glasswork 1.0.1 → 1.2.0

package/CHANGELOG.md

@@ -7,17 +7,62 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.2.0] - 2026-09-29
+
 ### Added
 
+- **`glasswork/sse`** — in-process server-sent event notifications for long-running Node.js deployments, with bounded connection buffers, heartbeats, and automatic cleanup. The broadcaster does not provide cross-instance delivery or work with the standard Lambda handler.
+
+### Fixed
+
+- Load the optional Swagger UI peer on the first UI request so minimal core consumers can import and bootstrap without it.
+
+- Enable partial batch responses in every SQS worker deployment example so failed jobs remain retryable.
+
+- Preserve SES webhook error responses and return a retryable status when event processing fails.
+
+- Secure the Better Auth role example with `input: false` and document the migration check for existing authorization data.
+- Enforce `allowGuest: false` for every unauthenticated request, including routes without an authorization rule, while still clearing invalid session cookies.
+- Resolve `SCOPED` route services from an isolated Awilix child container for each HTTP request and dispose the scope after handling.
+- Preserve trusted list-query scopes in every facet aggregation, including scopes on the aggregated field and nested logical conditions.
+- Verify SNS webhook signatures in every environment by default and restrict automatic subscription confirmation to bounded, non-redirecting AWS SNS requests.
+- Require an explicit SNS topic allowlist for verified webhooks and support AWS SNS signature versions 1 and 2.
+- Revoke Better Auth sessions with the authenticated session token and use Better Auth's standard cookie name by default.
+- Consume rate-limit capacity atomically, require complete DynamoDB configuration, and resolve client IPs from Lambda and Node adapter context.
+- HTML-escape email template variables by default, restrict dynamic URL schemes, and require triple braces for trusted raw HTML.
+- Encode raw SES messages from UTF-8 bytes and reject header or attachment metadata that could alter the MIME structure.
+- Export OpenAPI documents directly after route registration without mounting a temporary public endpoint or using a timer.
+
+## [1.1.0] - 2026-09-16
+
+### Added
+
+- **`glasswork/rls`** — PostgreSQL tenant isolation through Prisma Client Extensions, AsyncLocalStorage, Hono middleware, and a policy generator; includes transaction-scoped context, explicit bypass, and PostgreSQL integration tests.
+
 - **`parseFilterLiteral`**, **`parseFilterValue`**, **`parseWhereFilterValues`** — centralized filter value parsing for query params and Prisma `where` clauses
 - **`filter-value-schemas`** — Valibot operand schemas with transforms for typed Prisma filters
+- **`executePrismaList`** — direct execution of `findMany`, `count`, and optional `groupBy` aggregations on any Prisma model delegate, with optional `map` row-transformation callback
+- **`createPrismaListExecutor` row mapping** — added optional `map: (item: TItem) => TResult` callback to transform raw Prisma records into domain models or DTOs
+- **Virtual filter mapping (`mapFilters`)** — transform virtual/composite API filter fields into real database columns prior to search and scope merging; includes `mapPresenceFilter`, `mapBooleanFilter`, `mapValueFilter`, `renameFilter`, `nestFilter`, and `composeFilterMappers`
+- **Sort mapping (`mapSorts`)** — transform public API sort fields to nested relation paths (`'user.name'`) or custom sort clauses via `nestSort`, `renameSort`, or custom mapper functions in `createListQuery`
+- **`glasswork/audit`** — impersonation-aware auditing subsystem with ambient actor and tenant resolution, pluggable `AuditSink<TTx>` transactional sinks, and dual-logging
 
 ### Changed
 
+- Build and typecheck with stable TypeScript 7.0.2; verify published declarations and route inference with TypeScript 5.9, 6, and 7 in isolated npm consumers.
+- Propagate concrete authentication types through route contexts.
+- Update development dependencies, including Biome 2.5, AWS SDK clients, Hono, CASL, MJML, and documentation tooling. Keep Prisma on stable 7.10 and Vitest on the latest 4.x release compatible with Better Auth's testing peer range.
+- Add Node.js 26 to the CI test matrix alongside Node.js 20, 22, and 24; check packed-package imports and types on Node.js 20.
+- Make `ListQuerySchema` strict and bounded; malformed pagination, oversized strings, and unknown query parameters now return 422 instead of being clamped or ignored.
+- Reject unknown list-query filter fields, filter operators, and sort fields; validate date operands as existing calendar dates.
 - Typed filter schemas (`dateFilterSchema`, `intFilterSchema`, `numberFilterSchema`, `booleanFilterSchema`) parse string operands to Prisma types via Valibot transforms
 - `parseWhereFilterValues` reuses those schemas with `parse()` instead of custom coercion logic
 - List-query `where` deep copy uses `structuredClone` so parsed `Date` values are preserved
 
+### Fixed
+
+- Correctly escape end and else control flow markers in compiled email templates.
+
 ## [1.0.0] - 2026-06-10
 
 Major release: subpath exports, dependency upgrades (CASL 7, MJML 5, Valibot 1.4, Prisma 7), Prisma list-query helpers, and internal refactors. Breaking changes when upgrading from 0.x.
@@ -75,6 +120,8 @@ Major release: subpath exports, dependency upgrades (CASL 7, MJML 5, Valibot 1.4
 
 Last 0.x release before the 1.0 breaking changes. Earlier 0.x history is available on [GitHub releases](https://github.com/rolandboon/glasswork/releases).
 
-[Unreleased]: https://github.com/rolandboon/glasswork/compare/v1.0.0...HEAD
+[Unreleased]: https://github.com/rolandboon/glasswork/compare/v1.2.0...HEAD
+[1.2.0]: https://github.com/rolandboon/glasswork/compare/v1.1.0...v1.2.0
+[1.1.0]: https://github.com/rolandboon/glasswork/compare/v1.0.0...v1.1.0
 [1.0.0]: https://github.com/rolandboon/glasswork/compare/v0.13.3...v1.0.0
 [0.13.3]: https://github.com/rolandboon/glasswork/compare/v0.13.2...v0.13.3

package/README.md

@@ -53,6 +53,9 @@ Glasswork combines the best patterns from NestJS (modules, DI, OpenAPI) with the
 npm install glasswork hono awilix valibot hono-openapi
 ```
 
+To use Swagger UI at `/api`, also install `@hono/swagger-ui`. It is loaded on the
+first UI request; API routes and OpenAPI JSON generation do not require it.
+
 Glasswork 1.0 uses **subpath exports** (`glasswork/core`, `glasswork/http`, `glasswork/auth`, …). The root `glasswork` import covers core and HTTP only; optional subsystems use their own subpath. See [Package Exports](https://glasswork.dev/getting-started/package-exports).
 
 ## Quick Start
@@ -170,12 +173,44 @@ export default app; // Ready for Lambda or local server
 ## Requirements
 
 - Node.js 20+
-- TypeScript 5+
+- TypeScript 5.9, 6, or 7 (verified against the published declarations)
 
 ## Contributing
 
 Glasswork is in active development. Feedback, issues, and contributions are welcome!
 
+Builds and typechecks use stable TypeScript 7. Vitest stays on the latest 4.x
+release to remain compatible with Better Auth's testing peer range. CI runs the
+full test suite on Node.js 20, 22, 24, and 26, and checks the packed package's
+TypeScript 5.9, 6, and 7 consumer inference on Node.js 20.
+
+The repository can be developed and verified independently with npm:
+
+```sh
+npm ci
+npm run verify
+npm run docs:build
+```
+
+`npm run smoke:pack` installs the tarball in an isolated npm project, checks its
+published types, and imports its public entry points. Set `TYPESCRIPT_VERSION`
+to test another supported compiler, for example
+`TYPESCRIPT_VERSION=5.9.3 npm run smoke:pack` after building. Prisma's development
+tooling requires Node.js 20.19+, 22.12+, or 24+ on the respective supported lines.
+
+The RLS integration suite creates a temporary schema and restricted role in an
+existing PostgreSQL **test database**, then removes them afterwards. Set
+`RLS_TEST_DATABASE_URL` to a test administrator connection allowed to create schemas
+and roles; the actual isolation checks run as the restricted role:
+
+```sh
+RLS_TEST_DATABASE_URL=postgresql://test_admin:password@localhost:5432/test_db npm run verify
+```
+
+Without this variable, the PostgreSQL suite is skipped. CI sets it for both tests
+and coverage. To run coverage locally, use the same variable with
+`npm run test:coverage`.
+
 ## License
 
 MIT
@@ -191,5 +226,5 @@ MIT
 [build-href]: https://github.com/rolandboon/glasswork/actions/workflows/ci.yml
 [license-src]: https://img.shields.io/github/license/rolandboon/glasswork.svg?flat&colorA=1b1b1f&colorB=3e63dd
 [license-href]: https://opensource.org/licenses/MIT
-[type-script-src]: https://img.shields.io/badge/TypeScript-5.0%2B-blue?style=flat&labelColor=1b1b1f&color=3e63dd
+[type-script-src]: https://img.shields.io/badge/TypeScript-5.9%20%7C%206%20%7C%207-blue?style=flat&labelColor=1b1b1f&color=3e63dd
 [type-script-href]: https://www.typescriptlang.org/

package/dist/audit/audit-logger.d.ts

@@ -0,0 +1,22 @@
+import type { Logger } from '../utils/logger.js';
+import type { AuditingLogger, AuditRecordInput, AuditSink } from './types.js';
+export interface CreateAuditLoggerOptions<TTx = unknown> {
+    /** Persistence sink for audit records */
+    sink: AuditSink<TTx>;
+    /** Underlying logger (e.g. Pino logger) */
+    logger: Logger;
+    /** Service name to tag audit events with */
+    service?: string;
+    /** Custom formatter for the structured log payload */
+    formatLogPayload?: (record: AuditRecordInput) => Record<string, unknown>;
+}
+/**
+ * Creates an AuditingLogger that combines structured logging with persistence via an AuditSink.
+ *
+ * Each call to `logger.audit(message, entry, options)`:
+ * 1. Resolves ambient request context (actor, impersonation, tenant, correlation ID).
+ * 2. Emits a structured log (`audit: true` with audit attributes) via the underlying logger.
+ * 3. Persists the resolved audit record atomically using the provided sink.
+ */
+export declare function createAuditLogger<TTx = unknown>(options: CreateAuditLoggerOptions<TTx>): AuditingLogger<TTx>;
+//# sourceMappingURL=audit-logger.d.ts.map

package/dist/audit/audit-logger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-logger.d.ts","sourceRoot":"","sources":["../../src/audit/audit-logger.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAEjD,OAAO,KAAK,EAAmB,cAAc,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE/F,MAAM,WAAW,wBAAwB,CAAC,GAAG,GAAG,OAAO;IACrD,yCAAyC;IACzC,IAAI,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC;IACrB,2CAA2C;IAC3C,MAAM,EAAE,MAAM,CAAC;IACf,4CAA4C;IAC5C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,sDAAsD;IACtD,gBAAgB,CAAC,EAAE,CAAC,MAAM,EAAE,gBAAgB,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC1E;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,GAAG,OAAO,EAC7C,OAAO,EAAE,wBAAwB,CAAC,GAAG,CAAC,GACrC,cAAc,CAAC,GAAG,CAAC,CA6CrB"}

package/dist/audit/audit-logger.js

@@ -0,0 +1,44 @@
+import { resolveAuditRecord } from './context.js';
+/**
+ * Creates an AuditingLogger that combines structured logging with persistence via an AuditSink.
+ *
+ * Each call to `logger.audit(message, entry, options)`:
+ * 1. Resolves ambient request context (actor, impersonation, tenant, correlation ID).
+ * 2. Emits a structured log (`audit: true` with audit attributes) via the underlying logger.
+ * 3. Persists the resolved audit record atomically using the provided sink.
+ */
+export function createAuditLogger(options) {
+    const { sink, logger, service, formatLogPayload } = options;
+    const audit = async (message, entry, auditOptions) => {
+        const record = resolveAuditRecord({
+            ...entry,
+            message: entry.message ?? message,
+        }, service);
+        const logPayload = formatLogPayload
+            ? formatLogPayload(record)
+            : {
+                audit: true,
+                action: record.action,
+                category: record.category,
+                subjectType: record.subjectType,
+                subjectId: record.subjectId,
+                actorUserId: record.actorUserId,
+                effectiveUserId: record.effectiveUserId,
+                isImpersonating: record.isImpersonating,
+                tenantId: record.tenantId,
+                service: record.service,
+                metadata: record.metadata,
+            };
+        logger.info(message, logPayload);
+        await sink.record(record, auditOptions);
+    };
+    return {
+        debug: logger.debug.bind(logger),
+        info: logger.info.bind(logger),
+        warn: logger.warn.bind(logger),
+        error: logger.error.bind(logger),
+        child: logger.child?.bind(logger),
+        audit,
+    };
+}
+//# sourceMappingURL=audit-logger.js.map

package/dist/audit/audit-logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-logger.js","sourceRoot":"","sources":["../../src/audit/audit-logger.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAclD;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAAsC;IAEtC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,EAAE,GAAG,OAAO,CAAC;IAE5D,MAAM,KAAK,GAAG,KAAK,EACjB,OAAe,EACf,KAAsB,EACtB,YAA2B,EACZ,EAAE;QACjB,MAAM,MAAM,GAAG,kBAAkB,CAC/B;YACE,GAAG,KAAK;YACR,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,OAAO;SAClC,EACD,OAAO,CACR,CAAC;QAEF,MAAM,UAAU,GAAG,gBAAgB;YACjC,CAAC,CAAC,gBAAgB,CAAC,MAAM,CAAC;YAC1B,CAAC,CAAC;gBACE,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;aAC1B,CAAC;QAEN,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAEjC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAC1C,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC;QAChC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;QAC9B,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;QAC9B,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC;QAChC,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC;QACjC,KAAK;KACN,CAAC;AACJ,CAAC"}

package/dist/audit/context.d.ts

@@ -0,0 +1,13 @@
+import type { AuditContext, AuditEntryInput, AuditRecordInput } from './types.js';
+/**
+ * Get contextual information about the current actor and request for auditing.
+ * Returns undefined if called outside an authenticated request lifecycle.
+ */
+export declare function getAuditContext(): AuditContext | undefined;
+/**
+ * Resolve an audit entry input with ambient request context to produce a complete AuditRecordInput.
+ *
+ * @throws Error if no actorUserId can be resolved from either the entry or the request context.
+ */
+export declare function resolveAuditRecord(entry: AuditEntryInput, service?: string): AuditRecordInput;
+//# sourceMappingURL=context.d.ts.map

package/dist/audit/context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../src/audit/context.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAElF;;;GAGG;AACH,wBAAgB,eAAe,IAAI,YAAY,GAAG,SAAS,CAU1D;AAyCD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,eAAe,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,gBAAgB,CAgB7F"}

package/dist/audit/context.js

@@ -0,0 +1,66 @@
+import { getRequestActor, getRequestId } from '../observability/request-context.js';
+/**
+ * Get contextual information about the current actor and request for auditing.
+ * Returns undefined if called outside an authenticated request lifecycle.
+ */
+export function getAuditContext() {
+    const actor = getRequestActor();
+    if (!actor?.actorUserId)
+        return undefined;
+    return {
+        actorUserId: actor.actorUserId,
+        effectiveUserId: actor.effectiveUserId,
+        isImpersonating: actor.isImpersonating,
+        tenantId: actor.tenantId,
+        requestId: getRequestId(),
+    };
+}
+function resolveActor(entry, ctx) {
+    if (ctx?.isImpersonating) {
+        return {
+            actorUserId: ctx.actorUserId,
+            effectiveUserId: ctx.effectiveUserId ?? null,
+            isImpersonating: Boolean(ctx.effectiveUserId && ctx.effectiveUserId !== ctx.actorUserId),
+            tenantId: ctx.tenantId ?? entry.tenantId ?? null,
+        };
+    }
+    const actorUserId = entry.actorUserId ?? ctx?.actorUserId;
+    if (!actorUserId) {
+        throw new Error(`Audit entry '${entry.action}' requires an actorUserId, but none was provided or available in request context`);
+    }
+    const effectiveUserId = entry.effectiveUserId ?? ctx?.effectiveUserId ?? null;
+    return {
+        actorUserId,
+        effectiveUserId,
+        isImpersonating: Boolean(effectiveUserId && effectiveUserId !== actorUserId),
+        tenantId: entry.tenantId ?? ctx?.tenantId ?? null,
+    };
+}
+function formatAuditMessage(entry) {
+    if (entry.message)
+        return entry.message;
+    const target = entry.subjectId ? ` ${entry.subjectId}` : '';
+    return `Audit: ${entry.action} on ${entry.subjectType}${target}`;
+}
+/**
+ * Resolve an audit entry input with ambient request context to produce a complete AuditRecordInput.
+ *
+ * @throws Error if no actorUserId can be resolved from either the entry or the request context.
+ */
+export function resolveAuditRecord(entry, service) {
+    const ctx = getAuditContext();
+    const actors = resolveActor(entry, ctx);
+    return {
+        ...actors,
+        requestId: ctx?.requestId ?? null,
+        action: entry.action,
+        category: entry.category ?? 'DATA',
+        subjectType: entry.subjectType,
+        subjectId: entry.subjectId ?? null,
+        message: formatAuditMessage(entry),
+        metadata: entry.metadata ?? null,
+        service: service ?? null,
+        createdAt: new Date(),
+    };
+}
+//# sourceMappingURL=context.js.map

package/dist/audit/context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../../src/audit/context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,qCAAqC,CAAC;AAGpF;;;GAGG;AACH,MAAM,UAAU,eAAe;IAC7B,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;IAChC,IAAI,CAAC,KAAK,EAAE,WAAW;QAAE,OAAO,SAAS,CAAC;IAC1C,OAAO;QACL,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS,EAAE,YAAY,EAAE;KAC1B,CAAC;AACJ,CAAC;AASD,SAAS,YAAY,CAAC,KAAsB,EAAE,GAAkB;IAC9D,IAAI,GAAG,EAAE,eAAe,EAAE,CAAC;QACzB,OAAO;YACL,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,eAAe,EAAE,GAAG,CAAC,eAAe,IAAI,IAAI;YAC5C,eAAe,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,GAAG,CAAC,eAAe,KAAK,GAAG,CAAC,WAAW,CAAC;YACxF,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,IAAI,IAAI;SACjD,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,GAAG,EAAE,WAAW,CAAC;IAC1D,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,gBAAgB,KAAK,CAAC,MAAM,kFAAkF,CAC/G,CAAC;IACJ,CAAC;IAED,MAAM,eAAe,GAAG,KAAK,CAAC,eAAe,IAAI,GAAG,EAAE,eAAe,IAAI,IAAI,CAAC;IAC9E,OAAO;QACL,WAAW;QACX,eAAe;QACf,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,eAAe,KAAK,WAAW,CAAC;QAC5E,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,GAAG,EAAE,QAAQ,IAAI,IAAI;KAClD,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAsB;IAChD,IAAI,KAAK,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC,OAAO,CAAC;IACxC,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5D,OAAO,UAAU,KAAK,CAAC,MAAM,OAAO,KAAK,CAAC,WAAW,GAAG,MAAM,EAAE,CAAC;AACnE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAsB,EAAE,OAAgB;IACzE,MAAM,GAAG,GAAG,eAAe,EAAE,CAAC;IAC9B,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAExC,OAAO;QACL,GAAG,MAAM;QACT,SAAS,EAAE,GAAG,EAAE,SAAS,IAAI,IAAI;QACjC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,MAAM;QAClC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;QAClC,OAAO,EAAE,kBAAkB,CAAC,KAAK,CAAC;QAClC,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;QAChC,OAAO,EAAE,OAAO,IAAI,IAAI;QACxB,SAAS,EAAE,IAAI,IAAI,EAAE;KACtB,CAAC;AACJ,CAAC"}

package/dist/audit/index.d.ts

@@ -0,0 +1,8 @@
+/**
+ * @module glasswork/audit
+ * Audit logging, impersonation correlation, and audit sink abstraction.
+ */
+export { type CreateAuditLoggerOptions, createAuditLogger, } from './audit-logger.js';
+export { getAuditContext, resolveAuditRecord } from './context.js';
+export type { AuditContext, AuditEntryInput, AuditingLogger, AuditRecordInput, AuditSink, } from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/audit/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/audit/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EACL,KAAK,wBAAwB,EAC7B,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AACnE,YAAY,EACV,YAAY,EACZ,eAAe,EACf,cAAc,EACd,gBAAgB,EAChB,SAAS,GACV,MAAM,YAAY,CAAC"}

package/dist/audit/index.js

@@ -0,0 +1,7 @@
+/**
+ * @module glasswork/audit
+ * Audit logging, impersonation correlation, and audit sink abstraction.
+ */
+export { createAuditLogger, } from './audit-logger.js';
+export { getAuditContext, resolveAuditRecord } from './context.js';
+//# sourceMappingURL=index.js.map

package/dist/audit/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/audit/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAEL,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC"}

package/dist/audit/types.d.ts

@@ -0,0 +1,74 @@
+import type { Logger } from '../utils/logger.js';
+/**
+ * Contextual information about the actor and request for an audit event.
+ */
+export interface AuditContext {
+    /** Physical authenticated user who initiated the request */
+    actorUserId: string;
+    /** Effective user identity when acting via impersonation */
+    effectiveUserId?: string;
+    /** Whether the request is being executed via impersonation */
+    isImpersonating: boolean;
+    /** Tenant / organization identifier */
+    tenantId?: string;
+    /** Request identifier for distributed correlation */
+    requestId?: string;
+}
+/**
+ * Input for creating an audit event from business logic.
+ */
+export interface AuditEntryInput {
+    /** Unique action identifier (e.g. 'poll.create', 'member.archive') */
+    action: string;
+    /** Audit category (defaults to 'DATA') */
+    category?: string;
+    /** Target entity type (e.g. 'Poll', 'User', 'MedicalGroup') */
+    subjectType: string;
+    /** Target entity ID */
+    subjectId?: string | null;
+    /** Human-readable description of the event */
+    message?: string;
+    /** Additional structured metadata or changed fields */
+    metadata?: Record<string, unknown> | null;
+    /** Explicit actor override (e.g. for background jobs / seeders) */
+    actorUserId?: string | null;
+    /** Explicit effective user override */
+    effectiveUserId?: string | null;
+    /** Explicit tenant override */
+    tenantId?: string | null;
+}
+/**
+ * Fully resolved audit record ready for persistence and structured logging.
+ */
+export interface AuditRecordInput {
+    actorUserId: string;
+    effectiveUserId: string | null;
+    isImpersonating: boolean;
+    tenantId: string | null;
+    requestId: string | null;
+    action: string;
+    category: string;
+    subjectType: string;
+    subjectId: string | null;
+    message: string;
+    metadata: Record<string, unknown> | null;
+    service: string | null;
+    createdAt: Date;
+}
+/**
+ * Pluggable persistence sink for audit records (e.g. Prisma, DynamoDB, CloudWatch).
+ */
+export interface AuditSink<TTx = unknown> {
+    record(entry: AuditRecordInput, options?: {
+        tx?: TTx;
+    }): Promise<void>;
+}
+/**
+ * Logger extended with an `.audit()` method that writes structured logs and persists via a sink.
+ */
+export type AuditingLogger<TTx = unknown> = Logger & {
+    audit(message: string, entry: AuditEntryInput, options?: {
+        tx?: TTx;
+    }): Promise<void>;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/audit/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/audit/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAEjD;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,4DAA4D;IAC5D,WAAW,EAAE,MAAM,CAAC;IACpB,4DAA4D;IAC5D,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,8DAA8D;IAC9D,eAAe,EAAE,OAAO,CAAC;IACzB,uCAAuC;IACvC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qDAAqD;IACrD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,sEAAsE;IACtE,MAAM,EAAE,MAAM,CAAC;IACf,0CAA0C;IAC1C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+DAA+D;IAC/D,WAAW,EAAE,MAAM,CAAC;IACpB,uBAAuB;IACvB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,8CAA8C;IAC9C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,uDAAuD;IACvD,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC1C,mEAAmE;IACnE,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,uCAAuC;IACvC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,+BAA+B;IAC/B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,eAAe,EAAE,OAAO,CAAC;IACzB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACzC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,SAAS,CAAC,GAAG,GAAG,OAAO;IACtC,MAAM,CAAC,KAAK,EAAE,gBAAgB,EAAE,OAAO,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE,GAAG,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACxE;AAED;;GAEG;AACH,MAAM,MAAM,cAAc,CAAC,GAAG,GAAG,OAAO,IAAI,MAAM,GAAG;IACnD,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE,GAAG,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACvF,CAAC"}

package/dist/audit/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/audit/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/audit/types.ts"],"names":[],"mappings":""}

package/dist/auth/abilities.d.ts

@@ -24,7 +24,7 @@ export type AuthorizedAbility<TActions extends string, TSubjects extends string>
  *
  * const ability = defineAbility(currentUser);
  */
-export declare function createAbilityFactory<TSubjects extends string, TActions extends string = 'create' | 'read' | 'update' | 'delete' | 'manage'>(): (define: (can: AbilityBuilder<AuthorizedAbility<TActions, TSubjects>>["can"], cannot: AbilityBuilder<AuthorizedAbility<TActions, TSubjects>>["cannot"], user: AuthUser) => void) => (user: AuthUser) => AuthorizedAbility<TActions, TSubjects>;
+export declare function createAbilityFactory<TSubjects extends string, TActions extends string = 'create' | 'read' | 'update' | 'delete' | 'manage'>(): (define: (can: AbilityBuilder<AuthorizedAbility<TActions, TSubjects>>['can'], cannot: AbilityBuilder<AuthorizedAbility<TActions, TSubjects>>['cannot'], user: AuthUser) => void) => (user: AuthUser) => AuthorizedAbility<TActions, TSubjects>;
 /**
  * Define abilities using a declarative role-based configuration.
  */

package/dist/auth/abilities.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"abilities.d.ts","sourceRoot":"","sources":["../../src/auth/abilities.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,KAAK,aAAa,EAAE,MAAM,eAAe,CAAC;AACnE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAGlD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE3C;;GAEG;AACH,MAAM,MAAM,iBAAiB,CAAC,QAAQ,SAAS,MAAM,EAAE,SAAS,SAAS,MAAM,IAAI,aAAa,CAC9F;IAAC,QAAQ;IAAE,SAAS,GAAG,aAAa,CAAC,SAAS,CAAC;CAAC,CACjD,GAAG;IACF,SAAS,EAAE,CACT,MAAM,EAAE,QAAQ,EAChB,OAAO,EAAE,SAAS,GAAG,aAAa,CAAC,SAAS,CAAC,EAC7C,OAAO,CAAC,EAAE,MAAM,KACb,IAAI,CAAC;CACX,CAAC;AAqBF;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,CAClC,SAAS,SAAS,MAAM,EACxB,QAAQ,SAAS,MAAM,GAAG,QAAQ,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,MAK1E,QAAQ,CACN,GAAG,EAAE,cAAc,wCAAY,CAAC,KAAK,CAAC,EACtC,MAAM,EAAE,cAAc,wCAAY,CAAC,QAAQ,CAAC,EAC5C,IAAI,EAAE,QAAQ,KACX,IAAI,MAED,MAAM,QAAQ,4CAOzB;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,SAAS,MAAM,EACxB,QAAQ,SAAS,MAAM,EACvB,MAAM,SAAS,MAAM,EAErB,MAAM,EAAE,MAAM,CACZ,MAAM,EACN,CAAC,GAAG,EAAE;IACJ,GAAG,EAAE,cAAc,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE,SAAS,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC5F,MAAM,EAAE,cAAc,CACpB,aAAa,CAAC,CAAC,QAAQ,EAAE,SAAS,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC,CAChE,CAAC,QAAQ,CAAC,CAAC;IACZ,IAAI,EAAE,QAAQ,CAAC;CAChB,KAAK,IAAI,CACX;cAKW,QAAQ;IAelB,4DAA4D;kBAC9C,MAAM,SAAQ,OAAO,CAAC,QAAQ,CAAC;EAIhD;AAED;;GAEG;AACH,MAAM,MAAM,YAAY,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,QAAQ,KAAK,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC"}
+{"version":3,"file":"abilities.d.ts","sourceRoot":"","sources":["../../src/auth/abilities.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,KAAK,aAAa,EAAE,MAAM,eAAe,CAAC;AACnE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAGlD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE3C;;GAEG;AACH,MAAM,MAAM,iBAAiB,CAAC,QAAQ,SAAS,MAAM,EAAE,SAAS,SAAS,MAAM,IAAI,aAAa,CAC9F;IAAC,QAAQ;IAAE,SAAS,GAAG,aAAa,CAAC,SAAS,CAAC;CAAC,CACjD,GAAG;IACF,SAAS,EAAE,CACT,MAAM,EAAE,QAAQ,EAChB,OAAO,EAAE,SAAS,GAAG,aAAa,CAAC,SAAS,CAAC,EAC7C,OAAO,CAAC,EAAE,MAAM,KACb,IAAI,CAAC;CACX,CAAC;AAqBF;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,CAClC,SAAS,SAAS,MAAM,EACxB,QAAQ,SAAS,MAAM,GAAG,QAAQ,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,cAKlE,CACN,GAAG,EAAE,cAAc,wCAAY,CAAC,KAAK,CAAC,EACtC,MAAM,EAAE,cAAc,wCAAY,CAAC,QAAQ,CAAC,EAC5C,IAAI,EAAE,QAAQ,KACX,IAAI,YAEK,QAAQ,4CAOzB;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,SAAS,MAAM,EACxB,QAAQ,SAAS,MAAM,EACvB,MAAM,SAAS,MAAM,EAErB,MAAM,EAAE,MAAM,CACZ,MAAM,EACN,CAAC,GAAG,EAAE;IACJ,GAAG,EAAE,cAAc,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE,SAAS,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC5F,MAAM,EAAE,cAAc,CACpB,aAAa,CAAC,CAAC,QAAQ,EAAE,SAAS,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC,CAChE,CAAC,QAAQ,CAAC,CAAC;IACZ,IAAI,EAAE,QAAQ,CAAC;CAChB,KAAK,IAAI,CACX;IAKC,GAAG,OAAO,QAAQ;IAelB,4DAA4D;IAC5D,OAAO,OAAO,MAAM,SAAQ,OAAO,CAAC,QAAQ,CAAC;EAIhD;AAED;;GAEG;AACH,MAAM,MAAM,YAAY,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,QAAQ,KAAK,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC"}

package/dist/auth/abilities.js.map

@@ -1 +1 @@
-{"version":3,"file":"abilities.js","sourceRoot":"","sources":["../../src/auth/abilities.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAsB,MAAM,eAAe,CAAC;AAEnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAgB3D,SAAS,eAAe,CACtB,OAAwE;IAExE,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE;QAC5B,SAAS,CACP,MAAgB,EAChB,OAA6C,EAC7C,OAAgB;YAEhB,sHAAsH;YACtH,IAAI,CAAE,OAAe,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;gBAC3C,MAAM,IAAI,kBAAkB,CAC1B,OAAO,IAAI,gCAAgC,MAAM,gBAAgB,CAClE,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAA2C,CAAC;AAC/C,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,oBAAoB;IAMlC,OAAO,SAAS,aAAa,CAC3B,MAIS;QAET,OAAO,CAAC,IAAc,EAAc,EAAE;YACpC,MAAM,mBAAmB,GAAG,uBAAuB,EAAE,CAAC;YACtD,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,cAAc,CAAa,mBAAmB,CAAC,CAAC;YACnF,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YAC1B,OAAO,eAAe,CAAC,KAAK,EAAE,CAAC,CAAC;QAClC,CAAC,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAKjC,MASC;IAID,OAAO;QACL,GAAG,CAAC,IAAc;YAChB,MAAM,mBAAmB,GAAG,uBAAuB,EAAE,CAAC;YACtD,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,cAAc,CAE/C,mBAAmB,CAAC,CAAC;YAEvB,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAc,CAAC,CAAC;YAE/C,IAAI,UAAU,EAAE,CAAC;gBACf,UAAU,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YACpC,CAAC;YAED,OAAO,eAAe,CAAC,KAAK,EAAE,CAAC,CAAC;QAClC,CAAC;QAED,4DAA4D;QAC5D,OAAO,CAAC,IAAY,EAAE,OAA0B,EAAE;YAChD,OAAO,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,IAAI,EAAc,CAAC,CAAC;QAC7D,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"abilities.js","sourceRoot":"","sources":["../../src/auth/abilities.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAsB,MAAM,eAAe,CAAC;AAEnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAgB3D,SAAS,eAAe,CACtB,OAAwE;IAExE,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE;QAC5B,SAAS,CACP,MAAgB,EAChB,OAA6C,EAC7C,OAAgB;YAEhB,sHAAsH;YACtH,IAAI,CAAE,OAAe,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;gBAC3C,MAAM,IAAI,kBAAkB,CAC1B,OAAO,IAAI,gCAAgC,MAAM,gBAAgB,CAClE,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAA2C,CAAC;AAC/C,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,oBAAoB;IAMlC,OAAO,SAAS,aAAa,CAC3B,MAIS;QAET,OAAO,CAAC,IAAc,EAAc,EAAE;YACpC,MAAM,mBAAmB,GAAG,uBAAuB,EAAE,CAAC;YACtD,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,cAAc,CAAa,mBAAmB,CAAC,CAAC;YACnF,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YAC1B,OAAO,eAAe,CAAC,KAAK,EAAE,CAAC,CAAC;QAClC,CAAC,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAKjC,MASC;IAID,OAAO;QACL,GAAG,CAAC,IAAc;YAChB,MAAM,mBAAmB,GAAG,uBAAuB,EAAE,CAAC;YACtD,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,cAAc,CAE/C,mBAAmB,CAAC,CAAC;YAEvB,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAc,CAAC,CAAC;YAE/C,IAAI,UAAU,EAAE,CAAC;gBACf,UAAU,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YACpC,CAAC;YAED,OAAO,eAAe,CAAC,KAAK,EAAE,CAAC,CAAC;QAClC,CAAC;QAED,4DAA4D;QAC5D,OAAO,CAAC,IAAY,EAAE,IAAI,GAAsB,EAAE;YAChD,OAAO,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,IAAI,EAAc,CAAC,CAAC;QAC7D,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/auth/better-auth-provider.d.ts

@@ -1,5 +1,12 @@
 import type { AuthProvider, AuthUser } from './types.js';
 export interface BetterAuthClient {
+    $context?: Promise<{
+        authCookies: {
+            sessionToken: {
+                name: string;
+            };
+        };
+    }>;
     api: {
         getSession: (options: {
             headers?: Record<string, string>;
@@ -9,9 +16,10 @@ export interface BetterAuthClient {
         } | null>;
         revokeSession: (options: {
             body: {
-                id: string;
+                token: string;
             };
-        }) => Promise<void>;
+            headers: Record<string, string>;
+        }) => Promise<unknown>;
         signInEmail?: (options: {
             body: {
                 email: string;
@@ -31,12 +39,12 @@ export interface BetterAuthClient {
     };
     handler?: (request: Request) => Promise<Response>;
 }
-export interface BetterAuthProviderConfig {
+export interface BetterAuthProviderConfig<TUser extends AuthUser = AuthUser> {
     /** better-auth client instance */
     auth: BetterAuthClient;
     /** Map better-auth user to AuthUser */
-    mapUser?: (user: Record<string, unknown>) => AuthUser;
-    /** Cookie name for session token (default: 'session') */
+    mapUser?: (user: Record<string, unknown>) => TUser;
+    /** Override the cookie name. Otherwise use Better Auth's resolved cookie configuration. */
     cookieName?: string;
 }
 interface BetterAuthSession {
@@ -51,6 +59,9 @@ interface BetterAuthSession {
 /**
  * Wrap better-auth as a Glasswork AuthProvider.
  */
-export declare function createBetterAuthProvider(config: BetterAuthProviderConfig): AuthProvider;
+export declare function createBetterAuthProvider<TUser extends AuthUser>(config: BetterAuthProviderConfig<TUser> & {
+    mapUser: (user: Record<string, unknown>) => TUser;
+}): AuthProvider<TUser>;
+export declare function createBetterAuthProvider(config: BetterAuthProviderConfig<AuthUser>): AuthProvider<AuthUser>;
 export {};
 //# sourceMappingURL=better-auth-provider.d.ts.map

package/dist/auth/better-auth-provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"better-auth-provider.d.ts","sourceRoot":"","sources":["../../src/auth/better-auth-provider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAe,QAAQ,EAAE,MAAM,YAAY,CAAC;AAEtE,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE;QACH,UAAU,EAAE,CAAC,OAAO,EAAE;YAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;SAAE,KAAK,OAAO,CAAC;YACrE,OAAO,CAAC,EAAE,iBAAiB,GAAG,IAAI,CAAC;YACnC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;SACvC,GAAG,IAAI,CAAC,CAAC;QACV,aAAa,EAAE,CAAC,OAAO,EAAE;YAAE,IAAI,EAAE;gBAAE,EAAE,EAAE,MAAM,CAAA;aAAE,CAAA;SAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;QACpE,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE;YAAE,IAAI,EAAE;gBAAE,KAAK,EAAE,MAAM,CAAC;gBAAC,QAAQ,EAAE,MAAM,CAAA;aAAE,CAAA;SAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;QAC3F,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;SAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;QAC/E,YAAY,CAAC,EACT,CAAC,CAAC,OAAO,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;SAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC,GAClE,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG;YAClB,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE;gBAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;aAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;SAC9E,CAAC,CAAC;KACR,CAAC;IACF,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;CACnD;AAED,MAAM,WAAW,wBAAwB;IACvC,kCAAkC;IAClC,IAAI,EAAE,gBAAgB,CAAC;IACvB,uCAAuC;IACvC,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,QAAQ,CAAC;IACtD,yDAAyD;IACzD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,UAAU,iBAAiB;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAID;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,wBAAwB,GAAG,YAAY,CAgDvF"}
+{"version":3,"file":"better-auth-provider.d.ts","sourceRoot":"","sources":["../../src/auth/better-auth-provider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAe,QAAQ,EAAE,MAAM,YAAY,CAAC;AAEtE,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,OAAO,CAAC;QAAE,WAAW,EAAE;YAAE,YAAY,EAAE;gBAAE,IAAI,EAAE,MAAM,CAAA;aAAE,CAAA;SAAE,CAAA;KAAE,CAAC,CAAC;IACxE,GAAG,EAAE;QACH,UAAU,EAAE,CAAC,OAAO,EAAE;YAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;SAAE,KAAK,OAAO,CAAC;YACrE,OAAO,CAAC,EAAE,iBAAiB,GAAG,IAAI,CAAC;YACnC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;SACvC,GAAG,IAAI,CAAC,CAAC;QACV,aAAa,EAAE,CAAC,OAAO,EAAE;YACvB,IAAI,EAAE;gBAAE,KAAK,EAAE,MAAM,CAAA;aAAE,CAAC;YACxB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;SACjC,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;QACvB,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE;YAAE,IAAI,EAAE;gBAAE,KAAK,EAAE,MAAM,CAAC;gBAAC,QAAQ,EAAE,MAAM,CAAA;aAAE,CAAA;SAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;QAC3F,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;SAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;QAC/E,YAAY,CAAC,EACT,CAAC,CAAC,OAAO,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;SAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC,GAClE,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG;YAClB,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE;gBAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;aAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;SAC9E,CAAC,CAAC;KACR,CAAC;IACF,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;CACnD;AAED,MAAM,WAAW,wBAAwB,CAAC,KAAK,SAAS,QAAQ,GAAG,QAAQ;IACzE,kCAAkC;IAClC,IAAI,EAAE,gBAAgB,CAAC;IACvB,uCAAuC;IACvC,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,KAAK,CAAC;IACnD,2FAA2F;IAC3F,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,UAAU,iBAAiB;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAID;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,SAAS,QAAQ,EAC7D,MAAM,EAAE,wBAAwB,CAAC,KAAK,CAAC,GAAG;IACxC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,KAAK,CAAC;CACnD,GACA,YAAY,CAAC,KAAK,CAAC,CAAC;AACvB,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,wBAAwB,CAAC,QAAQ,CAAC,GACzC,YAAY,CAAC,QAAQ,CAAC,CAAC"}

package/dist/auth/better-auth-provider.js

@@ -1,9 +1,7 @@
-const DEFAULT_COOKIE_NAME = 'session';
-/**
- * Wrap better-auth as a Glasswork AuthProvider.
- */
+const DEFAULT_COOKIE_NAME = 'better-auth.session_token';
 export function createBetterAuthProvider(config) {
-    const { auth, mapUser, cookieName = DEFAULT_COOKIE_NAME } = config;
+    const { auth, mapUser, cookieName } = config;
+    const getSessionCookieName = async () => cookieName ?? (await auth.$context)?.authCookies.sessionToken.name ?? DEFAULT_COOKIE_NAME;
     const defaultMapUser = (user) => ({
         ...user,
         id: String(user.id ?? user.userId ?? ''),
@@ -13,10 +11,12 @@ export function createBetterAuthProvider(config) {
     });
     return {
         name: 'better-auth',
+        sessionCookieName: cookieName ?? DEFAULT_COOKIE_NAME,
+        getSessionCookieName,
         async validateSession(token) {
             try {
                 const result = await auth.api.getSession({
-                    headers: { cookie: `${cookieName}=${token}` },
+                    headers: { cookie: `${await getSessionCookieName()}=${token}` },
                 });
                 if (!result?.session || !result.user) {
                     return null;
@@ -30,13 +30,19 @@ export function createBetterAuthProvider(config) {
                 return null;
             }
         },
-        async invalidateSession(sessionId) {
-            await auth.api.revokeSession({ body: { id: sessionId } });
+        async invalidateSession(token) {
+            const headers = { cookie: `${await getSessionCookieName()}=${token}` };
+            const result = await auth.api.getSession({ headers });
+            const sessionToken = result?.session?.token;
+            if (typeof sessionToken !== 'string' || sessionToken.length === 0) {
+                return;
+            }
+            await auth.api.revokeSession({ body: { token: sessionToken }, headers });
         },
         async refreshSession(token) {
             try {
                 const result = await auth.api.getSession({
-                    headers: { cookie: `${cookieName}=${token}` },
+                    headers: { cookie: `${await getSessionCookieName()}=${token}` },
                 });
                 return result?.session ? mapSession(result.session) : null;
             }
@@ -53,6 +59,7 @@ function mapSession(session) {
         expiresAt: toDate(session.expiresAt),
         createdAt: toDate(session.createdAt),
         lastAccessedAt: session.lastAccessedAt ? toDate(session.lastAccessedAt) : undefined,
+        impersonatedBy: typeof session.impersonatedBy === 'string' ? session.impersonatedBy : undefined,
         metadata: session,
     };
 }

package/dist/auth/better-auth-provider.js.map

@@ -1 +1 @@
-{"version":3,"file":"better-auth-provider.js","sourceRoot":"","sources":["../../src/auth/better-auth-provider.ts"],"names":[],"mappings":"AAuCA,MAAM,mBAAmB,GAAG,SAAS,CAAC;AAEtC;;GAEG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAAgC;IACvE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,GAAG,mBAAmB,EAAE,GAAG,MAAM,CAAC;IAEnE,MAAM,cAAc,GAAG,CAAC,IAA6B,EAAY,EAAE,CAAC,CAAC;QACnE,GAAG,IAAI;QACP,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;QACxC,KAAK,EAAE,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;QAC9D,IAAI,EAAG,IAAI,CAAC,IAAe,IAAI,MAAM;QACrC,QAAQ,EAAG,IAAI,CAAC,QAA+B,IAAK,IAAI,CAAC,cAAqC;KAC/F,CAAC,CAAC;IAEH,OAAO;QACL,IAAI,EAAE,aAAa;QAEnB,KAAK,CAAC,eAAe,CAAC,KAAa;YACjC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;oBACvC,OAAO,EAAE,EAAE,MAAM,EAAE,GAAG,UAAU,IAAI,KAAK,EAAE,EAAE;iBAC9C,CAAC,CAAC;gBAEH,IAAI,CAAC,MAAM,EAAE,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;oBACrC,OAAO,IAAI,CAAC;gBACd,CAAC;gBAED,OAAO;oBACL,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC;oBACnC,IAAI,EAAE,CAAC,OAAO,IAAI,cAAc,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;iBAC/C,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,KAAK,CAAC,iBAAiB,CAAC,SAAiB;YACvC,MAAM,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;QAC5D,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,KAAa;YAChC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;oBACvC,OAAO,EAAE,EAAE,MAAM,EAAE,GAAG,UAAU,IAAI,KAAK,EAAE,EAAE;iBAC9C,CAAC,CAAC;gBACH,OAAO,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAC7D,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,OAA0B;IAC5C,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QACtB,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;QAC9B,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;QACpC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;QACpC,cAAc,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS;QACnF,QAAQ,EAAE,OAAO;KAClB,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,KAAoB;IAClC,OAAO,KAAK,YAAY,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;AACzD,CAAC"}
+{"version":3,"file":"better-auth-provider.js","sourceRoot":"","sources":["../../src/auth/better-auth-provider.ts"],"names":[],"mappings":"AA2CA,MAAM,mBAAmB,GAAG,2BAA2B,CAAC;AAaxD,MAAM,UAAU,wBAAwB,CACtC,MAA0C;IAE1C,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC;IAC7C,MAAM,oBAAoB,GAAG,KAAK,IAAqB,EAAE,CACvD,UAAU,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC,YAAY,CAAC,IAAI,IAAI,mBAAmB,CAAC;IAE5F,MAAM,cAAc,GAAG,CAAC,IAA6B,EAAY,EAAE,CAAC,CAAC;QACnE,GAAG,IAAI;QACP,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;QACxC,KAAK,EAAE,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;QAC9D,IAAI,EAAG,IAAI,CAAC,IAAe,IAAI,MAAM;QACrC,QAAQ,EAAG,IAAI,CAAC,QAA+B,IAAK,IAAI,CAAC,cAAqC;KAC/F,CAAC,CAAC;IAEH,OAAO;QACL,IAAI,EAAE,aAAa;QACnB,iBAAiB,EAAE,UAAU,IAAI,mBAAmB;QACpD,oBAAoB;QAEpB,KAAK,CAAC,eAAe,CAAC,KAAa;YACjC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;oBACvC,OAAO,EAAE,EAAE,MAAM,EAAE,GAAG,MAAM,oBAAoB,EAAE,IAAI,KAAK,EAAE,EAAE;iBAChE,CAAC,CAAC;gBAEH,IAAI,CAAC,MAAM,EAAE,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;oBACrC,OAAO,IAAI,CAAC;gBACd,CAAC;gBAED,OAAO;oBACL,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC;oBACnC,IAAI,EAAE,CAAC,OAAO,IAAI,cAAc,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;iBAC/C,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,KAAK,CAAC,iBAAiB,CAAC,KAAa;YACnC,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,oBAAoB,EAAE,IAAI,KAAK,EAAE,EAAE,CAAC;YACvE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;YACtD,MAAM,YAAY,GAAG,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;YAE5C,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAClE,OAAO;YACT,CAAC;YAED,MAAM,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QAC3E,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,KAAa;YAChC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;oBACvC,OAAO,EAAE,EAAE,MAAM,EAAE,GAAG,MAAM,oBAAoB,EAAE,IAAI,KAAK,EAAE,EAAE;iBAChE,CAAC,CAAC;gBACH,OAAO,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAC7D,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,OAA0B;IAC5C,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QACtB,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;QAC9B,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;QACpC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;QACpC,cAAc,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS;QACnF,cAAc,EAAE,OAAO,OAAO,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS;QAC/F,QAAQ,EAAE,OAAO;KAClB,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,KAAoB;IAClC,OAAO,KAAK,YAAY,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;AACzD,CAAC"}

package/dist/auth/index.d.ts

@@ -2,6 +2,6 @@ export { createAbilityFactory, defineRoleAbilities, type InferAbility, } from '.
 export { assertCan, can, subject } from './assert.js';
 export { type BetterAuthClient, type BetterAuthProviderConfig, createBetterAuthProvider, } from './better-auth-provider.js';
 export { type PrismaAbilityFactory, registerAuthCasl } from './casl-bridge.js';
-export { type AuthMiddlewareConfig, createAuthMiddleware, } from './middleware.js';
-export type { AuthContext, AuthProvider, AuthSession, AuthUser } from './types.js';
+export { type AuthAuthorizeConfig, type AuthMiddleware, type AuthMiddlewareConfig, createAuthMiddleware, } from './middleware.js';
+export type { AuthContext, AuthenticatedAuthContext, AuthProvider, AuthSession, AuthUser, } from './types.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,KAAK,YAAY,GAClB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EACL,KAAK,gBAAgB,EACrB,KAAK,wBAAwB,EAC7B,wBAAwB,GACzB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,KAAK,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAE/E,OAAO,EACL,KAAK,oBAAoB,EACzB,oBAAoB,GACrB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,KAAK,YAAY,GAClB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EACL,KAAK,gBAAgB,EACrB,KAAK,wBAAwB,EAC7B,wBAAwB,GACzB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,KAAK,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAE/E,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,KAAK,oBAAoB,EACzB,oBAAoB,GACrB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,WAAW,EACX,wBAAwB,EACxB,YAAY,EACZ,WAAW,EACX,QAAQ,GACT,MAAM,YAAY,CAAC"}

package/dist/auth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,mBAAmB,GAEpB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAGL,wBAAwB,GACzB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAA6B,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAE/E,OAAO,EAEL,oBAAoB,GACrB,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,mBAAmB,GAEpB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAGL,wBAAwB,GACzB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAA6B,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAE/E,OAAO,EAIL,oBAAoB,GACrB,MAAM,iBAAiB,CAAC"}