@archlast/server 0.0.1

package/dist/auth/better-auth-adapter.js

@@ -0,0 +1,460 @@
+"use strict";
+/**
+ * Better-Auth Database Adapter for Archlast
+ *
+ * This adapter maps Better-Auth operations to Archlast's IDatabaseClient.
+ * It handles:
+ * - Key mapping: id <-> _id (Better-Auth uses id, Archlast uses _id)
+ * - Table name mapping: user <-> system_auth_user, session <-> system_auth_session, etc.
+ * - Where clause transformation
+ * - Transaction support
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createArchlastBetterAuthAdapter = createArchlastBetterAuthAdapter;
+exports.archlastBetterAuthAdapter = archlastBetterAuthAdapter;
+const adapters_1 = require("better-auth/adapters");
+/**
+ * Mapping from Better-Auth model names to Archlast collection names
+ */
+const MODEL_TO_COLLECTION = {
+    user: "system_auth_user",
+    session: "system_auth_session",
+    account: "system_auth_account",
+    verification: "system_auth_verification",
+    // Organization plugin tables
+    organization: "system_auth_organization",
+    member: "system_auth_member",
+    invitation: "system_auth_invitation",
+    // API Key plugin table
+    apiKey: "system_auth_api_key",
+};
+/**
+ * Mapping from Archlast collection names to Better-Auth model names
+ */
+const COLLECTION_TO_MODEL = {
+    "system_auth_user": "user",
+    "system_auth_session": "session",
+    "system_auth_account": "account",
+    "system_auth_verification": "verification",
+    // Organization plugin tables
+    "system_auth_organization": "organization",
+    "system_auth_member": "member",
+    "system_auth_invitation": "invitation",
+    // API Key plugin table
+    "system_auth_api_key": "apiKey",
+};
+/**
+ * Field name mappings for Better-Auth
+ * Maps Better-Auth field names to Archlast field names
+ */
+const FIELD_MAPPINGS = {
+    // Better-Auth uses 'id', Archlast uses '_id'
+    id: "_id",
+    userId: "userId",
+    sessionId: "sessionId",
+    accountId: "accountId",
+    // Organization plugin fields
+    organizationId: "organizationId",
+};
+/**
+ * Reverse field name mappings
+ */
+const REVERSE_FIELD_MAPPINGS = {
+    _id: "id",
+};
+/**
+ * Convert Better-Auth where clause to Archlast query builder format
+ *
+ * Better-Auth can pass where clauses in two formats:
+ * 1. Array format: [{ field: "email", value: "..." }, { field: "id", value: "...", operator: "gt" }]
+ * 2. Object format (already transformed by factory): { email: "test@example.com", _id: "123" }
+ *
+ * Archlast format: { email: "...", _id: "...", age: { gt: 18 } }
+ */
+function whereClauseToQueryFormat(where) {
+    if (!where) {
+        return {};
+    }
+    // If where is already an object (not an array), it's been transformed by the factory
+    // Just map the id -> _id field if present
+    if (!Array.isArray(where)) {
+        const result = {};
+        for (const [key, value] of Object.entries(where)) {
+            // Map field names (e.g., "id" -> "_id")
+            const field = key in FIELD_MAPPINGS
+                ? FIELD_MAPPINGS[key]
+                : key;
+            result[field] = value;
+        }
+        return result;
+    }
+    // Handle array format (original Better-Auth format)
+    if (where.length === 0) {
+        return {};
+    }
+    const result = {};
+    for (const clause of where) {
+        if (!clause.field || clause.value === undefined) {
+            continue;
+        }
+        // Map field names (e.g., "id" -> "_id")
+        const field = clause.field in FIELD_MAPPINGS
+            ? FIELD_MAPPINGS[clause.field]
+            : clause.field;
+        const operator = clause.operator;
+        if (operator === "in") {
+            result[field] = { in: clause.value };
+        }
+        else if (operator === "ne") {
+            result[field] = { ne: clause.value };
+        }
+        else if (operator === "gt") {
+            result[field] = { gt: clause.value };
+        }
+        else if (operator === "gte") {
+            result[field] = { gte: clause.value };
+        }
+        else if (operator === "lt") {
+            result[field] = { lt: clause.value };
+        }
+        else if (operator === "lte") {
+            result[field] = { lte: clause.value };
+        }
+        else if (operator === "contains") {
+            result[field] = { contains: clause.value };
+        }
+        else if (operator === "starts") {
+            result[field] = { startsWith: clause.value };
+        }
+        else if (operator === "ends") {
+            result[field] = { endsWith: clause.value };
+        }
+        else {
+            // Default: equality (no operator or "eq")
+            result[field] = clause.value;
+        }
+    }
+    return result;
+}
+/**
+ * Transform data object from Better-Auth format to Archlast format
+ *
+ * NOTE: Better-Auth's createAdapterFactory applies mapKeysTransformInput and
+ * mapKeysTransformOutput BEFORE calling our adapter methods. So the data we
+ * receive already has 'id' → '_id' mapping applied. We don't need to do it again.
+ *
+ * We preserve Date objects - v.datetime() returns z.date() which handles Date objects.
+ */
+function transformInputData(data) {
+    // Better-Auth factory already applies key mapping via mapKeysTransformInput
+    // So we just pass through the data as-is
+    return data;
+}
+/**
+ * Transform data object from Archlast format to Better-Auth format
+ *
+ * NOTE: Better-Auth's createAdapterFactory applies mapKeysTransformOutput
+ * AFTER our adapter methods return. So we should return data with '_id' key
+ * and let the factory convert it to 'id'.
+ *
+ * We preserve Date objects - v.datetime() returns z.date() which handles Date objects.
+ */
+function transformOutputData(data) {
+    // Better-Auth factory applies mapKeysTransformOutput: { _id: "id" }
+    // So we just return the data as-is with '_id' key
+    // The factory will convert '_id' → 'id' for us
+    return data;
+}
+/**
+ * Transform array of records from Archlast format to Better-Auth format
+ */
+function transformOutputArray(records) {
+    if (!records || !Array.isArray(records)) {
+        return records;
+    }
+    return records.map(transformOutputData);
+}
+/**
+ * Convert Better-Auth sort clause to Archlast orderBy format
+ */
+function transformSortClause(sortBy) {
+    if (!sortBy)
+        return undefined;
+    const field = sortBy.field in FIELD_MAPPINGS
+        ? FIELD_MAPPINGS[sortBy.field]
+        : sortBy.field;
+    return {
+        [field]: sortBy.direction === "desc" ? "desc" : "asc",
+    };
+}
+/**
+ * Get Archlast collection name from Better-Auth model name
+ */
+function getCollectionName(model) {
+    return MODEL_TO_COLLECTION[model] || model;
+}
+/**
+ * Debug logger for adapter operations
+ */
+function debugLog(enabled, operation, data) {
+    if (enabled) {
+        console.error(`[Better-Auth Adapter] ${operation}:`, JSON.stringify(data, null, 2));
+    }
+}
+/**
+ * Wrap an adapter method with error handling and debug logging
+ */
+function withErrorHandling(operation, debugEnabled, fn) {
+    return (async function (...args) {
+        try {
+            if (debugEnabled) {
+                debugLog(debugEnabled, `${operation} - start`, { args });
+            }
+            const result = await fn(...args);
+            if (debugEnabled) {
+                debugLog(debugEnabled, `${operation} - success`, { result });
+            }
+            return result;
+        }
+        catch (error) {
+            debugLog(debugEnabled, `${operation} - error`, {
+                error: error instanceof Error ? error.message : String(error),
+                args,
+            });
+            throw new Error(`Better-Auth adapter error in ${operation}: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    });
+}
+/**
+ * Create a Better-Auth adapter factory for Archlast
+ * @param db The database client instance
+ * @param config Optional configuration
+ */
+function createArchlastBetterAuthAdapter(db, config = {}) {
+    return (0, adapters_1.createAdapterFactory)({
+        config: {
+            adapterId: "archlast",
+            adapterName: "Archlast Better-Auth Adapter",
+            usePlural: false,
+            debugLogs: config.debugLogs ?? false,
+            // Key mapping for input (Better-Auth -> Archlast)
+            mapKeysTransformInput: {
+                id: "_id",
+            },
+            // Key mapping for output (Archlast -> Better-Auth)
+            mapKeysTransformOutput: {
+                _id: "id",
+            },
+            // Archlast supports JSON in SQLite (stored as strings, parsed on read)
+            supportsJSON: true,
+            // Archlast uses v.datetime() which returns z.date() - Date objects
+            supportsDates: true,
+            // Archlast supports booleans (stored as 0/1 in SQLite, converted)
+            supportsBooleans: true,
+            // Transaction support - disabled for now.
+            // When set to false, Better Auth runs operations sequentially.
+            // Setting this to a function would require passing a TransactionAdapter
+            // with all adapter methods, which getCurrentAdapter expects.
+            transaction: false,
+        },
+        adapter: ({ options, getFieldName, getModelName, transformWhereClause }) => {
+            const debugEnabled = config.debugLogs ?? false;
+            // Use factory's transformWhereClause if available, otherwise use our own
+            const transformWhere = (where) => {
+                // Better-Auth factory provides transformWhereClause to handle where clause transformation
+                if (transformWhereClause && typeof transformWhereClause === 'function') {
+                    try {
+                        const transformed = transformWhereClause(where);
+                        if (debugEnabled) {
+                            debugLog(true, "transformWhereClause (factory)", { input: where, output: transformed });
+                        }
+                        if (transformed)
+                            return transformed;
+                    }
+                    catch (e) {
+                        // Fall through to our implementation
+                        if (debugEnabled) {
+                            debugLog(true, "transformWhereClause failed, using fallback", { error: String(e) });
+                        }
+                    }
+                }
+                // Fallback to our own implementation
+                return whereClauseToQueryFormat(where) || {};
+            };
+            return {
+                options: config,
+                /**
+                 * Create a new record
+                 */
+                create: withErrorHandling("create", debugEnabled, async ({ model, data }) => {
+                    const collection = getCollectionName(getModelName(model));
+                    const inputData = transformInputData(data);
+                    const id = await db.insert(collection, inputData);
+                    // Fetch and return the created record
+                    const record = await db.query(collection)
+                        .where({ _id: id })
+                        .findFirst();
+                    return transformOutputData(record);
+                }),
+                /**
+                 * Find a single record
+                 */
+                findOne: withErrorHandling("findOne", debugEnabled, async ({ model, where, join }) => {
+                    const collection = getCollectionName(getModelName(model));
+                    // Debug: log raw where clause format
+                    if (debugEnabled) {
+                        debugLog(true, "findOne - raw where", { model, collection, where, whereType: Array.isArray(where) ? 'array' : typeof where });
+                    }
+                    const queryWhere = transformWhere(where);
+                    if (debugEnabled) {
+                        debugLog(true, "findOne - transformed where", { queryWhere });
+                    }
+                    // For now, we don't support native joins
+                    // Better-Auth will handle joins if we return false for supportsJoin
+                    // STRATEGY: Try findFirst first, if it returns null and we have a where clause,
+                    // fall back to findMany + filter in memory (more reliable)
+                    let record = await db.query(collection)
+                        .where(queryWhere)
+                        .findFirst();
+                    // If findFirst returned null but we have a where clause, try findMany as fallback
+                    if (!record && queryWhere && Object.keys(queryWhere).length > 0) {
+                        if (debugEnabled) {
+                            debugLog(true, "findOne - findFirst returned null, trying findMany fallback", { queryWhere });
+                        }
+                        const allRecords = await db.query(collection).findMany();
+                        if (debugEnabled) {
+                            debugLog(true, "findOne - findMany result", {
+                                recordCount: allRecords?.length || 0,
+                                hasRecords: !!allRecords,
+                                sample: allRecords?.slice(0, 2).map((r) => ({
+                                    id: r._id || r.id,
+                                    username: r.username,
+                                    email: r.email
+                                }))
+                            });
+                        }
+                        // Filter in memory
+                        record = allRecords?.find((r) => {
+                            // Simple equality check for each field in queryWhere
+                            for (const [key, value] of Object.entries(queryWhere)) {
+                                if (r[key] !== value) {
+                                    return false;
+                                }
+                            }
+                            return true;
+                        });
+                        if (debugEnabled && record) {
+                            debugLog(true, "findOne - found record via findMany fallback", { record });
+                        }
+                        else if (debugEnabled) {
+                            debugLog(true, "findOne - no matching record found in findMany result", {
+                                queryWhere,
+                                totalRecords: allRecords?.length || 0
+                            });
+                        }
+                    }
+                    return transformOutputData(record);
+                }),
+                /**
+                 * Find multiple records
+                 */
+                findMany: withErrorHandling("findMany", debugEnabled, async ({ model, where, limit, offset, sortBy }) => {
+                    const collection = getCollectionName(getModelName(model));
+                    const queryWhere = transformWhere(where || []);
+                    let query = db.query(collection);
+                    if (Object.keys(queryWhere).length > 0) {
+                        query = query.where(queryWhere);
+                    }
+                    if (sortBy) {
+                        const sort = transformSortClause(sortBy);
+                        query = query.orderBy(sort);
+                    }
+                    if (offset !== undefined) {
+                        query = query.skip(offset);
+                    }
+                    if (limit !== undefined) {
+                        query = query.take(limit);
+                    }
+                    const records = await query.findMany();
+                    return transformOutputArray(records);
+                }),
+                /**
+                 * Count records
+                 */
+                count: withErrorHandling("count", debugEnabled, async ({ model, where }) => {
+                    const collection = getCollectionName(getModelName(model));
+                    const queryWhere = transformWhere(where || []);
+                    if (Object.keys(queryWhere).length === 0) {
+                        return db.query(collection).count();
+                    }
+                    return db.query(collection)
+                        .where(queryWhere)
+                        .count();
+                }),
+                /**
+                 * Update a single record (returns the updated record)
+                 */
+                update: withErrorHandling("update", debugEnabled, async ({ model, where, update }) => {
+                    const collection = getCollectionName(getModelName(model));
+                    const queryWhere = transformWhere(where || []);
+                    const updateData = transformInputData(update);
+                    // First find the record
+                    const record = await db.query(collection)
+                        .where(queryWhere)
+                        .findFirst();
+                    if (!record) {
+                        return null;
+                    }
+                    // Update it
+                    await db.update(collection, record._id, updateData);
+                    // Fetch and return updated record
+                    const updated = await db.query(collection)
+                        .where({ _id: record._id })
+                        .findFirst();
+                    return transformOutputData(updated);
+                }),
+                /**
+                 * Update multiple records (returns the count)
+                 */
+                updateMany: withErrorHandling("updateMany", debugEnabled, async ({ model, where, update }) => {
+                    const collection = getCollectionName(getModelName(model));
+                    const queryWhere = transformWhere(where || []);
+                    const updateData = transformInputData(update);
+                    const affected = await db.updateMany(collection, queryWhere, updateData);
+                    return affected;
+                }),
+                /**
+                 * Delete a single record
+                 * Optimized: Uses deleteMany directly with where clause (1 DB call instead of 2)
+                 */
+                delete: withErrorHandling("delete", debugEnabled, async ({ model, where }) => {
+                    const collection = getCollectionName(getModelName(model));
+                    const queryWhere = transformWhere(where || []);
+                    // Use deleteMany directly - more efficient than find + delete
+                    // The where clause should uniquely identify the record (usually by id or email)
+                    await db.deleteMany(collection, queryWhere);
+                }),
+                /**
+                 * Delete multiple records
+                 */
+                deleteMany: withErrorHandling("deleteMany", debugEnabled, async ({ model, where }) => {
+                    const collection = getCollectionName(getModelName(model));
+                    const queryWhere = transformWhere(where || []);
+                    return db.deleteMany(collection, queryWhere);
+                }),
+            };
+        },
+    });
+}
+/**
+ * Create the Better-Auth adapter with a database instance
+ *
+ * Returns the adapter factory directly - Better-Auth knows how to handle this.
+ * Do NOT wrap or modify the factory result, as this breaks Better-Auth's
+ * internal getCurrentAdapter function.
+ */
+function archlastBetterAuthAdapter(db, config = {}) {
+    // Return the factory directly - Better-Auth expects this format
+    return createArchlastBetterAuthAdapter(db, config);
+}
+//# sourceMappingURL=better-auth-adapter.js.map

package/dist/auth/better-auth-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"better-auth-adapter.js","sourceRoot":"","sources":["../../src/auth/better-auth-adapter.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;AA6QH,0EA+QC;AASD,8DAMC;AAziBD,mDAA4D;AAa5D;;GAEG;AACH,MAAM,mBAAmB,GAAG;IACxB,IAAI,EAAE,kBAAkB;IACxB,OAAO,EAAE,qBAAqB;IAC9B,OAAO,EAAE,qBAAqB;IAC9B,YAAY,EAAE,0BAA0B;IACxC,6BAA6B;IAC7B,YAAY,EAAE,0BAA0B;IACxC,MAAM,EAAE,oBAAoB;IAC5B,UAAU,EAAE,wBAAwB;IACpC,uBAAuB;IACvB,MAAM,EAAE,qBAAqB;CACvB,CAAC;AAEX;;GAEG;AACH,MAAM,mBAAmB,GAAG;IACxB,kBAAkB,EAAE,MAAM;IAC1B,qBAAqB,EAAE,SAAS;IAChC,qBAAqB,EAAE,SAAS;IAChC,0BAA0B,EAAE,cAAc;IAC1C,6BAA6B;IAC7B,0BAA0B,EAAE,cAAc;IAC1C,oBAAoB,EAAE,QAAQ;IAC9B,wBAAwB,EAAE,YAAY;IACtC,uBAAuB;IACvB,qBAAqB,EAAE,QAAQ;CACzB,CAAC;AAEX;;;GAGG;AACH,MAAM,cAAc,GAAG;IACnB,6CAA6C;IAC7C,EAAE,EAAE,KAAK;IACT,MAAM,EAAE,QAAQ;IAChB,SAAS,EAAE,WAAW;IACtB,SAAS,EAAE,WAAW;IACtB,6BAA6B;IAC7B,cAAc,EAAE,gBAAgB;CAC1B,CAAC;AAEX;;GAEG;AACH,MAAM,sBAAsB,GAAG;IAC3B,GAAG,EAAE,IAAI;CACH,CAAC;AAwBX;;;;;;;;GAQG;AACH,SAAS,wBAAwB,CAAC,KAAU;IACxC,IAAI,CAAC,KAAK,EAAE,CAAC;QACT,OAAO,EAAE,CAAC;IACd,CAAC;IAED,qFAAqF;IACrF,0CAA0C;IAC1C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,MAAM,GAAwB,EAAE,CAAC;QACvC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/C,wCAAwC;YACxC,MAAM,KAAK,GAAG,GAAG,IAAI,cAAc;gBAC/B,CAAC,CAAC,cAAc,CAAC,GAAkC,CAAC;gBACpD,CAAC,CAAC,GAAG,CAAC;YACV,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC;QAC1B,CAAC;QACD,OAAO,MAAM,CAAC;IAClB,CAAC;IAED,oDAAoD;IACpD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO,EAAE,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAwB,EAAE,CAAC;IACvC,KAAK,MAAM,MAAM,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC9C,SAAS;QACb,CAAC;QAED,wCAAwC;QACxC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,cAAc;YACxC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,KAAoC,CAAC;YAC7D,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;QAEnB,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAEjC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACpB,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;QACzC,CAAC;aAAM,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YAC3B,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;QACzC,CAAC;aAAM,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YAC3B,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;QACzC,CAAC;aAAM,IAAI,QAAQ,KAAK,KAAK,EAAE,CAAC;YAC5B,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;QAC1C,CAAC;aAAM,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YAC3B,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;QACzC,CAAC;aAAM,IAAI,QAAQ,KAAK,KAAK,EAAE,CAAC;YAC5B,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;QAC1C,CAAC;aAAM,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;YACjC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;QAC/C,CAAC;aAAM,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC/B,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,UAAU,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;QACjD,CAAC;aAAM,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;YAC7B,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;QAC/C,CAAC;aAAM,CAAC;YACJ,0CAA0C;YAC1C,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC;QACjC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,kBAAkB,CAAC,IAAS;IACjC,4EAA4E;IAC5E,yCAAyC;IACzC,OAAO,IAAI,CAAC;AAChB,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,mBAAmB,CAAC,IAAS;IAClC,oEAAoE;IACpE,kDAAkD;IAClD,+CAA+C;IAC/C,OAAO,IAAI,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,SAAS,oBAAoB,CAAC,OAAc;IACxC,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACtC,OAAO,OAAO,CAAC;IACnB,CAAC;IACD,OAAO,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;AAC5C,CAAC;AAED;;GAEG;AACH,SAAS,mBAAmB,CAAC,MAAW;IACpC,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAE9B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,cAAc;QACxC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,KAAoC,CAAC;QAC7D,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;IAEnB,OAAO;QACH,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK;KACxD,CAAC;AACN,CAAC;AAED;;GAEG;AACH,SAAS,iBAAiB,CAAC,KAAa;IACpC,OAAO,mBAAmB,CAAC,KAAyC,CAAC,IAAI,KAAK,CAAC;AACnF,CAAC;AAED;;GAEG;AACH,SAAS,QAAQ,CAAC,OAAgB,EAAE,SAAiB,EAAE,IAAS;IAC5D,IAAI,OAAO,EAAE,CAAC;QACV,OAAO,CAAC,KAAK,CAAC,yBAAyB,SAAS,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACxF,CAAC;AACL,CAAC;AAED;;GAEG;AACH,SAAS,iBAAiB,CACtB,SAAiB,EACjB,YAAqB,EACrB,EAAK;IAEL,OAAO,CAAC,KAAK,WAAW,GAAG,IAAW;QAClC,IAAI,CAAC;YACD,IAAI,YAAY,EAAE,CAAC;gBACf,QAAQ,CAAC,YAAY,EAAE,GAAG,SAAS,UAAU,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YAC7D,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;YACjC,IAAI,YAAY,EAAE,CAAC;gBACf,QAAQ,CAAC,YAAY,EAAE,GAAG,SAAS,YAAY,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;YACjE,CAAC;YACD,OAAO,MAAM,CAAC;QAClB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,QAAQ,CAAC,YAAY,EAAE,GAAG,SAAS,UAAU,EAAE;gBAC3C,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;gBAC7D,IAAI;aACP,CAAC,CAAC;YACH,MAAM,IAAI,KAAK,CACX,gCAAgC,SAAS,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACzG,CAAC;QACN,CAAC;IACL,CAAC,CAAM,CAAC;AACZ,CAAC;AAED;;;;GAIG;AACH,SAAgB,+BAA+B,CAC3C,EAAmB,EACnB,SAAkC,EAAE;IAGpC,OAAO,IAAA,+BAAoB,EAAC;QACxB,MAAM,EAAE;YACJ,SAAS,EAAE,UAAU;YACrB,WAAW,EAAE,8BAA8B;YAC3C,SAAS,EAAE,KAAK;YAChB,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,KAAK;YAEpC,kDAAkD;YAClD,qBAAqB,EAAE;gBACnB,EAAE,EAAE,KAAK;aACZ;YAED,mDAAmD;YACnD,sBAAsB,EAAE;gBACpB,GAAG,EAAE,IAAI;aACZ;YAED,uEAAuE;YACvE,YAAY,EAAE,IAAI;YAElB,mEAAmE;YACnE,aAAa,EAAE,IAAI;YAEnB,kEAAkE;YAClE,gBAAgB,EAAE,IAAI;YAEtB,0CAA0C;YAC1C,+DAA+D;YAC/D,wEAAwE;YACxE,6DAA6D;YAC7D,WAAW,EAAE,KAAK;SACrB;QACD,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,oBAAoB,EAAE,EAAE,EAAE;YACvE,MAAM,YAAY,GAAG,MAAM,CAAC,SAAS,IAAI,KAAK,CAAC;YAE/C,yEAAyE;YACzE,MAAM,cAAc,GAAG,CAAC,KAAU,EAAE,EAAE;gBAClC,0FAA0F;gBAC1F,IAAI,oBAAoB,IAAI,OAAO,oBAAoB,KAAK,UAAU,EAAE,CAAC;oBACrE,IAAI,CAAC;wBACD,MAAM,WAAW,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;wBAChD,IAAI,YAAY,EAAE,CAAC;4BACf,QAAQ,CAAC,IAAI,EAAE,gCAAgC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;wBAC5F,CAAC;wBACD,IAAI,WAAW;4BAAE,OAAO,WAAkC,CAAC;oBAC/D,CAAC;oBAAC,OAAO,CAAC,EAAE,CAAC;wBACT,qCAAqC;wBACrC,IAAI,YAAY,EAAE,CAAC;4BACf,QAAQ,CAAC,IAAI,EAAE,6CAA6C,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;wBACxF,CAAC;oBACL,CAAC;gBACL,CAAC;gBACD,qCAAqC;gBACrC,OAAO,wBAAwB,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YACjD,CAAC,CAAC;YAEF,OAAO;gBACH,OAAO,EAAE,MAAM;gBAEf;;mBAEG;gBACH,MAAM,EAAE,iBAAiB,CAAC,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE;oBACxE,MAAM,UAAU,GAAG,iBAAiB,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;oBAC1D,MAAM,SAAS,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;oBAE3C,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;oBAElD,sCAAsC;oBACtC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC;yBACpC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,EAAS,CAAC;yBACzB,SAAS,EAAE,CAAC;oBAEjB,OAAO,mBAAmB,CAAC,MAAM,CAAC,CAAC;gBACvC,CAAC,CAAC;gBAEF;;mBAEG;gBACH,OAAO,EAAE,iBAAiB,CAAC,SAAS,EAAE,YAAY,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE;oBACjF,MAAM,UAAU,GAAG,iBAAiB,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;oBAE1D,qCAAqC;oBACrC,IAAI,YAAY,EAAE,CAAC;wBACf,QAAQ,CAAC,IAAI,EAAE,qBAAqB,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC;oBAClI,CAAC;oBAED,MAAM,UAAU,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;oBAEzC,IAAI,YAAY,EAAE,CAAC;wBACf,QAAQ,CAAC,IAAI,EAAE,6BAA6B,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;oBAClE,CAAC;oBAED,yCAAyC;oBACzC,oEAAoE;oBAEpE,gFAAgF;oBAChF,2DAA2D;oBAC3D,IAAI,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC;yBAClC,KAAK,CAAC,UAAiB,CAAC;yBACxB,SAAS,EAAE,CAAC;oBAEjB,kFAAkF;oBAClF,IAAI,CAAC,MAAM,IAAI,UAAU,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBAC9D,IAAI,YAAY,EAAE,CAAC;4BACf,QAAQ,CAAC,IAAI,EAAE,6DAA6D,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;wBAClG,CAAC;wBAED,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE,CAAC;wBAEzD,IAAI,YAAY,EAAE,CAAC;4BACf,QAAQ,CAAC,IAAI,EAAE,2BAA2B,EAAE;gCACxC,WAAW,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;gCACpC,UAAU,EAAE,CAAC,CAAC,UAAU;gCACxB,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC;oCAC7C,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE;oCACjB,QAAQ,EAAE,CAAC,CAAC,QAAQ;oCACpB,KAAK,EAAE,CAAC,CAAC,KAAK;iCACjB,CAAC,CAAC;6BACN,CAAC,CAAC;wBACP,CAAC;wBAED,mBAAmB;wBACnB,MAAM,GAAG,UAAU,EAAE,IAAI,CAAC,CAAC,CAAM,EAAE,EAAE;4BACjC,qDAAqD;4BACrD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;gCACpD,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,KAAK,EAAE,CAAC;oCACnB,OAAO,KAAK,CAAC;gCACjB,CAAC;4BACL,CAAC;4BACD,OAAO,IAAI,CAAC;wBAChB,CAAC,CAAC,CAAC;wBAEH,IAAI,YAAY,IAAI,MAAM,EAAE,CAAC;4BACzB,QAAQ,CAAC,IAAI,EAAE,8CAA8C,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;wBAC/E,CAAC;6BAAM,IAAI,YAAY,EAAE,CAAC;4BACtB,QAAQ,CAAC,IAAI,EAAE,uDAAuD,EAAE;gCACpE,UAAU;gCACV,YAAY,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;6BACxC,CAAC,CAAC;wBACP,CAAC;oBACL,CAAC;oBAED,OAAO,mBAAmB,CAAC,MAAM,CAAC,CAAC;gBACvC,CAAC,CAAC;gBAEF;;mBAEG;gBACH,QAAQ,EAAE,iBAAiB,CAAC,UAAU,EAAE,YAAY,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE;oBACpG,MAAM,UAAU,GAAG,iBAAiB,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;oBAC1D,MAAM,UAAU,GAAG,cAAc,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;oBAE/C,IAAI,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;oBAEjC,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBACrC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,UAAiB,CAAC,CAAC;oBAC3C,CAAC;oBAED,IAAI,MAAM,EAAE,CAAC;wBACT,MAAM,IAAI,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;wBACzC,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;oBAChC,CAAC;oBAED,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;wBACvB,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;oBAC/B,CAAC;oBAED,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;wBACtB,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;oBAC9B,CAAC;oBAED,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE,CAAC;oBAEvC,OAAO,oBAAoB,CAAC,OAAO,CAAC,CAAC;gBACzC,CAAC,CAAC;gBAEF;;mBAEG;gBACH,KAAK,EAAE,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE;oBACvE,MAAM,UAAU,GAAG,iBAAiB,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;oBAC1D,MAAM,UAAU,GAAG,cAAc,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;oBAE/C,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;wBACvC,OAAO,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE,CAAC;oBACxC,CAAC;oBAED,OAAO,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC;yBACtB,KAAK,CAAC,UAAiB,CAAC;yBACxB,KAAK,EAAE,CAAC;gBACjB,CAAC,CAAC;gBAEF;;mBAEG;gBACH,MAAM,EAAE,iBAAiB,CAAC,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE;oBACjF,MAAM,UAAU,GAAG,iBAAiB,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;oBAC1D,MAAM,UAAU,GAAG,cAAc,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;oBAC/C,MAAM,UAAU,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;oBAE9C,wBAAwB;oBACxB,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC;yBACpC,KAAK,CAAC,UAAiB,CAAC;yBACxB,SAAS,EAAE,CAAC;oBAEjB,IAAI,CAAC,MAAM,EAAE,CAAC;wBACV,OAAO,IAAI,CAAC;oBAChB,CAAC;oBAED,YAAY;oBACZ,MAAM,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;oBAEpD,kCAAkC;oBAClC,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC;yBACrC,KAAK,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAS,CAAC;yBACjC,SAAS,EAAE,CAAC;oBAEjB,OAAO,mBAAmB,CAAC,OAAO,CAAC,CAAC;gBACxC,CAAC,CAAC;gBAEF;;mBAEG;gBACH,UAAU,EAAE,iBAAiB,CAAC,YAAY,EAAE,YAAY,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE;oBACzF,MAAM,UAAU,GAAG,iBAAiB,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;oBAC1D,MAAM,UAAU,GAAG,cAAc,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;oBAC/C,MAAM,UAAU,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;oBAE9C,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,UAAU,CAChC,UAAU,EACV,UAAiB,EACjB,UAAU,CACb,CAAC;oBAEF,OAAO,QAAQ,CAAC;gBACpB,CAAC,CAAC;gBAEF;;;mBAGG;gBACH,MAAM,EAAE,iBAAiB,CAAC,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE;oBACzE,MAAM,UAAU,GAAG,iBAAiB,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;oBAC1D,MAAM,UAAU,GAAG,cAAc,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;oBAE/C,8DAA8D;oBAC9D,gFAAgF;oBAChF,MAAM,EAAE,CAAC,UAAU,CAAC,UAAU,EAAE,UAAiB,CAAC,CAAC;gBACvD,CAAC,CAAC;gBAEF;;mBAEG;gBACH,UAAU,EAAE,iBAAiB,CAAC,YAAY,EAAE,YAAY,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE;oBACjF,MAAM,UAAU,GAAG,iBAAiB,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;oBAC1D,MAAM,UAAU,GAAG,cAAc,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;oBAE/C,OAAO,EAAE,CAAC,UAAU,CAChB,UAAU,EACV,UAAiB,CACpB,CAAC;gBACN,CAAC,CAAC;aACL,CAAC;QACN,CAAC;KACJ,CAAC,CAAC;AACP,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,yBAAyB,CACrC,EAAmB,EACnB,SAAkC,EAAE;IAEpC,gEAAgE;IAChE,OAAO,+BAA+B,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;AACvD,CAAC"}

package/dist/auth/better-auth-admin.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Better-Auth Admin Helpers
+ *
+ * NOTE: Most functionality has moved to role-helpers.ts
+ * - Use `requireAdmin` from role-helpers.ts for admin authentication
+ * - Use `isAdminRole` from role-helpers.ts for role checking
+ *
+ * This file now only contains setupFirstAdmin for initial admin setup.
+ */
+import type { BetterAuthInstance } from "./better-auth-instance.js";
+/**
+ * Create the first admin user (setup flow)
+ *
+ * This is used by the /setup endpoint when initializing the system.
+ * After the first user is created, the databaseHooks in better-auth-instance.ts
+ * will automatically promote subsequent first users to super-admin.
+ *
+ * Uses Better-Auth's admin plugin API instead of direct database access.
+ */
+export declare function setupFirstAdmin(auth: BetterAuthInstance, email: string, password: string, name?: string): Promise<{
+    success: boolean;
+    user?: any;
+    error?: string;
+}>;
+/**
+ * @deprecated Use `requireAdmin` from `role-helpers.ts` instead
+ */
+export declare function requireBetterAuthAdmin(auth: BetterAuthInstance, request: Request): Promise<{
+    user: any;
+    session: any;
+    role: import("./role-helpers.js").Role;
+} | null>;
+/**
+ * @deprecated Use `isAdminRole` from `role-helpers.ts` instead
+ */
+export declare function isAdminUser(user: {
+    role?: string;
+}): boolean;
+export declare const ADMIN_ROLES: readonly ["admin", "super-admin"];
+//# sourceMappingURL=better-auth-admin.d.ts.map

package/dist/auth/better-auth-admin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"better-auth-admin.d.ts","sourceRoot":"","sources":["../../src/auth/better-auth-admin.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAEpE;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CACjC,IAAI,EAAE,kBAAkB,EACxB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE,MAAM,GACd,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,GAAG,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CA2C3D;AAED;;GAEG;AACH,wBAAsB,sBAAsB,CACxC,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,OAAO;;;;UAInB;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAG5D;AAED,eAAO,MAAM,WAAW,mCAAoC,CAAC"}

package/dist/auth/better-auth-admin.js

@@ -0,0 +1,80 @@
+"use strict";
+/**
+ * Better-Auth Admin Helpers
+ *
+ * NOTE: Most functionality has moved to role-helpers.ts
+ * - Use `requireAdmin` from role-helpers.ts for admin authentication
+ * - Use `isAdminRole` from role-helpers.ts for role checking
+ *
+ * This file now only contains setupFirstAdmin for initial admin setup.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ADMIN_ROLES = void 0;
+exports.setupFirstAdmin = setupFirstAdmin;
+exports.requireBetterAuthAdmin = requireBetterAuthAdmin;
+exports.isAdminUser = isAdminUser;
+/**
+ * Create the first admin user (setup flow)
+ *
+ * This is used by the /setup endpoint when initializing the system.
+ * After the first user is created, the databaseHooks in better-auth-instance.ts
+ * will automatically promote subsequent first users to super-admin.
+ *
+ * Uses Better-Auth's admin plugin API instead of direct database access.
+ */
+async function setupFirstAdmin(auth, email, password, name) {
+    try {
+        // Check if any admin users exist using Better-Auth's listUsers API
+        const listResult = await auth.api.admin.listUsers({
+            query: { limit: 1, offset: 0 }
+        });
+        if (listResult?.users && listResult.users.length > 0) {
+            // Check if any user has admin role
+            const hasAdmin = listResult.users.some((u) => u.role === "admin" || u.role === "super-admin");
+            if (hasAdmin) {
+                return { success: false, error: "Admin already exists" };
+            }
+        }
+        // Create user with admin role using Better-Auth signUpEmail
+        const result = await auth.api.signUpEmail({
+            body: {
+                email,
+                password,
+                name: name || email.split("@")[0],
+            },
+        });
+        if (!result?.user) {
+            return { success: false, error: "Failed to create user" };
+        }
+        // Set admin role using Better-Auth's admin plugin API
+        await auth.api.admin.setRole({
+            body: {
+                userId: result.user.id,
+                role: "admin",
+            },
+        });
+        return { success: true, user: result.user };
+    }
+    catch (error) {
+        return {
+            success: false,
+            error: error instanceof Error ? error.message : String(error),
+        };
+    }
+}
+/**
+ * @deprecated Use `requireAdmin` from `role-helpers.ts` instead
+ */
+async function requireBetterAuthAdmin(auth, request) {
+    const { requireAdmin } = await import("./role-helpers.js");
+    return requireAdmin(auth, request);
+}
+/**
+ * @deprecated Use `isAdminRole` from `role-helpers.ts` instead
+ */
+function isAdminUser(user) {
+    const { isAdminRole } = require("./role-helpers.js");
+    return isAdminRole(user.role);
+}
+exports.ADMIN_ROLES = ["admin", "super-admin"];
+//# sourceMappingURL=better-auth-admin.js.map

package/dist/auth/better-auth-admin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"better-auth-admin.js","sourceRoot":"","sources":["../../src/auth/better-auth-admin.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;;AAaH,0CAgDC;AAKD,wDAMC;AAKD,kCAGC;AA5ED;;;;;;;;GAQG;AACI,KAAK,UAAU,eAAe,CACjC,IAAwB,EACxB,KAAa,EACb,QAAgB,EAChB,IAAa;IAEb,IAAI,CAAC;QACD,mEAAmE;QACnE,MAAM,UAAU,GAAG,MAAO,IAAY,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC;YACvD,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE;SACjC,CAAC,CAAC;QAEH,IAAI,UAAU,EAAE,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnD,mCAAmC;YACnC,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC;YACnG,IAAI,QAAQ,EAAE,CAAC;gBACX,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC;YAC7D,CAAC;QACL,CAAC;QAED,4DAA4D;QAC5D,MAAM,MAAM,GAAG,MAAO,IAAY,CAAC,GAAG,CAAC,WAAW,CAAC;YAC/C,IAAI,EAAE;gBACF,KAAK;gBACL,QAAQ;gBACR,IAAI,EAAE,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;aACpC;SACJ,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;YAChB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC;QAC9D,CAAC;QAED,sDAAsD;QACtD,MAAO,IAAY,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC;YAClC,IAAI,EAAE;gBACF,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE;gBACtB,IAAI,EAAE,OAAO;aAChB;SACJ,CAAC,CAAC;QAEH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;IAChD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,OAAO;YACH,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAChE,CAAC;IACN,CAAC;AACL,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,sBAAsB,CACxC,IAAwB,EACxB,OAAgB;IAEhB,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;IAC3D,OAAO,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AACvC,CAAC;AAED;;GAEG;AACH,SAAgB,WAAW,CAAC,IAAuB;IAC/C,MAAM,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACrD,OAAO,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAClC,CAAC;AAEY,QAAA,WAAW,GAAG,CAAC,OAAO,EAAE,aAAa,CAAU,CAAC"}

package/dist/auth/better-auth-api-key-resolver.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Better-Auth API Key Resolver
+ *
+ * Validates API keys from Better-Auth's apiKey plugin.
+ *
+ * Better-Auth API key format:
+ * - Prefix: arch_ (configurable, defaults to arch_)
+ * - Headers: x-api-key or Authorization: Bearer <key>
+ * - Storage: system_auth_api_key collection
+ * - Features: Rate limiting, expiration, metadata, permissions
+ *
+ * This resolver takes precedence over the legacy arc_key_* system.
+ */
+import type { AuthInput, AuthContext } from "./interfaces.js";
+import type { BetterAuthInstance } from "./better-auth-instance.js";
+export interface BetterAuthApiKeyResolverOptions {
+    auth: BetterAuthInstance;
+}
+export declare class BetterAuthApiKeyResolver {
+    private auth;
+    constructor(options: BetterAuthApiKeyResolverOptions);
+    /**
+     * Extract API key from request headers
+     * Checks both x-api-key and Authorization: Bearer header
+     */
+    private extractApiKey;
+    /**
+     * Resolve Better-Auth API key to AuthContext
+     *
+     * Steps:
+     * 1. Extract API key from headers
+     * 2. Verify using Better-Auth's verifyApiKey API
+     * 3. Check if key is enabled and not expired
+     * 4. Use user data from response (Better-Auth includes user in verifyApiKey response)
+     * 5. Build AuthContext with user context and permissions
+     */
+    resolve(input: AuthInput): Promise<AuthContext | null>;
+}
+//# sourceMappingURL=better-auth-api-key-resolver.d.ts.map

package/dist/auth/better-auth-api-key-resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"better-auth-api-key-resolver.d.ts","sourceRoot":"","sources":["../../src/auth/better-auth-api-key-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAG9D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAKpE,MAAM,WAAW,+BAA+B;IAC5C,IAAI,EAAE,kBAAkB,CAAC;CAC5B;AAED,qBAAa,wBAAwB;IACjC,OAAO,CAAC,IAAI,CAAqB;gBAErB,OAAO,EAAE,+BAA+B;IAIpD;;;OAGG;IACH,OAAO,CAAC,aAAa;IAyBrB;;;;;;;;;OASG;IACG,OAAO,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;CA2I/D"}