@velajs/better-auth 0.6.0 → 1.0.0

package/dist/index.js

@@ -1,15 +1,581 @@
-// Module
-export { BetterAuthModule } from "./better-auth.module.js";
-export { BetterAuthService } from "./better-auth.service.js";
-export { BetterAuthCatchallController, createBetterAuthCatchallController } from "./better-auth.controller.js";
-// Tokens & symbols
-export { BETTER_AUTH_OPTIONS, AUTH_USER_KEY, AUTH_SESSION_KEY } from "./better-auth.tokens.js";
-// Guards
-export { AuthGuard } from "./guards/auth.guard.js";
-export { RolesGuard } from "./guards/roles.guard.js";
-// Decorators
-export { CurrentUser } from "./decorators/current-user.decorator.js";
-export { CurrentSession } from "./decorators/current-session.decorator.js";
-export { Public, PUBLIC_KEY } from "./decorators/public.decorator.js";
-export { OptionalAuth, OPTIONAL_AUTH_KEY } from "./decorators/optional-auth.decorator.js";
-export { Roles, ROLES_KEY } from "./decorators/roles.decorator.js";
+import { a as __decorateMetadata, i as __decorateParam, n as BetterAuthService, r as __decorate, t as BETTER_AUTH_BUILDER } from "./better-auth.service-BMkyFX-w.js";
+import { All, Controller, ForbiddenException, Inject, Injectable, InjectionToken, REQUEST_CONTEXT, Reflector, Req, UnauthorizedException, clearTrustedRequestIdentity, createParamDecorator, defineModule, lazyProvider, provideGlobal, setTrustedRequestIdentity, stableHash } from "@velajs/vela";
+import { AUTHZ } from "@velajs/authz/vela";
+//#region src/decorators/public.decorator.ts
+const Public = Reflector.createDecorator({ key: "vela.auth.public" });
+const PUBLIC_KEY = Public.KEY;
+/** Validate and canonicalize the route prefix used by the public auth controller. */
+function normalizeBetterAuthBasePath(value) {
+	const basePath = value ?? "/api/auth";
+	if (basePath.length === 0 || basePath !== basePath.trim() || !basePath.startsWith("/") || basePath.startsWith("//") || basePath === "/" || basePath.endsWith("/") || /[\\?#*]/u.test(basePath) || /%(?:2e|2f|5c)/iu.test(basePath)) throw new Error("@velajs/better-auth: basePath must be a canonical absolute path such as \"/api/auth\"");
+	let decoded;
+	try {
+		decoded = decodeURIComponent(basePath);
+	} catch {
+		throw new Error("@velajs/better-auth: basePath contains invalid percent encoding");
+	}
+	if (decoded.split("/").some((segment) => segment === "." || segment === "..")) throw new Error("@velajs/better-auth: basePath must not contain dot segments");
+	return basePath;
+}
+//#endregion
+//#region src/better-auth.controller.ts
+/**
+* Build a catch-all controller that mounts better-auth's handler at `basePath`
+* (default `/api/auth`). This is a factory because vela reads a controller's
+* route off the class at decoration time, so a custom base path needs its own
+* decorated class — the path can't be parametrized on a single shared class.
+*
+* Two base paths to keep consistent:
+* - this `basePath` is RELATIVE to vela's `globalPrefix` (always prepended);
+* - better-auth routes against its OWN absolute `basePath` (the one you pass to
+*   `betterAuth({ basePath })`), which must equal `globalPrefix + basePath`.
+*
+* Both default to `/api/auth`, so the no-prefix / no-config case just works.
+*/
+function createBetterAuthCatchallController(basePath = "/api/auth") {
+	const normalizedBasePath = normalizeBetterAuthBasePath(basePath);
+	let BetterAuthCatchallController = class BetterAuthCatchallController {
+		auth;
+		constructor(auth) {
+			this.auth = auth;
+		}
+		async handle(c) {
+			return this.auth.handler(c.req.raw);
+		}
+	};
+	__decorate([
+		All("/*"),
+		__decorateParam(0, Req()),
+		__decorateMetadata("design:type", Function),
+		__decorateMetadata("design:paramtypes", [Object]),
+		__decorateMetadata("design:returntype", Promise)
+	], BetterAuthCatchallController.prototype, "handle", null);
+	BetterAuthCatchallController = __decorate([
+		Public(true),
+		Controller(normalizedBasePath),
+		Injectable(),
+		__decorateParam(0, Inject(BetterAuthService)),
+		__decorateMetadata("design:paramtypes", [typeof BetterAuthService === "undefined" ? Object : BetterAuthService])
+	], BetterAuthCatchallController);
+	return BetterAuthCatchallController;
+}
+/**
+* Default-path (`/api/auth`) catch-all controller. Retained for back-compat;
+* `BetterAuthModule` now mounts {@link createBetterAuthCatchallController} with
+* the configured `basePath`. Prefer the factory for a custom base path.
+*/
+const BetterAuthCatchallController = createBetterAuthCatchallController();
+//#endregion
+//#region src/better-auth.tokens.ts
+const BETTER_AUTH_OPTIONS = new InjectionToken("vela.BetterAuthOptions");
+const AUTH_USER_KEY = Symbol.for("vela.better-auth.user");
+const AUTH_SESSION_KEY = Symbol.for("vela.better-auth.session");
+const AUTH_ISSUER_KEY = Symbol.for("vela.better-auth.issuer");
+const AUTH_PRINCIPAL_TYPE_KEY = Symbol.for("vela.better-auth.principal-type");
+//#endregion
+//#region src/auth-request-state.ts
+const ANONYMOUS = Object.freeze({ authenticated: false });
+const stateByRequest = /* @__PURE__ */ new WeakMap();
+/** Clear any state before a guard evaluates a request. */
+const beginAuthRequest = (context) => {
+	stateByRequest.set(context.getRequest(), ANONYMOUS);
+};
+/** Publish a fully verified session for downstream guards and parameters. */
+const authenticateRequest = (context, state) => {
+	const authenticated = Object.freeze({
+		authenticated: true,
+		...state
+	});
+	stateByRequest.set(context.getRequest(), authenticated);
+	return authenticated;
+};
+/** Missing state is anonymous: no guard means no ambient identity. */
+const getAuthRequestState = (context) => context.getType() === "http" ? stateByRequest.get(context.getRequest()) ?? ANONYMOUS : ANONYMOUS;
+//#endregion
+//#region src/decorators/optional-auth.decorator.ts
+const OptionalAuth = Reflector.createDecorator({ key: "vela.auth.optional" });
+const OPTIONAL_AUTH_KEY = OptionalAuth.KEY;
+//#endregion
+//#region src/guards/auth.guard.ts
+let AuthGuard = class AuthGuard {
+	auth;
+	opts;
+	reflector = new Reflector();
+	constructor(auth, opts) {
+		this.auth = auth;
+		this.opts = opts;
+	}
+	async canActivate(context) {
+		if (context.getType() === "ws") {
+			if (hasValidWebSocketIdentity(context)) return true;
+			throw new AuthenticationRequiredException();
+		}
+		beginAuthRequest(context);
+		mirrorRequestContext(context, { authenticated: false });
+		if (this.reflector.getAllAndOverride(Public, context)) return true;
+		const request = context.getRequest();
+		const data = validateSessionData(await this.auth.api.getSession({ headers: request.headers }));
+		if (data) {
+			mirrorRequestContext(context, authenticateRequest(context, {
+				user: data.user,
+				session: data.session,
+				issuer: this.opts.issuer ?? "better-auth",
+				principalType: "user"
+			}));
+			return true;
+		}
+		if (this.reflector.getAllAndOverride(OptionalAuth, context)) return true;
+		throw new AuthenticationRequiredException();
+	}
+};
+AuthGuard = __decorate([
+	Injectable(),
+	__decorateParam(0, Inject(BetterAuthService)),
+	__decorateParam(1, Inject(BETTER_AUTH_OPTIONS)),
+	__decorateMetadata("design:paramtypes", [typeof BetterAuthService === "undefined" ? Object : BetterAuthService, Object])
+], AuthGuard);
+function hasValidWebSocketIdentity(context) {
+	try {
+		const data = context.switchToWs().getClient()?.data;
+		if (!data || typeof data !== "object") return false;
+		const record = data;
+		const principal = record.principal;
+		if (!principal || typeof principal !== "object") return false;
+		const fields = principal;
+		return typeof fields.issuer === "string" && fields.issuer.length > 0 && typeof fields.subject === "string" && fields.subject.length > 0 && (fields.principalType === "user" || fields.principalType === "service") && typeof record.tenantId === "string" && record.tenantId.length > 0 && typeof record.expiresAtMs === "number" && Number.isSafeInteger(record.expiresAtMs) && record.expiresAtMs > Date.now();
+	} catch {
+		return false;
+	}
+}
+/**
+* Preserve the public REQUEST_CONTEXT symbols for applications that consume
+* them directly. The private Request-keyed state above remains canonical: a
+* missing/duplicated framework token must not prevent a verified guard from
+* publishing identity to its own downstream decorators and guards.
+*/
+function mirrorRequestContext(context, state) {
+	const request = context.getRequest();
+	if (!state.authenticated) clearTrustedRequestIdentity(request);
+	else {
+		const tenantId = readActiveOrganizationId(state.session);
+		setTrustedRequestIdentity(request, {
+			principal: {
+				issuer: state.issuer,
+				subject: state.user.id,
+				principalType: state.principalType
+			},
+			...tenantId === void 0 ? {} : { tenantId }
+		});
+	}
+	const container = context.getContext().get("container");
+	if (!container) return;
+	let reqCtx;
+	try {
+		reqCtx = container.resolve(REQUEST_CONTEXT);
+	} catch {
+		return;
+	}
+	if (!state.authenticated) {
+		reqCtx.set(AUTH_USER_KEY, void 0);
+		reqCtx.set(AUTH_SESSION_KEY, void 0);
+		reqCtx.set(AUTH_ISSUER_KEY, void 0);
+		reqCtx.set(AUTH_PRINCIPAL_TYPE_KEY, void 0);
+		return;
+	}
+	reqCtx.set(AUTH_USER_KEY, state.user);
+	reqCtx.set(AUTH_SESSION_KEY, state.session);
+	reqCtx.set(AUTH_ISSUER_KEY, state.issuer);
+	reqCtx.set(AUTH_PRINCIPAL_TYPE_KEY, state.principalType);
+}
+function readActiveOrganizationId(session) {
+	const descriptor = Object.getOwnPropertyDescriptor(session, "activeOrganizationId");
+	if (descriptor === void 0 || !("value" in descriptor)) return void 0;
+	const value = descriptor.value;
+	return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+/** A test/provider override is trusted code, but its runtime result is not. */
+function validateSessionData(value) {
+	if (value === null || typeof value !== "object") return void 0;
+	try {
+		const userDescriptor = Object.getOwnPropertyDescriptor(value, "user");
+		const sessionDescriptor = Object.getOwnPropertyDescriptor(value, "session");
+		if (userDescriptor === void 0 || !("value" in userDescriptor) || sessionDescriptor === void 0 || !("value" in sessionDescriptor)) return;
+		const user = userDescriptor.value;
+		const session = sessionDescriptor.value;
+		if (user === null || typeof user !== "object" || session === null || typeof session !== "object") return;
+		const userIdDescriptor = Object.getOwnPropertyDescriptor(user, "id");
+		const sessionIdDescriptor = Object.getOwnPropertyDescriptor(session, "id");
+		const sessionUserIdDescriptor = Object.getOwnPropertyDescriptor(session, "userId");
+		const userId = userIdDescriptor !== void 0 && "value" in userIdDescriptor ? userIdDescriptor.value : void 0;
+		const sessionId = sessionIdDescriptor !== void 0 && "value" in sessionIdDescriptor ? sessionIdDescriptor.value : void 0;
+		const sessionUserId = sessionUserIdDescriptor !== void 0 && "value" in sessionUserIdDescriptor ? sessionUserIdDescriptor.value : void 0;
+		if (typeof userId !== "string" || userId.length === 0 || typeof sessionId !== "string" || sessionId.length === 0 || sessionUserId !== userId) return;
+		return {
+			user,
+			session
+		};
+	} catch {
+		return;
+	}
+}
+/**
+* `UnauthorizedException` preserves Nest-style direct behavior. The structural
+* VelaError brand also survives test/runtime package duplication, so the
+* central renderer still maps this to 401 rather than treating it as a foreign
+* 500 error.
+*/
+var AuthenticationRequiredException = class extends UnauthorizedException {
+	type = "VelaError";
+	code = "unauthorized";
+	status = 401;
+	constructor() {
+		super("Authentication required");
+	}
+};
+//#endregion
+//#region src/decorators/roles.decorator.ts
+const Roles = Reflector.createDecorator({ key: "vela.auth.roles" });
+const ROLES_KEY = Roles.KEY;
+//#endregion
+//#region src/guards/roles.guard.ts
+const ACCESS_DENIED$1 = "Access denied";
+let RolesGuard = class RolesGuard {
+	reflector = new Reflector();
+	canActivate(context) {
+		const required = this.reflector.getAllAndOverride(Roles, context);
+		if (!required || required.length === 0) return true;
+		const state = getAuthRequestState(context);
+		if (!state.authenticated) throw new ForbiddenException(ACCESS_DENIED$1);
+		const userRoles = normalizeRoles$1(state.user.role);
+		if (!required.some((r) => userRoles.includes(r))) throw new ForbiddenException(ACCESS_DENIED$1);
+		return true;
+	}
+};
+RolesGuard = __decorate([Injectable()], RolesGuard);
+function normalizeRoles$1(role) {
+	if (!role) return [];
+	if (Array.isArray(role)) return role;
+	return role.split(",").map((r) => r.trim()).filter(Boolean);
+}
+//#endregion
+//#region src/authz-bridge.ts
+/** Stable issuer namespace used for better-auth session principals. */
+const BETTER_AUTH_ISSUER = "better-auth";
+const normalizeRoles = (role) => {
+	if (!role) return [];
+	if (Array.isArray(role)) return role.filter(Boolean);
+	return role.split(",").map((r) => r.trim()).filter(Boolean);
+};
+/**
+* Adapts a better-auth user into a stable `@velajs/authz` {@link Identity}.
+* The issuer scopes `user.id` as both `subject` and the compatibility `userId`;
+* the admin-plugin `role` field supplies local roles.
+*
+* Fail-closed: a missing user (`null`/`undefined`, i.e. an unauthenticated
+* request) maps to the zero-privilege identity `{ roles: [] }`, so downstream
+* `can()` checks grant nothing.
+*/
+const identityFromUser = (user, issuer = BETTER_AUTH_ISSUER, principalType = "user") => {
+	if (!user || typeof user.id !== "string" || user.id.length === 0) return { roles: [] };
+	if (issuer.length === 0) throw new Error("@velajs/better-auth: identity issuer must be non-empty");
+	return {
+		issuer,
+		subject: user.id,
+		principalType,
+		userId: user.id,
+		roles: normalizeRoles(user.role)
+	};
+};
+/**
+* Flattens a better-auth AC role's `statements` into `resource:action`
+* permission strings — the granted-side format `@velajs/authz` matches
+* (wildcards included).
+*/
+const permissionsFromAcRole = (role) => {
+	const permissions = [];
+	for (const [resource, actions] of Object.entries(role.statements ?? {})) for (const action of actions ?? []) permissions.push(`${resource}:${action}`);
+	return permissions;
+};
+/**
+* Builds a fail-closed `@velajs/authz` {@link PermissionResolver} from a
+* better-auth access-control role table (`{ roleName: acRole }` — the same map
+* shape passed to better-auth's admin/organization plugins). An identity's
+* `roles` are unioned into their granted permission strings; unknown roles
+* contribute nothing.
+*
+* ```ts
+* const ac = createAccessControl({ posts: ['read', 'write'] });
+* const authz = createAuthz({
+*   resolver: betterAuthAcResolver({ editor: ac.newRole({ posts: ['write'] }) }),
+* });
+* await authz.can(identityFromUser(user), 'posts:write');
+* ```
+*/
+const betterAuthAcResolver = (roles) => {
+	const grantsByRole = /* @__PURE__ */ new Map();
+	for (const [name, role] of Object.entries(roles)) grantsByRole.set(name, permissionsFromAcRole(role));
+	return { grants(identity) {
+		const out = /* @__PURE__ */ new Set();
+		for (const name of identity.roles ?? []) for (const permission of grantsByRole.get(name) ?? []) out.add(permission);
+		return out;
+	} };
+};
+//#endregion
+//#region src/decorators/require-permission.decorator.ts
+/**
+* Declares the `@velajs/authz` permission(s) required to reach a controller or
+* route handler. Read via `Reflector` in an authorization guard, then checked
+* against the caller's `Identity` with `authz.can(...)`.
+*
+* ```ts
+* @RequirePermission(['posts:write'])
+* @Post()
+* create() { ... }
+* ```
+*
+* The metadata is a plain `string[]` of permission strings in the granted-side
+* format `@velajs/authz` matches (`resource:action`, or wildcards like
+* `posts:*`). Handler-level metadata overrides class-level (standard
+* `Reflector.getAllAndOverride` precedence).
+*
+* Semantics are **require-ALL** (AND): every listed permission must be granted
+* for access — the `PermissionGuard` denies if any one is missing. This
+* contrasts with `@Roles`, which is **OR** (any one of the listed roles
+* suffices).
+*/
+const RequirePermission = Reflector.createDecorator({ key: "vela.authz.permissions" });
+const REQUIRE_PERMISSION_KEY = RequirePermission.KEY;
+//#endregion
+//#region src/guards/permission.guard.ts
+const AUTHZ_TOKEN = AUTHZ;
+const ACCESS_DENIED = "Access denied";
+function resolveSingleAuthz(container, moduleId) {
+	try {
+		if (typeof container.resolveAll === "function") {
+			const candidates = container.resolveAll(AUTHZ_TOKEN, moduleId);
+			return candidates.length === 1 ? candidates[0] : void 0;
+		}
+		return container.resolve(AUTHZ_TOKEN, moduleId);
+	} catch {
+		return;
+	}
+}
+let PermissionGuard = class PermissionGuard {
+	reflector = new Reflector();
+	async canActivate(context) {
+		const required = this.reflector.getAllAndOverride(RequirePermission, context);
+		if (!required || required.length === 0) return true;
+		const container = resolveContextContainer(context);
+		const moduleId = context.getModuleId();
+		const authz = container === void 0 || moduleId === void 0 ? void 0 : resolveSingleAuthz(container, moduleId);
+		if (!authz) throw new ForbiddenException(ACCESS_DENIED);
+		const identity = resolveContextIdentity(context);
+		if (identity === void 0) throw new ForbiddenException(ACCESS_DENIED);
+		for (const permission of required) if (!await authz.can(identity, permission)) throw new ForbiddenException(ACCESS_DENIED);
+		return true;
+	}
+};
+PermissionGuard = __decorate([Injectable()], PermissionGuard);
+function resolveContextContainer(context) {
+	const direct = context.getContainer?.();
+	if (direct !== void 0) return direct;
+	if (context.getType() !== "http") return void 0;
+	try {
+		return context.getContext().get("container");
+	} catch {
+		return;
+	}
+}
+function resolveContextIdentity(context) {
+	if (context.getType() === "ws") try {
+		const data = context.switchToWs().getClient()?.data;
+		if (!data || typeof data !== "object") return void 0;
+		const record = data;
+		const principal = record.principal;
+		if (!principal || typeof principal !== "object") return void 0;
+		const fields = principal;
+		if (typeof fields.issuer !== "string" || fields.issuer.length === 0 || typeof fields.subject !== "string" || fields.subject.length === 0 || fields.principalType !== "user" && fields.principalType !== "service" || typeof record.tenantId !== "string" || record.tenantId.length === 0 || typeof record.expiresAtMs !== "number" || !Number.isSafeInteger(record.expiresAtMs) || record.expiresAtMs <= Date.now()) return;
+		return {
+			issuer: fields.issuer,
+			subject: fields.subject,
+			principalType: fields.principalType,
+			userId: fields.subject,
+			roles: []
+		};
+	} catch {
+		return;
+	}
+	const state = getAuthRequestState(context);
+	return state.authenticated ? identityFromUser(state.user, state.issuer, state.principalType) : void 0;
+}
+//#endregion
+//#region src/better-auth.module.ts
+const referenceIds = /* @__PURE__ */ new WeakMap();
+const explicitKeyClaims = /* @__PURE__ */ new Map();
+let nextReferenceId = 1;
+function referenceId(reference) {
+	const existing = referenceIds.get(reference);
+	if (existing !== void 0) return existing;
+	const id = nextReferenceId++;
+	referenceIds.set(reference, id);
+	return id;
+}
+function claimExplicitKey(key, kind, reference, shape) {
+	if (key.length === 0 || key !== key.trim()) throw new Error("@velajs/better-auth: an explicit module key must be a non-empty string");
+	const existing = explicitKeyClaims.get(key);
+	if (existing !== void 0 && (existing.kind !== kind || existing.reference !== reference || existing.shape !== shape)) throw new Error(`@velajs/better-auth: explicit module key "${key}" is already bound to a different auth registration`);
+	explicitKeyClaims.set(key, {
+		kind,
+		reference,
+		shape
+	});
+	return `explicit:${key}:ref:${referenceId(reference)}`;
+}
+function normalize(options) {
+	const basePath = normalizeBetterAuthBasePath(options.basePath);
+	const issuer = options.issuer ?? `better-auth:${basePath}`;
+	if (issuer.length === 0 || issuer !== issuer.trim()) throw new Error("@velajs/better-auth: issuer must be a non-empty stable namespace");
+	if (options.defaultPolicy !== void 0 && options.defaultPolicy !== "deny") throw new Error("@velajs/better-auth: defaultPolicy is deny-only; mark anonymous routes with @Public() or @OptionalAuth()");
+	return {
+		basePath,
+		issuer,
+		isGlobal: options.isGlobal ?? true,
+		defaultPolicy: "deny",
+		mountHandler: options.mountHandler ?? true
+	};
+}
+/** Providers, controllers, and exports shared by both entry points. */
+function commonContributions(n) {
+	return {
+		providers: [
+			BetterAuthService,
+			AuthGuard,
+			RolesGuard,
+			PermissionGuard
+		],
+		controllers: n.mountHandler ? [createBetterAuthCatchallController(n.basePath)] : [],
+		exports: [
+			BetterAuthService,
+			BETTER_AUTH_OPTIONS,
+			AuthGuard,
+			RolesGuard,
+			PermissionGuard
+		]
+	};
+}
+/**
+* The blessed engine generates `forRoot`. `setup` runs once per instance at
+* call time: it re-provides {@link BETTER_AUTH_OPTIONS} with defaults applied,
+* derives the auth builder from those options, mounts the catch-all controller,
+* and — via the `global:` slot — registers the app-wide guard when `isGlobal`.
+*
+* `isGlobal` here means "apply AuthGuard app-wide", NOT "make this a global
+* module", so the default `isGlobal → global: true` extras transform is
+* replaced with identity; the flag reaches `setup` through the options bag.
+*/
+const authModuleHost = defineModule({
+	name: "BetterAuth",
+	optionsToken: BETTER_AUTH_OPTIONS,
+	transform: (definition) => definition,
+	key: (options) => stableHash(normalize(options)),
+	setup: ({ OPTIONS, options }) => {
+		const n = normalize(options);
+		const common = commonContributions(n);
+		const auth = options.auth;
+		return {
+			providers: [
+				{
+					provide: OPTIONS,
+					useValue: {
+						...n,
+						auth
+					}
+				},
+				lazyProvider({
+					provide: BETTER_AUTH_BUILDER,
+					inject: [OPTIONS],
+					useFactory: (o) => o.auth
+				}),
+				...common.providers
+			],
+			controllers: common.controllers,
+			exports: common.exports,
+			global: n.isGlobal ? { guards: [AuthGuard] } : void 0
+		};
+	}
+});
+var BetterAuthModule = class BetterAuthModule {
+	/**
+	* Synchronous registration. The auth instance is constructed by the consumer
+	* at module-load time and passed in directly. Use this when the inputs to
+	* `betterAuth({...})` are available at startup (Node apps with a static DB
+	* connection, in-memory adapters, etc.).
+	*/
+	static forRoot(options) {
+		const shape = stableHash(normalize(options));
+		const key = options.key === void 0 ? `${shape}:auth:${referenceId(options.auth)}` : claimExplicitKey(options.key, "auth", options.auth, shape);
+		return {
+			...authModuleHost.ConfigurableModuleClass.forRoot({
+				...options,
+				key
+			}),
+			module: BetterAuthModule
+		};
+	}
+	/**
+	* Deferred / DI-driven registration. The user factory runs **lazily**, on the
+	* first time anything reads `BetterAuthService.auth` (or `.api` / `.handler`).
+	* In normal request handling that's `AuthGuard.canActivate` or the catch-all
+	* controller's `.handle`. At module load the factory does NOT run — it's only
+	* captured behind {@link lazyProvider}'s memoized thunk. This is what makes
+	* Cloudflare bindings (D1, KV, R2) work: the binding isn't ready at boot, but
+	* it IS by the time a request flows through and the guard / catch-all reads
+	* the service. Inject deps resolve at module load (cheap BindingRef wrappers);
+	* their *values* are read at first auth use, inside your factory body.
+	*/
+	static forRootAsync(options) {
+		const n = normalize(options);
+		const common = commonContributions(n);
+		const shape = stableHash({
+			...n,
+			inject: options.inject
+		});
+		const key = options.key === void 0 ? `${shape}:factory:${referenceId(options.useFactory)}` : claimExplicitKey(options.key, "factory", options.useFactory, shape);
+		return {
+			module: BetterAuthModule,
+			key,
+			imports: options.imports ?? [],
+			providers: [
+				{
+					provide: BETTER_AUTH_OPTIONS,
+					useValue: n
+				},
+				lazyProvider({
+					provide: BETTER_AUTH_BUILDER,
+					inject: options.inject,
+					useFactory: options.useFactory
+				}),
+				...common.providers,
+				...n.isGlobal ? provideGlobal("guard", AuthGuard) : []
+			],
+			controllers: common.controllers,
+			exports: common.exports
+		};
+	}
+};
+//#endregion
+//#region src/decorators/current-user.decorator.ts
+const CurrentUser = createParamDecorator((_data, ctx) => {
+	const state = getAuthRequestState(ctx);
+	return state.authenticated ? state.user : void 0;
+});
+//#endregion
+//#region src/decorators/current-session.decorator.ts
+const CurrentSession = createParamDecorator((_data, ctx) => {
+	const state = getAuthRequestState(ctx);
+	return state.authenticated ? state.session : void 0;
+});
+//#endregion
+export { AUTH_ISSUER_KEY, AUTH_PRINCIPAL_TYPE_KEY, AUTH_SESSION_KEY, AUTH_USER_KEY, AuthGuard, BETTER_AUTH_ISSUER, BETTER_AUTH_OPTIONS, BetterAuthCatchallController, BetterAuthModule, BetterAuthService, CurrentSession, CurrentUser, OPTIONAL_AUTH_KEY, OptionalAuth, PUBLIC_KEY, PermissionGuard, Public, REQUIRE_PERMISSION_KEY, ROLES_KEY, RequirePermission, Roles, RolesGuard, betterAuthAcResolver, createBetterAuthCatchallController, identityFromUser, permissionsFromAcRole };
+
+//# sourceMappingURL=index.js.map