@stratal/framework 0.0.27 → 0.1.0

package/dist/auth/index.d.mts

@@ -1,12 +1,11 @@
-import { t as AccessControlOptions } from "../types-DabF8LGz.mjs";
-import { r as AuthUser } from "../auth-context-CGVbiSX3.mjs";
+import { n as AccessControlOptions, t as AuthService } from "../auth.service-Onf3JkyL.mjs";
+import { r as AuthUser } from "../auth-context-C1om3Zsr.mjs";
 import { AsyncModuleOptions, DynamicModule } from "stratal/module";
 import { ApplicationError, HttpException } from "stratal/errors";
 import { Middleware, Next, RouteConfigurable, Router, RouterContext } from "stratal/router";
 import { LoggerService } from "stratal/logger";
 import { APIError } from "better-auth/api";
-import { Auth, BetterAuthOptions } from "better-auth";
-
+import { BetterAuthOptions } from "better-auth";
 //#region src/context/router-context.augment.d.ts
 declare module 'stratal/router' {
   interface RouterContext {
@@ -18,22 +17,26 @@ declare module 'stratal/router' {
      */
     user(): AuthUser;
   }
-} //# sourceMappingURL=router-context.augment.d.ts.map
+}
 //#endregion
 //#region src/auth/auth.module.d.ts
-interface AuthModuleAsyncOptions<TOptions extends BetterAuthOptions = BetterAuthOptions> extends AsyncModuleOptions<TOptions> {
+export interface AuthModuleAsyncOptions<TOptions extends BetterAuthOptions = BetterAuthOptions> extends AsyncModuleOptions<TOptions> {
   /**
    * Optional access control configuration.
    * When provided, registers AccessService and auto-adds the Stratal AC plugin to Better Auth.
    */
   accessControl?: AccessControlOptions;
 }
-declare class AuthModule implements RouteConfigurable {
+export declare class AuthModule implements RouteConfigurable {
   /**
    * Configure auth middleware globally.
    *
    * SessionVerificationMiddleware verifies the session and populates the
    * request-scoped AuthContext with the authenticated user.
+   *
+   * AccessShareMiddleware then shares the resulting roles and permissions to
+   * Inertia. Order matters: it reads what session verification wrote. Both
+   * no-op when their dependencies are absent.
    */
   configureRoutes(router: Router): void;
   /**
@@ -49,214 +52,213 @@ declare class AuthModule implements RouteConfigurable {
   static forRootAsync<TOptions extends BetterAuthOptions>(options: AuthModuleAsyncOptions<TOptions>): DynamicModule;
 }
 //#endregion
+//#region src/auth/middleware/session-verification.middleware.d.ts
+/**
+ * Session Verification Middleware
+ *
+ * Verifies user session via Better Auth and populates AuthContext with
+ * the authenticated user.
+ *
+ * **Responsibilities:**
+ * - Calls Better Auth's getSession() API
+ * - Populates AuthContext with the user record if the session is valid
+ * - Carries any cookie that read issued through to the response
+ * - Continues request chain regardless of session status
+ */
+export declare class SessionVerificationMiddleware implements Middleware {
+  private readonly authService;
+  private logger;
+  constructor(authService: AuthService, logger: LoggerService);
+  handle(ctx: RouterContext, next: Next): Promise<Response | void>;
+}
+//#endregion
+//#region src/auth/auth.primers.d.ts
+/**
+ * Middleware the response-cache gateway must run before resolving partitions.
+ *
+ * `ctx.user()` reads the request-scoped `AuthContext`, which
+ * `SessionVerificationMiddleware` populates. The gateway runs outside the
+ * app's middleware chain, so without this a partition resolver calling
+ * `ctx.user()` would throw `UserNotAuthenticatedError` on every request.
+ *
+ * Pass it alongside `gateway: { entrypoint }` — `primers` without a configured
+ * gateway is a boot error, because nothing would ever run the middleware
+ * listed here.
+ *
+ * The cost lands in the primer, not the accessor: `ctx.user()` is a memory
+ * read, while `SessionVerificationMiddleware` calls
+ * `authService.auth.api.getSession()`. On a cache **miss** that call happens
+ * twice — once in the gateway to resolve the partition, once in the app's own
+ * chain, since each runs in its own request scope. On a **hit** the app never
+ * runs, so only the gateway's single call is paid.
+ *
+ * @example
+ * ```typescript
+ * ResponseCacheModule.forRoot({
+ *   gateway: { entrypoint: 'Cached' },
+ *   primers: AUTH_GATEWAY_PRIMERS,
+ *   partitions: { user: (ctx) => ctx.user().id },
+ * })
+ * ```
+ */
+export declare const AUTH_GATEWAY_PRIMERS: readonly [typeof SessionVerificationMiddleware];
+//#endregion
 //#region src/auth/auth.tokens.d.ts
 /** Token for AuthService - core authentication service */
-declare const AUTH_SERVICE: unique symbol;
+export declare const AUTH_SERVICE: unique symbol;
 /** Token for Better Auth options configuration */
-declare const AUTH_OPTIONS: unique symbol;
+export declare const AUTH_OPTIONS: unique symbol;
 //#endregion
 //#region src/auth/errors/auth-errors.d.ts
-declare class UserNotFoundError extends HttpException {
+export declare class UserNotFoundError extends HttpException {
   readonly email?: string | undefined;
   constructor(email?: string | undefined);
 }
-declare class InvalidCredentialsError extends HttpException {
+export declare class InvalidCredentialsError extends HttpException {
   constructor();
 }
-declare class InvalidPasswordError extends HttpException {
+export declare class InvalidPasswordError extends HttpException {
   constructor();
 }
-declare class InvalidEmailError extends HttpException {
+export declare class InvalidEmailError extends HttpException {
   readonly email?: string | undefined;
   constructor(email?: string | undefined);
 }
-declare class SessionExpiredError extends HttpException {
+export declare class SessionExpiredError extends HttpException {
   constructor();
 }
-declare class FreshSessionRequiredError extends HttpException {
+export declare class FreshSessionRequiredError extends HttpException {
   constructor();
 }
-declare class EmailNotVerifiedError extends HttpException {
+export declare class EmailNotVerifiedError extends HttpException {
   readonly email?: string | undefined;
   constructor(email?: string | undefined);
 }
-declare class PasswordTooShortError extends HttpException {
+export declare class PasswordTooShortError extends HttpException {
   readonly minLength?: number | undefined;
   constructor(minLength?: number | undefined);
 }
-declare class PasswordTooLongError extends HttpException {
+export declare class PasswordTooLongError extends HttpException {
   readonly maxLength?: number | undefined;
   constructor(maxLength?: number | undefined);
 }
-declare class AccountAlreadyExistsError extends HttpException {
+export declare class AccountAlreadyExistsError extends HttpException {
   readonly email?: string | undefined;
   constructor(email?: string | undefined);
 }
-declare class SocialAccountLinkedError extends HttpException {
+export declare class SocialAccountLinkedError extends HttpException {
   readonly provider?: string | undefined;
   constructor(provider?: string | undefined);
 }
-declare class CannotUnlinkLastAccountError extends HttpException {
+export declare class CannotUnlinkLastAccountError extends HttpException {
   constructor();
 }
-declare class ProviderNotFoundError extends HttpException {
+export declare class ProviderNotFoundError extends HttpException {
   readonly provider?: string | undefined;
   constructor(provider?: string | undefined);
 }
-declare class UserEmailNotFoundError extends HttpException {
+export declare class UserEmailNotFoundError extends HttpException {
   constructor();
 }
-declare class AccountNotFoundError extends HttpException {
+export declare class AccountNotFoundError extends HttpException {
   constructor();
 }
-declare class CredentialAccountNotFoundError extends HttpException {
+export declare class CredentialAccountNotFoundError extends HttpException {
   constructor();
 }
-declare class UserAlreadyHasPasswordError extends HttpException {
+export declare class UserAlreadyHasPasswordError extends HttpException {
   constructor();
 }
-declare class EmailCannotBeUpdatedError extends HttpException {
+export declare class EmailCannotBeUpdatedError extends HttpException {
   readonly reason?: string | undefined;
   constructor(reason?: string | undefined);
 }
-declare class IdTokenNotSupportedError extends HttpException {
+export declare class IdTokenNotSupportedError extends HttpException {
   constructor();
 }
-declare class TokenExpiredError extends HttpException {
+export declare class TokenExpiredError extends HttpException {
   constructor();
 }
-declare class InvalidCallbackUrlError extends HttpException {
+export declare class InvalidCallbackUrlError extends HttpException {
   constructor();
 }
-declare class InvalidOriginError extends HttpException {
+export declare class InvalidOriginError extends HttpException {
   constructor();
 }
-declare class AuthValidationFailedError extends HttpException {
+export declare class AuthValidationFailedError extends HttpException {
   constructor();
 }
-declare class EmailAlreadyVerifiedError extends HttpException {
+export declare class EmailAlreadyVerifiedError extends HttpException {
   constructor();
 }
-declare class EmailMismatchError extends HttpException {
+export declare class EmailMismatchError extends HttpException {
   constructor();
 }
 //#endregion
 //#region src/auth/errors/invalid-token.error.d.ts
-declare class InvalidTokenError extends HttpException {
+export declare class InvalidTokenError extends HttpException {
   constructor();
 }
 //#endregion
 //#region src/auth/errors/organization-errors.d.ts
-declare class OrganizationNotFoundError extends HttpException {
+export declare class OrganizationNotFoundError extends HttpException {
   constructor();
 }
-declare class OrganizationMemberNotFoundError extends HttpException {
+export declare class OrganizationMemberNotFoundError extends HttpException {
   constructor();
 }
-declare class OrganizationInvitationNotFoundError extends HttpException {
+export declare class OrganizationInvitationNotFoundError extends HttpException {
   constructor();
 }
-declare class OrganizationPermissionDeniedError extends HttpException {
+export declare class OrganizationPermissionDeniedError extends HttpException {
   constructor();
 }
-declare class OrganizationInvitationRecipientMismatchError extends HttpException {
+export declare class OrganizationInvitationRecipientMismatchError extends HttpException {
   constructor();
 }
-declare class OrganizationConflictError extends HttpException {
+export declare class OrganizationConflictError extends HttpException {
   constructor();
 }
-declare class OrganizationLimitReachedError extends HttpException {
+export declare class OrganizationLimitReachedError extends HttpException {
   constructor();
 }
-declare class OrganizationMembershipError extends HttpException {
+export declare class OrganizationMembershipError extends HttpException {
   constructor();
 }
-declare class OrganizationTeamNotFoundError extends HttpException {
+export declare class OrganizationTeamNotFoundError extends HttpException {
   constructor();
 }
-declare class OrganizationRoleNotFoundError extends HttpException {
+export declare class OrganizationRoleNotFoundError extends HttpException {
   constructor();
 }
 //#endregion
 //#region src/auth/errors/token-required.error.d.ts
-declare class TokenRequiredError extends HttpException {
+export declare class TokenRequiredError extends HttpException {
   constructor();
 }
 //#endregion
-//#region src/auth/services/auth.service.d.ts
-/**
- * AuthService
- *
- * Base authentication service using Better Auth.
- * Configured via AuthModule.forRootAsync() from the application layer.
- *
- * **Extensibility:**
- * Extend this class to add custom methods. Subclasses inherit
- * `@Request(AUTH_SERVICE)` scope automatically — no decorator needed.
- *
- * @example
- * ```typescript
- * @Request(AUTH_SERVICE)
- * export class AppAuthService extends AuthService<AuthOptions> {
- *   async signInMagicLink(email: string) {
- *     return wrapBetterAuth(async () => {
- *       return this.auth.api.signInMagicLink({ body: { email }, headers: new Headers() })
- *     })
- *   }
- * }
- * ```
- */
-declare class AuthService<TOptions extends BetterAuthOptions = BetterAuthOptions> {
-  protected readonly options: TOptions;
-  private _authInstance?;
-  constructor(options: TOptions);
-  /**
-   * Get the Better Auth instance.
-   */
-  get auth(): Auth<TOptions>;
-}
-//#endregion
-//#region src/auth/middleware/session-verification.middleware.d.ts
-/**
- * Session Verification Middleware
- *
- * Verifies user session via Better Auth and populates AuthContext with
- * the authenticated user.
- *
- * **Responsibilities:**
- * - Calls Better Auth's getSession() API
- * - Populates AuthContext with the user record if the session is valid
- * - Continues request chain regardless of session status
- */
-declare class SessionVerificationMiddleware implements Middleware {
-  private readonly authService;
-  private logger;
-  constructor(authService: AuthService, logger: LoggerService);
-  handle(ctx: RouterContext, next: Next): Promise<void>;
-}
-//#endregion
 //#region src/auth/utils/auth-helpers.d.ts
 /**
  * Get shared Better Auth error handler configuration.
  * Use this in Better Auth config's onAPIError option.
  */
-declare function getErrorHandlerConfig(): BetterAuthOptions['onAPIError'];
+export declare function getErrorHandlerConfig(): BetterAuthOptions['onAPIError'];
 /**
  * Wrap a Better Auth function in a try/catch block and map errors to ApplicationError.
  */
-declare const wrapBetterAuth: <T>(fn: () => Promise<T>) => Promise<T>;
+export declare const wrapBetterAuth: <T>(fn: () => Promise<T>) => Promise<T>;
 //#endregion
 //#region src/auth/utils/better-auth-error-handler.d.ts
 /**
  * Maps Better Auth API error codes to ApplicationError instances.
  */
-declare function mapBetterAuthError(error: APIError): ApplicationError;
+export declare function mapBetterAuthError(error: APIError): ApplicationError;
 /**
  * Type guard to check if an error is a Better Auth APIError.
  * Uses duck typing to handle bundler environments (e.g. Vite)
  * where instanceof may fail across module boundaries.
  */
-declare function isAPIError(error: unknown): error is APIError;
+export declare function isAPIError(error: unknown): error is APIError;
 //#endregion
-export { AUTH_OPTIONS, AUTH_SERVICE, AccountAlreadyExistsError, AccountNotFoundError, AuthModule, AuthModuleAsyncOptions, AuthService, AuthValidationFailedError, CannotUnlinkLastAccountError, CredentialAccountNotFoundError, EmailAlreadyVerifiedError, EmailCannotBeUpdatedError, EmailMismatchError, EmailNotVerifiedError, FreshSessionRequiredError, IdTokenNotSupportedError, InvalidCallbackUrlError, InvalidCredentialsError, InvalidEmailError, InvalidOriginError, InvalidPasswordError, InvalidTokenError, OrganizationConflictError, OrganizationInvitationNotFoundError, OrganizationInvitationRecipientMismatchError, OrganizationLimitReachedError, OrganizationMemberNotFoundError, OrganizationMembershipError, OrganizationNotFoundError, OrganizationPermissionDeniedError, OrganizationRoleNotFoundError, OrganizationTeamNotFoundError, PasswordTooLongError, PasswordTooShortError, ProviderNotFoundError, SessionExpiredError, SessionVerificationMiddleware, SocialAccountLinkedError, TokenExpiredError, TokenRequiredError, UserAlreadyHasPasswordError, UserEmailNotFoundError, UserNotFoundError, getErrorHandlerConfig, isAPIError, mapBetterAuthError, wrapBetterAuth };
+export { AuthService };
 //# sourceMappingURL=index.d.mts.map

package/dist/auth/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../../src/context/router-context.augment.ts","../../src/auth/auth.module.ts","../../src/auth/auth.tokens.ts","../../src/auth/errors/auth-errors.ts","../../src/auth/errors/invalid-token.error.ts","../../src/auth/errors/organization-errors.ts","../../src/auth/errors/token-required.error.ts","../../src/auth/services/auth.service.ts","../../src/auth/middleware/session-verification.middleware.ts","../../src/auth/utils/auth-helpers.ts","../../src/auth/utils/better-auth-error-handler.ts"],"mappings":";;;;;;;;;;;YAaY,aAAA;;;;;;;IAOR,IAAA,IAAQ,QAAQ;EAAA;AAAA;;;UCqDH,sBAAA,kBAAwC,iBAAA,GAAoB,iBAAA,UACnE,kBAAA,CAAmB,QAAA;EAWuB;;;;EANlD,aAAA,GAAgB,oBAAA;AAAA;AAAA,cAML,UAAA,YAAsB,iBAAA;EAqBI;;;;;;EAdrC,eAAA,CAAgB,MAAA,EAAQ,MAAA;;;;AC3F1B;;;;AAA8D;AAG9D;;SDsGS,YAAA,kBAA8B,iBAAA,EACnC,OAAA,EAAS,sBAAA,CAAuB,QAAA,IAC/B,aAAA;AAAA;;;;cC3GQ,YAAA;;cAGA,YAAA;;;cCFA,iBAAA,SAA0B,aAAa;EAAA,SACtB,KAAA;cAAA,KAAA;AAAA;AAAA,cAKjB,uBAAA,SAAgC,aAAa;EAAb,WAAA;AAAA;AAAA,cAIhC,oBAAA,SAA6B,aAAa;EAAb,WAAA;AAAA;AAAA,cAI7B,iBAAA,SAA0B,aAAa;EAAA,SACtB,KAAA;cAAA,KAAA;AAAA;AAAA,cAKjB,mBAAA,SAA4B,aAAa;EAAb,WAAA;AAAA;AAAA,cAI5B,yBAAA,SAAkC,aAAa;EAAb,WAAA;AAAA;AAAA,cAIlC,qBAAA,SAA8B,aAAa;EAAA,SAC1B,KAAA;cAAA,KAAA;AAAA;AAAA,cAKjB,qBAAA,SAA8B,aAAa;EAAA,SAC1B,SAAA;cAAA,SAAA;AAAA;AAAA,cAKjB,oBAAA,SAA6B,aAAa;EAAA,SACzB,SAAA;cAAA,SAAA;AAAA;AAAA,cAKjB,yBAAA,SAAkC,aAAa;EAAA,SAC9B,KAAA;cAAA,KAAA;AAAA;AAAA,cAKjB,wBAAA,SAAiC,aAAa;EAAA,SAC7B,QAAA;cAAA,QAAA;AAAA;AAAA,cAKjB,4BAAA,SAAqC,aAAa;EAAb,WAAA;AAAA;AAAA,cAIrC,qBAAA,SAA8B,aAAa;EAAA,SAC1B,QAAA;cAAA,QAAA;AAAA;AAAA,cAKjB,sBAAA,SAA+B,aAAa;EAAb,WAAA;AAAA;AAAA,cAI/B,oBAAA,SAA6B,aAAa;EAAb,WAAA;AAAA;AAAA,cAI7B,8BAAA,SAAuC,aAAa;EAAb,WAAA;AAAA;AAAA,cAIvC,2BAAA,SAAoC,aAAa;EAAb,WAAA;AAAA;AAAA,cAIpC,yBAAA,SAAkC,aAAa;EAAA,SAC9B,MAAA;cAAA,MAAA;AAAA;AAAA,cAKjB,wBAAA,SAAiC,aAAa;EAAb,WAAA;AAAA;AAAA,cAIjC,iBAAA,SAA0B,aAAa;EAAb,WAAA;AAAA;AAAA,cAI1B,uBAAA,SAAgC,aAAa;EAAb,WAAA;AAAA;AAAA,cAIhC,kBAAA,SAA2B,aAAa;EAAb,WAAA;AAAA;AAAA,cAI3B,yBAAA,SAAkC,aAAa;EAAb,WAAA;AAAA;AAAA,cAIlC,yBAAA,SAAkC,aAAa;EAAb,WAAA;AAAA;AAAA,cAIlC,kBAAA,SAA2B,aAAa;EAAb,WAAA;AAAA;;;cClH3B,iBAAA,SAA0B,aAAa;EAAb,WAAA;AAAA;;;cCA1B,yBAAA,SAAkC,aAAa;EAAb,WAAA;AAAA;AAAA,cAGlC,+BAAA,SAAwC,aAAa;EAAb,WAAA;AAAA;AAAA,cAGxC,mCAAA,SAA4C,aAAa;EAAb,WAAA;AAAA;AAAA,cAG5C,iCAAA,SAA0C,aAAa;EAAb,WAAA;AAAA;AAAA,cAG1C,4CAAA,SAAqD,aAAa;EAAb,WAAA;AAAA;AAAA,cAGrD,yBAAA,SAAkC,aAAa;EAAb,WAAA;AAAA;AAAA,cAGlC,6BAAA,SAAsC,aAAa;EAAb,WAAA;AAAA;AAAA,cAGtC,2BAAA,SAAoC,aAAa;EAAb,WAAA;AAAA;AAAA,cAGpC,6BAAA,SAAsC,aAAa;EAAb,WAAA;AAAA;AAAA,cAGtC,6BAAA,SAAsC,aAAa;EAAb,WAAA;AAAA;;;cC3BtC,kBAAA,SAA2B,aAAa;EAAb,WAAA;AAAA;;;;;;;;;;;;ANQmB;;;;;;;;;AAUvC;;;;cOSP,WAAA,kBAA6B,iBAAA,GAAoB,iBAAA;EAAA,mBAIjB,OAAA,EAAS,QAAA;EAAA,QAH5C,aAAA;cAGmC,OAAA,EAAS,QAAA;ENwCuB;;;EAAA,IMlCvE,IAAA,IAAQ,IAAA,CAAK,QAAA;AAAA;;;;;;;;;;AP7BwC;;;;cQS9C,6BAAA,YAAyC,UAAA;EAAA,iBAGjC,WAAA;EAAA,QAC4B,MAAA;cAD5B,WAAA,EAAa,WAAA,EACe,MAAA,EAAQ,aAAA;EAGjD,MAAA,CAAO,GAAA,EAAK,aAAA,EAAe,IAAA,EAAM,IAAA,GAAO,OAAA;AAAA;;;;;;;iBCnBhC,qBAAA,IAAyB,iBAAiB;;;;cAe7C,cAAA,MAA2B,EAAA,QAAU,OAAA,CAAQ,CAAA,MAAK,OAAA,CAAQ,CAAA;;;;;;iBCuBvD,kBAAA,CAAmB,KAAA,EAAO,QAAA,GAAW,gBAAgB;;;;;AVnCV;iBUqP3C,UAAA,CAAW,KAAA,YAAiB,KAAA,IAAS,QAAQ"}
+{"version":3,"file":"index.d.mts","names":[],"sources":["../../src/context/router-context.augment.ts","../../src/auth/auth.module.ts","../../src/auth/middleware/session-verification.middleware.ts","../../src/auth/auth.primers.ts","../../src/auth/auth.tokens.ts","../../src/auth/errors/auth-errors.ts","../../src/auth/errors/invalid-token.error.ts","../../src/auth/errors/organization-errors.ts","../../src/auth/errors/token-required.error.ts","../../src/auth/utils/auth-helpers.ts","../../src/auth/utils/better-auth-error-handler.ts"],"mappings":";;;;;;;;;;YAaY;;;;;;;IAOR,QAAQ;;;;;iBCsDK,uBAAuB,iBAAiB,oBAAoB,2BACnE,mBAAmB;;;;;EAK3B,gBAAgB;;qBAML,sBAAsB;;;;;;;;;;;EAWjC,gBAAgB,QAAQ;;;;;;;;;;;SAejB,aAAa,iBAAiB,mBACnC,SAAS,uBAAuB,YAC/B;;;;;;;;;;;;;;;;qBCxFQ,yCAAyC;mBAGjC;UAC4B;EAH/C,YAEmB,aAAa,aACe,QAAQ;EAGjD,OAAO,KAAK,eAAe,MAAM,OAAO,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qBCH3C,uCAAoB;;;;qBC7BpB;;qBAGA;;;qBCFA,0BAA0B;WACT;EAA5B,YAA4B;;qBAKjB,gCAAgC;EAC3C;;qBAGW,6BAA6B;EACxC;;qBAGW,0BAA0B;WACT;EAA5B,YAA4B;;qBAKjB,4BAA4B;EACvC;;qBAGW,kCAAkC;EAC7C;;qBAGW,8BAA8B;WACb;EAA5B,YAA4B;;qBAKjB,8BAA8B;WACb;EAA5B,YAA4B;;qBAKjB,6BAA6B;WACZ;EAA5B,YAA4B;;qBAKjB,kCAAkC;WACjB;EAA5B,YAA4B;;qBAKjB,iCAAiC;WAChB;EAA5B,YAA4B;;qBAKjB,qCAAqC;EAChD;;qBAGW,8BAA8B;WACb;EAA5B,YAA4B;;qBAKjB,+BAA+B;EAC1C;;qBAGW,6BAA6B;EACxC;;qBAGW,uCAAuC;EAClD;;qBAGW,oCAAoC;EAC/C;;qBAGW,kCAAkC;WACjB;EAA5B,YAA4B;;qBAKjB,iCAAiC;EAC5C;;qBAGW,0BAA0B;EACrC;;qBAGW,gCAAgC;EAC3C;;qBAGW,2BAA2B;EACtC;;qBAGW,kCAAkC;EAC7C;;qBAGW,kCAAkC;EAC7C;;qBAGW,2BAA2B;EACtC;;;;qBCnHW,0BAA0B;EACrC;;;;qBCDW,kCAAkC;EAC7C;;qBAEW,wCAAwC;EACnD;;qBAEW,4CAA4C;EACvD;;qBAEW,0CAA0C;EACrD;;qBAEW,qDAAqD;EAChE;;qBAEW,kCAAkC;EAC7C;;qBAEW,sCAAsC;EACjD;;qBAEW,oCAAoC;EAC/C;;qBAEW,sCAAsC;EACjD;;qBAEW,sCAAsC;EACjD;;;;qBC5BW,2BAA2B;EACtC;;;;;;;;wBCIc,yBAAyB;;;;qBAe5B,iBAAwB,GAAC,UAAY,QAAQ,OAAK,QAAQ;;;;;;wBCuBvD,mBAAmB,OAAO,WAAW;;;;;;wBAkNrC,WAAW,iBAAiB,SAAS"}

package/dist/auth/index.mjs

@@ -1,12 +1,13 @@
-import { n as createStratalAcPlugin, t as AccessService } from "../access.service-BmDhE-re.mjs";
-import { n as AC_TOKENS, t as __decorateParam } from "../decorateParam-DwV9LSPl.mjs";
-import { t as __decorate } from "../decorate-B7nr7eBl.mjs";
-import { t as AuthContext } from "../auth-context-C8NBfiMa.mjs";
+import { n as AC_TOKENS, t as __decorateParam } from "../decorateParam-xwTkq9gO.mjs";
+import { t as __decorate } from "../decorate-RQD1h28J.mjs";
+import { a as AccessShareMiddleware, i as createStratalAcPlugin, n as AUTH_OPTIONS, r as AUTH_SERVICE, t as AccessService } from "../access.service-BjmnWBEo.mjs";
+import { t as AuthContext } from "../auth-context-cNSS1rmh.mjs";
 import { CONTAINER_TOKEN, DI_TOKENS, Request, Transient, inject } from "stratal/di";
 import { Module } from "stratal/module";
 import { RATE_LIMITER_TOKENS, RateLimiterRegistry } from "stratal/rate-limiter";
 import { AuthError, HttpException } from "stratal/errors";
 import { RouterContext } from "stratal/router";
+import { parseSetCookieHeader } from "better-auth/cookies";
 import { LOGGER_TOKENS } from "stratal/logger";
 import { betterAuth } from "better-auth/minimal";
 import { APIError } from "better-auth/api";
@@ -23,13 +24,11 @@ RouterContext.macro("user", function() {
 	return this.getContainer().resolve(DI_TOKENS.AuthContext).requireUser();
 });
 //#endregion
-//#region src/auth/auth.tokens.ts
-/** Token for AuthService - core authentication service */
-const AUTH_SERVICE = Symbol.for("stratal:auth:service");
-/** Token for Better Auth options configuration */
-const AUTH_OPTIONS = Symbol.for("stratal:auth:options");
-//#endregion
 //#region src/auth/middleware/session-verification.middleware.ts
+/** Every cookie name a `Set-Cookie` value assigns, read with Better Auth's own parser. */
+function namesIn(setCookie) {
+	return [...parseSetCookieHeader(setCookie).keys()];
+}
 let SessionVerificationMiddleware = class SessionVerificationMiddleware {
 	authService;
 	logger;
@@ -38,13 +37,45 @@ let SessionVerificationMiddleware = class SessionVerificationMiddleware {
 		this.logger = logger;
 	}
 	async handle(ctx, next) {
+		/**
+		* The cookies Better Auth wrote while reading the session.
+		*
+		* Reading one is not always free of side effects: under `session.cookieCache`
+		* it mints the cached-session cookie, and once past `session.updateAge` it
+		* reissues the session cookie against the extended expiry. Both are `Set-Cookie`
+		* on a response Better Auth builds internally, which is discarded unless asked
+		* for — so left unforwarded, the cache is written on every request and read on
+		* none, and a sliding expiry never reaches the browser at all.
+		*/
+		let issued = [];
 		try {
-			const result = await this.authService.auth.api.getSession({ headers: ctx.c.req.raw.headers });
-			if (result) ctx.getContainer().resolve(DI_TOKENS.AuthContext).setAuthContext({ user: result.user });
+			const { headers, response } = await this.authService.auth.api.getSession({
+				headers: ctx.c.req.raw.headers,
+				returnHeaders: true
+			});
+			if (response) ctx.getContainer().resolve(DI_TOKENS.AuthContext).setAuthContext({ user: response.user });
+			issued = headers.getSetCookie();
 		} catch (error) {
 			this.logger.debug("Session validation failed (e.g., invalidated in DB)", { error });
 		}
-		return next();
+		await next();
+		if (issued.length === 0) return;
+		const status = ctx.c.res?.status;
+		if (typeof status !== "number" || status < 200 || status > 599) return;
+		/**
+		* A name the handler has already spoken for, which this must not overwrite.
+		*
+		* Sign-out is the case that makes this load-bearing rather than tidy. The session
+		* is still valid when it is read, so a cached-session cookie can be minted on the
+		* way in; the handler then clears that same cookie on the way out. Appending
+		* afterwards would put it back — a signed-out browser holding a cached session,
+		* which is the one thing the cache must never survive.
+		*/
+		const spokenFor = new Set(ctx.c.res.headers.getSetCookie().flatMap(namesIn));
+		for (const cookie of issued) {
+			if (namesIn(cookie).some((name) => spokenFor.has(name))) continue;
+			ctx.c.header("set-cookie", cookie, { append: true });
+		}
 	}
 };
 SessionVerificationMiddleware = __decorate([
@@ -95,22 +126,54 @@ RateLimiterRegistry.macro("forPath", function(path, resolver) {
 RateLimiterRegistry.macro("pathEntries", function() {
 	return (pathResolvers.get(this) ?? /* @__PURE__ */ new Map()).entries();
 });
-const BETTER_AUTH_TTL_SECONDS = 86400;
 const BETTER_AUTH_KEY_PREFIX = "ba-rl:";
 /**
 * Adapt Stratal's `IRateLimiterStore` into better-auth's `customStorage` shape.
-* Better-auth supplies its own `RateLimit` records (`{ key, count, lastRequest }`);
-* the adapter just persists them under a separate key namespace.
+*
+* Better-auth requires a single atomic `consume(key, rule)` rather than the
+* separate `get`/`set` pair it used to accept, because a split read and write
+* cannot hold a limit under concurrent requests. `IRateLimiterStore` is a plain
+* typed KV with no compare-and-set, so this is better-auth's documented
+* read-decide-write fallback for backends lacking an atomic primitive, and the
+* decision below mirrors their reference implementation exactly.
+*
+* Accuracy therefore follows the configured store, and matches what Stratal's
+* own throttling already does on the same backend: exact on
+* `InMemoryRateLimiterStore` (read-decide-write is atomic in a single isolate),
+* best-effort on `KvRateLimiterStore`, where concurrent writes from different
+* edge locations may undercount. Register a Durable Object store for strict
+* accuracy across edges — the same escape hatch the KV store documents.
 */
 function createBetterAuthRateLimitStorage(store) {
-	return {
-		async get(key) {
-			return await store.get(`${BETTER_AUTH_KEY_PREFIX}${key}`);
-		},
-		async set(key, value, _update) {
-			await store.set(`${BETTER_AUTH_KEY_PREFIX}${key}`, value, BETTER_AUTH_TTL_SECONDS);
+	return { async consume(key, rule) {
+		const storageKey = `${BETTER_AUTH_KEY_PREFIX}${key}`;
+		const windowMs = rule.window * 1e3;
+		const now = Date.now();
+		const record = await store.get(storageKey);
+		const write = async (count, lastRequest) => {
+			await store.set(storageKey, {
+				key,
+				count,
+				lastRequest
+			}, rule.window);
+		};
+		if (!record || now - record.lastRequest >= windowMs) {
+			await write(1, now);
+			return {
+				allowed: true,
+				retryAfter: null
+			};
 		}
-	};
+		if (record.count >= rule.max) return {
+			allowed: false,
+			retryAfter: Math.ceil((record.lastRequest + windowMs - now) / 1e3)
+		};
+		await write(record.count + 1, now);
+		return {
+			allowed: true,
+			retryAfter: null
+		};
+	} };
 }
 /**
 * Project every `forPath` entry on the registry into better-auth's
@@ -471,9 +534,14 @@ let AuthModule = _AuthModule = class AuthModule {
 	*
 	* SessionVerificationMiddleware verifies the session and populates the
 	* request-scoped AuthContext with the authenticated user.
+	*
+	* AccessShareMiddleware then shares the resulting roles and permissions to
+	* Inertia. Order matters: it reads what session verification wrote. Both
+	* no-op when their dependencies are absent.
 	*/
 	configureRoutes(router) {
 		router.use(SessionVerificationMiddleware);
+		router.use(AccessShareMiddleware);
 	}
 	/**
 	* Configure AuthModule with async options factory.
@@ -538,6 +606,37 @@ let AuthModule = _AuthModule = class AuthModule {
 };
 AuthModule = _AuthModule = __decorate([Module({ providers: [AuthContext] })], AuthModule);
 //#endregion
-export { AUTH_OPTIONS, AUTH_SERVICE, AccountAlreadyExistsError, AccountNotFoundError, AuthModule, AuthService, AuthValidationFailedError, CannotUnlinkLastAccountError, CredentialAccountNotFoundError, EmailAlreadyVerifiedError, EmailCannotBeUpdatedError, EmailMismatchError, EmailNotVerifiedError, FreshSessionRequiredError, IdTokenNotSupportedError, InvalidCallbackUrlError, InvalidCredentialsError, InvalidEmailError, InvalidOriginError, InvalidPasswordError, InvalidTokenError, OrganizationConflictError, OrganizationInvitationNotFoundError, OrganizationInvitationRecipientMismatchError, OrganizationLimitReachedError, OrganizationMemberNotFoundError, OrganizationMembershipError, OrganizationNotFoundError, OrganizationPermissionDeniedError, OrganizationRoleNotFoundError, OrganizationTeamNotFoundError, PasswordTooLongError, PasswordTooShortError, ProviderNotFoundError, SessionExpiredError, SessionVerificationMiddleware, SocialAccountLinkedError, TokenExpiredError, TokenRequiredError, UserAlreadyHasPasswordError, UserEmailNotFoundError, UserNotFoundError, getErrorHandlerConfig, isAPIError, mapBetterAuthError, wrapBetterAuth };
+//#region src/auth/auth.primers.ts
+/**
+* Middleware the response-cache gateway must run before resolving partitions.
+*
+* `ctx.user()` reads the request-scoped `AuthContext`, which
+* `SessionVerificationMiddleware` populates. The gateway runs outside the
+* app's middleware chain, so without this a partition resolver calling
+* `ctx.user()` would throw `UserNotAuthenticatedError` on every request.
+*
+* Pass it alongside `gateway: { entrypoint }` — `primers` without a configured
+* gateway is a boot error, because nothing would ever run the middleware
+* listed here.
+*
+* The cost lands in the primer, not the accessor: `ctx.user()` is a memory
+* read, while `SessionVerificationMiddleware` calls
+* `authService.auth.api.getSession()`. On a cache **miss** that call happens
+* twice — once in the gateway to resolve the partition, once in the app's own
+* chain, since each runs in its own request scope. On a **hit** the app never
+* runs, so only the gateway's single call is paid.
+*
+* @example
+* ```typescript
+* ResponseCacheModule.forRoot({
+*   gateway: { entrypoint: 'Cached' },
+*   primers: AUTH_GATEWAY_PRIMERS,
+*   partitions: { user: (ctx) => ctx.user().id },
+* })
+* ```
+*/
+const AUTH_GATEWAY_PRIMERS = [SessionVerificationMiddleware];
+//#endregion
+export { AUTH_GATEWAY_PRIMERS, AUTH_OPTIONS, AUTH_SERVICE, AccountAlreadyExistsError, AccountNotFoundError, AuthModule, AuthService, AuthValidationFailedError, CannotUnlinkLastAccountError, CredentialAccountNotFoundError, EmailAlreadyVerifiedError, EmailCannotBeUpdatedError, EmailMismatchError, EmailNotVerifiedError, FreshSessionRequiredError, IdTokenNotSupportedError, InvalidCallbackUrlError, InvalidCredentialsError, InvalidEmailError, InvalidOriginError, InvalidPasswordError, InvalidTokenError, OrganizationConflictError, OrganizationInvitationNotFoundError, OrganizationInvitationRecipientMismatchError, OrganizationLimitReachedError, OrganizationMemberNotFoundError, OrganizationMembershipError, OrganizationNotFoundError, OrganizationPermissionDeniedError, OrganizationRoleNotFoundError, OrganizationTeamNotFoundError, PasswordTooLongError, PasswordTooShortError, ProviderNotFoundError, SessionExpiredError, SessionVerificationMiddleware, SocialAccountLinkedError, TokenExpiredError, TokenRequiredError, UserAlreadyHasPasswordError, UserEmailNotFoundError, UserNotFoundError, getErrorHandlerConfig, isAPIError, mapBetterAuthError, wrapBetterAuth };
 
 //# sourceMappingURL=index.mjs.map