@stratal/framework 0.0.18 → 0.0.20

package/dist/auth/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":[],"sources":["../../src/auth/auth.tokens.ts","../../src/auth/middleware/auth-context.middleware.ts","../../src/auth/middleware/session-verification.middleware.ts","../../src/auth/errors/auth-errors.ts","../../src/auth/errors/invalid-token.error.ts","../../src/auth/errors/token-required.error.ts","../../src/auth/errors/verification-failed.error.ts","../../src/auth/utils/better-auth-error-handler.ts","../../src/auth/utils/auth-helpers.ts","../../src/auth/services/auth.service.ts","../../src/auth/auth.module.ts"],"sourcesContent":["/** Token for AuthService - core authentication service */\nexport const AUTH_SERVICE = Symbol.for('stratal:auth:service')\n\n/** Token for Better Auth options configuration */\nexport const AUTH_OPTIONS = Symbol.for('stratal:auth:options')\n","import { DI_TOKENS, Transient } from 'stratal/di'\nimport type { Middleware, Next, RouterContext } from 'stratal/router'\nimport { AuthContext } from '../../context/auth-context'\n\n/**\n * Auth Context Middleware\n *\n * Registers AuthContext in the request container at the start of each request.\n * This MUST run before SessionVerificationMiddleware and any other middleware\n * that depends on AuthContext.\n */\n@Transient()\nexport class AuthContextMiddleware implements Middleware {\n  async handle(ctx: RouterContext, next: Next): Promise<void> {\n    const requestContainer = ctx.getContainer()\n\n    const authContext = new AuthContext()\n    requestContainer.registerValue(DI_TOKENS.AuthContext, authContext)\n\n    await next()\n  }\n}\n","import { DI_TOKENS, Transient } from 'stratal/di'\nimport { LOGGER_TOKENS, type LoggerService } from 'stratal/logger'\nimport type { Middleware, Next, RouterContext } from 'stratal/router'\nimport { inject } from 'tsyringe'\nimport { type AuthContext } from '../../context/auth-context'\nimport { AUTH_SERVICE } from '../auth.tokens'\nimport type { AuthService } from '../services/auth.service'\n\n/**\n * Session Verification Middleware\n *\n * Verifies user session via Better Auth and populates AuthContext with userId.\n *\n * **Responsibilities:**\n * - Calls Better Auth's getSession() API\n * - Populates AuthContext with userId if session is valid\n * - Continues request chain regardless of session status\n */\n@Transient()\nexport class SessionVerificationMiddleware implements Middleware {\n  constructor(\n    @inject(AUTH_SERVICE)\n    private readonly authService: AuthService,\n    @inject(LOGGER_TOKENS.LoggerService) private logger: LoggerService\n  ) { }\n\n  async handle(ctx: RouterContext, next: Next): Promise<void> {\n    try {\n      const session = await this.authService.auth.api.getSession({\n        headers: ctx.c.req.raw.headers\n      })\n\n      if (session) {\n        const authContext = ctx.getContainer().resolve<AuthContext>(DI_TOKENS.AuthContext)\n        authContext.setAuthContext({ userId: session.user.id })\n      }\n\n      await next()\n    } catch (error: unknown) {\n      this.logger.debug('Session validation failed (e.g., invalidated in DB)', { error });\n      await next()\n    }\n  }\n}\n","import { ApplicationError, ERROR_CODES } from 'stratal/errors'\n\nexport class UserNotFoundError extends ApplicationError {\n  constructor(email?: string) {\n    super('errors.auth.userNotFound', ERROR_CODES.RESOURCE.NOT_FOUND, email ? { email } : undefined)\n  }\n}\n\nexport class InvalidCredentialsError extends ApplicationError {\n  constructor() {\n    super('errors.auth.invalidCredentials', ERROR_CODES.AUTH.INVALID_CREDENTIALS)\n  }\n}\n\nexport class InvalidPasswordError extends ApplicationError {\n  constructor() {\n    super('errors.auth.invalidPassword', ERROR_CODES.AUTH.INVALID_CREDENTIALS)\n  }\n}\n\nexport class InvalidEmailError extends ApplicationError {\n  constructor(email?: string) {\n    super('errors.auth.invalidEmail', ERROR_CODES.VALIDATION.INVALID_FORMAT, email ? { email } : undefined)\n  }\n}\n\nexport class SessionExpiredError extends ApplicationError {\n  constructor() {\n    super('errors.auth.sessionExpired', ERROR_CODES.AUTH.SESSION_EXPIRED)\n  }\n}\n\nexport class EmailNotVerifiedError extends ApplicationError {\n  constructor(email?: string) {\n    super('errors.auth.emailNotVerified', ERROR_CODES.AUTH.EMAIL_NOT_VERIFIED, email ? { email } : undefined)\n  }\n}\n\nexport class PasswordTooShortError extends ApplicationError {\n  constructor(minLength: number) {\n    super('errors.auth.passwordTooShort', ERROR_CODES.AUTH.PASSWORD_TOO_SHORT, { minLength })\n  }\n}\n\nexport class PasswordTooLongError extends ApplicationError {\n  constructor(maxLength: number) {\n    super('errors.auth.passwordTooLong', ERROR_CODES.AUTH.PASSWORD_TOO_LONG, { maxLength })\n  }\n}\n\nexport class AccountAlreadyExistsError extends ApplicationError {\n  constructor(email?: string) {\n    super('errors.auth.accountAlreadyExists', ERROR_CODES.AUTH.ACCOUNT_ALREADY_EXISTS, email ? { email } : undefined)\n  }\n}\n\nexport class FailedToCreateUserError extends ApplicationError {\n  constructor(reason?: string) {\n    super('errors.auth.failedToCreateUser', ERROR_CODES.AUTH.FAILED_TO_CREATE_USER, reason ? { reason } : undefined)\n  }\n}\n\nexport class FailedToCreateSessionError extends ApplicationError {\n  constructor(reason?: string) {\n    super('errors.auth.failedToCreateSession', ERROR_CODES.AUTH.FAILED_TO_CREATE_SESSION, reason ? { reason } : undefined)\n  }\n}\n\nexport class FailedToUpdateUserError extends ApplicationError {\n  constructor(reason?: string) {\n    super('errors.auth.failedToUpdateUser', ERROR_CODES.AUTH.FAILED_TO_UPDATE_USER, reason ? { reason } : undefined)\n  }\n}\n\nexport class SocialAccountLinkedError extends ApplicationError {\n  constructor(provider?: string) {\n    super('errors.auth.socialAccountLinked', ERROR_CODES.AUTH.SOCIAL_ACCOUNT_LINKED, provider ? { provider } : undefined)\n  }\n}\n\nexport class CannotUnlinkLastAccountError extends ApplicationError {\n  constructor() {\n    super('errors.auth.cannotUnlinkLastAccount', ERROR_CODES.AUTH.CANNOT_UNLINK_LAST_ACCOUNT)\n  }\n}\n\nexport class ProviderNotFoundError extends ApplicationError {\n  constructor(provider?: string) {\n    super('errors.auth.providerNotFound', ERROR_CODES.RESOURCE.NOT_FOUND, provider ? { provider } : undefined)\n  }\n}\n\nexport class UserEmailNotFoundError extends ApplicationError {\n  constructor() {\n    super('errors.auth.userEmailNotFound', ERROR_CODES.RESOURCE.NOT_FOUND)\n  }\n}\n\nexport class AccountNotFoundError extends ApplicationError {\n  constructor() {\n    super('errors.auth.accountNotFound', ERROR_CODES.RESOURCE.NOT_FOUND)\n  }\n}\n\nexport class CredentialAccountNotFoundError extends ApplicationError {\n  constructor() {\n    super('errors.auth.credentialAccountNotFound', ERROR_CODES.RESOURCE.NOT_FOUND)\n  }\n}\n\nexport class UserAlreadyHasPasswordError extends ApplicationError {\n  constructor() {\n    super('errors.auth.userAlreadyHasPassword', ERROR_CODES.RESOURCE.CONFLICT)\n  }\n}\n\nexport class EmailCannotBeUpdatedError extends ApplicationError {\n  constructor(reason?: string) {\n    super('errors.auth.emailCannotBeUpdated', ERROR_CODES.VALIDATION.GENERIC, reason ? { reason } : undefined)\n  }\n}\n\nexport class FailedToGetSessionError extends ApplicationError {\n  constructor(reason?: string) {\n    super('errors.auth.failedToGetSession', ERROR_CODES.SYSTEM.INTERNAL_ERROR, reason ? { reason } : undefined)\n  }\n}\n\nexport class FailedToGetUserInfoError extends ApplicationError {\n  constructor(reason?: string) {\n    super('errors.auth.failedToGetUserInfo', ERROR_CODES.SYSTEM.INTERNAL_ERROR, reason ? { reason } : undefined)\n  }\n}\n\nexport class IdTokenNotSupportedError extends ApplicationError {\n  constructor() {\n    super('errors.auth.invalidToken', ERROR_CODES.VALIDATION.GENERIC)\n  }\n}\n\nexport class TokenExpiredError extends ApplicationError {\n  constructor() {\n    super('errors.auth.tokenExpired', ERROR_CODES.VALIDATION.GENERIC)\n  }\n}\n","import { ApplicationError, ERROR_CODES } from 'stratal/errors'\n\nexport class InvalidTokenError extends ApplicationError {\n  constructor() {\n    super('errors.auth.invalidToken', ERROR_CODES.AUTH.INVALID_TOKEN)\n  }\n}\n","import { ApplicationError, ERROR_CODES } from 'stratal/errors'\n\nexport class TokenRequiredError extends ApplicationError {\n  constructor() {\n    super('errors.auth.tokenRequired', ERROR_CODES.VALIDATION.REQUIRED_FIELD, { field: 'token' })\n  }\n}\n","import { ApplicationError, ERROR_CODES } from 'stratal/errors'\n\nexport class VerificationFailedError extends ApplicationError {\n  constructor() {\n    super('errors.auth.verificationFailed', ERROR_CODES.AUTH.INVALID_CREDENTIALS)\n  }\n}\n","import { type BASE_ERROR_CODES } from '@better-auth/core/error'\nimport { APIError } from 'better-auth/api'\nimport type { ApplicationError } from 'stratal/errors'\nimport { InternalError } from 'stratal/errors'\nimport {\n  AccountAlreadyExistsError,\n  AccountNotFoundError,\n  CannotUnlinkLastAccountError,\n  CredentialAccountNotFoundError,\n  EmailCannotBeUpdatedError,\n  EmailNotVerifiedError,\n  FailedToCreateSessionError,\n  FailedToCreateUserError,\n  FailedToGetSessionError,\n  FailedToGetUserInfoError,\n  FailedToUpdateUserError,\n  IdTokenNotSupportedError,\n  InvalidCredentialsError,\n  InvalidEmailError,\n  InvalidPasswordError,\n  InvalidTokenError,\n  PasswordTooLongError,\n  PasswordTooShortError,\n  ProviderNotFoundError,\n  SessionExpiredError,\n  SocialAccountLinkedError,\n  TokenExpiredError,\n  UserAlreadyHasPasswordError,\n  UserEmailNotFoundError,\n  UserNotFoundError,\n} from '../errors'\n\n/**\n * Maps Better Auth API error codes to ApplicationError instances.\n */\nexport function mapBetterAuthError(error: APIError): ApplicationError {\n  const errorCode = error.body?.code as keyof typeof BASE_ERROR_CODES | 'TOKEN_EXPIRED' | undefined\n\n  if (error.status === 'FOUND') {\n    const headers = error.headers as Headers\n    const location = headers.get('location') ?? ''\n\n    if (location.includes('INVALID_TOKEN')) return new InvalidTokenError()\n    if (location.includes('EXPIRED_TOKEN')) return new TokenExpiredError()\n    if (location.includes('ATTEMPTS_EXCEEDED')) return new InvalidTokenError()\n    if (location.includes('new_user_signup_disabled')) return new UserNotFoundError()\n    if (location.includes('failed_to_create_user')) return new FailedToCreateUserError()\n    if (location.includes('failed_to_create_session')) return new FailedToCreateSessionError()\n  }\n\n  if (!errorCode) {\n    return new InternalError({\n      originalError: `Better Auth error: ${error.message}`,\n      stack: error.stack,\n    })\n  }\n\n  // User errors\n  if (errorCode === 'USER_NOT_FOUND') return new UserNotFoundError()\n  if (errorCode === 'USER_EMAIL_NOT_FOUND') return new UserEmailNotFoundError()\n\n  // Credential errors\n  if (errorCode === 'INVALID_EMAIL_OR_PASSWORD') return new InvalidCredentialsError()\n  if (errorCode === 'INVALID_PASSWORD') return new InvalidPasswordError()\n  if (errorCode === 'INVALID_EMAIL') return new InvalidEmailError()\n\n  // Session errors\n  if (errorCode === 'SESSION_EXPIRED') return new SessionExpiredError()\n  if (errorCode === 'FAILED_TO_CREATE_SESSION') return new FailedToCreateSessionError()\n  if (errorCode === 'FAILED_TO_GET_SESSION') return new FailedToGetSessionError()\n\n  // Email verification\n  if (errorCode === 'EMAIL_NOT_VERIFIED') return new EmailNotVerifiedError()\n  if (errorCode === 'EMAIL_CAN_NOT_BE_UPDATED') return new EmailCannotBeUpdatedError()\n\n  // Password validation\n  if (errorCode === 'PASSWORD_TOO_SHORT') return new PasswordTooShortError(8)\n  if (errorCode === 'PASSWORD_TOO_LONG') return new PasswordTooLongError(128)\n\n  // Account errors\n  if (errorCode === 'USER_ALREADY_EXISTS' || errorCode === 'USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL') {\n    return new AccountAlreadyExistsError()\n  }\n  if (errorCode === 'ACCOUNT_NOT_FOUND') return new AccountNotFoundError()\n  if (errorCode === 'CREDENTIAL_ACCOUNT_NOT_FOUND') return new CredentialAccountNotFoundError()\n  if (errorCode === 'FAILED_TO_UNLINK_LAST_ACCOUNT') return new CannotUnlinkLastAccountError()\n\n  // User creation/update errors\n  if (errorCode === 'FAILED_TO_CREATE_USER') return new FailedToCreateUserError()\n  if (errorCode === 'FAILED_TO_UPDATE_USER') return new FailedToUpdateUserError()\n  if (errorCode === 'FAILED_TO_GET_USER_INFO') return new FailedToGetUserInfoError()\n\n  // Social account errors\n  if (errorCode === 'SOCIAL_ACCOUNT_ALREADY_LINKED') return new SocialAccountLinkedError()\n  if (errorCode === 'PROVIDER_NOT_FOUND') return new ProviderNotFoundError()\n\n  // Token errors\n  if (errorCode === 'ID_TOKEN_NOT_SUPPORTED') return new IdTokenNotSupportedError()\n  if (errorCode === 'INVALID_TOKEN') return new IdTokenNotSupportedError()\n  if (errorCode === 'TOKEN_EXPIRED') return new TokenExpiredError()\n\n  // Password management\n  if (errorCode === 'USER_ALREADY_HAS_PASSWORD') return new UserAlreadyHasPasswordError()\n\n  // Unknown error code\n  return new InternalError({\n    originalError: `Better Auth error [${errorCode}]: ${error.message}`,\n    stack: error.stack,\n  })\n}\n\n/**\n * Type guard to check if an error is a Better Auth APIError.\n * Uses duck typing to handle bundler environments (e.g. Vite)\n * where instanceof may fail across module boundaries.\n */\nexport function isAPIError(error: unknown): error is APIError {\n  if (error instanceof APIError) return true\n\n  return (\n    error instanceof Error\n    && error.name === 'APIError'\n    && 'status' in error\n    && 'statusCode' in error\n  )\n}\n","import type { BetterAuthOptions } from 'better-auth'\nimport { isAPIError, mapBetterAuthError } from './better-auth-error-handler'\n\n/**\n * Get shared Better Auth error handler configuration.\n * Use this in Better Auth config's onAPIError option.\n */\nexport function getErrorHandlerConfig(): BetterAuthOptions['onAPIError'] {\n  return {\n    throw: false,\n    onError: (error) => {\n      if (isAPIError(error)) {\n        throw mapBetterAuthError(error)\n      }\n      throw error\n    },\n  }\n}\n\n/**\n * Wrap a Better Auth function in a try/catch block and map errors to ApplicationError.\n */\nexport const wrapBetterAuth = async <T>(fn: () => Promise<T>): Promise<T> => {\n  try {\n    return await fn()\n  } catch (error) {\n    if (isAPIError(error)) {\n      throw mapBetterAuthError(error)\n    }\n    throw error\n  }\n}\n","import type { Auth, BetterAuthOptions } from 'better-auth'\nimport { betterAuth } from 'better-auth'\nimport { inject } from 'tsyringe'\nimport { Transient } from 'stratal/di'\nimport { AUTH_OPTIONS, AUTH_SERVICE } from '../auth.tokens'\nimport { getErrorHandlerConfig } from '../utils'\n\n/**\n * AuthService\n *\n * Base authentication service using Better Auth.\n * Configured via AuthModule.forRootAsync() from the application layer.\n *\n * **Extensibility:**\n * Extend this class in application layer to add custom methods.\n *\n * @example\n * ```typescript\n * @Transient(AUTH_SERVICE)\n * export class AppAuthService extends AuthService<AuthOptions> {\n *   async signInMagicLink(email: string) {\n *     return wrapBetterAuth(async () => {\n *       return this.auth.api.signInMagicLink({ body: { email }, headers: new Headers() })\n *     })\n *   }\n * }\n * ```\n */\n@Transient(AUTH_SERVICE)\nexport class AuthService<TOptions extends BetterAuthOptions = BetterAuthOptions> {\n  private authInstance: Auth<TOptions>\n\n  constructor(\n    @inject(AUTH_OPTIONS) protected readonly options: TOptions\n  ) {\n    this.authInstance = betterAuth({\n      ...this.options,\n      onAPIError: getErrorHandlerConfig()\n    }) as Auth<TOptions>\n  }\n\n  /**\n   * Get the Better Auth instance\n   */\n  get auth(): Auth<TOptions> {\n    return this.authInstance\n  }\n}\n","/**\n * Auth Module\n *\n * Provides configurable authentication using Better Auth.\n * Use `forRootAsync` to configure Better Auth options from the application layer.\n *\n * @example\n * ```typescript\n * @Module({\n *   imports: [\n *     AuthModule.forRootAsync({\n *       inject: [DI_TOKENS.Database, CONFIG_TOKENS.ConfigService],\n *       useFactory: (db, config) => createAuthOptions(db, config)\n *     })\n *   ]\n * })\n * export class AppModule {}\n * ```\n */\n\nimport type { BetterAuthOptions } from 'better-auth'\nimport type { RouteConfigurable, Router } from 'stratal/router'\nimport { Module } from 'stratal/module'\nimport type { AsyncModuleOptions, DynamicModule } from 'stratal/module'\nimport { AUTH_OPTIONS, AUTH_SERVICE } from './auth.tokens'\nimport { AuthContextMiddleware } from './middleware/auth-context.middleware'\nimport { SessionVerificationMiddleware } from './middleware/session-verification.middleware'\nimport { AuthService } from './services/auth.service'\n\n@Module({\n  providers: []\n})\nexport class AuthModule implements RouteConfigurable {\n  /**\n   * Configure auth middleware globally.\n   *\n   * Registers middlewares in order:\n   * 1. AuthContextMiddleware - Creates and registers AuthContext in request container\n   * 2. SessionVerificationMiddleware - Verifies session and populates AuthContext with userId\n   */\n  configureRoutes(router: Router): void {\n    router.use(AuthContextMiddleware, SessionVerificationMiddleware)\n  }\n\n  /**\n   * Configure AuthModule with async options factory\n   */\n  static forRootAsync<TOptions extends BetterAuthOptions>(\n    options: AsyncModuleOptions<TOptions>\n  ): DynamicModule {\n    return {\n      module: AuthModule,\n      providers: [\n        {\n          provide: AUTH_OPTIONS,\n          useFactory: options.useFactory,\n          inject: options.inject\n        },\n        {\n          provide: AUTH_SERVICE,\n          useClass: AuthService\n        }\n      ]\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;AACA,MAAa,eAAe,OAAO,IAAI,uBAAuB;;AAG9D,MAAa,eAAe,OAAO,IAAI,uBAAuB;;;ACQvD,IAAA,wBAAA,MAAM,sBAA4C;CACvD,MAAM,OAAO,KAAoB,MAA2B;EAC1D,MAAM,mBAAmB,IAAI,cAAc;EAE3C,MAAM,cAAc,IAAI,aAAa;AACrC,mBAAiB,cAAc,UAAU,aAAa,YAAY;AAElE,QAAM,MAAM;;;oCARf,WAAW,CAAA,EAAA,sBAAA;;;ACQL,IAAA,gCAAA,MAAM,8BAAoD;CAC/D,YACE,aAEA,QACA;AAFiB,OAAA,cAAA;AAC4B,OAAA,SAAA;;CAG/C,MAAM,OAAO,KAAoB,MAA2B;AAC1D,MAAI;GACF,MAAM,UAAU,MAAM,KAAK,YAAY,KAAK,IAAI,WAAW,EACzD,SAAS,IAAI,EAAE,IAAI,IAAI,SACxB,CAAC;AAEF,OAAI,QACkB,KAAI,cAAc,CAAC,QAAqB,UAAU,YAAY,CACtE,eAAe,EAAE,QAAQ,QAAQ,KAAK,IAAI,CAAC;AAGzD,SAAM,MAAM;WACL,OAAgB;AACvB,QAAK,OAAO,MAAM,uDAAuD,EAAE,OAAO,CAAC;AACnF,SAAM,MAAM;;;;;CAtBjB,WAAW;oBAGP,OAAO,aAAa,CAAA;oBAEpB,OAAO,cAAc,cAAc,CAAA;;;;;ACrBxC,IAAa,oBAAb,cAAuC,iBAAiB;CACtD,YAAY,OAAgB;AAC1B,QAAM,4BAA4B,YAAY,SAAS,WAAW,QAAQ,EAAE,OAAO,GAAG,KAAA,EAAU;;;AAIpG,IAAa,0BAAb,cAA6C,iBAAiB;CAC5D,cAAc;AACZ,QAAM,kCAAkC,YAAY,KAAK,oBAAoB;;;AAIjF,IAAa,uBAAb,cAA0C,iBAAiB;CACzD,cAAc;AACZ,QAAM,+BAA+B,YAAY,KAAK,oBAAoB;;;AAI9E,IAAa,oBAAb,cAAuC,iBAAiB;CACtD,YAAY,OAAgB;AAC1B,QAAM,4BAA4B,YAAY,WAAW,gBAAgB,QAAQ,EAAE,OAAO,GAAG,KAAA,EAAU;;;AAI3G,IAAa,sBAAb,cAAyC,iBAAiB;CACxD,cAAc;AACZ,QAAM,8BAA8B,YAAY,KAAK,gBAAgB;;;AAIzE,IAAa,wBAAb,cAA2C,iBAAiB;CAC1D,YAAY,OAAgB;AAC1B,QAAM,gCAAgC,YAAY,KAAK,oBAAoB,QAAQ,EAAE,OAAO,GAAG,KAAA,EAAU;;;AAI7G,IAAa,wBAAb,cAA2C,iBAAiB;CAC1D,YAAY,WAAmB;AAC7B,QAAM,gCAAgC,YAAY,KAAK,oBAAoB,EAAE,WAAW,CAAC;;;AAI7F,IAAa,uBAAb,cAA0C,iBAAiB;CACzD,YAAY,WAAmB;AAC7B,QAAM,+BAA+B,YAAY,KAAK,mBAAmB,EAAE,WAAW,CAAC;;;AAI3F,IAAa,4BAAb,cAA+C,iBAAiB;CAC9D,YAAY,OAAgB;AAC1B,QAAM,oCAAoC,YAAY,KAAK,wBAAwB,QAAQ,EAAE,OAAO,GAAG,KAAA,EAAU;;;AAIrH,IAAa,0BAAb,cAA6C,iBAAiB;CAC5D,YAAY,QAAiB;AAC3B,QAAM,kCAAkC,YAAY,KAAK,uBAAuB,SAAS,EAAE,QAAQ,GAAG,KAAA,EAAU;;;AAIpH,IAAa,6BAAb,cAAgD,iBAAiB;CAC/D,YAAY,QAAiB;AAC3B,QAAM,qCAAqC,YAAY,KAAK,0BAA0B,SAAS,EAAE,QAAQ,GAAG,KAAA,EAAU;;;AAI1H,IAAa,0BAAb,cAA6C,iBAAiB;CAC5D,YAAY,QAAiB;AAC3B,QAAM,kCAAkC,YAAY,KAAK,uBAAuB,SAAS,EAAE,QAAQ,GAAG,KAAA,EAAU;;;AAIpH,IAAa,2BAAb,cAA8C,iBAAiB;CAC7D,YAAY,UAAmB;AAC7B,QAAM,mCAAmC,YAAY,KAAK,uBAAuB,WAAW,EAAE,UAAU,GAAG,KAAA,EAAU;;;AAIzH,IAAa,+BAAb,cAAkD,iBAAiB;CACjE,cAAc;AACZ,QAAM,uCAAuC,YAAY,KAAK,2BAA2B;;;AAI7F,IAAa,wBAAb,cAA2C,iBAAiB;CAC1D,YAAY,UAAmB;AAC7B,QAAM,gCAAgC,YAAY,SAAS,WAAW,WAAW,EAAE,UAAU,GAAG,KAAA,EAAU;;;AAI9G,IAAa,yBAAb,cAA4C,iBAAiB;CAC3D,cAAc;AACZ,QAAM,iCAAiC,YAAY,SAAS,UAAU;;;AAI1E,IAAa,uBAAb,cAA0C,iBAAiB;CACzD,cAAc;AACZ,QAAM,+BAA+B,YAAY,SAAS,UAAU;;;AAIxE,IAAa,iCAAb,cAAoD,iBAAiB;CACnE,cAAc;AACZ,QAAM,yCAAyC,YAAY,SAAS,UAAU;;;AAIlF,IAAa,8BAAb,cAAiD,iBAAiB;CAChE,cAAc;AACZ,QAAM,sCAAsC,YAAY,SAAS,SAAS;;;AAI9E,IAAa,4BAAb,cAA+C,iBAAiB;CAC9D,YAAY,QAAiB;AAC3B,QAAM,oCAAoC,YAAY,WAAW,SAAS,SAAS,EAAE,QAAQ,GAAG,KAAA,EAAU;;;AAI9G,IAAa,0BAAb,cAA6C,iBAAiB;CAC5D,YAAY,QAAiB;AAC3B,QAAM,kCAAkC,YAAY,OAAO,gBAAgB,SAAS,EAAE,QAAQ,GAAG,KAAA,EAAU;;;AAI/G,IAAa,2BAAb,cAA8C,iBAAiB;CAC7D,YAAY,QAAiB;AAC3B,QAAM,mCAAmC,YAAY,OAAO,gBAAgB,SAAS,EAAE,QAAQ,GAAG,KAAA,EAAU;;;AAIhH,IAAa,2BAAb,cAA8C,iBAAiB;CAC7D,cAAc;AACZ,QAAM,4BAA4B,YAAY,WAAW,QAAQ;;;AAIrE,IAAa,oBAAb,cAAuC,iBAAiB;CACtD,cAAc;AACZ,QAAM,4BAA4B,YAAY,WAAW,QAAQ;;;;;AC5IrE,IAAa,oBAAb,cAAuC,iBAAiB;CACtD,cAAc;AACZ,QAAM,4BAA4B,YAAY,KAAK,cAAc;;;;;ACFrE,IAAa,qBAAb,cAAwC,iBAAiB;CACvD,cAAc;AACZ,QAAM,6BAA6B,YAAY,WAAW,gBAAgB,EAAE,OAAO,SAAS,CAAC;;;;;ACFjG,IAAa,0BAAb,cAA6C,iBAAiB;CAC5D,cAAc;AACZ,QAAM,kCAAkC,YAAY,KAAK,oBAAoB;;;;;;;;AC+BjF,SAAgB,mBAAmB,OAAmC;CACpE,MAAM,YAAY,MAAM,MAAM;AAE9B,KAAI,MAAM,WAAW,SAAS;EAE5B,MAAM,WADU,MAAM,QACG,IAAI,WAAW,IAAI;AAE5C,MAAI,SAAS,SAAS,gBAAgB,CAAE,QAAO,IAAI,mBAAmB;AACtE,MAAI,SAAS,SAAS,gBAAgB,CAAE,QAAO,IAAI,mBAAmB;AACtE,MAAI,SAAS,SAAS,oBAAoB,CAAE,QAAO,IAAI,mBAAmB;AAC1E,MAAI,SAAS,SAAS,2BAA2B,CAAE,QAAO,IAAI,mBAAmB;AACjF,MAAI,SAAS,SAAS,wBAAwB,CAAE,QAAO,IAAI,yBAAyB;AACpF,MAAI,SAAS,SAAS,2BAA2B,CAAE,QAAO,IAAI,4BAA4B;;AAG5F,KAAI,CAAC,UACH,QAAO,IAAI,cAAc;EACvB,eAAe,sBAAsB,MAAM;EAC3C,OAAO,MAAM;EACd,CAAC;AAIJ,KAAI,cAAc,iBAAkB,QAAO,IAAI,mBAAmB;AAClE,KAAI,cAAc,uBAAwB,QAAO,IAAI,wBAAwB;AAG7E,KAAI,cAAc,4BAA6B,QAAO,IAAI,yBAAyB;AACnF,KAAI,cAAc,mBAAoB,QAAO,IAAI,sBAAsB;AACvE,KAAI,cAAc,gBAAiB,QAAO,IAAI,mBAAmB;AAGjE,KAAI,cAAc,kBAAmB,QAAO,IAAI,qBAAqB;AACrE,KAAI,cAAc,2BAA4B,QAAO,IAAI,4BAA4B;AACrF,KAAI,cAAc,wBAAyB,QAAO,IAAI,yBAAyB;AAG/E,KAAI,cAAc,qBAAsB,QAAO,IAAI,uBAAuB;AAC1E,KAAI,cAAc,2BAA4B,QAAO,IAAI,2BAA2B;AAGpF,KAAI,cAAc,qBAAsB,QAAO,IAAI,sBAAsB,EAAE;AAC3E,KAAI,cAAc,oBAAqB,QAAO,IAAI,qBAAqB,IAAI;AAG3E,KAAI,cAAc,yBAAyB,cAAc,wCACvD,QAAO,IAAI,2BAA2B;AAExC,KAAI,cAAc,oBAAqB,QAAO,IAAI,sBAAsB;AACxE,KAAI,cAAc,+BAAgC,QAAO,IAAI,gCAAgC;AAC7F,KAAI,cAAc,gCAAiC,QAAO,IAAI,8BAA8B;AAG5F,KAAI,cAAc,wBAAyB,QAAO,IAAI,yBAAyB;AAC/E,KAAI,cAAc,wBAAyB,QAAO,IAAI,yBAAyB;AAC/E,KAAI,cAAc,0BAA2B,QAAO,IAAI,0BAA0B;AAGlF,KAAI,cAAc,gCAAiC,QAAO,IAAI,0BAA0B;AACxF,KAAI,cAAc,qBAAsB,QAAO,IAAI,uBAAuB;AAG1E,KAAI,cAAc,yBAA0B,QAAO,IAAI,0BAA0B;AACjF,KAAI,cAAc,gBAAiB,QAAO,IAAI,0BAA0B;AACxE,KAAI,cAAc,gBAAiB,QAAO,IAAI,mBAAmB;AAGjE,KAAI,cAAc,4BAA6B,QAAO,IAAI,6BAA6B;AAGvF,QAAO,IAAI,cAAc;EACvB,eAAe,sBAAsB,UAAU,KAAK,MAAM;EAC1D,OAAO,MAAM;EACd,CAAC;;;;;;;AAQJ,SAAgB,WAAW,OAAmC;AAC5D,KAAI,iBAAiB,SAAU,QAAO;AAEtC,QACE,iBAAiB,SACd,MAAM,SAAS,cACf,YAAY,SACZ,gBAAgB;;;;;;;;ACpHvB,SAAgB,wBAAyD;AACvE,QAAO;EACL,OAAO;EACP,UAAU,UAAU;AAClB,OAAI,WAAW,MAAM,CACnB,OAAM,mBAAmB,MAAM;AAEjC,SAAM;;EAET;;;;;AAMH,MAAa,iBAAiB,OAAU,OAAqC;AAC3E,KAAI;AACF,SAAO,MAAM,IAAI;UACV,OAAO;AACd,MAAI,WAAW,MAAM,CACnB,OAAM,mBAAmB,MAAM;AAEjC,QAAM;;;;;ACAH,IAAA,cAAA,MAAM,YAAoE;CAC/E;CAEA,YACE,SACA;AADyC,OAAA,UAAA;AAEzC,OAAK,eAAe,WAAW;GAC7B,GAAG,KAAK;GACR,YAAY,uBAAuB;GACpC,CAAC;;;;;CAMJ,IAAI,OAAuB;AACzB,SAAO,KAAK;;;;CAjBf,UAAU,aAAa;oBAKnB,OAAO,aAAa,CAAA;;;;;;ACDlB,IAAA,aAAA,cAAA,MAAM,WAAwC;;;;;;;;CAQnD,gBAAgB,QAAsB;AACpC,SAAO,IAAI,uBAAuB,8BAA8B;;;;;CAMlE,OAAO,aACL,SACe;AACf,SAAO;GACL,QAAA;GACA,WAAW,CACT;IACE,SAAS;IACT,YAAY,QAAQ;IACpB,QAAQ,QAAQ;IACjB,EACD;IACE,SAAS;IACT,UAAU;IACX,CACF;GACF;;;uCAlCJ,OAAO,EACN,WAAW,EAAE,EACd,CAAC,CAAA,EAAA,WAAA"}
+{"version":3,"file":"index.mjs","names":["inject","inject"],"sources":["../../src/auth/auth.tokens.ts","../../src/auth/i18n/en.ts","../../src/auth/middleware/auth-context.middleware.ts","../../src/auth/middleware/session-verification.middleware.ts","../../src/auth/rate-limit-bridge.ts","../../src/auth/errors/auth-errors.ts","../../src/auth/errors/invalid-token.error.ts","../../src/auth/errors/organization-errors.ts","../../src/auth/errors/token-required.error.ts","../../src/auth/errors/verification-failed.error.ts","../../src/auth/utils/better-auth-error-handler.ts","../../src/auth/utils/auth-helpers.ts","../../src/auth/services/auth.service.ts","../../src/auth/auth.module.ts"],"sourcesContent":["/** Token for AuthService - core authentication service */\nexport const AUTH_SERVICE = Symbol.for('stratal:auth:service')\n\n/** Token for Better Auth options configuration */\nexport const AUTH_OPTIONS = Symbol.for('stratal:auth:options')\n","export const authMessages = {\n  en: {\n    auth: {\n      errors: {\n        tokenRequired: 'Verification token is required',\n        invalidToken: 'Invalid or expired verification token',\n        verificationFailed: 'Verification failed. Please try again.',\n        userNotFound: 'User not found. Please check your credentials.',\n        invalidCredentials: 'Invalid email or password',\n        invalidPassword: 'Invalid password',\n        invalidEmail: 'Invalid email address',\n        sessionExpired: 'Your session has expired. Please sign in again.',\n        emailNotVerified: 'Please verify your email address before signing in',\n        passwordTooShort: 'Password must be at least {minLength} characters',\n        passwordTooLong: 'Password must be at most {maxLength} characters',\n        accountAlreadyExists: 'An account with this email already exists',\n        failedToCreateUser: 'Failed to create user account. Please try again.',\n        failedToCreateSession: 'Failed to create session. Please try again.',\n        failedToGetSession: 'Failed to retrieve session. Please try again.',\n        failedToUpdateUser: 'Failed to update user information. Please try again.',\n        failedToGetUserInfo: 'Failed to retrieve user information. Please try again.',\n        socialAccountLinked: 'This social account is already linked to another user',\n        providerNotFound: 'Authentication provider not found',\n        userEmailNotFound: 'User email address not found',\n        accountNotFound: 'Account not found',\n        credentialAccountNotFound: 'Credential account not found',\n        cannotUnlinkLastAccount: 'Cannot unlink your last account',\n        userAlreadyHasPassword: 'User already has a password set',\n        emailCannotBeUpdated: 'Email address cannot be updated at this time',\n        tokenExpired: 'The verification token has expired. Please request a new verification email.',\n        invalidCallbackUrl: 'Invalid callback URL',\n        invalidOrigin: 'Request origin is not allowed',\n        validationFailed: 'Authentication validation failed',\n        emailAlreadyVerified: 'Email address is already verified',\n        emailMismatch: 'Email address does not match',\n        unknownError: 'An authentication error occurred',\n      },\n      org: {\n        organizationNotFound: 'Organization not found',\n        memberNotFound: 'Member not found',\n        invitationNotFound: 'Invitation not found',\n        permissionDenied: 'You do not have permission to perform this action',\n        invitationRecipientMismatch: 'You are not the recipient of this invitation',\n        conflict: 'A resource with this identifier already exists',\n        limitReached: 'The maximum limit has been reached',\n        membershipError: 'This action cannot be performed due to membership constraints',\n        teamNotFound: 'Team not found',\n        roleNotFound: 'Role not found',\n      },\n    },\n  },\n} as const\n\ndeclare module 'stratal/i18n' {\n  interface AppMessageNamespaces {\n    auth: typeof authMessages['en']['auth']\n  }\n}\n","import { DI_TOKENS, Transient } from 'stratal/di'\nimport type { Middleware, Next, RouterContext } from 'stratal/router'\nimport { AuthContext } from '../../context/auth-context'\n\n/**\n * Auth Context Middleware\n *\n * Registers AuthContext in the request container at the start of each request.\n * This MUST run before SessionVerificationMiddleware and any other middleware\n * that depends on AuthContext.\n */\n@Transient()\nexport class AuthContextMiddleware implements Middleware {\n  async handle(ctx: RouterContext, next: Next): Promise<void> {\n    const requestContainer = ctx.getContainer()\n\n    const authContext = new AuthContext()\n    requestContainer.registerValue(DI_TOKENS.AuthContext, authContext)\n\n    return next()\n  }\n}\n","import { DI_TOKENS, Transient } from 'stratal/di'\nimport { LOGGER_TOKENS, type LoggerService } from 'stratal/logger'\nimport type { Middleware, Next, RouterContext } from 'stratal/router'\nimport { inject } from 'tsyringe'\nimport { type AuthContext } from '../../context/auth-context'\nimport { AUTH_SERVICE } from '../auth.tokens'\nimport type { AuthService } from '../services/auth.service'\n\n/**\n * Session Verification Middleware\n *\n * Verifies user session via Better Auth and populates AuthContext with\n * the authenticated user.\n *\n * **Responsibilities:**\n * - Calls Better Auth's getSession() API\n * - Populates AuthContext with the user record if the session is valid\n * - Continues request chain regardless of session status\n */\n@Transient()\nexport class SessionVerificationMiddleware implements Middleware {\n  constructor(\n    @inject(AUTH_SERVICE)\n    private readonly authService: AuthService,\n    @inject(LOGGER_TOKENS.LoggerService) private logger: LoggerService\n  ) { }\n\n  async handle(ctx: RouterContext, next: Next): Promise<void> {\n    try {\n      const result = await this.authService.auth.api.getSession({\n        headers: ctx.c.req.raw.headers\n      })\n\n      if (result) {\n        const authContext = ctx.getContainer().resolve<AuthContext>(DI_TOKENS.AuthContext)\n        authContext.setAuthContext({\n          user: result.user,\n        })\n      }\n    } catch (error: unknown) {\n      this.logger.debug('Session validation failed (e.g., invalidated in DB)', { error })\n    }\n\n    return next()\n  }\n}\n","/**\n * Rate-limit bridge between Stratal's `RateLimiterModule` and better-auth.\n *\n * Importing this file (transitively, via `auth.module.ts`) does two things:\n *\n *  1. Augments `RateLimiterRegistry` with `forPath()` + `pathEntries()` via\n *     Stratal's `Macroable`. Path-keyed rules registered on the same registry\n *     used for Stratal's own throttling are projected into better-auth's\n *     `customRules` by {@link projectCustomRules}.\n *  2. Exports {@link createBetterAuthRateLimitStorage} — adapts Stratal's\n *     {@link IRateLimiterStore} into better-auth's `customStorage`, so both\n *     systems share one backing store.\n *\n * `AuthModule.forRootAsync` wires both automatically when `RateLimiterModule`\n * is imported. Users with explicit `rateLimit.customStorage` /\n * `rateLimit.customRules` keys in their auth factory keep precedence.\n *\n * Frictions, documented for path-keyed entries:\n *\n *  - `Limit.by(...)` is meaningless. Better-auth scopes per-IP+path.\n *  - Multiple `Limit`s reduce to the most restrictive (smallest max-per-second).\n *  - `Limit.none()` projects to `false` (better-auth's \"disable\" sentinel).\n *  - `Limit.response(...)` is a no-op. Better-auth renders its own 429.\n *  - Snapshot caveat: `customRules` is built once at AuthService construction,\n *    so register all `forPath()` entries inside `OnInitialize` hooks.\n */\nimport { type IRateLimiterStore, type Limit, RateLimiterRegistry } from 'stratal/rate-limiter'\n\n/**\n * Resolver attached to a path-keyed limiter entry. Receives the native\n * `Request` (better-auth's customRules invokes us with the live Request)\n * and returns one or more `Limit`s. Async is supported.\n */\nexport type PathLimitResolver = (\n  req: Request,\n) => Limit | Limit[] | Promise<Limit | Limit[]>\n\ninterface BetterAuthRateLimit {\n  key: string\n  count: number\n  lastRequest: number\n}\n\ninterface BetterAuthRateLimitRule {\n  window: number\n  max: number\n}\n\ntype BetterAuthCustomRule =\n  | BetterAuthRateLimitRule\n  | false\n  | ((req: Request) => Promise<BetterAuthRateLimitRule | false>)\n\n// Per-instance path map — keyed by registry so we don't pin GC roots.\nconst pathResolvers = new WeakMap<RateLimiterRegistry, Map<string, PathLimitResolver>>()\n\nfunction getOrCreatePathMap(registry: RateLimiterRegistry): Map<string, PathLimitResolver> {\n  let map = pathResolvers.get(registry)\n  if (!map) {\n    map = new Map()\n    pathResolvers.set(registry, map)\n  }\n  return map\n}\n\nRateLimiterRegistry.macro('forPath', function (\n  this: RateLimiterRegistry,\n  path: string,\n  resolver: PathLimitResolver,\n): void {\n  getOrCreatePathMap(this).set(path, resolver)\n})\n\nRateLimiterRegistry.macro('pathEntries', function (\n  this: RateLimiterRegistry,\n): IterableIterator<[string, PathLimitResolver]> {\n  return (pathResolvers.get(this) ?? new Map<string, PathLimitResolver>()).entries()\n})\n\ndeclare module 'stratal/rate-limiter' {\n  interface RateLimiterRegistry {\n    /**\n     * Register a rate-limit rule for a better-auth path pattern. The rule\n     * is projected into better-auth's `rateLimit.customRules` automatically\n     * when both modules are imported.\n     *\n     * @example\n     * limiter.forPath('/sign-in/email', () => Limit.perSeconds(10, 3))\n     * limiter.forPath('/two-factor/*', async (req) => { ... })\n     * limiter.forPath('/forget-password', () => Limit.none())\n     */\n    forPath(path: string, resolver: PathLimitResolver): void\n\n    /**\n     * Iterate every path-keyed entry registered via `forPath`. Used by the\n     * auth bridge to project entries into better-auth's `customRules`.\n     */\n    pathEntries(): IterableIterator<[string, PathLimitResolver]>\n  }\n}\n\n// Better-auth manages window expiry itself by reading `lastRequest`. We still\n// need a TTL on the underlying KV so dead records don't accumulate. 1 day\n// covers any reasonable better-auth window without colliding with the next.\nconst BETTER_AUTH_TTL_SECONDS = 86_400\nconst BETTER_AUTH_KEY_PREFIX = 'ba-rl:'\n\n/**\n * Adapt Stratal's `IRateLimiterStore` into better-auth's `customStorage` shape.\n * Better-auth supplies its own `RateLimit` records (`{ key, count, lastRequest }`);\n * the adapter just persists them under a separate key namespace.\n */\nexport function createBetterAuthRateLimitStorage(store: IRateLimiterStore): {\n  get: (key: string) => Promise<BetterAuthRateLimit | null>\n  set: (key: string, value: BetterAuthRateLimit, update?: boolean) => Promise<void>\n} {\n  return {\n    async get(key) {\n      return await store.get<BetterAuthRateLimit>(`${BETTER_AUTH_KEY_PREFIX}${key}`)\n    },\n    async set(key, value, _update) {\n      await store.set(`${BETTER_AUTH_KEY_PREFIX}${key}`, value, BETTER_AUTH_TTL_SECONDS)\n    },\n  }\n}\n\n/**\n * Project every `forPath` entry on the registry into better-auth's\n * `customRules` shape. Each entry becomes an async function that resolves\n * the user's `Limit`(s) and reduces them to a single `{ window, max }` pair\n * (or `false` for `Limit.none()`).\n *\n * Multi-`Limit` reduction picks the most restrictive — smallest\n * `max / windowSeconds` ratio; ties favour the first.\n */\nexport function projectCustomRules(\n  registry: RateLimiterRegistry,\n): Record<string, BetterAuthCustomRule> {\n  const rules: Record<string, BetterAuthCustomRule> = {}\n\n  for (const [path, resolver] of registry.pathEntries()) {\n    rules[path] = async (req: Request): Promise<BetterAuthRateLimitRule | false> => {\n      const resolved = await resolver(req)\n      const candidates = (Array.isArray(resolved) ? resolved : [resolved]).filter((l) => !l.disabled)\n      if (candidates.length === 0) return false\n\n      const chosen = candidates.reduce((a, b) =>\n        a.max / a.windowSeconds <= b.max / b.windowSeconds ? a : b,\n      )\n\n      return { window: chosen.windowSeconds, max: chosen.max }\n    }\n  }\n\n  return rules\n}\n","import { ApplicationError, ERROR_CODES } from 'stratal/errors'\n\nexport class UserNotFoundError extends ApplicationError {\n  constructor(email?: string) {\n    super('auth.errors.userNotFound', ERROR_CODES.RESOURCE.NOT_FOUND, email ? { email } : undefined)\n  }\n}\n\nexport class InvalidCredentialsError extends ApplicationError {\n  constructor() {\n    super('auth.errors.invalidCredentials', ERROR_CODES.AUTH.INVALID_CREDENTIALS)\n  }\n}\n\nexport class InvalidPasswordError extends ApplicationError {\n  constructor() {\n    super('auth.errors.invalidPassword', ERROR_CODES.AUTH.INVALID_CREDENTIALS)\n  }\n}\n\nexport class InvalidEmailError extends ApplicationError {\n  constructor(email?: string) {\n    super('auth.errors.invalidEmail', ERROR_CODES.VALIDATION.INVALID_FORMAT, email ? { email } : undefined)\n  }\n}\n\nexport class SessionExpiredError extends ApplicationError {\n  constructor() {\n    super('auth.errors.sessionExpired', ERROR_CODES.AUTH.SESSION_EXPIRED)\n  }\n}\n\nexport class EmailNotVerifiedError extends ApplicationError {\n  constructor(email?: string) {\n    super('auth.errors.emailNotVerified', ERROR_CODES.AUTH.EMAIL_NOT_VERIFIED, email ? { email } : undefined)\n  }\n}\n\nexport class PasswordTooShortError extends ApplicationError {\n  constructor(minLength: number) {\n    super('auth.errors.passwordTooShort', ERROR_CODES.AUTH.PASSWORD_TOO_SHORT, { minLength })\n  }\n}\n\nexport class PasswordTooLongError extends ApplicationError {\n  constructor(maxLength: number) {\n    super('auth.errors.passwordTooLong', ERROR_CODES.AUTH.PASSWORD_TOO_LONG, { maxLength })\n  }\n}\n\nexport class AccountAlreadyExistsError extends ApplicationError {\n  constructor(email?: string) {\n    super('auth.errors.accountAlreadyExists', ERROR_CODES.AUTH.ACCOUNT_ALREADY_EXISTS, email ? { email } : undefined)\n  }\n}\n\nexport class FailedToCreateUserError extends ApplicationError {\n  constructor(reason?: string) {\n    super('auth.errors.failedToCreateUser', ERROR_CODES.AUTH.FAILED_TO_CREATE_USER, reason ? { reason } : undefined)\n  }\n}\n\nexport class FailedToCreateSessionError extends ApplicationError {\n  constructor(reason?: string) {\n    super('auth.errors.failedToCreateSession', ERROR_CODES.AUTH.FAILED_TO_CREATE_SESSION, reason ? { reason } : undefined)\n  }\n}\n\nexport class FailedToUpdateUserError extends ApplicationError {\n  constructor(reason?: string) {\n    super('auth.errors.failedToUpdateUser', ERROR_CODES.AUTH.FAILED_TO_UPDATE_USER, reason ? { reason } : undefined)\n  }\n}\n\nexport class SocialAccountLinkedError extends ApplicationError {\n  constructor(provider?: string) {\n    super('auth.errors.socialAccountLinked', ERROR_CODES.AUTH.SOCIAL_ACCOUNT_LINKED, provider ? { provider } : undefined)\n  }\n}\n\nexport class CannotUnlinkLastAccountError extends ApplicationError {\n  constructor() {\n    super('auth.errors.cannotUnlinkLastAccount', ERROR_CODES.AUTH.CANNOT_UNLINK_LAST_ACCOUNT)\n  }\n}\n\nexport class ProviderNotFoundError extends ApplicationError {\n  constructor(provider?: string) {\n    super('auth.errors.providerNotFound', ERROR_CODES.RESOURCE.NOT_FOUND, provider ? { provider } : undefined)\n  }\n}\n\nexport class UserEmailNotFoundError extends ApplicationError {\n  constructor() {\n    super('auth.errors.userEmailNotFound', ERROR_CODES.RESOURCE.NOT_FOUND)\n  }\n}\n\nexport class AccountNotFoundError extends ApplicationError {\n  constructor() {\n    super('auth.errors.accountNotFound', ERROR_CODES.RESOURCE.NOT_FOUND)\n  }\n}\n\nexport class CredentialAccountNotFoundError extends ApplicationError {\n  constructor() {\n    super('auth.errors.credentialAccountNotFound', ERROR_CODES.RESOURCE.NOT_FOUND)\n  }\n}\n\nexport class UserAlreadyHasPasswordError extends ApplicationError {\n  constructor() {\n    super('auth.errors.userAlreadyHasPassword', ERROR_CODES.RESOURCE.CONFLICT)\n  }\n}\n\nexport class EmailCannotBeUpdatedError extends ApplicationError {\n  constructor(reason?: string) {\n    super('auth.errors.emailCannotBeUpdated', ERROR_CODES.VALIDATION.GENERIC, reason ? { reason } : undefined)\n  }\n}\n\nexport class FailedToGetSessionError extends ApplicationError {\n  constructor(reason?: string) {\n    super('auth.errors.failedToGetSession', ERROR_CODES.SYSTEM.INTERNAL_ERROR, reason ? { reason } : undefined)\n  }\n}\n\nexport class FailedToGetUserInfoError extends ApplicationError {\n  constructor(reason?: string) {\n    super('auth.errors.failedToGetUserInfo', ERROR_CODES.SYSTEM.INTERNAL_ERROR, reason ? { reason } : undefined)\n  }\n}\n\nexport class IdTokenNotSupportedError extends ApplicationError {\n  constructor() {\n    super('auth.errors.invalidToken', ERROR_CODES.VALIDATION.GENERIC)\n  }\n}\n\nexport class TokenExpiredError extends ApplicationError {\n  constructor() {\n    super('auth.errors.tokenExpired', ERROR_CODES.VALIDATION.GENERIC)\n  }\n}\n\nexport class InvalidCallbackUrlError extends ApplicationError {\n  constructor() {\n    super('auth.errors.invalidCallbackUrl', ERROR_CODES.VALIDATION.INVALID_FORMAT)\n  }\n}\n\nexport class InvalidOriginError extends ApplicationError {\n  constructor() {\n    super('auth.errors.invalidOrigin', ERROR_CODES.AUTHZ.FORBIDDEN)\n  }\n}\n\nexport class AuthValidationFailedError extends ApplicationError {\n  constructor() {\n    super('auth.errors.validationFailed', ERROR_CODES.VALIDATION.GENERIC)\n  }\n}\n\nexport class EmailAlreadyVerifiedError extends ApplicationError {\n  constructor() {\n    super('auth.errors.emailAlreadyVerified', ERROR_CODES.RESOURCE.CONFLICT)\n  }\n}\n\nexport class EmailMismatchError extends ApplicationError {\n  constructor() {\n    super('auth.errors.emailMismatch', ERROR_CODES.VALIDATION.INVALID_FORMAT)\n  }\n}\n\nexport class BetterAuthUnknownError extends ApplicationError {\n  constructor(errorCode?: string) {\n    super('auth.errors.unknownError', ERROR_CODES.SYSTEM.INTERNAL_ERROR, errorCode ? { errorCode } : undefined)\n  }\n}\n","import { ApplicationError, ERROR_CODES } from 'stratal/errors'\n\nexport class InvalidTokenError extends ApplicationError {\n  constructor() {\n    super('auth.errors.invalidToken', ERROR_CODES.AUTH.INVALID_TOKEN)\n  }\n}\n","import { ApplicationError, ERROR_CODES } from 'stratal/errors'\n\nexport class OrganizationNotFoundError extends ApplicationError {\n  constructor() {\n    super('auth.org.organizationNotFound', ERROR_CODES.AUTH.ORGANIZATION_NOT_FOUND)\n  }\n}\n\nexport class OrganizationMemberNotFoundError extends ApplicationError {\n  constructor() {\n    super('auth.org.memberNotFound', ERROR_CODES.AUTH.MEMBER_NOT_FOUND)\n  }\n}\n\nexport class OrganizationInvitationNotFoundError extends ApplicationError {\n  constructor() {\n    super('auth.org.invitationNotFound', ERROR_CODES.AUTH.INVITATION_NOT_FOUND)\n  }\n}\n\nexport class OrganizationPermissionDeniedError extends ApplicationError {\n  constructor() {\n    super('auth.org.permissionDenied', ERROR_CODES.AUTHZ.FORBIDDEN)\n  }\n}\n\nexport class OrganizationInvitationRecipientMismatchError extends ApplicationError {\n  constructor() {\n    super('auth.org.invitationRecipientMismatch', ERROR_CODES.AUTH.INVITATION_RECIPIENT_MISMATCH)\n  }\n}\n\nexport class OrganizationConflictError extends ApplicationError {\n  constructor() {\n    super('auth.org.conflict', ERROR_CODES.RESOURCE.CONFLICT)\n  }\n}\n\nexport class OrganizationLimitReachedError extends ApplicationError {\n  constructor() {\n    super('auth.org.limitReached', ERROR_CODES.AUTH.ORGANIZATION_LIMIT_REACHED)\n  }\n}\n\nexport class OrganizationMembershipError extends ApplicationError {\n  constructor() {\n    super('auth.org.membershipError', ERROR_CODES.AUTH.ORGANIZATION_MEMBERSHIP_REQUIRED)\n  }\n}\n\nexport class OrganizationTeamNotFoundError extends ApplicationError {\n  constructor() {\n    super('auth.org.teamNotFound', ERROR_CODES.RESOURCE.NOT_FOUND)\n  }\n}\n\nexport class OrganizationRoleNotFoundError extends ApplicationError {\n  constructor() {\n    super('auth.org.roleNotFound', ERROR_CODES.RESOURCE.NOT_FOUND)\n  }\n}\n","import { ApplicationError, ERROR_CODES } from 'stratal/errors'\n\nexport class TokenRequiredError extends ApplicationError {\n  constructor() {\n    super('auth.errors.tokenRequired', ERROR_CODES.VALIDATION.REQUIRED_FIELD, { field: 'token' })\n  }\n}\n","import { ApplicationError, ERROR_CODES } from 'stratal/errors'\n\nexport class VerificationFailedError extends ApplicationError {\n  constructor() {\n    super('auth.errors.verificationFailed', ERROR_CODES.AUTH.INVALID_CREDENTIALS)\n  }\n}\n","import { APIError } from 'better-auth/api'\nimport type { ApplicationError } from 'stratal/errors'\nimport {\n  AccountAlreadyExistsError,\n  AccountNotFoundError,\n  AuthValidationFailedError,\n  BetterAuthUnknownError,\n  CannotUnlinkLastAccountError,\n  CredentialAccountNotFoundError,\n  EmailAlreadyVerifiedError,\n  EmailCannotBeUpdatedError,\n  EmailMismatchError,\n  EmailNotVerifiedError,\n  FailedToCreateSessionError,\n  FailedToCreateUserError,\n  FailedToGetSessionError,\n  FailedToGetUserInfoError,\n  FailedToUpdateUserError,\n  IdTokenNotSupportedError,\n  InvalidCallbackUrlError,\n  InvalidCredentialsError,\n  InvalidEmailError,\n  InvalidOriginError,\n  InvalidPasswordError,\n  InvalidTokenError,\n  OrganizationConflictError,\n  OrganizationInvitationNotFoundError,\n  OrganizationInvitationRecipientMismatchError,\n  OrganizationLimitReachedError,\n  OrganizationMemberNotFoundError,\n  OrganizationMembershipError,\n  OrganizationNotFoundError,\n  OrganizationPermissionDeniedError,\n  OrganizationRoleNotFoundError,\n  OrganizationTeamNotFoundError,\n  PasswordTooLongError,\n  PasswordTooShortError,\n  ProviderNotFoundError,\n  SessionExpiredError,\n  SocialAccountLinkedError,\n  TokenExpiredError,\n  UserAlreadyHasPasswordError,\n  UserEmailNotFoundError,\n  UserNotFoundError,\n} from '../errors'\n\n/**\n * Maps Better Auth API error codes to ApplicationError instances.\n */\nexport function mapBetterAuthError(error: APIError): ApplicationError {\n  const errorCode = error.body?.code\n\n  if (error.status === 'FOUND') {\n    const headers = error.headers as Headers\n    const location = headers.get('location') ?? ''\n\n    if (location.includes('INVALID_TOKEN')) return new InvalidTokenError()\n    if (location.includes('EXPIRED_TOKEN')) return new TokenExpiredError()\n    if (location.includes('ATTEMPTS_EXCEEDED')) return new InvalidTokenError()\n    if (location.includes('new_user_signup_disabled')) return new UserNotFoundError()\n    if (location.includes('failed_to_create_user')) return new FailedToCreateUserError()\n    if (location.includes('failed_to_create_session')) return new FailedToCreateSessionError()\n  }\n\n  if (!errorCode) {\n    return new BetterAuthUnknownError()\n  }\n\n  // ── Base Error Codes ──────────────────────────────────────────────────\n\n  // User errors\n  if (errorCode === 'USER_NOT_FOUND' || errorCode === 'INVALID_USER') return new UserNotFoundError()\n  if (errorCode === 'USER_EMAIL_NOT_FOUND') return new UserEmailNotFoundError()\n\n  // Credential errors\n  if (errorCode === 'INVALID_EMAIL_OR_PASSWORD') return new InvalidCredentialsError()\n  if (errorCode === 'INVALID_PASSWORD') return new InvalidPasswordError()\n  if (errorCode === 'INVALID_EMAIL') return new InvalidEmailError()\n\n  // Session errors\n  if (errorCode === 'SESSION_EXPIRED' || errorCode === 'SESSION_NOT_FRESH') return new SessionExpiredError()\n  if (errorCode === 'FAILED_TO_CREATE_SESSION') return new FailedToCreateSessionError()\n  if (errorCode === 'FAILED_TO_GET_SESSION') return new FailedToGetSessionError()\n\n  // Email verification\n  if (errorCode === 'EMAIL_NOT_VERIFIED') return new EmailNotVerifiedError()\n  if (errorCode === 'EMAIL_CAN_NOT_BE_UPDATED') return new EmailCannotBeUpdatedError()\n  if (errorCode === 'EMAIL_ALREADY_VERIFIED') return new EmailAlreadyVerifiedError()\n  if (errorCode === 'EMAIL_MISMATCH') return new EmailMismatchError()\n\n  // Password validation\n  if (errorCode === 'PASSWORD_TOO_SHORT') return new PasswordTooShortError(8)\n  if (errorCode === 'PASSWORD_TOO_LONG') return new PasswordTooLongError(128)\n\n  // Account errors\n  if (errorCode === 'USER_ALREADY_EXISTS' || errorCode === 'USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL') {\n    return new AccountAlreadyExistsError()\n  }\n  if (errorCode === 'ACCOUNT_NOT_FOUND') return new AccountNotFoundError()\n  if (errorCode === 'CREDENTIAL_ACCOUNT_NOT_FOUND') return new CredentialAccountNotFoundError()\n  if (errorCode === 'FAILED_TO_UNLINK_LAST_ACCOUNT') return new CannotUnlinkLastAccountError()\n\n  // User creation/update errors\n  if (errorCode === 'FAILED_TO_CREATE_USER') return new FailedToCreateUserError()\n  if (errorCode === 'FAILED_TO_UPDATE_USER') return new FailedToUpdateUserError()\n  if (errorCode === 'FAILED_TO_GET_USER_INFO') return new FailedToGetUserInfoError()\n\n  // Social account errors\n  if (errorCode === 'SOCIAL_ACCOUNT_ALREADY_LINKED' || errorCode === 'LINKED_ACCOUNT_ALREADY_EXISTS') {\n    return new SocialAccountLinkedError()\n  }\n  if (errorCode === 'PROVIDER_NOT_FOUND') return new ProviderNotFoundError()\n\n  // Token errors\n  if (errorCode === 'ID_TOKEN_NOT_SUPPORTED') return new IdTokenNotSupportedError()\n  if (errorCode === 'INVALID_TOKEN') return new InvalidTokenError()\n  if (errorCode === 'TOKEN_EXPIRED') return new TokenExpiredError()\n\n  // Password management\n  if (errorCode === 'USER_ALREADY_HAS_PASSWORD' || errorCode === 'PASSWORD_ALREADY_SET') {\n    return new UserAlreadyHasPasswordError()\n  }\n\n  // Callback/redirect URL errors\n  if (\n    errorCode === 'INVALID_CALLBACK_URL'\n    || errorCode === 'INVALID_REDIRECT_URL'\n    || errorCode === 'INVALID_NEW_USER_CALLBACK_URL'\n    || errorCode === 'INVALID_ERROR_CALLBACK_URL'\n    || errorCode === 'CALLBACK_URL_REQUIRED'\n  ) {\n    return new InvalidCallbackUrlError()\n  }\n\n  // Origin/CORS errors\n  if (\n    errorCode === 'INVALID_ORIGIN'\n    || errorCode === 'MISSING_OR_NULL_ORIGIN'\n    || errorCode === 'CROSS_SITE_NAVIGATION_LOGIN_BLOCKED'\n  ) {\n    return new InvalidOriginError()\n  }\n\n  // Validation errors\n  if (\n    errorCode === 'VALIDATION_ERROR'\n    || errorCode === 'MISSING_FIELD'\n    || errorCode === 'FIELD_NOT_ALLOWED'\n    || errorCode === 'BODY_MUST_BE_AN_OBJECT'\n    || errorCode === 'ASYNC_VALIDATION_NOT_SUPPORTED'\n    || errorCode === 'METHOD_NOT_ALLOWED_DEFER_SESSION_REQUIRED'\n  ) {\n    return new AuthValidationFailedError()\n  }\n\n  // Verification errors\n  if (errorCode === 'FAILED_TO_CREATE_VERIFICATION' || errorCode === 'VERIFICATION_EMAIL_NOT_ENABLED') {\n    return new FailedToCreateSessionError()\n  }\n\n  // ── Organization Plugin Error Codes ───────────────────────────────────\n\n  // Organization not found\n  if (errorCode === 'ORGANIZATION_NOT_FOUND' || errorCode === 'NO_ACTIVE_ORGANIZATION') {\n    return new OrganizationNotFoundError()\n  }\n\n  // Member not found\n  if (\n    errorCode === 'MEMBER_NOT_FOUND'\n    || errorCode === 'USER_IS_NOT_A_MEMBER_OF_THE_ORGANIZATION'\n    || errorCode === 'USER_IS_NOT_A_MEMBER_OF_THE_TEAM'\n  ) {\n    return new OrganizationMemberNotFoundError()\n  }\n\n  // Invitation not found\n  if (errorCode === 'INVITATION_NOT_FOUND' || errorCode === 'FAILED_TO_RETRIEVE_INVITATION') {\n    return new OrganizationInvitationNotFoundError()\n  }\n\n  // Invitation recipient mismatch\n  if (\n    errorCode === 'YOU_ARE_NOT_THE_RECIPIENT_OF_THE_INVITATION'\n    || errorCode === 'EMAIL_VERIFICATION_REQUIRED_BEFORE_ACCEPTING_OR_REJECTING_INVITATION'\n  ) {\n    return new OrganizationInvitationRecipientMismatchError()\n  }\n\n  // Team not found\n  if (errorCode === 'TEAM_NOT_FOUND' || errorCode === 'YOU_DO_NOT_HAVE_AN_ACTIVE_TEAM') {\n    return new OrganizationTeamNotFoundError()\n  }\n\n  // Role not found\n  if (errorCode === 'ROLE_NOT_FOUND' || errorCode === 'INVALID_RESOURCE') {\n    return new OrganizationRoleNotFoundError()\n  }\n\n  // Organization conflict/already exists\n  if (\n    errorCode === 'ORGANIZATION_ALREADY_EXISTS'\n    || errorCode === 'ORGANIZATION_SLUG_ALREADY_TAKEN'\n    || errorCode === 'USER_IS_ALREADY_A_MEMBER_OF_THIS_ORGANIZATION'\n    || errorCode === 'USER_IS_ALREADY_INVITED_TO_THIS_ORGANIZATION'\n    || errorCode === 'TEAM_ALREADY_EXISTS'\n    || errorCode === 'ROLE_NAME_IS_ALREADY_TAKEN'\n  ) {\n    return new OrganizationConflictError()\n  }\n\n  // Organization limit reached\n  if (\n    errorCode === 'YOU_HAVE_REACHED_THE_MAXIMUM_NUMBER_OF_ORGANIZATIONS'\n    || errorCode === 'YOU_HAVE_REACHED_THE_MAXIMUM_NUMBER_OF_TEAMS'\n    || errorCode === 'ORGANIZATION_MEMBERSHIP_LIMIT_REACHED'\n    || errorCode === 'INVITATION_LIMIT_REACHED'\n    || errorCode === 'TEAM_MEMBER_LIMIT_REACHED'\n    || errorCode === 'TOO_MANY_ROLES'\n  ) {\n    return new OrganizationLimitReachedError()\n  }\n\n  // Organization membership constraints\n  if (\n    errorCode === 'YOU_CANNOT_LEAVE_THE_ORGANIZATION_AS_THE_ONLY_OWNER'\n    || errorCode === 'YOU_CANNOT_LEAVE_THE_ORGANIZATION_WITHOUT_AN_OWNER'\n    || errorCode === 'UNABLE_TO_REMOVE_LAST_TEAM'\n    || errorCode === 'CANNOT_DELETE_A_PRE_DEFINED_ROLE'\n    || errorCode === 'ROLE_IS_ASSIGNED_TO_MEMBERS'\n    || errorCode === 'YOU_CANNOT_IMPERSONATE_ADMINS'\n    || errorCode === 'YOU_CANNOT_BAN_YOURSELF'\n    || errorCode === 'YOU_CANNOT_REMOVE_YOURSELF'\n    || errorCode === 'INVITER_IS_NO_LONGER_A_MEMBER_OF_THE_ORGANIZATION'\n  ) {\n    return new OrganizationMembershipError()\n  }\n\n  // Organization permission denied (catch-all for YOU_ARE_NOT_ALLOWED_TO_* patterns)\n  if (\n    errorCode.startsWith('YOU_ARE_NOT_ALLOWED_TO_')\n    || errorCode === 'YOU_ARE_NOT_A_MEMBER_OF_THIS_ORGANIZATION'\n    || errorCode === 'YOU_CAN_NOT_ACCESS_THE_MEMBERS_OF_THIS_TEAM'\n    || errorCode === 'YOU_MUST_BE_IN_AN_ORGANIZATION_TO_CREATE_A_ROLE'\n    || errorCode === 'MISSING_AC_INSTANCE'\n  ) {\n    return new OrganizationPermissionDeniedError()\n  }\n\n  // Unknown error code\n  return new BetterAuthUnknownError(errorCode)\n}\n\n/**\n * Type guard to check if an error is a Better Auth APIError.\n * Uses duck typing to handle bundler environments (e.g. Vite)\n * where instanceof may fail across module boundaries.\n */\nexport function isAPIError(error: unknown): error is APIError {\n  if (error instanceof APIError) return true\n\n  return (\n    error instanceof Error\n    && error.name === 'APIError'\n    && 'status' in error\n    && 'statusCode' in error\n  )\n}\n","import type { BetterAuthOptions } from 'better-auth'\nimport { isAPIError, mapBetterAuthError } from './better-auth-error-handler'\n\n/**\n * Get shared Better Auth error handler configuration.\n * Use this in Better Auth config's onAPIError option.\n */\nexport function getErrorHandlerConfig(): BetterAuthOptions['onAPIError'] {\n  return {\n    throw: false,\n    onError: (error) => {\n      if (isAPIError(error)) {\n        throw mapBetterAuthError(error)\n      }\n      throw error\n    },\n  }\n}\n\n/**\n * Wrap a Better Auth function in a try/catch block and map errors to ApplicationError.\n */\nexport const wrapBetterAuth = async <T>(fn: () => Promise<T>): Promise<T> => {\n  try {\n    return await fn()\n  } catch (error) {\n    if (isAPIError(error)) {\n      throw mapBetterAuthError(error)\n    }\n    throw error\n  }\n}\n","import type { Auth, BetterAuthOptions } from 'better-auth'\nimport { betterAuth } from 'better-auth'\nimport { inject } from 'tsyringe'\nimport { Transient } from 'stratal/di'\nimport { AUTH_OPTIONS, AUTH_SERVICE } from '../auth.tokens'\nimport { getErrorHandlerConfig } from '../utils'\n\n/**\n * AuthService\n *\n * Base authentication service using Better Auth.\n * Configured via AuthModule.forRootAsync() from the application layer.\n *\n * **Extensibility:**\n * Extend this class in application layer to add custom methods.\n *\n * @example\n * ```typescript\n * @Transient(AUTH_SERVICE)\n * export class AppAuthService extends AuthService<AuthOptions> {\n *   async signInMagicLink(email: string) {\n *     return wrapBetterAuth(async () => {\n *       return this.auth.api.signInMagicLink({ body: { email }, headers: new Headers() })\n *     })\n *   }\n * }\n * ```\n */\n@Transient(AUTH_SERVICE)\nexport class AuthService<TOptions extends BetterAuthOptions = BetterAuthOptions> {\n  private authInstance: Auth<TOptions>\n\n  constructor(\n    @inject(AUTH_OPTIONS) protected readonly options: TOptions\n  ) {\n    this.authInstance = betterAuth({\n      ...this.options,\n      onAPIError: getErrorHandlerConfig()\n    }) as Auth<TOptions>\n  }\n\n  /**\n   * Get the Better Auth instance\n   */\n  get auth(): Auth<TOptions> {\n    return this.authInstance\n  }\n}\n","/**\n * Auth Module\n *\n * Provides configurable authentication using Better Auth.\n * Use `forRootAsync` to configure Better Auth options from the application layer.\n *\n * Optionally pass `accessControl` to enable permission-based authorization.\n * This auto-adds the Stratal AC plugin to Better Auth and registers `AccessService`.\n *\n * @example Without access control\n * ```typescript\n * @Module({\n *   imports: [\n *     AuthModule.forRootAsync({\n *       inject: [DI_TOKENS.Database, CONFIG_TOKENS.ConfigService],\n *       useFactory: (db, config) => createAuthOptions(db, config)\n *     })\n *   ]\n * })\n * export class AppModule {}\n * ```\n *\n * @example With access control\n * ```typescript\n * import { createAccessControl } from '@stratal/framework/access-control'\n * import { admin } from 'better-auth/plugins'\n *\n * const permissions = createAccessControl({\n *   resources: { posts: ['create', 'read', 'update', 'delete'] } as const,\n *   roles: { admin: { posts: ['create', 'read', 'update', 'delete'] }, user: { posts: ['read'] } },\n * })\n *\n * @Module({\n *   imports: [\n *     AuthModule.forRootAsync({\n *       inject: [DI_TOKENS.Database],\n *       useFactory: (db) => ({\n *         database: ...,\n *         plugins: [admin({ ...permissions })],\n *       }),\n *       accessControl: permissions,\n *     })\n *   ]\n * })\n * ```\n */\n\nimport type { BetterAuthOptions } from 'better-auth'\nimport { CONTAINER_TOKEN, type Container } from 'stratal/di'\nimport { I18nModule } from 'stratal/i18n'\nimport type { AsyncModuleOptions, DynamicModule } from 'stratal/module'\nimport { Module } from 'stratal/module'\nimport type { IRateLimiterStore, RateLimiterRegistry } from 'stratal/rate-limiter'\nimport { RATE_LIMITER_TOKENS } from 'stratal/rate-limiter'\nimport type { RouteConfigurable, Router } from 'stratal/router'\nimport { createStratalAcPlugin } from '../access-control/plugin'\nimport { AccessService } from '../access-control/services/access.service'\nimport { AC_TOKENS } from '../access-control/tokens'\nimport type { AccessControlOptions } from '../access-control/types'\nimport { AUTH_OPTIONS, AUTH_SERVICE } from './auth.tokens'\nimport { authMessages } from './i18n'\nimport { AuthContextMiddleware } from './middleware/auth-context.middleware'\nimport { SessionVerificationMiddleware } from './middleware/session-verification.middleware'\n// Side-effect import: registers `forPath`/`pathEntries` macros on\n// `RateLimiterRegistry` and the `declare module` augmentation that exposes\n// them at the type level. Must run before any consumer calls `forPath()`.\nimport {\n  createBetterAuthRateLimitStorage,\n  projectCustomRules,\n} from './rate-limit-bridge'\nimport { AuthService } from './services/auth.service'\n\nexport interface AuthModuleAsyncOptions<TOptions extends BetterAuthOptions = BetterAuthOptions>\n  extends AsyncModuleOptions<TOptions> {\n  /**\n   * Optional access control configuration.\n   * When provided, registers AccessService and auto-adds the Stratal AC plugin to Better Auth.\n   */\n  accessControl?: AccessControlOptions\n}\n\n@Module({\n  imports: [\n    I18nModule.registerMessages(authMessages),\n  ],\n  providers: []\n})\nexport class AuthModule implements RouteConfigurable {\n  /**\n   * Configure auth middleware globally.\n   *\n   * Registers middlewares in order:\n   * 1. AuthContextMiddleware - Creates and registers AuthContext in request container\n   * 2. SessionVerificationMiddleware - Verifies session and populates AuthContext with userId + role\n   */\n  configureRoutes(router: Router): void {\n    router.use(AuthContextMiddleware, SessionVerificationMiddleware)\n  }\n\n  /**\n   * Configure AuthModule with async options factory.\n   * Optionally provide `accessControl` to enable permission-based authorization.\n   *\n   * When `RateLimiterModule` is also imported, better-auth's `rateLimit`\n   * block is auto-wired: `customStorage` shares Stratal's backing store, and\n   * any `RateLimiterRegistry.forPath(...)` entries are projected into\n   * `customRules`. User-supplied `rateLimit.{customStorage, customRules}` keys\n   * take precedence on a per-key basis.\n   */\n  static forRootAsync<TOptions extends BetterAuthOptions>(\n    options: AuthModuleAsyncOptions<TOptions>\n  ): DynamicModule {\n    const { accessControl } = options\n    const userInject = options.inject ?? []\n    const userFactory = options.useFactory as (...args: unknown[]) => TOptions\n\n    const authOptionsProvider = {\n      provide: AUTH_OPTIONS,\n      useFactory: (container: Container, ...userDeps: unknown[]): BetterAuthOptions => {\n        let raw = userFactory(...userDeps) as BetterAuthOptions\n\n        if (accessControl) {\n          raw = {\n            ...raw,\n            plugins: [createStratalAcPlugin(accessControl), ...(raw.plugins ?? [])],\n          }\n        }\n\n        const tsyringe = container.getTsyringeContainer()\n        const rateLimiterPresent = tsyringe.isRegistered(\n          RATE_LIMITER_TOKENS.ModuleMarker,\n          true,\n        )\n\n        if (rateLimiterPresent) {\n          const store = container.resolve<IRateLimiterStore>(RATE_LIMITER_TOKENS.Store)\n          const registry = container.resolve<RateLimiterRegistry>(RATE_LIMITER_TOKENS.Registry)\n\n          raw = {\n            ...raw,\n            rateLimit: {\n              enabled: true,\n              ...raw.rateLimit,\n              customStorage: raw.rateLimit?.customStorage ?? createBetterAuthRateLimitStorage(store),\n              customRules: {\n                ...projectCustomRules(registry),\n                ...(raw.rateLimit?.customRules ?? {}),\n              },\n            },\n          }\n        }\n\n        return raw\n      },\n      inject: [CONTAINER_TOKEN, ...userInject],\n    }\n\n    return {\n      module: AuthModule,\n      providers: [\n        authOptionsProvider,\n        {\n          provide: AUTH_SERVICE,\n          useClass: AuthService,\n        },\n        ...(accessControl\n          ? [\n            { provide: AC_TOKENS.Options, useValue: accessControl as unknown as object },\n            { provide: AC_TOKENS.AccessService, useClass: AccessService },\n          ]\n          : []),\n      ],\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;AACA,MAAa,eAAe,OAAO,IAAI,uBAAuB;;AAG9D,MAAa,eAAe,OAAO,IAAI,uBAAuB;;;ACJ9D,MAAa,eAAe,EAC1B,IAAI,EACF,MAAM;CACJ,QAAQ;EACN,eAAe;EACf,cAAc;EACd,oBAAoB;EACpB,cAAc;EACd,oBAAoB;EACpB,iBAAiB;EACjB,cAAc;EACd,gBAAgB;EAChB,kBAAkB;EAClB,kBAAkB;EAClB,iBAAiB;EACjB,sBAAsB;EACtB,oBAAoB;EACpB,uBAAuB;EACvB,oBAAoB;EACpB,oBAAoB;EACpB,qBAAqB;EACrB,qBAAqB;EACrB,kBAAkB;EAClB,mBAAmB;EACnB,iBAAiB;EACjB,2BAA2B;EAC3B,yBAAyB;EACzB,wBAAwB;EACxB,sBAAsB;EACtB,cAAc;EACd,oBAAoB;EACpB,eAAe;EACf,kBAAkB;EAClB,sBAAsB;EACtB,eAAe;EACf,cAAc;EACf;CACD,KAAK;EACH,sBAAsB;EACtB,gBAAgB;EAChB,oBAAoB;EACpB,kBAAkB;EAClB,6BAA6B;EAC7B,UAAU;EACV,cAAc;EACd,iBAAiB;EACjB,cAAc;EACd,cAAc;EACf;CACF,EACF,EACF;;;ACvCM,IAAA,wBAAA,MAAM,sBAA4C;CACvD,MAAM,OAAO,KAAoB,MAA2B;EAC1D,MAAM,mBAAmB,IAAI,cAAc;EAE3C,MAAM,cAAc,IAAI,aAAa;AACrC,mBAAiB,cAAc,UAAU,aAAa,YAAY;AAElE,SAAO,MAAM;;;oCARhB,WAAW,CAAA,EAAA,sBAAA;;;ACSL,IAAA,gCAAA,MAAM,8BAAoD;CAC/D,YACE,aAEA,QACA;AAFiB,OAAA,cAAA;AAC4B,OAAA,SAAA;;CAG/C,MAAM,OAAO,KAAoB,MAA2B;AAC1D,MAAI;GACF,MAAM,SAAS,MAAM,KAAK,YAAY,KAAK,IAAI,WAAW,EACxD,SAAS,IAAI,EAAE,IAAI,IAAI,SACxB,CAAC;AAEF,OAAI,OACkB,KAAI,cAAc,CAAC,QAAqB,UAAU,YAC3D,CAAC,eAAe,EACzB,MAAM,OAAO,MACd,CAAC;WAEG,OAAgB;AACvB,QAAK,OAAO,MAAM,uDAAuD,EAAE,OAAO,CAAC;;AAGrF,SAAO,MAAM;;;;CAxBhB,WAAW;oBAGPA,SAAO,aAAa,CAAA;oBAEpBA,SAAO,cAAc,cAAc,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AC8BxC,MAAM,gCAAgB,IAAI,SAA8D;AAExF,SAAS,mBAAmB,UAA+D;CACzF,IAAI,MAAM,cAAc,IAAI,SAAS;AACrC,KAAI,CAAC,KAAK;AACR,wBAAM,IAAI,KAAK;AACf,gBAAc,IAAI,UAAU,IAAI;;AAElC,QAAO;;AAGT,oBAAoB,MAAM,WAAW,SAEnC,MACA,UACM;AACN,oBAAmB,KAAK,CAAC,IAAI,MAAM,SAAS;EAC5C;AAEF,oBAAoB,MAAM,eAAe,WAEQ;AAC/C,SAAQ,cAAc,IAAI,KAAK,oBAAI,IAAI,KAAgC,EAAE,SAAS;EAClF;AA2BF,MAAM,0BAA0B;AAChC,MAAM,yBAAyB;;;;;;AAO/B,SAAgB,iCAAiC,OAG/C;AACA,QAAO;EACL,MAAM,IAAI,KAAK;AACb,UAAO,MAAM,MAAM,IAAyB,GAAG,yBAAyB,MAAM;;EAEhF,MAAM,IAAI,KAAK,OAAO,SAAS;AAC7B,SAAM,MAAM,IAAI,GAAG,yBAAyB,OAAO,OAAO,wBAAwB;;EAErF;;;;;;;;;;;AAYH,SAAgB,mBACd,UACsC;CACtC,MAAM,QAA8C,EAAE;AAEtD,MAAK,MAAM,CAAC,MAAM,aAAa,SAAS,aAAa,CACnD,OAAM,QAAQ,OAAO,QAA2D;EAC9E,MAAM,WAAW,MAAM,SAAS,IAAI;EACpC,MAAM,cAAc,MAAM,QAAQ,SAAS,GAAG,WAAW,CAAC,SAAS,EAAE,QAAQ,MAAM,CAAC,EAAE,SAAS;AAC/F,MAAI,WAAW,WAAW,EAAG,QAAO;EAEpC,MAAM,SAAS,WAAW,QAAQ,GAAG,MACnC,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,gBAAgB,IAAI,EAC1D;AAED,SAAO;GAAE,QAAQ,OAAO;GAAe,KAAK,OAAO;GAAK;;AAI5D,QAAO;;;;ACxJT,IAAa,oBAAb,cAAuC,iBAAiB;CACtD,YAAY,OAAgB;AAC1B,QAAM,4BAA4B,YAAY,SAAS,WAAW,QAAQ,EAAE,OAAO,GAAG,KAAA,EAAU;;;AAIpG,IAAa,0BAAb,cAA6C,iBAAiB;CAC5D,cAAc;AACZ,QAAM,kCAAkC,YAAY,KAAK,oBAAoB;;;AAIjF,IAAa,uBAAb,cAA0C,iBAAiB;CACzD,cAAc;AACZ,QAAM,+BAA+B,YAAY,KAAK,oBAAoB;;;AAI9E,IAAa,oBAAb,cAAuC,iBAAiB;CACtD,YAAY,OAAgB;AAC1B,QAAM,4BAA4B,YAAY,WAAW,gBAAgB,QAAQ,EAAE,OAAO,GAAG,KAAA,EAAU;;;AAI3G,IAAa,sBAAb,cAAyC,iBAAiB;CACxD,cAAc;AACZ,QAAM,8BAA8B,YAAY,KAAK,gBAAgB;;;AAIzE,IAAa,wBAAb,cAA2C,iBAAiB;CAC1D,YAAY,OAAgB;AAC1B,QAAM,gCAAgC,YAAY,KAAK,oBAAoB,QAAQ,EAAE,OAAO,GAAG,KAAA,EAAU;;;AAI7G,IAAa,wBAAb,cAA2C,iBAAiB;CAC1D,YAAY,WAAmB;AAC7B,QAAM,gCAAgC,YAAY,KAAK,oBAAoB,EAAE,WAAW,CAAC;;;AAI7F,IAAa,uBAAb,cAA0C,iBAAiB;CACzD,YAAY,WAAmB;AAC7B,QAAM,+BAA+B,YAAY,KAAK,mBAAmB,EAAE,WAAW,CAAC;;;AAI3F,IAAa,4BAAb,cAA+C,iBAAiB;CAC9D,YAAY,OAAgB;AAC1B,QAAM,oCAAoC,YAAY,KAAK,wBAAwB,QAAQ,EAAE,OAAO,GAAG,KAAA,EAAU;;;AAIrH,IAAa,0BAAb,cAA6C,iBAAiB;CAC5D,YAAY,QAAiB;AAC3B,QAAM,kCAAkC,YAAY,KAAK,uBAAuB,SAAS,EAAE,QAAQ,GAAG,KAAA,EAAU;;;AAIpH,IAAa,6BAAb,cAAgD,iBAAiB;CAC/D,YAAY,QAAiB;AAC3B,QAAM,qCAAqC,YAAY,KAAK,0BAA0B,SAAS,EAAE,QAAQ,GAAG,KAAA,EAAU;;;AAI1H,IAAa,0BAAb,cAA6C,iBAAiB;CAC5D,YAAY,QAAiB;AAC3B,QAAM,kCAAkC,YAAY,KAAK,uBAAuB,SAAS,EAAE,QAAQ,GAAG,KAAA,EAAU;;;AAIpH,IAAa,2BAAb,cAA8C,iBAAiB;CAC7D,YAAY,UAAmB;AAC7B,QAAM,mCAAmC,YAAY,KAAK,uBAAuB,WAAW,EAAE,UAAU,GAAG,KAAA,EAAU;;;AAIzH,IAAa,+BAAb,cAAkD,iBAAiB;CACjE,cAAc;AACZ,QAAM,uCAAuC,YAAY,KAAK,2BAA2B;;;AAI7F,IAAa,wBAAb,cAA2C,iBAAiB;CAC1D,YAAY,UAAmB;AAC7B,QAAM,gCAAgC,YAAY,SAAS,WAAW,WAAW,EAAE,UAAU,GAAG,KAAA,EAAU;;;AAI9G,IAAa,yBAAb,cAA4C,iBAAiB;CAC3D,cAAc;AACZ,QAAM,iCAAiC,YAAY,SAAS,UAAU;;;AAI1E,IAAa,uBAAb,cAA0C,iBAAiB;CACzD,cAAc;AACZ,QAAM,+BAA+B,YAAY,SAAS,UAAU;;;AAIxE,IAAa,iCAAb,cAAoD,iBAAiB;CACnE,cAAc;AACZ,QAAM,yCAAyC,YAAY,SAAS,UAAU;;;AAIlF,IAAa,8BAAb,cAAiD,iBAAiB;CAChE,cAAc;AACZ,QAAM,sCAAsC,YAAY,SAAS,SAAS;;;AAI9E,IAAa,4BAAb,cAA+C,iBAAiB;CAC9D,YAAY,QAAiB;AAC3B,QAAM,oCAAoC,YAAY,WAAW,SAAS,SAAS,EAAE,QAAQ,GAAG,KAAA,EAAU;;;AAI9G,IAAa,0BAAb,cAA6C,iBAAiB;CAC5D,YAAY,QAAiB;AAC3B,QAAM,kCAAkC,YAAY,OAAO,gBAAgB,SAAS,EAAE,QAAQ,GAAG,KAAA,EAAU;;;AAI/G,IAAa,2BAAb,cAA8C,iBAAiB;CAC7D,YAAY,QAAiB;AAC3B,QAAM,mCAAmC,YAAY,OAAO,gBAAgB,SAAS,EAAE,QAAQ,GAAG,KAAA,EAAU;;;AAIhH,IAAa,2BAAb,cAA8C,iBAAiB;CAC7D,cAAc;AACZ,QAAM,4BAA4B,YAAY,WAAW,QAAQ;;;AAIrE,IAAa,oBAAb,cAAuC,iBAAiB;CACtD,cAAc;AACZ,QAAM,4BAA4B,YAAY,WAAW,QAAQ;;;AAIrE,IAAa,0BAAb,cAA6C,iBAAiB;CAC5D,cAAc;AACZ,QAAM,kCAAkC,YAAY,WAAW,eAAe;;;AAIlF,IAAa,qBAAb,cAAwC,iBAAiB;CACvD,cAAc;AACZ,QAAM,6BAA6B,YAAY,MAAM,UAAU;;;AAInE,IAAa,4BAAb,cAA+C,iBAAiB;CAC9D,cAAc;AACZ,QAAM,gCAAgC,YAAY,WAAW,QAAQ;;;AAIzE,IAAa,4BAAb,cAA+C,iBAAiB;CAC9D,cAAc;AACZ,QAAM,oCAAoC,YAAY,SAAS,SAAS;;;AAI5E,IAAa,qBAAb,cAAwC,iBAAiB;CACvD,cAAc;AACZ,QAAM,6BAA6B,YAAY,WAAW,eAAe;;;AAI7E,IAAa,yBAAb,cAA4C,iBAAiB;CAC3D,YAAY,WAAoB;AAC9B,QAAM,4BAA4B,YAAY,OAAO,gBAAgB,YAAY,EAAE,WAAW,GAAG,KAAA,EAAU;;;;;AChL/G,IAAa,oBAAb,cAAuC,iBAAiB;CACtD,cAAc;AACZ,QAAM,4BAA4B,YAAY,KAAK,cAAc;;;;;ACFrE,IAAa,4BAAb,cAA+C,iBAAiB;CAC9D,cAAc;AACZ,QAAM,iCAAiC,YAAY,KAAK,uBAAuB;;;AAInF,IAAa,kCAAb,cAAqD,iBAAiB;CACpE,cAAc;AACZ,QAAM,2BAA2B,YAAY,KAAK,iBAAiB;;;AAIvE,IAAa,sCAAb,cAAyD,iBAAiB;CACxE,cAAc;AACZ,QAAM,+BAA+B,YAAY,KAAK,qBAAqB;;;AAI/E,IAAa,oCAAb,cAAuD,iBAAiB;CACtE,cAAc;AACZ,QAAM,6BAA6B,YAAY,MAAM,UAAU;;;AAInE,IAAa,+CAAb,cAAkE,iBAAiB;CACjF,cAAc;AACZ,QAAM,wCAAwC,YAAY,KAAK,8BAA8B;;;AAIjG,IAAa,4BAAb,cAA+C,iBAAiB;CAC9D,cAAc;AACZ,QAAM,qBAAqB,YAAY,SAAS,SAAS;;;AAI7D,IAAa,gCAAb,cAAmD,iBAAiB;CAClE,cAAc;AACZ,QAAM,yBAAyB,YAAY,KAAK,2BAA2B;;;AAI/E,IAAa,8BAAb,cAAiD,iBAAiB;CAChE,cAAc;AACZ,QAAM,4BAA4B,YAAY,KAAK,iCAAiC;;;AAIxF,IAAa,gCAAb,cAAmD,iBAAiB;CAClE,cAAc;AACZ,QAAM,yBAAyB,YAAY,SAAS,UAAU;;;AAIlE,IAAa,gCAAb,cAAmD,iBAAiB;CAClE,cAAc;AACZ,QAAM,yBAAyB,YAAY,SAAS,UAAU;;;;;ACxDlE,IAAa,qBAAb,cAAwC,iBAAiB;CACvD,cAAc;AACZ,QAAM,6BAA6B,YAAY,WAAW,gBAAgB,EAAE,OAAO,SAAS,CAAC;;;;;ACFjG,IAAa,0BAAb,cAA6C,iBAAiB;CAC5D,cAAc;AACZ,QAAM,kCAAkC,YAAY,KAAK,oBAAoB;;;;;;;;AC6CjF,SAAgB,mBAAmB,OAAmC;CACpE,MAAM,YAAY,MAAM,MAAM;AAE9B,KAAI,MAAM,WAAW,SAAS;EAE5B,MAAM,WADU,MAAM,QACG,IAAI,WAAW,IAAI;AAE5C,MAAI,SAAS,SAAS,gBAAgB,CAAE,QAAO,IAAI,mBAAmB;AACtE,MAAI,SAAS,SAAS,gBAAgB,CAAE,QAAO,IAAI,mBAAmB;AACtE,MAAI,SAAS,SAAS,oBAAoB,CAAE,QAAO,IAAI,mBAAmB;AAC1E,MAAI,SAAS,SAAS,2BAA2B,CAAE,QAAO,IAAI,mBAAmB;AACjF,MAAI,SAAS,SAAS,wBAAwB,CAAE,QAAO,IAAI,yBAAyB;AACpF,MAAI,SAAS,SAAS,2BAA2B,CAAE,QAAO,IAAI,4BAA4B;;AAG5F,KAAI,CAAC,UACH,QAAO,IAAI,wBAAwB;AAMrC,KAAI,cAAc,oBAAoB,cAAc,eAAgB,QAAO,IAAI,mBAAmB;AAClG,KAAI,cAAc,uBAAwB,QAAO,IAAI,wBAAwB;AAG7E,KAAI,cAAc,4BAA6B,QAAO,IAAI,yBAAyB;AACnF,KAAI,cAAc,mBAAoB,QAAO,IAAI,sBAAsB;AACvE,KAAI,cAAc,gBAAiB,QAAO,IAAI,mBAAmB;AAGjE,KAAI,cAAc,qBAAqB,cAAc,oBAAqB,QAAO,IAAI,qBAAqB;AAC1G,KAAI,cAAc,2BAA4B,QAAO,IAAI,4BAA4B;AACrF,KAAI,cAAc,wBAAyB,QAAO,IAAI,yBAAyB;AAG/E,KAAI,cAAc,qBAAsB,QAAO,IAAI,uBAAuB;AAC1E,KAAI,cAAc,2BAA4B,QAAO,IAAI,2BAA2B;AACpF,KAAI,cAAc,yBAA0B,QAAO,IAAI,2BAA2B;AAClF,KAAI,cAAc,iBAAkB,QAAO,IAAI,oBAAoB;AAGnE,KAAI,cAAc,qBAAsB,QAAO,IAAI,sBAAsB,EAAE;AAC3E,KAAI,cAAc,oBAAqB,QAAO,IAAI,qBAAqB,IAAI;AAG3E,KAAI,cAAc,yBAAyB,cAAc,wCACvD,QAAO,IAAI,2BAA2B;AAExC,KAAI,cAAc,oBAAqB,QAAO,IAAI,sBAAsB;AACxE,KAAI,cAAc,+BAAgC,QAAO,IAAI,gCAAgC;AAC7F,KAAI,cAAc,gCAAiC,QAAO,IAAI,8BAA8B;AAG5F,KAAI,cAAc,wBAAyB,QAAO,IAAI,yBAAyB;AAC/E,KAAI,cAAc,wBAAyB,QAAO,IAAI,yBAAyB;AAC/E,KAAI,cAAc,0BAA2B,QAAO,IAAI,0BAA0B;AAGlF,KAAI,cAAc,mCAAmC,cAAc,gCACjE,QAAO,IAAI,0BAA0B;AAEvC,KAAI,cAAc,qBAAsB,QAAO,IAAI,uBAAuB;AAG1E,KAAI,cAAc,yBAA0B,QAAO,IAAI,0BAA0B;AACjF,KAAI,cAAc,gBAAiB,QAAO,IAAI,mBAAmB;AACjE,KAAI,cAAc,gBAAiB,QAAO,IAAI,mBAAmB;AAGjE,KAAI,cAAc,+BAA+B,cAAc,uBAC7D,QAAO,IAAI,6BAA6B;AAI1C,KACE,cAAc,0BACX,cAAc,0BACd,cAAc,mCACd,cAAc,gCACd,cAAc,wBAEjB,QAAO,IAAI,yBAAyB;AAItC,KACE,cAAc,oBACX,cAAc,4BACd,cAAc,sCAEjB,QAAO,IAAI,oBAAoB;AAIjC,KACE,cAAc,sBACX,cAAc,mBACd,cAAc,uBACd,cAAc,4BACd,cAAc,oCACd,cAAc,4CAEjB,QAAO,IAAI,2BAA2B;AAIxC,KAAI,cAAc,mCAAmC,cAAc,iCACjE,QAAO,IAAI,4BAA4B;AAMzC,KAAI,cAAc,4BAA4B,cAAc,yBAC1D,QAAO,IAAI,2BAA2B;AAIxC,KACE,cAAc,sBACX,cAAc,8CACd,cAAc,mCAEjB,QAAO,IAAI,iCAAiC;AAI9C,KAAI,cAAc,0BAA0B,cAAc,gCACxD,QAAO,IAAI,qCAAqC;AAIlD,KACE,cAAc,iDACX,cAAc,uEAEjB,QAAO,IAAI,8CAA8C;AAI3D,KAAI,cAAc,oBAAoB,cAAc,iCAClD,QAAO,IAAI,+BAA+B;AAI5C,KAAI,cAAc,oBAAoB,cAAc,mBAClD,QAAO,IAAI,+BAA+B;AAI5C,KACE,cAAc,iCACX,cAAc,qCACd,cAAc,mDACd,cAAc,kDACd,cAAc,yBACd,cAAc,6BAEjB,QAAO,IAAI,2BAA2B;AAIxC,KACE,cAAc,0DACX,cAAc,kDACd,cAAc,2CACd,cAAc,8BACd,cAAc,+BACd,cAAc,iBAEjB,QAAO,IAAI,+BAA+B;AAI5C,KACE,cAAc,yDACX,cAAc,wDACd,cAAc,gCACd,cAAc,sCACd,cAAc,iCACd,cAAc,mCACd,cAAc,6BACd,cAAc,gCACd,cAAc,oDAEjB,QAAO,IAAI,6BAA6B;AAI1C,KACE,UAAU,WAAW,0BAA0B,IAC5C,cAAc,+CACd,cAAc,iDACd,cAAc,qDACd,cAAc,sBAEjB,QAAO,IAAI,mCAAmC;AAIhD,QAAO,IAAI,uBAAuB,UAAU;;;;;;;AAQ9C,SAAgB,WAAW,OAAmC;AAC5D,KAAI,iBAAiB,SAAU,QAAO;AAEtC,QACE,iBAAiB,SACd,MAAM,SAAS,cACf,YAAY,SACZ,gBAAgB;;;;;;;;AClQvB,SAAgB,wBAAyD;AACvE,QAAO;EACL,OAAO;EACP,UAAU,UAAU;AAClB,OAAI,WAAW,MAAM,CACnB,OAAM,mBAAmB,MAAM;AAEjC,SAAM;;EAET;;;;;AAMH,MAAa,iBAAiB,OAAU,OAAqC;AAC3E,KAAI;AACF,SAAO,MAAM,IAAI;UACV,OAAO;AACd,MAAI,WAAW,MAAM,CACnB,OAAM,mBAAmB,MAAM;AAEjC,QAAM;;;;;ACAH,IAAA,cAAA,MAAM,YAAoE;CAC/E;CAEA,YACE,SACA;AADyC,OAAA,UAAA;AAEzC,OAAK,eAAe,WAAW;GAC7B,GAAG,KAAK;GACR,YAAY,uBAAuB;GACpC,CAAC;;;;;CAMJ,IAAI,OAAuB;AACzB,SAAO,KAAK;;;;CAjBf,UAAU,aAAa;oBAKnBC,SAAO,aAAa,CAAA;;;;;;ACsDlB,IAAA,aAAA,cAAA,MAAM,WAAwC;;;;;;;;CAQnD,gBAAgB,QAAsB;AACpC,SAAO,IAAI,uBAAuB,8BAA8B;;;;;;;;;;;;CAalE,OAAO,aACL,SACe;EACf,MAAM,EAAE,kBAAkB;EAC1B,MAAM,aAAa,QAAQ,UAAU,EAAE;EACvC,MAAM,cAAc,QAAQ;EAE5B,MAAM,sBAAsB;GAC1B,SAAS;GACT,aAAa,WAAsB,GAAG,aAA2C;IAC/E,IAAI,MAAM,YAAY,GAAG,SAAS;AAElC,QAAI,cACF,OAAM;KACJ,GAAG;KACH,SAAS,CAAC,sBAAsB,cAAc,EAAE,GAAI,IAAI,WAAW,EAAE,CAAE;KACxE;AASH,QANiB,UAAU,sBACQ,CAAC,aAClC,oBAAoB,cACpB,KAGoB,EAAE;KACtB,MAAM,QAAQ,UAAU,QAA2B,oBAAoB,MAAM;KAC7E,MAAM,WAAW,UAAU,QAA6B,oBAAoB,SAAS;AAErF,WAAM;MACJ,GAAG;MACH,WAAW;OACT,SAAS;OACT,GAAG,IAAI;OACP,eAAe,IAAI,WAAW,iBAAiB,iCAAiC,MAAM;OACtF,aAAa;QACX,GAAG,mBAAmB,SAAS;QAC/B,GAAI,IAAI,WAAW,eAAe,EAAE;QACrC;OACF;MACF;;AAGH,WAAO;;GAET,QAAQ,CAAC,iBAAiB,GAAG,WAAW;GACzC;AAED,SAAO;GACL,QAAA;GACA,WAAW;IACT;IACA;KACE,SAAS;KACT,UAAU;KACX;IACD,GAAI,gBACA,CACA;KAAE,SAAS,UAAU;KAAS,UAAU;KAAoC,EAC5E;KAAE,SAAS,UAAU;KAAe,UAAU;KAAe,CAC9D,GACC,EAAE;IACP;GACF;;;uCA3FJ,OAAO;CACN,SAAS,CACP,WAAW,iBAAiB,aAAa,CAC1C;CACD,WAAW,EAAE;CACd,CAAC,CAAA,EAAA,WAAA"}

package/dist/auth-context-6Li1JkIq.mjs

@@ -0,0 +1,85 @@
+import { t as __decorate } from "./decorate-CdfCRvAc.mjs";
+import { n as UserNotAuthenticatedError, r as ContextNotInitializedError } from "./errors-B1vVXc1T.mjs";
+import { DI_TOKENS, Transient } from "stratal/di";
+//#region src/context/auth-context.ts
+let AuthContext = class AuthContext {
+	user;
+	/**
+	* Set authentication context.
+	* This should be called once per request with the authenticated user.
+	*/
+	setAuthContext(info) {
+		this.user = info.user;
+	}
+	/**
+	* Get the authenticated user if available.
+	* Returns undefined if no user is authenticated.
+	*/
+	getUser() {
+		return this.user;
+	}
+	/**
+	* Get the authenticated user or throw if not authenticated.
+	*/
+	requireUser() {
+		if (!this.user) throw new UserNotAuthenticatedError();
+		return this.user;
+	}
+	/**
+	* Get user ID if available.
+	* Returns undefined if no user is authenticated.
+	*/
+	getUserId() {
+		return this.user?.id;
+	}
+	/**
+	* Get user ID or throw if not authenticated.
+	* Use this when authentication is required.
+	*/
+	requireUserId() {
+		return this.requireUser().id;
+	}
+	/**
+	* Get full authentication context or throw if not initialized.
+	*/
+	getAuthInfo() {
+		if (!this.user) throw new ContextNotInitializedError("Authentication");
+		return { user: this.user };
+	}
+	/**
+	* Get the raw role string from the authenticated user.
+	*
+	* Reads from `user.role` — apps that use roles should augment {@link AuthUser}
+	* with `role: string` (or similar) so this returns a typed value.
+	*/
+	getRole() {
+		return this.user?.role;
+	}
+	/**
+	* Get the user's roles as an array.
+	* Returns an empty array if no role is set or user is not authenticated.
+	*/
+	getRoles() {
+		const role = this.getRole();
+		if (!role) return [];
+		return role.split(",").map((r) => r.trim()).filter(Boolean);
+	}
+	/**
+	* Check if user is authenticated.
+	*/
+	isAuthenticated() {
+		return !!this.user;
+	}
+	/**
+	* Clear authentication context.
+	* Useful for testing or cleanup.
+	*/
+	clearAuthContext() {
+		this.user = void 0;
+	}
+};
+AuthContext = __decorate([Transient(DI_TOKENS.AuthContext)], AuthContext);
+//#endregion
+export { AuthContext as t };
+
+//# sourceMappingURL=auth-context-6Li1JkIq.mjs.map

package/dist/auth-context-6Li1JkIq.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-context-6Li1JkIq.mjs","names":[],"sources":["../src/context/auth-context.ts"],"sourcesContent":["import type { BaseUser } from '@better-auth/core/db'\nimport { Transient, DI_TOKENS } from 'stratal/di'\nimport {\n  ContextNotInitializedError,\n  UserNotAuthenticatedError\n} from './errors'\n\n/**\n * Authenticated user shape stored in {@link AuthContext}.\n *\n * Inherits Better Auth's base user fields, with `name` made optional so apps\n * that store `firstName`/`lastName` (or other name conventions) instead of\n * `name` aren't forced to declare a phantom value.\n *\n * Augment via TypeScript module declaration to add app-specific fields. Match\n * the augmentation to whatever your Better Auth `user.additionalFields` /\n * plugins are configured to return:\n *\n * @example\n * ```ts\n * declare module '@stratal/framework/context' {\n *   interface AuthUser {\n *     firstName: string\n *     lastName: string\n *     role: string\n *   }\n * }\n * ```\n */\nexport interface AuthUser extends Omit<BaseUser, 'name'> {\n  name?: string\n}\n\nexport interface AuthInfo {\n  user: AuthUser\n}\n\n@Transient(DI_TOKENS.AuthContext)\nexport class AuthContext {\n  protected user?: AuthUser\n\n  /**\n   * Set authentication context.\n   * This should be called once per request with the authenticated user.\n   */\n  setAuthContext(info: AuthInfo): void {\n    this.user = info.user\n  }\n\n  /**\n   * Get the authenticated user if available.\n   * Returns undefined if no user is authenticated.\n   */\n  getUser(): AuthUser | undefined {\n    return this.user\n  }\n\n  /**\n   * Get the authenticated user or throw if not authenticated.\n   */\n  requireUser(): AuthUser {\n    if (!this.user) {\n      throw new UserNotAuthenticatedError()\n    }\n    return this.user\n  }\n\n  /**\n   * Get user ID if available.\n   * Returns undefined if no user is authenticated.\n   */\n  getUserId(): string | undefined {\n    return this.user?.id\n  }\n\n  /**\n   * Get user ID or throw if not authenticated.\n   * Use this when authentication is required.\n   */\n  requireUserId(): string {\n    return this.requireUser().id\n  }\n\n  /**\n   * Get full authentication context or throw if not initialized.\n   */\n  getAuthInfo(): AuthInfo {\n    if (!this.user) {\n      throw new ContextNotInitializedError('Authentication')\n    }\n    return { user: this.user }\n  }\n\n  /**\n   * Get the raw role string from the authenticated user.\n   *\n   * Reads from `user.role` — apps that use roles should augment {@link AuthUser}\n   * with `role: string` (or similar) so this returns a typed value.\n   */\n  getRole(): string | undefined {\n    return (this.user as { role?: string } | undefined)?.role\n  }\n\n  /**\n   * Get the user's roles as an array.\n   * Returns an empty array if no role is set or user is not authenticated.\n   */\n  getRoles(): string[] {\n    const role = this.getRole()\n    if (!role) return []\n    return role.split(',').map(r => r.trim()).filter(Boolean)\n  }\n\n  /**\n   * Check if user is authenticated.\n   */\n  isAuthenticated(): boolean {\n    return !!this.user\n  }\n\n  /**\n   * Clear authentication context.\n   * Useful for testing or cleanup.\n   */\n  clearAuthContext(): void {\n    this.user = undefined\n  }\n}\n"],"mappings":";;;;AAsCO,IAAA,cAAA,MAAM,YAAY;CACvB;;;;;CAMA,eAAe,MAAsB;AACnC,OAAK,OAAO,KAAK;;;;;;CAOnB,UAAgC;AAC9B,SAAO,KAAK;;;;;CAMd,cAAwB;AACtB,MAAI,CAAC,KAAK,KACR,OAAM,IAAI,2BAA2B;AAEvC,SAAO,KAAK;;;;;;CAOd,YAAgC;AAC9B,SAAO,KAAK,MAAM;;;;;;CAOpB,gBAAwB;AACtB,SAAO,KAAK,aAAa,CAAC;;;;;CAM5B,cAAwB;AACtB,MAAI,CAAC,KAAK,KACR,OAAM,IAAI,2BAA2B,iBAAiB;AAExD,SAAO,EAAE,MAAM,KAAK,MAAM;;;;;;;;CAS5B,UAA8B;AAC5B,SAAQ,KAAK,MAAwC;;;;;;CAOvD,WAAqB;EACnB,MAAM,OAAO,KAAK,SAAS;AAC3B,MAAI,CAAC,KAAM,QAAO,EAAE;AACpB,SAAO,KAAK,MAAM,IAAI,CAAC,KAAI,MAAK,EAAE,MAAM,CAAC,CAAC,OAAO,QAAQ;;;;;CAM3D,kBAA2B;AACzB,SAAO,CAAC,CAAC,KAAK;;;;;;CAOhB,mBAAyB;AACvB,OAAK,OAAO,KAAA;;;0BAxFf,UAAU,UAAU,YAAY,CAAA,EAAA,YAAA"}

package/dist/auth-context-B44CDZCt.d.mts

@@ -0,0 +1,86 @@
+import { BaseUser } from "@better-auth/core/db";
+
+//#region src/context/auth-context.d.ts
+/**
+ * Authenticated user shape stored in {@link AuthContext}.
+ *
+ * Inherits Better Auth's base user fields, with `name` made optional so apps
+ * that store `firstName`/`lastName` (or other name conventions) instead of
+ * `name` aren't forced to declare a phantom value.
+ *
+ * Augment via TypeScript module declaration to add app-specific fields. Match
+ * the augmentation to whatever your Better Auth `user.additionalFields` /
+ * plugins are configured to return:
+ *
+ * @example
+ * ```ts
+ * declare module '@stratal/framework/context' {
+ *   interface AuthUser {
+ *     firstName: string
+ *     lastName: string
+ *     role: string
+ *   }
+ * }
+ * ```
+ */
+interface AuthUser extends Omit<BaseUser, 'name'> {
+  name?: string;
+}
+interface AuthInfo {
+  user: AuthUser;
+}
+declare class AuthContext {
+  protected user?: AuthUser;
+  /**
+   * Set authentication context.
+   * This should be called once per request with the authenticated user.
+   */
+  setAuthContext(info: AuthInfo): void;
+  /**
+   * Get the authenticated user if available.
+   * Returns undefined if no user is authenticated.
+   */
+  getUser(): AuthUser | undefined;
+  /**
+   * Get the authenticated user or throw if not authenticated.
+   */
+  requireUser(): AuthUser;
+  /**
+   * Get user ID if available.
+   * Returns undefined if no user is authenticated.
+   */
+  getUserId(): string | undefined;
+  /**
+   * Get user ID or throw if not authenticated.
+   * Use this when authentication is required.
+   */
+  requireUserId(): string;
+  /**
+   * Get full authentication context or throw if not initialized.
+   */
+  getAuthInfo(): AuthInfo;
+  /**
+   * Get the raw role string from the authenticated user.
+   *
+   * Reads from `user.role` — apps that use roles should augment {@link AuthUser}
+   * with `role: string` (or similar) so this returns a typed value.
+   */
+  getRole(): string | undefined;
+  /**
+   * Get the user's roles as an array.
+   * Returns an empty array if no role is set or user is not authenticated.
+   */
+  getRoles(): string[];
+  /**
+   * Check if user is authenticated.
+   */
+  isAuthenticated(): boolean;
+  /**
+   * Clear authentication context.
+   * Useful for testing or cleanup.
+   */
+  clearAuthContext(): void;
+}
+//#endregion
+export { AuthInfo as n, AuthUser as r, AuthContext as t };
+//# sourceMappingURL=auth-context-B44CDZCt.d.mts.map

package/dist/auth-context-B44CDZCt.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-context-B44CDZCt.d.mts","names":[],"sources":["../src/context/auth-context.ts"],"mappings":";;;;;AA6BA;;;;;;;;;AAIA;;;;;AAIA;;;;;;UARiB,QAAA,SAAiB,IAAA,CAAK,QAAA;EACrC,IAAA;AAAA;AAAA,UAGe,QAAA;EACf,IAAA,EAAM,QAAA;AAAA;AAAA,cAIK,WAAA;EAAA,UACD,IAAA,GAAO,QAAA;EAMF;;;;EAAf,cAAA,CAAe,IAAA,EAAM,QAAA;EA0BrB;;;;EAlBA,OAAA,CAAA,GAAW,QAAA;EAsDX;;;EA/CA,WAAA,CAAA,GAAe,QAAA;EAgEC;;;;EArDhB,SAAA,CAAA;;;;;EAQA,aAAA,CAAA;;;;EAOA,WAAA,CAAA,GAAe,QAAA;;;;;;;EAaf,OAAA,CAAA;;;;;EAQA,QAAA,CAAA;;;;EASA,eAAA,CAAA;;;;;EAQA,gBAAA,CAAA;AAAA"}

package/dist/context/index.d.mts

@@ -1,4 +1,4 @@
-import { n as AuthInfo, t as AuthContext } from "../auth-context-BD2ApWg1.mjs";
+import { n as AuthInfo, r as AuthUser, t as AuthContext } from "../auth-context-B44CDZCt.mjs";
 import { ApplicationError } from "stratal/errors";
 
 //#region src/context/errors/context-not-initialized.error.d.ts
@@ -16,5 +16,5 @@ declare class UserNotAuthorizedError extends ApplicationError {
   constructor();
 }
 //#endregion
-export { AuthContext, AuthInfo, ContextNotInitializedError, UserNotAuthenticatedError, UserNotAuthorizedError };
+export { AuthContext, AuthInfo, AuthUser, ContextNotInitializedError, UserNotAuthenticatedError, UserNotAuthorizedError };
 //# sourceMappingURL=index.d.mts.map

package/dist/context/index.mjs

@@ -1,3 +1,3 @@
-import { n as UserNotAuthenticatedError, r as ContextNotInitializedError, t as UserNotAuthorizedError } from "../errors-C_KIIU1v.mjs";
-import { t as AuthContext } from "../auth-context-BfekHvM9.mjs";
+import { n as UserNotAuthenticatedError, r as ContextNotInitializedError, t as UserNotAuthorizedError } from "../errors-B1vVXc1T.mjs";
+import { t as AuthContext } from "../auth-context-6Li1JkIq.mjs";
 export { AuthContext, ContextNotInitializedError, UserNotAuthenticatedError, UserNotAuthorizedError };

package/dist/database/index.d.mts

@@ -1,3 +1,3 @@
-import { a as InternalDatabaseEventContext, i as InferConnectionSchema, n as DefaultConnectionName, o as StratalDatabase, r as InferAnySchema, t as ConnectionName } from "../types-Gjk0d2qB.mjs";
-import { A as InjectDB, C as fromZenStackError, D as ForeignKeyConstraintError, E as InvalidErrorCodeRangeError, F as DatabaseModule, I as DatabaseModuleConfig, M as connectionSymbol, N as DatabaseService, O as DatabaseConfigError, P as DatabaseConnectionConfig, S as ParseEvent, T as RecordNotFoundError, _ as DatabaseOperation, a as DbPushCommand, b as GetResult, c as ZenStackCommand, d as EventEmitterPlugin, f as EventEmitterPluginOptions, g as DatabaseEvents, h as DatabaseEventName, i as MigrateDeployCommand, j as DATABASE_TOKENS, k as DatabaseError, l as SchemaSwitcherPlugin, m as databaseI18n, n as MigrateResetCommand, o as DbPullCommand, p as ErrorHandlerPlugin, r as MigrateDevCommand, s as DbGenerateCommand, t as MigrateStatusCommand, u as SchemaSwitcherPluginOptions, v as EventPhase, w as UniqueConstraintError, x as ModelName, y as GetData } from "../index-B1iGBJcO.mjs";
-export { ConnectionName, DATABASE_TOKENS, DatabaseConfigError, DatabaseConnectionConfig, DatabaseError, DatabaseEventName, DatabaseEvents, DatabaseModule, DatabaseModuleConfig, DatabaseOperation, DatabaseService, DbGenerateCommand, DbPullCommand, DbPushCommand, DefaultConnectionName, ErrorHandlerPlugin, EventEmitterPlugin, EventEmitterPluginOptions, EventPhase, ForeignKeyConstraintError, GetData, GetResult, InferAnySchema, InferConnectionSchema, InjectDB, InternalDatabaseEventContext, InvalidErrorCodeRangeError, MigrateDeployCommand, MigrateDevCommand, MigrateResetCommand, MigrateStatusCommand, ModelName, ParseEvent, RecordNotFoundError, SchemaSwitcherPlugin, SchemaSwitcherPluginOptions, StratalDatabase, UniqueConstraintError, ZenStackCommand, connectionSymbol, databaseI18n, fromZenStackError };
+import { a as InferConnectionSchema, i as InferConnectionExtensions, n as DefaultConnectionName, o as InternalDatabaseEventContext, r as InferAnySchema, s as StratalDatabase, t as ConnectionName } from "../types-BZlcRR2M.mjs";
+import { A as DATABASE_TOKENS, C as UniqueConstraintError, D as DatabaseConfigError, E as ForeignKeyConstraintError, F as DatabaseModuleConfig, M as DatabaseService, N as DatabaseConnectionConfig, O as DatabaseError, P as DatabaseModule, S as fromZenStackError, T as InvalidErrorCodeRangeError, _ as EventPhase, a as DbPushCommand, b as ModelName, c as ZenStackCommand, d as EventEmitterPluginOptions, f as ErrorHandlerPlugin, g as DatabaseOperation, h as DatabaseEvents, i as MigrateDeployCommand, j as connectionSymbol, k as InjectDB, l as SchemaSwitcher, m as DatabaseEventName, n as MigrateResetCommand, o as DbPullCommand, p as databaseMessages, r as MigrateDevCommand, s as DbGenerateCommand, t as MigrateStatusCommand, u as EventEmitterPlugin, v as GetData, w as RecordNotFoundError, x as ParseEvent, y as GetResult } from "../index-CCDPF-1Y.mjs";
+export { ConnectionName, DATABASE_TOKENS, DatabaseConfigError, DatabaseConnectionConfig, DatabaseError, DatabaseEventName, DatabaseEvents, DatabaseModule, DatabaseModuleConfig, DatabaseOperation, DatabaseService, DbGenerateCommand, DbPullCommand, DbPushCommand, DefaultConnectionName, ErrorHandlerPlugin, EventEmitterPlugin, EventEmitterPluginOptions, EventPhase, ForeignKeyConstraintError, GetData, GetResult, InferAnySchema, InferConnectionExtensions, InferConnectionSchema, InjectDB, InternalDatabaseEventContext, InvalidErrorCodeRangeError, MigrateDeployCommand, MigrateDevCommand, MigrateResetCommand, MigrateStatusCommand, ModelName, ParseEvent, RecordNotFoundError, SchemaSwitcher, StratalDatabase, UniqueConstraintError, ZenStackCommand, connectionSymbol, databaseMessages, fromZenStackError };

package/dist/database/index.mjs

@@ -1,9 +1,10 @@
-import { t as __decorate } from "../decorate-C12QolJF.mjs";
-import { t as __decorateMetadata } from "../decorateMetadata-rWbWGUuO.mjs";
-import { Module } from "stratal/module";
+import { t as __decorateMetadata } from "../decorateMetadata-CqtSx3_1.mjs";
+import { t as __decorate } from "../decorate-CdfCRvAc.mjs";
 import { DI_TOKENS, Scope, Transient, delay } from "stratal/di";
+import { I18nModule } from "stratal/i18n";
+import { Module } from "stratal/module";
 import { ApplicationError, ERROR_CODES } from "stratal/errors";
-import { inject } from "tsyringe";
+import { inject as inject$1 } from "tsyringe";
 import { Command } from "stratal/quarry";
 import { ORMError, ORMErrorReason, ZenStackClient } from "@zenstackhq/orm";
 import { withI18n, z } from "stratal/validation";
@@ -365,30 +366,32 @@ var EventEmitterPlugin = class {
 	};
 };
 //#endregion
-//#region src/database/plugins/schema-switcher.plugin.ts
+//#region src/database/plugins/schema-switcher.ts
 /**
-* ZenStack runtime plugin that sets PostgreSQL search_path before each query.
-* Used for tenant isolation in multi-tenant applications.
+* Switches the active schema on a ZenStack/Kysely database client by mutating
+* `$schema.provider.defaultSchema`. This causes ZenStack's QueryNameMapper to
+* generate fully-qualified table references (e.g. `"tenant_123"."User"`).
 *
-* @example
-* ```typescript
-* super(schema, {
-*   dialect: new PostgresDialect({ pool }),
-*   plugins: [
-*     new SchemaSwitcherPlugin({ schemaName: `tenant_${tenantId}` })
-*   ]
-* })
-* ```
+* Must be called BEFORE any queries are made on the client.
+*
+* Note: The ZenStack RuntimePlugin `onQuery` hook fires after table names are
+* already resolved, so a plugin-based approach cannot set the schema prefix.
+* Direct client mutation is the only supported method.
 */
-var SchemaSwitcherPlugin = class {
-	id = "schema-switcher";
-	constructor(options) {
-		this.options = options;
+var SchemaSwitcher = class {
+	static apply(client, schemaName) {
+		const c = client;
+		const switched = {
+			...c.$schema,
+			provider: {
+				...c.$schema.provider,
+				defaultSchema: schemaName
+			}
+		};
+		c.$schema = switched;
+		c.schema = switched;
+		return client;
 	}
-	onQuery = async ({ args, proceed, client }) => {
-		await client.$executeRawUnsafe(`SET search_path TO "${this.options.schemaName}"`);
-		return proceed(args);
-	};
 };
 //#endregion
 //#region src/database/database.helpers.ts
@@ -396,7 +399,8 @@ const databaseConnectionSchema = z.object({
 	name: z.string().min(1, withI18n("database.connectionNameRequired")),
 	schema: z.object({}).loose(),
 	dialect: z.function(),
-	plugins: z.array(z.object({}).loose()).optional()
+	plugins: z.array(z.object({}).loose()).optional(),
+	computedFields: z.object({}).loose().optional()
 });
 z.object({
 	default: z.string().min(1, withI18n("database.defaultConnectionRequired")),
@@ -416,7 +420,8 @@ function createDatabaseService(conn, eventRegistry) {
 			const dialect = conn.dialect();
 			super(conn.schema, {
 				dialect,
-				plugins
+				plugins,
+				computedFields: conn.computedFields
 			});
 		}
 	};
@@ -433,6 +438,15 @@ function connectionSymbol(name) {
 	return Symbol.for(`stratal:database:connection:${name}`);
 }
 //#endregion
+//#region src/database/i18n/en.ts
+const databaseMessages = { en: {
+	connectionNameRequired: "Connection name is required",
+	defaultConnectionRequired: "Default connection name is required",
+	connectionRequired: "At least one connection is required",
+	duplicateConnections: "Duplicate connection names found",
+	defaultConnectionNotFound: "Default connection not found in connections"
+} };
+//#endregion
 //#region src/database/database.module.ts
 var _DatabaseModule;
 let DatabaseModule = _DatabaseModule = class DatabaseModule {
@@ -470,30 +484,24 @@ let DatabaseModule = _DatabaseModule = class DatabaseModule {
 		context.logger.info("DatabaseModule shutdown");
 	}
 };
-DatabaseModule = _DatabaseModule = __decorate([Module({ providers: [
-	DbGenerateCommand,
-	DbPushCommand,
-	DbPullCommand,
-	MigrateDevCommand,
-	MigrateDeployCommand,
-	MigrateStatusCommand,
-	MigrateResetCommand
-] })], DatabaseModule);
+DatabaseModule = _DatabaseModule = __decorate([Module({
+	imports: [I18nModule.registerMessages({ en: { database: databaseMessages.en } })],
+	providers: [
+		DbGenerateCommand,
+		DbPushCommand,
+		DbPullCommand,
+		MigrateDevCommand,
+		MigrateDeployCommand,
+		MigrateStatusCommand,
+		MigrateResetCommand
+	]
+})], DatabaseModule);
 //#endregion
 //#region src/database/decorators/inject-db.decorator.ts
 function InjectDB(name) {
-	return inject(connectionSymbol(name));
+	return inject$1(connectionSymbol(name));
 }
 //#endregion
-//#region src/database/i18n/en.ts
-const databaseI18n = { database: {
-	connectionNameRequired: "Connection name is required",
-	defaultConnectionRequired: "Default connection name is required",
-	connectionRequired: "At least one connection is required",
-	duplicateConnections: "Duplicate connection names found",
-	defaultConnectionNotFound: "Default connection not found in connections"
-} };
-//#endregion
-export { DATABASE_TOKENS, DatabaseConfigError, DatabaseError, DatabaseModule, DbGenerateCommand, DbPullCommand, DbPushCommand, ErrorHandlerPlugin, EventEmitterPlugin, ForeignKeyConstraintError, InjectDB, InvalidErrorCodeRangeError, MigrateDeployCommand, MigrateDevCommand, MigrateResetCommand, MigrateStatusCommand, RecordNotFoundError, SchemaSwitcherPlugin, UniqueConstraintError, ZenStackCommand, connectionSymbol, databaseI18n, fromZenStackError };
+export { DATABASE_TOKENS, DatabaseConfigError, DatabaseError, DatabaseModule, DbGenerateCommand, DbPullCommand, DbPushCommand, ErrorHandlerPlugin, EventEmitterPlugin, ForeignKeyConstraintError, InjectDB, InvalidErrorCodeRangeError, MigrateDeployCommand, MigrateDevCommand, MigrateResetCommand, MigrateStatusCommand, RecordNotFoundError, SchemaSwitcher, UniqueConstraintError, ZenStackCommand, connectionSymbol, databaseMessages, fromZenStackError };
 
 //# sourceMappingURL=index.mjs.map