@suluk/better-auth 0.2.1 → 0.3.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@suluk/better-auth",
-  "version": "0.2.1",
+  "version": "0.3.0",
   "description": "Official Better-Auth-on-Hono support for Suluk: auth methods -> v4 securitySchemes; ingest Better Auth's OpenAPI 3.0 -> v4; session -> principal for per-viewer docs. CANDIDATE tooling.",
   "publishConfig": {
     "access": "public"
@@ -20,7 +20,7 @@
   },
   "dependencies": {
     "@suluk/core": "^0.1.13",
-    "@suluk/openapi-compat": "^0.1.3"
+    "@suluk/openapi-compat": "^0.1.4"
   },
   "peerDependencies": {
     "better-auth": "^1.0.0",
@@ -36,7 +36,7 @@
   },
   "devDependencies": {
     "@types/bun": "latest",
-    "@suluk/hono": "^0.1.5"
+    "@suluk/hono": "^0.3.0"
   },
   "scripts": {
     "test": "bun test",

package/src/index.ts

@@ -11,7 +11,7 @@ export { authSecuritySchemes, type AuthMethods, type AuthSecurity } from "./secu
 export { normalizeOas30, ingestAuthOpenAPI, mergeAuth, type IngestOptions } from "./ingest";
 export {
   principalFromSession, MFA_SCOPE, mcpConnectionKeyId, orgScope, parseOrgScope,
-  type Principal, type SessionLike, type PrincipalOptions,
+  type Principal, type SessionLike, type PrincipalOptions, type AppVars,
 } from "./principal";
 export { mountAuth, type AuthHandlerLike, type HonoLike, type MountAuthOptions } from "./mount";
 // scope-aware API-key verification (Phase 0): wraps Better Auth's verifyApiKey to return a { scopes } Principal,
@@ -30,3 +30,6 @@ export { previewLoginHandler, isPreviewRuntime, type PreviewRequestLike, type Pr
 // C057 local-dev any-email login (the Google mock when no GOOGLE_CLIENT_ID) — fail-closed behind an `armed` flag, mints
 // a REAL session via the public signUp/signIn API. The registry arms it only in dev-mock mode; a prod deploy 404s it.
 export { devLoginHandler, DEV_LOGIN_PASSWORD, type DevLoginAuthLike, type DevLoginOptions } from "./dev-login";
+// Provider FEE weights — Google OAuth is free ($0); the real per-login cost is D1 infra. AUTH_WEIGHTS carries `google.oauth`
+// at 0 for observability + as the paid-Google-API extension point. Merge into the app's table (see @suluk/cost mergeWeights).
+export { AUTH_WEIGHTS, GOOGLE_OAUTH_MICRO_USD } from "./weights";

package/src/principal.ts

@@ -8,6 +8,16 @@ export interface Principal {
   scopes: string[];
 }
 
+/** The Hono context Variables the auth middleware POPULATES per `/api/*` request — the resolved caller (`c.get("user")`,
+ *  `c.var.scopes`, and the api-key id/name for a keyed caller). A module that READS the auth-set principal (e.g. `mcp`)
+ *  types its context off THIS shared shape instead of importing the app's `../auth` — so it needs no sibling import. */
+export interface AppVars {
+  user?: { id: string; email?: string };
+  scopes?: string[];
+  keyId?: string;
+  keyName?: string;
+}
+
 /** A minimal view of a Better Auth session (duck-typed; works with the real Session shape). */
 export interface SessionLike {
   user?: { role?: string | string[]; scopes?: string[] } | null;

package/src/weights.ts

@@ -0,0 +1,16 @@
+/**
+ * GOOGLE / better-auth WEIGHTS — the cost of authenticating, contributed to the token weight table (the provider analogue
+ * of @suluk/cloudflare's infra weights). Google Sign-In (OAuth) is FREE and better-auth is self-hosted, so the third-party
+ * fee is $0. The REAL per-login cost is the D1 session read/write — declare THAT as infra (`d1.write` / `d1.read`), which
+ * the bubbled-up Cloudflare weights price. `google.oauth` is carried at 0 for OBSERVABILITY (a login route can mark that it
+ * calls Google, so the cost trace names the dependency) and as the extension point for a PAID Google API (Maps, Places, …)
+ * should one ever be wired — set its weight here and every route that declares it reprices automatically.
+ *
+ * Merge `AUTH_WEIGHTS` into the app's weight table (see @suluk/cost `mergeWeights`). Pure data — no runtime dependency.
+ */
+
+/** Google OAuth / Sign-In fee: $0 (free). Kept as a declared meter for observability + as the paid-Google-API extension point. */
+export const GOOGLE_OAUTH_MICRO_USD = 0;
+
+/** The provider fee weights for auth (meter → µ$/unit) to merge into the token weight table — $0 today (the cost is infra). */
+export const AUTH_WEIGHTS: Record<string, number> = { "google.oauth": GOOGLE_OAUTH_MICRO_USD };