@procedures/better-auth 0.13.2 → 0.14.1

package/dist/auth.d.ts

@@ -1,8 +1,9 @@
 import type { Db, MongoClient } from "mongodb";
 import type { BetterAuthConfig } from "./config.js";
 /**
- * The parts of a Better Auth server that an app uses. Mount `handler` on `config.basePath`, for
- * example with `toNodeHandler` of `better-auth/node`. `SessionPrincipals` reads `api.getSession`.
+ * The parts of a Better Auth server that an app uses. Mount `handler` on `config.basePath` with
+ * `betterAuthHandler()`, which adds the credentialed CORS of the trusted origins. `SessionPrincipals`
+ * reads `api.getSession`.
  */
 export interface BetterAuthServer {
     /** The handler of the auth routes. */

package/dist/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEpD;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,sCAAsC;IACtC,QAAQ,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC1D,QAAQ,CAAC,GAAG,EAAE;QACZ,qEAAqE;QACrE,UAAU,CAAC,OAAO,EAAE;YAAE,OAAO,EAAE,OAAO,CAAA;SAAE,GAAG,OAAO,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;SAAE,GAAG,IAAI,CAAC,CAAC;KAChI,CAAC;CACH;AAED,qEAAqE;AACrE,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,gBAAgB,GAAG,gBAAgB,CAyBxG"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAGpD;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,sCAAsC;IACtC,QAAQ,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC1D,QAAQ,CAAC,GAAG,EAAE;QACZ,qEAAqE;QACrE,UAAU,CAAC,OAAO,EAAE;YAAE,OAAO,EAAE,OAAO,CAAA;SAAE,GAAG,OAAO,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;SAAE,GAAG,IAAI,CAAC,CAAC;KAChI,CAAC;CACH;AAED,qEAAqE;AACrE,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,gBAAgB,GAAG,gBAAgB,CAExG"}

package/dist/auth.js

@@ -4,37 +4,13 @@
  * password. Better Auth does the OAuth state, PKCE and the CSRF checks.
  *
  * Give Better Auth its own database: its `user` collection must not mix with the data of the app.
- * The app mounts `auth.handler` on `config.basePath`: the routes belong to the app.
+ * The app mounts `auth.handler` on `config.basePath` (`betterAuthHandler()`): the routes belong to the app.
  */
 import { betterAuth } from "better-auth";
 import { mongodbAdapter } from "better-auth/adapters/mongodb";
-import { organization } from "better-auth/plugins";
-import { passkey } from "@better-auth/passkey";
+import { betterAuthOptions } from "./options.js";
 /** This function makes the Better Auth server of a configuration. */
 export function createBetterAuth(db, client, config) {
-    const testHooks = {
-        user: {
-            create: {
-                before: async (user) => ({ data: { ...user, emailVerified: true } }),
-            },
-        },
-    };
-    return betterAuth({
-        appName: config.appName,
-        basePath: config.basePath,
-        baseURL: config.baseURL,
-        secret: config.secret,
-        database: mongodbAdapter(db, { client }),
-        trustedOrigins: [...config.trustedOrigins],
-        socialProviders: {
-            ...(config.github ? { github: { ...config.github } } : {}),
-            ...(config.google ? { google: { ...config.google } } : {}),
-        },
-        emailAndPassword: { enabled: config.testAccounts },
-        // A test account has no email check: the test server trusts its email
-        ...(config.testAccounts ? { databaseHooks: testHooks } : {}),
-        // The passkeys expect the origins of the app, not the Origin header of each request
-        plugins: [organization(), passkey({ rpID: config.rpID, rpName: config.appName, origin: [...config.trustedOrigins] })],
-    });
+    return betterAuth(betterAuthOptions(config, mongodbAdapter(db, { client })));
 }
 //# sourceMappingURL=auth.js.map

package/dist/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAiB/C,qEAAqE;AACrE,MAAM,UAAU,gBAAgB,CAAC,EAAM,EAAE,MAAmB,EAAE,MAAwB;IACpF,MAAM,SAAS,GAAG;QAChB,IAAI,EAAE;YACJ,MAAM,EAAE;gBACN,MAAM,EAAE,KAAK,EAAE,IAA6B,EAA8C,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,EAAE,CAAC;aAC1I;SACF;KACF,CAAC;IACF,OAAO,UAAU,CAAC;QAChB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,QAAQ,EAAE,cAAc,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;QACxC,cAAc,EAAE,CAAC,GAAG,MAAM,CAAC,cAAc,CAAC;QAC1C,eAAe,EAAE;YACf,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3D;QACD,gBAAgB,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,YAAY,EAAE;QAClD,sEAAsE;QACtE,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,oFAAoF;QACpF,OAAO,EAAE,CAAC,YAAY,EAAE,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;KACtH,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAG9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAgBjD,qEAAqE;AACrE,MAAM,UAAU,gBAAgB,CAAC,EAAM,EAAE,MAAmB,EAAE,MAAwB;IACpF,OAAO,UAAU,CAAC,iBAAiB,CAAC,MAAM,EAAE,cAAc,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;AAC/E,CAAC"}

package/dist/config.d.ts

@@ -7,6 +7,7 @@
  * - `GOOGLE_CLIENT_ID` and `GOOGLE_CLIENT_SECRET`: the sign-in with Google.
  * - `AUTH_TEST_ACCOUNTS=1`: accounts with an email and a password, for the tests. Production refuses it.
  * - `PASSKEY_RP_ID`: the domain of the passkeys (default: the host of the first trusted origin).
+ * - `AUTH_CROSS_SITE_COOKIES=1`: the session cookies get `SameSite=None` and `Secure`, for a page on another site.
  */
 /** The client id and the secret of an OAuth provider. */
 export interface OAuthClient {
@@ -29,6 +30,12 @@ export interface BetterAuthConfig {
     readonly testAccounts: boolean;
     /** The relying party of the passkeys: a domain of the origins of the app. */
     readonly rpID: string;
+    /**
+     * True: the cookies of Better Auth get `SameSite=None` and `Secure`, so a page on another site
+     * sends them (CLI-49). A browser keeps a `Secure` cookie only over HTTPS or from `localhost`.
+     * The default is false: `SameSite=Lax`.
+     */
+    readonly crossSiteCookies?: boolean | undefined;
 }
 /** The options of `betterAuthConfig`. */
 export interface BetterAuthConfigOptions {

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,yDAAyD;AACzD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,uDAAuD;AACvD,MAAM,WAAW,gBAAgB;IAC/B,6CAA6C;IAC7C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,qDAAqD;IACrD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,0FAA0F;IAC1F,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;IAC1C,4FAA4F;IAC5F,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,6EAA6E;IAC7E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,yCAAyC;AACzC,MAAM,WAAW,uBAAuB;IACtC,wDAAwD;IACxD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,8BAA8B;IAC9B,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,2CAA2C;IAC3C,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,qDAAqD;IACrD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACxC;AAED,mHAAmH;AACnH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,EAAE,OAAO,EAAE,uBAAuB,GAAG,gBAAgB,GAAG,MAAM,CA4B/I"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,yDAAyD;AACzD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,uDAAuD;AACvD,MAAM,WAAW,gBAAgB;IAC/B,6CAA6C;IAC7C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,qDAAqD;IACrD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,0FAA0F;IAC1F,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;IAC1C,4FAA4F;IAC5F,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,6EAA6E;IAC7E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CACjD;AAED,yCAAyC;AACzC,MAAM,WAAW,uBAAuB;IACtC,wDAAwD;IACxD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,8BAA8B;IAC9B,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,2CAA2C;IAC3C,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,qDAAqD;IACrD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACxC;AAED,mHAAmH;AACnH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,EAAE,OAAO,EAAE,uBAAuB,GAAG,gBAAgB,GAAG,MAAM,CA6B/I"}

package/dist/config.js

@@ -7,6 +7,7 @@
  * - `GOOGLE_CLIENT_ID` and `GOOGLE_CLIENT_SECRET`: the sign-in with Google.
  * - `AUTH_TEST_ACCOUNTS=1`: accounts with an email and a password, for the tests. Production refuses it.
  * - `PASSKEY_RP_ID`: the domain of the passkeys (default: the host of the first trusted origin).
+ * - `AUTH_CROSS_SITE_COOKIES=1`: the session cookies get `SameSite=None` and `Secure`, for a page on another site.
  */
 /** This function reads the configuration from the environment. It gives a message when the server cannot start. */
 export function betterAuthConfig(env, options) {
@@ -39,6 +40,7 @@ export function betterAuthConfig(env, options) {
         ...(google ? { google } : {}),
         testAccounts: env["AUTH_TEST_ACCOUNTS"] === "1",
         rpID: env["PASSKEY_RP_ID"] || firstHost,
+        ...(env["AUTH_CROSS_SITE_COOKIES"] === "1" ? { crossSiteCookies: true } : {}),
     };
 }
 //# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAsCH,mHAAmH;AACnH,MAAM,UAAU,gBAAgB,CAAC,GAAiD,EAAE,OAAgC;IAClH,MAAM,MAAM,GAAG,GAAG,CAAC,oBAAoB,CAAC,IAAI,EAAE,CAAC;IAC/C,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE;QAAE,OAAO,oDAAoD,CAAC;IACpF,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,YAAY,IAAI,GAAG,CAAC,oBAAoB,CAAC,KAAK,GAAG;QAAE,OAAO,6CAA6C,CAAC;IAChI,MAAM,IAAI,GAAG,CAAC,EAAU,EAAE,GAAW,EAA2B,EAAE;QAChE,MAAM,QAAQ,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC;QACzB,MAAM,YAAY,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9B,OAAO,QAAQ,IAAI,YAAY,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3E,CAAC,CAAC;IACF,IAAI,SAAS,GAAG,WAAW,CAAC;IAC5B,IAAI,CAAC;QACH,SAAS,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,kBAAkB,CAAC,CAAC,QAAQ,CAAC;IAChF,CAAC;IAAC,MAAM,CAAC;QACP,0DAA0D;IAC5D,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,kBAAkB,EAAE,sBAAsB,CAAC,CAAC;IAChE,MAAM,MAAM,GAAG,IAAI,CAAC,kBAAkB,EAAE,sBAAsB,CAAC,CAAC;IAChE,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,KAAK;QACjC,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,OAAO;QACrC,MAAM;QACN,OAAO,EAAE,GAAG,CAAC,eAAe,CAAC,IAAI,oBAAoB,OAAO,CAAC,IAAI,EAAE;QACnE,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,YAAY,EAAE,GAAG,CAAC,oBAAoB,CAAC,KAAK,GAAG;QAC/C,IAAI,EAAE,GAAG,CAAC,eAAe,CAAC,IAAI,SAAS;KACxC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AA4CH,mHAAmH;AACnH,MAAM,UAAU,gBAAgB,CAAC,GAAiD,EAAE,OAAgC;IAClH,MAAM,MAAM,GAAG,GAAG,CAAC,oBAAoB,CAAC,IAAI,EAAE,CAAC;IAC/C,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE;QAAE,OAAO,oDAAoD,CAAC;IACpF,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,YAAY,IAAI,GAAG,CAAC,oBAAoB,CAAC,KAAK,GAAG;QAAE,OAAO,6CAA6C,CAAC;IAChI,MAAM,IAAI,GAAG,CAAC,EAAU,EAAE,GAAW,EAA2B,EAAE;QAChE,MAAM,QAAQ,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC;QACzB,MAAM,YAAY,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9B,OAAO,QAAQ,IAAI,YAAY,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3E,CAAC,CAAC;IACF,IAAI,SAAS,GAAG,WAAW,CAAC;IAC5B,IAAI,CAAC;QACH,SAAS,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,kBAAkB,CAAC,CAAC,QAAQ,CAAC;IAChF,CAAC;IAAC,MAAM,CAAC;QACP,0DAA0D;IAC5D,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,kBAAkB,EAAE,sBAAsB,CAAC,CAAC;IAChE,MAAM,MAAM,GAAG,IAAI,CAAC,kBAAkB,EAAE,sBAAsB,CAAC,CAAC;IAChE,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,KAAK;QACjC,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,OAAO;QACrC,MAAM;QACN,OAAO,EAAE,GAAG,CAAC,eAAe,CAAC,IAAI,oBAAoB,OAAO,CAAC,IAAI,EAAE;QACnE,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,YAAY,EAAE,GAAG,CAAC,oBAAoB,CAAC,KAAK,GAAG;QAC/C,IAAI,EAAE,GAAG,CAAC,eAAe,CAAC,IAAI,SAAS;QACvC,GAAG,CAAC,GAAG,CAAC,yBAAyB,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9E,CAAC;AACJ,CAAC"}

package/dist/handler.d.ts

@@ -0,0 +1,101 @@
+/**
+ * The Node handler of the auth routes, with credentialed CORS from the trusted origins of the
+ * host (CLI-49).
+ *
+ * The handler of Better Auth sends no CORS headers. A page on another origin then gets no
+ * session, and its POST requests fail. `betterAuthHandler()` puts the CORS of
+ * `credentialedCors()` of `@procedures/client/node` in front of the routes. Thus the
+ * `allowedOrigins` of the host, the list of the browser checks of `procedureHandler`, drives
+ * the CORS of the auth routes too. `betterAuthFace()` takes that list from the policy of a
+ * procedures host.
+ */
+import type { IncomingMessage, ServerResponse } from "node:http";
+import type { BrowserGuardOptions, HostPolicy } from "@procedures/client";
+import { type CredentialedCorsOptions } from "@procedures/client/node";
+import type { BetterAuthServer } from "./auth.js";
+/** The methods of a preflight of the auth routes: Better Auth uses GET and POST. */
+export declare const AUTH_CORS_METHODS: readonly string[];
+/** The request headers of a preflight of the auth routes. */
+export declare const AUTH_CORS_HEADERS: readonly string[];
+/**
+ * The request tracking of a procedures host: `track` of the context of a face (CLI-54). The
+ * function does the work of one request through the service of the host, on the route
+ * `<face> <key>`. It answers a refusal with 503. The type is structural.
+ */
+export type AuthRequestTracker = (req: IncomingMessage, res: ServerResponse, key: string, serve: (signal: AbortSignal) => Promise<void> | void) => Promise<void>;
+/** The options of `betterAuthHandler()`. */
+export interface BetterAuthHandlerOptions {
+    /**
+     * The origins that get credentialed CORS: the `allowedOrigins` of the host. A list or a
+     * function of origins. `"*"` is refused (CSRF). Without it, no other origin gets CORS.
+     */
+    readonly allowedOrigins?: BrowserGuardOptions["allowedOrigins"];
+    /** The path of the auth routes. The default is `/auth`, as `betterAuthConfig` gives it. */
+    readonly basePath?: string | undefined;
+    /**
+     * More of the CORS: `methods`, `allowedHeaders`, `exposedHeaders` and `maxAge`. The defaults are
+     * `AUTH_CORS_METHODS` and `AUTH_CORS_HEADERS`.
+     */
+    readonly cors?: CredentialedCorsOptions | undefined;
+    /**
+     * The request tracking of a host (CLI-54). Each request of the routes goes through it, with the
+     * path under `basePath` as its key. A preflight does not. `betterAuthFace()` gives the tracking
+     * of the host. Without it, each request starts directly.
+     */
+    readonly track?: AuthRequestTracker | undefined;
+}
+/**
+ * The Node handler of the auth routes. A call gives true when the handler takes the request (its
+ * path is under `basePath`), and false for another request. The handler then does not touch the
+ * request.
+ */
+export interface NodeAuthHandler {
+    (req: IncomingMessage, res: ServerResponse): boolean;
+    /** This method gives true when the handler takes the request: its path is under `basePath`. */
+    matches(req: IncomingMessage): boolean;
+    /** The handler as a middleware of Connect or Express, at the level of the app: a request outside `basePath` goes to `next`. */
+    middleware(req: IncomingMessage, res: ServerResponse, next: (error?: unknown) => void): void;
+    /** The path under which the handler takes the requests. */
+    readonly basePath: string;
+}
+/**
+ * This function gives the Node handler of the auth routes, with credentialed CORS for the trusted
+ * origins. Mount it on the mount list of a listener, or as a middleware of the app.
+ *
+ * @example
+ * ```typescript
+ * const handler = betterAuthHandler(auth, { allowedOrigins: ["http://localhost:5173"] });
+ * app.use(handler.middleware); // Express, at the level of the app
+ * ```
+ */
+export declare function betterAuthHandler(auth: Pick<BetterAuthServer, "handler">, options?: BetterAuthHandlerOptions): NodeAuthHandler;
+/** What the auth face needs of its host: the policy, for its trusted origins, and the request tracking. */
+export interface BetterAuthFaceContext {
+    readonly policy: HostPolicy;
+    /** The request tracking of the host, on the route pattern of the face (`auth *`, CLI-54). */
+    readonly track?: AuthRequestTracker | undefined;
+}
+/** The auth face: its request handler and its endpoint, for `host.info`. */
+export interface BetterAuthFace {
+    readonly handler: (req: IncomingMessage, res: ServerResponse) => boolean;
+    readonly endpoint: {
+        readonly type: string;
+        readonly scheme: "http";
+        readonly path: string;
+    };
+}
+/**
+ * This function gives the auth routes as a face of a procedures host (`createProcedureHost()` of
+ * `@procedures/peer`). The face takes the trusted origins of the policy of the host
+ * (`browser.allowedOrigins`), unless the options give other origins. Each request of the routes
+ * goes through the request tracking of the host (`track`, CLI-54). Thus a request after the stop
+ * of the intake gets 503, and the drain waits for a request in flight. The types are structural:
+ * this package does not depend on `@procedures/peer`.
+ *
+ * @example
+ * ```typescript
+ * const host = createProcedureHost({ registry, policy, faces: { http: true, auth: betterAuthFace(auth) }, listen });
+ * ```
+ */
+export declare function betterAuthFace(auth: Pick<BetterAuthServer, "handler">, options?: BetterAuthHandlerOptions): (context: BetterAuthFaceContext) => BetterAuthFace;
+//# sourceMappingURL=handler.d.ts.map

package/dist/handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../src/handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAEjE,OAAO,KAAK,EAAE,mBAAmB,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAC1E,OAAO,EAAoB,KAAK,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AACzF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAElD,oFAAoF;AACpF,eAAO,MAAM,iBAAiB,EAAE,SAAS,MAAM,EAA8C,CAAC;AAE9F,6DAA6D;AAC7D,eAAO,MAAM,iBAAiB,EAAE,SAAS,MAAM,EAAqD,CAAC;AAErG;;;;GAIG;AACH,MAAM,MAAM,kBAAkB,GAAG,CAC/B,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,KACjD,OAAO,CAAC,IAAI,CAAC,CAAC;AAEnB,4CAA4C;AAC5C,MAAM,WAAW,wBAAwB;IACvC;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,mBAAmB,CAAC,gBAAgB,CAAC,CAAC;IAChE,2FAA2F;IAC3F,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC;;;OAGG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,uBAAuB,GAAG,SAAS,CAAC;IACpD;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,kBAAkB,GAAG,SAAS,CAAC;CACjD;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC;IACrD,+FAA+F;IAC/F,OAAO,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC;IACvC,+HAA+H;IAC/H,UAAU,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,IAAI,GAAG,IAAI,CAAC;IAC7F,2DAA2D;IAC3D,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAgCD;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC,gBAAgB,EAAE,SAAS,CAAC,EAAE,OAAO,GAAE,wBAA6B,GAAG,eAAe,CA8ClI;AAED,2GAA2G;AAC3G,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,6FAA6F;IAC7F,QAAQ,CAAC,KAAK,CAAC,EAAE,kBAAkB,GAAG,SAAS,CAAC;CACjD;AAED,4EAA4E;AAC5E,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,KAAK,OAAO,CAAC;IACzE,QAAQ,CAAC,QAAQ,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CAC9F;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,gBAAgB,EAAE,SAAS,CAAC,EAAE,OAAO,GAAE,wBAA6B,GAAG,CAAC,OAAO,EAAE,qBAAqB,KAAK,cAAc,CAalK"}

package/dist/handler.js

@@ -0,0 +1,122 @@
+import { toNodeHandler } from "better-auth/node";
+import { credentialedCors } from "@procedures/client/node";
+/** The methods of a preflight of the auth routes: Better Auth uses GET and POST. */
+export const AUTH_CORS_METHODS = Object.freeze(["GET", "POST", "OPTIONS"]);
+/** The request headers of a preflight of the auth routes. */
+export const AUTH_CORS_HEADERS = Object.freeze(["Content-Type", "Authorization"]);
+/** True when the value of a `Vary` header names the field, or is `*`. */
+function varies(value, field) {
+    return value.split(",").some((part) => {
+        const name = part.trim().toLowerCase();
+        return name === "*" || name === field.toLowerCase();
+    });
+}
+/**
+ * The handler of the routes, with `Origin` in each `Vary` header. The Node adapter of Better Auth
+ * sets each header of a response with `setHeader`, so a `Vary` of a route replaces the `Vary:
+ * Origin` of the CORS. A shared cache then can give the answer of one origin to another origin.
+ */
+function keepVaryOrigin(handler) {
+    return async (request) => {
+        const response = await handler(request);
+        const vary = response.headers.get("vary");
+        if (vary === null || varies(vary, "Origin"))
+            return response;
+        const headers = new Headers(response.headers);
+        headers.set("vary", `${vary}, Origin`);
+        return new Response(response.body, { status: response.status, statusText: response.statusText, headers });
+    };
+}
+/** The path of a request URL, without its query. */
+function pathOf(url) {
+    const path = (url ?? "/").split("?")[0] ?? "/";
+    return path === "" ? "/" : path;
+}
+/**
+ * This function gives the Node handler of the auth routes, with credentialed CORS for the trusted
+ * origins. Mount it on the mount list of a listener, or as a middleware of the app.
+ *
+ * @example
+ * ```typescript
+ * const handler = betterAuthHandler(auth, { allowedOrigins: ["http://localhost:5173"] });
+ * app.use(handler.middleware); // Express, at the level of the app
+ * ```
+ */
+export function betterAuthHandler(auth, options = {}) {
+    const basePath = (options.basePath ?? "/auth").replace(/\/+$/, "") || "/";
+    const prefix = basePath === "/" ? "/" : `${basePath}/`;
+    const cors = credentialedCors(options.allowedOrigins, { methods: AUTH_CORS_METHODS, allowedHeaders: AUTH_CORS_HEADERS, ...options.cors });
+    // The CORS sets `Vary: Origin` on each response, for each origin: the routes keep it
+    const routes = toNodeHandler(keepVaryOrigin(auth.handler));
+    const matches = (req) => {
+        const path = pathOf(req.url);
+        return path === basePath || path.startsWith(prefix);
+    };
+    const fail = (res, error) => {
+        if (res.headersSent) {
+            res.destroy(error instanceof Error ? error : new Error(String(error)));
+            return;
+        }
+        res.statusCode = 500;
+        res.setHeader("Content-Type", "application/json");
+        res.end(JSON.stringify({ error: "The auth routes failed", code: "INTERNAL_ERROR" }));
+    };
+    const { track } = options;
+    const serve = (req, res) => {
+        // A preflight ends in the CORS. A request of another origin goes on without CORS headers:
+        // the CSRF checks of Better Auth refuse a write of an origin that it does not trust
+        if (cors(req, res))
+            return;
+        if (!track) {
+            routes(req, res).catch((error) => fail(res, error));
+            return;
+        }
+        // The tracking of the host: the request counts until its response closes, and the drain waits
+        // for it. The CORS headers are on the response already, so a page can read a refusal (503).
+        const path = pathOf(req.url);
+        const key = path.length > prefix.length ? path.slice(prefix.length) : "/";
+        track(req, res, key, () => routes(req, res)).catch((error) => fail(res, error));
+    };
+    const handler = (req, res) => {
+        if (!matches(req))
+            return false;
+        serve(req, res);
+        return true;
+    };
+    return Object.assign(handler, {
+        matches,
+        middleware: (req, res, next) => {
+            if (!handler(req, res))
+                next();
+        },
+        basePath,
+    });
+}
+/**
+ * This function gives the auth routes as a face of a procedures host (`createProcedureHost()` of
+ * `@procedures/peer`). The face takes the trusted origins of the policy of the host
+ * (`browser.allowedOrigins`), unless the options give other origins. Each request of the routes
+ * goes through the request tracking of the host (`track`, CLI-54). Thus a request after the stop
+ * of the intake gets 503, and the drain waits for a request in flight. The types are structural:
+ * this package does not depend on `@procedures/peer`.
+ *
+ * @example
+ * ```typescript
+ * const host = createProcedureHost({ registry, policy, faces: { http: true, auth: betterAuthFace(auth) }, listen });
+ * ```
+ */
+export function betterAuthFace(auth, options = {}) {
+    return (context) => {
+        const track = options.track ?? context.track;
+        const handler = betterAuthHandler(auth, {
+            ...options,
+            allowedOrigins: options.allowedOrigins ?? context.policy.browser.allowedOrigins,
+            ...(track ? { track } : {}),
+        });
+        return {
+            handler: (req, res) => handler(req, res),
+            endpoint: { type: "auth", scheme: "http", path: handler.basePath },
+        };
+    };
+}
+//# sourceMappingURL=handler.js.map

package/dist/handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler.js","sourceRoot":"","sources":["../src/handler.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEjD,OAAO,EAAE,gBAAgB,EAAgC,MAAM,yBAAyB,CAAC;AAGzF,oFAAoF;AACpF,MAAM,CAAC,MAAM,iBAAiB,GAAsB,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;AAE9F,6DAA6D;AAC7D,MAAM,CAAC,MAAM,iBAAiB,GAAsB,MAAM,CAAC,MAAM,CAAC,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC,CAAC;AAmDrG,yEAAyE;AACzE,SAAS,MAAM,CAAC,KAAa,EAAE,KAAa;IAC1C,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;QACpC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACvC,OAAO,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,KAAK,CAAC,WAAW,EAAE,CAAC;IACtD,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,OAAoC;IAC1D,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE;QACvB,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;QACxC,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,IAAI,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC;YAAE,OAAO,QAAQ,CAAC;QAC7D,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC9C,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,IAAI,UAAU,CAAC,CAAC;QACvC,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;IAC5G,CAAC,CAAC;AACJ,CAAC;AAED,oDAAoD;AACpD,SAAS,MAAM,CAAC,GAAuB;IACrC,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;IAC/C,OAAO,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAClC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAuC,EAAE,OAAO,GAA6B,EAAE;IAC/G,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC;IAC1E,MAAM,MAAM,GAAG,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,QAAQ,GAAG,CAAC;IACvD,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,iBAAiB,EAAE,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1I,qFAAqF;IACrF,MAAM,MAAM,GAAG,aAAa,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAG,CAAC,GAAoB,EAAW,EAAE;QAChD,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC7B,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACtD,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,CAAC,GAAmB,EAAE,KAAc,EAAQ,EAAE;QACzD,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;YACpB,GAAG,CAAC,OAAO,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACvE,OAAO;QACT,CAAC;QACD,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;QACrB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;QAClD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC;IACvF,CAAC,CAAC;IACF,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;IAC1B,MAAM,KAAK,GAAG,CAAC,GAAoB,EAAE,GAAmB,EAAQ,EAAE;QAChE,0FAA0F;QAC1F,oFAAoF;QACpF,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC;YAAE,OAAO;QAC3B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;YAC7D,OAAO;QACT,CAAC;QACD,8FAA8F;QAC9F,4FAA4F;QAC5F,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAC1E,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;IAC3F,CAAC,CAAC;IACF,MAAM,OAAO,GAAG,CAAC,GAAoB,EAAE,GAAmB,EAAW,EAAE;QACrE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAChC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAChB,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE;QAC5B,OAAO;QACP,UAAU,EAAE,CAAC,GAAoB,EAAE,GAAmB,EAAE,IAA+B,EAAQ,EAAE;YAC/F,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC;gBAAE,IAAI,EAAE,CAAC;QACjC,CAAC;QACD,QAAQ;KACT,CAAC,CAAC;AACL,CAAC;AAeD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,cAAc,CAAC,IAAuC,EAAE,OAAO,GAA6B,EAAE;IAC5G,OAAO,CAAC,OAAO,EAAE,EAAE;QACjB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC;QAC7C,MAAM,OAAO,GAAG,iBAAiB,CAAC,IAAI,EAAE;YACtC,GAAG,OAAO;YACV,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc;YAC/E,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5B,CAAC,CAAC;QACH,OAAO;YACL,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC;YACxC,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,QAAQ,EAAE;SACnE,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -3,4 +3,5 @@ export * from "./config.js";
 export * from "./auth.js";
 export * from "./principals.js";
 export * from "./principal-of.js";
+export * from "./handler.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,WAAW,CAAC;AAC1B,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,WAAW,CAAC;AAC1B,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC;AAClC,cAAc,cAAc,CAAC"}

package/dist/index.js

@@ -3,4 +3,5 @@ export * from "./config.js";
 export * from "./auth.js";
 export * from "./principals.js";
 export * from "./principal-of.js";
+export * from "./handler.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,WAAW,CAAC;AAC1B,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,WAAW,CAAC;AAC1B,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC;AAClC,cAAc,cAAc,CAAC"}

package/dist/options.d.ts

@@ -0,0 +1,10 @@
+/**
+ * The options of Better Auth for a configuration and a database adapter. `createBetterAuth` gives
+ * them the MongoDB adapter, and a test gives them the memory adapter. The package root does not
+ * export this module.
+ */
+import type { BetterAuthOptions } from "better-auth";
+import type { BetterAuthConfig } from "./config.js";
+/** This function gives the options of Better Auth for a configuration and a database adapter. */
+export declare function betterAuthOptions(config: BetterAuthConfig, database: BetterAuthOptions["database"]): BetterAuthOptions;
+//# sourceMappingURL=options.d.ts.map

package/dist/options.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"options.d.ts","sourceRoot":"","sources":["../src/options.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAGrD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEpD,iGAAiG;AACjG,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,gBAAgB,EAAE,QAAQ,EAAE,iBAAiB,CAAC,UAAU,CAAC,GAAG,iBAAiB,CA2BtH"}

package/dist/options.js

@@ -0,0 +1,32 @@
+import { organization } from "better-auth/plugins";
+import { passkey } from "@better-auth/passkey";
+/** This function gives the options of Better Auth for a configuration and a database adapter. */
+export function betterAuthOptions(config, database) {
+    const testHooks = {
+        user: {
+            create: {
+                before: async (user) => ({ data: { ...user, emailVerified: true } }),
+            },
+        },
+    };
+    return {
+        appName: config.appName,
+        basePath: config.basePath,
+        baseURL: config.baseURL,
+        secret: config.secret,
+        database: database,
+        trustedOrigins: [...config.trustedOrigins],
+        socialProviders: {
+            ...(config.github ? { github: { ...config.github } } : {}),
+            ...(config.google ? { google: { ...config.google } } : {}),
+        },
+        emailAndPassword: { enabled: config.testAccounts },
+        // A test account has no email check: the test server trusts its email
+        ...(config.testAccounts ? { databaseHooks: testHooks } : {}),
+        // A page on another site sends a cookie only with SameSite=None, and a browser keeps such a cookie only when it is Secure (CLI-49)
+        ...(config.crossSiteCookies === true ? { advanced: { defaultCookieAttributes: { sameSite: "none", secure: true } } } : {}),
+        // The passkeys expect the origins of the app, not the Origin header of each request
+        plugins: [organization(), passkey({ rpID: config.rpID, rpName: config.appName, origin: [...config.trustedOrigins] })],
+    };
+}
+//# sourceMappingURL=options.js.map

package/dist/options.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"options.js","sourceRoot":"","sources":["../src/options.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAG/C,iGAAiG;AACjG,MAAM,UAAU,iBAAiB,CAAC,MAAwB,EAAE,QAAuC;IACjG,MAAM,SAAS,GAAG;QAChB,IAAI,EAAE;YACJ,MAAM,EAAE;gBACN,MAAM,EAAE,KAAK,EAAE,IAA6B,EAA8C,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,EAAE,CAAC;aAC1I;SACF;KACF,CAAC;IACF,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,QAAQ,EAAE,QAAQ;QAClB,cAAc,EAAE,CAAC,GAAG,MAAM,CAAC,cAAc,CAAC;QAC1C,eAAe,EAAE;YACf,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3D;QACD,gBAAgB,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,YAAY,EAAE;QAClD,sEAAsE;QACtE,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,mIAAmI;QACnI,GAAG,CAAC,MAAM,CAAC,gBAAgB,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,uBAAuB,EAAE,EAAE,QAAQ,EAAE,MAAe,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnI,oFAAoF;QACpF,OAAO,EAAE,CAAC,YAAY,EAAE,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;KACtH,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/package",
   "name": "@procedures/better-auth",
-  "version": "0.13.2",
+  "version": "0.14.1",
   "description": "Better Auth for a procedures server: the sign-in with GitHub, Google and passkeys over MongoDB, and a request hook that gives the principal of a session or of an agent token.",
   "keywords": [
     "procedures",
@@ -50,10 +50,14 @@
   "engines": {
     "node": ">=22"
   },
-  "client": null,
+  "client": {
+    "browser": [
+      "./browser"
+    ]
+  },
   "dependencies": {
     "@better-auth/passkey": "^1.7.10",
-    "@procedures/client": "0.13.2",
+    "@procedures/client": "0.14.1",
     "@simplewebauthn/browser": "^13.3.0",
     "better-auth": "^1.7.10",
     "zod": "^4.6.5"

package/src/auth.ts

@@ -4,18 +4,18 @@
  * password. Better Auth does the OAuth state, PKCE and the CSRF checks.
  *
  * Give Better Auth its own database: its `user` collection must not mix with the data of the app.
- * The app mounts `auth.handler` on `config.basePath`: the routes belong to the app.
+ * The app mounts `auth.handler` on `config.basePath` (`betterAuthHandler()`): the routes belong to the app.
  */
 import { betterAuth } from "better-auth";
 import { mongodbAdapter } from "better-auth/adapters/mongodb";
-import { organization } from "better-auth/plugins";
-import { passkey } from "@better-auth/passkey";
 import type { Db, MongoClient } from "mongodb";
 import type { BetterAuthConfig } from "./config.js";
+import { betterAuthOptions } from "./options.js";
 
 /**
- * The parts of a Better Auth server that an app uses. Mount `handler` on `config.basePath`, for
- * example with `toNodeHandler` of `better-auth/node`. `SessionPrincipals` reads `api.getSession`.
+ * The parts of a Better Auth server that an app uses. Mount `handler` on `config.basePath` with
+ * `betterAuthHandler()`, which adds the credentialed CORS of the trusted origins. `SessionPrincipals`
+ * reads `api.getSession`.
  */
 export interface BetterAuthServer {
   /** The handler of the auth routes. */
@@ -28,28 +28,5 @@ export interface BetterAuthServer {
 
 /** This function makes the Better Auth server of a configuration. */
 export function createBetterAuth(db: Db, client: MongoClient, config: BetterAuthConfig): BetterAuthServer {
-  const testHooks = {
-    user: {
-      create: {
-        before: async (user: Record<string, unknown>): Promise<{ data: Record<string, unknown> }> => ({ data: { ...user, emailVerified: true } }),
-      },
-    },
-  };
-  return betterAuth({
-    appName: config.appName,
-    basePath: config.basePath,
-    baseURL: config.baseURL,
-    secret: config.secret,
-    database: mongodbAdapter(db, { client }),
-    trustedOrigins: [...config.trustedOrigins],
-    socialProviders: {
-      ...(config.github ? { github: { ...config.github } } : {}),
-      ...(config.google ? { google: { ...config.google } } : {}),
-    },
-    emailAndPassword: { enabled: config.testAccounts },
-    // A test account has no email check: the test server trusts its email
-    ...(config.testAccounts ? { databaseHooks: testHooks } : {}),
-    // The passkeys expect the origins of the app, not the Origin header of each request
-    plugins: [organization(), passkey({ rpID: config.rpID, rpName: config.appName, origin: [...config.trustedOrigins] })],
-  });
+  return betterAuth(betterAuthOptions(config, mongodbAdapter(db, { client })));
 }

package/src/config.ts

@@ -7,6 +7,7 @@
  * - `GOOGLE_CLIENT_ID` and `GOOGLE_CLIENT_SECRET`: the sign-in with Google.
  * - `AUTH_TEST_ACCOUNTS=1`: accounts with an email and a password, for the tests. Production refuses it.
  * - `PASSKEY_RP_ID`: the domain of the passkeys (default: the host of the first trusted origin).
+ * - `AUTH_CROSS_SITE_COOKIES=1`: the session cookies get `SameSite=None` and `Secure`, for a page on another site.
  */
 
 /** The client id and the secret of an OAuth provider. */
@@ -31,6 +32,12 @@ export interface BetterAuthConfig {
   readonly testAccounts: boolean;
   /** The relying party of the passkeys: a domain of the origins of the app. */
   readonly rpID: string;
+  /**
+   * True: the cookies of Better Auth get `SameSite=None` and `Secure`, so a page on another site
+   * sends them (CLI-49). A browser keeps a `Secure` cookie only over HTTPS or from `localhost`.
+   * The default is false: `SameSite=Lax`.
+   */
+  readonly crossSiteCookies?: boolean | undefined;
 }
 
 /** The options of `betterAuthConfig`. */
@@ -73,5 +80,6 @@ export function betterAuthConfig(env: Readonly<Record<string, string | undefined
     ...(google ? { google } : {}),
     testAccounts: env["AUTH_TEST_ACCOUNTS"] === "1",
     rpID: env["PASSKEY_RP_ID"] || firstHost,
+    ...(env["AUTH_CROSS_SITE_COOKIES"] === "1" ? { crossSiteCookies: true } : {}),
   };
 }