@lunora/auth 0.0.0 → 1.0.0-alpha.1

package/dist/adapter.d.mts

@@ -0,0 +1,43 @@
+import { createAdapterFactory } from 'better-auth/adapters';
+import { d1Executor } from "./sql-store.mjs";
+import { AuthStore } from "./store.mjs";
+/**
+* A better-auth database adapter backed by an {@link AuthStore} — the bridge
+* that routes better-auth's reads and writes through Lunora's data layer
+* instead of better-auth's built-in D1/Kysely adapter. Pass the result as
+* `createAuth({ database: lunoraAuthAdapter(store) })`; better-auth's
+* `createAdapterFactory` handles id generation, default values, field-name
+* mapping and output shaping, so this only translates the cleaned CRUD calls
+* onto the store.
+*
+* ```ts
+* const auth = createAuth({
+*     secret: env.AUTH_SECRET,
+*     emailAndPassword: { enabled: true },
+*     database: lunoraAuthAdapter(lunoraStore), // lunoraStore writes via ctx.db
+* });
+* ```
+*
+* Scope: the {@link AuthStore} interface is single-table CRUD. better-auth's
+* relational `join` reads (an advanced opt-in) are not handled — pair the
+* adapter with `disableJoins` or let better-auth fall back to per-table reads.
+*/
+declare const lunoraAuthAdapter: (store: AuthStore) => ReturnType<typeof createAdapterFactory>;
+/**
+* One-liner for the common case: a better-auth `database` backed by a Cloudflare
+* D1 binding, via Lunora's SQL store — equivalent to
+* `lunoraAuthAdapter(createSqlAuthStore(d1Executor(d1)))`.
+*
+* Prefer this over passing the raw `env.DB` as `database`. With raw D1,
+* better-auth resolves its Kysely adapter through a runtime `await import(...)`
+* inside `auth.$context`, and that dynamic import never settles under
+* `@cloudflare/vite-plugin`'s worker runner — so it hangs *every* auth request
+* in `pnpm dev` (a standalone `wrangler dev` or a deployed worker bundle it
+* up-front, so they're unaffected — which makes the hang baffling to debug).
+* This explicit adapter skips that import entirely, so dev and prod behave the
+* same. The migration instance is the one exception — it wants raw `env.DB` so
+* `ensureMigrated`'s Kysely migrator can create the tables (its `$context` is
+* never resolved, so the hang doesn't apply there).
+*/
+declare const lunoraD1Adapter: (d1: Parameters<typeof d1Executor>[0]) => ReturnType<typeof lunoraAuthAdapter>;
+export { lunoraAuthAdapter, lunoraD1Adapter };

package/dist/adapter.d.ts

@@ -0,0 +1,43 @@
+import { createAdapterFactory } from 'better-auth/adapters';
+import { d1Executor } from "./sql-store.js";
+import { AuthStore } from "./store.js";
+/**
+* A better-auth database adapter backed by an {@link AuthStore} — the bridge
+* that routes better-auth's reads and writes through Lunora's data layer
+* instead of better-auth's built-in D1/Kysely adapter. Pass the result as
+* `createAuth({ database: lunoraAuthAdapter(store) })`; better-auth's
+* `createAdapterFactory` handles id generation, default values, field-name
+* mapping and output shaping, so this only translates the cleaned CRUD calls
+* onto the store.
+*
+* ```ts
+* const auth = createAuth({
+*     secret: env.AUTH_SECRET,
+*     emailAndPassword: { enabled: true },
+*     database: lunoraAuthAdapter(lunoraStore), // lunoraStore writes via ctx.db
+* });
+* ```
+*
+* Scope: the {@link AuthStore} interface is single-table CRUD. better-auth's
+* relational `join` reads (an advanced opt-in) are not handled — pair the
+* adapter with `disableJoins` or let better-auth fall back to per-table reads.
+*/
+declare const lunoraAuthAdapter: (store: AuthStore) => ReturnType<typeof createAdapterFactory>;
+/**
+* One-liner for the common case: a better-auth `database` backed by a Cloudflare
+* D1 binding, via Lunora's SQL store — equivalent to
+* `lunoraAuthAdapter(createSqlAuthStore(d1Executor(d1)))`.
+*
+* Prefer this over passing the raw `env.DB` as `database`. With raw D1,
+* better-auth resolves its Kysely adapter through a runtime `await import(...)`
+* inside `auth.$context`, and that dynamic import never settles under
+* `@cloudflare/vite-plugin`'s worker runner — so it hangs *every* auth request
+* in `pnpm dev` (a standalone `wrangler dev` or a deployed worker bundle it
+* up-front, so they're unaffected — which makes the hang baffling to debug).
+* This explicit adapter skips that import entirely, so dev and prod behave the
+* same. The migration instance is the one exception — it wants raw `env.DB` so
+* `ensureMigrated`'s Kysely migrator can create the tables (its `$context` is
+* never resolved, so the hang doesn't apply there).
+*/
+declare const lunoraD1Adapter: (d1: Parameters<typeof d1Executor>[0]) => ReturnType<typeof lunoraAuthAdapter>;
+export { lunoraAuthAdapter, lunoraD1Adapter };

package/dist/adapter.mjs

@@ -0,0 +1,47 @@
+import { createAdapterFactory } from 'better-auth/adapters';
+import { createSqlAuthStore, d1Executor } from './sql-store.mjs';
+
+const asRow = (row) => row;
+const asRowOrNull = (row) => row ?? null;
+const asRows = (rows) => rows;
+const lunoraAuthAdapter = (store) => createAdapterFactory({
+  adapter: () => {
+    return {
+      consumeOne: async ({ model, where }) => asRowOrNull(await store.consumeOne(model, where)),
+      count: async ({ model, where }) => store.count(model, where ?? []),
+      create: async ({ data, model }) => asRow(await store.create(model, data)),
+      delete: async ({ model, where }) => {
+        await store.remove(model, where);
+      },
+      deleteMany: async ({ model, where }) => store.remove(model, where),
+      findMany: async ({ limit, model, offset, sortBy, where }) => asRows(await store.read(model, { limit, offset, sortBy, where: where ?? [] })),
+      findOne: async ({ model, where }) => {
+        const [row] = await store.read(model, { limit: 1, where });
+        return asRowOrNull(row);
+      },
+      update: async ({ model, update, where }) => {
+        const [row] = await store.update(model, where, update);
+        return asRowOrNull(row);
+      },
+      updateMany: async ({ model, update, where }) => {
+        const updated = await store.update(model, where, update);
+        return updated.length;
+      }
+    };
+  },
+  config: {
+    adapterId: "lunora",
+    adapterName: "Lunora Adapter",
+    // Conservative flags so the adapter is store-agnostic: better-auth
+    // serializes dates/booleans/json to primitives (string/number) before a
+    // write and parses them back after a read, so a store — in-memory or
+    // SQL — only ever handles primitives, never schema-aware codecs.
+    supportsBooleans: false,
+    supportsDates: false,
+    supportsJSON: false,
+    supportsNumericIds: false
+  }
+});
+const lunoraD1Adapter = (d1) => lunoraAuthAdapter(createSqlAuthStore(d1Executor(d1)));
+
+export { lunoraAuthAdapter, lunoraD1Adapter };

package/dist/index.d.mts

@@ -0,0 +1,386 @@
+export { lunoraAuthAdapter, lunoraD1Adapter } from "./adapter.mjs";
+import { L as LunoraAuth, a as LunoraAuthOptions } from "./packem_shared/create-auth.d-M36jwG_Y.mjs";
+export { c as createAuth } from "./packem_shared/create-auth.d-M36jwG_Y.mjs";
+export { type LunoraAuthApiContext, LunoraAuthHeadersError, type WithAuthPluginsMiddleware, type WithAuthPluginsOptions, withAuthPlugins } from "./middleware.mjs";
+export { default as authTables } from "./schema.mjs";
+import { BetterAuthOptions } from 'better-auth';
+export { type SqlExecutor, createSqlAuthStore, d1Executor } from "./sql-store.mjs";
+export { type AuthQuery, type AuthRow, type AuthStore, type AuthWhereClause, createMemoryAuthStore, matchesWhere } from "./store.mjs";
+export { type FetchLike, TURNSTILE_VERIFY_ENDPOINT, type TurnstileVerifyResult, type VerifyTurnstileOptions, verifyTurnstile } from "./turnstile.mjs";
+export { type VerifyTurnstileMiddlewareOptions, verifyTurnstileMiddleware } from "./turnstile-middleware.mjs";
+import 'better-auth/adapters';
+import '@lunora/server';
+/**
+* A timestamp as it leaves the admin API: epoch-ms (better-auth stores `Date`s,
+* which we normalize on output) or `null` when the column is unset.
+*/
+type AuthTimestamp = null | number;
+/**
+* One user row as the admin API surfaces it. The fixed keys mirror better-auth's
+* core `user` table plus the `admin()` plugin columns (`role`/`banned`/…); the
+* index signature carries any app-defined `user.additionalFields` so callers
+* (the studio) can render them generically. Password material never lives on
+* this row (it's in the `account` table) and is never returned.
+*/
+interface AuthAdminUser {
+  [key: string]: unknown;
+  banExpires?: AuthTimestamp;
+  banned?: boolean | null;
+  banReason?: null | string;
+  createdAt?: AuthTimestamp;
+  email?: null | string;
+  emailVerified?: boolean | null;
+  id: string;
+  image?: null | string;
+  name?: null | string;
+  role?: null | string;
+  updatedAt?: AuthTimestamp;
+}
+/**
+* One session row as the admin API surfaces it. Mirrors better-auth's `session`
+* table; `impersonatedBy` is set when the session was minted by
+* {@link AuthAdmin.impersonateUser}. The signing `token` is stripped — it's a
+* bearer credential, and the only place we hand one back is the explicit
+* impersonation flow.
+*/
+interface AuthAdminSession {
+  [key: string]: unknown;
+  createdAt?: AuthTimestamp;
+  expiresAt?: AuthTimestamp;
+  id: string;
+  impersonatedBy?: null | string;
+  ipAddress?: null | string;
+  userAgent?: null | string;
+  userId: string;
+}
+/** One linked account (a credential or OAuth provider). All token material is stripped. */
+interface AuthAccount {
+  [key: string]: unknown;
+  accountId?: null | string;
+  createdAt?: AuthTimestamp;
+  id: string;
+  providerId?: null | string;
+  scope?: null | string;
+  userId: string;
+}
+/** One organization row (from the `organization` plugin). */
+interface AuthOrganization {
+  [key: string]: unknown;
+  createdAt?: AuthTimestamp;
+  id: string;
+  name?: null | string;
+  slug?: null | string;
+}
+/** One organization membership row. */
+interface AuthMember {
+  [key: string]: unknown;
+  createdAt?: AuthTimestamp;
+  id: string;
+  organizationId: string;
+  role?: null | string;
+  userId: string;
+}
+/** One pending organization invitation. */
+interface AuthInvitation {
+  [key: string]: unknown;
+  email?: null | string;
+  expiresAt?: AuthTimestamp;
+  id: string;
+  organizationId: string;
+  role?: null | string;
+  status?: null | string;
+}
+/** One registered passkey. Credential secrets (`publicKey`) are stripped. */
+interface AuthPasskey {
+  [key: string]: unknown;
+  createdAt?: AuthTimestamp;
+  deviceType?: null | string;
+  id: string;
+  name?: null | string;
+  userId: string;
+}
+/** A page of rows plus the unpaginated total. */
+interface AuthPage<T> {
+  rows: T[];
+  total: number;
+}
+/**
+* Which admin surfaces a given auth instance supports, derived from the enabled
+* better-auth plugins (and any {@link CreateAuthAdminOptions.features} overrides).
+* The studio calls {@link AuthAdmin.capabilities} once and renders only the
+* panels whose capability is `true` — so a deployment that doesn't enable, say,
+* the `organization` plugin never shows an Organizations section.
+*/
+interface AuthCapabilities {
+  /** Linked-account browsing/unlinking — core (the `account` table always exists). */
+  accounts: boolean;
+  /** The `admin()` plugin: ban/role/impersonate/create/delete/set-password. */
+  admin: boolean;
+  /** The `organization` plugin: orgs, members, invitations. */
+  organization: boolean;
+  /** The `@better-auth/passkey` plugin: per-user passkeys. */
+  passkey: boolean;
+  /** The `two-factor` plugin: per-user 2FA status / disable. */
+  twoFactor: boolean;
+}
+/** A scalar value usable in an adapter `where` clause / filter. */
+type WhereValue = boolean | number | string;
+/** Filtering / paging options for {@link AuthAdmin.listUsers}. */
+interface ListUsersOptions {
+  /** Column to filter on with `=` (defaults to `email` when `filterValue` is set). */
+  filterField?: string;
+  /** Exact-match filter value. */
+  filterValue?: WhereValue;
+  limit?: number;
+  offset?: number;
+  /** Substring search value (matched with `contains`). */
+  search?: string;
+  /** Column the `search` substring matches against (default `email`). */
+  searchField?: string;
+  /** Column to order by (default `createdAt`). */
+  sortBy?: string;
+  sortDirection?: "asc" | "desc";
+}
+/** The result of {@link AuthAdmin.impersonateUser}: a fresh session token to act as the target user. */
+interface ImpersonationResult {
+  expiresAt: AuthTimestamp;
+  /** Bearer session token for the impersonated user. The caller is responsible for using it (e.g. setting the cookie). */
+  token: string;
+  user: AuthAdminUser;
+}
+/**
+* The full read + write surface the studio's auth dashboard drives, backed by
+* better-auth's tables. Returned by {@link createAuthAdmin}. The runtime accepts
+* a structurally-compatible object as its `authAdmin` option and exposes each
+* method behind an admin-token-gated endpoint. Methods whose backing plugin is
+* absent still exist (they're not conditionally omitted) but the studio gates
+* them on {@link AuthAdmin.capabilities}; calling one for an unconfigured plugin
+* surfaces the underlying adapter error.
+*/
+interface AuthAdmin {
+  banUser: (input: {
+    expiresInSeconds?: number;
+    reason?: string;
+    userId: string;
+  }) => Promise<AuthAdminUser>;
+  cancelInvitation: (input: {
+    invitationId: string;
+  }) => Promise<void>;
+  capabilities: () => Promise<AuthCapabilities>;
+  createUser: (input: {
+    data?: Record<string, unknown>;
+    email: string;
+    name: string;
+    password?: string;
+    role?: string | string[];
+  }) => Promise<AuthAdminUser>;
+  deletePasskey: (input: {
+    passkeyId: string;
+  }) => Promise<void>;
+  disableTwoFactor: (input: {
+    userId: string;
+  }) => Promise<void>;
+  impersonateUser: (input: {
+    userId: string;
+  }) => Promise<ImpersonationResult>;
+  listAccounts: (input: {
+    userId: string;
+  }) => Promise<AuthAccount[]>;
+  listInvitations: (options: {
+    limit?: number;
+    offset?: number;
+    organizationId: string;
+  }) => Promise<AuthPage<AuthInvitation>>;
+  listMembers: (options: {
+    limit?: number;
+    offset?: number;
+    organizationId: string;
+  }) => Promise<AuthPage<AuthMember>>;
+  listOrganizations: (options: {
+    limit?: number;
+    offset?: number;
+  }) => Promise<AuthPage<AuthOrganization>>;
+  listPasskeys: (input: {
+    userId: string;
+  }) => Promise<AuthPasskey[]>;
+  listSessions: (options: {
+    limit?: number;
+    offset?: number;
+    userId?: string;
+  }) => Promise<AuthPage<AuthAdminSession>>;
+  listUsers: (options: ListUsersOptions) => Promise<AuthPage<AuthAdminUser>>;
+  removeMember: (input: {
+    memberId: string;
+  }) => Promise<void>;
+  removeUser: (input: {
+    userId: string;
+  }) => Promise<void>;
+  revokeUserSession: (input: {
+    sessionId: string;
+  }) => Promise<void>;
+  revokeUserSessions: (input: {
+    userId: string;
+  }) => Promise<void>;
+  setRole: (input: {
+    role: string | string[];
+    userId: string;
+  }) => Promise<AuthAdminUser>;
+  setUserPassword: (input: {
+    newPassword: string;
+    userId: string;
+  }) => Promise<void>;
+  unbanUser: (input: {
+    userId: string;
+  }) => Promise<AuthAdminUser>;
+  unlinkAccount: (input: {
+    accountId: string;
+    userId: string;
+  }) => Promise<void>;
+  updateUser: (input: {
+    data: Record<string, unknown>;
+    userId: string;
+  }) => Promise<AuthAdminUser>;
+}
+/** Options for {@link createAuthAdmin}. */
+interface CreateAuthAdminOptions {
+  /**
+  * Force individual {@link AuthCapabilities} on or off regardless of which
+  * plugins are detected — e.g. `{ impersonate: false }`-style opt-outs by
+  * setting `admin: false`, or hiding linked accounts with `accounts: false`.
+  * A capability is reported only when both its plugin is enabled *and* its
+  * override isn't `false`.
+  */
+  features?: Partial<AuthCapabilities>;
+  /**
+  * User id recorded as the impersonator on sessions minted by
+  * {@link AuthAdmin.impersonateUser}. Defaults to the impersonated user's own
+  * id (a self-reference) since the trusted admin plane has no acting user.
+  */
+  impersonatedBy?: string;
+  /**
+  * How long (in seconds) an impersonation session lives. Must be a positive
+  * finite integer. Capped at 24 × {@link DEFAULT_IMPERSONATION_SECONDS}
+  * (86 400 s / 24 h). Defaults to {@link DEFAULT_IMPERSONATION_SECONDS}
+  * (3 600 s / 1 h).
+  */
+  impersonationSeconds?: number;
+}
+/**
+* A normalized failure from an admin operation. better-auth throws `APIError`s
+* carrying a `body.code` (e.g. `USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL`); we
+* surface that `code` so the runtime can map it onto an HTTP status and the
+* studio can show a meaningful message instead of a generic 500.
+*/
+declare class LunoraAuthAdminError extends Error {
+  readonly code: string;
+  constructor(message: string, code: string);
+}
+/**
+* Build the studio's auth user-management plane on top of better-auth.
+*
+* Pass the result as the runtime's `authAdmin` option; the runtime exposes each
+* method behind an admin-token-gated `/_lunora/admin/auth/*` endpoint. The set
+* of usable surfaces is reported by {@link AuthAdmin.capabilities} — derived
+* from the enabled better-auth plugins, so enabling `admin()`, `organization()`,
+* `twoFactor()`, or the passkey plugin in the auth config is what lights up the
+* matching dashboard panels.
+*
+* **Trust model — important.** These operations talk to better-auth's
+* `internalAdapter` (and `adapter`/password hasher) **directly**, deliberately
+* bypassing the plugins' own endpoints, which require the caller to hold an
+* admin-role session. That session check is the wrong gate here: the runtime
+* already authorizes every call with `LUNORA_ADMIN_TOKEN`, so this helper acts
+* as a trusted server-side operator. It is therefore not an end-user-callable
+* API — never expose it on a path that isn't admin-token gated.
+*
+* `auth.$context` is a promise (better-auth resolves the adapter, password
+* config, etc. lazily); we memoize it so the first call pays the cost once.
+*/
+declare const createAuthAdmin: (auth: LunoraAuth, options?: CreateAuthAdminOptions) => AuthAdmin;
+/**
+* Default basePath used by better-auth's client + handler. Override via the
+* second argument if you mount the auth routes somewhere else.
+*/
+declare const DEFAULT_AUTH_BASE_PATH: string;
+/**
+* Route an inbound `Request` to better-auth if the path falls under
+* `basePath`; otherwise return `null` so the caller can continue dispatching.
+*
+* Better-auth handles arbitrarily nested paths (`/api/auth/sign-in/email`,
+* `/api/auth/callback/github`, …), so we use prefix matching instead of the
+* exact-path map `createWorker` consumes for top-level routes.
+*/
+declare const handleAuthRequest: (auth: LunoraAuth, request: Request, basePath?: string) => Promise<Response | undefined>;
+/**
+* Apply better-auth's required schema (`user`, `session`, `account`,
+* `verification`) to the configured database. Idempotent — better-auth
+* diffs the existing schema and only runs the missing DDL.
+*
+* Cached per `options` reference so the diff cost (one PRAGMA-style sweep
+* per table) doesn't fire on every request. In Cloudflare Workers the same
+* `env.DB` binding is reused across invocations within a single isolate, so
+* caching against the options object — which captures the binding — is
+* sufficient.
+*
+* For production you should prefer pre-applying the schema at deploy time
+* via `compileMigrationsSql` + `wrangler d1 execute`; this helper exists for
+* dev/playground and small deployments.
+*/
+declare const ensureMigrated: (auth: LunoraAuth | {
+  options: LunoraAuthOptions;
+}) => Promise<void>;
+/**
+* Compile better-auth's migrations to a single SQL string. Useful for
+* `wrangler d1 execute --file -` in CI so the deploy step applies the schema
+* before the first user request.
+*/
+declare const compileMigrationsSql: (options: LunoraAuthOptions) => Promise<string>;
+/**
+* Lunora-friendly view over better-auth's `session` option.
+*
+* This is a typed alias for better-auth's own `session` shape — Lunora stays a
+* thin wrapper, so we don't reimplement the fields, we just give them a named,
+* documented home so callers get autocomplete without reaching into
+* `BetterAuthOptions`. The most relevant fields for session rotation / richer
+* policies are `expiresIn` (absolute session lifetime, in seconds),
+* `updateAge` (rolling-rotation interval, in seconds — how often an active
+* session's expiry is pushed forward; `0` rotates on every use),
+* `disableSessionRefresh` (turn rolling rotation off entirely so sessions
+* expire at the absolute `expiresIn` regardless of activity), `freshAge`
+* (freshness window, in seconds, for sensitive operations like account
+* deletion; `0` treats every session as fresh — not recommended), and
+* `cookieCache` (opt-in signed-cookie session cache to skip DB reads).
+*
+* See better-auth's `session` option for the full field list.
+*/
+type SessionPolicy = NonNullable<BetterAuthOptions["session"]>;
+/**
+* Validate a {@link SessionPolicy} and return it unchanged (pass-through).
+*
+* better-auth happily accepts the `session` block verbatim, so the only job
+* here is to catch obviously-broken numeric inputs at construction time —
+* negative or non-finite durations — rather than letting them produce
+* surprising cookie expiries at runtime. Field names mirror better-auth's
+* `session` option exactly so the validated object forwards 1:1.
+*/
+declare const validateSessionPolicy: (policy: SessionPolicy) => SessionPolicy;
+/**
+* Ready-made {@link SessionPolicy} presets covering the common rotation /
+* expiry trade-offs. Spread or override fields as needed:
+*
+* ```ts
+* import { createAuth, sessionPresets } from "@lunora/auth";
+*
+* export const auth = createAuth({
+*     secret: env.AUTH_SECRET,
+*     database: env.DB,
+*     session: { ...sessionPresets.rolling, freshAge: 60 * 5 },
+* });
+* ```
+*
+* - `rolling` — balanced default: 7-day absolute expiry, rotated once per day.
+* - `strict` — short, security-sensitive: 1-hour expiry, 15-minute rotation.
+* - `longLived` — low-friction consumer apps: 30-day expiry, daily rotation.
+*/
+declare const sessionPresets: Record<"longLived" | "rolling" | "strict", SessionPolicy>;
+export { type AuthAccount, type AuthAdmin, type AuthAdminSession, type AuthAdminUser, type AuthCapabilities, type AuthInvitation, type AuthMember, type AuthOrganization, type AuthPage, type AuthPasskey, type AuthTimestamp, type CreateAuthAdminOptions, DEFAULT_AUTH_BASE_PATH, type ImpersonationResult, type ListUsersOptions, type LunoraAuth, LunoraAuthAdminError, type LunoraAuthOptions, type SessionPolicy, compileMigrationsSql, createAuthAdmin, ensureMigrated, handleAuthRequest, sessionPresets, validateSessionPolicy };