better-ship 0.4.0 → 0.5.0

package/dist/tanstack.d.ts

@@ -1 +1,81 @@
-export {}
+import { A as ErrorTable } from "./index-B9Y1hVh6.js";
+import { Register, RequestServerOptions } from "@tanstack/react-start";
+import { AnyRedirect } from "@tanstack/react-router";
+import { BetterAuthCookies } from "better-auth";
+//#region src/infrastructure/tanstack/auth.middleware.d.ts
+/** The fields middleware reads; generic callers retain every additional session and user field. */
+type AuthSession = {
+  readonly user: {
+    readonly id: string;
+  };
+  readonly session: {
+    readonly id: string;
+  };
+};
+/** Authenticated context retains the application's complete user and session types. */
+type RequiredAuthContext<Session extends AuthSession> = {
+  readonly user: Session['user'];
+  readonly session: Session['session'];
+};
+/** Optional authentication supplies both fields together or neither field. */
+type AuthContext<Session extends AuthSession> = RequiredAuthContext<Session> | {
+  readonly user: undefined;
+  readonly session: undefined;
+};
+/** Select the current request's Better Auth instance from TanStack's registered context. */
+type AuthMiddlewareOptions<Session extends AuthSession> = {
+  readonly getAuth: (context: RequestServerOptions<Register, undefined>['context']) => {
+    readonly api: {
+      readonly getSession: (options: {
+        headers: Headers;
+      }) => Promise<Session | null>;
+    };
+  };
+};
+/**
+ * Preserve Porte's function and request middleware contracts with application-owned services.
+ * Optional lookup failures log once and continue as guests. Required lookup failures propagate.
+ */
+export declare function createAuthMiddleware<Session extends AuthSession>(options: AuthMiddlewareOptions<Session>): {
+  extractAuth: import("@tanstack/react-start").FunctionMiddlewareAfterServer<{}, unknown, undefined, AuthContext<Session>, undefined, undefined, undefined>;
+  requireAuth: import("@tanstack/react-start").FunctionMiddlewareAfterServer<{}, unknown, undefined, RequiredAuthContext<Session>, undefined, undefined, undefined>;
+  requireAuthRequest: import("@tanstack/react-start").RequestMiddlewareAfterServer<{}, undefined, RequiredAuthContext<Session>>;
+};
+//#endregion
+//#region src/infrastructure/tanstack/error.middleware.d.ts
+type RequestContext = RequestServerOptions<Register, undefined>['context'];
+/** The part of a Better Auth instance the boundary reads: its computed cookie definitions. */
+type AuthCookieSource = {
+  readonly $context: Promise<{
+    readonly authCookies: BetterAuthCookies;
+  }>;
+};
+/** The application's error table, its stale-session redirect, and its Better Auth instance. */
+type ErrorMiddlewareOptions<Entries> = {
+  readonly errors: ErrorTable<Entries>;
+  /** Build the redirect a server function throws for a stale session. */
+  readonly signIn: () => AnyRedirect;
+  /** Select the request's Better Auth instance; its cookie definitions say what to clear. */
+  readonly getAuth: (context: RequestContext) => AuthCookieSource;
+};
+/**
+ * Build both transport boundaries from one error table.
+ * Register `functionErrorMiddleware` globally. Put `routeErrorMiddleware` first in an API route's `server.middleware`.
+ */
+export declare function createErrorMiddleware<Entries>(options: ErrorMiddlewareOptions<Entries>): {
+  functionErrorMiddleware: import("@tanstack/react-start").FunctionMiddlewareAfterServer<{}, unknown, undefined, undefined, undefined, undefined, undefined>;
+  routeErrorMiddleware: import("@tanstack/react-start").RequestMiddlewareAfterServer<{}, undefined, undefined>;
+  toErrorPayload: (cause: unknown) => { [Tag in keyof Entries & string]: Entries[Tag] extends (infer T) ? T extends Entries[Tag] ? T extends {
+    readonly fields: infer Fields extends import("zod").ZodType;
+  } ? {
+    readonly _tag: Tag;
+    readonly message: string;
+  } & import("zod").infer<Fields> : {
+    readonly _tag: Tag;
+    readonly message: string;
+  } : never : never; }[keyof Entries & string];
+  toHttpErrorResponse: (cause: unknown) => Response;
+};
+//#endregion
+export type { AuthContext, AuthCookieSource, AuthMiddlewareOptions, AuthSession, ErrorMiddlewareOptions, RequiredAuthContext };
+//# sourceMappingURL=tanstack.d.ts.map

package/dist/tanstack.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tanstack.d.ts","names":[],"sources":["../src/infrastructure/tanstack/auth.middleware.ts","../src/infrastructure/tanstack/error.middleware.ts"],"mappings":";;;;;;KASY;WACD;aAAiB;;WACjB;aAAoB;;;;KAInB,oBAAoB,gBAAgB;WACrC,MAAM;WACN,SAAS;;;KAIR,YAAY,gBAAgB,eACpC,oBAAoB;WAET;WACA;;;KAIH,sBAAsB,gBAAgB;WACvC,UAAU,SAAS,qBAAqB;aACtC;eACE,aAAa;QAAW,SAAS;YAAc,QAAQ;;;;;;;;wBAStD,qBAAqB,gBAAgB,aACnD,SAAS,sBAAsB;;;;;;;KChC5B,iBAAiB,qBAAqB;;KAG/B;WACD,UAAU;aAAmB,aAAa;;;;KAIzC,uBAAuB;WACxB,QAAQ,WAAW;;WAEnB,cAAc;;WAEd,UAAU,SAAS,mBAAmB;;;;;;wBAOjC,sBAAsB,SAAS,SAAS,uBAAuB"}

package/dist/tanstack.js

@@ -0,0 +1,214 @@
+import { A as AppError, C as ValidationError, D as StaleSessionError, a as createLogger, k as AuthenticationError } from "./core-CnwWj4MY.js";
+import { z } from "zod";
+import { createMiddleware } from "@tanstack/react-start";
+import { deleteCookie, getRequestHeaders } from "@tanstack/react-start/server";
+import { getSessionCookie, parseCookies } from "better-auth/cookies";
+import { isNotFound, isRedirect } from "@tanstack/react-router";
+import { getReasonPhrase } from "http-status-codes";
+
+//#region src/infrastructure/tanstack/auth.middleware.ts
+const logger$1 = createLogger("auth-middleware");
+/**
+* Preserve Porte's function and request middleware contracts with application-owned services.
+* Optional lookup failures log once and continue as guests. Required lookup failures propagate.
+*/
+function createAuthMiddleware(options) {
+	const extractAuth = createMiddleware({ type: "function" }).server(async ({ next, context }) => {
+		let resolved;
+		try {
+			resolved = await options.getAuth(context).api.getSession({ headers: getRequestHeaders() });
+		} catch (error) {
+			logger$1.error("get_session_failed", { error });
+			resolved = null;
+		}
+		if (resolved === null) return next({ context: {
+			user: void 0,
+			session: void 0
+		} });
+		return next({ context: {
+			user: resolved.user,
+			session: resolved.session
+		} });
+	});
+	async function resolveRequiredSession(context, headers) {
+		const resolved = await options.getAuth(context).api.getSession({ headers });
+		if (resolved === null) {
+			if (getSessionCookie(headers)) throw new StaleSessionError();
+			throw new AuthenticationError();
+		}
+		return resolved;
+	}
+	return {
+		extractAuth,
+		requireAuth: createMiddleware({ type: "function" }).server(async ({ next, context }) => {
+			const resolved = await resolveRequiredSession(context, getRequestHeaders());
+			return next({ context: {
+				user: resolved.user,
+				session: resolved.session
+			} });
+		}),
+		requireAuthRequest: createMiddleware({ type: "request" }).server(async ({ request, next, context }) => {
+			const resolved = await resolveRequiredSession(context, request.headers);
+			return next({ context: {
+				user: resolved.user,
+				session: resolved.session
+			} });
+		})
+	};
+}
+
+//#endregion
+//#region src/infrastructure/tanstack/resolve-failure.ts
+const logger = createLogger("error-boundary");
+/**
+* Resolve one failure through the table or fall back to the generic replacement, and log it once.
+* Both transport converters call this, so one rule decides the log level: mapped is a warning, unmapped is an error with the cause.
+*/
+function resolveFailure(table, cause) {
+	const resolved = table.resolve(cause);
+	if (resolved !== null) {
+		logger.warn("handled_error", { details: {
+			tag: resolved.payload._tag,
+			status: resolved.status
+		} });
+		return resolved;
+	}
+	const classification = cause instanceof AppError ? cause.classification : "unknown";
+	logger.error("unexpected_error", {
+		error: cause,
+		details: { classification }
+	});
+	return table.fallback(cause);
+}
+
+//#endregion
+//#region src/infrastructure/tanstack/http-error-response.ts
+const RetryAfterSchema = z.object({ retryAfter: z.number() });
+/**
+* Build the API route converter for one error table.
+* The body is RFC 9457 problem details; public fields become extension members.
+*/
+function createHttpErrorResponseConverter(table) {
+	return function toHttpErrorResponse(cause) {
+		const { status, payload } = resolveFailure(table, cause);
+		const { _tag, message, ...fields } = payload;
+		const body = {
+			type: "about:blank",
+			title: getReasonPhrase(status),
+			detail: message,
+			...fields
+		};
+		const headers = new Headers({ "Content-Type": "application/problem+json" });
+		const retry = RetryAfterSchema.safeParse(payload);
+		if (retry.success) headers.set("Retry-After", String(retry.data.retryAfter));
+		return Response.json(body, {
+			status,
+			headers
+		});
+	};
+}
+
+//#endregion
+//#region src/infrastructure/tanstack/session-cookies.ts
+/**
+* Delete the session, session cache, account cache, and remember-me cookies of one instance.
+* Chunks present on the request go too. Names and attributes come from the instance, so custom prefixes and domain cookies clear.
+*/
+function clearStaleSessionCookies(cookies) {
+	const present = [...parseCookies(getRequestHeaders().get("cookie") ?? "").keys()];
+	const definitions = [
+		cookies.sessionToken,
+		cookies.sessionData,
+		cookies.accountData,
+		cookies.dontRememberToken
+	];
+	for (const cookie of definitions) {
+		const chunks = present.filter((name) => name.startsWith(`${cookie.name}.`));
+		for (const name of /* @__PURE__ */ new Set([cookie.name, ...chunks])) deleteCookie(name, deletionOf(cookie.attributes));
+	}
+}
+function deletionOf(attributes) {
+	const options = {
+		path: attributes.path ?? "/",
+		secure: attributes.secure ?? false
+	};
+	if (attributes.domain !== void 0) options.domain = attributes.domain;
+	return options;
+}
+
+//#endregion
+//#region src/infrastructure/tanstack/to-error-payload.ts
+const SerializedIssuesSchema = z.array(z.object({
+	message: z.string(),
+	path: z.array(z.union([z.string(), z.number()]))
+})).min(1);
+function reconstructValidationError(cause) {
+	if (!(cause instanceof Error)) return null;
+	let message;
+	try {
+		message = JSON.parse(cause.message);
+	} catch {
+		return null;
+	}
+	const parsed = SerializedIssuesSchema.safeParse(message);
+	return parsed.success ? ValidationError.fromIssues(parsed.data) : null;
+}
+/**
+* Build the server-function converter for one error table.
+* The result is a plain object, because only own data survives serialization.
+*/
+function createErrorPayloadConverter(table) {
+	return function toErrorPayload(cause) {
+		return resolveFailure(table, reconstructValidationError(cause) ?? cause).payload;
+	};
+}
+
+//#endregion
+//#region src/infrastructure/tanstack/error.middleware.ts
+/**
+* Build both transport boundaries from one error table.
+* Register `functionErrorMiddleware` globally. Put `routeErrorMiddleware` first in an API route's `server.middleware`.
+*/
+function createErrorMiddleware(options) {
+	const toErrorPayload = createErrorPayloadConverter(options.errors);
+	const toHttpErrorResponse = createHttpErrorResponseConverter(options.errors);
+	async function clearSession(context) {
+		const { authCookies } = await options.getAuth(context).$context;
+		clearStaleSessionCookies(authCookies);
+	}
+	async function handleFunctionError(cause, context) {
+		if (isNotFound(cause) || isRedirect(cause)) throw cause;
+		if (cause instanceof StaleSessionError) {
+			await clearSession(context);
+			throw options.signIn();
+		}
+		throw toErrorPayload(cause);
+	}
+	async function handleRouteError(cause, context) {
+		if (isNotFound(cause) || isRedirect(cause)) throw cause;
+		if (cause instanceof StaleSessionError) await clearSession(context);
+		return toHttpErrorResponse(cause);
+	}
+	return {
+		functionErrorMiddleware: createMiddleware({ type: "function" }).server(async ({ next, context }) => {
+			try {
+				return await next();
+			} catch (cause) {
+				return handleFunctionError(cause, context);
+			}
+		}),
+		routeErrorMiddleware: createMiddleware({ type: "request" }).server(async ({ next, context }) => {
+			try {
+				return await next();
+			} catch (cause) {
+				return handleRouteError(cause, context);
+			}
+		}),
+		toErrorPayload,
+		toHttpErrorResponse
+	};
+}
+
+//#endregion
+export { createAuthMiddleware, createErrorMiddleware };
+//# sourceMappingURL=tanstack.js.map

package/dist/tanstack.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tanstack.js","names":["logger"],"sources":["../src/infrastructure/tanstack/auth.middleware.ts","../src/infrastructure/tanstack/resolve-failure.ts","../src/infrastructure/tanstack/http-error-response.ts","../src/infrastructure/tanstack/session-cookies.ts","../src/infrastructure/tanstack/to-error-payload.ts","../src/infrastructure/tanstack/error.middleware.ts"],"sourcesContent":["import { createMiddleware, type Register, type RequestServerOptions } from '@tanstack/react-start'\nimport { getRequestHeaders } from '@tanstack/react-start/server'\nimport { getSessionCookie } from 'better-auth/cookies'\n\nimport { AuthenticationError, StaleSessionError, createLogger } from '@/core'\n\nconst logger = createLogger('auth-middleware')\n\n/** The fields middleware reads; generic callers retain every additional session and user field. */\nexport type AuthSession = {\n  readonly user: { readonly id: string }\n  readonly session: { readonly id: string }\n}\n\n/** Authenticated context retains the application's complete user and session types. */\nexport type RequiredAuthContext<Session extends AuthSession> = {\n  readonly user: Session['user']\n  readonly session: Session['session']\n}\n\n/** Optional authentication supplies both fields together or neither field. */\nexport type AuthContext<Session extends AuthSession> =\n  | RequiredAuthContext<Session>\n  | {\n      readonly user: undefined\n      readonly session: undefined\n    }\n\n/** Select the current request's Better Auth instance from TanStack's registered context. */\nexport type AuthMiddlewareOptions<Session extends AuthSession> = {\n  readonly getAuth: (context: RequestServerOptions<Register, undefined>['context']) => {\n    readonly api: {\n      readonly getSession: (options: { headers: Headers }) => Promise<Session | null>\n    }\n  }\n}\n\n/**\n * Preserve Porte's function and request middleware contracts with application-owned services.\n * Optional lookup failures log once and continue as guests. Required lookup failures propagate.\n */\nexport function createAuthMiddleware<Session extends AuthSession>(\n  options: AuthMiddlewareOptions<Session>,\n) {\n  const extractAuth = createMiddleware({ type: 'function' }).server<AuthContext<Session>>(\n    async ({ next, context }) => {\n      let resolved: Session | null\n      try {\n        resolved = await options.getAuth(context).api.getSession({ headers: getRequestHeaders() })\n      } catch (error) {\n        logger.error('get_session_failed', { error })\n        resolved = null\n      }\n      if (resolved === null)\n        return next<AuthContext<Session>>({ context: { user: undefined, session: undefined } })\n      return next<AuthContext<Session>>({\n        context: { user: resolved.user, session: resolved.session },\n      })\n    },\n  )\n\n  async function resolveRequiredSession(\n    context: RequestServerOptions<Register, undefined>['context'],\n    headers: Headers,\n  ): Promise<Session> {\n    const resolved = await options.getAuth(context).api.getSession({ headers })\n    if (resolved === null) {\n      if (getSessionCookie(headers)) throw new StaleSessionError()\n      throw new AuthenticationError()\n    }\n    return resolved\n  }\n\n  const requireAuth = createMiddleware({ type: 'function' }).server(async ({ next, context }) => {\n    const resolved = await resolveRequiredSession(context, getRequestHeaders())\n    return next<RequiredAuthContext<Session>>({\n      context: { user: resolved.user, session: resolved.session },\n    })\n  })\n  const requireAuthRequest = createMiddleware({ type: 'request' }).server(\n    async ({ request, next, context }) => {\n      const resolved = await resolveRequiredSession(context, request.headers)\n      return next<RequiredAuthContext<Session>>({\n        context: { user: resolved.user, session: resolved.session },\n      })\n    },\n  )\n  return { extractAuth, requireAuth, requireAuthRequest }\n}\n","import { AppError, createLogger, type ErrorTable, type ResolvedError } from '@/core'\nimport type { ErrorPayloadOf } from '@/core'\n\nconst logger = createLogger('error-boundary')\n\n/**\n * Resolve one failure through the table or fall back to the generic replacement, and log it once.\n * Both transport converters call this, so one rule decides the log level: mapped is a warning, unmapped is an error with the cause.\n */\nexport function resolveFailure<Entries>(\n  table: ErrorTable<Entries>,\n  cause: unknown,\n): ResolvedError<ErrorPayloadOf<ErrorTable<Entries>>> {\n  const resolved = table.resolve(cause)\n  if (resolved !== null) {\n    logger.warn('handled_error', {\n      details: { tag: resolved.payload._tag, status: resolved.status },\n    })\n    return resolved\n  }\n  const classification = cause instanceof AppError ? cause.classification : 'unknown'\n  logger.error('unexpected_error', { error: cause, details: { classification } })\n  return table.fallback(cause)\n}\n","import { getReasonPhrase } from 'http-status-codes'\nimport { z } from 'zod'\n\nimport type { ErrorTable, ProblemDetails } from '@/core'\n\nimport { resolveFailure } from './resolve-failure.ts'\n\n// A known delay becomes the header; a null delay sends no header.\nconst RetryAfterSchema = z.object({ retryAfter: z.number() })\n\n/**\n * Build the API route converter for one error table.\n * The body is RFC 9457 problem details; public fields become extension members.\n */\nexport function createHttpErrorResponseConverter<Entries>(table: ErrorTable<Entries>) {\n  return function toHttpErrorResponse(cause: unknown): Response {\n    const { status, payload } = resolveFailure(table, cause)\n    const { _tag, message, ...fields } = payload\n    const body: ProblemDetails = {\n      type: 'about:blank',\n      title: getReasonPhrase(status),\n      detail: message,\n      ...fields,\n    }\n    const headers = new Headers({ 'Content-Type': 'application/problem+json' })\n    const retry = RetryAfterSchema.safeParse(payload)\n    if (retry.success) headers.set('Retry-After', String(retry.data.retryAfter))\n    return Response.json(body, { status, headers })\n  }\n}\n","import { deleteCookie, getRequestHeaders } from '@tanstack/react-start/server'\nimport type { BetterAuthCookies } from 'better-auth'\nimport { parseCookies } from 'better-auth/cookies'\n\ntype AuthCookie = BetterAuthCookies['sessionToken']\ntype DeleteCookieOptions = NonNullable<Parameters<typeof deleteCookie>[1]>\n\n/**\n * Delete the session, session cache, account cache, and remember-me cookies of one instance.\n * Chunks present on the request go too. Names and attributes come from the instance, so custom prefixes and domain cookies clear.\n */\nexport function clearStaleSessionCookies(cookies: BetterAuthCookies): void {\n  const present = [...parseCookies(getRequestHeaders().get('cookie') ?? '').keys()]\n  const definitions = [\n    cookies.sessionToken,\n    cookies.sessionData,\n    cookies.accountData,\n    cookies.dontRememberToken,\n  ]\n  for (const cookie of definitions) {\n    // Better Auth names a chunk `${name}.${index}`, so a missed chunk would resurrect the value.\n    const chunks = present.filter((name) => name.startsWith(`${cookie.name}.`))\n    for (const name of new Set([cookie.name, ...chunks]))\n      deleteCookie(name, deletionOf(cookie.attributes))\n  }\n}\n\nfunction deletionOf(attributes: AuthCookie['attributes']): DeleteCookieOptions {\n  // Better Auth sets `/` and the secure flag at runtime; the types leave both optional.\n  const options: DeleteCookieOptions = {\n    path: attributes.path ?? '/',\n    secure: attributes.secure ?? false,\n  }\n  if (attributes.domain !== undefined) options.domain = attributes.domain\n  return options\n}\n","import { z } from 'zod'\n\nimport { ValidationError, type ErrorPayloadOf, type ErrorTable } from '@/core'\n\nimport { resolveFailure } from './resolve-failure.ts'\n\n// TanStack serializes a validator's issues into `Error.message` as JSON.\nconst SerializedIssuesSchema = z\n  .array(z.object({ message: z.string(), path: z.array(z.union([z.string(), z.number()])) }))\n  .min(1)\n\nfunction reconstructValidationError(cause: unknown): ValidationError | null {\n  if (!(cause instanceof Error)) return null\n  let message: unknown\n  try {\n    message = JSON.parse(cause.message)\n  } catch {\n    return null\n  }\n  const parsed = SerializedIssuesSchema.safeParse(message)\n  return parsed.success ? ValidationError.fromIssues(parsed.data) : null\n}\n\n/**\n * Build the server-function converter for one error table.\n * The result is a plain object, because only own data survives serialization.\n */\nexport function createErrorPayloadConverter<Entries>(table: ErrorTable<Entries>) {\n  return function toErrorPayload(cause: unknown): ErrorPayloadOf<ErrorTable<Entries>> {\n    return resolveFailure(table, reconstructValidationError(cause) ?? cause).payload\n  }\n}\n","import { isNotFound, isRedirect, type AnyRedirect } from '@tanstack/react-router'\nimport { createMiddleware, type Register, type RequestServerOptions } from '@tanstack/react-start'\nimport type { BetterAuthCookies } from 'better-auth'\n\nimport { StaleSessionError, type ErrorTable } from '@/core'\n\nimport { createHttpErrorResponseConverter } from './http-error-response.ts'\nimport { clearStaleSessionCookies } from './session-cookies.ts'\nimport { createErrorPayloadConverter } from './to-error-payload.ts'\n\ntype RequestContext = RequestServerOptions<Register, undefined>['context']\n\n/** The part of a Better Auth instance the boundary reads: its computed cookie definitions. */\nexport type AuthCookieSource = {\n  readonly $context: Promise<{ readonly authCookies: BetterAuthCookies }>\n}\n\n/** The application's error table, its stale-session redirect, and its Better Auth instance. */\nexport type ErrorMiddlewareOptions<Entries> = {\n  readonly errors: ErrorTable<Entries>\n  /** Build the redirect a server function throws for a stale session. */\n  readonly signIn: () => AnyRedirect\n  /** Select the request's Better Auth instance; its cookie definitions say what to clear. */\n  readonly getAuth: (context: RequestContext) => AuthCookieSource\n}\n\n/**\n * Build both transport boundaries from one error table.\n * Register `functionErrorMiddleware` globally. Put `routeErrorMiddleware` first in an API route's `server.middleware`.\n */\nexport function createErrorMiddleware<Entries>(options: ErrorMiddlewareOptions<Entries>) {\n  const toErrorPayload = createErrorPayloadConverter(options.errors)\n  const toHttpErrorResponse = createHttpErrorResponseConverter(options.errors)\n\n  async function clearSession(context: RequestContext): Promise<void> {\n    const { authCookies } = await options.getAuth(context).$context\n    clearStaleSessionCookies(authCookies)\n  }\n\n  async function handleFunctionError(cause: unknown, context: RequestContext): Promise<never> {\n    // oxlint-disable-next-line typescript/only-throw-error -- TanStack uses throwable control-flow objects.\n    if (isNotFound(cause) || isRedirect(cause)) throw cause\n    if (cause instanceof StaleSessionError) {\n      await clearSession(context)\n      // oxlint-disable-next-line typescript/only-throw-error -- Router redirects by throwing this.\n      throw options.signIn()\n    }\n    // oxlint-disable-next-line typescript/only-throw-error -- The client rejects with this and reads its tag.\n    throw toErrorPayload(cause)\n  }\n\n  // A route answers 401 instead of a redirect because fetch would follow it into the HTML shell.\n  async function handleRouteError(cause: unknown, context: RequestContext): Promise<Response> {\n    // oxlint-disable-next-line typescript/only-throw-error -- TanStack uses throwable control-flow objects.\n    if (isNotFound(cause) || isRedirect(cause)) throw cause\n    if (cause instanceof StaleSessionError) await clearSession(context)\n    return toHttpErrorResponse(cause)\n  }\n\n  const functionErrorMiddleware = createMiddleware({ type: 'function' }).server(\n    async ({ next, context }) => {\n      try {\n        return await next()\n      } catch (cause) {\n        return handleFunctionError(cause, context)\n      }\n    },\n  )\n\n  const routeErrorMiddleware = createMiddleware({ type: 'request' }).server(\n    async ({ next, context }) => {\n      try {\n        return await next()\n      } catch (cause) {\n        return handleRouteError(cause, context)\n      }\n    },\n  )\n\n  return { functionErrorMiddleware, routeErrorMiddleware, toErrorPayload, toHttpErrorResponse }\n}\n"],"mappings":";;;;;;;;;AAMA,MAAMA,WAAS,aAAa,iBAAiB;;;;;AAmC7C,SAAgB,qBACd,SACA;CACA,MAAM,cAAc,iBAAiB,EAAE,MAAM,WAAW,CAAC,CAAC,CAAC,OACzD,OAAO,EAAE,MAAM,cAAc;EAC3B,IAAI;EACJ,IAAI;GACF,WAAW,MAAM,QAAQ,QAAQ,OAAO,CAAC,CAAC,IAAI,WAAW,EAAE,SAAS,kBAAkB,EAAE,CAAC;EAC3F,SAAS,OAAO;GACd,SAAO,MAAM,sBAAsB,EAAE,MAAM,CAAC;GAC5C,WAAW;EACb;EACA,IAAI,aAAa,MACf,OAAO,KAA2B,EAAE,SAAS;GAAE,MAAM;GAAW,SAAS;EAAU,EAAE,CAAC;EACxF,OAAO,KAA2B,EAChC,SAAS;GAAE,MAAM,SAAS;GAAM,SAAS,SAAS;EAAQ,EAC5D,CAAC;CACH,CACF;CAEA,eAAe,uBACb,SACA,SACkB;EAClB,MAAM,WAAW,MAAM,QAAQ,QAAQ,OAAO,CAAC,CAAC,IAAI,WAAW,EAAE,QAAQ,CAAC;EAC1E,IAAI,aAAa,MAAM;GACrB,IAAI,iBAAiB,OAAO,GAAG,MAAM,IAAI,kBAAkB;GAC3D,MAAM,IAAI,oBAAoB;EAChC;EACA,OAAO;CACT;CAgBA,OAAO;EAAE;EAAa,aAdF,iBAAiB,EAAE,MAAM,WAAW,CAAC,CAAC,CAAC,OAAO,OAAO,EAAE,MAAM,cAAc;GAC7F,MAAM,WAAW,MAAM,uBAAuB,SAAS,kBAAkB,CAAC;GAC1E,OAAO,KAAmC,EACxC,SAAS;IAAE,MAAM,SAAS;IAAM,SAAS,SAAS;GAAQ,EAC5D,CAAC;EACH,CASgC;EAAG,oBARR,iBAAiB,EAAE,MAAM,UAAU,CAAC,CAAC,CAAC,OAC/D,OAAO,EAAE,SAAS,MAAM,cAAc;GACpC,MAAM,WAAW,MAAM,uBAAuB,SAAS,QAAQ,OAAO;GACtE,OAAO,KAAmC,EACxC,SAAS;IAAE,MAAM,SAAS;IAAM,SAAS,SAAS;GAAQ,EAC5D,CAAC;EACH,CAEkD;CAAE;AACxD;;;;ACrFA,MAAM,SAAS,aAAa,gBAAgB;;;;;AAM5C,SAAgB,eACd,OACA,OACoD;CACpD,MAAM,WAAW,MAAM,QAAQ,KAAK;CACpC,IAAI,aAAa,MAAM;EACrB,OAAO,KAAK,iBAAiB,EAC3B,SAAS;GAAE,KAAK,SAAS,QAAQ;GAAM,QAAQ,SAAS;EAAO,EACjE,CAAC;EACD,OAAO;CACT;CACA,MAAM,iBAAiB,iBAAiB,WAAW,MAAM,iBAAiB;CAC1E,OAAO,MAAM,oBAAoB;EAAE,OAAO;EAAO,SAAS,EAAE,eAAe;CAAE,CAAC;CAC9E,OAAO,MAAM,SAAS,KAAK;AAC7B;;;;ACfA,MAAM,mBAAmB,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;;;;;AAM5D,SAAgB,iCAA0C,OAA4B;CACpF,OAAO,SAAS,oBAAoB,OAA0B;EAC5D,MAAM,EAAE,QAAQ,YAAY,eAAe,OAAO,KAAK;EACvD,MAAM,EAAE,MAAM,SAAS,GAAG,WAAW;EACrC,MAAM,OAAuB;GAC3B,MAAM;GACN,OAAO,gBAAgB,MAAM;GAC7B,QAAQ;GACR,GAAG;EACL;EACA,MAAM,UAAU,IAAI,QAAQ,EAAE,gBAAgB,2BAA2B,CAAC;EAC1E,MAAM,QAAQ,iBAAiB,UAAU,OAAO;EAChD,IAAI,MAAM,SAAS,QAAQ,IAAI,eAAe,OAAO,MAAM,KAAK,UAAU,CAAC;EAC3E,OAAO,SAAS,KAAK,MAAM;GAAE;GAAQ;EAAQ,CAAC;CAChD;AACF;;;;;;;;AClBA,SAAgB,yBAAyB,SAAkC;CACzE,MAAM,UAAU,CAAC,GAAG,aAAa,kBAAkB,CAAC,CAAC,IAAI,QAAQ,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC;CAChF,MAAM,cAAc;EAClB,QAAQ;EACR,QAAQ;EACR,QAAQ;EACR,QAAQ;CACV;CACA,KAAK,MAAM,UAAU,aAAa;EAEhC,MAAM,SAAS,QAAQ,QAAQ,SAAS,KAAK,WAAW,GAAG,OAAO,KAAK,EAAE,CAAC;EAC1E,KAAK,MAAM,wBAAQ,IAAI,IAAI,CAAC,OAAO,MAAM,GAAG,MAAM,CAAC,GACjD,aAAa,MAAM,WAAW,OAAO,UAAU,CAAC;CACpD;AACF;AAEA,SAAS,WAAW,YAA2D;CAE7E,MAAM,UAA+B;EACnC,MAAM,WAAW,QAAQ;EACzB,QAAQ,WAAW,UAAU;CAC/B;CACA,IAAI,WAAW,WAAW,QAAW,QAAQ,SAAS,WAAW;CACjE,OAAO;AACT;;;;AC5BA,MAAM,yBAAyB,EAC5B,MAAM,EAAE,OAAO;CAAE,SAAS,EAAE,OAAO;CAAG,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;AAAE,CAAC,CAAC,CAAC,CAC1F,IAAI,CAAC;AAER,SAAS,2BAA2B,OAAwC;CAC1E,IAAI,EAAE,iBAAiB,QAAQ,OAAO;CACtC,IAAI;CACJ,IAAI;EACF,UAAU,KAAK,MAAM,MAAM,OAAO;CACpC,QAAQ;EACN,OAAO;CACT;CACA,MAAM,SAAS,uBAAuB,UAAU,OAAO;CACvD,OAAO,OAAO,UAAU,gBAAgB,WAAW,OAAO,IAAI,IAAI;AACpE;;;;;AAMA,SAAgB,4BAAqC,OAA4B;CAC/E,OAAO,SAAS,eAAe,OAAqD;EAClF,OAAO,eAAe,OAAO,2BAA2B,KAAK,KAAK,KAAK,CAAC,CAAC;CAC3E;AACF;;;;;;;;ACDA,SAAgB,sBAA+B,SAA0C;CACvF,MAAM,iBAAiB,4BAA4B,QAAQ,MAAM;CACjE,MAAM,sBAAsB,iCAAiC,QAAQ,MAAM;CAE3E,eAAe,aAAa,SAAwC;EAClE,MAAM,EAAE,gBAAgB,MAAM,QAAQ,QAAQ,OAAO,CAAC,CAAC;EACvD,yBAAyB,WAAW;CACtC;CAEA,eAAe,oBAAoB,OAAgB,SAAyC;EAE1F,IAAI,WAAW,KAAK,KAAK,WAAW,KAAK,GAAG,MAAM;EAClD,IAAI,iBAAiB,mBAAmB;GACtC,MAAM,aAAa,OAAO;GAE1B,MAAM,QAAQ,OAAO;EACvB;EAEA,MAAM,eAAe,KAAK;CAC5B;CAGA,eAAe,iBAAiB,OAAgB,SAA4C;EAE1F,IAAI,WAAW,KAAK,KAAK,WAAW,KAAK,GAAG,MAAM;EAClD,IAAI,iBAAiB,mBAAmB,MAAM,aAAa,OAAO;EAClE,OAAO,oBAAoB,KAAK;CAClC;CAsBA,OAAO;EAAE,yBApBuB,iBAAiB,EAAE,MAAM,WAAW,CAAC,CAAC,CAAC,OACrE,OAAO,EAAE,MAAM,cAAc;GAC3B,IAAI;IACF,OAAO,MAAM,KAAK;GACpB,SAAS,OAAO;IACd,OAAO,oBAAoB,OAAO,OAAO;GAC3C;EACF,CAa6B;EAAG,sBAVL,iBAAiB,EAAE,MAAM,UAAU,CAAC,CAAC,CAAC,OACjE,OAAO,EAAE,MAAM,cAAc;GAC3B,IAAI;IACF,OAAO,MAAM,KAAK;GACpB,SAAS,OAAO;IACd,OAAO,iBAAiB,OAAO,OAAO;GACxC;EACF,CAGmD;EAAG;EAAgB;CAAoB;AAC9F"}

package/dist/{unit-of-work-context-CILhzKWb.js → unit-of-work-context-C7vz5OYS.js}

@@ -1,4 +1,4 @@
-import { t as UnitOfWorkAlreadyActiveError } from "./application-BpSwCKJ5.js";
+import { t as UnitOfWorkAlreadyActiveError } from "./application-DEerezCl.js";
 import { panic } from "better-result";
 import { AsyncLocalStorage } from "node:async_hooks";
 
@@ -45,4 +45,4 @@ function currentContext() {
 
 //#endregion
 export { stageD1Statement as i, eventCollector as n, runWithUnitOfWorkContext as r, collectD1Statements as t };
-//# sourceMappingURL=unit-of-work-context-CILhzKWb.js.map
+//# sourceMappingURL=unit-of-work-context-C7vz5OYS.js.map

package/dist/{unit-of-work-context-CILhzKWb.js.map → unit-of-work-context-C7vz5OYS.js.map}

@@ -1 +1 @@
-{"version":3,"file":"unit-of-work-context-CILhzKWb.js","names":[],"sources":["../src/infrastructure/unit-of-work-context.ts"],"sourcesContent":["import { AsyncLocalStorage } from 'node:async_hooks'\n\nimport { panic } from 'better-result'\nimport type { BatchItem } from 'drizzle-orm/batch'\n\nimport { UnitOfWorkAlreadyActiveError, type Event, type IEventCollector } from '@/application'\n\ntype UnitOfWorkContext = { readonly events: Event[] } & (\n  | { readonly database: 'd1'; readonly statements: BatchItem<'sqlite'>[] }\n  | { readonly database: 'postgres' }\n)\n\n// One async scope isolates events and D1 statements and rejects nesting across both adapters.\nconst storage = new AsyncLocalStorage<UnitOfWorkContext>()\n\n/** Reject nested transactions before database work starts; preserve independent concurrent execution. */\nexport async function runWithUnitOfWorkContext<T>(\n  database: UnitOfWorkContext['database'],\n  work: () => Promise<T>,\n): Promise<T> {\n  if (storage.getStore() !== undefined) throw new UnitOfWorkAlreadyActiveError()\n  const context: UnitOfWorkContext =\n    database === 'd1' ? { database, events: [], statements: [] } : { database, events: [] }\n  return storage.run(context, work)\n}\n\n/** Inject this shared scope into the unit of work and expose its emitter to application handlers. */\nexport const eventCollector: IEventCollector = {\n  emit(event) {\n    currentContext().events.push(event)\n  },\n  collect() {\n    return [...currentContext().events]\n  },\n}\n\n/** Queue one native D1 statement for the active batch; other contexts cannot accept D1 writes. */\nexport function stageD1Statement(statement: BatchItem<'sqlite'>): void {\n  d1Context().statements.push(statement)\n}\n\n/** Read the active D1 batch in staging order for commit. */\nexport function collectD1Statements(): ReadonlyArray<BatchItem<'sqlite'>> {\n  return [...d1Context().statements]\n}\n\nfunction d1Context(): Extract<UnitOfWorkContext, { database: 'd1' }> {\n  const context = currentContext()\n  if (context.database !== 'd1') return panic('D1 statements require a D1 unit of work')\n  return context\n}\n\nfunction currentContext(): UnitOfWorkContext {\n  return storage.getStore() ?? panic('operation requires an active unit of work')\n}\n"],"mappings":";;;;;AAaA,MAAM,UAAU,IAAI,kBAAqC;;AAGzD,eAAsB,yBACpB,UACA,MACY;CACZ,IAAI,QAAQ,SAAS,MAAM,QAAW,MAAM,IAAI,6BAA6B;CAC7E,MAAM,UACJ,aAAa,OAAO;EAAE;EAAU,QAAQ,CAAC;EAAG,YAAY,CAAC;CAAE,IAAI;EAAE;EAAU,QAAQ,CAAC;CAAE;CACxF,OAAO,QAAQ,IAAI,SAAS,IAAI;AAClC;;AAGA,MAAa,iBAAkC;CAC7C,KAAK,OAAO;EACV,eAAe,CAAC,CAAC,OAAO,KAAK,KAAK;CACpC;CACA,UAAU;EACR,OAAO,CAAC,GAAG,eAAe,CAAC,CAAC,MAAM;CACpC;AACF;;AAGA,SAAgB,iBAAiB,WAAsC;CACrE,UAAU,CAAC,CAAC,WAAW,KAAK,SAAS;AACvC;;AAGA,SAAgB,sBAA0D;CACxE,OAAO,CAAC,GAAG,UAAU,CAAC,CAAC,UAAU;AACnC;AAEA,SAAS,YAA4D;CACnE,MAAM,UAAU,eAAe;CAC/B,IAAI,QAAQ,aAAa,MAAM,OAAO,MAAM,yCAAyC;CACrF,OAAO;AACT;AAEA,SAAS,iBAAoC;CAC3C,OAAO,QAAQ,SAAS,KAAK,MAAM,2CAA2C;AAChF"}
+{"version":3,"file":"unit-of-work-context-C7vz5OYS.js","names":[],"sources":["../src/infrastructure/unit-of-work-context.ts"],"sourcesContent":["import { AsyncLocalStorage } from 'node:async_hooks'\n\nimport { panic } from 'better-result'\nimport type { BatchItem } from 'drizzle-orm/batch'\n\nimport { UnitOfWorkAlreadyActiveError, type Event, type IEventCollector } from '@/application'\n\ntype UnitOfWorkContext = { readonly events: Event[] } & (\n  | { readonly database: 'd1'; readonly statements: BatchItem<'sqlite'>[] }\n  | { readonly database: 'postgres' }\n)\n\n// One async scope isolates events and D1 statements and rejects nesting across both adapters.\nconst storage = new AsyncLocalStorage<UnitOfWorkContext>()\n\n/** Reject nested transactions before database work starts; preserve independent concurrent execution. */\nexport async function runWithUnitOfWorkContext<T>(\n  database: UnitOfWorkContext['database'],\n  work: () => Promise<T>,\n): Promise<T> {\n  if (storage.getStore() !== undefined) throw new UnitOfWorkAlreadyActiveError()\n  const context: UnitOfWorkContext =\n    database === 'd1' ? { database, events: [], statements: [] } : { database, events: [] }\n  return storage.run(context, work)\n}\n\n/** Inject this shared scope into the unit of work and expose its emitter to application handlers. */\nexport const eventCollector: IEventCollector = {\n  emit(event) {\n    currentContext().events.push(event)\n  },\n  collect() {\n    return [...currentContext().events]\n  },\n}\n\n/** Queue one native D1 statement for the active batch; other contexts cannot accept D1 writes. */\nexport function stageD1Statement(statement: BatchItem<'sqlite'>): void {\n  d1Context().statements.push(statement)\n}\n\n/** Read the active D1 batch in staging order for commit. */\nexport function collectD1Statements(): ReadonlyArray<BatchItem<'sqlite'>> {\n  return [...d1Context().statements]\n}\n\nfunction d1Context(): Extract<UnitOfWorkContext, { database: 'd1' }> {\n  const context = currentContext()\n  if (context.database !== 'd1') return panic('D1 statements require a D1 unit of work')\n  return context\n}\n\nfunction currentContext(): UnitOfWorkContext {\n  return storage.getStore() ?? panic('operation requires an active unit of work')\n}\n"],"mappings":";;;;;AAaA,MAAM,UAAU,IAAI,kBAAqC;;AAGzD,eAAsB,yBACpB,UACA,MACY;CACZ,IAAI,QAAQ,SAAS,MAAM,QAAW,MAAM,IAAI,6BAA6B;CAC7E,MAAM,UACJ,aAAa,OAAO;EAAE;EAAU,QAAQ,CAAC;EAAG,YAAY,CAAC;CAAE,IAAI;EAAE;EAAU,QAAQ,CAAC;CAAE;CACxF,OAAO,QAAQ,IAAI,SAAS,IAAI;AAClC;;AAGA,MAAa,iBAAkC;CAC7C,KAAK,OAAO;EACV,eAAe,CAAC,CAAC,OAAO,KAAK,KAAK;CACpC;CACA,UAAU;EACR,OAAO,CAAC,GAAG,eAAe,CAAC,CAAC,MAAM;CACpC;AACF;;AAGA,SAAgB,iBAAiB,WAAsC;CACrE,UAAU,CAAC,CAAC,WAAW,KAAK,SAAS;AACvC;;AAGA,SAAgB,sBAA0D;CACxE,OAAO,CAAC,GAAG,UAAU,CAAC,CAAC,UAAU;AACnC;AAEA,SAAS,YAA4D;CACnE,MAAM,UAAU,eAAe;CAC/B,IAAI,QAAQ,aAAa,MAAM,OAAO,MAAM,yCAAyC;CACrF,OAAO;AACT;AAEA,SAAS,iBAAoC;CAC3C,OAAO,QAAQ,SAAS,KAAK,MAAM,2CAA2C;AAChF"}

package/dist/{unit-of-work-context-DOkIB7HK.d.ts → unit-of-work-context-ml9L9cyY.d.ts}

@@ -1,4 +1,4 @@
-import { o as IEventCollector } from "./index-CkaFqbbV.js";
+import { o as IEventCollector } from "./index-Bdyh3_xC.js";
 import { BatchItem } from "drizzle-orm/batch";
 //#region src/infrastructure/drizzle-schema.d.ts
 /**
@@ -12,4 +12,4 @@ type DrizzleSchema = Record<string, unknown>;
 declare const eventCollector: IEventCollector;
 //#endregion
 export { DrizzleSchema as n, eventCollector as t };
-//# sourceMappingURL=unit-of-work-context-DOkIB7HK.d.ts.map
+//# sourceMappingURL=unit-of-work-context-ml9L9cyY.d.ts.map

package/dist/{unit-of-work-context-DOkIB7HK.d.ts.map → unit-of-work-context-ml9L9cyY.d.ts.map}

@@ -1 +1 @@
-{"version":3,"file":"unit-of-work-context-DOkIB7HK.d.ts","names":[],"sources":["../src/infrastructure/drizzle-schema.ts","../src/infrastructure/unit-of-work-context.ts"],"mappings":";;;;;;;KAKY,gBAAgB;;;;cCsBf,gBAAgB"}
+{"version":3,"file":"unit-of-work-context-ml9L9cyY.d.ts","names":[],"sources":["../src/infrastructure/drizzle-schema.ts","../src/infrastructure/unit-of-work-context.ts"],"mappings":";;;;;;;KAKY,gBAAgB;;;;cCsBf,gBAAgB"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://www.schemastore.org/package.json",
   "name": "better-ship",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Foundation for applications on Cloudflare Workers: logger, errors, message bus, infrastructure adapters, and UI primitives",
   "license": "Apache-2.0",
   "repository": {
@@ -16,7 +16,14 @@
   "type": "module",
   "exports": {
     "./application": "./dist/application.js",
+    "./better-auth": "./dist/better-auth.js",
+    "./better-auth/apple-client-secret": "./dist/better-auth/apple-client-secret.js",
+    "./better-auth/auth-client": "./dist/better-auth/auth-client.js",
+    "./better-auth/rate-limit": "./dist/better-auth/rate-limit.js",
+    "./better-auth/secondary-storage": "./dist/better-auth/secondary-storage.js",
+    "./better-auth/stripe": "./dist/better-auth/stripe.js",
     "./cloudflare": "./dist/cloudflare.js",
+    "./cloudflare/auth-secondary-storage": "./dist/cloudflare/auth-secondary-storage.js",
     "./core": "./dist/core.js",
     "./postgres": "./dist/postgres.js",
     "./tanstack": "./dist/tanstack.js",
@@ -27,23 +34,60 @@
     "access": "public"
   },
   "dependencies": {
-    "better-result": "3.0.1"
+    "better-result": "^3.0.1",
+    "http-status-codes": "^2.3.0",
+    "uuid": "^14.0.2",
+    "zod": "^4.6.2"
   },
   "devDependencies": {
-    "@cloudflare/vitest-plugin": "1.1.4",
-    "@cloudflare/workers-types": "5.20260905.1",
-    "@types/node": "26.4.1",
-    "drizzle-kit": "0.31.10",
-    "drizzle-orm": "0.45.2",
-    "postgres": "3.4.9",
-    "tsdown": "0.23.0",
-    "typescript": "7.0.2",
-    "vitest": "4.1.11"
+    "@better-auth/stripe": "^1.7.4",
+    "@cloudflare/vitest-plugin": "^1.1.7",
+    "@cloudflare/workers-types": "5.20260911.1",
+    "@tanstack/react-router": "^1.170.35",
+    "@tanstack/react-start": "^1.168.52",
+    "@tanstack/start-client-core": "^1.170.29",
+    "@tanstack/start-storage-context": "^1.167.31",
+    "@types/node": "^26.5.1",
+    "auth": "^1.7.4",
+    "better-auth": "^1.7.4",
+    "drizzle-kit": "^0.31.10",
+    "drizzle-orm": "^0.45.2",
+    "jose": "^6.2.12",
+    "postgres": "^3.4.9",
+    "stripe": "^22.6.2",
+    "tsdown": "^0.23.0",
+    "typescript": "^7.0.2",
+    "vitest": "^4.1.11",
+    "wrangler": "^4.131.0"
   },
   "peerDependencies": {
-    "drizzle-orm": "0.45.2"
+    "@better-auth/stripe": "^1.7.4",
+    "@tanstack/react-router": "^1.170.35",
+    "@tanstack/react-start": "^1.168.52",
+    "better-auth": "^1.7.4",
+    "drizzle-orm": "^0.45.2",
+    "jose": "^6.2.12",
+    "stripe": "^22.6.2"
   },
   "peerDependenciesMeta": {
+    "@better-auth/stripe": {
+      "optional": true
+    },
+    "stripe": {
+      "optional": true
+    },
+    "jose": {
+      "optional": true
+    },
+    "better-auth": {
+      "optional": true
+    },
+    "@tanstack/react-router": {
+      "optional": true
+    },
+    "@tanstack/react-start": {
+      "optional": true
+    },
     "drizzle-orm": {
       "optional": true
     }
@@ -58,6 +102,7 @@
     "lint": "oxlint . --quiet",
     "lint:fix": "oxlint . --fix --quiet",
     "test": "vitest run",
+    "cf-typegen": "wrangler types tests/infrastructure/cloudflare/worker-configuration.d.ts --config tests/infrastructure/cloudflare/wrangler.jsonc --include-runtime=false",
     "db:generate:d1": "drizzle-kit generate --config drizzle.d1.config.ts",
     "db:generate:postgres": "drizzle-kit generate --config drizzle.postgres.config.ts"
   }

package/src/core/authentication.error.ts

@@ -0,0 +1,11 @@
+import { AppError } from './app-error.ts'
+
+/** A protected operation requires a session that the caller did not provide. */
+export class AuthenticationError extends AppError {
+  readonly _tag = 'AuthenticationError'
+  readonly classification = 'terminal'
+
+  constructor() {
+    super('Authentication required')
+  }
+}