bunderstack 0.23.4 → 0.24.1

package/CHANGELOG.md

@@ -2,6 +2,73 @@
 
 All notable changes to `bunderstack` will be documented in this file.
 
+## [0.24.1] — 2026-09-14
+
+### Fixed
+
+- Preserve the exact Better Auth configuration through `defineAuth()`,
+  `bunderstack()`, and `BunderstackApp`, so plugin APIs and session fields
+  remain available on `app.auth`.
+- Keep `drizzle-kit` out of the production `bunderstack/provision` bundle.
+  Production provisioning now requires committed migrations; development
+  schema push lives in `bunderstack/provision-schema`.
+
+## [0.24.0] - 2026-09-05
+
+### Changed
+
+- **Env-first declarations.** The declaration stays one object, and the slots
+  that hold credentials — `database`, `storage`, `messaging`, and `realtime` —
+  now also accept a function of the validated environment; `auth` has taken a
+  `{ db, env }` builder since 0.22. A slot function is resolved once per
+  `inspect()`, `start()`, and test fixture, and it supplies values, never
+  shapes.
+- **`backend.manifest` becomes `backend.inspect({ env })`.** A manifest depends
+  on the environment, so it is a call. Inspection validates the environment,
+  resolves the declaration, and builds the manifest without opening a database,
+  a bucket, a provider connection, or a worker.
+- **`email` becomes `messaging`.** Channels are named, each names one provider,
+  and each provider carries its own message type. `app.email.send()` becomes
+  `app.messaging.<channel>.send()`, `ctx.email` becomes `ctx.messaging`, and
+  `t.email.sent` becomes `t.messaging.<channel>.sent`. Providers are declared
+  with `resend()`, `smtp()`, `customEmail()`, and `telegram()`.
+- **Capture replaces the console provider.** A channel whose required
+  configuration is absent or empty writes the message to the journal instead of
+  sending, and prints it locally. On a host the body stays out of the logs. A
+  wrong key and a rejected request still raise.
+- **The message journal replaces the email log.** `_bunderstack_messages` and
+  `_bunderstack_message_events` replace `_bunderstack_emails` and
+  `_bunderstack_email_events`, and record the channel, provider, credential
+  source, status, recipients, content, and error. Applications with committed
+  migrations must run their `db:generate` command and apply the generated
+  migration after upgrading.
+- Manifest version 4 adds `messaging.channels`; the blueprint gains
+  `resources.messaging`. Neither carries a key, a token, or a sender address.
+
+### Added
+
+- **Managed messaging credentials.** `BUNDERSTACK_MESSAGING_CONFIG` supplies
+  provider-keyed defaults that every channel of that provider shares. A field
+  the channel declares itself wins field by field, and each journal row records
+  whether its credentials were `explicit`, `managed`, or `capture`.
+- **Blueprint shape probes.** Blueprint generation resolves the declaration
+  against two accepted environments and rejects a declaration whose shape
+  depends on a value, naming the differing paths and never a value.
+- **Hosted contract checking.** `bunderstack blueprint --hosted-check` compares
+  an inspected declaration with the committed blueprint. At runtime,
+  `BUNDERSTACK_BLUEPRINT_PATH` makes `start()` verify that contract before it
+  connects to anything.
+- `defineApi({ schema, env, messaging })` types `context.messaging` exactly for
+  a router declared in its own module.
+- `createMessaging(channels, { env, db })` builds the same channel facades
+  outside a started app, for a Better Auth builder or a script. It replaces
+  `createEmail`.
+
+### Removed
+
+- The eager `backend.manifest` property, the `email` configuration key,
+  `app.email`, `ctx.email`, and `t.email`. See `docs/MIGRATION-0.24.md`.
+
 ## [0.23.4] - 2026-09-01
 
 ### Fixed

package/README.md

@@ -1,6 +1,6 @@
 # bunderstack
 
-The complete backend & full-stack framework for Bun: type-safe oRPC APIs, auth, storage, realtime, jobs, email, live views, and client bindings from one single file declaration.
+The complete backend & full-stack framework for Bun: type-safe oRPC APIs, auth, storage, realtime, jobs, messaging, live views, and client bindings from one single file declaration.
 
 ```sh
 bun add bunderstack better-auth drizzle-orm valibot @libsql/client
@@ -14,7 +14,7 @@ import * as schema from './schema'
 
 export const backend = bunderstack({
   schema,
-  database: { adapter: libsql(), url: 'file:./data.db' },
+  database: { adapter: libsql() },
   access: { posts: { crud: true } },
   realtime: true,
   api: {
@@ -42,7 +42,7 @@ await context.realtime.publish(schema.posts, 'update', post)
 ```
 
 Use the in-memory Publisher for one process or configure
-`realtime: { redis: process.env.REDIS_URL! }` for multi-process delivery and
+`realtime: (env) => ({ redis: env.REDIS_URL })` for multi-process delivery and
 replay. Deployment metadata is generated with `bunx bunderstack blueprint`.
 
 ## Package Subpaths (0.21+)
@@ -51,6 +51,7 @@ replay. Deployment metadata is generated with `bunx bunderstack blueprint`.
 - `bunderstack/testing` — Isolated lexical fixtures and reusable test factories
   (`backend.test()` / `backend.test.configure()`)
 - `bunderstack/provision` — Explicit production schema provisioning
+- `bunderstack/provision-schema` — Development-only schema push via Drizzle Kit
 - `bunderstack/client` — Framework-neutral RPC & LiveView client (`createClient`, `createLiveView`)
 - `bunderstack/client-rest` — Type-safe REST client
 - `bunderstack/client-react`, `bunderstack/client-solid`, `bunderstack/client-vue`, `bunderstack/client-svelte` — LiveView UI bindings
@@ -59,7 +60,8 @@ replay. Deployment metadata is generated with `bunx bunderstack blueprint`.
 - `bunderstack/start` & `bunderstack/start-auth` — TanStack Start full-stack integration
 - `bunderstack/libsql`, `bunderstack/postgres-js`, `bunderstack/bun-sql`, `bunderstack/bun-sqlite`, `bunderstack/pglite` — Database adapters
 - `bunderstack/storage/*` — Storage adapters (`s3`, `disk`)
-- `bunderstack/email-smtp` — SMTP email adapter
+- `bunderstack/messaging` — Messaging channel descriptors (`resend`, `customEmail`, `telegram`)
+- `bunderstack/email-smtp` — SMTP email channel
 - `bunderstack/jobs/*` — Job queue adapters (`memory`, `redis`)
 
 See the [workspace documentation](https://github.com/kirill-dev-pro/bunderstack#readme) for webhooks, clients,
@@ -69,6 +71,7 @@ storage, collections, lifecycle, and complete examples.
 
 Every change is listed with before/after code in the migration guides, which live in full at:
 
+- [Migrating to 0.24](https://github.com/kirill-dev-pro/bunderstack/blob/main/docs/MIGRATION-0.24.md)
 - [Migrating to 0.22](https://github.com/kirill-dev-pro/bunderstack/blob/main/docs/MIGRATION-0.22.md)
 - [Migrating to 0.21](https://github.com/kirill-dev-pro/bunderstack/blob/main/docs/MIGRATION-0.21.md)
 - [Migrating to 0.17](https://github.com/kirill-dev-pro/bunderstack/blob/main/docs/MIGRATION-0.17.md)

package/dist/api/builder.d.ts

@@ -1,10 +1,11 @@
 import { type AnyMiddleware, type AnyRouter, type Context, type Middleware } from '@orpc/server';
 import type { EnvConfigInput, ValidatedEnv } from '../env.js';
+import type { MessagingConfig } from '../messaging/index.js';
 import type { ApiContext } from './context.js';
 import { BUNDERSTACK_ERRORS } from '../errors.js';
 export type { ProtectedContextAdditions } from './types.js';
-export declare function createApiBuilder<TSchema extends Record<string, unknown> = Record<string, unknown>, TEnv = Record<string, unknown>>(): {
-    public: import("@orpc/server").BuilderWithMiddlewares<ApiContext<TSchema, TEnv> & object, object, {
+export declare function createApiBuilder<TSchema extends Record<string, unknown> = Record<string, unknown>, TEnv = Record<string, unknown>, TMessaging extends MessagingConfig | undefined = MessagingConfig>(): {
+    public: import("@orpc/server").BuilderWithMiddlewares<ApiContext<TSchema, TEnv, TMessaging> & object, object, {
         readonly BAD_REQUEST: {
             readonly data: import("valibot").OptionalSchema<import("valibot").StrictObjectSchema<{
                 readonly code: import("valibot").OptionalSchema<import("valibot").LiteralSchema<"BAD_REQUEST", undefined>, "BAD_REQUEST">;
@@ -62,7 +63,7 @@ export declare function createApiBuilder<TSchema extends Record<string, unknown>
             }>;
         };
     }>;
-    protected: import("@orpc/server").BuilderWithMiddlewares<ApiContext<TSchema, TEnv> & object, Omit<object, "user" | "session"> & {
+    protected: import("@orpc/server").BuilderWithMiddlewares<ApiContext<TSchema, TEnv, TMessaging> & object, Omit<object, "user" | "session"> & {
         user: import("..").AccessUser;
         session: {
             activeOrganizationId: string | null;
@@ -125,7 +126,7 @@ export declare function createApiBuilder<TSchema extends Record<string, unknown>
             }>;
         };
     }>;
-    webhook: import("@orpc/server").BuilderWithMiddlewares<ApiContext<TSchema, TEnv> & object, object, {
+    webhook: import("@orpc/server").BuilderWithMiddlewares<ApiContext<TSchema, TEnv, TMessaging> & object, object, {
         readonly BAD_REQUEST: {
             readonly data: import("valibot").OptionalSchema<import("valibot").StrictObjectSchema<{
                 readonly code: import("valibot").OptionalSchema<import("valibot").LiteralSchema<"BAD_REQUEST", undefined>, "BAD_REQUEST">;
@@ -191,18 +192,19 @@ export declare function createApiBuilder<TSchema extends Record<string, unknown>
      * The annotation is explicit because the inferred `DecoratedMiddleware`
      * is internal to `@orpc/server` and cannot be named in the emitted types.
      */
-    middleware: <TOutContext extends Context>(middleware: Middleware<ApiContext<TSchema, TEnv>, TOutContext, unknown, unknown, typeof BUNDERSTACK_ERRORS>) => AnyMiddleware;
+    middleware: <TOutContext extends Context>(middleware: Middleware<ApiContext<TSchema, TEnv, TMessaging>, TOutContext, unknown, unknown, typeof BUNDERSTACK_ERRORS>) => AnyMiddleware;
 };
 /**
  * Same builder as `createApiBuilder`, but the generics come from the values an
  * application already has. It reads nothing at runtime, so a module can call it
  * at import time and export the bases that its router modules import.
  */
-export declare function defineApi<TSchema extends Record<string, unknown>, TEnv extends EnvConfigInput | undefined = undefined>(_options: {
+export declare function defineApi<TSchema extends Record<string, unknown>, TEnv extends EnvConfigInput | undefined = undefined, TMessaging extends MessagingConfig = MessagingConfig>(_options: {
     schema: TSchema;
     env?: TEnv;
+    messaging?: TMessaging;
 }): {
-    public: import("@orpc/server").BuilderWithMiddlewares<ApiContext<TSchema, ValidatedEnv<TEnv>> & object, object, {
+    public: import("@orpc/server").BuilderWithMiddlewares<ApiContext<TSchema, ValidatedEnv<TEnv>, TMessaging> & object, object, {
         readonly BAD_REQUEST: {
             readonly data: import("valibot").OptionalSchema<import("valibot").StrictObjectSchema<{
                 readonly code: import("valibot").OptionalSchema<import("valibot").LiteralSchema<"BAD_REQUEST", undefined>, "BAD_REQUEST">;
@@ -260,7 +262,7 @@ export declare function defineApi<TSchema extends Record<string, unknown>, TEnv
             }>;
         };
     }>;
-    protected: import("@orpc/server").BuilderWithMiddlewares<ApiContext<TSchema, ValidatedEnv<TEnv>> & object, Omit<object, "user" | "session"> & {
+    protected: import("@orpc/server").BuilderWithMiddlewares<ApiContext<TSchema, ValidatedEnv<TEnv>, TMessaging> & object, Omit<object, "user" | "session"> & {
         user: import("..").AccessUser;
         session: {
             activeOrganizationId: string | null;
@@ -323,7 +325,7 @@ export declare function defineApi<TSchema extends Record<string, unknown>, TEnv
             }>;
         };
     }>;
-    webhook: import("@orpc/server").BuilderWithMiddlewares<ApiContext<TSchema, ValidatedEnv<TEnv>> & object, object, {
+    webhook: import("@orpc/server").BuilderWithMiddlewares<ApiContext<TSchema, ValidatedEnv<TEnv>, TMessaging> & object, object, {
         readonly BAD_REQUEST: {
             readonly data: import("valibot").OptionalSchema<import("valibot").StrictObjectSchema<{
                 readonly code: import("valibot").OptionalSchema<import("valibot").LiteralSchema<"BAD_REQUEST", undefined>, "BAD_REQUEST">;
@@ -389,7 +391,7 @@ export declare function defineApi<TSchema extends Record<string, unknown>, TEnv
      * The annotation is explicit because the inferred `DecoratedMiddleware`
      * is internal to `@orpc/server` and cannot be named in the emitted types.
      */
-    middleware: <TOutContext extends Context>(middleware: Middleware<ApiContext<TSchema, ValidatedEnv<TEnv>>, TOutContext, unknown, unknown, {
+    middleware: <TOutContext extends Context>(middleware: Middleware<ApiContext<TSchema, ValidatedEnv<TEnv>, TMessaging>, TOutContext, unknown, unknown, {
         readonly BAD_REQUEST: {
             readonly data: import("valibot").OptionalSchema<import("valibot").StrictObjectSchema<{
                 readonly code: import("valibot").OptionalSchema<import("valibot").LiteralSchema<"BAD_REQUEST", undefined>, "BAD_REQUEST">;
@@ -448,6 +450,6 @@ export declare function defineApi<TSchema extends Record<string, unknown>, TEnv
         };
     }>) => AnyMiddleware;
 };
-export type BunderstackApiBuilder<TSchema extends Record<string, unknown>, TEnv = Record<string, unknown>> = ReturnType<typeof createApiBuilder<TSchema, TEnv>>;
+export type BunderstackApiBuilder<TSchema extends Record<string, unknown>, TEnv = Record<string, unknown>, TMessaging extends MessagingConfig | undefined = MessagingConfig> = ReturnType<typeof createApiBuilder<TSchema, TEnv, TMessaging>>;
 export type ApiFactory<TSchema extends Record<string, unknown>, TEnv, TCustomApiRouter extends AnyRouter> = (builder: BunderstackApiBuilder<TSchema, TEnv>) => TCustomApiRouter;
 //# sourceMappingURL=builder.d.ts.map

package/dist/api/builder.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"builder.d.ts","sourceRoot":"","sources":["../../src/api/builder.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,aAAa,EAClB,KAAK,SAAS,EACd,KAAK,OAAO,EACZ,KAAK,UAAU,EAChB,MAAM,cAAc,CAAA;AAErB,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAA;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AAE3C,OAAO,EACL,kBAAkB,EAGnB,MAAM,WAAW,CAAA;AAClB,YAAY,EAAE,yBAAyB,EAAE,MAAM,SAAS,CAAA;AAExD,wBAAgB,gBAAgB,CAC9B,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjE,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IA0B5B;;;;;;;OAOG;gBACuC,CAAC,WAAW,SAAS,OAAO,EACpE,UAAU,EAAE,UAAU,CACpB,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,EACzB,WAAW,EACX,OAAO,EACP,OAAO,EACP,OAAO,kBAAkB,CAC1B,KACE,aAAa;EAErB;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CACvB,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACvC,IAAI,SAAS,cAAc,GAAG,SAAS,GAAG,SAAS,EACnD,QAAQ,EAAE;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,GAAG,CAAC,EAAE,IAAI,CAAA;CAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IA5BvC;;;;;;;OAOG;iBACwC,WAAW,SAAS,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WAQjE,aAAa;EAcrB;AAED,MAAM,MAAM,qBAAqB,CAC/B,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACvC,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAC5B,UAAU,CAAC,OAAO,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAA;AAEtD,MAAM,MAAM,UAAU,CACpB,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACvC,IAAI,EACJ,gBAAgB,SAAS,SAAS,IAChC,CAAC,OAAO,EAAE,qBAAqB,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,gBAAgB,CAAA"}
+{"version":3,"file":"builder.d.ts","sourceRoot":"","sources":["../../src/api/builder.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,aAAa,EAClB,KAAK,SAAS,EACd,KAAK,OAAO,EACZ,KAAK,UAAU,EAChB,MAAM,cAAc,CAAA;AAErB,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAA;AAC1D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AAE3C,OAAO,EACL,kBAAkB,EAGnB,MAAM,WAAW,CAAA;AAClB,YAAY,EAAE,yBAAyB,EAAE,MAAM,SAAS,CAAA;AAExD,wBAAgB,gBAAgB,CAC9B,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjE,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,UAAU,SAAS,eAAe,GAAG,SAAS,GAAG,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IA0B9D;;;;;;;OAOG;gBACuC,CAAC,WAAW,SAAS,OAAO,EACpE,UAAU,EAAE,UAAU,CACpB,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,EACrC,WAAW,EACX,OAAO,EACP,OAAO,EACP,OAAO,kBAAkB,CAC1B,KACE,aAAa;EAErB;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CACvB,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACvC,IAAI,SAAS,cAAc,GAAG,SAAS,GAAG,SAAS,EACnD,UAAU,SAAS,eAAe,GAAG,eAAe,EACpD,QAAQ,EAAE;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,GAAG,CAAC,EAAE,IAAI,CAAC;IAAC,SAAS,CAAC,EAAE,UAAU,CAAA;CAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IA7B/D;;;;;;;OAOG;iBACwC,WAAW,SAAS,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WAQjE,aAAa;EAerB;AAED,MAAM,MAAM,qBAAqB,CAC/B,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACvC,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,UAAU,SAAS,eAAe,GAAG,SAAS,GAAG,eAAe,IAC9D,UAAU,CAAC,OAAO,gBAAgB,CAAC,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAA;AAElE,MAAM,MAAM,UAAU,CACpB,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACvC,IAAI,EACJ,gBAAgB,SAAS,SAAS,IAChC,CAAC,OAAO,EAAE,qBAAqB,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,gBAAgB,CAAA"}

package/dist/api/builder.js.map

@@ -1 +1 @@
-{"version":3,"file":"builder.js","sourceRoot":"","sources":["../../src/api/builder.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,EAAE,GAKH,MAAM,cAAc,CAAA;AAKrB,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,WAAW,CAAA;AAGlB,MAAM,UAAU,gBAAgB;IAI9B,MAAM,IAAI,GAAG,EAAE;SACZ,QAAQ,EAA6B;SACrC,MAAM,CAAC,kBAAkB,CAAC;SAC1B,GAAG,CAAC,oBAAoB,CAAC,CAAA;IAE5B,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE;QACzD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,EAAE,CAAA;QAC1C,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAClB,MAAM,IAAI,gBAAgB,CAAC,cAAc,EAAE,yBAAyB,CAAC,CAAA;QACvE,CAAC;QACD,OAAO,IAAI,CAAC;YACV,OAAO,EAAE;gBACP,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,OAAO,EAAE;oBACP,oBAAoB,EAAE,OAAO,CAAC,oBAAoB;iBACnD;aACF;SACF,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,OAAO;QACL,MAAM,EAAE,IAAI;QACZ,SAAS,EAAE,aAAa;QACxB,OAAO,EAAE,IAAI;QACb;;;;;;;WAOG;QACH,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAQnB;KACnB,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAGvB,QAAyC;IACzC,OAAO,gBAAgB,EAA+B,CAAA;AACxD,CAAC","sourcesContent":["import {\n  os,\n  type AnyMiddleware,\n  type AnyRouter,\n  type Context,\n  type Middleware,\n} from '@orpc/server'\n\nimport type { EnvConfigInput, ValidatedEnv } from '../env'\nimport type { ApiContext } from './context'\n\nimport {\n  BUNDERSTACK_ERRORS,\n  BunderstackError,\n  mapBunderstackErrors,\n} from '../errors'\nexport type { ProtectedContextAdditions } from './types'\n\nexport function createApiBuilder<\n  TSchema extends Record<string, unknown> = Record<string, unknown>,\n  TEnv = Record<string, unknown>,\n>() {\n  const base = os\n    .$context<ApiContext<TSchema, TEnv>>()\n    .errors(BUNDERSTACK_ERRORS)\n    .use(mapBunderstackErrors)\n\n  const protectedProc = base.use(async ({ context, next }) => {\n    const session = await context.getSession()\n    if (!session.user) {\n      throw new BunderstackError('UNAUTHORIZED', 'Authentication required')\n    }\n    return next({\n      context: {\n        user: session.user,\n        session: {\n          activeOrganizationId: session.activeOrganizationId,\n        },\n      },\n    })\n  })\n\n  return {\n    public: base,\n    protected: protectedProc,\n    webhook: base,\n    /**\n     * Declares a standalone middleware over the base context. Use it for\n     * `bunderstack({ middleware })`, which reaches every procedure in\n     * the graph, and for `.use(...)` on any base declared here.\n     *\n     * The annotation is explicit because the inferred `DecoratedMiddleware`\n     * is internal to `@orpc/server` and cannot be named in the emitted types.\n     */\n    middleware: base.middleware.bind(base) as <TOutContext extends Context>(\n      middleware: Middleware<\n        ApiContext<TSchema, TEnv>,\n        TOutContext,\n        unknown,\n        unknown,\n        typeof BUNDERSTACK_ERRORS\n      >,\n    ) => AnyMiddleware,\n  }\n}\n\n/**\n * Same builder as `createApiBuilder`, but the generics come from the values an\n * application already has. It reads nothing at runtime, so a module can call it\n * at import time and export the bases that its router modules import.\n */\nexport function defineApi<\n  TSchema extends Record<string, unknown>,\n  TEnv extends EnvConfigInput | undefined = undefined,\n>(_options: { schema: TSchema; env?: TEnv }) {\n  return createApiBuilder<TSchema, ValidatedEnv<TEnv>>()\n}\n\nexport type BunderstackApiBuilder<\n  TSchema extends Record<string, unknown>,\n  TEnv = Record<string, unknown>,\n> = ReturnType<typeof createApiBuilder<TSchema, TEnv>>\n\nexport type ApiFactory<\n  TSchema extends Record<string, unknown>,\n  TEnv,\n  TCustomApiRouter extends AnyRouter,\n> = (builder: BunderstackApiBuilder<TSchema, TEnv>) => TCustomApiRouter\n"]}
+{"version":3,"file":"builder.js","sourceRoot":"","sources":["../../src/api/builder.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,EAAE,GAKH,MAAM,cAAc,CAAA;AAMrB,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,WAAW,CAAA;AAGlB,MAAM,UAAU,gBAAgB;IAK9B,MAAM,IAAI,GAAG,EAAE;SACZ,QAAQ,EAAyC;SACjD,MAAM,CAAC,kBAAkB,CAAC;SAC1B,GAAG,CAAC,oBAAoB,CAAC,CAAA;IAE5B,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE;QACzD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,EAAE,CAAA;QAC1C,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAClB,MAAM,IAAI,gBAAgB,CAAC,cAAc,EAAE,yBAAyB,CAAC,CAAA;QACvE,CAAC;QACD,OAAO,IAAI,CAAC;YACV,OAAO,EAAE;gBACP,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,OAAO,EAAE;oBACP,oBAAoB,EAAE,OAAO,CAAC,oBAAoB;iBACnD;aACF;SACF,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,OAAO;QACL,MAAM,EAAE,IAAI;QACZ,SAAS,EAAE,aAAa;QACxB,OAAO,EAAE,IAAI;QACb;;;;;;;WAOG;QACH,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAQnB;KACnB,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAIvB,QAAiE;IACjE,OAAO,gBAAgB,EAA2C,CAAA;AACpE,CAAC","sourcesContent":["import {\n  os,\n  type AnyMiddleware,\n  type AnyRouter,\n  type Context,\n  type Middleware,\n} from '@orpc/server'\n\nimport type { EnvConfigInput, ValidatedEnv } from '../env'\nimport type { MessagingConfig } from '../messaging'\nimport type { ApiContext } from './context'\n\nimport {\n  BUNDERSTACK_ERRORS,\n  BunderstackError,\n  mapBunderstackErrors,\n} from '../errors'\nexport type { ProtectedContextAdditions } from './types'\n\nexport function createApiBuilder<\n  TSchema extends Record<string, unknown> = Record<string, unknown>,\n  TEnv = Record<string, unknown>,\n  TMessaging extends MessagingConfig | undefined = MessagingConfig,\n>() {\n  const base = os\n    .$context<ApiContext<TSchema, TEnv, TMessaging>>()\n    .errors(BUNDERSTACK_ERRORS)\n    .use(mapBunderstackErrors)\n\n  const protectedProc = base.use(async ({ context, next }) => {\n    const session = await context.getSession()\n    if (!session.user) {\n      throw new BunderstackError('UNAUTHORIZED', 'Authentication required')\n    }\n    return next({\n      context: {\n        user: session.user,\n        session: {\n          activeOrganizationId: session.activeOrganizationId,\n        },\n      },\n    })\n  })\n\n  return {\n    public: base,\n    protected: protectedProc,\n    webhook: base,\n    /**\n     * Declares a standalone middleware over the base context. Use it for\n     * `bunderstack({ middleware })`, which reaches every procedure in\n     * the graph, and for `.use(...)` on any base declared here.\n     *\n     * The annotation is explicit because the inferred `DecoratedMiddleware`\n     * is internal to `@orpc/server` and cannot be named in the emitted types.\n     */\n    middleware: base.middleware.bind(base) as <TOutContext extends Context>(\n      middleware: Middleware<\n        ApiContext<TSchema, TEnv, TMessaging>,\n        TOutContext,\n        unknown,\n        unknown,\n        typeof BUNDERSTACK_ERRORS\n      >,\n    ) => AnyMiddleware,\n  }\n}\n\n/**\n * Same builder as `createApiBuilder`, but the generics come from the values an\n * application already has. It reads nothing at runtime, so a module can call it\n * at import time and export the bases that its router modules import.\n */\nexport function defineApi<\n  TSchema extends Record<string, unknown>,\n  TEnv extends EnvConfigInput | undefined = undefined,\n  TMessaging extends MessagingConfig = MessagingConfig,\n>(_options: { schema: TSchema; env?: TEnv; messaging?: TMessaging }) {\n  return createApiBuilder<TSchema, ValidatedEnv<TEnv>, TMessaging>()\n}\n\nexport type BunderstackApiBuilder<\n  TSchema extends Record<string, unknown>,\n  TEnv = Record<string, unknown>,\n  TMessaging extends MessagingConfig | undefined = MessagingConfig,\n> = ReturnType<typeof createApiBuilder<TSchema, TEnv, TMessaging>>\n\nexport type ApiFactory<\n  TSchema extends Record<string, unknown>,\n  TEnv,\n  TCustomApiRouter extends AnyRouter,\n> = (builder: BunderstackApiBuilder<TSchema, TEnv>) => TCustomApiRouter\n"]}

package/dist/api/context.d.ts

@@ -1,26 +1,26 @@
 import type { AccessUser, AuthSessionResolver } from '../access.js';
 import type { DbFor } from '../db.js';
-import type { EmailFacade } from '../email.js';
 import type { JobsRuntimeFacade } from '../jobs/define.js';
 import type { BunderstackLogger } from '../logging.js';
+import type { MessagingConfig, MessagingFacadesFor } from '../messaging/index.js';
 import type { RealtimeFacade } from '../realtime/facade.js';
 import type { AuthInstance, StorageFacade } from '../runtime.js';
-export interface ApiContextDeps<TSchema extends Record<string, unknown> = Record<string, unknown>, TEnv = Record<string, unknown>> {
+export interface ApiContextDeps<TSchema extends Record<string, unknown> = Record<string, unknown>, TEnv = Record<string, unknown>, TMessaging extends MessagingConfig | undefined = MessagingConfig> {
     db: DbFor<TSchema>;
     env: TEnv;
     storage: StorageFacade;
-    email: EmailFacade;
+    messaging: MessagingFacadesFor<TMessaging>;
     jobs: JobsRuntimeFacade;
     realtime: RealtimeFacade<TSchema>;
     auth: AuthInstance;
     authResolver?: AuthSessionResolver;
     logger?: BunderstackLogger;
 }
-export interface ApiContext<TSchema extends Record<string, unknown> = Record<string, unknown>, TEnv = Record<string, unknown>> {
+export interface ApiContext<TSchema extends Record<string, unknown> = Record<string, unknown>, TEnv = Record<string, unknown>, TMessaging extends MessagingConfig | undefined = MessagingConfig> {
     db: DbFor<TSchema>;
     env: TEnv;
     storage: StorageFacade;
-    email: EmailFacade;
+    messaging: MessagingFacadesFor<TMessaging>;
     jobs: JobsRuntimeFacade;
     realtime: RealtimeFacade<TSchema>;
     auth: AuthInstance;
@@ -43,5 +43,5 @@ export interface ApiContext<TSchema extends Record<string, unknown> = Record<str
         activeOrganizationId: string | null;
     } | undefined;
 }
-export declare function createApiContext<TSchema extends Record<string, unknown> = Record<string, unknown>, TEnv = Record<string, unknown>>(deps: ApiContextDeps<TSchema, TEnv>, request: Request): ApiContext<TSchema, TEnv>;
+export declare function createApiContext<TSchema extends Record<string, unknown> = Record<string, unknown>, TEnv = Record<string, unknown>, TMessaging extends MessagingConfig | undefined = MessagingConfig>(deps: ApiContextDeps<TSchema, TEnv, TMessaging>, request: Request): ApiContext<TSchema, TEnv, TMessaging>;
 //# sourceMappingURL=context.d.ts.map

package/dist/api/context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../src/api/context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAA;AAChE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,OAAO,CAAA;AAClC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAA;AAC3C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AACvD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACxD,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAK7D,MAAM,WAAW,cAAc,CAC7B,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjE,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAE9B,EAAE,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;IAClB,GAAG,EAAE,IAAI,CAAA;IACT,OAAO,EAAE,aAAa,CAAA;IACtB,KAAK,EAAE,WAAW,CAAA;IAClB,IAAI,EAAE,iBAAiB,CAAA;IACvB,QAAQ,EAAE,cAAc,CAAC,OAAO,CAAC,CAAA;IACjC,IAAI,EAAE,YAAY,CAAA;IAClB,YAAY,CAAC,EAAE,mBAAmB,CAAA;IAClC,MAAM,CAAC,EAAE,iBAAiB,CAAA;CAC3B;AAED,MAAM,WAAW,UAAU,CACzB,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjE,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAE9B,EAAE,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;IAClB,GAAG,EAAE,IAAI,CAAA;IACT,OAAO,EAAE,aAAa,CAAA;IACtB,KAAK,EAAE,WAAW,CAAA;IAClB,IAAI,EAAE,iBAAiB,CAAA;IACvB,QAAQ,EAAE,cAAc,CAAC,OAAO,CAAC,CAAA;IACjC,IAAI,EAAE,YAAY,CAAA;IAClB,MAAM,EAAE,iBAAiB,CAAA;IACzB,OAAO,EAAE,OAAO,CAAA;IAChB,UAAU,EAAE,OAAO,CAAA;IACnB,UAAU,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAA;IACjC,UAAU,EAAE,MAAM,OAAO,CAAC;QACxB,IAAI,EAAE,UAAU,GAAG,IAAI,CAAA;QACvB,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAA;KACpC,CAAC,CAAA;IACF;;;;;OAKG;IACH,WAAW,EAAE,MACT;QAAE,IAAI,EAAE,UAAU,GAAG,IAAI,CAAC;QAAC,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAChE,SAAS,CAAA;CACd;AAED,wBAAgB,gBAAgB,CAC9B,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjE,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAE9B,IAAI,EAAE,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,EACnC,OAAO,EAAE,OAAO,GACf,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,CA8C3B"}
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../src/api/context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAA;AAChE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,OAAO,CAAA;AAClC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AACvD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AACnD,OAAO,KAAK,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;AACxE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACxD,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAK7D,MAAM,WAAW,cAAc,CAC7B,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjE,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,UAAU,SAAS,eAAe,GAAG,SAAS,GAAG,eAAe;IAEhE,EAAE,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;IAClB,GAAG,EAAE,IAAI,CAAA;IACT,OAAO,EAAE,aAAa,CAAA;IACtB,SAAS,EAAE,mBAAmB,CAAC,UAAU,CAAC,CAAA;IAC1C,IAAI,EAAE,iBAAiB,CAAA;IACvB,QAAQ,EAAE,cAAc,CAAC,OAAO,CAAC,CAAA;IACjC,IAAI,EAAE,YAAY,CAAA;IAClB,YAAY,CAAC,EAAE,mBAAmB,CAAA;IAClC,MAAM,CAAC,EAAE,iBAAiB,CAAA;CAC3B;AAED,MAAM,WAAW,UAAU,CACzB,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjE,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,UAAU,SAAS,eAAe,GAAG,SAAS,GAAG,eAAe;IAEhE,EAAE,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;IAClB,GAAG,EAAE,IAAI,CAAA;IACT,OAAO,EAAE,aAAa,CAAA;IACtB,SAAS,EAAE,mBAAmB,CAAC,UAAU,CAAC,CAAA;IAC1C,IAAI,EAAE,iBAAiB,CAAA;IACvB,QAAQ,EAAE,cAAc,CAAC,OAAO,CAAC,CAAA;IACjC,IAAI,EAAE,YAAY,CAAA;IAClB,MAAM,EAAE,iBAAiB,CAAA;IACzB,OAAO,EAAE,OAAO,CAAA;IAChB,UAAU,EAAE,OAAO,CAAA;IACnB,UAAU,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAA;IACjC,UAAU,EAAE,MAAM,OAAO,CAAC;QACxB,IAAI,EAAE,UAAU,GAAG,IAAI,CAAA;QACvB,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAA;KACpC,CAAC,CAAA;IACF;;;;;OAKG;IACH,WAAW,EAAE,MACT;QAAE,IAAI,EAAE,UAAU,GAAG,IAAI,CAAC;QAAC,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAChE,SAAS,CAAA;CACd;AAED,wBAAgB,gBAAgB,CAC9B,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjE,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,UAAU,SAAS,eAAe,GAAG,SAAS,GAAG,eAAe,EAEhE,IAAI,EAAE,cAAc,CAAC,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,EAC/C,OAAO,EAAE,OAAO,GACf,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,CA8CvC"}

package/dist/api/context.js

@@ -25,7 +25,7 @@ export function createApiContext(deps, request) {
         db: deps.db,
         env: deps.env,
         storage: deps.storage,
-        email: deps.email,
+        messaging: deps.messaging,
         jobs: deps.jobs,
         realtime: deps.realtime,
         auth: deps.auth,

package/dist/api/context.js.map

@@ -1 +1 @@
-{"version":3,"file":"context.js","sourceRoot":"","sources":["../../src/api/context.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AA+C1C,MAAM,UAAU,gBAAgB,CAI9B,IAAmC,EACnC,OAAgB;IAEhB,uEAAuE;IACvE,MAAM,cAAc,GAAG,OAAO,CAAC,KAAK,EAAE,CAAA;IACtC,IAAI,cAA2C,CAAA;IAC/C,IAAI,cAES,CAAA;IAEb,IAAI,cAES,CAAA;IAEb,MAAM,UAAU,GAAG,GAAG,EAAE;QACtB,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,cAAc,GAAG,cAAc,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CACtE,CAAC,OAAO,EAAE,EAAE;gBACV,cAAc,GAAG,OAAO,CAAA;gBACxB,OAAO,OAAO,CAAA;YAChB,CAAC,CACF,CAAA;QACH,CAAC;QACD,OAAO,cAAc,CAAA;IACvB,CAAC,CAAA;IAED,MAAM,WAAW,GAAG,GAAG,EAAE,CAAC,cAAc,CAAA;IAExC,MAAM,UAAU,GAAG,GAAG,EAAE;QACtB,IAAI,CAAC,cAAc;YAAE,cAAc,GAAG,cAAc,CAAC,IAAI,EAAE,CAAA;QAC3D,OAAO,cAAc,CAAA;IACvB,CAAC,CAAA;IAED,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,aAAa;QACpC,OAAO;QACP,UAAU,EAAE,IAAI,OAAO,EAAE;QACzB,UAAU;QACV,UAAU;QACV,WAAW;KACZ,CAAA;AACH,CAAC","sourcesContent":["import type { AccessUser, AuthSessionResolver } from '../access'\nimport type { DbFor } from '../db'\nimport type { EmailFacade } from '../email'\nimport type { JobsRuntimeFacade } from '../jobs/define'\nimport type { BunderstackLogger } from '../logging'\nimport type { RealtimeFacade } from '../realtime/facade'\nimport type { AuthInstance, StorageFacade } from '../runtime'\n\nimport { resolveSession } from '../access'\nimport { consoleLogger } from '../logging'\n\nexport interface ApiContextDeps<\n  TSchema extends Record<string, unknown> = Record<string, unknown>,\n  TEnv = Record<string, unknown>,\n> {\n  db: DbFor<TSchema>\n  env: TEnv\n  storage: StorageFacade\n  email: EmailFacade\n  jobs: JobsRuntimeFacade\n  realtime: RealtimeFacade<TSchema>\n  auth: AuthInstance\n  authResolver?: AuthSessionResolver\n  logger?: BunderstackLogger\n}\n\nexport interface ApiContext<\n  TSchema extends Record<string, unknown> = Record<string, unknown>,\n  TEnv = Record<string, unknown>,\n> {\n  db: DbFor<TSchema>\n  env: TEnv\n  storage: StorageFacade\n  email: EmailFacade\n  jobs: JobsRuntimeFacade\n  realtime: RealtimeFacade<TSchema>\n  auth: AuthInstance\n  logger: BunderstackLogger\n  request: Request\n  resHeaders: Headers\n  getRawBody: () => Promise<string>\n  getSession: () => Promise<{\n    user: AccessUser | null\n    activeOrganizationId: string | null\n  }>\n  /**\n   * The session that some earlier code already resolved, or `undefined`.\n   * Never starts a resolution, so a global middleware can log the caller\n   * without removing the lazy session behavior that signed webhooks rely on.\n   * Use it for observability only. Never use it for authorization.\n   */\n  peekSession: () =>\n    | { user: AccessUser | null; activeOrganizationId: string | null }\n    | undefined\n}\n\nexport function createApiContext<\n  TSchema extends Record<string, unknown> = Record<string, unknown>,\n  TEnv = Record<string, unknown>,\n>(\n  deps: ApiContextDeps<TSchema, TEnv>,\n  request: Request,\n): ApiContext<TSchema, TEnv> {\n  // Reserve the body stream before a transport codec consumes `request`.\n  const rawBodyRequest = request.clone()\n  let rawBodyPromise: Promise<string> | undefined\n  let sessionPromise:\n    | Promise<{ user: AccessUser | null; activeOrganizationId: string | null }>\n    | undefined\n\n  let settledSession:\n    | { user: AccessUser | null; activeOrganizationId: string | null }\n    | undefined\n\n  const getSession = () => {\n    if (!sessionPromise) {\n      sessionPromise = resolveSession(deps.authResolver, request.headers).then(\n        (session) => {\n          settledSession = session\n          return session\n        },\n      )\n    }\n    return sessionPromise\n  }\n\n  const peekSession = () => settledSession\n\n  const getRawBody = () => {\n    if (!rawBodyPromise) rawBodyPromise = rawBodyRequest.text()\n    return rawBodyPromise\n  }\n\n  return {\n    db: deps.db,\n    env: deps.env,\n    storage: deps.storage,\n    email: deps.email,\n    jobs: deps.jobs,\n    realtime: deps.realtime,\n    auth: deps.auth,\n    logger: deps.logger ?? consoleLogger,\n    request,\n    resHeaders: new Headers(),\n    getRawBody,\n    getSession,\n    peekSession,\n  }\n}\n"]}
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../../src/api/context.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAiD1C,MAAM,UAAU,gBAAgB,CAK9B,IAA+C,EAC/C,OAAgB;IAEhB,uEAAuE;IACvE,MAAM,cAAc,GAAG,OAAO,CAAC,KAAK,EAAE,CAAA;IACtC,IAAI,cAA2C,CAAA;IAC/C,IAAI,cAES,CAAA;IAEb,IAAI,cAES,CAAA;IAEb,MAAM,UAAU,GAAG,GAAG,EAAE;QACtB,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,cAAc,GAAG,cAAc,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CACtE,CAAC,OAAO,EAAE,EAAE;gBACV,cAAc,GAAG,OAAO,CAAA;gBACxB,OAAO,OAAO,CAAA;YAChB,CAAC,CACF,CAAA;QACH,CAAC;QACD,OAAO,cAAc,CAAA;IACvB,CAAC,CAAA;IAED,MAAM,WAAW,GAAG,GAAG,EAAE,CAAC,cAAc,CAAA;IAExC,MAAM,UAAU,GAAG,GAAG,EAAE;QACtB,IAAI,CAAC,cAAc;YAAE,cAAc,GAAG,cAAc,CAAC,IAAI,EAAE,CAAA;QAC3D,OAAO,cAAc,CAAA;IACvB,CAAC,CAAA;IAED,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,aAAa;QACpC,OAAO;QACP,UAAU,EAAE,IAAI,OAAO,EAAE;QACzB,UAAU;QACV,UAAU;QACV,WAAW;KACZ,CAAA;AACH,CAAC","sourcesContent":["import type { AccessUser, AuthSessionResolver } from '../access'\nimport type { DbFor } from '../db'\nimport type { JobsRuntimeFacade } from '../jobs/define'\nimport type { BunderstackLogger } from '../logging'\nimport type { MessagingConfig, MessagingFacadesFor } from '../messaging'\nimport type { RealtimeFacade } from '../realtime/facade'\nimport type { AuthInstance, StorageFacade } from '../runtime'\n\nimport { resolveSession } from '../access'\nimport { consoleLogger } from '../logging'\n\nexport interface ApiContextDeps<\n  TSchema extends Record<string, unknown> = Record<string, unknown>,\n  TEnv = Record<string, unknown>,\n  TMessaging extends MessagingConfig | undefined = MessagingConfig,\n> {\n  db: DbFor<TSchema>\n  env: TEnv\n  storage: StorageFacade\n  messaging: MessagingFacadesFor<TMessaging>\n  jobs: JobsRuntimeFacade\n  realtime: RealtimeFacade<TSchema>\n  auth: AuthInstance\n  authResolver?: AuthSessionResolver\n  logger?: BunderstackLogger\n}\n\nexport interface ApiContext<\n  TSchema extends Record<string, unknown> = Record<string, unknown>,\n  TEnv = Record<string, unknown>,\n  TMessaging extends MessagingConfig | undefined = MessagingConfig,\n> {\n  db: DbFor<TSchema>\n  env: TEnv\n  storage: StorageFacade\n  messaging: MessagingFacadesFor<TMessaging>\n  jobs: JobsRuntimeFacade\n  realtime: RealtimeFacade<TSchema>\n  auth: AuthInstance\n  logger: BunderstackLogger\n  request: Request\n  resHeaders: Headers\n  getRawBody: () => Promise<string>\n  getSession: () => Promise<{\n    user: AccessUser | null\n    activeOrganizationId: string | null\n  }>\n  /**\n   * The session that some earlier code already resolved, or `undefined`.\n   * Never starts a resolution, so a global middleware can log the caller\n   * without removing the lazy session behavior that signed webhooks rely on.\n   * Use it for observability only. Never use it for authorization.\n   */\n  peekSession: () =>\n    | { user: AccessUser | null; activeOrganizationId: string | null }\n    | undefined\n}\n\nexport function createApiContext<\n  TSchema extends Record<string, unknown> = Record<string, unknown>,\n  TEnv = Record<string, unknown>,\n  TMessaging extends MessagingConfig | undefined = MessagingConfig,\n>(\n  deps: ApiContextDeps<TSchema, TEnv, TMessaging>,\n  request: Request,\n): ApiContext<TSchema, TEnv, TMessaging> {\n  // Reserve the body stream before a transport codec consumes `request`.\n  const rawBodyRequest = request.clone()\n  let rawBodyPromise: Promise<string> | undefined\n  let sessionPromise:\n    | Promise<{ user: AccessUser | null; activeOrganizationId: string | null }>\n    | undefined\n\n  let settledSession:\n    | { user: AccessUser | null; activeOrganizationId: string | null }\n    | undefined\n\n  const getSession = () => {\n    if (!sessionPromise) {\n      sessionPromise = resolveSession(deps.authResolver, request.headers).then(\n        (session) => {\n          settledSession = session\n          return session\n        },\n      )\n    }\n    return sessionPromise\n  }\n\n  const peekSession = () => settledSession\n\n  const getRawBody = () => {\n    if (!rawBodyPromise) rawBodyPromise = rawBodyRequest.text()\n    return rawBodyPromise\n  }\n\n  return {\n    db: deps.db,\n    env: deps.env,\n    storage: deps.storage,\n    messaging: deps.messaging,\n    jobs: deps.jobs,\n    realtime: deps.realtime,\n    auth: deps.auth,\n    logger: deps.logger ?? consoleLogger,\n    request,\n    resHeaders: new Headers(),\n    getRawBody,\n    getSession,\n    peekSession,\n  }\n}\n"]}

package/dist/api/crud-router.d.ts

@@ -61,7 +61,7 @@ export type BuildTableCrudProceduresArgs<TSchema extends Record<string, unknown>
     livePublisher?: RealtimePublisher;
 };
 export declare function buildTableCrudProcedures<TSchema extends Record<string, unknown>, TTable extends Table, TFilterable extends string = string, TSortable extends string = string>(args: BuildTableCrudProceduresArgs<TSchema, TTable>): {
-    list: import("@orpc/server").DecoratedProcedure<import("./context.js").ApiContext<TSchema, Record<string, unknown>> & object, object, v.GenericSchema<ListInputFor<TTable, TFilterable, TSortable>, ListInputFor<TTable, TFilterable, TSortable>>, v.StrictObjectSchema<{
+    list: import("@orpc/server").DecoratedProcedure<import("./context.js").ApiContext<TSchema, Record<string, unknown>, import("..").MessagingConfig> & object, object, v.GenericSchema<ListInputFor<TTable, TFilterable, TSortable>, ListInputFor<TTable, TFilterable, TSortable>>, v.StrictObjectSchema<{
         readonly items: v.ArraySchema<v.GenericSchema<TTable["$inferSelect"], TTable["$inferSelect"]>, undefined>;
         readonly nextCursor: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
         readonly hasMore: v.BooleanSchema<undefined>;
@@ -130,7 +130,7 @@ export declare function buildTableCrudProcedures<TSchema extends Record<string,
             }>;
         };
     }, never>;
-    get: import("@orpc/server").DecoratedProcedure<import("./context.js").ApiContext<TSchema, Record<string, unknown>> & object, object, v.StrictObjectSchema<{
+    get: import("@orpc/server").DecoratedProcedure<import("./context.js").ApiContext<TSchema, Record<string, unknown>, import("..").MessagingConfig> & object, object, v.StrictObjectSchema<{
         readonly id: v.StringSchema<undefined>;
     }, undefined>, v.GenericSchema<TTable["$inferSelect"], TTable["$inferSelect"]>, {
         readonly BAD_REQUEST: {
@@ -190,7 +190,7 @@ export declare function buildTableCrudProcedures<TSchema extends Record<string,
             }>;
         };
     }, Extract<TTable["$inferSelect"], import("@orpc/client").AnyORPCError>>;
-    create: import("@orpc/server").DecoratedProcedure<import("./context.js").ApiContext<TSchema, Record<string, unknown>> & object, object, v.GenericSchema<Partial<TTable["$inferInsert"]>, Partial<TTable["$inferInsert"]>>, v.GenericSchema<TTable["$inferSelect"], TTable["$inferSelect"]>, {
+    create: import("@orpc/server").DecoratedProcedure<import("./context.js").ApiContext<TSchema, Record<string, unknown>, import("..").MessagingConfig> & object, object, v.GenericSchema<Partial<TTable["$inferInsert"]>, Partial<TTable["$inferInsert"]>>, v.GenericSchema<TTable["$inferSelect"], TTable["$inferSelect"]>, {
         readonly BAD_REQUEST: {
             readonly data: v.OptionalSchema<v.StrictObjectSchema<{
                 readonly code: v.OptionalSchema<v.LiteralSchema<"BAD_REQUEST", undefined>, "BAD_REQUEST">;
@@ -248,7 +248,7 @@ export declare function buildTableCrudProcedures<TSchema extends Record<string,
             }>;
         };
     }, Extract<TTable["$inferSelect"], import("@orpc/client").AnyORPCError>>;
-    update: import("@orpc/server").DecoratedProcedure<import("./context.js").ApiContext<TSchema, Record<string, unknown>> & object, object, v.GenericSchema<{
+    update: import("@orpc/server").DecoratedProcedure<import("./context.js").ApiContext<TSchema, Record<string, unknown>, import("..").MessagingConfig> & object, object, v.GenericSchema<{
         id: string;
     } & Partial<Omit<TTable["$inferInsert"], "id">>, {
         id: string;
@@ -310,7 +310,7 @@ export declare function buildTableCrudProcedures<TSchema extends Record<string,
             }>;
         };
     }, Extract<TTable["$inferSelect"], import("@orpc/client").AnyORPCError>>;
-    delete: import("@orpc/server").DecoratedProcedure<import("./context.js").ApiContext<TSchema, Record<string, unknown>> & object, object, v.StrictObjectSchema<{
+    delete: import("@orpc/server").DecoratedProcedure<import("./context.js").ApiContext<TSchema, Record<string, unknown>, import("..").MessagingConfig> & object, object, v.StrictObjectSchema<{
         readonly id: v.StringSchema<undefined>;
     }, undefined>, v.UndefinedSchema<undefined>, {
         readonly BAD_REQUEST: {
@@ -370,7 +370,7 @@ export declare function buildTableCrudProcedures<TSchema extends Record<string,
             }>;
         };
     }, never>;
-    live: import("@orpc/server").DecoratedProcedure<import("./context.js").ApiContext<TSchema, Record<string, unknown>> & object, object, v.GenericSchema<LiveInputFor<TTable, TFilterable, TSortable>, LiveInputFor<TTable, TFilterable, TSortable>>, import("@orpc/contract").Schema<AsyncIteratorObject<{
+    live: import("@orpc/server").DecoratedProcedure<import("./context.js").ApiContext<TSchema, Record<string, unknown>, import("..").MessagingConfig> & object, object, v.GenericSchema<LiveInputFor<TTable, TFilterable, TSortable>, LiveInputFor<TTable, TFilterable, TSortable>>, import("@orpc/contract").Schema<AsyncIteratorObject<{
         type: "snapshot";
         items: TTable["$inferSelect"][];
         sort: string;

package/dist/api/realtime-router.d.ts

@@ -7,7 +7,7 @@ type RealtimeRouterOptions = {
 };
 export declare function buildRealtimeApiRouter(publisher: RealtimePublisher | undefined, access: ResolvedAccess, options?: RealtimeRouterOptions): {
     realtime: {
-        changes: import("@orpc/server").DecoratedProcedure<import("./context.js").ApiContext<Record<string, unknown>, Record<string, unknown>> & object, object, v.StrictObjectSchema<{
+        changes: import("@orpc/server").DecoratedProcedure<import("./context.js").ApiContext<Record<string, unknown>, Record<string, unknown>, import("..").MessagingConfig> & object, object, v.StrictObjectSchema<{
             readonly tables: v.SchemaWithPipe<readonly [v.UnionSchema<[v.StringSchema<undefined>, v.ArraySchema<v.StringSchema<undefined>, undefined>], undefined>, v.TransformAction<string | string[], string[]>]>;
         }, undefined>, import("@orpc/contract").Schema<AsyncIteratorObject<{
             table: string;

package/dist/api/storage-router.d.ts

@@ -6,7 +6,7 @@ import type { ApiContext } from './context.js';
 export declare function buildStorageApiRouter(registry: BucketStorageRegistry, operations: StorageOperations): {
     files: {
         [k: string]: {
-            prepareUpload: import("@orpc/server").DecoratedProcedure<ApiContext<Record<string, unknown>, Record<string, unknown>> & object, object, v.StrictObjectSchema<{
+            prepareUpload: import("@orpc/server").DecoratedProcedure<ApiContext<Record<string, unknown>, Record<string, unknown>, import("..").MessagingConfig> & object, object, v.StrictObjectSchema<{
                 readonly filename: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
                 readonly contentType: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
             }, undefined>, v.VariantSchema<"mode", [v.StrictObjectSchema<{
@@ -76,7 +76,7 @@ export declare function buildStorageApiRouter(registry: BucketStorageRegistry, o
                     }>;
                 };
             }, never>;
-            upload: import("@orpc/server").DecoratedProcedure<ApiContext<Record<string, unknown>, Record<string, unknown>> & object, object, v.StrictObjectSchema<{
+            upload: import("@orpc/server").DecoratedProcedure<ApiContext<Record<string, unknown>, Record<string, unknown>, import("..").MessagingConfig> & object, object, v.StrictObjectSchema<{
                 readonly params: v.OptionalSchema<v.StrictObjectSchema<{}, undefined>, {}>;
                 readonly query: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.UnknownSchema, undefined>, {}>;
                 readonly headers: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.UnknownSchema, undefined>, {}>;
@@ -147,7 +147,7 @@ export declare function buildStorageApiRouter(registry: BucketStorageRegistry, o
                     }>;
                 };
             }, never>;
-            confirmUpload: import("@orpc/server").DecoratedProcedure<ApiContext<Record<string, unknown>, Record<string, unknown>> & object, object, v.StrictObjectSchema<{
+            confirmUpload: import("@orpc/server").DecoratedProcedure<ApiContext<Record<string, unknown>, Record<string, unknown>, import("..").MessagingConfig> & object, object, v.StrictObjectSchema<{
                 readonly id: v.StringSchema<undefined>;
             }, undefined>, v.StrictObjectSchema<{
                 readonly fileId: v.StringSchema<undefined>;
@@ -210,7 +210,7 @@ export declare function buildStorageApiRouter(registry: BucketStorageRegistry, o
                     }>;
                 };
             }, never>;
-            download: import("@orpc/server").DecoratedProcedure<ApiContext<Record<string, unknown>, Record<string, unknown>> & object, object, v.StrictObjectSchema<{
+            download: import("@orpc/server").DecoratedProcedure<ApiContext<Record<string, unknown>, Record<string, unknown>, import("..").MessagingConfig> & object, object, v.StrictObjectSchema<{
                 readonly params: v.StrictObjectSchema<{
                     readonly path: v.StringSchema<undefined>;
                 }, undefined>;
@@ -283,7 +283,7 @@ export declare function buildStorageApiRouter(registry: BucketStorageRegistry, o
                     }>;
                 };
             }, never>;
-            delete: import("@orpc/server").DecoratedProcedure<ApiContext<Record<string, unknown>, Record<string, unknown>> & object, object, v.StrictObjectSchema<{
+            delete: import("@orpc/server").DecoratedProcedure<ApiContext<Record<string, unknown>, Record<string, unknown>, import("..").MessagingConfig> & object, object, v.StrictObjectSchema<{
                 readonly path: v.StringSchema<undefined>;
             }, undefined>, v.UndefinedSchema<undefined>, {
                 readonly BAD_REQUEST: {

package/dist/auth.d.ts

@@ -1,17 +1,27 @@
-import { type Auth } from 'better-auth';
+import { type Auth, type BetterAuthPlugin } from 'better-auth';
+import { openAPI } from 'better-auth/plugins';
 import type { AuthSessionResolver } from './access.js';
 import type { BetterAuthConfig } from './config.js';
 import type { AnyDb, Dialect } from './dialect.js';
 import type { EmailFacade } from './email.js';
+type ConfiguredAuthPlugins<TConfig extends BetterAuthConfig> = TConfig extends {
+    plugins: infer TPlugins extends readonly BetterAuthPlugin[];
+} ? TPlugins : [];
+type WithBunderstackAuthDefaults<TConfig extends BetterAuthConfig> = Omit<BetterAuthConfig, 'plugins'> & Omit<TConfig, 'plugins'> & {
+    plugins: [...ConfiguredAuthPlugins<TConfig>, ReturnType<typeof openAPI>];
+};
 /**
- * Returns better-auth's plain `Auth`, not the plugin-parameterised type its
- * builder infers: declaration emit would otherwise inline that whole inferred
- * options object into the published `.d.ts`, where it no longer satisfies
- * better-auth's own `BetterAuthOptions` constraint. Plugin-specific endpoints
- * are reached through runtime checks (see the OpenAPI schema lookup in
- * `index.ts`), so nothing depends on the wider type.
+ * The public Better Auth instance retains every endpoint and model field from
+ * the declared config. Bunderstack always installs OpenAPI at runtime, so its
+ * endpoints are part of the public type even when the app omitted the plugin.
  */
-export declare function createAuth(db: AnyDb, cfg: BetterAuthConfig, dialect: Dialect, userSchema?: Record<string, unknown>): Auth;
+export type BunderstackAuth<TConfig extends BetterAuthConfig = BetterAuthConfig> = Auth<WithBunderstackAuthDefaults<TConfig>> & Auth;
+/**
+ * Build Better Auth while exposing its named plugin-aware public type. The
+ * implementation accepts the resolved runtime config, while `TConfig` carries
+ * the declaration that produced it; their relationship is asserted once here.
+ */
+export declare function createAuth<TConfig extends BetterAuthConfig = BetterAuthConfig>(db: AnyDb, cfg: BetterAuthConfig, dialect: Dialect, userSchema?: Record<string, unknown>): BunderstackAuth<TConfig>;
 /**
  * better-auth resolves its models out of the app's own schema, so an app that
  * declares none has no auth at all. Session resolution must then short-circuit
@@ -28,7 +38,7 @@ export declare function missingAuthModels(schema: Record<string, unknown>, cfg:
  * Keeping this adapter here means internal modules never depend on better-auth's
  * evolving types.
  */
-export declare function toAuthSessionResolver(auth: ReturnType<typeof createAuth>): AuthSessionResolver;
+export declare function toAuthSessionResolver(auth: Auth): AuthSessionResolver;
 /**
  * Fill better-auth's email hooks from the bunderstack email facade. Only fills
  * gaps: user-supplied handlers always win, and nothing is injected when email
@@ -36,4 +46,5 @@ export declare function toAuthSessionResolver(auth: ReturnType<typeof createAuth
  * (injecting it unasked would enable the feature).
  */
 export declare function withEmailAuthDefaults(cfg: BetterAuthConfig, email: EmailFacade, emailConfigured: boolean): BetterAuthConfig;
+export {};
 //# sourceMappingURL=auth.d.ts.map

package/dist/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AACA,OAAO,EAAc,KAAK,IAAI,EAAE,MAAM,aAAa,CAAA;AAInD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAA;AACnD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAA;AAChD,OAAO,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAC/C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAA;AAE1C;;;;;;;GAOG;AACH,wBAAgB,UAAU,CACxB,EAAE,EAAE,KAAK,EACT,GAAG,EAAE,gBAAgB,EACrB,OAAO,EAAE,OAAO,EAChB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACnC,IAAI,CAcN;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,GAAG,EAAE,gBAAgB,GACpB,MAAM,EAAE,CAMV;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,UAAU,CAAC,OAAO,UAAU,CAAC,GAClC,mBAAmB,CA+BrB;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,gBAAgB,EACrB,KAAK,EAAE,WAAW,EAClB,eAAe,EAAE,OAAO,GACvB,gBAAgB,CAkClB"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AACA,OAAO,EAAc,KAAK,IAAI,EAAE,KAAK,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAE1E,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAE7C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAA;AACnD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAA;AAChD,OAAO,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAC/C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAA;AAE1C,KAAK,qBAAqB,CAAC,OAAO,SAAS,gBAAgB,IAAI,OAAO,SAAS;IAC7E,OAAO,EAAE,MAAM,QAAQ,SAAS,SAAS,gBAAgB,EAAE,CAAA;CAC5D,GACG,QAAQ,GACR,EAAE,CAAA;AAEN,KAAK,2BAA2B,CAAC,OAAO,SAAS,gBAAgB,IAAI,IAAI,CACvE,gBAAgB,EAChB,SAAS,CACV,GACC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,GAAG;IACzB,OAAO,EAAE,CAAC,GAAG,qBAAqB,CAAC,OAAO,CAAC,EAAE,UAAU,CAAC,OAAO,OAAO,CAAC,CAAC,CAAA;CACzE,CAAA;AAEH;;;;GAIG;AACH,MAAM,MAAM,eAAe,CACzB,OAAO,SAAS,gBAAgB,GAAG,gBAAgB,IACjD,IAAI,CAAC,2BAA2B,CAAC,OAAO,CAAC,CAAC,GAAG,IAAI,CAAA;AAErD;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,OAAO,SAAS,gBAAgB,GAAG,gBAAgB,EAC5E,EAAE,EAAE,KAAK,EACT,GAAG,EAAE,gBAAgB,EACrB,OAAO,EAAE,OAAO,EAChB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACnC,eAAe,CAAC,OAAO,CAAC,CAY1B;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,GAAG,EAAE,gBAAgB,GACpB,MAAM,EAAE,CAMV;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,IAAI,GAAG,mBAAmB,CA+BrE;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,gBAAgB,EACrB,KAAK,EAAE,WAAW,EAClB,eAAe,EAAE,OAAO,GACvB,gBAAgB,CAkClB"}

package/dist/auth.js

@@ -3,18 +3,13 @@ import { betterAuth } from 'better-auth';
 import { drizzleAdapter } from 'better-auth/adapters/drizzle';
 import { openAPI } from 'better-auth/plugins';
 /**
- * Returns better-auth's plain `Auth`, not the plugin-parameterised type its
- * builder infers: declaration emit would otherwise inline that whole inferred
- * options object into the published `.d.ts`, where it no longer satisfies
- * better-auth's own `BetterAuthOptions` constraint. Plugin-specific endpoints
- * are reached through runtime checks (see the OpenAPI schema lookup in
- * `index.ts`), so nothing depends on the wider type.
+ * Build Better Auth while exposing its named plugin-aware public type. The
+ * implementation accepts the resolved runtime config, while `TConfig` carries
+ * the declaration that produced it; their relationship is asserted once here.
  */
 export function createAuth(db, cfg, dialect, userSchema) {
     const hasOpenApi = cfg.plugins?.some((p) => p.id === 'open-api');
     const plugins = hasOpenApi ? cfg.plugins : [...(cfg.plugins || []), openAPI()];
-    // Type-only narrowing: the value is unchanged, but the published signature
-    // stays a type better-auth itself can name.
     return betterAuth({
         ...cfg,
         plugins,

package/dist/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,cAAc;AACd,OAAO,EAAE,UAAU,EAAa,MAAM,aAAa,CAAA;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAC7D,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAO7C;;;;;;;GAOG;AACH,MAAM,UAAU,UAAU,CACxB,EAAS,EACT,GAAqB,EACrB,OAAgB,EAChB,UAAoC;IAEpC,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,UAAU,CAAC,CAAA;IACrE,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,CAAA;IAE9E,2EAA2E;IAC3E,4CAA4C;IAC5C,OAAO,UAAU,CAAC;QAChB,GAAG,GAAG;QACN,OAAO;QACP,QAAQ,EAAE,cAAc,CAAC,EAA0C,EAAE;YACnE,QAAQ,EAAE,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ;YAC5C,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9C,CAAC;KACH,CAAoB,CAAA;AACvB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAC/B,MAA+B,EAC/B,GAAqB;IAErB,MAAM,MAAM,GAAG;QACb,GAAG,CAAC,IAAI,EAAE,SAAS,IAAI,MAAM;QAC7B,GAAG,CAAC,OAAO,EAAE,SAAS,IAAI,SAAS;KACpC,CAAA;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;AACjD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CACnC,IAAmC;IAEnC,OAAO;QACL,GAAG,EAAE;YACH,KAAK,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE;gBAC1B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,CAAA;gBACrD,IAAI,MAAM,IAAI,MAAM,IAAI,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;oBAC9C,MAAM,OAAO,GAAG,SAAS,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAA;oBAC3D,MAAM,oBAAoB,GACxB,OAAO;wBACP,sBAAsB,IAAI,OAAO;wBACjC,OAAO,OAAO,CAAC,oBAAoB,KAAK,QAAQ;wBAC9C,CAAC,CAAC,OAAO,CAAC,oBAAoB;wBAC9B,CAAC,CAAC,IAAI,CAAA;oBACV,MAAM,IAAI,GACR,MAAM,IAAI,MAAM,CAAC,IAAI,IAAI,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ;wBAC3D,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI;wBAClB,CAAC,CAAC,SAAS,CAAA;oBACf,OAAO;wBACL,IAAI,EAAE;4BACJ,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE;4BAClB,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK;4BACxB,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI;4BACtB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;yBAC1B;wBACD,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC,IAAI;qBACnD,CAAA;gBACH,CAAC;gBACD,OAAO,IAAI,CAAA;YACb,CAAC;SACF;KACF,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CACnC,GAAqB,EACrB,KAAkB,EAClB,eAAwB;IAExB,IAAI,CAAC,eAAe;QAAE,OAAO,GAAG,CAAA;IAChC,MAAM,GAAG,GAAqB,EAAE,GAAG,GAAG,EAAE,CAAA;IAExC,IACE,GAAG,CAAC,gBAAgB,EAAE,OAAO;QAC7B,CAAC,GAAG,CAAC,gBAAgB,CAAC,iBAAiB,EACvC,CAAC;QACD,GAAG,CAAC,gBAAgB,GAAG;YACrB,GAAG,GAAG,CAAC,gBAAgB;YACvB,iBAAiB,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE;gBACzC,MAAM,KAAK,CAAC,IAAI,CAAC;oBACf,EAAE,EAAE,IAAI,CAAC,KAAK;oBACd,OAAO,EAAE,qBAAqB;oBAC9B,IAAI,EAAE,6CAA6C,GAAG,4DAA4D;iBACnH,CAAC,CAAA;YACJ,CAAC;SACF,CAAA;IACH,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,iBAAiB,EAAE,qBAAqB,EAAE,CAAC;QAClD,GAAG,CAAC,iBAAiB,GAAG;YACtB,GAAG,GAAG,CAAC,iBAAiB;YACxB,qBAAqB,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE;gBAC7C,MAAM,KAAK,CAAC,IAAI,CAAC;oBACf,EAAE,EAAE,IAAI,CAAC,KAAK;oBACd,OAAO,EAAE,mBAAmB;oBAC5B,IAAI,EAAE,mDAAmD,GAAG,EAAE;iBAC/D,CAAC,CAAA;YACJ,CAAC;SACF,CAAA;IACH,CAAC;IAED,OAAO,GAAG,CAAA;AACZ,CAAC","sourcesContent":["// src/auth.ts\nimport { betterAuth, type Auth } from 'better-auth'\nimport { drizzleAdapter } from 'better-auth/adapters/drizzle'\nimport { openAPI } from 'better-auth/plugins'\n\nimport type { AuthSessionResolver } from './access'\nimport type { BetterAuthConfig } from './config'\nimport type { AnyDb, Dialect } from './dialect'\nimport type { EmailFacade } from './email'\n\n/**\n * Returns better-auth's plain `Auth`, not the plugin-parameterised type its\n * builder infers: declaration emit would otherwise inline that whole inferred\n * options object into the published `.d.ts`, where it no longer satisfies\n * better-auth's own `BetterAuthOptions` constraint. Plugin-specific endpoints\n * are reached through runtime checks (see the OpenAPI schema lookup in\n * `index.ts`), so nothing depends on the wider type.\n */\nexport function createAuth(\n  db: AnyDb,\n  cfg: BetterAuthConfig,\n  dialect: Dialect,\n  userSchema?: Record<string, unknown>,\n): Auth {\n  const hasOpenApi = cfg.plugins?.some((p: any) => p.id === 'open-api')\n  const plugins = hasOpenApi ? cfg.plugins : [...(cfg.plugins || []), openAPI()]\n\n  // Type-only narrowing: the value is unchanged, but the published signature\n  // stays a type better-auth itself can name.\n  return betterAuth({\n    ...cfg,\n    plugins,\n    database: drizzleAdapter(db as Parameters<typeof drizzleAdapter>[0], {\n      provider: dialect === 'pg' ? 'pg' : 'sqlite',\n      ...(userSchema ? { schema: userSchema } : {}),\n    }),\n  }) as unknown as Auth\n}\n\n/**\n * better-auth resolves its models out of the app's own schema, so an app that\n * declares none has no auth at all. Session resolution must then short-circuit\n * to null: the drizzle adapter throws on a missing model, and any session\n * cookie for the host — a browser keeps those per host, not per port, so one\n * minted by another local app arrives here too — would break every request.\n */\nexport function missingAuthModels(\n  schema: Record<string, unknown>,\n  cfg: BetterAuthConfig,\n): string[] {\n  const models = [\n    cfg.user?.modelName ?? 'user',\n    cfg.session?.modelName ?? 'session',\n  ]\n  return models.filter((model) => !schema[model])\n}\n\n/**\n * Adapt the raw better-auth instance to our internal {@link AuthSessionResolver}\n * contract. better-auth's `getSession` has a union return (a bare session, or a\n * `{ headers, response }` wrapper when `returnHeaders` is set); we only ever\n * call the bare form, so we narrow on `'user' in result` and map to our shape.\n * Keeping this adapter here means internal modules never depend on better-auth's\n * evolving types.\n */\nexport function toAuthSessionResolver(\n  auth: ReturnType<typeof createAuth>,\n): AuthSessionResolver {\n  return {\n    api: {\n      async getSession({ headers }) {\n        const result = await auth.api.getSession({ headers })\n        if (result && 'user' in result && result.user) {\n          const session = 'session' in result ? result.session : null\n          const activeOrganizationId =\n            session &&\n            'activeOrganizationId' in session &&\n            typeof session.activeOrganizationId === 'string'\n              ? session.activeOrganizationId\n              : null\n          const role =\n            'role' in result.user && typeof result.user.role === 'string'\n              ? result.user.role\n              : undefined\n          return {\n            user: {\n              id: result.user.id,\n              email: result.user.email,\n              name: result.user.name,\n              ...(role ? { role } : {}),\n            },\n            session: session ? { activeOrganizationId } : null,\n          }\n        }\n        return null\n      },\n    },\n  }\n}\n\n/**\n * Fill better-auth's email hooks from the bunderstack email facade. Only fills\n * gaps: user-supplied handlers always win, and nothing is injected when email\n * isn't configured. emailAndPassword is only touched when the user enabled it\n * (injecting it unasked would enable the feature).\n */\nexport function withEmailAuthDefaults(\n  cfg: BetterAuthConfig,\n  email: EmailFacade,\n  emailConfigured: boolean,\n): BetterAuthConfig {\n  if (!emailConfigured) return cfg\n  const out: BetterAuthConfig = { ...cfg }\n\n  if (\n    cfg.emailAndPassword?.enabled &&\n    !cfg.emailAndPassword.sendResetPassword\n  ) {\n    out.emailAndPassword = {\n      ...cfg.emailAndPassword,\n      sendResetPassword: async ({ user, url }) => {\n        await email.send({\n          to: user.email,\n          subject: 'Reset your password',\n          text: `Click the link to reset your password:\\n\\n${url}\\n\\nIf you didn't request this, you can ignore this email.`,\n        })\n      },\n    }\n  }\n\n  if (!cfg.emailVerification?.sendVerificationEmail) {\n    out.emailVerification = {\n      ...cfg.emailVerification,\n      sendVerificationEmail: async ({ user, url }) => {\n        await email.send({\n          to: user.email,\n          subject: 'Verify your email',\n          text: `Click the link to verify your email address:\\n\\n${url}`,\n        })\n      },\n    }\n  }\n\n  return out\n}\n"]}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,cAAc;AACd,OAAO,EAAE,UAAU,EAAoC,MAAM,aAAa,CAAA;AAC1E,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAC7D,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AA8B7C;;;;GAIG;AACH,MAAM,UAAU,UAAU,CACxB,EAAS,EACT,GAAqB,EACrB,OAAgB,EAChB,UAAoC;IAEpC,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,UAAU,CAAC,CAAA;IACrE,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,CAAA;IAE9E,OAAO,UAAU,CAAC;QAChB,GAAG,GAAG;QACN,OAAO;QACP,QAAQ,EAAE,cAAc,CAAC,EAA0C,EAAE;YACnE,QAAQ,EAAE,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ;YAC5C,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9C,CAAC;KACH,CAAwC,CAAA;AAC3C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAC/B,MAA+B,EAC/B,GAAqB;IAErB,MAAM,MAAM,GAAG;QACb,GAAG,CAAC,IAAI,EAAE,SAAS,IAAI,MAAM;QAC7B,GAAG,CAAC,OAAO,EAAE,SAAS,IAAI,SAAS;KACpC,CAAA;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;AACjD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAU;IAC9C,OAAO;QACL,GAAG,EAAE;YACH,KAAK,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE;gBAC1B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,CAAA;gBACrD,IAAI,MAAM,IAAI,MAAM,IAAI,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;oBAC9C,MAAM,OAAO,GAAG,SAAS,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAA;oBAC3D,MAAM,oBAAoB,GACxB,OAAO;wBACP,sBAAsB,IAAI,OAAO;wBACjC,OAAO,OAAO,CAAC,oBAAoB,KAAK,QAAQ;wBAC9C,CAAC,CAAC,OAAO,CAAC,oBAAoB;wBAC9B,CAAC,CAAC,IAAI,CAAA;oBACV,MAAM,IAAI,GACR,MAAM,IAAI,MAAM,CAAC,IAAI,IAAI,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ;wBAC3D,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI;wBAClB,CAAC,CAAC,SAAS,CAAA;oBACf,OAAO;wBACL,IAAI,EAAE;4BACJ,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE;4BAClB,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK;4BACxB,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI;4BACtB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;yBAC1B;wBACD,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC,IAAI;qBACnD,CAAA;gBACH,CAAC;gBACD,OAAO,IAAI,CAAA;YACb,CAAC;SACF;KACF,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CACnC,GAAqB,EACrB,KAAkB,EAClB,eAAwB;IAExB,IAAI,CAAC,eAAe;QAAE,OAAO,GAAG,CAAA;IAChC,MAAM,GAAG,GAAqB,EAAE,GAAG,GAAG,EAAE,CAAA;IAExC,IACE,GAAG,CAAC,gBAAgB,EAAE,OAAO;QAC7B,CAAC,GAAG,CAAC,gBAAgB,CAAC,iBAAiB,EACvC,CAAC;QACD,GAAG,CAAC,gBAAgB,GAAG;YACrB,GAAG,GAAG,CAAC,gBAAgB;YACvB,iBAAiB,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE;gBACzC,MAAM,KAAK,CAAC,IAAI,CAAC;oBACf,EAAE,EAAE,IAAI,CAAC,KAAK;oBACd,OAAO,EAAE,qBAAqB;oBAC9B,IAAI,EAAE,6CAA6C,GAAG,4DAA4D;iBACnH,CAAC,CAAA;YACJ,CAAC;SACF,CAAA;IACH,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,iBAAiB,EAAE,qBAAqB,EAAE,CAAC;QAClD,GAAG,CAAC,iBAAiB,GAAG;YACtB,GAAG,GAAG,CAAC,iBAAiB;YACxB,qBAAqB,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE;gBAC7C,MAAM,KAAK,CAAC,IAAI,CAAC;oBACf,EAAE,EAAE,IAAI,CAAC,KAAK;oBACd,OAAO,EAAE,mBAAmB;oBAC5B,IAAI,EAAE,mDAAmD,GAAG,EAAE;iBAC/D,CAAC,CAAA;YACJ,CAAC;SACF,CAAA;IACH,CAAC;IAED,OAAO,GAAG,CAAA;AACZ,CAAC","sourcesContent":["// src/auth.ts\nimport { betterAuth, type Auth, type BetterAuthPlugin } from 'better-auth'\nimport { drizzleAdapter } from 'better-auth/adapters/drizzle'\nimport { openAPI } from 'better-auth/plugins'\n\nimport type { AuthSessionResolver } from './access'\nimport type { BetterAuthConfig } from './config'\nimport type { AnyDb, Dialect } from './dialect'\nimport type { EmailFacade } from './email'\n\ntype ConfiguredAuthPlugins<TConfig extends BetterAuthConfig> = TConfig extends {\n  plugins: infer TPlugins extends readonly BetterAuthPlugin[]\n}\n  ? TPlugins\n  : []\n\ntype WithBunderstackAuthDefaults<TConfig extends BetterAuthConfig> = Omit<\n  BetterAuthConfig,\n  'plugins'\n> &\n  Omit<TConfig, 'plugins'> & {\n    plugins: [...ConfiguredAuthPlugins<TConfig>, ReturnType<typeof openAPI>]\n  }\n\n/**\n * The public Better Auth instance retains every endpoint and model field from\n * the declared config. Bunderstack always installs OpenAPI at runtime, so its\n * endpoints are part of the public type even when the app omitted the plugin.\n */\nexport type BunderstackAuth<\n  TConfig extends BetterAuthConfig = BetterAuthConfig,\n> = Auth<WithBunderstackAuthDefaults<TConfig>> & Auth\n\n/**\n * Build Better Auth while exposing its named plugin-aware public type. The\n * implementation accepts the resolved runtime config, while `TConfig` carries\n * the declaration that produced it; their relationship is asserted once here.\n */\nexport function createAuth<TConfig extends BetterAuthConfig = BetterAuthConfig>(\n  db: AnyDb,\n  cfg: BetterAuthConfig,\n  dialect: Dialect,\n  userSchema?: Record<string, unknown>,\n): BunderstackAuth<TConfig> {\n  const hasOpenApi = cfg.plugins?.some((p: any) => p.id === 'open-api')\n  const plugins = hasOpenApi ? cfg.plugins : [...(cfg.plugins || []), openAPI()]\n\n  return betterAuth({\n    ...cfg,\n    plugins,\n    database: drizzleAdapter(db as Parameters<typeof drizzleAdapter>[0], {\n      provider: dialect === 'pg' ? 'pg' : 'sqlite',\n      ...(userSchema ? { schema: userSchema } : {}),\n    }),\n  }) as unknown as BunderstackAuth<TConfig>\n}\n\n/**\n * better-auth resolves its models out of the app's own schema, so an app that\n * declares none has no auth at all. Session resolution must then short-circuit\n * to null: the drizzle adapter throws on a missing model, and any session\n * cookie for the host — a browser keeps those per host, not per port, so one\n * minted by another local app arrives here too — would break every request.\n */\nexport function missingAuthModels(\n  schema: Record<string, unknown>,\n  cfg: BetterAuthConfig,\n): string[] {\n  const models = [\n    cfg.user?.modelName ?? 'user',\n    cfg.session?.modelName ?? 'session',\n  ]\n  return models.filter((model) => !schema[model])\n}\n\n/**\n * Adapt the raw better-auth instance to our internal {@link AuthSessionResolver}\n * contract. better-auth's `getSession` has a union return (a bare session, or a\n * `{ headers, response }` wrapper when `returnHeaders` is set); we only ever\n * call the bare form, so we narrow on `'user' in result` and map to our shape.\n * Keeping this adapter here means internal modules never depend on better-auth's\n * evolving types.\n */\nexport function toAuthSessionResolver(auth: Auth): AuthSessionResolver {\n  return {\n    api: {\n      async getSession({ headers }) {\n        const result = await auth.api.getSession({ headers })\n        if (result && 'user' in result && result.user) {\n          const session = 'session' in result ? result.session : null\n          const activeOrganizationId =\n            session &&\n            'activeOrganizationId' in session &&\n            typeof session.activeOrganizationId === 'string'\n              ? session.activeOrganizationId\n              : null\n          const role =\n            'role' in result.user && typeof result.user.role === 'string'\n              ? result.user.role\n              : undefined\n          return {\n            user: {\n              id: result.user.id,\n              email: result.user.email,\n              name: result.user.name,\n              ...(role ? { role } : {}),\n            },\n            session: session ? { activeOrganizationId } : null,\n          }\n        }\n        return null\n      },\n    },\n  }\n}\n\n/**\n * Fill better-auth's email hooks from the bunderstack email facade. Only fills\n * gaps: user-supplied handlers always win, and nothing is injected when email\n * isn't configured. emailAndPassword is only touched when the user enabled it\n * (injecting it unasked would enable the feature).\n */\nexport function withEmailAuthDefaults(\n  cfg: BetterAuthConfig,\n  email: EmailFacade,\n  emailConfigured: boolean,\n): BetterAuthConfig {\n  if (!emailConfigured) return cfg\n  const out: BetterAuthConfig = { ...cfg }\n\n  if (\n    cfg.emailAndPassword?.enabled &&\n    !cfg.emailAndPassword.sendResetPassword\n  ) {\n    out.emailAndPassword = {\n      ...cfg.emailAndPassword,\n      sendResetPassword: async ({ user, url }) => {\n        await email.send({\n          to: user.email,\n          subject: 'Reset your password',\n          text: `Click the link to reset your password:\\n\\n${url}\\n\\nIf you didn't request this, you can ignore this email.`,\n        })\n      },\n    }\n  }\n\n  if (!cfg.emailVerification?.sendVerificationEmail) {\n    out.emailVerification = {\n      ...cfg.emailVerification,\n      sendVerificationEmail: async ({ user, url }) => {\n        await email.send({\n          to: user.email,\n          subject: 'Verify your email',\n          text: `Click the link to verify your email address:\\n\\n${url}`,\n        })\n      },\n    }\n  }\n\n  return out\n}\n"]}