@kabyeon/nexusjs 0.6.5

package/dist/auth/auth.controller.d.ts

@@ -0,0 +1,175 @@
+/**
+ * `AuthController` — built-in controller exposing common auth endpoints.
+ *
+ * Mount it in any `@Module` to get a working auth API:
+ *
+ *   @Module({
+ *     controllers: [AuthController],
+ *     providers: [AuthService],
+ *   })
+ *   export class AuthModule {}
+ *
+ * Endpoints (all prefixed with `config.basePath`, default `/api/auth`):
+ *   - GET  /session               → current session
+ *   - POST /sign-up/email         → email/password registration
+ *   - POST /sign-in/email         → email/password login
+ *   - POST /sign-out              → invalidate session
+ *   - GET  /sign-in/:provider     → start OAuth flow
+ *   - GET  /callback/:provider    → OAuth callback
+ *   - POST /jwt                   → issue JWT (JWT plugin only)
+ *   - POST /passkey/register      → start passkey registration
+ *   - POST /passkey/authenticate  → complete passkey auth
+ *
+ * Most of the actual logic is delegated to `auth.handler` from
+ * better-auth. The controller exists to make the routes visible to
+ * `nx route:list` and to add NexusJS-style DI.
+ */
+import type { Context } from "hono";
+import { AuthService } from "./auth.service.js";
+export declare class AuthController {
+    private readonly auth;
+    constructor(auth: AuthService);
+    /**
+     * GET /api/auth/session
+     * Returns the current session (or null if unauthenticated).
+     */
+    session(c: Context): Promise<Response & import("hono").TypedResponse<{
+        user: {
+            [x: string]: import("hono/utils/types").JSONValue;
+            id: string;
+            email: string;
+            emailVerified: boolean;
+            name: string;
+            image?: string | null | undefined;
+            createdAt: string;
+            updatedAt: string;
+        };
+        session: {
+            [x: string]: import("hono/utils/types").JSONValue;
+            id: string;
+            userId: string;
+            token: string;
+            expiresAt: string;
+            ipAddress?: string | null | undefined;
+            userAgent?: string | null | undefined;
+            createdAt: string;
+            updatedAt: string;
+        };
+    } | {
+        user: null;
+        session: null;
+    }, import("hono/utils/http-status").ContentfulStatusCode, "json">>;
+    /**
+     * POST /api/auth/sign-up/email
+     * Body: { email, password, name, callbackURL? }
+     */
+    signUpEmail(c: Context, body: any): Promise<Response & import("hono").TypedResponse<{
+        token: null;
+        user: {
+            id: string;
+            createdAt: string;
+            updatedAt: string;
+            email: string;
+            emailVerified: boolean;
+            name: string;
+            image?: string | null | undefined | undefined;
+        };
+    } | {
+        token: string;
+        user: {
+            id: string;
+            createdAt: string;
+            updatedAt: string;
+            email: string;
+            emailVerified: boolean;
+            name: string;
+            image?: string | null | undefined | undefined;
+        };
+    }, 201, "json">>;
+    /**
+     * POST /api/auth/sign-in/email
+     * Body: { email, password, callbackURL? }
+     */
+    signInEmail(c: Context, body: any): Promise<Response & import("hono").TypedResponse<{
+        redirect: boolean;
+        token: string;
+        url?: string | undefined | undefined;
+        user: {
+            id: string;
+            createdAt: string;
+            updatedAt: string;
+            email: string;
+            emailVerified: boolean;
+            name: string;
+            image?: string | null | undefined | undefined;
+        };
+    }, import("hono/utils/http-status").ContentfulStatusCode, "json">>;
+    /**
+     * POST /api/auth/sign-out
+     */
+    signOut(c: Context, _res: Response): Promise<Response & import("hono").TypedResponse<{
+        ok: true;
+    }, import("hono/utils/http-status").ContentfulStatusCode, "json">>;
+    /**
+     * GET /api/auth/sign-in/:provider
+     * Returns a redirect to the social provider's auth page.
+     */
+    socialSignIn(c: Context, _body: never): Promise<Response & import("hono").TypedResponse<{
+        redirect: boolean;
+        url: string;
+    } | {
+        redirect: boolean;
+        token: string;
+        user: {
+            id: string;
+            createdAt: string;
+            updatedAt: string;
+            email: string;
+            emailVerified: boolean;
+            name: string;
+            image?: string | null | undefined | undefined;
+        };
+    }, import("hono/utils/http-status").ContentfulStatusCode, "json">>;
+    /**
+     * GET /api/auth/callback/:provider
+     * Social provider redirect target. The better-auth handler does the
+     * real work; this is a passthrough for `route:list` visibility.
+     */
+    oauthCallback(c: Context): Promise<Response & import("hono").TypedResponse<{
+        redirect: boolean;
+        url: string;
+    } | {
+        redirect: boolean;
+        token: string;
+        user: {
+            id: string;
+            createdAt: string;
+            updatedAt: string;
+            email: string;
+            emailVerified: boolean;
+            name: string;
+            image?: string | null | undefined | undefined;
+        };
+    }, import("hono/utils/http-status").ContentfulStatusCode, "json">>;
+    /**
+     * POST /api/auth/jwt
+     * Issues a JWT for the current user. Requires the JWT plugin.
+     */
+    issueJwt(c: Context): Promise<(Response & import("hono").TypedResponse<{
+        error: string;
+    }, 401, "json">) | (Response & import("hono").TypedResponse<{
+        token: string;
+        expiresAt: string;
+    }, import("hono/utils/http-status").ContentfulStatusCode, "json">)>;
+    /**
+     * POST /api/auth/passkey/register
+     * Start passkey registration. Requires the passkey plugin.
+     */
+    passkeyRegister(c: Context): Promise<Response & import("hono").TypedResponse<import("hono/utils/types").JSONValue, import("hono/utils/http-status").ContentfulStatusCode, "json">>;
+    /**
+     * POST /api/auth/passkey/authenticate
+     * Body: passkey assertion
+     */
+    passkeyAuthenticate(c: Context, body: any): Promise<Response & import("hono").TypedResponse<import("hono/utils/types").JSONValue, import("hono/utils/http-status").ContentfulStatusCode, "json">>;
+}
+//# sourceMappingURL=auth.controller.d.ts.map

package/dist/auth/auth.controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.controller.d.ts","sourceRoot":"","sources":["../../src/auth/auth.controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAWH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACpC,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAGhD,qBACa,cAAc;IACa,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,WAAW;IAEzE;;;OAGG;IAEG,OAAO,CAAQ,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;IAO/B;;;OAGG;IAEG,WAAW,CAAQ,CAAC,EAAE,OAAO,EAAU,IAAI,EAAE,GAAG;;;;;;;;;;;;;;;;;;;;;;;IAKtD;;;OAGG;IAEG,WAAW,CAAQ,CAAC,EAAE,OAAO,EAAU,IAAI,EAAE,GAAG;;;;;;;;;;;;;;IAKtD;;OAEG;IAEG,OAAO,CAAQ,CAAC,EAAE,OAAO,EAAS,IAAI,EAAE,QAAQ;;;IAKtD;;;OAGG;IAEG,YAAY,CACV,CAAC,EAAE,OAAO,EACT,KAAK,EAAE,KAAK;;;;;;;;;;;;;;;;IAQrB;;;;OAIG;IAEG,aAAa,CAAQ,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;IAQrC;;;OAGG;IAEG,QAAQ,CAAQ,CAAC,EAAE,OAAO;;;;;;IAShC;;;OAGG;IAEG,eAAe,CAAQ,CAAC,EAAE,OAAO;IAOvC;;;OAGG;IAEG,mBAAmB,CAAQ,CAAC,EAAE,OAAO,EAAU,IAAI,EAAE,GAAG;CAO9D"}

package/dist/auth/auth.d.ts

@@ -0,0 +1,47 @@
+/**
+ * `createAuth()` — wrap better-auth's `betterAuth()` factory with
+ * NexusJS-friendly defaults.
+ *
+ * This is the **only** place that talks to better-auth directly. Every
+ * other NexusJS auth module consumes the resulting `Auth` instance via
+ * DI or the registered token.
+ *
+ * Why an adapter layer instead of calling `betterAuth()` directly?
+ *   1. NexusJS users write `auth.config.ts`, not raw better-auth options.
+ *      The adapter translates between the two.
+ *   2. Plugin selection (jwt, passkey) is toggled by boolean flags,
+ *      not by importing plugin objects.
+ *   3. Cookie / CORS / cross-subdomain defaults match Hono's `cors()`
+ *      middleware so the two never conflict.
+ *
+ * Usage:
+ *   // src/auth/auth.ts
+ *   import { createAuth } from 'nexusjs/auth';
+ *   export const auth = createAuth({
+ *     basePath: '/api/auth',
+ *     emailAndPassword: { enabled: true },
+ *     socialProviders: {
+ *       github: {
+ *         clientId: process.env.GITHUB_CLIENT_ID!,
+ *         clientSecret: process.env.GITHUB_CLIENT_SECRET!,
+ *       },
+ *     },
+ *   });
+ */
+import { betterAuth } from "better-auth";
+import type { AuthConfig } from "./types.js";
+type BetterAuthInstance = ReturnType<typeof betterAuth>;
+/**
+ * Create a better-auth instance with NexusJS-friendly defaults.
+ *
+ * @param config NexusJS-shaped config (see types.ts).
+ * @returns A `better-auth` Auth instance.
+ */
+export declare function createAuth(config?: AuthConfig): BetterAuthInstance;
+/**
+ * Type alias for the returned auth instance — convenient for DI token
+ * typings.
+ */
+export type NexusAuth = ReturnType<typeof createAuth>;
+export {};
+//# sourceMappingURL=auth.d.ts.map

package/dist/auth/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/auth/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C,KAAK,kBAAkB,GAAG,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC;AAExD;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,MAAM,GAAE,UAAe,GAAG,kBAAkB,CAuFtE;AAED;;;GAGG;AACH,MAAM,MAAM,SAAS,GAAG,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC"}

package/dist/auth/auth.module.d.ts

@@ -0,0 +1,34 @@
+/**
+ * `AuthModule` — drop-in module for adding auth to any NexusJS app.
+ *
+ * Usage:
+ *   // src/app/app.module.ts
+ *   @Module({
+ *     imports: [AuthModule.forRoot({ ... })],
+ *   })
+ *   export class AppModule {}
+ *
+ * The `forRoot` static factory builds a one-off `AuthModule` subclass
+ * pre-configured with the user's `auth` config. The provider token
+ * `'AUTH_CONFIG'` carries the config to the `AuthService` constructor.
+ *
+ * AuthService is registered under **both** its class token and
+ * `AuthService.TOKEN` (a Symbol). The class token is what the
+ * container scans; the Symbol is what `@Inject(AuthService.TOKEN)`
+ * looks up. Both resolve to the same instance via `useExisting`.
+ */
+import "reflect-metadata";
+import type { AuthConfig } from "./types.js";
+export declare class AuthModule {
+    /**
+     * Build a configured `AuthModule` class with the given config.
+     *
+     * The returned class can be `imports`-ed by any other module and
+     * will provide the `AuthService` (and a `AUTH_CONFIG` value
+     * provider) to its container.
+     */
+    static forRoot(config: AuthConfig): {
+        new (): {};
+    };
+}
+//# sourceMappingURL=auth.module.d.ts.map

package/dist/auth/auth.module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.module.d.ts","sourceRoot":"","sources":["../../src/auth/auth.module.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,kBAAkB,CAAC;AAI1B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C,qBAQa,UAAU;IACtB;;;;;;OAMG;IACH,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU;;;CAmBjC"}

package/dist/auth/auth.service.d.ts

@@ -0,0 +1,192 @@
+/**
+ * `AuthService` — DI-friendly wrapper around a better-auth instance.
+ *
+ * Why a service wrapper?
+ *   - Hides the raw better-auth object behind a stable NexusJS API.
+ *   - Exposes the high-level operations controllers need:
+ *     signUp, signIn, signOut, getSession, oauthUrl, jwt, passkey.
+ *   - Allows tests to swap the implementation via DI.
+ *
+ * Usage:
+ *   constructor(@Inject(AuthService.TOKEN) private auth: AuthService) {}
+ *
+ *   await this.auth.signUp.email({ email, password, name });
+ *   const session = await this.auth.getSession({ headers: c.req.raw.headers });
+ *   return this.auth.redirect('/dashboard');  // 302
+ */
+import type { AuthUser, AuthSessionRecord, AuthSession, AuthConfig } from "./types.js";
+import { type NexusAuth } from "./auth.js";
+import type { SessionService } from "../session/index.js";
+export declare class AuthService {
+    #private;
+    private readonly config;
+    /** DI token — use with `@Inject(AuthService.TOKEN)`. */
+    static readonly TOKEN: unique symbol;
+    /** The underlying better-auth instance. */
+    readonly instance: NexusAuth;
+    constructor(config: AuthConfig);
+    /**
+     * Bind a SessionService. When bound, `getSession()` consults the
+     * SessionService first and falls back to better-auth. Returns `this`
+     * for chaining.
+     */
+    bindSession(sessionService: SessionService): this;
+    /**
+     * Returns true when a SessionService has been bound.
+     */
+    hasSessionBinding(): boolean;
+    /**
+     * Get the current session from a request. Returns `null` if not
+     * authenticated.
+     *
+     * When a SessionService is bound, we try it first (cookie-based,
+     * stateless, edge-friendly); better-auth remains the source of
+     * truth for `user` / `session` records. The cookie value carries
+     * `userId` which lets you cross-reference both systems.
+     */
+    getSession(input: {
+        headers: Headers;
+    }): Promise<AuthSession>;
+    /**
+     * Read the raw SessionService record from a request (no better-auth
+     * lookup). Returns null when no SessionService is bound or no
+     * session is found.
+     */
+    getRawSession(input: {
+        headers: Headers;
+    }): Promise<import("../session/types.js").SessionRecord<Record<string, unknown>> | null>;
+    /**
+     * Email + password sign-up. Throws if email/password is disabled
+     * in the auth config.
+     */
+    signUp(input: {
+        email: string;
+        password: string;
+        name: string;
+        image?: string;
+        callbackURL?: string;
+    }): Promise<{
+        token: null;
+        user: {
+            id: string;
+            createdAt: Date;
+            updatedAt: Date;
+            email: string;
+            emailVerified: boolean;
+            name: string;
+            image?: string | null | undefined | undefined;
+        };
+    } | {
+        token: string;
+        user: {
+            id: string;
+            createdAt: Date;
+            updatedAt: Date;
+            email: string;
+            emailVerified: boolean;
+            name: string;
+            image?: string | null | undefined | undefined;
+        };
+    }>;
+    /** Email + password sign-in. */
+    signIn(input: {
+        email: string;
+        password: string;
+        callbackURL?: string;
+    }): Promise<{
+        redirect: boolean;
+        token: string;
+        url?: string | undefined;
+        user: {
+            id: string;
+            createdAt: Date;
+            updatedAt: Date;
+            email: string;
+            emailVerified: boolean;
+            name: string;
+            image?: string | null | undefined | undefined;
+        };
+    }>;
+    /** Sign out — invalidates the current session. */
+    signOut(input: {
+        headers: Headers;
+    }): Promise<{
+        success: boolean;
+    }>;
+    /**
+     * Get the URL the client should redirect to for a social sign-in.
+     */
+    getOAuthUrl(input: {
+        provider: string;
+        callbackURL?: string;
+    }): Promise<{
+        redirect: boolean;
+        url: string;
+    } | {
+        redirect: boolean;
+        token: string;
+        url: undefined;
+        user: {
+            id: string;
+            createdAt: Date;
+            updatedAt: Date;
+            email: string;
+            emailVerified: boolean;
+            name: string;
+            image?: string | null | undefined | undefined;
+        };
+    }>;
+    /**
+     * Sign in / link a social account and return the user.
+     */
+    handleOAuthCallback(input: {
+        headers: Headers;
+        query: Record<string, string>;
+    }): Promise<{
+        redirect: boolean;
+        url: string;
+    } | {
+        redirect: boolean;
+        token: string;
+        url: undefined;
+        user: {
+            id: string;
+            createdAt: Date;
+            updatedAt: Date;
+            email: string;
+            emailVerified: boolean;
+            name: string;
+            image?: string | null | undefined | undefined;
+        };
+    }>;
+    /**
+     * Issue a JWT for the currently-authenticated user. Returns
+     * `{ token, expiresAt }`. Requires the JWT plugin (`config.jwt.enabled`).
+     */
+    issueJwt(input: {
+        userId: string;
+    }): Promise<{
+        token: string;
+        expiresAt: Date;
+    }>;
+    registerPasskey(input: {
+        headers: Headers;
+    }): Promise<unknown>;
+    authenticatePasskey(input: {
+        headers: Headers;
+        body: unknown;
+    }): Promise<unknown>;
+    /**
+     * Build a redirect Response. Used by controllers that need to send
+     * the user to a different page after sign-in / sign-up.
+     */
+    redirect(to: string, status?: 302 | 303 | 307 | 308): Response;
+    /**
+     * Convert a session into the `AuthVariables` shape Hono expects.
+     */
+    toContextVariables(session: AuthSession): {
+        user: AuthUser | null;
+        session: AuthSessionRecord | null;
+    };
+}
+//# sourceMappingURL=auth.service.d.ts.map

package/dist/auth/auth.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.service.d.ts","sourceRoot":"","sources":["../../src/auth/auth.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,KAAK,EACX,QAAQ,EACR,iBAAiB,EACjB,WAAW,EACX,UAAU,EACV,MAAM,YAAY,CAAC;AACpB,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,WAAW,CAAC;AACvD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAE1D,qBACa,WAAW;;IAmBC,OAAO,CAAC,QAAQ,CAAC,MAAM;IAlB/C,wDAAwD;IACxD,MAAM,CAAC,QAAQ,CAAC,KAAK,gBAAmC;IAExD,2CAA2C;IAC3C,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC;gBAcY,MAAM,EAAE,UAAU;IAW3D;;;;OAIG;IACH,WAAW,CAAC,cAAc,EAAE,cAAc,GAAG,IAAI;IAKjD;;OAEG;IACH,iBAAiB,IAAI,OAAO;IAQ5B;;;;;;;;OAQG;IACG,UAAU,CAAC,KAAK,EAAE;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,WAAW,CAAC;IA8BnE;;;;OAIG;IACG,aAAa,CAAC,KAAK,EAAE;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE;IAc/C;;;OAGG;IACG,MAAM,CAAC,KAAK,EAAE;QACnB,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,WAAW,CAAC,EAAE,MAAM,CAAC;KACrB;;;;;;;;;;;;;;;;;;;;;;;IAMD,gCAAgC;IAC1B,MAAM,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE;;;;;;;;;;;;;;IAM7E,kDAAkD;IAC5C,OAAO,CAAC,KAAK,EAAE;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE;;;IAUzC;;OAEG;IACG,WAAW,CAAC,KAAK,EAAE;QACxB,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,CAAC,EAAE,MAAM,CAAC;KACrB;;;;;;;;;;;;;;;;;IAMD;;OAEG;IACG,mBAAmB,CAAC,KAAK,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE;;;;;;;;;;;;;;;;;IAYpF;;;OAGG;IACG,QAAQ,CAAC,KAAK,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE;eAG9B,MAAM;mBACF,IAAI;;IAeZ,eAAe,CAAC,KAAK,EAAE;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE;IAc3C,mBAAmB,CAAC,KAAK,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE;IAgBpE;;;OAGG;IACH,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,GAAE,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAS,GAAG,QAAQ;IAInE;;OAEG;IACH,kBAAkB,CAAC,OAAO,EAAE,WAAW,GAAG;QACzC,IAAI,EAAE,QAAQ,GAAG,IAAI,CAAC;QACtB,OAAO,EAAE,iBAAiB,GAAG,IAAI,CAAC;KAClC;CAID"}

package/dist/auth/decorators/current-user.d.ts

@@ -0,0 +1,58 @@
+/**
+ * `@CurrentUser()` — controller parameter decorator that injects the
+ * authenticated user (and optionally the session) into a handler.
+ *
+ * Usage:
+ *   @Get('/me')
+ *   me(@CurrentUser() user: AuthUser) {
+ *     return user;
+ *   }
+ *
+ *   @Get('/profile')
+ *   profile(@CurrentUser({ session: true }) ctx: { user: AuthUser; session: AuthSessionRecord }) {
+ *     return ctx;
+ *   }
+ *
+ *   @Get('/dashboard')
+ *   dashboard(@CurrentUser({ required: true }) user: AuthUser) {
+ *     // 401 is thrown before the handler if no user is present.
+ *     return this.dashboardService.forUser(user.id);
+ *   }
+ */
+import "reflect-metadata";
+import type { AuthUser, AuthSessionRecord } from "../types.js";
+export interface CurrentUserOptions {
+    /**
+     * Include the session in the injected value. Default: `false`.
+     * When true, the value is `{ user, session }` instead of just the user.
+     */
+    session?: boolean;
+    /**
+     * Throw 401 if no user is present. Default: `false`.
+     * When true, the framework returns a 401 response without invoking
+     * the handler.
+     */
+    required?: boolean;
+    /**
+     * Throw 403 if the user does not satisfy the predicate.
+     */
+    assert?: (user: AuthUser) => boolean | Promise<boolean>;
+}
+/**
+ * Inject the authenticated user (or `{ user, session }` if `session: true`).
+ */
+export declare function CurrentUser(options?: CurrentUserOptions): ParameterDecorator;
+/**
+ * Convenience: throw 401 with a JSON body when no user is present.
+ * Exposed for users who want to enforce auth inside the handler.
+ */
+export declare class UnauthenticatedError extends Error {
+    readonly status = 401;
+    constructor(message?: string);
+}
+export declare class ForbiddenError extends Error {
+    readonly status = 403;
+    constructor(message?: string);
+}
+export type { AuthSessionRecord as AuthSession };
+//# sourceMappingURL=current-user.d.ts.map

package/dist/auth/decorators/current-user.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"current-user.d.ts","sourceRoot":"","sources":["../../../src/auth/decorators/current-user.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,kBAAkB,CAAC;AAG1B,OAAO,KAAK,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAE/D,MAAM,WAAW,kBAAkB;IAClC;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;OAEG;IACH,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,QAAQ,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACxD;AAED;;GAEG;AACH,wBAAgB,WAAW,CAC1B,OAAO,GAAE,kBAAuB,GAC9B,kBAAkB,CAEpB;AAED;;;GAGG;AACH,qBAAa,oBAAqB,SAAQ,KAAK;IAC9C,QAAQ,CAAC,MAAM,OAAO;gBACV,OAAO,SAA6B;CAIhD;AAED,qBAAa,cAAe,SAAQ,KAAK;IACxC,QAAQ,CAAC,MAAM,OAAO;gBACV,OAAO,SAA8B;CAIjD;AAGD,YAAY,EAAE,iBAAiB,IAAI,WAAW,EAAE,CAAC"}

package/dist/auth/index.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Public API for the NexusJS auth module.
+ *
+ * This is a thin layer over `better-auth` — it does not re-implement
+ * any auth primitives. It adapts better-auth's surface to NexusJS's
+ * DI / decorator model.
+ *
+ * Quick start:
+ *
+ *   // src/auth/auth.ts
+ *   import { createAuth } from 'nexusjs/auth';
+ *   export const auth = createAuth({
+ *     emailAndPassword: { enabled: true },
+ *     socialProviders: { github: { clientId: '...', clientSecret: '...' } },
+ *   });
+ *
+ *   // src/app/app.module.ts
+ *   import { Module } from 'nexusjs';
+ *   import { AuthModule } from 'nexusjs/auth';
+ *
+ *   @Module({ imports: [AuthModule.forRoot({ ... })] })
+ *   export class AppModule {}
+ *
+ *   // any controller
+ *   import { CurrentUser } from 'nexusjs/auth';
+ *
+ *   @Controller('/profile')
+ *   class ProfileController {
+ *     @Get('/')
+ *     me(@CurrentUser({ required: true }) user) {
+ *       return user;
+ *     }
+ *   }
+ */
+export * from "./types.js";
+export { createAuth } from "./auth.js";
+export type { NexusAuth } from "./auth.js";
+export { AuthService } from "./auth.service.js";
+export { AuthController } from "./auth.controller.js";
+export { AuthModule } from "./auth.module.js";
+export { authMiddleware, authHandler, type AuthMiddlewareMode, type AuthMiddlewareOptions, } from "./middleware.js";
+export { CurrentUser, UnauthenticatedError, ForbiddenError, type CurrentUserOptions, } from "./decorators/current-user.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,cAAc,YAAY,CAAC;AAC3B,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,YAAY,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EACN,cAAc,EACd,WAAW,EACX,KAAK,kBAAkB,EACvB,KAAK,qBAAqB,GAC1B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACN,WAAW,EACX,oBAAoB,EACpB,cAAc,EACd,KAAK,kBAAkB,GACvB,MAAM,8BAA8B,CAAC"}