@lunora/auth 1.0.0-alpha.11 → 1.0.0-alpha.13

package/dist/adapter.mjs

@@ -19,6 +19,7 @@ const lunoraAuthAdapter = (store) => createAdapterFactory({
         const [row] = await store.read(model, { limit: 1, where });
         return asRowOrNull(row);
       },
+      incrementOne: async ({ increment, model, set, where }) => asRowOrNull(await store.incrementOne(model, where, increment, set)),
       update: async ({ model, update, where }) => {
         const [row] = await store.update(model, where, update);
         return asRowOrNull(row);

package/dist/index.d.mts

@@ -1,6 +1,6 @@
 export { lunoraAuthAdapter, lunoraD1Adapter } from "./adapter.mjs";
-import { L as LunoraAuth, a as LunoraAuthOptions } from "./packem_shared/create-auth.d-M36jwG_Y.mjs";
-export { c as createAuth } from "./packem_shared/create-auth.d-M36jwG_Y.mjs";
+import { L as LunoraAuth, a as LunoraAuthOptions } from "./packem_shared/create-auth.d-Mwhb4gSc.mjs";
+export { c as createAuth, r as resolveAuthOptions } from "./packem_shared/create-auth.d-Mwhb4gSc.mjs";
 export { type LunoraAuthApiContext, LunoraAuthHeadersError, type WithAuthPluginsMiddleware, type WithAuthPluginsOptions, withAuthPlugins } from "./middleware.mjs";
 export { default as authTables } from "./schema.mjs";
 import { BetterAuthOptions } from 'better-auth';
@@ -333,6 +333,12 @@ declare const ensureMigrated: (auth: LunoraAuth | {
 * Compile better-auth's migrations to a single SQL string. Useful for
 * `wrangler d1 execute --file -` in CI so the deploy step applies the schema
 * before the first user request.
+*
+* Compiles from the SAME resolved options `createAuth` runs with (via
+* `resolveAuthOptions`), not the raw caller options — so the schema includes the
+* `rateLimit` table the worker's default-on durable limiter writes to. Compiling
+* from the raw options would omit it, and the running worker would then write to
+* a table the migration never created.
 */
 declare const compileMigrationsSql: (options: LunoraAuthOptions) => Promise<string>;
 /**
@@ -378,9 +384,13 @@ declare const validateSessionPolicy: (policy: SessionPolicy) => SessionPolicy;
 * });
 * ```
 *
-* - `rolling` — balanced default: 7-day absolute expiry, rotated once per day.
-* - `strict` — short, security-sensitive: 1-hour expiry, 15-minute rotation.
-* - `longLived` — low-friction consumer apps: 30-day expiry, daily rotation.
+* - `rolling` — balanced default: 7-day absolute expiry, rotated once per day,
+*   with a 60s signed-cookie session cache so bursts of authenticated calls
+*   skip the per-request DB session read.
+* - `strict` — short, security-sensitive: 1-hour expiry, 15-minute rotation,
+*   cookie cache **off** (fast revocation / short freshness is the whole point).
+* - `longLived` — low-friction consumer apps: 30-day expiry, daily rotation,
+*   with the same 60s cookie cache as `rolling`.
 */
 declare const sessionPresets: Record<"longLived" | "rolling" | "strict", SessionPolicy>;
 export { type AuthAccount, type AuthAdmin, type AuthAdminSession, type AuthAdminUser, type AuthCapabilities, type AuthInvitation, type AuthMember, type AuthOrganization, type AuthPage, type AuthPasskey, type AuthTimestamp, type CreateAuthAdminOptions, DEFAULT_AUTH_BASE_PATH, type ImpersonationResult, type ListUsersOptions, type LunoraAuth, LunoraAuthAdminError, type LunoraAuthOptions, type SessionPolicy, compileMigrationsSql, createAuthAdmin, ensureMigrated, handleAuthRequest, sessionPresets, validateSessionPolicy };

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 export { lunoraAuthAdapter, lunoraD1Adapter } from "./adapter.js";
-import { L as LunoraAuth, a as LunoraAuthOptions } from "./packem_shared/create-auth.d-M36jwG_Y.js";
-export { c as createAuth } from "./packem_shared/create-auth.d-M36jwG_Y.js";
+import { L as LunoraAuth, a as LunoraAuthOptions } from "./packem_shared/create-auth.d-Mwhb4gSc.js";
+export { c as createAuth, r as resolveAuthOptions } from "./packem_shared/create-auth.d-Mwhb4gSc.js";
 export { type LunoraAuthApiContext, LunoraAuthHeadersError, type WithAuthPluginsMiddleware, type WithAuthPluginsOptions, withAuthPlugins } from "./middleware.js";
 export { default as authTables } from "./schema.js";
 import { BetterAuthOptions } from 'better-auth';
@@ -333,6 +333,12 @@ declare const ensureMigrated: (auth: LunoraAuth | {
 * Compile better-auth's migrations to a single SQL string. Useful for
 * `wrangler d1 execute --file -` in CI so the deploy step applies the schema
 * before the first user request.
+*
+* Compiles from the SAME resolved options `createAuth` runs with (via
+* `resolveAuthOptions`), not the raw caller options — so the schema includes the
+* `rateLimit` table the worker's default-on durable limiter writes to. Compiling
+* from the raw options would omit it, and the running worker would then write to
+* a table the migration never created.
 */
 declare const compileMigrationsSql: (options: LunoraAuthOptions) => Promise<string>;
 /**
@@ -378,9 +384,13 @@ declare const validateSessionPolicy: (policy: SessionPolicy) => SessionPolicy;
 * });
 * ```
 *
-* - `rolling` — balanced default: 7-day absolute expiry, rotated once per day.
-* - `strict` — short, security-sensitive: 1-hour expiry, 15-minute rotation.
-* - `longLived` — low-friction consumer apps: 30-day expiry, daily rotation.
+* - `rolling` — balanced default: 7-day absolute expiry, rotated once per day,
+*   with a 60s signed-cookie session cache so bursts of authenticated calls
+*   skip the per-request DB session read.
+* - `strict` — short, security-sensitive: 1-hour expiry, 15-minute rotation,
+*   cookie cache **off** (fast revocation / short freshness is the whole point).
+* - `longLived` — low-friction consumer apps: 30-day expiry, daily rotation,
+*   with the same 60s cookie cache as `rolling`.
 */
 declare const sessionPresets: Record<"longLived" | "rolling" | "strict", SessionPolicy>;
 export { type AuthAccount, type AuthAdmin, type AuthAdminSession, type AuthAdminUser, type AuthCapabilities, type AuthInvitation, type AuthMember, type AuthOrganization, type AuthPage, type AuthPasskey, type AuthTimestamp, type CreateAuthAdminOptions, DEFAULT_AUTH_BASE_PATH, type ImpersonationResult, type ListUsersOptions, type LunoraAuth, LunoraAuthAdminError, type LunoraAuthOptions, type SessionPolicy, compileMigrationsSql, createAuthAdmin, ensureMigrated, handleAuthRequest, sessionPresets, validateSessionPolicy };

package/dist/index.mjs

@@ -1,11 +1,11 @@
 export { lunoraAuthAdapter, lunoraD1Adapter } from './adapter.mjs';
 export { LunoraAuthAdminError, createAuthAdmin } from './packem_shared/LunoraAuthAdminError-BxrfEeA_.mjs';
-export { createAuth } from './packem_shared/createAuth-B-tvsvQU.mjs';
+export { createAuth, resolveAuthOptions } from './packem_shared/createAuth-hRGxUJ9w.mjs';
 export { DEFAULT_AUTH_BASE_PATH, handleAuthRequest } from './packem_shared/DEFAULT_AUTH_BASE_PATH-DjcUWEQl.mjs';
 export { LunoraAuthHeadersError, withAuthPlugins } from './middleware.mjs';
-export { compileMigrationsSql, ensureMigrated } from './packem_shared/compileMigrationsSql-wZH3oXDu.mjs';
+export { compileMigrationsSql, ensureMigrated } from './packem_shared/compileMigrationsSql-cyE5U18R.mjs';
 export { default as authTables } from './schema.mjs';
-export { sessionPresets, validateSessionPolicy } from './packem_shared/sessionPresets-B95rXrd8.mjs';
+export { sessionPresets, validateSessionPolicy } from './packem_shared/sessionPresets-Dwwd74_J.mjs';
 export { createSqlAuthStore, d1Executor } from './sql-store.mjs';
 export { createMemoryAuthStore, matchesWhere } from './store.mjs';
 export { TURNSTILE_VERIFY_ENDPOINT, verifyTurnstile } from './turnstile.mjs';

package/dist/middleware.d.mts

@@ -1,4 +1,4 @@
-import { L as LunoraAuth } from "./packem_shared/create-auth.d-M36jwG_Y.mjs";
+import { L as LunoraAuth } from "./packem_shared/create-auth.d-Mwhb4gSc.mjs";
 import 'better-auth';
 /**
 * Structural mirror of `@lunora/server`'s `MiddlewareNext` — the continuation

package/dist/middleware.d.ts

@@ -1,4 +1,4 @@
-import { L as LunoraAuth } from "./packem_shared/create-auth.d-M36jwG_Y.js";
+import { L as LunoraAuth } from "./packem_shared/create-auth.d-Mwhb4gSc.js";
 import 'better-auth';
 /**
 * Structural mirror of `@lunora/server`'s `MiddlewareNext` — the continuation

package/dist/packem_shared/{compileMigrationsSql-wZH3oXDu.mjs → compileMigrationsSql-cyE5U18R.mjs}

@@ -1,4 +1,5 @@
 import { getMigrations } from 'better-auth/db/migration';
+import { resolveAuthOptions } from './createAuth-hRGxUJ9w.mjs';
 
 const migrating = /* @__PURE__ */ new WeakMap();
 const ensureMigrated = async (auth) => {
@@ -21,7 +22,7 @@ const ensureMigrated = async (auth) => {
   }
 };
 const compileMigrationsSql = async (options) => {
-  const { compileMigrations } = await getMigrations(options);
+  const { compileMigrations } = await getMigrations(resolveAuthOptions(options));
   return compileMigrations();
 };
 

package/dist/packem_shared/create-auth.d-Mwhb4gSc.d.mts

@@ -0,0 +1,128 @@
+import { betterAuth, BetterAuthOptions } from 'better-auth';
+/**
+* Lunora's options pass straight through to better-auth — the only thing we add
+* is requiring `secret` up front so a misconfigured deployment fails loudly
+* instead of at the first sign-in.
+*
+* For `database`, prefer `lunoraD1Adapter` (`database: lunoraD1Adapter(env.DB)`)
+* over passing the raw `env.DB`. better-auth *does* accept a D1Database directly,
+* but it then resolves its Kysely adapter via a runtime `await import(...)` inside
+* `auth.$context` — and that import never settles under `@cloudflare/vite-plugin`'s
+* worker runner, hanging every auth request in `pnpm dev`. The explicit adapter
+* skips it, so dev and prod behave the same. (Raw `env.DB` is still correct for
+* the migration-only instance — see `lunoraD1Adapter`'s note.)
+*
+* Session rotation / richer session policies are configured via the `session`
+* field (a `SessionPolicy`); Lunora validates it for obviously-broken
+* durations and forwards it verbatim to better-auth. See `sessionPresets`
+* for ready-made rotation/expiry trade-offs.
+*
+* ## Serverless background tasks (Cloudflare Workers)
+*
+* better-auth runs some work *after* sending the response — most importantly the
+* password-reset email, whose background send is what keeps reset responses
+* constant-time (a timing-attack defence: the response doesn't reveal whether
+* the account exists). On Cloudflare Workers a promise that isn't handed to
+* `ctx.waitUntil` can be cancelled the moment the response returns, dropping
+* that send and weakening the guarantee. Wire your request's `ctx.waitUntil`
+* into better-auth's background handler so the work survives:
+*
+* ```ts
+* // in your worker fetch handler, where `ctx: ExecutionContext` is in scope
+* const auth = createAuth({
+*     secret: env.AUTH_SECRET,
+*     database: lunoraD1Adapter(env.DB),
+*     advanced: {
+*         backgroundTasks: { handler: (promise) => ctx.waitUntil(promise) },
+*     },
+* });
+* ```
+*
+* (Lunora can't set this for you — `ctx.waitUntil` is per-request, but
+* `createAuth` runs once at worker setup.)
+*/
+type LunoraAuthOptions = BetterAuthOptions;
+/**
+* The full better-auth instance: `auth.handler` accepts a `Request` and
+* returns a `Response` (used by `handleAuthRequest`); `auth.api`
+* exposes the typed endpoint surface for server-side calls (e.g.
+* `auth.api.getSession({ headers })` inside a query/mutation).
+*/
+type LunoraAuth = ReturnType<typeof betterAuth>;
+/**
+* Resolve the caller's options into the exact shape `createAuth` hands to
+* `betterAuth` — the hardened, default-filled options the running worker uses.
+* Exported (and pure) so the migration path can compile the schema from the
+* same resolved options: `compileMigrationsSql` routes through here, so the
+* `rateLimit` table the worker's durable limiter writes to is included in the
+* migration rather than silently omitted (it would be, if migrations saw the
+* raw options while the worker ran the resolved ones).
+*
+* ## What it fills (each gated independently on caller silence)
+*
+* Secure-by-default cookies + secret-strength warning via {@link hardenAuthOptions},
+* applied first so all hardening composes onto one options object.
+*
+* Rate limiting is ON by default for `/api/auth/*`.
+*
+* better-auth's own default is `rateLimit.enabled ?? isProduction`, and its
+* `isProduction` is `"development" === "production"` resolved at
+* module-load time. On Cloudflare Workers that check is unreliable: the
+* runtime has no Node `process.env` (absent entirely without
+* `nodejs_compat`, and even with it `NODE_ENV` is rarely `"production"` at
+* request time). So better-auth would silently leave auth endpoints
+* _unthrottled_ on a real deployment — the surprise we refuse to ship.
+*
+* We therefore default `enabled: true` whenever the caller hasn't made an
+* explicit choice. We only fill the `enabled` flag and otherwise forward
+* the caller's `rateLimit` verbatim, so better-auth's `window` (10s) / `max`
+* (100) defaults and any custom rules still apply. Callers who genuinely
+* want it off can pass `rateLimit: { enabled: false }` (e.g. when fronting
+* auth with their own limiter), and any explicit `enabled` value wins.
+*
+* We also default `storage: "database"` — but only when rate limiting is not
+* explicitly disabled (`enabled !== false`). Filling storage under a disabled
+* limiter is harmless at runtime but makes `getAuthTables` emit an unused
+* `rateLimit` table, so we skip it there.
+*
+* better-auth's own default is `storage: "memory"` — a per-isolate,
+* non-durable counter. On Cloudflare Workers that means each isolate keeps
+* its own tally, counters vanish on isolate recycle, and traffic spread
+* across isolates never sums to the configured `max` — a limiter that
+* reports "enabled" while never enforcing a global limit (the exact
+* brute-force / credential-stuffing protection on `/sign-in`, OTP, and
+* password-reset it is meant to buy). `storage: "database"` rides the counter
+* through the configured `database` adapter — Lunora's store over the D1 auth
+* tables — so the limit is durable *and* atomic (the store's native
+* `incrementOne` gives a one-winner guarantee across isolates). Callers with
+* their own durable store can pass an explicit `rateLimit: { storage: … }`
+* (or `customStorage`), and any explicit value wins.
+*
+* Session cookie cache is ON by default too.
+*
+* Every authenticated call resolves identity through better-auth's
+* `getSession`, which — without a cache — is a DB (D1) read on the hot path
+* of every query/mutation/action that reads `ctx.auth` and of the WebSocket
+* upgrade. better-auth's `session.cookieCache` carries the session payload in
+* a short-lived signed cookie so `getSession` can answer without hitting the
+* database until the cache window elapses. We default it on with a
+* deliberately short 60s `maxAge` (better-auth's own default is 300s): long
+* enough to erase the per-request read for a burst of calls, short enough
+* that a revoked or role-changed session self-corrects within a minute.
+* The one tradeoff — a revoked session stays valid until the cache expires —
+* is bounded by that TTL; callers who need immediate revocation opt out with
+* `session: { cookieCache: { enabled: false } }` (or the `strict` preset).
+*
+* Every explicit caller value is forwarded verbatim. The two `rateLimit` fills
+* merge into a single `rateLimit` object so neither clobbers the other.
+*/
+declare const resolveAuthOptions: (options: LunoraAuthOptions) => LunoraAuthOptions;
+/**
+* Create the auth instance. Thin wrapper around `betterAuth` that enforces
+* the `secret` requirement at construction time so misconfigured deployments
+* fail loudly at the first fetch rather than the first sign-in attempt, then
+* hands {@link resolveAuthOptions}'s hardened, default-filled options to
+* better-auth.
+*/
+declare const createAuth: (options: LunoraAuthOptions) => LunoraAuth;
+export { LunoraAuth as L, LunoraAuthOptions as a, createAuth as c, resolveAuthOptions as r };

package/dist/packem_shared/create-auth.d-Mwhb4gSc.d.ts

@@ -0,0 +1,128 @@
+import { betterAuth, BetterAuthOptions } from 'better-auth';
+/**
+* Lunora's options pass straight through to better-auth — the only thing we add
+* is requiring `secret` up front so a misconfigured deployment fails loudly
+* instead of at the first sign-in.
+*
+* For `database`, prefer `lunoraD1Adapter` (`database: lunoraD1Adapter(env.DB)`)
+* over passing the raw `env.DB`. better-auth *does* accept a D1Database directly,
+* but it then resolves its Kysely adapter via a runtime `await import(...)` inside
+* `auth.$context` — and that import never settles under `@cloudflare/vite-plugin`'s
+* worker runner, hanging every auth request in `pnpm dev`. The explicit adapter
+* skips it, so dev and prod behave the same. (Raw `env.DB` is still correct for
+* the migration-only instance — see `lunoraD1Adapter`'s note.)
+*
+* Session rotation / richer session policies are configured via the `session`
+* field (a `SessionPolicy`); Lunora validates it for obviously-broken
+* durations and forwards it verbatim to better-auth. See `sessionPresets`
+* for ready-made rotation/expiry trade-offs.
+*
+* ## Serverless background tasks (Cloudflare Workers)
+*
+* better-auth runs some work *after* sending the response — most importantly the
+* password-reset email, whose background send is what keeps reset responses
+* constant-time (a timing-attack defence: the response doesn't reveal whether
+* the account exists). On Cloudflare Workers a promise that isn't handed to
+* `ctx.waitUntil` can be cancelled the moment the response returns, dropping
+* that send and weakening the guarantee. Wire your request's `ctx.waitUntil`
+* into better-auth's background handler so the work survives:
+*
+* ```ts
+* // in your worker fetch handler, where `ctx: ExecutionContext` is in scope
+* const auth = createAuth({
+*     secret: env.AUTH_SECRET,
+*     database: lunoraD1Adapter(env.DB),
+*     advanced: {
+*         backgroundTasks: { handler: (promise) => ctx.waitUntil(promise) },
+*     },
+* });
+* ```
+*
+* (Lunora can't set this for you — `ctx.waitUntil` is per-request, but
+* `createAuth` runs once at worker setup.)
+*/
+type LunoraAuthOptions = BetterAuthOptions;
+/**
+* The full better-auth instance: `auth.handler` accepts a `Request` and
+* returns a `Response` (used by `handleAuthRequest`); `auth.api`
+* exposes the typed endpoint surface for server-side calls (e.g.
+* `auth.api.getSession({ headers })` inside a query/mutation).
+*/
+type LunoraAuth = ReturnType<typeof betterAuth>;
+/**
+* Resolve the caller's options into the exact shape `createAuth` hands to
+* `betterAuth` — the hardened, default-filled options the running worker uses.
+* Exported (and pure) so the migration path can compile the schema from the
+* same resolved options: `compileMigrationsSql` routes through here, so the
+* `rateLimit` table the worker's durable limiter writes to is included in the
+* migration rather than silently omitted (it would be, if migrations saw the
+* raw options while the worker ran the resolved ones).
+*
+* ## What it fills (each gated independently on caller silence)
+*
+* Secure-by-default cookies + secret-strength warning via {@link hardenAuthOptions},
+* applied first so all hardening composes onto one options object.
+*
+* Rate limiting is ON by default for `/api/auth/*`.
+*
+* better-auth's own default is `rateLimit.enabled ?? isProduction`, and its
+* `isProduction` is `"development" === "production"` resolved at
+* module-load time. On Cloudflare Workers that check is unreliable: the
+* runtime has no Node `process.env` (absent entirely without
+* `nodejs_compat`, and even with it `NODE_ENV` is rarely `"production"` at
+* request time). So better-auth would silently leave auth endpoints
+* _unthrottled_ on a real deployment — the surprise we refuse to ship.
+*
+* We therefore default `enabled: true` whenever the caller hasn't made an
+* explicit choice. We only fill the `enabled` flag and otherwise forward
+* the caller's `rateLimit` verbatim, so better-auth's `window` (10s) / `max`
+* (100) defaults and any custom rules still apply. Callers who genuinely
+* want it off can pass `rateLimit: { enabled: false }` (e.g. when fronting
+* auth with their own limiter), and any explicit `enabled` value wins.
+*
+* We also default `storage: "database"` — but only when rate limiting is not
+* explicitly disabled (`enabled !== false`). Filling storage under a disabled
+* limiter is harmless at runtime but makes `getAuthTables` emit an unused
+* `rateLimit` table, so we skip it there.
+*
+* better-auth's own default is `storage: "memory"` — a per-isolate,
+* non-durable counter. On Cloudflare Workers that means each isolate keeps
+* its own tally, counters vanish on isolate recycle, and traffic spread
+* across isolates never sums to the configured `max` — a limiter that
+* reports "enabled" while never enforcing a global limit (the exact
+* brute-force / credential-stuffing protection on `/sign-in`, OTP, and
+* password-reset it is meant to buy). `storage: "database"` rides the counter
+* through the configured `database` adapter — Lunora's store over the D1 auth
+* tables — so the limit is durable *and* atomic (the store's native
+* `incrementOne` gives a one-winner guarantee across isolates). Callers with
+* their own durable store can pass an explicit `rateLimit: { storage: … }`
+* (or `customStorage`), and any explicit value wins.
+*
+* Session cookie cache is ON by default too.
+*
+* Every authenticated call resolves identity through better-auth's
+* `getSession`, which — without a cache — is a DB (D1) read on the hot path
+* of every query/mutation/action that reads `ctx.auth` and of the WebSocket
+* upgrade. better-auth's `session.cookieCache` carries the session payload in
+* a short-lived signed cookie so `getSession` can answer without hitting the
+* database until the cache window elapses. We default it on with a
+* deliberately short 60s `maxAge` (better-auth's own default is 300s): long
+* enough to erase the per-request read for a burst of calls, short enough
+* that a revoked or role-changed session self-corrects within a minute.
+* The one tradeoff — a revoked session stays valid until the cache expires —
+* is bounded by that TTL; callers who need immediate revocation opt out with
+* `session: { cookieCache: { enabled: false } }` (or the `strict` preset).
+*
+* Every explicit caller value is forwarded verbatim. The two `rateLimit` fills
+* merge into a single `rateLimit` object so neither clobbers the other.
+*/
+declare const resolveAuthOptions: (options: LunoraAuthOptions) => LunoraAuthOptions;
+/**
+* Create the auth instance. Thin wrapper around `betterAuth` that enforces
+* the `secret` requirement at construction time so misconfigured deployments
+* fail loudly at the first fetch rather than the first sign-in attempt, then
+* hands {@link resolveAuthOptions}'s hardened, default-filled options to
+* better-auth.
+*/
+declare const createAuth: (options: LunoraAuthOptions) => LunoraAuth;
+export { LunoraAuth as L, LunoraAuthOptions as a, createAuth as c, resolveAuthOptions as r };

package/dist/packem_shared/{createAuth-B-tvsvQU.mjs → createAuth-hRGxUJ9w.mjs}

@@ -1,5 +1,5 @@
 import { betterAuth } from 'better-auth';
-import { validateSessionPolicy } from './sessionPresets-B95rXrd8.mjs';
+import { validateSessionPolicy } from './sessionPresets-Dwwd74_J.mjs';
 
 const MIN_SECRET_LENGTH = 32;
 const isWeakSecret = (secret) => {
@@ -21,6 +21,21 @@ const isHttpsBaseUrl = (baseURL) => {
   }
   return false;
 };
+const isExplicitHttpBaseUrl = (baseURL) => {
+  if (typeof baseURL === "string") {
+    return baseURL.startsWith("http://");
+  }
+  if (baseURL && typeof baseURL === "object") {
+    if (baseURL.protocol === "http") {
+      return true;
+    }
+    if (baseURL.protocol === "https") {
+      return false;
+    }
+    return typeof baseURL.fallback === "string" && baseURL.fallback.startsWith("http://");
+  }
+  return false;
+};
 const hardenAuthOptions = (options) => {
   if (isWeakSecret(options.secret)) {
     const message = `@lunora/auth: AUTH_SECRET is only ${String(options.secret?.trim().length)} characters. Use at least ${String(MIN_SECRET_LENGTH)} for a brute-force-resistant secret — generate one with \`openssl rand -hex 32\`.`;
@@ -35,10 +50,26 @@ const hardenAuthOptions = (options) => {
     advanced: {
       ...advanced,
       defaultCookieAttributes: advanced.defaultCookieAttributes ?? { httpOnly: true, path: "/", sameSite: "lax" },
-      ...advanced.useSecureCookies === void 0 && isHttpsBaseUrl(options.baseURL) ? { useSecureCookies: true } : {}
+      ...advanced.useSecureCookies === void 0 ? { useSecureCookies: !isExplicitHttpBaseUrl(options.baseURL) } : {}
     }
   };
 };
+const resolveAuthOptions = (options) => {
+  const hardened = hardenAuthOptions(options);
+  const needsRateLimitEnabled = hardened.rateLimit?.enabled === void 0;
+  const needsRateLimitStorage = hardened.rateLimit?.storage === void 0 && hardened.rateLimit?.enabled !== false;
+  return {
+    ...hardened,
+    ...needsRateLimitEnabled || needsRateLimitStorage ? {
+      rateLimit: {
+        ...hardened.rateLimit,
+        ...needsRateLimitEnabled ? { enabled: true } : {},
+        ...needsRateLimitStorage ? { storage: "database" } : {}
+      }
+    } : {},
+    ...hardened.session?.cookieCache === void 0 ? { session: { ...hardened.session, cookieCache: { enabled: true, maxAge: 60 } } } : {}
+  };
+};
 const createAuth = (options) => {
   if (!options.secret || options.secret.trim() === "") {
     throw new Error(
@@ -48,9 +79,7 @@ const createAuth = (options) => {
   if (options.session) {
     validateSessionPolicy(options.session);
   }
-  const hardened = hardenAuthOptions(options);
-  const resolvedOptions = hardened.rateLimit?.enabled === void 0 ? { ...hardened, rateLimit: { ...hardened.rateLimit, enabled: true } } : hardened;
-  return betterAuth(resolvedOptions);
+  return betterAuth(resolveAuthOptions(options));
 };
 
-export { createAuth };
+export { createAuth, resolveAuthOptions };

package/dist/packem_shared/{sessionPresets-B95rXrd8.mjs → sessionPresets-Dwwd74_J.mjs}

@@ -16,16 +16,19 @@ const validateSessionPolicy = (policy) => {
 };
 const sessionPresets = {
   longLived: {
+    cookieCache: { enabled: true, maxAge: 60 },
     expiresIn: 30 * DAY,
     freshAge: DAY,
     updateAge: DAY
   },
   rolling: {
+    cookieCache: { enabled: true, maxAge: 60 },
     expiresIn: 7 * DAY,
     freshAge: DAY,
     updateAge: DAY
   },
   strict: {
+    cookieCache: { enabled: false },
     expiresIn: HOUR,
     freshAge: 5 * MINUTE,
     updateAge: 15 * MINUTE

package/dist/schema.d.mts

@@ -1,5 +1,5 @@
 import { TableDefinition } from '@lunora/server';
-import { a as LunoraAuthOptions } from "./packem_shared/create-auth.d-M36jwG_Y.mjs";
+import { a as LunoraAuthOptions } from "./packem_shared/create-auth.d-Mwhb4gSc.mjs";
 import 'better-auth';
 /**
 * Derive Lunora table definitions from a better-auth config — the bridge that

package/dist/schema.d.ts

@@ -1,5 +1,5 @@
 import { TableDefinition } from '@lunora/server';
-import { a as LunoraAuthOptions } from "./packem_shared/create-auth.d-M36jwG_Y.js";
+import { a as LunoraAuthOptions } from "./packem_shared/create-auth.d-Mwhb4gSc.js";
 import 'better-auth';
 /**
 * Derive Lunora table definitions from a better-auth config — the bridge that

package/dist/sql-store.mjs

@@ -111,6 +111,28 @@ const createSqlAuthStore = (executor) => {
       );
       return { ...data };
     },
+    incrementOne: async (model, where, increment, set) => {
+      const table = quoteId(model);
+      const incrementColumns = Object.keys(increment);
+      const setColumns = set ? Object.keys(set) : [];
+      const fragment = compileWhere(where);
+      if (incrementColumns.length === 0 && setColumns.length === 0) {
+        const [row2] = await executor.all(`SELECT * FROM ${table}${whereSuffix(fragment)} LIMIT 1`, fragment.params);
+        return row2;
+      }
+      const assignments = [
+        // COALESCE(col, 0) so a NULL counter advances from 0 rather than staying
+        // NULL (`NULL + ? = NULL` in SQLite/D1) — matches the memory store, which
+        // treats a non-numeric/absent counter as 0.
+        ...incrementColumns.map((column) => `${quoteId(column)} = COALESCE(${quoteId(column)}, 0) + ?`),
+        ...setColumns.map((column) => `${quoteId(column)} = ?`)
+      ].join(", ");
+      const [row] = await executor.all(
+        `UPDATE ${table} SET ${assignments} WHERE rowid IN (SELECT rowid FROM ${table}${whereSuffix(fragment)} LIMIT 1) RETURNING *`,
+        [...incrementColumns.map((column) => increment[column]), ...setColumns.map((column) => set[column]), ...fragment.params]
+      );
+      return row;
+    },
     read: async (model, query) => {
       const fragment = compileWhere(query.where);
       const parameters = [...fragment.params];

package/dist/store.d.mts

@@ -43,6 +43,24 @@ interface AuthStore {
   count: (model: string, where: ReadonlyArray<AuthWhereClause>) => Promise<number>;
   /** Insert `data` into `model`; return the stored row (the adapter pre-fills `id`). */
   create: (model: string, data: AuthRow) => Promise<AuthRow>;
+  /**
+  * Atomically apply signed numeric deltas to **at most one** row in `model`
+  * matching `where`, then return the updated row (or `undefined` if the guard
+  * matched none). For each `increment` entry it applies `field = field + delta`
+  * (a negative delta decrements); the optional `set` map assigns absolute
+  * values in the same step. The `where` clause is both selector **and** guard
+  * — comparison operators are honoured, so a guard like
+  * `{ field: "count", operator: "lt", value: max }` only mutates the row while
+  * it still satisfies the predicate.
+  *
+  * Backs better-auth's durable (`storage: "database"`) rate limiter, whose
+  * counter rides these tables. Implementing it natively — one statement that
+  * guards, increments, and returns — gives the **one-winner-across-isolates**
+  * guarantee the read-then-update fallback cannot: on Workers two concurrent
+  * requests would otherwise both read `count=4` and both write `5`, letting a
+  * `max` of 5 pass 6+. Same race-closing rationale as {@link AuthStore.consumeOne}.
+  */
+  incrementOne: (model: string, where: ReadonlyArray<AuthWhereClause>, increment: Record<string, number>, set?: AuthRow) => Promise<AuthRow | undefined>;
   /** Read rows from `model` honouring the filter/sort/window in `query`. */
   read: (model: string, query: AuthQuery) => Promise<AuthRow[]>;
   /** Delete rows in `model` matching `where`; return how many were removed. */

package/dist/store.d.ts

@@ -43,6 +43,24 @@ interface AuthStore {
   count: (model: string, where: ReadonlyArray<AuthWhereClause>) => Promise<number>;
   /** Insert `data` into `model`; return the stored row (the adapter pre-fills `id`). */
   create: (model: string, data: AuthRow) => Promise<AuthRow>;
+  /**
+  * Atomically apply signed numeric deltas to **at most one** row in `model`
+  * matching `where`, then return the updated row (or `undefined` if the guard
+  * matched none). For each `increment` entry it applies `field = field + delta`
+  * (a negative delta decrements); the optional `set` map assigns absolute
+  * values in the same step. The `where` clause is both selector **and** guard
+  * — comparison operators are honoured, so a guard like
+  * `{ field: "count", operator: "lt", value: max }` only mutates the row while
+  * it still satisfies the predicate.
+  *
+  * Backs better-auth's durable (`storage: "database"`) rate limiter, whose
+  * counter rides these tables. Implementing it natively — one statement that
+  * guards, increments, and returns — gives the **one-winner-across-isolates**
+  * guarantee the read-then-update fallback cannot: on Workers two concurrent
+  * requests would otherwise both read `count=4` and both write `5`, letting a
+  * `max` of 5 pass 6+. Same race-closing rationale as {@link AuthStore.consumeOne}.
+  */
+  incrementOne: (model: string, where: ReadonlyArray<AuthWhereClause>, increment: Record<string, number>, set?: AuthRow) => Promise<AuthRow | undefined>;
   /** Read rows from `model` honouring the filter/sort/window in `query`. */
   read: (model: string, query: AuthQuery) => Promise<AuthRow[]>;
   /** Delete rows in `model` matching `where`; return how many were removed. */

package/dist/store.mjs

@@ -128,6 +128,19 @@ const createMemoryAuthStore = () => {
       tableOf(model).push(row);
       return Promise.resolve({ ...row });
     },
+    incrementOne: (model, where, increment, set) => {
+      const row = tableOf(model).find((candidate) => matchesWhere(candidate, where));
+      if (!row) {
+        return Promise.resolve(void 0);
+      }
+      for (const [field, delta] of Object.entries(increment)) {
+        row[field] = (typeof row[field] === "number" ? row[field] : 0) + delta;
+      }
+      if (set) {
+        Object.assign(row, set);
+      }
+      return Promise.resolve({ ...row });
+    },
     read: (model, query) => {
       let rows = tableOf(model).filter((row) => matchesWhere(row, query.where));
       if (query.sortBy) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/auth",
-  "version": "1.0.0-alpha.11",
+  "version": "1.0.0-alpha.13",
   "description": "Auth for Lunora — a thin better-auth wrapper: email/password, OAuth, plugins, D1-backed",
   "keywords": [
     "auth",
@@ -83,7 +83,7 @@
   },
   "dependencies": {
     "@better-auth/passkey": "^1.6.22",
-    "@lunora/server": "1.0.0-alpha.10",
+    "@lunora/server": "1.0.0-alpha.12",
     "@lunora/values": "1.0.0-alpha.3",
     "better-auth": "^1.6.22"
   },

package/dist/packem_shared/create-auth.d-M36jwG_Y.d.mts

@@ -1,58 +0,0 @@
-import { betterAuth, BetterAuthOptions } from 'better-auth';
-/**
-* Lunora's options pass straight through to better-auth — the only thing we add
-* is requiring `secret` up front so a misconfigured deployment fails loudly
-* instead of at the first sign-in.
-*
-* For `database`, prefer `lunoraD1Adapter` (`database: lunoraD1Adapter(env.DB)`)
-* over passing the raw `env.DB`. better-auth *does* accept a D1Database directly,
-* but it then resolves its Kysely adapter via a runtime `await import(...)` inside
-* `auth.$context` — and that import never settles under `@cloudflare/vite-plugin`'s
-* worker runner, hanging every auth request in `pnpm dev`. The explicit adapter
-* skips it, so dev and prod behave the same. (Raw `env.DB` is still correct for
-* the migration-only instance — see `lunoraD1Adapter`'s note.)
-*
-* Session rotation / richer session policies are configured via the `session`
-* field (a `SessionPolicy`); Lunora validates it for obviously-broken
-* durations and forwards it verbatim to better-auth. See `sessionPresets`
-* for ready-made rotation/expiry trade-offs.
-*
-* ## Serverless background tasks (Cloudflare Workers)
-*
-* better-auth runs some work *after* sending the response — most importantly the
-* password-reset email, whose background send is what keeps reset responses
-* constant-time (a timing-attack defence: the response doesn't reveal whether
-* the account exists). On Cloudflare Workers a promise that isn't handed to
-* `ctx.waitUntil` can be cancelled the moment the response returns, dropping
-* that send and weakening the guarantee. Wire your request's `ctx.waitUntil`
-* into better-auth's background handler so the work survives:
-*
-* ```ts
-* // in your worker fetch handler, where `ctx: ExecutionContext` is in scope
-* const auth = createAuth({
-*     secret: env.AUTH_SECRET,
-*     database: lunoraD1Adapter(env.DB),
-*     advanced: {
-*         backgroundTasks: { handler: (promise) => ctx.waitUntil(promise) },
-*     },
-* });
-* ```
-*
-* (Lunora can't set this for you — `ctx.waitUntil` is per-request, but
-* `createAuth` runs once at worker setup.)
-*/
-type LunoraAuthOptions = BetterAuthOptions;
-/**
-* The full better-auth instance: `auth.handler` accepts a `Request` and
-* returns a `Response` (used by `handleAuthRequest`); `auth.api`
-* exposes the typed endpoint surface for server-side calls (e.g.
-* `auth.api.getSession({ headers })` inside a query/mutation).
-*/
-type LunoraAuth = ReturnType<typeof betterAuth>;
-/**
-* Create the auth instance. Thin wrapper around `betterAuth` that enforces
-* the `secret` requirement at construction time so misconfigured deployments
-* fail loudly at the first fetch rather than the first sign-in attempt.
-*/
-declare const createAuth: (options: LunoraAuthOptions) => LunoraAuth;
-export { LunoraAuth as L, LunoraAuthOptions as a, createAuth as c };

package/dist/packem_shared/create-auth.d-M36jwG_Y.d.ts

@@ -1,58 +0,0 @@
-import { betterAuth, BetterAuthOptions } from 'better-auth';
-/**
-* Lunora's options pass straight through to better-auth — the only thing we add
-* is requiring `secret` up front so a misconfigured deployment fails loudly
-* instead of at the first sign-in.
-*
-* For `database`, prefer `lunoraD1Adapter` (`database: lunoraD1Adapter(env.DB)`)
-* over passing the raw `env.DB`. better-auth *does* accept a D1Database directly,
-* but it then resolves its Kysely adapter via a runtime `await import(...)` inside
-* `auth.$context` — and that import never settles under `@cloudflare/vite-plugin`'s
-* worker runner, hanging every auth request in `pnpm dev`. The explicit adapter
-* skips it, so dev and prod behave the same. (Raw `env.DB` is still correct for
-* the migration-only instance — see `lunoraD1Adapter`'s note.)
-*
-* Session rotation / richer session policies are configured via the `session`
-* field (a `SessionPolicy`); Lunora validates it for obviously-broken
-* durations and forwards it verbatim to better-auth. See `sessionPresets`
-* for ready-made rotation/expiry trade-offs.
-*
-* ## Serverless background tasks (Cloudflare Workers)
-*
-* better-auth runs some work *after* sending the response — most importantly the
-* password-reset email, whose background send is what keeps reset responses
-* constant-time (a timing-attack defence: the response doesn't reveal whether
-* the account exists). On Cloudflare Workers a promise that isn't handed to
-* `ctx.waitUntil` can be cancelled the moment the response returns, dropping
-* that send and weakening the guarantee. Wire your request's `ctx.waitUntil`
-* into better-auth's background handler so the work survives:
-*
-* ```ts
-* // in your worker fetch handler, where `ctx: ExecutionContext` is in scope
-* const auth = createAuth({
-*     secret: env.AUTH_SECRET,
-*     database: lunoraD1Adapter(env.DB),
-*     advanced: {
-*         backgroundTasks: { handler: (promise) => ctx.waitUntil(promise) },
-*     },
-* });
-* ```
-*
-* (Lunora can't set this for you — `ctx.waitUntil` is per-request, but
-* `createAuth` runs once at worker setup.)
-*/
-type LunoraAuthOptions = BetterAuthOptions;
-/**
-* The full better-auth instance: `auth.handler` accepts a `Request` and
-* returns a `Response` (used by `handleAuthRequest`); `auth.api`
-* exposes the typed endpoint surface for server-side calls (e.g.
-* `auth.api.getSession({ headers })` inside a query/mutation).
-*/
-type LunoraAuth = ReturnType<typeof betterAuth>;
-/**
-* Create the auth instance. Thin wrapper around `betterAuth` that enforces
-* the `secret` requirement at construction time so misconfigured deployments
-* fail loudly at the first fetch rather than the first sign-in attempt.
-*/
-declare const createAuth: (options: LunoraAuthOptions) => LunoraAuth;
-export { LunoraAuth as L, LunoraAuthOptions as a, createAuth as c };