@lunora/auth 0.0.0 → 1.0.0-alpha.1

package/dist/packem_shared/ensureMigrated-wZH3oXDu.mjs

@@ -0,0 +1,28 @@
+import { getMigrations } from 'better-auth/db/migration';
+
+const migrating = /* @__PURE__ */ new WeakMap();
+const ensureMigrated = async (auth) => {
+  const { options } = auth;
+  const inFlight = migrating.get(options);
+  if (inFlight) {
+    await inFlight;
+    return;
+  }
+  const run = (async () => {
+    const { runMigrations } = await getMigrations(options);
+    await runMigrations();
+  })();
+  migrating.set(options, run);
+  try {
+    await run;
+  } catch (error) {
+    migrating.delete(options);
+    throw error;
+  }
+};
+const compileMigrationsSql = async (options) => {
+  const { compileMigrations } = await getMigrations(options);
+  return compileMigrations();
+};
+
+export { compileMigrationsSql, ensureMigrated };

package/dist/packem_shared/sessionPresets-B95rXrd8.mjs

@@ -0,0 +1,35 @@
+const MINUTE = 60;
+const HOUR = 60 * MINUTE;
+const DAY = 24 * HOUR;
+const validateSessionPolicy = (policy) => {
+  const durationFields = ["expiresIn", "updateAge", "freshAge"];
+  for (const field of durationFields) {
+    const value = policy[field];
+    if (value === void 0) {
+      continue;
+    }
+    if (typeof value !== "number" || !Number.isFinite(value) || value < 0) {
+      throw new TypeError(`@lunora/auth: \`session.${field}\` must be a non-negative, finite number of seconds`);
+    }
+  }
+  return policy;
+};
+const sessionPresets = {
+  longLived: {
+    expiresIn: 30 * DAY,
+    freshAge: DAY,
+    updateAge: DAY
+  },
+  rolling: {
+    expiresIn: 7 * DAY,
+    freshAge: DAY,
+    updateAge: DAY
+  },
+  strict: {
+    expiresIn: HOUR,
+    freshAge: 5 * MINUTE,
+    updateAge: 15 * MINUTE
+  }
+};
+
+export { sessionPresets, validateSessionPolicy };

package/dist/plugins-client.d.mts

@@ -0,0 +1,2 @@
+export { passkeyClient } from '@better-auth/passkey/client';
+export { adminClient, anonymousClient, customSessionClient, deviceAuthorizationClient, emailOTPClient, genericOAuthClient, inferAdditionalFields, inferOrgAdditionalFields, jwtClient, lastLoginMethodClient, magicLinkClient, multiSessionClient, oidcClient, oneTimeTokenClient, organizationClient, phoneNumberClient, siweClient, twoFactorClient, usernameClient } from 'better-auth/client/plugins';

package/dist/plugins-client.d.ts

@@ -0,0 +1,2 @@
+export { passkeyClient } from '@better-auth/passkey/client';
+export { adminClient, anonymousClient, customSessionClient, deviceAuthorizationClient, emailOTPClient, genericOAuthClient, inferAdditionalFields, inferOrgAdditionalFields, jwtClient, lastLoginMethodClient, magicLinkClient, multiSessionClient, oidcClient, oneTimeTokenClient, organizationClient, phoneNumberClient, siweClient, twoFactorClient, usernameClient } from 'better-auth/client/plugins';

package/dist/plugins-client.mjs

@@ -0,0 +1,2 @@
+export { passkeyClient } from '@better-auth/passkey/client';
+export { adminClient, anonymousClient, customSessionClient, deviceAuthorizationClient, emailOTPClient, genericOAuthClient, inferAdditionalFields, inferOrgAdditionalFields, jwtClient, lastLoginMethodClient, magicLinkClient, multiSessionClient, oidcClient, oneTimeTokenClient, organizationClient, phoneNumberClient, siweClient, twoFactorClient, usernameClient } from 'better-auth/client/plugins';

package/dist/plugins.d.mts

@@ -0,0 +1,22 @@
+export { passkey } from '@better-auth/passkey';
+export { captcha, mcp, withMcpAuth } from 'better-auth/plugins';
+export { createAccessControl } from 'better-auth/plugins/access';
+export { admin } from 'better-auth/plugins/admin';
+export { anonymous } from 'better-auth/plugins/anonymous';
+export { bearer } from 'better-auth/plugins/bearer';
+export { customSession } from 'better-auth/plugins/custom-session';
+export { deviceAuthorization } from 'better-auth/plugins/device-authorization';
+export { emailOTP } from 'better-auth/plugins/email-otp';
+export { genericOAuth } from 'better-auth/plugins/generic-oauth';
+export { haveIBeenPwned } from 'better-auth/plugins/haveibeenpwned';
+export { jwt } from 'better-auth/plugins/jwt';
+export { magicLink } from 'better-auth/plugins/magic-link';
+export { multiSession } from 'better-auth/plugins/multi-session';
+export { oAuthProxy } from 'better-auth/plugins/oauth-proxy';
+export { oidcProvider } from 'better-auth/plugins/oidc-provider';
+export { oneTimeToken } from 'better-auth/plugins/one-time-token';
+export { organization } from 'better-auth/plugins/organization';
+export { phoneNumber } from 'better-auth/plugins/phone-number';
+export { siwe } from 'better-auth/plugins/siwe';
+export { twoFactor } from 'better-auth/plugins/two-factor';
+export { username } from 'better-auth/plugins/username';

package/dist/plugins.d.ts

@@ -0,0 +1,22 @@
+export { passkey } from '@better-auth/passkey';
+export { captcha, mcp, withMcpAuth } from 'better-auth/plugins';
+export { createAccessControl } from 'better-auth/plugins/access';
+export { admin } from 'better-auth/plugins/admin';
+export { anonymous } from 'better-auth/plugins/anonymous';
+export { bearer } from 'better-auth/plugins/bearer';
+export { customSession } from 'better-auth/plugins/custom-session';
+export { deviceAuthorization } from 'better-auth/plugins/device-authorization';
+export { emailOTP } from 'better-auth/plugins/email-otp';
+export { genericOAuth } from 'better-auth/plugins/generic-oauth';
+export { haveIBeenPwned } from 'better-auth/plugins/haveibeenpwned';
+export { jwt } from 'better-auth/plugins/jwt';
+export { magicLink } from 'better-auth/plugins/magic-link';
+export { multiSession } from 'better-auth/plugins/multi-session';
+export { oAuthProxy } from 'better-auth/plugins/oauth-proxy';
+export { oidcProvider } from 'better-auth/plugins/oidc-provider';
+export { oneTimeToken } from 'better-auth/plugins/one-time-token';
+export { organization } from 'better-auth/plugins/organization';
+export { phoneNumber } from 'better-auth/plugins/phone-number';
+export { siwe } from 'better-auth/plugins/siwe';
+export { twoFactor } from 'better-auth/plugins/two-factor';
+export { username } from 'better-auth/plugins/username';

package/dist/plugins.mjs

@@ -0,0 +1,22 @@
+export { passkey } from '@better-auth/passkey';
+export { captcha, mcp, withMcpAuth } from 'better-auth/plugins';
+export { createAccessControl } from 'better-auth/plugins/access';
+export { admin } from 'better-auth/plugins/admin';
+export { anonymous } from 'better-auth/plugins/anonymous';
+export { bearer } from 'better-auth/plugins/bearer';
+export { customSession } from 'better-auth/plugins/custom-session';
+export { deviceAuthorization } from 'better-auth/plugins/device-authorization';
+export { emailOTP } from 'better-auth/plugins/email-otp';
+export { genericOAuth } from 'better-auth/plugins/generic-oauth';
+export { haveIBeenPwned } from 'better-auth/plugins/haveibeenpwned';
+export { jwt } from 'better-auth/plugins/jwt';
+export { magicLink } from 'better-auth/plugins/magic-link';
+export { multiSession } from 'better-auth/plugins/multi-session';
+export { oAuthProxy } from 'better-auth/plugins/oauth-proxy';
+export { oidcProvider } from 'better-auth/plugins/oidc-provider';
+export { oneTimeToken } from 'better-auth/plugins/one-time-token';
+export { organization } from 'better-auth/plugins/organization';
+export { phoneNumber } from 'better-auth/plugins/phone-number';
+export { siwe } from 'better-auth/plugins/siwe';
+export { twoFactor } from 'better-auth/plugins/two-factor';
+export { username } from 'better-auth/plugins/username';

package/dist/schema.d.mts

@@ -0,0 +1,44 @@
+import { TableDefinition } from '@lunora/server';
+import { a as LunoraAuthOptions } from "./packem_shared/create-auth.d-M36jwG_Y.mjs";
+import 'better-auth';
+/**
+* Derive Lunora table definitions from a better-auth config — the bridge that
+* makes the **full** better-auth plugin ecosystem first-class Lunora data.
+*
+* better-auth's own `getAuthTables(options)` already merges every configured
+* plugin's `schema` into one table map (core `user`/`session`/`account`/
+* `verification`, plus whatever the plugins on `options.plugins` add —
+* `organization`/`member`/`invitation`/`team`/`teamMember` from the
+* organization plugin, `role`/`banned`/… columns from admin, `passkey`,
+* `twoFactor`, `jwks`, …). This walks that map and emits an equivalent
+* `defineTable` for each, so adding a plugin to `options.plugins` automatically
+* surfaces its tables in the Lunora schema — no hand-written table definitions
+* to keep in sync.
+*
+* Spread the result into `defineSchema` alongside your app tables (the keys are
+* better-auth's real table names — `user`, `session`, … — left **unprefixed**
+* because better-auth's adapter addresses them by exactly those names). Because
+* the names are unprefixed, do **not** declare an app table that reuses one of
+* better-auth's reserved names in the same `defineSchema` — JS spread order
+* would let the later key win silently (unlike the plugin-extension path, which
+* throws on collision):
+*
+* ```ts
+* import { authTables } from "@lunora/auth";
+* const authOptions = { emailAndPassword: { enabled: true }, plugins: [organization(), admin()] };
+* export const schema = defineSchema({
+*     ...authTables(authOptions),
+*     todos: defineTable({ title: v.string() }),
+* });
+* ```
+*
+* Scope: this emits the table **shapes** (columns + types + nullability +
+* uniqueness + FK ids). It deliberately does not carry better-auth's
+* `defaultValue`/`onUpdate` (filled by better-auth's own write layer), `index`
+* hints, or `bigint` precision (`bigint` fields map to `v.number()`). Those only
+* matter once better-auth's writes are routed through Lunora's ORM — a separate
+* adapter follow-up; today the auth rows are still written by better-auth's D1
+* adapter and these tables make them typed + queryable via `ctx.db`.
+*/
+declare const authTables: (options: LunoraAuthOptions) => Record<string, TableDefinition>;
+export { authTables as default };

package/dist/schema.d.ts

@@ -0,0 +1,44 @@
+import { TableDefinition } from '@lunora/server';
+import { a as LunoraAuthOptions } from "./packem_shared/create-auth.d-M36jwG_Y.js";
+import 'better-auth';
+/**
+* Derive Lunora table definitions from a better-auth config — the bridge that
+* makes the **full** better-auth plugin ecosystem first-class Lunora data.
+*
+* better-auth's own `getAuthTables(options)` already merges every configured
+* plugin's `schema` into one table map (core `user`/`session`/`account`/
+* `verification`, plus whatever the plugins on `options.plugins` add —
+* `organization`/`member`/`invitation`/`team`/`teamMember` from the
+* organization plugin, `role`/`banned`/… columns from admin, `passkey`,
+* `twoFactor`, `jwks`, …). This walks that map and emits an equivalent
+* `defineTable` for each, so adding a plugin to `options.plugins` automatically
+* surfaces its tables in the Lunora schema — no hand-written table definitions
+* to keep in sync.
+*
+* Spread the result into `defineSchema` alongside your app tables (the keys are
+* better-auth's real table names — `user`, `session`, … — left **unprefixed**
+* because better-auth's adapter addresses them by exactly those names). Because
+* the names are unprefixed, do **not** declare an app table that reuses one of
+* better-auth's reserved names in the same `defineSchema` — JS spread order
+* would let the later key win silently (unlike the plugin-extension path, which
+* throws on collision):
+*
+* ```ts
+* import { authTables } from "@lunora/auth";
+* const authOptions = { emailAndPassword: { enabled: true }, plugins: [organization(), admin()] };
+* export const schema = defineSchema({
+*     ...authTables(authOptions),
+*     todos: defineTable({ title: v.string() }),
+* });
+* ```
+*
+* Scope: this emits the table **shapes** (columns + types + nullability +
+* uniqueness + FK ids). It deliberately does not carry better-auth's
+* `defaultValue`/`onUpdate` (filled by better-auth's own write layer), `index`
+* hints, or `bigint` precision (`bigint` fields map to `v.number()`). Those only
+* matter once better-auth's writes are routed through Lunora's ORM — a separate
+* adapter follow-up; today the auth rows are still written by better-auth's D1
+* adapter and these tables make them typed + queryable via `ctx.db`.
+*/
+declare const authTables: (options: LunoraAuthOptions) => Record<string, TableDefinition>;
+export { authTables as default };

package/dist/schema.mjs

@@ -0,0 +1,62 @@
+import { defineTable } from '@lunora/server';
+import { v } from '@lunora/values';
+import { getAuthTables } from 'better-auth/db';
+
+const baseValidator = (attribute) => {
+  if (attribute.references) {
+    return v.id(attribute.references.model);
+  }
+  const { type } = attribute;
+  if (Array.isArray(type)) {
+    return v.string();
+  }
+  switch (type) {
+    case "boolean": {
+      return v.boolean();
+    }
+    case "date": {
+      return v.date();
+    }
+    case "number": {
+      return v.number();
+    }
+    case "number[]": {
+      return v.array(v.number());
+    }
+    case "string": {
+      return v.string();
+    }
+    case "string[]": {
+      return v.array(v.string());
+    }
+    // "json" and anything unrecognised: keep the row shape permissive rather
+    // than fail schema generation on a plugin's exotic column type.
+    default: {
+      return v.any();
+    }
+  }
+};
+const fieldValidator = (attribute) => {
+  let validator = baseValidator(attribute);
+  if (attribute.required === false) {
+    validator = validator.nullable();
+  }
+  if (attribute.unique === true) {
+    validator = validator.unique();
+  }
+  return validator;
+};
+const authTables = (options) => {
+  const tables = getAuthTables(options);
+  const schema = {};
+  for (const table of Object.values(tables)) {
+    const shape = {};
+    for (const [fieldKey, attribute] of Object.entries(table.fields)) {
+      shape[attribute.fieldName ?? fieldKey] = fieldValidator(attribute);
+    }
+    schema[table.modelName] = defineTable(shape).externallyManaged();
+  }
+  return schema;
+};
+
+export { authTables as default };

package/dist/sql-store.d.mts

@@ -0,0 +1,51 @@
+import { AuthStore } from "./store.mjs";
+import 'better-auth/adapters';
+/** A D1 prepared-statement chain — the slice of `D1Database` {@link d1Executor} needs. */
+interface D1Like {
+  prepare: (sql: string) => {
+    bind: (...values: unknown[]) => {
+      all: () => Promise<{
+        results?: Record<string, unknown>[];
+      }>;
+      run: () => Promise<unknown>;
+    };
+  };
+}
+/**
+* The minimal SQL seam a {@link createSqlAuthStore} runs on — structurally the
+* same `{ all, run }` contract as `@lunora/d1`'s `D1Exec`, so a Lunora D1 binding
+* satisfies it directly (see {@link d1Executor}) and a `node:sqlite` handle does
+* too in tests. `all` runs reads and returns rows; `run` runs writes.
+*/
+interface SqlExecutor {
+  all: (sql: string, parameters: ReadonlyArray<unknown>) => Promise<Record<string, unknown>[]>;
+  run: (sql: string, parameters: ReadonlyArray<unknown>) => Promise<void>;
+}
+/**
+* An {@link AuthStore} backed by a SQL database through the {@link SqlExecutor}
+* seam — the production counterpart to `createMemoryAuthStore`. Point it at the
+* same database that hosts Lunora's global (D1) tables (the ones `authTables(...)`
+* generates) and better-auth's reads/writes land there as ordinary rows Lunora
+* can also query. Assumes the auth tables already exist (Lunora owns the schema /
+* migrations); it never issues DDL.
+*
+* ```ts
+* const store = createSqlAuthStore(d1Executor(env.DB));
+* const auth = createAuth({ secret: env.AUTH_SECRET, database: lunoraAuthAdapter(store) });
+* ```
+*
+* Clause semantics match `createMemoryAuthStore` (operator parity is
+* covered by a cross-store agreement test) with one unavoidable caveat:
+* case-**insensitive** matching uses SQLite's ASCII-only `LOWER()`, whereas the
+* in-memory store uses JS full-Unicode `toLowerCase()`. They agree on ASCII
+* (emails, ids, tokens — the credential path); they can differ only for
+* case-insensitive comparison of non-ASCII text.
+*/
+declare const createSqlAuthStore: (executor: SqlExecutor) => AuthStore;
+/**
+* Wrap a Cloudflare D1 binding (`env.DB`) as a {@link SqlExecutor}, so
+* `createSqlAuthStore(d1Executor(env.DB))` routes better-auth onto D1 — the same
+* binding Lunora's `.global()` tables use.
+*/
+declare const d1Executor: (database: D1Like) => SqlExecutor;
+export { SqlExecutor, createSqlAuthStore, d1Executor };

package/dist/sql-store.d.ts

@@ -0,0 +1,51 @@
+import { AuthStore } from "./store.js";
+import 'better-auth/adapters';
+/** A D1 prepared-statement chain — the slice of `D1Database` {@link d1Executor} needs. */
+interface D1Like {
+  prepare: (sql: string) => {
+    bind: (...values: unknown[]) => {
+      all: () => Promise<{
+        results?: Record<string, unknown>[];
+      }>;
+      run: () => Promise<unknown>;
+    };
+  };
+}
+/**
+* The minimal SQL seam a {@link createSqlAuthStore} runs on — structurally the
+* same `{ all, run }` contract as `@lunora/d1`'s `D1Exec`, so a Lunora D1 binding
+* satisfies it directly (see {@link d1Executor}) and a `node:sqlite` handle does
+* too in tests. `all` runs reads and returns rows; `run` runs writes.
+*/
+interface SqlExecutor {
+  all: (sql: string, parameters: ReadonlyArray<unknown>) => Promise<Record<string, unknown>[]>;
+  run: (sql: string, parameters: ReadonlyArray<unknown>) => Promise<void>;
+}
+/**
+* An {@link AuthStore} backed by a SQL database through the {@link SqlExecutor}
+* seam — the production counterpart to `createMemoryAuthStore`. Point it at the
+* same database that hosts Lunora's global (D1) tables (the ones `authTables(...)`
+* generates) and better-auth's reads/writes land there as ordinary rows Lunora
+* can also query. Assumes the auth tables already exist (Lunora owns the schema /
+* migrations); it never issues DDL.
+*
+* ```ts
+* const store = createSqlAuthStore(d1Executor(env.DB));
+* const auth = createAuth({ secret: env.AUTH_SECRET, database: lunoraAuthAdapter(store) });
+* ```
+*
+* Clause semantics match `createMemoryAuthStore` (operator parity is
+* covered by a cross-store agreement test) with one unavoidable caveat:
+* case-**insensitive** matching uses SQLite's ASCII-only `LOWER()`, whereas the
+* in-memory store uses JS full-Unicode `toLowerCase()`. They agree on ASCII
+* (emails, ids, tokens — the credential path); they can differ only for
+* case-insensitive comparison of non-ASCII text.
+*/
+declare const createSqlAuthStore: (executor: SqlExecutor) => AuthStore;
+/**
+* Wrap a Cloudflare D1 binding (`env.DB`) as a {@link SqlExecutor}, so
+* `createSqlAuthStore(d1Executor(env.DB))` routes better-auth onto D1 — the same
+* binding Lunora's `.global()` tables use.
+*/
+declare const d1Executor: (database: D1Like) => SqlExecutor;
+export { SqlExecutor, createSqlAuthStore, d1Executor };

package/dist/sql-store.mjs

@@ -0,0 +1,162 @@
+const quoteId = (name) => `"${name.replaceAll('"', '""')}"`;
+const NEVER = { params: [], sql: "0" };
+const sided = (column, insensitive) => insensitive ? { column: `LOWER(${column})`, placeholder: "LOWER(?)" } : { column, placeholder: "?" };
+const patternFragment = (column, value, operator, insensitive) => {
+  if (typeof value !== "string") {
+    return NEVER;
+  }
+  const side = sided(column, insensitive);
+  if (operator === "contains") {
+    return { params: [value], sql: `instr(${side.column}, ${side.placeholder}) > 0` };
+  }
+  if (operator === "starts_with") {
+    return { params: [value], sql: `instr(${side.column}, ${side.placeholder}) = 1` };
+  }
+  return { params: [value, value], sql: `substr(${side.column}, -length(?)) = ${side.placeholder}` };
+};
+const equalityFragment = (column, value, insensitive, negated) => {
+  if (value === null) {
+    return { params: [], sql: `${column} IS ${negated ? "NOT " : ""}NULL` };
+  }
+  const side = sided(column, insensitive);
+  const symbol = negated ? "<>" : "=";
+  return { params: [value], sql: `${side.column} ${symbol} ${side.placeholder}` };
+};
+const inFragment = (column, value, negated, insensitive) => {
+  const values = Array.isArray(value) ? value : [];
+  if (values.length === 0) {
+    return { params: [], sql: negated ? "1" : "0" };
+  }
+  const side = sided(column, insensitive);
+  const placeholders = values.map(() => side.placeholder).join(", ");
+  return { params: [...values], sql: `${side.column} ${negated ? "NOT IN" : "IN"} (${placeholders})` };
+};
+const compileClause = (clause) => {
+  const column = quoteId(clause.field);
+  const { mode, operator, value } = clause;
+  const insensitive = mode === "insensitive";
+  switch (operator) {
+    case "contains":
+    case "ends_with":
+    case "starts_with": {
+      return patternFragment(column, value, operator, insensitive);
+    }
+    case "gt": {
+      return { params: [value], sql: `${column} > ?` };
+    }
+    case "gte": {
+      return { params: [value], sql: `${column} >= ?` };
+    }
+    case "in": {
+      return inFragment(column, value, false, insensitive);
+    }
+    case "lt": {
+      return { params: [value], sql: `${column} < ?` };
+    }
+    case "lte": {
+      return { params: [value], sql: `${column} <= ?` };
+    }
+    case "ne": {
+      return equalityFragment(column, value, insensitive, true);
+    }
+    case "not_in": {
+      return inFragment(column, value, true, insensitive);
+    }
+    // "eq" and the default: null-aware equality.
+    default: {
+      return equalityFragment(column, value, insensitive, false);
+    }
+  }
+};
+const compileWhere = (where) => {
+  if (where.length === 0) {
+    return { params: [], sql: "" };
+  }
+  let accumulator = compileClause(where[0]);
+  for (const clause of where.slice(1)) {
+    const fragment = compileClause(clause);
+    const connector = clause.connector === "OR" ? "OR" : "AND";
+    accumulator = { params: [...accumulator.params, ...fragment.params], sql: `(${accumulator.sql} ${connector} ${fragment.sql})` };
+  }
+  return accumulator;
+};
+const whereSuffix = (fragment) => fragment.sql ? ` WHERE ${fragment.sql}` : "";
+const createSqlAuthStore = (executor) => {
+  const selectRows = (model, where) => {
+    const fragment = compileWhere(where);
+    return executor.all(`SELECT * FROM ${quoteId(model)}${whereSuffix(fragment)}`, fragment.params);
+  };
+  return {
+    consumeOne: async (model, where) => {
+      const fragment = compileWhere(where);
+      const table = quoteId(model);
+      const [row] = await executor.all(
+        `DELETE FROM ${table} WHERE rowid IN (SELECT rowid FROM ${table}${whereSuffix(fragment)} LIMIT 1) RETURNING *`,
+        fragment.params
+      );
+      return row;
+    },
+    count: async (model, where) => {
+      const fragment = compileWhere(where);
+      const [row] = await executor.all(`SELECT COUNT(*) AS __count FROM ${quoteId(model)}${whereSuffix(fragment)}`, fragment.params);
+      return Number(row?.["__count"] ?? 0);
+    },
+    create: async (model, data) => {
+      const columns = Object.keys(data);
+      const placeholders = columns.map(() => "?").join(", ");
+      const sql = `INSERT INTO ${quoteId(model)} (${columns.map((column) => quoteId(column)).join(", ")}) VALUES (${placeholders})`;
+      await executor.run(
+        sql,
+        columns.map((column) => data[column])
+      );
+      return { ...data };
+    },
+    read: async (model, query) => {
+      const fragment = compileWhere(query.where);
+      const parameters = [...fragment.params];
+      let sql = `SELECT * FROM ${quoteId(model)}${whereSuffix(fragment)}`;
+      if (query.sortBy) {
+        sql += ` ORDER BY ${quoteId(query.sortBy.field)} ${query.sortBy.direction === "asc" ? "ASC" : "DESC"}`;
+      }
+      if (query.limit !== void 0) {
+        sql += " LIMIT ?";
+        parameters.push(Math.trunc(query.limit));
+      }
+      if (query.offset) {
+        sql += `${query.limit === void 0 ? " LIMIT -1" : ""} OFFSET ?`;
+        parameters.push(Math.trunc(query.offset));
+      }
+      return executor.all(sql, parameters);
+    },
+    remove: async (model, where) => {
+      const fragment = compileWhere(where);
+      const deleted = await executor.all(`DELETE FROM ${quoteId(model)}${whereSuffix(fragment)} RETURNING *`, fragment.params);
+      return deleted.length;
+    },
+    update: async (model, where, values) => {
+      const columns = Object.keys(values);
+      if (columns.length === 0) {
+        return selectRows(model, where);
+      }
+      const assignments = columns.map((column) => `${quoteId(column)} = ?`).join(", ");
+      const fragment = compileWhere(where);
+      return executor.all(`UPDATE ${quoteId(model)} SET ${assignments}${whereSuffix(fragment)} RETURNING *`, [
+        ...columns.map((column) => values[column]),
+        ...fragment.params
+      ]);
+    }
+  };
+};
+const d1Executor = (database) => {
+  return {
+    all: async (sql, parameters) => {
+      const result = await database.prepare(sql).bind(...parameters).all();
+      return result.results ?? [];
+    },
+    run: async (sql, parameters) => {
+      await database.prepare(sql).bind(...parameters).run();
+    }
+  };
+};
+
+export { createSqlAuthStore, d1Executor };

package/dist/store.d.mts

@@ -0,0 +1,66 @@
+import { CustomAdapter } from 'better-auth/adapters';
+/** A stored auth row — an opaque bag of columns keyed by better-auth field name. */
+type AuthRow = Record<string, unknown>;
+/**
+* One normalized better-auth where clause. Derived from {@link CustomAdapter}'s
+* own method signature (rather than re-declared) so a better-auth change to the
+* clause shape surfaces as a compile error here, not a silent mis-match.
+*/
+type AuthWhereClause = NonNullable<Parameters<CustomAdapter["findOne"]>[0]["where"]>[number];
+/** Read query handed to {@link AuthStore.read}: a where filter plus optional sort/window. */
+interface AuthQuery {
+  limit?: number;
+  offset?: number;
+  sortBy?: {
+    direction: "asc" | "desc";
+    field: string;
+  };
+  where: ReadonlyArray<AuthWhereClause>;
+}
+/**
+* The minimal table-addressed store the `lunoraAuthAdapter` drives. This is the
+* seam a Lunora runtime binds to its ORM: back each method with `ctx.db` over
+* the global (D1) auth tables that `authTables(...)` generates, and better-auth's
+* reads/writes flow through Lunora's data layer (triggers, aggregates, OCC)
+* instead of better-auth's own adapter. Field names and table (`model`) names are
+* already the database names better-auth resolved from the schema, so a store
+* passes them straight through.
+*
+* {@link createMemoryAuthStore} is a reference in-memory implementation (also
+* what the tests run better-auth against); `createSqlAuthStore` is the SQL one.
+*/
+interface AuthStore {
+  /**
+  * Atomically delete **at most one** row in `model` matching `where` and
+  * return it (or `undefined` if none matched). Backs better-auth's
+  * single-use-token consume (OTP / magic-link / email-verification /
+  * password-reset): implementing it natively — one round trip that finds and
+  * deletes in a single statement — closes the read-then-delete race the
+  * factory's `findMany` + `deleteMany` fallback would otherwise leave open.
+  */
+  consumeOne: (model: string, where: ReadonlyArray<AuthWhereClause>) => Promise<AuthRow | undefined>;
+  /** Count rows in `model` matching `where` (empty `where` = all rows). */
+  count: (model: string, where: ReadonlyArray<AuthWhereClause>) => Promise<number>;
+  /** Insert `data` into `model`; return the stored row (the adapter pre-fills `id`). */
+  create: (model: string, data: AuthRow) => Promise<AuthRow>;
+  /** Read rows from `model` honouring the filter/sort/window in `query`. */
+  read: (model: string, query: AuthQuery) => Promise<AuthRow[]>;
+  /** Delete rows in `model` matching `where`; return how many were removed. */
+  remove: (model: string, where: ReadonlyArray<AuthWhereClause>) => Promise<number>;
+  /** Patch rows in `model` matching `where` with `values`; return the updated rows. */
+  update: (model: string, where: ReadonlyArray<AuthWhereClause>, values: AuthRow) => Promise<AuthRow[]>;
+}
+/**
+* Evaluate a better-auth where clause list against a row. Clauses fold
+* left-to-right by their `connector` (`AND` by default, `OR` when set) — the
+* same precedence better-auth's own adapters use. An empty list matches every
+* row. Exported so any in-memory-style {@link AuthStore} can reuse it.
+*/
+declare const matchesWhere: (row: AuthRow, where: ReadonlyArray<AuthWhereClause>) => boolean;
+/**
+* Reference in-memory {@link AuthStore} — used to run better-auth end to end in
+* tests, and a worked example of the contract a Lunora-`ctx.db`-backed store
+* fulfils. Not for production (state is per-instance and non-durable).
+*/
+declare const createMemoryAuthStore: () => AuthStore;
+export { AuthQuery, type AuthRow, AuthStore, type AuthWhereClause, createMemoryAuthStore, matchesWhere };