@velajs/better-auth 1.22.2 → 1.29.0

package/CHANGELOG.md

@@ -1,5 +1,98 @@
 # Changelog
 
+## 1.29.0
+
+### Minor Changes
+
+- 2dd809d: `BetterAuthModule.forRoot({ key })` and `forRootAsync({ key })` no longer throw when a root is rebuilt with the same explicit key in one isolate, for example per Worker environment or per Durable Object. Within an application, the same registration still deduplicates.
+  
+  **Behavior change:** an explicit `key` no longer rejects a different registration that reuses it within one application. The key now labels a registration instead of claiming it: the options shape and the auth instance (or `useFactory`) stay part of the module's identity, so each distinct registration under the same key, one with a different auth instance, factory or options, becomes its own module instance, as a registration without a key does. Previously the second registration threw. Use distinct keys, or pass the same auth instance or factory and options, when one application should hold a single registration.
+- 8a3016c: Add `BetterAuthUpgradeAuthenticator` for `@WebSocketGateway({ authenticator: BetterAuthUpgradeAuthenticator })`. It reads the session cookie through the module's `BetterAuthService`, validates the full session, and issues a WebSocket identity under the `BetterAuthModule` issuer, as `AuthGuard` does for HTTP, expiring with the session. The tenant is the session's active organization; provide `BETTER_AUTH_UPGRADE_TENANT` in the module that declares the gateway to choose it per connection (`(session, context, request) => tenantId | undefined`). Without a tenant, the upgrade is refused.
+- 4071cb7: The built-in guards inject the application `Reflector` instead of constructing their own: `AuthGuard` (`@velajs/better-auth`), `FeatureFlagGuard` (`@velajs/feature-flags`), `PermissionGuard` and `RolesGuard` (`@velajs/authz/vela`), `TenantGuard` (`@velajs/tenant/vela`) and `CedarGuard` (`@velajs/authz-cedar/vela`). `PermissionGuard`, `RolesGuard` and `TenantGuard` are now injectable, so `@UseGuards()` builds them in the declaring module through DI, like any provider.
+  
+  **Behavior change:** each guard takes the `Reflector` as a constructor parameter, after any dependencies it already had: `new PermissionGuard(reflector)`, `new RolesGuard(reflector)`, `new TenantGuard(reflector)`, `new CedarGuard(reflector)`, `new AuthGuard(auth, options, reflector)` and `new FeatureFlagGuard(flags, reflector)`. Code that constructs a guard itself, such as `app.useGlobalGuards(new TenantGuard(app.get(Reflector)))` or a unit test, passes the application's `Reflector` or a `new Reflector()`, and a subclass that declares its own constructor passes it to `super()`. A guard class passed to `app.useGlobalGuards()` is built through DI only when a module registers it, including the copy a module registers for a `@UseGuards()` reference; otherwise pass an instance or register it as `{ provide: APP_GUARD, useClass: PermissionGuard }`. Guards resolved through DI need no change.
+- 4071cb7: A factory without parameters may omit `inject` in `BetterAuthModule.forRootAsync()`, `MailModule.forRootAsync()`, `StorageModule.forRootAsync()`, `RpcClientModule.registerAsync()` and `overrideProvider(token).useFactory({ factory })`, as in the `@velajs/vela` factories. A factory with parameters still names their tokens in `inject`, and a dependency tuple given as a type argument still needs a matching `inject`.
+  
+  `StorageModule.forRootAsync()` factories may return `{ driver, multipartGrantSecret }` instead of a bare driver, so the multipart grant secret comes through DI, for example from `ENV`, now that roots are static. The factory still runs once, on first use, or again on the next use until it succeeds; its secret takes precedence over `http.multipartGrantSecret` and is validated with the rest of the factory result on each such use, and multipart endpoints without any secret keep refusing every request. Adds the `StorageAsyncResult` and `StorageControllerOptions` types, and `createStorageController()` takes an optional token for the values it resolves per application.
+  
+  **Behavior change:** a multipart grant secret shorter than 32 bytes is a server configuration error instead of a client error. `StorageModule.forRoot()` throws for such an `http.multipartGrantSecret` when the module is set up, and a `forRootAsync()` factory that returns one fails every storage operation and multipart request until the factory returns a valid result, which the controller answers with a redacted 502 `upstream_error`. Multipart requests no longer answer 400 `invalid_request` with a message that names the setting.
+  
+  **Behavior change:** `MailModule.forRootAsync()` and `StorageModule.forRootAsync()` throw when called with a factory that declares parameters but no `inject`, naming the method, instead of running it with `undefined` arguments. `MailModuleAsyncOptions`, `StorageModuleAsyncOptions` and `RpcClientAsyncOptions` are type aliases instead of interfaces, so an interface can no longer extend them: intersect them instead (`RpcClientAsyncOptions<Inject> & { region: string }`). `MailModuleAsyncOptions.imports` is typed `ModuleImport[]`, so a caller that enables `exactOptionalPropertyTypes` omits it instead of passing `undefined`.
+
+### Patch Changes
+
+- Updated dependencies [07d1713]
+- Updated dependencies [db18d3a]
+- Updated dependencies [07d1713]
+- Updated dependencies [4071cb7]
+- Updated dependencies [bacaacd]
+- Updated dependencies [a814199]
+- Updated dependencies [1838474]
+- Updated dependencies [8a3016c]
+- Updated dependencies [d803a49]
+- Updated dependencies [b235935]
+- Updated dependencies [08a81c8]
+- Updated dependencies [5b5b81d]
+- Updated dependencies [7daf4fc]
+- Updated dependencies [35e8e0d]
+- Updated dependencies [4420501]
+- Updated dependencies [ff44b6a]
+- Updated dependencies [6d4f0c0]
+- Updated dependencies [e3bda2a]
+- Updated dependencies [bd7e3c9]
+- Updated dependencies [2b74880]
+- Updated dependencies [5ba8635]
+- Updated dependencies [db0c834]
+- Updated dependencies [d6f6a65]
+- Updated dependencies [8a3016c]
+- Updated dependencies [d5a3ec8]
+- Updated dependencies [0f7e8e7]
+- Updated dependencies [41ec70d]
+- Updated dependencies [b265297]
+- Updated dependencies [bdfff47]
+- Updated dependencies [28c7d07]
+- Updated dependencies [8a3016c]
+- Updated dependencies [44efdde]
+  - @velajs/vela@1.29.0
+  - @velajs/authz@1.29.0
+
+## 1.28.0
+
+### Minor Changes
+
+- Continue the module-based Workers APIs on the 1.x release line. Vela permits breaking changes in minor releases and does not retain compatibility layers. Upgrade the framework and integrations together for native queue dispatch, cron scheduling, RPC modules and asynchronous roots; see docs/module-workers.md.
+
+### Patch Changes
+
+- Updated dependencies
+  - @velajs/authz@1.28.0
+  - @velajs/vela@1.28.0
+
+## 3.0.0
+
+### Major Changes
+
+- Publish module-based Workers on the unused 3.x stable release line. Earlier experimental 2.0.0 registry versions are immutable and do not contain this release. Upgrade the framework and integrations together; see docs/module-workers.md for queue bootstrap, native delivery, RPC modules and async root migration details.
+
+### Patch Changes
+
+- Updated dependencies
+  - @velajs/authz@3.0.0
+  - @velajs/vela@3.0.0
+
+## 2.0.0
+
+### Major Changes
+
+- a2d2692: Require the Vela 2 module/runtime peer line. Packages that raise their framework or adapter peer requirement ship a major version so existing 1.x installations are not offered an incompatible patch release. Upgrade the related framework integrations together; native queue/bootstrap migration is documented in docs/module-workers.md.
+
+### Patch Changes
+
+- Updated dependencies [a2d2692]
+- Updated dependencies [b99d71a]
+  - @velajs/authz@2.0.0
+  - @velajs/vela@2.0.0
+
 ## 1.22.2
 
 ### Patch Changes

package/README.md

@@ -74,12 +74,12 @@ imports: [
 
 ### Pattern B — DI'd plugin construction
 
-`forRootAsync` requires an explicit `inject` tuple (use `inject: []` when there are no dependencies), so factory parameter types always have matching runtime tokens. It lets Vela services participate in your Better Auth configuration. On Workers, declare `WORKER_ENV = new InjectionToken<WorkerEnv>('app.Env')` and pass that token to `createCloudflareWorker(AppModule, { envToken: WORKER_ENV })`; the native event environment is available before DI factories run.
+`forRootAsync` types the factory's parameters from its `inject` tuple, so they always have matching runtime tokens; a factory without parameters may omit `inject`. It lets Vela services participate in your Better Auth configuration. On Workers, inject the framework `ENV` from `@velajs/vela`: `createCloudflareWorker(AppModule)` seeds the native event environment before DI factories run, and `wrangler types` types its bindings.
 
 ```ts
 imports: [
   BetterAuthModule.forRootAsync({
-    inject: [WORKER_ENV, EmailService],
+    inject: [ENV, EmailService],
     useFactory: (env, email) => betterAuth({
         database: drizzleAdapter(drizzle(env.DB), { provider: 'sqlite' }),
         plugins: [
@@ -191,6 +191,41 @@ falls back to a platform-attested client address.
 
 `BETTER_AUTH_OPTIONS` contains runtime configuration; read the auth instance from `BetterAuthService`. Use `createBetterAuthCatchallController()` for a manually mounted catch-all.
 
+## WebSocket upgrades
+
+`BetterAuthUpgradeAuthenticator` authenticates a WebSocket upgrade from the Better Auth session cookie. The application resolves it from the module that declares the gateway, so that module must see `BetterAuthModule`'s exports:
+
+```ts
+import { defineProvider, Module } from '@velajs/vela';
+import { WebSocketGateway } from '@velajs/vela/websocket';
+import {
+  BETTER_AUTH_UPGRADE_TENANT,
+  BetterAuthModule,
+  BetterAuthUpgradeAuthenticator,
+} from '@velajs/better-auth';
+
+@WebSocketGateway({
+  path: '/boards/:board/ws',
+  roomParam: 'board',
+  authenticator: BetterAuthUpgradeAuthenticator,
+})
+class BoardGateway {}
+
+@Module({
+  imports: [BetterAuthModule.forRoot({ auth, issuer: 'boards' })],
+  providers: [
+    BoardGateway,
+    // Optional: choose the tenant per connection. Returning undefined refuses it.
+    defineProvider(BETTER_AUTH_UPGRADE_TENANT, {
+      useValue: (_session, context) => (context.room === 'lobby' ? 'public' : undefined),
+    }),
+  ],
+})
+class BoardsModule {}
+```
+
+The principal carries the module's `issuer`, as `AuthGuard` does for HTTP, and the identity expires with the session. Every WebSocket identity needs a tenant: by default it is the session's active organization, and a session without one is refused unless a `BETTER_AUTH_UPGRADE_TENANT` resolver supplies a tenant.
+
 ## Trusted identity and typing
 
 `@CurrentUser()` and `@CurrentSession()` expose only validated Better Auth data tied to the exact current trusted identity. Public routes, missing/rejected sessions, logout, expiry, and another provider replacing the identity invalidate those values. Hono user variables cannot grant roles or permissions.
@@ -221,12 +256,11 @@ If you deploy to Cloudflare Workers, smoke-test your bundle for `node:` imports.
 Set `mountHandler: false` and mount the catch-all yourself if you need a base path other than `/api/auth`:
 
 ```ts
-import { Controller, All, Req, Inject, Injectable } from '@velajs/vela';
+import { Controller, All, Req, Inject } from '@velajs/vela';
 import { BetterAuthService, Public } from '@velajs/better-auth';
 
 @Public(true)
 @Controller('/auth')
-@Injectable()
 class CustomCatchallController {
   constructor(@Inject(BetterAuthService) private auth: BetterAuthService) {}
   @All('/*') handle(@Req() c: Context) { return this.auth.handler(c.req.raw); }

package/dist/index.d.ts

@@ -1,5 +1,6 @@
 import { a as Session, i as BetterAuthRuntimeOptions, n as BetterAuthInstance, o as User, r as BetterAuthModuleOptions, t as BetterAuthService } from "./better-auth.service-CvmboUID.js";
-import { CanActivate, DynamicModule, ExecutionContext, InferTokens, InjectionToken, Token, Type } from "@velajs/vela";
+import { CanActivate, DynamicModule, ExecutionContext, FactoryInject, InferTokens, InjectionToken, Reflector, Token, Type } from "@velajs/vela";
+import { UpgradeAuthenticator, WebSocketUpgradeAuthenticationContext, WebSocketUpgradeIdentity } from "@velajs/vela/websocket";
 import { Identity, PermissionResolver } from "@velajs/authz";
 //#region src/better-auth.module.d.ts
 /**
@@ -11,14 +12,15 @@ import { Identity, PermissionResolver } from "@velajs/authz";
  *
  * ```ts
  * BetterAuthModule.forRootAsync({
- *   inject: [WORKER_ENV, ConfigService], // captured as readonly tuple
+ *   inject: [ENV, ConfigService],         // captured as readonly tuple
  *   useFactory: (env, config) =>          // inferred from the tokens
  *     betterAuth({ database: drizzleAdapter(drizzle(env.DB), ...) }),
  * });
  * ```
+ *
+ * A factory without parameters may omit `inject`.
  */
-interface ForRootAsyncOptions<Inject extends readonly Token[] = readonly Token[]> {
-  inject: Inject;
+type ForRootAsyncOptions<Inject extends readonly Token[] = readonly Token[]> = {
   imports?: DynamicModule['imports'];
   useFactory: (...deps: InferTokens<Inject>) => BetterAuthInstance;
   isGlobal?: boolean;
@@ -26,7 +28,7 @@ interface ForRootAsyncOptions<Inject extends readonly Token[] = readonly Token[]
   basePath?: string;
   issuer?: string;
   key?: string;
-}
+} & FactoryInject<Inject>;
 export declare class BetterAuthModule {
   /**
    * Synchronous registration. The auth instance is constructed by the consumer
@@ -74,10 +76,44 @@ export declare class AuthGuard implements CanActivate {
   private readonly auth;
   private readonly opts;
   private readonly reflector;
-  constructor(auth: BetterAuthService, opts: BetterAuthRuntimeOptions);
+  constructor(auth: BetterAuthService, opts: BetterAuthRuntimeOptions, reflector: Reflector);
   canActivate(context: ExecutionContext): Promise<boolean>;
 }
 //#endregion
+//#region src/upgrade-authenticator.d.ts
+/** The validated Better Auth session behind a WebSocket upgrade. */
+interface BetterAuthUpgradeSession {
+  readonly user: User;
+  readonly session: Session;
+}
+/**
+ * Chooses the tenant a WebSocket connection joins. Returning no tenant (or
+ * throwing) refuses the upgrade.
+ */
+type BetterAuthUpgradeTenantResolver = (session: BetterAuthUpgradeSession, context: WebSocketUpgradeAuthenticationContext, request: Request) => string | undefined | Promise<string | undefined>;
+/**
+ * Optional tenant resolver for {@link BetterAuthUpgradeAuthenticator}. Provide it
+ * in the module that declares the gateway; without one, the session's active
+ * organization is the tenant.
+ */
+export declare const BETTER_AUTH_UPGRADE_TENANT: InjectionToken<BetterAuthUpgradeTenantResolver>;
+/**
+ * WebSocket upgrade authenticator backed by the Better Auth session cookie:
+ * `@WebSocketGateway({ authenticator: BetterAuthUpgradeAuthenticator })`.
+ *
+ * The principal uses the `BetterAuthModule` issuer, as `AuthGuard` does for
+ * HTTP. The identity expires with the session. Every WebSocket identity carries
+ * a tenant, so a session without an active organization is refused unless a
+ * {@link BETTER_AUTH_UPGRADE_TENANT} resolver supplies one.
+ */
+export declare class BetterAuthUpgradeAuthenticator implements UpgradeAuthenticator {
+  private readonly auth;
+  private readonly options;
+  private readonly resolveTenant?;
+  constructor(auth: BetterAuthService, options: BetterAuthRuntimeOptions, resolveTenant?: BetterAuthUpgradeTenantResolver | undefined);
+  authenticate(request: Request, context: WebSocketUpgradeAuthenticationContext): Promise<WebSocketUpgradeIdentity | false>;
+}
+//#endregion
 //#region src/decorators/current-user.decorator.d.ts
 export declare const CurrentUser: (data?: unknown, ...pipes: import("@velajs/vela").PipeType[]) => ParameterDecorator;
 //#endregion
@@ -147,5 +183,5 @@ export declare const permissionsFromAcRole: (role: BetterAuthAcRole) => string[]
  */
 export declare const betterAuthAcResolver: (roles: Readonly<Record<string, BetterAuthAcRole>>) => PermissionResolver;
 //#endregion
-export { type AuthUser, type BetterAuthAcRole, type BetterAuthInstance, type BetterAuthModuleOptions, type BetterAuthRuntimeOptions, BetterAuthService, type Session, type User };
+export { type AuthUser, type BetterAuthAcRole, type BetterAuthInstance, type BetterAuthModuleOptions, type BetterAuthRuntimeOptions, BetterAuthService, type BetterAuthUpgradeSession, type BetterAuthUpgradeTenantResolver, type Session, type User };
 //# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -1,5 +1,5 @@
 import { a as __decorateMetadata, i as __decorateParam, n as BetterAuthService, r as __decorate, t as BETTER_AUTH_BUILDER } from "./better-auth.service-SNg1YFTK.js";
-import { All, Controller, Inject, Injectable, InjectionToken, Reflector, Req, UnauthorizedException, clearTrustedRequestIdentity, createParamDecorator, createTrustedRequestIdentityStore, defineProvider, getTrustedContextRequest, provideGlobal, setTrustedRequestIdentity, stableHash } from "@velajs/vela";
+import { All, Controller, Inject, Injectable, InjectionToken, Optional, Reflector, Req, UnauthorizedException, clearTrustedRequestIdentity, createParamDecorator, createTrustedRequestIdentityStore, defineProvider, getTrustedContextRequest, lazyProvider, provideGlobal, setTrustedRequestIdentity, stableHash } from "@velajs/vela";
 import { getContextIdentity } from "@velajs/authz/vela";
 //#region src/decorators/public.decorator.ts
 const Public = Reflector.createDecorator({ key: "vela.auth.public" });
@@ -53,7 +53,6 @@ function createBetterAuthCatchallController(basePath = "/api/auth") {
 	BetterAuthCatchallController = __decorate([
 		Public(true),
 		Controller(normalizedBasePath),
-		Injectable(),
 		__decorateParam(0, Inject(BetterAuthService)),
 		__decorateMetadata("design:paramtypes", [typeof BetterAuthService === "undefined" ? Object : BetterAuthService])
 	], BetterAuthCatchallController);
@@ -174,10 +173,11 @@ const OPTIONAL_AUTH_KEY = OptionalAuth.KEY;
 let AuthGuard = class AuthGuard {
 	auth;
 	opts;
-	reflector = new Reflector();
-	constructor(auth, opts) {
+	reflector;
+	constructor(auth, opts, reflector) {
 		this.auth = auth;
 		this.opts = opts;
+		this.reflector = reflector;
 	}
 	async canActivate(context) {
 		if (context.getType() === "ws") {
@@ -203,12 +203,16 @@ AuthGuard = __decorate([
 	Injectable(),
 	__decorateParam(0, Inject(BetterAuthService)),
 	__decorateParam(1, Inject(BETTER_AUTH_OPTIONS)),
-	__decorateMetadata("design:paramtypes", [typeof BetterAuthService === "undefined" ? Object : BetterAuthService, Object])
+	__decorateParam(2, Inject(Reflector)),
+	__decorateMetadata("design:paramtypes", [
+		typeof BetterAuthService === "undefined" ? Object : BetterAuthService,
+		Object,
+		typeof Reflector === "undefined" ? Object : Reflector
+	])
 ], AuthGuard);
 //#endregion
 //#region src/better-auth.module.ts
 const referenceIds = /* @__PURE__ */ new WeakMap();
-const explicitKeyClaims = /* @__PURE__ */ new Map();
 let nextReferenceId = 1;
 function referenceId(reference) {
 	const existing = referenceIds.get(reference);
@@ -217,16 +221,16 @@ function referenceId(reference) {
 	referenceIds.set(reference, id);
 	return id;
 }
-function claimExplicitKey(key, kind, reference, shape) {
+/**
+* An explicit key names a registration without widening its identity: the
+* options shape and auth reference stay in the module key, so the same
+* registration deduplicates within an application while a different one
+* (including a root rebuilt per environment) becomes its own instance. No
+* process-wide state is kept, so repeated bootstraps in one isolate succeed.
+*/
+function explicitKey(key, shape, reference) {
 	if (key.length === 0 || key !== key.trim()) throw new Error("@velajs/better-auth: an explicit module key must be a non-empty string");
-	const existing = explicitKeyClaims.get(key);
-	if (existing !== void 0 && (existing.kind !== kind || existing.reference !== reference || existing.shape !== shape)) throw new Error(`@velajs/better-auth: explicit module key "${key}" is already bound to a different auth registration`);
-	explicitKeyClaims.set(key, {
-		kind,
-		reference,
-		shape
-	});
-	return `explicit:${key}:ref:${referenceId(reference)}`;
+	return `explicit:${key}:${shape}:ref:${referenceId(reference)}`;
 }
 function normalize(options) {
 	const basePath = normalizeBetterAuthBasePath(options.basePath);
@@ -261,7 +265,7 @@ var BetterAuthModule = class BetterAuthModule {
 	static forRoot(options) {
 		const normalized = normalize(options);
 		const shape = stableHash(normalized);
-		const key = options.key === void 0 ? `${shape}:auth:${referenceId(options.auth)}` : claimExplicitKey(options.key, "auth", options.auth, shape);
+		const key = options.key === void 0 ? `${shape}:auth:${referenceId(options.auth)}` : explicitKey(options.key, shape, options.auth);
 		const common = commonContributions(normalized);
 		return {
 			module: BetterAuthModule,
@@ -292,16 +296,17 @@ var BetterAuthModule = class BetterAuthModule {
 			...n,
 			inject: options.inject
 		});
-		const key = options.key === void 0 ? `${shape}:factory:${referenceId(options.useFactory)}` : claimExplicitKey(options.key, "factory", options.useFactory, shape);
+		const key = options.key === void 0 ? `${shape}:factory:${referenceId(options.useFactory)}` : explicitKey(options.key, shape, options.useFactory);
 		return {
 			module: BetterAuthModule,
 			key,
 			imports: options.imports ?? [],
 			providers: [
 				defineProvider(BETTER_AUTH_OPTIONS, { useValue: n }),
-				defineProvider(BETTER_AUTH_BUILDER, {
-					inject: options.inject,
-					useFactory: (...deps) => () => options.useFactory(...deps)
+				lazyProvider({
+					...options,
+					provide: BETTER_AUTH_BUILDER,
+					memoize: false
 				}),
 				...common.providers,
 				...n.isGlobal ? provideGlobal("guard", AuthGuard) : []
@@ -312,6 +317,54 @@ var BetterAuthModule = class BetterAuthModule {
 	}
 };
 //#endregion
+//#region src/upgrade-authenticator.ts
+/**
+* Optional tenant resolver for {@link BetterAuthUpgradeAuthenticator}. Provide it
+* in the module that declares the gateway; without one, the session's active
+* organization is the tenant.
+*/
+const BETTER_AUTH_UPGRADE_TENANT = new InjectionToken("vela.better-auth.UpgradeTenant");
+let BetterAuthUpgradeAuthenticator = class BetterAuthUpgradeAuthenticator {
+	auth;
+	options;
+	resolveTenant;
+	constructor(auth, options, resolveTenant) {
+		this.auth = auth;
+		this.options = options;
+		this.resolveTenant = resolveTenant;
+	}
+	async authenticate(request, context) {
+		const data = validateSessionData(await this.auth.api.getSession({ headers: request.headers }));
+		if (!data) return false;
+		const tenantId = this.resolveTenant ? await this.resolveTenant({
+			user: data.user,
+			session: data.session
+		}, context, request) : data.tenantId;
+		if (typeof tenantId !== "string" || tenantId.length === 0) return false;
+		return {
+			principal: {
+				issuer: this.options.issuer ?? "better-auth",
+				subject: data.user.id,
+				principalType: "user"
+			},
+			tenantId,
+			expiresAtMs: data.session.expiresAt.getTime()
+		};
+	}
+};
+BetterAuthUpgradeAuthenticator = __decorate([
+	Injectable(),
+	__decorateParam(0, Inject(BetterAuthService)),
+	__decorateParam(1, Inject(BETTER_AUTH_OPTIONS)),
+	__decorateParam(2, Optional()),
+	__decorateParam(2, Inject(BETTER_AUTH_UPGRADE_TENANT)),
+	__decorateMetadata("design:paramtypes", [
+		typeof BetterAuthService === "undefined" ? Object : BetterAuthService,
+		Object,
+		Object
+	])
+], BetterAuthUpgradeAuthenticator);
+//#endregion
 //#region src/decorators/current-user.decorator.ts
 const CurrentUser = createParamDecorator((_data, ctx) => {
 	return getAuthRequestState(ctx)?.user;
@@ -386,6 +439,6 @@ const betterAuthAcResolver = (roles) => {
 	} };
 };
 //#endregion
-export { AuthGuard, BETTER_AUTH_ISSUER, BETTER_AUTH_OPTIONS, BetterAuthModule, BetterAuthService, CurrentSession, CurrentUser, OPTIONAL_AUTH_KEY, OptionalAuth, PUBLIC_KEY, Public, betterAuthAcResolver, createBetterAuthCatchallController, identityFromUser, permissionsFromAcRole };
+export { AuthGuard, BETTER_AUTH_ISSUER, BETTER_AUTH_OPTIONS, BETTER_AUTH_UPGRADE_TENANT, BetterAuthModule, BetterAuthService, BetterAuthUpgradeAuthenticator, CurrentSession, CurrentUser, OPTIONAL_AUTH_KEY, OptionalAuth, PUBLIC_KEY, Public, betterAuthAcResolver, createBetterAuthCatchallController, identityFromUser, permissionsFromAcRole };
 
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":[],"sources":["../src/decorators/public.decorator.ts","../src/base-path.ts","../src/better-auth.controller.ts","../src/better-auth.tokens.ts","../src/auth-request-state.ts","../src/session-data.ts","../src/decorators/optional-auth.decorator.ts","../src/guards/auth.guard.ts","../src/better-auth.module.ts","../src/decorators/current-user.decorator.ts","../src/decorators/current-session.decorator.ts","../src/authz-bridge.ts"],"sourcesContent":["import { Reflector } from '@velajs/vela';\n\nexport const Public = Reflector.createDecorator<boolean>({ key: 'vela.auth.public' });\nexport const PUBLIC_KEY = Public.KEY;\n","export const DEFAULT_BETTER_AUTH_BASE_PATH = '/api/auth';\n\n/** Validate and canonicalize the route prefix used by the public auth controller. */\nexport function normalizeBetterAuthBasePath(value?: string): string {\n  const basePath = value ?? DEFAULT_BETTER_AUTH_BASE_PATH;\n  if (\n    basePath.length === 0 ||\n    basePath !== basePath.trim() ||\n    !basePath.startsWith('/') ||\n    basePath.startsWith('//') ||\n    basePath === '/' ||\n    basePath.endsWith('/') ||\n    /[\\\\?#*]/u.test(basePath) ||\n    /%(?:2e|2f|5c)/iu.test(basePath)\n  ) {\n    throw new Error(\n      '@velajs/better-auth: basePath must be a canonical absolute path such as \"/api/auth\"',\n    );\n  }\n\n  let decoded: string;\n  try {\n    decoded = decodeURIComponent(basePath);\n  } catch {\n    throw new Error('@velajs/better-auth: basePath contains invalid percent encoding');\n  }\n  if (decoded.split('/').some((segment) => segment === '.' || segment === '..')) {\n    throw new Error('@velajs/better-auth: basePath must not contain dot segments');\n  }\n  return basePath;\n}\n","import { All, Controller, Inject, Injectable, Req, type Type } from '@velajs/vela';\nimport type { Context } from 'hono';\nimport { BetterAuthService } from './better-auth.service';\nimport { Public } from './decorators/public.decorator';\nimport { normalizeBetterAuthBasePath } from './base-path';\n\n/**\n * Build a catch-all controller that mounts better-auth's handler at `basePath`\n * (default `/api/auth`). This is a factory because vela reads a controller's\n * route off the class at decoration time, so a custom base path needs its own\n * decorated class — the path can't be parametrized on a single shared class.\n *\n * Two base paths to keep consistent:\n * - this `basePath` is RELATIVE to vela's `globalPrefix` (always prepended);\n * - better-auth routes against its OWN absolute `basePath` (the one you pass to\n *   `betterAuth({ basePath })`), which must equal `globalPrefix + basePath`.\n *\n * Both default to `/api/auth`, so the no-prefix / no-config case just works.\n */\nexport function createBetterAuthCatchallController(basePath: string = '/api/auth'): Type {\n  const normalizedBasePath = normalizeBetterAuthBasePath(basePath);\n  @Public(true)\n  @Controller(normalizedBasePath)\n  @Injectable()\n  class BetterAuthCatchallController {\n    // Inject the service — its `.handler` getter triggers lazy construction\n    // of the underlying betterAuth() instance on first access, AFTER any\n    // runtime adapter middleware (Cloudflare env capture) has run.\n    constructor(@Inject(BetterAuthService) private readonly auth: BetterAuthService) {}\n\n    @All('/*')\n    async handle(@Req() c: Context): Promise<Response> {\n      return this.auth.handler(c.req.raw);\n    }\n  }\n  return BetterAuthCatchallController;\n}\n","import { InjectionToken } from '@velajs/vela';\nimport type { BetterAuthRuntimeOptions } from './better-auth.types';\n\nexport const BETTER_AUTH_OPTIONS = new InjectionToken<BetterAuthRuntimeOptions>(\n  'vela.BetterAuthOptions',\n);\n","import {\n  clearTrustedRequestIdentity,\n  createTrustedRequestIdentityStore,\n  getTrustedContextRequest,\n  setTrustedRequestIdentity,\n  type ExecutionContext,\n} from '@velajs/vela';\nimport type { SessionData } from './session-data';\n\n// This map stores provider payload, never a second authentication authority.\n// A clear, expiry, or identity replacement makes the payload unreachable.\nconst sessions = createTrustedRequestIdentityStore<SessionData>();\n\nexport function beginAuthRequest(context: ExecutionContext): void {\n  clearTrustedRequestIdentity(context.getRequest());\n}\n\nexport function authenticateRequest(\n  context: ExecutionContext,\n  data: SessionData,\n  issuer: string,\n): void {\n  const request = context.getRequest();\n  setTrustedRequestIdentity(request, {\n    principal: { issuer, subject: data.user.id, principalType: 'user' },\n    expiresAtMs: data.session.expiresAt.getTime(),\n    roles: data.roles,\n    ...(data.tenantId === undefined ? {} : { tenantId: data.tenantId }),\n  });\n  sessions.set(request, data);\n}\n\nexport function getAuthRequestState(context: ExecutionContext): SessionData | undefined {\n  const request = getTrustedContextRequest(context);\n  return request ? sessions.get(request) : undefined;\n}\n","import type { Session, User } from './better-auth.types';\n\nexport interface SessionData {\n  readonly user: User;\n  readonly session: Session;\n  readonly roles: readonly string[];\n  readonly tenantId?: string;\n}\n\nfunction own(value: unknown, key: string): unknown {\n  if (typeof value !== 'object' || value === null) return undefined;\n  const descriptor = Object.getOwnPropertyDescriptor(value, key);\n  return descriptor && 'value' in descriptor ? descriptor.value : undefined;\n}\n\nfunction requiredString(value: unknown): value is string {\n  return typeof value === 'string' && value.length > 0;\n}\n\nfunction date(value: unknown): Date | undefined {\n  return value instanceof Date && Number.isFinite(value.getTime()) ? new Date(value) : undefined;\n}\n\nfunction optionalString(value: unknown): value is string | null | undefined {\n  return value === undefined || value === null || typeof value === 'string';\n}\n\n/** Keep plugin data opaque; base model fields below are validated individually. */\nfunction dataProperties(value: object): Record<string, unknown> {\n  return Object.fromEntries(Object.keys(value).map((key) => [key, own(value, key)]));\n}\n\n/** Validate the full Better Auth base models, not merely ids masquerading as them. */\nexport function validateSessionData(value: unknown): SessionData | undefined {\n  try {\n    const user = own(value, 'user');\n    const session = own(value, 'session');\n    if (\n      typeof user !== 'object' ||\n      user === null ||\n      typeof session !== 'object' ||\n      session === null\n    ) {\n      return undefined;\n    }\n    const id = own(user, 'id');\n    const email = own(user, 'email');\n    const name = own(user, 'name');\n    const emailVerified = own(user, 'emailVerified');\n    const image = own(user, 'image');\n    const createdAt = date(own(user, 'createdAt'));\n    const updatedAt = date(own(user, 'updatedAt'));\n    const sessionId = own(session, 'id');\n    const userId = own(session, 'userId');\n    const token = own(session, 'token');\n    const sessionCreatedAt = date(own(session, 'createdAt'));\n    const sessionUpdatedAt = date(own(session, 'updatedAt'));\n    const expiresAt = date(own(session, 'expiresAt'));\n    const ipAddress = own(session, 'ipAddress');\n    const userAgent = own(session, 'userAgent');\n    const organization = own(session, 'activeOrganizationId');\n    const role = own(user, 'role');\n    let roles: string[] = [];\n    if (role !== undefined && role !== null) {\n      if (typeof role === 'string')\n        roles = role\n          .split(',')\n          .map((part) => part.trim())\n          .filter(Boolean);\n      else if (\n        Array.isArray(role) &&\n        role.every((entry: unknown): entry is string => typeof entry === 'string')\n      ) {\n        roles = role.map((entry: string) => entry.trim()).filter(Boolean);\n      } else return undefined;\n    }\n    if (\n      !requiredString(id) ||\n      !requiredString(email) ||\n      typeof name !== 'string' ||\n      typeof emailVerified !== 'boolean' ||\n      !optionalString(image) ||\n      !createdAt ||\n      !updatedAt ||\n      !requiredString(sessionId) ||\n      userId !== id ||\n      !requiredString(token) ||\n      !sessionCreatedAt ||\n      !sessionUpdatedAt ||\n      !expiresAt ||\n      expiresAt.getTime() <= Date.now() ||\n      !optionalString(ipAddress) ||\n      !optionalString(userAgent) ||\n      (organization !== undefined && organization !== null && !requiredString(organization))\n    )\n      return undefined;\n    return {\n      user: Object.freeze({\n        ...dataProperties(user),\n        id,\n        email,\n        name,\n        emailVerified,\n        createdAt,\n        updatedAt,\n        image,\n      }),\n      session: Object.freeze({\n        ...dataProperties(session),\n        id: sessionId,\n        userId: id,\n        token,\n        createdAt: sessionCreatedAt,\n        updatedAt: sessionUpdatedAt,\n        expiresAt,\n        ipAddress,\n        userAgent,\n      }),\n      roles: Object.freeze(roles),\n      ...(typeof organization === 'string' ? { tenantId: organization } : {}),\n    };\n  } catch {\n    return undefined;\n  }\n}\n","import { Reflector } from '@velajs/vela';\n\nexport const OptionalAuth = Reflector.createDecorator<boolean>({ key: 'vela.auth.optional' });\nexport const OPTIONAL_AUTH_KEY = OptionalAuth.KEY;\n","import {\n  Inject,\n  Injectable,\n  Reflector,\n  UnauthorizedException,\n  getTrustedContextRequest,\n  type CanActivate,\n  type ExecutionContext,\n} from '@velajs/vela';\nimport { getContextIdentity } from '@velajs/authz/vela';\nimport { BETTER_AUTH_OPTIONS } from '../better-auth.tokens';\nimport { BetterAuthService } from '../better-auth.service';\nimport type { BetterAuthRuntimeOptions } from '../better-auth.types';\nimport { authenticateRequest, beginAuthRequest, getAuthRequestState } from '../auth-request-state';\nimport { validateSessionData } from '../session-data';\nimport { OptionalAuth } from '../decorators/optional-auth.decorator';\nimport { Public } from '../decorators/public.decorator';\n\n@Injectable()\nexport class AuthGuard implements CanActivate {\n  private readonly reflector = new Reflector();\n\n  constructor(\n    @Inject(BetterAuthService) private readonly auth: BetterAuthService,\n    @Inject(BETTER_AUTH_OPTIONS) private readonly opts: BetterAuthRuntimeOptions,\n  ) {}\n\n  async canActivate(context: ExecutionContext): Promise<boolean> {\n    // Frames trust only the authenticated connection attachment; HTTP cookies\n    // and request payload never become ambient WebSocket authentication.\n    if (context.getType() === 'ws') {\n      if (getContextIdentity(context)) return true;\n      throw new UnauthorizedException('Authentication required');\n    }\n    // Custom HTTP-backed dispatchers authenticate once at the outer boundary.\n    // Never re-read credentials or clear shared authority across sibling fields.\n    if (context.getType() !== 'http') {\n      if (\n        getTrustedContextRequest(context) &&\n        (getAuthRequestState(context) ||\n          this.reflector.getAllAndOverride(Public, context) ||\n          this.reflector.getAllAndOverride(OptionalAuth, context))\n      )\n        return true;\n      throw new UnauthorizedException('Authentication required');\n    }\n    beginAuthRequest(context);\n    if (this.reflector.getAllAndOverride(Public, context)) return true;\n\n    const raw = await this.auth.api.getSession({ headers: context.getRequest().headers });\n    const data = validateSessionData(raw);\n    if (data) {\n      authenticateRequest(context, data, this.opts.issuer ?? 'better-auth');\n      return true;\n    }\n    if (this.reflector.getAllAndOverride(OptionalAuth, context)) return true;\n    throw new UnauthorizedException('Authentication required');\n  }\n}\n","import {\n  defineProvider,\n  provideGlobal,\n  stableHash,\n  type DynamicModule,\n  type InferTokens,\n  type Token,\n  type Type,\n} from '@velajs/vela';\nimport { createBetterAuthCatchallController } from './better-auth.controller';\nimport { BetterAuthService, BETTER_AUTH_BUILDER } from './better-auth.service';\nimport { BETTER_AUTH_OPTIONS } from './better-auth.tokens';\nimport type {\n  BetterAuthInstance,\n  BetterAuthModuleOptions,\n  BetterAuthRuntimeOptions,\n} from './better-auth.types';\nimport { AuthGuard } from './guards/auth.guard';\nimport { normalizeBetterAuthBasePath } from './base-path';\n\nconst referenceIds = new WeakMap<object, number>();\nconst explicitKeyClaims = new Map<\n  string,\n  { readonly kind: 'auth' | 'factory'; readonly reference: object; readonly shape: string }\n>();\nlet nextReferenceId = 1;\n\nfunction referenceId(reference: object): number {\n  const existing = referenceIds.get(reference);\n  if (existing !== undefined) return existing;\n  const id = nextReferenceId++;\n  referenceIds.set(reference, id);\n  return id;\n}\n\nfunction claimExplicitKey(\n  key: string,\n  kind: 'auth' | 'factory',\n  reference: object,\n  shape: string,\n): string {\n  if (key.length === 0 || key !== key.trim()) {\n    throw new Error('@velajs/better-auth: an explicit module key must be a non-empty string');\n  }\n  const existing = explicitKeyClaims.get(key);\n  if (\n    existing !== undefined &&\n    (existing.kind !== kind || existing.reference !== reference || existing.shape !== shape)\n  ) {\n    throw new Error(\n      `@velajs/better-auth: explicit module key \"${key}\" is already bound to a different auth registration`,\n    );\n  }\n  explicitKeyClaims.set(key, { kind, reference, shape });\n  return `explicit:${key}:ref:${referenceId(reference)}`;\n}\n\n/** Structural options with defaults applied (everything but the auth instance). */\ninterface NormalizedOptions {\n  basePath: string;\n  issuer: string;\n  isGlobal: boolean;\n  mountHandler: boolean;\n}\n\nfunction normalize(options: BetterAuthRuntimeOptions): NormalizedOptions {\n  const basePath = normalizeBetterAuthBasePath(options.basePath);\n  const issuer = options.issuer ?? `better-auth:${basePath}`;\n  if (issuer.length === 0 || issuer !== issuer.trim()) {\n    throw new Error('@velajs/better-auth: issuer must be a non-empty stable namespace');\n  }\n  return {\n    basePath,\n    issuer,\n    isGlobal: options.isGlobal ?? true,\n    mountHandler: options.mountHandler ?? true,\n  };\n}\n\n/** Providers, controllers, and exports shared by both entry points. */\nfunction commonContributions(n: NormalizedOptions): {\n  providers: NonNullable<DynamicModule['providers']>;\n  controllers: Type[];\n  exports: DynamicModule['exports'];\n} {\n  return {\n    providers: [BetterAuthService, AuthGuard],\n    controllers: n.mountHandler ? [createBetterAuthCatchallController(n.basePath)] : [],\n    exports: [BetterAuthService, BETTER_AUTH_OPTIONS, AuthGuard],\n  };\n}\n\n/**\n * Options for {@link BetterAuthModule.forRootAsync}.\n *\n * The `Inject` type parameter captures the literal `inject` tuple at the call\n * site (via `const` inference) so `useFactory` parameters are typed from the\n * inject array, position-by-position — no `as const`, no `(...deps: any[])`:\n *\n * ```ts\n * BetterAuthModule.forRootAsync({\n *   inject: [WORKER_ENV, ConfigService], // captured as readonly tuple\n *   useFactory: (env, config) =>          // inferred from the tokens\n *     betterAuth({ database: drizzleAdapter(drizzle(env.DB), ...) }),\n * });\n * ```\n */\ninterface ForRootAsyncOptions<Inject extends readonly Token[] = readonly Token[]> {\n  inject: Inject;\n  imports?: DynamicModule['imports'];\n  useFactory: (...deps: InferTokens<Inject>) => BetterAuthInstance;\n  isGlobal?: boolean;\n  mountHandler?: boolean;\n  basePath?: string;\n  issuer?: string;\n  key?: string;\n}\n\nexport class BetterAuthModule {\n  /**\n   * Synchronous registration. The auth instance is constructed by the consumer\n   * at module-load time and passed in directly. Use this when the inputs to\n   * `betterAuth({...})` are available at startup (Node apps with a static DB\n   * connection, in-memory adapters, etc.).\n   */\n  static forRoot(\n    options: BetterAuthModuleOptions & { isGlobal?: boolean; key?: string },\n  ): DynamicModule {\n    const normalized = normalize(options);\n    const shape = stableHash(normalized);\n    const key =\n      options.key === undefined\n        ? `${shape}:auth:${referenceId(options.auth)}`\n        : claimExplicitKey(options.key, 'auth', options.auth, shape);\n    const common = commonContributions(normalized);\n    return {\n      module: BetterAuthModule,\n      key,\n      providers: [\n        defineProvider(BETTER_AUTH_OPTIONS, { useValue: normalized }),\n        defineProvider(BETTER_AUTH_BUILDER, { useValue: () => options.auth }),\n        ...common.providers,\n        ...(normalized.isGlobal ? provideGlobal('guard', AuthGuard) : []),\n      ],\n      controllers: common.controllers,\n      exports: common.exports,\n    };\n  }\n\n  /**\n   * Deferred / DI-driven registration. The user factory runs **lazily**, on the\n   * first time anything reads `BetterAuthService.auth` (or `.api` / `.handler`).\n   * In normal request handling that's `AuthGuard.canActivate` or the catch-all\n   * controller's `.handle`. At module load the factory does NOT run — it's only\n   * captured in the checked builder provider. The Workers adapter supplies its\n   * native environment before DI; the lazily constructed auth instance belongs\n   * to that environment's application and never captures another app's bindings.\n   */\n  static forRootAsync<const Inject extends readonly Token[] = readonly Token[]>(\n    options: ForRootAsyncOptions<Inject>,\n  ): DynamicModule {\n    const n = normalize(options);\n    const common = commonContributions(n);\n    const shape = stableHash({ ...n, inject: options.inject });\n    const key =\n      options.key === undefined\n        ? `${shape}:factory:${referenceId(options.useFactory)}`\n        : claimExplicitKey(options.key, 'factory', options.useFactory, shape);\n    return {\n      module: BetterAuthModule,\n      key,\n      imports: options.imports ?? [],\n      providers: [\n        defineProvider(BETTER_AUTH_OPTIONS, { useValue: n }),\n        defineProvider(BETTER_AUTH_BUILDER, {\n          inject: options.inject,\n          useFactory:\n            (...deps: InferTokens<Inject>) =>\n            () =>\n              options.useFactory(...deps),\n        }),\n        ...common.providers,\n        ...(n.isGlobal ? provideGlobal('guard', AuthGuard) : []),\n      ],\n      controllers: common.controllers,\n      exports: common.exports,\n    };\n  }\n}\n","import { createParamDecorator, type ExecutionContext } from '@velajs/vela';\nimport { getAuthRequestState } from '../auth-request-state';\nimport type { User } from '../better-auth.types';\n\nexport const CurrentUser = createParamDecorator(\n  (_data: unknown, ctx: ExecutionContext): User | undefined => {\n    const state = getAuthRequestState(ctx);\n    return state?.user;\n  },\n);\n","import { createParamDecorator, type ExecutionContext } from '@velajs/vela';\nimport { getAuthRequestState } from '../auth-request-state';\nimport type { Session } from '../better-auth.types';\n\nexport const CurrentSession = createParamDecorator(\n  (_data: unknown, ctx: ExecutionContext): Session | undefined => {\n    const state = getAuthRequestState(ctx);\n    return state?.session;\n  },\n);\n","import type { Identity, PermissionResolver } from '@velajs/authz';\nimport type { User } from './better-auth.types';\n\n/**\n * A better-auth user carrying the optional `role` field contributed by the\n * admin plugin. `role` may be a single role, a comma-separated list, or an\n * array — {@link identityFromUser} normalizes all three.\n */\nexport type AuthUser = Pick<User, 'id'> & { role?: string | string[] | null };\n\n/** Stable issuer namespace used for better-auth session principals. */\nexport const BETTER_AUTH_ISSUER = 'better-auth';\n\nconst normalizeRoles = (role: string | string[] | null | undefined): string[] => {\n  if (!role) return [];\n  // Strip empty entries and return a fresh array (never alias the caller's\n  // input), matching the comma-string path below.\n  if (Array.isArray(role)) return role.filter(Boolean);\n  return role\n    .split(',')\n    .map((r) => r.trim())\n    .filter(Boolean);\n};\n\n/**\n * Pure authorization projection; this does not authenticate or publish trusted state.\n * Adapts an already verified better-auth user into a stable `@velajs/authz` {@link Identity}.\n * The issuer scopes `user.id` as both `subject` and the compatibility `userId`;\n * the admin-plugin `role` field supplies local roles.\n *\n * Fail-closed: a missing user (`null`/`undefined`, i.e. an unauthenticated\n * request) maps to the zero-privilege identity `{ roles: [] }`, so downstream\n * `can()` checks grant nothing.\n */\nexport const identityFromUser = (\n  user: AuthUser | null | undefined,\n  issuer: string = BETTER_AUTH_ISSUER,\n  principalType: 'user' | 'service' = 'user',\n): Identity => {\n  if (!user || typeof user.id !== 'string' || user.id.length === 0) return { roles: [] };\n  if (issuer.length === 0)\n    throw new Error('@velajs/better-auth: identity issuer must be non-empty');\n  return {\n    issuer,\n    subject: user.id,\n    principalType,\n    userId: user.id,\n    roles: normalizeRoles(user.role),\n  };\n};\n\n/**\n * The minimal slice of a better-auth access-control role consumed here. Both\n * `createAccessControl(...).newRole(...)` and the standalone `role(...)` return\n * `{ authorize, statements }`; `statements` is the `{ resource: actions[] }`\n * grant map for that role — the only accessor {@link betterAuthAcResolver}\n * reads.\n */\nexport interface BetterAuthAcRole {\n  readonly statements: Readonly<Record<string, readonly string[]>>;\n}\n\n/**\n * Flattens a better-auth AC role's `statements` into `resource:action`\n * permission strings — the granted-side format `@velajs/authz` matches\n * (wildcards included).\n */\nexport const permissionsFromAcRole = (role: BetterAuthAcRole): string[] => {\n  const permissions: string[] = [];\n  for (const [resource, actions] of Object.entries(role.statements ?? {})) {\n    for (const action of actions ?? []) permissions.push(`${resource}:${action}`);\n  }\n  return permissions;\n};\n\n/**\n * Builds a fail-closed `@velajs/authz` {@link PermissionResolver} from a\n * better-auth access-control role table (`{ roleName: acRole }` — the same map\n * shape passed to better-auth's admin/organization plugins). An identity's\n * `roles` are unioned into their granted permission strings; unknown roles\n * contribute nothing.\n *\n * ```ts\n * const ac = createAccessControl({ posts: ['read', 'write'] });\n * const authz = createAuthz({\n *   resolver: betterAuthAcResolver({ editor: ac.newRole({ posts: ['write'] }) }),\n * });\n * await authz.can(identityFromUser(user), 'posts:write');\n * ```\n */\nexport const betterAuthAcResolver = (\n  roles: Readonly<Record<string, BetterAuthAcRole>>,\n): PermissionResolver => {\n  const grantsByRole = new Map<string, string[]>();\n  for (const [name, role] of Object.entries(roles)) {\n    grantsByRole.set(name, permissionsFromAcRole(role));\n  }\n  return {\n    grants(identity: Identity): Set<string> {\n      const out = new Set<string>();\n      for (const name of identity.roles ?? []) {\n        for (const permission of grantsByRole.get(name) ?? []) out.add(permission);\n      }\n      return out;\n    },\n  };\n};\n"],"mappings":";;;;AAEA,MAAa,SAAS,UAAU,gBAAyB,EAAE,KAAK,mBAAmB,CAAC;AACpF,MAAa,aAAa,OAAO;;ACAjC,SAAgB,4BAA4B,OAAwB;CAClE,MAAM,WAAW,SAAA;CACjB,IACE,SAAS,WAAW,KACpB,aAAa,SAAS,KAAK,KAC3B,CAAC,SAAS,WAAW,GAAG,KACxB,SAAS,WAAW,IAAI,KACxB,aAAa,OACb,SAAS,SAAS,GAAG,KACrB,WAAW,KAAK,QAAQ,KACxB,kBAAkB,KAAK,QAAQ,GAE/B,MAAM,IAAI,MACR,uFACF;CAGF,IAAI;CACJ,IAAI;EACF,UAAU,mBAAmB,QAAQ;CACvC,QAAQ;EACN,MAAM,IAAI,MAAM,iEAAiE;CACnF;CACA,IAAI,QAAQ,MAAM,GAAG,CAAC,CAAC,MAAM,YAAY,YAAY,OAAO,YAAY,IAAI,GAC1E,MAAM,IAAI,MAAM,6DAA6D;CAE/E,OAAO;AACT;;;;;;;;;;;;;;;;ACXA,SAAgB,mCAAmC,WAAmB,aAAmB;CACvF,MAAM,qBAAqB,4BAA4B,QAAQ;CAC/D,IAGM,+BAHN,MAGM,6BAA6B;EAIuB;EAAxD,YAAY,MAAqE;GAAzB,KAAA,OAAA;EAA0B;EAElF,MACM,OAAO,GAAsC;GACjD,OAAO,KAAK,KAAK,QAAQ,EAAE,IAAI,GAAG;EACpC;CACF;;EAJG,IAAI,IAAI;EACK,gBAAA,GAAA,IAAI,CAAA;;;;;;EAVnB,OAAO,IAAI;EACX,WAAW,kBAAkB;EAC7B,WAAW;EAKG,gBAAA,GAAA,OAAO,iBAAiB,CAAA;;;CAOvC,OAAO;AACT;;;ACjCA,MAAa,sBAAsB,IAAI,eACrC,wBACF;;;ACMA,MAAM,WAAW,kCAA+C;AAEhE,SAAgB,iBAAiB,SAAiC;CAChE,4BAA4B,QAAQ,WAAW,CAAC;AAClD;AAEA,SAAgB,oBACd,SACA,MACA,QACM;CACN,MAAM,UAAU,QAAQ,WAAW;CACnC,0BAA0B,SAAS;EACjC,WAAW;GAAE;GAAQ,SAAS,KAAK,KAAK;GAAI,eAAe;EAAO;EAClE,aAAa,KAAK,QAAQ,UAAU,QAAQ;EAC5C,OAAO,KAAK;EACZ,GAAI,KAAK,aAAa,KAAA,IAAY,CAAC,IAAI,EAAE,UAAU,KAAK,SAAS;CACnE,CAAC;CACD,SAAS,IAAI,SAAS,IAAI;AAC5B;AAEA,SAAgB,oBAAoB,SAAoD;CACtF,MAAM,UAAU,yBAAyB,OAAO;CAChD,OAAO,UAAU,SAAS,IAAI,OAAO,IAAI,KAAA;AAC3C;;;AC1BA,SAAS,IAAI,OAAgB,KAAsB;CACjD,IAAI,OAAO,UAAU,YAAY,UAAU,MAAM,OAAO,KAAA;CACxD,MAAM,aAAa,OAAO,yBAAyB,OAAO,GAAG;CAC7D,OAAO,cAAc,WAAW,aAAa,WAAW,QAAQ,KAAA;AAClE;AAEA,SAAS,eAAe,OAAiC;CACvD,OAAO,OAAO,UAAU,YAAY,MAAM,SAAS;AACrD;AAEA,SAAS,KAAK,OAAkC;CAC9C,OAAO,iBAAiB,QAAQ,OAAO,SAAS,MAAM,QAAQ,CAAC,IAAI,IAAI,KAAK,KAAK,IAAI,KAAA;AACvF;AAEA,SAAS,eAAe,OAAoD;CAC1E,OAAO,UAAU,KAAA,KAAa,UAAU,QAAQ,OAAO,UAAU;AACnE;;AAGA,SAAS,eAAe,OAAwC;CAC9D,OAAO,OAAO,YAAY,OAAO,KAAK,KAAK,CAAC,CAAC,KAAK,QAAQ,CAAC,KAAK,IAAI,OAAO,GAAG,CAAC,CAAC,CAAC;AACnF;;AAGA,SAAgB,oBAAoB,OAAyC;CAC3E,IAAI;EACF,MAAM,OAAO,IAAI,OAAO,MAAM;EAC9B,MAAM,UAAU,IAAI,OAAO,SAAS;EACpC,IACE,OAAO,SAAS,YAChB,SAAS,QACT,OAAO,YAAY,YACnB,YAAY,MAEZ;EAEF,MAAM,KAAK,IAAI,MAAM,IAAI;EACzB,MAAM,QAAQ,IAAI,MAAM,OAAO;EAC/B,MAAM,OAAO,IAAI,MAAM,MAAM;EAC7B,MAAM,gBAAgB,IAAI,MAAM,eAAe;EAC/C,MAAM,QAAQ,IAAI,MAAM,OAAO;EAC/B,MAAM,YAAY,KAAK,IAAI,MAAM,WAAW,CAAC;EAC7C,MAAM,YAAY,KAAK,IAAI,MAAM,WAAW,CAAC;EAC7C,MAAM,YAAY,IAAI,SAAS,IAAI;EACnC,MAAM,SAAS,IAAI,SAAS,QAAQ;EACpC,MAAM,QAAQ,IAAI,SAAS,OAAO;EAClC,MAAM,mBAAmB,KAAK,IAAI,SAAS,WAAW,CAAC;EACvD,MAAM,mBAAmB,KAAK,IAAI,SAAS,WAAW,CAAC;EACvD,MAAM,YAAY,KAAK,IAAI,SAAS,WAAW,CAAC;EAChD,MAAM,YAAY,IAAI,SAAS,WAAW;EAC1C,MAAM,YAAY,IAAI,SAAS,WAAW;EAC1C,MAAM,eAAe,IAAI,SAAS,sBAAsB;EACxD,MAAM,OAAO,IAAI,MAAM,MAAM;EAC7B,IAAI,QAAkB,CAAC;EACvB,IAAI,SAAS,KAAA,KAAa,SAAS,MAAM;GACvC,IAAI,OAAO,SAAS,UAClB,QAAQ,KACL,MAAM,GAAG,CAAC,CACV,KAAK,SAAS,KAAK,KAAK,CAAC,CAAC,CAC1B,OAAO,OAAO;QACd,IACH,MAAM,QAAQ,IAAI,KAClB,KAAK,OAAO,UAAoC,OAAO,UAAU,QAAQ,GAEzE,QAAQ,KAAK,KAAK,UAAkB,MAAM,KAAK,CAAC,CAAC,CAAC,OAAO,OAAO;QAC3D,OAAO,KAAA;EAChB;EACA,IACE,CAAC,eAAe,EAAE,KAClB,CAAC,eAAe,KAAK,KACrB,OAAO,SAAS,YAChB,OAAO,kBAAkB,aACzB,CAAC,eAAe,KAAK,KACrB,CAAC,aACD,CAAC,aACD,CAAC,eAAe,SAAS,KACzB,WAAW,MACX,CAAC,eAAe,KAAK,KACrB,CAAC,oBACD,CAAC,oBACD,CAAC,aACD,UAAU,QAAQ,KAAK,KAAK,IAAI,KAChC,CAAC,eAAe,SAAS,KACzB,CAAC,eAAe,SAAS,KACxB,iBAAiB,KAAA,KAAa,iBAAiB,QAAQ,CAAC,eAAe,YAAY,GAEpF,OAAO,KAAA;EACT,OAAO;GACL,MAAM,OAAO,OAAO;IAClB,GAAG,eAAe,IAAI;IACtB;IACA;IACA;IACA;IACA;IACA;IACA;GACF,CAAC;GACD,SAAS,OAAO,OAAO;IACrB,GAAG,eAAe,OAAO;IACzB,IAAI;IACJ,QAAQ;IACR;IACA,WAAW;IACX,WAAW;IACX;IACA;IACA;GACF,CAAC;GACD,OAAO,OAAO,OAAO,KAAK;GAC1B,GAAI,OAAO,iBAAiB,WAAW,EAAE,UAAU,aAAa,IAAI,CAAC;EACvE;CACF,QAAQ;EACN;CACF;AACF;;;AC1HA,MAAa,eAAe,UAAU,gBAAyB,EAAE,KAAK,qBAAqB,CAAC;AAC5F,MAAa,oBAAoB,aAAa;;;ACgBvC,IAAM,YAAN,MAAM,UAAiC;CAIE;CACE;CAJhD,YAA6B,IAAI,UAAU;CAE3C,YACE,MACA,MACA;EAF4C,KAAA,OAAA;EACE,KAAA,OAAA;CAC7C;CAEH,MAAM,YAAY,SAA6C;EAG7D,IAAI,QAAQ,QAAQ,MAAM,MAAM;GAC9B,IAAI,mBAAmB,OAAO,GAAG,OAAO;GACxC,MAAM,IAAI,sBAAsB,yBAAyB;EAC3D;EAGA,IAAI,QAAQ,QAAQ,MAAM,QAAQ;GAChC,IACE,yBAAyB,OAAO,MAC/B,oBAAoB,OAAO,KAC1B,KAAK,UAAU,kBAAkB,QAAQ,OAAO,KAChD,KAAK,UAAU,kBAAkB,cAAc,OAAO,IAExD,OAAO;GACT,MAAM,IAAI,sBAAsB,yBAAyB;EAC3D;EACA,iBAAiB,OAAO;EACxB,IAAI,KAAK,UAAU,kBAAkB,QAAQ,OAAO,GAAG,OAAO;EAG9D,MAAM,OAAO,oBAAoB,MADf,KAAK,KAAK,IAAI,WAAW,EAAE,SAAS,QAAQ,WAAW,CAAC,CAAC,QAAQ,CAAC,CAChD;EACpC,IAAI,MAAM;GACR,oBAAoB,SAAS,MAAM,KAAK,KAAK,UAAU,aAAa;GACpE,OAAO;EACT;EACA,IAAI,KAAK,UAAU,kBAAkB,cAAc,OAAO,GAAG,OAAO;EACpE,MAAM,IAAI,sBAAsB,yBAAyB;CAC3D;AACF;;CAxCC,WAAW;CAKP,gBAAA,GAAA,OAAO,iBAAiB,CAAA;CACxB,gBAAA,GAAA,OAAO,mBAAmB,CAAA;;;;;ACJ/B,MAAM,+BAAe,IAAI,QAAwB;AACjD,MAAM,oCAAoB,IAAI,IAG5B;AACF,IAAI,kBAAkB;AAEtB,SAAS,YAAY,WAA2B;CAC9C,MAAM,WAAW,aAAa,IAAI,SAAS;CAC3C,IAAI,aAAa,KAAA,GAAW,OAAO;CACnC,MAAM,KAAK;CACX,aAAa,IAAI,WAAW,EAAE;CAC9B,OAAO;AACT;AAEA,SAAS,iBACP,KACA,MACA,WACA,OACQ;CACR,IAAI,IAAI,WAAW,KAAK,QAAQ,IAAI,KAAK,GACvC,MAAM,IAAI,MAAM,wEAAwE;CAE1F,MAAM,WAAW,kBAAkB,IAAI,GAAG;CAC1C,IACE,aAAa,KAAA,MACZ,SAAS,SAAS,QAAQ,SAAS,cAAc,aAAa,SAAS,UAAU,QAElF,MAAM,IAAI,MACR,6CAA6C,IAAI,oDACnD;CAEF,kBAAkB,IAAI,KAAK;EAAE;EAAM;EAAW;CAAM,CAAC;CACrD,OAAO,YAAY,IAAI,OAAO,YAAY,SAAS;AACrD;AAUA,SAAS,UAAU,SAAsD;CACvE,MAAM,WAAW,4BAA4B,QAAQ,QAAQ;CAC7D,MAAM,SAAS,QAAQ,UAAU,eAAe;CAChD,IAAI,OAAO,WAAW,KAAK,WAAW,OAAO,KAAK,GAChD,MAAM,IAAI,MAAM,kEAAkE;CAEpF,OAAO;EACL;EACA;EACA,UAAU,QAAQ,YAAY;EAC9B,cAAc,QAAQ,gBAAgB;CACxC;AACF;;AAGA,SAAS,oBAAoB,GAI3B;CACA,OAAO;EACL,WAAW,CAAC,mBAAmB,SAAS;EACxC,aAAa,EAAE,eAAe,CAAC,mCAAmC,EAAE,QAAQ,CAAC,IAAI,CAAC;EAClF,SAAS;GAAC;GAAmB;GAAqB;EAAS;CAC7D;AACF;AA4BA,IAAa,mBAAb,MAAa,iBAAiB;;;;;;;CAO5B,OAAO,QACL,SACe;EACf,MAAM,aAAa,UAAU,OAAO;EACpC,MAAM,QAAQ,WAAW,UAAU;EACnC,MAAM,MACJ,QAAQ,QAAQ,KAAA,IACZ,GAAG,MAAM,QAAQ,YAAY,QAAQ,IAAI,MACzC,iBAAiB,QAAQ,KAAK,QAAQ,QAAQ,MAAM,KAAK;EAC/D,MAAM,SAAS,oBAAoB,UAAU;EAC7C,OAAO;GACL,QAAQ;GACR;GACA,WAAW;IACT,eAAe,qBAAqB,EAAE,UAAU,WAAW,CAAC;IAC5D,eAAe,qBAAqB,EAAE,gBAAgB,QAAQ,KAAK,CAAC;IACpE,GAAG,OAAO;IACV,GAAI,WAAW,WAAW,cAAc,SAAS,SAAS,IAAI,CAAC;GACjE;GACA,aAAa,OAAO;GACpB,SAAS,OAAO;EAClB;CACF;;;;;;;;;;CAWA,OAAO,aACL,SACe;EACf,MAAM,IAAI,UAAU,OAAO;EAC3B,MAAM,SAAS,oBAAoB,CAAC;EACpC,MAAM,QAAQ,WAAW;GAAE,GAAG;GAAG,QAAQ,QAAQ;EAAO,CAAC;EACzD,MAAM,MACJ,QAAQ,QAAQ,KAAA,IACZ,GAAG,MAAM,WAAW,YAAY,QAAQ,UAAU,MAClD,iBAAiB,QAAQ,KAAK,WAAW,QAAQ,YAAY,KAAK;EACxE,OAAO;GACL,QAAQ;GACR;GACA,SAAS,QAAQ,WAAW,CAAC;GAC7B,WAAW;IACT,eAAe,qBAAqB,EAAE,UAAU,EAAE,CAAC;IACnD,eAAe,qBAAqB;KAClC,QAAQ,QAAQ;KAChB,aACG,GAAG,eAEF,QAAQ,WAAW,GAAG,IAAI;IAChC,CAAC;IACD,GAAG,OAAO;IACV,GAAI,EAAE,WAAW,cAAc,SAAS,SAAS,IAAI,CAAC;GACxD;GACA,aAAa,OAAO;GACpB,SAAS,OAAO;EAClB;CACF;AACF;;;ACxLA,MAAa,cAAc,sBACxB,OAAgB,QAA4C;CAE3D,OADc,oBAAoB,GACvB,CAAC,EAAE;AAChB,CACF;;;ACLA,MAAa,iBAAiB,sBAC3B,OAAgB,QAA+C;CAE9D,OADc,oBAAoB,GACvB,CAAC,EAAE;AAChB,CACF;;;;ACEA,MAAa,qBAAqB;AAElC,MAAM,kBAAkB,SAAyD;CAC/E,IAAI,CAAC,MAAM,OAAO,CAAC;CAGnB,IAAI,MAAM,QAAQ,IAAI,GAAG,OAAO,KAAK,OAAO,OAAO;CACnD,OAAO,KACJ,MAAM,GAAG,CAAC,CACV,KAAK,MAAM,EAAE,KAAK,CAAC,CAAC,CACpB,OAAO,OAAO;AACnB;;;;;;;;;;;AAYA,MAAa,oBACX,MACA,SAAiB,oBACjB,gBAAoC,WACvB;CACb,IAAI,CAAC,QAAQ,OAAO,KAAK,OAAO,YAAY,KAAK,GAAG,WAAW,GAAG,OAAO,EAAE,OAAO,CAAC,EAAE;CACrF,IAAI,OAAO,WAAW,GACpB,MAAM,IAAI,MAAM,wDAAwD;CAC1E,OAAO;EACL;EACA,SAAS,KAAK;EACd;EACA,QAAQ,KAAK;EACb,OAAO,eAAe,KAAK,IAAI;CACjC;AACF;;;;;;AAkBA,MAAa,yBAAyB,SAAqC;CACzE,MAAM,cAAwB,CAAC;CAC/B,KAAK,MAAM,CAAC,UAAU,YAAY,OAAO,QAAQ,KAAK,cAAc,CAAC,CAAC,GACpE,KAAK,MAAM,UAAU,WAAW,CAAC,GAAG,YAAY,KAAK,GAAG,SAAS,GAAG,QAAQ;CAE9E,OAAO;AACT;;;;;;;;;;;;;;;;AAiBA,MAAa,wBACX,UACuB;CACvB,MAAM,+BAAe,IAAI,IAAsB;CAC/C,KAAK,MAAM,CAAC,MAAM,SAAS,OAAO,QAAQ,KAAK,GAC7C,aAAa,IAAI,MAAM,sBAAsB,IAAI,CAAC;CAEpD,OAAO,EACL,OAAO,UAAiC;EACtC,MAAM,sBAAM,IAAI,IAAY;EAC5B,KAAK,MAAM,QAAQ,SAAS,SAAS,CAAC,GACpC,KAAK,MAAM,cAAc,aAAa,IAAI,IAAI,KAAK,CAAC,GAAG,IAAI,IAAI,UAAU;EAE3E,OAAO;CACT,EACF;AACF"}
+{"version":3,"file":"index.js","names":[],"sources":["../src/decorators/public.decorator.ts","../src/base-path.ts","../src/better-auth.controller.ts","../src/better-auth.tokens.ts","../src/auth-request-state.ts","../src/session-data.ts","../src/decorators/optional-auth.decorator.ts","../src/guards/auth.guard.ts","../src/better-auth.module.ts","../src/upgrade-authenticator.ts","../src/decorators/current-user.decorator.ts","../src/decorators/current-session.decorator.ts","../src/authz-bridge.ts"],"sourcesContent":["import { Reflector } from '@velajs/vela';\n\nexport const Public = Reflector.createDecorator<boolean>({ key: 'vela.auth.public' });\nexport const PUBLIC_KEY = Public.KEY;\n","export const DEFAULT_BETTER_AUTH_BASE_PATH = '/api/auth';\n\n/** Validate and canonicalize the route prefix used by the public auth controller. */\nexport function normalizeBetterAuthBasePath(value?: string): string {\n  const basePath = value ?? DEFAULT_BETTER_AUTH_BASE_PATH;\n  if (\n    basePath.length === 0 ||\n    basePath !== basePath.trim() ||\n    !basePath.startsWith('/') ||\n    basePath.startsWith('//') ||\n    basePath === '/' ||\n    basePath.endsWith('/') ||\n    /[\\\\?#*]/u.test(basePath) ||\n    /%(?:2e|2f|5c)/iu.test(basePath)\n  ) {\n    throw new Error(\n      '@velajs/better-auth: basePath must be a canonical absolute path such as \"/api/auth\"',\n    );\n  }\n\n  let decoded: string;\n  try {\n    decoded = decodeURIComponent(basePath);\n  } catch {\n    throw new Error('@velajs/better-auth: basePath contains invalid percent encoding');\n  }\n  if (decoded.split('/').some((segment) => segment === '.' || segment === '..')) {\n    throw new Error('@velajs/better-auth: basePath must not contain dot segments');\n  }\n  return basePath;\n}\n","import { All, Controller, Inject, Req, type Type } from '@velajs/vela';\nimport type { Context } from 'hono';\nimport { BetterAuthService } from './better-auth.service';\nimport { Public } from './decorators/public.decorator';\nimport { normalizeBetterAuthBasePath } from './base-path';\n\n/**\n * Build a catch-all controller that mounts better-auth's handler at `basePath`\n * (default `/api/auth`). This is a factory because vela reads a controller's\n * route off the class at decoration time, so a custom base path needs its own\n * decorated class — the path can't be parametrized on a single shared class.\n *\n * Two base paths to keep consistent:\n * - this `basePath` is RELATIVE to vela's `globalPrefix` (always prepended);\n * - better-auth routes against its OWN absolute `basePath` (the one you pass to\n *   `betterAuth({ basePath })`), which must equal `globalPrefix + basePath`.\n *\n * Both default to `/api/auth`, so the no-prefix / no-config case just works.\n */\nexport function createBetterAuthCatchallController(basePath: string = '/api/auth'): Type {\n  const normalizedBasePath = normalizeBetterAuthBasePath(basePath);\n  @Public(true)\n  @Controller(normalizedBasePath)\n  class BetterAuthCatchallController {\n    // Inject the service — its `.handler` getter triggers lazy construction\n    // of the underlying betterAuth() instance on first access, AFTER any\n    // runtime adapter middleware (Cloudflare env capture) has run.\n    constructor(@Inject(BetterAuthService) private readonly auth: BetterAuthService) {}\n\n    @All('/*')\n    async handle(@Req() c: Context): Promise<Response> {\n      return this.auth.handler(c.req.raw);\n    }\n  }\n  return BetterAuthCatchallController;\n}\n","import { InjectionToken } from '@velajs/vela';\nimport type { BetterAuthRuntimeOptions } from './better-auth.types';\n\nexport const BETTER_AUTH_OPTIONS = new InjectionToken<BetterAuthRuntimeOptions>(\n  'vela.BetterAuthOptions',\n);\n","import {\n  clearTrustedRequestIdentity,\n  createTrustedRequestIdentityStore,\n  getTrustedContextRequest,\n  setTrustedRequestIdentity,\n  type ExecutionContext,\n} from '@velajs/vela';\nimport type { SessionData } from './session-data';\n\n// This map stores provider payload, never a second authentication authority.\n// A clear, expiry, or identity replacement makes the payload unreachable.\nconst sessions = createTrustedRequestIdentityStore<SessionData>();\n\nexport function beginAuthRequest(context: ExecutionContext): void {\n  clearTrustedRequestIdentity(context.getRequest());\n}\n\nexport function authenticateRequest(\n  context: ExecutionContext,\n  data: SessionData,\n  issuer: string,\n): void {\n  const request = context.getRequest();\n  setTrustedRequestIdentity(request, {\n    principal: { issuer, subject: data.user.id, principalType: 'user' },\n    expiresAtMs: data.session.expiresAt.getTime(),\n    roles: data.roles,\n    ...(data.tenantId === undefined ? {} : { tenantId: data.tenantId }),\n  });\n  sessions.set(request, data);\n}\n\nexport function getAuthRequestState(context: ExecutionContext): SessionData | undefined {\n  const request = getTrustedContextRequest(context);\n  return request ? sessions.get(request) : undefined;\n}\n","import type { Session, User } from './better-auth.types';\n\nexport interface SessionData {\n  readonly user: User;\n  readonly session: Session;\n  readonly roles: readonly string[];\n  readonly tenantId?: string;\n}\n\nfunction own(value: unknown, key: string): unknown {\n  if (typeof value !== 'object' || value === null) return undefined;\n  const descriptor = Object.getOwnPropertyDescriptor(value, key);\n  return descriptor && 'value' in descriptor ? descriptor.value : undefined;\n}\n\nfunction requiredString(value: unknown): value is string {\n  return typeof value === 'string' && value.length > 0;\n}\n\nfunction date(value: unknown): Date | undefined {\n  return value instanceof Date && Number.isFinite(value.getTime()) ? new Date(value) : undefined;\n}\n\nfunction optionalString(value: unknown): value is string | null | undefined {\n  return value === undefined || value === null || typeof value === 'string';\n}\n\n/** Keep plugin data opaque; base model fields below are validated individually. */\nfunction dataProperties(value: object): Record<string, unknown> {\n  return Object.fromEntries(Object.keys(value).map((key) => [key, own(value, key)]));\n}\n\n/** Validate the full Better Auth base models, not merely ids masquerading as them. */\nexport function validateSessionData(value: unknown): SessionData | undefined {\n  try {\n    const user = own(value, 'user');\n    const session = own(value, 'session');\n    if (\n      typeof user !== 'object' ||\n      user === null ||\n      typeof session !== 'object' ||\n      session === null\n    ) {\n      return undefined;\n    }\n    const id = own(user, 'id');\n    const email = own(user, 'email');\n    const name = own(user, 'name');\n    const emailVerified = own(user, 'emailVerified');\n    const image = own(user, 'image');\n    const createdAt = date(own(user, 'createdAt'));\n    const updatedAt = date(own(user, 'updatedAt'));\n    const sessionId = own(session, 'id');\n    const userId = own(session, 'userId');\n    const token = own(session, 'token');\n    const sessionCreatedAt = date(own(session, 'createdAt'));\n    const sessionUpdatedAt = date(own(session, 'updatedAt'));\n    const expiresAt = date(own(session, 'expiresAt'));\n    const ipAddress = own(session, 'ipAddress');\n    const userAgent = own(session, 'userAgent');\n    const organization = own(session, 'activeOrganizationId');\n    const role = own(user, 'role');\n    let roles: string[] = [];\n    if (role !== undefined && role !== null) {\n      if (typeof role === 'string')\n        roles = role\n          .split(',')\n          .map((part) => part.trim())\n          .filter(Boolean);\n      else if (\n        Array.isArray(role) &&\n        role.every((entry: unknown): entry is string => typeof entry === 'string')\n      ) {\n        roles = role.map((entry: string) => entry.trim()).filter(Boolean);\n      } else return undefined;\n    }\n    if (\n      !requiredString(id) ||\n      !requiredString(email) ||\n      typeof name !== 'string' ||\n      typeof emailVerified !== 'boolean' ||\n      !optionalString(image) ||\n      !createdAt ||\n      !updatedAt ||\n      !requiredString(sessionId) ||\n      userId !== id ||\n      !requiredString(token) ||\n      !sessionCreatedAt ||\n      !sessionUpdatedAt ||\n      !expiresAt ||\n      expiresAt.getTime() <= Date.now() ||\n      !optionalString(ipAddress) ||\n      !optionalString(userAgent) ||\n      (organization !== undefined && organization !== null && !requiredString(organization))\n    )\n      return undefined;\n    return {\n      user: Object.freeze({\n        ...dataProperties(user),\n        id,\n        email,\n        name,\n        emailVerified,\n        createdAt,\n        updatedAt,\n        image,\n      }),\n      session: Object.freeze({\n        ...dataProperties(session),\n        id: sessionId,\n        userId: id,\n        token,\n        createdAt: sessionCreatedAt,\n        updatedAt: sessionUpdatedAt,\n        expiresAt,\n        ipAddress,\n        userAgent,\n      }),\n      roles: Object.freeze(roles),\n      ...(typeof organization === 'string' ? { tenantId: organization } : {}),\n    };\n  } catch {\n    return undefined;\n  }\n}\n","import { Reflector } from '@velajs/vela';\n\nexport const OptionalAuth = Reflector.createDecorator<boolean>({ key: 'vela.auth.optional' });\nexport const OPTIONAL_AUTH_KEY = OptionalAuth.KEY;\n","import {\n  Inject,\n  Injectable,\n  Reflector,\n  UnauthorizedException,\n  getTrustedContextRequest,\n  type CanActivate,\n  type ExecutionContext,\n} from '@velajs/vela';\nimport { getContextIdentity } from '@velajs/authz/vela';\nimport { BETTER_AUTH_OPTIONS } from '../better-auth.tokens';\nimport { BetterAuthService } from '../better-auth.service';\nimport type { BetterAuthRuntimeOptions } from '../better-auth.types';\nimport { authenticateRequest, beginAuthRequest, getAuthRequestState } from '../auth-request-state';\nimport { validateSessionData } from '../session-data';\nimport { OptionalAuth } from '../decorators/optional-auth.decorator';\nimport { Public } from '../decorators/public.decorator';\n\n@Injectable()\nexport class AuthGuard implements CanActivate {\n  constructor(\n    @Inject(BetterAuthService) private readonly auth: BetterAuthService,\n    @Inject(BETTER_AUTH_OPTIONS) private readonly opts: BetterAuthRuntimeOptions,\n    @Inject(Reflector) private readonly reflector: Reflector,\n  ) {}\n\n  async canActivate(context: ExecutionContext): Promise<boolean> {\n    // Frames trust only the authenticated connection attachment; HTTP cookies\n    // and request payload never become ambient WebSocket authentication.\n    if (context.getType() === 'ws') {\n      if (getContextIdentity(context)) return true;\n      throw new UnauthorizedException('Authentication required');\n    }\n    // Custom HTTP-backed dispatchers authenticate once at the outer boundary.\n    // Never re-read credentials or clear shared authority across sibling fields.\n    if (context.getType() !== 'http') {\n      if (\n        getTrustedContextRequest(context) &&\n        (getAuthRequestState(context) ||\n          this.reflector.getAllAndOverride(Public, context) ||\n          this.reflector.getAllAndOverride(OptionalAuth, context))\n      )\n        return true;\n      throw new UnauthorizedException('Authentication required');\n    }\n    beginAuthRequest(context);\n    if (this.reflector.getAllAndOverride(Public, context)) return true;\n\n    const raw = await this.auth.api.getSession({ headers: context.getRequest().headers });\n    const data = validateSessionData(raw);\n    if (data) {\n      authenticateRequest(context, data, this.opts.issuer ?? 'better-auth');\n      return true;\n    }\n    if (this.reflector.getAllAndOverride(OptionalAuth, context)) return true;\n    throw new UnauthorizedException('Authentication required');\n  }\n}\n","import {\n  defineProvider,\n  lazyProvider,\n  provideGlobal,\n  stableHash,\n  type DynamicModule,\n  type FactoryInject,\n  type InferTokens,\n  type Token,\n  type Type,\n} from '@velajs/vela';\nimport { createBetterAuthCatchallController } from './better-auth.controller';\nimport { BetterAuthService, BETTER_AUTH_BUILDER } from './better-auth.service';\nimport { BETTER_AUTH_OPTIONS } from './better-auth.tokens';\nimport type {\n  BetterAuthInstance,\n  BetterAuthModuleOptions,\n  BetterAuthRuntimeOptions,\n} from './better-auth.types';\nimport { AuthGuard } from './guards/auth.guard';\nimport { normalizeBetterAuthBasePath } from './base-path';\n\nconst referenceIds = new WeakMap<object, number>();\nlet nextReferenceId = 1;\n\nfunction referenceId(reference: object): number {\n  const existing = referenceIds.get(reference);\n  if (existing !== undefined) return existing;\n  const id = nextReferenceId++;\n  referenceIds.set(reference, id);\n  return id;\n}\n\n/**\n * An explicit key names a registration without widening its identity: the\n * options shape and auth reference stay in the module key, so the same\n * registration deduplicates within an application while a different one\n * (including a root rebuilt per environment) becomes its own instance. No\n * process-wide state is kept, so repeated bootstraps in one isolate succeed.\n */\nfunction explicitKey(key: string, shape: string, reference: object): string {\n  if (key.length === 0 || key !== key.trim()) {\n    throw new Error('@velajs/better-auth: an explicit module key must be a non-empty string');\n  }\n  return `explicit:${key}:${shape}:ref:${referenceId(reference)}`;\n}\n\n/** Structural options with defaults applied (everything but the auth instance). */\ninterface NormalizedOptions {\n  basePath: string;\n  issuer: string;\n  isGlobal: boolean;\n  mountHandler: boolean;\n}\n\nfunction normalize(options: BetterAuthRuntimeOptions): NormalizedOptions {\n  const basePath = normalizeBetterAuthBasePath(options.basePath);\n  const issuer = options.issuer ?? `better-auth:${basePath}`;\n  if (issuer.length === 0 || issuer !== issuer.trim()) {\n    throw new Error('@velajs/better-auth: issuer must be a non-empty stable namespace');\n  }\n  return {\n    basePath,\n    issuer,\n    isGlobal: options.isGlobal ?? true,\n    mountHandler: options.mountHandler ?? true,\n  };\n}\n\n/** Providers, controllers, and exports shared by both entry points. */\nfunction commonContributions(n: NormalizedOptions): {\n  providers: NonNullable<DynamicModule['providers']>;\n  controllers: Type[];\n  exports: DynamicModule['exports'];\n} {\n  return {\n    providers: [BetterAuthService, AuthGuard],\n    controllers: n.mountHandler ? [createBetterAuthCatchallController(n.basePath)] : [],\n    exports: [BetterAuthService, BETTER_AUTH_OPTIONS, AuthGuard],\n  };\n}\n\n/**\n * Options for {@link BetterAuthModule.forRootAsync}.\n *\n * The `Inject` type parameter captures the literal `inject` tuple at the call\n * site (via `const` inference) so `useFactory` parameters are typed from the\n * inject array, position-by-position — no `as const`, no `(...deps: any[])`:\n *\n * ```ts\n * BetterAuthModule.forRootAsync({\n *   inject: [ENV, ConfigService],         // captured as readonly tuple\n *   useFactory: (env, config) =>          // inferred from the tokens\n *     betterAuth({ database: drizzleAdapter(drizzle(env.DB), ...) }),\n * });\n * ```\n *\n * A factory without parameters may omit `inject`.\n */\ntype ForRootAsyncOptions<Inject extends readonly Token[] = readonly Token[]> = {\n  imports?: DynamicModule['imports'];\n  useFactory: (...deps: InferTokens<Inject>) => BetterAuthInstance;\n  isGlobal?: boolean;\n  mountHandler?: boolean;\n  basePath?: string;\n  issuer?: string;\n  key?: string;\n} & FactoryInject<Inject>;\n\nexport class BetterAuthModule {\n  /**\n   * Synchronous registration. The auth instance is constructed by the consumer\n   * at module-load time and passed in directly. Use this when the inputs to\n   * `betterAuth({...})` are available at startup (Node apps with a static DB\n   * connection, in-memory adapters, etc.).\n   */\n  static forRoot(\n    options: BetterAuthModuleOptions & { isGlobal?: boolean; key?: string },\n  ): DynamicModule {\n    const normalized = normalize(options);\n    const shape = stableHash(normalized);\n    const key =\n      options.key === undefined\n        ? `${shape}:auth:${referenceId(options.auth)}`\n        : explicitKey(options.key, shape, options.auth);\n    const common = commonContributions(normalized);\n    return {\n      module: BetterAuthModule,\n      key,\n      providers: [\n        defineProvider(BETTER_AUTH_OPTIONS, { useValue: normalized }),\n        defineProvider(BETTER_AUTH_BUILDER, { useValue: () => options.auth }),\n        ...common.providers,\n        ...(normalized.isGlobal ? provideGlobal('guard', AuthGuard) : []),\n      ],\n      controllers: common.controllers,\n      exports: common.exports,\n    };\n  }\n\n  /**\n   * Deferred / DI-driven registration. The user factory runs **lazily**, on the\n   * first time anything reads `BetterAuthService.auth` (or `.api` / `.handler`).\n   * In normal request handling that's `AuthGuard.canActivate` or the catch-all\n   * controller's `.handle`. At module load the factory does NOT run — it's only\n   * captured in the checked builder provider. The Workers adapter supplies its\n   * native environment before DI; the lazily constructed auth instance belongs\n   * to that environment's application and never captures another app's bindings.\n   */\n  static forRootAsync<const Inject extends readonly Token[] = readonly Token[]>(\n    options: ForRootAsyncOptions<Inject>,\n  ): DynamicModule {\n    const n = normalize(options);\n    const common = commonContributions(n);\n    const shape = stableHash({ ...n, inject: options.inject });\n    const key =\n      options.key === undefined\n        ? `${shape}:factory:${referenceId(options.useFactory)}`\n        : explicitKey(options.key, shape, options.useFactory);\n    return {\n      module: BetterAuthModule,\n      key,\n      imports: options.imports ?? [],\n      providers: [\n        defineProvider(BETTER_AUTH_OPTIONS, { useValue: n }),\n        // Unmemoized: BetterAuthService caches the instance it builds.\n        lazyProvider<BetterAuthInstance, Inject>({\n          ...options,\n          provide: BETTER_AUTH_BUILDER,\n          memoize: false,\n        }),\n        ...common.providers,\n        ...(n.isGlobal ? provideGlobal('guard', AuthGuard) : []),\n      ],\n      controllers: common.controllers,\n      exports: common.exports,\n    };\n  }\n}\n","import { Inject, Injectable, InjectionToken, Optional } from '@velajs/vela';\nimport type {\n  UpgradeAuthenticator,\n  WebSocketUpgradeAuthenticationContext,\n  WebSocketUpgradeIdentity,\n} from '@velajs/vela/websocket';\nimport { BetterAuthService } from './better-auth.service';\nimport { BETTER_AUTH_OPTIONS } from './better-auth.tokens';\nimport type { BetterAuthRuntimeOptions, Session, User } from './better-auth.types';\nimport { validateSessionData } from './session-data';\n\n/** The validated Better Auth session behind a WebSocket upgrade. */\nexport interface BetterAuthUpgradeSession {\n  readonly user: User;\n  readonly session: Session;\n}\n\n/**\n * Chooses the tenant a WebSocket connection joins. Returning no tenant (or\n * throwing) refuses the upgrade.\n */\nexport type BetterAuthUpgradeTenantResolver = (\n  session: BetterAuthUpgradeSession,\n  context: WebSocketUpgradeAuthenticationContext,\n  request: Request,\n) => string | undefined | Promise<string | undefined>;\n\n/**\n * Optional tenant resolver for {@link BetterAuthUpgradeAuthenticator}. Provide it\n * in the module that declares the gateway; without one, the session's active\n * organization is the tenant.\n */\nexport const BETTER_AUTH_UPGRADE_TENANT = new InjectionToken<BetterAuthUpgradeTenantResolver>(\n  'vela.better-auth.UpgradeTenant',\n);\n\n/**\n * WebSocket upgrade authenticator backed by the Better Auth session cookie:\n * `@WebSocketGateway({ authenticator: BetterAuthUpgradeAuthenticator })`.\n *\n * The principal uses the `BetterAuthModule` issuer, as `AuthGuard` does for\n * HTTP. The identity expires with the session. Every WebSocket identity carries\n * a tenant, so a session without an active organization is refused unless a\n * {@link BETTER_AUTH_UPGRADE_TENANT} resolver supplies one.\n */\n@Injectable()\nexport class BetterAuthUpgradeAuthenticator implements UpgradeAuthenticator {\n  constructor(\n    @Inject(BetterAuthService) private readonly auth: BetterAuthService,\n    @Inject(BETTER_AUTH_OPTIONS) private readonly options: BetterAuthRuntimeOptions,\n    @Optional()\n    @Inject(BETTER_AUTH_UPGRADE_TENANT)\n    private readonly resolveTenant?: BetterAuthUpgradeTenantResolver,\n  ) {}\n\n  async authenticate(\n    request: Request,\n    context: WebSocketUpgradeAuthenticationContext,\n  ): Promise<WebSocketUpgradeIdentity | false> {\n    const data = validateSessionData(await this.auth.api.getSession({ headers: request.headers }));\n    if (!data) return false;\n    const tenantId = this.resolveTenant\n      ? await this.resolveTenant({ user: data.user, session: data.session }, context, request)\n      : data.tenantId;\n    if (typeof tenantId !== 'string' || tenantId.length === 0) return false;\n    return {\n      principal: {\n        issuer: this.options.issuer ?? 'better-auth',\n        subject: data.user.id,\n        principalType: 'user',\n      },\n      tenantId,\n      expiresAtMs: data.session.expiresAt.getTime(),\n    };\n  }\n}\n","import { createParamDecorator, type ExecutionContext } from '@velajs/vela';\nimport { getAuthRequestState } from '../auth-request-state';\nimport type { User } from '../better-auth.types';\n\nexport const CurrentUser = createParamDecorator(\n  (_data: unknown, ctx: ExecutionContext): User | undefined => {\n    const state = getAuthRequestState(ctx);\n    return state?.user;\n  },\n);\n","import { createParamDecorator, type ExecutionContext } from '@velajs/vela';\nimport { getAuthRequestState } from '../auth-request-state';\nimport type { Session } from '../better-auth.types';\n\nexport const CurrentSession = createParamDecorator(\n  (_data: unknown, ctx: ExecutionContext): Session | undefined => {\n    const state = getAuthRequestState(ctx);\n    return state?.session;\n  },\n);\n","import type { Identity, PermissionResolver } from '@velajs/authz';\nimport type { User } from './better-auth.types';\n\n/**\n * A better-auth user carrying the optional `role` field contributed by the\n * admin plugin. `role` may be a single role, a comma-separated list, or an\n * array — {@link identityFromUser} normalizes all three.\n */\nexport type AuthUser = Pick<User, 'id'> & { role?: string | string[] | null };\n\n/** Stable issuer namespace used for better-auth session principals. */\nexport const BETTER_AUTH_ISSUER = 'better-auth';\n\nconst normalizeRoles = (role: string | string[] | null | undefined): string[] => {\n  if (!role) return [];\n  // Strip empty entries and return a fresh array (never alias the caller's\n  // input), matching the comma-string path below.\n  if (Array.isArray(role)) return role.filter(Boolean);\n  return role\n    .split(',')\n    .map((r) => r.trim())\n    .filter(Boolean);\n};\n\n/**\n * Pure authorization projection; this does not authenticate or publish trusted state.\n * Adapts an already verified better-auth user into a stable `@velajs/authz` {@link Identity}.\n * The issuer scopes `user.id` as both `subject` and the compatibility `userId`;\n * the admin-plugin `role` field supplies local roles.\n *\n * Fail-closed: a missing user (`null`/`undefined`, i.e. an unauthenticated\n * request) maps to the zero-privilege identity `{ roles: [] }`, so downstream\n * `can()` checks grant nothing.\n */\nexport const identityFromUser = (\n  user: AuthUser | null | undefined,\n  issuer: string = BETTER_AUTH_ISSUER,\n  principalType: 'user' | 'service' = 'user',\n): Identity => {\n  if (!user || typeof user.id !== 'string' || user.id.length === 0) return { roles: [] };\n  if (issuer.length === 0)\n    throw new Error('@velajs/better-auth: identity issuer must be non-empty');\n  return {\n    issuer,\n    subject: user.id,\n    principalType,\n    userId: user.id,\n    roles: normalizeRoles(user.role),\n  };\n};\n\n/**\n * The minimal slice of a better-auth access-control role consumed here. Both\n * `createAccessControl(...).newRole(...)` and the standalone `role(...)` return\n * `{ authorize, statements }`; `statements` is the `{ resource: actions[] }`\n * grant map for that role — the only accessor {@link betterAuthAcResolver}\n * reads.\n */\nexport interface BetterAuthAcRole {\n  readonly statements: Readonly<Record<string, readonly string[]>>;\n}\n\n/**\n * Flattens a better-auth AC role's `statements` into `resource:action`\n * permission strings — the granted-side format `@velajs/authz` matches\n * (wildcards included).\n */\nexport const permissionsFromAcRole = (role: BetterAuthAcRole): string[] => {\n  const permissions: string[] = [];\n  for (const [resource, actions] of Object.entries(role.statements ?? {})) {\n    for (const action of actions ?? []) permissions.push(`${resource}:${action}`);\n  }\n  return permissions;\n};\n\n/**\n * Builds a fail-closed `@velajs/authz` {@link PermissionResolver} from a\n * better-auth access-control role table (`{ roleName: acRole }` — the same map\n * shape passed to better-auth's admin/organization plugins). An identity's\n * `roles` are unioned into their granted permission strings; unknown roles\n * contribute nothing.\n *\n * ```ts\n * const ac = createAccessControl({ posts: ['read', 'write'] });\n * const authz = createAuthz({\n *   resolver: betterAuthAcResolver({ editor: ac.newRole({ posts: ['write'] }) }),\n * });\n * await authz.can(identityFromUser(user), 'posts:write');\n * ```\n */\nexport const betterAuthAcResolver = (\n  roles: Readonly<Record<string, BetterAuthAcRole>>,\n): PermissionResolver => {\n  const grantsByRole = new Map<string, string[]>();\n  for (const [name, role] of Object.entries(roles)) {\n    grantsByRole.set(name, permissionsFromAcRole(role));\n  }\n  return {\n    grants(identity: Identity): Set<string> {\n      const out = new Set<string>();\n      for (const name of identity.roles ?? []) {\n        for (const permission of grantsByRole.get(name) ?? []) out.add(permission);\n      }\n      return out;\n    },\n  };\n};\n"],"mappings":";;;;AAEA,MAAa,SAAS,UAAU,gBAAyB,EAAE,KAAK,mBAAmB,CAAC;AACpF,MAAa,aAAa,OAAO;;ACAjC,SAAgB,4BAA4B,OAAwB;CAClE,MAAM,WAAW,SAAA;CACjB,IACE,SAAS,WAAW,KACpB,aAAa,SAAS,KAAK,KAC3B,CAAC,SAAS,WAAW,GAAG,KACxB,SAAS,WAAW,IAAI,KACxB,aAAa,OACb,SAAS,SAAS,GAAG,KACrB,WAAW,KAAK,QAAQ,KACxB,kBAAkB,KAAK,QAAQ,GAE/B,MAAM,IAAI,MACR,uFACF;CAGF,IAAI;CACJ,IAAI;EACF,UAAU,mBAAmB,QAAQ;CACvC,QAAQ;EACN,MAAM,IAAI,MAAM,iEAAiE;CACnF;CACA,IAAI,QAAQ,MAAM,GAAG,CAAC,CAAC,MAAM,YAAY,YAAY,OAAO,YAAY,IAAI,GAC1E,MAAM,IAAI,MAAM,6DAA6D;CAE/E,OAAO;AACT;;;;;;;;;;;;;;;;ACXA,SAAgB,mCAAmC,WAAmB,aAAmB;CACvF,MAAM,qBAAqB,4BAA4B,QAAQ;CAC/D,IAEM,+BAFN,MAEM,6BAA6B;EAIuB;EAAxD,YAAY,MAAqE;GAAzB,KAAA,OAAA;EAA0B;EAElF,MACM,OAAO,GAAsC;GACjD,OAAO,KAAK,KAAK,QAAQ,EAAE,IAAI,GAAG;EACpC;CACF;;EAJG,IAAI,IAAI;EACK,gBAAA,GAAA,IAAI,CAAA;;;;;;EATnB,OAAO,IAAI;EACX,WAAW,kBAAkB;EAKf,gBAAA,GAAA,OAAO,iBAAiB,CAAA;;;CAOvC,OAAO;AACT;;;AChCA,MAAa,sBAAsB,IAAI,eACrC,wBACF;;;ACMA,MAAM,WAAW,kCAA+C;AAEhE,SAAgB,iBAAiB,SAAiC;CAChE,4BAA4B,QAAQ,WAAW,CAAC;AAClD;AAEA,SAAgB,oBACd,SACA,MACA,QACM;CACN,MAAM,UAAU,QAAQ,WAAW;CACnC,0BAA0B,SAAS;EACjC,WAAW;GAAE;GAAQ,SAAS,KAAK,KAAK;GAAI,eAAe;EAAO;EAClE,aAAa,KAAK,QAAQ,UAAU,QAAQ;EAC5C,OAAO,KAAK;EACZ,GAAI,KAAK,aAAa,KAAA,IAAY,CAAC,IAAI,EAAE,UAAU,KAAK,SAAS;CACnE,CAAC;CACD,SAAS,IAAI,SAAS,IAAI;AAC5B;AAEA,SAAgB,oBAAoB,SAAoD;CACtF,MAAM,UAAU,yBAAyB,OAAO;CAChD,OAAO,UAAU,SAAS,IAAI,OAAO,IAAI,KAAA;AAC3C;;;AC1BA,SAAS,IAAI,OAAgB,KAAsB;CACjD,IAAI,OAAO,UAAU,YAAY,UAAU,MAAM,OAAO,KAAA;CACxD,MAAM,aAAa,OAAO,yBAAyB,OAAO,GAAG;CAC7D,OAAO,cAAc,WAAW,aAAa,WAAW,QAAQ,KAAA;AAClE;AAEA,SAAS,eAAe,OAAiC;CACvD,OAAO,OAAO,UAAU,YAAY,MAAM,SAAS;AACrD;AAEA,SAAS,KAAK,OAAkC;CAC9C,OAAO,iBAAiB,QAAQ,OAAO,SAAS,MAAM,QAAQ,CAAC,IAAI,IAAI,KAAK,KAAK,IAAI,KAAA;AACvF;AAEA,SAAS,eAAe,OAAoD;CAC1E,OAAO,UAAU,KAAA,KAAa,UAAU,QAAQ,OAAO,UAAU;AACnE;;AAGA,SAAS,eAAe,OAAwC;CAC9D,OAAO,OAAO,YAAY,OAAO,KAAK,KAAK,CAAC,CAAC,KAAK,QAAQ,CAAC,KAAK,IAAI,OAAO,GAAG,CAAC,CAAC,CAAC;AACnF;;AAGA,SAAgB,oBAAoB,OAAyC;CAC3E,IAAI;EACF,MAAM,OAAO,IAAI,OAAO,MAAM;EAC9B,MAAM,UAAU,IAAI,OAAO,SAAS;EACpC,IACE,OAAO,SAAS,YAChB,SAAS,QACT,OAAO,YAAY,YACnB,YAAY,MAEZ;EAEF,MAAM,KAAK,IAAI,MAAM,IAAI;EACzB,MAAM,QAAQ,IAAI,MAAM,OAAO;EAC/B,MAAM,OAAO,IAAI,MAAM,MAAM;EAC7B,MAAM,gBAAgB,IAAI,MAAM,eAAe;EAC/C,MAAM,QAAQ,IAAI,MAAM,OAAO;EAC/B,MAAM,YAAY,KAAK,IAAI,MAAM,WAAW,CAAC;EAC7C,MAAM,YAAY,KAAK,IAAI,MAAM,WAAW,CAAC;EAC7C,MAAM,YAAY,IAAI,SAAS,IAAI;EACnC,MAAM,SAAS,IAAI,SAAS,QAAQ;EACpC,MAAM,QAAQ,IAAI,SAAS,OAAO;EAClC,MAAM,mBAAmB,KAAK,IAAI,SAAS,WAAW,CAAC;EACvD,MAAM,mBAAmB,KAAK,IAAI,SAAS,WAAW,CAAC;EACvD,MAAM,YAAY,KAAK,IAAI,SAAS,WAAW,CAAC;EAChD,MAAM,YAAY,IAAI,SAAS,WAAW;EAC1C,MAAM,YAAY,IAAI,SAAS,WAAW;EAC1C,MAAM,eAAe,IAAI,SAAS,sBAAsB;EACxD,MAAM,OAAO,IAAI,MAAM,MAAM;EAC7B,IAAI,QAAkB,CAAC;EACvB,IAAI,SAAS,KAAA,KAAa,SAAS,MAAM;GACvC,IAAI,OAAO,SAAS,UAClB,QAAQ,KACL,MAAM,GAAG,CAAC,CACV,KAAK,SAAS,KAAK,KAAK,CAAC,CAAC,CAC1B,OAAO,OAAO;QACd,IACH,MAAM,QAAQ,IAAI,KAClB,KAAK,OAAO,UAAoC,OAAO,UAAU,QAAQ,GAEzE,QAAQ,KAAK,KAAK,UAAkB,MAAM,KAAK,CAAC,CAAC,CAAC,OAAO,OAAO;QAC3D,OAAO,KAAA;EAChB;EACA,IACE,CAAC,eAAe,EAAE,KAClB,CAAC,eAAe,KAAK,KACrB,OAAO,SAAS,YAChB,OAAO,kBAAkB,aACzB,CAAC,eAAe,KAAK,KACrB,CAAC,aACD,CAAC,aACD,CAAC,eAAe,SAAS,KACzB,WAAW,MACX,CAAC,eAAe,KAAK,KACrB,CAAC,oBACD,CAAC,oBACD,CAAC,aACD,UAAU,QAAQ,KAAK,KAAK,IAAI,KAChC,CAAC,eAAe,SAAS,KACzB,CAAC,eAAe,SAAS,KACxB,iBAAiB,KAAA,KAAa,iBAAiB,QAAQ,CAAC,eAAe,YAAY,GAEpF,OAAO,KAAA;EACT,OAAO;GACL,MAAM,OAAO,OAAO;IAClB,GAAG,eAAe,IAAI;IACtB;IACA;IACA;IACA;IACA;IACA;IACA;GACF,CAAC;GACD,SAAS,OAAO,OAAO;IACrB,GAAG,eAAe,OAAO;IACzB,IAAI;IACJ,QAAQ;IACR;IACA,WAAW;IACX,WAAW;IACX;IACA;IACA;GACF,CAAC;GACD,OAAO,OAAO,OAAO,KAAK;GAC1B,GAAI,OAAO,iBAAiB,WAAW,EAAE,UAAU,aAAa,IAAI,CAAC;EACvE;CACF,QAAQ;EACN;CACF;AACF;;;AC1HA,MAAa,eAAe,UAAU,gBAAyB,EAAE,KAAK,qBAAqB,CAAC;AAC5F,MAAa,oBAAoB,aAAa;;;ACgBvC,IAAM,YAAN,MAAM,UAAiC;CAEE;CACE;CACV;CAHtC,YACE,MACA,MACA,WACA;EAH4C,KAAA,OAAA;EACE,KAAA,OAAA;EACV,KAAA,YAAA;CACnC;CAEH,MAAM,YAAY,SAA6C;EAG7D,IAAI,QAAQ,QAAQ,MAAM,MAAM;GAC9B,IAAI,mBAAmB,OAAO,GAAG,OAAO;GACxC,MAAM,IAAI,sBAAsB,yBAAyB;EAC3D;EAGA,IAAI,QAAQ,QAAQ,MAAM,QAAQ;GAChC,IACE,yBAAyB,OAAO,MAC/B,oBAAoB,OAAO,KAC1B,KAAK,UAAU,kBAAkB,QAAQ,OAAO,KAChD,KAAK,UAAU,kBAAkB,cAAc,OAAO,IAExD,OAAO;GACT,MAAM,IAAI,sBAAsB,yBAAyB;EAC3D;EACA,iBAAiB,OAAO;EACxB,IAAI,KAAK,UAAU,kBAAkB,QAAQ,OAAO,GAAG,OAAO;EAG9D,MAAM,OAAO,oBAAoB,MADf,KAAK,KAAK,IAAI,WAAW,EAAE,SAAS,QAAQ,WAAW,CAAC,CAAC,QAAQ,CAAC,CAChD;EACpC,IAAI,MAAM;GACR,oBAAoB,SAAS,MAAM,KAAK,KAAK,UAAU,aAAa;GACpE,OAAO;EACT;EACA,IAAI,KAAK,UAAU,kBAAkB,cAAc,OAAO,GAAG,OAAO;EACpE,MAAM,IAAI,sBAAsB,yBAAyB;CAC3D;AACF;;CAvCC,WAAW;CAGP,gBAAA,GAAA,OAAO,iBAAiB,CAAA;CACxB,gBAAA,GAAA,OAAO,mBAAmB,CAAA;CAC1B,gBAAA,GAAA,OAAO,SAAS,CAAA;;;;;;;;;ACDrB,MAAM,+BAAe,IAAI,QAAwB;AACjD,IAAI,kBAAkB;AAEtB,SAAS,YAAY,WAA2B;CAC9C,MAAM,WAAW,aAAa,IAAI,SAAS;CAC3C,IAAI,aAAa,KAAA,GAAW,OAAO;CACnC,MAAM,KAAK;CACX,aAAa,IAAI,WAAW,EAAE;CAC9B,OAAO;AACT;;;;;;;;AASA,SAAS,YAAY,KAAa,OAAe,WAA2B;CAC1E,IAAI,IAAI,WAAW,KAAK,QAAQ,IAAI,KAAK,GACvC,MAAM,IAAI,MAAM,wEAAwE;CAE1F,OAAO,YAAY,IAAI,GAAG,MAAM,OAAO,YAAY,SAAS;AAC9D;AAUA,SAAS,UAAU,SAAsD;CACvE,MAAM,WAAW,4BAA4B,QAAQ,QAAQ;CAC7D,MAAM,SAAS,QAAQ,UAAU,eAAe;CAChD,IAAI,OAAO,WAAW,KAAK,WAAW,OAAO,KAAK,GAChD,MAAM,IAAI,MAAM,kEAAkE;CAEpF,OAAO;EACL;EACA;EACA,UAAU,QAAQ,YAAY;EAC9B,cAAc,QAAQ,gBAAgB;CACxC;AACF;;AAGA,SAAS,oBAAoB,GAI3B;CACA,OAAO;EACL,WAAW,CAAC,mBAAmB,SAAS;EACxC,aAAa,EAAE,eAAe,CAAC,mCAAmC,EAAE,QAAQ,CAAC,IAAI,CAAC;EAClF,SAAS;GAAC;GAAmB;GAAqB;EAAS;CAC7D;AACF;AA6BA,IAAa,mBAAb,MAAa,iBAAiB;;;;;;;CAO5B,OAAO,QACL,SACe;EACf,MAAM,aAAa,UAAU,OAAO;EACpC,MAAM,QAAQ,WAAW,UAAU;EACnC,MAAM,MACJ,QAAQ,QAAQ,KAAA,IACZ,GAAG,MAAM,QAAQ,YAAY,QAAQ,IAAI,MACzC,YAAY,QAAQ,KAAK,OAAO,QAAQ,IAAI;EAClD,MAAM,SAAS,oBAAoB,UAAU;EAC7C,OAAO;GACL,QAAQ;GACR;GACA,WAAW;IACT,eAAe,qBAAqB,EAAE,UAAU,WAAW,CAAC;IAC5D,eAAe,qBAAqB,EAAE,gBAAgB,QAAQ,KAAK,CAAC;IACpE,GAAG,OAAO;IACV,GAAI,WAAW,WAAW,cAAc,SAAS,SAAS,IAAI,CAAC;GACjE;GACA,aAAa,OAAO;GACpB,SAAS,OAAO;EAClB;CACF;;;;;;;;;;CAWA,OAAO,aACL,SACe;EACf,MAAM,IAAI,UAAU,OAAO;EAC3B,MAAM,SAAS,oBAAoB,CAAC;EACpC,MAAM,QAAQ,WAAW;GAAE,GAAG;GAAG,QAAQ,QAAQ;EAAO,CAAC;EACzD,MAAM,MACJ,QAAQ,QAAQ,KAAA,IACZ,GAAG,MAAM,WAAW,YAAY,QAAQ,UAAU,MAClD,YAAY,QAAQ,KAAK,OAAO,QAAQ,UAAU;EACxD,OAAO;GACL,QAAQ;GACR;GACA,SAAS,QAAQ,WAAW,CAAC;GAC7B,WAAW;IACT,eAAe,qBAAqB,EAAE,UAAU,EAAE,CAAC;IAEnD,aAAyC;KACvC,GAAG;KACH,SAAS;KACT,SAAS;IACX,CAAC;IACD,GAAG,OAAO;IACV,GAAI,EAAE,WAAW,cAAc,SAAS,SAAS,IAAI,CAAC;GACxD;GACA,aAAa,OAAO;GACpB,SAAS,OAAO;EAClB;CACF;AACF;;;;;;;;AClJA,MAAa,6BAA6B,IAAI,eAC5C,gCACF;AAYO,IAAM,iCAAN,MAAM,+BAA+D;CAE5B;CACE;CAG7B;CALnB,YACE,MACA,SACA,eAGA;EAL4C,KAAA,OAAA;EACE,KAAA,UAAA;EAG7B,KAAA,gBAAA;CAChB;CAEH,MAAM,aACJ,SACA,SAC2C;EAC3C,MAAM,OAAO,oBAAoB,MAAM,KAAK,KAAK,IAAI,WAAW,EAAE,SAAS,QAAQ,QAAQ,CAAC,CAAC;EAC7F,IAAI,CAAC,MAAM,OAAO;EAClB,MAAM,WAAW,KAAK,gBAClB,MAAM,KAAK,cAAc;GAAE,MAAM,KAAK;GAAM,SAAS,KAAK;EAAQ,GAAG,SAAS,OAAO,IACrF,KAAK;EACT,IAAI,OAAO,aAAa,YAAY,SAAS,WAAW,GAAG,OAAO;EAClE,OAAO;GACL,WAAW;IACT,QAAQ,KAAK,QAAQ,UAAU;IAC/B,SAAS,KAAK,KAAK;IACnB,eAAe;GACjB;GACA;GACA,aAAa,KAAK,QAAQ,UAAU,QAAQ;EAC9C;CACF;AACF;;CA9BC,WAAW;CAGP,gBAAA,GAAA,OAAO,iBAAiB,CAAA;CACxB,gBAAA,GAAA,OAAO,mBAAmB,CAAA;CAC1B,gBAAA,GAAA,SAAS,CAAA;CACT,gBAAA,GAAA,OAAO,0BAA0B,CAAA;;;;;;;;;AC/CtC,MAAa,cAAc,sBACxB,OAAgB,QAA4C;CAE3D,OADc,oBAAoB,GACvB,CAAC,EAAE;AAChB,CACF;;;ACLA,MAAa,iBAAiB,sBAC3B,OAAgB,QAA+C;CAE9D,OADc,oBAAoB,GACvB,CAAC,EAAE;AAChB,CACF;;;;ACEA,MAAa,qBAAqB;AAElC,MAAM,kBAAkB,SAAyD;CAC/E,IAAI,CAAC,MAAM,OAAO,CAAC;CAGnB,IAAI,MAAM,QAAQ,IAAI,GAAG,OAAO,KAAK,OAAO,OAAO;CACnD,OAAO,KACJ,MAAM,GAAG,CAAC,CACV,KAAK,MAAM,EAAE,KAAK,CAAC,CAAC,CACpB,OAAO,OAAO;AACnB;;;;;;;;;;;AAYA,MAAa,oBACX,MACA,SAAiB,oBACjB,gBAAoC,WACvB;CACb,IAAI,CAAC,QAAQ,OAAO,KAAK,OAAO,YAAY,KAAK,GAAG,WAAW,GAAG,OAAO,EAAE,OAAO,CAAC,EAAE;CACrF,IAAI,OAAO,WAAW,GACpB,MAAM,IAAI,MAAM,wDAAwD;CAC1E,OAAO;EACL;EACA,SAAS,KAAK;EACd;EACA,QAAQ,KAAK;EACb,OAAO,eAAe,KAAK,IAAI;CACjC;AACF;;;;;;AAkBA,MAAa,yBAAyB,SAAqC;CACzE,MAAM,cAAwB,CAAC;CAC/B,KAAK,MAAM,CAAC,UAAU,YAAY,OAAO,QAAQ,KAAK,cAAc,CAAC,CAAC,GACpE,KAAK,MAAM,UAAU,WAAW,CAAC,GAAG,YAAY,KAAK,GAAG,SAAS,GAAG,QAAQ;CAE9E,OAAO;AACT;;;;;;;;;;;;;;;;AAiBA,MAAa,wBACX,UACuB;CACvB,MAAM,+BAAe,IAAI,IAAsB;CAC/C,KAAK,MAAM,CAAC,MAAM,SAAS,OAAO,QAAQ,KAAK,GAC7C,aAAa,IAAI,MAAM,sBAAsB,IAAI,CAAC;CAEpD,OAAO,EACL,OAAO,UAAiC;EACtC,MAAM,sBAAM,IAAI,IAAY;EAC5B,KAAK,MAAM,QAAQ,SAAS,SAAS,CAAC,GACpC,KAAK,MAAM,cAAc,aAAa,IAAI,IAAI,KAAK,CAAC,GAAG,IAAI,IAAI,UAAU;EAE3E,OAAO;CACT,EACF;AACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@velajs/better-auth",
-  "version": "1.22.2",
+  "version": "1.29.0",
   "description": "better-auth integration for the Vela framework",
   "keywords": [
     "auth",
@@ -47,7 +47,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@velajs/authz": "1.23.0"
+    "@velajs/authz": "1.29.0"
   },
   "devDependencies": {
     "@arethetypeswrong/cli": "0.18.5",
@@ -62,15 +62,15 @@
     "typescript": "7.0.2",
     "unplugin-swc": "1.5.9",
     "vite": "^8.0.16",
-    "vitest": "4.1.10",
-    "@velajs/vela": "1.25.0",
-    "@velajs/tenant": "1.24.1",
-    "@velajs/testing": "1.23.0"
+    "vitest": "4.1.11",
+    "@velajs/tenant": "1.29.0",
+    "@velajs/vela": "1.29.0",
+    "@velajs/testing": "1.29.0"
   },
   "peerDependencies": {
     "better-auth": ">=1.2.0",
     "hono": ">=4",
-    "@velajs/vela": "^1.25.0"
+    "@velajs/vela": "^1.29.0"
   },
   "engines": {
     "node": ">=24"
@@ -78,7 +78,7 @@
   "scripts": {
     "build": "tsdown",
     "test": "vitest run",
-    "typecheck": "tsc --noEmit",
+    "typecheck": "tsc --noEmit && tsc --noEmit -p tsconfig.test.json",
     "lint": "oxlint .",
     "format": "oxfmt .",
     "format:check": "oxfmt --check .",