@headless-lms/adapter-auth 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 mdwt
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/access.d.ts

@@ -0,0 +1,100 @@
+//#region src/access.d.ts
+declare const statement: {
+  readonly course: readonly ["create", "read", "update", "delete"];
+  readonly progress: readonly ["view"];
+  readonly organization: readonly ["update", "delete"];
+  readonly member: readonly ["create", "update", "delete"];
+  readonly invitation: readonly ["create", "cancel"];
+  readonly team: readonly ["create", "update", "delete"];
+  readonly ac: readonly ["create", "read", "update", "delete"];
+};
+declare const ac: {
+  newRole<const TRoleStatements extends import("better-auth/plugins/access").Statements>(statements: import("better-auth/plugins/access").RoleInput<{
+    readonly course: readonly ["create", "read", "update", "delete"];
+    readonly progress: readonly ["view"];
+    readonly organization: readonly ["update", "delete"];
+    readonly member: readonly ["create", "update", "delete"];
+    readonly invitation: readonly ["create", "cancel"];
+    readonly team: readonly ["create", "update", "delete"];
+    readonly ac: readonly ["create", "read", "update", "delete"];
+  }, TRoleStatements>): import("better-auth/plugins/access").Role<import("better-auth/plugins/access").ExactRoleStatements<TRoleStatements>, {
+    readonly course: readonly ["create", "read", "update", "delete"];
+    readonly progress: readonly ["view"];
+    readonly organization: readonly ["update", "delete"];
+    readonly member: readonly ["create", "update", "delete"];
+    readonly invitation: readonly ["create", "cancel"];
+    readonly team: readonly ["create", "update", "delete"];
+    readonly ac: readonly ["create", "read", "update", "delete"];
+  }>;
+  statements: {
+    readonly course: readonly ["create", "read", "update", "delete"];
+    readonly progress: readonly ["view"];
+    readonly organization: readonly ["update", "delete"];
+    readonly member: readonly ["create", "update", "delete"];
+    readonly invitation: readonly ["create", "cancel"];
+    readonly team: readonly ["create", "update", "delete"];
+    readonly ac: readonly ["create", "read", "update", "delete"];
+  };
+};
+declare const roles: {
+  owner: import("better-auth/plugins/access").Role<import("better-auth/plugins/access").ExactRoleStatements<{
+    readonly course: ["create", "read", "update", "delete"];
+    readonly progress: ["view"];
+    readonly organization: readonly ["update", "delete"];
+    readonly member: readonly ["create", "update", "delete"];
+    readonly invitation: readonly ["create", "cancel"];
+    readonly team: readonly ["create", "update", "delete"];
+    readonly ac: readonly ["create", "read", "update", "delete"];
+  }>, {
+    readonly course: readonly ["create", "read", "update", "delete"];
+    readonly progress: readonly ["view"];
+    readonly organization: readonly ["update", "delete"];
+    readonly member: readonly ["create", "update", "delete"];
+    readonly invitation: readonly ["create", "cancel"];
+    readonly team: readonly ["create", "update", "delete"];
+    readonly ac: readonly ["create", "read", "update", "delete"];
+  }>;
+  admin: import("better-auth/plugins/access").Role<import("better-auth/plugins/access").ExactRoleStatements<{
+    readonly course: ["create", "read", "update", "delete"];
+    readonly progress: ["view"];
+    readonly organization: readonly ["update"];
+    readonly invitation: readonly ["create", "cancel"];
+    readonly member: readonly ["create", "update", "delete"];
+    readonly team: readonly ["create", "update", "delete"];
+    readonly ac: readonly ["create", "read", "update", "delete"];
+  }>, {
+    readonly course: readonly ["create", "read", "update", "delete"];
+    readonly progress: readonly ["view"];
+    readonly organization: readonly ["update", "delete"];
+    readonly member: readonly ["create", "update", "delete"];
+    readonly invitation: readonly ["create", "cancel"];
+    readonly team: readonly ["create", "update", "delete"];
+    readonly ac: readonly ["create", "read", "update", "delete"];
+  }>;
+  instructor: import("better-auth/plugins/access").Role<import("better-auth/plugins/access").ExactRoleStatements<{
+    readonly course: ["read", "update"];
+    readonly progress: ["view"];
+  }>, {
+    readonly course: readonly ["create", "read", "update", "delete"];
+    readonly progress: readonly ["view"];
+    readonly organization: readonly ["update", "delete"];
+    readonly member: readonly ["create", "update", "delete"];
+    readonly invitation: readonly ["create", "cancel"];
+    readonly team: readonly ["create", "update", "delete"];
+    readonly ac: readonly ["create", "read", "update", "delete"];
+  }>;
+  student: import("better-auth/plugins/access").Role<import("better-auth/plugins/access").ExactRoleStatements<{
+    readonly course: ["read"];
+  }>, {
+    readonly course: readonly ["create", "read", "update", "delete"];
+    readonly progress: readonly ["view"];
+    readonly organization: readonly ["update", "delete"];
+    readonly member: readonly ["create", "update", "delete"];
+    readonly invitation: readonly ["create", "cancel"];
+    readonly team: readonly ["create", "update", "delete"];
+    readonly ac: readonly ["create", "read", "update", "delete"];
+  }>;
+};
+//#endregion
+export { ac, roles, statement };
+//# sourceMappingURL=access.d.ts.map

package/dist/access.js

@@ -0,0 +1,45 @@
+import { createAccessControl } from "better-auth/plugins/access";
+import { adminAc, defaultStatements, ownerAc } from "better-auth/plugins/organization/access";
+//#region src/access.ts
+const statement = {
+	...defaultStatements,
+	course: [
+		"create",
+		"read",
+		"update",
+		"delete"
+	],
+	progress: ["view"]
+};
+const ac = createAccessControl(statement);
+const roles = {
+	owner: ac.newRole({
+		...ownerAc.statements,
+		course: [
+			"create",
+			"read",
+			"update",
+			"delete"
+		],
+		progress: ["view"]
+	}),
+	admin: ac.newRole({
+		...adminAc.statements,
+		course: [
+			"create",
+			"read",
+			"update",
+			"delete"
+		],
+		progress: ["view"]
+	}),
+	instructor: ac.newRole({
+		course: ["read", "update"],
+		progress: ["view"]
+	}),
+	student: ac.newRole({ course: ["read"] })
+};
+//#endregion
+export { ac, roles, statement };
+
+//# sourceMappingURL=access.js.map

package/dist/access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.js","names":[],"sources":["../src/access.ts"],"sourcesContent":["// Better Auth org-plugin access control. Better Auth is the system of record for\n// roles; these four roles mirror the domain Role union (core/organizations/roles).\nimport { createAccessControl } from 'better-auth/plugins/access';\nimport { defaultStatements, ownerAc, adminAc } from 'better-auth/plugins/organization/access';\n\nexport const statement = {\n  ...defaultStatements,\n  course: ['create', 'read', 'update', 'delete'],\n  progress: ['view'],\n} as const;\n\nconst ac = createAccessControl(statement);\n\nexport const roles = {\n  owner: ac.newRole({\n    ...ownerAc.statements,\n    course: ['create', 'read', 'update', 'delete'],\n    progress: ['view'],\n  }),\n  admin: ac.newRole({\n    ...adminAc.statements,\n    course: ['create', 'read', 'update', 'delete'],\n    progress: ['view'],\n  }),\n  instructor: ac.newRole({\n    course: ['read', 'update'],\n    progress: ['view'],\n  }),\n  student: ac.newRole({\n    course: ['read'],\n  }),\n};\n\nexport { ac };\n"],"mappings":";;;AAKA,MAAa,YAAY;CACvB,GAAG;CACH,QAAQ;EAAC;EAAU;EAAQ;EAAU;CAAQ;CAC7C,UAAU,CAAC,MAAM;AACnB;AAEA,MAAM,KAAK,oBAAoB,SAAS;AAExC,MAAa,QAAQ;CACnB,OAAO,GAAG,QAAQ;EAChB,GAAG,QAAQ;EACX,QAAQ;GAAC;GAAU;GAAQ;GAAU;EAAQ;EAC7C,UAAU,CAAC,MAAM;CACnB,CAAC;CACD,OAAO,GAAG,QAAQ;EAChB,GAAG,QAAQ;EACX,QAAQ;GAAC;GAAU;GAAQ;GAAU;EAAQ;EAC7C,UAAU,CAAC,MAAM;CACnB,CAAC;CACD,YAAY,GAAG,QAAQ;EACrB,QAAQ,CAAC,QAAQ,QAAQ;EACzB,UAAU,CAAC,MAAM;CACnB,CAAC;CACD,SAAS,GAAG,QAAQ,EAClB,QAAQ,CAAC,MAAM,EACjB,CAAC;AACH"}

package/dist/better-auth.d.ts

@@ -0,0 +1,417 @@
+import { $strip } from "./node_modules/.pnpm/zod@4.4.3/node_modules/zod/v4/core/schemas.js";
+import { CreateAuthOptions, Hooks } from "./types.js";
+import { AuthHeaders, AuthOrganization, MemberWriteContext, OrgAdmin, Role, UpdateOrganizationInput } from "@headless-lms/core/organizations";
+import { ActiveSession, Logger, NewOrganizationInput, SessionVerifier } from "@headless-lms/core/types";
+import { IncomingHttpHeaders } from "node:http";
+import { SessionAdmin } from "@headless-lms/core/identity";
+//#region src/better-auth.d.ts
+declare function createAuth(opts: CreateAuthOptions): import("better-auth").Auth<{
+  baseURL: string;
+  secret: string;
+  trustedOrigins: string[];
+  session: {
+    cookieCache: {
+      enabled: true;
+      maxAge: number;
+    };
+  };
+  advanced: {
+    database: {
+      generateId: () => string;
+    };
+    crossSubDomainCookies: {
+      enabled: true;
+      domain: string | undefined;
+    };
+    defaultCookieAttributes: {
+      sameSite: "lax";
+      secure: boolean;
+      httpOnly: true;
+    };
+  };
+  database: (options: import("better-auth").BetterAuthOptions) => import("better-auth").DBAdapter<import("better-auth").BetterAuthOptions>;
+  emailAndPassword: {
+    enabled: true;
+    sendResetPassword: (data: {
+      user: import("better-auth").User;
+      url: string;
+      token: string;
+    }, request?: Request) => Promise<void>;
+  };
+  plugins: [{
+    id: "magic-link";
+    version: string;
+    endpoints: {
+      signInMagicLink: import("better-auth").StrictEndpoint<"/sign-in/magic-link", {
+        method: "POST";
+        requireHeaders: true;
+        use: ((inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<void>)[];
+        body: import("better-auth").ZodObject<{
+          email: import("better-auth").ZodEmail;
+          name: import("better-auth").ZodOptional<import("better-auth").ZodString>;
+          callbackURL: import("better-auth").ZodOptional<import("better-auth").ZodString>;
+          newUserCallbackURL: import("better-auth").ZodOptional<import("better-auth").ZodString>;
+          errorCallbackURL: import("better-auth").ZodOptional<import("better-auth").ZodString>;
+          metadata: import("better-auth").ZodOptional<import("better-auth").ZodRecord<import("better-auth").ZodString, import("better-auth").ZodAny>>;
+        }, $strip>;
+        metadata: {
+          openapi: {
+            operationId: string;
+            description: string;
+            responses: {
+              200: {
+                description: string;
+                content: {
+                  "application/json": {
+                    schema: {
+                      type: "object";
+                      properties: {
+                        status: {
+                          type: string;
+                        };
+                      };
+                    };
+                  };
+                };
+              };
+            };
+          };
+        };
+      }, {
+        status: boolean;
+      }>;
+      magicLinkVerify: import("better-auth").StrictEndpoint<"/magic-link/verify", {
+        method: "GET";
+        query: import("better-auth").ZodObject<{
+          token: import("better-auth").ZodString;
+          callbackURL: import("better-auth").ZodOptional<import("better-auth").ZodString>;
+          errorCallbackURL: import("better-auth").ZodOptional<import("better-auth").ZodString>;
+          newUserCallbackURL: import("better-auth").ZodOptional<import("better-auth").ZodString>;
+        }, $strip>;
+        use: ((inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<void>)[];
+        requireHeaders: true;
+        metadata: {
+          openapi: {
+            operationId: string;
+            description: string;
+            responses: {
+              200: {
+                description: string;
+                content: {
+                  "application/json": {
+                    schema: {
+                      type: "object";
+                      properties: {
+                        session: {
+                          $ref: string;
+                        };
+                        user: {
+                          $ref: string;
+                        };
+                      };
+                    };
+                  };
+                };
+              };
+            };
+          };
+        };
+      }, {
+        token: string;
+        user: {
+          id: string;
+          createdAt: Date;
+          updatedAt: Date;
+          email: string;
+          emailVerified: boolean;
+          name: string;
+          image?: string | null | undefined;
+        };
+        session: {
+          id: string;
+          createdAt: Date;
+          updatedAt: Date;
+          userId: string;
+          expiresAt: Date;
+          token: string;
+          ipAddress?: string | null | undefined;
+          userAgent?: string | null | undefined;
+        };
+      }>;
+    };
+    rateLimit: {
+      pathMatcher(path: string): boolean;
+      window: number;
+      max: number;
+    }[];
+    options: import("better-auth/plugins").MagicLinkOptions;
+  }, import("better-auth/plugins").DefaultOrganizationPlugin<{
+    ac: {
+      newRole<const TRoleStatements extends import("better-auth/plugins").Statements>(statements: import("better-auth/plugins").RoleInput<{
+        readonly course: readonly ["create", "read", "update", "delete"];
+        readonly progress: readonly ["view"];
+        readonly organization: readonly ["update", "delete"];
+        readonly member: readonly ["create", "update", "delete"];
+        readonly invitation: readonly ["create", "cancel"];
+        readonly team: readonly ["create", "update", "delete"];
+        readonly ac: readonly ["create", "read", "update", "delete"];
+      }, TRoleStatements>): import("better-auth/plugins").Role<import("better-auth/plugins").ExactRoleStatements<TRoleStatements>, {
+        readonly course: readonly ["create", "read", "update", "delete"];
+        readonly progress: readonly ["view"];
+        readonly organization: readonly ["update", "delete"];
+        readonly member: readonly ["create", "update", "delete"];
+        readonly invitation: readonly ["create", "cancel"];
+        readonly team: readonly ["create", "update", "delete"];
+        readonly ac: readonly ["create", "read", "update", "delete"];
+      }>;
+      statements: {
+        readonly course: readonly ["create", "read", "update", "delete"];
+        readonly progress: readonly ["view"];
+        readonly organization: readonly ["update", "delete"];
+        readonly member: readonly ["create", "update", "delete"];
+        readonly invitation: readonly ["create", "cancel"];
+        readonly team: readonly ["create", "update", "delete"];
+        readonly ac: readonly ["create", "read", "update", "delete"];
+      };
+    };
+    roles: {
+      owner: import("better-auth/plugins").Role<import("better-auth/plugins").ExactRoleStatements<{
+        readonly course: ["create", "read", "update", "delete"];
+        readonly progress: ["view"];
+        readonly organization: readonly ["update", "delete"];
+        readonly member: readonly ["create", "update", "delete"];
+        readonly invitation: readonly ["create", "cancel"];
+        readonly team: readonly ["create", "update", "delete"];
+        readonly ac: readonly ["create", "read", "update", "delete"];
+      }>, {
+        readonly course: readonly ["create", "read", "update", "delete"];
+        readonly progress: readonly ["view"];
+        readonly organization: readonly ["update", "delete"];
+        readonly member: readonly ["create", "update", "delete"];
+        readonly invitation: readonly ["create", "cancel"];
+        readonly team: readonly ["create", "update", "delete"];
+        readonly ac: readonly ["create", "read", "update", "delete"];
+      }>;
+      admin: import("better-auth/plugins").Role<import("better-auth/plugins").ExactRoleStatements<{
+        readonly course: ["create", "read", "update", "delete"];
+        readonly progress: ["view"];
+        readonly organization: readonly ["update"];
+        readonly invitation: readonly ["create", "cancel"];
+        readonly member: readonly ["create", "update", "delete"];
+        readonly team: readonly ["create", "update", "delete"];
+        readonly ac: readonly ["create", "read", "update", "delete"];
+      }>, {
+        readonly course: readonly ["create", "read", "update", "delete"];
+        readonly progress: readonly ["view"];
+        readonly organization: readonly ["update", "delete"];
+        readonly member: readonly ["create", "update", "delete"];
+        readonly invitation: readonly ["create", "cancel"];
+        readonly team: readonly ["create", "update", "delete"];
+        readonly ac: readonly ["create", "read", "update", "delete"];
+      }>;
+      instructor: import("better-auth/plugins").Role<import("better-auth/plugins").ExactRoleStatements<{
+        readonly course: ["read", "update"];
+        readonly progress: ["view"];
+      }>, {
+        readonly course: readonly ["create", "read", "update", "delete"];
+        readonly progress: readonly ["view"];
+        readonly organization: readonly ["update", "delete"];
+        readonly member: readonly ["create", "update", "delete"];
+        readonly invitation: readonly ["create", "cancel"];
+        readonly team: readonly ["create", "update", "delete"];
+        readonly ac: readonly ["create", "read", "update", "delete"];
+      }>;
+      student: import("better-auth/plugins").Role<import("better-auth/plugins").ExactRoleStatements<{
+        readonly course: ["read"];
+      }>, {
+        readonly course: readonly ["create", "read", "update", "delete"];
+        readonly progress: readonly ["view"];
+        readonly organization: readonly ["update", "delete"];
+        readonly member: readonly ["create", "update", "delete"];
+        readonly invitation: readonly ["create", "cancel"];
+        readonly team: readonly ["create", "update", "delete"];
+        readonly ac: readonly ["create", "read", "update", "delete"];
+      }>;
+    };
+    creatorRole: string;
+    organizationHooks: Hooks;
+  }>, {
+    id: "custom-session";
+    version: string;
+    hooks: {
+      after: {
+        matcher: (ctx: import("better-auth").HookEndpointContext) => boolean;
+        handler: (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
+          user: {
+            id: string;
+            createdAt: Date;
+            updatedAt: Date;
+            email: string;
+            emailVerified: boolean;
+            name: string;
+            image?: string | null | undefined;
+          };
+          session: {
+            id: string;
+            createdAt: Date;
+            updatedAt: Date;
+            userId: string;
+            expiresAt: Date;
+            token: string;
+            ipAddress?: string | null | undefined;
+            userAgent?: string | null | undefined;
+          };
+          activeMemberRole: string | null;
+          activeOrganization: {
+            id: string;
+            name: string;
+            slug: string;
+          } | null;
+          organizations: {
+            id: string;
+            name: string;
+            slug: string;
+          }[];
+        }[] | undefined>;
+      }[];
+    };
+    endpoints: {
+      getSession: import("better-auth").StrictEndpoint<"/get-session", {
+        method: "GET";
+        query: import("better-auth").ZodOptional<import("better-auth").ZodObject<{
+          disableCookieCache: import("better-auth").ZodOptional<import("better-auth").ZodCoercedBoolean<unknown>>;
+          disableRefresh: import("better-auth").ZodOptional<import("better-auth").ZodCoercedBoolean<unknown>>;
+        }, $strip>>;
+        metadata: {
+          CUSTOM_SESSION: boolean;
+          openapi: {
+            description: string;
+            responses: {
+              "200": {
+                description: string;
+                content: {
+                  "application/json": {
+                    schema: {
+                      type: "array";
+                      nullable: boolean;
+                      items: {
+                        $ref: string;
+                      };
+                    };
+                  };
+                };
+              };
+            };
+          };
+        };
+        requireHeaders: true;
+      }, {
+        user: {
+          id: string;
+          createdAt: Date;
+          updatedAt: Date;
+          email: string;
+          emailVerified: boolean;
+          name: string;
+          image?: string | null | undefined;
+        };
+        session: {
+          id: string;
+          createdAt: Date;
+          updatedAt: Date;
+          userId: string;
+          expiresAt: Date;
+          token: string;
+          ipAddress?: string | null | undefined;
+          userAgent?: string | null | undefined;
+        };
+        activeMemberRole: string | null;
+        activeOrganization: {
+          id: string;
+          name: string;
+          slug: string;
+        } | null;
+        organizations: {
+          id: string;
+          name: string;
+          slug: string;
+        }[];
+      } | null>;
+    };
+    $Infer: {
+      Session: {
+        user: {
+          id: string;
+          createdAt: Date;
+          updatedAt: Date;
+          email: string;
+          emailVerified: boolean;
+          name: string;
+          image?: string | null | undefined;
+        };
+        session: {
+          id: string;
+          createdAt: Date;
+          updatedAt: Date;
+          userId: string;
+          expiresAt: Date;
+          token: string;
+          ipAddress?: string | null | undefined;
+          userAgent?: string | null | undefined;
+        };
+        activeMemberRole: string | null;
+        activeOrganization: {
+          id: string;
+          name: string;
+          slug: string;
+        } | null;
+        organizations: {
+          id: string;
+          name: string;
+          slug: string;
+        }[];
+      };
+    };
+    options: import("better-auth/plugins").CustomSessionPluginOptions | undefined;
+  }];
+  databaseHooks: {
+    user: {
+      create: {
+        before: (user: import("better-auth").User & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void | {
+          data: import("better-auth").User;
+        }>;
+      };
+    };
+    session: {
+      create: {
+        before: ((session: import("better-auth").Session & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void | {
+          data: import("better-auth").Session & Record<string, unknown>;
+        }>) | undefined;
+      };
+    };
+  };
+}>;
+type Auth = ReturnType<typeof createAuth>;
+declare class BetterAuth implements SessionVerifier, OrgAdmin, SessionAdmin {
+  protected auth: Auth;
+  protected logger: Logger;
+  constructor(opts: CreateAuthOptions);
+  handler(request: Request): Promise<Response>;
+  verify(headers: IncomingHttpHeaders): Promise<ActiveSession | null>;
+  /** Stamps the org onto the caller's session row. The 5-minute cookie cache
+   *  still holds the pre-stamp session, so callers refresh it client-side with
+   *  `getSession({ disableCookieCache: true })`. */
+  stampActiveOrganization(headers: AuthHeaders, orgId: string): Promise<boolean>;
+  createOrganization(headers: AuthHeaders, input: NewOrganizationInput): Promise<AuthOrganization>;
+  setActiveOrganization(headers: AuthHeaders, externalId: string): Promise<void>;
+  updateOrganization(headers: AuthHeaders, externalId: string, input: UpdateOrganizationInput): Promise<AuthOrganization>;
+  deleteOrganization(headers: AuthHeaders, externalId: string): Promise<void>;
+  grantMembership(orgExternalId: string, userExternalId: string, role: string): Promise<void>;
+  updateRole(ctx: MemberWriteContext, userExternalId: string, role: Role): Promise<void>;
+  removeMember(ctx: MemberWriteContext, userExternalId: string): Promise<void>;
+  protected headersOf(ctx: MemberWriteContext): Headers;
+  protected resolveMemberId(ctx: MemberWriteContext, userExternalId: string): Promise<string>;
+}
+//#endregion
+export { Auth, BetterAuth, createAuth };
+//# sourceMappingURL=better-auth.d.ts.map

package/dist/better-auth.js

@@ -0,0 +1,222 @@
+import { ac, roles } from "./access.js";
+import { fromNodeHeaders } from "better-auth/node";
+import { APIError, betterAuth } from "better-auth";
+import { drizzleAdapter } from "better-auth/adapters/drizzle";
+import * as authSchema from "@headless-lms/adapter-db/schema/better-auth";
+import { prefixId } from "@headless-lms/core/shared/id";
+import { customSession, magicLink, organization } from "better-auth/plugins";
+import { eq } from "drizzle-orm";
+import { OrganizationRuleError, parseRole } from "@headless-lms/core/organizations";
+//#region src/better-auth.ts
+function createAuth(opts) {
+	const { sendResetPassword, sendMagicLink, beforeUserCreate, beforeCreateSession } = opts.hooks;
+	return betterAuth({
+		baseURL: opts.baseUrl,
+		secret: opts.secret,
+		trustedOrigins: opts.trustedOrigins,
+		session: { cookieCache: {
+			enabled: true,
+			maxAge: 300
+		} },
+		advanced: {
+			database: { generateId: () => prefixId("id") },
+			crossSubDomainCookies: {
+				enabled: true,
+				domain: opts.cookieDomain || void 0
+			},
+			defaultCookieAttributes: {
+				sameSite: "lax",
+				secure: opts.secureCookies ?? false,
+				httpOnly: true
+			}
+		},
+		database: drizzleAdapter(opts.db, {
+			provider: "pg",
+			schema: authSchema
+		}),
+		emailAndPassword: {
+			enabled: true,
+			sendResetPassword
+		},
+		plugins: [
+			magicLink({
+				disableSignUp: true,
+				sendMagicLink
+			}),
+			organization({
+				ac,
+				roles,
+				creatorRole: "owner",
+				organizationHooks: opts.hooks
+			}),
+			customSession(async ({ user, session }) => {
+				const memberships = await opts.db.select({
+					role: authSchema.member.role,
+					id: authSchema.organization.id,
+					name: authSchema.organization.name,
+					slug: authSchema.organization.slug
+				}).from(authSchema.member).innerJoin(authSchema.organization, eq(authSchema.member.organizationId, authSchema.organization.id)).where(eq(authSchema.member.userId, user.id));
+				const activeOrgId = session.activeOrganizationId ?? null;
+				const active = memberships.find((m) => m.id === activeOrgId) ?? null;
+				return {
+					user,
+					session,
+					activeMemberRole: active?.role ?? null,
+					activeOrganization: active ? {
+						id: active.id,
+						name: active.name,
+						slug: active.slug
+					} : null,
+					organizations: memberships.map(({ id, name, slug }) => ({
+						id,
+						name,
+						slug
+					}))
+				};
+			})
+		],
+		databaseHooks: {
+			user: { create: { before: beforeUserCreate } },
+			session: { create: { before: beforeCreateSession } }
+		}
+	});
+}
+var BetterAuth = class {
+	auth;
+	logger;
+	constructor(opts) {
+		this.auth = createAuth(opts);
+		this.logger = opts.logger;
+	}
+	async handler(request) {
+		return this.auth.handler(request);
+	}
+	async verify(headers) {
+		const res = await this.auth.api.getSession({ headers: fromNodeHeaders(headers) });
+		if (!res) return null;
+		return {
+			user: {
+				id: res.user.id,
+				createdAt: res.user.createdAt,
+				email: res.user.email,
+				firstName: res.user.name,
+				externalId: res.user.id,
+				lastName: res.user.name,
+				updatedAt: res.user.updatedAt
+			},
+			session: { activeOrganizationId: res.session.activeOrganizationId ?? null }
+		};
+	}
+	/** Stamps the org onto the caller's session row. The 5-minute cookie cache
+	*  still holds the pre-stamp session, so callers refresh it client-side with
+	*  `getSession({ disableCookieCache: true })`. */
+	async stampActiveOrganization(headers, orgId) {
+		const token = ((await this.auth.api.getSession({ headers: fromNodeHeaders(headers) }))?.session)?.token;
+		if (!token) return false;
+		await (await this.auth.$context).internalAdapter.updateSession(token, { activeOrganizationId: orgId });
+		return true;
+	}
+	async createOrganization(headers, input) {
+		const org = await this.auth.api.createOrganization({
+			body: {
+				name: input.name,
+				slug: input.slug
+			},
+			headers: fromNodeHeaders(headers)
+		});
+		if (!org) throw new Error(`Couldn't create organization`);
+		return {
+			id: org.id,
+			name: org.name,
+			slug: org.slug,
+			createdAt: org.createdAt
+		};
+	}
+	async setActiveOrganization(headers, externalId) {
+		await this.auth.api.setActiveOrganization({
+			body: { organizationId: externalId },
+			headers: fromNodeHeaders(headers)
+		});
+	}
+	async updateOrganization(headers, externalId, input) {
+		try {
+			const org = await this.auth.api.updateOrganization({
+				body: {
+					organizationId: externalId,
+					data: {
+						name: input.name,
+						slug: input.slug
+					}
+				},
+				headers: fromNodeHeaders(headers)
+			});
+			if (!org) throw new Error(`Couldn't update organization`);
+			return {
+				id: org.id,
+				name: org.name,
+				slug: org.slug,
+				createdAt: org.createdAt
+			};
+		} catch (err) {
+			if (err instanceof APIError) throw new OrganizationRuleError(err.message || "Could not update organization");
+			throw err;
+		}
+	}
+	async deleteOrganization(headers, externalId) {
+		try {
+			await this.auth.api.deleteOrganization({
+				body: { organizationId: externalId },
+				headers: fromNodeHeaders(headers)
+			});
+		} catch (err) {
+			if (err instanceof APIError) throw new OrganizationRuleError(err.message || "Could not delete organization");
+			throw err;
+		}
+	}
+	async grantMembership(orgExternalId, userExternalId, role) {
+		await this.auth.api.addMember({ body: {
+			userId: userExternalId,
+			organizationId: orgExternalId,
+			role: parseRole(role)
+		} });
+	}
+	async updateRole(ctx, userExternalId, role) {
+		await this.auth.api.updateMemberRole({
+			body: {
+				memberId: await this.resolveMemberId(ctx, userExternalId),
+				role,
+				organizationId: ctx.authOrgId
+			},
+			headers: this.headersOf(ctx)
+		});
+	}
+	async removeMember(ctx, userExternalId) {
+		await this.auth.api.removeMember({
+			body: {
+				memberIdOrEmail: await this.resolveMemberId(ctx, userExternalId),
+				organizationId: ctx.authOrgId
+			},
+			headers: this.headersOf(ctx)
+		});
+	}
+	headersOf(ctx) {
+		return fromNodeHeaders(ctx.headers);
+	}
+	async resolveMemberId(ctx, userExternalId) {
+		const memberId = (await this.auth.api.listMembers({
+			query: {
+				organizationId: ctx.authOrgId,
+				filterField: "userId",
+				filterValue: userExternalId,
+				limit: 1
+			},
+			headers: this.headersOf(ctx)
+		}))?.members?.[0]?.id;
+		if (!memberId) throw new OrganizationRuleError("That person is no longer a member of this organization");
+		return memberId;
+	}
+};
+//#endregion
+export { BetterAuth, createAuth };
+
+//# sourceMappingURL=better-auth.js.map

package/dist/better-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"better-auth.js","names":[],"sources":["../src/better-auth.ts"],"sourcesContent":["import type {\n  ActiveSession,\n  Logger, NewOrganizationInput,\n  SessionVerifier,\n} from '@headless-lms/core/types';\nimport type { IncomingHttpHeaders } from 'node:http';\nimport { fromNodeHeaders } from 'better-auth/node';\nimport { APIError, betterAuth } from 'better-auth';\nimport type { CreateAuthOptions } from './types.js';\nimport { drizzleAdapter } from 'better-auth/adapters/drizzle';\nimport * as authSchema from '@headless-lms/adapter-db/schema/better-auth';\nimport { prefixId } from '@headless-lms/core/shared/id';\nimport { customSession, magicLink, organization } from 'better-auth/plugins';\nimport { eq } from 'drizzle-orm';\nimport { ac, roles } from './access.js';\nimport  { type AuthHeaders, type AuthOrganization, type MemberWriteContext, type OrgAdmin, OrganizationRuleError, parseRole, type Role, type UpdateOrganizationInput } from '@headless-lms/core/organizations';\nimport type { SessionAdmin } from '@headless-lms/core/identity';\n\nexport function createAuth(opts: CreateAuthOptions) {\n  const { sendResetPassword, sendMagicLink, beforeUserCreate, beforeCreateSession } = opts.hooks;\n\n  const auth = betterAuth({\n    baseURL: opts.baseUrl,\n    secret: opts.secret,\n    trustedOrigins: opts.trustedOrigins,\n    session: {\n      // Signed short-lived cookie cache: avoids a Postgres session lookup on\n      // every request. The BFF verifies the session per request (each API call\n      // + every SSR getSession), so without this each one is a DB round-trip.\n      // The cache holds for maxAge; sign-out / expiry still invalidate it.\n      cookieCache: {\n        enabled: true,\n        maxAge: 5 * 60,\n      },\n    },\n    advanced: {\n      database: {\n        // Prefixed, KSUID-bodied ids for every better-auth table (usr_, org_, …).\n        generateId: () => prefixId('id'),\n      },\n      // Cross-subdomain shared session cookie for admin/api/web on one parent\n      // domain (e.g. `.example.com` in prod). Left unset in local dev so the\n      // host-only `localhost` cookie is used, which is already shared across\n      // ports (cookies are not port-scoped).\n      crossSubDomainCookies: {\n        enabled: true,\n        domain: opts.cookieDomain || undefined,\n      },\n      // Same-site cookie for the shared-parent-domain plan. Only switch to\n      // `sameSite: \"none\"` + `secure` if admin and api are genuinely cross-site\n      // (different registrable domains).\n      defaultCookieAttributes: {\n        sameSite: 'lax',\n        secure: opts.secureCookies ?? false,\n        httpOnly: true,\n      },\n    },\n    database: drizzleAdapter(opts.db, {\n      provider: 'pg',\n      schema: authSchema,\n    }),\n    emailAndPassword: {\n      enabled: true,\n      sendResetPassword,\n    },\n    plugins: [\n      magicLink({\n        disableSignUp: true,\n        sendMagicLink,\n      }),\n      organization({\n        ac,\n        roles,\n        creatorRole: 'owner',\n        organizationHooks: opts.hooks,\n      }),\n      // Enrich get-session with the caller's memberships (role + org) so BFFs\n      // resolve auth in one call instead of fanning out to get-active-member /\n      // get-full-organization / organization/list. Custom fields bypass the\n      // cookie cache, so this costs one indexed query per get-session.\n      customSession(async ({ user, session }) => {\n        const memberships = await opts.db\n          .select({\n            role: authSchema.member.role,\n            id: authSchema.organization.id,\n            name: authSchema.organization.name,\n            slug: authSchema.organization.slug,\n          })\n          .from(authSchema.member)\n          .innerJoin(authSchema.organization, eq(authSchema.member.organizationId, authSchema.organization.id))\n          .where(eq(authSchema.member.userId, user.id));\n        const activeOrgId =\n          (session as { activeOrganizationId?: string | null }).activeOrganizationId ?? null;\n        const active = memberships.find((m) => m.id === activeOrgId) ?? null;\n        return {\n          user,\n          session,\n          activeMemberRole: active?.role ?? null,\n          activeOrganization: active ? { id: active.id, name: active.name, slug: active.slug } : null,\n          organizations: memberships.map(({ id, name, slug }) => ({ id, name, slug })),\n        };\n      }),\n    ],\n    databaseHooks: {\n      user: {\n        create: {\n          before: beforeUserCreate,\n        },\n      },\n      session: {\n        create: {\n          before: beforeCreateSession,\n        },\n      },\n    },\n  });\n  return auth;\n}\n\nexport type Auth = ReturnType<typeof createAuth>;\n\nexport class BetterAuth implements SessionVerifier, OrgAdmin, SessionAdmin {\n  protected auth: Auth;\n  protected logger: Logger;\n\n  constructor(opts: CreateAuthOptions) {\n    this.auth = createAuth(opts);\n    this.logger = opts.logger;\n  }\n\n  async handler(request: Request) :Promise<Response>{\n    return this.auth.handler(request);\n  }\n\n  async verify(headers: IncomingHttpHeaders): Promise<ActiveSession | null> {\n    const res = await this.auth.api.getSession({ headers: fromNodeHeaders(headers) });\n    if (!res) {\n      return null;\n    }\n    return {\n      user: {\n        id: res.user.id,\n        createdAt: res.user.createdAt,\n        email: res.user.email,\n        firstName: res.user.name,\n        externalId: res.user.id,\n        lastName: res.user.name,\n        updatedAt: res.user.updatedAt,\n      },\n      session: {\n        // customSession erases the org plugin's session extension from the\n        // inferred type; the field is still present at runtime.\n        activeOrganizationId:\n          (res.session as { activeOrganizationId?: string | null }).activeOrganizationId ?? null,\n      },\n    };\n  }\n\n\n  /** Stamps the org onto the caller's session row. The 5-minute cookie cache\n   *  still holds the pre-stamp session, so callers refresh it client-side with\n   *  `getSession({ disableCookieCache: true })`. */\n  async stampActiveOrganization(headers: AuthHeaders, orgId: string): Promise<boolean> {\n    const session = await this.auth.api.getSession({ headers: fromNodeHeaders(headers) });\n    const token = (session?.session as { token?: string } | undefined)?.token;\n    if (!token) {\n      return false;\n    }\n    const ctx = await this.auth.$context;\n    await ctx.internalAdapter.updateSession(token, { activeOrganizationId: orgId });\n    return true;\n  }\n\n  async createOrganization(\n    headers: AuthHeaders,\n    input: NewOrganizationInput,\n  ): Promise<AuthOrganization> {\n    const org = await this.auth.api.createOrganization({\n      body: { name: input.name, slug: input.slug },\n      headers: fromNodeHeaders(headers),\n    });\n    if (!org) {\n      throw new Error(`Couldn't create organization`);\n    }\n    return { id: org.id, name: org.name, slug: org.slug, createdAt: org.createdAt };\n  }\n  async setActiveOrganization(headers: AuthHeaders, externalId: string): Promise<void> {\n    await this.auth.api.setActiveOrganization({\n      body: { organizationId: externalId },\n      headers: fromNodeHeaders(headers),\n    });\n  }\n  async updateOrganization(\n    headers: AuthHeaders,\n    externalId: string,\n    input: UpdateOrganizationInput,\n  ): Promise<AuthOrganization> {\n    try {\n      const org = await this.auth.api.updateOrganization({\n        body: { organizationId: externalId, data: { name: input.name, slug: input.slug } },\n        headers: fromNodeHeaders(headers),\n      });\n      if (!org) {\n        throw new Error(`Couldn't update organization`);\n      }\n      return { id: org.id, name: org.name, slug: org.slug, createdAt: org.createdAt };\n    } catch (err) {\n      // Surface Better Auth validation/permission failures (e.g. slug taken) as\n      // a domain rule error the route maps to 409 rather than a raw 500.\n      if (err instanceof APIError) {\n        throw new OrganizationRuleError(err.message || 'Could not update organization');\n      }\n      throw err;\n    }\n  }\n  async deleteOrganization(headers: AuthHeaders, externalId: string): Promise<void> {\n    try {\n      await this.auth.api.deleteOrganization({\n        body: { organizationId: externalId },\n        headers: fromNodeHeaders(headers),\n      });\n    } catch (err) {\n      if (err instanceof APIError) {\n        throw new OrganizationRuleError(err.message || 'Could not delete organization');\n      }\n      throw err;\n    }\n  }\n  async grantMembership(\n    orgExternalId: string,\n    userExternalId: string,\n    role: string,\n  ): Promise<void> {\n    // Server-side (no session): the accepted invitation is the authorisation.\n    await this.auth.api.addMember({\n      body: { userId: userExternalId, organizationId: orgExternalId, role: parseRole(role) },\n    });\n  }\n  async updateRole(ctx: MemberWriteContext, userExternalId: string, role: Role): Promise<void> {\n    await this.auth.api.updateMemberRole({\n      body: {\n        memberId: await this.resolveMemberId(ctx, userExternalId),\n        role,\n        organizationId: ctx.authOrgId,\n      },\n      headers: this.headersOf(ctx),\n    });\n  }\n  async removeMember(ctx: MemberWriteContext, userExternalId: string): Promise<void> {\n    await this.auth.api.removeMember({\n      body: {\n        memberIdOrEmail: await this.resolveMemberId(ctx, userExternalId),\n        organizationId: ctx.authOrgId,\n      },\n      headers: this.headersOf(ctx),\n    });\n  }\n\n  protected headersOf(ctx: MemberWriteContext): Headers {\n    return fromNodeHeaders(ctx.headers);\n  }\n\n  // Better Auth's member endpoints key on its own member id, which the domain\n  // deliberately does not store — `(org, user)` already identifies the record,\n  // so it is looked up here instead of mirrored into org_users.\n  protected async resolveMemberId(\n    ctx: MemberWriteContext,\n    userExternalId: string,\n  ): Promise<string> {\n    const res = await this.auth.api.listMembers({\n      query: {\n        organizationId: ctx.authOrgId,\n        filterField: 'userId',\n        filterValue: userExternalId,\n        limit: 1,\n      },\n      headers: this.headersOf(ctx),\n    });\n    const memberId = res?.members?.[0]?.id;\n    if (!memberId) {\n      throw new OrganizationRuleError('That person is no longer a member of this organization');\n    }\n    return memberId;\n  }\n}\n"],"mappings":";;;;;;;;;;AAkBA,SAAgB,WAAW,MAAyB;CAClD,MAAM,EAAE,mBAAmB,eAAe,kBAAkB,wBAAwB,KAAK;CAiGzF,OA/Fa,WAAW;EACtB,SAAS,KAAK;EACd,QAAQ,KAAK;EACb,gBAAgB,KAAK;EACrB,SAAS,EAKP,aAAa;GACX,SAAS;GACT,QAAQ;EACV,EACF;EACA,UAAU;GACR,UAAU,EAER,kBAAkB,SAAS,IAAI,EACjC;GAKA,uBAAuB;IACrB,SAAS;IACT,QAAQ,KAAK,gBAAgB,KAAA;GAC/B;GAIA,yBAAyB;IACvB,UAAU;IACV,QAAQ,KAAK,iBAAiB;IAC9B,UAAU;GACZ;EACF;EACA,UAAU,eAAe,KAAK,IAAI;GAChC,UAAU;GACV,QAAQ;EACV,CAAC;EACD,kBAAkB;GAChB,SAAS;GACT;EACF;EACA,SAAS;GACP,UAAU;IACR,eAAe;IACf;GACF,CAAC;GACD,aAAa;IACX;IACA;IACA,aAAa;IACb,mBAAmB,KAAK;GAC1B,CAAC;GAKD,cAAc,OAAO,EAAE,MAAM,cAAc;IACzC,MAAM,cAAc,MAAM,KAAK,GAC5B,OAAO;KACN,MAAM,WAAW,OAAO;KACxB,IAAI,WAAW,aAAa;KAC5B,MAAM,WAAW,aAAa;KAC9B,MAAM,WAAW,aAAa;IAChC,CAAC,CAAC,CACD,KAAK,WAAW,MAAM,CAAC,CACvB,UAAU,WAAW,cAAc,GAAG,WAAW,OAAO,gBAAgB,WAAW,aAAa,EAAE,CAAC,CAAC,CACpG,MAAM,GAAG,WAAW,OAAO,QAAQ,KAAK,EAAE,CAAC;IAC9C,MAAM,cACH,QAAqD,wBAAwB;IAChF,MAAM,SAAS,YAAY,MAAM,MAAM,EAAE,OAAO,WAAW,KAAK;IAChE,OAAO;KACL;KACA;KACA,kBAAkB,QAAQ,QAAQ;KAClC,oBAAoB,SAAS;MAAE,IAAI,OAAO;MAAI,MAAM,OAAO;MAAM,MAAM,OAAO;KAAK,IAAI;KACvF,eAAe,YAAY,KAAK,EAAE,IAAI,MAAM,YAAY;MAAE;MAAI;MAAM;KAAK,EAAE;IAC7E;GACF,CAAC;EACH;EACA,eAAe;GACb,MAAM,EACJ,QAAQ,EACN,QAAQ,iBACV,EACF;GACA,SAAS,EACP,QAAQ,EACN,QAAQ,oBACV,EACF;EACF;CACF,CACU;AACZ;AAIA,IAAa,aAAb,MAA2E;CACzE;CACA;CAEA,YAAY,MAAyB;EACnC,KAAK,OAAO,WAAW,IAAI;EAC3B,KAAK,SAAS,KAAK;CACrB;CAEA,MAAM,QAAQ,SAAoC;EAChD,OAAO,KAAK,KAAK,QAAQ,OAAO;CAClC;CAEA,MAAM,OAAO,SAA6D;EACxE,MAAM,MAAM,MAAM,KAAK,KAAK,IAAI,WAAW,EAAE,SAAS,gBAAgB,OAAO,EAAE,CAAC;EAChF,IAAI,CAAC,KACH,OAAO;EAET,OAAO;GACL,MAAM;IACJ,IAAI,IAAI,KAAK;IACb,WAAW,IAAI,KAAK;IACpB,OAAO,IAAI,KAAK;IAChB,WAAW,IAAI,KAAK;IACpB,YAAY,IAAI,KAAK;IACrB,UAAU,IAAI,KAAK;IACnB,WAAW,IAAI,KAAK;GACtB;GACA,SAAS,EAGP,sBACG,IAAI,QAAqD,wBAAwB,KACtF;EACF;CACF;;;;CAMA,MAAM,wBAAwB,SAAsB,OAAiC;EAEnF,MAAM,UAAS,MADO,KAAK,KAAK,IAAI,WAAW,EAAE,SAAS,gBAAgB,OAAO,EAAE,CAAC,EAAA,EAC5D,QAAA,EAA4C;EACpE,IAAI,CAAC,OACH,OAAO;EAGT,OAAM,MADY,KAAK,KAAK,SAAA,CAClB,gBAAgB,cAAc,OAAO,EAAE,sBAAsB,MAAM,CAAC;EAC9E,OAAO;CACT;CAEA,MAAM,mBACJ,SACA,OAC2B;EAC3B,MAAM,MAAM,MAAM,KAAK,KAAK,IAAI,mBAAmB;GACjD,MAAM;IAAE,MAAM,MAAM;IAAM,MAAM,MAAM;GAAK;GAC3C,SAAS,gBAAgB,OAAO;EAClC,CAAC;EACD,IAAI,CAAC,KACH,MAAM,IAAI,MAAM,8BAA8B;EAEhD,OAAO;GAAE,IAAI,IAAI;GAAI,MAAM,IAAI;GAAM,MAAM,IAAI;GAAM,WAAW,IAAI;EAAU;CAChF;CACA,MAAM,sBAAsB,SAAsB,YAAmC;EACnF,MAAM,KAAK,KAAK,IAAI,sBAAsB;GACxC,MAAM,EAAE,gBAAgB,WAAW;GACnC,SAAS,gBAAgB,OAAO;EAClC,CAAC;CACH;CACA,MAAM,mBACJ,SACA,YACA,OAC2B;EAC3B,IAAI;GACF,MAAM,MAAM,MAAM,KAAK,KAAK,IAAI,mBAAmB;IACjD,MAAM;KAAE,gBAAgB;KAAY,MAAM;MAAE,MAAM,MAAM;MAAM,MAAM,MAAM;KAAK;IAAE;IACjF,SAAS,gBAAgB,OAAO;GAClC,CAAC;GACD,IAAI,CAAC,KACH,MAAM,IAAI,MAAM,8BAA8B;GAEhD,OAAO;IAAE,IAAI,IAAI;IAAI,MAAM,IAAI;IAAM,MAAM,IAAI;IAAM,WAAW,IAAI;GAAU;EAChF,SAAS,KAAK;GAGZ,IAAI,eAAe,UACjB,MAAM,IAAI,sBAAsB,IAAI,WAAW,+BAA+B;GAEhF,MAAM;EACR;CACF;CACA,MAAM,mBAAmB,SAAsB,YAAmC;EAChF,IAAI;GACF,MAAM,KAAK,KAAK,IAAI,mBAAmB;IACrC,MAAM,EAAE,gBAAgB,WAAW;IACnC,SAAS,gBAAgB,OAAO;GAClC,CAAC;EACH,SAAS,KAAK;GACZ,IAAI,eAAe,UACjB,MAAM,IAAI,sBAAsB,IAAI,WAAW,+BAA+B;GAEhF,MAAM;EACR;CACF;CACA,MAAM,gBACJ,eACA,gBACA,MACe;EAEf,MAAM,KAAK,KAAK,IAAI,UAAU,EAC5B,MAAM;GAAE,QAAQ;GAAgB,gBAAgB;GAAe,MAAM,UAAU,IAAI;EAAE,EACvF,CAAC;CACH;CACA,MAAM,WAAW,KAAyB,gBAAwB,MAA2B;EAC3F,MAAM,KAAK,KAAK,IAAI,iBAAiB;GACnC,MAAM;IACJ,UAAU,MAAM,KAAK,gBAAgB,KAAK,cAAc;IACxD;IACA,gBAAgB,IAAI;GACtB;GACA,SAAS,KAAK,UAAU,GAAG;EAC7B,CAAC;CACH;CACA,MAAM,aAAa,KAAyB,gBAAuC;EACjF,MAAM,KAAK,KAAK,IAAI,aAAa;GAC/B,MAAM;IACJ,iBAAiB,MAAM,KAAK,gBAAgB,KAAK,cAAc;IAC/D,gBAAgB,IAAI;GACtB;GACA,SAAS,KAAK,UAAU,GAAG;EAC7B,CAAC;CACH;CAEA,UAAoB,KAAkC;EACpD,OAAO,gBAAgB,IAAI,OAAO;CACpC;CAKA,MAAgB,gBACd,KACA,gBACiB;EAUjB,MAAM,YAAW,MATC,KAAK,KAAK,IAAI,YAAY;GAC1C,OAAO;IACL,gBAAgB,IAAI;IACpB,aAAa;IACb,aAAa;IACb,OAAO;GACT;GACA,SAAS,KAAK,UAAU,GAAG;EAC7B,CAAC,EAAA,EACqB,UAAU,EAAE,EAAE;EACpC,IAAI,CAAC,UACH,MAAM,IAAI,sBAAsB,wDAAwD;EAE1F,OAAO;CACT;AACF"}

package/dist/index.d.ts

@@ -0,0 +1,3 @@
+import { CreateAuthOptions, Hooks } from "./types.js";
+import { Auth, BetterAuth, createAuth } from "./better-auth.js";
+export { Auth, BetterAuth, CreateAuthOptions, Hooks, createAuth };

package/dist/index.js

@@ -0,0 +1,3 @@
+import { BetterAuth, createAuth } from "./better-auth.js";
+import "./types.js";
+export { BetterAuth, createAuth };

package/dist/node_modules/.pnpm/zod@4.4.3/node_modules/zod/v4/core/schemas.d.ts

@@ -0,0 +1,8 @@
+//#region ../../node_modules/.pnpm/zod@4.4.3/node_modules/zod/v4/core/schemas.d.cts
+type $strip = {
+  out: {};
+  in: {};
+};
+//#endregion
+export { $strip };
+//# sourceMappingURL=schemas.d.ts.map

package/dist/types.d.ts

@@ -0,0 +1,41 @@
+import { GenericEndpointContext, Session, User } from "better-auth";
+import { OrganizationOptions } from "better-auth/plugins";
+import { NodePgDatabase } from "drizzle-orm/node-postgres";
+import { Logger } from "@headless-lms/core/types";
+//#region src/types.d.ts
+type Hooks = NonNullable<OrganizationOptions['organizationHooks']> & {
+  beforeUserCreate: (user: User & Record<string, unknown>, context: GenericEndpointContext | null) => Promise<boolean | void | {
+    data: User;
+  }>;
+  beforeCreateSession?: (session: Session & Record<string, unknown>, context: GenericEndpointContext | null) => Promise<boolean | void | {
+    data: Session & Record<string, unknown>;
+  }>;
+  sendResetPassword: (data: {
+    user: User;
+    url: string;
+    token: string;
+  }, request?: Request) => Promise<void>;
+  sendMagicLink: (data: {
+    email: string;
+    url: string;
+    token: string;
+    metadata?: Record<string, unknown>;
+  }, ctx?: GenericEndpointContext | undefined) => Promise<void>;
+};
+interface CreateAuthOptions {
+  db: NodePgDatabase;
+  baseUrl: string;
+  secret: string;
+  trustedOrigins: string[];
+  /** Logs failures that must not abort an auth flow (e.g. a failed invite email). */
+  logger: Logger;
+  /** Handlers for what the engine reports. The adapter owns no rules. */
+  hooks: Hooks;
+  /** Parent domain for cross-subdomain session cookies (e.g. ".example.com"); undefined → host-only cookie. */
+  cookieDomain?: string;
+  /** Mark session cookies Secure (set behind HTTPS / in production). */
+  secureCookies?: boolean;
+}
+//#endregion
+export { CreateAuthOptions, Hooks };
+//# sourceMappingURL=types.d.ts.map

package/dist/types.js

@@ -0,0 +1,3 @@
+import "better-auth";
+import "better-auth/plugins";
+export {};

package/package.json

@@ -0,0 +1,47 @@
+{
+  "name": "@headless-lms/adapter-auth",
+  "version": "0.1.0",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "dependencies": {
+    "better-auth": "^1.6.25",
+    "drizzle-orm": "^0.45.2",
+    "@headless-lms/adapter-db": "0.1.0",
+    "@headless-lms/core": "0.1.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.10.2",
+    "tsdown": "^0.22.9",
+    "typescript": "^5.7.2",
+    "vitest": "^2.1.8"
+  },
+  "description": "better-auth adapter for the headless LMS",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/mdwt/headless-lms.git",
+    "directory": "adapters/auth"
+  },
+  "homepage": "https://github.com/mdwt/headless-lms#readme",
+  "bugs": {
+    "url": "https://github.com/mdwt/headless-lms/issues"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsdown",
+    "test": "vitest run",
+    "typecheck": "tsc -p tsconfig.json --noEmit"
+  }
+}