elm-ssr 1.0.6 → 1.0.7

package/bin/elm-ssr.mjs

@@ -410,6 +410,10 @@ switch (command) {
       try {
         const result = await addAuthProvider(rootPath, appConfig, providerArg);
         console.log(`Added ${result.name} to ${appConfig.name}`);
+        if (result.warnings && result.warnings.length > 0) {
+          console.log(`\nWarnings:`);
+          for (const warning of result.warnings) console.log(`  - ${warning}`);
+        }
         console.log(`\nNext steps:`);
         if (result.provider === "better-auth") {
           console.log(`  1. Run: bun install`);

package/lib/scaffold/app-templates.mjs

@@ -23,7 +23,75 @@ export const elmJsonTemplate = ({ http = false } = {}) => ({
   }
 });
 
-export const sharedTemplate = (namespace, auth) => `module ${namespace}.View.Shared exposing (head, layout)
+export const sharedTemplate = (namespace, auth) => auth ? `module ${namespace}.View.Shared exposing (head, layoutFor, User, sessionDecoder)
+
+import ElmSsr.Html exposing (Node, a, div, header, main_, nav, span, text)
+import ElmSsr.Html.Attributes exposing (class, href)
+import ElmSsr.Page as Page
+import Json.Decode as Decode
+
+
+head : List (Node msg)
+head =
+    [ Page.metaCharset "utf-8"
+    , Page.metaViewport "width=device-width, initial-scale=1"
+    , Page.stylesheet "/styles.css"
+    ]
+
+
+type alias User =
+    { email : String
+    , name : Maybe String
+    }
+
+
+userDecoder : Decode.Decoder User
+userDecoder =
+    Decode.map2 User
+        (Decode.field "email" Decode.string)
+        (Decode.maybe (Decode.field "name" Decode.string))
+
+
+{-| Decodes the session payload's "user" field, if present. Pair with
+\`Loader.session Shared.sessionDecoder |> Loader.map (Maybe.andThen identity)\`
+to get \`Maybe User\` — outer Maybe is "no session", inner is "session, no user".
+-}
+sessionDecoder : Decode.Decoder (Maybe User)
+sessionDecoder =
+    Decode.oneOf
+        [ Decode.field "user" (Decode.nullable userDecoder)
+        , Decode.succeed Nothing
+        ]
+
+
+{-| Session-aware page chrome — nav shows "Sign in" or the signed-in user. -}
+layoutFor : String -> Maybe User -> List (Node msg) -> Node msg
+layoutFor pageTitle maybeUser body =
+    div [ class "page" ]
+        [ header [ class "header" ]
+            [ div [ class "header-inner" ]
+                [ a [ class "brand", href "/" ]
+                    [ span [ class "brand-icon" ] [ text "◆" ]
+                    , text "elm-ssr"
+                    ]
+                , nav [ class "nav" ]
+                    [ a [ class "nav-link", href "/" ] [ text "Home" ]
+                    , a [ class "nav-link", href "/counter" ] [ text "Counter" ]
+                    , case maybeUser of
+                        Just user ->
+                            a [ class "nav-link", href "/profile" ]
+                                [ text (Maybe.withDefault user.email user.name) ]
+
+                        Nothing ->
+                            a [ class "nav-link", href "/login" ] [ text "Sign in" ]
+                    ]
+                ]
+            ]
+        , main_ [ class "main" ]
+            [ div [ class "container" ] body
+            ]
+        ]
+` : `module ${namespace}.View.Shared exposing (head, layout)
 
 import ElmSsr.Html exposing (Node, a, div, header, main_, nav, span, text)
 import ElmSsr.Html.Attributes exposing (class, href)
@@ -49,8 +117,67 @@ layout pageTitle body =
                     ]
                 , nav [ class "nav" ]
                     [ a [ class "nav-link", href "/" ] [ text "Home" ]
-                    , a [ class "nav-link", href "/counter" ] [ text "Counter" ]${auth ? `
-                    , a [ class "nav-link", href "/login" ] [ text "Sign in" ]` : ""}
+                    , a [ class "nav-link", href "/counter" ] [ text "Counter" ]
+                    ]
+                ]
+            ]
+        , main_ [ class "main" ]
+            [ div [ class "container" ] body
+            ]
+        ]
+`;
+
+// Additive block appended to an existing (non-auth) View/Shared.elm by `auth add`.
+// Deliberately does NOT touch the existing `layout` function or its call sites —
+// existing pages keep compiling unchanged; only newly-added Login/Profile pages
+// (and any page the user migrates by hand) use `layoutFor`.
+export const sharedAuthAddition = () => `
+
+type alias User =
+    { email : String
+    , name : Maybe String
+    }
+
+
+userDecoder : Decode.Decoder User
+userDecoder =
+    Decode.map2 User
+        (Decode.field "email" Decode.string)
+        (Decode.maybe (Decode.field "name" Decode.string))
+
+
+{-| Decodes the session payload's "user" field, if present. Pair with
+\`Loader.session Shared.sessionDecoder |> Loader.map (Maybe.andThen identity)\`
+to get \`Maybe User\` — outer Maybe is "no session", inner is "session, no user".
+-}
+sessionDecoder : Decode.Decoder (Maybe User)
+sessionDecoder =
+    Decode.oneOf
+        [ Decode.field "user" (Decode.nullable userDecoder)
+        , Decode.succeed Nothing
+        ]
+
+
+{-| Session-aware page chrome — nav shows "Sign in" or the signed-in user. -}
+layoutFor : String -> Maybe User -> List (Node msg) -> Node msg
+layoutFor pageTitle maybeUser body =
+    div [ class "page" ]
+        [ header [ class "header" ]
+            [ div [ class "header-inner" ]
+                [ a [ class "brand", href "/" ]
+                    [ span [ class "brand-icon" ] [ text "◆" ]
+                    , text "elm-ssr"
+                    ]
+                , nav [ class "nav" ]
+                    [ a [ class "nav-link", href "/" ] [ text "Home" ]
+                    , a [ class "nav-link", href "/counter" ] [ text "Counter" ]
+                    , case maybeUser of
+                        Just user ->
+                            a [ class "nav-link", href "/profile" ]
+                                [ text (Maybe.withDefault user.email user.name) ]
+
+                        Nothing ->
+                            a [ class "nav-link", href "/login" ] [ text "Sign in" ]
                     ]
                 ]
             ]
@@ -60,7 +187,71 @@ layout pageTitle body =
         ]
 `;
 
-export const indexRouteTemplate = (namespace, auth) => `module ${namespace}.Routes.Index exposing (page, action)
+export const indexRouteTemplate = (namespace, auth) => auth ? `module ${namespace}.Routes.Index exposing (page, action)
+
+import ElmSsr.Action as Action exposing (Action)
+import ElmSsr.Document exposing (Document)
+import ElmSsr.Html exposing (a, div, h1, h2, p, section, span, text)
+import ElmSsr.Html.Attributes exposing (class, href)
+import ElmSsr.Loader as Loader exposing (Loader)
+import ElmSsr.Page as Page
+import ElmSsr.Route exposing (Request)
+import ${namespace}.View.Shared as Shared
+
+
+page : Request -> Loader (Document Never)
+page _ =
+    Loader.session Shared.sessionDecoder
+        |> Loader.map (Maybe.andThen identity)
+        |> Loader.map view
+
+
+action : Request -> Action (Document Never)
+action _ =
+    Action.fail 405 "Method not allowed"
+
+
+view : Maybe Shared.User -> Document Never
+view maybeUser =
+    Page.page
+        { title = "elm-ssr"
+        , head = Shared.head
+        , body =
+            [ Shared.layoutFor "Home"
+                maybeUser
+                [ section [ class "hero" ]
+                    [ h1 [ class "hero-title" ] [ text "Ship fast." ]
+                    , p [ class "hero-subtitle" ]
+                        [ text "Type-safe server-side rendering with interactive islands. Runs on Cloudflare Workers and Bun." ]
+                    , div [ class "hero-actions" ]
+                        ([ a [ class "btn btn-primary", href "/counter" ] [ text "Try the counter" ] ]
+                            ++ (case maybeUser of
+                                    Just _ ->
+                                        [ a [ class "btn btn-secondary", href "/profile" ] [ text "Your profile" ] ]
+
+                                    Nothing ->
+                                        [ a [ class "btn btn-secondary", href "/login" ] [ text "Sign in" ] ]
+                               )
+                        )
+                    ]
+                , section [ class "features" ]
+                    [ featureCard "⚡" "Edge-first" "Renders in milliseconds at the edge. No cold starts."
+                    , featureCard "🦺" "Fully typed" "End-to-end Elm types from DB to HTML. No runtime surprises."
+                    , featureCard "🏝️" "Islands" "Add interactivity exactly where you need it. Zero JS elsewhere."
+                    ]
+                ]
+            ]
+        }
+
+
+featureCard : String -> String -> String -> ElmSsr.Html.Node msg
+featureCard icon title_ body =
+    div [ class "feature-card" ]
+        [ span [ class "feature-icon" ] [ text icon ]
+        , h2 [ class "feature-title" ] [ text title_ ]
+        , p [ class "feature-body" ] [ text body ]
+        ]
+` : `module ${namespace}.Routes.Index exposing (page, action)
 
 import ElmSsr.Action as Action exposing (Action)
 import ElmSsr.Document exposing (Document)
@@ -94,9 +285,7 @@ view =
                     , p [ class "hero-subtitle" ]
                         [ text "Type-safe server-side rendering with interactive islands. Runs on Cloudflare Workers and Bun." ]
                     , div [ class "hero-actions" ]
-                        [ a [ class "btn btn-primary", href "/counter" ] [ text "Try the counter" ]${auth ? `
-                        , a [ class "btn btn-secondary", href "/login" ] [ text "Sign in" ]` : ""}
-                        ]
+                        [ a [ class "btn btn-primary", href "/counter" ] [ text "Try the counter" ] ]
                     ]
                 , section [ class "features" ]
                     [ featureCard "⚡" "Edge-first" "Renders in milliseconds at the edge. No cold starts."
@@ -117,7 +306,50 @@ featureCard icon title_ body =
         ]
 `;
 
-export const counterRouteTemplate = (namespace) => `module ${namespace}.Routes.Counter exposing (page, action)
+export const counterRouteTemplate = (namespace, auth) => auth ? `module ${namespace}.Routes.Counter exposing (page, action)
+
+import ElmSsr.Action as Action exposing (Action)
+import ElmSsr.Document exposing (Document)
+import ElmSsr.Html exposing (div, h1, p, text)
+import ElmSsr.Html.Attributes exposing (class)
+import ElmSsr.Loader as Loader exposing (Loader)
+import ElmSsr.Page as Page
+import ElmSsr.Route exposing (Request)
+import ${namespace}.Islands.Counter as Counter
+import ${namespace}.View.Shared as Shared
+
+
+page : Request -> Loader (Document Never)
+page _ =
+    Loader.session Shared.sessionDecoder
+        |> Loader.map (Maybe.andThen identity)
+        |> Loader.map view
+
+
+action : Request -> Action (Document Never)
+action _ =
+    Action.fail 405 "Method not allowed"
+
+
+view : Maybe Shared.User -> Document Never
+view maybeUser =
+    Page.page
+        { title = "Counter | elm-ssr"
+        , head = Shared.head
+        , body =
+            [ Shared.layoutFor "Counter"
+                maybeUser
+                [ div [ class "page-header" ]
+                    [ h1 [] [ text "Interactive Counter" ]
+                    , p [ class "page-subtitle" ]
+                        [ text "This page is server-rendered. Only the counter widget below is a client-side island — zero JS elsewhere." ]
+                    ]
+                , div [ class "card" ]
+                    [ Counter.embed { start = 0 } ]
+                ]
+            ]
+        }
+` : `module ${namespace}.Routes.Counter exposing (page, action)
 
 import ElmSsr.Action as Action exposing (Action)
 import ElmSsr.Document exposing (Document)
@@ -252,7 +484,47 @@ view model =
         ]
 `;
 
-export const notFoundRouteTemplate = (namespace) => `module ${namespace}.Routes.NotFound exposing (page, action)
+export const notFoundRouteTemplate = (namespace, auth) => auth ? `module ${namespace}.Routes.NotFound exposing (page, action)
+
+import ElmSsr.Action as Action exposing (Action)
+import ElmSsr.Document exposing (Document)
+import ElmSsr.Html exposing (a, div, h1, p, text)
+import ElmSsr.Html.Attributes exposing (class, href)
+import ElmSsr.Loader as Loader exposing (Loader)
+import ElmSsr.Page as Page
+import ElmSsr.Route exposing (Request)
+import ${namespace}.View.Shared as Shared
+
+
+page : Request -> Loader (Document Never)
+page _ =
+    Loader.session Shared.sessionDecoder
+        |> Loader.map (Maybe.andThen identity)
+        |> Loader.map view
+
+
+action : Request -> Action (Document Never)
+action _ =
+    Action.fail 405 "Method not allowed"
+
+
+view : Maybe Shared.User -> Document Never
+view maybeUser =
+    Page.notFound
+        { title = "Not Found | elm-ssr"
+        , head = Shared.head
+        , body =
+            [ Shared.layoutFor "Not Found"
+                maybeUser
+                [ div [ class "error-page" ]
+                    [ h1 [ class "error-code" ] [ text "404" ]
+                    , p [ class "error-message" ] [ text "This page doesn't exist." ]
+                    , a [ class "btn btn-primary", href "/" ] [ text "Go home" ]
+                    ]
+                ]
+            ]
+        }
+` : `module ${namespace}.Routes.NotFound exposing (page, action)
 
 import ElmSsr.Action as Action exposing (Action)
 import ElmSsr.Document exposing (Document)

package/lib/scaffold/auth-add.mjs

@@ -3,14 +3,14 @@ import { dirname, resolve } from "node:path";
 import {
   betterAuthProviderCode,
   auth0ProviderCode,
-  betterAuthEndpointTemplate,
-  auth0EndpointTemplate,
   loginRouteTemplateBetterAuth,
   loginRouteTemplateAuth0,
   profileRouteTemplate,
   loginIslandTemplate,
   betterAuthMigrationTemplate
 } from "./auth-templates.mjs";
+import { sharedAuthAddition } from "./app-templates.mjs";
+import { authPeerDependencies } from "./auth-deps.mjs";
 
 const PROVIDER_NAMES = { "better-auth": "betterAuth", auth0: "auth0" };
 
@@ -28,59 +28,42 @@ const detectProviders = (runtimeContent) => {
   return found;
 };
 
-// Add auth imports after the effects import line.
+// Add auth imports after the effects import line. composeAuthProviders comes
+// from the elm-ssr library itself; only the concrete provider (configured by
+// the user's app-specific env shape) lives in the generated Auth.ts.
 const addAuthImports = (content, provider) => {
   const providerName = provider === "better-auth" ? "betterAuthProvider" : "auth0Provider";
-  const sessionImport = `import { memorySessionStore } from "elm-ssr/sessions";`;
   const anchor = `import { inMemoryEffects, cloudflareEffects } from "elm-ssr/effects";`;
   let next = content;
 
-  if (!next.includes(sessionImport)) {
-    next = next.replace(anchor, `${anchor}\n${sessionImport}`);
+  if (!next.includes(`import { memorySessionStore } from "elm-ssr/sessions";`)) {
+    next = next.replace(anchor, `${anchor}\nimport { memorySessionStore } from "elm-ssr/sessions";`);
+  }
+  if (!next.includes(`import { composeAuthProviders } from "elm-ssr/auth";`)) {
+    next = next.replace(anchor, `${anchor}\nimport { composeAuthProviders } from "elm-ssr/auth";`);
   }
 
   const endpointImport = next.match(/import \{ ([^}]+) \} from "\.\/src\/Endpoints\/Auth";/);
   if (endpointImport) {
     const names = endpointImport[1].split(",").map((name) => name.trim()).filter(Boolean);
-    for (const name of [providerName, "composeAuthProviders"]) {
-      if (!names.includes(name)) names.push(name);
-    }
+    if (!names.includes(providerName)) names.push(providerName);
     return next.replace(endpointImport[0], `import { ${names.join(", ")} } from "./src/Endpoints/Auth";`);
   }
 
-  return next.replace(anchor, `${anchor}\nimport { ${providerName}, composeAuthProviders } from "./src/Endpoints/Auth";`);
+  return next.replace(anchor, `${anchor}\nimport { ${providerName} } from "./src/Endpoints/Auth";`);
 };
 
-const betterAuthRuntimeEnvBlock = `let bunAuthDb: any = undefined;
-if (typeof (globalThis as any).Bun !== "undefined") {
-  const sqliteModule = "bun" + ":sqlite";
-  const { Database } = require(sqliteModule);
-  bunAuthDb = new Database(import.meta.dir + "/app.db");
-}
-
-const getAuthEnv = (env: any): any =>
-  bunAuthDb && !env?.DB ? { ...(env ?? {}), DB: bunAuthDb } : env;
-
-`;
-
-// Build the auth init block that goes before createWorkerApp.
-const buildAuthInitBlock = (provider, hasDb) => {
-  if (provider === "better-auth") {
-    return `
-// elm-ssr-auth:start
-${betterAuthRuntimeEnvBlock}
-export const sessionStore = memorySessionStore();
-
-const authMiddleware = composeAuthProviders([
-  betterAuthProvider({ getEnv: getAuthEnv }),
-]);`;
-  }
+// Build the auth init block that goes before createWorkerApp. The provider
+// itself (sourced from Auth.ts) is already fully configured — no per-runtime
+// env-resolution glue needed here.
+const buildAuthInitBlock = (provider) => {
+  const providerCall = provider === "better-auth" ? "betterAuthProvider" : "auth0Provider";
   return `
 // elm-ssr-auth:start
 export const sessionStore = memorySessionStore();
 
 const authMiddleware = composeAuthProviders([
-  auth0Provider(),
+  ${providerCall},
 ]);`;
 };
 
@@ -122,19 +105,19 @@ ${effectsLine}
 // elm-ssr-auth:end\n`;
 
   const withImports = addAuthImports(base, provider);
-  return withImports + buildAuthInitBlock(provider, hasDb) + newWorker;
+  return withImports + buildAuthInitBlock(provider) + newWorker;
 };
 
 // Adds a second provider to an already-auth runtime.ts.
 const addProviderToRuntime = (content, provider) => {
   let next = addAuthImports(content, provider);
-  const providerCall = provider === "better-auth"
-    ? "betterAuthProvider({ getEnv: getAuthEnv })"
-    : "auth0Provider()";
-  if (next.includes(providerCall)) return next;
-  if (provider === "better-auth" && !next.includes("const getAuthEnv =")) {
-    next = next.replace("// elm-ssr-auth:start\n", `// elm-ssr-auth:start\n${betterAuthRuntimeEnvBlock}`);
-  }
+  const providerCall = provider === "better-auth" ? "betterAuthProvider" : "auth0Provider";
+  // Scope the idempotency check to the composeAuthProviders array body —
+  // providerCall is now a bare identifier that also appears in the import
+  // line addAuthImports just added, so a whole-file `.includes` would always
+  // (wrongly) short-circuit here.
+  const arrayMatch = next.match(/composeAuthProviders\(\[\n([\s\S]*?)\]\)/);
+  if (arrayMatch && arrayMatch[1].includes(providerCall)) return next;
   return next.replace(
     /composeAuthProviders\(\[\n([\s\S]*?)\]\)/,
     (_, inner) => `composeAuthProviders([\n${inner}  ${providerCall},\n])`
@@ -152,19 +135,14 @@ const patchRuntimeForAuth = (content, provider, hasDb) => {
   return injectAuthIntoRuntime(content, provider, hasDb);
 };
 
-// Adds a provider to Auth.ts (creates full file if missing, appends code otherwise).
+// Adds a provider to Auth.ts (creates the file if missing, appends otherwise).
+// Each provider's glue is self-contained (no shared contract preamble to
+// manage), so a fresh file and an append are the same operation.
 const updateAuthTs = (existingContent, provider) => {
   const providerFn = provider === "better-auth" ? "betterAuthProvider" : "auth0Provider";
   if (existingContent.includes(providerFn)) return null; // already present
   const snippet = provider === "better-auth" ? betterAuthProviderCode : auth0ProviderCode;
-  // If file already has the contract section, just append provider code.
-  if (existingContent.includes("composeAuthProviders")) {
-    return existingContent.trimEnd() + "\n" + snippet + "\n";
-  }
-  // No contract yet — generate full file.
-  return provider === "better-auth"
-    ? betterAuthEndpointTemplate()
-    : auth0EndpointTemplate();
+  return existingContent ? existingContent.trimEnd() + "\n" + snippet + "\n" : snippet;
 };
 
 // Returns provider-specific env vars to add to .dev.vars / .env.
@@ -184,6 +162,44 @@ const missingEnvVars = (existingContent, provider) => {
   return vars.filter(([key]) => !existingContent.includes(`${key}=`));
 };
 
+// Adds `User` / `sessionDecoder` / `layoutFor` to an existing (non-auth)
+// View/Shared.elm so the new Login/Profile pages have something to import.
+// This is purely additive: the existing `layout` function and its call sites
+// in Index/Counter/NotFound (or any hand-written page) are left untouched, so
+// the app keeps compiling exactly as it did before — those pages just don't
+// get session-aware nav until migrated to `layoutFor` by hand (a warning
+// points at the new function so that's a deliberate, easy follow-up).
+const upgradeSharedForAuth = async (appRoot, namespace) => {
+  const sharedPath = resolve(appRoot, `src/${namespace.replace(/\./g, "/")}/View/Shared.elm`);
+  let existing = "";
+  try { existing = await readFile(sharedPath, "utf8"); } catch { return []; }
+  if (existing.includes("sessionDecoder")) return []; // already upgraded
+
+  let next = existing;
+
+  const exposingMatch = next.match(/^module ([\w.]+) exposing \(([^)]*)\)/m);
+  if (exposingMatch) {
+    const [fullMatch, moduleName, exposed] = exposingMatch;
+    const names = exposed.split(",").map((n) => n.trim()).filter(Boolean);
+    for (const name of ["layoutFor", "User", "sessionDecoder"]) {
+      if (!names.includes(name)) names.push(name);
+    }
+    next = next.replace(fullMatch, `module ${moduleName} exposing (${names.join(", ")})`);
+  }
+
+  if (!next.includes("import Json.Decode")) {
+    next = next.replace(/^import ElmSsr\.Page as Page$/m, (line) => `${line}\nimport Json.Decode as Decode`);
+  }
+
+  next = next.trimEnd() + "\n" + sharedAuthAddition();
+
+  await writeFile(sharedPath, next, "utf8");
+
+  return [
+    `View/Shared.elm gained User/sessionDecoder/layoutFor for session-aware nav. The original "layout" function (used by your existing pages) is untouched and still shows a static nav — switch a page to "Shared.layoutFor pageTitle maybeUser body" (reading the session like Routes/Profile.elm does) when you want it to reflect signed-in state.`
+  ];
+};
+
 /**
  * Add an auth provider to an existing elm-ssr app.
  * Idempotent: running it twice has no effect.
@@ -192,6 +208,7 @@ export const addAuthProvider = async (rootPath, appConfig, rawProvider) => {
   const provider = normaliseProvider(rawProvider);
   const appRoot = resolve(rootPath, appConfig.root);
   const namespace = appConfig.module;
+  const warnings = await upgradeSharedForAuth(appRoot, namespace);
 
   // ── Auth.ts ───────────────────────────────────────────────────────────────
   const authTsPath = resolve(appRoot, "src/Endpoints/Auth.ts");
@@ -270,8 +287,12 @@ export const addAuthProvider = async (rootPath, appConfig, rawProvider) => {
     const pkgPath = resolve(rootPath, "package.json");
     try {
       const pkg = JSON.parse(await readFile(pkgPath, "utf8"));
-      if (!pkg.devDependencies?.["better-auth"]) {
-        pkg.devDependencies = { ...pkg.devDependencies, "better-auth": "1.6.22" };
+      const peerDeps = await authPeerDependencies();
+      const addDeps = {};
+      if (!pkg.devDependencies?.["better-auth"]) addDeps["better-auth"] = peerDeps["better-auth"] ?? "latest";
+      if (!pkg.devDependencies?.["@better-auth/infra"]) addDeps["@better-auth/infra"] = peerDeps["@better-auth/infra"] ?? "latest";
+      if (Object.keys(addDeps).length > 0) {
+        pkg.devDependencies = { ...pkg.devDependencies, ...addDeps };
         await writeFile(pkgPath, JSON.stringify(pkg, null, 2) + "\n", "utf8");
       }
     } catch {}
@@ -288,7 +309,7 @@ export const addAuthProvider = async (rootPath, appConfig, rawProvider) => {
     }
   }
 
-  return { provider, name: PROVIDER_NAMES[provider] };
+  return { provider, name: PROVIDER_NAMES[provider], warnings };
 };
 
 /**

package/lib/scaffold/auth-deps.mjs

@@ -0,0 +1,16 @@
+import { readFile } from "node:fs/promises";
+import { resolve } from "node:path";
+
+// elm-ssr's own package.json declares better-auth / @better-auth/infra as
+// peerDependencies — the single source of truth for what version
+// elm-ssr/auth/better-auth was built and tested against. The scaffold reads
+// from there instead of keeping its own separate hardcoded version strings
+// that could silently drift out of sync.
+let cached = null;
+export const authPeerDependencies = async () => {
+  if (cached) return cached;
+  const pkgPath = resolve(new URL(".", import.meta.url).pathname, "../../package.json");
+  const pkg = JSON.parse(await readFile(pkgPath, "utf8"));
+  cached = pkg.peerDependencies ?? {};
+  return cached;
+};