@stratal/framework 0.0.21 → 0.0.23

package/dist/auth/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":["inject","inject"],"sources":["../../src/auth/auth.tokens.ts","../../src/auth/i18n/en.ts","../../src/auth/middleware/auth-context.middleware.ts","../../src/auth/middleware/session-verification.middleware.ts","../../src/auth/rate-limit-bridge.ts","../../src/auth/errors/auth-errors.ts","../../src/auth/errors/invalid-token.error.ts","../../src/auth/errors/organization-errors.ts","../../src/auth/errors/token-required.error.ts","../../src/auth/errors/verification-failed.error.ts","../../src/auth/utils/better-auth-error-handler.ts","../../src/auth/utils/auth-helpers.ts","../../src/auth/services/auth.service.ts","../../src/auth/auth.module.ts"],"sourcesContent":["/** Token for AuthService - core authentication service */\nexport const AUTH_SERVICE = Symbol.for('stratal:auth:service')\n\n/** Token for Better Auth options configuration */\nexport const AUTH_OPTIONS = Symbol.for('stratal:auth:options')\n","export const authMessages = {\n  en: {\n    auth: {\n      errors: {\n        tokenRequired: 'Verification token is required',\n        invalidToken: 'Invalid or expired verification token',\n        verificationFailed: 'Verification failed. Please try again.',\n        userNotFound: 'User not found. Please check your credentials.',\n        invalidCredentials: 'Invalid email or password',\n        invalidPassword: 'Invalid password',\n        invalidEmail: 'Invalid email address',\n        sessionExpired: 'Your session has expired. Please sign in again.',\n        emailNotVerified: 'Please verify your email address before signing in',\n        passwordTooShort: 'Password must be at least {minLength} characters',\n        passwordTooLong: 'Password must be at most {maxLength} characters',\n        accountAlreadyExists: 'An account with this email already exists',\n        failedToCreateUser: 'Failed to create user account. Please try again.',\n        failedToCreateSession: 'Failed to create session. Please try again.',\n        failedToGetSession: 'Failed to retrieve session. Please try again.',\n        failedToUpdateUser: 'Failed to update user information. Please try again.',\n        failedToGetUserInfo: 'Failed to retrieve user information. Please try again.',\n        socialAccountLinked: 'This social account is already linked to another user',\n        providerNotFound: 'Authentication provider not found',\n        userEmailNotFound: 'User email address not found',\n        accountNotFound: 'Account not found',\n        credentialAccountNotFound: 'Credential account not found',\n        cannotUnlinkLastAccount: 'Cannot unlink your last account',\n        userAlreadyHasPassword: 'User already has a password set',\n        emailCannotBeUpdated: 'Email address cannot be updated at this time',\n        tokenExpired: 'The verification token has expired. Please request a new verification email.',\n        invalidCallbackUrl: 'Invalid callback URL',\n        invalidOrigin: 'Request origin is not allowed',\n        validationFailed: 'Authentication validation failed',\n        emailAlreadyVerified: 'Email address is already verified',\n        emailMismatch: 'Email address does not match',\n        unknownError: 'An authentication error occurred',\n      },\n      org: {\n        organizationNotFound: 'Organization not found',\n        memberNotFound: 'Member not found',\n        invitationNotFound: 'Invitation not found',\n        permissionDenied: 'You do not have permission to perform this action',\n        invitationRecipientMismatch: 'You are not the recipient of this invitation',\n        conflict: 'A resource with this identifier already exists',\n        limitReached: 'The maximum limit has been reached',\n        membershipError: 'This action cannot be performed due to membership constraints',\n        teamNotFound: 'Team not found',\n        roleNotFound: 'Role not found',\n      },\n    },\n  },\n} as const\n\ndeclare module 'stratal/i18n' {\n  interface AppMessageNamespaces {\n    auth: typeof authMessages['en']['auth']\n  }\n}\n","import { DI_TOKENS, Transient } from 'stratal/di'\nimport type { Middleware, Next, RouterContext } from 'stratal/router'\nimport { AuthContext } from '../../context/auth-context'\n\n/**\n * Auth Context Middleware\n *\n * Registers AuthContext in the request container at the start of each request.\n * This MUST run before SessionVerificationMiddleware and any other middleware\n * that depends on AuthContext.\n */\n@Transient()\nexport class AuthContextMiddleware implements Middleware {\n  async handle(ctx: RouterContext, next: Next): Promise<void> {\n    const requestContainer = ctx.getContainer()\n\n    const authContext = new AuthContext()\n    requestContainer.registerValue(DI_TOKENS.AuthContext, authContext)\n\n    return next()\n  }\n}\n","import { DI_TOKENS, Transient } from 'stratal/di'\nimport { LOGGER_TOKENS, type LoggerService } from 'stratal/logger'\nimport type { Middleware, Next, RouterContext } from 'stratal/router'\nimport { inject } from 'tsyringe'\nimport { type AuthContext } from '../../context/auth-context'\nimport { AUTH_SERVICE } from '../auth.tokens'\nimport type { AuthService } from '../services/auth.service'\n\n/**\n * Session Verification Middleware\n *\n * Verifies user session via Better Auth and populates AuthContext with\n * the authenticated user.\n *\n * **Responsibilities:**\n * - Calls Better Auth's getSession() API\n * - Populates AuthContext with the user record if the session is valid\n * - Continues request chain regardless of session status\n */\n@Transient()\nexport class SessionVerificationMiddleware implements Middleware {\n  constructor(\n    @inject(AUTH_SERVICE)\n    private readonly authService: AuthService,\n    @inject(LOGGER_TOKENS.LoggerService) private logger: LoggerService\n  ) { }\n\n  async handle(ctx: RouterContext, next: Next): Promise<void> {\n    try {\n      const result = await this.authService.auth.api.getSession({\n        headers: ctx.c.req.raw.headers\n      })\n\n      if (result) {\n        const authContext = ctx.getContainer().resolve<AuthContext>(DI_TOKENS.AuthContext)\n        authContext.setAuthContext({\n          user: result.user,\n        })\n      }\n    } catch (error: unknown) {\n      this.logger.debug('Session validation failed (e.g., invalidated in DB)', { error })\n    }\n\n    return next()\n  }\n}\n","/**\n * Rate-limit bridge between Stratal's `RateLimiterModule` and better-auth.\n *\n * Importing this file (transitively, via `auth.module.ts`) does two things:\n *\n *  1. Augments `RateLimiterRegistry` with `forPath()` + `pathEntries()` via\n *     Stratal's `Macroable`. Path-keyed rules registered on the same registry\n *     used for Stratal's own throttling are projected into better-auth's\n *     `customRules` by {@link projectCustomRules}.\n *  2. Exports {@link createBetterAuthRateLimitStorage} — adapts Stratal's\n *     {@link IRateLimiterStore} into better-auth's `customStorage`, so both\n *     systems share one backing store.\n *\n * `AuthModule.forRootAsync` wires both automatically when `RateLimiterModule`\n * is imported. Users with explicit `rateLimit.customStorage` /\n * `rateLimit.customRules` keys in their auth factory keep precedence.\n *\n * Frictions, documented for path-keyed entries:\n *\n *  - `Limit.by(...)` is meaningless. Better-auth scopes per-IP+path.\n *  - Multiple `Limit`s reduce to the most restrictive (smallest max-per-second).\n *  - `Limit.none()` projects to `false` (better-auth's \"disable\" sentinel).\n *  - `Limit.response(...)` is a no-op. Better-auth renders its own 429.\n *  - Snapshot caveat: `customRules` is built once at AuthService construction,\n *    so register all `forPath()` entries inside `OnInitialize` hooks.\n */\nimport { type IRateLimiterStore, type Limit, RateLimiterRegistry } from 'stratal/rate-limiter'\n\n/**\n * Resolver attached to a path-keyed limiter entry. Receives the native\n * `Request` (better-auth's customRules invokes us with the live Request)\n * and returns one or more `Limit`s. Async is supported.\n */\nexport type PathLimitResolver = (\n  req: Request,\n) => Limit | Limit[] | Promise<Limit | Limit[]>\n\ninterface BetterAuthRateLimit {\n  key: string\n  count: number\n  lastRequest: number\n}\n\ninterface BetterAuthRateLimitRule {\n  window: number\n  max: number\n}\n\ntype BetterAuthCustomRule =\n  | BetterAuthRateLimitRule\n  | false\n  | ((req: Request) => Promise<BetterAuthRateLimitRule | false>)\n\n// Per-instance path map — keyed by registry so we don't pin GC roots.\nconst pathResolvers = new WeakMap<RateLimiterRegistry, Map<string, PathLimitResolver>>()\n\nfunction getOrCreatePathMap(registry: RateLimiterRegistry): Map<string, PathLimitResolver> {\n  let map = pathResolvers.get(registry)\n  if (!map) {\n    map = new Map()\n    pathResolvers.set(registry, map)\n  }\n  return map\n}\n\nRateLimiterRegistry.macro('forPath', function (\n  this: RateLimiterRegistry,\n  path: string,\n  resolver: PathLimitResolver,\n): void {\n  getOrCreatePathMap(this).set(path, resolver)\n})\n\nRateLimiterRegistry.macro('pathEntries', function (\n  this: RateLimiterRegistry,\n): IterableIterator<[string, PathLimitResolver]> {\n  return (pathResolvers.get(this) ?? new Map<string, PathLimitResolver>()).entries()\n})\n\ndeclare module 'stratal/rate-limiter' {\n  interface RateLimiterRegistry {\n    /**\n     * Register a rate-limit rule for a better-auth path pattern. The rule\n     * is projected into better-auth's `rateLimit.customRules` automatically\n     * when both modules are imported.\n     *\n     * @example\n     * limiter.forPath('/sign-in/email', () => Limit.perSeconds(10, 3))\n     * limiter.forPath('/two-factor/*', async (req) => { ... })\n     * limiter.forPath('/forget-password', () => Limit.none())\n     */\n    forPath(path: string, resolver: PathLimitResolver): void\n\n    /**\n     * Iterate every path-keyed entry registered via `forPath`. Used by the\n     * auth bridge to project entries into better-auth's `customRules`.\n     */\n    pathEntries(): IterableIterator<[string, PathLimitResolver]>\n  }\n}\n\n// Better-auth manages window expiry itself by reading `lastRequest`. We still\n// need a TTL on the underlying KV so dead records don't accumulate. 1 day\n// covers any reasonable better-auth window without colliding with the next.\nconst BETTER_AUTH_TTL_SECONDS = 86_400\nconst BETTER_AUTH_KEY_PREFIX = 'ba-rl:'\n\n/**\n * Adapt Stratal's `IRateLimiterStore` into better-auth's `customStorage` shape.\n * Better-auth supplies its own `RateLimit` records (`{ key, count, lastRequest }`);\n * the adapter just persists them under a separate key namespace.\n */\nexport function createBetterAuthRateLimitStorage(store: IRateLimiterStore): {\n  get: (key: string) => Promise<BetterAuthRateLimit | null>\n  set: (key: string, value: BetterAuthRateLimit, update?: boolean) => Promise<void>\n} {\n  return {\n    async get(key) {\n      return await store.get<BetterAuthRateLimit>(`${BETTER_AUTH_KEY_PREFIX}${key}`)\n    },\n    async set(key, value, _update) {\n      await store.set(`${BETTER_AUTH_KEY_PREFIX}${key}`, value, BETTER_AUTH_TTL_SECONDS)\n    },\n  }\n}\n\n/**\n * Project every `forPath` entry on the registry into better-auth's\n * `customRules` shape. Each entry becomes an async function that resolves\n * the user's `Limit`(s) and reduces them to a single `{ window, max }` pair\n * (or `false` for `Limit.none()`).\n *\n * Multi-`Limit` reduction picks the most restrictive — smallest\n * `max / windowSeconds` ratio; ties favour the first.\n */\nexport function projectCustomRules(\n  registry: RateLimiterRegistry,\n): Record<string, BetterAuthCustomRule> {\n  const rules: Record<string, BetterAuthCustomRule> = {}\n\n  for (const [path, resolver] of registry.pathEntries()) {\n    rules[path] = async (req: Request): Promise<BetterAuthRateLimitRule | false> => {\n      const resolved = await resolver(req)\n      const candidates = (Array.isArray(resolved) ? resolved : [resolved]).filter((l) => !l.disabled)\n      if (candidates.length === 0) return false\n\n      const chosen = candidates.reduce((a, b) =>\n        a.max / a.windowSeconds <= b.max / b.windowSeconds ? a : b,\n      )\n\n      return { window: chosen.windowSeconds, max: chosen.max }\n    }\n  }\n\n  return rules\n}\n","import { ApplicationError, ERROR_CODES } from 'stratal/errors'\n\nexport class UserNotFoundError extends ApplicationError {\n  constructor(email?: string) {\n    super('auth.errors.userNotFound', ERROR_CODES.RESOURCE.NOT_FOUND, email ? { email } : undefined)\n  }\n}\n\nexport class InvalidCredentialsError extends ApplicationError {\n  constructor() {\n    super('auth.errors.invalidCredentials', ERROR_CODES.AUTH.INVALID_CREDENTIALS)\n  }\n}\n\nexport class InvalidPasswordError extends ApplicationError {\n  constructor() {\n    super('auth.errors.invalidPassword', ERROR_CODES.AUTH.INVALID_CREDENTIALS)\n  }\n}\n\nexport class InvalidEmailError extends ApplicationError {\n  constructor(email?: string) {\n    super('auth.errors.invalidEmail', ERROR_CODES.VALIDATION.INVALID_FORMAT, email ? { email } : undefined)\n  }\n}\n\nexport class SessionExpiredError extends ApplicationError {\n  constructor() {\n    super('auth.errors.sessionExpired', ERROR_CODES.AUTH.SESSION_EXPIRED)\n  }\n}\n\nexport class EmailNotVerifiedError extends ApplicationError {\n  constructor(email?: string) {\n    super('auth.errors.emailNotVerified', ERROR_CODES.AUTH.EMAIL_NOT_VERIFIED, email ? { email } : undefined)\n  }\n}\n\nexport class PasswordTooShortError extends ApplicationError {\n  constructor(minLength: number) {\n    super('auth.errors.passwordTooShort', ERROR_CODES.AUTH.PASSWORD_TOO_SHORT, { minLength })\n  }\n}\n\nexport class PasswordTooLongError extends ApplicationError {\n  constructor(maxLength: number) {\n    super('auth.errors.passwordTooLong', ERROR_CODES.AUTH.PASSWORD_TOO_LONG, { maxLength })\n  }\n}\n\nexport class AccountAlreadyExistsError extends ApplicationError {\n  constructor(email?: string) {\n    super('auth.errors.accountAlreadyExists', ERROR_CODES.AUTH.ACCOUNT_ALREADY_EXISTS, email ? { email } : undefined)\n  }\n}\n\nexport class FailedToCreateUserError extends ApplicationError {\n  constructor(reason?: string) {\n    super('auth.errors.failedToCreateUser', ERROR_CODES.AUTH.FAILED_TO_CREATE_USER, reason ? { reason } : undefined)\n  }\n}\n\nexport class FailedToCreateSessionError extends ApplicationError {\n  constructor(reason?: string) {\n    super('auth.errors.failedToCreateSession', ERROR_CODES.AUTH.FAILED_TO_CREATE_SESSION, reason ? { reason } : undefined)\n  }\n}\n\nexport class FailedToUpdateUserError extends ApplicationError {\n  constructor(reason?: string) {\n    super('auth.errors.failedToUpdateUser', ERROR_CODES.AUTH.FAILED_TO_UPDATE_USER, reason ? { reason } : undefined)\n  }\n}\n\nexport class SocialAccountLinkedError extends ApplicationError {\n  constructor(provider?: string) {\n    super('auth.errors.socialAccountLinked', ERROR_CODES.AUTH.SOCIAL_ACCOUNT_LINKED, provider ? { provider } : undefined)\n  }\n}\n\nexport class CannotUnlinkLastAccountError extends ApplicationError {\n  constructor() {\n    super('auth.errors.cannotUnlinkLastAccount', ERROR_CODES.AUTH.CANNOT_UNLINK_LAST_ACCOUNT)\n  }\n}\n\nexport class ProviderNotFoundError extends ApplicationError {\n  constructor(provider?: string) {\n    super('auth.errors.providerNotFound', ERROR_CODES.RESOURCE.NOT_FOUND, provider ? { provider } : undefined)\n  }\n}\n\nexport class UserEmailNotFoundError extends ApplicationError {\n  constructor() {\n    super('auth.errors.userEmailNotFound', ERROR_CODES.RESOURCE.NOT_FOUND)\n  }\n}\n\nexport class AccountNotFoundError extends ApplicationError {\n  constructor() {\n    super('auth.errors.accountNotFound', ERROR_CODES.RESOURCE.NOT_FOUND)\n  }\n}\n\nexport class CredentialAccountNotFoundError extends ApplicationError {\n  constructor() {\n    super('auth.errors.credentialAccountNotFound', ERROR_CODES.RESOURCE.NOT_FOUND)\n  }\n}\n\nexport class UserAlreadyHasPasswordError extends ApplicationError {\n  constructor() {\n    super('auth.errors.userAlreadyHasPassword', ERROR_CODES.RESOURCE.CONFLICT)\n  }\n}\n\nexport class EmailCannotBeUpdatedError extends ApplicationError {\n  constructor(reason?: string) {\n    super('auth.errors.emailCannotBeUpdated', ERROR_CODES.VALIDATION.GENERIC, reason ? { reason } : undefined)\n  }\n}\n\nexport class FailedToGetSessionError extends ApplicationError {\n  constructor(reason?: string) {\n    super('auth.errors.failedToGetSession', ERROR_CODES.SYSTEM.INTERNAL_ERROR, reason ? { reason } : undefined)\n  }\n}\n\nexport class FailedToGetUserInfoError extends ApplicationError {\n  constructor(reason?: string) {\n    super('auth.errors.failedToGetUserInfo', ERROR_CODES.SYSTEM.INTERNAL_ERROR, reason ? { reason } : undefined)\n  }\n}\n\nexport class IdTokenNotSupportedError extends ApplicationError {\n  constructor() {\n    super('auth.errors.invalidToken', ERROR_CODES.VALIDATION.GENERIC)\n  }\n}\n\nexport class TokenExpiredError extends ApplicationError {\n  constructor() {\n    super('auth.errors.tokenExpired', ERROR_CODES.VALIDATION.GENERIC)\n  }\n}\n\nexport class InvalidCallbackUrlError extends ApplicationError {\n  constructor() {\n    super('auth.errors.invalidCallbackUrl', ERROR_CODES.VALIDATION.INVALID_FORMAT)\n  }\n}\n\nexport class InvalidOriginError extends ApplicationError {\n  constructor() {\n    super('auth.errors.invalidOrigin', ERROR_CODES.AUTHZ.FORBIDDEN)\n  }\n}\n\nexport class AuthValidationFailedError extends ApplicationError {\n  constructor() {\n    super('auth.errors.validationFailed', ERROR_CODES.VALIDATION.GENERIC)\n  }\n}\n\nexport class EmailAlreadyVerifiedError extends ApplicationError {\n  constructor() {\n    super('auth.errors.emailAlreadyVerified', ERROR_CODES.RESOURCE.CONFLICT)\n  }\n}\n\nexport class EmailMismatchError extends ApplicationError {\n  constructor() {\n    super('auth.errors.emailMismatch', ERROR_CODES.VALIDATION.INVALID_FORMAT)\n  }\n}\n\nexport class BetterAuthUnknownError extends ApplicationError {\n  constructor(errorCode?: string) {\n    super('auth.errors.unknownError', ERROR_CODES.SYSTEM.INTERNAL_ERROR, errorCode ? { errorCode } : undefined)\n  }\n}\n","import { ApplicationError, ERROR_CODES } from 'stratal/errors'\n\nexport class InvalidTokenError extends ApplicationError {\n  constructor() {\n    super('auth.errors.invalidToken', ERROR_CODES.AUTH.INVALID_TOKEN)\n  }\n}\n","import { ApplicationError, ERROR_CODES } from 'stratal/errors'\n\nexport class OrganizationNotFoundError extends ApplicationError {\n  constructor() {\n    super('auth.org.organizationNotFound', ERROR_CODES.AUTH.ORGANIZATION_NOT_FOUND)\n  }\n}\n\nexport class OrganizationMemberNotFoundError extends ApplicationError {\n  constructor() {\n    super('auth.org.memberNotFound', ERROR_CODES.AUTH.MEMBER_NOT_FOUND)\n  }\n}\n\nexport class OrganizationInvitationNotFoundError extends ApplicationError {\n  constructor() {\n    super('auth.org.invitationNotFound', ERROR_CODES.AUTH.INVITATION_NOT_FOUND)\n  }\n}\n\nexport class OrganizationPermissionDeniedError extends ApplicationError {\n  constructor() {\n    super('auth.org.permissionDenied', ERROR_CODES.AUTHZ.FORBIDDEN)\n  }\n}\n\nexport class OrganizationInvitationRecipientMismatchError extends ApplicationError {\n  constructor() {\n    super('auth.org.invitationRecipientMismatch', ERROR_CODES.AUTH.INVITATION_RECIPIENT_MISMATCH)\n  }\n}\n\nexport class OrganizationConflictError extends ApplicationError {\n  constructor() {\n    super('auth.org.conflict', ERROR_CODES.RESOURCE.CONFLICT)\n  }\n}\n\nexport class OrganizationLimitReachedError extends ApplicationError {\n  constructor() {\n    super('auth.org.limitReached', ERROR_CODES.AUTH.ORGANIZATION_LIMIT_REACHED)\n  }\n}\n\nexport class OrganizationMembershipError extends ApplicationError {\n  constructor() {\n    super('auth.org.membershipError', ERROR_CODES.AUTH.ORGANIZATION_MEMBERSHIP_REQUIRED)\n  }\n}\n\nexport class OrganizationTeamNotFoundError extends ApplicationError {\n  constructor() {\n    super('auth.org.teamNotFound', ERROR_CODES.RESOURCE.NOT_FOUND)\n  }\n}\n\nexport class OrganizationRoleNotFoundError extends ApplicationError {\n  constructor() {\n    super('auth.org.roleNotFound', ERROR_CODES.RESOURCE.NOT_FOUND)\n  }\n}\n","import { ApplicationError, ERROR_CODES } from 'stratal/errors'\n\nexport class TokenRequiredError extends ApplicationError {\n  constructor() {\n    super('auth.errors.tokenRequired', ERROR_CODES.VALIDATION.REQUIRED_FIELD, { field: 'token' })\n  }\n}\n","import { ApplicationError, ERROR_CODES } from 'stratal/errors'\n\nexport class VerificationFailedError extends ApplicationError {\n  constructor() {\n    super('auth.errors.verificationFailed', ERROR_CODES.AUTH.INVALID_CREDENTIALS)\n  }\n}\n","import { APIError } from 'better-auth/api'\nimport type { ApplicationError } from 'stratal/errors'\nimport {\n  AccountAlreadyExistsError,\n  AccountNotFoundError,\n  AuthValidationFailedError,\n  BetterAuthUnknownError,\n  CannotUnlinkLastAccountError,\n  CredentialAccountNotFoundError,\n  EmailAlreadyVerifiedError,\n  EmailCannotBeUpdatedError,\n  EmailMismatchError,\n  EmailNotVerifiedError,\n  FailedToCreateSessionError,\n  FailedToCreateUserError,\n  FailedToGetSessionError,\n  FailedToGetUserInfoError,\n  FailedToUpdateUserError,\n  IdTokenNotSupportedError,\n  InvalidCallbackUrlError,\n  InvalidCredentialsError,\n  InvalidEmailError,\n  InvalidOriginError,\n  InvalidPasswordError,\n  InvalidTokenError,\n  OrganizationConflictError,\n  OrganizationInvitationNotFoundError,\n  OrganizationInvitationRecipientMismatchError,\n  OrganizationLimitReachedError,\n  OrganizationMemberNotFoundError,\n  OrganizationMembershipError,\n  OrganizationNotFoundError,\n  OrganizationPermissionDeniedError,\n  OrganizationRoleNotFoundError,\n  OrganizationTeamNotFoundError,\n  PasswordTooLongError,\n  PasswordTooShortError,\n  ProviderNotFoundError,\n  SessionExpiredError,\n  SocialAccountLinkedError,\n  TokenExpiredError,\n  UserAlreadyHasPasswordError,\n  UserEmailNotFoundError,\n  UserNotFoundError,\n} from '../errors'\n\n/**\n * Maps Better Auth API error codes to ApplicationError instances.\n */\nexport function mapBetterAuthError(error: APIError): ApplicationError {\n  const errorCode = error.body?.code\n\n  if (error.status === 'FOUND') {\n    const headers = error.headers as Headers\n    const location = headers.get('location') ?? ''\n\n    if (location.includes('INVALID_TOKEN')) return new InvalidTokenError()\n    if (location.includes('EXPIRED_TOKEN')) return new TokenExpiredError()\n    if (location.includes('ATTEMPTS_EXCEEDED')) return new InvalidTokenError()\n    if (location.includes('new_user_signup_disabled')) return new UserNotFoundError()\n    if (location.includes('failed_to_create_user')) return new FailedToCreateUserError()\n    if (location.includes('failed_to_create_session')) return new FailedToCreateSessionError()\n  }\n\n  if (!errorCode) {\n    return new BetterAuthUnknownError()\n  }\n\n  // ── Base Error Codes ──────────────────────────────────────────────────\n\n  // User errors\n  if (errorCode === 'USER_NOT_FOUND' || errorCode === 'INVALID_USER') return new UserNotFoundError()\n  if (errorCode === 'USER_EMAIL_NOT_FOUND') return new UserEmailNotFoundError()\n\n  // Credential errors\n  if (errorCode === 'INVALID_EMAIL_OR_PASSWORD') return new InvalidCredentialsError()\n  if (errorCode === 'INVALID_PASSWORD') return new InvalidPasswordError()\n  if (errorCode === 'INVALID_EMAIL') return new InvalidEmailError()\n\n  // Session errors\n  if (errorCode === 'SESSION_EXPIRED' || errorCode === 'SESSION_NOT_FRESH') return new SessionExpiredError()\n  if (errorCode === 'FAILED_TO_CREATE_SESSION') return new FailedToCreateSessionError()\n  if (errorCode === 'FAILED_TO_GET_SESSION') return new FailedToGetSessionError()\n\n  // Email verification\n  if (errorCode === 'EMAIL_NOT_VERIFIED') return new EmailNotVerifiedError()\n  if (errorCode === 'EMAIL_CAN_NOT_BE_UPDATED') return new EmailCannotBeUpdatedError()\n  if (errorCode === 'EMAIL_ALREADY_VERIFIED') return new EmailAlreadyVerifiedError()\n  if (errorCode === 'EMAIL_MISMATCH') return new EmailMismatchError()\n\n  // Password validation\n  if (errorCode === 'PASSWORD_TOO_SHORT') return new PasswordTooShortError(8)\n  if (errorCode === 'PASSWORD_TOO_LONG') return new PasswordTooLongError(128)\n\n  // Account errors\n  if (errorCode === 'USER_ALREADY_EXISTS' || errorCode === 'USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL') {\n    return new AccountAlreadyExistsError()\n  }\n  if (errorCode === 'ACCOUNT_NOT_FOUND') return new AccountNotFoundError()\n  if (errorCode === 'CREDENTIAL_ACCOUNT_NOT_FOUND') return new CredentialAccountNotFoundError()\n  if (errorCode === 'FAILED_TO_UNLINK_LAST_ACCOUNT') return new CannotUnlinkLastAccountError()\n\n  // User creation/update errors\n  if (errorCode === 'FAILED_TO_CREATE_USER') return new FailedToCreateUserError()\n  if (errorCode === 'FAILED_TO_UPDATE_USER') return new FailedToUpdateUserError()\n  if (errorCode === 'FAILED_TO_GET_USER_INFO') return new FailedToGetUserInfoError()\n\n  // Social account errors\n  if (errorCode === 'SOCIAL_ACCOUNT_ALREADY_LINKED' || errorCode === 'LINKED_ACCOUNT_ALREADY_EXISTS') {\n    return new SocialAccountLinkedError()\n  }\n  if (errorCode === 'PROVIDER_NOT_FOUND') return new ProviderNotFoundError()\n\n  // Token errors\n  if (errorCode === 'ID_TOKEN_NOT_SUPPORTED') return new IdTokenNotSupportedError()\n  if (errorCode === 'INVALID_TOKEN') return new InvalidTokenError()\n  if (errorCode === 'TOKEN_EXPIRED') return new TokenExpiredError()\n\n  // Password management\n  if (errorCode === 'USER_ALREADY_HAS_PASSWORD' || errorCode === 'PASSWORD_ALREADY_SET') {\n    return new UserAlreadyHasPasswordError()\n  }\n\n  // Callback/redirect URL errors\n  if (\n    errorCode === 'INVALID_CALLBACK_URL'\n    || errorCode === 'INVALID_REDIRECT_URL'\n    || errorCode === 'INVALID_NEW_USER_CALLBACK_URL'\n    || errorCode === 'INVALID_ERROR_CALLBACK_URL'\n    || errorCode === 'CALLBACK_URL_REQUIRED'\n  ) {\n    return new InvalidCallbackUrlError()\n  }\n\n  // Origin/CORS errors\n  if (\n    errorCode === 'INVALID_ORIGIN'\n    || errorCode === 'MISSING_OR_NULL_ORIGIN'\n    || errorCode === 'CROSS_SITE_NAVIGATION_LOGIN_BLOCKED'\n  ) {\n    return new InvalidOriginError()\n  }\n\n  // Validation errors\n  if (\n    errorCode === 'VALIDATION_ERROR'\n    || errorCode === 'MISSING_FIELD'\n    || errorCode === 'FIELD_NOT_ALLOWED'\n    || errorCode === 'BODY_MUST_BE_AN_OBJECT'\n    || errorCode === 'ASYNC_VALIDATION_NOT_SUPPORTED'\n    || errorCode === 'METHOD_NOT_ALLOWED_DEFER_SESSION_REQUIRED'\n  ) {\n    return new AuthValidationFailedError()\n  }\n\n  // Verification errors\n  if (errorCode === 'FAILED_TO_CREATE_VERIFICATION' || errorCode === 'VERIFICATION_EMAIL_NOT_ENABLED') {\n    return new FailedToCreateSessionError()\n  }\n\n  // ── Organization Plugin Error Codes ───────────────────────────────────\n\n  // Organization not found\n  if (errorCode === 'ORGANIZATION_NOT_FOUND' || errorCode === 'NO_ACTIVE_ORGANIZATION') {\n    return new OrganizationNotFoundError()\n  }\n\n  // Member not found\n  if (\n    errorCode === 'MEMBER_NOT_FOUND'\n    || errorCode === 'USER_IS_NOT_A_MEMBER_OF_THE_ORGANIZATION'\n    || errorCode === 'USER_IS_NOT_A_MEMBER_OF_THE_TEAM'\n  ) {\n    return new OrganizationMemberNotFoundError()\n  }\n\n  // Invitation not found\n  if (errorCode === 'INVITATION_NOT_FOUND' || errorCode === 'FAILED_TO_RETRIEVE_INVITATION') {\n    return new OrganizationInvitationNotFoundError()\n  }\n\n  // Invitation recipient mismatch\n  if (\n    errorCode === 'YOU_ARE_NOT_THE_RECIPIENT_OF_THE_INVITATION'\n    || errorCode === 'EMAIL_VERIFICATION_REQUIRED_BEFORE_ACCEPTING_OR_REJECTING_INVITATION'\n  ) {\n    return new OrganizationInvitationRecipientMismatchError()\n  }\n\n  // Team not found\n  if (errorCode === 'TEAM_NOT_FOUND' || errorCode === 'YOU_DO_NOT_HAVE_AN_ACTIVE_TEAM') {\n    return new OrganizationTeamNotFoundError()\n  }\n\n  // Role not found\n  if (errorCode === 'ROLE_NOT_FOUND' || errorCode === 'INVALID_RESOURCE') {\n    return new OrganizationRoleNotFoundError()\n  }\n\n  // Organization conflict/already exists\n  if (\n    errorCode === 'ORGANIZATION_ALREADY_EXISTS'\n    || errorCode === 'ORGANIZATION_SLUG_ALREADY_TAKEN'\n    || errorCode === 'USER_IS_ALREADY_A_MEMBER_OF_THIS_ORGANIZATION'\n    || errorCode === 'USER_IS_ALREADY_INVITED_TO_THIS_ORGANIZATION'\n    || errorCode === 'TEAM_ALREADY_EXISTS'\n    || errorCode === 'ROLE_NAME_IS_ALREADY_TAKEN'\n  ) {\n    return new OrganizationConflictError()\n  }\n\n  // Organization limit reached\n  if (\n    errorCode === 'YOU_HAVE_REACHED_THE_MAXIMUM_NUMBER_OF_ORGANIZATIONS'\n    || errorCode === 'YOU_HAVE_REACHED_THE_MAXIMUM_NUMBER_OF_TEAMS'\n    || errorCode === 'ORGANIZATION_MEMBERSHIP_LIMIT_REACHED'\n    || errorCode === 'INVITATION_LIMIT_REACHED'\n    || errorCode === 'TEAM_MEMBER_LIMIT_REACHED'\n    || errorCode === 'TOO_MANY_ROLES'\n  ) {\n    return new OrganizationLimitReachedError()\n  }\n\n  // Organization membership constraints\n  if (\n    errorCode === 'YOU_CANNOT_LEAVE_THE_ORGANIZATION_AS_THE_ONLY_OWNER'\n    || errorCode === 'YOU_CANNOT_LEAVE_THE_ORGANIZATION_WITHOUT_AN_OWNER'\n    || errorCode === 'UNABLE_TO_REMOVE_LAST_TEAM'\n    || errorCode === 'CANNOT_DELETE_A_PRE_DEFINED_ROLE'\n    || errorCode === 'ROLE_IS_ASSIGNED_TO_MEMBERS'\n    || errorCode === 'YOU_CANNOT_IMPERSONATE_ADMINS'\n    || errorCode === 'YOU_CANNOT_BAN_YOURSELF'\n    || errorCode === 'YOU_CANNOT_REMOVE_YOURSELF'\n    || errorCode === 'INVITER_IS_NO_LONGER_A_MEMBER_OF_THE_ORGANIZATION'\n  ) {\n    return new OrganizationMembershipError()\n  }\n\n  // Organization permission denied (catch-all for YOU_ARE_NOT_ALLOWED_TO_* patterns)\n  if (\n    errorCode.startsWith('YOU_ARE_NOT_ALLOWED_TO_')\n    || errorCode === 'YOU_ARE_NOT_A_MEMBER_OF_THIS_ORGANIZATION'\n    || errorCode === 'YOU_CAN_NOT_ACCESS_THE_MEMBERS_OF_THIS_TEAM'\n    || errorCode === 'YOU_MUST_BE_IN_AN_ORGANIZATION_TO_CREATE_A_ROLE'\n    || errorCode === 'MISSING_AC_INSTANCE'\n  ) {\n    return new OrganizationPermissionDeniedError()\n  }\n\n  // Unknown error code\n  return new BetterAuthUnknownError(errorCode)\n}\n\n/**\n * Type guard to check if an error is a Better Auth APIError.\n * Uses duck typing to handle bundler environments (e.g. Vite)\n * where instanceof may fail across module boundaries.\n */\nexport function isAPIError(error: unknown): error is APIError {\n  if (error instanceof APIError) return true\n\n  return (\n    error instanceof Error\n    && error.name === 'APIError'\n    && 'status' in error\n    && 'statusCode' in error\n  )\n}\n","import type { BetterAuthOptions } from 'better-auth'\nimport { isAPIError, mapBetterAuthError } from './better-auth-error-handler'\n\n/**\n * Get shared Better Auth error handler configuration.\n * Use this in Better Auth config's onAPIError option.\n */\nexport function getErrorHandlerConfig(): BetterAuthOptions['onAPIError'] {\n  return {\n    throw: false,\n    onError: (error) => {\n      if (isAPIError(error)) {\n        throw mapBetterAuthError(error)\n      }\n      throw error\n    },\n  }\n}\n\n/**\n * Wrap a Better Auth function in a try/catch block and map errors to ApplicationError.\n */\nexport const wrapBetterAuth = async <T>(fn: () => Promise<T>): Promise<T> => {\n  try {\n    return await fn()\n  } catch (error) {\n    if (isAPIError(error)) {\n      throw mapBetterAuthError(error)\n    }\n    throw error\n  }\n}\n","import type { Auth, BetterAuthOptions } from 'better-auth'\nimport { betterAuth } from 'better-auth'\nimport { inject } from 'tsyringe'\nimport { Transient } from 'stratal/di'\nimport { AUTH_OPTIONS, AUTH_SERVICE } from '../auth.tokens'\nimport { getErrorHandlerConfig } from '../utils'\n\n/**\n * AuthService\n *\n * Base authentication service using Better Auth.\n * Configured via AuthModule.forRootAsync() from the application layer.\n *\n * **Extensibility:**\n * Extend this class in application layer to add custom methods.\n *\n * @example\n * ```typescript\n * @Transient(AUTH_SERVICE)\n * export class AppAuthService extends AuthService<AuthOptions> {\n *   async signInMagicLink(email: string) {\n *     return wrapBetterAuth(async () => {\n *       return this.auth.api.signInMagicLink({ body: { email }, headers: new Headers() })\n *     })\n *   }\n * }\n * ```\n */\n@Transient(AUTH_SERVICE)\nexport class AuthService<TOptions extends BetterAuthOptions = BetterAuthOptions> {\n  private authInstance: Auth<TOptions>\n\n  constructor(\n    @inject(AUTH_OPTIONS) protected readonly options: TOptions\n  ) {\n    this.authInstance = betterAuth({\n      ...this.options,\n      onAPIError: getErrorHandlerConfig()\n    }) as Auth<TOptions>\n  }\n\n  /**\n   * Get the Better Auth instance\n   */\n  get auth(): Auth<TOptions> {\n    return this.authInstance\n  }\n}\n","/**\n * Auth Module\n *\n * Provides configurable authentication using Better Auth.\n * Use `forRootAsync` to configure Better Auth options from the application layer.\n *\n * Optionally pass `accessControl` to enable permission-based authorization.\n * This auto-adds the Stratal AC plugin to Better Auth and registers `AccessService`.\n *\n * @example Without access control\n * ```typescript\n * @Module({\n *   imports: [\n *     AuthModule.forRootAsync({\n *       inject: [DI_TOKENS.Database, CONFIG_TOKENS.ConfigService],\n *       useFactory: (db, config) => createAuthOptions(db, config)\n *     })\n *   ]\n * })\n * export class AppModule {}\n * ```\n *\n * @example With access control\n * ```typescript\n * import { createAccessControl } from '@stratal/framework/access-control'\n * import { admin } from 'better-auth/plugins'\n *\n * const permissions = createAccessControl({\n *   resources: { posts: ['create', 'read', 'update', 'delete'] } as const,\n *   roles: { admin: { posts: ['create', 'read', 'update', 'delete'] }, user: { posts: ['read'] } },\n * })\n *\n * @Module({\n *   imports: [\n *     AuthModule.forRootAsync({\n *       inject: [DI_TOKENS.Database],\n *       useFactory: (db) => ({\n *         database: ...,\n *         plugins: [admin({ ...permissions })],\n *       }),\n *       accessControl: permissions,\n *     })\n *   ]\n * })\n * ```\n */\n\nimport type { BetterAuthOptions } from 'better-auth'\nimport { CONTAINER_TOKEN, type Container } from 'stratal/di'\nimport { I18nModule } from 'stratal/i18n'\nimport type { AsyncModuleOptions, DynamicModule } from 'stratal/module'\nimport { Module } from 'stratal/module'\nimport type { IRateLimiterStore, RateLimiterRegistry } from 'stratal/rate-limiter'\nimport { RATE_LIMITER_TOKENS } from 'stratal/rate-limiter'\nimport type { RouteConfigurable, Router } from 'stratal/router'\nimport { createStratalAcPlugin } from '../access-control/plugin'\nimport { AccessService } from '../access-control/services/access.service'\nimport { AC_TOKENS } from '../access-control/tokens'\nimport type { AccessControlOptions } from '../access-control/types'\nimport { AUTH_OPTIONS, AUTH_SERVICE } from './auth.tokens'\nimport { authMessages } from './i18n'\nimport { AuthContextMiddleware } from './middleware/auth-context.middleware'\nimport { SessionVerificationMiddleware } from './middleware/session-verification.middleware'\n// Side-effect import: registers `forPath`/`pathEntries` macros on\n// `RateLimiterRegistry` and the `declare module` augmentation that exposes\n// them at the type level. Must run before any consumer calls `forPath()`.\nimport {\n  createBetterAuthRateLimitStorage,\n  projectCustomRules,\n} from './rate-limit-bridge'\nimport { AuthService } from './services/auth.service'\n\nexport interface AuthModuleAsyncOptions<TOptions extends BetterAuthOptions = BetterAuthOptions>\n  extends AsyncModuleOptions<TOptions> {\n  /**\n   * Optional access control configuration.\n   * When provided, registers AccessService and auto-adds the Stratal AC plugin to Better Auth.\n   */\n  accessControl?: AccessControlOptions\n}\n\n@Module({\n  imports: [\n    I18nModule.registerMessages(authMessages),\n  ],\n  providers: []\n})\nexport class AuthModule implements RouteConfigurable {\n  /**\n   * Configure auth middleware globally.\n   *\n   * Registers middlewares in order:\n   * 1. AuthContextMiddleware - Creates and registers AuthContext in request container\n   * 2. SessionVerificationMiddleware - Verifies session and populates AuthContext with userId + role\n   */\n  configureRoutes(router: Router): void {\n    router.use(AuthContextMiddleware, SessionVerificationMiddleware)\n  }\n\n  /**\n   * Configure AuthModule with async options factory.\n   * Optionally provide `accessControl` to enable permission-based authorization.\n   *\n   * When `RateLimiterModule` is also imported, better-auth's `rateLimit`\n   * block is auto-wired: `customStorage` shares Stratal's backing store, and\n   * any `RateLimiterRegistry.forPath(...)` entries are projected into\n   * `customRules`. User-supplied `rateLimit.{customStorage, customRules}` keys\n   * take precedence on a per-key basis.\n   */\n  static forRootAsync<TOptions extends BetterAuthOptions>(\n    options: AuthModuleAsyncOptions<TOptions>\n  ): DynamicModule {\n    const { accessControl } = options\n    const userInject = options.inject ?? []\n    const userFactory = options.useFactory as (...args: unknown[]) => TOptions\n\n    const authOptionsProvider = {\n      provide: AUTH_OPTIONS,\n      useFactory: (container: Container, ...userDeps: unknown[]): BetterAuthOptions => {\n        let raw = userFactory(...userDeps) as BetterAuthOptions\n\n        if (accessControl) {\n          raw = {\n            ...raw,\n            plugins: [createStratalAcPlugin(accessControl), ...(raw.plugins ?? [])],\n          }\n        }\n\n        const tsyringe = container.getTsyringeContainer()\n        const rateLimiterPresent = tsyringe.isRegistered(\n          RATE_LIMITER_TOKENS.ModuleMarker,\n          true,\n        )\n\n        if (rateLimiterPresent) {\n          const store = container.resolve<IRateLimiterStore>(RATE_LIMITER_TOKENS.Store)\n          const registry = container.resolve<RateLimiterRegistry>(RATE_LIMITER_TOKENS.Registry)\n\n          raw = {\n            ...raw,\n            rateLimit: {\n              enabled: true,\n              ...raw.rateLimit,\n              customStorage: raw.rateLimit?.customStorage ?? createBetterAuthRateLimitStorage(store),\n              customRules: {\n                ...projectCustomRules(registry),\n                ...(raw.rateLimit?.customRules ?? {}),\n              },\n            },\n          }\n        }\n\n        return raw\n      },\n      inject: [CONTAINER_TOKEN, ...userInject],\n    }\n\n    return {\n      module: AuthModule,\n      providers: [\n        authOptionsProvider,\n        {\n          provide: AUTH_SERVICE,\n          useClass: AuthService,\n        },\n        ...(accessControl\n          ? [\n            { provide: AC_TOKENS.Options, useValue: accessControl as unknown as object },\n            { provide: AC_TOKENS.AccessService, useClass: AccessService },\n          ]\n          : []),\n      ],\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;AACA,MAAa,eAAe,OAAO,IAAI,uBAAuB;;AAG9D,MAAa,eAAe,OAAO,IAAI,uBAAuB;;;ACJ9D,MAAa,eAAe,EAC1B,IAAI,EACF,MAAM;CACJ,QAAQ;EACN,eAAe;EACf,cAAc;EACd,oBAAoB;EACpB,cAAc;EACd,oBAAoB;EACpB,iBAAiB;EACjB,cAAc;EACd,gBAAgB;EAChB,kBAAkB;EAClB,kBAAkB;EAClB,iBAAiB;EACjB,sBAAsB;EACtB,oBAAoB;EACpB,uBAAuB;EACvB,oBAAoB;EACpB,oBAAoB;EACpB,qBAAqB;EACrB,qBAAqB;EACrB,kBAAkB;EAClB,mBAAmB;EACnB,iBAAiB;EACjB,2BAA2B;EAC3B,yBAAyB;EACzB,wBAAwB;EACxB,sBAAsB;EACtB,cAAc;EACd,oBAAoB;EACpB,eAAe;EACf,kBAAkB;EAClB,sBAAsB;EACtB,eAAe;EACf,cAAc;EACf;CACD,KAAK;EACH,sBAAsB;EACtB,gBAAgB;EAChB,oBAAoB;EACpB,kBAAkB;EAClB,6BAA6B;EAC7B,UAAU;EACV,cAAc;EACd,iBAAiB;EACjB,cAAc;EACd,cAAc;EACf;CACF,EACF,EACF;;;ACvCM,IAAA,wBAAA,MAAM,sBAA4C;CACvD,MAAM,OAAO,KAAoB,MAA2B;EAC1D,MAAM,mBAAmB,IAAI,cAAc;EAE3C,MAAM,cAAc,IAAI,aAAa;EACrC,iBAAiB,cAAc,UAAU,aAAa,YAAY;EAElE,OAAO,MAAM;;;oCARhB,WAAW,CAAA,EAAA,sBAAA;;;ACSL,IAAA,gCAAA,MAAM,8BAAoD;CAG5C;CAC4B;CAH/C,YACE,aAEA,QACA;EAFiB,KAAA,cAAA;EAC4B,KAAA,SAAA;;CAG/C,MAAM,OAAO,KAAoB,MAA2B;EAC1D,IAAI;GACF,MAAM,SAAS,MAAM,KAAK,YAAY,KAAK,IAAI,WAAW,EACxD,SAAS,IAAI,EAAE,IAAI,IAAI,SACxB,CAAC;GAEF,IAAI,QAEF,IADwB,cAAc,CAAC,QAAqB,UAAU,YAC3D,CAAC,eAAe,EACzB,MAAM,OAAO,MACd,CAAC;WAEG,OAAgB;GACvB,KAAK,OAAO,MAAM,uDAAuD,EAAE,OAAO,CAAC;;EAGrF,OAAO,MAAM;;;;CAxBhB,WAAW;oBAGPA,SAAO,aAAa,CAAA;oBAEpBA,SAAO,cAAc,cAAc,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AC8BxC,MAAM,gCAAgB,IAAI,SAA8D;AAExF,SAAS,mBAAmB,UAA+D;CACzF,IAAI,MAAM,cAAc,IAAI,SAAS;CACrC,IAAI,CAAC,KAAK;EACR,sBAAM,IAAI,KAAK;EACf,cAAc,IAAI,UAAU,IAAI;;CAElC,OAAO;;AAGT,oBAAoB,MAAM,WAAW,SAEnC,MACA,UACM;CACN,mBAAmB,KAAK,CAAC,IAAI,MAAM,SAAS;EAC5C;AAEF,oBAAoB,MAAM,eAAe,WAEQ;CAC/C,QAAQ,cAAc,IAAI,KAAK,oBAAI,IAAI,KAAgC,EAAE,SAAS;EAClF;AA2BF,MAAM,0BAA0B;AAChC,MAAM,yBAAyB;;;;;;AAO/B,SAAgB,iCAAiC,OAG/C;CACA,OAAO;EACL,MAAM,IAAI,KAAK;GACb,OAAO,MAAM,MAAM,IAAyB,GAAG,yBAAyB,MAAM;;EAEhF,MAAM,IAAI,KAAK,OAAO,SAAS;GAC7B,MAAM,MAAM,IAAI,GAAG,yBAAyB,OAAO,OAAO,wBAAwB;;EAErF;;;;;;;;;;;AAYH,SAAgB,mBACd,UACsC;CACtC,MAAM,QAA8C,EAAE;CAEtD,KAAK,MAAM,CAAC,MAAM,aAAa,SAAS,aAAa,EACnD,MAAM,QAAQ,OAAO,QAA2D;EAC9E,MAAM,WAAW,MAAM,SAAS,IAAI;EACpC,MAAM,cAAc,MAAM,QAAQ,SAAS,GAAG,WAAW,CAAC,SAAS,EAAE,QAAQ,MAAM,CAAC,EAAE,SAAS;EAC/F,IAAI,WAAW,WAAW,GAAG,OAAO;EAEpC,MAAM,SAAS,WAAW,QAAQ,GAAG,MACnC,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,gBAAgB,IAAI,EAC1D;EAED,OAAO;GAAE,QAAQ,OAAO;GAAe,KAAK,OAAO;GAAK;;CAI5D,OAAO;;;;ACxJT,IAAa,oBAAb,cAAuC,iBAAiB;CACtD,YAAY,OAAgB;EAC1B,MAAM,4BAA4B,YAAY,SAAS,WAAW,QAAQ,EAAE,OAAO,GAAG,KAAA,EAAU;;;AAIpG,IAAa,0BAAb,cAA6C,iBAAiB;CAC5D,cAAc;EACZ,MAAM,kCAAkC,YAAY,KAAK,oBAAoB;;;AAIjF,IAAa,uBAAb,cAA0C,iBAAiB;CACzD,cAAc;EACZ,MAAM,+BAA+B,YAAY,KAAK,oBAAoB;;;AAI9E,IAAa,oBAAb,cAAuC,iBAAiB;CACtD,YAAY,OAAgB;EAC1B,MAAM,4BAA4B,YAAY,WAAW,gBAAgB,QAAQ,EAAE,OAAO,GAAG,KAAA,EAAU;;;AAI3G,IAAa,sBAAb,cAAyC,iBAAiB;CACxD,cAAc;EACZ,MAAM,8BAA8B,YAAY,KAAK,gBAAgB;;;AAIzE,IAAa,wBAAb,cAA2C,iBAAiB;CAC1D,YAAY,OAAgB;EAC1B,MAAM,gCAAgC,YAAY,KAAK,oBAAoB,QAAQ,EAAE,OAAO,GAAG,KAAA,EAAU;;;AAI7G,IAAa,wBAAb,cAA2C,iBAAiB;CAC1D,YAAY,WAAmB;EAC7B,MAAM,gCAAgC,YAAY,KAAK,oBAAoB,EAAE,WAAW,CAAC;;;AAI7F,IAAa,uBAAb,cAA0C,iBAAiB;CACzD,YAAY,WAAmB;EAC7B,MAAM,+BAA+B,YAAY,KAAK,mBAAmB,EAAE,WAAW,CAAC;;;AAI3F,IAAa,4BAAb,cAA+C,iBAAiB;CAC9D,YAAY,OAAgB;EAC1B,MAAM,oCAAoC,YAAY,KAAK,wBAAwB,QAAQ,EAAE,OAAO,GAAG,KAAA,EAAU;;;AAIrH,IAAa,0BAAb,cAA6C,iBAAiB;CAC5D,YAAY,QAAiB;EAC3B,MAAM,kCAAkC,YAAY,KAAK,uBAAuB,SAAS,EAAE,QAAQ,GAAG,KAAA,EAAU;;;AAIpH,IAAa,6BAAb,cAAgD,iBAAiB;CAC/D,YAAY,QAAiB;EAC3B,MAAM,qCAAqC,YAAY,KAAK,0BAA0B,SAAS,EAAE,QAAQ,GAAG,KAAA,EAAU;;;AAI1H,IAAa,0BAAb,cAA6C,iBAAiB;CAC5D,YAAY,QAAiB;EAC3B,MAAM,kCAAkC,YAAY,KAAK,uBAAuB,SAAS,EAAE,QAAQ,GAAG,KAAA,EAAU;;;AAIpH,IAAa,2BAAb,cAA8C,iBAAiB;CAC7D,YAAY,UAAmB;EAC7B,MAAM,mCAAmC,YAAY,KAAK,uBAAuB,WAAW,EAAE,UAAU,GAAG,KAAA,EAAU;;;AAIzH,IAAa,+BAAb,cAAkD,iBAAiB;CACjE,cAAc;EACZ,MAAM,uCAAuC,YAAY,KAAK,2BAA2B;;;AAI7F,IAAa,wBAAb,cAA2C,iBAAiB;CAC1D,YAAY,UAAmB;EAC7B,MAAM,gCAAgC,YAAY,SAAS,WAAW,WAAW,EAAE,UAAU,GAAG,KAAA,EAAU;;;AAI9G,IAAa,yBAAb,cAA4C,iBAAiB;CAC3D,cAAc;EACZ,MAAM,iCAAiC,YAAY,SAAS,UAAU;;;AAI1E,IAAa,uBAAb,cAA0C,iBAAiB;CACzD,cAAc;EACZ,MAAM,+BAA+B,YAAY,SAAS,UAAU;;;AAIxE,IAAa,iCAAb,cAAoD,iBAAiB;CACnE,cAAc;EACZ,MAAM,yCAAyC,YAAY,SAAS,UAAU;;;AAIlF,IAAa,8BAAb,cAAiD,iBAAiB;CAChE,cAAc;EACZ,MAAM,sCAAsC,YAAY,SAAS,SAAS;;;AAI9E,IAAa,4BAAb,cAA+C,iBAAiB;CAC9D,YAAY,QAAiB;EAC3B,MAAM,oCAAoC,YAAY,WAAW,SAAS,SAAS,EAAE,QAAQ,GAAG,KAAA,EAAU;;;AAI9G,IAAa,0BAAb,cAA6C,iBAAiB;CAC5D,YAAY,QAAiB;EAC3B,MAAM,kCAAkC,YAAY,OAAO,gBAAgB,SAAS,EAAE,QAAQ,GAAG,KAAA,EAAU;;;AAI/G,IAAa,2BAAb,cAA8C,iBAAiB;CAC7D,YAAY,QAAiB;EAC3B,MAAM,mCAAmC,YAAY,OAAO,gBAAgB,SAAS,EAAE,QAAQ,GAAG,KAAA,EAAU;;;AAIhH,IAAa,2BAAb,cAA8C,iBAAiB;CAC7D,cAAc;EACZ,MAAM,4BAA4B,YAAY,WAAW,QAAQ;;;AAIrE,IAAa,oBAAb,cAAuC,iBAAiB;CACtD,cAAc;EACZ,MAAM,4BAA4B,YAAY,WAAW,QAAQ;;;AAIrE,IAAa,0BAAb,cAA6C,iBAAiB;CAC5D,cAAc;EACZ,MAAM,kCAAkC,YAAY,WAAW,eAAe;;;AAIlF,IAAa,qBAAb,cAAwC,iBAAiB;CACvD,cAAc;EACZ,MAAM,6BAA6B,YAAY,MAAM,UAAU;;;AAInE,IAAa,4BAAb,cAA+C,iBAAiB;CAC9D,cAAc;EACZ,MAAM,gCAAgC,YAAY,WAAW,QAAQ;;;AAIzE,IAAa,4BAAb,cAA+C,iBAAiB;CAC9D,cAAc;EACZ,MAAM,oCAAoC,YAAY,SAAS,SAAS;;;AAI5E,IAAa,qBAAb,cAAwC,iBAAiB;CACvD,cAAc;EACZ,MAAM,6BAA6B,YAAY,WAAW,eAAe;;;AAI7E,IAAa,yBAAb,cAA4C,iBAAiB;CAC3D,YAAY,WAAoB;EAC9B,MAAM,4BAA4B,YAAY,OAAO,gBAAgB,YAAY,EAAE,WAAW,GAAG,KAAA,EAAU;;;;;AChL/G,IAAa,oBAAb,cAAuC,iBAAiB;CACtD,cAAc;EACZ,MAAM,4BAA4B,YAAY,KAAK,cAAc;;;;;ACFrE,IAAa,4BAAb,cAA+C,iBAAiB;CAC9D,cAAc;EACZ,MAAM,iCAAiC,YAAY,KAAK,uBAAuB;;;AAInF,IAAa,kCAAb,cAAqD,iBAAiB;CACpE,cAAc;EACZ,MAAM,2BAA2B,YAAY,KAAK,iBAAiB;;;AAIvE,IAAa,sCAAb,cAAyD,iBAAiB;CACxE,cAAc;EACZ,MAAM,+BAA+B,YAAY,KAAK,qBAAqB;;;AAI/E,IAAa,oCAAb,cAAuD,iBAAiB;CACtE,cAAc;EACZ,MAAM,6BAA6B,YAAY,MAAM,UAAU;;;AAInE,IAAa,+CAAb,cAAkE,iBAAiB;CACjF,cAAc;EACZ,MAAM,wCAAwC,YAAY,KAAK,8BAA8B;;;AAIjG,IAAa,4BAAb,cAA+C,iBAAiB;CAC9D,cAAc;EACZ,MAAM,qBAAqB,YAAY,SAAS,SAAS;;;AAI7D,IAAa,gCAAb,cAAmD,iBAAiB;CAClE,cAAc;EACZ,MAAM,yBAAyB,YAAY,KAAK,2BAA2B;;;AAI/E,IAAa,8BAAb,cAAiD,iBAAiB;CAChE,cAAc;EACZ,MAAM,4BAA4B,YAAY,KAAK,iCAAiC;;;AAIxF,IAAa,gCAAb,cAAmD,iBAAiB;CAClE,cAAc;EACZ,MAAM,yBAAyB,YAAY,SAAS,UAAU;;;AAIlE,IAAa,gCAAb,cAAmD,iBAAiB;CAClE,cAAc;EACZ,MAAM,yBAAyB,YAAY,SAAS,UAAU;;;;;ACxDlE,IAAa,qBAAb,cAAwC,iBAAiB;CACvD,cAAc;EACZ,MAAM,6BAA6B,YAAY,WAAW,gBAAgB,EAAE,OAAO,SAAS,CAAC;;;;;ACFjG,IAAa,0BAAb,cAA6C,iBAAiB;CAC5D,cAAc;EACZ,MAAM,kCAAkC,YAAY,KAAK,oBAAoB;;;;;;;;AC6CjF,SAAgB,mBAAmB,OAAmC;CACpE,MAAM,YAAY,MAAM,MAAM;CAE9B,IAAI,MAAM,WAAW,SAAS;EAE5B,MAAM,WADU,MAAM,QACG,IAAI,WAAW,IAAI;EAE5C,IAAI,SAAS,SAAS,gBAAgB,EAAE,OAAO,IAAI,mBAAmB;EACtE,IAAI,SAAS,SAAS,gBAAgB,EAAE,OAAO,IAAI,mBAAmB;EACtE,IAAI,SAAS,SAAS,oBAAoB,EAAE,OAAO,IAAI,mBAAmB;EAC1E,IAAI,SAAS,SAAS,2BAA2B,EAAE,OAAO,IAAI,mBAAmB;EACjF,IAAI,SAAS,SAAS,wBAAwB,EAAE,OAAO,IAAI,yBAAyB;EACpF,IAAI,SAAS,SAAS,2BAA2B,EAAE,OAAO,IAAI,4BAA4B;;CAG5F,IAAI,CAAC,WACH,OAAO,IAAI,wBAAwB;CAMrC,IAAI,cAAc,oBAAoB,cAAc,gBAAgB,OAAO,IAAI,mBAAmB;CAClG,IAAI,cAAc,wBAAwB,OAAO,IAAI,wBAAwB;CAG7E,IAAI,cAAc,6BAA6B,OAAO,IAAI,yBAAyB;CACnF,IAAI,cAAc,oBAAoB,OAAO,IAAI,sBAAsB;CACvE,IAAI,cAAc,iBAAiB,OAAO,IAAI,mBAAmB;CAGjE,IAAI,cAAc,qBAAqB,cAAc,qBAAqB,OAAO,IAAI,qBAAqB;CAC1G,IAAI,cAAc,4BAA4B,OAAO,IAAI,4BAA4B;CACrF,IAAI,cAAc,yBAAyB,OAAO,IAAI,yBAAyB;CAG/E,IAAI,cAAc,sBAAsB,OAAO,IAAI,uBAAuB;CAC1E,IAAI,cAAc,4BAA4B,OAAO,IAAI,2BAA2B;CACpF,IAAI,cAAc,0BAA0B,OAAO,IAAI,2BAA2B;CAClF,IAAI,cAAc,kBAAkB,OAAO,IAAI,oBAAoB;CAGnE,IAAI,cAAc,sBAAsB,OAAO,IAAI,sBAAsB,EAAE;CAC3E,IAAI,cAAc,qBAAqB,OAAO,IAAI,qBAAqB,IAAI;CAG3E,IAAI,cAAc,yBAAyB,cAAc,yCACvD,OAAO,IAAI,2BAA2B;CAExC,IAAI,cAAc,qBAAqB,OAAO,IAAI,sBAAsB;CACxE,IAAI,cAAc,gCAAgC,OAAO,IAAI,gCAAgC;CAC7F,IAAI,cAAc,iCAAiC,OAAO,IAAI,8BAA8B;CAG5F,IAAI,cAAc,yBAAyB,OAAO,IAAI,yBAAyB;CAC/E,IAAI,cAAc,yBAAyB,OAAO,IAAI,yBAAyB;CAC/E,IAAI,cAAc,2BAA2B,OAAO,IAAI,0BAA0B;CAGlF,IAAI,cAAc,mCAAmC,cAAc,iCACjE,OAAO,IAAI,0BAA0B;CAEvC,IAAI,cAAc,sBAAsB,OAAO,IAAI,uBAAuB;CAG1E,IAAI,cAAc,0BAA0B,OAAO,IAAI,0BAA0B;CACjF,IAAI,cAAc,iBAAiB,OAAO,IAAI,mBAAmB;CACjE,IAAI,cAAc,iBAAiB,OAAO,IAAI,mBAAmB;CAGjE,IAAI,cAAc,+BAA+B,cAAc,wBAC7D,OAAO,IAAI,6BAA6B;CAI1C,IACE,cAAc,0BACX,cAAc,0BACd,cAAc,mCACd,cAAc,gCACd,cAAc,yBAEjB,OAAO,IAAI,yBAAyB;CAItC,IACE,cAAc,oBACX,cAAc,4BACd,cAAc,uCAEjB,OAAO,IAAI,oBAAoB;CAIjC,IACE,cAAc,sBACX,cAAc,mBACd,cAAc,uBACd,cAAc,4BACd,cAAc,oCACd,cAAc,6CAEjB,OAAO,IAAI,2BAA2B;CAIxC,IAAI,cAAc,mCAAmC,cAAc,kCACjE,OAAO,IAAI,4BAA4B;CAMzC,IAAI,cAAc,4BAA4B,cAAc,0BAC1D,OAAO,IAAI,2BAA2B;CAIxC,IACE,cAAc,sBACX,cAAc,8CACd,cAAc,oCAEjB,OAAO,IAAI,iCAAiC;CAI9C,IAAI,cAAc,0BAA0B,cAAc,iCACxD,OAAO,IAAI,qCAAqC;CAIlD,IACE,cAAc,iDACX,cAAc,wEAEjB,OAAO,IAAI,8CAA8C;CAI3D,IAAI,cAAc,oBAAoB,cAAc,kCAClD,OAAO,IAAI,+BAA+B;CAI5C,IAAI,cAAc,oBAAoB,cAAc,oBAClD,OAAO,IAAI,+BAA+B;CAI5C,IACE,cAAc,iCACX,cAAc,qCACd,cAAc,mDACd,cAAc,kDACd,cAAc,yBACd,cAAc,8BAEjB,OAAO,IAAI,2BAA2B;CAIxC,IACE,cAAc,0DACX,cAAc,kDACd,cAAc,2CACd,cAAc,8BACd,cAAc,+BACd,cAAc,kBAEjB,OAAO,IAAI,+BAA+B;CAI5C,IACE,cAAc,yDACX,cAAc,wDACd,cAAc,gCACd,cAAc,sCACd,cAAc,iCACd,cAAc,mCACd,cAAc,6BACd,cAAc,gCACd,cAAc,qDAEjB,OAAO,IAAI,6BAA6B;CAI1C,IACE,UAAU,WAAW,0BAA0B,IAC5C,cAAc,+CACd,cAAc,iDACd,cAAc,qDACd,cAAc,uBAEjB,OAAO,IAAI,mCAAmC;CAIhD,OAAO,IAAI,uBAAuB,UAAU;;;;;;;AAQ9C,SAAgB,WAAW,OAAmC;CAC5D,IAAI,iBAAiB,UAAU,OAAO;CAEtC,OACE,iBAAiB,SACd,MAAM,SAAS,cACf,YAAY,SACZ,gBAAgB;;;;;;;;AClQvB,SAAgB,wBAAyD;CACvE,OAAO;EACL,OAAO;EACP,UAAU,UAAU;GAClB,IAAI,WAAW,MAAM,EACnB,MAAM,mBAAmB,MAAM;GAEjC,MAAM;;EAET;;;;;AAMH,MAAa,iBAAiB,OAAU,OAAqC;CAC3E,IAAI;EACF,OAAO,MAAM,IAAI;UACV,OAAO;EACd,IAAI,WAAW,MAAM,EACnB,MAAM,mBAAmB,MAAM;EAEjC,MAAM;;;;;ACAH,IAAA,cAAA,MAAM,YAAoE;CAIpC;CAH3C;CAEA,YACE,SACA;EADyC,KAAA,UAAA;EAEzC,KAAK,eAAe,WAAW;GAC7B,GAAG,KAAK;GACR,YAAY,uBAAuB;GACpC,CAAC;;;;;CAMJ,IAAI,OAAuB;EACzB,OAAO,KAAK;;;;CAjBf,UAAU,aAAa;oBAKnBC,SAAO,aAAa,CAAA;;;;;;ACsDlB,IAAA,aAAA,cAAA,MAAM,WAAwC;;;;;;;;CAQnD,gBAAgB,QAAsB;EACpC,OAAO,IAAI,uBAAuB,8BAA8B;;;;;;;;;;;;CAalE,OAAO,aACL,SACe;EACf,MAAM,EAAE,kBAAkB;EAC1B,MAAM,aAAa,QAAQ,UAAU,EAAE;EACvC,MAAM,cAAc,QAAQ;EAE5B,MAAM,sBAAsB;GAC1B,SAAS;GACT,aAAa,WAAsB,GAAG,aAA2C;IAC/E,IAAI,MAAM,YAAY,GAAG,SAAS;IAElC,IAAI,eACF,MAAM;KACJ,GAAG;KACH,SAAS,CAAC,sBAAsB,cAAc,EAAE,GAAI,IAAI,WAAW,EAAE,CAAE;KACxE;IASH,IANiB,UAAU,sBACQ,CAAC,aAClC,oBAAoB,cACpB,KAGoB,EAAE;KACtB,MAAM,QAAQ,UAAU,QAA2B,oBAAoB,MAAM;KAC7E,MAAM,WAAW,UAAU,QAA6B,oBAAoB,SAAS;KAErF,MAAM;MACJ,GAAG;MACH,WAAW;OACT,SAAS;OACT,GAAG,IAAI;OACP,eAAe,IAAI,WAAW,iBAAiB,iCAAiC,MAAM;OACtF,aAAa;QACX,GAAG,mBAAmB,SAAS;QAC/B,GAAI,IAAI,WAAW,eAAe,EAAE;QACrC;OACF;MACF;;IAGH,OAAO;;GAET,QAAQ,CAAC,iBAAiB,GAAG,WAAW;GACzC;EAED,OAAO;GACL,QAAA;GACA,WAAW;IACT;IACA;KACE,SAAS;KACT,UAAU;KACX;IACD,GAAI,gBACA,CACA;KAAE,SAAS,UAAU;KAAS,UAAU;KAAoC,EAC5E;KAAE,SAAS,UAAU;KAAe,UAAU;KAAe,CAC9D,GACC,EAAE;IACP;GACF;;;uCA3FJ,OAAO;CACN,SAAS,CACP,WAAW,iBAAiB,aAAa,CAC1C;CACD,WAAW,EAAE;CACd,CAAC,CAAA,EAAA,WAAA"}
+{"version":3,"file":"index.mjs","names":[],"sources":["../../src/context/router-context.augment.ts","../../src/auth/auth.tokens.ts","../../src/auth/middleware/session-verification.middleware.ts","../../src/auth/rate-limit-bridge.ts","../../src/auth/errors/auth-errors.ts","../../src/auth/errors/invalid-token.error.ts","../../src/auth/errors/organization-errors.ts","../../src/auth/errors/token-required.error.ts","../../src/auth/utils/better-auth-error-handler.ts","../../src/auth/utils/auth-helpers.ts","../../src/auth/services/auth.service.ts","../../src/auth/auth.module.ts"],"sourcesContent":["/**\n * Augments Stratal's `RouterContext` with a `user()` accessor backed by the\n * request-scoped {@link AuthContext}.\n *\n * Side-effect import: registers the `user` macro on `RouterContext` and the\n * `declare module` augmentation that exposes it at the type level. Imported by\n * {@link AuthModule} so it runs whenever auth is configured.\n */\nimport { DI_TOKENS } from 'stratal/di'\nimport { RouterContext } from 'stratal/router'\nimport type { AuthContext, AuthUser } from './auth-context'\n\ndeclare module 'stratal/router' {\n  interface RouterContext {\n    /**\n     * The authenticated user for the current request.\n     *\n     * Throws `UserNotAuthenticatedError` if the request is unauthenticated.\n     * Provided by `@stratal/framework`'s `AuthModule` via {@link AuthContext}.\n     */\n    user(): AuthUser\n  }\n}\n\nRouterContext.macro('user', function (this: RouterContext): AuthUser {\n  return this.getContainer().resolve<AuthContext>(DI_TOKENS.AuthContext).requireUser()\n})\n","/** Token for AuthService - core authentication service */\nexport const AUTH_SERVICE = Symbol.for('stratal:auth:service')\n\n/** Token for Better Auth options configuration */\nexport const AUTH_OPTIONS = Symbol.for('stratal:auth:options')\n","import { DI_TOKENS, inject, Transient } from 'stratal/di'\nimport { LOGGER_TOKENS, type LoggerService } from 'stratal/logger'\nimport type { Middleware, Next, RouterContext } from 'stratal/router'\nimport { type AuthContext } from '../../context/auth-context'\nimport { AUTH_SERVICE } from '../auth.tokens'\nimport type { AuthService } from '../services/auth.service'\n\n/**\n * Session Verification Middleware\n *\n * Verifies user session via Better Auth and populates AuthContext with\n * the authenticated user.\n *\n * **Responsibilities:**\n * - Calls Better Auth's getSession() API\n * - Populates AuthContext with the user record if the session is valid\n * - Continues request chain regardless of session status\n */\n@Transient()\nexport class SessionVerificationMiddleware implements Middleware {\n  constructor(\n    @inject(AUTH_SERVICE)\n    private readonly authService: AuthService,\n    @inject(LOGGER_TOKENS.LoggerService) private logger: LoggerService\n  ) { }\n\n  async handle(ctx: RouterContext, next: Next): Promise<void> {\n    try {\n      const result = await this.authService.auth.api.getSession({\n        headers: ctx.c.req.raw.headers\n      })\n\n      if (result) {\n        const authContext = ctx.getContainer().resolve<AuthContext>(DI_TOKENS.AuthContext)\n        authContext.setAuthContext({\n          user: result.user,\n        })\n      }\n    } catch (error: unknown) {\n      this.logger.debug('Session validation failed (e.g., invalidated in DB)', { error })\n    }\n\n    return next()\n  }\n}\n","/**\n * Rate-limit bridge between Stratal's `RateLimiterModule` and better-auth.\n *\n * Importing this file (transitively, via `auth.module.ts`) does two things:\n *\n *  1. Augments `RateLimiterRegistry` with `forPath()` + `pathEntries()` via\n *     Stratal's `Macroable`. Path-keyed rules registered on the same registry\n *     used for Stratal's own throttling are projected into better-auth's\n *     `customRules` by {@link projectCustomRules}.\n *  2. Exports {@link createBetterAuthRateLimitStorage} — adapts Stratal's\n *     {@link IRateLimiterStore} into better-auth's `customStorage`, so both\n *     systems share one backing store.\n *\n * `AuthModule.forRootAsync` wires both automatically when `RateLimiterModule`\n * is imported. Users with explicit `rateLimit.customStorage` /\n * `rateLimit.customRules` keys in their auth factory keep precedence.\n *\n * Frictions, documented for path-keyed entries:\n *\n *  - `Limit.by(...)` is meaningless. Better-auth scopes per-IP+path.\n *  - Multiple `Limit`s reduce to the most restrictive (smallest max-per-second).\n *  - `Limit.none()` projects to `false` (better-auth's \"disable\" sentinel).\n *  - `Limit.response(...)` is a no-op. Better-auth renders its own 429.\n *  - Snapshot caveat: `customRules` is built once at AuthService construction,\n *    so register all `forPath()` entries inside `OnInitialize` hooks.\n */\nimport { type IRateLimiterStore, type Limit, RateLimiterRegistry } from 'stratal/rate-limiter'\n\n/**\n * Resolver attached to a path-keyed limiter entry. Receives the native\n * `Request` (better-auth's customRules invokes us with the live Request)\n * and returns one or more `Limit`s. Async is supported.\n */\nexport type PathLimitResolver = (\n  req: Request,\n) => Limit | Limit[] | Promise<Limit | Limit[]>\n\ninterface BetterAuthRateLimit {\n  key: string\n  count: number\n  lastRequest: number\n}\n\ninterface BetterAuthRateLimitRule {\n  window: number\n  max: number\n}\n\ntype BetterAuthCustomRule =\n  | BetterAuthRateLimitRule\n  | false\n  | ((req: Request) => Promise<BetterAuthRateLimitRule | false>)\n\n// Per-instance path map — keyed by registry so we don't pin GC roots.\nconst pathResolvers = new WeakMap<RateLimiterRegistry, Map<string, PathLimitResolver>>()\n\nfunction getOrCreatePathMap(registry: RateLimiterRegistry): Map<string, PathLimitResolver> {\n  let map = pathResolvers.get(registry)\n  if (!map) {\n    map = new Map()\n    pathResolvers.set(registry, map)\n  }\n  return map\n}\n\nRateLimiterRegistry.macro('forPath', function (\n  this: RateLimiterRegistry,\n  path: string,\n  resolver: PathLimitResolver,\n): void {\n  getOrCreatePathMap(this).set(path, resolver)\n})\n\nRateLimiterRegistry.macro('pathEntries', function (\n  this: RateLimiterRegistry,\n): IterableIterator<[string, PathLimitResolver]> {\n  return (pathResolvers.get(this) ?? new Map<string, PathLimitResolver>()).entries()\n})\n\ndeclare module 'stratal/rate-limiter' {\n  interface RateLimiterRegistry {\n    /**\n     * Register a rate-limit rule for a better-auth path pattern. The rule\n     * is projected into better-auth's `rateLimit.customRules` automatically\n     * when both modules are imported.\n     *\n     * @example\n     * limiter.forPath('/sign-in/email', () => Limit.perSeconds(10, 3))\n     * limiter.forPath('/two-factor/*', async (req) => { ... })\n     * limiter.forPath('/forget-password', () => Limit.none())\n     */\n    forPath(path: string, resolver: PathLimitResolver): void\n\n    /**\n     * Iterate every path-keyed entry registered via `forPath`. Used by the\n     * auth bridge to project entries into better-auth's `customRules`.\n     */\n    pathEntries(): IterableIterator<[string, PathLimitResolver]>\n  }\n}\n\n// Better-auth manages window expiry itself by reading `lastRequest`. We still\n// need a TTL on the underlying KV so dead records don't accumulate. 1 day\n// covers any reasonable better-auth window without colliding with the next.\nconst BETTER_AUTH_TTL_SECONDS = 86_400\nconst BETTER_AUTH_KEY_PREFIX = 'ba-rl:'\n\n/**\n * Adapt Stratal's `IRateLimiterStore` into better-auth's `customStorage` shape.\n * Better-auth supplies its own `RateLimit` records (`{ key, count, lastRequest }`);\n * the adapter just persists them under a separate key namespace.\n */\nexport function createBetterAuthRateLimitStorage(store: IRateLimiterStore): {\n  get: (key: string) => Promise<BetterAuthRateLimit | null>\n  set: (key: string, value: BetterAuthRateLimit, update?: boolean) => Promise<void>\n} {\n  return {\n    async get(key) {\n      return await store.get<BetterAuthRateLimit>(`${BETTER_AUTH_KEY_PREFIX}${key}`)\n    },\n    async set(key, value, _update) {\n      await store.set(`${BETTER_AUTH_KEY_PREFIX}${key}`, value, BETTER_AUTH_TTL_SECONDS)\n    },\n  }\n}\n\n/**\n * Project every `forPath` entry on the registry into better-auth's\n * `customRules` shape. Each entry becomes an async function that resolves\n * the user's `Limit`(s) and reduces them to a single `{ window, max }` pair\n * (or `false` for `Limit.none()`).\n *\n * Multi-`Limit` reduction picks the most restrictive — smallest\n * `max / windowSeconds` ratio; ties favour the first.\n */\nexport function projectCustomRules(\n  registry: RateLimiterRegistry,\n): Record<string, BetterAuthCustomRule> {\n  const rules: Record<string, BetterAuthCustomRule> = {}\n\n  for (const [path, resolver] of registry.pathEntries()) {\n    rules[path] = async (req: Request): Promise<BetterAuthRateLimitRule | false> => {\n      const resolved = await resolver(req)\n      const candidates = (Array.isArray(resolved) ? resolved : [resolved]).filter((l) => !l.disabled)\n      if (candidates.length === 0) return false\n\n      const chosen = candidates.reduce((a, b) =>\n        a.max / a.windowSeconds <= b.max / b.windowSeconds ? a : b,\n      )\n\n      return { window: chosen.windowSeconds, max: chosen.max }\n    }\n  }\n\n  return rules\n}\n","import { HttpException } from 'stratal/errors'\n\nexport class UserNotFoundError extends HttpException {\n  constructor(public readonly email?: string) {\n    super(404, 'User not found')\n  }\n}\n\nexport class InvalidCredentialsError extends HttpException {\n  constructor() { super(401, 'Invalid email or password') }\n}\n\nexport class InvalidPasswordError extends HttpException {\n  constructor() { super(401, 'Invalid password') }\n}\n\nexport class InvalidEmailError extends HttpException {\n  constructor(public readonly email?: string) {\n    super(422, 'Invalid email address')\n  }\n}\n\nexport class SessionExpiredError extends HttpException {\n  constructor() { super(401, 'Session expired') }\n}\n\nexport class EmailNotVerifiedError extends HttpException {\n  constructor(public readonly email?: string) {\n    super(403, 'Email not verified')\n  }\n}\n\nexport class PasswordTooShortError extends HttpException {\n  constructor(public readonly minLength?: number) {\n    super(422, 'Password too short')\n  }\n}\n\nexport class PasswordTooLongError extends HttpException {\n  constructor(public readonly maxLength?: number) {\n    super(422, 'Password too long')\n  }\n}\n\nexport class AccountAlreadyExistsError extends HttpException {\n  constructor(public readonly email?: string) {\n    super(409, 'Account already exists')\n  }\n}\n\nexport class SocialAccountLinkedError extends HttpException {\n  constructor(public readonly provider?: string) {\n    super(409, 'Social account already linked')\n  }\n}\n\nexport class CannotUnlinkLastAccountError extends HttpException {\n  constructor() { super(409, 'Cannot unlink last account') }\n}\n\nexport class ProviderNotFoundError extends HttpException {\n  constructor(public readonly provider?: string) {\n    super(404, 'Authentication provider not found')\n  }\n}\n\nexport class UserEmailNotFoundError extends HttpException {\n  constructor() { super(404, 'User email not found') }\n}\n\nexport class AccountNotFoundError extends HttpException {\n  constructor() { super(404, 'Account not found') }\n}\n\nexport class CredentialAccountNotFoundError extends HttpException {\n  constructor() { super(404, 'Credential account not found') }\n}\n\nexport class UserAlreadyHasPasswordError extends HttpException {\n  constructor() { super(409, 'User already has a password') }\n}\n\nexport class EmailCannotBeUpdatedError extends HttpException {\n  constructor(public readonly reason?: string) {\n    super(422, 'Email cannot be updated')\n  }\n}\n\nexport class IdTokenNotSupportedError extends HttpException {\n  constructor() { super(422, 'ID token not supported') }\n}\n\nexport class TokenExpiredError extends HttpException {\n  constructor() { super(401, 'Token expired') }\n}\n\nexport class InvalidCallbackUrlError extends HttpException {\n  constructor() { super(422, 'Invalid callback URL') }\n}\n\nexport class InvalidOriginError extends HttpException {\n  constructor() { super(403, 'Invalid request origin') }\n}\n\nexport class AuthValidationFailedError extends HttpException {\n  constructor() { super(422, 'Authentication validation failed') }\n}\n\nexport class EmailAlreadyVerifiedError extends HttpException {\n  constructor() { super(409, 'Email already verified') }\n}\n\nexport class EmailMismatchError extends HttpException {\n  constructor() { super(422, 'Email mismatch') }\n}\n","import { HttpException } from 'stratal/errors'\n\nexport class InvalidTokenError extends HttpException {\n  constructor() { super(401, 'Invalid or expired token') }\n}\n","import { HttpException } from 'stratal/errors'\n\nexport class OrganizationNotFoundError extends HttpException {\n  constructor() { super(404, 'Organization not found') }\n}\nexport class OrganizationMemberNotFoundError extends HttpException {\n  constructor() { super(404, 'Organization member not found') }\n}\nexport class OrganizationInvitationNotFoundError extends HttpException {\n  constructor() { super(404, 'Invitation not found') }\n}\nexport class OrganizationPermissionDeniedError extends HttpException {\n  constructor() { super(403, 'Organization permission denied') }\n}\nexport class OrganizationInvitationRecipientMismatchError extends HttpException {\n  constructor() { super(403, 'Invitation recipient mismatch') }\n}\nexport class OrganizationConflictError extends HttpException {\n  constructor() { super(409, 'Organization resource conflict') }\n}\nexport class OrganizationLimitReachedError extends HttpException {\n  constructor() { super(422, 'Organization limit reached') }\n}\nexport class OrganizationMembershipError extends HttpException {\n  constructor() { super(422, 'Organization membership constraint violated') }\n}\nexport class OrganizationTeamNotFoundError extends HttpException {\n  constructor() { super(404, 'Team not found') }\n}\nexport class OrganizationRoleNotFoundError extends HttpException {\n  constructor() { super(404, 'Role not found') }\n}\n","import { HttpException } from 'stratal/errors'\n\nexport class TokenRequiredError extends HttpException {\n  constructor() { super(401, 'Verification token is required') }\n}\n","import { APIError } from 'better-auth/api'\nimport { AuthError } from 'stratal/errors'\nimport type { ApplicationError } from 'stratal/errors'\nimport {\n  AccountAlreadyExistsError,\n  AccountNotFoundError,\n  AuthValidationFailedError,\n  CannotUnlinkLastAccountError,\n  CredentialAccountNotFoundError,\n  EmailAlreadyVerifiedError,\n  EmailCannotBeUpdatedError,\n  EmailMismatchError,\n  EmailNotVerifiedError,\n  IdTokenNotSupportedError,\n  InvalidCallbackUrlError,\n  InvalidCredentialsError,\n  InvalidEmailError,\n  InvalidOriginError,\n  InvalidPasswordError,\n  InvalidTokenError,\n  OrganizationConflictError,\n  OrganizationInvitationNotFoundError,\n  OrganizationInvitationRecipientMismatchError,\n  OrganizationLimitReachedError,\n  OrganizationMemberNotFoundError,\n  OrganizationMembershipError,\n  OrganizationNotFoundError,\n  OrganizationPermissionDeniedError,\n  OrganizationRoleNotFoundError,\n  OrganizationTeamNotFoundError,\n  PasswordTooLongError,\n  PasswordTooShortError,\n  ProviderNotFoundError,\n  SessionExpiredError,\n  SocialAccountLinkedError,\n  TokenExpiredError,\n  UserAlreadyHasPasswordError,\n  UserEmailNotFoundError,\n  UserNotFoundError,\n} from '../errors'\n\n/**\n * Maps Better Auth API error codes to ApplicationError instances.\n */\nexport function mapBetterAuthError(error: APIError): ApplicationError {\n  const errorCode = error.body?.code\n\n  if (error.status === 'FOUND') {\n    const headers = error.headers as Headers\n    const location = headers.get('location') ?? ''\n\n    if (location.includes('INVALID_TOKEN')) return new InvalidTokenError()\n    if (location.includes('EXPIRED_TOKEN')) return new TokenExpiredError()\n    if (location.includes('ATTEMPTS_EXCEEDED')) return new InvalidTokenError()\n    if (location.includes('new_user_signup_disabled')) return new UserNotFoundError()\n    if (location.includes('failed_to_create_user')) return new AuthError('Failed to create user')\n    if (location.includes('failed_to_create_session')) return new AuthError('Failed to create session')\n  }\n\n  if (!errorCode) {\n    return new AuthError('An authentication error occurred')\n  }\n\n  // ── Base Error Codes ──────────────────────────────────────────────────\n\n  // User errors\n  if (errorCode === 'USER_NOT_FOUND' || errorCode === 'INVALID_USER') return new UserNotFoundError()\n  if (errorCode === 'USER_EMAIL_NOT_FOUND') return new UserEmailNotFoundError()\n\n  // Credential errors\n  if (errorCode === 'INVALID_EMAIL_OR_PASSWORD') return new InvalidCredentialsError()\n  if (errorCode === 'INVALID_PASSWORD') return new InvalidPasswordError()\n  if (errorCode === 'INVALID_EMAIL') return new InvalidEmailError()\n\n  // Session errors\n  if (errorCode === 'SESSION_EXPIRED' || errorCode === 'SESSION_NOT_FRESH') return new SessionExpiredError()\n  if (errorCode === 'FAILED_TO_CREATE_SESSION') return new AuthError('Failed to create session')\n  if (errorCode === 'FAILED_TO_GET_SESSION') return new AuthError('Failed to retrieve session')\n\n  // Email verification\n  if (errorCode === 'EMAIL_NOT_VERIFIED') return new EmailNotVerifiedError()\n  if (errorCode === 'EMAIL_CAN_NOT_BE_UPDATED') return new EmailCannotBeUpdatedError()\n  if (errorCode === 'EMAIL_ALREADY_VERIFIED') return new EmailAlreadyVerifiedError()\n  if (errorCode === 'EMAIL_MISMATCH') return new EmailMismatchError()\n\n  // Password validation\n  if (errorCode === 'PASSWORD_TOO_SHORT') return new PasswordTooShortError(8)\n  if (errorCode === 'PASSWORD_TOO_LONG') return new PasswordTooLongError(128)\n\n  // Account errors\n  if (errorCode === 'USER_ALREADY_EXISTS' || errorCode === 'USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL') {\n    return new AccountAlreadyExistsError()\n  }\n  if (errorCode === 'ACCOUNT_NOT_FOUND') return new AccountNotFoundError()\n  if (errorCode === 'CREDENTIAL_ACCOUNT_NOT_FOUND') return new CredentialAccountNotFoundError()\n  if (errorCode === 'FAILED_TO_UNLINK_LAST_ACCOUNT') return new CannotUnlinkLastAccountError()\n\n  // User creation/update errors\n  if (errorCode === 'FAILED_TO_CREATE_USER') return new AuthError('Failed to create user')\n  if (errorCode === 'FAILED_TO_UPDATE_USER') return new AuthError('Failed to update user')\n  if (errorCode === 'FAILED_TO_GET_USER_INFO') return new AuthError('Failed to retrieve user info')\n\n  // Social account errors\n  if (errorCode === 'SOCIAL_ACCOUNT_ALREADY_LINKED' || errorCode === 'LINKED_ACCOUNT_ALREADY_EXISTS') {\n    return new SocialAccountLinkedError()\n  }\n  if (errorCode === 'PROVIDER_NOT_FOUND') return new ProviderNotFoundError()\n\n  // Token errors\n  if (errorCode === 'ID_TOKEN_NOT_SUPPORTED') return new IdTokenNotSupportedError()\n  if (errorCode === 'INVALID_TOKEN') return new InvalidTokenError()\n  if (errorCode === 'TOKEN_EXPIRED') return new TokenExpiredError()\n\n  // Password management\n  if (errorCode === 'USER_ALREADY_HAS_PASSWORD' || errorCode === 'PASSWORD_ALREADY_SET') {\n    return new UserAlreadyHasPasswordError()\n  }\n\n  // Callback/redirect URL errors\n  if (\n    errorCode === 'INVALID_CALLBACK_URL'\n    || errorCode === 'INVALID_REDIRECT_URL'\n    || errorCode === 'INVALID_NEW_USER_CALLBACK_URL'\n    || errorCode === 'INVALID_ERROR_CALLBACK_URL'\n    || errorCode === 'CALLBACK_URL_REQUIRED'\n  ) {\n    return new InvalidCallbackUrlError()\n  }\n\n  // Origin/CORS errors\n  if (\n    errorCode === 'INVALID_ORIGIN'\n    || errorCode === 'MISSING_OR_NULL_ORIGIN'\n    || errorCode === 'CROSS_SITE_NAVIGATION_LOGIN_BLOCKED'\n  ) {\n    return new InvalidOriginError()\n  }\n\n  // Validation errors\n  if (\n    errorCode === 'VALIDATION_ERROR'\n    || errorCode === 'MISSING_FIELD'\n    || errorCode === 'FIELD_NOT_ALLOWED'\n    || errorCode === 'BODY_MUST_BE_AN_OBJECT'\n    || errorCode === 'ASYNC_VALIDATION_NOT_SUPPORTED'\n    || errorCode === 'METHOD_NOT_ALLOWED_DEFER_SESSION_REQUIRED'\n  ) {\n    return new AuthValidationFailedError()\n  }\n\n  // Verification errors\n  if (errorCode === 'FAILED_TO_CREATE_VERIFICATION' || errorCode === 'VERIFICATION_EMAIL_NOT_ENABLED') {\n    return new AuthError('Failed to create session')\n  }\n\n  // ── Organization Plugin Error Codes ───────────────────────────────────\n\n  // Organization not found\n  if (errorCode === 'ORGANIZATION_NOT_FOUND' || errorCode === 'NO_ACTIVE_ORGANIZATION') {\n    return new OrganizationNotFoundError()\n  }\n\n  // Member not found\n  if (\n    errorCode === 'MEMBER_NOT_FOUND'\n    || errorCode === 'USER_IS_NOT_A_MEMBER_OF_THE_ORGANIZATION'\n    || errorCode === 'USER_IS_NOT_A_MEMBER_OF_THE_TEAM'\n  ) {\n    return new OrganizationMemberNotFoundError()\n  }\n\n  // Invitation not found\n  if (errorCode === 'INVITATION_NOT_FOUND' || errorCode === 'FAILED_TO_RETRIEVE_INVITATION') {\n    return new OrganizationInvitationNotFoundError()\n  }\n\n  // Invitation recipient mismatch\n  if (\n    errorCode === 'YOU_ARE_NOT_THE_RECIPIENT_OF_THE_INVITATION'\n    || errorCode === 'EMAIL_VERIFICATION_REQUIRED_BEFORE_ACCEPTING_OR_REJECTING_INVITATION'\n  ) {\n    return new OrganizationInvitationRecipientMismatchError()\n  }\n\n  // Team not found\n  if (errorCode === 'TEAM_NOT_FOUND' || errorCode === 'YOU_DO_NOT_HAVE_AN_ACTIVE_TEAM') {\n    return new OrganizationTeamNotFoundError()\n  }\n\n  // Role not found\n  if (errorCode === 'ROLE_NOT_FOUND' || errorCode === 'INVALID_RESOURCE') {\n    return new OrganizationRoleNotFoundError()\n  }\n\n  // Organization conflict/already exists\n  if (\n    errorCode === 'ORGANIZATION_ALREADY_EXISTS'\n    || errorCode === 'ORGANIZATION_SLUG_ALREADY_TAKEN'\n    || errorCode === 'USER_IS_ALREADY_A_MEMBER_OF_THIS_ORGANIZATION'\n    || errorCode === 'USER_IS_ALREADY_INVITED_TO_THIS_ORGANIZATION'\n    || errorCode === 'TEAM_ALREADY_EXISTS'\n    || errorCode === 'ROLE_NAME_IS_ALREADY_TAKEN'\n  ) {\n    return new OrganizationConflictError()\n  }\n\n  // Organization limit reached\n  if (\n    errorCode === 'YOU_HAVE_REACHED_THE_MAXIMUM_NUMBER_OF_ORGANIZATIONS'\n    || errorCode === 'YOU_HAVE_REACHED_THE_MAXIMUM_NUMBER_OF_TEAMS'\n    || errorCode === 'ORGANIZATION_MEMBERSHIP_LIMIT_REACHED'\n    || errorCode === 'INVITATION_LIMIT_REACHED'\n    || errorCode === 'TEAM_MEMBER_LIMIT_REACHED'\n    || errorCode === 'TOO_MANY_ROLES'\n  ) {\n    return new OrganizationLimitReachedError()\n  }\n\n  // Organization membership constraints\n  if (\n    errorCode === 'YOU_CANNOT_LEAVE_THE_ORGANIZATION_AS_THE_ONLY_OWNER'\n    || errorCode === 'YOU_CANNOT_LEAVE_THE_ORGANIZATION_WITHOUT_AN_OWNER'\n    || errorCode === 'UNABLE_TO_REMOVE_LAST_TEAM'\n    || errorCode === 'CANNOT_DELETE_A_PRE_DEFINED_ROLE'\n    || errorCode === 'ROLE_IS_ASSIGNED_TO_MEMBERS'\n    || errorCode === 'YOU_CANNOT_IMPERSONATE_ADMINS'\n    || errorCode === 'YOU_CANNOT_BAN_YOURSELF'\n    || errorCode === 'YOU_CANNOT_REMOVE_YOURSELF'\n    || errorCode === 'INVITER_IS_NO_LONGER_A_MEMBER_OF_THE_ORGANIZATION'\n  ) {\n    return new OrganizationMembershipError()\n  }\n\n  // Organization permission denied (catch-all for YOU_ARE_NOT_ALLOWED_TO_* patterns)\n  if (\n    errorCode.startsWith('YOU_ARE_NOT_ALLOWED_TO_')\n    || errorCode === 'YOU_ARE_NOT_A_MEMBER_OF_THIS_ORGANIZATION'\n    || errorCode === 'YOU_CAN_NOT_ACCESS_THE_MEMBERS_OF_THIS_TEAM'\n    || errorCode === 'YOU_MUST_BE_IN_AN_ORGANIZATION_TO_CREATE_A_ROLE'\n    || errorCode === 'MISSING_AC_INSTANCE'\n  ) {\n    return new OrganizationPermissionDeniedError()\n  }\n\n  // Unknown error code\n  return new AuthError('An authentication error occurred')\n}\n\n/**\n * Type guard to check if an error is a Better Auth APIError.\n * Uses duck typing to handle bundler environments (e.g. Vite)\n * where instanceof may fail across module boundaries.\n */\nexport function isAPIError(error: unknown): error is APIError {\n  if (error instanceof APIError) return true\n\n  return (\n    error instanceof Error\n    && error.name === 'APIError'\n    && 'status' in error\n    && 'statusCode' in error\n  )\n}\n","import type { BetterAuthOptions } from 'better-auth'\nimport { isAPIError, mapBetterAuthError } from './better-auth-error-handler'\n\n/**\n * Get shared Better Auth error handler configuration.\n * Use this in Better Auth config's onAPIError option.\n */\nexport function getErrorHandlerConfig(): BetterAuthOptions['onAPIError'] {\n  return {\n    throw: false,\n    onError: (error) => {\n      if (isAPIError(error)) {\n        throw mapBetterAuthError(error)\n      }\n      throw error\n    },\n  }\n}\n\n/**\n * Wrap a Better Auth function in a try/catch block and map errors to ApplicationError.\n */\nexport const wrapBetterAuth = async <T>(fn: () => Promise<T>): Promise<T> => {\n  try {\n    return await fn()\n  } catch (error) {\n    if (isAPIError(error)) {\n      throw mapBetterAuthError(error)\n    }\n    throw error\n  }\n}\n","import type { Auth, BetterAuthOptions } from 'better-auth';\nimport { betterAuth } from 'better-auth/minimal';\nimport { inject, Request } from 'stratal/di';\nimport { AUTH_OPTIONS, AUTH_SERVICE } from '../auth.tokens';\nimport { getErrorHandlerConfig } from '../utils';\n\n/**\n * AuthService\n *\n * Base authentication service using Better Auth.\n * Configured via AuthModule.forRootAsync() from the application layer.\n *\n * **Extensibility:**\n * Extend this class to add custom methods. Subclasses inherit\n * `@Request(AUTH_SERVICE)` scope automatically — no decorator needed.\n *\n * @example\n * ```typescript\n * @Request(AUTH_SERVICE)\n * export class AppAuthService extends AuthService<AuthOptions> {\n *   async signInMagicLink(email: string) {\n *     return wrapBetterAuth(async () => {\n *       return this.auth.api.signInMagicLink({ body: { email }, headers: new Headers() })\n *     })\n *   }\n * }\n * ```\n */\n@Request(AUTH_SERVICE)\nexport class AuthService<TOptions extends BetterAuthOptions = BetterAuthOptions> {\n  private _authInstance?: Auth<TOptions>\n\n  constructor(\n    @inject(AUTH_OPTIONS) protected readonly options: TOptions\n  ) {}\n\n  /**\n   * Get the Better Auth instance.\n   */\n  get auth(): Auth<TOptions> {\n    this._authInstance ??= betterAuth({\n        ...this.options,\n        onAPIError: getErrorHandlerConfig()\n    }) as Auth<TOptions>;\n\n    return this._authInstance\n  }\n}\n","/**\n * Auth Module\n *\n * Provides configurable authentication using Better Auth.\n * Use `forRootAsync` to configure Better Auth options from the application layer.\n *\n * Optionally pass `accessControl` to enable permission-based authorization.\n * This auto-adds the Stratal AC plugin to Better Auth and registers `AccessService`.\n *\n * @example Without access control\n * ```typescript\n * @Module({\n *   imports: [\n *     AuthModule.forRootAsync({\n *       inject: [DI_TOKENS.Database, CONFIG_TOKENS.ConfigService],\n *       useFactory: (db, config) => createAuthOptions(db, config)\n *     })\n *   ]\n * })\n * export class AppModule {}\n * ```\n *\n * @example With access control\n * ```typescript\n * import { createAccessControl } from '@stratal/framework/access-control'\n * import { admin } from 'better-auth/plugins'\n *\n * const permissions = createAccessControl({\n *   resources: { posts: ['create', 'read', 'update', 'delete'] } as const,\n *   roles: { admin: { posts: ['create', 'read', 'update', 'delete'] }, user: { posts: ['read'] } },\n * })\n *\n * @Module({\n *   imports: [\n *     AuthModule.forRootAsync({\n *       inject: [DI_TOKENS.Database],\n *       useFactory: (db) => ({\n *         database: ...,\n *         plugins: [admin({ ...permissions })],\n *       }),\n *       accessControl: permissions,\n *     })\n *   ]\n * })\n * ```\n */\n\nimport type { BetterAuthOptions } from 'better-auth'\nimport { CONTAINER_TOKEN, type Container } from 'stratal/di'\nimport type { AsyncModuleOptions, DynamicModule } from 'stratal/module'\nimport { Module } from 'stratal/module'\nimport type { IRateLimiterStore, RateLimiterRegistry } from 'stratal/rate-limiter'\nimport { RATE_LIMITER_TOKENS } from 'stratal/rate-limiter'\nimport type { RouteConfigurable, Router } from 'stratal/router'\nimport { createStratalAcPlugin } from '../access-control/plugin'\nimport { AccessService } from '../access-control/services/access.service'\nimport { AC_TOKENS } from '../access-control/tokens'\nimport type { AccessControlOptions } from '../access-control/types'\nimport { AuthContext } from '../context/auth-context'\n// Side-effect import: registers the `user()` macro on `RouterContext` and its\n// type augmentation, backed by the request-scoped `AuthContext`.\nimport '../context/router-context.augment'\nimport { AUTH_OPTIONS, AUTH_SERVICE } from './auth.tokens'\nimport { SessionVerificationMiddleware } from './middleware/session-verification.middleware'\n// Side-effect import: registers `forPath`/`pathEntries` macros on\n// `RateLimiterRegistry` and the `declare module` augmentation that exposes\n// them at the type level. Must run before any consumer calls `forPath()`.\nimport {\n  createBetterAuthRateLimitStorage,\n  projectCustomRules,\n} from './rate-limit-bridge'\nimport { AuthService } from './services/auth.service'\n\nexport interface AuthModuleAsyncOptions<TOptions extends BetterAuthOptions = BetterAuthOptions>\n  extends AsyncModuleOptions<TOptions> {\n  /**\n   * Optional access control configuration.\n   * When provided, registers AccessService and auto-adds the Stratal AC plugin to Better Auth.\n   */\n  accessControl?: AccessControlOptions\n}\n\n@Module({\n  providers: [AuthContext]\n})\nexport class AuthModule implements RouteConfigurable {\n  /**\n   * Configure auth middleware globally.\n   *\n   * SessionVerificationMiddleware verifies the session and populates the\n   * request-scoped AuthContext with the authenticated user.\n   */\n  configureRoutes(router: Router): void {\n    router.use(SessionVerificationMiddleware)\n  }\n\n  /**\n   * Configure AuthModule with async options factory.\n   * Optionally provide `accessControl` to enable permission-based authorization.\n   *\n   * When `RateLimiterModule` is also imported, better-auth's `rateLimit`\n   * block is auto-wired: `customStorage` shares Stratal's backing store, and\n   * any `RateLimiterRegistry.forPath(...)` entries are projected into\n   * `customRules`. User-supplied `rateLimit.{customStorage, customRules}` keys\n   * take precedence on a per-key basis.\n   */\n  static forRootAsync<TOptions extends BetterAuthOptions>(\n    options: AuthModuleAsyncOptions<TOptions>\n  ): DynamicModule {\n    const { accessControl } = options\n    const userInject = options.inject ?? []\n    const userFactory = options.useFactory as (...args: unknown[]) => TOptions\n\n    const authOptionsProvider = {\n      provide: AUTH_OPTIONS,\n      useFactory: (container: Container, ...userDeps: unknown[]): BetterAuthOptions => {\n        let raw = userFactory(...userDeps) as BetterAuthOptions\n\n        if (accessControl) {\n          raw = {\n            ...raw,\n            plugins: [createStratalAcPlugin(accessControl), ...(raw.plugins ?? [])],\n          }\n        }\n\n        const rateLimiterPresent = container.isRegistered(\n          RATE_LIMITER_TOKENS.ModuleMarker,\n        )\n\n        if (rateLimiterPresent) {\n          const store = container.resolve<IRateLimiterStore>(RATE_LIMITER_TOKENS.Store)\n          const registry = container.resolve<RateLimiterRegistry>(RATE_LIMITER_TOKENS.Registry)\n\n          raw = {\n            ...raw,\n            rateLimit: {\n              enabled: true,\n              ...raw.rateLimit,\n              customStorage: raw.rateLimit?.customStorage ?? createBetterAuthRateLimitStorage(store),\n              customRules: {\n                ...projectCustomRules(registry),\n                ...(raw.rateLimit?.customRules ?? {}),\n              },\n            },\n          }\n        }\n\n        return raw\n      },\n      inject: [CONTAINER_TOKEN, ...userInject],\n    }\n\n    return {\n      module: AuthModule,\n      providers: [\n        authOptionsProvider,\n        {\n          provide: AUTH_SERVICE,\n          useClass: AuthService,\n        },\n        ...(accessControl\n          ? [\n            { provide: AC_TOKENS.Options, useValue: accessControl as unknown as object },\n            { provide: AC_TOKENS.AccessService, useClass: AccessService },\n          ]\n          : []),\n      ],\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAwBA,cAAc,MAAM,QAAQ,WAAyC;CACnE,OAAO,KAAK,aAAa,EAAE,QAAqB,UAAU,WAAW,EAAE,YAAY;AACrF,CAAC;;;;ACzBD,MAAa,eAAe,OAAO,IAAI,sBAAsB;;AAG7D,MAAa,eAAe,OAAO,IAAI,sBAAsB;;;ACetD,IAAA,gCAAA,MAAM,8BAAoD;CAG5C;CAC4B;CAH/C,YACE,aAEA,QACA;EAFiB,KAAA,cAAA;EAC4B,KAAA,SAAA;CAC3C;CAEJ,MAAM,OAAO,KAAoB,MAA2B;EAC1D,IAAI;GACF,MAAM,SAAS,MAAM,KAAK,YAAY,KAAK,IAAI,WAAW,EACxD,SAAS,IAAI,EAAE,IAAI,IAAI,QACzB,CAAC;GAED,IAAI,QAEF,IADwB,aAAa,EAAE,QAAqB,UAAU,WAC5D,EAAE,eAAe,EACzB,MAAM,OAAO,KACf,CAAC;EAEL,SAAS,OAAgB;GACvB,KAAK,OAAO,MAAM,uDAAuD,EAAE,MAAM,CAAC;EACpF;EAEA,OAAO,KAAK;CACd;AACF;;CA1BC,UAAU;oBAGN,OAAO,YAAY,CAAA;oBAEnB,OAAO,cAAc,aAAa,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AC+BvC,MAAM,gCAAgB,IAAI,QAA6D;AAEvF,SAAS,mBAAmB,UAA+D;CACzF,IAAI,MAAM,cAAc,IAAI,QAAQ;CACpC,IAAI,CAAC,KAAK;EACR,sBAAM,IAAI,IAAI;EACd,cAAc,IAAI,UAAU,GAAG;CACjC;CACA,OAAO;AACT;AAEA,oBAAoB,MAAM,WAAW,SAEnC,MACA,UACM;CACN,mBAAmB,IAAI,EAAE,IAAI,MAAM,QAAQ;AAC7C,CAAC;AAED,oBAAoB,MAAM,eAAe,WAEQ;CAC/C,QAAQ,cAAc,IAAI,IAAI,qBAAK,IAAI,IAA+B,GAAG,QAAQ;AACnF,CAAC;AA2BD,MAAM,0BAA0B;AAChC,MAAM,yBAAyB;;;;;;AAO/B,SAAgB,iCAAiC,OAG/C;CACA,OAAO;EACL,MAAM,IAAI,KAAK;GACb,OAAO,MAAM,MAAM,IAAyB,GAAG,yBAAyB,KAAK;EAC/E;EACA,MAAM,IAAI,KAAK,OAAO,SAAS;GAC7B,MAAM,MAAM,IAAI,GAAG,yBAAyB,OAAO,OAAO,uBAAuB;EACnF;CACF;AACF;;;;;;;;;;AAWA,SAAgB,mBACd,UACsC;CACtC,MAAM,QAA8C,CAAC;CAErD,KAAK,MAAM,CAAC,MAAM,aAAa,SAAS,YAAY,GAClD,MAAM,QAAQ,OAAO,QAA2D;EAC9E,MAAM,WAAW,MAAM,SAAS,GAAG;EACnC,MAAM,cAAc,MAAM,QAAQ,QAAQ,IAAI,WAAW,CAAC,QAAQ,GAAG,QAAQ,MAAM,CAAC,EAAE,QAAQ;EAC9F,IAAI,WAAW,WAAW,GAAG,OAAO;EAEpC,MAAM,SAAS,WAAW,QAAQ,GAAG,MACnC,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,gBAAgB,IAAI,CAC3D;EAEA,OAAO;GAAE,QAAQ,OAAO;GAAe,KAAK,OAAO;EAAI;CACzD;CAGF,OAAO;AACT;;;ACzJA,IAAa,oBAAb,cAAuC,cAAc;CACvB;CAA5B,YAAY,OAAgC;EAC1C,MAAM,KAAK,gBAAgB;EADD,KAAA,QAAA;CAE5B;AACF;AAEA,IAAa,0BAAb,cAA6C,cAAc;CACzD,cAAc;EAAE,MAAM,KAAK,2BAA2B;CAAE;AAC1D;AAEA,IAAa,uBAAb,cAA0C,cAAc;CACtD,cAAc;EAAE,MAAM,KAAK,kBAAkB;CAAE;AACjD;AAEA,IAAa,oBAAb,cAAuC,cAAc;CACvB;CAA5B,YAAY,OAAgC;EAC1C,MAAM,KAAK,uBAAuB;EADR,KAAA,QAAA;CAE5B;AACF;AAEA,IAAa,sBAAb,cAAyC,cAAc;CACrD,cAAc;EAAE,MAAM,KAAK,iBAAiB;CAAE;AAChD;AAEA,IAAa,wBAAb,cAA2C,cAAc;CAC3B;CAA5B,YAAY,OAAgC;EAC1C,MAAM,KAAK,oBAAoB;EADL,KAAA,QAAA;CAE5B;AACF;AAEA,IAAa,wBAAb,cAA2C,cAAc;CAC3B;CAA5B,YAAY,WAAoC;EAC9C,MAAM,KAAK,oBAAoB;EADL,KAAA,YAAA;CAE5B;AACF;AAEA,IAAa,uBAAb,cAA0C,cAAc;CAC1B;CAA5B,YAAY,WAAoC;EAC9C,MAAM,KAAK,mBAAmB;EADJ,KAAA,YAAA;CAE5B;AACF;AAEA,IAAa,4BAAb,cAA+C,cAAc;CAC/B;CAA5B,YAAY,OAAgC;EAC1C,MAAM,KAAK,wBAAwB;EADT,KAAA,QAAA;CAE5B;AACF;AAEA,IAAa,2BAAb,cAA8C,cAAc;CAC9B;CAA5B,YAAY,UAAmC;EAC7C,MAAM,KAAK,+BAA+B;EADhB,KAAA,WAAA;CAE5B;AACF;AAEA,IAAa,+BAAb,cAAkD,cAAc;CAC9D,cAAc;EAAE,MAAM,KAAK,4BAA4B;CAAE;AAC3D;AAEA,IAAa,wBAAb,cAA2C,cAAc;CAC3B;CAA5B,YAAY,UAAmC;EAC7C,MAAM,KAAK,mCAAmC;EADpB,KAAA,WAAA;CAE5B;AACF;AAEA,IAAa,yBAAb,cAA4C,cAAc;CACxD,cAAc;EAAE,MAAM,KAAK,sBAAsB;CAAE;AACrD;AAEA,IAAa,uBAAb,cAA0C,cAAc;CACtD,cAAc;EAAE,MAAM,KAAK,mBAAmB;CAAE;AAClD;AAEA,IAAa,iCAAb,cAAoD,cAAc;CAChE,cAAc;EAAE,MAAM,KAAK,8BAA8B;CAAE;AAC7D;AAEA,IAAa,8BAAb,cAAiD,cAAc;CAC7D,cAAc;EAAE,MAAM,KAAK,6BAA6B;CAAE;AAC5D;AAEA,IAAa,4BAAb,cAA+C,cAAc;CAC/B;CAA5B,YAAY,QAAiC;EAC3C,MAAM,KAAK,yBAAyB;EADV,KAAA,SAAA;CAE5B;AACF;AAEA,IAAa,2BAAb,cAA8C,cAAc;CAC1D,cAAc;EAAE,MAAM,KAAK,wBAAwB;CAAE;AACvD;AAEA,IAAa,oBAAb,cAAuC,cAAc;CACnD,cAAc;EAAE,MAAM,KAAK,eAAe;CAAE;AAC9C;AAEA,IAAa,0BAAb,cAA6C,cAAc;CACzD,cAAc;EAAE,MAAM,KAAK,sBAAsB;CAAE;AACrD;AAEA,IAAa,qBAAb,cAAwC,cAAc;CACpD,cAAc;EAAE,MAAM,KAAK,wBAAwB;CAAE;AACvD;AAEA,IAAa,4BAAb,cAA+C,cAAc;CAC3D,cAAc;EAAE,MAAM,KAAK,kCAAkC;CAAE;AACjE;AAEA,IAAa,4BAAb,cAA+C,cAAc;CAC3D,cAAc;EAAE,MAAM,KAAK,wBAAwB;CAAE;AACvD;AAEA,IAAa,qBAAb,cAAwC,cAAc;CACpD,cAAc;EAAE,MAAM,KAAK,gBAAgB;CAAE;AAC/C;;;AChHA,IAAa,oBAAb,cAAuC,cAAc;CACnD,cAAc;EAAE,MAAM,KAAK,0BAA0B;CAAE;AACzD;;;ACFA,IAAa,4BAAb,cAA+C,cAAc;CAC3D,cAAc;EAAE,MAAM,KAAK,wBAAwB;CAAE;AACvD;AACA,IAAa,kCAAb,cAAqD,cAAc;CACjE,cAAc;EAAE,MAAM,KAAK,+BAA+B;CAAE;AAC9D;AACA,IAAa,sCAAb,cAAyD,cAAc;CACrE,cAAc;EAAE,MAAM,KAAK,sBAAsB;CAAE;AACrD;AACA,IAAa,oCAAb,cAAuD,cAAc;CACnE,cAAc;EAAE,MAAM,KAAK,gCAAgC;CAAE;AAC/D;AACA,IAAa,+CAAb,cAAkE,cAAc;CAC9E,cAAc;EAAE,MAAM,KAAK,+BAA+B;CAAE;AAC9D;AACA,IAAa,4BAAb,cAA+C,cAAc;CAC3D,cAAc;EAAE,MAAM,KAAK,gCAAgC;CAAE;AAC/D;AACA,IAAa,gCAAb,cAAmD,cAAc;CAC/D,cAAc;EAAE,MAAM,KAAK,4BAA4B;CAAE;AAC3D;AACA,IAAa,8BAAb,cAAiD,cAAc;CAC7D,cAAc;EAAE,MAAM,KAAK,6CAA6C;CAAE;AAC5E;AACA,IAAa,gCAAb,cAAmD,cAAc;CAC/D,cAAc;EAAE,MAAM,KAAK,gBAAgB;CAAE;AAC/C;AACA,IAAa,gCAAb,cAAmD,cAAc;CAC/D,cAAc;EAAE,MAAM,KAAK,gBAAgB;CAAE;AAC/C;;;AC7BA,IAAa,qBAAb,cAAwC,cAAc;CACpD,cAAc;EAAE,MAAM,KAAK,gCAAgC;CAAE;AAC/D;;;;;;ACwCA,SAAgB,mBAAmB,OAAmC;CACpE,MAAM,YAAY,MAAM,MAAM;CAE9B,IAAI,MAAM,WAAW,SAAS;EAE5B,MAAM,WADU,MAAM,QACG,IAAI,UAAU,KAAK;EAE5C,IAAI,SAAS,SAAS,eAAe,GAAG,OAAO,IAAI,kBAAkB;EACrE,IAAI,SAAS,SAAS,eAAe,GAAG,OAAO,IAAI,kBAAkB;EACrE,IAAI,SAAS,SAAS,mBAAmB,GAAG,OAAO,IAAI,kBAAkB;EACzE,IAAI,SAAS,SAAS,0BAA0B,GAAG,OAAO,IAAI,kBAAkB;EAChF,IAAI,SAAS,SAAS,uBAAuB,GAAG,OAAO,IAAI,UAAU,uBAAuB;EAC5F,IAAI,SAAS,SAAS,0BAA0B,GAAG,OAAO,IAAI,UAAU,0BAA0B;CACpG;CAEA,IAAI,CAAC,WACH,OAAO,IAAI,UAAU,kCAAkC;CAMzD,IAAI,cAAc,oBAAoB,cAAc,gBAAgB,OAAO,IAAI,kBAAkB;CACjG,IAAI,cAAc,wBAAwB,OAAO,IAAI,uBAAuB;CAG5E,IAAI,cAAc,6BAA6B,OAAO,IAAI,wBAAwB;CAClF,IAAI,cAAc,oBAAoB,OAAO,IAAI,qBAAqB;CACtE,IAAI,cAAc,iBAAiB,OAAO,IAAI,kBAAkB;CAGhE,IAAI,cAAc,qBAAqB,cAAc,qBAAqB,OAAO,IAAI,oBAAoB;CACzG,IAAI,cAAc,4BAA4B,OAAO,IAAI,UAAU,0BAA0B;CAC7F,IAAI,cAAc,yBAAyB,OAAO,IAAI,UAAU,4BAA4B;CAG5F,IAAI,cAAc,sBAAsB,OAAO,IAAI,sBAAsB;CACzE,IAAI,cAAc,4BAA4B,OAAO,IAAI,0BAA0B;CACnF,IAAI,cAAc,0BAA0B,OAAO,IAAI,0BAA0B;CACjF,IAAI,cAAc,kBAAkB,OAAO,IAAI,mBAAmB;CAGlE,IAAI,cAAc,sBAAsB,OAAO,IAAI,sBAAsB,CAAC;CAC1E,IAAI,cAAc,qBAAqB,OAAO,IAAI,qBAAqB,GAAG;CAG1E,IAAI,cAAc,yBAAyB,cAAc,yCACvD,OAAO,IAAI,0BAA0B;CAEvC,IAAI,cAAc,qBAAqB,OAAO,IAAI,qBAAqB;CACvE,IAAI,cAAc,gCAAgC,OAAO,IAAI,+BAA+B;CAC5F,IAAI,cAAc,iCAAiC,OAAO,IAAI,6BAA6B;CAG3F,IAAI,cAAc,yBAAyB,OAAO,IAAI,UAAU,uBAAuB;CACvF,IAAI,cAAc,yBAAyB,OAAO,IAAI,UAAU,uBAAuB;CACvF,IAAI,cAAc,2BAA2B,OAAO,IAAI,UAAU,8BAA8B;CAGhG,IAAI,cAAc,mCAAmC,cAAc,iCACjE,OAAO,IAAI,yBAAyB;CAEtC,IAAI,cAAc,sBAAsB,OAAO,IAAI,sBAAsB;CAGzE,IAAI,cAAc,0BAA0B,OAAO,IAAI,yBAAyB;CAChF,IAAI,cAAc,iBAAiB,OAAO,IAAI,kBAAkB;CAChE,IAAI,cAAc,iBAAiB,OAAO,IAAI,kBAAkB;CAGhE,IAAI,cAAc,+BAA+B,cAAc,wBAC7D,OAAO,IAAI,4BAA4B;CAIzC,IACE,cAAc,0BACX,cAAc,0BACd,cAAc,mCACd,cAAc,gCACd,cAAc,yBAEjB,OAAO,IAAI,wBAAwB;CAIrC,IACE,cAAc,oBACX,cAAc,4BACd,cAAc,uCAEjB,OAAO,IAAI,mBAAmB;CAIhC,IACE,cAAc,sBACX,cAAc,mBACd,cAAc,uBACd,cAAc,4BACd,cAAc,oCACd,cAAc,6CAEjB,OAAO,IAAI,0BAA0B;CAIvC,IAAI,cAAc,mCAAmC,cAAc,kCACjE,OAAO,IAAI,UAAU,0BAA0B;CAMjD,IAAI,cAAc,4BAA4B,cAAc,0BAC1D,OAAO,IAAI,0BAA0B;CAIvC,IACE,cAAc,sBACX,cAAc,8CACd,cAAc,oCAEjB,OAAO,IAAI,gCAAgC;CAI7C,IAAI,cAAc,0BAA0B,cAAc,iCACxD,OAAO,IAAI,oCAAoC;CAIjD,IACE,cAAc,iDACX,cAAc,wEAEjB,OAAO,IAAI,6CAA6C;CAI1D,IAAI,cAAc,oBAAoB,cAAc,kCAClD,OAAO,IAAI,8BAA8B;CAI3C,IAAI,cAAc,oBAAoB,cAAc,oBAClD,OAAO,IAAI,8BAA8B;CAI3C,IACE,cAAc,iCACX,cAAc,qCACd,cAAc,mDACd,cAAc,kDACd,cAAc,yBACd,cAAc,8BAEjB,OAAO,IAAI,0BAA0B;CAIvC,IACE,cAAc,0DACX,cAAc,kDACd,cAAc,2CACd,cAAc,8BACd,cAAc,+BACd,cAAc,kBAEjB,OAAO,IAAI,8BAA8B;CAI3C,IACE,cAAc,yDACX,cAAc,wDACd,cAAc,gCACd,cAAc,sCACd,cAAc,iCACd,cAAc,mCACd,cAAc,6BACd,cAAc,gCACd,cAAc,qDAEjB,OAAO,IAAI,4BAA4B;CAIzC,IACE,UAAU,WAAW,yBAAyB,KAC3C,cAAc,+CACd,cAAc,iDACd,cAAc,qDACd,cAAc,uBAEjB,OAAO,IAAI,kCAAkC;CAI/C,OAAO,IAAI,UAAU,kCAAkC;AACzD;;;;;;AAOA,SAAgB,WAAW,OAAmC;CAC5D,IAAI,iBAAiB,UAAU,OAAO;CAEtC,OACE,iBAAiB,SACd,MAAM,SAAS,cACf,YAAY,SACZ,gBAAgB;AAEvB;;;;;;;AC/PA,SAAgB,wBAAyD;CACvE,OAAO;EACL,OAAO;EACP,UAAU,UAAU;GAClB,IAAI,WAAW,KAAK,GAClB,MAAM,mBAAmB,KAAK;GAEhC,MAAM;EACR;CACF;AACF;;;;AAKA,MAAa,iBAAiB,OAAU,OAAqC;CAC3E,IAAI;EACF,OAAO,MAAM,GAAG;CAClB,SAAS,OAAO;EACd,IAAI,WAAW,KAAK,GAClB,MAAM,mBAAmB,KAAK;EAEhC,MAAM;CACR;AACF;;;ACFO,IAAA,cAAA,MAAM,YAAoE;CAIpC;CAH3C;CAEA,YACE,SACA;EADyC,KAAA,UAAA;CACxC;;;;CAKH,IAAI,OAAuB;EACzB,KAAK,kBAAkB,WAAW;GAC9B,GAAG,KAAK;GACR,YAAY,sBAAsB;EACtC,CAAC;EAED,OAAO,KAAK;CACd;AACF;0BAnBC,QAAQ,YAAY,GAAA,gBAAA,GAKhB,OAAO,YAAY,CAAA,CAAA,GAAA,WAAA;;;;ACoDjB,IAAA,aAAA,cAAA,MAAM,WAAwC;;;;;;;CAOnD,gBAAgB,QAAsB;EACpC,OAAO,IAAI,6BAA6B;CAC1C;;;;;;;;;;;CAYA,OAAO,aACL,SACe;EACf,MAAM,EAAE,kBAAkB;EAC1B,MAAM,aAAa,QAAQ,UAAU,CAAC;EACtC,MAAM,cAAc,QAAQ;EAE5B,MAAM,sBAAsB;GAC1B,SAAS;GACT,aAAa,WAAsB,GAAG,aAA2C;IAC/E,IAAI,MAAM,YAAY,GAAG,QAAQ;IAEjC,IAAI,eACF,MAAM;KACJ,GAAG;KACH,SAAS,CAAC,sBAAsB,aAAa,GAAG,GAAI,IAAI,WAAW,CAAC,CAAE;IACxE;IAOF,IAJ2B,UAAU,aACnC,oBAAoB,YAGD,GAAG;KACtB,MAAM,QAAQ,UAAU,QAA2B,oBAAoB,KAAK;KAC5E,MAAM,WAAW,UAAU,QAA6B,oBAAoB,QAAQ;KAEpF,MAAM;MACJ,GAAG;MACH,WAAW;OACT,SAAS;OACT,GAAG,IAAI;OACP,eAAe,IAAI,WAAW,iBAAiB,iCAAiC,KAAK;OACrF,aAAa;QACX,GAAG,mBAAmB,QAAQ;QAC9B,GAAI,IAAI,WAAW,eAAe,CAAC;OACrC;MACF;KACF;IACF;IAEA,OAAO;GACT;GACA,QAAQ,CAAC,iBAAiB,GAAG,UAAU;EACzC;EAEA,OAAO;GACL,QAAA;GACA,WAAW;IACT;IACA;KACE,SAAS;KACT,UAAU;IACZ;IACA,GAAI,gBACA,CACA;KAAE,SAAS,UAAU;KAAS,UAAU;IAAmC,GAC3E;KAAE,SAAS,UAAU;KAAe,UAAU;IAAc,CAC9D,IACE,CAAC;GACP;EACF;CACF;AACF;uCAvFC,OAAO,EACN,WAAW,CAAC,WAAW,EACzB,CAAC,CAAA,GAAA,UAAA"}

package/dist/{auth-context-HLwuOl51.mjs → auth-context-C8NBfiMa.mjs}

@@ -1,6 +1,7 @@
-import { t as __decorate } from "./decorate-DViXs-0l.mjs";
-import { n as UserNotAuthenticatedError, r as ContextNotInitializedError } from "./errors-B1vVXc1T.mjs";
-import { DI_TOKENS, Transient } from "stratal/di";
+import { t as __decorate } from "./decorate-B7nr7eBl.mjs";
+import { n as UserNotAuthenticatedError } from "./errors-BvJSaUTW.mjs";
+import { DI_TOKENS, Request } from "stratal/di";
+import { AuthError } from "stratal/errors";
 //#region src/context/auth-context.ts
 let AuthContext = class AuthContext {
 	user;
@@ -43,7 +44,7 @@ let AuthContext = class AuthContext {
 	* Get full authentication context or throw if not initialized.
 	*/
 	getAuthInfo() {
-		if (!this.user) throw new ContextNotInitializedError("Authentication");
+		if (!this.user) throw new AuthError("Auth context has not been initialized");
 		return { user: this.user };
 	}
 	/**
@@ -78,8 +79,8 @@ let AuthContext = class AuthContext {
 		this.user = void 0;
 	}
 };
-AuthContext = __decorate([Transient(DI_TOKENS.AuthContext)], AuthContext);
+AuthContext = __decorate([Request(DI_TOKENS.AuthContext)], AuthContext);
 //#endregion
 export { AuthContext as t };
 
-//# sourceMappingURL=auth-context-HLwuOl51.mjs.map
+//# sourceMappingURL=auth-context-C8NBfiMa.mjs.map

package/dist/auth-context-C8NBfiMa.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-context-C8NBfiMa.mjs","names":[],"sources":["../src/context/auth-context.ts"],"sourcesContent":["import type { BaseUser } from '@better-auth/core/db'\nimport { Request, DI_TOKENS } from 'stratal/di'\nimport { AuthError } from 'stratal/errors'\nimport {\n  UserNotAuthenticatedError\n} from './errors'\n\n/**\n * Authenticated user shape stored in {@link AuthContext}.\n *\n * Inherits Better Auth's base user fields. Apps whose schema stores\n * `firstName`/`lastName` instead of a `name` column should expose a `name`\n * via a ZenStack result extension (see\n * https://zenstack.dev/docs/orm/plugins/extending-orm-client#adding-fields-to-query-results)\n * so reads return a populated `name` for free.\n *\n * Augment via TypeScript module declaration to add app-specific fields. Match\n * the augmentation to whatever your Better Auth `user.additionalFields` /\n * plugins are configured to return:\n *\n * @example\n * ```ts\n * declare module '@stratal/framework/context' {\n *   interface AuthUser {\n *     role: string\n *     locale: string\n *   }\n * }\n * ```\n */\nexport interface AuthUser extends BaseUser {}\n\nexport interface AuthInfo {\n  user: AuthUser\n}\n\n@Request(DI_TOKENS.AuthContext)\nexport class AuthContext {\n  protected user?: AuthUser\n\n  /**\n   * Set authentication context.\n   * This should be called once per request with the authenticated user.\n   */\n  setAuthContext(info: AuthInfo): void {\n    this.user = info.user\n  }\n\n  /**\n   * Get the authenticated user if available.\n   * Returns undefined if no user is authenticated.\n   */\n  getUser(): AuthUser | undefined {\n    return this.user\n  }\n\n  /**\n   * Get the authenticated user or throw if not authenticated.\n   */\n  requireUser(): AuthUser {\n    if (!this.user) {\n      throw new UserNotAuthenticatedError()\n    }\n    return this.user\n  }\n\n  /**\n   * Get user ID if available.\n   * Returns undefined if no user is authenticated.\n   */\n  getUserId(): string | undefined {\n    return this.user?.id\n  }\n\n  /**\n   * Get user ID or throw if not authenticated.\n   * Use this when authentication is required.\n   */\n  requireUserId(): string {\n    return this.requireUser().id\n  }\n\n  /**\n   * Get full authentication context or throw if not initialized.\n   */\n  getAuthInfo(): AuthInfo {\n    if (!this.user) {\n      throw new AuthError('Auth context has not been initialized')\n    }\n    return { user: this.user }\n  }\n\n  /**\n   * Get the raw role string from the authenticated user.\n   *\n   * Reads from `user.role` — apps that use roles should augment {@link AuthUser}\n   * with `role: string` (or similar) so this returns a typed value.\n   */\n  getRole(): string | undefined {\n    return (this.user as { role?: string } | undefined)?.role\n  }\n\n  /**\n   * Get the user's roles as an array.\n   * Returns an empty array if no role is set or user is not authenticated.\n   */\n  getRoles(): string[] {\n    const role = this.getRole()\n    if (!role) return []\n    return role.split(',').map(r => r.trim()).filter(Boolean)\n  }\n\n  /**\n   * Check if user is authenticated.\n   */\n  isAuthenticated(): boolean {\n    return !!this.user\n  }\n\n  /**\n   * Clear authentication context.\n   * Useful for testing or cleanup.\n   */\n  clearAuthContext(): void {\n    this.user = undefined\n  }\n}\n"],"mappings":";;;;;AAqCO,IAAA,cAAA,MAAM,YAAY;CACvB;;;;;CAMA,eAAe,MAAsB;EACnC,KAAK,OAAO,KAAK;CACnB;;;;;CAMA,UAAgC;EAC9B,OAAO,KAAK;CACd;;;;CAKA,cAAwB;EACtB,IAAI,CAAC,KAAK,MACR,MAAM,IAAI,0BAA0B;EAEtC,OAAO,KAAK;CACd;;;;;CAMA,YAAgC;EAC9B,OAAO,KAAK,MAAM;CACpB;;;;;CAMA,gBAAwB;EACtB,OAAO,KAAK,YAAY,EAAE;CAC5B;;;;CAKA,cAAwB;EACtB,IAAI,CAAC,KAAK,MACR,MAAM,IAAI,UAAU,uCAAuC;EAE7D,OAAO,EAAE,MAAM,KAAK,KAAK;CAC3B;;;;;;;CAQA,UAA8B;EAC5B,OAAQ,KAAK,MAAwC;CACvD;;;;;CAMA,WAAqB;EACnB,MAAM,OAAO,KAAK,QAAQ;EAC1B,IAAI,CAAC,MAAM,OAAO,CAAC;EACnB,OAAO,KAAK,MAAM,GAAG,EAAE,KAAI,MAAK,EAAE,KAAK,CAAC,EAAE,OAAO,OAAO;CAC1D;;;;CAKA,kBAA2B;EACzB,OAAO,CAAC,CAAC,KAAK;CAChB;;;;;CAMA,mBAAyB;EACvB,KAAK,OAAO,KAAA;CACd;AACF;0BA1FC,QAAQ,UAAU,WAAW,CAAA,GAAA,WAAA"}

package/dist/{auth-context-DXSTlnQH.d.mts → auth-context-CGVbiSX3.d.mts}

@@ -82,4 +82,4 @@ declare class AuthContext {
 }
 //#endregion
 export { AuthInfo as n, AuthUser as r, AuthContext as t };
-//# sourceMappingURL=auth-context-DXSTlnQH.d.mts.map
+//# sourceMappingURL=auth-context-CGVbiSX3.d.mts.map

package/dist/auth-context-CGVbiSX3.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-context-CGVbiSX3.d.mts","names":[],"sources":["../src/context/auth-context.ts"],"mappings":";;;;;AA8BA;;;;AAA0C;AAE1C;;;;AACgB;AAGhB;;;;;;;;;;;UANiB,QAAA,SAAiB,QAAQ;AAAA,UAEzB,QAAA;EACf,IAAA,EAAM,QAAQ;AAAA;AAAA,cAIH,WAAA;EAAA,UACD,IAAA,GAAO,QAAA;EAqBF;;;;EAff,cAAA,CAAe,IAAA,EAAM,QAAA;EAsDrB;;;;EA9CA,OAAA,IAAW,QAAA;EAuEK;;;EAhEhB,WAAA,IAAe,QAAA;;;;;EAWf,SAAA;;;;;EAQA,aAAA;;;;EAOA,WAAA,IAAe,QAAA;;;;;;;EAaf,OAAA;;;;;EAQA,QAAA;;;;EASA,eAAA;;;;;EAQA,gBAAA;AAAA"}

package/dist/context/index.d.mts

@@ -1,20 +1,15 @@
-import { n as AuthInfo, r as AuthUser, t as AuthContext } from "../auth-context-DXSTlnQH.mjs";
-import { ApplicationError } from "stratal/errors";
+import { n as AuthInfo, r as AuthUser, t as AuthContext } from "../auth-context-CGVbiSX3.mjs";
+import { HttpException } from "stratal/errors";
 
-//#region src/context/errors/context-not-initialized.error.d.ts
-declare class ContextNotInitializedError extends ApplicationError {
-  constructor(contextType?: string);
-}
-//#endregion
 //#region src/context/errors/user-not-authenticated.error.d.ts
-declare class UserNotAuthenticatedError extends ApplicationError {
+declare class UserNotAuthenticatedError extends HttpException {
   constructor();
 }
 //#endregion
 //#region src/context/errors/user-not-authorized.error.d.ts
-declare class UserNotAuthorizedError extends ApplicationError {
+declare class UserNotAuthorizedError extends HttpException {
   constructor();
 }
 //#endregion
-export { AuthContext, AuthInfo, AuthUser, ContextNotInitializedError, UserNotAuthenticatedError, UserNotAuthorizedError };
+export { AuthContext, AuthInfo, AuthUser, UserNotAuthenticatedError, UserNotAuthorizedError };
 //# sourceMappingURL=index.d.mts.map

package/dist/context/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../../src/context/errors/context-not-initialized.error.ts","../../src/context/errors/user-not-authenticated.error.ts","../../src/context/errors/user-not-authorized.error.ts"],"mappings":";;;;cAEa,0BAAA,SAAmC,gBAAA;cAClC,WAAA;AAAA;;;cCDD,yBAAA,SAAkC,gBAAA;EAAA,WAAA,CAAA;AAAA;;;cCAlC,sBAAA,SAA+B,gBAAA;EAAA,WAAA,CAAA;AAAA"}
+{"version":3,"file":"index.d.mts","names":[],"sources":["../../src/context/errors/user-not-authenticated.error.ts","../../src/context/errors/user-not-authorized.error.ts"],"mappings":";;;;cAEa,yBAAA,SAAkC,aAAa;EAAb,WAAA;AAAA;;;cCAlC,sBAAA,SAA+B,aAAa;EAAb,WAAA;AAAA"}

package/dist/context/index.mjs

@@ -1,3 +1,3 @@
-import { n as UserNotAuthenticatedError, r as ContextNotInitializedError, t as UserNotAuthorizedError } from "../errors-B1vVXc1T.mjs";
-import { t as AuthContext } from "../auth-context-HLwuOl51.mjs";
-export { AuthContext, ContextNotInitializedError, UserNotAuthenticatedError, UserNotAuthorizedError };
+import { n as UserNotAuthenticatedError, t as UserNotAuthorizedError } from "../errors-BvJSaUTW.mjs";
+import { t as AuthContext } from "../auth-context-C8NBfiMa.mjs";
+export { AuthContext, UserNotAuthenticatedError, UserNotAuthorizedError };

package/dist/database/index.d.mts

@@ -1,3 +1,3 @@
-import { a as InferConnectionSchema, i as InferConnectionExtensions, n as DefaultConnectionName, o as InternalDatabaseEventContext, r as InferAnySchema, s as StratalDatabase, t as ConnectionName } from "../types-BZlcRR2M.mjs";
-import { A as DATABASE_TOKENS, C as UniqueConstraintError, D as DatabaseConfigError, E as ForeignKeyConstraintError, F as DatabaseModuleConfig, M as DatabaseService, N as DatabaseConnectionConfig, O as DatabaseError, P as DatabaseModule, S as fromZenStackError, T as InvalidErrorCodeRangeError, _ as EventPhase, a as DbPushCommand, b as ModelName, c as ZenStackCommand, d as EventEmitterPluginOptions, f as ErrorHandlerPlugin, g as DatabaseOperation, h as DatabaseEvents, i as MigrateDeployCommand, j as connectionSymbol, k as InjectDB, l as SchemaSwitcher, m as DatabaseEventName, n as MigrateResetCommand, o as DbPullCommand, p as databaseMessages, r as MigrateDevCommand, s as DbGenerateCommand, t as MigrateStatusCommand, u as EventEmitterPlugin, v as GetData, w as RecordNotFoundError, x as ParseEvent, y as GetResult } from "../index-CCDPF-1Y.mjs";
-export { ConnectionName, DATABASE_TOKENS, DatabaseConfigError, DatabaseConnectionConfig, DatabaseError, DatabaseEventName, DatabaseEvents, DatabaseModule, DatabaseModuleConfig, DatabaseOperation, DatabaseService, DbGenerateCommand, DbPullCommand, DbPushCommand, DefaultConnectionName, ErrorHandlerPlugin, EventEmitterPlugin, EventEmitterPluginOptions, EventPhase, ForeignKeyConstraintError, GetData, GetResult, InferAnySchema, InferConnectionExtensions, InferConnectionSchema, InjectDB, InternalDatabaseEventContext, InvalidErrorCodeRangeError, MigrateDeployCommand, MigrateDevCommand, MigrateResetCommand, MigrateStatusCommand, ModelName, ParseEvent, RecordNotFoundError, SchemaSwitcher, StratalDatabase, UniqueConstraintError, ZenStackCommand, connectionSymbol, databaseMessages, fromZenStackError };
+import { a as InferConnectionSchema, i as InferConnectionExtensions, n as DefaultConnectionName, o as InternalDatabaseEventContext, r as InferAnySchema, s as StratalDatabase, t as ConnectionName } from "../types-CWZ9q74G.mjs";
+import { A as DatabaseModule, C as UniqueConstraintError, D as connectionSymbol, E as DATABASE_TOKENS, O as DatabaseService, S as fromZenStackError, T as InjectDB, _ as EventPhase, a as DbPushCommand, b as ModelName, c as ZenStackCommand, d as EventEmitterPluginOptions, f as ErrorHandlerPlugin, g as DatabaseOperation, h as DatabaseEvents, i as MigrateDeployCommand, j as DatabaseModuleConfig, k as DatabaseConnectionConfig, l as SchemaSwitcher, m as DatabaseEventName, n as MigrateResetCommand, o as DbPullCommand, p as databaseMessages, r as MigrateDevCommand, s as DbGenerateCommand, t as MigrateStatusCommand, u as EventEmitterPlugin, v as GetData, w as RecordNotFoundError, x as ParseEvent, y as GetResult } from "../index-jILx9QXw.mjs";
+export { ConnectionName, DATABASE_TOKENS, DatabaseConnectionConfig, DatabaseEventName, DatabaseEvents, DatabaseModule, DatabaseModuleConfig, DatabaseOperation, DatabaseService, DbGenerateCommand, DbPullCommand, DbPushCommand, DefaultConnectionName, ErrorHandlerPlugin, EventEmitterPlugin, EventEmitterPluginOptions, EventPhase, GetData, GetResult, InferAnySchema, InferConnectionExtensions, InferConnectionSchema, InjectDB, InternalDatabaseEventContext, MigrateDeployCommand, MigrateDevCommand, MigrateResetCommand, MigrateStatusCommand, ModelName, ParseEvent, RecordNotFoundError, SchemaSwitcher, StratalDatabase, UniqueConstraintError, ZenStackCommand, connectionSymbol, databaseMessages, fromZenStackError };