@krutai/auth 0.1.7 → 0.1.9

package/AI_REFERENCE.md

@@ -3,7 +3,7 @@
 ## Package Overview
 
 - **Name**: `@krutai/auth`
-- **Version**: `0.1.7`
+- **Version**: `0.1.9`
 - **Purpose**: Authentication package for KrutAI — wraps Better Auth with a `krutAuth` function and optional API key validation via `KrutAuth` class
 - **Entry**: `src/index.ts` → `dist/index.{js,mjs,d.ts}`
 - **Build**: `tsup` (CJS + ESM, all deps external)
@@ -11,7 +11,7 @@
 ## Dependency Architecture
 
 ```
-@krutai/auth@0.1.7
+@krutai/auth@0.1.9
 ├── dependency: krutai              ← API key validation (also peerDep)
 ├── dependency: better-auth         ← auth engine (external in tsup)
 ├── dependency: better-sqlite3      ← default SQLite adapter
@@ -30,6 +30,8 @@ packages/auth/
 │   ├── types.ts     # KrutAuthConfig, AuthSession, BetterAuthOptions
 │   ├── react.ts     # re-exports better-auth/react (createAuthClient, hooks)
 │   └── next-js.ts   # re-exports better-auth/next-js (toNextJsHandler)
+├── scripts/
+│   └── migrate.js   # postinstall: auto-migrates SQLite tables via better-auth
 ├── package.json
 ├── tsconfig.json
 └── tsup.config.ts
@@ -49,6 +51,8 @@ packages/auth/
 
 Drop-in replacement for `betterAuth`. Users should always use this.
 
+**Always include `baseURL`** to avoid Better Auth base URL warnings:
+
 ```typescript
 import { krutAuth } from "@krutai/auth";
 import Database from "better-sqlite3";
@@ -56,11 +60,7 @@ import Database from "better-sqlite3";
 export const auth = krutAuth({
   database: new Database("./sqlite.db"),
   emailAndPassword: { enabled: true },
-  user: {
-    additionalFields: {
-      name: { type: "string", required: true },
-    },
-  },
+  baseURL: process.env.BETTER_AUTH_BASE_URL ?? "http://localhost:3000",
 });
 ```
 
@@ -103,9 +103,12 @@ interface KrutAuthConfig {
 
 ### Validator Re-exports (from `krutai`)
 
+> **Note for AI assistants**: Only `validateApiKeyFormat`, `validateApiKeyWithService`, and `ApiKeyValidationError` are exported. `createApiKeyChecker` is **NOT exported**. Do not suggest it.
+> The API key validation is **format/length only** (not null, minimum length). There is no external API check call.
+
 ```typescript
 // These are re-exported from krutai — NOT defined here
-export { validateApiKeyFormat, validateApiKeyWithService, createApiKeyChecker, ApiKeyValidationError } from 'krutai';
+export { validateApiKeyFormat, validateApiKeyWithService, ApiKeyValidationError } from 'krutai';
 ```
 
 ## Usage Examples
@@ -118,6 +121,7 @@ import Database from "better-sqlite3";
 export const auth = krutAuth({
   database: new Database("./sqlite.db"),
   emailAndPassword: { enabled: true },
+  baseURL: process.env.BETTER_AUTH_BASE_URL ?? "http://localhost:3000",
 });
 ```
 
@@ -165,6 +169,15 @@ try {
 }
 ```
 
+## Auto-Migration (postinstall)
+
+`scripts/migrate.js` runs after `npm install` to create all required Better Auth SQLite tables automatically. This means users do NOT need to run any manual migration commands — sign-up and sign-in work out of the box.
+
+The script:
+1. Creates `sqlite.db` in the project root (if not present)
+2. Runs `better-auth migrate` to create all required tables
+3. Skips silently if the DB already exists and tables are up to date
+
 ## tsup Configuration Notes
 
 - `better-auth` → **external** (real dependency, NOT bundled)
@@ -174,10 +187,11 @@ try {
 
 ## Important Notes
 
-1. **Use `krutAuth` not `betterAuth`**: The public API is `krutAuth`. `betterAuth` is an internal implementation detail
-2. **Validator lives in `krutai`**: Never add a local `validator.ts` — import from `krutai`
-3. **No `noExternal` for `better-auth` or `krutai`**: They must stay external in tsup
-4. **`getBetterAuth()` returns `Auth`**: Uses the `Auth` type from `better-auth`, not `ReturnType<typeof betterAuth>`
+1. **Always set `baseURL`**: Pass `baseURL: process.env.BETTER_AUTH_BASE_URL` in `krutAuth()` options
+2. **Use `krutAuth` not `betterAuth`**: The public API is `krutAuth`. `betterAuth` is an internal implementation detail
+3. **Validator lives in `krutai`**: Never add a local `validator.ts` — import from `krutai`
+4. **No `noExternal` for `better-auth` or `krutai`**: They must stay external in tsup
+5. **`getBetterAuth()` returns `Auth`**: Uses the `Auth` type from `better-auth`, not `ReturnType<typeof betterAuth>`
 
 ## Related Packages
 

package/README.md

@@ -7,6 +7,7 @@ Authentication package for KrutAI powered by [Better Auth](https://www.better-au
 - 🔐 **API Key Protection** — Requires a valid KrutAI API key (validated via `krutai`)
 - 🚀 **Better Auth Integration** — Built on top of Better Auth
 - 📦 **Auto-installs everything** — `krutai`, `better-auth`, `better-sqlite3` install automatically
+- 🗄️ **Auto-migrates SQLite** — Database tables are created automatically on install
 - 🎯 **Next.js Ready** — First-class support via `@krutai/auth/next-js`
 - ⚡ **Dual Format** — Supports both ESM and CommonJS
 - 🔷 **TypeScript First** — Full type safety and IntelliSense
@@ -17,7 +18,7 @@ Authentication package for KrutAI powered by [Better Auth](https://www.better-au
 npm install @krutai/auth
 ```
 
-> **Note:** `krutai`, `better-auth`, `better-sqlite3`, and `@types/better-sqlite3` are all installed automatically.
+> **Note:** `krutai`, `better-auth`, `better-sqlite3`, and `@types/better-sqlite3` are all installed automatically. SQLite tables are migrated automatically after install.
 
 ## Quick Start
 
@@ -33,17 +34,12 @@ export const auth = krutAuth({
   emailAndPassword: {
     enabled: true,
   },
-  user: {
-    additionalFields: {
-      name: {
-        type: "string",
-        required: true,
-      },
-    },
-  },
+  baseURL: process.env.BETTER_AUTH_BASE_URL ?? "http://localhost:3000",
 });
 ```
 
+> **Required:** Set `BETTER_AUTH_BASE_URL` in your `.env` file (e.g. `http://localhost:3000` for dev, `https://yourdomain.com` for production). Without this, redirects and callbacks will not work.
+
 ### API Route handler
 
 ```typescript
@@ -82,6 +78,13 @@ const auth = new KrutAuth({
 await auth.initialize();
 ```
 
+## Environment Variables
+
+| Variable | Required | Description |
+|---|---|---|
+| `BETTER_AUTH_BASE_URL` | ✅ | Your app's base URL (e.g. `http://localhost:3000`) |
+| `BETTER_AUTH_SECRET` | recommended | Secret for signing sessions |
+
 ## Exports
 
 | Import path | What it provides |
@@ -137,7 +140,7 @@ try {
 ## Architecture
 
 ```
-@krutai/auth@0.1.7
+@krutai/auth@0.1.9
 ├── dependency: krutai          ← API key validation
 ├── dependency: better-auth     ← auth engine
 ├── dependency: better-sqlite3  ← default database adapter

package/dist/index.d.mts

@@ -1,7 +1,7 @@
 import * as better_auth from 'better-auth';
 import { BetterAuthOptions, Auth } from 'better-auth';
 export { BetterAuthOptions } from 'better-auth';
-export { ApiKeyValidationError, createApiKeyChecker, validateApiKeyFormat, validateApiKeyWithService } from 'krutai';
+export { ApiKeyValidationError, validateApiKeyFormat, validateApiKeyWithService } from 'krutai';
 
 /**
  * Configuration options for KrutAuth
@@ -140,6 +140,6 @@ declare class KrutAuth {
  */
 declare function krutAuth(options: BetterAuthOptions): better_auth.Auth<BetterAuthOptions>;
 
-declare const VERSION = "0.1.7";
+declare const VERSION = "0.1.9";
 
 export { type AuthSession, KrutAuth, type KrutAuthConfig, VERSION, krutAuth };

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 import * as better_auth from 'better-auth';
 import { BetterAuthOptions, Auth } from 'better-auth';
 export { BetterAuthOptions } from 'better-auth';
-export { ApiKeyValidationError, createApiKeyChecker, validateApiKeyFormat, validateApiKeyWithService } from 'krutai';
+export { ApiKeyValidationError, validateApiKeyFormat, validateApiKeyWithService } from 'krutai';
 
 /**
  * Configuration options for KrutAuth
@@ -140,6 +140,6 @@ declare class KrutAuth {
  */
 declare function krutAuth(options: BetterAuthOptions): better_auth.Auth<BetterAuthOptions>;
 
-declare const VERSION = "0.1.7";
+declare const VERSION = "0.1.9";
 
 export { type AuthSession, KrutAuth, type KrutAuthConfig, VERSION, krutAuth };

package/dist/index.js

@@ -96,16 +96,12 @@ var KrutAuth = class {
 function krutAuth(options) {
   return betterAuth.betterAuth(options);
 }
-var VERSION = "0.1.7";
+var VERSION = "0.1.9";
 
 Object.defineProperty(exports, "ApiKeyValidationError", {
   enumerable: true,
   get: function () { return krutai.ApiKeyValidationError; }
 });
-Object.defineProperty(exports, "createApiKeyChecker", {
-  enumerable: true,
-  get: function () { return krutai.createApiKeyChecker; }
-});
 Object.defineProperty(exports, "validateApiKeyFormat", {
   enumerable: true,
   get: function () { return krutai.validateApiKeyFormat; }

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/client.ts","../src/index.ts"],"names":["validateApiKeyFormat","validateApiKeyWithService","betterAuth"],"mappings":";;;;;;AAiCO,IAAM,WAAN,MAAe;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUlB,YAAoB,MAAA,EAAwB;AAAxB,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAEhB,IAAAA,2BAAA,CAAqB,OAAO,MAAM,CAAA;AAClC,IAAA,IAAA,CAAK,SAAS,MAAA,CAAO,MAAA;AAGrB,IAAA,IAAI,MAAA,CAAO,mBAAmB,KAAA,EAAO;AACjC,MAAA,IAAA,CAAK,oBAAA,EAAqB;AAAA,IAC9B;AAAA,EACJ;AAAA,EAlBQ,MAAA;AAAA,EACA,kBAAA,GAAkC,IAAA;AAAA,EAClC,WAAA,GAAc,KAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuBtB,MAAM,UAAA,GAA4B;AAC9B,IAAA,IAAI,KAAK,WAAA,EAAa;AAClB,MAAA;AAAA,IACJ;AAGA,IAAA,IAAI,IAAA,CAAK,MAAA,CAAO,cAAA,KAAmB,KAAA,EAAO;AACtC,MAAA,MAAMC,gCAAA,CAA0B,KAAK,MAAM,CAAA;AAAA,IAC/C;AAEA,IAAA,IAAA,CAAK,oBAAA,EAAqB;AAC1B,IAAA,IAAA,CAAK,WAAA,GAAc,IAAA;AAAA,EACvB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,oBAAA,GAA6B;AACjC,IAAA,IAAA,CAAK,qBAAqBC,qBAAA,CAAW;AAAA,MACjC,GAAG,KAAK,MAAA,CAAO;AAAA,KAClB,CAAA;AAAA,EACL;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,aAAA,GAAsB;AAClB,IAAA,IAAI,CAAC,KAAK,kBAAA,EAAoB;AAC1B,MAAA,MAAM,IAAI,KAAA;AAAA,QACN;AAAA,OACJ;AAAA,IACJ;AACA,IAAA,OAAO,IAAA,CAAK,kBAAA;AAAA,EAChB;AAAA;AAAA;AAAA;AAAA,EAKA,aAAA,GAAyB;AACrB,IAAA,OAAO,IAAA,CAAK,WAAA;AAAA,EAChB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,SAAA,GAAoB;AAChB,IAAA,OAAO,IAAA,CAAK,MAAA;AAAA,EAChB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,MAAA,GAAwB;AAC1B,IAAA,OAAO,KAAK,aAAA,EAAc;AAAA,EAC9B;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,OAAA,GAAyB;AAC3B,IAAA,OAAO,KAAK,aAAA,EAAc;AAAA,EAC9B;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,UAAA,GAA4B;AAC9B,IAAA,OAAO,KAAK,aAAA,EAAc;AAAA,EAC9B;AACJ;ACtFO,SAAS,SAAS,OAAA,EAA4B;AACjD,EAAA,OAAOA,sBAAW,OAAO,CAAA;AAC7B;AAiBO,IAAM,OAAA,GAAU","file":"index.js","sourcesContent":["import { betterAuth } from 'better-auth';\nimport type { Auth } from 'better-auth';\nimport type { KrutAuthConfig } from './types';\n// Import validation from krutai peer dependency\nimport {\n    validateApiKeyFormat,\n    validateApiKeyWithService,\n} from 'krutai';\n\n/**\n * KrutAuth - Authentication client for KrutAI\n *\n * This class wraps Better Auth and adds API key validation\n * to ensure only authorized users can access authentication features.\n *\n * @example\n * ```typescript\n * import { KrutAuth } from '@krutai/auth';\n *\n * const auth = new KrutAuth({\n *   apiKey: 'your-api-key-here',\n *   betterAuthOptions: {\n *     // Better Auth configuration\n *   }\n * });\n *\n * // Initialize the client (validates API key)\n * await auth.initialize();\n *\n * // Use authentication features\n * const betterAuth = auth.getBetterAuth();\n * ```\n */\nexport class KrutAuth {\n    private apiKey: string;\n    private betterAuthInstance: Auth | null = null;\n    private initialized = false;\n\n    /**\n     * Creates a new KrutAuth instance\n     * @param config - Configuration options\n     * @throws {ApiKeyValidationError} If API key is invalid\n     */\n    constructor(private config: KrutAuthConfig) {\n        // Validate API key format immediately\n        validateApiKeyFormat(config.apiKey);\n        this.apiKey = config.apiKey;\n\n        // Initialize if validation is not required on init\n        if (config.validateOnInit === false) {\n            this.initializeBetterAuth();\n        }\n    }\n\n    /**\n     * Initialize the authentication client\n     * Validates the API key and sets up Better Auth\n     * @throws {ApiKeyValidationError} If API key validation fails\n     */\n    async initialize(): Promise<void> {\n        if (this.initialized) {\n            return;\n        }\n\n        // Validate API key with service if needed\n        if (this.config.validateOnInit !== false) {\n            await validateApiKeyWithService(this.apiKey);\n        }\n\n        this.initializeBetterAuth();\n        this.initialized = true;\n    }\n\n    /**\n     * Initialize Better Auth instance\n     * @private\n     */\n    private initializeBetterAuth(): void {\n        this.betterAuthInstance = betterAuth({\n            ...this.config.betterAuthOptions,\n        });\n    }\n\n    /**\n     * Get the Better Auth instance\n     * @throws {Error} If not initialized\n     */\n    getBetterAuth(): Auth {\n        if (!this.betterAuthInstance) {\n            throw new Error(\n                'KrutAuth not initialized. Call initialize() first or set validateOnInit to false.'\n            );\n        }\n        return this.betterAuthInstance;\n    }\n\n    /**\n     * Check if the client is initialized\n     */\n    isInitialized(): boolean {\n        return this.initialized;\n    }\n\n    /**\n     * Get the API key (useful for making authenticated requests)\n     * @returns The API key\n     */\n    getApiKey(): string {\n        return this.apiKey;\n    }\n\n    /**\n     * Sign in a user\n     * This is a convenience method that wraps Better Auth\n     * You can access the full Better Auth API via getBetterAuth()\n     */\n    async signIn(): Promise<Auth> {\n        return this.getBetterAuth();\n    }\n\n    /**\n     * Sign out the current user\n     * You can access the full Better Auth API via getBetterAuth()\n     */\n    async signOut(): Promise<Auth> {\n        return this.getBetterAuth();\n    }\n\n    /**\n     * Get the current session\n     * You can access the full Better Auth API via getBetterAuth()\n     */\n    async getSession(): Promise<Auth> {\n        return this.getBetterAuth();\n    }\n}\n","/**\n * @krutai/auth - Authentication package for KrutAI\n *\n * Requires `krutai` as a peer dependency (installed automatically).\n *\n * @example Server-side (Next.js API route / server component)\n * ```typescript\n * import { krutAuth } from \"@krutai/auth\";\n * import Database from \"better-sqlite3\";\n *\n * export const auth = krutAuth({\n *   database: new Database(\"./sqlite.db\"),\n *   emailAndPassword: { enabled: true },\n * });\n * ```\n *\n * @example Client-side (React / Next.js client component)\n * ```typescript\n * import { createAuthClient } from \"@krutai/auth/react\";\n *\n * export const authClient = createAuthClient({\n *   baseURL: process.env.NEXT_PUBLIC_APP_URL ?? \"http://localhost:3000\",\n * });\n *\n * export const { signIn, signUp, signOut, useSession } = authClient;\n * ```\n *\n * @packageDocumentation\n */\n\nimport { betterAuth } from 'better-auth';\nimport type { BetterAuthOptions } from 'better-auth';\n\n/**\n * krutAuth — drop-in replacement for betterAuth.\n *\n * Use this instead of importing betterAuth directly.\n *\n * @example\n * ```typescript\n * import { krutAuth } from \"@krutai/auth\";\n * import Database from \"better-sqlite3\";\n *\n * export const auth = krutAuth({\n *   database: new Database(\"./sqlite.db\"),\n *   emailAndPassword: { enabled: true },\n * });\n * ```\n */\nexport function krutAuth(options: BetterAuthOptions) {\n    return betterAuth(options);\n}\n\n// Export main KrutAuth class (API-key-protected wrapper)\nexport { KrutAuth } from './client';\n\n// Export types\nexport type { KrutAuthConfig, AuthSession, BetterAuthOptions } from './types';\n\n// Re-export validator utilities from krutai peer dependency\nexport {\n    validateApiKeyFormat,\n    validateApiKeyWithService,\n    createApiKeyChecker,\n    ApiKeyValidationError,\n} from 'krutai';\n\n// Package metadata\nexport const VERSION = '0.1.7';\n"]}
+{"version":3,"sources":["../src/client.ts","../src/index.ts"],"names":["validateApiKeyFormat","validateApiKeyWithService","betterAuth"],"mappings":";;;;;;AAiCO,IAAM,WAAN,MAAe;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUlB,YAAoB,MAAA,EAAwB;AAAxB,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAEhB,IAAAA,2BAAA,CAAqB,OAAO,MAAM,CAAA;AAClC,IAAA,IAAA,CAAK,SAAS,MAAA,CAAO,MAAA;AAGrB,IAAA,IAAI,MAAA,CAAO,mBAAmB,KAAA,EAAO;AACjC,MAAA,IAAA,CAAK,oBAAA,EAAqB;AAAA,IAC9B;AAAA,EACJ;AAAA,EAlBQ,MAAA;AAAA,EACA,kBAAA,GAAkC,IAAA;AAAA,EAClC,WAAA,GAAc,KAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuBtB,MAAM,UAAA,GAA4B;AAC9B,IAAA,IAAI,KAAK,WAAA,EAAa;AAClB,MAAA;AAAA,IACJ;AAGA,IAAA,IAAI,IAAA,CAAK,MAAA,CAAO,cAAA,KAAmB,KAAA,EAAO;AACtC,MAAA,MAAMC,gCAAA,CAA0B,KAAK,MAAM,CAAA;AAAA,IAC/C;AAEA,IAAA,IAAA,CAAK,oBAAA,EAAqB;AAC1B,IAAA,IAAA,CAAK,WAAA,GAAc,IAAA;AAAA,EACvB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,oBAAA,GAA6B;AACjC,IAAA,IAAA,CAAK,qBAAqBC,qBAAA,CAAW;AAAA,MACjC,GAAG,KAAK,MAAA,CAAO;AAAA,KAClB,CAAA;AAAA,EACL;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,aAAA,GAAsB;AAClB,IAAA,IAAI,CAAC,KAAK,kBAAA,EAAoB;AAC1B,MAAA,MAAM,IAAI,KAAA;AAAA,QACN;AAAA,OACJ;AAAA,IACJ;AACA,IAAA,OAAO,IAAA,CAAK,kBAAA;AAAA,EAChB;AAAA;AAAA;AAAA;AAAA,EAKA,aAAA,GAAyB;AACrB,IAAA,OAAO,IAAA,CAAK,WAAA;AAAA,EAChB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,SAAA,GAAoB;AAChB,IAAA,OAAO,IAAA,CAAK,MAAA;AAAA,EAChB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,MAAA,GAAwB;AAC1B,IAAA,OAAO,KAAK,aAAA,EAAc;AAAA,EAC9B;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,OAAA,GAAyB;AAC3B,IAAA,OAAO,KAAK,aAAA,EAAc;AAAA,EAC9B;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,UAAA,GAA4B;AAC9B,IAAA,OAAO,KAAK,aAAA,EAAc;AAAA,EAC9B;AACJ;ACrFO,SAAS,SAAS,OAAA,EAA4B;AACjD,EAAA,OAAOA,sBAAW,OAAO,CAAA;AAC7B;AAgBO,IAAM,OAAA,GAAU","file":"index.js","sourcesContent":["import { betterAuth } from 'better-auth';\nimport type { Auth } from 'better-auth';\nimport type { KrutAuthConfig } from './types';\n// Import validation from krutai peer dependency\nimport {\n    validateApiKeyFormat,\n    validateApiKeyWithService,\n} from 'krutai';\n\n/**\n * KrutAuth - Authentication client for KrutAI\n *\n * This class wraps Better Auth and adds API key validation\n * to ensure only authorized users can access authentication features.\n *\n * @example\n * ```typescript\n * import { KrutAuth } from '@krutai/auth';\n *\n * const auth = new KrutAuth({\n *   apiKey: 'your-api-key-here',\n *   betterAuthOptions: {\n *     // Better Auth configuration\n *   }\n * });\n *\n * // Initialize the client (validates API key)\n * await auth.initialize();\n *\n * // Use authentication features\n * const betterAuth = auth.getBetterAuth();\n * ```\n */\nexport class KrutAuth {\n    private apiKey: string;\n    private betterAuthInstance: Auth | null = null;\n    private initialized = false;\n\n    /**\n     * Creates a new KrutAuth instance\n     * @param config - Configuration options\n     * @throws {ApiKeyValidationError} If API key is invalid\n     */\n    constructor(private config: KrutAuthConfig) {\n        // Validate API key format immediately\n        validateApiKeyFormat(config.apiKey);\n        this.apiKey = config.apiKey;\n\n        // Initialize if validation is not required on init\n        if (config.validateOnInit === false) {\n            this.initializeBetterAuth();\n        }\n    }\n\n    /**\n     * Initialize the authentication client\n     * Validates the API key and sets up Better Auth\n     * @throws {ApiKeyValidationError} If API key validation fails\n     */\n    async initialize(): Promise<void> {\n        if (this.initialized) {\n            return;\n        }\n\n        // Validate API key with service if needed\n        if (this.config.validateOnInit !== false) {\n            await validateApiKeyWithService(this.apiKey);\n        }\n\n        this.initializeBetterAuth();\n        this.initialized = true;\n    }\n\n    /**\n     * Initialize Better Auth instance\n     * @private\n     */\n    private initializeBetterAuth(): void {\n        this.betterAuthInstance = betterAuth({\n            ...this.config.betterAuthOptions,\n        });\n    }\n\n    /**\n     * Get the Better Auth instance\n     * @throws {Error} If not initialized\n     */\n    getBetterAuth(): Auth {\n        if (!this.betterAuthInstance) {\n            throw new Error(\n                'KrutAuth not initialized. Call initialize() first or set validateOnInit to false.'\n            );\n        }\n        return this.betterAuthInstance;\n    }\n\n    /**\n     * Check if the client is initialized\n     */\n    isInitialized(): boolean {\n        return this.initialized;\n    }\n\n    /**\n     * Get the API key (useful for making authenticated requests)\n     * @returns The API key\n     */\n    getApiKey(): string {\n        return this.apiKey;\n    }\n\n    /**\n     * Sign in a user\n     * This is a convenience method that wraps Better Auth\n     * You can access the full Better Auth API via getBetterAuth()\n     */\n    async signIn(): Promise<Auth> {\n        return this.getBetterAuth();\n    }\n\n    /**\n     * Sign out the current user\n     * You can access the full Better Auth API via getBetterAuth()\n     */\n    async signOut(): Promise<Auth> {\n        return this.getBetterAuth();\n    }\n\n    /**\n     * Get the current session\n     * You can access the full Better Auth API via getBetterAuth()\n     */\n    async getSession(): Promise<Auth> {\n        return this.getBetterAuth();\n    }\n}\n","/**\n * @krutai/auth - Authentication package for KrutAI\n *\n * Requires `krutai` as a peer dependency (installed automatically).\n *\n * @example Server-side (Next.js API route / server component)\n * ```typescript\n * import { krutAuth } from \"@krutai/auth\";\n * import Database from \"better-sqlite3\";\n *\n * export const auth = krutAuth({\n *   database: new Database(\"./sqlite.db\"),\n *   emailAndPassword: { enabled: true },\n *   baseURL: process.env.BETTER_AUTH_BASE_URL ?? \"http://localhost:3000\",\n * });\n * ```\n *\n * @example Client-side (React / Next.js client component)\n * ```typescript\n * import { createAuthClient } from \"@krutai/auth/react\";\n *\n * export const authClient = createAuthClient({\n *   baseURL: process.env.NEXT_PUBLIC_APP_URL ?? \"http://localhost:3000\",\n * });\n *\n * export const { signIn, signUp, signOut, useSession } = authClient;\n * ```\n *\n * @packageDocumentation\n */\n\nimport { betterAuth } from 'better-auth';\nimport type { BetterAuthOptions } from 'better-auth';\n\n/**\n * krutAuth — drop-in replacement for betterAuth.\n *\n * Use this instead of importing betterAuth directly.\n *\n * @example\n * ```typescript\n * import { krutAuth } from \"@krutai/auth\";\n * import Database from \"better-sqlite3\";\n *\n * export const auth = krutAuth({\n *   database: new Database(\"./sqlite.db\"),\n *   emailAndPassword: { enabled: true },\n * });\n * ```\n */\nexport function krutAuth(options: BetterAuthOptions) {\n    return betterAuth(options);\n}\n\n// Export main KrutAuth class (API-key-protected wrapper)\nexport { KrutAuth } from './client';\n\n// Export types\nexport type { KrutAuthConfig, AuthSession, BetterAuthOptions } from './types';\n\n// Re-export minimal validator utilities (format/length check only)\nexport {\n    validateApiKeyFormat,\n    validateApiKeyWithService,\n    ApiKeyValidationError,\n} from 'krutai';\n\n// Package metadata\nexport const VERSION = '0.1.9';\n"]}

package/dist/index.mjs

@@ -1,6 +1,6 @@
 import { betterAuth } from 'better-auth';
 import { validateApiKeyFormat, validateApiKeyWithService } from 'krutai';
-export { ApiKeyValidationError, createApiKeyChecker, validateApiKeyFormat, validateApiKeyWithService } from 'krutai';
+export { ApiKeyValidationError, validateApiKeyFormat, validateApiKeyWithService } from 'krutai';
 
 // src/index.ts
 var KrutAuth = class {
@@ -95,7 +95,7 @@ var KrutAuth = class {
 function krutAuth(options) {
   return betterAuth(options);
 }
-var VERSION = "0.1.7";
+var VERSION = "0.1.9";
 
 export { KrutAuth, VERSION, krutAuth };
 //# sourceMappingURL=index.mjs.map

package/dist/index.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/client.ts","../src/index.ts"],"names":["betterAuth"],"mappings":";;;;;AAiCO,IAAM,WAAN,MAAe;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUlB,YAAoB,MAAA,EAAwB;AAAxB,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAEhB,IAAA,oBAAA,CAAqB,OAAO,MAAM,CAAA;AAClC,IAAA,IAAA,CAAK,SAAS,MAAA,CAAO,MAAA;AAGrB,IAAA,IAAI,MAAA,CAAO,mBAAmB,KAAA,EAAO;AACjC,MAAA,IAAA,CAAK,oBAAA,EAAqB;AAAA,IAC9B;AAAA,EACJ;AAAA,EAlBQ,MAAA;AAAA,EACA,kBAAA,GAAkC,IAAA;AAAA,EAClC,WAAA,GAAc,KAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuBtB,MAAM,UAAA,GAA4B;AAC9B,IAAA,IAAI,KAAK,WAAA,EAAa;AAClB,MAAA;AAAA,IACJ;AAGA,IAAA,IAAI,IAAA,CAAK,MAAA,CAAO,cAAA,KAAmB,KAAA,EAAO;AACtC,MAAA,MAAM,yBAAA,CAA0B,KAAK,MAAM,CAAA;AAAA,IAC/C;AAEA,IAAA,IAAA,CAAK,oBAAA,EAAqB;AAC1B,IAAA,IAAA,CAAK,WAAA,GAAc,IAAA;AAAA,EACvB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,oBAAA,GAA6B;AACjC,IAAA,IAAA,CAAK,qBAAqB,UAAA,CAAW;AAAA,MACjC,GAAG,KAAK,MAAA,CAAO;AAAA,KAClB,CAAA;AAAA,EACL;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,aAAA,GAAsB;AAClB,IAAA,IAAI,CAAC,KAAK,kBAAA,EAAoB;AAC1B,MAAA,MAAM,IAAI,KAAA;AAAA,QACN;AAAA,OACJ;AAAA,IACJ;AACA,IAAA,OAAO,IAAA,CAAK,kBAAA;AAAA,EAChB;AAAA;AAAA;AAAA;AAAA,EAKA,aAAA,GAAyB;AACrB,IAAA,OAAO,IAAA,CAAK,WAAA;AAAA,EAChB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,SAAA,GAAoB;AAChB,IAAA,OAAO,IAAA,CAAK,MAAA;AAAA,EAChB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,MAAA,GAAwB;AAC1B,IAAA,OAAO,KAAK,aAAA,EAAc;AAAA,EAC9B;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,OAAA,GAAyB;AAC3B,IAAA,OAAO,KAAK,aAAA,EAAc;AAAA,EAC9B;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,UAAA,GAA4B;AAC9B,IAAA,OAAO,KAAK,aAAA,EAAc;AAAA,EAC9B;AACJ;ACtFO,SAAS,SAAS,OAAA,EAA4B;AACjD,EAAA,OAAOA,WAAW,OAAO,CAAA;AAC7B;AAiBO,IAAM,OAAA,GAAU","file":"index.mjs","sourcesContent":["import { betterAuth } from 'better-auth';\nimport type { Auth } from 'better-auth';\nimport type { KrutAuthConfig } from './types';\n// Import validation from krutai peer dependency\nimport {\n    validateApiKeyFormat,\n    validateApiKeyWithService,\n} from 'krutai';\n\n/**\n * KrutAuth - Authentication client for KrutAI\n *\n * This class wraps Better Auth and adds API key validation\n * to ensure only authorized users can access authentication features.\n *\n * @example\n * ```typescript\n * import { KrutAuth } from '@krutai/auth';\n *\n * const auth = new KrutAuth({\n *   apiKey: 'your-api-key-here',\n *   betterAuthOptions: {\n *     // Better Auth configuration\n *   }\n * });\n *\n * // Initialize the client (validates API key)\n * await auth.initialize();\n *\n * // Use authentication features\n * const betterAuth = auth.getBetterAuth();\n * ```\n */\nexport class KrutAuth {\n    private apiKey: string;\n    private betterAuthInstance: Auth | null = null;\n    private initialized = false;\n\n    /**\n     * Creates a new KrutAuth instance\n     * @param config - Configuration options\n     * @throws {ApiKeyValidationError} If API key is invalid\n     */\n    constructor(private config: KrutAuthConfig) {\n        // Validate API key format immediately\n        validateApiKeyFormat(config.apiKey);\n        this.apiKey = config.apiKey;\n\n        // Initialize if validation is not required on init\n        if (config.validateOnInit === false) {\n            this.initializeBetterAuth();\n        }\n    }\n\n    /**\n     * Initialize the authentication client\n     * Validates the API key and sets up Better Auth\n     * @throws {ApiKeyValidationError} If API key validation fails\n     */\n    async initialize(): Promise<void> {\n        if (this.initialized) {\n            return;\n        }\n\n        // Validate API key with service if needed\n        if (this.config.validateOnInit !== false) {\n            await validateApiKeyWithService(this.apiKey);\n        }\n\n        this.initializeBetterAuth();\n        this.initialized = true;\n    }\n\n    /**\n     * Initialize Better Auth instance\n     * @private\n     */\n    private initializeBetterAuth(): void {\n        this.betterAuthInstance = betterAuth({\n            ...this.config.betterAuthOptions,\n        });\n    }\n\n    /**\n     * Get the Better Auth instance\n     * @throws {Error} If not initialized\n     */\n    getBetterAuth(): Auth {\n        if (!this.betterAuthInstance) {\n            throw new Error(\n                'KrutAuth not initialized. Call initialize() first or set validateOnInit to false.'\n            );\n        }\n        return this.betterAuthInstance;\n    }\n\n    /**\n     * Check if the client is initialized\n     */\n    isInitialized(): boolean {\n        return this.initialized;\n    }\n\n    /**\n     * Get the API key (useful for making authenticated requests)\n     * @returns The API key\n     */\n    getApiKey(): string {\n        return this.apiKey;\n    }\n\n    /**\n     * Sign in a user\n     * This is a convenience method that wraps Better Auth\n     * You can access the full Better Auth API via getBetterAuth()\n     */\n    async signIn(): Promise<Auth> {\n        return this.getBetterAuth();\n    }\n\n    /**\n     * Sign out the current user\n     * You can access the full Better Auth API via getBetterAuth()\n     */\n    async signOut(): Promise<Auth> {\n        return this.getBetterAuth();\n    }\n\n    /**\n     * Get the current session\n     * You can access the full Better Auth API via getBetterAuth()\n     */\n    async getSession(): Promise<Auth> {\n        return this.getBetterAuth();\n    }\n}\n","/**\n * @krutai/auth - Authentication package for KrutAI\n *\n * Requires `krutai` as a peer dependency (installed automatically).\n *\n * @example Server-side (Next.js API route / server component)\n * ```typescript\n * import { krutAuth } from \"@krutai/auth\";\n * import Database from \"better-sqlite3\";\n *\n * export const auth = krutAuth({\n *   database: new Database(\"./sqlite.db\"),\n *   emailAndPassword: { enabled: true },\n * });\n * ```\n *\n * @example Client-side (React / Next.js client component)\n * ```typescript\n * import { createAuthClient } from \"@krutai/auth/react\";\n *\n * export const authClient = createAuthClient({\n *   baseURL: process.env.NEXT_PUBLIC_APP_URL ?? \"http://localhost:3000\",\n * });\n *\n * export const { signIn, signUp, signOut, useSession } = authClient;\n * ```\n *\n * @packageDocumentation\n */\n\nimport { betterAuth } from 'better-auth';\nimport type { BetterAuthOptions } from 'better-auth';\n\n/**\n * krutAuth — drop-in replacement for betterAuth.\n *\n * Use this instead of importing betterAuth directly.\n *\n * @example\n * ```typescript\n * import { krutAuth } from \"@krutai/auth\";\n * import Database from \"better-sqlite3\";\n *\n * export const auth = krutAuth({\n *   database: new Database(\"./sqlite.db\"),\n *   emailAndPassword: { enabled: true },\n * });\n * ```\n */\nexport function krutAuth(options: BetterAuthOptions) {\n    return betterAuth(options);\n}\n\n// Export main KrutAuth class (API-key-protected wrapper)\nexport { KrutAuth } from './client';\n\n// Export types\nexport type { KrutAuthConfig, AuthSession, BetterAuthOptions } from './types';\n\n// Re-export validator utilities from krutai peer dependency\nexport {\n    validateApiKeyFormat,\n    validateApiKeyWithService,\n    createApiKeyChecker,\n    ApiKeyValidationError,\n} from 'krutai';\n\n// Package metadata\nexport const VERSION = '0.1.7';\n"]}
+{"version":3,"sources":["../src/client.ts","../src/index.ts"],"names":["betterAuth"],"mappings":";;;;;AAiCO,IAAM,WAAN,MAAe;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUlB,YAAoB,MAAA,EAAwB;AAAxB,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAEhB,IAAA,oBAAA,CAAqB,OAAO,MAAM,CAAA;AAClC,IAAA,IAAA,CAAK,SAAS,MAAA,CAAO,MAAA;AAGrB,IAAA,IAAI,MAAA,CAAO,mBAAmB,KAAA,EAAO;AACjC,MAAA,IAAA,CAAK,oBAAA,EAAqB;AAAA,IAC9B;AAAA,EACJ;AAAA,EAlBQ,MAAA;AAAA,EACA,kBAAA,GAAkC,IAAA;AAAA,EAClC,WAAA,GAAc,KAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuBtB,MAAM,UAAA,GAA4B;AAC9B,IAAA,IAAI,KAAK,WAAA,EAAa;AAClB,MAAA;AAAA,IACJ;AAGA,IAAA,IAAI,IAAA,CAAK,MAAA,CAAO,cAAA,KAAmB,KAAA,EAAO;AACtC,MAAA,MAAM,yBAAA,CAA0B,KAAK,MAAM,CAAA;AAAA,IAC/C;AAEA,IAAA,IAAA,CAAK,oBAAA,EAAqB;AAC1B,IAAA,IAAA,CAAK,WAAA,GAAc,IAAA;AAAA,EACvB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,oBAAA,GAA6B;AACjC,IAAA,IAAA,CAAK,qBAAqB,UAAA,CAAW;AAAA,MACjC,GAAG,KAAK,MAAA,CAAO;AAAA,KAClB,CAAA;AAAA,EACL;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,aAAA,GAAsB;AAClB,IAAA,IAAI,CAAC,KAAK,kBAAA,EAAoB;AAC1B,MAAA,MAAM,IAAI,KAAA;AAAA,QACN;AAAA,OACJ;AAAA,IACJ;AACA,IAAA,OAAO,IAAA,CAAK,kBAAA;AAAA,EAChB;AAAA;AAAA;AAAA;AAAA,EAKA,aAAA,GAAyB;AACrB,IAAA,OAAO,IAAA,CAAK,WAAA;AAAA,EAChB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,SAAA,GAAoB;AAChB,IAAA,OAAO,IAAA,CAAK,MAAA;AAAA,EAChB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,MAAA,GAAwB;AAC1B,IAAA,OAAO,KAAK,aAAA,EAAc;AAAA,EAC9B;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,OAAA,GAAyB;AAC3B,IAAA,OAAO,KAAK,aAAA,EAAc;AAAA,EAC9B;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,UAAA,GAA4B;AAC9B,IAAA,OAAO,KAAK,aAAA,EAAc;AAAA,EAC9B;AACJ;ACrFO,SAAS,SAAS,OAAA,EAA4B;AACjD,EAAA,OAAOA,WAAW,OAAO,CAAA;AAC7B;AAgBO,IAAM,OAAA,GAAU","file":"index.mjs","sourcesContent":["import { betterAuth } from 'better-auth';\nimport type { Auth } from 'better-auth';\nimport type { KrutAuthConfig } from './types';\n// Import validation from krutai peer dependency\nimport {\n    validateApiKeyFormat,\n    validateApiKeyWithService,\n} from 'krutai';\n\n/**\n * KrutAuth - Authentication client for KrutAI\n *\n * This class wraps Better Auth and adds API key validation\n * to ensure only authorized users can access authentication features.\n *\n * @example\n * ```typescript\n * import { KrutAuth } from '@krutai/auth';\n *\n * const auth = new KrutAuth({\n *   apiKey: 'your-api-key-here',\n *   betterAuthOptions: {\n *     // Better Auth configuration\n *   }\n * });\n *\n * // Initialize the client (validates API key)\n * await auth.initialize();\n *\n * // Use authentication features\n * const betterAuth = auth.getBetterAuth();\n * ```\n */\nexport class KrutAuth {\n    private apiKey: string;\n    private betterAuthInstance: Auth | null = null;\n    private initialized = false;\n\n    /**\n     * Creates a new KrutAuth instance\n     * @param config - Configuration options\n     * @throws {ApiKeyValidationError} If API key is invalid\n     */\n    constructor(private config: KrutAuthConfig) {\n        // Validate API key format immediately\n        validateApiKeyFormat(config.apiKey);\n        this.apiKey = config.apiKey;\n\n        // Initialize if validation is not required on init\n        if (config.validateOnInit === false) {\n            this.initializeBetterAuth();\n        }\n    }\n\n    /**\n     * Initialize the authentication client\n     * Validates the API key and sets up Better Auth\n     * @throws {ApiKeyValidationError} If API key validation fails\n     */\n    async initialize(): Promise<void> {\n        if (this.initialized) {\n            return;\n        }\n\n        // Validate API key with service if needed\n        if (this.config.validateOnInit !== false) {\n            await validateApiKeyWithService(this.apiKey);\n        }\n\n        this.initializeBetterAuth();\n        this.initialized = true;\n    }\n\n    /**\n     * Initialize Better Auth instance\n     * @private\n     */\n    private initializeBetterAuth(): void {\n        this.betterAuthInstance = betterAuth({\n            ...this.config.betterAuthOptions,\n        });\n    }\n\n    /**\n     * Get the Better Auth instance\n     * @throws {Error} If not initialized\n     */\n    getBetterAuth(): Auth {\n        if (!this.betterAuthInstance) {\n            throw new Error(\n                'KrutAuth not initialized. Call initialize() first or set validateOnInit to false.'\n            );\n        }\n        return this.betterAuthInstance;\n    }\n\n    /**\n     * Check if the client is initialized\n     */\n    isInitialized(): boolean {\n        return this.initialized;\n    }\n\n    /**\n     * Get the API key (useful for making authenticated requests)\n     * @returns The API key\n     */\n    getApiKey(): string {\n        return this.apiKey;\n    }\n\n    /**\n     * Sign in a user\n     * This is a convenience method that wraps Better Auth\n     * You can access the full Better Auth API via getBetterAuth()\n     */\n    async signIn(): Promise<Auth> {\n        return this.getBetterAuth();\n    }\n\n    /**\n     * Sign out the current user\n     * You can access the full Better Auth API via getBetterAuth()\n     */\n    async signOut(): Promise<Auth> {\n        return this.getBetterAuth();\n    }\n\n    /**\n     * Get the current session\n     * You can access the full Better Auth API via getBetterAuth()\n     */\n    async getSession(): Promise<Auth> {\n        return this.getBetterAuth();\n    }\n}\n","/**\n * @krutai/auth - Authentication package for KrutAI\n *\n * Requires `krutai` as a peer dependency (installed automatically).\n *\n * @example Server-side (Next.js API route / server component)\n * ```typescript\n * import { krutAuth } from \"@krutai/auth\";\n * import Database from \"better-sqlite3\";\n *\n * export const auth = krutAuth({\n *   database: new Database(\"./sqlite.db\"),\n *   emailAndPassword: { enabled: true },\n *   baseURL: process.env.BETTER_AUTH_BASE_URL ?? \"http://localhost:3000\",\n * });\n * ```\n *\n * @example Client-side (React / Next.js client component)\n * ```typescript\n * import { createAuthClient } from \"@krutai/auth/react\";\n *\n * export const authClient = createAuthClient({\n *   baseURL: process.env.NEXT_PUBLIC_APP_URL ?? \"http://localhost:3000\",\n * });\n *\n * export const { signIn, signUp, signOut, useSession } = authClient;\n * ```\n *\n * @packageDocumentation\n */\n\nimport { betterAuth } from 'better-auth';\nimport type { BetterAuthOptions } from 'better-auth';\n\n/**\n * krutAuth — drop-in replacement for betterAuth.\n *\n * Use this instead of importing betterAuth directly.\n *\n * @example\n * ```typescript\n * import { krutAuth } from \"@krutai/auth\";\n * import Database from \"better-sqlite3\";\n *\n * export const auth = krutAuth({\n *   database: new Database(\"./sqlite.db\"),\n *   emailAndPassword: { enabled: true },\n * });\n * ```\n */\nexport function krutAuth(options: BetterAuthOptions) {\n    return betterAuth(options);\n}\n\n// Export main KrutAuth class (API-key-protected wrapper)\nexport { KrutAuth } from './client';\n\n// Export types\nexport type { KrutAuthConfig, AuthSession, BetterAuthOptions } from './types';\n\n// Re-export minimal validator utilities (format/length check only)\nexport {\n    validateApiKeyFormat,\n    validateApiKeyWithService,\n    ApiKeyValidationError,\n} from 'krutai';\n\n// Package metadata\nexport const VERSION = '0.1.9';\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@krutai/auth",
-    "version": "0.1.7",
+    "version": "0.1.9",
     "description": "Authentication package for KrutAI — installs krutai, better-auth, and better-sqlite3 automatically",
     "main": "./dist/index.js",
     "module": "./dist/index.mjs",
@@ -24,6 +24,7 @@
     },
     "files": [
         "dist",
+        "scripts",
         "README.md",
         "AI_REFERENCE.md"
     ],
@@ -31,7 +32,8 @@
         "build": "tsup",
         "dev": "tsup --watch",
         "clean": "rm -rf dist *.tsbuildinfo",
-        "typecheck": "tsc --noEmit"
+        "typecheck": "tsc --noEmit",
+        "postinstall": "node scripts/migrate.js"
     },
     "keywords": [
         "krutai",
@@ -63,4 +65,4 @@
         "url": "git+https://github.com/AccountantAIOrg/krut_packages.git",
         "directory": "packages/auth"
     }
-}
+}

package/scripts/migrate.js

@@ -0,0 +1,53 @@
+#!/usr/bin/env node
+/**
+ * @krutai/auth — postinstall migration script
+ *
+ * Automatically creates (or updates) the SQLite database tables
+ * required by Better Auth. Runs after `npm install @krutai/auth`.
+ *
+ * The database file is placed at the project root as `sqlite.db`.
+ * Set BETTER_AUTH_DB_PATH to override the location.
+ * Set SKIP_KRUTAI_MIGRATE=1 to skip this script entirely.
+ */
+
+const { execSync } = require('child_process');
+const path = require('path');
+const fs = require('fs');
+
+// Allow opt-out
+if (process.env.SKIP_KRUTAI_MIGRATE === '1') {
+    console.log('[krutai/auth] Skipping migration (SKIP_KRUTAI_MIGRATE=1)');
+    process.exit(0);
+}
+
+// Determine project root (where the consuming project's package.json lives)
+// When postinstall runs under node_modules/@krutai/auth, we go up 3 levels.
+const projectRoot = path.resolve(__dirname, '..', '..', '..', '..');
+
+// Fallback: if we're being run from within the monorepo itself, use cwd
+const packageJson = path.join(projectRoot, 'package.json');
+const root = fs.existsSync(packageJson) ? projectRoot : process.cwd();
+
+const dbPath = process.env.BETTER_AUTH_DB_PATH ?? path.join(root, 'sqlite.db');
+
+console.log('[krutai/auth] Running Better Auth SQLite migration...');
+console.log(`[krutai/auth] Database: ${dbPath}`);
+
+try {
+    // better-auth provides a CLI via `npx better-auth migrate`
+    // Pass the db path via env so it's picked up automatically
+    execSync('npx better-auth migrate --yes', {
+        cwd: root,
+        stdio: 'inherit',
+        env: {
+            ...process.env,
+            BETTER_AUTH_DB_PATH: dbPath,
+            BETTER_AUTH_DATABASE_URL: `file:${dbPath}`,
+        },
+    });
+    console.log('[krutai/auth] Migration complete. SQLite tables are ready.');
+} catch (err) {
+    // Don't fail the install — the user may not have a lib/auth.ts yet
+    console.warn('[krutai/auth] Migration skipped or failed (this is OK if you have not created lib/auth.ts yet).');
+    console.warn('[krutai/auth] Run `npx better-auth migrate` manually after setting up your auth config.');
+}