@stratal/framework 0.0.0-canary-ccb3f17 → 0.0.0-canary-e5681b8

package/README.md

@@ -1,6 +1,6 @@
 # @stratal/framework
 
-Authentication, database ORM, RBAC, guards, and test factories for [Stratal](https://github.com/strataljs/stratal) applications.
+Authentication, database ORM, access control, guards, and test factories for [Stratal](https://stratal.dev) applications.
 
 [![npm version](https://img.shields.io/npm/v/@stratal/framework)](https://www.npmjs.com/package/@stratal/framework)
 [![CI](https://github.com/strataljs/stratal/actions/workflows/ci.yml/badge.svg)](https://github.com/strataljs/stratal/actions/workflows/ci.yml)
@@ -13,13 +13,13 @@ Authentication, database ORM, RBAC, guards, and test factories for [Stratal](htt
 [![PRs Welcome](https://img.shields.io/badge/PRs-welcome-brightgreen.svg)](https://github.com/strataljs/stratal/pulls)
 [![GitHub stars](https://img.shields.io/github/stars/strataljs/stratal?style=social)](https://github.com/strataljs/stratal)
 
-## Modules
+## What's inside
 
-- **AuthModule** — Better Auth integration with session management and middleware
-- **DatabaseModule** — ZenStack ORM with support for multiple named connections
-- **RbacModule** — Casbin-based role-based access control with ZenStack policy adapter
-- **AuthGuard** — Authentication and scoped authorization guard for route protection
-- **AuthContext** — Request-scoped user context for accessing the authenticated user
+- **DatabaseModule** — ZenStack ORM with multiple named connections, plus `db:*` and `migrate:*` Quarry commands
+- **AuthModule** — Better Auth integration with session verification middleware and a `ctx.user()` shorthand
+- **Access control** — Resources, roles and permissions built on Better Auth's `access` plugin
+- **AuthGuard** — Authentication and permission enforcement for routes and controllers
+- **AuthContext** — Request-scoped user context for the authenticated user
 - **Factory** — Test data factories with sequenced attributes powered by Faker.js
 
 ## Installation
@@ -32,16 +32,25 @@ yarn add @stratal/framework
 
 ### Peer dependencies
 
-| Package | Required |
+| Package | Notes |
 |---|---|
-| `stratal` | Yes |
-| `@zenstackhq/orm` | Yes |
-| `pg` | Yes |
-| `better-auth` | No — needed for `AuthModule` |
-| `@better-auth/core` | No — needed for `AuthModule` |
-| `@zenstackhq/better-auth` | No — needed for `AuthModule` |
-| `casbin` | No — needed for `RbacModule` |
-| `@faker-js/faker` | No — needed for `Factory` |
+| `stratal` | The core framework |
+| `@zenstackhq/orm` | ORM runtime |
+| `@zenstackhq/schema` | Generated schema types |
+| `pg` | PostgreSQL driver |
+| `better-auth` | Authentication |
+| `@better-auth/core` | Authentication |
+
+### Sub-path exports
+
+```typescript
+import { AuthModule } from '@stratal/framework/auth'
+import { DatabaseModule } from '@stratal/framework/database'
+import { createAccessControl } from '@stratal/framework/access-control'
+import { AuthGuard } from '@stratal/framework/guards'
+import type { AuthContext, AuthUser } from '@stratal/framework/context'
+import { Factory } from '@stratal/framework/factory'
+```
 
 ### AI Agent Skills
 
@@ -53,27 +62,48 @@ npx skills add strataljs/stratal
 
 | Skill | Description |
 |---|---|
-| `stratal` | Build Cloudflare Workers apps with the Stratal framework — modules, DI, controllers, routing, OpenAPI, queues, cron, events, seeders, CLI, auth, database, RBAC, testing, and more |
+| `stratal` | Build Cloudflare Workers apps with the Stratal framework — modules, DI, controllers, routing, OpenAPI, queues, cron, events, seeders, CLI, auth, database, access control, testing, and more |
 
 ## Quick Start
 
 ```typescript
 import { Stratal } from 'stratal'
+import { DI_TOKENS } from 'stratal/di'
 import { Module } from 'stratal/module'
 import { AuthModule } from '@stratal/framework/auth'
-import { DatabaseModule } from '@stratal/framework/database'
-import { RbacModule } from '@stratal/framework/rbac'
+import { createPoolFactory, DatabaseModule } from '@stratal/framework/database'
+import { PostgresDialect } from 'kysely'
+import { Pool } from 'pg'
+import { permissions } from './permissions'
+import { schema } from './zenstack/schema'
 
 @Module({
   imports: [
-    DatabaseModule.forRoot({
-      connections: [{ name: 'default', connectionString: 'DATABASE_URL' }],
+    DatabaseModule.forRootAsync({
+      inject: [DI_TOKENS.CloudflareEnv],
+      useFactory: (env) => ({
+        default: 'main',
+        connections: [
+          {
+            name: 'main',
+            schema,
+            dialect: () => new PostgresDialect({
+              pool: createPoolFactory(env, () => new Pool({
+                connectionString: env.HYPERDRIVE.connectionString,
+              })),
+            }),
+          },
+        ],
+      }),
     }),
     AuthModule.forRootAsync({
-      inject: [],
-      useFactory: () => ({ /* Better Auth options */ }),
+      inject: [DI_TOKENS.Database],
+      useFactory: (db) => ({
+        database: db,
+        emailAndPassword: { enabled: true },
+        accessControl: permissions,
+      }),
     }),
-    RbacModule.forRoot({ model: MODEL }),
   ],
 })
 class AppModule {}
@@ -81,10 +111,122 @@ class AppModule {}
 export default new Stratal({ module: AppModule })
 ```
 
+A connection takes a generated ZenStack `schema` and a `dialect` factory. `createPoolFactory()` picks the connection topology from the environment — a fresh pool per resolution behind Hyperdrive in production, one shared pool under `@stratal/testing` — so your app config never branches on whether it is running under test.
+
+The factory is only called when the module initializes, so a large generated schema can sit behind an `import()` and stay out of the isolate's startup budget.
+
+## Access control
+
+Define resources and roles once with `createAccessControl()`, then hand the result to Better Auth:
+
+```typescript
+// permissions.ts
+import { createAccessControl } from '@stratal/framework/access-control'
+
+export const permissions = createAccessControl({
+  resources: {
+    posts: ['create', 'read', 'update', 'delete'],
+    admin: ['access'],
+  } as const,
+  roles: {
+    user: { posts: ['create', 'read'] },
+    editor: { posts: ['create', 'read', 'update'] },
+    admin: { posts: ['create', 'read', 'update', 'delete'], admin: ['access'] },
+  },
+})
+```
+
+Compose roles with `extendRole()` — duplicate resource keys are merged, not overwritten:
+
+```typescript
+import { extendRole } from '@stratal/framework/access-control'
+
+const { ac, roles } = permissions
+const superAdmin = extendRole(ac, roles.admin, { users: ['ban', 'delete'] })
+```
+
+## Guards
+
+`AuthGuard()` enforces authentication; pass `permissions` to enforce authorization too. Prefer guards over checking the auth context by hand — they throw the right 401 / 403 automatically.
+
+```typescript
+import { AuthGuard } from '@stratal/framework/guards'
+import { UseGuards } from 'stratal/guards'
+import { Controller } from 'stratal/router'
+
+@Controller('/profile', { version: '1' })
+@UseGuards(AuthGuard())
+export class ProfileController {}
+
+@Controller('/admin', { version: '1' })
+@UseGuards(AuthGuard({ permissions: 'admin:access' }))
+export class AdminController {}
+
+// Several permissions — all must be satisfied by one of the user's roles
+@Controller('/posts', { version: '1' })
+@UseGuards(AuthGuard({ permissions: ['posts:update', 'posts:delete'] }))
+export class PostsController {}
+```
+
+Permissions are written `resource:action`; `resource` alone means "any action on that resource". A list is combined with AND — every permission must be granted — while a user holding several roles passes if any one role satisfies the whole list.
+
+Guards can also be applied per method, and combined with Stratal's [versioning](https://stratal.dev) so the version never has to be written into the path.
+
+## Reading the authenticated user
+
+Enforcement belongs on the guard, not in the handler. Once `AuthGuard()` is applied, the route only runs for an authenticated user, so reading the user is just a read:
+
+```typescript
+@Controller('/profile', { version: '1' })
+@UseGuards(AuthGuard())
+export class ProfileController {
+  async show(ctx: RouterContext) {
+    return ctx.json(await this.service.forUser(ctx.user().id))
+  }
+}
+```
+
+`ctx.user()` is a `RouterContext` shorthand that `AuthModule` adds. Inject `AuthContext` where you don't have the request context to hand:
+
+```typescript
+import type { AuthContext } from '@stratal/framework/context'
+import { DI_TOKENS, inject, Transient } from 'stratal/di'
+
+@Transient()
+export class ProfileService {
+  constructor(@inject(DI_TOKENS.AuthContext) private auth: AuthContext) {}
+
+  profile() {
+    return this.auth.requireUser()
+  }
+}
+```
+
+`requireUser()` throws `UserNotAuthenticatedError` when signed out — a backstop for code reachable outside a guarded route, not a substitute for the guard. `getUser()` returns `AuthUser | undefined` instead of throwing, and `getRoles()` splits `user.role` on commas.
+
+Augment `AuthUser` to type your own fields:
+
+```typescript
+declare module '@stratal/framework/context' {
+  interface AuthUser {
+    firstName: string
+    role: string
+  }
+}
+```
+
 ## Documentation
 
 Full guides and examples are available at **[stratal.dev](https://stratal.dev)**.
 
+## Support the project
+
+If Stratal is useful to you, **[star the repository](https://github.com/strataljs/stratal)** — it is the simplest way to help others find it.
+
+## Maintainer
+
+Built and maintained by **Temitayo Fadojutimi** — [@adesege_](https://x.com/adesege_).
+
 ## License
 
 MIT

package/dist/access-control/index.d.mts

@@ -5,7 +5,7 @@ import { Middleware, Next, RouterContext } from "stratal/router";
 import { AccessControl, Role, Statements } from "better-auth/plugins/access";
 import { BetterAuthPlugin } from "better-auth";
 //#region src/access-control/tokens.d.ts
-declare const AC_TOKENS: {
+export declare const AC_TOKENS: {
   /** Request-scoped access service */
   readonly AccessService: symbol;
   /** Access control module options (ac, roles) */
@@ -39,7 +39,7 @@ declare const AC_TOKENS: {
  * plugins: [admin({ ...permissions })]
  * ```
  */
-declare function createAccessControl<const TResources extends Statements, const TRoles extends Record<string, RolePermissions<TResources>>>(config: {
+export declare function createAccessControl<const TResources extends Statements, const TRoles extends Record<string, RolePermissions<TResources>>>(config: {
   resources: TResources;
   roles: TRoles;
 }): AccessControlOptions<TResources, TRoles>;
@@ -74,7 +74,7 @@ type MergeStatements<A extends Statements, B extends Partial<Record<string, read
  * // if userRole had posts: ['create', 'read'], editorRole has posts: ['create', 'read', 'update']
  * ```
  */
-declare function extendRole<TParent extends Statements, TExtra extends Partial<Record<string, readonly string[]>>>(ac: AccessControl<TParent>, parent: Role<TParent>, extra: TExtra): Role<MergeStatements<TParent, TExtra>>;
+export declare function extendRole<TParent extends Statements, TExtra extends Partial<Record<string, readonly string[]>>>(ac: AccessControl<TParent>, parent: Role<TParent>, extra: TExtra): Role<MergeStatements<TParent, TExtra>>;
 //#endregion
 //#region src/access-control/plugin.d.ts
 /**
@@ -86,7 +86,7 @@ declare function extendRole<TParent extends Statements, TExtra extends Partial<R
  * Auto-added to Better Auth options when `accessControl` is provided to
  * `AuthModule.forRootAsync()`. Users never call this directly.
  */
-declare function createStratalAcPlugin(_options: AccessControlOptions): BetterAuthPlugin;
+export declare function createStratalAcPlugin(_options: AccessControlOptions): BetterAuthPlugin;
 //#endregion
 //#region src/access-control/services/access.service.d.ts
 /**
@@ -116,7 +116,7 @@ declare function createStratalAcPlugin(_options: AccessControlOptions): BetterAu
  * await accessService.setUserRole(userId, ['editor', 'reviewer'])
  * ```
  */
-declare class AccessService {
+export declare class AccessService {
   private readonly authContext;
   private readonly authService;
   private readonly options;
@@ -184,18 +184,18 @@ declare class AccessService {
  * Wrapped in `ctx.always()` so partial reloads never drop the prop; the client
  * treats an absent `access` prop as a wiring error, not as "denied".
  */
-declare class AccessShareMiddleware implements Middleware {
+export declare class AccessShareMiddleware implements Middleware {
   private readonly access?;
   constructor(access?: AccessService | undefined);
   handle(ctx: RouterContext, next: Next): Promise<void>;
 }
 //#endregion
 //#region src/access-control/errors/insufficient-permissions.error.d.ts
-declare class InsufficientPermissionsError extends HttpException {
+export declare class InsufficientPermissionsError extends HttpException {
   readonly requiredPermissions: string;
   readonly userId?: string;
   constructor(requiredPermissions: string | string[], userId?: string);
 }
 //#endregion
-export { AC_TOKENS, type AccessControlOptions, AccessService, AccessShareMiddleware, InsufficientPermissionsError, createAccessControl, createStratalAcPlugin, extendRole };
+export type { AccessControlOptions };
 //# sourceMappingURL=index.d.mts.map

package/dist/access-control/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../../src/access-control/tokens.ts","../../src/access-control/create-access-control.ts","../../src/access-control/extend-role.ts","../../src/access-control/plugin.ts","../../src/access-control/services/access.service.ts","../../src/access-control/access-share.middleware.ts","../../src/access-control/errors/insufficient-permissions.error.ts"],"mappings":";;;;;;;cAAa;;WAEX;;WAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBC0Bc,0BACR,mBAAmB,kBACnB,eAAe,eAAe,gBAAgB,cACpD;EACA,WAAW;EACX,OAAO;IACL,qBAAqB,YAAY;;;;;;;;;;;;;;KCvBhC,gBACH,UAAU,YACV,UAAU,QAAQ,yCAEjB,WAAW,UAAU,IAAI,gBAAgB,IACxC,gBAAgB,cACN,EAAE,aAAa,YAAY,EAAE,iBACvC,EAAE,KACF,gBAAgB,IAChB,YAAY,EAAE;;;;;;;;;;;;;;;;;;iBAqBF,WACd,gBAAgB,YAChB,eAAe,QAAQ,oCAEvB,IAAI,cAAc,UAClB,QAAQ,KAAK,UACb,OAAO,SACN,KAAK,gBAAgB,SAAS;;;;;;;;;;;;iBCtCjB,sBAAsB,UAAU,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cC4B1D;mBAGQ;mBAEA;mBAEA;EANnB,YAEmB,aAAa,aAEb,aAAa,aAEb,SAAS;;;;;;;EAStB,aAAa,iBAAiB;;;;;;EAe9B,YAAY,gBAAgB,0BAA0B;;;;;;EActD,cAAc,gBAAgB,aAAa,2BAA2B;;;;;EAStE,sBAAsB,iBAAiB,QAAQ;;;;;EASrD;;;;;EAQA,yBAAyB,aAAa;;;;;EAUtC,6BAA6B;UAKrB;UAqBA;;;;;;;;;;;;;;;;;;;;;;;cC7GG,iCAAiC;mBAGzB;EAFnB,YAEmB,SAAS;EAGtB,OAAO,KAAK,eAAe,MAAM,OAAO;;;;cC1CnC,qCAAqC;WAChC;WACA;EAEhB,YAAY,wCAAwC"}
+{"version":3,"file":"index.d.mts","names":[],"sources":["../../src/access-control/tokens.ts","../../src/access-control/create-access-control.ts","../../src/access-control/extend-role.ts","../../src/access-control/plugin.ts","../../src/access-control/services/access.service.ts","../../src/access-control/access-share.middleware.ts","../../src/access-control/errors/insufficient-permissions.error.ts"],"mappings":";;;;;;;qBAAa;;WAEX;;WAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wBC0Bc,0BACR,mBAAmB,kBACnB,eAAe,eAAe,gBAAgB,cACpD;EACA,WAAW;EACX,OAAO;IACL,qBAAqB,YAAY;;;;;;;;;;;;;;KCvBhC,gBACH,UAAU,YACV,UAAU,QAAQ,yCAEjB,WAAW,UAAU,IAAI,gBAAgB,IACxC,gBAAgB,cACN,EAAE,aAAa,YAAY,EAAE,iBACvC,EAAE,KACF,gBAAgB,IAChB,YAAY,EAAE;;;;;;;;;;;;;;;;;;wBAqBF,WACd,gBAAgB,YAChB,eAAe,QAAQ,oCAEvB,IAAI,cAAc,UAClB,QAAQ,KAAK,UACb,OAAO,SACN,KAAK,gBAAgB,SAAS;;;;;;;;;;;;wBCtCjB,sBAAsB,UAAU,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qBC4B1D;mBAGQ;mBAEA;mBAEA;EANnB,YAEmB,aAAa,aAEb,aAAa,aAEb,SAAS;;;;;;;EAStB,aAAa,iBAAiB;;;;;;EAe9B,YAAY,gBAAgB,0BAA0B;;;;;;EActD,cAAc,gBAAgB,aAAa,2BAA2B;;;;;EAStE,sBAAsB,iBAAiB,QAAQ;;;;;EASrD;;;;;EAQA,yBAAyB,aAAa;;;;;EAUtC,6BAA6B;UAKrB;UAqBA;;;;;;;;;;;;;;;;;;;;;;;qBC7GG,iCAAiC;mBAGzB;EAFnB,YAEmB,SAAS;EAGtB,OAAO,KAAK,eAAe,MAAM,OAAO;;;;qBC1CnC,qCAAqC;WAChC;WACA;EAEhB,YAAY,wCAAwC"}

package/dist/access-control/index.mjs

@@ -1,5 +1,5 @@
-import { n as AC_TOKENS } from "../decorateParam-DQ95ttaa.mjs";
-import { a as AccessShareMiddleware, i as createStratalAcPlugin, t as AccessService } from "../access.service-rsEreT-4.mjs";
+import { n as AC_TOKENS } from "../decorateParam-xwTkq9gO.mjs";
+import { a as AccessShareMiddleware, i as createStratalAcPlugin, t as AccessService } from "../access.service-BjmnWBEo.mjs";
 import { t as InsufficientPermissionsError } from "../insufficient-permissions.error-DeEyZRgy.mjs";
 import { createAccessControl as createAccessControl$1 } from "better-auth/plugins/access";
 //#region src/access-control/create-access-control.ts

package/dist/{access.service-rsEreT-4.mjs → access.service-BjmnWBEo.mjs}

@@ -1,5 +1,5 @@
-import { n as AC_TOKENS, t as __decorateParam } from "./decorateParam-DQ95ttaa.mjs";
-import { t as __decorate } from "./decorate-ZDdbRmsv.mjs";
+import { n as AC_TOKENS, t as __decorateParam } from "./decorateParam-xwTkq9gO.mjs";
+import { t as __decorate } from "./decorate-RQD1h28J.mjs";
 import { DI_TOKENS, Request, Transient, inject } from "stratal/di";
 //#region src/access-control/access-share.middleware.ts
 let AccessShareMiddleware = class AccessShareMiddleware {
@@ -157,4 +157,4 @@ AccessService = __decorate([
 //#endregion
 export { AccessShareMiddleware as a, createStratalAcPlugin as i, AUTH_OPTIONS as n, AUTH_SERVICE as r, AccessService as t };
 
-//# sourceMappingURL=access.service-rsEreT-4.mjs.map
+//# sourceMappingURL=access.service-BjmnWBEo.mjs.map

package/dist/{access.service-rsEreT-4.mjs.map → access.service-BjmnWBEo.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"access.service-rsEreT-4.mjs","names":[],"sources":["../src/access-control/access-share.middleware.ts","../src/access-control/plugin.ts","../src/auth/auth.tokens.ts","../src/access-control/services/access.service.ts"],"sourcesContent":["import { inject, Transient } from 'stratal/di'\nimport type { Middleware, Next, RouterContext } from 'stratal/router'\nimport type { AccessService } from './services/access.service'\nimport { AC_TOKENS } from './tokens'\n\n/**\n * The Inertia methods this middleware needs, declared structurally.\n *\n * `@stratal/framework` must not depend on `@stratal/inertia` (the dependency\n * runs the other way at the type level, via the generated registry), so the\n * two optional context methods are described here and probed at runtime\n * instead of pulled in through a `/// <reference types=\"...\" />`.\n */\ninterface MaybeInertiaContext {\n  share?: (key: string, value: unknown) => void\n  always?: <T>(callback: () => T) => unknown\n}\n\n/**\n * Shares the current user's roles and merged permissions as the `access` prop\n * on every Inertia page rendered during the request, so the client can gate\n * rendering with `<Can>` / `<HasRole>` from `@stratal/inertia/react/access`.\n *\n * Both values come from `AuthContext` (populated by\n * `SessionVerificationMiddleware`) — no database hit and no I/O, which is why\n * this is registered globally by `AuthModule` rather than being opt-in the way\n * `FeatureFlagShareMiddleware` is.\n *\n * Inert unless access control is configured and Inertia is installed. Not\n * restricted to `GET`: an Inertia render can legally happen on any method —\n * e.g. `return ctx.inertia('Posts/Create', {...})` from a `POST` handler\n * re-rendering after a validation failure — and every `<Can>` / `useCan` on\n * that page needs `access` just as much as it would on a full `GET` visit.\n *\n * Wrapped in `ctx.always()` so partial reloads never drop the prop; the client\n * treats an absent `access` prop as a wiring error, not as \"denied\".\n */\n@Transient()\nexport class AccessShareMiddleware implements Middleware {\n  constructor(\n    @inject(AC_TOKENS.AccessService, { isOptional: true })\n    private readonly access?: AccessService,\n  ) { }\n\n  async handle(ctx: RouterContext, next: Next): Promise<void> {\n    const access = this.access\n    const inertia = ctx as RouterContext & MaybeInertiaContext\n\n    if (\n      access\n      && typeof inertia.share === 'function'\n      && typeof inertia.always === 'function'\n    ) {\n      inertia.share('access', inertia.always(() => ({\n        roles: access.getCurrentUserRoles(),\n        permissions: access.getCurrentUserPermissions(),\n      })))\n    }\n\n    await next()\n  }\n}\n","import type { BetterAuthPlugin } from 'better-auth'\nimport type { AccessControlOptions } from './types'\n\n/**\n * Creates the Stratal access control Better Auth plugin.\n *\n * Ensures the `user.role` schema field exists.\n * No endpoints are added — all permission logic lives in AccessService.\n *\n * Auto-added to Better Auth options when `accessControl` is provided to\n * `AuthModule.forRootAsync()`. Users never call this directly.\n */\nexport function createStratalAcPlugin(_options: AccessControlOptions): BetterAuthPlugin {\n  return {\n    id: 'stratal-ac',\n    schema: {\n      user: {\n        fields: {\n          role: {\n            type: 'string',\n            required: false,\n            input: false,\n            defaultValue: 'user',\n          },\n        },\n      },\n    },\n  }\n}\n","/** Token for AuthService - core authentication service */\nexport const AUTH_SERVICE = Symbol.for('stratal:auth:service')\n\n/** Token for Better Auth options configuration */\nexport const AUTH_OPTIONS = Symbol.for('stratal:auth:options')\n","import { DI_TOKENS, inject, Request } from 'stratal/di'\nimport { AUTH_SERVICE } from '../../auth/auth.tokens'\nimport type { AuthService } from '../../auth/services/auth.service'\nimport type { AuthContext } from '../../context/auth-context'\nimport { AC_TOKENS } from '../tokens'\nimport type { AccessControlOptions } from '../types'\n\nfunction parseRoles(role: string | null | undefined): string[] {\n  if (!role) return []\n  return role.split(',').map(r => r.trim()).filter(Boolean)\n}\n\n/**\n * AccessService\n *\n * Request-scoped service for role and permission management.\n *\n * Roles for the current user are read from AuthContext (populated by\n * SessionVerificationMiddleware — no DB hit). Other users are resolved\n * from the database.\n *\n * Permission checks use Better Auth's `role.authorize()` locally with\n * OR logic — access is granted if any of the user's roles allows it.\n *\n * @example\n * ```typescript\n * // Check current user\n * await accessService.currentUserHasPermission({ posts: ['update'] })\n *\n * // Check arbitrary user (e.g. from an admin action)\n * await accessService.hasPermission(userId, { admin: ['access'] })\n *\n * // Assign a role\n * await accessService.setUserRole(userId, 'admin')\n *\n * // Assign multiple roles\n * await accessService.setUserRole(userId, ['editor', 'reviewer'])\n * ```\n */\n@Request(AC_TOKENS.AccessService)\nexport class AccessService {\n  constructor(\n    @inject(DI_TOKENS.AuthContext)\n    private readonly authContext: AuthContext,\n    @inject(AUTH_SERVICE)\n    private readonly authService: AuthService,\n    @inject(AC_TOKENS.Options)\n    private readonly options: AccessControlOptions\n  ) { }\n\n  /**\n   * Get all roles for a user.\n   *\n   * Uses AuthContext for the current user (no DB hit).\n   * Falls back to DB for other users.\n   */\n  async getUserRoles(userId: string): Promise<string[]> {\n    if (userId === this.authContext.getUserId()) {\n      const roles = this.authContext.getRoles()\n      if (roles.length > 0) return roles\n    }\n    const ctx = await this.authService.auth.$context\n    const user = await ctx.internalAdapter.findUserById(userId)\n    return parseRoles((user as { role?: string | null } | null)?.role)\n  }\n\n  /**\n   * Assign one or more roles to a user.\n   *\n   * Multiple roles are stored as a comma-separated string in `user.role`.\n   */\n  async setUserRole(userId: string, role: string | string[]): Promise<void> {\n    const roleStr = Array.isArray(role) ? role.join(',') : role\n    const ctx = await this.authService.auth.$context\n    await ctx.internalAdapter.updateUser(\n      userId,\n      { role: roleStr } as Parameters<typeof ctx.internalAdapter.updateUser>[1]\n    )\n  }\n\n  /**\n   * Check if a user has the required permissions.\n   *\n   * Returns true if any of the user's roles grants all of the requested permissions.\n   */\n  async hasPermission(userId: string, permissions: Record<string, string[]>): Promise<boolean> {\n    const roles = await this.getUserRoles(userId)\n    return this.checkPermissions(roles, permissions)\n  }\n\n  /**\n   * Get the merged permission set for a user across all their roles.\n   * Useful for sending to the frontend.\n   */\n  async getPermissionsForUser(userId: string): Promise<Record<string, string[]>> {\n    const roles = await this.getUserRoles(userId)\n    return this.mergePermissions(roles)\n  }\n\n  /**\n   * Get all roles for the currently authenticated user.\n   * Reads from AuthContext — no DB hit.\n   */\n  getCurrentUserRoles(): string[] {\n    return this.authContext.getRoles()\n  }\n\n  /**\n   * Check if the currently authenticated user has the required permissions.\n   * Reads roles from AuthContext — no DB hit.\n   */\n  currentUserHasPermission(permissions: Record<string, string[]>): boolean {\n    const roles = this.authContext.getRoles()\n    if (roles.length === 0) return false\n    return this.checkPermissions(roles, permissions)\n  }\n\n  /**\n   * Get merged permissions for the currently authenticated user.\n   * Reads roles from AuthContext — no DB hit.\n   */\n  getCurrentUserPermissions(): Record<string, string[]> {\n    const roles = this.authContext.getRoles()\n    return this.mergePermissions(roles)\n  }\n\n  private checkPermissions(roles: string[], permissions: Record<string, string[]>): boolean {\n    return roles.some(roleName => {\n      const roleObj = this.options.roles[roleName]\n      if (!roleObj) return false\n\n      const specific: Record<string, string[]> = {}\n\n      for (const [resource, actions] of Object.entries(permissions)) {\n        if (actions.includes('*')) {\n          // Wildcard: role must have at least one action defined for this resource\n          const roleActions = (roleObj.statements as Record<string, readonly string[]>)[resource]\n          if (!roleActions?.length) return false\n        } else {\n          specific[resource] = actions\n        }\n      }\n\n      return Object.keys(specific).length === 0 || roleObj.authorize(specific).success\n    })\n  }\n\n  private mergePermissions(roles: string[]): Record<string, string[]> {\n    const result: Record<string, string[]> = {}\n    for (const roleName of roles) {\n      const roleObj = this.options.roles[roleName]\n      if (!roleObj) continue\n      for (const [resource, actions] of Object.entries(roleObj.statements)) {\n        result[resource] ??= []\n        for (const action of actions as string[]) {\n          if (!result[resource].includes(action)) {\n            result[resource].push(action)\n          }\n        }\n      }\n    }\n    return result\n  }\n}\n"],"mappings":";;;;AAsCO,IAAM,wBAAN,MAAM,sBAA4C;CAGpC;CAFnB,YACE,QAEA;EADiB,KAAA,SAAA;CACf;CAEJ,MAAM,OAAO,KAAoB,MAA2B;EAC1D,MAAM,SAAS,KAAK;EACpB,MAAM,UAAU;EAEhB,IACE,UACG,OAAO,QAAQ,UAAU,cACzB,OAAO,QAAQ,WAAW,YAE7B,QAAQ,MAAM,UAAU,QAAQ,cAAc;GAC5C,OAAO,OAAO,oBAAoB;GAClC,aAAa,OAAO,0BAA0B;EAChD,EAAE,CAAC;EAGL,MAAM,KAAK;CACb;AACF;AAxBC,wBAAA,WAAA,CAAA,UAAU,GAAA,gBAAA,GAGN,OAAO,UAAU,eAAe,EAAE,YAAY,KAAK,CAAC,CAAA,CAAA,GAAA,qBAAA;;;;;;;;;;;;AC5BzD,SAAgB,sBAAsB,UAAkD;CACtF,OAAO;EACL,IAAI;EACJ,QAAQ,EACN,MAAM,EACJ,QAAQ,EACN,MAAM;GACJ,MAAM;GACN,UAAU;GACV,OAAO;GACP,cAAc;EAChB,EACF,EACF,EACF;CACF;AACF;;;;AC3BA,MAAa,eAAe,OAAO,IAAI,sBAAsB;;AAG7D,MAAa,eAAe,OAAO,IAAI,sBAAsB;;;ACG7D,SAAS,WAAW,MAA2C;CAC7D,IAAI,CAAC,MAAM,OAAO,CAAC;CACnB,OAAO,KAAK,MAAM,GAAG,CAAC,CAAC,KAAI,MAAK,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,OAAO;AAC1D;AA8BO,IAAM,gBAAN,MAAM,cAAc;CAGN;CAEA;CAEA;CANnB,YACE,aAEA,aAEA,SAEA;EALiB,KAAA,cAAA;EAEA,KAAA,cAAA;EAEA,KAAA,UAAA;CACf;;;;;;;CAQJ,MAAM,aAAa,QAAmC;EACpD,IAAI,WAAW,KAAK,YAAY,UAAU,GAAG;GAC3C,MAAM,QAAQ,KAAK,YAAY,SAAS;GACxC,IAAI,MAAM,SAAS,GAAG,OAAO;EAC/B;EAGA,OAAO,YAAY,OADA,MADD,KAAK,YAAY,KAAK,SAAA,CACjB,gBAAgB,aAAa,MAAM,EAAA,EACG,IAAI;CACnE;;;;;;CAOA,MAAM,YAAY,QAAgB,MAAwC;EACxE,MAAM,UAAU,MAAM,QAAQ,IAAI,IAAI,KAAK,KAAK,GAAG,IAAI;EAEvD,OAAM,MADY,KAAK,YAAY,KAAK,SAAA,CAC9B,gBAAgB,WACxB,QACA,EAAE,MAAM,QAAQ,CAClB;CACF;;;;;;CAOA,MAAM,cAAc,QAAgB,aAAyD;EAC3F,MAAM,QAAQ,MAAM,KAAK,aAAa,MAAM;EAC5C,OAAO,KAAK,iBAAiB,OAAO,WAAW;CACjD;;;;;CAMA,MAAM,sBAAsB,QAAmD;EAC7E,MAAM,QAAQ,MAAM,KAAK,aAAa,MAAM;EAC5C,OAAO,KAAK,iBAAiB,KAAK;CACpC;;;;;CAMA,sBAAgC;EAC9B,OAAO,KAAK,YAAY,SAAS;CACnC;;;;;CAMA,yBAAyB,aAAgD;EACvE,MAAM,QAAQ,KAAK,YAAY,SAAS;EACxC,IAAI,MAAM,WAAW,GAAG,OAAO;EAC/B,OAAO,KAAK,iBAAiB,OAAO,WAAW;CACjD;;;;;CAMA,4BAAsD;EACpD,MAAM,QAAQ,KAAK,YAAY,SAAS;EACxC,OAAO,KAAK,iBAAiB,KAAK;CACpC;CAEA,iBAAyB,OAAiB,aAAgD;EACxF,OAAO,MAAM,MAAK,aAAY;GAC5B,MAAM,UAAU,KAAK,QAAQ,MAAM;GACnC,IAAI,CAAC,SAAS,OAAO;GAErB,MAAM,WAAqC,CAAC;GAE5C,KAAK,MAAM,CAAC,UAAU,YAAY,OAAO,QAAQ,WAAW,GAC1D,IAAI,QAAQ,SAAS,GAAG,GAGlB;QAAA,CADiB,QAAQ,WAAiD,SAC9D,EAAE,QAAQ,OAAO;GAAA,OAEjC,SAAS,YAAY;GAIzB,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,WAAW,KAAK,QAAQ,UAAU,QAAQ,CAAC,CAAC;EAC3E,CAAC;CACH;CAEA,iBAAyB,OAA2C;EAClE,MAAM,SAAmC,CAAC;EAC1C,KAAK,MAAM,YAAY,OAAO;GAC5B,MAAM,UAAU,KAAK,QAAQ,MAAM;GACnC,IAAI,CAAC,SAAS;GACd,KAAK,MAAM,CAAC,UAAU,YAAY,OAAO,QAAQ,QAAQ,UAAU,GAAG;IACpE,OAAO,cAAc,CAAC;IACtB,KAAK,MAAM,UAAU,SACnB,IAAI,CAAC,OAAO,SAAS,CAAC,SAAS,MAAM,GACnC,OAAO,SAAS,CAAC,KAAK,MAAM;GAGlC;EACF;EACA,OAAO;CACT;AACF;;CA5HC,QAAQ,UAAU,aAAa;CAG3B,gBAAA,GAAA,OAAO,UAAU,WAAW,CAAA;CAE5B,gBAAA,GAAA,OAAO,YAAY,CAAA;CAEnB,gBAAA,GAAA,OAAO,UAAU,OAAO,CAAA"}
+{"version":3,"file":"access.service-BjmnWBEo.mjs","names":[],"sources":["../src/access-control/access-share.middleware.ts","../src/access-control/plugin.ts","../src/auth/auth.tokens.ts","../src/access-control/services/access.service.ts"],"sourcesContent":["import { inject, Transient } from 'stratal/di'\nimport type { Middleware, Next, RouterContext } from 'stratal/router'\nimport type { AccessService } from './services/access.service'\nimport { AC_TOKENS } from './tokens'\n\n/**\n * The Inertia methods this middleware needs, declared structurally.\n *\n * `@stratal/framework` must not depend on `@stratal/inertia` (the dependency\n * runs the other way at the type level, via the generated registry), so the\n * two optional context methods are described here and probed at runtime\n * instead of pulled in through a `/// <reference types=\"...\" />`.\n */\ninterface MaybeInertiaContext {\n  share?: (key: string, value: unknown) => void\n  always?: <T>(callback: () => T) => unknown\n}\n\n/**\n * Shares the current user's roles and merged permissions as the `access` prop\n * on every Inertia page rendered during the request, so the client can gate\n * rendering with `<Can>` / `<HasRole>` from `@stratal/inertia/react/access`.\n *\n * Both values come from `AuthContext` (populated by\n * `SessionVerificationMiddleware`) — no database hit and no I/O, which is why\n * this is registered globally by `AuthModule` rather than being opt-in the way\n * `FeatureFlagShareMiddleware` is.\n *\n * Inert unless access control is configured and Inertia is installed. Not\n * restricted to `GET`: an Inertia render can legally happen on any method —\n * e.g. `return ctx.inertia('Posts/Create', {...})` from a `POST` handler\n * re-rendering after a validation failure — and every `<Can>` / `useCan` on\n * that page needs `access` just as much as it would on a full `GET` visit.\n *\n * Wrapped in `ctx.always()` so partial reloads never drop the prop; the client\n * treats an absent `access` prop as a wiring error, not as \"denied\".\n */\n@Transient()\nexport class AccessShareMiddleware implements Middleware {\n  constructor(\n    @inject(AC_TOKENS.AccessService, { isOptional: true })\n    private readonly access?: AccessService,\n  ) { }\n\n  async handle(ctx: RouterContext, next: Next): Promise<void> {\n    const access = this.access\n    const inertia = ctx as RouterContext & MaybeInertiaContext\n\n    if (\n      access\n      && typeof inertia.share === 'function'\n      && typeof inertia.always === 'function'\n    ) {\n      inertia.share('access', inertia.always(() => ({\n        roles: access.getCurrentUserRoles(),\n        permissions: access.getCurrentUserPermissions(),\n      })))\n    }\n\n    await next()\n  }\n}\n","import type { BetterAuthPlugin } from 'better-auth'\nimport type { AccessControlOptions } from './types'\n\n/**\n * Creates the Stratal access control Better Auth plugin.\n *\n * Ensures the `user.role` schema field exists.\n * No endpoints are added — all permission logic lives in AccessService.\n *\n * Auto-added to Better Auth options when `accessControl` is provided to\n * `AuthModule.forRootAsync()`. Users never call this directly.\n */\nexport function createStratalAcPlugin(_options: AccessControlOptions): BetterAuthPlugin {\n  return {\n    id: 'stratal-ac',\n    schema: {\n      user: {\n        fields: {\n          role: {\n            type: 'string',\n            required: false,\n            input: false,\n            defaultValue: 'user',\n          },\n        },\n      },\n    },\n  }\n}\n","/** Token for AuthService - core authentication service */\nexport const AUTH_SERVICE = Symbol.for('stratal:auth:service')\n\n/** Token for Better Auth options configuration */\nexport const AUTH_OPTIONS = Symbol.for('stratal:auth:options')\n","import { DI_TOKENS, inject, Request } from 'stratal/di'\nimport { AUTH_SERVICE } from '../../auth/auth.tokens'\nimport type { AuthService } from '../../auth/services/auth.service'\nimport type { AuthContext } from '../../context/auth-context'\nimport { AC_TOKENS } from '../tokens'\nimport type { AccessControlOptions } from '../types'\n\nfunction parseRoles(role: string | null | undefined): string[] {\n  if (!role) return []\n  return role.split(',').map(r => r.trim()).filter(Boolean)\n}\n\n/**\n * AccessService\n *\n * Request-scoped service for role and permission management.\n *\n * Roles for the current user are read from AuthContext (populated by\n * SessionVerificationMiddleware — no DB hit). Other users are resolved\n * from the database.\n *\n * Permission checks use Better Auth's `role.authorize()` locally with\n * OR logic — access is granted if any of the user's roles allows it.\n *\n * @example\n * ```typescript\n * // Check current user\n * await accessService.currentUserHasPermission({ posts: ['update'] })\n *\n * // Check arbitrary user (e.g. from an admin action)\n * await accessService.hasPermission(userId, { admin: ['access'] })\n *\n * // Assign a role\n * await accessService.setUserRole(userId, 'admin')\n *\n * // Assign multiple roles\n * await accessService.setUserRole(userId, ['editor', 'reviewer'])\n * ```\n */\n@Request(AC_TOKENS.AccessService)\nexport class AccessService {\n  constructor(\n    @inject(DI_TOKENS.AuthContext)\n    private readonly authContext: AuthContext,\n    @inject(AUTH_SERVICE)\n    private readonly authService: AuthService,\n    @inject(AC_TOKENS.Options)\n    private readonly options: AccessControlOptions\n  ) { }\n\n  /**\n   * Get all roles for a user.\n   *\n   * Uses AuthContext for the current user (no DB hit).\n   * Falls back to DB for other users.\n   */\n  async getUserRoles(userId: string): Promise<string[]> {\n    if (userId === this.authContext.getUserId()) {\n      const roles = this.authContext.getRoles()\n      if (roles.length > 0) return roles\n    }\n    const ctx = await this.authService.auth.$context\n    const user = await ctx.internalAdapter.findUserById(userId)\n    return parseRoles((user as { role?: string | null } | null)?.role)\n  }\n\n  /**\n   * Assign one or more roles to a user.\n   *\n   * Multiple roles are stored as a comma-separated string in `user.role`.\n   */\n  async setUserRole(userId: string, role: string | string[]): Promise<void> {\n    const roleStr = Array.isArray(role) ? role.join(',') : role\n    const ctx = await this.authService.auth.$context\n    await ctx.internalAdapter.updateUser(\n      userId,\n      { role: roleStr } as Parameters<typeof ctx.internalAdapter.updateUser>[1]\n    )\n  }\n\n  /**\n   * Check if a user has the required permissions.\n   *\n   * Returns true if any of the user's roles grants all of the requested permissions.\n   */\n  async hasPermission(userId: string, permissions: Record<string, string[]>): Promise<boolean> {\n    const roles = await this.getUserRoles(userId)\n    return this.checkPermissions(roles, permissions)\n  }\n\n  /**\n   * Get the merged permission set for a user across all their roles.\n   * Useful for sending to the frontend.\n   */\n  async getPermissionsForUser(userId: string): Promise<Record<string, string[]>> {\n    const roles = await this.getUserRoles(userId)\n    return this.mergePermissions(roles)\n  }\n\n  /**\n   * Get all roles for the currently authenticated user.\n   * Reads from AuthContext — no DB hit.\n   */\n  getCurrentUserRoles(): string[] {\n    return this.authContext.getRoles()\n  }\n\n  /**\n   * Check if the currently authenticated user has the required permissions.\n   * Reads roles from AuthContext — no DB hit.\n   */\n  currentUserHasPermission(permissions: Record<string, string[]>): boolean {\n    const roles = this.authContext.getRoles()\n    if (roles.length === 0) return false\n    return this.checkPermissions(roles, permissions)\n  }\n\n  /**\n   * Get merged permissions for the currently authenticated user.\n   * Reads roles from AuthContext — no DB hit.\n   */\n  getCurrentUserPermissions(): Record<string, string[]> {\n    const roles = this.authContext.getRoles()\n    return this.mergePermissions(roles)\n  }\n\n  private checkPermissions(roles: string[], permissions: Record<string, string[]>): boolean {\n    return roles.some(roleName => {\n      const roleObj = this.options.roles[roleName]\n      if (!roleObj) return false\n\n      const specific: Record<string, string[]> = {}\n\n      for (const [resource, actions] of Object.entries(permissions)) {\n        if (actions.includes('*')) {\n          // Wildcard: role must have at least one action defined for this resource\n          const roleActions = (roleObj.statements as Record<string, readonly string[]>)[resource]\n          if (!roleActions?.length) return false\n        } else {\n          specific[resource] = actions\n        }\n      }\n\n      return Object.keys(specific).length === 0 || roleObj.authorize(specific).success\n    })\n  }\n\n  private mergePermissions(roles: string[]): Record<string, string[]> {\n    const result: Record<string, string[]> = {}\n    for (const roleName of roles) {\n      const roleObj = this.options.roles[roleName]\n      if (!roleObj) continue\n      for (const [resource, actions] of Object.entries(roleObj.statements)) {\n        result[resource] ??= []\n        for (const action of actions as string[]) {\n          if (!result[resource].includes(action)) {\n            result[resource].push(action)\n          }\n        }\n      }\n    }\n    return result\n  }\n}\n"],"mappings":";;;;AAsCO,IAAM,wBAAN,MAAM,sBAA4C;CAGpC;CAFnB,YACE,QAEA;EADiB,KAAA,SAAA;CACf;CAEJ,MAAM,OAAO,KAAoB,MAA2B;EAC1D,MAAM,SAAS,KAAK;EACpB,MAAM,UAAU;EAEhB,IACE,UACG,OAAO,QAAQ,UAAU,cACzB,OAAO,QAAQ,WAAW,YAE7B,QAAQ,MAAM,UAAU,QAAQ,cAAc;GAC5C,OAAO,OAAO,oBAAoB;GAClC,aAAa,OAAO,0BAA0B;EAChD,EAAE,CAAC;EAGL,MAAM,KAAK;CACb;AACF;AAxBC,wBAAA,WAAA,CAAA,UAAU,GAAA,gBAAA,GAGN,OAAO,UAAU,eAAe,EAAE,YAAY,KAAK,CAAC,CAAA,CAAA,GAAA,qBAAA;;;;;;;;;;;;AC5BzD,SAAgB,sBAAsB,UAAkD;CACtF,OAAO;EACL,IAAI;EACJ,QAAQ,EACN,MAAM,EACJ,QAAQ,EACN,MAAM;GACJ,MAAM;GACN,UAAU;GACV,OAAO;GACP,cAAc;EAChB,EACF,EACF,EACF;CACF;AACF;;;;AC3BA,MAAa,eAAe,OAAO,IAAI,sBAAsB;;AAG7D,MAAa,eAAe,OAAO,IAAI,sBAAsB;;;ACG7D,SAAS,WAAW,MAA2C;CAC7D,IAAI,CAAC,MAAM,OAAO,CAAC;CACnB,OAAO,KAAK,MAAM,GAAG,CAAC,CAAC,KAAI,MAAK,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,OAAO;AAC1D;AA8BO,IAAM,gBAAN,MAAM,cAAc;CAGN;CAEA;CAEA;CANnB,YACE,aAEA,aAEA,SAEA;EALiB,KAAA,cAAA;EAEA,KAAA,cAAA;EAEA,KAAA,UAAA;CACf;;;;;;;CAQJ,MAAM,aAAa,QAAmC;EACpD,IAAI,WAAW,KAAK,YAAY,UAAU,GAAG;GAC3C,MAAM,QAAQ,KAAK,YAAY,SAAS;GACxC,IAAI,MAAM,SAAS,GAAG,OAAO;EAC/B;EAGA,OAAO,YAAY,OADA,MADD,KAAK,YAAY,KAAK,SAAA,CACjB,gBAAgB,aAAa,MAAM,EAAA,EACG,IAAI;CACnE;;;;;;CAOA,MAAM,YAAY,QAAgB,MAAwC;EACxE,MAAM,UAAU,MAAM,QAAQ,IAAI,IAAI,KAAK,KAAK,GAAG,IAAI;EAEvD,OAAM,MADY,KAAK,YAAY,KAAK,SAAA,CAC9B,gBAAgB,WACxB,QACA,EAAE,MAAM,QAAQ,CAClB;CACF;;;;;;CAOA,MAAM,cAAc,QAAgB,aAAyD;EAC3F,MAAM,QAAQ,MAAM,KAAK,aAAa,MAAM;EAC5C,OAAO,KAAK,iBAAiB,OAAO,WAAW;CACjD;;;;;CAMA,MAAM,sBAAsB,QAAmD;EAC7E,MAAM,QAAQ,MAAM,KAAK,aAAa,MAAM;EAC5C,OAAO,KAAK,iBAAiB,KAAK;CACpC;;;;;CAMA,sBAAgC;EAC9B,OAAO,KAAK,YAAY,SAAS;CACnC;;;;;CAMA,yBAAyB,aAAgD;EACvE,MAAM,QAAQ,KAAK,YAAY,SAAS;EACxC,IAAI,MAAM,WAAW,GAAG,OAAO;EAC/B,OAAO,KAAK,iBAAiB,OAAO,WAAW;CACjD;;;;;CAMA,4BAAsD;EACpD,MAAM,QAAQ,KAAK,YAAY,SAAS;EACxC,OAAO,KAAK,iBAAiB,KAAK;CACpC;CAEA,iBAAyB,OAAiB,aAAgD;EACxF,OAAO,MAAM,MAAK,aAAY;GAC5B,MAAM,UAAU,KAAK,QAAQ,MAAM;GACnC,IAAI,CAAC,SAAS,OAAO;GAErB,MAAM,WAAqC,CAAC;GAE5C,KAAK,MAAM,CAAC,UAAU,YAAY,OAAO,QAAQ,WAAW,GAC1D,IAAI,QAAQ,SAAS,GAAG,GAGlB;QAAA,CADiB,QAAQ,WAAiD,SAC9D,EAAE,QAAQ,OAAO;GAAA,OAEjC,SAAS,YAAY;GAIzB,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,WAAW,KAAK,QAAQ,UAAU,QAAQ,CAAC,CAAC;EAC3E,CAAC;CACH;CAEA,iBAAyB,OAA2C;EAClE,MAAM,SAAmC,CAAC;EAC1C,KAAK,MAAM,YAAY,OAAO;GAC5B,MAAM,UAAU,KAAK,QAAQ,MAAM;GACnC,IAAI,CAAC,SAAS;GACd,KAAK,MAAM,CAAC,UAAU,YAAY,OAAO,QAAQ,QAAQ,UAAU,GAAG;IACpE,OAAO,cAAc,CAAC;IACtB,KAAK,MAAM,UAAU,SACnB,IAAI,CAAC,OAAO,SAAS,CAAC,SAAS,MAAM,GACnC,OAAO,SAAS,CAAC,KAAK,MAAM;GAGlC;EACF;EACA,OAAO;CACT;AACF;;CA5HC,QAAQ,UAAU,aAAa;CAG3B,gBAAA,GAAA,OAAO,UAAU,WAAW,CAAA;CAE5B,gBAAA,GAAA,OAAO,YAAY,CAAA;CAEnB,gBAAA,GAAA,OAAO,UAAU,OAAO,CAAA"}

package/dist/auth/index.d.mts

@@ -20,14 +20,14 @@ declare module 'stratal/router' {
 }
 //#endregion
 //#region src/auth/auth.module.d.ts
-interface AuthModuleAsyncOptions<TOptions extends BetterAuthOptions = BetterAuthOptions> extends AsyncModuleOptions<TOptions> {
+export interface AuthModuleAsyncOptions<TOptions extends BetterAuthOptions = BetterAuthOptions> extends AsyncModuleOptions<TOptions> {
   /**
    * Optional access control configuration.
    * When provided, registers AccessService and auto-adds the Stratal AC plugin to Better Auth.
    */
   accessControl?: AccessControlOptions;
 }
-declare class AuthModule implements RouteConfigurable {
+export declare class AuthModule implements RouteConfigurable {
   /**
    * Configure auth middleware globally.
    *
@@ -62,9 +62,10 @@ declare class AuthModule implements RouteConfigurable {
  * **Responsibilities:**
  * - Calls Better Auth's getSession() API
  * - Populates AuthContext with the user record if the session is valid
+ * - Carries any cookie that read issued through to the response
  * - Continues request chain regardless of session status
  */
-declare class SessionVerificationMiddleware implements Middleware {
+export declare class SessionVerificationMiddleware implements Middleware {
   private readonly authService;
   private logger;
   constructor(authService: AuthService, logger: LoggerService);
@@ -100,139 +101,139 @@ declare class SessionVerificationMiddleware implements Middleware {
  * })
  * ```
  */
-declare const AUTH_GATEWAY_PRIMERS: readonly [typeof SessionVerificationMiddleware];
+export declare const AUTH_GATEWAY_PRIMERS: readonly [typeof SessionVerificationMiddleware];
 //#endregion
 //#region src/auth/auth.tokens.d.ts
 /** Token for AuthService - core authentication service */
-declare const AUTH_SERVICE: unique symbol;
+export declare const AUTH_SERVICE: unique symbol;
 /** Token for Better Auth options configuration */
-declare const AUTH_OPTIONS: unique symbol;
+export declare const AUTH_OPTIONS: unique symbol;
 //#endregion
 //#region src/auth/errors/auth-errors.d.ts
-declare class UserNotFoundError extends HttpException {
+export declare class UserNotFoundError extends HttpException {
   readonly email?: string | undefined;
   constructor(email?: string | undefined);
 }
-declare class InvalidCredentialsError extends HttpException {
+export declare class InvalidCredentialsError extends HttpException {
   constructor();
 }
-declare class InvalidPasswordError extends HttpException {
+export declare class InvalidPasswordError extends HttpException {
   constructor();
 }
-declare class InvalidEmailError extends HttpException {
+export declare class InvalidEmailError extends HttpException {
   readonly email?: string | undefined;
   constructor(email?: string | undefined);
 }
-declare class SessionExpiredError extends HttpException {
+export declare class SessionExpiredError extends HttpException {
   constructor();
 }
-declare class FreshSessionRequiredError extends HttpException {
+export declare class FreshSessionRequiredError extends HttpException {
   constructor();
 }
-declare class EmailNotVerifiedError extends HttpException {
+export declare class EmailNotVerifiedError extends HttpException {
   readonly email?: string | undefined;
   constructor(email?: string | undefined);
 }
-declare class PasswordTooShortError extends HttpException {
+export declare class PasswordTooShortError extends HttpException {
   readonly minLength?: number | undefined;
   constructor(minLength?: number | undefined);
 }
-declare class PasswordTooLongError extends HttpException {
+export declare class PasswordTooLongError extends HttpException {
   readonly maxLength?: number | undefined;
   constructor(maxLength?: number | undefined);
 }
-declare class AccountAlreadyExistsError extends HttpException {
+export declare class AccountAlreadyExistsError extends HttpException {
   readonly email?: string | undefined;
   constructor(email?: string | undefined);
 }
-declare class SocialAccountLinkedError extends HttpException {
+export declare class SocialAccountLinkedError extends HttpException {
   readonly provider?: string | undefined;
   constructor(provider?: string | undefined);
 }
-declare class CannotUnlinkLastAccountError extends HttpException {
+export declare class CannotUnlinkLastAccountError extends HttpException {
   constructor();
 }
-declare class ProviderNotFoundError extends HttpException {
+export declare class ProviderNotFoundError extends HttpException {
   readonly provider?: string | undefined;
   constructor(provider?: string | undefined);
 }
-declare class UserEmailNotFoundError extends HttpException {
+export declare class UserEmailNotFoundError extends HttpException {
   constructor();
 }
-declare class AccountNotFoundError extends HttpException {
+export declare class AccountNotFoundError extends HttpException {
   constructor();
 }
-declare class CredentialAccountNotFoundError extends HttpException {
+export declare class CredentialAccountNotFoundError extends HttpException {
   constructor();
 }
-declare class UserAlreadyHasPasswordError extends HttpException {
+export declare class UserAlreadyHasPasswordError extends HttpException {
   constructor();
 }
-declare class EmailCannotBeUpdatedError extends HttpException {
+export declare class EmailCannotBeUpdatedError extends HttpException {
   readonly reason?: string | undefined;
   constructor(reason?: string | undefined);
 }
-declare class IdTokenNotSupportedError extends HttpException {
+export declare class IdTokenNotSupportedError extends HttpException {
   constructor();
 }
-declare class TokenExpiredError extends HttpException {
+export declare class TokenExpiredError extends HttpException {
   constructor();
 }
-declare class InvalidCallbackUrlError extends HttpException {
+export declare class InvalidCallbackUrlError extends HttpException {
   constructor();
 }
-declare class InvalidOriginError extends HttpException {
+export declare class InvalidOriginError extends HttpException {
   constructor();
 }
-declare class AuthValidationFailedError extends HttpException {
+export declare class AuthValidationFailedError extends HttpException {
   constructor();
 }
-declare class EmailAlreadyVerifiedError extends HttpException {
+export declare class EmailAlreadyVerifiedError extends HttpException {
   constructor();
 }
-declare class EmailMismatchError extends HttpException {
+export declare class EmailMismatchError extends HttpException {
   constructor();
 }
 //#endregion
 //#region src/auth/errors/invalid-token.error.d.ts
-declare class InvalidTokenError extends HttpException {
+export declare class InvalidTokenError extends HttpException {
   constructor();
 }
 //#endregion
 //#region src/auth/errors/organization-errors.d.ts
-declare class OrganizationNotFoundError extends HttpException {
+export declare class OrganizationNotFoundError extends HttpException {
   constructor();
 }
-declare class OrganizationMemberNotFoundError extends HttpException {
+export declare class OrganizationMemberNotFoundError extends HttpException {
   constructor();
 }
-declare class OrganizationInvitationNotFoundError extends HttpException {
+export declare class OrganizationInvitationNotFoundError extends HttpException {
   constructor();
 }
-declare class OrganizationPermissionDeniedError extends HttpException {
+export declare class OrganizationPermissionDeniedError extends HttpException {
   constructor();
 }
-declare class OrganizationInvitationRecipientMismatchError extends HttpException {
+export declare class OrganizationInvitationRecipientMismatchError extends HttpException {
   constructor();
 }
-declare class OrganizationConflictError extends HttpException {
+export declare class OrganizationConflictError extends HttpException {
   constructor();
 }
-declare class OrganizationLimitReachedError extends HttpException {
+export declare class OrganizationLimitReachedError extends HttpException {
   constructor();
 }
-declare class OrganizationMembershipError extends HttpException {
+export declare class OrganizationMembershipError extends HttpException {
   constructor();
 }
-declare class OrganizationTeamNotFoundError extends HttpException {
+export declare class OrganizationTeamNotFoundError extends HttpException {
   constructor();
 }
-declare class OrganizationRoleNotFoundError extends HttpException {
+export declare class OrganizationRoleNotFoundError extends HttpException {
   constructor();
 }
 //#endregion
 //#region src/auth/errors/token-required.error.d.ts
-declare class TokenRequiredError extends HttpException {
+export declare class TokenRequiredError extends HttpException {
   constructor();
 }
 //#endregion
@@ -241,23 +242,23 @@ declare class TokenRequiredError extends HttpException {
  * Get shared Better Auth error handler configuration.
  * Use this in Better Auth config's onAPIError option.
  */
-declare function getErrorHandlerConfig(): BetterAuthOptions['onAPIError'];
+export declare function getErrorHandlerConfig(): BetterAuthOptions['onAPIError'];
 /**
  * Wrap a Better Auth function in a try/catch block and map errors to ApplicationError.
  */
-declare const wrapBetterAuth: <T>(fn: () => Promise<T>) => Promise<T>;
+export declare const wrapBetterAuth: <T>(fn: () => Promise<T>) => Promise<T>;
 //#endregion
 //#region src/auth/utils/better-auth-error-handler.d.ts
 /**
  * Maps Better Auth API error codes to ApplicationError instances.
  */
-declare function mapBetterAuthError(error: APIError): ApplicationError;
+export declare function mapBetterAuthError(error: APIError): ApplicationError;
 /**
  * Type guard to check if an error is a Better Auth APIError.
  * Uses duck typing to handle bundler environments (e.g. Vite)
  * where instanceof may fail across module boundaries.
  */
-declare function isAPIError(error: unknown): error is APIError;
+export declare function isAPIError(error: unknown): error is APIError;
 //#endregion
-export { AUTH_GATEWAY_PRIMERS, AUTH_OPTIONS, AUTH_SERVICE, AccountAlreadyExistsError, AccountNotFoundError, AuthModule, AuthModuleAsyncOptions, AuthService, AuthValidationFailedError, CannotUnlinkLastAccountError, CredentialAccountNotFoundError, EmailAlreadyVerifiedError, EmailCannotBeUpdatedError, EmailMismatchError, EmailNotVerifiedError, FreshSessionRequiredError, IdTokenNotSupportedError, InvalidCallbackUrlError, InvalidCredentialsError, InvalidEmailError, InvalidOriginError, InvalidPasswordError, InvalidTokenError, OrganizationConflictError, OrganizationInvitationNotFoundError, OrganizationInvitationRecipientMismatchError, OrganizationLimitReachedError, OrganizationMemberNotFoundError, OrganizationMembershipError, OrganizationNotFoundError, OrganizationPermissionDeniedError, OrganizationRoleNotFoundError, OrganizationTeamNotFoundError, PasswordTooLongError, PasswordTooShortError, ProviderNotFoundError, SessionExpiredError, SessionVerificationMiddleware, SocialAccountLinkedError, TokenExpiredError, TokenRequiredError, UserAlreadyHasPasswordError, UserEmailNotFoundError, UserNotFoundError, getErrorHandlerConfig, isAPIError, mapBetterAuthError, wrapBetterAuth };
+export { AuthService };
 //# sourceMappingURL=index.d.mts.map