@geekmidas/constructs 10.0.0-alpha.9 → 10.0.0-alpha.91

package/dist/auth-BMCJN30Y.d.cts

@@ -0,0 +1,268 @@
+import { c as ServicesOf, n as Construct, r as Consumable, t as Authenticator } from "./construct-interface-B1AfqRl4.cjs";
+import { n as Telemetry } from "./telemetry-B48RLjyk.cjs";
+import { EnvironmentParser } from "@geekmidas/envkit";
+import { Service, ServiceRecord, ServiceRegisterOptions } from "@geekmidas/services";
+import { ConstructName, Declaration } from "@geekmidas/manifest";
+import { betterAuth } from "better-auth";
+import { Hono } from "hono";
+//#region src/auth.d.ts
+/** The server better-auth hands back. */
+type AuthServer = ReturnType<typeof betterAuth>;
+/** A signed-in session as better-auth hands it back: `{ user, session }`. */
+type AuthSession = AuthServer['$Infer']['Session'];
+/**
+ * What `.dependsOn([auth])` hands a handler: the auth server, over HTTP.
+ *
+ * The server itself — its secret, its tenant's connection, its mailer — lives
+ * in the auth app's own process and nowhere else. Every other process is a
+ * caller of it, so what it is given is an address and this, with the one
+ * call handlers make kept in Better Auth's shape: `api.getSession({ headers })`
+ * answers `{ user, session }` or `null`, as the server's own `api` does.
+ */
+interface AuthClient {
+  readonly api: {
+    /**
+     * The session the request's cookie or bearer token belongs to, or `null`
+     * when there is none — asked of `<basePath>/get-session` at the auth
+     * server's URL. Only `cookie` and `authorization` are forwarded, with
+     * the client's address as `x-gkm-client-ip` (read from the request's
+     * `x-forwarded-for`) and the active trace context.
+     *
+     * @throws {AuthServerUnreachable} when the request does not get there.
+     * @throws {SessionCheckFailed} when the server answers with a failure.
+     */
+    getSession(input: {
+      headers: ConstructorParameters<typeof Headers>[0];
+    }): Promise<AuthSession | null>;
+  };
+}
+/** Everything better-auth takes, minus what the construct owns. */
+type BetterAuthOptions = Omit<Parameters<typeof betterAuth>[0], 'database' | 'secret' | 'basePath' | 'baseURL'>;
+/**
+ * What an `options` callback is handed: the options this construct was
+ * registered with, and a client for each construct its `dependsOn` names —
+ * keyed by service name, exactly as an endpoint's handler receives them.
+ */
+type BetterAuthOptionsContext<TUses extends readonly Consumable[]> = ServiceRegisterOptions & {
+  services: ServiceRecord<[...ServicesOf<TUses>]>;
+};
+interface BetterAuthConfig<TDatabase extends Consumable, TUses extends readonly Consumable[] = readonly []> {
+  /**
+   * The schema tenant its tables live in.
+   *
+   * A construct rather than a URL: the tenant already declares its schema and
+   * its role, and taking the declaration is what puts the edge in the graph
+   * instead of a connection string in two places.
+   */
+  database: TDatabase;
+  /**
+   * The app that serves this auth server, relative to the workspace root —
+   * `'apps/auth'`.
+   *
+   * Required, for the reason `RestApi.path` is. Not to be confused with
+   * `basePath`, which is where its routes are mounted in a URL.
+   */
+  path: string;
+  /**
+   * The label it answers on under a stage's domain — `api` for
+   * `api.myapp.com`, from `domains` — and under the project locally,
+   * `api.myapp.localhost`. Absent, its id kebab-cased.
+   */
+  subdomain?: string;
+  /**
+   * Where the auth routes are mounted, e.g. `/api/auth`.
+   *
+   * Structural — it is part of the URL every client calls, so it cannot differ
+   * between stages the way the host can.
+   */
+  basePath?: string;
+  /**
+   * The constructs `options` uses — the mailer a magic link goes through,
+   * most often.
+   *
+   * One list, two jobs, the way an endpoint's `.dependsOn()` has: each is an
+   * edge on the server's handler, so whatever is composed from the edges (a
+   * container's environment, a deploy's grants) includes it; and each is
+   * handed to `options` as a client in `services`, so there is no other way
+   * for `options` to reach it — nothing to import and register by hand, and
+   * so nothing that can be used without being declared.
+   */
+  dependsOn?: TUses;
+  /**
+   * What the auth server's process emits — the `Telemetry` construct, passed
+   * like a `RestApi`'s. An edge to the node: the deploy hands the process the
+   * `OTEL_*` keys its stage resolves.
+   */
+  telemetry?: Telemetry;
+  /**
+   * The rest of better-auth's options: providers, plugins, email settings.
+   *
+   * A function when they need another construct — a magic-link plugin has to
+   * *send* the link. It is handed the options this construct was registered
+   * with, and `services`: a client for each construct in `dependsOn`.
+   */
+  options?: BetterAuthOptions | ((context: BetterAuthOptionsContext<TUses>) => BetterAuthOptions | Promise<BetterAuthOptions>);
+}
+declare class BetterAuth<TName extends string = string, TDatabase extends Consumable = Consumable, const TUses extends readonly Consumable[] = readonly []> implements Construct<TName, AuthClient>, Authenticator<AuthSession> {
+  private readonly config;
+  readonly id: TName;
+  /**
+   * What `.dependsOn([auth])` injects: an {@link AuthClient}, never the server.
+   *
+   * Which of the two a process holds is decided by how it reaches the
+   * construct, not by asking where it is running. The auth app's process is
+   * its generated entry, which calls {@link server} and nothing else — a
+   * self-serving surface has no endpoints of its own for a `dependsOn` to sit
+   * on. Every other process reaches it through this. So the API, a worker, a
+   * test's in-process endpoints all get the client, and none of them needs
+   * the signing secret, the auth tenant's URL or the mailer to start.
+   */
+  readonly service: Service<Uncapitalize<TName>, AuthClient>;
+  readonly basePath: string;
+  /**
+   * Declared once and read by both `declare()` and `connect()`, so the keys the
+   * target publishes and the keys the server reads cannot drift.
+   */
+  private readonly keys;
+  constructor(id: ConstructName<TName>, config: BetterAuthConfig<TDatabase, TUses>);
+  /**
+   * A signing secret and a surface.
+   *
+   * The database is *not* declared here — the tenant that was passed in
+   * declares it, and declaring it twice is the duplication the whole model
+   * removes. What is declared is what this construct owns: the key it signs
+   * with, and the routes it answers on.
+   *
+   * One endpoint, wildcarded. Better Auth routes internally and the set of
+   * paths depends on which capabilities are enabled, so enumerating them here
+   * would be a copy of its router that goes stale on its next release. The
+   * surface's job is to send everything under `basePath` to one handler, which
+   * is exactly what the declaration says.
+   */
+  declare(): Declaration[];
+  /**
+   * Whose request this is: the session for these headers, or `null`.
+   *
+   * Asked of the auth server over HTTP, at the URL the `.auth()` edge injects —
+   * so it is the same call whether the server runs in this process, beside
+   * it, or behind MSW in a test. The same call {@link AuthClient} makes.
+   */
+  verify(headers: Headers, envParser: EnvironmentParser<{}>): Promise<AuthSession | null>;
+  /**
+   * The client a caller of this server holds: its URL and nothing else.
+   *
+   * `<ID>_URL` is the one key a consumer is given for an edge to a surface —
+   * the compose network's address between containers, the public one where
+   * that is all there is — so this is everything it can know.
+   */
+  client(envParser: EnvironmentParser<{}>): AuthClient;
+  /**
+   * The tenant this server keeps its tables in — whose migrations folder,
+   * `db/<tenant>/`, Better Auth's schema is written into.
+   */
+  get databaseId(): string;
+  /**
+   * The SQL that brings the tenant up to Better Auth's schema, or `undefined`
+   * when it already matches.
+   *
+   * What `gkm migration` writes as the tenant's next migration, so Better
+   * Auth's tables are committed, reviewed and applied like any other — rather
+   * than diffed against the database at runtime, where a change nobody wrote
+   * down happens on whichever machine migrates first.
+   *
+   * Compared as the owner, against the tenant `gkm migrate` has already brought
+   * up to date: what comes back is only what the committed files are missing.
+   */
+  pendingMigration(options: ServiceRegisterOptions): Promise<string | undefined>;
+  /**
+   * The server this surface runs as, built from its own declaration.
+   *
+   * A surface is a deploy unit, so something has to serve it, and the thing
+   * that knows how is the construct — not a generator writing a mount into
+   * somebody else's entry point. That is how the auth server came to be
+   * mounted by a hook in the application it was supposed to be separate from,
+   * and then to be served by nothing at all when the hook was deleted.
+   *
+   * The routes come from {@link declare}: one wildcard under `basePath`, read
+   * off the same declaration the manifest carries, so the surface the graph
+   * describes and the surface that answers requests cannot disagree.
+   *
+   * ```ts
+   * // .gkm/server/app.ts — the whole generated entry
+   * import { auth } from '@acme/constructs/auth.js';
+   * export const { app } = await auth.server({ envParser });
+   * ```
+   *
+   * The only way to the server: it is what reads the signing secret, opens
+   * the tenant and builds the mailer, so it is built here, in the auth app's
+   * own process, and `.dependsOn([auth])` everywhere else gets
+   * {@link AuthClient}. `auth` is the better-auth instance behind the app.
+   */
+  server(options: ServiceRegisterOptions): Promise<{
+    app: Hono;
+    auth: AuthServer;
+  }>;
+  /**
+   * The ids of the better-auth plugins this server runs — what a client has
+   * to pair its own plugins with (`magic-link` with `magicLinkClient`).
+   * Resolved the way the server resolves them, options callback included.
+   */
+  pluginIds(options: ServiceRegisterOptions): Promise<string[]>;
+  /** Better-auth's options as given — a value, or a callback of the environment. */
+  private configured;
+  private connect;
+  /**
+   * Everything better-auth is given: the app's options, and what the construct
+   * owns — its secret, its URL, its tenant's connection, the origins and cookie
+   * domain its graph derives. One place, so the server and its migrations are
+   * built from the same options.
+   */
+  private optionsFor;
+}
+/** A magic link moved to the device address when an app is its destination. */
+declare function deviceLink(url: string, deviceUrl: string): string;
+/** A mobile app depends on this auth server, which has no Expo plugin. */
+declare class ExpoPluginRequired extends Error {
+  readonly server: string;
+  /** The schemes the graph says call it — what made the plugin necessary. */
+  readonly origins: readonly string[];
+  constructor(server: string,
+  /** The schemes the graph says call it — what made the plugin necessary. */
+  origins: readonly string[]);
+}
+/** The auth server answered a session check with a failure. */
+declare class SessionCheckFailed extends Error {
+  readonly authenticator: string;
+  readonly status: number;
+  constructor(authenticator: string, status: number);
+}
+/** A session check never reached the auth server. */
+declare class AuthServerUnreachable extends Error {
+  readonly authenticator: string;
+  readonly url: string;
+  constructor(authenticator: string, url: string, cause: unknown);
+}
+/**
+ * Better Auth's DDL, safe to run where its tables already exist.
+ *
+ * Its SQL is Kysely's, so its shape is known: `create table "…"`, `create index
+ * "…"`, `alter table "…" add column "…"`. A database that has been running
+ * already has those — Better Auth used to create them at runtime — and the
+ * first committed migration would fail on them rather than recording that they
+ * are there.
+ */
+declare function idempotent(statements: string): string;
+/**
+ * `request`, without {@link CLIENT_IP_HEADER} unless an internal caller sent
+ * it — no `Origin`, no forwarding header, a loopback or private peer: the
+ * rule a request's span continues a trace by (`@geekmidas/telescope`'s
+ * `isInternalCaller`).
+ *
+ * The stack's own edges strip the header already. This holds wherever one
+ * does not — a platform's proxy, a port published straight to the internet —
+ * so a stranger cannot pick the address Better Auth rate-limits them by.
+ */
+declare function withTrustedClientIp(request: Request, remoteAddress: string | undefined): Request;
+//#endregion
+export { BetterAuth as a, BetterAuthOptionsContext as c, deviceLink as d, idempotent as f, AuthSession as i, ExpoPluginRequired as l, AuthServer as n, BetterAuthConfig as o, withTrustedClientIp as p, AuthServerUnreachable as r, BetterAuthOptions as s, AuthClient as t, SessionCheckFailed as u };
+//# sourceMappingURL=auth-BMCJN30Y.d.cts.map

package/dist/auth-BMCJN30Y.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-BMCJN30Y.d.cts","names":[],"sources":["../src/auth.ts"],"mappings":";;;;;;;;;KA2DY,aAAa,kBAAkB;;KAG/B,cAAc;;;;;;;;;;UAWT;WACP;;;;;;;;;;;IAWR,WAAW;MACV,SAAS,6BAA6B;QACnC,QAAQ;;;;KAKF,oBAAoB,KAC/B,kBAAkB;;;;;;KASP,yBAAyB,uBAAuB,gBAC3D;EACC,UAAU,kBAAkB,WAAW;;UAGxB,iBAChB,kBAAkB,YAClB,uBAAuB;;;;;;;;EASvB,UAAU;;;;;;;;EAQV;;;;;;EAMA;;;;;;;EAOA;;;;;;;;;;;;EAYA,YAAY;;;;;;EAMZ,YAAY;;;;;;;;EAQZ,UACG,sBAEA,SAAS,yBAAyB,WAC7B,oBAAoB,QAAQ;;cAKxB,WACZ,+BACA,kBAAkB,aAAa,kBACzB,uBAAuB,uCACjB,UAAU,OAAO,aAAa,cAAc;mBA+BtC;WA7BT,IAAI;;;;;;;;;;;;WAYJ,SAAS,QAAQ,aAAa,QAAQ;WACtC;;;;;mBAMQ;EAQjB,YACC,IAAI,cAAc,QACD,QAAQ,iBAAiB,WAAW;;;;;;;;;;;;;;;EAuCtD,WAAW;;;;;;;;EAgDL,OACL,SAAS,SACT,WAAW,wBACT,QAAQ;;;;;;;;EAWX,OAAO,WAAW,wBAAwB;;;;;MAkBtC;;;;;;;;;;;;;EAgBE,iBACL,SAAS,yBACP;;;;;;;;;;;;;;;;;;;;;;;;;EAsDG,OACL,SAAS,yBACP;IAAU,KAAK;IAAM,MAAM;;;;;;;EAsDxB,UAAU,SAAS,yBAAyB;;UAMpC;UAuBA;;;;;;;UAmBA;;;iBA8JC,WAAW,aAAa;;cAY3B,2BAA2B;WAE7B;;WAEA;EAHV,YACU,gBAEA;;EAAA;;;cAiEE,2BAA2B;WAE7B;WACA;EAFV,YACU,uBACA;;;cAYE,8BAA8B;WAEhC;WACA;EAFV,YACU,uBACA,aACT;;;;;;;;;;;iBAqBc,WAAW;;;;;;;;;;;iBAgCX,oBACf,SAAS,SACT,oCACE"}

package/dist/auth-CcuceLYo.d.mts

@@ -0,0 +1,268 @@
+import { c as ServicesOf, n as Construct, r as Consumable, t as Authenticator } from "./construct-interface-DluK3_da.mjs";
+import { n as Telemetry } from "./telemetry-DRtT1_0A.mjs";
+import { ConstructName, Declaration } from "@geekmidas/manifest";
+import { EnvironmentParser } from "@geekmidas/envkit";
+import { Service, ServiceRecord, ServiceRegisterOptions } from "@geekmidas/services";
+import { Hono } from "hono";
+import { betterAuth } from "better-auth";
+//#region src/auth.d.ts
+/** The server better-auth hands back. */
+type AuthServer = ReturnType<typeof betterAuth>;
+/** A signed-in session as better-auth hands it back: `{ user, session }`. */
+type AuthSession = AuthServer['$Infer']['Session'];
+/**
+ * What `.dependsOn([auth])` hands a handler: the auth server, over HTTP.
+ *
+ * The server itself — its secret, its tenant's connection, its mailer — lives
+ * in the auth app's own process and nowhere else. Every other process is a
+ * caller of it, so what it is given is an address and this, with the one
+ * call handlers make kept in Better Auth's shape: `api.getSession({ headers })`
+ * answers `{ user, session }` or `null`, as the server's own `api` does.
+ */
+interface AuthClient {
+  readonly api: {
+    /**
+     * The session the request's cookie or bearer token belongs to, or `null`
+     * when there is none — asked of `<basePath>/get-session` at the auth
+     * server's URL. Only `cookie` and `authorization` are forwarded, with
+     * the client's address as `x-gkm-client-ip` (read from the request's
+     * `x-forwarded-for`) and the active trace context.
+     *
+     * @throws {AuthServerUnreachable} when the request does not get there.
+     * @throws {SessionCheckFailed} when the server answers with a failure.
+     */
+    getSession(input: {
+      headers: ConstructorParameters<typeof Headers>[0];
+    }): Promise<AuthSession | null>;
+  };
+}
+/** Everything better-auth takes, minus what the construct owns. */
+type BetterAuthOptions = Omit<Parameters<typeof betterAuth>[0], 'database' | 'secret' | 'basePath' | 'baseURL'>;
+/**
+ * What an `options` callback is handed: the options this construct was
+ * registered with, and a client for each construct its `dependsOn` names —
+ * keyed by service name, exactly as an endpoint's handler receives them.
+ */
+type BetterAuthOptionsContext<TUses extends readonly Consumable[]> = ServiceRegisterOptions & {
+  services: ServiceRecord<[...ServicesOf<TUses>]>;
+};
+interface BetterAuthConfig<TDatabase extends Consumable, TUses extends readonly Consumable[] = readonly []> {
+  /**
+   * The schema tenant its tables live in.
+   *
+   * A construct rather than a URL: the tenant already declares its schema and
+   * its role, and taking the declaration is what puts the edge in the graph
+   * instead of a connection string in two places.
+   */
+  database: TDatabase;
+  /**
+   * The app that serves this auth server, relative to the workspace root —
+   * `'apps/auth'`.
+   *
+   * Required, for the reason `RestApi.path` is. Not to be confused with
+   * `basePath`, which is where its routes are mounted in a URL.
+   */
+  path: string;
+  /**
+   * The label it answers on under a stage's domain — `api` for
+   * `api.myapp.com`, from `domains` — and under the project locally,
+   * `api.myapp.localhost`. Absent, its id kebab-cased.
+   */
+  subdomain?: string;
+  /**
+   * Where the auth routes are mounted, e.g. `/api/auth`.
+   *
+   * Structural — it is part of the URL every client calls, so it cannot differ
+   * between stages the way the host can.
+   */
+  basePath?: string;
+  /**
+   * The constructs `options` uses — the mailer a magic link goes through,
+   * most often.
+   *
+   * One list, two jobs, the way an endpoint's `.dependsOn()` has: each is an
+   * edge on the server's handler, so whatever is composed from the edges (a
+   * container's environment, a deploy's grants) includes it; and each is
+   * handed to `options` as a client in `services`, so there is no other way
+   * for `options` to reach it — nothing to import and register by hand, and
+   * so nothing that can be used without being declared.
+   */
+  dependsOn?: TUses;
+  /**
+   * What the auth server's process emits — the `Telemetry` construct, passed
+   * like a `RestApi`'s. An edge to the node: the deploy hands the process the
+   * `OTEL_*` keys its stage resolves.
+   */
+  telemetry?: Telemetry;
+  /**
+   * The rest of better-auth's options: providers, plugins, email settings.
+   *
+   * A function when they need another construct — a magic-link plugin has to
+   * *send* the link. It is handed the options this construct was registered
+   * with, and `services`: a client for each construct in `dependsOn`.
+   */
+  options?: BetterAuthOptions | ((context: BetterAuthOptionsContext<TUses>) => BetterAuthOptions | Promise<BetterAuthOptions>);
+}
+declare class BetterAuth<TName extends string = string, TDatabase extends Consumable = Consumable, const TUses extends readonly Consumable[] = readonly []> implements Construct<TName, AuthClient>, Authenticator<AuthSession> {
+  private readonly config;
+  readonly id: TName;
+  /**
+   * What `.dependsOn([auth])` injects: an {@link AuthClient}, never the server.
+   *
+   * Which of the two a process holds is decided by how it reaches the
+   * construct, not by asking where it is running. The auth app's process is
+   * its generated entry, which calls {@link server} and nothing else — a
+   * self-serving surface has no endpoints of its own for a `dependsOn` to sit
+   * on. Every other process reaches it through this. So the API, a worker, a
+   * test's in-process endpoints all get the client, and none of them needs
+   * the signing secret, the auth tenant's URL or the mailer to start.
+   */
+  readonly service: Service<Uncapitalize<TName>, AuthClient>;
+  readonly basePath: string;
+  /**
+   * Declared once and read by both `declare()` and `connect()`, so the keys the
+   * target publishes and the keys the server reads cannot drift.
+   */
+  private readonly keys;
+  constructor(id: ConstructName<TName>, config: BetterAuthConfig<TDatabase, TUses>);
+  /**
+   * A signing secret and a surface.
+   *
+   * The database is *not* declared here — the tenant that was passed in
+   * declares it, and declaring it twice is the duplication the whole model
+   * removes. What is declared is what this construct owns: the key it signs
+   * with, and the routes it answers on.
+   *
+   * One endpoint, wildcarded. Better Auth routes internally and the set of
+   * paths depends on which capabilities are enabled, so enumerating them here
+   * would be a copy of its router that goes stale on its next release. The
+   * surface's job is to send everything under `basePath` to one handler, which
+   * is exactly what the declaration says.
+   */
+  declare(): Declaration[];
+  /**
+   * Whose request this is: the session for these headers, or `null`.
+   *
+   * Asked of the auth server over HTTP, at the URL the `.auth()` edge injects —
+   * so it is the same call whether the server runs in this process, beside
+   * it, or behind MSW in a test. The same call {@link AuthClient} makes.
+   */
+  verify(headers: Headers, envParser: EnvironmentParser<{}>): Promise<AuthSession | null>;
+  /**
+   * The client a caller of this server holds: its URL and nothing else.
+   *
+   * `<ID>_URL` is the one key a consumer is given for an edge to a surface —
+   * the compose network's address between containers, the public one where
+   * that is all there is — so this is everything it can know.
+   */
+  client(envParser: EnvironmentParser<{}>): AuthClient;
+  /**
+   * The tenant this server keeps its tables in — whose migrations folder,
+   * `db/<tenant>/`, Better Auth's schema is written into.
+   */
+  get databaseId(): string;
+  /**
+   * The SQL that brings the tenant up to Better Auth's schema, or `undefined`
+   * when it already matches.
+   *
+   * What `gkm migration` writes as the tenant's next migration, so Better
+   * Auth's tables are committed, reviewed and applied like any other — rather
+   * than diffed against the database at runtime, where a change nobody wrote
+   * down happens on whichever machine migrates first.
+   *
+   * Compared as the owner, against the tenant `gkm migrate` has already brought
+   * up to date: what comes back is only what the committed files are missing.
+   */
+  pendingMigration(options: ServiceRegisterOptions): Promise<string | undefined>;
+  /**
+   * The server this surface runs as, built from its own declaration.
+   *
+   * A surface is a deploy unit, so something has to serve it, and the thing
+   * that knows how is the construct — not a generator writing a mount into
+   * somebody else's entry point. That is how the auth server came to be
+   * mounted by a hook in the application it was supposed to be separate from,
+   * and then to be served by nothing at all when the hook was deleted.
+   *
+   * The routes come from {@link declare}: one wildcard under `basePath`, read
+   * off the same declaration the manifest carries, so the surface the graph
+   * describes and the surface that answers requests cannot disagree.
+   *
+   * ```ts
+   * // .gkm/server/app.ts — the whole generated entry
+   * import { auth } from '@acme/constructs/auth.js';
+   * export const { app } = await auth.server({ envParser });
+   * ```
+   *
+   * The only way to the server: it is what reads the signing secret, opens
+   * the tenant and builds the mailer, so it is built here, in the auth app's
+   * own process, and `.dependsOn([auth])` everywhere else gets
+   * {@link AuthClient}. `auth` is the better-auth instance behind the app.
+   */
+  server(options: ServiceRegisterOptions): Promise<{
+    app: Hono;
+    auth: AuthServer;
+  }>;
+  /**
+   * The ids of the better-auth plugins this server runs — what a client has
+   * to pair its own plugins with (`magic-link` with `magicLinkClient`).
+   * Resolved the way the server resolves them, options callback included.
+   */
+  pluginIds(options: ServiceRegisterOptions): Promise<string[]>;
+  /** Better-auth's options as given — a value, or a callback of the environment. */
+  private configured;
+  private connect;
+  /**
+   * Everything better-auth is given: the app's options, and what the construct
+   * owns — its secret, its URL, its tenant's connection, the origins and cookie
+   * domain its graph derives. One place, so the server and its migrations are
+   * built from the same options.
+   */
+  private optionsFor;
+}
+/** A magic link moved to the device address when an app is its destination. */
+declare function deviceLink(url: string, deviceUrl: string): string;
+/** A mobile app depends on this auth server, which has no Expo plugin. */
+declare class ExpoPluginRequired extends Error {
+  readonly server: string;
+  /** The schemes the graph says call it — what made the plugin necessary. */
+  readonly origins: readonly string[];
+  constructor(server: string,
+  /** The schemes the graph says call it — what made the plugin necessary. */
+  origins: readonly string[]);
+}
+/** The auth server answered a session check with a failure. */
+declare class SessionCheckFailed extends Error {
+  readonly authenticator: string;
+  readonly status: number;
+  constructor(authenticator: string, status: number);
+}
+/** A session check never reached the auth server. */
+declare class AuthServerUnreachable extends Error {
+  readonly authenticator: string;
+  readonly url: string;
+  constructor(authenticator: string, url: string, cause: unknown);
+}
+/**
+ * Better Auth's DDL, safe to run where its tables already exist.
+ *
+ * Its SQL is Kysely's, so its shape is known: `create table "…"`, `create index
+ * "…"`, `alter table "…" add column "…"`. A database that has been running
+ * already has those — Better Auth used to create them at runtime — and the
+ * first committed migration would fail on them rather than recording that they
+ * are there.
+ */
+declare function idempotent(statements: string): string;
+/**
+ * `request`, without {@link CLIENT_IP_HEADER} unless an internal caller sent
+ * it — no `Origin`, no forwarding header, a loopback or private peer: the
+ * rule a request's span continues a trace by (`@geekmidas/telescope`'s
+ * `isInternalCaller`).
+ *
+ * The stack's own edges strip the header already. This holds wherever one
+ * does not — a platform's proxy, a port published straight to the internet —
+ * so a stranger cannot pick the address Better Auth rate-limits them by.
+ */
+declare function withTrustedClientIp(request: Request, remoteAddress: string | undefined): Request;
+//#endregion
+export { BetterAuth as a, BetterAuthOptionsContext as c, deviceLink as d, idempotent as f, AuthSession as i, ExpoPluginRequired as l, AuthServer as n, BetterAuthConfig as o, withTrustedClientIp as p, AuthServerUnreachable as r, BetterAuthOptions as s, AuthClient as t, SessionCheckFailed as u };
+//# sourceMappingURL=auth-CcuceLYo.d.mts.map

package/dist/auth-CcuceLYo.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-CcuceLYo.d.mts","names":[],"sources":["../src/auth.ts"],"mappings":";;;;;;;;;KA2DY,aAAa,kBAAkB;;KAG/B,cAAc;;;;;;;;;;UAWT;WACP;;;;;;;;;;;IAWR,WAAW;MACV,SAAS,6BAA6B;QACnC,QAAQ;;;;KAKF,oBAAoB,KAC/B,kBAAkB;;;;;;KASP,yBAAyB,uBAAuB,gBAC3D;EACC,UAAU,kBAAkB,WAAW;;UAGxB,iBAChB,kBAAkB,YAClB,uBAAuB;;;;;;;;EASvB,UAAU;;;;;;;;EAQV;;;;;;EAMA;;;;;;;EAOA;;;;;;;;;;;;EAYA,YAAY;;;;;;EAMZ,YAAY;;;;;;;;EAQZ,UACG,sBAEA,SAAS,yBAAyB,WAC7B,oBAAoB,QAAQ;;cAKxB,WACZ,+BACA,kBAAkB,aAAa,kBACzB,uBAAuB,uCACjB,UAAU,OAAO,aAAa,cAAc;mBA+BtC;WA7BT,IAAI;;;;;;;;;;;;WAYJ,SAAS,QAAQ,aAAa,QAAQ;WACtC;;;;;mBAMQ;EAQjB,YACC,IAAI,cAAc,QACD,QAAQ,iBAAiB,WAAW;;;;;;;;;;;;;;;EAuCtD,WAAW;;;;;;;;EAgDL,OACL,SAAS,SACT,WAAW,wBACT,QAAQ;;;;;;;;EAWX,OAAO,WAAW,wBAAwB;;;;;MAkBtC;;;;;;;;;;;;;EAgBE,iBACL,SAAS,yBACP;;;;;;;;;;;;;;;;;;;;;;;;;EAsDG,OACL,SAAS,yBACP;IAAU,KAAK;IAAM,MAAM;;;;;;;EAsDxB,UAAU,SAAS,yBAAyB;;UAMpC;UAuBA;;;;;;;UAmBA;;;iBA8JC,WAAW,aAAa;;cAY3B,2BAA2B;WAE7B;;WAEA;EAHV,YACU,gBAEA;;EAAA;;;cAiEE,2BAA2B;WAE7B;WACA;EAFV,YACU,uBACA;;;cAYE,8BAA8B;WAEhC;WACA;EAFV,YACU,uBACA,aACT;;;;;;;;;;;iBAqBc,WAAW;;;;;;;;;;;iBAgCX,oBACf,SAAS,SACT,oCACE"}