@procedures/better-auth 0.0.0-bootstrap.0 → 0.12.1

package/dist/auth.d.ts

@@ -0,0 +1,22 @@
+import type { Db, MongoClient } from "mongodb";
+import type { BetterAuthConfig } from "./config.js";
+/**
+ * The parts of a Better Auth server that an app uses. Mount `handler` on `config.basePath`, for
+ * example with `toNodeHandler` of `better-auth/node`. `SessionPrincipals` reads `api.getSession`.
+ */
+export interface BetterAuthServer {
+    /** The handler of the auth routes. */
+    readonly handler: (request: Request) => Promise<Response>;
+    readonly api: {
+        /** The session and the user of the cookies of a request, or null. */
+        getSession(context: {
+            headers: Headers;
+        }): Promise<{
+            user: Record<string, unknown>;
+            session: Record<string, unknown>;
+        } | null>;
+    };
+}
+/** This function makes the Better Auth server of a configuration. */
+export declare function createBetterAuth(db: Db, client: MongoClient, config: BetterAuthConfig): BetterAuthServer;
+//# sourceMappingURL=auth.d.ts.map

package/dist/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEpD;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,sCAAsC;IACtC,QAAQ,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC1D,QAAQ,CAAC,GAAG,EAAE;QACZ,qEAAqE;QACrE,UAAU,CAAC,OAAO,EAAE;YAAE,OAAO,EAAE,OAAO,CAAA;SAAE,GAAG,OAAO,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;SAAE,GAAG,IAAI,CAAC,CAAC;KAChI,CAAC;CACH;AAED,qEAAqE;AACrE,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,gBAAgB,GAAG,gBAAgB,CAyBxG"}

package/dist/auth.js

@@ -0,0 +1,40 @@
+/**
+ * A Better Auth server over MongoDB: the sign-in with GitHub and Google, the sessions in `httpOnly`
+ * cookies, the groups (the organization plugin) and the passkeys (WebAuthn). The app stores no
+ * password. Better Auth does the OAuth state, PKCE and the CSRF checks.
+ *
+ * Give Better Auth its own database: its `user` collection must not mix with the data of the app.
+ * The app mounts `auth.handler` on `config.basePath`: the routes belong to the app.
+ */
+import { betterAuth } from "better-auth";
+import { mongodbAdapter } from "better-auth/adapters/mongodb";
+import { organization } from "better-auth/plugins";
+import { passkey } from "@better-auth/passkey";
+/** This function makes the Better Auth server of a configuration. */
+export function createBetterAuth(db, client, config) {
+    const testHooks = {
+        user: {
+            create: {
+                before: async (user) => ({ data: { ...user, emailVerified: true } }),
+            },
+        },
+    };
+    return betterAuth({
+        appName: config.appName,
+        basePath: config.basePath,
+        baseURL: config.baseURL,
+        secret: config.secret,
+        database: mongodbAdapter(db, { client }),
+        trustedOrigins: [...config.trustedOrigins],
+        socialProviders: {
+            ...(config.github ? { github: { ...config.github } } : {}),
+            ...(config.google ? { google: { ...config.google } } : {}),
+        },
+        emailAndPassword: { enabled: config.testAccounts },
+        // A test account has no email check: the test server trusts its email
+        ...(config.testAccounts ? { databaseHooks: testHooks } : {}),
+        // The passkeys expect the origins of the app, not the Origin header of each request
+        plugins: [organization(), passkey({ rpID: config.rpID, rpName: config.appName, origin: [...config.trustedOrigins] })],
+    });
+}
+//# sourceMappingURL=auth.js.map

package/dist/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAiB/C,qEAAqE;AACrE,MAAM,UAAU,gBAAgB,CAAC,EAAM,EAAE,MAAmB,EAAE,MAAwB;IACpF,MAAM,SAAS,GAAG;QAChB,IAAI,EAAE;YACJ,MAAM,EAAE;gBACN,MAAM,EAAE,KAAK,EAAE,IAA6B,EAA8C,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,EAAE,CAAC;aAC1I;SACF;KACF,CAAC;IACF,OAAO,UAAU,CAAC;QAChB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,QAAQ,EAAE,cAAc,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;QACxC,cAAc,EAAE,CAAC,GAAG,MAAM,CAAC,cAAc,CAAC;QAC1C,eAAe,EAAE;YACf,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3D;QACD,gBAAgB,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,YAAY,EAAE;QAClD,sEAAsE;QACtE,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,oFAAoF;QACpF,OAAO,EAAE,CAAC,YAAY,EAAE,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;KACtH,CAAC,CAAC;AACL,CAAC"}

package/dist/config.d.ts

@@ -0,0 +1,46 @@
+/**
+ * The configuration of a Better Auth server from the environment.
+ *
+ * - `BETTER_AUTH_SECRET`: the secret that signs the session cookies (16 characters or more).
+ * - `AUTH_BASE_URL`: the public origin of the server (default `http://localhost:<port>`).
+ * - `GITHUB_CLIENT_ID` and `GITHUB_CLIENT_SECRET`: the sign-in with GitHub.
+ * - `GOOGLE_CLIENT_ID` and `GOOGLE_CLIENT_SECRET`: the sign-in with Google.
+ * - `AUTH_TEST_ACCOUNTS=1`: accounts with an email and a password, for the tests. Production refuses it.
+ * - `PASSKEY_RP_ID`: the domain of the passkeys (default: the host of the first trusted origin).
+ */
+/** The client id and the secret of an OAuth provider. */
+export interface OAuthClient {
+    readonly clientId: string;
+    readonly clientSecret: string;
+}
+/** The configuration that `createBetterAuth` reads. */
+export interface BetterAuthConfig {
+    /** The name of the app. Passkeys show it. */
+    readonly appName: string;
+    /** The path of the auth routes (default `/auth`). */
+    readonly basePath: string;
+    readonly secret: string;
+    readonly baseURL: string;
+    /** The origins of the app. The CSRF checks and the passkeys accept only these origins. */
+    readonly trustedOrigins: readonly string[];
+    readonly github?: OAuthClient | undefined;
+    readonly google?: OAuthClient | undefined;
+    /** Accounts with an email and a password, for the tests. Their email counts as verified. */
+    readonly testAccounts: boolean;
+    /** The relying party of the passkeys: a domain of the origins of the app. */
+    readonly rpID: string;
+}
+/** The options of `betterAuthConfig`. */
+export interface BetterAuthConfigOptions {
+    /** The port of the server, for the default base URL. */
+    readonly port: number;
+    /** The origins of the app. */
+    readonly trustedOrigins: readonly string[];
+    /** The name of the app (default "App"). */
+    readonly appName?: string | undefined;
+    /** The path of the auth routes (default `/auth`). */
+    readonly basePath?: string | undefined;
+}
+/** This function reads the configuration from the environment. It gives a message when the server cannot start. */
+export declare function betterAuthConfig(env: Readonly<Record<string, string | undefined>>, options: BetterAuthConfigOptions): BetterAuthConfig | string;
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,yDAAyD;AACzD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,uDAAuD;AACvD,MAAM,WAAW,gBAAgB;IAC/B,6CAA6C;IAC7C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,qDAAqD;IACrD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,0FAA0F;IAC1F,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;IAC1C,4FAA4F;IAC5F,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,6EAA6E;IAC7E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,yCAAyC;AACzC,MAAM,WAAW,uBAAuB;IACtC,wDAAwD;IACxD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,8BAA8B;IAC9B,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,2CAA2C;IAC3C,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,qDAAqD;IACrD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACxC;AAED,mHAAmH;AACnH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,EAAE,OAAO,EAAE,uBAAuB,GAAG,gBAAgB,GAAG,MAAM,CA4B/I"}

package/dist/config.js

@@ -0,0 +1,44 @@
+/**
+ * The configuration of a Better Auth server from the environment.
+ *
+ * - `BETTER_AUTH_SECRET`: the secret that signs the session cookies (16 characters or more).
+ * - `AUTH_BASE_URL`: the public origin of the server (default `http://localhost:<port>`).
+ * - `GITHUB_CLIENT_ID` and `GITHUB_CLIENT_SECRET`: the sign-in with GitHub.
+ * - `GOOGLE_CLIENT_ID` and `GOOGLE_CLIENT_SECRET`: the sign-in with Google.
+ * - `AUTH_TEST_ACCOUNTS=1`: accounts with an email and a password, for the tests. Production refuses it.
+ * - `PASSKEY_RP_ID`: the domain of the passkeys (default: the host of the first trusted origin).
+ */
+/** This function reads the configuration from the environment. It gives a message when the server cannot start. */
+export function betterAuthConfig(env, options) {
+    const secret = env["BETTER_AUTH_SECRET"] ?? "";
+    if (secret.length < 16)
+        return "BETTER_AUTH_SECRET must have 16 characters or more";
+    if (env["NODE_ENV"] === "production" && env["AUTH_TEST_ACCOUNTS"] === "1")
+        return "AUTH_TEST_ACCOUNTS is refused in production";
+    const pair = (id, key) => {
+        const clientId = env[id];
+        const clientSecret = env[key];
+        return clientId && clientSecret ? { clientId, clientSecret } : undefined;
+    };
+    let firstHost = "localhost";
+    try {
+        firstHost = new URL(options.trustedOrigins[0] ?? "http://localhost").hostname;
+    }
+    catch {
+        // An origin that is not a URL: the passkeys use localhost
+    }
+    const github = pair("GITHUB_CLIENT_ID", "GITHUB_CLIENT_SECRET");
+    const google = pair("GOOGLE_CLIENT_ID", "GOOGLE_CLIENT_SECRET");
+    return {
+        appName: options.appName ?? "App",
+        basePath: options.basePath ?? "/auth",
+        secret,
+        baseURL: env["AUTH_BASE_URL"] || `http://localhost:${options.port}`,
+        trustedOrigins: options.trustedOrigins,
+        ...(github ? { github } : {}),
+        ...(google ? { google } : {}),
+        testAccounts: env["AUTH_TEST_ACCOUNTS"] === "1",
+        rpID: env["PASSKEY_RP_ID"] || firstHost,
+    };
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAsCH,mHAAmH;AACnH,MAAM,UAAU,gBAAgB,CAAC,GAAiD,EAAE,OAAgC;IAClH,MAAM,MAAM,GAAG,GAAG,CAAC,oBAAoB,CAAC,IAAI,EAAE,CAAC;IAC/C,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE;QAAE,OAAO,oDAAoD,CAAC;IACpF,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,YAAY,IAAI,GAAG,CAAC,oBAAoB,CAAC,KAAK,GAAG;QAAE,OAAO,6CAA6C,CAAC;IAChI,MAAM,IAAI,GAAG,CAAC,EAAU,EAAE,GAAW,EAA2B,EAAE;QAChE,MAAM,QAAQ,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC;QACzB,MAAM,YAAY,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9B,OAAO,QAAQ,IAAI,YAAY,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3E,CAAC,CAAC;IACF,IAAI,SAAS,GAAG,WAAW,CAAC;IAC5B,IAAI,CAAC;QACH,SAAS,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,kBAAkB,CAAC,CAAC,QAAQ,CAAC;IAChF,CAAC;IAAC,MAAM,CAAC;QACP,0DAA0D;IAC5D,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,kBAAkB,EAAE,sBAAsB,CAAC,CAAC;IAChE,MAAM,MAAM,GAAG,IAAI,CAAC,kBAAkB,EAAE,sBAAsB,CAAC,CAAC;IAChE,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,KAAK;QACjC,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,OAAO;QACrC,MAAM;QACN,OAAO,EAAE,GAAG,CAAC,eAAe,CAAC,IAAI,oBAAoB,OAAO,CAAC,IAAI,EAAE;QACnE,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,YAAY,EAAE,GAAG,CAAC,oBAAoB,CAAC,KAAK,GAAG;QAC/C,IAAI,EAAE,GAAG,CAAC,eAAe,CAAC,IAAI,SAAS;KACxC,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,6 @@
+export * from "./types.js";
+export * from "./config.js";
+export * from "./auth.js";
+export * from "./principals.js";
+export * from "./principal-of.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,WAAW,CAAC;AAC1B,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC"}

package/dist/index.js

@@ -0,0 +1,6 @@
+export * from "./types.js";
+export * from "./config.js";
+export * from "./auth.js";
+export * from "./principals.js";
+export * from "./principal-of.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,WAAW,CAAC;AAC1B,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC"}

package/dist/principal-of.d.ts

@@ -0,0 +1,51 @@
+/**
+ * The request hook of a procedures server (`principalOf`) over Better Auth. It gives the principal
+ * of a network request:
+ *
+ * - The agent token in the bearer token: the principal `agent`. With the act-as header, the agent
+ *   acts for that user, with the rights of the user and no more. The `actAs` policy tells for whom.
+ *   Without the policy, the hook refuses each act-as request.
+ * - Else the session cookie: the principal of the signed-in user.
+ * - Else the anonymous principal with the `anonymous` narrowing. Without that option, the hook gives
+ *   no principal, and the server refuses the request.
+ *
+ * A bearer token that is not the agent token goes on to the token check of the server. A server
+ * with this hook sets no `token`: its token check runs after the hook, and a cookie session has no
+ * bearer token.
+ */
+import { type CapabilityRequest, type Credentials, type PrincipalOf } from "@procedures/client";
+import type { SessionPrincipals, SignedInUser } from "./principals.js";
+/** The `via` of each principal that the hook gives. */
+export declare const VIA: {
+    readonly session: "better-auth";
+    readonly agent: "agent-token";
+    readonly agentAs: "agent-as";
+    readonly anonymous: "anonymous";
+};
+/** The id of the principal of the agent token. */
+export declare const AGENT_ID = "agent";
+/** The id of the principal of a request without a user. */
+export declare const ANONYMOUS_ID = "anonymous";
+/** The policy of act-as: true when the agent can act for this user. */
+export type ActAsPolicy = (user: SignedInUser, credentials: Credentials) => boolean | Promise<boolean>;
+/** The options of `betterAuthPrincipalOf`. */
+export interface BetterAuthPrincipalOfOptions {
+    /** The users of the sessions. */
+    readonly principals: SessionPrincipals;
+    /** The token of the agent. Without it, no request is the agent. */
+    readonly agentToken?: string | undefined;
+    /** The header that names the user for whom the agent acts (default `x-act-as`). */
+    readonly actAsHeader?: string | undefined;
+    /** For whom the agent can act. Without it, the hook refuses each act-as request. */
+    readonly actAs?: ActAsPolicy | undefined;
+    /**
+     * The narrowing of a request without a user (for example `{ effects: { writes: [] } }` for read
+     * only). Without it (the default), the hook gives no principal, and the server refuses the request.
+     */
+    readonly anonymous?: CapabilityRequest | false | undefined;
+}
+/** This function makes the headers of a request from its credentials, for the session lookup. */
+export declare function headersOf(credentials: Credentials): Headers;
+/** This function gives the request hook of a procedures server over Better Auth. */
+export declare function betterAuthPrincipalOf(options: BetterAuthPrincipalOfOptions): PrincipalOf;
+//# sourceMappingURL=principal-of.d.ts.map

package/dist/principal-of.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"principal-of.d.ts","sourceRoot":"","sources":["../src/principal-of.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAgB,KAAK,iBAAiB,EAAE,KAAK,WAAW,EAAkB,KAAK,WAAW,EAAwB,MAAM,oBAAoB,CAAC;AACpJ,OAAO,KAAK,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAEvE,uDAAuD;AACvD,eAAO,MAAM,GAAG;aACd,OAAO,EAAE,aAAa;aACtB,KAAK,EAAE,aAAa;aACpB,OAAO,EAAE,UAAU;aACnB,SAAS,EAAE,WAAW;CACd,CAAC;AAEX,kDAAkD;AAClD,eAAO,MAAM,QAAQ,UAAU,CAAC;AAChC,2DAA2D;AAC3D,eAAO,MAAM,YAAY,cAAc,CAAC;AAExC,uEAAuE;AACvE,MAAM,MAAM,WAAW,GAAG,CAAC,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEvG,8CAA8C;AAC9C,MAAM,WAAW,4BAA4B;IAC3C,iCAAiC;IACjC,QAAQ,CAAC,UAAU,EAAE,iBAAiB,CAAC;IACvC,mEAAmE;IACnE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,mFAAmF;IACnF,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,oFAAoF;IACpF,QAAQ,CAAC,KAAK,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;IACzC;;;OAGG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,iBAAiB,GAAG,KAAK,GAAG,SAAS,CAAC;CAC5D;AAOD,iGAAiG;AACjG,wBAAgB,SAAS,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,CAgB3D;AAED,oFAAoF;AACpF,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,4BAA4B,GAAG,WAAW,CA2BxF"}

package/dist/principal-of.js

@@ -0,0 +1,84 @@
+/**
+ * The request hook of a procedures server (`principalOf`) over Better Auth. It gives the principal
+ * of a network request:
+ *
+ * - The agent token in the bearer token: the principal `agent`. With the act-as header, the agent
+ *   acts for that user, with the rights of the user and no more. The `actAs` policy tells for whom.
+ *   Without the policy, the hook refuses each act-as request.
+ * - Else the session cookie: the principal of the signed-in user.
+ * - Else the anonymous principal with the `anonymous` narrowing. Without that option, the hook gives
+ *   no principal, and the server refuses the request.
+ *
+ * A bearer token that is not the agent token goes on to the token check of the server. A server
+ * with this hook sets no `token`: its token check runs after the hook, and a cookie session has no
+ * bearer token.
+ */
+import { tokenMatches } from "@procedures/client";
+/** The `via` of each principal that the hook gives. */
+export const VIA = {
+    session: "better-auth",
+    agent: "agent-token",
+    agentAs: "agent-as",
+    anonymous: "anonymous",
+};
+/** The id of the principal of the agent token. */
+export const AGENT_ID = "agent";
+/** The id of the principal of a request without a user. */
+export const ANONYMOUS_ID = "anonymous";
+/** The claims of a user: the verified email, the name and the groups. */
+function userClaims(user) {
+    return { ...(user.email ? { email: user.email } : {}), ...(user.name ? { name: user.name } : {}), groups: user.groups };
+}
+/** This function makes the headers of a request from its credentials, for the session lookup. */
+export function headersOf(credentials) {
+    const headers = new Headers();
+    for (const [name, value] of Object.entries(credentials.headers ?? {})) {
+        try {
+            headers.set(name, value);
+        }
+        catch {
+            // A header name that the Fetch API refuses: the session lookup does not need it
+        }
+    }
+    if (!headers.has("cookie") && credentials.cookies) {
+        const cookie = Object.entries(credentials.cookies)
+            .map(([name, value]) => `${name}=${encodeURIComponent(value)}`)
+            .join("; ");
+        if (cookie)
+            headers.set("cookie", cookie);
+    }
+    return headers;
+}
+/** This function gives the request hook of a procedures server over Better Auth. */
+export function betterAuthPrincipalOf(options) {
+    const actAsHeader = (options.actAsHeader ?? "x-act-as").toLowerCase();
+    const anonymous = options.anonymous === false ? undefined : options.anonymous;
+    /** The identity of a request without a user, or undefined when the server refuses it. */
+    const anonymousIdentity = (claims) => anonymous === undefined
+        ? undefined
+        : // The via is `anonymous` also for an agent that acts for an unknown user: the via decides the subject (refer to subjectOf of @procedures/access)
+            { principal: { id: ANONYMOUS_ID, via: VIA.anonymous, ...(claims ? { claims } : {}) }, narrowing: anonymous };
+    const identity = (principal) => ({ principal });
+    return async (credentials) => {
+        if (options.agentToken && tokenMatches(options.agentToken, credentials.bearer)) {
+            const target = credentials.headers?.[actAsHeader];
+            if (!target)
+                return identity({ id: AGENT_ID, via: VIA.agent, claims: { agent: true } });
+            if (!options.actAs)
+                return undefined;
+            const user = await options.principals.ofUser(target);
+            // An unknown user has no rights: the agent acts as an anonymous request, and a refused
+            // act-as gives no principal (never the bare agent, which is a service account)
+            if (!user)
+                return anonymousIdentity({ agent: true, actAs: target });
+            if (!(await options.actAs(user, credentials)))
+                return undefined;
+            return identity({ id: user.id, via: VIA.agentAs, claims: { ...userClaims(user), agent: true, actAs: user.id } });
+        }
+        const user = await options.principals.ofHeaders(headersOf(credentials));
+        if (user)
+            return identity({ id: user.id, via: VIA.session, claims: userClaims(user) });
+        return anonymousIdentity();
+    };
+}
+//# sourceMappingURL=principal-of.js.map

package/dist/principal-of.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principal-of.js","sourceRoot":"","sources":["../src/principal-of.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,YAAY,EAAoG,MAAM,oBAAoB,CAAC;AAGpJ,uDAAuD;AACvD,MAAM,CAAC,MAAM,GAAG,GAAG;IACjB,OAAO,EAAE,aAAa;IACtB,KAAK,EAAE,aAAa;IACpB,OAAO,EAAE,UAAU;IACnB,SAAS,EAAE,WAAW;CACd,CAAC;AAEX,kDAAkD;AAClD,MAAM,CAAC,MAAM,QAAQ,GAAG,OAAO,CAAC;AAChC,2DAA2D;AAC3D,MAAM,CAAC,MAAM,YAAY,GAAG,WAAW,CAAC;AAsBxC,yEAAyE;AACzE,SAAS,UAAU,CAAC,IAAkB;IACpC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;AAC1H,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,SAAS,CAAC,WAAwB;IAChD,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;QACtE,IAAI,CAAC;YACH,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,gFAAgF;QAClF,CAAC;IACH,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,WAAW,CAAC,OAAO,EAAE,CAAC;QAClD,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC;aAC/C,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;aAC9D,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,IAAI,MAAM;YAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,qBAAqB,CAAC,OAAqC;IACzE,MAAM,WAAW,GAAG,CAAC,OAAO,CAAC,WAAW,IAAI,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;IACtE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IAC9E,yFAAyF;IACzF,MAAM,iBAAiB,GAAG,CAAC,MAAgC,EAA+B,EAAE,CAC1F,SAAS,KAAK,SAAS;QACrB,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,iJAAiJ;YACjJ,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,YAAY,EAAE,GAAG,EAAE,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;IACnH,MAAM,QAAQ,GAAG,CAAC,SAAoB,EAAmB,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;IAE5E,OAAO,KAAK,EAAE,WAAW,EAAE,EAAE;QAC3B,IAAI,OAAO,CAAC,UAAU,IAAI,YAAY,CAAC,OAAO,CAAC,UAAU,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/E,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,EAAE,CAAC,WAAW,CAAC,CAAC;YAClD,IAAI,CAAC,MAAM;gBAAE,OAAO,QAAQ,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;YACxF,IAAI,CAAC,OAAO,CAAC,KAAK;gBAAE,OAAO,SAAS,CAAC;YACrC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACrD,uFAAuF;YACvF,+EAA+E;YAC/E,IAAI,CAAC,IAAI;gBAAE,OAAO,iBAAiB,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YACpE,IAAI,CAAC,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;gBAAE,OAAO,SAAS,CAAC;YAChE,OAAO,QAAQ,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,GAAG,UAAU,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACnH,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC;QACxE,IAAI,IAAI;YAAE,OAAO,QAAQ,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACvF,OAAO,iBAAiB,EAAE,CAAC;IAC7B,CAAC,CAAC;AACJ,CAAC"}

package/dist/principals.d.ts

@@ -0,0 +1,59 @@
+/**
+ * The person of a request: the session cookie gives the user, and the `member` records of the
+ * organization plugin give the groups. A short memo keeps the boot of a page, which sends many
+ * requests at the same time, to one session lookup.
+ */
+import { type Db } from "mongodb";
+/** A group of a user: an organization of the organization plugin, with the role of the user. */
+export interface UserGroup {
+    readonly id: string;
+    readonly role: string;
+}
+/** A signed-in user. `email` is present only when it is verified. */
+export interface SignedInUser {
+    readonly id: string;
+    readonly email?: string | undefined;
+    readonly name?: string | undefined;
+    readonly groups: readonly UserGroup[];
+}
+/** The part of a Better Auth server that `SessionPrincipals` uses. */
+export interface SessionSource {
+    readonly api: {
+        getSession(context: {
+            headers: Headers;
+        }): Promise<{
+            user?: unknown;
+        } | null | undefined>;
+    };
+}
+/** The options of `SessionPrincipals`. */
+export interface SessionPrincipalsOptions {
+    /** The Better Auth server. */
+    readonly auth: SessionSource;
+    /** The database of Better Auth: its `user` and `member` collections. */
+    readonly db: Db;
+    /** Use an email that is not verified, for a test server only (default false). */
+    readonly trustUnverifiedEmail?: boolean | undefined;
+    /** The time that a session lookup stays, in milliseconds (default 5000). */
+    readonly sessionMemoMs?: number | undefined;
+    /** The time that a groups lookup stays, in milliseconds (default 10000). */
+    readonly groupsMemoMs?: number | undefined;
+    /** The clock (default `Date.now`). The tests give their own. */
+    readonly now?: (() => number) | undefined;
+    /** The function that reports a failed lookup (default `console.warn`). */
+    readonly warn?: ((message: string) => void) | undefined;
+}
+/** The users of the sessions of the requests. */
+export declare class SessionPrincipals {
+    #private;
+    constructor(options: SessionPrincipalsOptions);
+    /** This method gives the user of the session cookie of the headers, or undefined when there is no session. */
+    ofHeaders(headers: Headers): Promise<SignedInUser | undefined>;
+    /** This method gives a user by id from the records of Better Auth, or undefined when the user is unknown. */
+    ofUser(id: string): Promise<SignedInUser | undefined>;
+    /** This method gives the groups of a user: the `member` records of the organization plugin. */
+    groupsOf(id: string): Promise<readonly UserGroup[]>;
+    /** This method forgets the memo of the groups of a user, for example after a change of a membership. */
+    forgetGroups(id: string): void;
+}
+//# sourceMappingURL=principals.d.ts.map

package/dist/principals.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"principals.d.ts","sourceRoot":"","sources":["../src/principals.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAY,KAAK,EAAE,EAAE,MAAM,SAAS,CAAC;AAE5C,gGAAgG;AAChG,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,qEAAqE;AACrE,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,SAAS,SAAS,EAAE,CAAC;CACvC;AAED,sEAAsE;AACtE,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,GAAG,EAAE;QAAE,UAAU,CAAC,OAAO,EAAE;YAAE,OAAO,EAAE,OAAO,CAAA;SAAE,GAAG,OAAO,CAAC;YAAE,IAAI,CAAC,EAAE,OAAO,CAAA;SAAE,GAAG,IAAI,GAAG,SAAS,CAAC,CAAA;KAAE,CAAC;CAC7G;AAED,0CAA0C;AAC1C,MAAM,WAAW,wBAAwB;IACvC,8BAA8B;IAC9B,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,wEAAwE;IACxE,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC;IAChB,iFAAiF;IACjF,QAAQ,CAAC,oBAAoB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACpD,4EAA4E;IAC5E,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C,4EAA4E;IAC5E,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,gEAAgE;IAChE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,MAAM,CAAC,GAAG,SAAS,CAAC;IAC1C,0EAA0E;IAC1E,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;CACzD;AASD,iDAAiD;AACjD,qBAAa,iBAAiB;;IAK5B,YAAY,OAAO,EAAE,wBAAwB,EAE5C;IAeD,8GAA8G;IAC9G,SAAS,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAW7D;IAsBD,6GAA6G;IACvG,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAS1D;IAED,+FAA+F;IAC/F,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC,CAiBlD;IAED,wGAAwG;IACxG,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAE7B;CACF"}

package/dist/principals.js

@@ -0,0 +1,112 @@
+/**
+ * The person of a request: the session cookie gives the user, and the `member` records of the
+ * organization plugin give the groups. A short memo keeps the boot of a page, which sends many
+ * requests at the same time, to one session lookup.
+ */
+import { ObjectId } from "mongodb";
+const MAX_MEMO = 5_000;
+/** The ids to look for: the text, and the `ObjectId` when the text is one. */
+function idsOf(id) {
+    return ObjectId.isValid(id) ? [id, new ObjectId(id)] : [id];
+}
+/** The users of the sessions of the requests. */
+export class SessionPrincipals {
+    #options;
+    #sessions = new Map();
+    #groups = new Map();
+    constructor(options) {
+        this.#options = options;
+    }
+    #now() {
+        return (this.#options.now ?? Date.now)();
+    }
+    #warn(message) {
+        (this.#options.warn ?? ((text) => console.warn(text)))(message);
+    }
+    #email(user) {
+        const verified = user["emailVerified"] === true || this.#options.trustUnverifiedEmail === true;
+        return typeof user["email"] === "string" && user["email"] && verified ? user["email"] : undefined;
+    }
+    /** This method gives the user of the session cookie of the headers, or undefined when there is no session. */
+    ofHeaders(headers) {
+        const cookie = headers.get("cookie") ?? "";
+        if (!cookie)
+            return Promise.resolve(undefined);
+        const now = this.#now();
+        const ttl = this.#options.sessionMemoMs ?? 5_000;
+        const hit = this.#sessions.get(cookie);
+        if (hit && now - hit.at < ttl)
+            return hit.user;
+        const user = this.#resolve(headers);
+        this.#sessions.set(cookie, { at: now, user });
+        if (this.#sessions.size > MAX_MEMO)
+            prune(this.#sessions, now, ttl);
+        return user;
+    }
+    async #resolve(headers) {
+        let session;
+        try {
+            session = await this.#options.auth.api.getSession({ headers });
+        }
+        catch {
+            return undefined;
+        }
+        const user = session?.user;
+        if (typeof user !== "object" || user === null)
+            return undefined;
+        const record = user;
+        if (record["id"] === undefined || record["id"] === null)
+            return undefined;
+        return this.#userOf(String(record["id"]), record);
+    }
+    async #userOf(id, record) {
+        const email = this.#email(record);
+        const name = typeof record["name"] === "string" && record["name"] ? record["name"] : undefined;
+        return { id, ...(email ? { email } : {}), ...(name ? { name } : {}), groups: await this.groupsOf(id) };
+    }
+    /** This method gives a user by id from the records of Better Auth, or undefined when the user is unknown. */
+    async ofUser(id) {
+        let record;
+        try {
+            record = (await this.#options.db.collection("user").findOne({ _id: { $in: idsOf(id) } }));
+        }
+        catch (error) {
+            this.#warn(`[better-auth] the lookup of a user failed: ${error instanceof Error ? error.message : String(error)}`);
+            return undefined;
+        }
+        return record ? this.#userOf(id, record) : undefined;
+    }
+    /** This method gives the groups of a user: the `member` records of the organization plugin. */
+    groupsOf(id) {
+        const now = this.#now();
+        const ttl = this.#options.groupsMemoMs ?? 10_000;
+        const hit = this.#groups.get(id);
+        if (hit && now - hit.at < ttl)
+            return hit.groups;
+        const groups = (async () => {
+            try {
+                const rows = (await this.#options.db.collection("member").find({ userId: { $in: idsOf(id) } }).toArray());
+                return rows.map((row) => ({ id: String(row["organizationId"]), role: String(row["role"] ?? "member") }));
+            }
+            catch (error) {
+                this.#warn(`[better-auth] the lookup of the groups failed: ${error instanceof Error ? error.message : String(error)}`);
+                return [];
+            }
+        })();
+        this.#groups.set(id, { at: now, groups });
+        if (this.#groups.size > MAX_MEMO)
+            prune(this.#groups, now, ttl);
+        return groups;
+    }
+    /** This method forgets the memo of the groups of a user, for example after a change of a membership. */
+    forgetGroups(id) {
+        this.#groups.delete(id);
+    }
+}
+/** This function removes the expired entries of a memo. */
+function prune(map, now, ttl) {
+    for (const [key, entry] of map)
+        if (now - entry.at >= ttl)
+            map.delete(key);
+}
+//# sourceMappingURL=principals.js.map

package/dist/principals.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principals.js","sourceRoot":"","sources":["../src/principals.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,QAAQ,EAAW,MAAM,SAAS,CAAC;AAuC5C,MAAM,QAAQ,GAAG,KAAK,CAAC;AAEvB,8EAA8E;AAC9E,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAC9D,CAAC;AAED,iDAAiD;AACjD,MAAM,OAAO,iBAAiB;IACnB,QAAQ,CAA2B;IACnC,SAAS,GAAG,IAAI,GAAG,EAAmE,CAAC;IACvF,OAAO,GAAG,IAAI,GAAG,EAAiE,CAAC;IAE5F,YAAY,OAAiC;QAC3C,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;IAC1B,CAAC;IAED,IAAI;QACF,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,OAAe;QACnB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC1E,CAAC;IAED,MAAM,CAAC,IAA6B;QAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,KAAK,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,oBAAoB,KAAK,IAAI,CAAC;QAC/F,OAAO,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACpG,CAAC;IAED,8GAA8G;IAC9G,SAAS,CAAC,OAAgB;QACxB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC3C,IAAI,CAAC,MAAM;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,aAAa,IAAI,KAAK,CAAC;QACjD,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,GAAG,IAAI,GAAG,GAAG,GAAG,CAAC,EAAE,GAAG,GAAG;YAAE,OAAO,GAAG,CAAC,IAAI,CAAC;QAC/C,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACpC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,GAAG,QAAQ;YAAE,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QACpE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,OAAgB;QAC7B,IAAI,OAA8C,CAAC;QACnD,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QACjE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,EAAE,IAAI,CAAC;QAC3B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;QAChE,MAAM,MAAM,GAAG,IAA+B,CAAC;QAC/C,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;QAC1E,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACpD,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,EAAU,EAAE,MAA+B;QACvD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAClC,MAAM,IAAI,GAAG,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/F,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;IACzG,CAAC;IAED,6GAA6G;IAC7G,KAAK,CAAC,MAAM,CAAC,EAAU;QACrB,IAAI,MAAsC,CAAC;QAC3C,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC,EAAE,EAAW,CAAC,CAAmC,CAAC;QACvI,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,KAAK,CAAC,8CAA8C,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACnH,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvD,CAAC;IAED,+FAA+F;IAC/F,QAAQ,CAAC,EAAU;QACjB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,YAAY,IAAI,MAAM,CAAC;QACjD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACjC,IAAI,GAAG,IAAI,GAAG,GAAG,GAAG,CAAC,EAAE,GAAG,GAAG;YAAE,OAAO,GAAG,CAAC,MAAM,CAAC;QACjD,MAAM,MAAM,GAAG,CAAC,KAAK,IAAmC,EAAE;YACxD,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC,EAAE,EAAW,CAAC,CAAC,OAAO,EAAE,CAA8B,CAAC;gBAChJ,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;YAC3G,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,KAAK,CAAC,kDAAkD,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBACvH,OAAO,EAAE,CAAC;YACZ,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;QACL,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;QAC1C,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,QAAQ;YAAE,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QAChE,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,wGAAwG;IACxG,YAAY,CAAC,EAAU;QACrB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC1B,CAAC;CACF;AAED,2DAA2D;AAC3D,SAAS,KAAK,CAAC,GAAgC,EAAE,GAAW,EAAE,GAAW;IACvE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,GAAG;QAAE,IAAI,GAAG,GAAG,KAAK,CAAC,EAAE,IAAI,GAAG;YAAE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAC7E,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Type definitions of the procedures of this package
+ *
+ * mark procedure new adds the types of each new procedure here.
+ */
+export {};
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC"}

package/dist/types.js

@@ -0,0 +1,7 @@
+/**
+ * Type definitions of the procedures of this package
+ *
+ * mark procedure new adds the types of each new procedure here.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC"}

package/package.json

@@ -1,13 +1,66 @@
 {
+  "$schema": "https://json.schemastore.org/package",
   "name": "@procedures/better-auth",
-  "version": "0.0.0-bootstrap.0",
-  "description": "A placeholder that lets npm trust the release workflow of mark1russell7/client. Use a later version.",
+  "version": "0.12.1",
+  "description": "Better Auth for a procedures server: the sign-in with GitHub, Google and passkeys over MongoDB, and a request hook that gives the principal of a session or of an agent token.",
+  "keywords": [
+    "procedures",
+    "better-auth",
+    "authentication",
+    "oauth",
+    "passkey",
+    "session",
+    "principal"
+  ],
+  "homepage": "https://mark1russell7.github.io/client/",
+  "bugs": {
+    "url": "https://github.com/mark1russell7/client/issues"
+  },
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/mark1russell7/client.git"
+    "url": "git+https://github.com/mark1russell7/client.git",
+    "directory": "packages/better-auth"
   },
   "license": "MIT",
-  "publishConfig": {
-    "access": "public"
+  "author": "Mark Russell (https://github.com/mark1russell7)",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "src"
+  ],
+  "sideEffects": false,
+  "devDependencies": {
+    "@mark1russell7/cue": "^1.0.0",
+    "mongodb": "^7.7.0",
+    "typescript": "^7.0.2",
+    "vitest": "^5.0.3"
+  },
+  "engines": {
+    "node": ">=22"
+  },
+  "client": null,
+  "dependencies": {
+    "@better-auth/passkey": "^1.7.10",
+    "@procedures/client": "0.12.1",
+    "better-auth": "^1.7.10",
+    "zod": "^4.6.5"
+  },
+  "peerDependencies": {
+    "mongodb": "^6.0.0 || ^7.0.0"
+  },
+  "scripts": {
+    "build": "tsc -b",
+    "typecheck": "tsc --noEmit",
+    "clean": "rm -rf dist .tsbuildinfo",
+    "test": "vitest run --passWithNoTests",
+    "test:watch": "vitest"
   }
-}
+}