@velajs/better-auth 1.0.0 → 1.22.1

package/dist/index.js

@@ -1,6 +1,6 @@
-import { a as __decorateMetadata, i as __decorateParam, n as BetterAuthService, r as __decorate, t as BETTER_AUTH_BUILDER } from "./better-auth.service-BMkyFX-w.js";
-import { All, Controller, ForbiddenException, Inject, Injectable, InjectionToken, REQUEST_CONTEXT, Reflector, Req, UnauthorizedException, clearTrustedRequestIdentity, createParamDecorator, defineModule, lazyProvider, provideGlobal, setTrustedRequestIdentity, stableHash } from "@velajs/vela";
-import { AUTHZ } from "@velajs/authz/vela";
+import { a as __decorateMetadata, i as __decorateParam, n as BetterAuthService, r as __decorate, t as BETTER_AUTH_BUILDER } from "./better-auth.service-DurQ4JQf.js";
+import { All, Controller, Inject, Injectable, InjectionToken, Reflector, Req, UnauthorizedException, clearTrustedRequestIdentity, createParamDecorator, defineProvider, getTrustedRequestIdentity, provideGlobal, setTrustedRequestIdentity, stableHash } from "@velajs/vela";
+import { getContextIdentity } from "@velajs/authz/vela";
 //#region src/decorators/public.decorator.ts
 const Public = Reflector.createDecorator({ key: "vela.auth.public" });
 const PUBLIC_KEY = Public.KEY;
@@ -59,38 +59,114 @@ function createBetterAuthCatchallController(basePath = "/api/auth") {
 	], BetterAuthCatchallController);
 	return BetterAuthCatchallController;
 }
-/**
-* Default-path (`/api/auth`) catch-all controller. Retained for back-compat;
-* `BetterAuthModule` now mounts {@link createBetterAuthCatchallController} with
-* the configured `basePath`. Prefer the factory for a custom base path.
-*/
-const BetterAuthCatchallController = createBetterAuthCatchallController();
 //#endregion
 //#region src/better-auth.tokens.ts
 const BETTER_AUTH_OPTIONS = new InjectionToken("vela.BetterAuthOptions");
-const AUTH_USER_KEY = Symbol.for("vela.better-auth.user");
-const AUTH_SESSION_KEY = Symbol.for("vela.better-auth.session");
-const AUTH_ISSUER_KEY = Symbol.for("vela.better-auth.issuer");
-const AUTH_PRINCIPAL_TYPE_KEY = Symbol.for("vela.better-auth.principal-type");
 //#endregion
 //#region src/auth-request-state.ts
-const ANONYMOUS = Object.freeze({ authenticated: false });
-const stateByRequest = /* @__PURE__ */ new WeakMap();
-/** Clear any state before a guard evaluates a request. */
-const beginAuthRequest = (context) => {
-	stateByRequest.set(context.getRequest(), ANONYMOUS);
-};
-/** Publish a fully verified session for downstream guards and parameters. */
-const authenticateRequest = (context, state) => {
-	const authenticated = Object.freeze({
-		authenticated: true,
-		...state
+const sessions = /* @__PURE__ */ new WeakMap();
+function beginAuthRequest(context) {
+	clearTrustedRequestIdentity(context.getRequest());
+}
+function authenticateRequest(context, data, issuer) {
+	const request = context.getRequest();
+	setTrustedRequestIdentity(request, {
+		principal: {
+			issuer,
+			subject: data.user.id,
+			principalType: "user"
+		},
+		expiresAtMs: data.session.expiresAt.getTime(),
+		roles: data.roles,
+		...data.tenantId === void 0 ? {} : { tenantId: data.tenantId }
 	});
-	stateByRequest.set(context.getRequest(), authenticated);
-	return authenticated;
-};
-/** Missing state is anonymous: no guard means no ambient identity. */
-const getAuthRequestState = (context) => context.getType() === "http" ? stateByRequest.get(context.getRequest()) ?? ANONYMOUS : ANONYMOUS;
+	const identity = getTrustedRequestIdentity(request);
+	if (identity) sessions.set(identity, data);
+}
+function getAuthRequestState(context) {
+	if (context.getType() !== "http") return void 0;
+	const identity = getTrustedRequestIdentity(context.getRequest());
+	return identity && sessions.get(identity);
+}
+//#endregion
+//#region src/session-data.ts
+function own(value, key) {
+	if (typeof value !== "object" || value === null) return void 0;
+	const descriptor = Object.getOwnPropertyDescriptor(value, key);
+	return descriptor && "value" in descriptor ? descriptor.value : void 0;
+}
+function requiredString(value) {
+	return typeof value === "string" && value.length > 0;
+}
+function date(value) {
+	return value instanceof Date && Number.isFinite(value.getTime()) ? new Date(value) : void 0;
+}
+function optionalString(value) {
+	return value === void 0 || value === null || typeof value === "string";
+}
+/** Keep plugin data opaque; base model fields below are validated individually. */
+function dataProperties(value) {
+	return Object.fromEntries(Object.keys(value).map((key) => [key, own(value, key)]));
+}
+/** Validate the full Better Auth base models, not merely ids masquerading as them. */
+function validateSessionData(value) {
+	try {
+		const user = own(value, "user");
+		const session = own(value, "session");
+		if (typeof user !== "object" || user === null || typeof session !== "object" || session === null) return;
+		const id = own(user, "id");
+		const email = own(user, "email");
+		const name = own(user, "name");
+		const emailVerified = own(user, "emailVerified");
+		const image = own(user, "image");
+		const createdAt = date(own(user, "createdAt"));
+		const updatedAt = date(own(user, "updatedAt"));
+		const sessionId = own(session, "id");
+		const userId = own(session, "userId");
+		const token = own(session, "token");
+		const sessionCreatedAt = date(own(session, "createdAt"));
+		const sessionUpdatedAt = date(own(session, "updatedAt"));
+		const expiresAt = date(own(session, "expiresAt"));
+		const ipAddress = own(session, "ipAddress");
+		const userAgent = own(session, "userAgent");
+		const organization = own(session, "activeOrganizationId");
+		const role = own(user, "role");
+		let roles = [];
+		if (role !== void 0 && role !== null) {
+			if (typeof role === "string") roles = role.split(",").map((part) => part.trim()).filter(Boolean);
+			else if (Array.isArray(role) && role.every((entry) => typeof entry === "string")) roles = role.map((entry) => entry.trim()).filter(Boolean);
+			else return void 0;
+		}
+		if (!requiredString(id) || !requiredString(email) || typeof name !== "string" || typeof emailVerified !== "boolean" || !optionalString(image) || !createdAt || !updatedAt || !requiredString(sessionId) || userId !== id || !requiredString(token) || !sessionCreatedAt || !sessionUpdatedAt || !expiresAt || expiresAt.getTime() <= Date.now() || !optionalString(ipAddress) || !optionalString(userAgent) || organization !== void 0 && organization !== null && !requiredString(organization)) return void 0;
+		return {
+			user: Object.freeze({
+				...dataProperties(user),
+				id,
+				email,
+				name,
+				emailVerified,
+				createdAt,
+				updatedAt,
+				image
+			}),
+			session: Object.freeze({
+				...dataProperties(session),
+				id: sessionId,
+				userId: id,
+				token,
+				createdAt: sessionCreatedAt,
+				updatedAt: sessionUpdatedAt,
+				expiresAt,
+				ipAddress,
+				userAgent
+			}),
+			roles: Object.freeze(roles),
+			...typeof organization === "string" ? { tenantId: organization } : {}
+		};
+	} catch {
+		return;
+	}
+}
 //#endregion
 //#region src/decorators/optional-auth.decorator.ts
 const OptionalAuth = Reflector.createDecorator({ key: "vela.auth.optional" });
@@ -107,25 +183,18 @@ let AuthGuard = class AuthGuard {
 	}
 	async canActivate(context) {
 		if (context.getType() === "ws") {
-			if (hasValidWebSocketIdentity(context)) return true;
-			throw new AuthenticationRequiredException();
+			if (getContextIdentity(context)) return true;
+			throw new UnauthorizedException("Authentication required");
 		}
 		beginAuthRequest(context);
-		mirrorRequestContext(context, { authenticated: false });
 		if (this.reflector.getAllAndOverride(Public, context)) return true;
-		const request = context.getRequest();
-		const data = validateSessionData(await this.auth.api.getSession({ headers: request.headers }));
+		const data = validateSessionData(await this.auth.api.getSession({ headers: context.getRequest().headers }));
 		if (data) {
-			mirrorRequestContext(context, authenticateRequest(context, {
-				user: data.user,
-				session: data.session,
-				issuer: this.opts.issuer ?? "better-auth",
-				principalType: "user"
-			}));
+			authenticateRequest(context, data, this.opts.issuer ?? "better-auth");
 			return true;
 		}
 		if (this.reflector.getAllAndOverride(OptionalAuth, context)) return true;
-		throw new AuthenticationRequiredException();
+		throw new UnauthorizedException("Authentication required");
 	}
 };
 AuthGuard = __decorate([
@@ -134,280 +203,6 @@ AuthGuard = __decorate([
 	__decorateParam(1, Inject(BETTER_AUTH_OPTIONS)),
 	__decorateMetadata("design:paramtypes", [typeof BetterAuthService === "undefined" ? Object : BetterAuthService, Object])
 ], AuthGuard);
-function hasValidWebSocketIdentity(context) {
-	try {
-		const data = context.switchToWs().getClient()?.data;
-		if (!data || typeof data !== "object") return false;
-		const record = data;
-		const principal = record.principal;
-		if (!principal || typeof principal !== "object") return false;
-		const fields = principal;
-		return typeof fields.issuer === "string" && fields.issuer.length > 0 && typeof fields.subject === "string" && fields.subject.length > 0 && (fields.principalType === "user" || fields.principalType === "service") && typeof record.tenantId === "string" && record.tenantId.length > 0 && typeof record.expiresAtMs === "number" && Number.isSafeInteger(record.expiresAtMs) && record.expiresAtMs > Date.now();
-	} catch {
-		return false;
-	}
-}
-/**
-* Preserve the public REQUEST_CONTEXT symbols for applications that consume
-* them directly. The private Request-keyed state above remains canonical: a
-* missing/duplicated framework token must not prevent a verified guard from
-* publishing identity to its own downstream decorators and guards.
-*/
-function mirrorRequestContext(context, state) {
-	const request = context.getRequest();
-	if (!state.authenticated) clearTrustedRequestIdentity(request);
-	else {
-		const tenantId = readActiveOrganizationId(state.session);
-		setTrustedRequestIdentity(request, {
-			principal: {
-				issuer: state.issuer,
-				subject: state.user.id,
-				principalType: state.principalType
-			},
-			...tenantId === void 0 ? {} : { tenantId }
-		});
-	}
-	const container = context.getContext().get("container");
-	if (!container) return;
-	let reqCtx;
-	try {
-		reqCtx = container.resolve(REQUEST_CONTEXT);
-	} catch {
-		return;
-	}
-	if (!state.authenticated) {
-		reqCtx.set(AUTH_USER_KEY, void 0);
-		reqCtx.set(AUTH_SESSION_KEY, void 0);
-		reqCtx.set(AUTH_ISSUER_KEY, void 0);
-		reqCtx.set(AUTH_PRINCIPAL_TYPE_KEY, void 0);
-		return;
-	}
-	reqCtx.set(AUTH_USER_KEY, state.user);
-	reqCtx.set(AUTH_SESSION_KEY, state.session);
-	reqCtx.set(AUTH_ISSUER_KEY, state.issuer);
-	reqCtx.set(AUTH_PRINCIPAL_TYPE_KEY, state.principalType);
-}
-function readActiveOrganizationId(session) {
-	const descriptor = Object.getOwnPropertyDescriptor(session, "activeOrganizationId");
-	if (descriptor === void 0 || !("value" in descriptor)) return void 0;
-	const value = descriptor.value;
-	return typeof value === "string" && value.length > 0 ? value : void 0;
-}
-/** A test/provider override is trusted code, but its runtime result is not. */
-function validateSessionData(value) {
-	if (value === null || typeof value !== "object") return void 0;
-	try {
-		const userDescriptor = Object.getOwnPropertyDescriptor(value, "user");
-		const sessionDescriptor = Object.getOwnPropertyDescriptor(value, "session");
-		if (userDescriptor === void 0 || !("value" in userDescriptor) || sessionDescriptor === void 0 || !("value" in sessionDescriptor)) return;
-		const user = userDescriptor.value;
-		const session = sessionDescriptor.value;
-		if (user === null || typeof user !== "object" || session === null || typeof session !== "object") return;
-		const userIdDescriptor = Object.getOwnPropertyDescriptor(user, "id");
-		const sessionIdDescriptor = Object.getOwnPropertyDescriptor(session, "id");
-		const sessionUserIdDescriptor = Object.getOwnPropertyDescriptor(session, "userId");
-		const userId = userIdDescriptor !== void 0 && "value" in userIdDescriptor ? userIdDescriptor.value : void 0;
-		const sessionId = sessionIdDescriptor !== void 0 && "value" in sessionIdDescriptor ? sessionIdDescriptor.value : void 0;
-		const sessionUserId = sessionUserIdDescriptor !== void 0 && "value" in sessionUserIdDescriptor ? sessionUserIdDescriptor.value : void 0;
-		if (typeof userId !== "string" || userId.length === 0 || typeof sessionId !== "string" || sessionId.length === 0 || sessionUserId !== userId) return;
-		return {
-			user,
-			session
-		};
-	} catch {
-		return;
-	}
-}
-/**
-* `UnauthorizedException` preserves Nest-style direct behavior. The structural
-* VelaError brand also survives test/runtime package duplication, so the
-* central renderer still maps this to 401 rather than treating it as a foreign
-* 500 error.
-*/
-var AuthenticationRequiredException = class extends UnauthorizedException {
-	type = "VelaError";
-	code = "unauthorized";
-	status = 401;
-	constructor() {
-		super("Authentication required");
-	}
-};
-//#endregion
-//#region src/decorators/roles.decorator.ts
-const Roles = Reflector.createDecorator({ key: "vela.auth.roles" });
-const ROLES_KEY = Roles.KEY;
-//#endregion
-//#region src/guards/roles.guard.ts
-const ACCESS_DENIED$1 = "Access denied";
-let RolesGuard = class RolesGuard {
-	reflector = new Reflector();
-	canActivate(context) {
-		const required = this.reflector.getAllAndOverride(Roles, context);
-		if (!required || required.length === 0) return true;
-		const state = getAuthRequestState(context);
-		if (!state.authenticated) throw new ForbiddenException(ACCESS_DENIED$1);
-		const userRoles = normalizeRoles$1(state.user.role);
-		if (!required.some((r) => userRoles.includes(r))) throw new ForbiddenException(ACCESS_DENIED$1);
-		return true;
-	}
-};
-RolesGuard = __decorate([Injectable()], RolesGuard);
-function normalizeRoles$1(role) {
-	if (!role) return [];
-	if (Array.isArray(role)) return role;
-	return role.split(",").map((r) => r.trim()).filter(Boolean);
-}
-//#endregion
-//#region src/authz-bridge.ts
-/** Stable issuer namespace used for better-auth session principals. */
-const BETTER_AUTH_ISSUER = "better-auth";
-const normalizeRoles = (role) => {
-	if (!role) return [];
-	if (Array.isArray(role)) return role.filter(Boolean);
-	return role.split(",").map((r) => r.trim()).filter(Boolean);
-};
-/**
-* Adapts a better-auth user into a stable `@velajs/authz` {@link Identity}.
-* The issuer scopes `user.id` as both `subject` and the compatibility `userId`;
-* the admin-plugin `role` field supplies local roles.
-*
-* Fail-closed: a missing user (`null`/`undefined`, i.e. an unauthenticated
-* request) maps to the zero-privilege identity `{ roles: [] }`, so downstream
-* `can()` checks grant nothing.
-*/
-const identityFromUser = (user, issuer = BETTER_AUTH_ISSUER, principalType = "user") => {
-	if (!user || typeof user.id !== "string" || user.id.length === 0) return { roles: [] };
-	if (issuer.length === 0) throw new Error("@velajs/better-auth: identity issuer must be non-empty");
-	return {
-		issuer,
-		subject: user.id,
-		principalType,
-		userId: user.id,
-		roles: normalizeRoles(user.role)
-	};
-};
-/**
-* Flattens a better-auth AC role's `statements` into `resource:action`
-* permission strings — the granted-side format `@velajs/authz` matches
-* (wildcards included).
-*/
-const permissionsFromAcRole = (role) => {
-	const permissions = [];
-	for (const [resource, actions] of Object.entries(role.statements ?? {})) for (const action of actions ?? []) permissions.push(`${resource}:${action}`);
-	return permissions;
-};
-/**
-* Builds a fail-closed `@velajs/authz` {@link PermissionResolver} from a
-* better-auth access-control role table (`{ roleName: acRole }` — the same map
-* shape passed to better-auth's admin/organization plugins). An identity's
-* `roles` are unioned into their granted permission strings; unknown roles
-* contribute nothing.
-*
-* ```ts
-* const ac = createAccessControl({ posts: ['read', 'write'] });
-* const authz = createAuthz({
-*   resolver: betterAuthAcResolver({ editor: ac.newRole({ posts: ['write'] }) }),
-* });
-* await authz.can(identityFromUser(user), 'posts:write');
-* ```
-*/
-const betterAuthAcResolver = (roles) => {
-	const grantsByRole = /* @__PURE__ */ new Map();
-	for (const [name, role] of Object.entries(roles)) grantsByRole.set(name, permissionsFromAcRole(role));
-	return { grants(identity) {
-		const out = /* @__PURE__ */ new Set();
-		for (const name of identity.roles ?? []) for (const permission of grantsByRole.get(name) ?? []) out.add(permission);
-		return out;
-	} };
-};
-//#endregion
-//#region src/decorators/require-permission.decorator.ts
-/**
-* Declares the `@velajs/authz` permission(s) required to reach a controller or
-* route handler. Read via `Reflector` in an authorization guard, then checked
-* against the caller's `Identity` with `authz.can(...)`.
-*
-* ```ts
-* @RequirePermission(['posts:write'])
-* @Post()
-* create() { ... }
-* ```
-*
-* The metadata is a plain `string[]` of permission strings in the granted-side
-* format `@velajs/authz` matches (`resource:action`, or wildcards like
-* `posts:*`). Handler-level metadata overrides class-level (standard
-* `Reflector.getAllAndOverride` precedence).
-*
-* Semantics are **require-ALL** (AND): every listed permission must be granted
-* for access — the `PermissionGuard` denies if any one is missing. This
-* contrasts with `@Roles`, which is **OR** (any one of the listed roles
-* suffices).
-*/
-const RequirePermission = Reflector.createDecorator({ key: "vela.authz.permissions" });
-const REQUIRE_PERMISSION_KEY = RequirePermission.KEY;
-//#endregion
-//#region src/guards/permission.guard.ts
-const AUTHZ_TOKEN = AUTHZ;
-const ACCESS_DENIED = "Access denied";
-function resolveSingleAuthz(container, moduleId) {
-	try {
-		if (typeof container.resolveAll === "function") {
-			const candidates = container.resolveAll(AUTHZ_TOKEN, moduleId);
-			return candidates.length === 1 ? candidates[0] : void 0;
-		}
-		return container.resolve(AUTHZ_TOKEN, moduleId);
-	} catch {
-		return;
-	}
-}
-let PermissionGuard = class PermissionGuard {
-	reflector = new Reflector();
-	async canActivate(context) {
-		const required = this.reflector.getAllAndOverride(RequirePermission, context);
-		if (!required || required.length === 0) return true;
-		const container = resolveContextContainer(context);
-		const moduleId = context.getModuleId();
-		const authz = container === void 0 || moduleId === void 0 ? void 0 : resolveSingleAuthz(container, moduleId);
-		if (!authz) throw new ForbiddenException(ACCESS_DENIED);
-		const identity = resolveContextIdentity(context);
-		if (identity === void 0) throw new ForbiddenException(ACCESS_DENIED);
-		for (const permission of required) if (!await authz.can(identity, permission)) throw new ForbiddenException(ACCESS_DENIED);
-		return true;
-	}
-};
-PermissionGuard = __decorate([Injectable()], PermissionGuard);
-function resolveContextContainer(context) {
-	const direct = context.getContainer?.();
-	if (direct !== void 0) return direct;
-	if (context.getType() !== "http") return void 0;
-	try {
-		return context.getContext().get("container");
-	} catch {
-		return;
-	}
-}
-function resolveContextIdentity(context) {
-	if (context.getType() === "ws") try {
-		const data = context.switchToWs().getClient()?.data;
-		if (!data || typeof data !== "object") return void 0;
-		const record = data;
-		const principal = record.principal;
-		if (!principal || typeof principal !== "object") return void 0;
-		const fields = principal;
-		if (typeof fields.issuer !== "string" || fields.issuer.length === 0 || typeof fields.subject !== "string" || fields.subject.length === 0 || fields.principalType !== "user" && fields.principalType !== "service" || typeof record.tenantId !== "string" || record.tenantId.length === 0 || typeof record.expiresAtMs !== "number" || !Number.isSafeInteger(record.expiresAtMs) || record.expiresAtMs <= Date.now()) return;
-		return {
-			issuer: fields.issuer,
-			subject: fields.subject,
-			principalType: fields.principalType,
-			userId: fields.subject,
-			roles: []
-		};
-	} catch {
-		return;
-	}
-	const state = getAuthRequestState(context);
-	return state.authenticated ? identityFromUser(state.user, state.issuer, state.principalType) : void 0;
-}
 //#endregion
 //#region src/better-auth.module.ts
 const referenceIds = /* @__PURE__ */ new WeakMap();
@@ -435,75 +230,25 @@ function normalize(options) {
 	const basePath = normalizeBetterAuthBasePath(options.basePath);
 	const issuer = options.issuer ?? `better-auth:${basePath}`;
 	if (issuer.length === 0 || issuer !== issuer.trim()) throw new Error("@velajs/better-auth: issuer must be a non-empty stable namespace");
-	if (options.defaultPolicy !== void 0 && options.defaultPolicy !== "deny") throw new Error("@velajs/better-auth: defaultPolicy is deny-only; mark anonymous routes with @Public() or @OptionalAuth()");
 	return {
 		basePath,
 		issuer,
 		isGlobal: options.isGlobal ?? true,
-		defaultPolicy: "deny",
 		mountHandler: options.mountHandler ?? true
 	};
 }
 /** Providers, controllers, and exports shared by both entry points. */
 function commonContributions(n) {
 	return {
-		providers: [
-			BetterAuthService,
-			AuthGuard,
-			RolesGuard,
-			PermissionGuard
-		],
+		providers: [BetterAuthService, AuthGuard],
 		controllers: n.mountHandler ? [createBetterAuthCatchallController(n.basePath)] : [],
 		exports: [
 			BetterAuthService,
 			BETTER_AUTH_OPTIONS,
-			AuthGuard,
-			RolesGuard,
-			PermissionGuard
+			AuthGuard
 		]
 	};
 }
-/**
-* The blessed engine generates `forRoot`. `setup` runs once per instance at
-* call time: it re-provides {@link BETTER_AUTH_OPTIONS} with defaults applied,
-* derives the auth builder from those options, mounts the catch-all controller,
-* and — via the `global:` slot — registers the app-wide guard when `isGlobal`.
-*
-* `isGlobal` here means "apply AuthGuard app-wide", NOT "make this a global
-* module", so the default `isGlobal → global: true` extras transform is
-* replaced with identity; the flag reaches `setup` through the options bag.
-*/
-const authModuleHost = defineModule({
-	name: "BetterAuth",
-	optionsToken: BETTER_AUTH_OPTIONS,
-	transform: (definition) => definition,
-	key: (options) => stableHash(normalize(options)),
-	setup: ({ OPTIONS, options }) => {
-		const n = normalize(options);
-		const common = commonContributions(n);
-		const auth = options.auth;
-		return {
-			providers: [
-				{
-					provide: OPTIONS,
-					useValue: {
-						...n,
-						auth
-					}
-				},
-				lazyProvider({
-					provide: BETTER_AUTH_BUILDER,
-					inject: [OPTIONS],
-					useFactory: (o) => o.auth
-				}),
-				...common.providers
-			],
-			controllers: common.controllers,
-			exports: common.exports,
-			global: n.isGlobal ? { guards: [AuthGuard] } : void 0
-		};
-	}
-});
 var BetterAuthModule = class BetterAuthModule {
 	/**
 	* Synchronous registration. The auth instance is constructed by the consumer
@@ -512,14 +257,21 @@ var BetterAuthModule = class BetterAuthModule {
 	* connection, in-memory adapters, etc.).
 	*/
 	static forRoot(options) {
-		const shape = stableHash(normalize(options));
+		const normalized = normalize(options);
+		const shape = stableHash(normalized);
 		const key = options.key === void 0 ? `${shape}:auth:${referenceId(options.auth)}` : claimExplicitKey(options.key, "auth", options.auth, shape);
+		const common = commonContributions(normalized);
 		return {
-			...authModuleHost.ConfigurableModuleClass.forRoot({
-				...options,
-				key
-			}),
-			module: BetterAuthModule
+			module: BetterAuthModule,
+			key,
+			providers: [
+				defineProvider(BETTER_AUTH_OPTIONS, { useValue: normalized }),
+				defineProvider(BETTER_AUTH_BUILDER, { useValue: () => options.auth }),
+				...common.providers,
+				...normalized.isGlobal ? provideGlobal("guard", AuthGuard) : []
+			],
+			controllers: common.controllers,
+			exports: common.exports
 		};
 	}
 	/**
@@ -527,11 +279,9 @@ var BetterAuthModule = class BetterAuthModule {
 	* first time anything reads `BetterAuthService.auth` (or `.api` / `.handler`).
 	* In normal request handling that's `AuthGuard.canActivate` or the catch-all
 	* controller's `.handle`. At module load the factory does NOT run — it's only
-	* captured behind {@link lazyProvider}'s memoized thunk. This is what makes
-	* Cloudflare bindings (D1, KV, R2) work: the binding isn't ready at boot, but
-	* it IS by the time a request flows through and the guard / catch-all reads
-	* the service. Inject deps resolve at module load (cheap BindingRef wrappers);
-	* their *values* are read at first auth use, inside your factory body.
+	* captured in the checked builder provider. The Workers adapter supplies its
+	* native environment before DI; the lazily constructed auth instance belongs
+	* to that environment's application and never captures another app's bindings.
 	*/
 	static forRootAsync(options) {
 		const n = normalize(options);
@@ -546,14 +296,10 @@ var BetterAuthModule = class BetterAuthModule {
 			key,
 			imports: options.imports ?? [],
 			providers: [
-				{
-					provide: BETTER_AUTH_OPTIONS,
-					useValue: n
-				},
-				lazyProvider({
-					provide: BETTER_AUTH_BUILDER,
+				defineProvider(BETTER_AUTH_OPTIONS, { useValue: n }),
+				defineProvider(BETTER_AUTH_BUILDER, {
 					inject: options.inject,
-					useFactory: options.useFactory
+					useFactory: (...deps) => () => options.useFactory(...deps)
 				}),
 				...common.providers,
 				...n.isGlobal ? provideGlobal("guard", AuthGuard) : []
@@ -566,16 +312,78 @@ var BetterAuthModule = class BetterAuthModule {
 //#endregion
 //#region src/decorators/current-user.decorator.ts
 const CurrentUser = createParamDecorator((_data, ctx) => {
-	const state = getAuthRequestState(ctx);
-	return state.authenticated ? state.user : void 0;
+	return getAuthRequestState(ctx)?.user;
 });
 //#endregion
 //#region src/decorators/current-session.decorator.ts
 const CurrentSession = createParamDecorator((_data, ctx) => {
-	const state = getAuthRequestState(ctx);
-	return state.authenticated ? state.session : void 0;
+	return getAuthRequestState(ctx)?.session;
 });
 //#endregion
-export { AUTH_ISSUER_KEY, AUTH_PRINCIPAL_TYPE_KEY, AUTH_SESSION_KEY, AUTH_USER_KEY, AuthGuard, BETTER_AUTH_ISSUER, BETTER_AUTH_OPTIONS, BetterAuthCatchallController, BetterAuthModule, BetterAuthService, CurrentSession, CurrentUser, OPTIONAL_AUTH_KEY, OptionalAuth, PUBLIC_KEY, PermissionGuard, Public, REQUIRE_PERMISSION_KEY, ROLES_KEY, RequirePermission, Roles, RolesGuard, betterAuthAcResolver, createBetterAuthCatchallController, identityFromUser, permissionsFromAcRole };
+//#region src/authz-bridge.ts
+/** Stable issuer namespace used for better-auth session principals. */
+const BETTER_AUTH_ISSUER = "better-auth";
+const normalizeRoles = (role) => {
+	if (!role) return [];
+	if (Array.isArray(role)) return role.filter(Boolean);
+	return role.split(",").map((r) => r.trim()).filter(Boolean);
+};
+/**
+* Pure authorization projection; this does not authenticate or publish trusted state.
+* Adapts an already verified better-auth user into a stable `@velajs/authz` {@link Identity}.
+* The issuer scopes `user.id` as both `subject` and the compatibility `userId`;
+* the admin-plugin `role` field supplies local roles.
+*
+* Fail-closed: a missing user (`null`/`undefined`, i.e. an unauthenticated
+* request) maps to the zero-privilege identity `{ roles: [] }`, so downstream
+* `can()` checks grant nothing.
+*/
+const identityFromUser = (user, issuer = BETTER_AUTH_ISSUER, principalType = "user") => {
+	if (!user || typeof user.id !== "string" || user.id.length === 0) return { roles: [] };
+	if (issuer.length === 0) throw new Error("@velajs/better-auth: identity issuer must be non-empty");
+	return {
+		issuer,
+		subject: user.id,
+		principalType,
+		userId: user.id,
+		roles: normalizeRoles(user.role)
+	};
+};
+/**
+* Flattens a better-auth AC role's `statements` into `resource:action`
+* permission strings — the granted-side format `@velajs/authz` matches
+* (wildcards included).
+*/
+const permissionsFromAcRole = (role) => {
+	const permissions = [];
+	for (const [resource, actions] of Object.entries(role.statements ?? {})) for (const action of actions ?? []) permissions.push(`${resource}:${action}`);
+	return permissions;
+};
+/**
+* Builds a fail-closed `@velajs/authz` {@link PermissionResolver} from a
+* better-auth access-control role table (`{ roleName: acRole }` — the same map
+* shape passed to better-auth's admin/organization plugins). An identity's
+* `roles` are unioned into their granted permission strings; unknown roles
+* contribute nothing.
+*
+* ```ts
+* const ac = createAccessControl({ posts: ['read', 'write'] });
+* const authz = createAuthz({
+*   resolver: betterAuthAcResolver({ editor: ac.newRole({ posts: ['write'] }) }),
+* });
+* await authz.can(identityFromUser(user), 'posts:write');
+* ```
+*/
+const betterAuthAcResolver = (roles) => {
+	const grantsByRole = /* @__PURE__ */ new Map();
+	for (const [name, role] of Object.entries(roles)) grantsByRole.set(name, permissionsFromAcRole(role));
+	return { grants(identity) {
+		const out = /* @__PURE__ */ new Set();
+		for (const name of identity.roles ?? []) for (const permission of grantsByRole.get(name) ?? []) out.add(permission);
+		return out;
+	} };
+};
+//#endregion
+export { AuthGuard, BETTER_AUTH_ISSUER, BETTER_AUTH_OPTIONS, BetterAuthModule, BetterAuthService, CurrentSession, CurrentUser, OPTIONAL_AUTH_KEY, OptionalAuth, PUBLIC_KEY, Public, betterAuthAcResolver, createBetterAuthCatchallController, identityFromUser, permissionsFromAcRole };
 
 //# sourceMappingURL=index.js.map