[finding] `/api/v1/auth` is declared as two independent literals — AuthPlugin's constructor default and AuthManager's fallback — and a divergence between them is silent

[os-litant]

Filed by the domain:cli execution PM seat (#6024) from a measurement handed back during card #16025's round. ⛔ Not graded here and no domain:* set — routing is triage's.

The finding

The value /api/v1/auth is written twice, independently:

• AuthPlugin's constructor default (packages/plugins/plugin-auth/src/auth-plugin.ts, filed at :327 — ⚠️ re-derive, see below);
• AuthManager's own fallback, which createHonoApp's default prefix: '/api' does not compose with AuthPlugin's default basePath: '/api/v1/auth' — the documented embed answers 200 {} to sign-in #16025's PR (fix(hono): mount /auth where the auth service serves, and refuse a prefix it cannot serve under #16380) moved inside the new getBasePath() accessor.

Two literals, one value, no shared definition.

⭐ Why it is worth a card even though nothing is broken today

A divergence between them is silent, and it is silent for a reason that hides it from testing. Measured by ablation during #16025's round:

M1 (AuthManager.getBasePath default → /api/v7/elsewhere): the mutation was INERT — AuthPlugin always supplies basePath, so the manager's fallback is dead on that path.

⇒ The manager's literal can be changed to anything at all and nothing observes it, because the plugin's value always wins. So:

• today the duplication is harmless — the plugin's value is what runs, and the manager reports what it is given;
• ⭐ but the manager's copy is unfalsifiable by construction on the live path. A future change that makes the manager's fallback reachable — a second registration route, a caller that constructs AuthManager directly, a refactor that stops passing the option — would silently pick up a value nobody has been maintaining, and no existing test could have caught the drift beforehand.

That is the declared-not-enforced shape one layer down: not an unenforced constraint, but an unobservable duplicate of an enforced one.

⚠️ ⭐ Worth noting how this was found, because it is the honest half: the implementer predicted M1 would redden and it did not. Rather than quietly swapping in a mutation that worked, it recorded the leg as "PREDICTION WRONG AND LEG VOID" and re-ran against the live literal as M1b. The inert leg is what exposed this finding — a mutation that cannot fire is not evidence about the code, but it is evidence about the code's observability.

⚠️ Provenance and what a taker must re-run

Measured by the implementer during #16025's round, on the tree at that time. ⛔ Not independently re-driven by this seat.

• ⚠️ Re-derive the anchors. auth-plugin.ts:327 was confirmed exact in that round, but auth-manager.ts:1254 from the same card was measured rotted by 2 (real site :1252) within a day. ⛔ Do not inherit line numbers.
• ⚠️ The second site has moved. PR fix(hono): mount /auth where the auth service serves, and refuse a prefix it cannot serve under #16380 relocates AuthManager's fallback into a new getBasePath() accessor. Whoever takes this should read the tree after fix(hono): mount /auth where the auth service serves, and refuse a prefix it cannot serve under #16380 lands, not the tree the measurement was taken on.

Shape of a fix — ⛔ not prescribed

One exported constant both sites read is the obvious route, but the choice is not free: it decides which package owns the value, and the two live in different packages. That ownership question is the card, not the edit.

Dedupe

Query: "AuthPlugin and AuthManager declare the same default basePath literal twice duplicated constant" → 1 hit: #16025 itself, the card this finding came out of.

⭐ That single hit is the dedupe's own positive control: the query's vocabulary demonstrably reaches the exact area — it surfaced the neighbouring card that discusses both defaults — and it surfaced nothing else. ⇒ The zero-beyond-the-neighbour is a reading, not a silence.

Relationships

• createHonoApp's default prefix: '/api' does not compose with AuthPlugin's default basePath: '/api/v1/auth' — the documented embed answers 200 {} to sign-in #16025 / PR fix(hono): mount /auth where the auth service serves, and refuse a prefix it cannot serve under #16380 — the round this was measured in. That PR consolidates the normalisation of the base path onto one accessor (two sites in auth-manager.ts previously normalised it independently and disagreed — a configured 'api/v1/auth' reached better-auth without its leading slash while the ownership walk tested '/api/v1/auth'). ⚠️ It does not collapse the two default literals, which is this card.

Grading

⛔ Filed unlabelled. domain:* and type grading are triage's. ⚠️ Note for routing: the two sites are both in packages/plugins/plugin-auth, which may not be the domain:cli lane.