@lunora/auth 0.0.0 → 1.0.0-alpha.1

package/dist/middleware.d.ts

@@ -0,0 +1,189 @@
+import { L as LunoraAuth } from "./packem_shared/create-auth.d-M36jwG_Y.js";
+import 'better-auth';
+/**
+* Structural mirror of `@lunora/server`'s `MiddlewareNext` — the continuation
+* callback handed to a middleware. Repeated here so this package does not take
+* a runtime dependency on `@lunora/server`; the types are assignable from the
+* fully-typed builder.
+*/
+interface MiddlewareNext<ContextIn> {
+  (): Promise<ContextIn>;
+  <Extension extends Record<string, unknown>>(options: {
+    ctx: Extension;
+  }): Promise<ContextIn & Extension>;
+}
+/**
+* Thrown by the runtime header guard when a privileged `ctx.authApi.*` endpoint
+* is invoked without a `headers` property on its argument object. Carries the
+* offending `method` name so callers can pinpoint the bad call site, and points
+* at the explicit escape hatches.
+*
+* This is the runtime sibling of the static `auth_api_call_without_headers`
+* advisor lint — both treat a header-less `ctx.authApi.*` call as an
+* authorization bypass, so a call that trips the lint also trips this guard.
+*/
+declare class LunoraAuthHeadersError extends Error {
+  /** The `ctx.authApi.&lt;method>` that was called without `headers`. */
+  readonly method: string;
+  constructor(method: string);
+}
+/**
+* Options for {@link withAuthPlugins}.
+*/
+interface WithAuthPluginsOptions {
+  /**
+  * Whether to install the runtime header guard around `ctx.authApi`.
+  *
+  * **Defaults to `true` — the safe default.** When enabled, every
+  * `ctx.authApi.&lt;method>(…)` call that omits `headers` throws
+  * {@link LunoraAuthHeadersError} instead of silently running with full
+  * server-to-server privileges. For a deliberate, per-call unauthenticated
+  * invocation, use the explicit `ctx.authApi.withoutHeaders()` escape hatch
+  * rather than disabling the guard wholesale.
+  *
+  * Set to `false` only when you have audited every `ctx.authApi.*` call site
+  * and accept responsibility for passing headers yourself. This is the loud,
+  * all-or-nothing opt-out; prefer `withoutHeaders()` for one-offs.
+  */
+  enforceHeaders?: boolean;
+}
+/**
+* The Lunora context extension this middleware installs. It does *not* replace
+* `ctx.auth` (the identity-only surface populated by the runtime — `userId` and
+* `getIdentity()`); instead it adds a sibling `ctx.authApi` that points at the
+* full better-auth plugin API surface.
+*
+* The shape of `authApi` is the shape of the better-auth instance's `api` —
+* a flat record of endpoint functions like `createOrganization`, `banUser`,
+* `listMembers`, … contributed by whichever plugins are configured on the auth
+* instance. Because the type is `Auth["api"]` and `LunoraAuth` is generic over
+* the auth instance, callers get end-to-end inference: the endpoints they see
+* are exactly the ones their auth instance loaded.
+*/
+interface LunoraAuthApiContext<Auth extends LunoraAuth> {
+  /**
+  * The better-auth endpoint surface — every endpoint contributed by every
+  * plugin configured on the auth instance, ready to call directly:
+  *
+  * ```ts
+  * await ctx.authApi.createOrganization({ body: { name: "Acme" }, headers });
+  * await ctx.authApi.banUser({ body: { userId: "u_1" }, headers });
+  * ```
+  *
+  * # ⚠️ SECURITY: privileged surface — you MUST pass `headers`
+  *
+  * This is the **full, privileged** better-auth API (`auth.api`) — it
+  * includes admin/management endpoints such as `banUser`, `setRole`,
+  * impersonation, `createOrganization`, `removeMember`, … better-auth
+  * authorizes these calls from the caller's session in the `headers` you
+  * pass. Invoked **without** `headers`, better-auth treats the call as a
+  * trusted server-side invocation and **bypasses session authorization
+  * entirely** — any procedure that can reach `ctx.authApi` could then ban a
+  * user, escalate a role, or read another tenant's data.
+  *
+  * To stop that bypass at runtime, `withAuthPlugins` installs a guard around
+  * `ctx.authApi` by default: a header-less call to any endpoint throws
+  * {@link LunoraAuthHeadersError} rather than running with full privileges.
+  * The same `auth_api_call_without_headers` advisor lint catches it
+  * statically; the guard is the runtime backstop for the cases the lint
+  * can't see (dynamic method names, indirected calls). For the rare,
+  * deliberate unauthenticated server-to-server call, opt out explicitly with
+  * `ctx.authApi.withoutHeaders().&lt;method>(…)`.
+  *
+  * Lunora's procedure context carries only the resolved identity, not the
+  * raw inbound `Headers`, so this middleware CANNOT pre-bind them for you.
+  * Therefore: **thread the inbound `Headers` into every `ctx.authApi.*`
+  * call** (typically from an HTTP action — see {@link withAuthPlugins}). A
+  * header-less call is an authorization bypass, not a convenience.
+  */
+  readonly authApi: {
+    /**
+    * Explicit, loud escape hatch from the runtime header guard. Returns
+    * the raw, **unguarded** `auth.api` surface — every endpoint reached
+    * through it runs as a trusted server-to-server call with session
+    * authorization skipped.
+    *
+    * ```ts
+    * // A scheduled job with no inbound request that must create the
+    * // system org. Audited and intentional:
+    * await ctx.authApi.withoutHeaders().createOrganization({ body: { name } });
+    * ```
+    *
+    * Use only for deliberate, audited unauthenticated calls. For ordinary
+    * request-driven calls, pass `headers` so authorization is enforced.
+    */
+    withoutHeaders: () => Auth["api"];
+  } & Auth["api"];
+}
+/**
+* Build a Lunora middleware that mounts a better-auth instance's plugin API
+* onto `ctx.authApi`. Compose it with `.use(...)` once per builder and every
+* downstream handler gets typed access to the plugin endpoints — no more
+* importing the auth instance directly from every query/mutation file.
+*
+* # ⚠️ SECURITY: headers are load-bearing for authorization
+*
+* `ctx.authApi` is the **full privileged** better-auth surface (`auth.api`):
+* `banUser`, `setRole`, impersonation, `createOrganization`, `removeMember`,
+* and so on. better-auth authorizes these from the caller's session carried in
+* the `headers` you pass. **Called without `headers`, better-auth treats the
+* invocation as a trusted server-side call and skips session authorization
+* altogether** — so a header-less `ctx.authApi.banUser(...)` from any procedure
+* runs with full privileges regardless of who the caller is. This is an
+* authorization bypass, not just a missing convenience.
+*
+* To make that bypass fail loudly instead of silently, this middleware wraps
+* `ctx.authApi` in a **runtime header guard by default**: any endpoint called
+* without a `headers` property throws {@link LunoraAuthHeadersError}. The guard
+* mirrors the static `auth_api_call_without_headers` advisor lint exactly, so
+* the two agree on what counts as a header-bearing call.
+*
+* - **Default (safe):** `withAuthPlugins(auth)` — header-less calls throw.
+* - **Per-call opt-out (preferred):** `ctx.authApi.withoutHeaders().banUser(…)`
+* for a deliberate, audited unauthenticated server-to-server call.
+* - **Whole-middleware opt-out (loud):** `withAuthPlugins(auth, { enforceHeaders: false })`
+* disables the guard entirely; only do this once every call site is audited.
+*
+* Lunora's procedure context does not currently carry the raw request headers
+* (only the resolved identity — see `AuthState` in `@lunora/server`), so
+* this middleware **cannot** pre-bind headers for you and does **not** do so.
+* You MUST pass the inbound `Headers` explicitly into **every** `ctx.authApi.*`
+* call, from a transport that has them — typically an HTTP action:
+*
+* ```ts
+* // lunora/orgs.ts
+* import { httpAction } from "@lunora/server";
+* import { withAuthPlugins } from "@lunora/auth/middleware";
+* import { auth } from "./auth.js";
+*
+* export const createOrg = httpAction(async (ctx, request) => {
+*     const { name } = await request.json();
+*
+*     // ctx.authApi is installed by withAuthPlugins(auth) on the builder.
+*     const org = await ctx.authApi.createOrganization({
+*         body: { name },
+*         headers: request.headers,
+*     });
+*
+*     return Response.json(org);
+* });
+* ```
+*
+* For internal server-to-server calls where there is no inbound request
+* (e.g. a scheduled job that creates the system org), opt out explicitly with
+* `ctx.authApi.withoutHeaders()` and authenticate with whatever bearer token
+* your auth instance is configured to honour.
+*/
+/**
+* Shape of the middleware {@link withAuthPlugins} returns: a callable generic
+* over the incoming ctx so chaining `.use(...)` preserves whatever ctx fields
+* the upstream middleware already installed. Lives as its own interface
+* because TypeScript doesn't allow declaring `const fn: &lt;CtxIn>() => ...` —
+* the generic must live on a callable type alias or interface.
+*/
+type WithAuthPluginsMiddleware<Auth extends LunoraAuth> = <ContextIn>(options: {
+  ctx: ContextIn;
+  next: MiddlewareNext<ContextIn>;
+}) => Promise<ContextIn & LunoraAuthApiContext<Auth>>;
+declare const withAuthPlugins: <Auth extends LunoraAuth>(auth: Auth, options?: WithAuthPluginsOptions) => WithAuthPluginsMiddleware<Auth>;
+export { LunoraAuthApiContext, LunoraAuthHeadersError, WithAuthPluginsMiddleware, WithAuthPluginsOptions, withAuthPlugins };

package/dist/middleware.mjs

@@ -0,0 +1,53 @@
+const callHasHeaders = (argument) => {
+  if (argument === void 0) {
+    return false;
+  }
+  if (typeof argument !== "object" || argument === null) {
+    return true;
+  }
+  const { headers } = argument;
+  return headers !== void 0 && headers !== null;
+};
+const guardAuthApi = (api) => {
+  const withoutHeaders = () => api;
+  return /* @__PURE__ */ new Proxy(api, {
+    // eslint-disable-next-line sonarjs/function-return-type -- a Proxy `get` trap is intrinsically polymorphic: it returns the synthetic `withoutHeaders`, the guarded endpoint wrapper, or any passthrough property value
+    get(target, property, receiver) {
+      if (property === "withoutHeaders" && !(property in target)) {
+        return withoutHeaders;
+      }
+      const value = Reflect.get(target, property, receiver);
+      if (typeof value !== "function" || typeof property !== "string") {
+        return value;
+      }
+      const method = property;
+      return (...arguments_) => {
+        if (!callHasHeaders(arguments_[0])) {
+          return Promise.reject(new LunoraAuthHeadersError(method));
+        }
+        return Reflect.apply(value, target, arguments_);
+      };
+    }
+  });
+};
+class LunoraAuthHeadersError extends Error {
+  /** The `ctx.authApi.<method>` that was called without `headers`. */
+  method;
+  constructor(method) {
+    super(
+      `@lunora/auth: ctx.authApi.${method}(…) was called without \`headers\`. better-auth treats a header-less call as a trusted server-to-server invocation and skips session authorization entirely — an authorization bypass. Pass the inbound request headers: ctx.authApi.${method}({ body, headers: request.headers }). If you genuinely intend an unauthenticated server-to-server call, opt out explicitly via ctx.authApi.withoutHeaders().<method>(…), or disable the guard for the whole middleware with withAuthPlugins(auth, { enforceHeaders: false }).`
+    );
+    this.name = "LunoraAuthHeadersError";
+    this.method = method;
+  }
+}
+const withAuthPlugins = (auth, options = {}) => {
+  const enforceHeaders = options.enforceHeaders ?? true;
+  const authApi = enforceHeaders ? guardAuthApi(auth.api) : auth.api;
+  return async ({ next }) => {
+    const extended = await next({ ctx: { authApi } });
+    return extended;
+  };
+};
+
+export { LunoraAuthHeadersError, withAuthPlugins };

package/dist/packem_shared/DEFAULT_AUTH_BASE_PATH-DjcUWEQl.mjs

@@ -0,0 +1,11 @@
+const DEFAULT_AUTH_BASE_PATH = "/api/auth";
+const handleAuthRequest = async (auth, request, basePath = DEFAULT_AUTH_BASE_PATH) => {
+  const url = new URL(request.url);
+  const base = basePath.endsWith("/") ? basePath.slice(0, -1) : basePath;
+  if (url.pathname !== base && !url.pathname.startsWith(`${base}/`)) {
+    return void 0;
+  }
+  return auth.handler(request);
+};
+
+export { DEFAULT_AUTH_BASE_PATH, handleAuthRequest };

package/dist/packem_shared/create-auth.d-M36jwG_Y.d.mts

@@ -0,0 +1,58 @@
+import { betterAuth, BetterAuthOptions } from 'better-auth';
+/**
+* Lunora's options pass straight through to better-auth — the only thing we add
+* is requiring `secret` up front so a misconfigured deployment fails loudly
+* instead of at the first sign-in.
+*
+* For `database`, prefer `lunoraD1Adapter` (`database: lunoraD1Adapter(env.DB)`)
+* over passing the raw `env.DB`. better-auth *does* accept a D1Database directly,
+* but it then resolves its Kysely adapter via a runtime `await import(...)` inside
+* `auth.$context` — and that import never settles under `@cloudflare/vite-plugin`'s
+* worker runner, hanging every auth request in `pnpm dev`. The explicit adapter
+* skips it, so dev and prod behave the same. (Raw `env.DB` is still correct for
+* the migration-only instance — see `lunoraD1Adapter`'s note.)
+*
+* Session rotation / richer session policies are configured via the `session`
+* field (a `SessionPolicy`); Lunora validates it for obviously-broken
+* durations and forwards it verbatim to better-auth. See `sessionPresets`
+* for ready-made rotation/expiry trade-offs.
+*
+* ## Serverless background tasks (Cloudflare Workers)
+*
+* better-auth runs some work *after* sending the response — most importantly the
+* password-reset email, whose background send is what keeps reset responses
+* constant-time (a timing-attack defence: the response doesn't reveal whether
+* the account exists). On Cloudflare Workers a promise that isn't handed to
+* `ctx.waitUntil` can be cancelled the moment the response returns, dropping
+* that send and weakening the guarantee. Wire your request's `ctx.waitUntil`
+* into better-auth's background handler so the work survives:
+*
+* ```ts
+* // in your worker fetch handler, where `ctx: ExecutionContext` is in scope
+* const auth = createAuth({
+*     secret: env.AUTH_SECRET,
+*     database: lunoraD1Adapter(env.DB),
+*     advanced: {
+*         backgroundTasks: { handler: (promise) => ctx.waitUntil(promise) },
+*     },
+* });
+* ```
+*
+* (Lunora can't set this for you — `ctx.waitUntil` is per-request, but
+* `createAuth` runs once at worker setup.)
+*/
+type LunoraAuthOptions = BetterAuthOptions;
+/**
+* The full better-auth instance: `auth.handler` accepts a `Request` and
+* returns a `Response` (used by `handleAuthRequest`); `auth.api`
+* exposes the typed endpoint surface for server-side calls (e.g.
+* `auth.api.getSession({ headers })` inside a query/mutation).
+*/
+type LunoraAuth = ReturnType<typeof betterAuth>;
+/**
+* Create the auth instance. Thin wrapper around `betterAuth` that enforces
+* the `secret` requirement at construction time so misconfigured deployments
+* fail loudly at the first fetch rather than the first sign-in attempt.
+*/
+declare const createAuth: (options: LunoraAuthOptions) => LunoraAuth;
+export { LunoraAuth as L, LunoraAuthOptions as a, createAuth as c };

package/dist/packem_shared/create-auth.d-M36jwG_Y.d.ts

@@ -0,0 +1,58 @@
+import { betterAuth, BetterAuthOptions } from 'better-auth';
+/**
+* Lunora's options pass straight through to better-auth — the only thing we add
+* is requiring `secret` up front so a misconfigured deployment fails loudly
+* instead of at the first sign-in.
+*
+* For `database`, prefer `lunoraD1Adapter` (`database: lunoraD1Adapter(env.DB)`)
+* over passing the raw `env.DB`. better-auth *does* accept a D1Database directly,
+* but it then resolves its Kysely adapter via a runtime `await import(...)` inside
+* `auth.$context` — and that import never settles under `@cloudflare/vite-plugin`'s
+* worker runner, hanging every auth request in `pnpm dev`. The explicit adapter
+* skips it, so dev and prod behave the same. (Raw `env.DB` is still correct for
+* the migration-only instance — see `lunoraD1Adapter`'s note.)
+*
+* Session rotation / richer session policies are configured via the `session`
+* field (a `SessionPolicy`); Lunora validates it for obviously-broken
+* durations and forwards it verbatim to better-auth. See `sessionPresets`
+* for ready-made rotation/expiry trade-offs.
+*
+* ## Serverless background tasks (Cloudflare Workers)
+*
+* better-auth runs some work *after* sending the response — most importantly the
+* password-reset email, whose background send is what keeps reset responses
+* constant-time (a timing-attack defence: the response doesn't reveal whether
+* the account exists). On Cloudflare Workers a promise that isn't handed to
+* `ctx.waitUntil` can be cancelled the moment the response returns, dropping
+* that send and weakening the guarantee. Wire your request's `ctx.waitUntil`
+* into better-auth's background handler so the work survives:
+*
+* ```ts
+* // in your worker fetch handler, where `ctx: ExecutionContext` is in scope
+* const auth = createAuth({
+*     secret: env.AUTH_SECRET,
+*     database: lunoraD1Adapter(env.DB),
+*     advanced: {
+*         backgroundTasks: { handler: (promise) => ctx.waitUntil(promise) },
+*     },
+* });
+* ```
+*
+* (Lunora can't set this for you — `ctx.waitUntil` is per-request, but
+* `createAuth` runs once at worker setup.)
+*/
+type LunoraAuthOptions = BetterAuthOptions;
+/**
+* The full better-auth instance: `auth.handler` accepts a `Request` and
+* returns a `Response` (used by `handleAuthRequest`); `auth.api`
+* exposes the typed endpoint surface for server-side calls (e.g.
+* `auth.api.getSession({ headers })` inside a query/mutation).
+*/
+type LunoraAuth = ReturnType<typeof betterAuth>;
+/**
+* Create the auth instance. Thin wrapper around `betterAuth` that enforces
+* the `secret` requirement at construction time so misconfigured deployments
+* fail loudly at the first fetch rather than the first sign-in attempt.
+*/
+declare const createAuth: (options: LunoraAuthOptions) => LunoraAuth;
+export { LunoraAuth as L, LunoraAuthOptions as a, createAuth as c };

package/dist/packem_shared/createAuth-B-tvsvQU.mjs

@@ -0,0 +1,56 @@
+import { betterAuth } from 'better-auth';
+import { validateSessionPolicy } from './sessionPresets-B95rXrd8.mjs';
+
+const MIN_SECRET_LENGTH = 32;
+const isWeakSecret = (secret) => {
+  const trimmedLength = typeof secret === "string" ? secret.trim().length : 0;
+  return trimmedLength > 0 && trimmedLength < MIN_SECRET_LENGTH;
+};
+const isHttpsBaseUrl = (baseURL) => {
+  if (typeof baseURL === "string") {
+    return baseURL.startsWith("https://");
+  }
+  if (baseURL && typeof baseURL === "object") {
+    if (baseURL.protocol === "https") {
+      return true;
+    }
+    if (baseURL.protocol === "http") {
+      return false;
+    }
+    return typeof baseURL.fallback === "string" && baseURL.fallback.startsWith("https://");
+  }
+  return false;
+};
+const hardenAuthOptions = (options) => {
+  if (isWeakSecret(options.secret)) {
+    const message = `@lunora/auth: AUTH_SECRET is only ${String(options.secret?.trim().length)} characters. Use at least ${String(MIN_SECRET_LENGTH)} for a brute-force-resistant secret — generate one with \`openssl rand -hex 32\`.`;
+    if (isHttpsBaseUrl(options.baseURL)) {
+      throw new Error(message);
+    }
+    console.warn(message);
+  }
+  const advanced = options.advanced ?? {};
+  return {
+    ...options,
+    advanced: {
+      ...advanced,
+      defaultCookieAttributes: advanced.defaultCookieAttributes ?? { httpOnly: true, path: "/", sameSite: "lax" },
+      ...advanced.useSecureCookies === void 0 && isHttpsBaseUrl(options.baseURL) ? { useSecureCookies: true } : {}
+    }
+  };
+};
+const createAuth = (options) => {
+  if (!options.secret || options.secret.trim() === "") {
+    throw new Error(
+      '@lunora/auth: `secret` is required. Set AUTH_SECRET locally in .dev.vars (`lunora env set AUTH_SECRET "$(openssl rand -hex 32)"`), and in production with `wrangler secret put AUTH_SECRET`.'
+    );
+  }
+  if (options.session) {
+    validateSessionPolicy(options.session);
+  }
+  const hardened = hardenAuthOptions(options);
+  const resolvedOptions = hardened.rateLimit?.enabled === void 0 ? { ...hardened, rateLimit: { ...hardened.rateLimit, enabled: true } } : hardened;
+  return betterAuth(resolvedOptions);
+};
+
+export { createAuth };

package/dist/packem_shared/createAuthAdmin-BxrfEeA_.mjs

@@ -0,0 +1,249 @@
+class LunoraAuthAdminError extends Error {
+  code;
+  constructor(message, code) {
+    super(message);
+    this.name = "LunoraAuthAdminError";
+    this.code = code;
+  }
+}
+const DEFAULT_LIMIT = 50;
+const MAX_LIMIT = 500;
+const DEFAULT_IMPERSONATION_SECONDS = 3600;
+const MAX_IMPERSONATION_SECONDS = DEFAULT_IMPERSONATION_SECONDS * 24;
+const MAX_BAN_SECONDS = 100 * 365 * 24 * 60 * 60;
+const SENSITIVE_FIELDS = /* @__PURE__ */ new Set(["accessToken", "backupCodes", "idToken", "password", "publicKey", "refreshToken", "secret", "token"]);
+const clampLimit = (limit) => Math.min(Math.max(Math.trunc(limit ?? DEFAULT_LIMIT), 1), MAX_LIMIT);
+const clampOffset = (offset) => Math.max(0, Math.trunc(offset ?? 0));
+const normalizeRow = (row) => {
+  const out = {};
+  for (const [key, value] of Object.entries(row)) {
+    if (SENSITIVE_FIELDS.has(key)) {
+      continue;
+    }
+    out[key] = value instanceof Date ? value.getTime() : value;
+  }
+  return out;
+};
+const serializeRole = (role) => Array.isArray(role) ? role.join(",") : role;
+const asAdminError = (error) => {
+  if (error instanceof LunoraAuthAdminError) {
+    return error;
+  }
+  const candidate = error;
+  const code = candidate?.body?.code ?? candidate?.code ?? "AUTH_ADMIN_ERROR";
+  const message = candidate?.body?.message ?? candidate?.message ?? "auth admin operation failed";
+  return new LunoraAuthAdminError(message, code);
+};
+const createAuthAdmin = (auth, options = {}) => {
+  const context = auth.$context;
+  const features = options.features ?? {};
+  const withContext = async (function_) => {
+    try {
+      return await function_(await context);
+    } catch (error) {
+      throw asAdminError(error);
+    }
+  };
+  const toUser = (row) => normalizeRow(row);
+  const page = async (context_, model, options_) => {
+    const where = options_.where && options_.where.length > 0 ? options_.where : void 0;
+    const [rows, total] = await Promise.all([
+      context_.adapter.findMany({
+        limit: clampLimit(options_.limit),
+        model,
+        offset: clampOffset(options_.offset),
+        sortBy: options_.sortBy,
+        where
+      }),
+      context_.adapter.count({ model, where })
+    ]);
+    return { rows: rows.map((row) => normalizeRow(row)), total };
+  };
+  return {
+    banUser: ({ expiresInSeconds, reason, userId }) => withContext(async (context_) => {
+      const seconds = typeof expiresInSeconds === "number" && Number.isFinite(expiresInSeconds) ? Math.min(Math.trunc(expiresInSeconds), MAX_BAN_SECONDS) : 0;
+      const banExpires = seconds > 0 ? new Date(Date.now() + seconds * 1e3) : void 0;
+      const user = await context_.internalAdapter.updateUser(userId, {
+        banExpires,
+        banned: true,
+        banReason: reason ?? "No reason"
+      });
+      await context_.internalAdapter.deleteUserSessions(userId);
+      return toUser(user);
+    }),
+    cancelInvitation: ({ invitationId }) => withContext(async (context_) => {
+      await context_.adapter.delete({ model: "invitation", where: [{ field: "id", value: invitationId }] });
+    }),
+    capabilities: () => withContext((context_) => {
+      const ids = new Set((context_.options.plugins ?? []).map((plugin) => plugin.id));
+      const has = (id) => ids.has(id);
+      return Promise.resolve({
+        accounts: features.accounts ?? true,
+        admin: features.admin ?? has("admin"),
+        organization: features.organization ?? has("organization"),
+        passkey: features.passkey ?? has("passkey"),
+        twoFactor: features.twoFactor ?? has("two-factor")
+      });
+    }),
+    // The one op that genuinely builds a row rather than mutating one. Replicates
+    // the plugin's create-user handler over `internalAdapter` (lowercase + dedupe
+    // email, create the row, then link a credential account when a password is given).
+    createUser: ({ data, email, name, password, role }) => withContext(async (context_) => {
+      const normalizedEmail = email.toLowerCase();
+      if (await context_.internalAdapter.findUserByEmail(normalizedEmail)) {
+        throw new LunoraAuthAdminError("a user with this email already exists", "USER_ALREADY_EXISTS");
+      }
+      const user = await context_.internalAdapter.createUser({
+        email: normalizedEmail,
+        name,
+        role: role === void 0 ? void 0 : serializeRole(role),
+        ...data
+      });
+      if (password !== void 0 && password !== "") {
+        const hashed = await context_.password.hash(password);
+        await context_.internalAdapter.linkAccount({
+          accountId: user.id,
+          password: hashed,
+          providerId: "credential",
+          userId: user.id
+        });
+      }
+      return toUser(user);
+    }),
+    deletePasskey: ({ passkeyId }) => withContext(async (context_) => {
+      await context_.adapter.delete({ model: "passkey", where: [{ field: "id", value: passkeyId }] });
+    }),
+    disableTwoFactor: ({ userId }) => withContext(async (context_) => {
+      await context_.adapter.deleteMany({ model: "twoFactor", where: [{ field: "userId", value: userId }] });
+      await context_.internalAdapter.updateUser(userId, { twoFactorEnabled: false });
+    }),
+    impersonateUser: ({ userId }) => withContext(async (context_) => {
+      const user = await context_.internalAdapter.findUserById(userId);
+      if (!user) {
+        throw new LunoraAuthAdminError("user not found", "USER_NOT_FOUND");
+      }
+      const rawSeconds = options.impersonationSeconds;
+      let ttlSeconds = DEFAULT_IMPERSONATION_SECONDS;
+      if (rawSeconds !== void 0) {
+        if (!Number.isInteger(rawSeconds) || !Number.isFinite(rawSeconds) || rawSeconds <= 0) {
+          throw new LunoraAuthAdminError("impersonationSeconds must be a positive finite integer", "INVALID_IMPERSONATION_SECONDS");
+        }
+        ttlSeconds = Math.min(rawSeconds, MAX_IMPERSONATION_SECONDS);
+      }
+      const expiresAt = new Date(Date.now() + ttlSeconds * 1e3);
+      const session = await context_.internalAdapter.createSession(
+        userId,
+        true,
+        { expiresAt, impersonatedBy: options.impersonatedBy ?? userId },
+        true
+      );
+      return {
+        expiresAt: session.expiresAt instanceof Date ? session.expiresAt.getTime() : expiresAt.getTime(),
+        token: session.token,
+        user: toUser(user)
+      };
+    }),
+    listAccounts: ({ userId }) => withContext(async (context_) => {
+      const rows = await context_.adapter.findMany({ model: "account", where: [{ field: "userId", value: userId }] });
+      return rows.map((row) => normalizeRow(row));
+    }),
+    listInvitations: ({ limit, offset, organizationId }) => withContext(
+      (context_) => page(context_, "invitation", {
+        limit,
+        offset,
+        where: [{ field: "organizationId", value: organizationId }]
+      })
+    ),
+    listMembers: ({ limit, offset, organizationId }) => withContext(
+      (context_) => page(context_, "member", {
+        limit,
+        offset,
+        sortBy: { direction: "desc", field: "createdAt" },
+        where: [{ field: "organizationId", value: organizationId }]
+      })
+    ),
+    listOrganizations: ({ limit, offset }) => withContext((context_) => page(context_, "organization", { limit, offset, sortBy: { direction: "desc", field: "createdAt" } })),
+    listPasskeys: ({ userId }) => withContext(async (context_) => {
+      const rows = await context_.adapter.findMany({ model: "passkey", where: [{ field: "userId", value: userId }] });
+      return rows.map((row) => normalizeRow(row));
+    }),
+    listSessions: ({ limit, offset, userId }) => withContext(
+      (context_) => page(context_, "session", {
+        limit,
+        offset,
+        sortBy: { direction: "desc", field: "createdAt" },
+        where: userId === void 0 || userId === "" ? void 0 : [{ field: "userId", value: userId }]
+      })
+    ),
+    listUsers: ({ filterField, filterValue, limit, offset, search, searchField, sortBy, sortDirection }) => withContext((context_) => {
+      const where = [];
+      if (search !== void 0 && search !== "") {
+        where.push({ field: searchField ?? "email", operator: "contains", value: search });
+      }
+      if (filterValue !== void 0) {
+        where.push({ field: filterField ?? "email", operator: "eq", value: filterValue });
+      }
+      return page(context_, "user", {
+        limit,
+        offset,
+        sortBy: { direction: sortDirection ?? "desc", field: sortBy ?? "createdAt" },
+        where
+      });
+    }),
+    removeMember: ({ memberId }) => withContext(async (context_) => {
+      await context_.adapter.delete({ model: "member", where: [{ field: "id", value: memberId }] });
+    }),
+    removeUser: ({ userId }) => withContext(async (context_) => {
+      await context_.internalAdapter.deleteUserSessions(userId);
+      await context_.internalAdapter.deleteUser(userId);
+    }),
+    // Keyed on the session *id*, not its token: tokens are bearer credentials we
+    // deliberately never surface to the studio. Resolve the row to recover its
+    // token, then delete via `internalAdapter.deleteSession` — which also clears
+    // secondary (KV) storage, unlike a raw `adapter.delete` on the DB row.
+    revokeUserSession: ({ sessionId }) => withContext(async (context_) => {
+      const session = await context_.adapter.findOne({ model: "session", where: [{ field: "id", value: sessionId }] });
+      if (session?.token) {
+        await context_.internalAdapter.deleteSession(session.token);
+      }
+    }),
+    revokeUserSessions: ({ userId }) => withContext(async (context_) => {
+      await context_.internalAdapter.deleteUserSessions(userId);
+    }),
+    setRole: ({ role, userId }) => withContext(async (context_) => {
+      const user = await context_.internalAdapter.updateUser(userId, { role: serializeRole(role) });
+      return toUser(user);
+    }),
+    setUserPassword: ({ newPassword, userId }) => withContext(async (context_) => {
+      const min = context_.password.config.minPasswordLength;
+      const max = context_.password.config.maxPasswordLength;
+      if (newPassword.length < min) {
+        throw new LunoraAuthAdminError(`password must be at least ${min.toString()} characters`, "PASSWORD_TOO_SHORT");
+      }
+      if (newPassword.length > max) {
+        throw new LunoraAuthAdminError(`password must be at most ${max.toString()} characters`, "PASSWORD_TOO_LONG");
+      }
+      const hashed = await context_.password.hash(newPassword);
+      await context_.internalAdapter.updatePassword(userId, hashed);
+    }),
+    unbanUser: ({ userId }) => withContext(async (context_) => {
+      const user = await context_.internalAdapter.updateUser(userId, { banExpires: null, banned: false, banReason: null });
+      return toUser(user);
+    }),
+    unlinkAccount: ({ accountId, userId }) => withContext(async (context_) => {
+      await context_.adapter.delete({
+        model: "account",
+        where: [
+          { field: "id", value: accountId },
+          { connector: "AND", field: "userId", value: userId }
+        ]
+      });
+    }),
+    updateUser: ({ data, userId }) => withContext(async (context_) => {
+      const user = await context_.internalAdapter.updateUser(userId, data);
+      return toUser(user);
+    })
+  };
+};
+
+export { LunoraAuthAdminError, createAuthAdmin };