3C;;;;;EAKA;;EAEA,YAAY;;;;;;KAOD,kBAAkB;;EAE7B,QAAQ;;EAER,OAAO;;EAEP,MAAM;;KAGK,iBACX,kBAAkB,gBAClB,gBAAgB,SAAS,QACzB,oBACA,eAAe,yCACf;EAEA,UAAU,cAAc;EACxB,QAAQ;EACR,QAAQ;EACR,QAAQ;EACR,SAAS;IACN,8BAA8B,UACjC,uBAAuB;;;;;;;;;;;;;;;;;;KAkBZ,YACX,kBAAkB,gBAClB,gBAAgB,SAAS,QACzB,oBACA,eAAe,yCACf,0BAEA,KAAK,iBAAiB,WAAW,SAAS,UAAU,QAAQ,eACxD;;;;KAKA,mBACJ,kBAAkB,gBAClB,gBAAgB,SAAS;EAEzB,UAAU,cAAc;EACxB,QAAQ;EACR,QAAQ;EACR,QAAQ;;;;;;EAMR,MAAM;;;;;KAMF,uBAAuB,yBAAyB;;;;;;EAQlD,IAAI;;KAGK,eACX,kBAAkB,gBAClB,gBAAgB,SAAS,QACzB,yBACG,mBAAmB,WAAW,WAAW,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;KA4BxD,UACX,kBAAkB,gBAClB,gBAAgB,SAAS,QACzB,oBACA,0BAEA,KAAK,eAAe,WAAW,SAAS,eACpC,QAAQ,YAAY;;;;;;;;;;;;;KAcb,mBAAmB,oBAC9B,mBAAmB,eAAe,eAAe,YAC3C,SAAS,UAAU,mBAAmB,UACzC,mBAAmB,eAAe,aAC9B,SAAS,WACZ;;;;;;;;;;;;;KAcO,sBACX,uBACA,gBAAgB,iBAEf,OAAO,mBAAmB,aACzB,OAAO,gBAAgB,WAAW,YAAY;EAE/C,aAAa,YAAY;;;;;;;;;;;;;;;;;;UA2BV;MACZ;GACH;;;;;;;;;;;;;;;;;;UAmBe;MACZ;GACH;;;;;UAMe;EAChB;EACA;EACA,UAAU;EACV;EACA;EACA;EACA;;;;;UAMgB;EAChB,UAAU;EACV,UAAU;IAAc;IAAe,UAAU;;EACjD,SAAS;;;;;UAMO,qBAAqB;EACrC,MAAM;EACN,UAAU;;;;;cAME;UACJ;EAKR,OAAO,aAAa;EAKpB,OAAO,cAAc,eAAe,UAAU;EAK9C,aACC,cACA,UAAU,KAAK;EAShB,OAAO,MAAM;EAKb,KAAK,GAAG,MAAM,IAAI,qBAAqB;EAIvC,eAAe;;;;;KAQX,oBACJ,kBAAkB,gBAClB,gBAAgB,SAAS,QACzB;;EAGA,UAAU,cAAc;;EAExB,QAAQ;;EAER,QAAQ;;EAER,QAAQ;;EAER,SAAS;;;;;KAML,eACJ,qBAAqB,mCAAmC,kCAIxD,6BACG;;;;;;;EASD,SAAS,QAAQ;;;;;KAMf,gBAAgB,yBAAyB;;;;;;;EAS3C,IAAI;;;;;;;;;;;;;;KAeK,gBACX,cAAc,yCACd,kBAAkB,gBAClB,gBAAgB,SAAS,QACzB,oBACA,qBAAqB,mCAAmC,kCAIxD,uBACA,6BACG,oBAAoB,WAAW,SAAS,YAC3C,8BAA8B,SAC9B,eAAe,cAAc,iBAC7B,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KA+BL,gBACX,eAAe,yCACf,kBAAkB,gBAClB,gBAAgB,SAAS,QACzB,kBAAkB,0CAClB,oBACA,uBACA,2BACA,qBAAqB,mCAAmC,qCAKxD,KAAK,gBACJ,QACA,WACA,SACA,UACA,cACA,WACA,gBAED,UAAU,oBACN,kBAAkB,mBAMlB,yBAAyB,aACzB,qBAAqB,yBAAyB,cAC9C,QAAQ,yBAAyB,cACjC,QAAQ,qBAAqB,yBAAyB,yBAGtD,gCACA,mBACA,QAAQ;;;;aAKD;;EAEX;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA;;KAGW,eAAe,KAC1B,UAAU,8BAA8B,iCACrC,oBAAoB"}
+{"version":3,"file":"Endpoint-Du-NwPX2.d.mts","names":[],"sources":["../src/endpoints/Authorizer.ts","../src/endpoints/audit.ts","../src/endpoints/rls.ts","../src/endpoints/sessionAuth.ts","../src/endpoints/Endpoint.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;UAIiB;;EAEhB;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA,QAAQ;;EAER;;GAEC;;;;;UAMe;EAChB,WAAW;EACX,WAAW;EACX,oBAAoB;EACpB,oBAAoB;;UAGJ;EAChB;EACA;EACA;EACA,QAAQ;;;;;;cAOI;;aAEX;aACA;aACA;aACA;;;aAGA;aACA;aACA;;;aAGA;aACA;aACA;aACA;;;aAGA;aACA;aACA;;;aAGA;aACA;aACA;;;aAGA;aACA;aACA;aACA;aACA;;;;KAKU,uCAAuC;;;;UAKlC;;;;EAIhB;;;;EAIA,iBAAiB;;;;;EAKjB;;;;;EAKA;;;;;EAKA,WAAW;;;;;iBAMI,iBACf,cACA,UAAU,KAAK,sBACb;;;;iBAUa,wBACf,eACE,QAAQ;;;;iBAOK,kBACf,cACA,gBAAgB,eAAe,kBAC7B;;;;;;;;;;UC3Hc,YAChB,qBAAqB,kCACrB,gBAAgB,8BAChB,cAAc,iBAAiB,gBAAgB,iBAAiB;;EAGhE,MAAM;;EAEN,UACC,UAAU,gBAAgB,mBACvB,oBAAoB,uBAEnB,oBAAoB,cAAc;;EAEvC,QACC,UAAU,gBAAgB,mBACvB,oBAAoB;;EAIxB,YACC,UAAU,gBAAgB,mBACvB,oBAAoB,gCAEV;;EAEd;;;;;;;;;KAUW,eACX,kBAAkB,gBAClB,oBACA,gBAAgB,SAAS,WACrB;EACJ,UAAU,cAAc;EACxB,SAAS;EACT,QAAQ;EACR,QAAQ;EACR,QAAQ;MACH,aAAa,QAAQ;;;;;;;UC1DV;GACf;;;;;;;;;;;;;;;;;;KAmBU,oBACX,kBAAkB,gBAClB,oBACA,gBAAgB,SAAS,WACrB;EACJ,UAAU,cAAc;EACxB,SAAS;EACT,QAAQ;EACR,QAAQ;EACR,QAAQ;MACH,aAAa,QAAQ;;;;;;;;UASV,UAChB,kBAAkB,gBAClB,oBACA,gBAAgB,SAAS;;EAGzB,WAAW,oBAAoB,WAAW,UAAU;;EAEpD;;;;;cAMY;;;;KAKD,mBAAmB;;;;;;;;;UCzDd;;EAEhB,cAAc,QAAQ;;;cA0CV,wBAAwB;WACf;EAArB,YAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cCKT,SACZ,uBACA,gBAAgB,YAChB,eAAe,sBACf,kBAAkB,0CAClB,kBAAkB,gBAClB,gBAAgB,SAAS,QACzB,oBACA,sBAAsB,sCACtB,kDACA,qBAAqB,mCAAmC,kCAIxD,uBACA,sDACS,SACT,QACA,WACA,SACA,WACA,eACA,0BACA,WACA,sBACA,cACA,gBACC,QACA,WACA,SACA,WACA,WACA,eACA;EAGD;;EAEA,OAAO;;EAEP,QAAQ;;;;;;;;EAQR,SAAS;;EAET;;EAEA;;WAEgB,QAAQ;;;;;;WAMR;;;;;EAMT,YAAY;;WAEH,gBAAgB;;EAEzB,YAAY,UAAU,WAAW,SAAS,UAAU;;;;;;;WAQ3C;;EAET,WAAW,YACjB,WACA,SACA,UACA,QACA;;EAGM,YAAY;;EAEZ,aAAa;;EAEb,iBAAiB,eAAe,WAAW,UAAU;;EAErD,QAAQ,YAAY,cAAc;;EAE1B,kBAAkB,QAAQ,sBAAsB;;EAExD,YAAY,UAAU,WAAW,UAAU;;EAE3C;;UAEC;;;;;;;;;;;;;;;;;;;SA6BK,mBACZ,WAAW,0CACX,UAAU,uBAAoB;;;;;MAS3B,eAAQ,WAAA,mBAAA;;;;;;;;;EAYN,WAAW,gBAAgB,QAChC,gBACA,KAAK,IACH,QAAQ,8BAA8B,OAAO;;;;;;;;EAc1C,UAAU,gBAAgB,QAAQ,oBAAoB;SAMrD,gBAAgB;;;;;;;;;;;;;;SAiBhB,cAAc,SAAS,yBAAyB;;;;;;;;;;;;;;SAiChD,cAAc,mCAAmC;;;;;;;;;;;;;;;;;;;;SA+CjD,mBACN,cACA,eACA,UAAU;;;;;;;;EA2BX,YACC,KAAK,gBAAgB,QAAQ,WAAW,SAAS,YAC/C,8BAA8B;EAUjC,UAAO,KACD,gBACJ,QACA,WACA,SACA,UACA,cACA,WACA,gBACA,UACS,oBACR,kBAAkB,mBAGhB,yBAAyB,aACzB,qBAAqB,yBAAyB,cAC9C,QAAQ,yBAAyB,cACjC,QAAQ,qBAAqB,yBAAyB,qBAGtD,4BACA,eACA,QAAQ;;;;;;;SAoCN,WAAW,WAAW,OAAO;;;;SAW7B,YAAY,GAClB,UAAU,IAAI,qBAAqB,KACjC,YAAY,qBAAqB;;;;;;MAchC,SAC6C,mBAAmB;;;;;;EAQ9D,gBACL,qBAAqB,qBACnB,QAAQ,sBAAsB,QAAQ;;;;;;;;;;;;;;;;;;;EAuJzC,cACC,IACA,QACA,OACA,aACA,MACA,OACA,QACA,QAAQ,cACR,UACA,YACA,SACA,YACA,YACA,WACA,WACA,QACA,QACA,YACA,SACA,uBACA,gBACA,QACA,iBACA,WACA,WACA,cACA,aACE,gBACF,QACA,SACA,QACA,WACA,WACA,SACA,UACA,WACA,eACA,0BACA,cACA,WACA;;;;;;;;;;;;;;;;;;;UAkHe;;EAEhB;;;;;;;;EAQA,WAAW;;;;;EAKX,OAAO;;;;;;;;;;;;;UAcS,gBAChB,uBACA,gBAAgB,YAChB,eAAe,sBACf,gBAAgB,0CAChB,kBAAkB,gBAClB,gBAAgB,SAAS,QACzB,oBACA,kBAAkB,0CAClB,sBAAsB,sCACtB,kDACA,qBAAqB,mCAAmC,kCAIxD,uBACA;;EAGA,OAAO;;EAEP,QAAQ;;EAER,IAAI,gBACH,QACA,WACA,SACA,SACA,UACA,WACA,eACA;;EAGD,WACG,YAAY,WAAW,SAAS,UAAU,QAAQ;;EAGrD;;EAEA;;EAEA;;EAEA;;EAEA,OAAO;;EAEP,QAAQ;;EAER,UAAU;;;;;;;EAOV;;EAEA,QAAQ;;EAER,YAAY,UAAU,WAAW,SAAS,UAAU;;EAEpD,YAAY;;EAEZ,QAAQ;;EAER,SAAS;;EAET,aAAa;;EAEb,SAAS;;;;EAIT,wBAAwB,QAAQ,0BAA0B;;EAE1D,iBAAiB,eAAe,WAAW,UAAU;;EAErD,SAAS,YAAY,cAAc;;EAEnC,kBAAkB,QAAQ,sBAAsB;;EAEhD,YAAY,UAAU,WAAW,UAAU;;EAE3C;;;;;EAKA;;EAEA,YAAY;;;;;;KAOD,kBAAkB;;EAE7B,QAAQ;;EAER,OAAO;;EAEP,MAAM;;KAGK,iBACX,kBAAkB,gBAClB,gBAAgB,SAAS,QACzB,oBACA,eAAe,yCACf;EAEA,UAAU,cAAc;EACxB,QAAQ;EACR,QAAQ;EACR,QAAQ;EACR,SAAS;IACN,8BAA8B,UACjC,uBAAuB;;;;;;;;;;;;;;;;;;KAkBZ,YACX,kBAAkB,gBAClB,gBAAgB,SAAS,QACzB,oBACA,eAAe,yCACf,0BAEA,KAAK,iBAAiB,WAAW,SAAS,UAAU,QAAQ,eACxD;;;;KAKA,mBACJ,kBAAkB,gBAClB,gBAAgB,SAAS;EAEzB,UAAU,cAAc;EACxB,QAAQ;EACR,QAAQ;EACR,QAAQ;;;;;;EAMR,MAAM;;;;;KAMF,uBAAuB,yBAAyB;;;;;;EAQlD,IAAI;;KAGK,eACX,kBAAkB,gBAClB,gBAAgB,SAAS,QACzB,yBACG,mBAAmB,WAAW,WAAW,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;KA4BxD,UACX,kBAAkB,gBAClB,gBAAgB,SAAS,QACzB,oBACA,0BAEA,KAAK,eAAe,WAAW,SAAS,eACpC,QAAQ,YAAY;;;;;;;;;;;;;KAcb,mBAAmB,oBAC9B,mBAAmB,eAAe,eAAe,YAC3C,SAAS,UAAU,mBAAmB,UACzC,mBAAmB,eAAe,aAC9B,SAAS,WACZ;;;;;;;;;;;;;KAcO,sBACX,uBACA,gBAAgB,iBAEf,OAAO,mBAAmB,aACzB,OAAO,gBAAgB,WAAW,YAAY;EAE/C,aAAa,YAAY;;;;;;;;;;;;;;;;;;UA2BV;MACZ;GACH;;;;;;;;;;;;;;;;;;UAmBe;MACZ;GACH;;;;;UAMe;EAChB;EACA;EACA,UAAU;EACV;EACA;EACA;EACA;;;;;UAMgB;EAChB,UAAU;EACV,UAAU;IAAc;IAAe,UAAU;;EACjD,SAAS;;;;;UAMO,qBAAqB;EACrC,MAAM;EACN,UAAU;;;;;cAME;UACJ;EAKR,OAAO,aAAa;EAKpB,OAAO,cAAc,eAAe,UAAU;EAK9C,aACC,cACA,UAAU,KAAK;EAShB,OAAO,MAAM;EAKb,KAAK,GAAG,MAAM,IAAI,qBAAqB;EAIvC,eAAe;;;;;KAQX,oBACJ,kBAAkB,gBAClB,gBAAgB,SAAS,QACzB;;EAGA,UAAU,cAAc;;EAExB,QAAQ;;EAER,QAAQ;;EAER,QAAQ;;EAER,SAAS;;;;;KAML,eACJ,qBAAqB,mCAAmC,kCAIxD,6BACG;;;;;;;EASD,SAAS,QAAQ;;;;;KAMf,gBAAgB,yBAAyB;;;;;;;EAS3C,IAAI;;;;;;;;;;;;;;KAeK,gBACX,cAAc,yCACd,kBAAkB,gBAClB,gBAAgB,SAAS,QACzB,oBACA,qBAAqB,mCAAmC,kCAIxD,uBACA,6BACG,oBAAoB,WAAW,SAAS,YAC3C,8BAA8B,SAC9B,eAAe,cAAc,iBAC7B,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KA+BL,gBACX,eAAe,yCACf,kBAAkB,gBAClB,gBAAgB,SAAS,QACzB,kBAAkB,0CAClB,oBACA,uBACA,2BACA,qBAAqB,mCAAmC,qCAKxD,KAAK,gBACJ,QACA,WACA,SACA,UACA,cACA,WACA,gBAED,UAAU,oBACN,kBAAkB,mBAMlB,yBAAyB,aACzB,qBAAqB,yBAAyB,cAC9C,QAAQ,yBAAyB,cACjC,QAAQ,qBAAqB,yBAAyB,yBAGtD,gCACA,mBACA,QAAQ;;;;aAKD;;EAEX;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA;;KAGW,eAAe,KAC1B,UAAU,8BAA8B,iCACrC,oBAAoB"}

package/dist/{Endpoint-C4PZn_mD.d.cts → Endpoint-aCvBMPoH.d.cts}

@@ -5,7 +5,7 @@ import { t as Authenticator } from "./construct-interface-B1AfqRl4.cjs";
 import "./index-BuzRvKOQ.cjs";
 import { n as LowerHttpMethod, t as HttpMethod } from "./types-DMuSQeLL.cjs";
 import { t as EndpointTelemetry } from "./telemetry-B48RLjyk.cjs";
-import { i as AuthSession } from "./auth-CwYlcogd.cjs";
+import { i as AuthSession } from "./auth-BMCJN30Y.cjs";
 import { EnvironmentParser } from "@geekmidas/envkit";
 import { Logger } from "@geekmidas/logger";
 import { InferComposableStandardSchema, InferStandardSchema, InferStandardSchemaInput } from "@geekmidas/schema";
@@ -885,4 +885,4 @@ declare enum SuccessStatus {
 type EndpointOutput<T> = T extends Endpoint<any, any, any, infer OutSchema, any, any, any, any> ? InferStandardSchema<OutSchema> : never;
 //#endregion
 export { getSecurityScheme as A, Authorizer as C, OAuthFlows as D, OAuthFlow as E, SecurityScheme as O, MappedAudit as S, BuiltInSecuritySchemeId as T, RlsBypass as _, EndpointContext as a, RlsContextExtractor as b, EndpointSchemas as c, ResponseBuilder as d, SessionFn as f, RLS_BYPASS as g, SessionAuth as h, Endpoint as i, isBuiltInSecurityScheme as j, createAuthorizer as k, EndpointSurface as l, NoAuthenticator as m, ConvertRouteParams as n, EndpointHandler as o, SuccessStatus as p, CookieFn as r, EndpointOutput as s, AuthorizeFn as t, HeaderFn as u, RlsConfig as v, BUILT_IN_SECURITY_SCHEMES as w, ActorExtractor as x, RlsContext as y };
-//# sourceMappingURL=Endpoint-C4PZn_mD.d.cts.map
+//# sourceMappingURL=Endpoint-aCvBMPoH.d.cts.map

package/dist/{Endpoint-ViSuXwMB.d.mts.map → Endpoint-aCvBMPoH.d.cts.map}

@@ -1 +1 @@
-{"version":3,"file":"Endpoint-ViSuXwMB.d.mts","names":[],"sources":["../src/endpoints/Authorizer.ts","../src/endpoints/audit.ts","../src/endpoints/rls.ts","../src/endpoints/sessionAuth.ts","../src/endpoints/Endpoint.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;UAIiB;;EAEhB;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA,QAAQ;;EAER;;GAEC;;;;;UAMe;EAChB,WAAW;EACX,WAAW;EACX,oBAAoB;EACpB,oBAAoB;;UAGJ;EAChB;EACA;EACA;EACA,QAAQ;;;;;;cAOI;;aAEX;aACA;aACA;aACA;;;aAGA;aACA;aACA;;;aAGA;aACA;aACA;aACA;;;aAGA;aACA;aACA;;;aAGA;aACA;aACA;;;aAGA;aACA;aACA;aACA;aACA;;;;KAKU,uCAAuC;;;;UAKlC;;;;EAIhB;;;;EAIA,iBAAiB;;;;;EAKjB;;;;;EAKA;;;;;EAKA,WAAW;;;;;iBAMI,iBACf,cACA,UAAU,KAAK,sBACb;;;;iBAUa,wBACf,eACE,QAAQ;;;;iBAOK,kBACf,cACA,gBAAgB,eAAe,kBAC7B;;;;;;;;;;UC3Hc,YAChB,qBAAqB,kCACrB,gBAAgB,8BAChB,cAAc,iBAAiB,gBAAgB,iBAAiB;;EAGhE,MAAM;;EAEN,UACC,UAAU,gBAAgB,mBACvB,oBAAoB,uBAEnB,oBAAoB,cAAc;;EAEvC,QACC,UAAU,gBAAgB,mBACvB,oBAAoB;;EAIxB,YACC,UAAU,gBAAgB,mBACvB,oBAAoB,gCAEV;;EAEd;;;;;;;;;KAUW,eACX,kBAAkB,gBAClB,oBACA,gBAAgB,SAAS,WACrB;EACJ,UAAU,cAAc;EACxB,SAAS;EACT,QAAQ;EACR,QAAQ;EACR,QAAQ;MACH,aAAa,QAAQ;;;;;;;UC1DV;GACf;;;;;;;;;;;;;;;;;;KAmBU,oBACX,kBAAkB,gBAClB,oBACA,gBAAgB,SAAS,WACrB;EACJ,UAAU,cAAc;EACxB,SAAS;EACT,QAAQ;EACR,QAAQ;EACR,QAAQ;MACH,aAAa,QAAQ;;;;;;;;UASV,UAChB,kBAAkB,gBAClB,oBACA,gBAAgB,SAAS;;EAGzB,WAAW,oBAAoB,WAAW,UAAU;;EAEpD;;;;;cAMY;;;;KAKD,mBAAmB;;;;;;;;;UCzDd;;EAEhB,cAAc,QAAQ;;;cA0CV,wBAAwB;WACf;EAArB,YAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cCKT,SACZ,uBACA,gBAAgB,YAChB,eAAe,sBACf,kBAAkB,0CAClB,kBAAkB,gBAClB,gBAAgB,SAAS,QACzB,oBACA,sBAAsB,sCACtB,kDACA,qBAAqB,mCAAmC,kCAIxD,uBACA,sDACS,SACT,QACA,WACA,SACA,WACA,eACA,0BACA,WACA,sBACA,cACA,gBACC,QACA,WACA,SACA,WACA,WACA,eACA;EAGD;;EAEA,OAAO;;EAEP,QAAQ;;;;;;;;EAQR,SAAS;;EAET;;EAEA;;WAEgB,QAAQ;;;;;;WAMR;;;;;EAMT,YAAY;;WAEH,gBAAgB;;EAEzB,YAAY,UAAU,WAAW,SAAS,UAAU;;;;;;;WAQ3C;;EAET,WAAW,YACjB,WACA,SACA,UACA,QACA;;EAGM,YAAY;;EAEZ,aAAa;;EAEb,iBAAiB,eAAe,WAAW,UAAU;;EAErD,QAAQ,YAAY,cAAc;;EAE1B,kBAAkB,QAAQ,sBAAsB;;EAExD,YAAY,UAAU,WAAW,UAAU;;EAE3C;;UAEC;;;;;;;;;;;;;;;;;;;SA6BK,mBACZ,WAAW,0CACX,UAAU,uBAAoB;;;;;MAS3B,eAAQ,WAAA,mBAAA;;;;;;;;;EAYN,WAAW,gBAAgB,QAChC,gBACA,KAAK,IACH,QAAQ,8BAA8B,OAAO;;;;;;;;EAc1C,UAAU,gBAAgB,QAAQ,oBAAoB;SAMrD,gBAAgB;;;;;;;;;;;;;;SAiBhB,cAAc,SAAS,yBAAyB;;;;;;;;;;;;;;SAiChD,cAAc,mCAAmC;;;;;;;;;;;;;;;;;;;;SA+CjD,mBACN,cACA,eACA,UAAU;;;;;;;;EA2BX,YACC,KAAK,gBAAgB,QAAQ,WAAW,SAAS,YAC/C,8BAA8B;EAUjC,UAAO,KACD,gBACJ,QACA,WACA,SACA,UACA,cACA,WACA,gBACA,UACS,oBACR,kBAAkB,mBAGhB,yBAAyB,aACzB,qBAAqB,yBAAyB,cAC9C,QAAQ,yBAAyB,cACjC,QAAQ,qBAAqB,yBAAyB,qBAGtD,4BACA,eACA,QAAQ;;;;;;;SAoCN,WAAW,WAAW,OAAO;;;;SAW7B,YAAY,GAClB,UAAU,IAAI,qBAAqB,KACjC,YAAY,qBAAqB;;;;;;MAchC,SAC6C,mBAAmB;;;;;;EAQ9D,gBACL,qBAAqB,qBACnB,QAAQ,sBAAsB,QAAQ;;;;;;;;;;;;;;;;;;;EAuJzC,cACC,IACA,QACA,OACA,aACA,MACA,OACA,QACA,QAAQ,cACR,UACA,YACA,SACA,YACA,YACA,WACA,WACA,QACA,QACA,YACA,SACA,uBACA,gBACA,QACA,iBACA,WACA,WACA,cACA,aACE,gBACF,QACA,SACA,QACA,WACA,WACA,SACA,UACA,WACA,eACA,0BACA,cACA,WACA;;;;;;;;;;;;;;;;;;;UAkHe;;EAEhB;;;;;;;;EAQA,WAAW;;;;;EAKX,OAAO;;;;;;;;;;;;;UAcS,gBAChB,uBACA,gBAAgB,YAChB,eAAe,sBACf,gBAAgB,0CAChB,kBAAkB,gBAClB,gBAAgB,SAAS,QACzB,oBACA,kBAAkB,0CAClB,sBAAsB,sCACtB,kDACA,qBAAqB,mCAAmC,kCAIxD,uBACA;;EAGA,OAAO;;EAEP,QAAQ;;EAER,IAAI,gBACH,QACA,WACA,SACA,SACA,UACA,WACA,eACA;;EAGD,WACG,YAAY,WAAW,SAAS,UAAU,QAAQ;;EAGrD;;EAEA;;EAEA;;EAEA;;EAEA,OAAO;;EAEP,QAAQ;;EAER,UAAU;;;;;;;EAOV;;EAEA,QAAQ;;EAER,YAAY,UAAU,WAAW,SAAS,UAAU;;EAEpD,YAAY;;EAEZ,QAAQ;;EAER,SAAS;;EAET,aAAa;;EAEb,SAAS;;;;EAIT,wBAAwB,QAAQ,0BAA0B;;EAE1D,iBAAiB,eAAe,WAAW,UAAU;;EAErD,SAAS,YAAY,cAAc;;EAEnC,kBAAkB,QAAQ,sBAAsB;;EAEhD,YAAY,UAAU,WAAW,UAAU;;EAE3C;;;;;EAKA;;EAEA,YAAY;;;;;;KAOD,kBAAkB;;EAE7B,QAAQ;;EAER,OAAO;;EAEP,MAAM;;KAGK,iBACX,kBAAkB,gBAClB,gBAAgB,SAAS,QACzB,oBACA,eAAe,yCACf;EAEA,UAAU,cAAc;EACxB,QAAQ;EACR,QAAQ;EACR,QAAQ;EACR,SAAS;IACN,8BAA8B,UACjC,uBAAuB;;;;;;;;;;;;;;;;;;KAkBZ,YACX,kBAAkB,gBAClB,gBAAgB,SAAS,QACzB,oBACA,eAAe,yCACf,0BAEA,KAAK,iBAAiB,WAAW,SAAS,UAAU,QAAQ,eACxD;;;;KAKA,mBACJ,kBAAkB,gBAClB,gBAAgB,SAAS;EAEzB,UAAU,cAAc;EACxB,QAAQ;EACR,QAAQ;EACR,QAAQ;;;;;;EAMR,MAAM;;;;;KAMF,uBAAuB,yBAAyB;;;;;;EAQlD,IAAI;;KAGK,eACX,kBAAkB,gBAClB,gBAAgB,SAAS,QACzB,yBACG,mBAAmB,WAAW,WAAW,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;KA4BxD,UACX,kBAAkB,gBAClB,gBAAgB,SAAS,QACzB,oBACA,0BAEA,KAAK,eAAe,WAAW,SAAS,eACpC,QAAQ,YAAY;;;;;;;;;;;;;KAcb,mBAAmB,oBAC9B,mBAAmB,eAAe,eAAe,YAC3C,SAAS,UAAU,mBAAmB,UACzC,mBAAmB,eAAe,aAC9B,SAAS,WACZ;;;;;;;;;;;;;KAcO,sBACX,uBACA,gBAAgB,iBAEf,OAAO,mBAAmB,aACzB,OAAO,gBAAgB,WAAW,YAAY;EAE/C,aAAa,YAAY;;;;;;;;;;;;;;;;;;UA2BV;MACZ;GACH;;;;;;;;;;;;;;;;;;UAmBe;MACZ;GACH;;;;;UAMe;EAChB;EACA;EACA,UAAU;EACV;EACA;EACA;EACA;;;;;UAMgB;EAChB,UAAU;EACV,UAAU;IAAc;IAAe,UAAU;;EACjD,SAAS;;;;;UAMO,qBAAqB;EACrC,MAAM;EACN,UAAU;;;;;cAME;UACJ;EAKR,OAAO,aAAa;EAKpB,OAAO,cAAc,eAAe,UAAU;EAK9C,aACC,cACA,UAAU,KAAK;EAShB,OAAO,MAAM;EAKb,KAAK,GAAG,MAAM,IAAI,qBAAqB;EAIvC,eAAe;;;;;KAQX,oBACJ,kBAAkB,gBAClB,gBAAgB,SAAS,QACzB;;EAGA,UAAU,cAAc;;EAExB,QAAQ;;EAER,QAAQ;;EAER,QAAQ;;EAER,SAAS;;;;;KAML,eACJ,qBAAqB,mCAAmC,kCAIxD,6BACG;;;;;;;EASD,SAAS,QAAQ;;;;;KAMf,gBAAgB,yBAAyB;;;;;;;EAS3C,IAAI;;;;;;;;;;;;;;KAeK,gBACX,cAAc,yCACd,kBAAkB,gBAClB,gBAAgB,SAAS,QACzB,oBACA,qBAAqB,mCAAmC,kCAIxD,uBACA,6BACG,oBAAoB,WAAW,SAAS,YAC3C,8BAA8B,SAC9B,eAAe,cAAc,iBAC7B,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KA+BL,gBACX,eAAe,yCACf,kBAAkB,gBAClB,gBAAgB,SAAS,QACzB,kBAAkB,0CAClB,oBACA,uBACA,2BACA,qBAAqB,mCAAmC,qCAKxD,KAAK,gBACJ,QACA,WACA,SACA,UACA,cACA,WACA,gBAED,UAAU,oBACN,kBAAkB,mBAMlB,yBAAyB,aACzB,qBAAqB,yBAAyB,cAC9C,QAAQ,yBAAyB,cACjC,QAAQ,qBAAqB,yBAAyB,yBAGtD,gCACA,mBACA,QAAQ;;;;aAKD;;EAEX;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA;;KAGW,eAAe,KAC1B,UAAU,8BAA8B,iCACrC,oBAAoB"}
+{"version":3,"file":"Endpoint-aCvBMPoH.d.cts","names":[],"sources":["../src/endpoints/Authorizer.ts","../src/endpoints/audit.ts","../src/endpoints/rls.ts","../src/endpoints/sessionAuth.ts","../src/endpoints/Endpoint.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;UAIiB;;EAEhB;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA,QAAQ;;EAER;;GAEC;;;;;UAMe;EAChB,WAAW;EACX,WAAW;EACX,oBAAoB;EACpB,oBAAoB;;UAGJ;EAChB;EACA;EACA;EACA,QAAQ;;;;;;cAOI;;aAEX;aACA;aACA;aACA;;;aAGA;aACA;aACA;;;aAGA;aACA;aACA;aACA;;;aAGA;aACA;aACA;;;aAGA;aACA;aACA;;;aAGA;aACA;aACA;aACA;aACA;;;;KAKU,uCAAuC;;;;UAKlC;;;;EAIhB;;;;EAIA,iBAAiB;;;;;EAKjB;;;;;EAKA;;;;;EAKA,WAAW;;;;;iBAMI,iBACf,cACA,UAAU,KAAK,sBACb;;;;iBAUa,wBACf,eACE,QAAQ;;;;iBAOK,kBACf,cACA,gBAAgB,eAAe,kBAC7B;;;;;;;;;;UC3Hc,YAChB,qBAAqB,kCACrB,gBAAgB,8BAChB,cAAc,iBAAiB,gBAAgB,iBAAiB;;EAGhE,MAAM;;EAEN,UACC,UAAU,gBAAgB,mBACvB,oBAAoB,uBAEnB,oBAAoB,cAAc;;EAEvC,QACC,UAAU,gBAAgB,mBACvB,oBAAoB;;EAIxB,YACC,UAAU,gBAAgB,mBACvB,oBAAoB,gCAEV;;EAEd;;;;;;;;;KAUW,eACX,kBAAkB,gBAClB,oBACA,gBAAgB,SAAS,WACrB;EACJ,UAAU,cAAc;EACxB,SAAS;EACT,QAAQ;EACR,QAAQ;EACR,QAAQ;MACH,aAAa,QAAQ;;;;;;;UC1DV;GACf;;;;;;;;;;;;;;;;;;KAmBU,oBACX,kBAAkB,gBAClB,oBACA,gBAAgB,SAAS,WACrB;EACJ,UAAU,cAAc;EACxB,SAAS;EACT,QAAQ;EACR,QAAQ;EACR,QAAQ;MACH,aAAa,QAAQ;;;;;;;;UASV,UAChB,kBAAkB,gBAClB,oBACA,gBAAgB,SAAS;;EAGzB,WAAW,oBAAoB,WAAW,UAAU;;EAEpD;;;;;cAMY;;;;KAKD,mBAAmB;;;;;;;;;UCzDd;;EAEhB,cAAc,QAAQ;;;cA0CV,wBAAwB;WACf;EAArB,YAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cCKT,SACZ,uBACA,gBAAgB,YAChB,eAAe,sBACf,kBAAkB,0CAClB,kBAAkB,gBAClB,gBAAgB,SAAS,QACzB,oBACA,sBAAsB,sCACtB,kDACA,qBAAqB,mCAAmC,kCAIxD,uBACA,sDACS,SACT,QACA,WACA,SACA,WACA,eACA,0BACA,WACA,sBACA,cACA,gBACC,QACA,WACA,SACA,WACA,WACA,eACA;EAGD;;EAEA,OAAO;;EAEP,QAAQ;;;;;;;;EAQR,SAAS;;EAET;;EAEA;;WAEgB,QAAQ;;;;;;WAMR;;;;;EAMT,YAAY;;WAEH,gBAAgB;;EAEzB,YAAY,UAAU,WAAW,SAAS,UAAU;;;;;;;WAQ3C;;EAET,WAAW,YACjB,WACA,SACA,UACA,QACA;;EAGM,YAAY;;EAEZ,aAAa;;EAEb,iBAAiB,eAAe,WAAW,UAAU;;EAErD,QAAQ,YAAY,cAAc;;EAE1B,kBAAkB,QAAQ,sBAAsB;;EAExD,YAAY,UAAU,WAAW,UAAU;;EAE3C;;UAEC;;;;;;;;;;;;;;;;;;;SA6BK,mBACZ,WAAW,0CACX,UAAU,uBAAoB;;;;;MAS3B,eAAQ,WAAA,mBAAA;;;;;;;;;EAYN,WAAW,gBAAgB,QAChC,gBACA,KAAK,IACH,QAAQ,8BAA8B,OAAO;;;;;;;;EAc1C,UAAU,gBAAgB,QAAQ,oBAAoB;SAMrD,gBAAgB;;;;;;;;;;;;;;SAiBhB,cAAc,SAAS,yBAAyB;;;;;;;;;;;;;;SAiChD,cAAc,mCAAmC;;;;;;;;;;;;;;;;;;;;SA+CjD,mBACN,cACA,eACA,UAAU;;;;;;;;EA2BX,YACC,KAAK,gBAAgB,QAAQ,WAAW,SAAS,YAC/C,8BAA8B;EAUjC,UAAO,KACD,gBACJ,QACA,WACA,SACA,UACA,cACA,WACA,gBACA,UACS,oBACR,kBAAkB,mBAGhB,yBAAyB,aACzB,qBAAqB,yBAAyB,cAC9C,QAAQ,yBAAyB,cACjC,QAAQ,qBAAqB,yBAAyB,qBAGtD,4BACA,eACA,QAAQ;;;;;;;SAoCN,WAAW,WAAW,OAAO;;;;SAW7B,YAAY,GAClB,UAAU,IAAI,qBAAqB,KACjC,YAAY,qBAAqB;;;;;;MAchC,SAC6C,mBAAmB;;;;;;EAQ9D,gBACL,qBAAqB,qBACnB,QAAQ,sBAAsB,QAAQ;;;;;;;;;;;;;;;;;;;EAuJzC,cACC,IACA,QACA,OACA,aACA,MACA,OACA,QACA,QAAQ,cACR,UACA,YACA,SACA,YACA,YACA,WACA,WACA,QACA,QACA,YACA,SACA,uBACA,gBACA,QACA,iBACA,WACA,WACA,cACA,aACE,gBACF,QACA,SACA,QACA,WACA,WACA,SACA,UACA,WACA,eACA,0BACA,cACA,WACA;;;;;;;;;;;;;;;;;;;UAkHe;;EAEhB;;;;;;;;EAQA,WAAW;;;;;EAKX,OAAO;;;;;;;;;;;;;UAcS,gBAChB,uBACA,gBAAgB,YAChB,eAAe,sBACf,gBAAgB,0CAChB,kBAAkB,gBAClB,gBAAgB,SAAS,QACzB,oBACA,kBAAkB,0CAClB,sBAAsB,sCACtB,kDACA,qBAAqB,mCAAmC,kCAIxD,uBACA;;EAGA,OAAO;;EAEP,QAAQ;;EAER,IAAI,gBACH,QACA,WACA,SACA,SACA,UACA,WACA,eACA;;EAGD,WACG,YAAY,WAAW,SAAS,UAAU,QAAQ;;EAGrD;;EAEA;;EAEA;;EAEA;;EAEA,OAAO;;EAEP,QAAQ;;EAER,UAAU;;;;;;;EAOV;;EAEA,QAAQ;;EAER,YAAY,UAAU,WAAW,SAAS,UAAU;;EAEpD,YAAY;;EAEZ,QAAQ;;EAER,SAAS;;EAET,aAAa;;EAEb,SAAS;;;;EAIT,wBAAwB,QAAQ,0BAA0B;;EAE1D,iBAAiB,eAAe,WAAW,UAAU;;EAErD,SAAS,YAAY,cAAc;;EAEnC,kBAAkB,QAAQ,sBAAsB;;EAEhD,YAAY,UAAU,WAAW,UAAU;;EAE3C;;;;;EAKA;;EAEA,YAAY;;;;;;KAOD,kBAAkB;;EAE7B,QAAQ;;EAER,OAAO;;EAEP,MAAM;;KAGK,iBACX,kBAAkB,gBAClB,gBAAgB,SAAS,QACzB,oBACA,eAAe,yCACf;EAEA,UAAU,cAAc;EACxB,QAAQ;EACR,QAAQ;EACR,QAAQ;EACR,SAAS;IACN,8BAA8B,UACjC,uBAAuB;;;;;;;;;;;;;;;;;;KAkBZ,YACX,kBAAkB,gBAClB,gBAAgB,SAAS,QACzB,oBACA,eAAe,yCACf,0BAEA,KAAK,iBAAiB,WAAW,SAAS,UAAU,QAAQ,eACxD;;;;KAKA,mBACJ,kBAAkB,gBAClB,gBAAgB,SAAS;EAEzB,UAAU,cAAc;EACxB,QAAQ;EACR,QAAQ;EACR,QAAQ;;;;;;EAMR,MAAM;;;;;KAMF,uBAAuB,yBAAyB;;;;;;EAQlD,IAAI;;KAGK,eACX,kBAAkB,gBAClB,gBAAgB,SAAS,QACzB,yBACG,mBAAmB,WAAW,WAAW,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;KA4BxD,UACX,kBAAkB,gBAClB,gBAAgB,SAAS,QACzB,oBACA,0BAEA,KAAK,eAAe,WAAW,SAAS,eACpC,QAAQ,YAAY;;;;;;;;;;;;;KAcb,mBAAmB,oBAC9B,mBAAmB,eAAe,eAAe,YAC3C,SAAS,UAAU,mBAAmB,UACzC,mBAAmB,eAAe,aAC9B,SAAS,WACZ;;;;;;;;;;;;;KAcO,sBACX,uBACA,gBAAgB,iBAEf,OAAO,mBAAmB,aACzB,OAAO,gBAAgB,WAAW,YAAY;EAE/C,aAAa,YAAY;;;;;;;;;;;;;;;;;;UA2BV;MACZ;GACH;;;;;;;;;;;;;;;;;;UAmBe;MACZ;GACH;;;;;UAMe;EAChB;EACA;EACA,UAAU;EACV;EACA;EACA;EACA;;;;;UAMgB;EAChB,UAAU;EACV,UAAU;IAAc;IAAe,UAAU;;EACjD,SAAS;;;;;UAMO,qBAAqB;EACrC,MAAM;EACN,UAAU;;;;;cAME;UACJ;EAKR,OAAO,aAAa;EAKpB,OAAO,cAAc,eAAe,UAAU;EAK9C,aACC,cACA,UAAU,KAAK;EAShB,OAAO,MAAM;EAKb,KAAK,GAAG,MAAM,IAAI,qBAAqB;EAIvC,eAAe;;;;;KAQX,oBACJ,kBAAkB,gBAClB,gBAAgB,SAAS,QACzB;;EAGA,UAAU,cAAc;;EAExB,QAAQ;;EAER,QAAQ;;EAER,QAAQ;;EAER,SAAS;;;;;KAML,eACJ,qBAAqB,mCAAmC,kCAIxD,6BACG;;;;;;;EASD,SAAS,QAAQ;;;;;KAMf,gBAAgB,yBAAyB;;;;;;;EAS3C,IAAI;;;;;;;;;;;;;;KAeK,gBACX,cAAc,yCACd,kBAAkB,gBAClB,gBAAgB,SAAS,QACzB,oBACA,qBAAqB,mCAAmC,kCAIxD,uBACA,6BACG,oBAAoB,WAAW,SAAS,YAC3C,8BAA8B,SAC9B,eAAe,cAAc,iBAC7B,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KA+BL,gBACX,eAAe,yCACf,kBAAkB,gBAClB,gBAAgB,SAAS,QACzB,kBAAkB,0CAClB,oBACA,uBACA,2BACA,qBAAqB,mCAAmC,qCAKxD,KAAK,gBACJ,QACA,WACA,SACA,UACA,cACA,WACA,gBAED,UAAU,oBACN,kBAAkB,mBAMlB,yBAAyB,aACzB,qBAAqB,yBAAyB,cAC9C,QAAQ,yBAAyB,cACjC,QAAQ,qBAAqB,yBAAyB,yBAGtD,gCACA,mBACA,QAAQ;;;;aAKD;;EAEX;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA;;KAGW,eAAe,KAC1B,UAAU,8BAA8B,iCACrC,oBAAoB"}

package/dist/{EndpointFactory-CLmsBr1G.d.mts → EndpointFactory-DMYdJCOj.d.mts}

@@ -4,7 +4,7 @@ import { c as ServicesOf, r as Consumable } from "./construct-interface-DluK3_da
 import { n as BaseFunctionBuilder } from "./index-CTkKOer4.mjs";
 import { t as HttpMethod } from "./types-DMuSQeLL.mjs";
 import { t as EndpointTelemetry } from "./telemetry-DRtT1_0A.mjs";
-import { C as Authorizer, O as SecurityScheme, S as MappedAudit, T as BuiltInSecuritySchemeId, _ as RlsBypass, c as EndpointSchemas, f as SessionFn, i as Endpoint, l as EndpointSurface, o as EndpointHandler, p as SuccessStatus, t as AuthorizeFn, v as RlsConfig, x as ActorExtractor } from "./Endpoint-ViSuXwMB.mjs";
+import { C as Authorizer, O as SecurityScheme, S as MappedAudit, T as BuiltInSecuritySchemeId, _ as RlsBypass, c as EndpointSchemas, f as SessionFn, i as Endpoint, l as EndpointSurface, o as EndpointHandler, p as SuccessStatus, t as AuthorizeFn, v as RlsConfig, x as ActorExtractor } from "./Endpoint-Du-NwPX2.mjs";
 import { Service } from "@geekmidas/services";
 import { AuditStorage, AuditableAction, ExtractStorageAuditAction } from "@geekmidas/audit";
 import { Logger } from "@geekmidas/logger";
@@ -360,4 +360,4 @@ interface EndpointFactoryOptions<TServices extends Service[] = [], TBasePath ext
 }
 //#endregion
 export { EndpointBuilder as n, EndpointFactory as t };
-//# sourceMappingURL=EndpointFactory-CLmsBr1G.d.mts.map
+//# sourceMappingURL=EndpointFactory-DMYdJCOj.d.mts.map

package/dist/{EndpointFactory-CLmsBr1G.d.mts.map → EndpointFactory-DMYdJCOj.d.mts.map}

@@ -1 +1 @@
-{"version":3,"file":"EndpointFactory-CLmsBr1G.d.mts","names":[],"sources":["../src/endpoints/EndpointBuilder.ts","../src/endpoints/EndpointFactory.ts"],"mappings":";;;;;;;;;;;;;cA0Ca,gBACZ,uBACA,gBAAgB,YAChB,eAAe,sBACf,kBAAkB,gBAClB,gBAAgB,SAAS,QACzB,kBAAkB,0CAClB,oBACA,4DACA,sBAAsB,sCACtB,kDACA,qBAAqB,mCAAmC,kCAIxD,uBACA,sDACS,oBACT,QACA,WACA,WACA,SACA,eACA,0BACA,WACA;WA8BU,OAAO;WACP,QAAQ;YA7BR,SAAS;YACT;YACA,UAAU;YACV;YACA;YACA;;EAEV,cAAc,UAAU,WAAW,SAAS,UAAU;EACtD,YAAY,YAAY,WAAW,SAAS,UAAU,QAAQ;EAE9D,aAAa;EACb,uBAAuB;EACvB,kBAAkB;EAClB,kBAAkB,eAAe,WAAW,UAAU;EACtD,SAAS,YAAY,cAAc;;;;;;;EAOnC,UAAW;EACX,wBAAwB,eAAe;EACvC,aAAa,UAAU,WAAW,UAAU;EAC5C;EACA,aAAa;EAEb,YACU,OAAO,QACP,QAAQ;EAMlB,mBACC,SAAS,QAAQ,0BAA0B;EAM5C,oBAAoB,SAAS,QAAQ,sBAAsB;EAI3D,YAAY;EAIZ,OAAO,QAAQ;;;;;;;;;;;;;;;;EAmBf,MAAM,eAAe,iBACpB,OAAO,QACP,OAAO,SAAS,QAAQ,oBAAoB,cAC1C,gBACF,QACA,SACA,YACI,WAAW,oBACf,SACA,WACA,UACA,cACA,eACA,0BACA,cACA,WACA;EAmBD,KAAK;EAIL,WAAW;;;;;;;;;;;EAcX,UAAU,SAAS;;;;;;;;;;;;;;;;;;;EAsBnB,aAAa;EAIb,KAAK,UAAU,kBACd,QAAQ,IACN,gBACF,QACA,SACA,KAAK;IAAoB,MAAM;KAC/B,WACA,SACA,WACA,UACA,cACA,eACA,0BACA,cACA,WACA;EAOD,OAAO,UAAU,kBAChB,QAAQ,IACN,gBACF,QACA,SACA,KAAK;IAAqB,OAAO;KACjC,WACA,SACA,WACA,UACA,cACA,eACA,0BACA,cACA,WACA;EAOD,MAAM,UAAU,kBACf,QAAQ,IACN,gBACF,QACA,SACA,KAAK;IAAqB,OAAO;KACjC,WACA,SACA,WACA,UACA,cACA,eACA,0BACA,cACA,WACA;EAKD,OAAO,UAAU,kBAChB,QAAQ,IACN,gBACF,QACA,SACA,KAAK;IAAsB,QAAQ;KACnC,WACA,SACA,WACA,UACA,cACA,eACA,0BACA,cACA,WACA;EAOD,UACC,IAAI,YAAY,WAAW,SAAS,UAAU,QAAQ;EAKvD,UAAU,QAAQ;EAIlB,WACC,MAAM,gCACJ,gBACF,QACA,SACA,QACA,WACA,SACA,WACA,UACA,cACA,eACA,0BACA,cACA,WACA;;;;;;;;;;;;EAkCD,gBAAgB,mBAAmB,cAClC,YAAY,IACV,gBACF,QACA,SACA,YACI,cAAc,WAAW,KAC7B,SACA,WACA,UACA,cACA,eACA,0BACA,cACA,WACA;EAkCD,SAAS,UAAU,WAClB,UAAU,IACR,gBACF,QACA,SACA,YACI,cAAc,IAClB,SACA,WACA,UACA,cACA,eACA,0BACA,cACA,WACA;EAwBD,OAAO,UAAU,QAChB,QAAQ,IACN,gBACF,QACA,SACA,QACA,WACA,GACA,WACA,UACA,cACA,eACA,0BACA,cACA,WACA;EAqBD,OAAO,UAAU,kBAChB,QAAQ,IACN,gBACF,QACA,SACA,QACA,WACA,SACA,GACA,UACA,cACA,eACA,0BACA,cACA,WACA;;;;;;EA0BQ,QAAQ,UAAU,mBAAmB,sBAC7C,SAAS,QAAQ,OAAO,KACtB,gBACF,QACA,SACA,QACA,WACA,SACA,WACA,UACA,cACA,GACA,OACA,0BAA0B,IAC1B,WACA;;;;;EA4BD,MACC,WAAW,eAAe,WAAW,UAAU,WAC7C,gBACF,QACA,SACA,QACA,WACA,SACA,WACA,UACA,cACA,eACA,0BACA,cACA,WACA;;;;;;;;;;;;;;;;;;EAsBD,MAAM,QAAQ,YAAY,cAAc;;;;;;;;;;;;;;;;EAmB/B,SAAS,GAAG,sBACpB,QAAQ,WAAW,OAAO,KAAK,QAAQ,OAAO,KAC5C,gBACF,QACA,SACA,QACA,WACA,SACA,WACA,UACA,cACA,eACA,0BACA,cACA,GACA;;;;;;;;;;;;;;;;;;;;EA6CD,IACC,QAAQ,UAAU,WAAW,UAAU,mBAAmB;;;;;;;;;;;;;;EAyB3D;EAKA,MAAM;EAMN,OACC,IAAI,gBACH,QACA,WACA,SACA,WACA,UACA,WACA,eACA,gBAEC,SACF,QACA,SACA,QACA,WACA,WACA,SACA,UACA,eACA,0BACA,cACA,WACA;;;;cC1sBW,gBACZ,kBAAkB,gBAClB,+BACA,gBAAgB,SAAS,QACzB,oBACA,4DACA,sBAAsB,2CACtB,kDACA,qBAAqB,mCAGjB,0BAA0B,YAAY,iBAC1C,uBACA,8CACA,yBAAyB,eAAe,kBAAkB,eAEzD,iBAED,mBACG,UAAU,WAAW,UAAU;UAG1B;;;;;;;;;;;UAWA;UACA;UACA;UAOA;UAMA;;;;;;;;UAQA;UACA;UACA;UACA;UAGA;UAGA;UACA;UACA;EAER,cACC,UACA,oBACA,eACA,yBAEA,iBACA,mBACA,sBACA,uBACA,uBACA,wBACA,uBACA,uBACA,kBACA,WACE,uBACF,WACA,WACA,SACA,UACA,cACA,eACA,0BACA,WACA,sBACA,kBACA;SAuBM,UAAU,0BAA0B,kBAC1C,MAAM,GACN,WAAU,YACR,UAAU,WAAW;EAmCxB,kBAAkB,6BACjB,aAAa,IACX,gBACF,WACA,WACA,SACA,UACA,GACA,eACA,0BACA,cACA,WACA,sBACA,kBACA;;;;;;;;;;;;;;;;;EAqDD,gBAAgB,UAAU,eAAe,iBACxC,SAAS,IACP,gBACF,WACA,WACA,SACA,UACA,cACA,eACA,0BACA,cACA,WACA,sBACA,mBAAmB,GACnB;;;;;;;;;;;EA8CD,WACC,MACG,gCACM,mBACN,gCAED,gBACF,WACA,WACA,SACA,UACA,cACA,eACA,0BACA,cACA,WACA,sBACA,kBACA;EAkDD,MAAM,sBACL,MAAM,QACJ,gBACF,WACA,UAAU,WAAW,QACrB,SACA,UACA,cACA,eACA,0BACA,cACA,WACA,sBACA,kBACA;EAmCD,UACC,IAAI,YAAY,WAAW,SAAS,qBAAqB,aACvD,gBACF,WACA,WACA,SACA,UACA,cACA,eACA,0BACA,cACA,WACA,sBACA,kBACA;;;;;;;;;;;;EA6CD,gBAAgB,mBAAmB,cAClC,YAAY,IACV,oBACE,WAAW,OAAO,YACtB,WACA,SACA,UACA,cACA,eACA,0BACA,cACA,WACA,sBACA,kBACA,cAAc,WAAW,OAAO,YAAY,UAAU;EA6BvD,SAAS,UAAU,WAClB,UAAU,IACR,oBACE,MAAM,YACV,WACA,SACA,UACA,cACA,eACA,0BACA,cACA,WACA,sBACA,kBACA,cAAc,MAAM,YAAY,UAAU;EA2C3C,OAAO,UAAU,QAChB,QAAQ,IACN,gBACF,WACA,WACA,GACA,UACA,cACA,eACA,0BACA,cACA,WACA,sBACA,kBACA,UAAU,WAAW,UAAU;EAiDhC,QAAQ,GACP,SAAS,UAAU,WAAW,SAAS,GAAG,aACxC,gBACF,WACA,WACA,SACA,GACA,cACA,eACA,0BACA,cACA,WACA,sBACA,kBACA,UAAU,WAAW,GAAG;;;;;EAgDzB,SAAS,GAAG,sBACX,QAAQ,WAAW,OAAO,KAAK,QAAQ,OAAO,KAC5C,gBACF,WACA,WACA,SACA,UACA,cACA,eACA,0BACA,cACA,GACA,OACA,kBACA;;;;;;EAmDD,QAAQ,UAAU,mBAAmB,sBACpC,SAAS,QAAQ,OAAO,KACtB,gBACF,WACA,WACA,SACA,UACA,cACA,GACA,OACA,0BAA0B,IAC1B,WACA,sBACA,kBACA;;;;;EA0CD,MACC,WAAW,eAAe,WAAW,UAAU,WAC7C,gBACF,WACA,WACA,SACA,UACA,cACA,eACA,0BACA,cACA,WACA,sBACA,kBACA;;;;;;;;;;;;;;;;;;;EAmDD,IAAI,gBAAgB,UAAU,WAAW,UAAU,UAClD,QAAQ,UACN,gBACF,WACA,WACA,SACA,UACA,cACA,eACA,0BACA,cACA,WACA,sBACA,kBACA;UAiCO;EA8FR,KAAK,sBAAsB,MAAM,QAAK,gBAAA,oBAAA,uBAAA,QAAA,mBAAA,YAAA,wBAAA,6BAAA,YAAA,UAAA,2BA2CN,UAAI,wBACN,YAAI,QAAA,YAAA,QAAA,UAAA,wBAAA,cAAA,aAAA,cAAA,aAAA,sBAAA,WAAA,oBAAA,UAAA,cAAA,eAAA,0BAAA,cAAA,WAAA;EAxClC,IAAI,sBAAsB,MAAM,QAAK,gBAAA,oBAAA,uBAAA,QAAA,mBAAA,YAAA,wBAAA,6BAAA,YAAA,UAAA,2BAuCL,UAAI,wBACN,YAAI,QAAA,YAAA,QAAA,UAAA,wBAAA,cAAA,aAAA,cAAA,aAAA,qBAAA,WAAA,oBAAA,UAAA,cAAA,eAAA,0BAAA,cAAA,WAAA;EApClC,IAAI,sBAAsB,MAAM,QAAK,gBAAA,oBAAA,uBAAA,QAAA,mBAAA,YAAA,wBAAA,6BAAA,YAAA,UAAA,2BAmCL,UAAI,wBACN,YAAI,QAAA,YAAA,QAAA,UAAA,wBAAA,cAAA,aAAA,cAAA,aAAA,qBAAA,WAAA,oBAAA,UAAA,cAAA,eAAA,0BAAA,cAAA,WAAA;EAhClC,OAAO,sBAAsB,MAAM,QAAK,gBAAA,oBAAA,uBAAA,QAAA,mBAAA,YAAA,wBAAA,6BAAA,YAAA,UAAA,2BA+BR,UAAI,wBACN,YAAI,QAAA,YAAA,QAAA,UAAA,wBAAA,cAAA,aAAA,cAAA,aAAA,wBAAA,WAAA,oBAAA,UAAA,cAAA,eAAA,0BAAA,cAAA,WAAA;EA5BlC,MAAM,sBAAsB,MAAM,QAAK,gBAAA,oBAAA,uBAAA,QAAA,mBAAA,YAAA,wBAAA,6BAAA,YAAA,UAAA,2BA2BP,UAAI,wBACN,YAAI,QAAA,YAAA,QAAA,UAAA,wBAAA,cAAA,aAAA,cAAA,aAAA,uBAAA,WAAA,oBAAA,UAAA,cAAA,eAAA,0BAAA,cAAA,WAAA;EAxBlC,QAAQ,sBAAsB,MAAM,QAAK,gBAAA,oBAAA,uBAAA,QAAA,mBAAA,YAAA,wBAAA,6BAAA,YAAA,UAAA,2BAuBT,UAAI,wBACN,YAAI,QAAA,YAAA,QAAA,UAAA,wBAAA,cAAA,aAAA,cAAA,aAAA,yBAAA,WAAA,oBAAA,UAAA,cAAA,eAAA,0BAAA,cAAA,WAAA;;KAnBvB,oBAAoB,oBAAoB,mBAAmB,UACpE,kBACC,IACA,OACD;KAES,UACX,0BACA,wBACG,oBACH,uBACG,QACA,mBACC,YACA,wBACC,6BACC,YACI,UACL,2BAA2B,UAC1B,wBAAwB,YACpB,QAAQ,YACR,QAAQ,UACZ,wBAAwB,YACpB,aAAa,YACb,aAAa;UAGP,uBAChB,kBAAkB,gBAClB,+BACA,gBAAgB,SAAS,QACzB,oBACA,4DACA,sBAAsB,sCACtB,kDACA,uBACA,8CACA,yBAAyB,eAAe,kBAAkB,eAEzD,iBAED,mBACG,UAAU,WAAW,UAAU;EAGlC,kBAAkB;;EAElB;EACA,WAAW;EACX,qBAAqB,YACpB,WACA,SACA,qBAEA;EAED,gBAAgB;EAChB,0BAA0B,UAAU,WAAW,SAAS,UAAU;EAClE,uBAAuB;EACvB,wBAAwB;EACxB,wBAAwB,QAAQ,0BAA0B;EAC1D,yBAAyB,QAAQ,sBAAsB;EACvD,wBAAwB,eAAe,WAAW,UAAU;EAC5D,wBAAwB;EACxB,mBAAmB;;;;;;;;;;;EAWnB,SAAS"}
+{"version":3,"file":"EndpointFactory-DMYdJCOj.d.mts","names":[],"sources":["../src/endpoints/EndpointBuilder.ts","../src/endpoints/EndpointFactory.ts"],"mappings":";;;;;;;;;;;;;cA0Ca,gBACZ,uBACA,gBAAgB,YAChB,eAAe,sBACf,kBAAkB,gBAClB,gBAAgB,SAAS,QACzB,kBAAkB,0CAClB,oBACA,4DACA,sBAAsB,sCACtB,kDACA,qBAAqB,mCAAmC,kCAIxD,uBACA,sDACS,oBACT,QACA,WACA,WACA,SACA,eACA,0BACA,WACA;WA8BU,OAAO;WACP,QAAQ;YA7BR,SAAS;YACT;YACA,UAAU;YACV;YACA;YACA;;EAEV,cAAc,UAAU,WAAW,SAAS,UAAU;EACtD,YAAY,YAAY,WAAW,SAAS,UAAU,QAAQ;EAE9D,aAAa;EACb,uBAAuB;EACvB,kBAAkB;EAClB,kBAAkB,eAAe,WAAW,UAAU;EACtD,SAAS,YAAY,cAAc;;;;;;;EAOnC,UAAW;EACX,wBAAwB,eAAe;EACvC,aAAa,UAAU,WAAW,UAAU;EAC5C;EACA,aAAa;EAEb,YACU,OAAO,QACP,QAAQ;EAMlB,mBACC,SAAS,QAAQ,0BAA0B;EAM5C,oBAAoB,SAAS,QAAQ,sBAAsB;EAI3D,YAAY;EAIZ,OAAO,QAAQ;;;;;;;;;;;;;;;;EAmBf,MAAM,eAAe,iBACpB,OAAO,QACP,OAAO,SAAS,QAAQ,oBAAoB,cAC1C,gBACF,QACA,SACA,YACI,WAAW,oBACf,SACA,WACA,UACA,cACA,eACA,0BACA,cACA,WACA;EAmBD,KAAK;EAIL,WAAW;;;;;;;;;;;EAcX,UAAU,SAAS;;;;;;;;;;;;;;;;;;;EAsBnB,aAAa;EAIb,KAAK,UAAU,kBACd,QAAQ,IACN,gBACF,QACA,SACA,KAAK;IAAoB,MAAM;KAC/B,WACA,SACA,WACA,UACA,cACA,eACA,0BACA,cACA,WACA;EAOD,OAAO,UAAU,kBAChB,QAAQ,IACN,gBACF,QACA,SACA,KAAK;IAAqB,OAAO;KACjC,WACA,SACA,WACA,UACA,cACA,eACA,0BACA,cACA,WACA;EAOD,MAAM,UAAU,kBACf,QAAQ,IACN,gBACF,QACA,SACA,KAAK;IAAqB,OAAO;KACjC,WACA,SACA,WACA,UACA,cACA,eACA,0BACA,cACA,WACA;EAKD,OAAO,UAAU,kBAChB,QAAQ,IACN,gBACF,QACA,SACA,KAAK;IAAsB,QAAQ;KACnC,WACA,SACA,WACA,UACA,cACA,eACA,0BACA,cACA,WACA;EAOD,UACC,IAAI,YAAY,WAAW,SAAS,UAAU,QAAQ;EAKvD,UAAU,QAAQ;EAIlB,WACC,MAAM,gCACJ,gBACF,QACA,SACA,QACA,WACA,SACA,WACA,UACA,cACA,eACA,0BACA,cACA,WACA;;;;;;;;;;;;EAkCD,gBAAgB,mBAAmB,cAClC,YAAY,IACV,gBACF,QACA,SACA,YACI,cAAc,WAAW,KAC7B,SACA,WACA,UACA,cACA,eACA,0BACA,cACA,WACA;EAkCD,SAAS,UAAU,WAClB,UAAU,IACR,gBACF,QACA,SACA,YACI,cAAc,IAClB,SACA,WACA,UACA,cACA,eACA,0BACA,cACA,WACA;EAwBD,OAAO,UAAU,QAChB,QAAQ,IACN,gBACF,QACA,SACA,QACA,WACA,GACA,WACA,UACA,cACA,eACA,0BACA,cACA,WACA;EAqBD,OAAO,UAAU,kBAChB,QAAQ,IACN,gBACF,QACA,SACA,QACA,WACA,SACA,GACA,UACA,cACA,eACA,0BACA,cACA,WACA;;;;;;EA0BQ,QAAQ,UAAU,mBAAmB,sBAC7C,SAAS,QAAQ,OAAO,KACtB,gBACF,QACA,SACA,QACA,WACA,SACA,WACA,UACA,cACA,GACA,OACA,0BAA0B,IAC1B,WACA;;;;;EA4BD,MACC,WAAW,eAAe,WAAW,UAAU,WAC7C,gBACF,QACA,SACA,QACA,WACA,SACA,WACA,UACA,cACA,eACA,0BACA,cACA,WACA;;;;;;;;;;;;;;;;;;EAsBD,MAAM,QAAQ,YAAY,cAAc;;;;;;;;;;;;;;;;EAmB/B,SAAS,GAAG,sBACpB,QAAQ,WAAW,OAAO,KAAK,QAAQ,OAAO,KAC5C,gBACF,QACA,SACA,QACA,WACA,SACA,WACA,UACA,cACA,eACA,0BACA,cACA,GACA;;;;;;;;;;;;;;;;;;;;EA6CD,IACC,QAAQ,UAAU,WAAW,UAAU,mBAAmB;;;;;;;;;;;;;;EAyB3D;EAKA,MAAM;EAMN,OACC,IAAI,gBACH,QACA,WACA,SACA,WACA,UACA,WACA,eACA,gBAEC,SACF,QACA,SACA,QACA,WACA,WACA,SACA,UACA,eACA,0BACA,cACA,WACA;;;;cC1sBW,gBACZ,kBAAkB,gBAClB,+BACA,gBAAgB,SAAS,QACzB,oBACA,4DACA,sBAAsB,2CACtB,kDACA,qBAAqB,mCAGjB,0BAA0B,YAAY,iBAC1C,uBACA,8CACA,yBAAyB,eAAe,kBAAkB,eAEzD,iBAED,mBACG,UAAU,WAAW,UAAU;UAG1B;;;;;;;;;;;UAWA;UACA;UACA;UAOA;UAMA;;;;;;;;UAQA;UACA;UACA;UACA;UAGA;UAGA;UACA;UACA;EAER,cACC,UACA,oBACA,eACA,yBAEA,iBACA,mBACA,sBACA,uBACA,uBACA,wBACA,uBACA,uBACA,kBACA,WACE,uBACF,WACA,WACA,SACA,UACA,cACA,eACA,0BACA,WACA,sBACA,kBACA;SAuBM,UAAU,0BAA0B,kBAC1C,MAAM,GACN,WAAU,YACR,UAAU,WAAW;EAmCxB,kBAAkB,6BACjB,aAAa,IACX,gBACF,WACA,WACA,SACA,UACA,GACA,eACA,0BACA,cACA,WACA,sBACA,kBACA;;;;;;;;;;;;;;;;;EAqDD,gBAAgB,UAAU,eAAe,iBACxC,SAAS,IACP,gBACF,WACA,WACA,SACA,UACA,cACA,eACA,0BACA,cACA,WACA,sBACA,mBAAmB,GACnB;;;;;;;;;;;EA8CD,WACC,MACG,gCACM,mBACN,gCAED,gBACF,WACA,WACA,SACA,UACA,cACA,eACA,0BACA,cACA,WACA,sBACA,kBACA;EAkDD,MAAM,sBACL,MAAM,QACJ,gBACF,WACA,UAAU,WAAW,QACrB,SACA,UACA,cACA,eACA,0BACA,cACA,WACA,sBACA,kBACA;EAmCD,UACC,IAAI,YAAY,WAAW,SAAS,qBAAqB,aACvD,gBACF,WACA,WACA,SACA,UACA,cACA,eACA,0BACA,cACA,WACA,sBACA,kBACA;;;;;;;;;;;;EA6CD,gBAAgB,mBAAmB,cAClC,YAAY,IACV,oBACE,WAAW,OAAO,YACtB,WACA,SACA,UACA,cACA,eACA,0BACA,cACA,WACA,sBACA,kBACA,cAAc,WAAW,OAAO,YAAY,UAAU;EA6BvD,SAAS,UAAU,WAClB,UAAU,IACR,oBACE,MAAM,YACV,WACA,SACA,UACA,cACA,eACA,0BACA,cACA,WACA,sBACA,kBACA,cAAc,MAAM,YAAY,UAAU;EA2C3C,OAAO,UAAU,QAChB,QAAQ,IACN,gBACF,WACA,WACA,GACA,UACA,cACA,eACA,0BACA,cACA,WACA,sBACA,kBACA,UAAU,WAAW,UAAU;EAiDhC,QAAQ,GACP,SAAS,UAAU,WAAW,SAAS,GAAG,aACxC,gBACF,WACA,WACA,SACA,GACA,cACA,eACA,0BACA,cACA,WACA,sBACA,kBACA,UAAU,WAAW,GAAG;;;;;EAgDzB,SAAS,GAAG,sBACX,QAAQ,WAAW,OAAO,KAAK,QAAQ,OAAO,KAC5C,gBACF,WACA,WACA,SACA,UACA,cACA,eACA,0BACA,cACA,GACA,OACA,kBACA;;;;;;EAmDD,QAAQ,UAAU,mBAAmB,sBACpC,SAAS,QAAQ,OAAO,KACtB,gBACF,WACA,WACA,SACA,UACA,cACA,GACA,OACA,0BAA0B,IAC1B,WACA,sBACA,kBACA;;;;;EA0CD,MACC,WAAW,eAAe,WAAW,UAAU,WAC7C,gBACF,WACA,WACA,SACA,UACA,cACA,eACA,0BACA,cACA,WACA,sBACA,kBACA;;;;;;;;;;;;;;;;;;;EAmDD,IAAI,gBAAgB,UAAU,WAAW,UAAU,UAClD,QAAQ,UACN,gBACF,WACA,WACA,SACA,UACA,cACA,eACA,0BACA,cACA,WACA,sBACA,kBACA;UAiCO;EA8FR,KAAK,sBAAsB,MAAM,QAAK,gBAAA,oBAAA,uBAAA,QAAA,mBAAA,YAAA,wBAAA,6BAAA,YAAA,UAAA,2BA2CN,UAAI,wBACN,YAAI,QAAA,YAAA,QAAA,UAAA,wBAAA,cAAA,aAAA,cAAA,aAAA,sBAAA,WAAA,oBAAA,UAAA,cAAA,eAAA,0BAAA,cAAA,WAAA;EAxClC,IAAI,sBAAsB,MAAM,QAAK,gBAAA,oBAAA,uBAAA,QAAA,mBAAA,YAAA,wBAAA,6BAAA,YAAA,UAAA,2BAuCL,UAAI,wBACN,YAAI,QAAA,YAAA,QAAA,UAAA,wBAAA,cAAA,aAAA,cAAA,aAAA,qBAAA,WAAA,oBAAA,UAAA,cAAA,eAAA,0BAAA,cAAA,WAAA;EApClC,IAAI,sBAAsB,MAAM,QAAK,gBAAA,oBAAA,uBAAA,QAAA,mBAAA,YAAA,wBAAA,6BAAA,YAAA,UAAA,2BAmCL,UAAI,wBACN,YAAI,QAAA,YAAA,QAAA,UAAA,wBAAA,cAAA,aAAA,cAAA,aAAA,qBAAA,WAAA,oBAAA,UAAA,cAAA,eAAA,0BAAA,cAAA,WAAA;EAhClC,OAAO,sBAAsB,MAAM,QAAK,gBAAA,oBAAA,uBAAA,QAAA,mBAAA,YAAA,wBAAA,6BAAA,YAAA,UAAA,2BA+BR,UAAI,wBACN,YAAI,QAAA,YAAA,QAAA,UAAA,wBAAA,cAAA,aAAA,cAAA,aAAA,wBAAA,WAAA,oBAAA,UAAA,cAAA,eAAA,0BAAA,cAAA,WAAA;EA5BlC,MAAM,sBAAsB,MAAM,QAAK,gBAAA,oBAAA,uBAAA,QAAA,mBAAA,YAAA,wBAAA,6BAAA,YAAA,UAAA,2BA2BP,UAAI,wBACN,YAAI,QAAA,YAAA,QAAA,UAAA,wBAAA,cAAA,aAAA,cAAA,aAAA,uBAAA,WAAA,oBAAA,UAAA,cAAA,eAAA,0BAAA,cAAA,WAAA;EAxBlC,QAAQ,sBAAsB,MAAM,QAAK,gBAAA,oBAAA,uBAAA,QAAA,mBAAA,YAAA,wBAAA,6BAAA,YAAA,UAAA,2BAuBT,UAAI,wBACN,YAAI,QAAA,YAAA,QAAA,UAAA,wBAAA,cAAA,aAAA,cAAA,aAAA,yBAAA,WAAA,oBAAA,UAAA,cAAA,eAAA,0BAAA,cAAA,WAAA;;KAnBvB,oBAAoB,oBAAoB,mBAAmB,UACpE,kBACC,IACA,OACD;KAES,UACX,0BACA,wBACG,oBACH,uBACG,QACA,mBACC,YACA,wBACC,6BACC,YACI,UACL,2BAA2B,UAC1B,wBAAwB,YACpB,QAAQ,YACR,QAAQ,UACZ,wBAAwB,YACpB,aAAa,YACb,aAAa;UAGP,uBAChB,kBAAkB,gBAClB,+BACA,gBAAgB,SAAS,QACzB,oBACA,4DACA,sBAAsB,sCACtB,kDACA,uBACA,8CACA,yBAAyB,eAAe,kBAAkB,eAEzD,iBAED,mBACG,UAAU,WAAW,UAAU;EAGlC,kBAAkB;;EAElB;EACA,WAAW;EACX,qBAAqB,YACpB,WACA,SACA,qBAEA;EAED,gBAAgB;EAChB,0BAA0B,UAAU,WAAW,SAAS,UAAU;EAClE,uBAAuB;EACvB,wBAAwB;EACxB,wBAAwB,QAAQ,0BAA0B;EAC1D,yBAAyB,QAAQ,sBAAsB;EACvD,wBAAwB,eAAe,WAAW,UAAU;EAC5D,wBAAwB;EACxB,mBAAmB;;;;;;;;;;;EAWnB,SAAS"}

package/dist/{EndpointFactory-CLnJ2GQ8.d.cts → EndpointFactory-I7s1co3Y.d.cts}

@@ -4,7 +4,7 @@ import { c as ServicesOf, r as Consumable } from "./construct-interface-B1AfqRl4
 import { n as BaseFunctionBuilder } from "./index-BuzRvKOQ.cjs";
 import { t as HttpMethod } from "./types-DMuSQeLL.cjs";
 import { t as EndpointTelemetry } from "./telemetry-B48RLjyk.cjs";
-import { C as Authorizer, O as SecurityScheme, S as MappedAudit, T as BuiltInSecuritySchemeId, _ as RlsBypass, c as EndpointSchemas, f as SessionFn, i as Endpoint, l as EndpointSurface, o as EndpointHandler, p as SuccessStatus, t as AuthorizeFn, v as RlsConfig, x as ActorExtractor } from "./Endpoint-C4PZn_mD.cjs";
+import { C as Authorizer, O as SecurityScheme, S as MappedAudit, T as BuiltInSecuritySchemeId, _ as RlsBypass, c as EndpointSchemas, f as SessionFn, i as Endpoint, l as EndpointSurface, o as EndpointHandler, p as SuccessStatus, t as AuthorizeFn, v as RlsConfig, x as ActorExtractor } from "./Endpoint-aCvBMPoH.cjs";
 import { Logger } from "@geekmidas/logger";
 import { InferStandardSchema } from "@geekmidas/schema";
 import { Service } from "@geekmidas/services";
@@ -360,4 +360,4 @@ interface EndpointFactoryOptions<TServices extends Service[] = [], TBasePath ext
 }
 //#endregion
 export { EndpointBuilder as n, EndpointFactory as t };
-//# sourceMappingURL=EndpointFactory-CLnJ2GQ8.d.cts.map
+//# sourceMappingURL=EndpointFactory-I7s1co3Y.d.cts.map

package/dist/{EndpointFactory-CLnJ2GQ8.d.cts.map → EndpointFactory-I7s1co3Y.d.cts.map}

@@ -1 +1 @@
-{"version":3,"file":"EndpointFactory-CLnJ2GQ8.d.cts","names":[],"sources":["../src/endpoints/EndpointBuilder.ts","../src/endpoints/EndpointFactory.ts"],"mappings":";;;;;;;;;;;;;cA0Ca,gBACZ,uBACA,gBAAgB,YAChB,eAAe,sBACf,kBAAkB,gBAClB,gBAAgB,SAAS,QACzB,kBAAkB,0CAClB,oBACA,4DACA,sBAAsB,sCACtB,kDACA,qBAAqB,mCAAmC,kCAIxD,uBACA,sDACS,oBACT,QACA,WACA,WACA,SACA,eACA,0BACA,WACA;WA8BU,OAAO;WACP,QAAQ;YA7BR,SAAS;YACT;YACA,UAAU;YACV;YACA;YACA;;EAEV,cAAc,UAAU,WAAW,SAAS,UAAU;EACtD,YAAY,YAAY,WAAW,SAAS,UAAU,QAAQ;EAE9D,aAAa;EACb,uBAAuB;EACvB,kBAAkB;EAClB,kBAAkB,eAAe,WAAW,UAAU;EACtD,SAAS,YAAY,cAAc;;;;;;;EAOnC,UAAW;EACX,wBAAwB,eAAe;EACvC,aAAa,UAAU,WAAW,UAAU;EAC5C;EACA,aAAa;EAEb,YACU,OAAO,QACP,QAAQ;EAMlB,mBACC,SAAS,QAAQ,0BAA0B;EAM5C,oBAAoB,SAAS,QAAQ,sBAAsB;EAI3D,YAAY;EAIZ,OAAO,QAAQ;;;;;;;;;;;;;;;;EAmBf,MAAM,eAAe,iBACpB,OAAO,QACP,OAAO,SAAS,QAAQ,oBAAoB,cAC1C,gBACF,QACA,SACA,YACI,WAAW,oBACf,SACA,WACA,UACA,cACA,eACA,0BACA,cACA,WACA;EAmBD,KAAK;EAIL,WAAW;;;;;;;;;;;EAcX,UAAU,SAAS;;;;;;;;;;;;;;;;;;;EAsBnB,aAAa;EAIb,KAAK,UAAU,kBACd,QAAQ,IACN,gBACF,QACA,SACA,KAAK;IAAoB,MAAM;KAC/B,WACA,SACA,WACA,UACA,cACA,eACA,0BACA,cACA,WACA;EAOD,OAAO,UAAU,kBAChB,QAAQ,IACN,gBACF,QACA,SACA,KAAK;IAAqB,OAAO;KACjC,WACA,SACA,WACA,UACA,cACA,eACA,0BACA,cACA,WACA;EAOD,MAAM,UAAU,kBACf,QAAQ,IACN,gBACF,QACA,SACA,KAAK;IAAqB,OAAO;KACjC,WACA,SACA,WACA,UACA,cACA,eACA,0BACA,cACA,WACA;EAKD,OAAO,UAAU,kBAChB,QAAQ,IACN,gBACF,QACA,SACA,KAAK;IAAsB,QAAQ;KACnC,WACA,SACA,WACA,UACA,cACA,eACA,0BACA,cACA,WACA;EAOD,UACC,IAAI,YAAY,WAAW,SAAS,UAAU,QAAQ;EAKvD,UAAU,QAAQ;EAIlB,WACC,MAAM,gCACJ,gBACF,QACA,SACA,QACA,WACA,SACA,WACA,UACA,cACA,eACA,0BACA,cACA,WACA;;;;;;;;;;;;EAkCD,gBAAgB,mBAAmB,cAClC,YAAY,IACV,gBACF,QACA,SACA,YACI,cAAc,WAAW,KAC7B,SACA,WACA,UACA,cACA,eACA,0BACA,cACA,WACA;EAkCD,SAAS,UAAU,WAClB,UAAU,IACR,gBACF,QACA,SACA,YACI,cAAc,IAClB,SACA,WACA,UACA,cACA,eACA,0BACA,cACA,WACA;EAwBD,OAAO,UAAU,QAChB,QAAQ,IACN,gBACF,QACA,SACA,QACA,WACA,GACA,WACA,UACA,cACA,eACA,0BACA,cACA,WACA;EAqBD,OAAO,UAAU,kBAChB,QAAQ,IACN,gBACF,QACA,SACA,QACA,WACA,SACA,GACA,UACA,cACA,eACA,0BACA,cACA,WACA;;;;;;EA0BQ,QAAQ,UAAU,mBAAmB,sBAC7C,SAAS,QAAQ,OAAO,KACtB,gBACF,QACA,SACA,QACA,WACA,SACA,WACA,UACA,cACA,GACA,OACA,0BAA0B,IAC1B,WACA;;;;;EA4BD,MACC,WAAW,eAAe,WAAW,UAAU,WAC7C,gBACF,QACA,SACA,QACA,WACA,SACA,WACA,UACA,cACA,eACA,0BACA,cACA,WACA;;;;;;;;;;;;;;;;;;EAsBD,MAAM,QAAQ,YAAY,cAAc;;;;;;;;;;;;;;;;EAmB/B,SAAS,GAAG,sBACpB,QAAQ,WAAW,OAAO,KAAK,QAAQ,OAAO,KAC5C,gBACF,QACA,SACA,QACA,WACA,SACA,WACA,UACA,cACA,eACA,0BACA,cACA,GACA;;;;;;;;;;;;;;;;;;;;EA6CD,IACC,QAAQ,UAAU,WAAW,UAAU,mBAAmB;;;;;;;;;;;;;;EAyB3D;EAKA,MAAM;EAMN,OACC,IAAI,gBACH,QACA,WACA,SACA,WACA,UACA,WACA,eACA,gBAEC,SACF,QACA,SACA,QACA,WACA,WACA,SACA,UACA,eACA,0BACA,cACA,WACA;;;;cC1sBW,gBACZ,kBAAkB,gBAClB,+BACA,gBAAgB,SAAS,QACzB,oBACA,4DACA,sBAAsB,2CACtB,kDACA,qBAAqB,mCAGjB,0BAA0B,YAAY,iBAC1C,uBACA,8CACA,yBAAyB,eAAe,kBAAkB,eAEzD,iBAED,mBACG,UAAU,WAAW,UAAU;UAG1B;;;;;;;;;;;UAWA;UACA;UACA;UAOA;UAMA;;;;;;;;UAQA;UACA;UACA;UACA;UAGA;UAGA;UACA;UACA;EAER,cACC,UACA,oBACA,eACA,yBAEA,iBACA,mBACA,sBACA,uBACA,uBACA,wBACA,uBACA,uBACA,kBACA,WACE,uBACF,WACA,WACA,SACA,UACA,cACA,eACA,0BACA,WACA,sBACA,kBACA;SAuBM,UAAU,0BAA0B,kBAC1C,MAAM,GACN,WAAU,YACR,UAAU,WAAW;EAmCxB,kBAAkB,6BACjB,aAAa,IACX,gBACF,WACA,WACA,SACA,UACA,GACA,eACA,0BACA,cACA,WACA,sBACA,kBACA;;;;;;;;;;;;;;;;;EAqDD,gBAAgB,UAAU,eAAe,iBACxC,SAAS,IACP,gBACF,WACA,WACA,SACA,UACA,cACA,eACA,0BACA,cACA,WACA,sBACA,mBAAmB,GACnB;;;;;;;;;;;EA8CD,WACC,MACG,gCACM,mBACN,gCAED,gBACF,WACA,WACA,SACA,UACA,cACA,eACA,0BACA,cACA,WACA,sBACA,kBACA;EAkDD,MAAM,sBACL,MAAM,QACJ,gBACF,WACA,UAAU,WAAW,QACrB,SACA,UACA,cACA,eACA,0BACA,cACA,WACA,sBACA,kBACA;EAmCD,UACC,IAAI,YAAY,WAAW,SAAS,qBAAqB,aACvD,gBACF,WACA,WACA,SACA,UACA,cACA,eACA,0BACA,cACA,WACA,sBACA,kBACA;;;;;;;;;;;;EA6CD,gBAAgB,mBAAmB,cAClC,YAAY,IACV,oBACE,WAAW,OAAO,YACtB,WACA,SACA,UACA,cACA,eACA,0BACA,cACA,WACA,sBACA,kBACA,cAAc,WAAW,OAAO,YAAY,UAAU;EA6BvD,SAAS,UAAU,WAClB,UAAU,IACR,oBACE,MAAM,YACV,WACA,SACA,UACA,cACA,eACA,0BACA,cACA,WACA,sBACA,kBACA,cAAc,MAAM,YAAY,UAAU;EA2C3C,OAAO,UAAU,QAChB,QAAQ,IACN,gBACF,WACA,WACA,GACA,UACA,cACA,eACA,0BACA,cACA,WACA,sBACA,kBACA,UAAU,WAAW,UAAU;EAiDhC,QAAQ,GACP,SAAS,UAAU,WAAW,SAAS,GAAG,aACxC,gBACF,WACA,WACA,SACA,GACA,cACA,eACA,0BACA,cACA,WACA,sBACA,kBACA,UAAU,WAAW,GAAG;;;;;EAgDzB,SAAS,GAAG,sBACX,QAAQ,WAAW,OAAO,KAAK,QAAQ,OAAO,KAC5C,gBACF,WACA,WACA,SACA,UACA,cACA,eACA,0BACA,cACA,GACA,OACA,kBACA;;;;;;EAmDD,QAAQ,UAAU,mBAAmB,sBACpC,SAAS,QAAQ,OAAO,KACtB,gBACF,WACA,WACA,SACA,UACA,cACA,GACA,OACA,0BAA0B,IAC1B,WACA,sBACA,kBACA;;;;;EA0CD,MACC,WAAW,eAAe,WAAW,UAAU,WAC7C,gBACF,WACA,WACA,SACA,UACA,cACA,eACA,0BACA,cACA,WACA,sBACA,kBACA;;;;;;;;;;;;;;;;;;;EAmDD,IAAI,gBAAgB,UAAU,WAAW,UAAU,UAClD,QAAQ,UACN,gBACF,WACA,WACA,SACA,UACA,cACA,eACA,0BACA,cACA,WACA,sBACA,kBACA;UAiCO;EA8FR,KAAK,sBAAsB,MAAM,QAAK,gBAAA,oBAAA,uBAAA,QAAA,mBAAA,YAAA,wBAAA,6BAAA,YAAA,UAAA,2BA2CN,UAAI,wBACN,YAAI,QAAA,YAAA,QAAA,UAAA,wBAAA,cAAA,aAAA,cAAA,aAAA,sBAAA,WAAA,oBAAA,UAAA,cAAA,eAAA,0BAAA,cAAA,WAAA;EAxClC,IAAI,sBAAsB,MAAM,QAAK,gBAAA,oBAAA,uBAAA,QAAA,mBAAA,YAAA,wBAAA,6BAAA,YAAA,UAAA,2BAuCL,UAAI,wBACN,YAAI,QAAA,YAAA,QAAA,UAAA,wBAAA,cAAA,aAAA,cAAA,aAAA,qBAAA,WAAA,oBAAA,UAAA,cAAA,eAAA,0BAAA,cAAA,WAAA;EApClC,IAAI,sBAAsB,MAAM,QAAK,gBAAA,oBAAA,uBAAA,QAAA,mBAAA,YAAA,wBAAA,6BAAA,YAAA,UAAA,2BAmCL,UAAI,wBACN,YAAI,QAAA,YAAA,QAAA,UAAA,wBAAA,cAAA,aAAA,cAAA,aAAA,qBAAA,WAAA,oBAAA,UAAA,cAAA,eAAA,0BAAA,cAAA,WAAA;EAhClC,OAAO,sBAAsB,MAAM,QAAK,gBAAA,oBAAA,uBAAA,QAAA,mBAAA,YAAA,wBAAA,6BAAA,YAAA,UAAA,2BA+BR,UAAI,wBACN,YAAI,QAAA,YAAA,QAAA,UAAA,wBAAA,cAAA,aAAA,cAAA,aAAA,wBAAA,WAAA,oBAAA,UAAA,cAAA,eAAA,0BAAA,cAAA,WAAA;EA5BlC,MAAM,sBAAsB,MAAM,QAAK,gBAAA,oBAAA,uBAAA,QAAA,mBAAA,YAAA,wBAAA,6BAAA,YAAA,UAAA,2BA2BP,UAAI,wBACN,YAAI,QAAA,YAAA,QAAA,UAAA,wBAAA,cAAA,aAAA,cAAA,aAAA,uBAAA,WAAA,oBAAA,UAAA,cAAA,eAAA,0BAAA,cAAA,WAAA;EAxBlC,QAAQ,sBAAsB,MAAM,QAAK,gBAAA,oBAAA,uBAAA,QAAA,mBAAA,YAAA,wBAAA,6BAAA,YAAA,UAAA,2BAuBT,UAAI,wBACN,YAAI,QAAA,YAAA,QAAA,UAAA,wBAAA,cAAA,aAAA,cAAA,aAAA,yBAAA,WAAA,oBAAA,UAAA,cAAA,eAAA,0BAAA,cAAA,WAAA;;KAnBvB,oBAAoB,oBAAoB,mBAAmB,UACpE,kBACC,IACA,OACD;KAES,UACX,0BACA,wBACG,oBACH,uBACG,QACA,mBACC,YACA,wBACC,6BACC,YACI,UACL,2BAA2B,UAC1B,wBAAwB,YACpB,QAAQ,YACR,QAAQ,UACZ,wBAAwB,YACpB,aAAa,YACb,aAAa;UAGP,uBAChB,kBAAkB,gBAClB,+BACA,gBAAgB,SAAS,QACzB,oBACA,4DACA,sBAAsB,sCACtB,kDACA,uBACA,8CACA,yBAAyB,eAAe,kBAAkB,eAEzD,iBAED,mBACG,UAAU,WAAW,UAAU;EAGlC,kBAAkB;;EAElB;EACA,WAAW;EACX,qBAAqB,YACpB,WACA,SACA,qBAEA;EAED,gBAAgB;EAChB,0BAA0B,UAAU,WAAW,SAAS,UAAU;EAClE,uBAAuB;EACvB,wBAAwB;EACxB,wBAAwB,QAAQ,0BAA0B;EAC1D,yBAAyB,QAAQ,sBAAsB;EACvD,wBAAwB,eAAe,WAAW,UAAU;EAC5D,wBAAwB;EACxB,mBAAmB;;;;;;;;;;;EAWnB,SAAS"}
+{"version":3,"file":"EndpointFactory-I7s1co3Y.d.cts","names":[],"sources":["../src/endpoints/EndpointBuilder.ts","../src/endpoints/EndpointFactory.ts"],"mappings":";;;;;;;;;;;;;cA0Ca,gBACZ,uBACA,gBAAgB,YAChB,eAAe,sBACf,kBAAkB,gBAClB,gBAAgB,SAAS,QACzB,kBAAkB,0CAClB,oBACA,4DACA,sBAAsB,sCACtB,kDACA,qBAAqB,mCAAmC,kCAIxD,uBACA,sDACS,oBACT,QACA,WACA,WACA,SACA,eACA,0BACA,WACA;WA8BU,OAAO;WACP,QAAQ;YA7BR,SAAS;YACT;YACA,UAAU;YACV;YACA;YACA;;EAEV,cAAc,UAAU,WAAW,SAAS,UAAU;EACtD,YAAY,YAAY,WAAW,SAAS,UAAU,QAAQ;EAE9D,aAAa;EACb,uBAAuB;EACvB,kBAAkB;EAClB,kBAAkB,eAAe,WAAW,UAAU;EACtD,SAAS,YAAY,cAAc;;;;;;;EAOnC,UAAW;EACX,wBAAwB,eAAe;EACvC,aAAa,UAAU,WAAW,UAAU;EAC5C;EACA,aAAa;EAEb,YACU,OAAO,QACP,QAAQ;EAMlB,mBACC,SAAS,QAAQ,0BAA0B;EAM5C,oBAAoB,SAAS,QAAQ,sBAAsB;EAI3D,YAAY;EAIZ,OAAO,QAAQ;;;;;;;;;;;;;;;;EAmBf,MAAM,eAAe,iBACpB,OAAO,QACP,OAAO,SAAS,QAAQ,oBAAoB,cAC1C,gBACF,QACA,SACA,YACI,WAAW,oBACf,SACA,WACA,UACA,cACA,eACA,0BACA,cACA,WACA;EAmBD,KAAK;EAIL,WAAW;;;;;;;;;;;EAcX,UAAU,SAAS;;;;;;;;;;;;;;;;;;;EAsBnB,aAAa;EAIb,KAAK,UAAU,kBACd,QAAQ,IACN,gBACF,QACA,SACA,KAAK;IAAoB,MAAM;KAC/B,WACA,SACA,WACA,UACA,cACA,eACA,0BACA,cACA,WACA;EAOD,OAAO,UAAU,kBAChB,QAAQ,IACN,gBACF,QACA,SACA,KAAK;IAAqB,OAAO;KACjC,WACA,SACA,WACA,UACA,cACA,eACA,0BACA,cACA,WACA;EAOD,MAAM,UAAU,kBACf,QAAQ,IACN,gBACF,QACA,SACA,KAAK;IAAqB,OAAO;KACjC,WACA,SACA,WACA,UACA,cACA,eACA,0BACA,cACA,WACA;EAKD,OAAO,UAAU,kBAChB,QAAQ,IACN,gBACF,QACA,SACA,KAAK;IAAsB,QAAQ;KACnC,WACA,SACA,WACA,UACA,cACA,eACA,0BACA,cACA,WACA;EAOD,UACC,IAAI,YAAY,WAAW,SAAS,UAAU,QAAQ;EAKvD,UAAU,QAAQ;EAIlB,WACC,MAAM,gCACJ,gBACF,QACA,SACA,QACA,WACA,SACA,WACA,UACA,cACA,eACA,0BACA,cACA,WACA;;;;;;;;;;;;EAkCD,gBAAgB,mBAAmB,cAClC,YAAY,IACV,gBACF,QACA,SACA,YACI,cAAc,WAAW,KAC7B,SACA,WACA,UACA,cACA,eACA,0BACA,cACA,WACA;EAkCD,SAAS,UAAU,WAClB,UAAU,IACR,gBACF,QACA,SACA,YACI,cAAc,IAClB,SACA,WACA,UACA,cACA,eACA,0BACA,cACA,WACA;EAwBD,OAAO,UAAU,QAChB,QAAQ,IACN,gBACF,QACA,SACA,QACA,WACA,GACA,WACA,UACA,cACA,eACA,0BACA,cACA,WACA;EAqBD,OAAO,UAAU,kBAChB,QAAQ,IACN,gBACF,QACA,SACA,QACA,WACA,SACA,GACA,UACA,cACA,eACA,0BACA,cACA,WACA;;;;;;EA0BQ,QAAQ,UAAU,mBAAmB,sBAC7C,SAAS,QAAQ,OAAO,KACtB,gBACF,QACA,SACA,QACA,WACA,SACA,WACA,UACA,cACA,GACA,OACA,0BAA0B,IAC1B,WACA;;;;;EA4BD,MACC,WAAW,eAAe,WAAW,UAAU,WAC7C,gBACF,QACA,SACA,QACA,WACA,SACA,WACA,UACA,cACA,eACA,0BACA,cACA,WACA;;;;;;;;;;;;;;;;;;EAsBD,MAAM,QAAQ,YAAY,cAAc;;;;;;;;;;;;;;;;EAmB/B,SAAS,GAAG,sBACpB,QAAQ,WAAW,OAAO,KAAK,QAAQ,OAAO,KAC5C,gBACF,QACA,SACA,QACA,WACA,SACA,WACA,UACA,cACA,eACA,0BACA,cACA,GACA;;;;;;;;;;;;;;;;;;;;EA6CD,IACC,QAAQ,UAAU,WAAW,UAAU,mBAAmB;;;;;;;;;;;;;;EAyB3D;EAKA,MAAM;EAMN,OACC,IAAI,gBACH,QACA,WACA,SACA,WACA,UACA,WACA,eACA,gBAEC,SACF,QACA,SACA,QACA,WACA,WACA,SACA,UACA,eACA,0BACA,cACA,WACA;;;;cC1sBW,gBACZ,kBAAkB,gBAClB,+BACA,gBAAgB,SAAS,QACzB,oBACA,4DACA,sBAAsB,2CACtB,kDACA,qBAAqB,mCAGjB,0BAA0B,YAAY,iBAC1C,uBACA,8CACA,yBAAyB,eAAe,kBAAkB,eAEzD,iBAED,mBACG,UAAU,WAAW,UAAU;UAG1B;;;;;;;;;;;UAWA;UACA;UACA;UAOA;UAMA;;;;;;;;UAQA;UACA;UACA;UACA;UAGA;UAGA;UACA;UACA;EAER,cACC,UACA,oBACA,eACA,yBAEA,iBACA,mBACA,sBACA,uBACA,uBACA,wBACA,uBACA,uBACA,kBACA,WACE,uBACF,WACA,WACA,SACA,UACA,cACA,eACA,0BACA,WACA,sBACA,kBACA;SAuBM,UAAU,0BAA0B,kBAC1C,MAAM,GACN,WAAU,YACR,UAAU,WAAW;EAmCxB,kBAAkB,6BACjB,aAAa,IACX,gBACF,WACA,WACA,SACA,UACA,GACA,eACA,0BACA,cACA,WACA,sBACA,kBACA;;;;;;;;;;;;;;;;;EAqDD,gBAAgB,UAAU,eAAe,iBACxC,SAAS,IACP,gBACF,WACA,WACA,SACA,UACA,cACA,eACA,0BACA,cACA,WACA,sBACA,mBAAmB,GACnB;;;;;;;;;;;EA8CD,WACC,MACG,gCACM,mBACN,gCAED,gBACF,WACA,WACA,SACA,UACA,cACA,eACA,0BACA,cACA,WACA,sBACA,kBACA;EAkDD,MAAM,sBACL,MAAM,QACJ,gBACF,WACA,UAAU,WAAW,QACrB,SACA,UACA,cACA,eACA,0BACA,cACA,WACA,sBACA,kBACA;EAmCD,UACC,IAAI,YAAY,WAAW,SAAS,qBAAqB,aACvD,gBACF,WACA,WACA,SACA,UACA,cACA,eACA,0BACA,cACA,WACA,sBACA,kBACA;;;;;;;;;;;;EA6CD,gBAAgB,mBAAmB,cAClC,YAAY,IACV,oBACE,WAAW,OAAO,YACtB,WACA,SACA,UACA,cACA,eACA,0BACA,cACA,WACA,sBACA,kBACA,cAAc,WAAW,OAAO,YAAY,UAAU;EA6BvD,SAAS,UAAU,WAClB,UAAU,IACR,oBACE,MAAM,YACV,WACA,SACA,UACA,cACA,eACA,0BACA,cACA,WACA,sBACA,kBACA,cAAc,MAAM,YAAY,UAAU;EA2C3C,OAAO,UAAU,QAChB,QAAQ,IACN,gBACF,WACA,WACA,GACA,UACA,cACA,eACA,0BACA,cACA,WACA,sBACA,kBACA,UAAU,WAAW,UAAU;EAiDhC,QAAQ,GACP,SAAS,UAAU,WAAW,SAAS,GAAG,aACxC,gBACF,WACA,WACA,SACA,GACA,cACA,eACA,0BACA,cACA,WACA,sBACA,kBACA,UAAU,WAAW,GAAG;;;;;EAgDzB,SAAS,GAAG,sBACX,QAAQ,WAAW,OAAO,KAAK,QAAQ,OAAO,KAC5C,gBACF,WACA,WACA,SACA,UACA,cACA,eACA,0BACA,cACA,GACA,OACA,kBACA;;;;;;EAmDD,QAAQ,UAAU,mBAAmB,sBACpC,SAAS,QAAQ,OAAO,KACtB,gBACF,WACA,WACA,SACA,UACA,cACA,GACA,OACA,0BAA0B,IAC1B,WACA,sBACA,kBACA;;;;;EA0CD,MACC,WAAW,eAAe,WAAW,UAAU,WAC7C,gBACF,WACA,WACA,SACA,UACA,cACA,eACA,0BACA,cACA,WACA,sBACA,kBACA;;;;;;;;;;;;;;;;;;;EAmDD,IAAI,gBAAgB,UAAU,WAAW,UAAU,UAClD,QAAQ,UACN,gBACF,WACA,WACA,SACA,UACA,cACA,eACA,0BACA,cACA,WACA,sBACA,kBACA;UAiCO;EA8FR,KAAK,sBAAsB,MAAM,QAAK,gBAAA,oBAAA,uBAAA,QAAA,mBAAA,YAAA,wBAAA,6BAAA,YAAA,UAAA,2BA2CN,UAAI,wBACN,YAAI,QAAA,YAAA,QAAA,UAAA,wBAAA,cAAA,aAAA,cAAA,aAAA,sBAAA,WAAA,oBAAA,UAAA,cAAA,eAAA,0BAAA,cAAA,WAAA;EAxClC,IAAI,sBAAsB,MAAM,QAAK,gBAAA,oBAAA,uBAAA,QAAA,mBAAA,YAAA,wBAAA,6BAAA,YAAA,UAAA,2BAuCL,UAAI,wBACN,YAAI,QAAA,YAAA,QAAA,UAAA,wBAAA,cAAA,aAAA,cAAA,aAAA,qBAAA,WAAA,oBAAA,UAAA,cAAA,eAAA,0BAAA,cAAA,WAAA;EApClC,IAAI,sBAAsB,MAAM,QAAK,gBAAA,oBAAA,uBAAA,QAAA,mBAAA,YAAA,wBAAA,6BAAA,YAAA,UAAA,2BAmCL,UAAI,wBACN,YAAI,QAAA,YAAA,QAAA,UAAA,wBAAA,cAAA,aAAA,cAAA,aAAA,qBAAA,WAAA,oBAAA,UAAA,cAAA,eAAA,0BAAA,cAAA,WAAA;EAhClC,OAAO,sBAAsB,MAAM,QAAK,gBAAA,oBAAA,uBAAA,QAAA,mBAAA,YAAA,wBAAA,6BAAA,YAAA,UAAA,2BA+BR,UAAI,wBACN,YAAI,QAAA,YAAA,QAAA,UAAA,wBAAA,cAAA,aAAA,cAAA,aAAA,wBAAA,WAAA,oBAAA,UAAA,cAAA,eAAA,0BAAA,cAAA,WAAA;EA5BlC,MAAM,sBAAsB,MAAM,QAAK,gBAAA,oBAAA,uBAAA,QAAA,mBAAA,YAAA,wBAAA,6BAAA,YAAA,UAAA,2BA2BP,UAAI,wBACN,YAAI,QAAA,YAAA,QAAA,UAAA,wBAAA,cAAA,aAAA,cAAA,aAAA,uBAAA,WAAA,oBAAA,UAAA,cAAA,eAAA,0BAAA,cAAA,WAAA;EAxBlC,QAAQ,sBAAsB,MAAM,QAAK,gBAAA,oBAAA,uBAAA,QAAA,mBAAA,YAAA,wBAAA,6BAAA,YAAA,UAAA,2BAuBT,UAAI,wBACN,YAAI,QAAA,YAAA,QAAA,UAAA,wBAAA,cAAA,aAAA,cAAA,aAAA,yBAAA,WAAA,oBAAA,UAAA,cAAA,eAAA,0BAAA,cAAA,WAAA;;KAnBvB,oBAAoB,oBAAoB,mBAAmB,UACpE,kBACC,IACA,OACD;KAES,UACX,0BACA,wBACG,oBACH,uBACG,QACA,mBACC,YACA,wBACC,6BACC,YACI,UACL,2BAA2B,UAC1B,wBAAwB,YACpB,QAAQ,YACR,QAAQ,UACZ,wBAAwB,YACpB,aAAa,YACb,aAAa;UAGP,uBAChB,kBAAkB,gBAClB,+BACA,gBAAgB,SAAS,QACzB,oBACA,4DACA,sBAAsB,sCACtB,kDACA,uBACA,8CACA,yBAAyB,eAAe,kBAAkB,eAEzD,iBAED,mBACG,UAAU,WAAW,UAAU;EAGlC,kBAAkB;;EAElB;EACA,WAAW;EACX,qBAAqB,YACpB,WACA,SACA,qBAEA;EAED,gBAAgB;EAChB,0BAA0B,UAAU,WAAW,SAAS,UAAU;EAClE,uBAAuB;EACvB,wBAAwB;EACxB,wBAAwB,QAAQ,0BAA0B;EAC1D,yBAAyB,QAAQ,sBAAsB;EACvD,wBAAwB,eAAe,WAAW,UAAU;EAC5D,wBAAwB;EACxB,mBAAmB;;;;;;;;;;;EAWnB,SAAS"}

package/dist/adaptors/aws.d.cts

@@ -2,7 +2,7 @@ import { t as StandardSchemaV1 } from "../index-CeEtxDmK.cjs";
 import { i as FunctionHandler, n as Function$1 } from "../Function-Pu-1kKZz.cjs";
 import { t as Cron } from "../Cron-DI3nKoic.cjs";
 import { t as HttpMethod } from "../types-DMuSQeLL.cjs";
-import { c as EndpointSchemas, i as Endpoint, r as CookieFn } from "../Endpoint-C4PZn_mD.cjs";
+import { c as EndpointSchemas, i as Endpoint, r as CookieFn } from "../Endpoint-aCvBMPoH.cjs";
 import { t as Telemetry } from "../lambdaTelemetry-8vnmVZQ5.cjs";
 import { t as Queue } from "../Queue-HPyi0e1i.cjs";
 import { t as Subscriber } from "../Subscriber-Bpp02cGr.cjs";

package/dist/adaptors/aws.d.mts

@@ -2,7 +2,7 @@ import { t as StandardSchemaV1 } from "../index-CeEtxDmK.mjs";
 import { i as FunctionHandler, n as Function$1 } from "../Function-DuqGcbOI.mjs";
 import { t as Cron } from "../Cron-uYAHPnp7.mjs";
 import { t as HttpMethod } from "../types-DMuSQeLL.mjs";
-import { c as EndpointSchemas, i as Endpoint, r as CookieFn } from "../Endpoint-ViSuXwMB.mjs";
+import { c as EndpointSchemas, i as Endpoint, r as CookieFn } from "../Endpoint-Du-NwPX2.mjs";
 import { t as Telemetry } from "../lambdaTelemetry-8vnmVZQ5.mjs";
 import { t as Queue } from "../Queue-DlsHRzUp.mjs";
 import { t as Subscriber } from "../Subscriber-CtN9R48-.mjs";

package/dist/adaptors/hono.d.cts

@@ -1,6 +1,6 @@
 import { t as StandardSchemaV1 } from "../index-CeEtxDmK.cjs";
 import { t as HttpMethod } from "../types-DMuSQeLL.cjs";
-import { c as EndpointSchemas, i as Endpoint } from "../Endpoint-C4PZn_mD.cjs";
+import { c as EndpointSchemas, i as Endpoint } from "../Endpoint-aCvBMPoH.cjs";
 import { EnvironmentParser } from "@geekmidas/envkit";
 import { Logger } from "@geekmidas/logger";
 import { Service, ServiceDiscovery, ServiceRecord } from "@geekmidas/services";

package/dist/adaptors/hono.d.mts

@@ -1,6 +1,6 @@
 import { t as StandardSchemaV1 } from "../index-CeEtxDmK.mjs";
 import { t as HttpMethod } from "../types-DMuSQeLL.mjs";
-import { c as EndpointSchemas, i as Endpoint } from "../Endpoint-ViSuXwMB.mjs";
+import { c as EndpointSchemas, i as Endpoint } from "../Endpoint-Du-NwPX2.mjs";
 import { EnvironmentParser } from "@geekmidas/envkit";
 import { Service, ServiceDiscovery, ServiceRecord } from "@geekmidas/services";
 import { Context, Hono } from "hono";

package/dist/adaptors/testing.d.cts

@@ -1,7 +1,7 @@
 import { t as StandardSchemaV1 } from "../index-CeEtxDmK.cjs";
 import { n as Function } from "../Function-Pu-1kKZz.cjs";
 import { t as HttpMethod } from "../types-DMuSQeLL.cjs";
-import { c as EndpointSchemas, i as Endpoint } from "../Endpoint-C4PZn_mD.cjs";
+import { c as EndpointSchemas, i as Endpoint } from "../Endpoint-aCvBMPoH.cjs";
 import { t as Queue } from "../Queue-HPyi0e1i.cjs";
 import { t as Subscriber } from "../Subscriber-Bpp02cGr.cjs";
 import { t as KyselyDatabase } from "../kysely-D0bpzgPs.cjs";

package/dist/adaptors/testing.d.mts

@@ -1,7 +1,7 @@
 import { t as StandardSchemaV1 } from "../index-CeEtxDmK.mjs";
 import { n as Function } from "../Function-DuqGcbOI.mjs";
 import { t as HttpMethod } from "../types-DMuSQeLL.mjs";
-import { c as EndpointSchemas, i as Endpoint } from "../Endpoint-ViSuXwMB.mjs";
+import { c as EndpointSchemas, i as Endpoint } from "../Endpoint-Du-NwPX2.mjs";
 import { t as Queue } from "../Queue-DlsHRzUp.mjs";
 import { t as Subscriber } from "../Subscriber-CtN9R48-.mjs";
 import { t as KyselyDatabase } from "../kysely-DUqC3Ie0.mjs";

package/dist/{auth-CwYlcogd.d.cts → auth-BMCJN30Y.d.cts}

@@ -65,7 +65,7 @@ interface BetterAuthConfig<TDatabase extends Consumable, TUses extends readonly
   path: string;
   /**
    * The label it answers on under a stage's domain — `api` for
-   * `api.myapp.com`, from `deploy.domains` — and under the project locally,
+   * `api.myapp.com`, from `domains` — and under the project locally,
    * `api.myapp.localhost`. Absent, its id kebab-cased.
    */
   subdomain?: string;
@@ -265,4 +265,4 @@ declare function idempotent(statements: string): string;
 declare function withTrustedClientIp(request: Request, remoteAddress: string | undefined): Request;
 //#endregion
 export { BetterAuth as a, BetterAuthOptionsContext as c, deviceLink as d, idempotent as f, AuthSession as i, ExpoPluginRequired as l, AuthServer as n, BetterAuthConfig as o, withTrustedClientIp as p, AuthServerUnreachable as r, BetterAuthOptions as s, AuthClient as t, SessionCheckFailed as u };
-//# sourceMappingURL=auth-CwYlcogd.d.cts.map
+//# sourceMappingURL=auth-BMCJN30Y.d.cts.map

package/dist/{auth-CYFghDZw.d.mts.map → auth-BMCJN30Y.d.cts.map}

@@ -1 +1 @@
-{"version":3,"file":"auth-CYFghDZw.d.mts","names":[],"sources":["../src/auth.ts"],"mappings":";;;;;;;;;KA2DY,aAAa,kBAAkB;;KAG/B,cAAc;;;;;;;;;;UAWT;WACP;;;;;;;;;;;IAWR,WAAW;MACV,SAAS,6BAA6B;QACnC,QAAQ;;;;KAKF,oBAAoB,KAC/B,kBAAkB;;;;;;KASP,yBAAyB,uBAAuB,gBAC3D;EACC,UAAU,kBAAkB,WAAW;;UAGxB,iBAChB,kBAAkB,YAClB,uBAAuB;;;;;;;;EASvB,UAAU;;;;;;;;EAQV;;;;;;EAMA;;;;;;;EAOA;;;;;;;;;;;;EAYA,YAAY;;;;;;EAMZ,YAAY;;;;;;;;EAQZ,UACG,sBAEA,SAAS,yBAAyB,WAC7B,oBAAoB,QAAQ;;cAKxB,WACZ,+BACA,kBAAkB,aAAa,kBACzB,uBAAuB,uCACjB,UAAU,OAAO,aAAa,cAAc;mBA+BtC;WA7BT,IAAI;;;;;;;;;;;;WAYJ,SAAS,QAAQ,aAAa,QAAQ;WACtC;;;;;mBAMQ;EAQjB,YACC,IAAI,cAAc,QACD,QAAQ,iBAAiB,WAAW;;;;;;;;;;;;;;;EAuCtD,WAAW;;;;;;;;EAgDL,OACL,SAAS,SACT,WAAW,wBACT,QAAQ;;;;;;;;EAWX,OAAO,WAAW,wBAAwB;;;;;MAkBtC;;;;;;;;;;;;;EAgBE,iBACL,SAAS,yBACP;;;;;;;;;;;;;;;;;;;;;;;;;EAsDG,OACL,SAAS,yBACP;IAAU,KAAK;IAAM,MAAM;;;;;;;EAsDxB,UAAU,SAAS,yBAAyB;;UAMpC;UAuBA;;;;;;;UAmBA;;;iBA8JC,WAAW,aAAa;;cAY3B,2BAA2B;WAE7B;;WAEA;EAHV,YACU,gBAEA;;EAAA;;;cAiEE,2BAA2B;WAE7B;WACA;EAFV,YACU,uBACA;;;cAYE,8BAA8B;WAEhC;WACA;EAFV,YACU,uBACA,aACT;;;;;;;;;;;iBAqBc,WAAW;;;;;;;;;;;iBAgCX,oBACf,SAAS,SACT,oCACE"}
+{"version":3,"file":"auth-BMCJN30Y.d.cts","names":[],"sources":["../src/auth.ts"],"mappings":";;;;;;;;;KA2DY,aAAa,kBAAkB;;KAG/B,cAAc;;;;;;;;;;UAWT;WACP;;;;;;;;;;;IAWR,WAAW;MACV,SAAS,6BAA6B;QACnC,QAAQ;;;;KAKF,oBAAoB,KAC/B,kBAAkB;;;;;;KASP,yBAAyB,uBAAuB,gBAC3D;EACC,UAAU,kBAAkB,WAAW;;UAGxB,iBAChB,kBAAkB,YAClB,uBAAuB;;;;;;;;EASvB,UAAU;;;;;;;;EAQV;;;;;;EAMA;;;;;;;EAOA;;;;;;;;;;;;EAYA,YAAY;;;;;;EAMZ,YAAY;;;;;;;;EAQZ,UACG,sBAEA,SAAS,yBAAyB,WAC7B,oBAAoB,QAAQ;;cAKxB,WACZ,+BACA,kBAAkB,aAAa,kBACzB,uBAAuB,uCACjB,UAAU,OAAO,aAAa,cAAc;mBA+BtC;WA7BT,IAAI;;;;;;;;;;;;WAYJ,SAAS,QAAQ,aAAa,QAAQ;WACtC;;;;;mBAMQ;EAQjB,YACC,IAAI,cAAc,QACD,QAAQ,iBAAiB,WAAW;;;;;;;;;;;;;;;EAuCtD,WAAW;;;;;;;;EAgDL,OACL,SAAS,SACT,WAAW,wBACT,QAAQ;;;;;;;;EAWX,OAAO,WAAW,wBAAwB;;;;;MAkBtC;;;;;;;;;;;;;EAgBE,iBACL,SAAS,yBACP;;;;;;;;;;;;;;;;;;;;;;;;;EAsDG,OACL,SAAS,yBACP;IAAU,KAAK;IAAM,MAAM;;;;;;;EAsDxB,UAAU,SAAS,yBAAyB;;UAMpC;UAuBA;;;;;;;UAmBA;;;iBA8JC,WAAW,aAAa;;cAY3B,2BAA2B;WAE7B;;WAEA;EAHV,YACU,gBAEA;;EAAA;;;cAiEE,2BAA2B;WAE7B;WACA;EAFV,YACU,uBACA;;;cAYE,8BAA8B;WAEhC;WACA;EAFV,YACU,uBACA,aACT;;;;;;;;;;;iBAqBc,WAAW;;;;;;;;;;;iBAgCX,oBACf,SAAS,SACT,oCACE"}

package/dist/{auth-CYFghDZw.d.mts → auth-CcuceLYo.d.mts}

@@ -65,7 +65,7 @@ interface BetterAuthConfig<TDatabase extends Consumable, TUses extends readonly
   path: string;
   /**
    * The label it answers on under a stage's domain — `api` for
-   * `api.myapp.com`, from `deploy.domains` — and under the project locally,
+   * `api.myapp.com`, from `domains` — and under the project locally,
    * `api.myapp.localhost`. Absent, its id kebab-cased.
    */
   subdomain?: string;
@@ -265,4 +265,4 @@ declare function idempotent(statements: string): string;
 declare function withTrustedClientIp(request: Request, remoteAddress: string | undefined): Request;
 //#endregion
 export { BetterAuth as a, BetterAuthOptionsContext as c, deviceLink as d, idempotent as f, AuthSession as i, ExpoPluginRequired as l, AuthServer as n, BetterAuthConfig as o, withTrustedClientIp as p, AuthServerUnreachable as r, BetterAuthOptions as s, AuthClient as t, SessionCheckFailed as u };
-//# sourceMappingURL=auth-CYFghDZw.d.mts.map
+//# sourceMappingURL=auth-CcuceLYo.d.mts.map

package/dist/{auth-CwYlcogd.d.cts.map → auth-CcuceLYo.d.mts.map}

@@ -1 +1 @@
-{"version":3,"file":"auth-CwYlcogd.d.cts","names":[],"sources":["../src/auth.ts"],"mappings":";;;;;;;;;KA2DY,aAAa,kBAAkB;;KAG/B,cAAc;;;;;;;;;;UAWT;WACP;;;;;;;;;;;IAWR,WAAW;MACV,SAAS,6BAA6B;QACnC,QAAQ;;;;KAKF,oBAAoB,KAC/B,kBAAkB;;;;;;KASP,yBAAyB,uBAAuB,gBAC3D;EACC,UAAU,kBAAkB,WAAW;;UAGxB,iBAChB,kBAAkB,YAClB,uBAAuB;;;;;;;;EASvB,UAAU;;;;;;;;EAQV;;;;;;EAMA;;;;;;;EAOA;;;;;;;;;;;;EAYA,YAAY;;;;;;EAMZ,YAAY;;;;;;;;EAQZ,UACG,sBAEA,SAAS,yBAAyB,WAC7B,oBAAoB,QAAQ;;cAKxB,WACZ,+BACA,kBAAkB,aAAa,kBACzB,uBAAuB,uCACjB,UAAU,OAAO,aAAa,cAAc;mBA+BtC;WA7BT,IAAI;;;;;;;;;;;;WAYJ,SAAS,QAAQ,aAAa,QAAQ;WACtC;;;;;mBAMQ;EAQjB,YACC,IAAI,cAAc,QACD,QAAQ,iBAAiB,WAAW;;;;;;;;;;;;;;;EAuCtD,WAAW;;;;;;;;EAgDL,OACL,SAAS,SACT,WAAW,wBACT,QAAQ;;;;;;;;EAWX,OAAO,WAAW,wBAAwB;;;;;MAkBtC;;;;;;;;;;;;;EAgBE,iBACL,SAAS,yBACP;;;;;;;;;;;;;;;;;;;;;;;;;EAsDG,OACL,SAAS,yBACP;IAAU,KAAK;IAAM,MAAM;;;;;;;EAsDxB,UAAU,SAAS,yBAAyB;;UAMpC;UAuBA;;;;;;;UAmBA;;;iBA8JC,WAAW,aAAa;;cAY3B,2BAA2B;WAE7B;;WAEA;EAHV,YACU,gBAEA;;EAAA;;;cAiEE,2BAA2B;WAE7B;WACA;EAFV,YACU,uBACA;;;cAYE,8BAA8B;WAEhC;WACA;EAFV,YACU,uBACA,aACT;;;;;;;;;;;iBAqBc,WAAW;;;;;;;;;;;iBAgCX,oBACf,SAAS,SACT,oCACE"}
+{"version":3,"file":"auth-CcuceLYo.d.mts","names":[],"sources":["../src/auth.ts"],"mappings":";;;;;;;;;KA2DY,aAAa,kBAAkB;;KAG/B,cAAc;;;;;;;;;;UAWT;WACP;;;;;;;;;;;IAWR,WAAW;MACV,SAAS,6BAA6B;QACnC,QAAQ;;;;KAKF,oBAAoB,KAC/B,kBAAkB;;;;;;KASP,yBAAyB,uBAAuB,gBAC3D;EACC,UAAU,kBAAkB,WAAW;;UAGxB,iBAChB,kBAAkB,YAClB,uBAAuB;;;;;;;;EASvB,UAAU;;;;;;;;EAQV;;;;;;EAMA;;;;;;;EAOA;;;;;;;;;;;;EAYA,YAAY;;;;;;EAMZ,YAAY;;;;;;;;EAQZ,UACG,sBAEA,SAAS,yBAAyB,WAC7B,oBAAoB,QAAQ;;cAKxB,WACZ,+BACA,kBAAkB,aAAa,kBACzB,uBAAuB,uCACjB,UAAU,OAAO,aAAa,cAAc;mBA+BtC;WA7BT,IAAI;;;;;;;;;;;;WAYJ,SAAS,QAAQ,aAAa,QAAQ;WACtC;;;;;mBAMQ;EAQjB,YACC,IAAI,cAAc,QACD,QAAQ,iBAAiB,WAAW;;;;;;;;;;;;;;;EAuCtD,WAAW;;;;;;;;EAgDL,OACL,SAAS,SACT,WAAW,wBACT,QAAQ;;;;;;;;EAWX,OAAO,WAAW,wBAAwB;;;;;MAkBtC;;;;;;;;;;;;;EAgBE,iBACL,SAAS,yBACP;;;;;;;;;;;;;;;;;;;;;;;;;EAsDG,OACL,SAAS,yBACP;IAAU,KAAK;IAAM,MAAM;;;;;;;EAsDxB,UAAU,SAAS,yBAAyB;;UAMpC;UAuBA;;;;;;;UAmBA;;;iBA8JC,WAAW,aAAa;;cAY3B,2BAA2B;WAE7B;;WAEA;EAHV,YACU,gBAEA;;EAAA;;;cAiEE,2BAA2B;WAE7B;WACA;EAFV,YACU,uBACA;;;cAYE,8BAA8B;WAEhC;WACA;EAFV,YACU,uBACA,aACT;;;;;;;;;;;iBAqBc,WAAW;;;;;;;;;;;iBAgCX,oBACf,SAAS,SACT,oCACE"}

package/dist/auth.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"auth.cjs","names":["canonicalId","environmentCase","provideKey","serviceKey","edgeTo","isWebOrigin","CLIENT_IP_HEADER"],"sources":["../src/auth.ts"],"sourcesContent":["/**\n * `BetterAuth` — a declared auth server.\n *\n * It is three things at once, which is what makes it the construct that\n * exercises most of the model: a consumer of a database, a producer of an\n * authorizer, and a set of endpoints. This lands the first two.\n *\n * Its tables live in a schema tenant it is *given* — `orders.schema('AuthDb')`\n * — rather than one it invents. The tenant declares the schema and the role;\n * this declares the one thing left, the signing secret, and reads back the keys\n * it needs.\n *\n * :::caution\n * The isolation that arrangement is *for* — the application's own role holding\n * no grant on these tables, so a compromised handler cannot read sessions — does\n * **not hold yet**. No target creates the per-schema role: both connect as the\n * database owner, so today the tenant is a `search_path`, which is a namespace\n * and not a privilege boundary. See \"Roles are declared and never created\" in\n * `docs/design/constructs-outstanding.md`.\n * :::\n *\n * It declares its own surface, so where it answers, who may call it, and the\n * domain its cookies are scoped to all arrive as environment resolved by the\n * target — none of them guessed from a port, and none of them listed by hand in\n * application config.\n */\n\nimport type { EnvironmentParser } from '@geekmidas/envkit';\nimport {\n\tCLIENT_IP_HEADER,\n\ttype ConstructName,\n\tcanonicalId,\n\ttype Declaration,\n\tenvironmentCase,\n\tisWebOrigin,\n\tprovideKey,\n\tserviceKey,\n} from '@geekmidas/manifest';\nimport type {\n\tService,\n\tServiceRecord,\n\tServiceRegisterOptions,\n} from '@geekmidas/services';\n// Types only: the server is built in `connect()`, from a dynamic import, so a\n// process that only holds the client never loads better-auth to get it.\nimport type { betterAuth } from 'better-auth';\nimport type { Hono } from 'hono';\nimport type { Kysely } from 'kysely';\nimport {\n\ttype Authenticator,\n\ttype Construct,\n\ttype Consumable,\n\tedgeTo,\n\ttype ServicesOf,\n} from './construct-interface';\nimport type { Telemetry } from './telemetry';\nimport { injectTraceContext } from './tracing';\n\n/** The server better-auth hands back. */\nexport type AuthServer = ReturnType<typeof betterAuth>;\n\n/** A signed-in session as better-auth hands it back: `{ user, session }`. */\nexport type AuthSession = AuthServer['$Infer']['Session'];\n\n/**\n * What `.dependsOn([auth])` hands a handler: the auth server, over HTTP.\n *\n * The server itself — its secret, its tenant's connection, its mailer — lives\n * in the auth app's own process and nowhere else. Every other process is a\n * caller of it, so what it is given is an address and this, with the one\n * call handlers make kept in Better Auth's shape: `api.getSession({ headers })`\n * answers `{ user, session }` or `null`, as the server's own `api` does.\n */\nexport interface AuthClient {\n\treadonly api: {\n\t\t/**\n\t\t * The session the request's cookie or bearer token belongs to, or `null`\n\t\t * when there is none — asked of `<basePath>/get-session` at the auth\n\t\t * server's URL. Only `cookie` and `authorization` are forwarded, with\n\t\t * the client's address as `x-gkm-client-ip` (read from the request's\n\t\t * `x-forwarded-for`) and the active trace context.\n\t\t *\n\t\t * @throws {AuthServerUnreachable} when the request does not get there.\n\t\t * @throws {SessionCheckFailed} when the server answers with a failure.\n\t\t */\n\t\tgetSession(input: {\n\t\t\theaders: ConstructorParameters<typeof Headers>[0];\n\t\t}): Promise<AuthSession | null>;\n\t};\n}\n\n/** Everything better-auth takes, minus what the construct owns. */\nexport type BetterAuthOptions = Omit<\n\tParameters<typeof betterAuth>[0],\n\t'database' | 'secret' | 'basePath' | 'baseURL'\n>;\n\n/**\n * What an `options` callback is handed: the options this construct was\n * registered with, and a client for each construct its `dependsOn` names —\n * keyed by service name, exactly as an endpoint's handler receives them.\n */\nexport type BetterAuthOptionsContext<TUses extends readonly Consumable[]> =\n\tServiceRegisterOptions & {\n\t\tservices: ServiceRecord<[...ServicesOf<TUses>]>;\n\t};\n\nexport interface BetterAuthConfig<\n\tTDatabase extends Consumable,\n\tTUses extends readonly Consumable[] = readonly [],\n> {\n\t/**\n\t * The schema tenant its tables live in.\n\t *\n\t * A construct rather than a URL: the tenant already declares its schema and\n\t * its role, and taking the declaration is what puts the edge in the graph\n\t * instead of a connection string in two places.\n\t */\n\tdatabase: TDatabase;\n\t/**\n\t * The app that serves this auth server, relative to the workspace root —\n\t * `'apps/auth'`.\n\t *\n\t * Required, for the reason `RestApi.path` is. Not to be confused with\n\t * `basePath`, which is where its routes are mounted in a URL.\n\t */\n\tpath: string;\n\t/**\n\t * The label it answers on under a stage's domain — `api` for\n\t * `api.myapp.com`, from `deploy.domains` — and under the project locally,\n\t * `api.myapp.localhost`. Absent, its id kebab-cased.\n\t */\n\tsubdomain?: string;\n\t/**\n\t * Where the auth routes are mounted, e.g. `/api/auth`.\n\t *\n\t * Structural — it is part of the URL every client calls, so it cannot differ\n\t * between stages the way the host can.\n\t */\n\tbasePath?: string;\n\t/**\n\t * The constructs `options` uses — the mailer a magic link goes through,\n\t * most often.\n\t *\n\t * One list, two jobs, the way an endpoint's `.dependsOn()` has: each is an\n\t * edge on the server's handler, so whatever is composed from the edges (a\n\t * container's environment, a deploy's grants) includes it; and each is\n\t * handed to `options` as a client in `services`, so there is no other way\n\t * for `options` to reach it — nothing to import and register by hand, and\n\t * so nothing that can be used without being declared.\n\t */\n\tdependsOn?: TUses;\n\t/**\n\t * What the auth server's process emits — the `Telemetry` construct, passed\n\t * like a `RestApi`'s. An edge to the node: the deploy hands the process the\n\t * `OTEL_*` keys its stage resolves.\n\t */\n\ttelemetry?: Telemetry;\n\t/**\n\t * The rest of better-auth's options: providers, plugins, email settings.\n\t *\n\t * A function when they need another construct — a magic-link plugin has to\n\t * *send* the link. It is handed the options this construct was registered\n\t * with, and `services`: a client for each construct in `dependsOn`.\n\t */\n\toptions?:\n\t\t| BetterAuthOptions\n\t\t| ((\n\t\t\t\tcontext: BetterAuthOptionsContext<TUses>,\n\t\t  ) => BetterAuthOptions | Promise<BetterAuthOptions>);\n}\n\nconst DEFAULT_BASE_PATH = '/api/auth';\n\nexport class BetterAuth<\n\tTName extends string = string,\n\tTDatabase extends Consumable = Consumable,\n\tconst TUses extends readonly Consumable[] = readonly [],\n> implements Construct<TName, AuthClient>, Authenticator<AuthSession>\n{\n\treadonly id: TName;\n\t/**\n\t * What `.dependsOn([auth])` injects: an {@link AuthClient}, never the server.\n\t *\n\t * Which of the two a process holds is decided by how it reaches the\n\t * construct, not by asking where it is running. The auth app's process is\n\t * its generated entry, which calls {@link server} and nothing else — a\n\t * self-serving surface has no endpoints of its own for a `dependsOn` to sit\n\t * on. Every other process reaches it through this. So the API, a worker, a\n\t * test's in-process endpoints all get the client, and none of them needs\n\t * the signing secret, the auth tenant's URL or the mailer to start.\n\t */\n\treadonly service: Service<Uncapitalize<TName>, AuthClient>;\n\treadonly basePath: string;\n\n\t/**\n\t * Declared once and read by both `declare()` and `connect()`, so the keys the\n\t * target publishes and the keys the server reads cannot drift.\n\t */\n\tprivate readonly keys: {\n\t\tsecretId: string;\n\t\tsecret: string;\n\t\turl: string;\n\t\ttrustedOrigins: string;\n\t\tcookieDomain: string;\n\t};\n\n\tconstructor(\n\t\tid: ConstructName<TName>,\n\t\tprivate readonly config: BetterAuthConfig<TDatabase, TUses>,\n\t) {\n\t\tconst canonical = canonicalId(id as string);\n\n\t\tthis.id = canonical as TName;\n\t\tthis.basePath = config.basePath ?? DEFAULT_BASE_PATH;\n\n\t\t// A secret's name is its key: `Auth` signs with `AUTH_SECRET`, which is\n\t\t// also what better-auth's own tooling looks for.\n\t\tconst secretId = `${canonical}Secret`;\n\t\tthis.keys = {\n\t\t\tsecretId,\n\t\t\tsecret: environmentCase(secretId),\n\t\t\turl: provideKey(canonical, 'url'),\n\t\t\ttrustedOrigins: provideKey(canonical, 'trustedOrigins'),\n\t\t\tcookieDomain: provideKey(canonical, 'cookieDomain'),\n\t\t};\n\n\t\t// A field, not a getter: consumers cache services by object identity.\n\t\tthis.service = {\n\t\t\tserviceName: serviceKey(canonical) as Uncapitalize<TName>,\n\t\t\tregister: (options) => this.client(options.envParser),\n\t\t};\n\t}\n\n\t/**\n\t * A signing secret and a surface.\n\t *\n\t * The database is *not* declared here — the tenant that was passed in\n\t * declares it, and declaring it twice is the duplication the whole model\n\t * removes. What is declared is what this construct owns: the key it signs\n\t * with, and the routes it answers on.\n\t *\n\t * One endpoint, wildcarded. Better Auth routes internally and the set of\n\t * paths depends on which capabilities are enabled, so enumerating them here\n\t * would be a copy of its router that goes stale on its next release. The\n\t * surface's job is to send everything under `basePath` to one handler, which\n\t * is exactly what the declaration says.\n\t */\n\tdeclare(): Declaration[] {\n\t\treturn [\n\t\t\t{\n\t\t\t\tkind: 'secret',\n\t\t\t\tid: this.keys.secretId,\n\t\t\t\tprovides: [this.keys.secret],\n\t\t\t},\n\t\t\t{\n\t\t\t\tkind: 'rest-api',\n\t\t\t\tid: this.id,\n\t\t\t\tpath: this.config.path,\n\t\t\t\t...(this.config.subdomain ? { subdomain: this.config.subdomain } : {}),\n\t\t\t\t...(this.config.telemetry\n\t\t\t\t\t? { telemetry: this.config.telemetry.id }\n\t\t\t\t\t: {}),\n\t\t\t\tprovides: [\n\t\t\t\t\tthis.keys.url,\n\t\t\t\t\tthis.keys.trustedOrigins,\n\t\t\t\t\tthis.keys.cookieDomain,\n\t\t\t\t],\n\t\t\t\tendpoints: [\n\t\t\t\t\t{\n\t\t\t\t\t\tid: `${this.id}Handler`,\n\t\t\t\t\t\thandler: `${this.id}.handler`,\n\t\t\t\t\t\tmethod: 'ANY',\n\t\t\t\t\t\tpath: `${this.basePath}/*`,\n\t\t\t\t\t\t// Read off the tenant rather than written down: this\n\t\t\t\t\t\t// construct takes whatever database it is given, and a\n\t\t\t\t\t\t// hardcoded kind is a second statement of a fact the\n\t\t\t\t\t\t// tenant already makes.\n\t\t\t\t\t\tdependencies: [\n\t\t\t\t\t\t\tedgeTo(this.config.database),\n\t\t\t\t\t\t\t...(this.config.dependsOn ?? []).map(edgeTo),\n\t\t\t\t\t\t],\n\t\t\t\t\t\trequires: [this.keys.secret],\n\t\t\t\t\t},\n\t\t\t\t],\n\t\t\t},\n\t\t];\n\t}\n\n\t/**\n\t * Whose request this is: the session for these headers, or `null`.\n\t *\n\t * Asked of the auth server over HTTP, at the URL the `.auth()` edge injects —\n\t * so it is the same call whether the server runs in this process, beside\n\t * it, or behind MSW in a test. The same call {@link AuthClient} makes.\n\t */\n\tasync verify(\n\t\theaders: Headers,\n\t\tenvParser: EnvironmentParser<{}>,\n\t): Promise<AuthSession | null> {\n\t\treturn this.client(envParser).api.getSession({ headers });\n\t}\n\n\t/**\n\t * The client a caller of this server holds: its URL and nothing else.\n\t *\n\t * `<ID>_URL` is the one key a consumer is given for an edge to a surface —\n\t * the compose network's address between containers, the public one where\n\t * that is all there is — so this is everything it can know.\n\t */\n\tclient(envParser: EnvironmentParser<{}>): AuthClient {\n\t\tconst { url } = envParser\n\t\t\t.create((get) => ({ url: get(this.keys.url).string() }))\n\t\t\t.parse();\n\t\tconst endpoint = `${url.replace(/\\/$/, '')}${this.basePath}`;\n\n\t\treturn {\n\t\t\tapi: {\n\t\t\t\tgetSession: ({ headers }) =>\n\t\t\t\t\tfetchSession(this.id, endpoint, new Headers(headers)),\n\t\t\t},\n\t\t};\n\t}\n\n\t/**\n\t * The tenant this server keeps its tables in — whose migrations folder,\n\t * `db/<tenant>/`, Better Auth's schema is written into.\n\t */\n\tget databaseId(): string {\n\t\treturn this.config.database.id;\n\t}\n\n\t/**\n\t * The SQL that brings the tenant up to Better Auth's schema, or `undefined`\n\t * when it already matches.\n\t *\n\t * What `gkm migration` writes as the tenant's next migration, so Better\n\t * Auth's tables are committed, reviewed and applied like any other — rather\n\t * than diffed against the database at runtime, where a change nobody wrote\n\t * down happens on whichever machine migrates first.\n\t *\n\t * Compared as the owner, against the tenant `gkm migrate` has already brought\n\t * up to date: what comes back is only what the committed files are missing.\n\t */\n\tasync pendingMigration(\n\t\toptions: ServiceRegisterOptions,\n\t): Promise<string | undefined> {\n\t\t// The options, not a server built from them: better-auth checks its\n\t\t// schema when a server starts, and before the migration that creates the\n\t\t// tables it can only report them missing.\n\t\tconst resolved = await this.optionsFor(options, { owner: true });\n\t\tconst db = (resolved.database as { db: Kysely<Record<string, never>> }).db;\n\n\t\ttry {\n\t\t\t// better-auth 1.7 split the migration builder out of `better-auth/db`\n\t\t\t// into its own entry, so importing it no longer drags the whole db\n\t\t\t// layer in behind it.\n\t\t\tconst { getMigrations } = await import('better-auth/db/migration');\n\t\t\tconst { toBeCreated, toBeAdded, toBeAddedIndexes, compileMigrations } =\n\t\t\t\tawait getMigrations(resolved);\n\n\t\t\tif (\n\t\t\t\ttoBeCreated.length === 0 &&\n\t\t\t\ttoBeAdded.length === 0 &&\n\t\t\t\ttoBeAddedIndexes.length === 0\n\t\t\t) {\n\t\t\t\treturn undefined;\n\t\t\t}\n\n\t\t\treturn idempotent(await compileMigrations());\n\t\t} finally {\n\t\t\t// Its own pool: left open, it keeps the process that asked alive.\n\t\t\tawait db.destroy();\n\t\t}\n\t}\n\n\t/**\n\t * The server this surface runs as, built from its own declaration.\n\t *\n\t * A surface is a deploy unit, so something has to serve it, and the thing\n\t * that knows how is the construct — not a generator writing a mount into\n\t * somebody else's entry point. That is how the auth server came to be\n\t * mounted by a hook in the application it was supposed to be separate from,\n\t * and then to be served by nothing at all when the hook was deleted.\n\t *\n\t * The routes come from {@link declare}: one wildcard under `basePath`, read\n\t * off the same declaration the manifest carries, so the surface the graph\n\t * describes and the surface that answers requests cannot disagree.\n\t *\n\t * ```ts\n\t * // .gkm/server/app.ts — the whole generated entry\n\t * import { auth } from '@acme/constructs/auth.js';\n\t * export const { app } = await auth.server({ envParser });\n\t * ```\n\t *\n\t * The only way to the server: it is what reads the signing secret, opens\n\t * the tenant and builds the mailer, so it is built here, in the auth app's\n\t * own process, and `.dependsOn([auth])` everywhere else gets\n\t * {@link AuthClient}. `auth` is the better-auth instance behind the app.\n\t */\n\tasync server(\n\t\toptions: ServiceRegisterOptions,\n\t): Promise<{ app: Hono; auth: AuthServer }> {\n\t\tconst { Hono } = await import('hono');\n\t\tconst { cors } = await import('hono/cors');\n\t\tconst app = new Hono();\n\t\tconst server = await this.connect(options);\n\n\t\t// Who may call this surface, read off the graph. The same list Better\n\t\t// Auth checks for CSRF — it arrives as `<ID>_TRUSTED_ORIGINS`, composed\n\t\t// by the target from whatever declared an edge to this construct, so a\n\t\t// site that depends on the auth server is allowed to reach it and\n\t\t// nothing else is. Nobody writes an origin down.\n\t\tconst { origins } = options.envParser\n\t\t\t.create((get) => ({\n\t\t\t\torigins: get(this.keys.trustedOrigins)\n\t\t\t\t\t.string()\n\t\t\t\t\t.default('')\n\t\t\t\t\t.transform((value: string) =>\n\t\t\t\t\t\tvalue\n\t\t\t\t\t\t\t.split(',')\n\t\t\t\t\t\t\t.map((origin) => origin.trim())\n\t\t\t\t\t\t\t.filter(Boolean),\n\t\t\t\t\t),\n\t\t\t}))\n\t\t\t.parse();\n\n\t\tapp.use('*', cors({ origin: origins, credentials: true, maxAge: 3600 }));\n\n\t\t// Read off the declaration rather than restated here. `ANY` is every\n\t\t// method Better Auth routes internally, which is the reason the\n\t\t// declaration wildcards rather than enumerating.\n\t\tconst [surface] = this.declare().filter(\n\t\t\t(d): d is Extract<Declaration, { kind: 'rest-api' }> =>\n\t\t\t\td.kind === 'rest-api',\n\t\t);\n\n\t\tfor (const endpoint of surface?.endpoints ?? []) {\n\t\t\tconst methods =\n\t\t\t\tendpoint.method === 'ANY'\n\t\t\t\t\t? (['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS'] as const)\n\t\t\t\t\t: ([endpoint.method] as const);\n\n\t\t\tapp.on([...methods], endpoint.path, (c) =>\n\t\t\t\tserver.handler(withTrustedClientIp(c.req.raw, remoteAddressOf(c))),\n\t\t\t);\n\t\t}\n\n\t\treturn { app, auth: server };\n\t}\n\n\t/**\n\t * The ids of the better-auth plugins this server runs — what a client has\n\t * to pair its own plugins with (`magic-link` with `magicLinkClient`).\n\t * Resolved the way the server resolves them, options callback included.\n\t */\n\tasync pluginIds(options: ServiceRegisterOptions): Promise<string[]> {\n\t\tconst { plugins = [] } = await this.configured(options);\n\t\treturn plugins.map(({ id }) => id);\n\t}\n\n\t/** Better-auth's options as given — a value, or a callback of the environment. */\n\tprivate async configured(\n\t\toptions: ServiceRegisterOptions,\n\t): Promise<BetterAuthOptions> {\n\t\t// Hoisted: narrowing a property of `this` is not preserved across the\n\t\t// await, and the false branch is the plain-object form.\n\t\tconst configure = this.config.options;\n\t\tif (typeof configure !== 'function') return configure ?? {};\n\n\t\t// A client for each declared construct, from the options this call was\n\t\t// given — not the process-wide discovery, which keeps whichever env\n\t\t// parser reached it first.\n\t\tconst services: Record<string, unknown> = {};\n\t\tfor (const construct of this.config.dependsOn ?? []) {\n\t\t\tservices[construct.service.serviceName] =\n\t\t\t\tawait construct.service.register(options);\n\t\t}\n\n\t\treturn configure({\n\t\t\t...options,\n\t\t\tservices,\n\t\t} as BetterAuthOptionsContext<TUses>);\n\t}\n\n\tprivate async connect(\n\t\toptions: ServiceRegisterOptions,\n\t\tas: { owner?: boolean } = {},\n\t): Promise<AuthServer> {\n\t\tconst { betterAuth } = await import('better-auth');\n\t\t// `Auth<O>` is invariant in its options in better-auth 1.7, so the value\n\t\t// built from a concrete literal is not assignable to the `AuthServer`\n\t\t// alias, which names the constraint. The runtime object is the same one\n\t\t// either way; the assertion keeps the variance where it happens instead\n\t\t// of spreading a generic through the construct's public type.\n\t\treturn betterAuth(await this.optionsFor(options, as)) as AuthServer;\n\t}\n\n\t/**\n\t * Everything better-auth is given: the app's options, and what the construct\n\t * owns — its secret, its URL, its tenant's connection, the origins and cookie\n\t * domain its graph derives. One place, so the server and its migrations are\n\t * built from the same options.\n\t */\n\tprivate async optionsFor(\n\t\toptions: ServiceRegisterOptions,\n\t\tas: { owner?: boolean } = {},\n\t): Promise<Parameters<typeof betterAuth>[0]> {\n\t\tconst { secret, baseUrl, trustedOrigins, cookieDomain, deviceUrl } =\n\t\t\toptions.envParser\n\t\t\t\t.create((get) => ({\n\t\t\t\t\tsecret: get(this.keys.secret).string(),\n\t\t\t\t\t// The surface's own URL, resolved by the target — not guessed from\n\t\t\t\t\t// a port, which was wrong the moment the server moved to 3001.\n\t\t\t\t\tbaseUrl: get(this.keys.url).string(),\n\t\t\t\t\t// Better Auth's CSRF check applies to every caller, not just\n\t\t\t\t\t// browsers, so an API calling the auth server is rejected unless\n\t\t\t\t\t// its origin is trusted. The list is derived from the graph and\n\t\t\t\t\t// arrives as one comma-separated value, for the same reason every\n\t\t\t\t\t// other derived value arrives as a string: it crosses a process\n\t\t\t\t\t// boundary as env.\n\t\t\t\t\ttrustedOrigins: get(this.keys.trustedOrigins)\n\t\t\t\t\t\t.string()\n\t\t\t\t\t\t.default('')\n\t\t\t\t\t\t.transform((value) =>\n\t\t\t\t\t\t\tvalue\n\t\t\t\t\t\t\t\t.split(',')\n\t\t\t\t\t\t\t\t.map((origin) => origin.trim())\n\t\t\t\t\t\t\t\t.filter(Boolean),\n\t\t\t\t\t\t),\n\t\t\t\t\t// The domain a session cookie has to carry to be readable by a\n\t\t\t\t\t// frontend on a sibling host. Optional because there is often\n\t\t\t\t\t// nothing to widen to: locally everything shares `localhost`,\n\t\t\t\t\t// where cookies ignore the port and a `Domain` would only be a\n\t\t\t\t\t// value the browser refuses.\n\t\t\t\t\tcookieDomain: get(this.keys.cookieDomain).string().optional(),\n\t\t\t\t\t// Where a phone reaches this server, on a local stage with a mobile\n\t\t\t\t\t// app: its own port on the LAN address. Never deployed.\n\t\t\t\t\tdeviceUrl: get(provideKey(this.id, 'deviceUrl')).string().optional(),\n\t\t\t\t}))\n\t\t\t\t.parse();\n\n\t\t// The tenant's own client: one construct, one connection, so what auth\n\t\t// writes and what the browser inspects cannot be two different databases.\n\t\t// A migration asks the tenant for its owner connection, which the tenant\n\t\t// exposes as a `Service` and not as anything `.dependsOn()` would take.\n\t\tconst tenant = this.config.database as Consumable & {\n\t\t\towner?: Service<string, unknown>;\n\t\t};\n\t\tconst source = as.owner && tenant.owner ? tenant.owner : tenant.service;\n\n\t\tconst db = (await source.register(options)) as Kysely<\n\t\t\tRecord<string, never>\n\t\t>;\n\n\t\tconst configured = await this.configured(options);\n\n\t\t// Whatever the app added wins over the derived list rather than\n\t\t// replacing it: an origin nobody declared is still sometimes real.\n\t\tconst origins = [\n\t\t\t...trustedOrigins,\n\t\t\t...(configured.trustedOrigins && Array.isArray(configured.trustedOrigins)\n\t\t\t\t? configured.trustedOrigins\n\t\t\t\t: []),\n\t\t];\n\n\t\tconst plugins = [...(configured.plugins ?? [])];\n\t\t// A mobile app depends on this server: the graph put its scheme among\n\t\t// the derived origins. It signs in through Better Auth's Expo plugin —\n\t\t// the app sends its scheme as the origin, and the plugin is what reads\n\t\t// it — so a server without it would refuse every request the app made.\n\t\t// Asked of the app rather than imported here: a package this one\n\t\t// imported would have to be its peer, and an optional peer gives every\n\t\t// differently-resolving workspace package its own copy of this one.\n\t\tconst mobile = trustedOrigins.filter((origin) => !isWebOrigin(origin));\n\t\tif (mobile.length > 0 && !plugins.some((plugin) => plugin.id === 'expo')) {\n\t\t\tthrow new ExpoPluginRequired(this.id, mobile);\n\t\t}\n\t\t// A sign-in link the app asked for is opened on the phone, which cannot\n\t\t// resolve this server's local hostname; on a local stage it is built on\n\t\t// the address the phone reaches it on instead.\n\t\tif (deviceUrl) {\n\t\t\tfor (const plugin of plugins) reachableFromDevice(plugin, deviceUrl);\n\t\t}\n\n\t\treturn {\n\t\t\t...configured,\n\t\t\tsecret,\n\t\t\tbaseURL: baseUrl,\n\t\t\tbasePath: this.basePath,\n\t\t\tdatabase: { db, type: 'postgres' },\n\t\t\tplugins,\n\t\t\ttrustedOrigins: origins,\n\t\t\tadvanced: {\n\t\t\t\t...configured.advanced,\n\t\t\t\t// The client's address on a call from one of this stack's own\n\t\t\t\t// services comes in gkm's header, ahead of whatever the app reads\n\t\t\t\t// otherwise — `X-Forwarded-For` by default, as Better Auth reads a\n\t\t\t\t// request that reached it through a proxy. The header is honoured\n\t\t\t\t// only from an internal caller: see `withTrustedClientIp`.\n\t\t\t\tipAddress: {\n\t\t\t\t\t...configured.advanced?.ipAddress,\n\t\t\t\t\tipAddressHeaders: [\n\t\t\t\t\t\tCLIENT_IP_HEADER,\n\t\t\t\t\t\t...(\n\t\t\t\t\t\t\tconfigured.advanced?.ipAddress?.ipAddressHeaders ?? [\n\t\t\t\t\t\t\t\t'x-forwarded-for',\n\t\t\t\t\t\t\t]\n\t\t\t\t\t\t).filter((name) => name.toLowerCase() !== CLIENT_IP_HEADER),\n\t\t\t\t\t],\n\t\t\t\t},\n\t\t\t\t// Only when a domain was derived. Better Auth reads the presence\n\t\t\t\t// of this block as intent, so enabling it with no domain would\n\t\t\t\t// widen the cookie to whatever host happened to set it — and the\n\t\t\t\t// case with nothing to widen to is the common one, not an error.\n\t\t\t\t...(cookieDomain\n\t\t\t\t\t? {\n\t\t\t\t\t\t\tcrossSubDomainCookies: {\n\t\t\t\t\t\t\t\tenabled: true,\n\t\t\t\t\t\t\t\tdomain: cookieDomain,\n\t\t\t\t\t\t\t\t...configured.advanced?.crossSubDomainCookies,\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t}\n\t\t\t\t\t: {}),\n\t\t\t},\n\t\t};\n\t}\n}\n\n/** Links already rewritten — an `options` object is reused across builds. */\nconst rewritten = new WeakSet<object>();\n\n/**\n * Build the magic links an app asked for on the address a phone reaches.\n *\n * An app's link carries its scheme as the `callbackURL` (`shop://…`)\n * where a browser's carries a path or an `http(s)` URL — which is how the two\n * are told apart. A browser's link is left alone: it is opened on this\n * machine, where the server's own hostname resolves.\n *\n * Better Auth's magic-link plugin calls `sendMagicLink` through the options\n * object it returns, so wrapping it there is wrapping the call.\n */\nfunction reachableFromDevice(plugin: { id: string }, deviceUrl: string): void {\n\tif (plugin.id !== 'magic-link') return;\n\tconst options = (plugin as { options?: MagicLinkOptions }).options;\n\tif (!options?.sendMagicLink || rewritten.has(options)) return;\n\trewritten.add(options);\n\n\tconst send = options.sendMagicLink;\n\toptions.sendMagicLink = (data, ...rest) =>\n\t\tsend({ ...data, url: deviceLink(data.url, deviceUrl) }, ...rest);\n}\n\ninterface MagicLinkOptions {\n\tsendMagicLink?: (\n\t\tdata: { email: string; url: string; token: string },\n\t\t...rest: unknown[]\n\t) => unknown;\n}\n\n/** A magic link moved to the device address when an app is its destination. */\nexport function deviceLink(url: string, deviceUrl: string): string {\n\ttry {\n\t\tconst link = new URL(url);\n\t\tconst callback = link.searchParams.get('callbackURL') ?? '/';\n\t\tif (callback.startsWith('/') || isWebOrigin(callback)) return url;\n\t\treturn new URL(`${link.pathname}${link.search}`, deviceUrl).toString();\n\t} catch {\n\t\treturn url;\n\t}\n}\n\n/** A mobile app depends on this auth server, which has no Expo plugin. */\nexport class ExpoPluginRequired extends Error {\n\tconstructor(\n\t\treadonly server: string,\n\t\t/** The schemes the graph says call it — what made the plugin necessary. */\n\t\treadonly origins: readonly string[],\n\t) {\n\t\tsuper(\n\t\t\t`'${server}' is called by a mobile app (${origins[0]}), and a mobile app ` +\n\t\t\t\t`signs in through Better Auth's Expo plugin: add expo() from ` +\n\t\t\t\t`'@better-auth/expo' to this auth server's plugins.`,\n\t\t);\n\t\tthis.name = 'ExpoPluginRequired';\n\t}\n}\n\n/** What is forwarded to the auth server: the headers a session travels in. */\nconst SESSION_HEADERS = ['cookie', 'authorization'] as const;\n\n/**\n * `GET <basePath>/get-session`, read the way Better Auth answers it.\n *\n * Whose request it is travels in {@link CLIENT_IP_HEADER} — the server\n * rate-limits `/get-session` by the client's address, so without it every\n * caller shares the API's one bucket — and never as `X-Forwarded-For`. A\n * forwarding header is what marks a request as outside traffic, so the auth\n * server would start its span in a trace of its own rather than continue the\n * API's. Without one, this is an internal caller's request, and the trace\n * context it carries is continued.\n */\nasync function fetchSession(\n\tauthenticator: string,\n\tendpoint: string,\n\tgiven: Headers,\n): Promise<AuthSession | null> {\n\tconst headers = new Headers();\n\tfor (const name of SESSION_HEADERS) {\n\t\tconst value = given.get(name);\n\t\tif (value) headers.set(name, value);\n\t}\n\t// The chain as the API received it, so the auth server reads it exactly\n\t// as it would have read `X-Forwarded-For` (its `trustedProxies` included).\n\t// Never a `CLIENT_IP_HEADER` the API was sent: this process cannot tell\n\t// here whether its own caller was internal, and the auth server trusts\n\t// whatever an internal caller — this one — says.\n\tconst client = given.get('x-forwarded-for');\n\tif (client) headers.set(CLIENT_IP_HEADER, client);\n\tinjectTraceContext(headers);\n\n\tconst url = `${endpoint}/get-session`;\n\tlet response: Response;\n\ttry {\n\t\tresponse = await fetch(url, { headers });\n\t} catch (cause) {\n\t\tthrow new AuthServerUnreachable(authenticator, url, cause);\n\t}\n\n\t// Better Auth answers `null` for a request with no session, and a 401 is\n\t// the same answer from anything in front of it. Anything else that is not\n\t// a 200 is the server failing, which is not \"signed out\" and must not be\n\t// read as it.\n\tif (response.status === 401) return null;\n\tif (!response.ok) {\n\t\tthrow new SessionCheckFailed(authenticator, response.status);\n\t}\n\n\treturn (await response.json()) as AuthSession | null;\n}\n\n/** The auth server answered a session check with a failure. */\nexport class SessionCheckFailed extends Error {\n\tconstructor(\n\t\treadonly authenticator: string,\n\t\treadonly status: number,\n\t) {\n\t\tsuper(\n\t\t\t`'${authenticator}' answered a session check with ${status}. ` +\n\t\t\t\t`A request with no session gets 200 and null, or 401; this is the ` +\n\t\t\t\t`server failing — check its logs, and that it is running at its URL.`,\n\t\t);\n\t\tthis.name = 'SessionCheckFailed';\n\t}\n}\n\n/** A session check never reached the auth server. */\nexport class AuthServerUnreachable extends Error {\n\tconstructor(\n\t\treadonly authenticator: string,\n\t\treadonly url: string,\n\t\tcause: unknown,\n\t) {\n\t\tsuper(\n\t\t\t`'${authenticator}' could not be reached at ${url} to check a session. ` +\n\t\t\t\t`Check that the auth app is running and that this app's ` +\n\t\t\t\t`${provideKey(authenticator, 'url')} points at it.`,\n\t\t\t{ cause },\n\t\t);\n\t\tthis.name = 'AuthServerUnreachable';\n\t}\n}\n\n/**\n * Better Auth's DDL, safe to run where its tables already exist.\n *\n * Its SQL is Kysely's, so its shape is known: `create table \"…\"`, `create index\n * \"…\"`, `alter table \"…\" add column \"…\"`. A database that has been running\n * already has those — Better Auth used to create them at runtime — and the\n * first committed migration would fail on them rather than recording that they\n * are there.\n */\nexport function idempotent(statements: string): string {\n\treturn statements\n\t\t.replace(/\\bcreate table \"/gi, 'create table if not exists \"')\n\t\t.replace(\n\t\t\t/\\bcreate (unique )?index \"/gi,\n\t\t\t(_, unique = '') => `create ${unique}index if not exists \"`,\n\t\t)\n\t\t.replace(/\\badd column \"/gi, 'add column if not exists \"');\n}\n\n/** Headers a reverse proxy or CDN adds on the way in. */\nconst FORWARDING_HEADERS = [\n\t'forwarded',\n\t'x-forwarded-for',\n\t'x-forwarded-host',\n\t'x-real-ip',\n\t'cf-connecting-ip',\n\t'true-client-ip',\n\t'fastly-client-ip',\n\t'x-client-ip',\n];\n\n/**\n * `request`, without {@link CLIENT_IP_HEADER} unless an internal caller sent\n * it — no `Origin`, no forwarding header, a loopback or private peer: the\n * rule a request's span continues a trace by (`@geekmidas/telescope`'s\n * `isInternalCaller`).\n *\n * The stack's own edges strip the header already. This holds wherever one\n * does not — a platform's proxy, a port published straight to the internet —\n * so a stranger cannot pick the address Better Auth rate-limits them by.\n */\nexport function withTrustedClientIp(\n\trequest: Request,\n\tremoteAddress: string | undefined,\n): Request {\n\tif (!request.headers.has(CLIENT_IP_HEADER)) return request;\n\tconst internal =\n\t\t!request.headers.has('origin') &&\n\t\t!FORWARDING_HEADERS.some((name) => request.headers.has(name)) &&\n\t\tisPrivateAddress(remoteAddress);\n\tif (internal) return request;\n\n\tconst headers = new Headers(request.headers);\n\theaders.delete(CLIENT_IP_HEADER);\n\treturn new Request(request, { headers });\n}\n\n/** The TCP peer of a request served by `@hono/node-server`, when there is one. */\nfunction remoteAddressOf(c: { env: unknown }): string | undefined {\n\tconst env = c.env as\n\t\t| { incoming?: { socket?: { remoteAddress?: string } } }\n\t\t| undefined;\n\treturn env?.incoming?.socket?.remoteAddress;\n}\n\n/**\n * Whether `address` is loopback or private: 127/8, 10/8, 172.16/12,\n * 192.168/16, 169.254/16, `::1`, `fc00::/7`, `fe80::/10`, and an IPv4 one\n * mapped into IPv6.\n */\nfunction isPrivateAddress(address: string | undefined): boolean {\n\tif (!address) return false;\n\tconst ip = address.toLowerCase().replace(/^::ffff:/, '');\n\n\tconst v4 = ip.match(/^(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})$/);\n\tif (v4) {\n\t\tconst [a, b] = [Number(v4[1]), Number(v4[2])];\n\t\treturn (\n\t\t\ta === 127 ||\n\t\t\ta === 10 ||\n\t\t\t(a === 172 && b >= 16 && b <= 31) ||\n\t\t\t(a === 192 && b === 168) ||\n\t\t\t(a === 169 && b === 254)\n\t\t);\n\t}\n\n\tif (ip === '::1') return true;\n\treturn /^f[cd][0-9a-f]{2}:/.test(ip) || /^fe[89ab][0-9a-f]:/.test(ip);\n}\n"],"mappings":";;;;;AA4KA,MAAM,oBAAoB;AAE1B,IAAa,aAAb,MAKA;CA8BmB;CA7BlB;;;;;;;;;;;;CAYA;CACA;;;;;CAMA;CAQA,YACC,IACA,QACC;EADgB,KAAA,SAAA;EAEjB,MAAM,aAAA,GAAYA,oBAAAA,YAAAA,CAAY,EAAY;EAE1C,KAAK,KAAK;EACV,KAAK,WAAW,OAAO,YAAY;EAInC,MAAM,WAAW,GAAG,UAAU;EAC9B,KAAK,OAAO;GACX;GACA,SAAA,GAAQC,oBAAAA,gBAAAA,CAAgB,QAAQ;GAChC,MAAA,GAAKC,oBAAAA,WAAAA,CAAW,WAAW,KAAK;GAChC,iBAAA,GAAgBA,oBAAAA,WAAAA,CAAW,WAAW,gBAAgB;GACtD,eAAA,GAAcA,oBAAAA,WAAAA,CAAW,WAAW,cAAc;EACnD;EAGA,KAAK,UAAU;GACd,cAAA,GAAaC,oBAAAA,WAAAA,CAAW,SAAS;GACjC,WAAW,YAAY,KAAK,OAAO,QAAQ,SAAS;EACrD;CACD;;;;;;;;;;;;;;;CAgBA,UAAyB;EACxB,OAAO,CACN;GACC,MAAM;GACN,IAAI,KAAK,KAAK;GACd,UAAU,CAAC,KAAK,KAAK,MAAM;EAC5B,GACA;GACC,MAAM;GACN,IAAI,KAAK;GACT,MAAM,KAAK,OAAO;GAClB,GAAI,KAAK,OAAO,YAAY,EAAE,WAAW,KAAK,OAAO,UAAU,IAAI,CAAC;GACpE,GAAI,KAAK,OAAO,YACb,EAAE,WAAW,KAAK,OAAO,UAAU,GAAG,IACtC,CAAC;GACJ,UAAU;IACT,KAAK,KAAK;IACV,KAAK,KAAK;IACV,KAAK,KAAK;GACX;GACA,WAAW,CACV;IACC,IAAI,GAAG,KAAK,GAAG;IACf,SAAS,GAAG,KAAK,GAAG;IACpB,QAAQ;IACR,MAAM,GAAG,KAAK,SAAS;IAKvB,cAAc,CACbC,4BAAAA,OAAO,KAAK,OAAO,QAAQ,GAC3B,IAAI,KAAK,OAAO,aAAa,CAAC,EAAA,CAAG,IAAIA,4BAAAA,MAAM,CAC5C;IACA,UAAU,CAAC,KAAK,KAAK,MAAM;GAC5B,CACD;EACD,CACD;CACD;;;;;;;;CASA,MAAM,OACL,SACA,WAC8B;EAC9B,OAAO,KAAK,OAAO,SAAS,CAAC,CAAC,IAAI,WAAW,EAAE,QAAQ,CAAC;CACzD;;;;;;;;CASA,OAAO,WAA8C;EACpD,MAAM,EAAE,QAAQ,UACd,QAAQ,SAAS,EAAE,KAAK,IAAI,KAAK,KAAK,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CACvD,MAAM;EACR,MAAM,WAAW,GAAG,IAAI,QAAQ,OAAO,EAAE,IAAI,KAAK;EAElD,OAAO,EACN,KAAK,EACJ,aAAa,EAAE,cACd,aAAa,KAAK,IAAI,UAAU,IAAI,QAAQ,OAAO,CAAC,EACtD,EACD;CACD;;;;;CAMA,IAAI,aAAqB;EACxB,OAAO,KAAK,OAAO,SAAS;CAC7B;;;;;;;;;;;;;CAcA,MAAM,iBACL,SAC8B;EAI9B,MAAM,WAAW,MAAM,KAAK,WAAW,SAAS,EAAE,OAAO,KAAK,CAAC;EAC/D,MAAM,KAAM,SAAS,SAAmD;EAExE,IAAI;GAIH,MAAM,EAAE,kBAAkB,MAAM,OAAO;GACvC,MAAM,EAAE,aAAa,WAAW,kBAAkB,sBACjD,MAAM,cAAc,QAAQ;GAE7B,IACC,YAAY,WAAW,KACvB,UAAU,WAAW,KACrB,iBAAiB,WAAW,GAE5B;GAGD,OAAO,WAAW,MAAM,kBAAkB,CAAC;EAC5C,UAAU;GAET,MAAM,GAAG,QAAQ;EAClB;CACD;;;;;;;;;;;;;;;;;;;;;;;;;CA0BA,MAAM,OACL,SAC2C;EAC3C,MAAM,EAAE,SAAS,MAAM,OAAO;EAC9B,MAAM,EAAE,SAAS,MAAM,OAAO;EAC9B,MAAM,MAAM,IAAI,KAAK;EACrB,MAAM,SAAS,MAAM,KAAK,QAAQ,OAAO;EAOzC,MAAM,EAAE,YAAY,QAAQ,UAC1B,QAAQ,SAAS,EACjB,SAAS,IAAI,KAAK,KAAK,cAAc,CAAC,CACpC,OAAO,CAAC,CACR,QAAQ,EAAE,CAAC,CACX,WAAW,UACX,MACE,MAAM,GAAG,CAAC,CACV,KAAK,WAAW,OAAO,KAAK,CAAC,CAAC,CAC9B,OAAO,OAAO,CACjB,EACF,EAAE,CAAC,CACF,MAAM;EAER,IAAI,IAAI,KAAK,KAAK;GAAE,QAAQ;GAAS,aAAa;GAAM,QAAQ;EAAK,CAAC,CAAC;EAKvE,MAAM,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,QAC/B,MACA,EAAE,SAAS,UACb;EAEA,KAAK,MAAM,YAAY,SAAS,aAAa,CAAC,GAAG;GAChD,MAAM,UACL,SAAS,WAAW,QAChB;IAAC;IAAO;IAAQ;IAAO;IAAS;IAAU;GAAS,IACnD,CAAC,SAAS,MAAM;GAErB,IAAI,GAAG,CAAC,GAAG,OAAO,GAAG,SAAS,OAAO,MACpC,OAAO,QAAQ,oBAAoB,EAAE,IAAI,KAAK,gBAAgB,CAAC,CAAC,CAAC,CAClE;EACD;EAEA,OAAO;GAAE;GAAK,MAAM;EAAO;CAC5B;;;;;;CAOA,MAAM,UAAU,SAAoD;EACnE,MAAM,EAAE,UAAU,CAAC,MAAM,MAAM,KAAK,WAAW,OAAO;EACtD,OAAO,QAAQ,KAAK,EAAE,SAAS,EAAE;CAClC;;CAGA,MAAc,WACb,SAC6B;EAG7B,MAAM,YAAY,KAAK,OAAO;EAC9B,IAAI,OAAO,cAAc,YAAY,OAAO,aAAa,CAAC;EAK1D,MAAM,WAAoC,CAAC;EAC3C,KAAK,MAAM,aAAa,KAAK,OAAO,aAAa,CAAC,GACjD,SAAS,UAAU,QAAQ,eAC1B,MAAM,UAAU,QAAQ,SAAS,OAAO;EAG1C,OAAO,UAAU;GAChB,GAAG;GACH;EACD,CAAoC;CACrC;CAEA,MAAc,QACb,SACA,KAA0B,CAAC,GACL;EACtB,MAAM,EAAE,eAAe,MAAM,OAAO;EAMpC,OAAO,WAAW,MAAM,KAAK,WAAW,SAAS,EAAE,CAAC;CACrD;;;;;;;CAQA,MAAc,WACb,SACA,KAA0B,CAAC,GACiB;EAC5C,MAAM,EAAE,QAAQ,SAAS,gBAAgB,cAAc,cACtD,QAAQ,UACN,QAAQ,SAAS;GACjB,QAAQ,IAAI,KAAK,KAAK,MAAM,CAAC,CAAC,OAAO;GAGrC,SAAS,IAAI,KAAK,KAAK,GAAG,CAAC,CAAC,OAAO;GAOnC,gBAAgB,IAAI,KAAK,KAAK,cAAc,CAAC,CAC3C,OAAO,CAAC,CACR,QAAQ,EAAE,CAAC,CACX,WAAW,UACX,MACE,MAAM,GAAG,CAAC,CACV,KAAK,WAAW,OAAO,KAAK,CAAC,CAAC,CAC9B,OAAO,OAAO,CACjB;GAMD,cAAc,IAAI,KAAK,KAAK,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS;GAG5D,WAAW,KAAA,GAAIF,oBAAAA,WAAAA,CAAW,KAAK,IAAI,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS;EACpE,EAAE,CAAC,CACF,MAAM;EAMT,MAAM,SAAS,KAAK,OAAO;EAK3B,MAAM,KAAM,OAFG,GAAG,SAAS,OAAO,QAAQ,OAAO,QAAQ,OAAO,QAAA,CAEvC,SAAS,OAAO;EAIzC,MAAM,aAAa,MAAM,KAAK,WAAW,OAAO;EAIhD,MAAM,UAAU,CACf,GAAG,gBACH,GAAI,WAAW,kBAAkB,MAAM,QAAQ,WAAW,cAAc,IACrE,WAAW,iBACX,CAAC,CACL;EAEA,MAAM,UAAU,CAAC,GAAI,WAAW,WAAW,CAAC,CAAE;EAQ9C,MAAM,SAAS,eAAe,QAAQ,WAAW,EAAA,GAACG,oBAAAA,YAAAA,CAAY,MAAM,CAAC;EACrE,IAAI,OAAO,SAAS,KAAK,CAAC,QAAQ,MAAM,WAAW,OAAO,OAAO,MAAM,GACtE,MAAM,IAAI,mBAAmB,KAAK,IAAI,MAAM;EAK7C,IAAI,WACH,KAAK,MAAM,UAAU,SAAS,oBAAoB,QAAQ,SAAS;EAGpE,OAAO;GACN,GAAG;GACH;GACA,SAAS;GACT,UAAU,KAAK;GACf,UAAU;IAAE;IAAI,MAAM;GAAW;GACjC;GACA,gBAAgB;GAChB,UAAU;IACT,GAAG,WAAW;IAMd,WAAW;KACV,GAAG,WAAW,UAAU;KACxB,kBAAkB,CACjBC,oBAAAA,kBACA,IACC,WAAW,UAAU,WAAW,oBAAoB,CACnD,iBACD,EAAA,CACC,QAAQ,SAAS,KAAK,YAAY,MAAMA,oBAAAA,gBAAgB,CAC3D;IACD;IAKA,GAAI,eACD,EACA,uBAAuB;KACtB,SAAS;KACT,QAAQ;KACR,GAAG,WAAW,UAAU;IACzB,EACD,IACC,CAAC;GACL;EACD;CACD;AACD;;AAGA,MAAM,4BAAY,IAAI,QAAgB;;;;;;;;;;;;AAatC,SAAS,oBAAoB,QAAwB,WAAyB;CAC7E,IAAI,OAAO,OAAO,cAAc;CAChC,MAAM,UAAW,OAA0C;CAC3D,IAAI,CAAC,SAAS,iBAAiB,UAAU,IAAI,OAAO,GAAG;CACvD,UAAU,IAAI,OAAO;CAErB,MAAM,OAAO,QAAQ;CACrB,QAAQ,iBAAiB,MAAM,GAAG,SACjC,KAAK;EAAE,GAAG;EAAM,KAAK,WAAW,KAAK,KAAK,SAAS;CAAE,GAAG,GAAG,IAAI;AACjE;;AAUA,SAAgB,WAAW,KAAa,WAA2B;CAClE,IAAI;EACH,MAAM,OAAO,IAAI,IAAI,GAAG;EACxB,MAAM,WAAW,KAAK,aAAa,IAAI,aAAa,KAAK;EACzD,IAAI,SAAS,WAAW,GAAG,MAAA,GAAKD,oBAAAA,YAAAA,CAAY,QAAQ,GAAG,OAAO;EAC9D,OAAO,IAAI,IAAI,GAAG,KAAK,WAAW,KAAK,UAAU,SAAS,CAAC,CAAC,SAAS;CACtE,QAAQ;EACP,OAAO;CACR;AACD;;AAGA,IAAa,qBAAb,cAAwC,MAAM;CAEnC;CAEA;CAHV,YACC,QAEA,SACC;EACD,MACC,IAAI,OAAO,+BAA+B,QAAQ,GAAG,mIAGtD;EARS,KAAA,SAAA;EAEA,KAAA,UAAA;EAOT,KAAK,OAAO;CACb;AACD;;AAGA,MAAM,kBAAkB,CAAC,UAAU,eAAe;;;;;;;;;;;;AAalD,eAAe,aACd,eACA,UACA,OAC8B;CAC9B,MAAM,UAAU,IAAI,QAAQ;CAC5B,KAAK,MAAM,QAAQ,iBAAiB;EACnC,MAAM,QAAQ,MAAM,IAAI,IAAI;EAC5B,IAAI,OAAO,QAAQ,IAAI,MAAM,KAAK;CACnC;CAMA,MAAM,SAAS,MAAM,IAAI,iBAAiB;CAC1C,IAAI,QAAQ,QAAQ,IAAIC,oBAAAA,kBAAkB,MAAM;CAChD,gBAAA,mBAAmB,OAAO;CAE1B,MAAM,MAAM,GAAG,SAAS;CACxB,IAAI;CACJ,IAAI;EACH,WAAW,MAAM,MAAM,KAAK,EAAE,QAAQ,CAAC;CACxC,SAAS,OAAO;EACf,MAAM,IAAI,sBAAsB,eAAe,KAAK,KAAK;CAC1D;CAMA,IAAI,SAAS,WAAW,KAAK,OAAO;CACpC,IAAI,CAAC,SAAS,IACb,MAAM,IAAI,mBAAmB,eAAe,SAAS,MAAM;CAG5D,OAAQ,MAAM,SAAS,KAAK;AAC7B;;AAGA,IAAa,qBAAb,cAAwC,MAAM;CAEnC;CACA;CAFV,YACC,eACA,QACC;EACD,MACC,IAAI,cAAc,kCAAkC,OAAO,uIAG5D;EAPS,KAAA,gBAAA;EACA,KAAA,SAAA;EAOT,KAAK,OAAO;CACb;AACD;;AAGA,IAAa,wBAAb,cAA2C,MAAM;CAEtC;CACA;CAFV,YACC,eACA,KACA,OACC;EACD,MACC,IAAI,cAAc,4BAA4B,IAAI,+EAAA,GAE9CJ,oBAAAA,WAAAA,CAAW,eAAe,KAAK,EAAE,iBACrC,EAAE,MAAM,CACT;EATS,KAAA,gBAAA;EACA,KAAA,MAAA;EAST,KAAK,OAAO;CACb;AACD;;;;;;;;;;AAWA,SAAgB,WAAW,YAA4B;CACtD,OAAO,WACL,QAAQ,sBAAsB,+BAA8B,CAAC,CAC7D,QACA,iCACC,GAAG,SAAS,OAAO,UAAU,OAAO,sBACtC,CAAC,CACA,QAAQ,oBAAoB,6BAA4B;AAC3D;;AAGA,MAAM,qBAAqB;CAC1B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACD;;;;;;;;;;;AAYA,SAAgB,oBACf,SACA,eACU;CACV,IAAI,CAAC,QAAQ,QAAQ,IAAII,oBAAAA,gBAAgB,GAAG,OAAO;CAKnD,IAHC,CAAC,QAAQ,QAAQ,IAAI,QAAQ,KAC7B,CAAC,mBAAmB,MAAM,SAAS,QAAQ,QAAQ,IAAI,IAAI,CAAC,KAC5D,iBAAiB,aAAa,GACjB,OAAO;CAErB,MAAM,UAAU,IAAI,QAAQ,QAAQ,OAAO;CAC3C,QAAQ,OAAOA,oBAAAA,gBAAgB;CAC/B,OAAO,IAAI,QAAQ,SAAS,EAAE,QAAQ,CAAC;AACxC;;AAGA,SAAS,gBAAgB,GAAyC;CAIjE,OAHY,EAAE,KAGF,UAAU,QAAQ;AAC/B;;;;;;AAOA,SAAS,iBAAiB,SAAsC;CAC/D,IAAI,CAAC,SAAS,OAAO;CACrB,MAAM,KAAK,QAAQ,YAAY,CAAC,CAAC,QAAQ,YAAY,EAAE;CAEvD,MAAM,KAAK,GAAG,MAAM,8CAA8C;CAClE,IAAI,IAAI;EACP,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,GAAG,EAAE,GAAG,OAAO,GAAG,EAAE,CAAC;EAC5C,OACC,MAAM,OACN,MAAM,MACL,MAAM,OAAO,KAAK,MAAM,KAAK,MAC7B,MAAM,OAAO,MAAM,OACnB,MAAM,OAAO,MAAM;CAEtB;CAEA,IAAI,OAAO,OAAO,OAAO;CACzB,OAAO,qBAAqB,KAAK,EAAE,KAAK,qBAAqB,KAAK,EAAE;AACrE"}
+{"version":3,"file":"auth.cjs","names":["canonicalId","environmentCase","provideKey","serviceKey","edgeTo","isWebOrigin","CLIENT_IP_HEADER"],"sources":["../src/auth.ts"],"sourcesContent":["/**\n * `BetterAuth` — a declared auth server.\n *\n * It is three things at once, which is what makes it the construct that\n * exercises most of the model: a consumer of a database, a producer of an\n * authorizer, and a set of endpoints. This lands the first two.\n *\n * Its tables live in a schema tenant it is *given* — `orders.schema('AuthDb')`\n * — rather than one it invents. The tenant declares the schema and the role;\n * this declares the one thing left, the signing secret, and reads back the keys\n * it needs.\n *\n * :::caution\n * The isolation that arrangement is *for* — the application's own role holding\n * no grant on these tables, so a compromised handler cannot read sessions — does\n * **not hold yet**. No target creates the per-schema role: both connect as the\n * database owner, so today the tenant is a `search_path`, which is a namespace\n * and not a privilege boundary. See \"Roles are declared and never created\" in\n * `docs/design/constructs-outstanding.md`.\n * :::\n *\n * It declares its own surface, so where it answers, who may call it, and the\n * domain its cookies are scoped to all arrive as environment resolved by the\n * target — none of them guessed from a port, and none of them listed by hand in\n * application config.\n */\n\nimport type { EnvironmentParser } from '@geekmidas/envkit';\nimport {\n\tCLIENT_IP_HEADER,\n\ttype ConstructName,\n\tcanonicalId,\n\ttype Declaration,\n\tenvironmentCase,\n\tisWebOrigin,\n\tprovideKey,\n\tserviceKey,\n} from '@geekmidas/manifest';\nimport type {\n\tService,\n\tServiceRecord,\n\tServiceRegisterOptions,\n} from '@geekmidas/services';\n// Types only: the server is built in `connect()`, from a dynamic import, so a\n// process that only holds the client never loads better-auth to get it.\nimport type { betterAuth } from 'better-auth';\nimport type { Hono } from 'hono';\nimport type { Kysely } from 'kysely';\nimport {\n\ttype Authenticator,\n\ttype Construct,\n\ttype Consumable,\n\tedgeTo,\n\ttype ServicesOf,\n} from './construct-interface';\nimport type { Telemetry } from './telemetry';\nimport { injectTraceContext } from './tracing';\n\n/** The server better-auth hands back. */\nexport type AuthServer = ReturnType<typeof betterAuth>;\n\n/** A signed-in session as better-auth hands it back: `{ user, session }`. */\nexport type AuthSession = AuthServer['$Infer']['Session'];\n\n/**\n * What `.dependsOn([auth])` hands a handler: the auth server, over HTTP.\n *\n * The server itself — its secret, its tenant's connection, its mailer — lives\n * in the auth app's own process and nowhere else. Every other process is a\n * caller of it, so what it is given is an address and this, with the one\n * call handlers make kept in Better Auth's shape: `api.getSession({ headers })`\n * answers `{ user, session }` or `null`, as the server's own `api` does.\n */\nexport interface AuthClient {\n\treadonly api: {\n\t\t/**\n\t\t * The session the request's cookie or bearer token belongs to, or `null`\n\t\t * when there is none — asked of `<basePath>/get-session` at the auth\n\t\t * server's URL. Only `cookie` and `authorization` are forwarded, with\n\t\t * the client's address as `x-gkm-client-ip` (read from the request's\n\t\t * `x-forwarded-for`) and the active trace context.\n\t\t *\n\t\t * @throws {AuthServerUnreachable} when the request does not get there.\n\t\t * @throws {SessionCheckFailed} when the server answers with a failure.\n\t\t */\n\t\tgetSession(input: {\n\t\t\theaders: ConstructorParameters<typeof Headers>[0];\n\t\t}): Promise<AuthSession | null>;\n\t};\n}\n\n/** Everything better-auth takes, minus what the construct owns. */\nexport type BetterAuthOptions = Omit<\n\tParameters<typeof betterAuth>[0],\n\t'database' | 'secret' | 'basePath' | 'baseURL'\n>;\n\n/**\n * What an `options` callback is handed: the options this construct was\n * registered with, and a client for each construct its `dependsOn` names —\n * keyed by service name, exactly as an endpoint's handler receives them.\n */\nexport type BetterAuthOptionsContext<TUses extends readonly Consumable[]> =\n\tServiceRegisterOptions & {\n\t\tservices: ServiceRecord<[...ServicesOf<TUses>]>;\n\t};\n\nexport interface BetterAuthConfig<\n\tTDatabase extends Consumable,\n\tTUses extends readonly Consumable[] = readonly [],\n> {\n\t/**\n\t * The schema tenant its tables live in.\n\t *\n\t * A construct rather than a URL: the tenant already declares its schema and\n\t * its role, and taking the declaration is what puts the edge in the graph\n\t * instead of a connection string in two places.\n\t */\n\tdatabase: TDatabase;\n\t/**\n\t * The app that serves this auth server, relative to the workspace root —\n\t * `'apps/auth'`.\n\t *\n\t * Required, for the reason `RestApi.path` is. Not to be confused with\n\t * `basePath`, which is where its routes are mounted in a URL.\n\t */\n\tpath: string;\n\t/**\n\t * The label it answers on under a stage's domain — `api` for\n\t * `api.myapp.com`, from `domains` — and under the project locally,\n\t * `api.myapp.localhost`. Absent, its id kebab-cased.\n\t */\n\tsubdomain?: string;\n\t/**\n\t * Where the auth routes are mounted, e.g. `/api/auth`.\n\t *\n\t * Structural — it is part of the URL every client calls, so it cannot differ\n\t * between stages the way the host can.\n\t */\n\tbasePath?: string;\n\t/**\n\t * The constructs `options` uses — the mailer a magic link goes through,\n\t * most often.\n\t *\n\t * One list, two jobs, the way an endpoint's `.dependsOn()` has: each is an\n\t * edge on the server's handler, so whatever is composed from the edges (a\n\t * container's environment, a deploy's grants) includes it; and each is\n\t * handed to `options` as a client in `services`, so there is no other way\n\t * for `options` to reach it — nothing to import and register by hand, and\n\t * so nothing that can be used without being declared.\n\t */\n\tdependsOn?: TUses;\n\t/**\n\t * What the auth server's process emits — the `Telemetry` construct, passed\n\t * like a `RestApi`'s. An edge to the node: the deploy hands the process the\n\t * `OTEL_*` keys its stage resolves.\n\t */\n\ttelemetry?: Telemetry;\n\t/**\n\t * The rest of better-auth's options: providers, plugins, email settings.\n\t *\n\t * A function when they need another construct — a magic-link plugin has to\n\t * *send* the link. It is handed the options this construct was registered\n\t * with, and `services`: a client for each construct in `dependsOn`.\n\t */\n\toptions?:\n\t\t| BetterAuthOptions\n\t\t| ((\n\t\t\t\tcontext: BetterAuthOptionsContext<TUses>,\n\t\t  ) => BetterAuthOptions | Promise<BetterAuthOptions>);\n}\n\nconst DEFAULT_BASE_PATH = '/api/auth';\n\nexport class BetterAuth<\n\tTName extends string = string,\n\tTDatabase extends Consumable = Consumable,\n\tconst TUses extends readonly Consumable[] = readonly [],\n> implements Construct<TName, AuthClient>, Authenticator<AuthSession>\n{\n\treadonly id: TName;\n\t/**\n\t * What `.dependsOn([auth])` injects: an {@link AuthClient}, never the server.\n\t *\n\t * Which of the two a process holds is decided by how it reaches the\n\t * construct, not by asking where it is running. The auth app's process is\n\t * its generated entry, which calls {@link server} and nothing else — a\n\t * self-serving surface has no endpoints of its own for a `dependsOn` to sit\n\t * on. Every other process reaches it through this. So the API, a worker, a\n\t * test's in-process endpoints all get the client, and none of them needs\n\t * the signing secret, the auth tenant's URL or the mailer to start.\n\t */\n\treadonly service: Service<Uncapitalize<TName>, AuthClient>;\n\treadonly basePath: string;\n\n\t/**\n\t * Declared once and read by both `declare()` and `connect()`, so the keys the\n\t * target publishes and the keys the server reads cannot drift.\n\t */\n\tprivate readonly keys: {\n\t\tsecretId: string;\n\t\tsecret: string;\n\t\turl: string;\n\t\ttrustedOrigins: string;\n\t\tcookieDomain: string;\n\t};\n\n\tconstructor(\n\t\tid: ConstructName<TName>,\n\t\tprivate readonly config: BetterAuthConfig<TDatabase, TUses>,\n\t) {\n\t\tconst canonical = canonicalId(id as string);\n\n\t\tthis.id = canonical as TName;\n\t\tthis.basePath = config.basePath ?? DEFAULT_BASE_PATH;\n\n\t\t// A secret's name is its key: `Auth` signs with `AUTH_SECRET`, which is\n\t\t// also what better-auth's own tooling looks for.\n\t\tconst secretId = `${canonical}Secret`;\n\t\tthis.keys = {\n\t\t\tsecretId,\n\t\t\tsecret: environmentCase(secretId),\n\t\t\turl: provideKey(canonical, 'url'),\n\t\t\ttrustedOrigins: provideKey(canonical, 'trustedOrigins'),\n\t\t\tcookieDomain: provideKey(canonical, 'cookieDomain'),\n\t\t};\n\n\t\t// A field, not a getter: consumers cache services by object identity.\n\t\tthis.service = {\n\t\t\tserviceName: serviceKey(canonical) as Uncapitalize<TName>,\n\t\t\tregister: (options) => this.client(options.envParser),\n\t\t};\n\t}\n\n\t/**\n\t * A signing secret and a surface.\n\t *\n\t * The database is *not* declared here — the tenant that was passed in\n\t * declares it, and declaring it twice is the duplication the whole model\n\t * removes. What is declared is what this construct owns: the key it signs\n\t * with, and the routes it answers on.\n\t *\n\t * One endpoint, wildcarded. Better Auth routes internally and the set of\n\t * paths depends on which capabilities are enabled, so enumerating them here\n\t * would be a copy of its router that goes stale on its next release. The\n\t * surface's job is to send everything under `basePath` to one handler, which\n\t * is exactly what the declaration says.\n\t */\n\tdeclare(): Declaration[] {\n\t\treturn [\n\t\t\t{\n\t\t\t\tkind: 'secret',\n\t\t\t\tid: this.keys.secretId,\n\t\t\t\tprovides: [this.keys.secret],\n\t\t\t},\n\t\t\t{\n\t\t\t\tkind: 'rest-api',\n\t\t\t\tid: this.id,\n\t\t\t\tpath: this.config.path,\n\t\t\t\t...(this.config.subdomain ? { subdomain: this.config.subdomain } : {}),\n\t\t\t\t...(this.config.telemetry\n\t\t\t\t\t? { telemetry: this.config.telemetry.id }\n\t\t\t\t\t: {}),\n\t\t\t\tprovides: [\n\t\t\t\t\tthis.keys.url,\n\t\t\t\t\tthis.keys.trustedOrigins,\n\t\t\t\t\tthis.keys.cookieDomain,\n\t\t\t\t],\n\t\t\t\tendpoints: [\n\t\t\t\t\t{\n\t\t\t\t\t\tid: `${this.id}Handler`,\n\t\t\t\t\t\thandler: `${this.id}.handler`,\n\t\t\t\t\t\tmethod: 'ANY',\n\t\t\t\t\t\tpath: `${this.basePath}/*`,\n\t\t\t\t\t\t// Read off the tenant rather than written down: this\n\t\t\t\t\t\t// construct takes whatever database it is given, and a\n\t\t\t\t\t\t// hardcoded kind is a second statement of a fact the\n\t\t\t\t\t\t// tenant already makes.\n\t\t\t\t\t\tdependencies: [\n\t\t\t\t\t\t\tedgeTo(this.config.database),\n\t\t\t\t\t\t\t...(this.config.dependsOn ?? []).map(edgeTo),\n\t\t\t\t\t\t],\n\t\t\t\t\t\trequires: [this.keys.secret],\n\t\t\t\t\t},\n\t\t\t\t],\n\t\t\t},\n\t\t];\n\t}\n\n\t/**\n\t * Whose request this is: the session for these headers, or `null`.\n\t *\n\t * Asked of the auth server over HTTP, at the URL the `.auth()` edge injects —\n\t * so it is the same call whether the server runs in this process, beside\n\t * it, or behind MSW in a test. The same call {@link AuthClient} makes.\n\t */\n\tasync verify(\n\t\theaders: Headers,\n\t\tenvParser: EnvironmentParser<{}>,\n\t): Promise<AuthSession | null> {\n\t\treturn this.client(envParser).api.getSession({ headers });\n\t}\n\n\t/**\n\t * The client a caller of this server holds: its URL and nothing else.\n\t *\n\t * `<ID>_URL` is the one key a consumer is given for an edge to a surface —\n\t * the compose network's address between containers, the public one where\n\t * that is all there is — so this is everything it can know.\n\t */\n\tclient(envParser: EnvironmentParser<{}>): AuthClient {\n\t\tconst { url } = envParser\n\t\t\t.create((get) => ({ url: get(this.keys.url).string() }))\n\t\t\t.parse();\n\t\tconst endpoint = `${url.replace(/\\/$/, '')}${this.basePath}`;\n\n\t\treturn {\n\t\t\tapi: {\n\t\t\t\tgetSession: ({ headers }) =>\n\t\t\t\t\tfetchSession(this.id, endpoint, new Headers(headers)),\n\t\t\t},\n\t\t};\n\t}\n\n\t/**\n\t * The tenant this server keeps its tables in — whose migrations folder,\n\t * `db/<tenant>/`, Better Auth's schema is written into.\n\t */\n\tget databaseId(): string {\n\t\treturn this.config.database.id;\n\t}\n\n\t/**\n\t * The SQL that brings the tenant up to Better Auth's schema, or `undefined`\n\t * when it already matches.\n\t *\n\t * What `gkm migration` writes as the tenant's next migration, so Better\n\t * Auth's tables are committed, reviewed and applied like any other — rather\n\t * than diffed against the database at runtime, where a change nobody wrote\n\t * down happens on whichever machine migrates first.\n\t *\n\t * Compared as the owner, against the tenant `gkm migrate` has already brought\n\t * up to date: what comes back is only what the committed files are missing.\n\t */\n\tasync pendingMigration(\n\t\toptions: ServiceRegisterOptions,\n\t): Promise<string | undefined> {\n\t\t// The options, not a server built from them: better-auth checks its\n\t\t// schema when a server starts, and before the migration that creates the\n\t\t// tables it can only report them missing.\n\t\tconst resolved = await this.optionsFor(options, { owner: true });\n\t\tconst db = (resolved.database as { db: Kysely<Record<string, never>> }).db;\n\n\t\ttry {\n\t\t\t// better-auth 1.7 split the migration builder out of `better-auth/db`\n\t\t\t// into its own entry, so importing it no longer drags the whole db\n\t\t\t// layer in behind it.\n\t\t\tconst { getMigrations } = await import('better-auth/db/migration');\n\t\t\tconst { toBeCreated, toBeAdded, toBeAddedIndexes, compileMigrations } =\n\t\t\t\tawait getMigrations(resolved);\n\n\t\t\tif (\n\t\t\t\ttoBeCreated.length === 0 &&\n\t\t\t\ttoBeAdded.length === 0 &&\n\t\t\t\ttoBeAddedIndexes.length === 0\n\t\t\t) {\n\t\t\t\treturn undefined;\n\t\t\t}\n\n\t\t\treturn idempotent(await compileMigrations());\n\t\t} finally {\n\t\t\t// Its own pool: left open, it keeps the process that asked alive.\n\t\t\tawait db.destroy();\n\t\t}\n\t}\n\n\t/**\n\t * The server this surface runs as, built from its own declaration.\n\t *\n\t * A surface is a deploy unit, so something has to serve it, and the thing\n\t * that knows how is the construct — not a generator writing a mount into\n\t * somebody else's entry point. That is how the auth server came to be\n\t * mounted by a hook in the application it was supposed to be separate from,\n\t * and then to be served by nothing at all when the hook was deleted.\n\t *\n\t * The routes come from {@link declare}: one wildcard under `basePath`, read\n\t * off the same declaration the manifest carries, so the surface the graph\n\t * describes and the surface that answers requests cannot disagree.\n\t *\n\t * ```ts\n\t * // .gkm/server/app.ts — the whole generated entry\n\t * import { auth } from '@acme/constructs/auth.js';\n\t * export const { app } = await auth.server({ envParser });\n\t * ```\n\t *\n\t * The only way to the server: it is what reads the signing secret, opens\n\t * the tenant and builds the mailer, so it is built here, in the auth app's\n\t * own process, and `.dependsOn([auth])` everywhere else gets\n\t * {@link AuthClient}. `auth` is the better-auth instance behind the app.\n\t */\n\tasync server(\n\t\toptions: ServiceRegisterOptions,\n\t): Promise<{ app: Hono; auth: AuthServer }> {\n\t\tconst { Hono } = await import('hono');\n\t\tconst { cors } = await import('hono/cors');\n\t\tconst app = new Hono();\n\t\tconst server = await this.connect(options);\n\n\t\t// Who may call this surface, read off the graph. The same list Better\n\t\t// Auth checks for CSRF — it arrives as `<ID>_TRUSTED_ORIGINS`, composed\n\t\t// by the target from whatever declared an edge to this construct, so a\n\t\t// site that depends on the auth server is allowed to reach it and\n\t\t// nothing else is. Nobody writes an origin down.\n\t\tconst { origins } = options.envParser\n\t\t\t.create((get) => ({\n\t\t\t\torigins: get(this.keys.trustedOrigins)\n\t\t\t\t\t.string()\n\t\t\t\t\t.default('')\n\t\t\t\t\t.transform((value: string) =>\n\t\t\t\t\t\tvalue\n\t\t\t\t\t\t\t.split(',')\n\t\t\t\t\t\t\t.map((origin) => origin.trim())\n\t\t\t\t\t\t\t.filter(Boolean),\n\t\t\t\t\t),\n\t\t\t}))\n\t\t\t.parse();\n\n\t\tapp.use('*', cors({ origin: origins, credentials: true, maxAge: 3600 }));\n\n\t\t// Read off the declaration rather than restated here. `ANY` is every\n\t\t// method Better Auth routes internally, which is the reason the\n\t\t// declaration wildcards rather than enumerating.\n\t\tconst [surface] = this.declare().filter(\n\t\t\t(d): d is Extract<Declaration, { kind: 'rest-api' }> =>\n\t\t\t\td.kind === 'rest-api',\n\t\t);\n\n\t\tfor (const endpoint of surface?.endpoints ?? []) {\n\t\t\tconst methods =\n\t\t\t\tendpoint.method === 'ANY'\n\t\t\t\t\t? (['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS'] as const)\n\t\t\t\t\t: ([endpoint.method] as const);\n\n\t\t\tapp.on([...methods], endpoint.path, (c) =>\n\t\t\t\tserver.handler(withTrustedClientIp(c.req.raw, remoteAddressOf(c))),\n\t\t\t);\n\t\t}\n\n\t\treturn { app, auth: server };\n\t}\n\n\t/**\n\t * The ids of the better-auth plugins this server runs — what a client has\n\t * to pair its own plugins with (`magic-link` with `magicLinkClient`).\n\t * Resolved the way the server resolves them, options callback included.\n\t */\n\tasync pluginIds(options: ServiceRegisterOptions): Promise<string[]> {\n\t\tconst { plugins = [] } = await this.configured(options);\n\t\treturn plugins.map(({ id }) => id);\n\t}\n\n\t/** Better-auth's options as given — a value, or a callback of the environment. */\n\tprivate async configured(\n\t\toptions: ServiceRegisterOptions,\n\t): Promise<BetterAuthOptions> {\n\t\t// Hoisted: narrowing a property of `this` is not preserved across the\n\t\t// await, and the false branch is the plain-object form.\n\t\tconst configure = this.config.options;\n\t\tif (typeof configure !== 'function') return configure ?? {};\n\n\t\t// A client for each declared construct, from the options this call was\n\t\t// given — not the process-wide discovery, which keeps whichever env\n\t\t// parser reached it first.\n\t\tconst services: Record<string, unknown> = {};\n\t\tfor (const construct of this.config.dependsOn ?? []) {\n\t\t\tservices[construct.service.serviceName] =\n\t\t\t\tawait construct.service.register(options);\n\t\t}\n\n\t\treturn configure({\n\t\t\t...options,\n\t\t\tservices,\n\t\t} as BetterAuthOptionsContext<TUses>);\n\t}\n\n\tprivate async connect(\n\t\toptions: ServiceRegisterOptions,\n\t\tas: { owner?: boolean } = {},\n\t): Promise<AuthServer> {\n\t\tconst { betterAuth } = await import('better-auth');\n\t\t// `Auth<O>` is invariant in its options in better-auth 1.7, so the value\n\t\t// built from a concrete literal is not assignable to the `AuthServer`\n\t\t// alias, which names the constraint. The runtime object is the same one\n\t\t// either way; the assertion keeps the variance where it happens instead\n\t\t// of spreading a generic through the construct's public type.\n\t\treturn betterAuth(await this.optionsFor(options, as)) as AuthServer;\n\t}\n\n\t/**\n\t * Everything better-auth is given: the app's options, and what the construct\n\t * owns — its secret, its URL, its tenant's connection, the origins and cookie\n\t * domain its graph derives. One place, so the server and its migrations are\n\t * built from the same options.\n\t */\n\tprivate async optionsFor(\n\t\toptions: ServiceRegisterOptions,\n\t\tas: { owner?: boolean } = {},\n\t): Promise<Parameters<typeof betterAuth>[0]> {\n\t\tconst { secret, baseUrl, trustedOrigins, cookieDomain, deviceUrl } =\n\t\t\toptions.envParser\n\t\t\t\t.create((get) => ({\n\t\t\t\t\tsecret: get(this.keys.secret).string(),\n\t\t\t\t\t// The surface's own URL, resolved by the target — not guessed from\n\t\t\t\t\t// a port, which was wrong the moment the server moved to 3001.\n\t\t\t\t\tbaseUrl: get(this.keys.url).string(),\n\t\t\t\t\t// Better Auth's CSRF check applies to every caller, not just\n\t\t\t\t\t// browsers, so an API calling the auth server is rejected unless\n\t\t\t\t\t// its origin is trusted. The list is derived from the graph and\n\t\t\t\t\t// arrives as one comma-separated value, for the same reason every\n\t\t\t\t\t// other derived value arrives as a string: it crosses a process\n\t\t\t\t\t// boundary as env.\n\t\t\t\t\ttrustedOrigins: get(this.keys.trustedOrigins)\n\t\t\t\t\t\t.string()\n\t\t\t\t\t\t.default('')\n\t\t\t\t\t\t.transform((value) =>\n\t\t\t\t\t\t\tvalue\n\t\t\t\t\t\t\t\t.split(',')\n\t\t\t\t\t\t\t\t.map((origin) => origin.trim())\n\t\t\t\t\t\t\t\t.filter(Boolean),\n\t\t\t\t\t\t),\n\t\t\t\t\t// The domain a session cookie has to carry to be readable by a\n\t\t\t\t\t// frontend on a sibling host. Optional because there is often\n\t\t\t\t\t// nothing to widen to: locally everything shares `localhost`,\n\t\t\t\t\t// where cookies ignore the port and a `Domain` would only be a\n\t\t\t\t\t// value the browser refuses.\n\t\t\t\t\tcookieDomain: get(this.keys.cookieDomain).string().optional(),\n\t\t\t\t\t// Where a phone reaches this server, on a local stage with a mobile\n\t\t\t\t\t// app: its own port on the LAN address. Never deployed.\n\t\t\t\t\tdeviceUrl: get(provideKey(this.id, 'deviceUrl')).string().optional(),\n\t\t\t\t}))\n\t\t\t\t.parse();\n\n\t\t// The tenant's own client: one construct, one connection, so what auth\n\t\t// writes and what the browser inspects cannot be two different databases.\n\t\t// A migration asks the tenant for its owner connection, which the tenant\n\t\t// exposes as a `Service` and not as anything `.dependsOn()` would take.\n\t\tconst tenant = this.config.database as Consumable & {\n\t\t\towner?: Service<string, unknown>;\n\t\t};\n\t\tconst source = as.owner && tenant.owner ? tenant.owner : tenant.service;\n\n\t\tconst db = (await source.register(options)) as Kysely<\n\t\t\tRecord<string, never>\n\t\t>;\n\n\t\tconst configured = await this.configured(options);\n\n\t\t// Whatever the app added wins over the derived list rather than\n\t\t// replacing it: an origin nobody declared is still sometimes real.\n\t\tconst origins = [\n\t\t\t...trustedOrigins,\n\t\t\t...(configured.trustedOrigins && Array.isArray(configured.trustedOrigins)\n\t\t\t\t? configured.trustedOrigins\n\t\t\t\t: []),\n\t\t];\n\n\t\tconst plugins = [...(configured.plugins ?? [])];\n\t\t// A mobile app depends on this server: the graph put its scheme among\n\t\t// the derived origins. It signs in through Better Auth's Expo plugin —\n\t\t// the app sends its scheme as the origin, and the plugin is what reads\n\t\t// it — so a server without it would refuse every request the app made.\n\t\t// Asked of the app rather than imported here: a package this one\n\t\t// imported would have to be its peer, and an optional peer gives every\n\t\t// differently-resolving workspace package its own copy of this one.\n\t\tconst mobile = trustedOrigins.filter((origin) => !isWebOrigin(origin));\n\t\tif (mobile.length > 0 && !plugins.some((plugin) => plugin.id === 'expo')) {\n\t\t\tthrow new ExpoPluginRequired(this.id, mobile);\n\t\t}\n\t\t// A sign-in link the app asked for is opened on the phone, which cannot\n\t\t// resolve this server's local hostname; on a local stage it is built on\n\t\t// the address the phone reaches it on instead.\n\t\tif (deviceUrl) {\n\t\t\tfor (const plugin of plugins) reachableFromDevice(plugin, deviceUrl);\n\t\t}\n\n\t\treturn {\n\t\t\t...configured,\n\t\t\tsecret,\n\t\t\tbaseURL: baseUrl,\n\t\t\tbasePath: this.basePath,\n\t\t\tdatabase: { db, type: 'postgres' },\n\t\t\tplugins,\n\t\t\ttrustedOrigins: origins,\n\t\t\tadvanced: {\n\t\t\t\t...configured.advanced,\n\t\t\t\t// The client's address on a call from one of this stack's own\n\t\t\t\t// services comes in gkm's header, ahead of whatever the app reads\n\t\t\t\t// otherwise — `X-Forwarded-For` by default, as Better Auth reads a\n\t\t\t\t// request that reached it through a proxy. The header is honoured\n\t\t\t\t// only from an internal caller: see `withTrustedClientIp`.\n\t\t\t\tipAddress: {\n\t\t\t\t\t...configured.advanced?.ipAddress,\n\t\t\t\t\tipAddressHeaders: [\n\t\t\t\t\t\tCLIENT_IP_HEADER,\n\t\t\t\t\t\t...(\n\t\t\t\t\t\t\tconfigured.advanced?.ipAddress?.ipAddressHeaders ?? [\n\t\t\t\t\t\t\t\t'x-forwarded-for',\n\t\t\t\t\t\t\t]\n\t\t\t\t\t\t).filter((name) => name.toLowerCase() !== CLIENT_IP_HEADER),\n\t\t\t\t\t],\n\t\t\t\t},\n\t\t\t\t// Only when a domain was derived. Better Auth reads the presence\n\t\t\t\t// of this block as intent, so enabling it with no domain would\n\t\t\t\t// widen the cookie to whatever host happened to set it — and the\n\t\t\t\t// case with nothing to widen to is the common one, not an error.\n\t\t\t\t...(cookieDomain\n\t\t\t\t\t? {\n\t\t\t\t\t\t\tcrossSubDomainCookies: {\n\t\t\t\t\t\t\t\tenabled: true,\n\t\t\t\t\t\t\t\tdomain: cookieDomain,\n\t\t\t\t\t\t\t\t...configured.advanced?.crossSubDomainCookies,\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t}\n\t\t\t\t\t: {}),\n\t\t\t},\n\t\t};\n\t}\n}\n\n/** Links already rewritten — an `options` object is reused across builds. */\nconst rewritten = new WeakSet<object>();\n\n/**\n * Build the magic links an app asked for on the address a phone reaches.\n *\n * An app's link carries its scheme as the `callbackURL` (`shop://…`)\n * where a browser's carries a path or an `http(s)` URL — which is how the two\n * are told apart. A browser's link is left alone: it is opened on this\n * machine, where the server's own hostname resolves.\n *\n * Better Auth's magic-link plugin calls `sendMagicLink` through the options\n * object it returns, so wrapping it there is wrapping the call.\n */\nfunction reachableFromDevice(plugin: { id: string }, deviceUrl: string): void {\n\tif (plugin.id !== 'magic-link') return;\n\tconst options = (plugin as { options?: MagicLinkOptions }).options;\n\tif (!options?.sendMagicLink || rewritten.has(options)) return;\n\trewritten.add(options);\n\n\tconst send = options.sendMagicLink;\n\toptions.sendMagicLink = (data, ...rest) =>\n\t\tsend({ ...data, url: deviceLink(data.url, deviceUrl) }, ...rest);\n}\n\ninterface MagicLinkOptions {\n\tsendMagicLink?: (\n\t\tdata: { email: string; url: string; token: string },\n\t\t...rest: unknown[]\n\t) => unknown;\n}\n\n/** A magic link moved to the device address when an app is its destination. */\nexport function deviceLink(url: string, deviceUrl: string): string {\n\ttry {\n\t\tconst link = new URL(url);\n\t\tconst callback = link.searchParams.get('callbackURL') ?? '/';\n\t\tif (callback.startsWith('/') || isWebOrigin(callback)) return url;\n\t\treturn new URL(`${link.pathname}${link.search}`, deviceUrl).toString();\n\t} catch {\n\t\treturn url;\n\t}\n}\n\n/** A mobile app depends on this auth server, which has no Expo plugin. */\nexport class ExpoPluginRequired extends Error {\n\tconstructor(\n\t\treadonly server: string,\n\t\t/** The schemes the graph says call it — what made the plugin necessary. */\n\t\treadonly origins: readonly string[],\n\t) {\n\t\tsuper(\n\t\t\t`'${server}' is called by a mobile app (${origins[0]}), and a mobile app ` +\n\t\t\t\t`signs in through Better Auth's Expo plugin: add expo() from ` +\n\t\t\t\t`'@better-auth/expo' to this auth server's plugins.`,\n\t\t);\n\t\tthis.name = 'ExpoPluginRequired';\n\t}\n}\n\n/** What is forwarded to the auth server: the headers a session travels in. */\nconst SESSION_HEADERS = ['cookie', 'authorization'] as const;\n\n/**\n * `GET <basePath>/get-session`, read the way Better Auth answers it.\n *\n * Whose request it is travels in {@link CLIENT_IP_HEADER} — the server\n * rate-limits `/get-session` by the client's address, so without it every\n * caller shares the API's one bucket — and never as `X-Forwarded-For`. A\n * forwarding header is what marks a request as outside traffic, so the auth\n * server would start its span in a trace of its own rather than continue the\n * API's. Without one, this is an internal caller's request, and the trace\n * context it carries is continued.\n */\nasync function fetchSession(\n\tauthenticator: string,\n\tendpoint: string,\n\tgiven: Headers,\n): Promise<AuthSession | null> {\n\tconst headers = new Headers();\n\tfor (const name of SESSION_HEADERS) {\n\t\tconst value = given.get(name);\n\t\tif (value) headers.set(name, value);\n\t}\n\t// The chain as the API received it, so the auth server reads it exactly\n\t// as it would have read `X-Forwarded-For` (its `trustedProxies` included).\n\t// Never a `CLIENT_IP_HEADER` the API was sent: this process cannot tell\n\t// here whether its own caller was internal, and the auth server trusts\n\t// whatever an internal caller — this one — says.\n\tconst client = given.get('x-forwarded-for');\n\tif (client) headers.set(CLIENT_IP_HEADER, client);\n\tinjectTraceContext(headers);\n\n\tconst url = `${endpoint}/get-session`;\n\tlet response: Response;\n\ttry {\n\t\tresponse = await fetch(url, { headers });\n\t} catch (cause) {\n\t\tthrow new AuthServerUnreachable(authenticator, url, cause);\n\t}\n\n\t// Better Auth answers `null` for a request with no session, and a 401 is\n\t// the same answer from anything in front of it. Anything else that is not\n\t// a 200 is the server failing, which is not \"signed out\" and must not be\n\t// read as it.\n\tif (response.status === 401) return null;\n\tif (!response.ok) {\n\t\tthrow new SessionCheckFailed(authenticator, response.status);\n\t}\n\n\treturn (await response.json()) as AuthSession | null;\n}\n\n/** The auth server answered a session check with a failure. */\nexport class SessionCheckFailed extends Error {\n\tconstructor(\n\t\treadonly authenticator: string,\n\t\treadonly status: number,\n\t) {\n\t\tsuper(\n\t\t\t`'${authenticator}' answered a session check with ${status}. ` +\n\t\t\t\t`A request with no session gets 200 and null, or 401; this is the ` +\n\t\t\t\t`server failing — check its logs, and that it is running at its URL.`,\n\t\t);\n\t\tthis.name = 'SessionCheckFailed';\n\t}\n}\n\n/** A session check never reached the auth server. */\nexport class AuthServerUnreachable extends Error {\n\tconstructor(\n\t\treadonly authenticator: string,\n\t\treadonly url: string,\n\t\tcause: unknown,\n\t) {\n\t\tsuper(\n\t\t\t`'${authenticator}' could not be reached at ${url} to check a session. ` +\n\t\t\t\t`Check that the auth app is running and that this app's ` +\n\t\t\t\t`${provideKey(authenticator, 'url')} points at it.`,\n\t\t\t{ cause },\n\t\t);\n\t\tthis.name = 'AuthServerUnreachable';\n\t}\n}\n\n/**\n * Better Auth's DDL, safe to run where its tables already exist.\n *\n * Its SQL is Kysely's, so its shape is known: `create table \"…\"`, `create index\n * \"…\"`, `alter table \"…\" add column \"…\"`. A database that has been running\n * already has those — Better Auth used to create them at runtime — and the\n * first committed migration would fail on them rather than recording that they\n * are there.\n */\nexport function idempotent(statements: string): string {\n\treturn statements\n\t\t.replace(/\\bcreate table \"/gi, 'create table if not exists \"')\n\t\t.replace(\n\t\t\t/\\bcreate (unique )?index \"/gi,\n\t\t\t(_, unique = '') => `create ${unique}index if not exists \"`,\n\t\t)\n\t\t.replace(/\\badd column \"/gi, 'add column if not exists \"');\n}\n\n/** Headers a reverse proxy or CDN adds on the way in. */\nconst FORWARDING_HEADERS = [\n\t'forwarded',\n\t'x-forwarded-for',\n\t'x-forwarded-host',\n\t'x-real-ip',\n\t'cf-connecting-ip',\n\t'true-client-ip',\n\t'fastly-client-ip',\n\t'x-client-ip',\n];\n\n/**\n * `request`, without {@link CLIENT_IP_HEADER} unless an internal caller sent\n * it — no `Origin`, no forwarding header, a loopback or private peer: the\n * rule a request's span continues a trace by (`@geekmidas/telescope`'s\n * `isInternalCaller`).\n *\n * The stack's own edges strip the header already. This holds wherever one\n * does not — a platform's proxy, a port published straight to the internet —\n * so a stranger cannot pick the address Better Auth rate-limits them by.\n */\nexport function withTrustedClientIp(\n\trequest: Request,\n\tremoteAddress: string | undefined,\n): Request {\n\tif (!request.headers.has(CLIENT_IP_HEADER)) return request;\n\tconst internal =\n\t\t!request.headers.has('origin') &&\n\t\t!FORWARDING_HEADERS.some((name) => request.headers.has(name)) &&\n\t\tisPrivateAddress(remoteAddress);\n\tif (internal) return request;\n\n\tconst headers = new Headers(request.headers);\n\theaders.delete(CLIENT_IP_HEADER);\n\treturn new Request(request, { headers });\n}\n\n/** The TCP peer of a request served by `@hono/node-server`, when there is one. */\nfunction remoteAddressOf(c: { env: unknown }): string | undefined {\n\tconst env = c.env as\n\t\t| { incoming?: { socket?: { remoteAddress?: string } } }\n\t\t| undefined;\n\treturn env?.incoming?.socket?.remoteAddress;\n}\n\n/**\n * Whether `address` is loopback or private: 127/8, 10/8, 172.16/12,\n * 192.168/16, 169.254/16, `::1`, `fc00::/7`, `fe80::/10`, and an IPv4 one\n * mapped into IPv6.\n */\nfunction isPrivateAddress(address: string | undefined): boolean {\n\tif (!address) return false;\n\tconst ip = address.toLowerCase().replace(/^::ffff:/, '');\n\n\tconst v4 = ip.match(/^(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})$/);\n\tif (v4) {\n\t\tconst [a, b] = [Number(v4[1]), Number(v4[2])];\n\t\treturn (\n\t\t\ta === 127 ||\n\t\t\ta === 10 ||\n\t\t\t(a === 172 && b >= 16 && b <= 31) ||\n\t\t\t(a === 192 && b === 168) ||\n\t\t\t(a === 169 && b === 254)\n\t\t);\n\t}\n\n\tif (ip === '::1') return true;\n\treturn /^f[cd][0-9a-f]{2}:/.test(ip) || /^fe[89ab][0-9a-f]:/.test(ip);\n}\n"],"mappings":";;;;;AA4KA,MAAM,oBAAoB;AAE1B,IAAa,aAAb,MAKA;CA8BmB;CA7BlB;;;;;;;;;;;;CAYA;CACA;;;;;CAMA;CAQA,YACC,IACA,QACC;EADgB,KAAA,SAAA;EAEjB,MAAM,aAAA,GAAYA,oBAAAA,YAAAA,CAAY,EAAY;EAE1C,KAAK,KAAK;EACV,KAAK,WAAW,OAAO,YAAY;EAInC,MAAM,WAAW,GAAG,UAAU;EAC9B,KAAK,OAAO;GACX;GACA,SAAA,GAAQC,oBAAAA,gBAAAA,CAAgB,QAAQ;GAChC,MAAA,GAAKC,oBAAAA,WAAAA,CAAW,WAAW,KAAK;GAChC,iBAAA,GAAgBA,oBAAAA,WAAAA,CAAW,WAAW,gBAAgB;GACtD,eAAA,GAAcA,oBAAAA,WAAAA,CAAW,WAAW,cAAc;EACnD;EAGA,KAAK,UAAU;GACd,cAAA,GAAaC,oBAAAA,WAAAA,CAAW,SAAS;GACjC,WAAW,YAAY,KAAK,OAAO,QAAQ,SAAS;EACrD;CACD;;;;;;;;;;;;;;;CAgBA,UAAyB;EACxB,OAAO,CACN;GACC,MAAM;GACN,IAAI,KAAK,KAAK;GACd,UAAU,CAAC,KAAK,KAAK,MAAM;EAC5B,GACA;GACC,MAAM;GACN,IAAI,KAAK;GACT,MAAM,KAAK,OAAO;GAClB,GAAI,KAAK,OAAO,YAAY,EAAE,WAAW,KAAK,OAAO,UAAU,IAAI,CAAC;GACpE,GAAI,KAAK,OAAO,YACb,EAAE,WAAW,KAAK,OAAO,UAAU,GAAG,IACtC,CAAC;GACJ,UAAU;IACT,KAAK,KAAK;IACV,KAAK,KAAK;IACV,KAAK,KAAK;GACX;GACA,WAAW,CACV;IACC,IAAI,GAAG,KAAK,GAAG;IACf,SAAS,GAAG,KAAK,GAAG;IACpB,QAAQ;IACR,MAAM,GAAG,KAAK,SAAS;IAKvB,cAAc,CACbC,4BAAAA,OAAO,KAAK,OAAO,QAAQ,GAC3B,IAAI,KAAK,OAAO,aAAa,CAAC,EAAA,CAAG,IAAIA,4BAAAA,MAAM,CAC5C;IACA,UAAU,CAAC,KAAK,KAAK,MAAM;GAC5B,CACD;EACD,CACD;CACD;;;;;;;;CASA,MAAM,OACL,SACA,WAC8B;EAC9B,OAAO,KAAK,OAAO,SAAS,CAAC,CAAC,IAAI,WAAW,EAAE,QAAQ,CAAC;CACzD;;;;;;;;CASA,OAAO,WAA8C;EACpD,MAAM,EAAE,QAAQ,UACd,QAAQ,SAAS,EAAE,KAAK,IAAI,KAAK,KAAK,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CACvD,MAAM;EACR,MAAM,WAAW,GAAG,IAAI,QAAQ,OAAO,EAAE,IAAI,KAAK;EAElD,OAAO,EACN,KAAK,EACJ,aAAa,EAAE,cACd,aAAa,KAAK,IAAI,UAAU,IAAI,QAAQ,OAAO,CAAC,EACtD,EACD;CACD;;;;;CAMA,IAAI,aAAqB;EACxB,OAAO,KAAK,OAAO,SAAS;CAC7B;;;;;;;;;;;;;CAcA,MAAM,iBACL,SAC8B;EAI9B,MAAM,WAAW,MAAM,KAAK,WAAW,SAAS,EAAE,OAAO,KAAK,CAAC;EAC/D,MAAM,KAAM,SAAS,SAAmD;EAExE,IAAI;GAIH,MAAM,EAAE,kBAAkB,MAAM,OAAO;GACvC,MAAM,EAAE,aAAa,WAAW,kBAAkB,sBACjD,MAAM,cAAc,QAAQ;GAE7B,IACC,YAAY,WAAW,KACvB,UAAU,WAAW,KACrB,iBAAiB,WAAW,GAE5B;GAGD,OAAO,WAAW,MAAM,kBAAkB,CAAC;EAC5C,UAAU;GAET,MAAM,GAAG,QAAQ;EAClB;CACD;;;;;;;;;;;;;;;;;;;;;;;;;CA0BA,MAAM,OACL,SAC2C;EAC3C,MAAM,EAAE,SAAS,MAAM,OAAO;EAC9B,MAAM,EAAE,SAAS,MAAM,OAAO;EAC9B,MAAM,MAAM,IAAI,KAAK;EACrB,MAAM,SAAS,MAAM,KAAK,QAAQ,OAAO;EAOzC,MAAM,EAAE,YAAY,QAAQ,UAC1B,QAAQ,SAAS,EACjB,SAAS,IAAI,KAAK,KAAK,cAAc,CAAC,CACpC,OAAO,CAAC,CACR,QAAQ,EAAE,CAAC,CACX,WAAW,UACX,MACE,MAAM,GAAG,CAAC,CACV,KAAK,WAAW,OAAO,KAAK,CAAC,CAAC,CAC9B,OAAO,OAAO,CACjB,EACF,EAAE,CAAC,CACF,MAAM;EAER,IAAI,IAAI,KAAK,KAAK;GAAE,QAAQ;GAAS,aAAa;GAAM,QAAQ;EAAK,CAAC,CAAC;EAKvE,MAAM,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,QAC/B,MACA,EAAE,SAAS,UACb;EAEA,KAAK,MAAM,YAAY,SAAS,aAAa,CAAC,GAAG;GAChD,MAAM,UACL,SAAS,WAAW,QAChB;IAAC;IAAO;IAAQ;IAAO;IAAS;IAAU;GAAS,IACnD,CAAC,SAAS,MAAM;GAErB,IAAI,GAAG,CAAC,GAAG,OAAO,GAAG,SAAS,OAAO,MACpC,OAAO,QAAQ,oBAAoB,EAAE,IAAI,KAAK,gBAAgB,CAAC,CAAC,CAAC,CAClE;EACD;EAEA,OAAO;GAAE;GAAK,MAAM;EAAO;CAC5B;;;;;;CAOA,MAAM,UAAU,SAAoD;EACnE,MAAM,EAAE,UAAU,CAAC,MAAM,MAAM,KAAK,WAAW,OAAO;EACtD,OAAO,QAAQ,KAAK,EAAE,SAAS,EAAE;CAClC;;CAGA,MAAc,WACb,SAC6B;EAG7B,MAAM,YAAY,KAAK,OAAO;EAC9B,IAAI,OAAO,cAAc,YAAY,OAAO,aAAa,CAAC;EAK1D,MAAM,WAAoC,CAAC;EAC3C,KAAK,MAAM,aAAa,KAAK,OAAO,aAAa,CAAC,GACjD,SAAS,UAAU,QAAQ,eAC1B,MAAM,UAAU,QAAQ,SAAS,OAAO;EAG1C,OAAO,UAAU;GAChB,GAAG;GACH;EACD,CAAoC;CACrC;CAEA,MAAc,QACb,SACA,KAA0B,CAAC,GACL;EACtB,MAAM,EAAE,eAAe,MAAM,OAAO;EAMpC,OAAO,WAAW,MAAM,KAAK,WAAW,SAAS,EAAE,CAAC;CACrD;;;;;;;CAQA,MAAc,WACb,SACA,KAA0B,CAAC,GACiB;EAC5C,MAAM,EAAE,QAAQ,SAAS,gBAAgB,cAAc,cACtD,QAAQ,UACN,QAAQ,SAAS;GACjB,QAAQ,IAAI,KAAK,KAAK,MAAM,CAAC,CAAC,OAAO;GAGrC,SAAS,IAAI,KAAK,KAAK,GAAG,CAAC,CAAC,OAAO;GAOnC,gBAAgB,IAAI,KAAK,KAAK,cAAc,CAAC,CAC3C,OAAO,CAAC,CACR,QAAQ,EAAE,CAAC,CACX,WAAW,UACX,MACE,MAAM,GAAG,CAAC,CACV,KAAK,WAAW,OAAO,KAAK,CAAC,CAAC,CAC9B,OAAO,OAAO,CACjB;GAMD,cAAc,IAAI,KAAK,KAAK,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS;GAG5D,WAAW,KAAA,GAAIF,oBAAAA,WAAAA,CAAW,KAAK,IAAI,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS;EACpE,EAAE,CAAC,CACF,MAAM;EAMT,MAAM,SAAS,KAAK,OAAO;EAK3B,MAAM,KAAM,OAFG,GAAG,SAAS,OAAO,QAAQ,OAAO,QAAQ,OAAO,QAAA,CAEvC,SAAS,OAAO;EAIzC,MAAM,aAAa,MAAM,KAAK,WAAW,OAAO;EAIhD,MAAM,UAAU,CACf,GAAG,gBACH,GAAI,WAAW,kBAAkB,MAAM,QAAQ,WAAW,cAAc,IACrE,WAAW,iBACX,CAAC,CACL;EAEA,MAAM,UAAU,CAAC,GAAI,WAAW,WAAW,CAAC,CAAE;EAQ9C,MAAM,SAAS,eAAe,QAAQ,WAAW,EAAA,GAACG,oBAAAA,YAAAA,CAAY,MAAM,CAAC;EACrE,IAAI,OAAO,SAAS,KAAK,CAAC,QAAQ,MAAM,WAAW,OAAO,OAAO,MAAM,GACtE,MAAM,IAAI,mBAAmB,KAAK,IAAI,MAAM;EAK7C,IAAI,WACH,KAAK,MAAM,UAAU,SAAS,oBAAoB,QAAQ,SAAS;EAGpE,OAAO;GACN,GAAG;GACH;GACA,SAAS;GACT,UAAU,KAAK;GACf,UAAU;IAAE;IAAI,MAAM;GAAW;GACjC;GACA,gBAAgB;GAChB,UAAU;IACT,GAAG,WAAW;IAMd,WAAW;KACV,GAAG,WAAW,UAAU;KACxB,kBAAkB,CACjBC,oBAAAA,kBACA,IACC,WAAW,UAAU,WAAW,oBAAoB,CACnD,iBACD,EAAA,CACC,QAAQ,SAAS,KAAK,YAAY,MAAMA,oBAAAA,gBAAgB,CAC3D;IACD;IAKA,GAAI,eACD,EACA,uBAAuB;KACtB,SAAS;KACT,QAAQ;KACR,GAAG,WAAW,UAAU;IACzB,EACD,IACC,CAAC;GACL;EACD;CACD;AACD;;AAGA,MAAM,4BAAY,IAAI,QAAgB;;;;;;;;;;;;AAatC,SAAS,oBAAoB,QAAwB,WAAyB;CAC7E,IAAI,OAAO,OAAO,cAAc;CAChC,MAAM,UAAW,OAA0C;CAC3D,IAAI,CAAC,SAAS,iBAAiB,UAAU,IAAI,OAAO,GAAG;CACvD,UAAU,IAAI,OAAO;CAErB,MAAM,OAAO,QAAQ;CACrB,QAAQ,iBAAiB,MAAM,GAAG,SACjC,KAAK;EAAE,GAAG;EAAM,KAAK,WAAW,KAAK,KAAK,SAAS;CAAE,GAAG,GAAG,IAAI;AACjE;;AAUA,SAAgB,WAAW,KAAa,WAA2B;CAClE,IAAI;EACH,MAAM,OAAO,IAAI,IAAI,GAAG;EACxB,MAAM,WAAW,KAAK,aAAa,IAAI,aAAa,KAAK;EACzD,IAAI,SAAS,WAAW,GAAG,MAAA,GAAKD,oBAAAA,YAAAA,CAAY,QAAQ,GAAG,OAAO;EAC9D,OAAO,IAAI,IAAI,GAAG,KAAK,WAAW,KAAK,UAAU,SAAS,CAAC,CAAC,SAAS;CACtE,QAAQ;EACP,OAAO;CACR;AACD;;AAGA,IAAa,qBAAb,cAAwC,MAAM;CAEnC;CAEA;CAHV,YACC,QAEA,SACC;EACD,MACC,IAAI,OAAO,+BAA+B,QAAQ,GAAG,mIAGtD;EARS,KAAA,SAAA;EAEA,KAAA,UAAA;EAOT,KAAK,OAAO;CACb;AACD;;AAGA,MAAM,kBAAkB,CAAC,UAAU,eAAe;;;;;;;;;;;;AAalD,eAAe,aACd,eACA,UACA,OAC8B;CAC9B,MAAM,UAAU,IAAI,QAAQ;CAC5B,KAAK,MAAM,QAAQ,iBAAiB;EACnC,MAAM,QAAQ,MAAM,IAAI,IAAI;EAC5B,IAAI,OAAO,QAAQ,IAAI,MAAM,KAAK;CACnC;CAMA,MAAM,SAAS,MAAM,IAAI,iBAAiB;CAC1C,IAAI,QAAQ,QAAQ,IAAIC,oBAAAA,kBAAkB,MAAM;CAChD,gBAAA,mBAAmB,OAAO;CAE1B,MAAM,MAAM,GAAG,SAAS;CACxB,IAAI;CACJ,IAAI;EACH,WAAW,MAAM,MAAM,KAAK,EAAE,QAAQ,CAAC;CACxC,SAAS,OAAO;EACf,MAAM,IAAI,sBAAsB,eAAe,KAAK,KAAK;CAC1D;CAMA,IAAI,SAAS,WAAW,KAAK,OAAO;CACpC,IAAI,CAAC,SAAS,IACb,MAAM,IAAI,mBAAmB,eAAe,SAAS,MAAM;CAG5D,OAAQ,MAAM,SAAS,KAAK;AAC7B;;AAGA,IAAa,qBAAb,cAAwC,MAAM;CAEnC;CACA;CAFV,YACC,eACA,QACC;EACD,MACC,IAAI,cAAc,kCAAkC,OAAO,uIAG5D;EAPS,KAAA,gBAAA;EACA,KAAA,SAAA;EAOT,KAAK,OAAO;CACb;AACD;;AAGA,IAAa,wBAAb,cAA2C,MAAM;CAEtC;CACA;CAFV,YACC,eACA,KACA,OACC;EACD,MACC,IAAI,cAAc,4BAA4B,IAAI,+EAAA,GAE9CJ,oBAAAA,WAAAA,CAAW,eAAe,KAAK,EAAE,iBACrC,EAAE,MAAM,CACT;EATS,KAAA,gBAAA;EACA,KAAA,MAAA;EAST,KAAK,OAAO;CACb;AACD;;;;;;;;;;AAWA,SAAgB,WAAW,YAA4B;CACtD,OAAO,WACL,QAAQ,sBAAsB,+BAA8B,CAAC,CAC7D,QACA,iCACC,GAAG,SAAS,OAAO,UAAU,OAAO,sBACtC,CAAC,CACA,QAAQ,oBAAoB,6BAA4B;AAC3D;;AAGA,MAAM,qBAAqB;CAC1B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACD;;;;;;;;;;;AAYA,SAAgB,oBACf,SACA,eACU;CACV,IAAI,CAAC,QAAQ,QAAQ,IAAII,oBAAAA,gBAAgB,GAAG,OAAO;CAKnD,IAHC,CAAC,QAAQ,QAAQ,IAAI,QAAQ,KAC7B,CAAC,mBAAmB,MAAM,SAAS,QAAQ,QAAQ,IAAI,IAAI,CAAC,KAC5D,iBAAiB,aAAa,GACjB,OAAO;CAErB,MAAM,UAAU,IAAI,QAAQ,QAAQ,OAAO;CAC3C,QAAQ,OAAOA,oBAAAA,gBAAgB;CAC/B,OAAO,IAAI,QAAQ,SAAS,EAAE,QAAQ,CAAC;AACxC;;AAGA,SAAS,gBAAgB,GAAyC;CAIjE,OAHY,EAAE,KAGF,UAAU,QAAQ;AAC/B;;;;;;AAOA,SAAS,iBAAiB,SAAsC;CAC/D,IAAI,CAAC,SAAS,OAAO;CACrB,MAAM,KAAK,QAAQ,YAAY,CAAC,CAAC,QAAQ,YAAY,EAAE;CAEvD,MAAM,KAAK,GAAG,MAAM,8CAA8C;CAClE,IAAI,IAAI;EACP,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,GAAG,EAAE,GAAG,OAAO,GAAG,EAAE,CAAC;EAC5C,OACC,MAAM,OACN,MAAM,MACL,MAAM,OAAO,KAAK,MAAM,KAAK,MAC7B,MAAM,OAAO,MAAM,OACnB,MAAM,OAAO,MAAM;CAEtB;CAEA,IAAI,OAAO,OAAO,OAAO;CACzB,OAAO,qBAAqB,KAAK,EAAE,KAAK,qBAAqB,KAAK,EAAE;AACrE"}

package/dist/auth.d.cts

@@ -1,2 +1,2 @@
-import { a as BetterAuth, c as BetterAuthOptionsContext, d as deviceLink, f as idempotent, i as AuthSession, l as ExpoPluginRequired, n as AuthServer, o as BetterAuthConfig, p as withTrustedClientIp, r as AuthServerUnreachable, s as BetterAuthOptions, t as AuthClient, u as SessionCheckFailed } from "./auth-CwYlcogd.cjs";
+import { a as BetterAuth, c as BetterAuthOptionsContext, d as deviceLink, f as idempotent, i as AuthSession, l as ExpoPluginRequired, n as AuthServer, o as BetterAuthConfig, p as withTrustedClientIp, r as AuthServerUnreachable, s as BetterAuthOptions, t as AuthClient, u as SessionCheckFailed } from "./auth-BMCJN30Y.cjs";
 export { AuthClient, AuthServer, AuthServerUnreachable, AuthSession, BetterAuth, BetterAuthConfig, BetterAuthOptions, BetterAuthOptionsContext, ExpoPluginRequired, SessionCheckFailed, deviceLink, idempotent, withTrustedClientIp };

package/dist/auth.d.mts

@@ -1,2 +1,2 @@
-import { a as BetterAuth, c as BetterAuthOptionsContext, d as deviceLink, f as idempotent, i as AuthSession, l as ExpoPluginRequired, n as AuthServer, o as BetterAuthConfig, p as withTrustedClientIp, r as AuthServerUnreachable, s as BetterAuthOptions, t as AuthClient, u as SessionCheckFailed } from "./auth-CYFghDZw.mjs";
+import { a as BetterAuth, c as BetterAuthOptionsContext, d as deviceLink, f as idempotent, i as AuthSession, l as ExpoPluginRequired, n as AuthServer, o as BetterAuthConfig, p as withTrustedClientIp, r as AuthServerUnreachable, s as BetterAuthOptions, t as AuthClient, u as SessionCheckFailed } from "./auth-CcuceLYo.mjs";
 export { AuthClient, AuthServer, AuthServerUnreachable, AuthSession, BetterAuth, BetterAuthConfig, BetterAuthOptions, BetterAuthOptionsContext, ExpoPluginRequired, SessionCheckFailed, deviceLink, idempotent, withTrustedClientIp };