@iskra-bun/auth-kit 0.1.0

package/dist/index.js

@@ -0,0 +1,278 @@
+// src/better-auth-config.ts
+import { betterAuth } from "better-auth";
+import { drizzleAdapter } from "better-auth/adapters/drizzle";
+import { genericOAuth } from "better-auth/plugins/generic-oauth";
+
+// src/schema.ts
+import { pgTable, text, timestamp, boolean } from "drizzle-orm/pg-core";
+import { mysqlTable, varchar, timestamp as mysqlTimestamp, boolean as mysqlBoolean, text as mysqlText } from "drizzle-orm/mysql-core";
+import { sqliteTable, text as sqliteText, integer } from "drizzle-orm/sqlite-core";
+var pgUser = pgTable("user", {
+  id: text("id").primaryKey(),
+  name: text("name"),
+  email: text("email").notNull().unique(),
+  emailVerified: boolean("emailVerified").notNull(),
+  image: text("image"),
+  createdAt: timestamp("createdAt").notNull(),
+  updatedAt: timestamp("updatedAt").notNull()
+});
+var pgSession = pgTable("session", {
+  id: text("id").primaryKey(),
+  expiresAt: timestamp("expiresAt").notNull(),
+  token: text("token").notNull().unique(),
+  createdAt: timestamp("createdAt").notNull(),
+  updatedAt: timestamp("updatedAt").notNull(),
+  ipAddress: text("ipAddress"),
+  userAgent: text("userAgent"),
+  userId: text("userId").notNull().references(() => pgUser.id)
+});
+var pgAccount = pgTable("account", {
+  id: text("id").primaryKey(),
+  accountId: text("accountId").notNull(),
+  providerId: text("providerId").notNull(),
+  userId: text("userId").notNull().references(() => pgUser.id),
+  accessToken: text("accessToken"),
+  refreshToken: text("refreshToken"),
+  idToken: text("idToken"),
+  accessTokenExpiresAt: timestamp("accessTokenExpiresAt"),
+  refreshTokenExpiresAt: timestamp("refreshTokenExpiresAt"),
+  scope: text("scope"),
+  password: text("password"),
+  createdAt: timestamp("createdAt").notNull(),
+  updatedAt: timestamp("updatedAt").notNull()
+});
+var pgVerification = pgTable("verification", {
+  id: text("id").primaryKey(),
+  identifier: text("identifier").notNull(),
+  value: text("value").notNull(),
+  expiresAt: timestamp("expiresAt").notNull(),
+  createdAt: timestamp("createdAt"),
+  updatedAt: timestamp("updatedAt")
+});
+var pgSchema = {
+  user: pgUser,
+  session: pgSession,
+  account: pgAccount,
+  verification: pgVerification
+};
+var mysqlUser = mysqlTable("user", {
+  id: varchar("id", { length: 36 }).primaryKey(),
+  name: varchar("name", { length: 255 }),
+  email: varchar("email", { length: 255 }).notNull().unique(),
+  emailVerified: mysqlBoolean("emailVerified").notNull(),
+  image: varchar("image", { length: 255 }),
+  createdAt: mysqlTimestamp("createdAt").notNull(),
+  updatedAt: mysqlTimestamp("updatedAt").notNull()
+});
+var mysqlSession = mysqlTable("session", {
+  id: varchar("id", { length: 36 }).primaryKey(),
+  expiresAt: mysqlTimestamp("expiresAt").notNull(),
+  token: varchar("token", { length: 255 }).notNull().unique(),
+  createdAt: mysqlTimestamp("createdAt").notNull(),
+  updatedAt: mysqlTimestamp("updatedAt").notNull(),
+  ipAddress: varchar("ipAddress", { length: 45 }),
+  userAgent: mysqlText("userAgent"),
+  userId: varchar("userId", { length: 36 }).notNull().references(() => mysqlUser.id)
+});
+var mysqlAccount = mysqlTable("account", {
+  id: varchar("id", { length: 36 }).primaryKey(),
+  accountId: varchar("accountId", { length: 255 }).notNull(),
+  providerId: varchar("providerId", { length: 255 }).notNull(),
+  userId: varchar("userId", { length: 36 }).notNull().references(() => mysqlUser.id),
+  accessToken: mysqlText("accessToken"),
+  refreshToken: mysqlText("refreshToken"),
+  idToken: mysqlText("idToken"),
+  accessTokenExpiresAt: mysqlTimestamp("accessTokenExpiresAt"),
+  refreshTokenExpiresAt: mysqlTimestamp("refreshTokenExpiresAt"),
+  scope: mysqlText("scope"),
+  password: varchar("password", { length: 255 }),
+  createdAt: mysqlTimestamp("createdAt").notNull(),
+  updatedAt: mysqlTimestamp("updatedAt").notNull()
+});
+var mysqlVerification = mysqlTable("verification", {
+  id: varchar("id", { length: 36 }).primaryKey(),
+  identifier: varchar("identifier", { length: 255 }).notNull(),
+  value: varchar("value", { length: 255 }).notNull(),
+  expiresAt: mysqlTimestamp("expiresAt").notNull(),
+  createdAt: mysqlTimestamp("createdAt"),
+  updatedAt: mysqlTimestamp("updatedAt")
+});
+var mysqlSchema = {
+  user: mysqlUser,
+  session: mysqlSession,
+  account: mysqlAccount,
+  verification: mysqlVerification
+};
+var sqliteUser = sqliteTable("user", {
+  id: sqliteText("id").primaryKey(),
+  name: sqliteText("name"),
+  email: sqliteText("email").notNull().unique(),
+  emailVerified: integer("emailVerified", { mode: "boolean" }).notNull(),
+  image: sqliteText("image"),
+  createdAt: integer("createdAt", { mode: "timestamp" }).notNull(),
+  updatedAt: integer("updatedAt", { mode: "timestamp" }).notNull()
+});
+var sqliteSession = sqliteTable("session", {
+  id: sqliteText("id").primaryKey(),
+  expiresAt: integer("expiresAt", { mode: "timestamp" }).notNull(),
+  token: sqliteText("token").notNull().unique(),
+  createdAt: integer("createdAt", { mode: "timestamp" }).notNull(),
+  updatedAt: integer("updatedAt", { mode: "timestamp" }).notNull(),
+  ipAddress: sqliteText("ipAddress"),
+  userAgent: sqliteText("userAgent"),
+  userId: sqliteText("userId").notNull().references(() => sqliteUser.id)
+});
+var sqliteAccount = sqliteTable("account", {
+  id: sqliteText("id").primaryKey(),
+  accountId: sqliteText("accountId").notNull(),
+  providerId: sqliteText("providerId").notNull(),
+  userId: sqliteText("userId").notNull().references(() => sqliteUser.id),
+  accessToken: sqliteText("accessToken"),
+  refreshToken: sqliteText("refreshToken"),
+  idToken: sqliteText("idToken"),
+  accessTokenExpiresAt: integer("accessTokenExpiresAt", { mode: "timestamp" }),
+  refreshTokenExpiresAt: integer("refreshTokenExpiresAt", { mode: "timestamp" }),
+  scope: sqliteText("scope"),
+  password: sqliteText("password"),
+  createdAt: integer("createdAt", { mode: "timestamp" }).notNull(),
+  updatedAt: integer("updatedAt", { mode: "timestamp" }).notNull()
+});
+var sqliteVerification = sqliteTable("verification", {
+  id: sqliteText("id").primaryKey(),
+  identifier: sqliteText("identifier").notNull(),
+  value: sqliteText("value").notNull(),
+  expiresAt: integer("expiresAt", { mode: "timestamp" }).notNull(),
+  createdAt: integer("createdAt", { mode: "timestamp" }),
+  updatedAt: integer("updatedAt", { mode: "timestamp" })
+});
+var sqliteSchema = {
+  user: sqliteUser,
+  session: sqliteSession,
+  account: sqliteAccount,
+  verification: sqliteVerification
+};
+
+// src/better-auth-config.ts
+var MIN_SECRET_LENGTH = 32;
+function createBetterAuth(options) {
+  const {
+    db,
+    adapterType,
+    secret,
+    baseURL = "http://localhost:3000",
+    basePath = "/api/auth",
+    trustedOrigins = [],
+    enableEmailPassword = true,
+    disableCSRFCheck = false,
+    cookieCacheMaxAge = 5 * 60,
+    socialProviders,
+    oidcConfig
+  } = options;
+  if (!secret || secret.length < MIN_SECRET_LENGTH) {
+    throw new Error(
+      `auth secret must be at least ${MIN_SECRET_LENGTH} characters; received ${secret ? secret.length : 0}`
+    );
+  }
+  const baseOrigin = new URL(baseURL).origin;
+  const allTrustedOrigins = trustedOrigins.includes(baseOrigin) ? trustedOrigins : [baseOrigin, ...trustedOrigins];
+  let schema;
+  let provider;
+  switch (adapterType) {
+    case "postgres":
+      schema = pgSchema;
+      provider = "pg";
+      break;
+    case "mysql":
+      schema = mysqlSchema;
+      provider = "mysql";
+      break;
+    case "sqlite":
+      schema = sqliteSchema;
+      provider = "sqlite";
+      break;
+    default:
+      throw new Error(`Unsupported adapter type: ${adapterType}`);
+  }
+  const database = drizzleAdapter(db, {
+    provider,
+    schema
+  });
+  const plugins = [];
+  if (oidcConfig) {
+    const authorizationUrl = oidcConfig.authorizationEndpoint || `${oidcConfig.issuer}/protocol/openid-connect/auth`;
+    const tokenUrl = oidcConfig.tokenEndpoint || `${oidcConfig.issuer}/protocol/openid-connect/token`;
+    const userInfoUrl = oidcConfig.userinfoEndpoint || `${oidcConfig.issuer}/protocol/openid-connect/userinfo`;
+    plugins.push(
+      genericOAuth({
+        config: [
+          {
+            providerId: oidcConfig.providerId || "oidc",
+            clientId: oidcConfig.clientId,
+            clientSecret: oidcConfig.clientSecret,
+            authorizationUrl,
+            tokenUrl,
+            userInfoUrl,
+            discoveryUrl: oidcConfig.discoveryEndpoint || `${oidcConfig.issuer}/.well-known/openid-configuration`,
+            scopes: oidcConfig.scopes || ["openid", "email", "profile"],
+            // Secure default: PKCE on. Disabling exposes auth-code
+            // interception/injection and requires an explicit false.
+            pkce: oidcConfig.pkce !== void 0 ? oidcConfig.pkce : true,
+            mapProfileToUser: (profile) => {
+              return {
+                id: profile.sub || profile.id,
+                email: profile.email,
+                name: profile.name || profile.preferred_username,
+                image: profile.picture || profile.image,
+                emailVerified: profile.email_verified || false
+              };
+            }
+          }
+        ]
+      })
+    );
+  }
+  return betterAuth({
+    database,
+    secret,
+    baseURL,
+    basePath,
+    trustedOrigins: allTrustedOrigins,
+    emailAndPassword: enableEmailPassword ? {
+      enabled: true,
+      autoSignIn: true
+    } : void 0,
+    socialProviders: Object.keys(socialProviders || {}).length > 0 ? socialProviders : void 0,
+    plugins,
+    session: {
+      expiresIn: 60 * 60 * 24 * 7,
+      updateAge: 60 * 60 * 24,
+      cookieCache: {
+        enabled: true,
+        maxAge: cookieCacheMaxAge
+      }
+    },
+    advanced: {
+      disableCSRFCheck,
+      generateId: () => crypto.randomUUID().replace(/-/g, "")
+    }
+  });
+}
+export {
+  createBetterAuth,
+  mysqlAccount,
+  mysqlSchema,
+  mysqlSession,
+  mysqlUser,
+  mysqlVerification,
+  pgAccount,
+  pgSchema,
+  pgSession,
+  pgUser,
+  pgVerification,
+  sqliteAccount,
+  sqliteSchema,
+  sqliteSession,
+  sqliteUser,
+  sqliteVerification
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/better-auth-config.ts","../src/schema.ts"],"sourcesContent":["import { betterAuth, type Auth as BetterAuthInstance } from \"better-auth\";\nimport { drizzleAdapter, type DB as DrizzleAdapterDb } from \"better-auth/adapters/drizzle\";\nimport { genericOAuth } from \"better-auth/plugins/generic-oauth\";\nimport type { PgDatabase, PgQueryResultHKT } from \"drizzle-orm/pg-core\";\nimport type { MySqlDatabase, MySqlQueryResultHKT, PreparedQueryHKTBase } from \"drizzle-orm/mysql-core\";\nimport type { BaseSQLiteDatabase } from \"drizzle-orm/sqlite-core\";\nimport { pgSchema, mysqlSchema, sqliteSchema } from \"./schema\";\n\n/**\n * The Drizzle database handle auth-kit accepts. A union of the supported dialect\n * databases (mirrors web-kit's `WebKitDrizzleDb`) so the public input is a real\n * Drizzle instance rather than `any` leaking into callers. The dialect-core base\n * classes are part of `drizzle-orm` itself, so no driver dependency is required.\n */\nexport type AuthKitDrizzleDb =\n    | PgDatabase<PgQueryResultHKT, Record<string, unknown>>\n    | MySqlDatabase<MySqlQueryResultHKT, PreparedQueryHKTBase, Record<string, unknown>>\n    | BaseSQLiteDatabase<\"sync\" | \"async\", unknown, Record<string, unknown>>;\n\n/** Minimum length, in characters, for the session-signing secret. */\nconst MIN_SECRET_LENGTH = 32;\n\nexport interface BetterAuthConfigOptions {\n    db: AuthKitDrizzleDb;\n    adapterType: \"postgres\" | \"mysql\" | \"sqlite\";\n    secret: string;\n    baseURL?: string;\n    basePath?: string;\n    trustedOrigins?: string[];\n    enableEmailPassword?: boolean;\n    disableCSRFCheck?: boolean;\n    /**\n     * Cookie-cache lifetime in seconds. This is the session-revocation lag: a\n     * revoked session keeps passing cached cookie checks until the cache entry\n     * expires. Lower it to tighten the revocation window (at the cost of more\n     * frequent DB lookups). Defaults to 300 (5 minutes).\n     */\n    cookieCacheMaxAge?: number;\n    // deno-lint-ignore no-explicit-any\n    socialProviders?: Record<string, any>;\n    oidcConfig?: {\n        clientId: string;\n        clientSecret: string;\n        issuer: string;\n        providerId?: string;\n        authorizationEndpoint?: string;\n        tokenEndpoint?: string;\n        userinfoEndpoint?: string;\n        jwksEndpoint?: string;\n        discoveryEndpoint?: string;\n        scopes?: string[];\n        pkce?: boolean;\n        mapping?: {\n            id?: string;\n            email?: string;\n            emailVerified?: string;\n            name?: string;\n            image?: string;\n            extraFields?: Record<string, string>;\n        };\n    };\n}\n\nexport function createBetterAuth(options: BetterAuthConfigOptions): BetterAuthInstance {\n    const {\n        db,\n        adapterType,\n        secret,\n        baseURL = \"http://localhost:3000\",\n        basePath = \"/api/auth\",\n        trustedOrigins = [],\n        enableEmailPassword = true,\n        disableCSRFCheck = false,\n        cookieCacheMaxAge = 5 * 60,\n        socialProviders,\n        oidcConfig,\n    } = options;\n\n    // A weak or empty secret signs forgeable sessions, so reject it before\n    // betterAuth() ever sees it rather than silently building an insecure auth.\n    if (!secret || secret.length < MIN_SECRET_LENGTH) {\n        throw new Error(\n            `auth secret must be at least ${MIN_SECRET_LENGTH} characters; received ${secret ? secret.length : 0}`,\n        );\n    }\n\n    const baseOrigin = new URL(baseURL).origin;\n    const allTrustedOrigins = trustedOrigins.includes(baseOrigin)\n        ? trustedOrigins\n        : [baseOrigin, ...trustedOrigins];\n\n    let schema;\n    let provider: \"pg\" | \"mysql\" | \"sqlite\";\n\n    switch (adapterType) {\n        case \"postgres\":\n            schema = pgSchema;\n            provider = \"pg\";\n            break;\n        case \"mysql\":\n            schema = mysqlSchema;\n            provider = \"mysql\";\n            break;\n        case \"sqlite\":\n            schema = sqliteSchema;\n            provider = \"sqlite\";\n            break;\n        default:\n            throw new Error(`Unsupported adapter type: ${adapterType}`);\n    }\n\n    const database = drizzleAdapter(db as unknown as DrizzleAdapterDb, {\n        provider,\n        schema\n    });\n\n    const plugins = [];\n    if (oidcConfig) {\n        const authorizationUrl = oidcConfig.authorizationEndpoint ||\n            `${oidcConfig.issuer}/protocol/openid-connect/auth`;\n        const tokenUrl = oidcConfig.tokenEndpoint ||\n            `${oidcConfig.issuer}/protocol/openid-connect/token`;\n        const userInfoUrl = oidcConfig.userinfoEndpoint ||\n            `${oidcConfig.issuer}/protocol/openid-connect/userinfo`;\n\n        plugins.push(\n            genericOAuth({\n                config: [\n                    {\n                        providerId: oidcConfig.providerId || \"oidc\",\n                        clientId: oidcConfig.clientId,\n                        clientSecret: oidcConfig.clientSecret,\n                        authorizationUrl,\n                        tokenUrl,\n                        userInfoUrl,\n                        discoveryUrl: oidcConfig.discoveryEndpoint ||\n                            `${oidcConfig.issuer}/.well-known/openid-configuration`,\n                        scopes: oidcConfig.scopes || [\"openid\", \"email\", \"profile\"],\n                        // Secure default: PKCE on. Disabling exposes auth-code\n                        // interception/injection and requires an explicit false.\n                        pkce: oidcConfig.pkce !== undefined ? oidcConfig.pkce : true,\n                        mapProfileToUser: (profile: any) => {\n                            return {\n                                id: profile.sub || profile.id,\n                                email: profile.email,\n                                name: profile.name || profile.preferred_username,\n                                image: profile.picture || profile.image,\n                                emailVerified: profile.email_verified || false,\n                            };\n                        },\n                    },\n                ],\n            }),\n        );\n    }\n\n    return betterAuth({\n        database,\n        secret,\n        baseURL,\n        basePath,\n        trustedOrigins: allTrustedOrigins,\n        emailAndPassword: enableEmailPassword\n            ? {\n                enabled: true,\n                autoSignIn: true,\n            }\n            : undefined,\n        socialProviders: Object.keys(socialProviders || {}).length > 0 ? socialProviders : undefined,\n        plugins,\n        session: {\n            expiresIn: 60 * 60 * 24 * 7,\n            updateAge: 60 * 60 * 24,\n            cookieCache: {\n                enabled: true,\n                maxAge: cookieCacheMaxAge,\n            },\n        },\n        advanced: {\n            disableCSRFCheck,\n            generateId: () => crypto.randomUUID().replace(/-/g, \"\"),\n        },\n    }) as unknown as BetterAuthInstance;\n}\n\nexport type Auth = ReturnType<typeof createBetterAuth>;\n","import { pgTable, text, timestamp, boolean } from \"drizzle-orm/pg-core\";\nimport { mysqlTable, varchar, timestamp as mysqlTimestamp, boolean as mysqlBoolean, text as mysqlText } from \"drizzle-orm/mysql-core\";\nimport { sqliteTable, text as sqliteText, integer } from \"drizzle-orm/sqlite-core\";\n\n// ==========================================\n// PostgreSQL Schema\n// ==========================================\n\nexport const pgUser = pgTable(\"user\", {\n    id: text(\"id\").primaryKey(),\n    name: text(\"name\"),\n    email: text(\"email\").notNull().unique(),\n    emailVerified: boolean(\"emailVerified\").notNull(),\n    image: text(\"image\"),\n    createdAt: timestamp(\"createdAt\").notNull(),\n    updatedAt: timestamp(\"updatedAt\").notNull()\n});\n\nexport const pgSession = pgTable(\"session\", {\n    id: text(\"id\").primaryKey(),\n    expiresAt: timestamp(\"expiresAt\").notNull(),\n    token: text(\"token\").notNull().unique(),\n    createdAt: timestamp(\"createdAt\").notNull(),\n    updatedAt: timestamp(\"updatedAt\").notNull(),\n    ipAddress: text(\"ipAddress\"),\n    userAgent: text(\"userAgent\"),\n    userId: text(\"userId\").notNull().references(() => pgUser.id)\n});\n\nexport const pgAccount = pgTable(\"account\", {\n    id: text(\"id\").primaryKey(),\n    accountId: text(\"accountId\").notNull(),\n    providerId: text(\"providerId\").notNull(),\n    userId: text(\"userId\").notNull().references(() => pgUser.id),\n    accessToken: text(\"accessToken\"),\n    refreshToken: text(\"refreshToken\"),\n    idToken: text(\"idToken\"),\n    accessTokenExpiresAt: timestamp(\"accessTokenExpiresAt\"),\n    refreshTokenExpiresAt: timestamp(\"refreshTokenExpiresAt\"),\n    scope: text(\"scope\"),\n    password: text(\"password\"),\n    createdAt: timestamp(\"createdAt\").notNull(),\n    updatedAt: timestamp(\"updatedAt\").notNull()\n});\n\nexport const pgVerification = pgTable(\"verification\", {\n    id: text(\"id\").primaryKey(),\n    identifier: text(\"identifier\").notNull(),\n    value: text(\"value\").notNull(),\n    expiresAt: timestamp(\"expiresAt\").notNull(),\n    createdAt: timestamp(\"createdAt\"),\n    updatedAt: timestamp(\"updatedAt\")\n});\n\nexport const pgSchema = {\n    user: pgUser,\n    session: pgSession,\n    account: pgAccount,\n    verification: pgVerification\n};\n\n// ==========================================\n// MySQL Schema\n// ==========================================\n\nexport const mysqlUser = mysqlTable(\"user\", {\n    id: varchar(\"id\", { length: 36 }).primaryKey(),\n    name: varchar(\"name\", { length: 255 }),\n    email: varchar(\"email\", { length: 255 }).notNull().unique(),\n    emailVerified: mysqlBoolean(\"emailVerified\").notNull(),\n    image: varchar(\"image\", { length: 255 }),\n    createdAt: mysqlTimestamp(\"createdAt\").notNull(),\n    updatedAt: mysqlTimestamp(\"updatedAt\").notNull()\n});\n\nexport const mysqlSession = mysqlTable(\"session\", {\n    id: varchar(\"id\", { length: 36 }).primaryKey(),\n    expiresAt: mysqlTimestamp(\"expiresAt\").notNull(),\n    token: varchar(\"token\", { length: 255 }).notNull().unique(),\n    createdAt: mysqlTimestamp(\"createdAt\").notNull(),\n    updatedAt: mysqlTimestamp(\"updatedAt\").notNull(),\n    ipAddress: varchar(\"ipAddress\", { length: 45 }),\n    userAgent: mysqlText(\"userAgent\"),\n    userId: varchar(\"userId\", { length: 36 }).notNull().references(() => mysqlUser.id)\n});\n\nexport const mysqlAccount = mysqlTable(\"account\", {\n    id: varchar(\"id\", { length: 36 }).primaryKey(),\n    accountId: varchar(\"accountId\", { length: 255 }).notNull(),\n    providerId: varchar(\"providerId\", { length: 255 }).notNull(),\n    userId: varchar(\"userId\", { length: 36 }).notNull().references(() => mysqlUser.id),\n    accessToken: mysqlText(\"accessToken\"),\n    refreshToken: mysqlText(\"refreshToken\"),\n    idToken: mysqlText(\"idToken\"),\n    accessTokenExpiresAt: mysqlTimestamp(\"accessTokenExpiresAt\"),\n    refreshTokenExpiresAt: mysqlTimestamp(\"refreshTokenExpiresAt\"),\n    scope: mysqlText(\"scope\"),\n    password: varchar(\"password\", { length: 255 }),\n    createdAt: mysqlTimestamp(\"createdAt\").notNull(),\n    updatedAt: mysqlTimestamp(\"updatedAt\").notNull()\n});\n\nexport const mysqlVerification = mysqlTable(\"verification\", {\n    id: varchar(\"id\", { length: 36 }).primaryKey(),\n    identifier: varchar(\"identifier\", { length: 255 }).notNull(),\n    value: varchar(\"value\", { length: 255 }).notNull(),\n    expiresAt: mysqlTimestamp(\"expiresAt\").notNull(),\n    createdAt: mysqlTimestamp(\"createdAt\"),\n    updatedAt: mysqlTimestamp(\"updatedAt\")\n});\n\nexport const mysqlSchema = {\n    user: mysqlUser,\n    session: mysqlSession,\n    account: mysqlAccount,\n    verification: mysqlVerification\n};\n\n// ==========================================\n// SQLite Schema\n// ==========================================\n\nexport const sqliteUser = sqliteTable(\"user\", {\n    id: sqliteText(\"id\").primaryKey(),\n    name: sqliteText(\"name\"),\n    email: sqliteText(\"email\").notNull().unique(),\n    emailVerified: integer(\"emailVerified\", { mode: \"boolean\" }).notNull(),\n    image: sqliteText(\"image\"),\n    createdAt: integer(\"createdAt\", { mode: \"timestamp\" }).notNull(),\n    updatedAt: integer(\"updatedAt\", { mode: \"timestamp\" }).notNull()\n});\n\nexport const sqliteSession = sqliteTable(\"session\", {\n    id: sqliteText(\"id\").primaryKey(),\n    expiresAt: integer(\"expiresAt\", { mode: \"timestamp\" }).notNull(),\n    token: sqliteText(\"token\").notNull().unique(),\n    createdAt: integer(\"createdAt\", { mode: \"timestamp\" }).notNull(),\n    updatedAt: integer(\"updatedAt\", { mode: \"timestamp\" }).notNull(),\n    ipAddress: sqliteText(\"ipAddress\"),\n    userAgent: sqliteText(\"userAgent\"),\n    userId: sqliteText(\"userId\").notNull().references(() => sqliteUser.id)\n});\n\nexport const sqliteAccount = sqliteTable(\"account\", {\n    id: sqliteText(\"id\").primaryKey(),\n    accountId: sqliteText(\"accountId\").notNull(),\n    providerId: sqliteText(\"providerId\").notNull(),\n    userId: sqliteText(\"userId\").notNull().references(() => sqliteUser.id),\n    accessToken: sqliteText(\"accessToken\"),\n    refreshToken: sqliteText(\"refreshToken\"),\n    idToken: sqliteText(\"idToken\"),\n    accessTokenExpiresAt: integer(\"accessTokenExpiresAt\", { mode: \"timestamp\" }),\n    refreshTokenExpiresAt: integer(\"refreshTokenExpiresAt\", { mode: \"timestamp\" }),\n    scope: sqliteText(\"scope\"),\n    password: sqliteText(\"password\"),\n    createdAt: integer(\"createdAt\", { mode: \"timestamp\" }).notNull(),\n    updatedAt: integer(\"updatedAt\", { mode: \"timestamp\" }).notNull()\n});\n\nexport const sqliteVerification = sqliteTable(\"verification\", {\n    id: sqliteText(\"id\").primaryKey(),\n    identifier: sqliteText(\"identifier\").notNull(),\n    value: sqliteText(\"value\").notNull(),\n    expiresAt: integer(\"expiresAt\", { mode: \"timestamp\" }).notNull(),\n    createdAt: integer(\"createdAt\", { mode: \"timestamp\" }),\n    updatedAt: integer(\"updatedAt\", { mode: \"timestamp\" })\n});\n\nexport const sqliteSchema = {\n    user: sqliteUser,\n    session: sqliteSession,\n    account: sqliteAccount,\n    verification: sqliteVerification\n};\n"],"mappings":";AAAA,SAAS,kBAAmD;AAC5D,SAAS,sBAAmD;AAC5D,SAAS,oBAAoB;;;ACF7B,SAAS,SAAS,MAAM,WAAW,eAAe;AAClD,SAAS,YAAY,SAAS,aAAa,gBAAgB,WAAW,cAAc,QAAQ,iBAAiB;AAC7G,SAAS,aAAa,QAAQ,YAAY,eAAe;AAMlD,IAAM,SAAS,QAAQ,QAAQ;AAAA,EAClC,IAAI,KAAK,IAAI,EAAE,WAAW;AAAA,EAC1B,MAAM,KAAK,MAAM;AAAA,EACjB,OAAO,KAAK,OAAO,EAAE,QAAQ,EAAE,OAAO;AAAA,EACtC,eAAe,QAAQ,eAAe,EAAE,QAAQ;AAAA,EAChD,OAAO,KAAK,OAAO;AAAA,EACnB,WAAW,UAAU,WAAW,EAAE,QAAQ;AAAA,EAC1C,WAAW,UAAU,WAAW,EAAE,QAAQ;AAC9C,CAAC;AAEM,IAAM,YAAY,QAAQ,WAAW;AAAA,EACxC,IAAI,KAAK,IAAI,EAAE,WAAW;AAAA,EAC1B,WAAW,UAAU,WAAW,EAAE,QAAQ;AAAA,EAC1C,OAAO,KAAK,OAAO,EAAE,QAAQ,EAAE,OAAO;AAAA,EACtC,WAAW,UAAU,WAAW,EAAE,QAAQ;AAAA,EAC1C,WAAW,UAAU,WAAW,EAAE,QAAQ;AAAA,EAC1C,WAAW,KAAK,WAAW;AAAA,EAC3B,WAAW,KAAK,WAAW;AAAA,EAC3B,QAAQ,KAAK,QAAQ,EAAE,QAAQ,EAAE,WAAW,MAAM,OAAO,EAAE;AAC/D,CAAC;AAEM,IAAM,YAAY,QAAQ,WAAW;AAAA,EACxC,IAAI,KAAK,IAAI,EAAE,WAAW;AAAA,EAC1B,WAAW,KAAK,WAAW,EAAE,QAAQ;AAAA,EACrC,YAAY,KAAK,YAAY,EAAE,QAAQ;AAAA,EACvC,QAAQ,KAAK,QAAQ,EAAE,QAAQ,EAAE,WAAW,MAAM,OAAO,EAAE;AAAA,EAC3D,aAAa,KAAK,aAAa;AAAA,EAC/B,cAAc,KAAK,cAAc;AAAA,EACjC,SAAS,KAAK,SAAS;AAAA,EACvB,sBAAsB,UAAU,sBAAsB;AAAA,EACtD,uBAAuB,UAAU,uBAAuB;AAAA,EACxD,OAAO,KAAK,OAAO;AAAA,EACnB,UAAU,KAAK,UAAU;AAAA,EACzB,WAAW,UAAU,WAAW,EAAE,QAAQ;AAAA,EAC1C,WAAW,UAAU,WAAW,EAAE,QAAQ;AAC9C,CAAC;AAEM,IAAM,iBAAiB,QAAQ,gBAAgB;AAAA,EAClD,IAAI,KAAK,IAAI,EAAE,WAAW;AAAA,EAC1B,YAAY,KAAK,YAAY,EAAE,QAAQ;AAAA,EACvC,OAAO,KAAK,OAAO,EAAE,QAAQ;AAAA,EAC7B,WAAW,UAAU,WAAW,EAAE,QAAQ;AAAA,EAC1C,WAAW,UAAU,WAAW;AAAA,EAChC,WAAW,UAAU,WAAW;AACpC,CAAC;AAEM,IAAM,WAAW;AAAA,EACpB,MAAM;AAAA,EACN,SAAS;AAAA,EACT,SAAS;AAAA,EACT,cAAc;AAClB;AAMO,IAAM,YAAY,WAAW,QAAQ;AAAA,EACxC,IAAI,QAAQ,MAAM,EAAE,QAAQ,GAAG,CAAC,EAAE,WAAW;AAAA,EAC7C,MAAM,QAAQ,QAAQ,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrC,OAAO,QAAQ,SAAS,EAAE,QAAQ,IAAI,CAAC,EAAE,QAAQ,EAAE,OAAO;AAAA,EAC1D,eAAe,aAAa,eAAe,EAAE,QAAQ;AAAA,EACrD,OAAO,QAAQ,SAAS,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvC,WAAW,eAAe,WAAW,EAAE,QAAQ;AAAA,EAC/C,WAAW,eAAe,WAAW,EAAE,QAAQ;AACnD,CAAC;AAEM,IAAM,eAAe,WAAW,WAAW;AAAA,EAC9C,IAAI,QAAQ,MAAM,EAAE,QAAQ,GAAG,CAAC,EAAE,WAAW;AAAA,EAC7C,WAAW,eAAe,WAAW,EAAE,QAAQ;AAAA,EAC/C,OAAO,QAAQ,SAAS,EAAE,QAAQ,IAAI,CAAC,EAAE,QAAQ,EAAE,OAAO;AAAA,EAC1D,WAAW,eAAe,WAAW,EAAE,QAAQ;AAAA,EAC/C,WAAW,eAAe,WAAW,EAAE,QAAQ;AAAA,EAC/C,WAAW,QAAQ,aAAa,EAAE,QAAQ,GAAG,CAAC;AAAA,EAC9C,WAAW,UAAU,WAAW;AAAA,EAChC,QAAQ,QAAQ,UAAU,EAAE,QAAQ,GAAG,CAAC,EAAE,QAAQ,EAAE,WAAW,MAAM,UAAU,EAAE;AACrF,CAAC;AAEM,IAAM,eAAe,WAAW,WAAW;AAAA,EAC9C,IAAI,QAAQ,MAAM,EAAE,QAAQ,GAAG,CAAC,EAAE,WAAW;AAAA,EAC7C,WAAW,QAAQ,aAAa,EAAE,QAAQ,IAAI,CAAC,EAAE,QAAQ;AAAA,EACzD,YAAY,QAAQ,cAAc,EAAE,QAAQ,IAAI,CAAC,EAAE,QAAQ;AAAA,EAC3D,QAAQ,QAAQ,UAAU,EAAE,QAAQ,GAAG,CAAC,EAAE,QAAQ,EAAE,WAAW,MAAM,UAAU,EAAE;AAAA,EACjF,aAAa,UAAU,aAAa;AAAA,EACpC,cAAc,UAAU,cAAc;AAAA,EACtC,SAAS,UAAU,SAAS;AAAA,EAC5B,sBAAsB,eAAe,sBAAsB;AAAA,EAC3D,uBAAuB,eAAe,uBAAuB;AAAA,EAC7D,OAAO,UAAU,OAAO;AAAA,EACxB,UAAU,QAAQ,YAAY,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC7C,WAAW,eAAe,WAAW,EAAE,QAAQ;AAAA,EAC/C,WAAW,eAAe,WAAW,EAAE,QAAQ;AACnD,CAAC;AAEM,IAAM,oBAAoB,WAAW,gBAAgB;AAAA,EACxD,IAAI,QAAQ,MAAM,EAAE,QAAQ,GAAG,CAAC,EAAE,WAAW;AAAA,EAC7C,YAAY,QAAQ,cAAc,EAAE,QAAQ,IAAI,CAAC,EAAE,QAAQ;AAAA,EAC3D,OAAO,QAAQ,SAAS,EAAE,QAAQ,IAAI,CAAC,EAAE,QAAQ;AAAA,EACjD,WAAW,eAAe,WAAW,EAAE,QAAQ;AAAA,EAC/C,WAAW,eAAe,WAAW;AAAA,EACrC,WAAW,eAAe,WAAW;AACzC,CAAC;AAEM,IAAM,cAAc;AAAA,EACvB,MAAM;AAAA,EACN,SAAS;AAAA,EACT,SAAS;AAAA,EACT,cAAc;AAClB;AAMO,IAAM,aAAa,YAAY,QAAQ;AAAA,EAC1C,IAAI,WAAW,IAAI,EAAE,WAAW;AAAA,EAChC,MAAM,WAAW,MAAM;AAAA,EACvB,OAAO,WAAW,OAAO,EAAE,QAAQ,EAAE,OAAO;AAAA,EAC5C,eAAe,QAAQ,iBAAiB,EAAE,MAAM,UAAU,CAAC,EAAE,QAAQ;AAAA,EACrE,OAAO,WAAW,OAAO;AAAA,EACzB,WAAW,QAAQ,aAAa,EAAE,MAAM,YAAY,CAAC,EAAE,QAAQ;AAAA,EAC/D,WAAW,QAAQ,aAAa,EAAE,MAAM,YAAY,CAAC,EAAE,QAAQ;AACnE,CAAC;AAEM,IAAM,gBAAgB,YAAY,WAAW;AAAA,EAChD,IAAI,WAAW,IAAI,EAAE,WAAW;AAAA,EAChC,WAAW,QAAQ,aAAa,EAAE,MAAM,YAAY,CAAC,EAAE,QAAQ;AAAA,EAC/D,OAAO,WAAW,OAAO,EAAE,QAAQ,EAAE,OAAO;AAAA,EAC5C,WAAW,QAAQ,aAAa,EAAE,MAAM,YAAY,CAAC,EAAE,QAAQ;AAAA,EAC/D,WAAW,QAAQ,aAAa,EAAE,MAAM,YAAY,CAAC,EAAE,QAAQ;AAAA,EAC/D,WAAW,WAAW,WAAW;AAAA,EACjC,WAAW,WAAW,WAAW;AAAA,EACjC,QAAQ,WAAW,QAAQ,EAAE,QAAQ,EAAE,WAAW,MAAM,WAAW,EAAE;AACzE,CAAC;AAEM,IAAM,gBAAgB,YAAY,WAAW;AAAA,EAChD,IAAI,WAAW,IAAI,EAAE,WAAW;AAAA,EAChC,WAAW,WAAW,WAAW,EAAE,QAAQ;AAAA,EAC3C,YAAY,WAAW,YAAY,EAAE,QAAQ;AAAA,EAC7C,QAAQ,WAAW,QAAQ,EAAE,QAAQ,EAAE,WAAW,MAAM,WAAW,EAAE;AAAA,EACrE,aAAa,WAAW,aAAa;AAAA,EACrC,cAAc,WAAW,cAAc;AAAA,EACvC,SAAS,WAAW,SAAS;AAAA,EAC7B,sBAAsB,QAAQ,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAAA,EAC3E,uBAAuB,QAAQ,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAAA,EAC7E,OAAO,WAAW,OAAO;AAAA,EACzB,UAAU,WAAW,UAAU;AAAA,EAC/B,WAAW,QAAQ,aAAa,EAAE,MAAM,YAAY,CAAC,EAAE,QAAQ;AAAA,EAC/D,WAAW,QAAQ,aAAa,EAAE,MAAM,YAAY,CAAC,EAAE,QAAQ;AACnE,CAAC;AAEM,IAAM,qBAAqB,YAAY,gBAAgB;AAAA,EAC1D,IAAI,WAAW,IAAI,EAAE,WAAW;AAAA,EAChC,YAAY,WAAW,YAAY,EAAE,QAAQ;AAAA,EAC7C,OAAO,WAAW,OAAO,EAAE,QAAQ;AAAA,EACnC,WAAW,QAAQ,aAAa,EAAE,MAAM,YAAY,CAAC,EAAE,QAAQ;AAAA,EAC/D,WAAW,QAAQ,aAAa,EAAE,MAAM,YAAY,CAAC;AAAA,EACrD,WAAW,QAAQ,aAAa,EAAE,MAAM,YAAY,CAAC;AACzD,CAAC;AAEM,IAAM,eAAe;AAAA,EACxB,MAAM;AAAA,EACN,SAAS;AAAA,EACT,SAAS;AAAA,EACT,cAAc;AAClB;;;ADzJA,IAAM,oBAAoB;AA2CnB,SAAS,iBAAiB,SAAsD;AACnF,QAAM;AAAA,IACF;AAAA,IACA;AAAA,IACA;AAAA,IACA,UAAU;AAAA,IACV,WAAW;AAAA,IACX,iBAAiB,CAAC;AAAA,IAClB,sBAAsB;AAAA,IACtB,mBAAmB;AAAA,IACnB,oBAAoB,IAAI;AAAA,IACxB;AAAA,IACA;AAAA,EACJ,IAAI;AAIJ,MAAI,CAAC,UAAU,OAAO,SAAS,mBAAmB;AAC9C,UAAM,IAAI;AAAA,MACN,gCAAgC,iBAAiB,yBAAyB,SAAS,OAAO,SAAS,CAAC;AAAA,IACxG;AAAA,EACJ;AAEA,QAAM,aAAa,IAAI,IAAI,OAAO,EAAE;AACpC,QAAM,oBAAoB,eAAe,SAAS,UAAU,IACtD,iBACA,CAAC,YAAY,GAAG,cAAc;AAEpC,MAAI;AACJ,MAAI;AAEJ,UAAQ,aAAa;AAAA,IACjB,KAAK;AACD,eAAS;AACT,iBAAW;AACX;AAAA,IACJ,KAAK;AACD,eAAS;AACT,iBAAW;AACX;AAAA,IACJ,KAAK;AACD,eAAS;AACT,iBAAW;AACX;AAAA,IACJ;AACI,YAAM,IAAI,MAAM,6BAA6B,WAAW,EAAE;AAAA,EAClE;AAEA,QAAM,WAAW,eAAe,IAAmC;AAAA,IAC/D;AAAA,IACA;AAAA,EACJ,CAAC;AAED,QAAM,UAAU,CAAC;AACjB,MAAI,YAAY;AACZ,UAAM,mBAAmB,WAAW,yBAChC,GAAG,WAAW,MAAM;AACxB,UAAM,WAAW,WAAW,iBACxB,GAAG,WAAW,MAAM;AACxB,UAAM,cAAc,WAAW,oBAC3B,GAAG,WAAW,MAAM;AAExB,YAAQ;AAAA,MACJ,aAAa;AAAA,QACT,QAAQ;AAAA,UACJ;AAAA,YACI,YAAY,WAAW,cAAc;AAAA,YACrC,UAAU,WAAW;AAAA,YACrB,cAAc,WAAW;AAAA,YACzB;AAAA,YACA;AAAA,YACA;AAAA,YACA,cAAc,WAAW,qBACrB,GAAG,WAAW,MAAM;AAAA,YACxB,QAAQ,WAAW,UAAU,CAAC,UAAU,SAAS,SAAS;AAAA;AAAA;AAAA,YAG1D,MAAM,WAAW,SAAS,SAAY,WAAW,OAAO;AAAA,YACxD,kBAAkB,CAAC,YAAiB;AAChC,qBAAO;AAAA,gBACH,IAAI,QAAQ,OAAO,QAAQ;AAAA,gBAC3B,OAAO,QAAQ;AAAA,gBACf,MAAM,QAAQ,QAAQ,QAAQ;AAAA,gBAC9B,OAAO,QAAQ,WAAW,QAAQ;AAAA,gBAClC,eAAe,QAAQ,kBAAkB;AAAA,cAC7C;AAAA,YACJ;AAAA,UACJ;AAAA,QACJ;AAAA,MACJ,CAAC;AAAA,IACL;AAAA,EACJ;AAEA,SAAO,WAAW;AAAA,IACd;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,gBAAgB;AAAA,IAChB,kBAAkB,sBACZ;AAAA,MACE,SAAS;AAAA,MACT,YAAY;AAAA,IAChB,IACE;AAAA,IACN,iBAAiB,OAAO,KAAK,mBAAmB,CAAC,CAAC,EAAE,SAAS,IAAI,kBAAkB;AAAA,IACnF;AAAA,IACA,SAAS;AAAA,MACL,WAAW,KAAK,KAAK,KAAK;AAAA,MAC1B,WAAW,KAAK,KAAK;AAAA,MACrB,aAAa;AAAA,QACT,SAAS;AAAA,QACT,QAAQ;AAAA,MACZ;AAAA,IACJ;AAAA,IACA,UAAU;AAAA,MACN;AAAA,MACA,YAAY,MAAM,OAAO,WAAW,EAAE,QAAQ,MAAM,EAAE;AAAA,IAC1D;AAAA,EACJ,CAAC;AACL;","names":[]}

package/package.json

@@ -0,0 +1,57 @@
+{
+    "name": "@iskra-bun/auth-kit",
+    "version": "0.1.0",
+    "description": "Integracion de autenticacion de Iskra basada en better-auth, agnostica del transporte.",
+    "keywords": [
+        "iskra",
+        "bun",
+        "auth",
+        "better-auth",
+        "session",
+        "oidc"
+    ],
+    "author": "Joan Lascano",
+    "license": "AGPL-3.0-or-later",
+    "repository": {
+        "type": "git",
+        "url": "git+https://github.com/fearful/iskra.git",
+        "directory": "packages/auth-kit"
+    },
+    "homepage": "https://github.com/fearful/iskra/tree/main/packages/auth-kit#readme",
+    "bugs": "https://github.com/fearful/iskra/issues",
+    "type": "module",
+    "main": "./dist/index.js",
+    "module": "./dist/index.js",
+    "types": "./dist/index.d.ts",
+    "exports": {
+        ".": {
+            "source": "./src/index.ts",
+            "bun": "./src/index.ts",
+            "types": "./dist/index.d.ts",
+            "import": "./dist/index.js",
+            "default": "./dist/index.js"
+        }
+    },
+    "files": [
+        "dist",
+        "src",
+        "README.md",
+        "CHANGELOG.md"
+    ],
+    "publishConfig": {
+        "access": "public"
+    },
+    "scripts": {
+        "test": "bun test",
+        "build": "tsup --config ../../tsup.config.ts"
+    },
+    "dependencies": {
+        "@iskra-bun/core": "0.1.1",
+        "better-auth": "^1.4.18",
+        "drizzle-orm": "^0.45.1"
+    },
+    "devDependencies": {
+        "@types/bun": "^1.3.5",
+        "@types/node": "^22.10.2"
+    }
+}

package/src/better-auth-config.ts

@@ -0,0 +1,186 @@
+import { betterAuth, type Auth as BetterAuthInstance } from "better-auth";
+import { drizzleAdapter, type DB as DrizzleAdapterDb } from "better-auth/adapters/drizzle";
+import { genericOAuth } from "better-auth/plugins/generic-oauth";
+import type { PgDatabase, PgQueryResultHKT } from "drizzle-orm/pg-core";
+import type { MySqlDatabase, MySqlQueryResultHKT, PreparedQueryHKTBase } from "drizzle-orm/mysql-core";
+import type { BaseSQLiteDatabase } from "drizzle-orm/sqlite-core";
+import { pgSchema, mysqlSchema, sqliteSchema } from "./schema";
+
+/**
+ * The Drizzle database handle auth-kit accepts. A union of the supported dialect
+ * databases (mirrors web-kit's `WebKitDrizzleDb`) so the public input is a real
+ * Drizzle instance rather than `any` leaking into callers. The dialect-core base
+ * classes are part of `drizzle-orm` itself, so no driver dependency is required.
+ */
+export type AuthKitDrizzleDb =
+    | PgDatabase<PgQueryResultHKT, Record<string, unknown>>
+    | MySqlDatabase<MySqlQueryResultHKT, PreparedQueryHKTBase, Record<string, unknown>>
+    | BaseSQLiteDatabase<"sync" | "async", unknown, Record<string, unknown>>;
+
+/** Minimum length, in characters, for the session-signing secret. */
+const MIN_SECRET_LENGTH = 32;
+
+export interface BetterAuthConfigOptions {
+    db: AuthKitDrizzleDb;
+    adapterType: "postgres" | "mysql" | "sqlite";
+    secret: string;
+    baseURL?: string;
+    basePath?: string;
+    trustedOrigins?: string[];
+    enableEmailPassword?: boolean;
+    disableCSRFCheck?: boolean;
+    /**
+     * Cookie-cache lifetime in seconds. This is the session-revocation lag: a
+     * revoked session keeps passing cached cookie checks until the cache entry
+     * expires. Lower it to tighten the revocation window (at the cost of more
+     * frequent DB lookups). Defaults to 300 (5 minutes).
+     */
+    cookieCacheMaxAge?: number;
+    // deno-lint-ignore no-explicit-any
+    socialProviders?: Record<string, any>;
+    oidcConfig?: {
+        clientId: string;
+        clientSecret: string;
+        issuer: string;
+        providerId?: string;
+        authorizationEndpoint?: string;
+        tokenEndpoint?: string;
+        userinfoEndpoint?: string;
+        jwksEndpoint?: string;
+        discoveryEndpoint?: string;
+        scopes?: string[];
+        pkce?: boolean;
+        mapping?: {
+            id?: string;
+            email?: string;
+            emailVerified?: string;
+            name?: string;
+            image?: string;
+            extraFields?: Record<string, string>;
+        };
+    };
+}
+
+export function createBetterAuth(options: BetterAuthConfigOptions): BetterAuthInstance {
+    const {
+        db,
+        adapterType,
+        secret,
+        baseURL = "http://localhost:3000",
+        basePath = "/api/auth",
+        trustedOrigins = [],
+        enableEmailPassword = true,
+        disableCSRFCheck = false,
+        cookieCacheMaxAge = 5 * 60,
+        socialProviders,
+        oidcConfig,
+    } = options;
+
+    // A weak or empty secret signs forgeable sessions, so reject it before
+    // betterAuth() ever sees it rather than silently building an insecure auth.
+    if (!secret || secret.length < MIN_SECRET_LENGTH) {
+        throw new Error(
+            `auth secret must be at least ${MIN_SECRET_LENGTH} characters; received ${secret ? secret.length : 0}`,
+        );
+    }
+
+    const baseOrigin = new URL(baseURL).origin;
+    const allTrustedOrigins = trustedOrigins.includes(baseOrigin)
+        ? trustedOrigins
+        : [baseOrigin, ...trustedOrigins];
+
+    let schema;
+    let provider: "pg" | "mysql" | "sqlite";
+
+    switch (adapterType) {
+        case "postgres":
+            schema = pgSchema;
+            provider = "pg";
+            break;
+        case "mysql":
+            schema = mysqlSchema;
+            provider = "mysql";
+            break;
+        case "sqlite":
+            schema = sqliteSchema;
+            provider = "sqlite";
+            break;
+        default:
+            throw new Error(`Unsupported adapter type: ${adapterType}`);
+    }
+
+    const database = drizzleAdapter(db as unknown as DrizzleAdapterDb, {
+        provider,
+        schema
+    });
+
+    const plugins = [];
+    if (oidcConfig) {
+        const authorizationUrl = oidcConfig.authorizationEndpoint ||
+            `${oidcConfig.issuer}/protocol/openid-connect/auth`;
+        const tokenUrl = oidcConfig.tokenEndpoint ||
+            `${oidcConfig.issuer}/protocol/openid-connect/token`;
+        const userInfoUrl = oidcConfig.userinfoEndpoint ||
+            `${oidcConfig.issuer}/protocol/openid-connect/userinfo`;
+
+        plugins.push(
+            genericOAuth({
+                config: [
+                    {
+                        providerId: oidcConfig.providerId || "oidc",
+                        clientId: oidcConfig.clientId,
+                        clientSecret: oidcConfig.clientSecret,
+                        authorizationUrl,
+                        tokenUrl,
+                        userInfoUrl,
+                        discoveryUrl: oidcConfig.discoveryEndpoint ||
+                            `${oidcConfig.issuer}/.well-known/openid-configuration`,
+                        scopes: oidcConfig.scopes || ["openid", "email", "profile"],
+                        // Secure default: PKCE on. Disabling exposes auth-code
+                        // interception/injection and requires an explicit false.
+                        pkce: oidcConfig.pkce !== undefined ? oidcConfig.pkce : true,
+                        mapProfileToUser: (profile: any) => {
+                            return {
+                                id: profile.sub || profile.id,
+                                email: profile.email,
+                                name: profile.name || profile.preferred_username,
+                                image: profile.picture || profile.image,
+                                emailVerified: profile.email_verified || false,
+                            };
+                        },
+                    },
+                ],
+            }),
+        );
+    }
+
+    return betterAuth({
+        database,
+        secret,
+        baseURL,
+        basePath,
+        trustedOrigins: allTrustedOrigins,
+        emailAndPassword: enableEmailPassword
+            ? {
+                enabled: true,
+                autoSignIn: true,
+            }
+            : undefined,
+        socialProviders: Object.keys(socialProviders || {}).length > 0 ? socialProviders : undefined,
+        plugins,
+        session: {
+            expiresIn: 60 * 60 * 24 * 7,
+            updateAge: 60 * 60 * 24,
+            cookieCache: {
+                enabled: true,
+                maxAge: cookieCacheMaxAge,
+            },
+        },
+        advanced: {
+            disableCSRFCheck,
+            generateId: () => crypto.randomUUID().replace(/-/g, ""),
+        },
+    }) as unknown as BetterAuthInstance;
+}
+
+export type Auth = ReturnType<typeof createBetterAuth>;

package/src/index.ts

@@ -0,0 +1,39 @@
+export {
+    createBetterAuth,
+    type Auth,
+    type AuthKitDrizzleDb,
+    type BetterAuthConfigOptions,
+} from "./better-auth-config";
+
+export {
+    pgUser,
+    pgSession,
+    pgAccount,
+    pgVerification,
+    pgSchema,
+    mysqlUser,
+    mysqlSession,
+    mysqlAccount,
+    mysqlVerification,
+    mysqlSchema,
+    sqliteUser,
+    sqliteSession,
+    sqliteAccount,
+    sqliteVerification,
+    sqliteSchema,
+} from "./schema";
+
+export type {
+    User,
+    Account,
+    Verification,
+    AuthSession,
+    PasswordResetToken,
+    EmailVerificationToken,
+    AuthContext,
+    SignUpInput,
+    SignInInput,
+    PasswordResetRequest,
+    PasswordResetConfirm,
+    EmailVerificationRequest,
+} from "./types";