@velajs/better-auth 0.6.1 → 2.0.0

package/dist/index.js

@@ -1,9 +1,22 @@
-import { a as __decorateMetadata, i as __decorateParam, n as BetterAuthService, r as __decorate, t as BETTER_AUTH_BUILDER } from "./better-auth.service-BMkyFX-w.js";
-import { All, Controller, ForbiddenException, Inject, Injectable, InjectionToken, REQUEST_CONTEXT, Reflector, Req, UnauthorizedException, createLazyParamDecorator, defineModule, lazyProvider, provideGlobal, stableHash } from "@velajs/vela";
-import { AUTHZ } from "@velajs/authz/vela";
+import { a as __decorateMetadata, i as __decorateParam, n as BetterAuthService, r as __decorate, t as BETTER_AUTH_BUILDER } from "./better-auth.service-DurQ4JQf.js";
+import { All, Controller, Inject, Injectable, InjectionToken, Reflector, Req, UnauthorizedException, clearTrustedRequestIdentity, createParamDecorator, defineProvider, getTrustedRequestIdentity, provideGlobal, setTrustedRequestIdentity, stableHash } from "@velajs/vela";
+import { getContextIdentity } from "@velajs/authz/vela";
 //#region src/decorators/public.decorator.ts
 const Public = Reflector.createDecorator({ key: "vela.auth.public" });
 const PUBLIC_KEY = Public.KEY;
+/** Validate and canonicalize the route prefix used by the public auth controller. */
+function normalizeBetterAuthBasePath(value) {
+	const basePath = value ?? "/api/auth";
+	if (basePath.length === 0 || basePath !== basePath.trim() || !basePath.startsWith("/") || basePath.startsWith("//") || basePath === "/" || basePath.endsWith("/") || /[\\?#*]/u.test(basePath) || /%(?:2e|2f|5c)/iu.test(basePath)) throw new Error("@velajs/better-auth: basePath must be a canonical absolute path such as \"/api/auth\"");
+	let decoded;
+	try {
+		decoded = decodeURIComponent(basePath);
+	} catch {
+		throw new Error("@velajs/better-auth: basePath contains invalid percent encoding");
+	}
+	if (decoded.split("/").some((segment) => segment === "." || segment === "..")) throw new Error("@velajs/better-auth: basePath must not contain dot segments");
+	return basePath;
+}
 //#endregion
 //#region src/better-auth.controller.ts
 /**
@@ -20,6 +33,7 @@ const PUBLIC_KEY = Public.KEY;
 * Both default to `/api/auth`, so the no-prefix / no-config case just works.
 */
 function createBetterAuthCatchallController(basePath = "/api/auth") {
+	const normalizedBasePath = normalizeBetterAuthBasePath(basePath);
 	let BetterAuthCatchallController = class BetterAuthCatchallController {
 		auth;
 		constructor(auth) {
@@ -38,24 +52,121 @@ function createBetterAuthCatchallController(basePath = "/api/auth") {
 	], BetterAuthCatchallController.prototype, "handle", null);
 	BetterAuthCatchallController = __decorate([
 		Public(true),
-		Controller(basePath),
+		Controller(normalizedBasePath),
 		Injectable(),
 		__decorateParam(0, Inject(BetterAuthService)),
 		__decorateMetadata("design:paramtypes", [typeof BetterAuthService === "undefined" ? Object : BetterAuthService])
 	], BetterAuthCatchallController);
 	return BetterAuthCatchallController;
 }
-/**
-* Default-path (`/api/auth`) catch-all controller. Retained for back-compat;
-* `BetterAuthModule` now mounts {@link createBetterAuthCatchallController} with
-* the configured `basePath`. Prefer the factory for a custom base path.
-*/
-const BetterAuthCatchallController = createBetterAuthCatchallController();
 //#endregion
 //#region src/better-auth.tokens.ts
 const BETTER_AUTH_OPTIONS = new InjectionToken("vela.BetterAuthOptions");
-const AUTH_USER_KEY = Symbol.for("vela.better-auth.user");
-const AUTH_SESSION_KEY = Symbol.for("vela.better-auth.session");
+//#endregion
+//#region src/auth-request-state.ts
+const sessions = /* @__PURE__ */ new WeakMap();
+function beginAuthRequest(context) {
+	clearTrustedRequestIdentity(context.getRequest());
+}
+function authenticateRequest(context, data, issuer) {
+	const request = context.getRequest();
+	setTrustedRequestIdentity(request, {
+		principal: {
+			issuer,
+			subject: data.user.id,
+			principalType: "user"
+		},
+		expiresAtMs: data.session.expiresAt.getTime(),
+		roles: data.roles,
+		...data.tenantId === void 0 ? {} : { tenantId: data.tenantId }
+	});
+	const identity = getTrustedRequestIdentity(request);
+	if (identity) sessions.set(identity, data);
+}
+function getAuthRequestState(context) {
+	if (context.getType() !== "http") return void 0;
+	const identity = getTrustedRequestIdentity(context.getRequest());
+	return identity && sessions.get(identity);
+}
+//#endregion
+//#region src/session-data.ts
+function own(value, key) {
+	if (typeof value !== "object" || value === null) return void 0;
+	const descriptor = Object.getOwnPropertyDescriptor(value, key);
+	return descriptor && "value" in descriptor ? descriptor.value : void 0;
+}
+function requiredString(value) {
+	return typeof value === "string" && value.length > 0;
+}
+function date(value) {
+	return value instanceof Date && Number.isFinite(value.getTime()) ? new Date(value) : void 0;
+}
+function optionalString(value) {
+	return value === void 0 || value === null || typeof value === "string";
+}
+/** Keep plugin data opaque; base model fields below are validated individually. */
+function dataProperties(value) {
+	return Object.fromEntries(Object.keys(value).map((key) => [key, own(value, key)]));
+}
+/** Validate the full Better Auth base models, not merely ids masquerading as them. */
+function validateSessionData(value) {
+	try {
+		const user = own(value, "user");
+		const session = own(value, "session");
+		if (typeof user !== "object" || user === null || typeof session !== "object" || session === null) return;
+		const id = own(user, "id");
+		const email = own(user, "email");
+		const name = own(user, "name");
+		const emailVerified = own(user, "emailVerified");
+		const image = own(user, "image");
+		const createdAt = date(own(user, "createdAt"));
+		const updatedAt = date(own(user, "updatedAt"));
+		const sessionId = own(session, "id");
+		const userId = own(session, "userId");
+		const token = own(session, "token");
+		const sessionCreatedAt = date(own(session, "createdAt"));
+		const sessionUpdatedAt = date(own(session, "updatedAt"));
+		const expiresAt = date(own(session, "expiresAt"));
+		const ipAddress = own(session, "ipAddress");
+		const userAgent = own(session, "userAgent");
+		const organization = own(session, "activeOrganizationId");
+		const role = own(user, "role");
+		let roles = [];
+		if (role !== void 0 && role !== null) {
+			if (typeof role === "string") roles = role.split(",").map((part) => part.trim()).filter(Boolean);
+			else if (Array.isArray(role) && role.every((entry) => typeof entry === "string")) roles = role.map((entry) => entry.trim()).filter(Boolean);
+			else return void 0;
+		}
+		if (!requiredString(id) || !requiredString(email) || typeof name !== "string" || typeof emailVerified !== "boolean" || !optionalString(image) || !createdAt || !updatedAt || !requiredString(sessionId) || userId !== id || !requiredString(token) || !sessionCreatedAt || !sessionUpdatedAt || !expiresAt || expiresAt.getTime() <= Date.now() || !optionalString(ipAddress) || !optionalString(userAgent) || organization !== void 0 && organization !== null && !requiredString(organization)) return void 0;
+		return {
+			user: Object.freeze({
+				...dataProperties(user),
+				id,
+				email,
+				name,
+				emailVerified,
+				createdAt,
+				updatedAt,
+				image
+			}),
+			session: Object.freeze({
+				...dataProperties(session),
+				id: sessionId,
+				userId: id,
+				token,
+				createdAt: sessionCreatedAt,
+				updatedAt: sessionUpdatedAt,
+				expiresAt,
+				ipAddress,
+				userAgent
+			}),
+			roles: Object.freeze(roles),
+			...typeof organization === "string" ? { tenantId: organization } : {}
+		};
+	} catch {
+		return;
+	}
+}
 //#endregion
 //#region src/decorators/optional-auth.decorator.ts
 const OptionalAuth = Reflector.createDecorator({ key: "vela.auth.optional" });
@@ -71,19 +182,18 @@ let AuthGuard = class AuthGuard {
 		this.opts = opts;
 	}
 	async canActivate(context) {
+		if (context.getType() === "ws") {
+			if (getContextIdentity(context)) return true;
+			throw new UnauthorizedException("Authentication required");
+		}
+		beginAuthRequest(context);
 		if (this.reflector.getAllAndOverride(Public, context)) return true;
-		const request = context.getRequest();
-		const path = new URL(request.url).pathname;
-		const basePath = this.opts.basePath ?? "/api/auth";
-		if (path === basePath || path.startsWith(`${basePath}/`)) return true;
-		const data = await this.auth.api.getSession({ headers: request.headers });
+		const data = validateSessionData(await this.auth.api.getSession({ headers: context.getRequest().headers }));
 		if (data) {
-			const reqCtx = resolveRequestContext(context);
-			reqCtx.set(AUTH_USER_KEY, data.user);
-			reqCtx.set(AUTH_SESSION_KEY, data.session);
+			authenticateRequest(context, data, this.opts.issuer ?? "better-auth");
 			return true;
 		}
-		if (this.opts.defaultPolicy === "allow" || this.reflector.getAllAndOverride(OptionalAuth, context)) return true;
+		if (this.reflector.getAllAndOverride(OptionalAuth, context)) return true;
 		throw new UnauthorizedException("Authentication required");
 	}
 };
@@ -93,209 +203,52 @@ AuthGuard = __decorate([
 	__decorateParam(1, Inject(BETTER_AUTH_OPTIONS)),
 	__decorateMetadata("design:paramtypes", [typeof BetterAuthService === "undefined" ? Object : BetterAuthService, Object])
 ], AuthGuard);
-function resolveRequestContext(context) {
-	return context.getContext().get("container").resolve(REQUEST_CONTEXT);
-}
-//#endregion
-//#region src/decorators/roles.decorator.ts
-const Roles = Reflector.createDecorator({ key: "vela.auth.roles" });
-const ROLES_KEY = Roles.KEY;
-//#endregion
-//#region src/guards/roles.guard.ts
-let RolesGuard = class RolesGuard {
-	reflector = new Reflector();
-	canActivate(context) {
-		const required = this.reflector.getAllAndOverride(Roles, context);
-		if (!required || required.length === 0) return true;
-		const user = context.getContext().get("container").resolve(REQUEST_CONTEXT).get(AUTH_USER_KEY);
-		if (!user) throw new ForbiddenException("Role check requires authentication");
-		const userRoles = normalizeRoles$1(user.role);
-		if (!required.some((r) => userRoles.includes(r))) throw new ForbiddenException(`Insufficient role; one of [${required.join(", ")}] required`);
-		return true;
-	}
-};
-RolesGuard = __decorate([Injectable()], RolesGuard);
-function normalizeRoles$1(role) {
-	if (!role) return [];
-	if (Array.isArray(role)) return role;
-	return role.split(",").map((r) => r.trim()).filter(Boolean);
-}
-//#endregion
-//#region src/authz-bridge.ts
-const normalizeRoles = (role) => {
-	if (!role) return [];
-	if (Array.isArray(role)) return role.filter(Boolean);
-	return role.split(",").map((r) => r.trim()).filter(Boolean);
-};
-/**
-* Adapts a better-auth user into a `@velajs/authz` {@link Identity}. Maps
-* `user.id` → `userId` and the admin-plugin `role` field → `roles`.
-*
-* Fail-closed: a missing user (`null`/`undefined`, i.e. an unauthenticated
-* request) maps to the zero-privilege identity `{ roles: [] }`, so downstream
-* `can()` checks grant nothing.
-*/
-const identityFromUser = (user) => {
-	if (!user) return { roles: [] };
-	return {
-		userId: user.id,
-		roles: normalizeRoles(user.role)
-	};
-};
-/**
-* Flattens a better-auth AC role's `statements` into `resource:action`
-* permission strings — the granted-side format `@velajs/authz` matches
-* (wildcards included).
-*/
-const permissionsFromAcRole = (role) => {
-	const permissions = [];
-	for (const [resource, actions] of Object.entries(role.statements ?? {})) for (const action of actions ?? []) permissions.push(`${resource}:${action}`);
-	return permissions;
-};
-/**
-* Builds a fail-closed `@velajs/authz` {@link PermissionResolver} from a
-* better-auth access-control role table (`{ roleName: acRole }` — the same map
-* shape passed to better-auth's admin/organization plugins). An identity's
-* `roles` are unioned into their granted permission strings; unknown roles
-* contribute nothing.
-*
-* ```ts
-* const ac = createAccessControl({ posts: ['read', 'write'] });
-* const authz = createAuthz({
-*   resolver: betterAuthAcResolver({ editor: ac.newRole({ posts: ['write'] }) }),
-* });
-* await authz.can(identityFromUser(user), 'posts:write');
-* ```
-*/
-const betterAuthAcResolver = (roles) => {
-	const grantsByRole = /* @__PURE__ */ new Map();
-	for (const [name, role] of Object.entries(roles)) grantsByRole.set(name, permissionsFromAcRole(role));
-	return { grants(identity) {
-		const out = /* @__PURE__ */ new Set();
-		for (const name of identity.roles ?? []) for (const permission of grantsByRole.get(name) ?? []) out.add(permission);
-		return out;
-	} };
-};
-//#endregion
-//#region src/decorators/require-permission.decorator.ts
-/**
-* Declares the `@velajs/authz` permission(s) required to reach a controller or
-* route handler. Read via `Reflector` in an authorization guard, then checked
-* against the caller's `Identity` with `authz.can(...)`.
-*
-* ```ts
-* @RequirePermission(['posts:write'])
-* @Post()
-* create() { ... }
-* ```
-*
-* The metadata is a plain `string[]` of permission strings in the granted-side
-* format `@velajs/authz` matches (`resource:action`, or wildcards like
-* `posts:*`). Handler-level metadata overrides class-level (standard
-* `Reflector.getAllAndOverride` precedence).
-*
-* Semantics are **require-ALL** (AND): every listed permission must be granted
-* for access — the `PermissionGuard` denies if any one is missing. This
-* contrasts with `@Roles`, which is **OR** (any one of the listed roles
-* suffices).
-*/
-const RequirePermission = Reflector.createDecorator({ key: "vela.authz.permissions" });
-const REQUIRE_PERMISSION_KEY = RequirePermission.KEY;
-//#endregion
-//#region src/guards/permission.guard.ts
-const AUTHZ_TOKEN = AUTHZ;
-let PermissionGuard = class PermissionGuard {
-	reflector = new Reflector();
-	async canActivate(context) {
-		const required = this.reflector.getAllAndOverride(RequirePermission, context);
-		if (!required || required.length === 0) return true;
-		const container = context.getContext().get("container");
-		let authz;
-		try {
-			authz = container.resolve(AUTHZ_TOKEN);
-		} catch {
-			authz = void 0;
-		}
-		if (!authz) throw new ForbiddenException("Authorization is not configured");
-		const user = container.resolve(REQUEST_CONTEXT).get(AUTH_USER_KEY);
-		if (!user) throw new ForbiddenException("Permission check requires authentication");
-		const identity = identityFromUser(user);
-		for (const permission of required) if (!await authz.can(identity, permission)) throw new ForbiddenException(`Missing permission: ${permission}`);
-		return true;
-	}
-};
-PermissionGuard = __decorate([Injectable()], PermissionGuard);
 //#endregion
 //#region src/better-auth.module.ts
-const DEFAULT_BASE_PATH = "/api/auth";
+const referenceIds = /* @__PURE__ */ new WeakMap();
+const explicitKeyClaims = /* @__PURE__ */ new Map();
+let nextReferenceId = 1;
+function referenceId(reference) {
+	const existing = referenceIds.get(reference);
+	if (existing !== void 0) return existing;
+	const id = nextReferenceId++;
+	referenceIds.set(reference, id);
+	return id;
+}
+function claimExplicitKey(key, kind, reference, shape) {
+	if (key.length === 0 || key !== key.trim()) throw new Error("@velajs/better-auth: an explicit module key must be a non-empty string");
+	const existing = explicitKeyClaims.get(key);
+	if (existing !== void 0 && (existing.kind !== kind || existing.reference !== reference || existing.shape !== shape)) throw new Error(`@velajs/better-auth: explicit module key "${key}" is already bound to a different auth registration`);
+	explicitKeyClaims.set(key, {
+		kind,
+		reference,
+		shape
+	});
+	return `explicit:${key}:ref:${referenceId(reference)}`;
+}
 function normalize(options) {
+	const basePath = normalizeBetterAuthBasePath(options.basePath);
+	const issuer = options.issuer ?? `better-auth:${basePath}`;
+	if (issuer.length === 0 || issuer !== issuer.trim()) throw new Error("@velajs/better-auth: issuer must be a non-empty stable namespace");
 	return {
-		basePath: options.basePath ?? DEFAULT_BASE_PATH,
-		isGlobal: options.isGlobal ?? false,
-		defaultPolicy: options.defaultPolicy ?? "deny",
+		basePath,
+		issuer,
+		isGlobal: options.isGlobal ?? true,
 		mountHandler: options.mountHandler ?? true
 	};
 }
 /** Providers, controllers, and exports shared by both entry points. */
 function commonContributions(n) {
 	return {
-		providers: [
-			BetterAuthService,
-			AuthGuard,
-			RolesGuard,
-			PermissionGuard
-		],
+		providers: [BetterAuthService, AuthGuard],
 		controllers: n.mountHandler ? [createBetterAuthCatchallController(n.basePath)] : [],
 		exports: [
 			BetterAuthService,
 			BETTER_AUTH_OPTIONS,
-			AuthGuard,
-			RolesGuard,
-			PermissionGuard
+			AuthGuard
 		]
 	};
 }
-/**
-* The blessed engine generates `forRoot`. `setup` runs once per instance at
-* call time: it re-provides {@link BETTER_AUTH_OPTIONS} with defaults applied,
-* derives the auth builder from those options, mounts the catch-all controller,
-* and — via the `global:` slot — registers the app-wide guard when `isGlobal`.
-*
-* `isGlobal` here means "apply AuthGuard app-wide", NOT "make this a global
-* module", so the default `isGlobal → global: true` extras transform is
-* replaced with identity; the flag reaches `setup` through the options bag.
-*/
-const authModuleHost = defineModule({
-	name: "BetterAuth",
-	optionsToken: BETTER_AUTH_OPTIONS,
-	transform: (definition) => definition,
-	key: (options) => stableHash(normalize(options)),
-	setup: ({ OPTIONS, options }) => {
-		const n = normalize(options);
-		const common = commonContributions(n);
-		const auth = options.auth;
-		return {
-			providers: [
-				{
-					provide: OPTIONS,
-					useValue: {
-						...n,
-						auth
-					}
-				},
-				lazyProvider({
-					provide: BETTER_AUTH_BUILDER,
-					inject: [OPTIONS],
-					useFactory: (o) => o.auth
-				}),
-				...common.providers
-			],
-			controllers: common.controllers,
-			exports: common.exports,
-			global: n.isGlobal ? { guards: [AuthGuard] } : void 0
-		};
-	}
-});
 var BetterAuthModule = class BetterAuthModule {
 	/**
 	* Synchronous registration. The auth instance is constructed by the consumer
@@ -304,9 +257,21 @@ var BetterAuthModule = class BetterAuthModule {
 	* connection, in-memory adapters, etc.).
 	*/
 	static forRoot(options) {
+		const normalized = normalize(options);
+		const shape = stableHash(normalized);
+		const key = options.key === void 0 ? `${shape}:auth:${referenceId(options.auth)}` : claimExplicitKey(options.key, "auth", options.auth, shape);
+		const common = commonContributions(normalized);
 		return {
-			...authModuleHost.ConfigurableModuleClass.forRoot(options),
-			module: BetterAuthModule
+			module: BetterAuthModule,
+			key,
+			providers: [
+				defineProvider(BETTER_AUTH_OPTIONS, { useValue: normalized }),
+				defineProvider(BETTER_AUTH_BUILDER, { useValue: () => options.auth }),
+				...common.providers,
+				...normalized.isGlobal ? provideGlobal("guard", AuthGuard) : []
+			],
+			controllers: common.controllers,
+			exports: common.exports
 		};
 	}
 	/**
@@ -314,31 +279,27 @@ var BetterAuthModule = class BetterAuthModule {
 	* first time anything reads `BetterAuthService.auth` (or `.api` / `.handler`).
 	* In normal request handling that's `AuthGuard.canActivate` or the catch-all
 	* controller's `.handle`. At module load the factory does NOT run — it's only
-	* captured behind {@link lazyProvider}'s memoized thunk. This is what makes
-	* Cloudflare bindings (D1, KV, R2) work: the binding isn't ready at boot, but
-	* it IS by the time a request flows through and the guard / catch-all reads
-	* the service. Inject deps resolve at module load (cheap BindingRef wrappers);
-	* their *values* are read at first auth use, inside your factory body.
+	* captured in the checked builder provider. The Workers adapter supplies its
+	* native environment before DI; the lazily constructed auth instance belongs
+	* to that environment's application and never captures another app's bindings.
 	*/
 	static forRootAsync(options) {
 		const n = normalize(options);
 		const common = commonContributions(n);
+		const shape = stableHash({
+			...n,
+			inject: options.inject
+		});
+		const key = options.key === void 0 ? `${shape}:factory:${referenceId(options.useFactory)}` : claimExplicitKey(options.key, "factory", options.useFactory, shape);
 		return {
 			module: BetterAuthModule,
-			key: options.key ?? stableHash({
-				...n,
-				inject: options.inject
-			}),
+			key,
 			imports: options.imports ?? [],
 			providers: [
-				{
-					provide: BETTER_AUTH_OPTIONS,
-					useValue: n
-				},
-				lazyProvider({
-					provide: BETTER_AUTH_BUILDER,
+				defineProvider(BETTER_AUTH_OPTIONS, { useValue: n }),
+				defineProvider(BETTER_AUTH_BUILDER, {
 					inject: options.inject,
-					useFactory: options.useFactory
+					useFactory: (...deps) => () => options.useFactory(...deps)
 				}),
 				...common.providers,
 				...n.isGlobal ? provideGlobal("guard", AuthGuard) : []
@@ -350,15 +311,79 @@ var BetterAuthModule = class BetterAuthModule {
 };
 //#endregion
 //#region src/decorators/current-user.decorator.ts
-const CurrentUser = createLazyParamDecorator((_data, ctx) => {
-	return ctx.getContext().get("container").resolve(REQUEST_CONTEXT).get(AUTH_USER_KEY);
+const CurrentUser = createParamDecorator((_data, ctx) => {
+	return getAuthRequestState(ctx)?.user;
 });
 //#endregion
 //#region src/decorators/current-session.decorator.ts
-const CurrentSession = createLazyParamDecorator((_data, ctx) => {
-	return ctx.getContext().get("container").resolve(REQUEST_CONTEXT).get(AUTH_SESSION_KEY);
+const CurrentSession = createParamDecorator((_data, ctx) => {
+	return getAuthRequestState(ctx)?.session;
 });
 //#endregion
-export { AUTH_SESSION_KEY, AUTH_USER_KEY, AuthGuard, BETTER_AUTH_OPTIONS, BetterAuthCatchallController, BetterAuthModule, BetterAuthService, CurrentSession, CurrentUser, OPTIONAL_AUTH_KEY, OptionalAuth, PUBLIC_KEY, PermissionGuard, Public, REQUIRE_PERMISSION_KEY, ROLES_KEY, RequirePermission, Roles, RolesGuard, betterAuthAcResolver, createBetterAuthCatchallController, identityFromUser, permissionsFromAcRole };
+//#region src/authz-bridge.ts
+/** Stable issuer namespace used for better-auth session principals. */
+const BETTER_AUTH_ISSUER = "better-auth";
+const normalizeRoles = (role) => {
+	if (!role) return [];
+	if (Array.isArray(role)) return role.filter(Boolean);
+	return role.split(",").map((r) => r.trim()).filter(Boolean);
+};
+/**
+* Pure authorization projection; this does not authenticate or publish trusted state.
+* Adapts an already verified better-auth user into a stable `@velajs/authz` {@link Identity}.
+* The issuer scopes `user.id` as both `subject` and the compatibility `userId`;
+* the admin-plugin `role` field supplies local roles.
+*
+* Fail-closed: a missing user (`null`/`undefined`, i.e. an unauthenticated
+* request) maps to the zero-privilege identity `{ roles: [] }`, so downstream
+* `can()` checks grant nothing.
+*/
+const identityFromUser = (user, issuer = BETTER_AUTH_ISSUER, principalType = "user") => {
+	if (!user || typeof user.id !== "string" || user.id.length === 0) return { roles: [] };
+	if (issuer.length === 0) throw new Error("@velajs/better-auth: identity issuer must be non-empty");
+	return {
+		issuer,
+		subject: user.id,
+		principalType,
+		userId: user.id,
+		roles: normalizeRoles(user.role)
+	};
+};
+/**
+* Flattens a better-auth AC role's `statements` into `resource:action`
+* permission strings — the granted-side format `@velajs/authz` matches
+* (wildcards included).
+*/
+const permissionsFromAcRole = (role) => {
+	const permissions = [];
+	for (const [resource, actions] of Object.entries(role.statements ?? {})) for (const action of actions ?? []) permissions.push(`${resource}:${action}`);
+	return permissions;
+};
+/**
+* Builds a fail-closed `@velajs/authz` {@link PermissionResolver} from a
+* better-auth access-control role table (`{ roleName: acRole }` — the same map
+* shape passed to better-auth's admin/organization plugins). An identity's
+* `roles` are unioned into their granted permission strings; unknown roles
+* contribute nothing.
+*
+* ```ts
+* const ac = createAccessControl({ posts: ['read', 'write'] });
+* const authz = createAuthz({
+*   resolver: betterAuthAcResolver({ editor: ac.newRole({ posts: ['write'] }) }),
+* });
+* await authz.can(identityFromUser(user), 'posts:write');
+* ```
+*/
+const betterAuthAcResolver = (roles) => {
+	const grantsByRole = /* @__PURE__ */ new Map();
+	for (const [name, role] of Object.entries(roles)) grantsByRole.set(name, permissionsFromAcRole(role));
+	return { grants(identity) {
+		const out = /* @__PURE__ */ new Set();
+		for (const name of identity.roles ?? []) for (const permission of grantsByRole.get(name) ?? []) out.add(permission);
+		return out;
+	} };
+};
+//#endregion
+export { AuthGuard, BETTER_AUTH_ISSUER, BETTER_AUTH_OPTIONS, BetterAuthModule, BetterAuthService, CurrentSession, CurrentUser, OPTIONAL_AUTH_KEY, OptionalAuth, PUBLIC_KEY, Public, betterAuthAcResolver, createBetterAuthCatchallController, identityFromUser, permissionsFromAcRole };
 
 //# sourceMappingURL=index.js.map