@lunora/auth 1.0.0-alpha.13 → 1.0.0-alpha.130

package/dist/plugins-enterprise.mjs

@@ -0,0 +1 @@
+import{sso as o}from"@better-auth/sso";const n=i=>{i?.domainVerification?.enabled!==!0&&console.warn("@lunora/auth: sso() is installed without `domainVerification: { enabled: true }` — an unverified `domain` still routes sign-in, so any signed-in user can register an identity provider for a domain they do not own. `/sso/register` is also session-only; narrow `providersLimit` if you keep verification off. Pass `domainVerification: { enabled: true }` once your deployment can prove domain ownership.")},r=(i=>(n(i),o(i)));export{r as sso};

package/dist/plugins.d.mts

@@ -1,5 +1,32 @@
+export {
+/**
+ * Close self-serve sign-up to invited addresses only: an account is created only
+ * for an email an administrator has invited with `createSignUpInvitation`.
+ * Declares the `signUpInvitation` table it reads. Lunora's own, not a better-auth
+ * re-export.
+ */
+type I as InviteOnlyOptions,
+/**
+ * Close self-serve sign-up to invited addresses only: an account is created only
+ * for an email an administrator has invited with `createSignUpInvitation`.
+ * Declares the `signUpInvitation` table it reads. Lunora's own, not a better-auth
+ * re-export.
+ */
+type a as IssuedSignUpInvitation,
+/**
+ * Close self-serve sign-up to invited addresses only: an account is created only
+ * for an email an administrator has invited with `createSignUpInvitation`.
+ * Declares the `signUpInvitation` table it reads. Lunora's own, not a better-auth
+ * re-export.
+ */
+type S as SignUpInvitation, i as inviteOnly } from "./packem_shared/invite-only.d-DKyHHkkQ.mjs";
+import { BetterAuthPlugin } from 'better-auth';
+export { apiKey } from '@better-auth/api-key';
+export { createMcpProtectedRequestHandler, mcp, requireMcpAuth } from '@better-auth/mcp';
+export { oauthDeviceAuthorization, oauthProvider } from '@better-auth/oauth-provider';
 export { passkey } from '@better-auth/passkey';
-export { captcha, mcp, withMcpAuth } from 'better-auth/plugins';
+export { scim } from '@better-auth/scim';
+export { captcha, lastLoginMethod, oneTap } from 'better-auth/plugins';
 export { createAccessControl } from 'better-auth/plugins/access';
 export { admin } from 'better-auth/plugins/admin';
 export { anonymous } from 'better-auth/plugins/anonymous';
@@ -13,10 +40,106 @@ export { jwt } from 'better-auth/plugins/jwt';
 export { magicLink } from 'better-auth/plugins/magic-link';
 export { multiSession } from 'better-auth/plugins/multi-session';
 export { oAuthProxy } from 'better-auth/plugins/oauth-proxy';
-export { oidcProvider } from 'better-auth/plugins/oidc-provider';
 export { oneTimeToken } from 'better-auth/plugins/one-time-token';
 export { organization } from 'better-auth/plugins/organization';
 export { phoneNumber } from 'better-auth/plugins/phone-number';
 export { siwe } from 'better-auth/plugins/siwe';
 export { twoFactor } from 'better-auth/plugins/two-factor';
 export { username } from 'better-auth/plugins/username';
+import "./packem_shared/create-auth.d-D1CKOFWc.mjs";
+/** Organization sub-features a UI branches on. */
+interface UiConfigOrganization {
+  /** Whether an ordinary user may create one at all. */
+  allowUserToCreate: boolean;
+  enabled: boolean;
+  /** Max invitations per organization, when configured. */
+  invitationLimit?: number;
+  /** Max organizations one user may belong to, when configured. */
+  limit?: number;
+  /** Max members per organization, when configured. */
+  membershipLimit?: number;
+  /** Custom roles / dynamic access control are configured. */
+  roles: boolean;
+  /** Teams are enabled. */
+  teams: boolean;
+}
+/** The public payload `GET {basePath}/ui-config` returns. */
+interface UiConfigPayload {
+  /** Whether email + password sign-in is enabled. */
+  emailAndPassword: boolean;
+  /** Absent when `expose.organization` is false — see {@link UiConfigOptions.expose}. */
+  organization?: UiConfigOrganization;
+  /** Enabled better-auth plugin ids, sorted. Absent when not disclosed. */
+  plugins?: string[];
+  /** Whether self-serve sign-up is open. */
+  signUp: boolean;
+  /** Configured social/OAuth provider ids, sorted. Absent when not disclosed. */
+  socialProviders?: string[];
+}
+/** Options for {@link uiConfig}. */
+interface UiConfigOptions {
+  /**
+   * Omit fields from the payload. Everything is published by default; set a
+   * key to `false` for a deployment that would rather not enumerate, say, its
+   * plugin set to anonymous callers.
+   *
+   * The field is **omitted, not emptied**. An empty `plugins: []` is
+   * indistinguishable from "this deployment runs no plugins", and the client
+   * ANDs the server's answer with its own registration — so emptying it would
+   * silently switch off every gated card instead of merely withholding the
+   * list. Absent means "not disclosed", and the client falls back to what
+   * `client.ts` registered.
+   */
+  expose?: {
+    organization?: boolean;
+    plugins?: boolean;
+    socialProviders?: boolean;
+  };
+  /**
+   * Extra provider ids to advertise beyond `socialProviders`. Providers wired
+   * through the `genericOAuth` plugin live in that plugin's own options rather
+   * than in `socialProviders`, so they cannot be derived here — list them if
+   * you want buttons for them.
+   */
+  extraProviders?: string[];
+  /**
+   * Path the endpoint mounts at, relative to the auth basePath.
+   * @default "/ui-config"
+   */
+  path?: string;
+}
+/**
+ * A better-auth server plugin publishing {@link UiConfigPayload} at
+ * `GET {basePath}/ui-config`.
+ *
+ * There is no client half: the payload is fetched with a plain `fetch` by
+ * whatever renders your auth screens, so it works before a client exists and
+ * from a framework this package knows nothing about.
+ *
+ * The return type is better-auth's own `BetterAuthPlugin` rather than the precise
+ * shape of the endpoint map. That is deliberate: `createAuthEndpoint`'s inferred
+ * type is anonymous, and naming it is the difference between a build that emits
+ * declarations and one that fails only in the bundler — after `tsc` and the
+ * tests have both gone green. `BetterAuthPlugin` is what `createAuth({ plugins })`
+ * consumes anyway.
+ */
+declare const uiConfig: (options?: UiConfigOptions) => BetterAuthPlugin;
+export {
+/**
+ * Publish which plugins and social providers this deployment enabled, at
+ * `GET {basePath}/ui-config`, so an auth UI configures itself instead of making
+ * you restate the list client-side. Lunora's own, not a better-auth re-export.
+ */
+type UiConfigOptions,
+/**
+ * Publish which plugins and social providers this deployment enabled, at
+ * `GET {basePath}/ui-config`, so an auth UI configures itself instead of making
+ * you restate the list client-side. Lunora's own, not a better-auth re-export.
+ */
+type UiConfigOrganization,
+/**
+ * Publish which plugins and social providers this deployment enabled, at
+ * `GET {basePath}/ui-config`, so an auth UI configures itself instead of making
+ * you restate the list client-side. Lunora's own, not a better-auth re-export.
+ */
+type UiConfigPayload, uiConfig };

package/dist/plugins.d.ts

@@ -1,5 +1,32 @@
+export {
+/**
+ * Close self-serve sign-up to invited addresses only: an account is created only
+ * for an email an administrator has invited with `createSignUpInvitation`.
+ * Declares the `signUpInvitation` table it reads. Lunora's own, not a better-auth
+ * re-export.
+ */
+type I as InviteOnlyOptions,
+/**
+ * Close self-serve sign-up to invited addresses only: an account is created only
+ * for an email an administrator has invited with `createSignUpInvitation`.
+ * Declares the `signUpInvitation` table it reads. Lunora's own, not a better-auth
+ * re-export.
+ */
+type a as IssuedSignUpInvitation,
+/**
+ * Close self-serve sign-up to invited addresses only: an account is created only
+ * for an email an administrator has invited with `createSignUpInvitation`.
+ * Declares the `signUpInvitation` table it reads. Lunora's own, not a better-auth
+ * re-export.
+ */
+type S as SignUpInvitation, i as inviteOnly } from "./packem_shared/invite-only.d-CsPJWAwM.js";
+import { BetterAuthPlugin } from 'better-auth';
+export { apiKey } from '@better-auth/api-key';
+export { createMcpProtectedRequestHandler, mcp, requireMcpAuth } from '@better-auth/mcp';
+export { oauthDeviceAuthorization, oauthProvider } from '@better-auth/oauth-provider';
 export { passkey } from '@better-auth/passkey';
-export { captcha, mcp, withMcpAuth } from 'better-auth/plugins';
+export { scim } from '@better-auth/scim';
+export { captcha, lastLoginMethod, oneTap } from 'better-auth/plugins';
 export { createAccessControl } from 'better-auth/plugins/access';
 export { admin } from 'better-auth/plugins/admin';
 export { anonymous } from 'better-auth/plugins/anonymous';
@@ -13,10 +40,106 @@ export { jwt } from 'better-auth/plugins/jwt';
 export { magicLink } from 'better-auth/plugins/magic-link';
 export { multiSession } from 'better-auth/plugins/multi-session';
 export { oAuthProxy } from 'better-auth/plugins/oauth-proxy';
-export { oidcProvider } from 'better-auth/plugins/oidc-provider';
 export { oneTimeToken } from 'better-auth/plugins/one-time-token';
 export { organization } from 'better-auth/plugins/organization';
 export { phoneNumber } from 'better-auth/plugins/phone-number';
 export { siwe } from 'better-auth/plugins/siwe';
 export { twoFactor } from 'better-auth/plugins/two-factor';
 export { username } from 'better-auth/plugins/username';
+import "./packem_shared/create-auth.d-D1CKOFWc.js";
+/** Organization sub-features a UI branches on. */
+interface UiConfigOrganization {
+  /** Whether an ordinary user may create one at all. */
+  allowUserToCreate: boolean;
+  enabled: boolean;
+  /** Max invitations per organization, when configured. */
+  invitationLimit?: number;
+  /** Max organizations one user may belong to, when configured. */
+  limit?: number;
+  /** Max members per organization, when configured. */
+  membershipLimit?: number;
+  /** Custom roles / dynamic access control are configured. */
+  roles: boolean;
+  /** Teams are enabled. */
+  teams: boolean;
+}
+/** The public payload `GET {basePath}/ui-config` returns. */
+interface UiConfigPayload {
+  /** Whether email + password sign-in is enabled. */
+  emailAndPassword: boolean;
+  /** Absent when `expose.organization` is false — see {@link UiConfigOptions.expose}. */
+  organization?: UiConfigOrganization;
+  /** Enabled better-auth plugin ids, sorted. Absent when not disclosed. */
+  plugins?: string[];
+  /** Whether self-serve sign-up is open. */
+  signUp: boolean;
+  /** Configured social/OAuth provider ids, sorted. Absent when not disclosed. */
+  socialProviders?: string[];
+}
+/** Options for {@link uiConfig}. */
+interface UiConfigOptions {
+  /**
+   * Omit fields from the payload. Everything is published by default; set a
+   * key to `false` for a deployment that would rather not enumerate, say, its
+   * plugin set to anonymous callers.
+   *
+   * The field is **omitted, not emptied**. An empty `plugins: []` is
+   * indistinguishable from "this deployment runs no plugins", and the client
+   * ANDs the server's answer with its own registration — so emptying it would
+   * silently switch off every gated card instead of merely withholding the
+   * list. Absent means "not disclosed", and the client falls back to what
+   * `client.ts` registered.
+   */
+  expose?: {
+    organization?: boolean;
+    plugins?: boolean;
+    socialProviders?: boolean;
+  };
+  /**
+   * Extra provider ids to advertise beyond `socialProviders`. Providers wired
+   * through the `genericOAuth` plugin live in that plugin's own options rather
+   * than in `socialProviders`, so they cannot be derived here — list them if
+   * you want buttons for them.
+   */
+  extraProviders?: string[];
+  /**
+   * Path the endpoint mounts at, relative to the auth basePath.
+   * @default "/ui-config"
+   */
+  path?: string;
+}
+/**
+ * A better-auth server plugin publishing {@link UiConfigPayload} at
+ * `GET {basePath}/ui-config`.
+ *
+ * There is no client half: the payload is fetched with a plain `fetch` by
+ * whatever renders your auth screens, so it works before a client exists and
+ * from a framework this package knows nothing about.
+ *
+ * The return type is better-auth's own `BetterAuthPlugin` rather than the precise
+ * shape of the endpoint map. That is deliberate: `createAuthEndpoint`'s inferred
+ * type is anonymous, and naming it is the difference between a build that emits
+ * declarations and one that fails only in the bundler — after `tsc` and the
+ * tests have both gone green. `BetterAuthPlugin` is what `createAuth({ plugins })`
+ * consumes anyway.
+ */
+declare const uiConfig: (options?: UiConfigOptions) => BetterAuthPlugin;
+export {
+/**
+ * Publish which plugins and social providers this deployment enabled, at
+ * `GET {basePath}/ui-config`, so an auth UI configures itself instead of making
+ * you restate the list client-side. Lunora's own, not a better-auth re-export.
+ */
+type UiConfigOptions,
+/**
+ * Publish which plugins and social providers this deployment enabled, at
+ * `GET {basePath}/ui-config`, so an auth UI configures itself instead of making
+ * you restate the list client-side. Lunora's own, not a better-auth re-export.
+ */
+type UiConfigOrganization,
+/**
+ * Publish which plugins and social providers this deployment enabled, at
+ * `GET {basePath}/ui-config`, so an auth UI configures itself instead of making
+ * you restate the list client-side. Lunora's own, not a better-auth re-export.
+ */
+type UiConfigPayload, uiConfig };

package/dist/plugins.mjs

@@ -1,22 +1 @@
-export { passkey } from '@better-auth/passkey';
-export { captcha, mcp, withMcpAuth } from 'better-auth/plugins';
-export { createAccessControl } from 'better-auth/plugins/access';
-export { admin } from 'better-auth/plugins/admin';
-export { anonymous } from 'better-auth/plugins/anonymous';
-export { bearer } from 'better-auth/plugins/bearer';
-export { customSession } from 'better-auth/plugins/custom-session';
-export { deviceAuthorization } from 'better-auth/plugins/device-authorization';
-export { emailOTP } from 'better-auth/plugins/email-otp';
-export { genericOAuth } from 'better-auth/plugins/generic-oauth';
-export { haveIBeenPwned } from 'better-auth/plugins/haveibeenpwned';
-export { jwt } from 'better-auth/plugins/jwt';
-export { magicLink } from 'better-auth/plugins/magic-link';
-export { multiSession } from 'better-auth/plugins/multi-session';
-export { oAuthProxy } from 'better-auth/plugins/oauth-proxy';
-export { oidcProvider } from 'better-auth/plugins/oidc-provider';
-export { oneTimeToken } from 'better-auth/plugins/one-time-token';
-export { organization } from 'better-auth/plugins/organization';
-export { phoneNumber } from 'better-auth/plugins/phone-number';
-export { siwe } from 'better-auth/plugins/siwe';
-export { twoFactor } from 'better-auth/plugins/two-factor';
-export { username } from 'better-auth/plugins/username';
+import{inviteOnly as e}from"./packem_shared/createSignUpInvitation-ClvskwuB.mjs";import{uiConfig as m}from"./packem_shared/uiConfig-B8pN6pks.mjs";import{apiKey as f}from"@better-auth/api-key";import{createMcpProtectedRequestHandler as i,mcp as n,requireMcpAuth as a}from"@better-auth/mcp";import{oauthDeviceAuthorization as s,oauthProvider as u}from"@better-auth/oauth-provider";import{passkey as d}from"@better-auth/passkey";import{scim as A}from"@better-auth/scim";import{captcha as v,lastLoginMethod as y,oneTap as P}from"better-auth/plugins";import{createAccessControl as T}from"better-auth/plugins/access";import{admin as z}from"better-auth/plugins/admin";import{anonymous as O}from"better-auth/plugins/anonymous";import{bearer as q}from"better-auth/plugins/bearer";import{customSession as L}from"better-auth/plugins/custom-session";import{deviceAuthorization as j}from"better-auth/plugins/device-authorization";import{emailOTP as D}from"better-auth/plugins/email-otp";import{genericOAuth as H}from"better-auth/plugins/generic-oauth";import{haveIBeenPwned as K}from"better-auth/plugins/haveibeenpwned";import{jwt as R}from"better-auth/plugins/jwt";import{magicLink as G}from"better-auth/plugins/magic-link";import{multiSession as Q}from"better-auth/plugins/multi-session";import{oAuthProxy as V}from"better-auth/plugins/oauth-proxy";import{oneTimeToken as X}from"better-auth/plugins/one-time-token";import{organization as Z}from"better-auth/plugins/organization";import{phoneNumber as $}from"better-auth/plugins/phone-number";import{siwe as ro}from"better-auth/plugins/siwe";import{twoFactor as to}from"better-auth/plugins/two-factor";import{username as po}from"better-auth/plugins/username";export{z as admin,O as anonymous,f as apiKey,q as bearer,v as captcha,T as createAccessControl,i as createMcpProtectedRequestHandler,L as customSession,j as deviceAuthorization,D as emailOTP,H as genericOAuth,K as haveIBeenPwned,e as inviteOnly,R as jwt,y as lastLoginMethod,G as magicLink,n as mcp,Q as multiSession,V as oAuthProxy,s as oauthDeviceAuthorization,u as oauthProvider,P as oneTap,X as oneTimeToken,Z as organization,d as passkey,$ as phoneNumber,a as requireMcpAuth,A as scim,ro as siwe,to as twoFactor,m as uiConfig,po as username};

package/dist/schema.d.mts

@@ -1,44 +1,44 @@
 import { TableDefinition } from '@lunora/server';
-import { a as LunoraAuthOptions } from "./packem_shared/create-auth.d-Mwhb4gSc.mjs";
+import { a as LunoraAuthOptions } from "./packem_shared/create-auth.d-D1CKOFWc.mjs";
 import 'better-auth';
 /**
-* Derive Lunora table definitions from a better-auth config — the bridge that
-* makes the **full** better-auth plugin ecosystem first-class Lunora data.
-*
-* better-auth's own `getAuthTables(options)` already merges every configured
-* plugin's `schema` into one table map (core `user`/`session`/`account`/
-* `verification`, plus whatever the plugins on `options.plugins` add —
-* `organization`/`member`/`invitation`/`team`/`teamMember` from the
-* organization plugin, `role`/`banned`/… columns from admin, `passkey`,
-* `twoFactor`, `jwks`, …). This walks that map and emits an equivalent
-* `defineTable` for each, so adding a plugin to `options.plugins` automatically
-* surfaces its tables in the Lunora schema — no hand-written table definitions
-* to keep in sync.
-*
-* Spread the result into `defineSchema` alongside your app tables (the keys are
-* better-auth's real table names — `user`, `session`, … — left **unprefixed**
-* because better-auth's adapter addresses them by exactly those names). Because
-* the names are unprefixed, do **not** declare an app table that reuses one of
-* better-auth's reserved names in the same `defineSchema` — JS spread order
-* would let the later key win silently (unlike the plugin-extension path, which
-* throws on collision):
-*
-* ```ts
-* import { authTables } from "@lunora/auth";
-* const authOptions = { emailAndPassword: { enabled: true }, plugins: [organization(), admin()] };
-* export const schema = defineSchema({
-*     ...authTables(authOptions),
-*     todos: defineTable({ title: v.string() }),
-* });
-* ```
-*
-* Scope: this emits the table **shapes** (columns + types + nullability +
-* uniqueness + FK ids). It deliberately does not carry better-auth's
-* `defaultValue`/`onUpdate` (filled by better-auth's own write layer), `index`
-* hints, or `bigint` precision (`bigint` fields map to `v.number()`). Those only
-* matter once better-auth's writes are routed through Lunora's ORM — a separate
-* adapter follow-up; today the auth rows are still written by better-auth's D1
-* adapter and these tables make them typed + queryable via `ctx.db`.
-*/
+ * Derive Lunora table definitions from a better-auth config — the bridge that
+ * makes the **full** better-auth plugin ecosystem first-class Lunora data.
+ *
+ * better-auth's own `getAuthTables(options)` already merges every configured
+ * plugin's `schema` into one table map (core `user`/`session`/`account`/
+ * `verification`, plus whatever the plugins on `options.plugins` add —
+ * `organization`/`member`/`invitation`/`team`/`teamMember` from the
+ * organization plugin, `role`/`banned`/… columns from admin, `passkey`,
+ * `twoFactor`, `jwks`, …). This walks that map and emits an equivalent
+ * `defineTable` for each, so adding a plugin to `options.plugins` automatically
+ * surfaces its tables in the Lunora schema — no hand-written table definitions
+ * to keep in sync.
+ *
+ * Spread the result into `defineSchema` alongside your app tables (the keys are
+ * better-auth's real table names — `user`, `session`, … — left **unprefixed**
+ * because better-auth's adapter addresses them by exactly those names). Because
+ * the names are unprefixed, do **not** declare an app table that reuses one of
+ * better-auth's reserved names in the same `defineSchema` — JS spread order
+ * would let the later key win silently (unlike the plugin-extension path, which
+ * throws on collision):
+ *
+ * ```ts
+ * import { authTables } from "@lunora/auth";
+ * const authOptions = { emailAndPassword: { enabled: true }, plugins: [organization(), admin()] };
+ * export const schema = defineSchema({
+ *     ...authTables(authOptions),
+ *     todos: defineTable({ title: v.string() }),
+ * });
+ * ```
+ *
+ * Scope: this emits the table **shapes** (columns + types + nullability +
+ * uniqueness + FK ids). It deliberately does not carry better-auth's
+ * `defaultValue`/`onUpdate` (filled by better-auth's own write layer), `index`
+ * hints, or `bigint` precision (`bigint` fields map to `v.number()`). Those only
+ * matter once better-auth's writes are routed through Lunora's ORM — a separate
+ * adapter follow-up; today the auth rows are still written by better-auth's D1
+ * adapter and these tables make them typed + queryable via `ctx.db`.
+ */
 declare const authTables: (options: LunoraAuthOptions) => Record<string, TableDefinition>;
 export { authTables as default };

package/dist/schema.d.ts

@@ -1,44 +1,44 @@
 import { TableDefinition } from '@lunora/server';
-import { a as LunoraAuthOptions } from "./packem_shared/create-auth.d-Mwhb4gSc.js";
+import { a as LunoraAuthOptions } from "./packem_shared/create-auth.d-D1CKOFWc.js";
 import 'better-auth';
 /**
-* Derive Lunora table definitions from a better-auth config — the bridge that
-* makes the **full** better-auth plugin ecosystem first-class Lunora data.
-*
-* better-auth's own `getAuthTables(options)` already merges every configured
-* plugin's `schema` into one table map (core `user`/`session`/`account`/
-* `verification`, plus whatever the plugins on `options.plugins` add —
-* `organization`/`member`/`invitation`/`team`/`teamMember` from the
-* organization plugin, `role`/`banned`/… columns from admin, `passkey`,
-* `twoFactor`, `jwks`, …). This walks that map and emits an equivalent
-* `defineTable` for each, so adding a plugin to `options.plugins` automatically
-* surfaces its tables in the Lunora schema — no hand-written table definitions
-* to keep in sync.
-*
-* Spread the result into `defineSchema` alongside your app tables (the keys are
-* better-auth's real table names — `user`, `session`, … — left **unprefixed**
-* because better-auth's adapter addresses them by exactly those names). Because
-* the names are unprefixed, do **not** declare an app table that reuses one of
-* better-auth's reserved names in the same `defineSchema` — JS spread order
-* would let the later key win silently (unlike the plugin-extension path, which
-* throws on collision):
-*
-* ```ts
-* import { authTables } from "@lunora/auth";
-* const authOptions = { emailAndPassword: { enabled: true }, plugins: [organization(), admin()] };
-* export const schema = defineSchema({
-*     ...authTables(authOptions),
-*     todos: defineTable({ title: v.string() }),
-* });
-* ```
-*
-* Scope: this emits the table **shapes** (columns + types + nullability +
-* uniqueness + FK ids). It deliberately does not carry better-auth's
-* `defaultValue`/`onUpdate` (filled by better-auth's own write layer), `index`
-* hints, or `bigint` precision (`bigint` fields map to `v.number()`). Those only
-* matter once better-auth's writes are routed through Lunora's ORM — a separate
-* adapter follow-up; today the auth rows are still written by better-auth's D1
-* adapter and these tables make them typed + queryable via `ctx.db`.
-*/
+ * Derive Lunora table definitions from a better-auth config — the bridge that
+ * makes the **full** better-auth plugin ecosystem first-class Lunora data.
+ *
+ * better-auth's own `getAuthTables(options)` already merges every configured
+ * plugin's `schema` into one table map (core `user`/`session`/`account`/
+ * `verification`, plus whatever the plugins on `options.plugins` add —
+ * `organization`/`member`/`invitation`/`team`/`teamMember` from the
+ * organization plugin, `role`/`banned`/… columns from admin, `passkey`,
+ * `twoFactor`, `jwks`, …). This walks that map and emits an equivalent
+ * `defineTable` for each, so adding a plugin to `options.plugins` automatically
+ * surfaces its tables in the Lunora schema — no hand-written table definitions
+ * to keep in sync.
+ *
+ * Spread the result into `defineSchema` alongside your app tables (the keys are
+ * better-auth's real table names — `user`, `session`, … — left **unprefixed**
+ * because better-auth's adapter addresses them by exactly those names). Because
+ * the names are unprefixed, do **not** declare an app table that reuses one of
+ * better-auth's reserved names in the same `defineSchema` — JS spread order
+ * would let the later key win silently (unlike the plugin-extension path, which
+ * throws on collision):
+ *
+ * ```ts
+ * import { authTables } from "@lunora/auth";
+ * const authOptions = { emailAndPassword: { enabled: true }, plugins: [organization(), admin()] };
+ * export const schema = defineSchema({
+ *     ...authTables(authOptions),
+ *     todos: defineTable({ title: v.string() }),
+ * });
+ * ```
+ *
+ * Scope: this emits the table **shapes** (columns + types + nullability +
+ * uniqueness + FK ids). It deliberately does not carry better-auth's
+ * `defaultValue`/`onUpdate` (filled by better-auth's own write layer), `index`
+ * hints, or `bigint` precision (`bigint` fields map to `v.number()`). Those only
+ * matter once better-auth's writes are routed through Lunora's ORM — a separate
+ * adapter follow-up; today the auth rows are still written by better-auth's D1
+ * adapter and these tables make them typed + queryable via `ctx.db`.
+ */
 declare const authTables: (options: LunoraAuthOptions) => Record<string, TableDefinition>;
 export { authTables as default };

package/dist/schema.mjs

@@ -1,62 +1 @@
-import { defineTable } from '@lunora/server';
-import { v } from '@lunora/values';
-import { getAuthTables } from 'better-auth/db';
-
-const baseValidator = (attribute) => {
-  if (attribute.references) {
-    return v.id(attribute.references.model);
-  }
-  const { type } = attribute;
-  if (Array.isArray(type)) {
-    return v.string();
-  }
-  switch (type) {
-    case "boolean": {
-      return v.boolean();
-    }
-    case "date": {
-      return v.date();
-    }
-    case "number": {
-      return v.number();
-    }
-    case "number[]": {
-      return v.array(v.number());
-    }
-    case "string": {
-      return v.string();
-    }
-    case "string[]": {
-      return v.array(v.string());
-    }
-    // "json" and anything unrecognised: keep the row shape permissive rather
-    // than fail schema generation on a plugin's exotic column type.
-    default: {
-      return v.any();
-    }
-  }
-};
-const fieldValidator = (attribute) => {
-  let validator = baseValidator(attribute);
-  if (attribute.required === false) {
-    validator = validator.nullable();
-  }
-  if (attribute.unique === true) {
-    validator = validator.unique();
-  }
-  return validator;
-};
-const authTables = (options) => {
-  const tables = getAuthTables(options);
-  const schema = {};
-  for (const table of Object.values(tables)) {
-    const shape = {};
-    for (const [fieldKey, attribute] of Object.entries(table.fields)) {
-      shape[attribute.fieldName ?? fieldKey] = fieldValidator(attribute);
-    }
-    schema[table.modelName] = defineTable(shape).externallyManaged();
-  }
-  return schema;
-};
-
-export { authTables as default };
+import{defineTable as i}from"@lunora/server";import{v as e}from"@lunora/values";import{getAuthTables as u}from"better-auth/db";const c=n=>{if(n.references)return e.id(n.references.model);const{type:r}=n;if(Array.isArray(r))return e.string();switch(r){case"boolean":return e.boolean();case"date":return e.date();case"number":return e.number();case"number[]":return e.array(e.number());case"string":return e.string();case"string[]":return e.array(e.string());default:return e.any()}},f=n=>{let r=c(n);return n.required===!1&&(r=r.nullable()),n.unique===!0&&(r=r.unique()),r},y=n=>{const r=u(n),a={};for(const t of Object.values(r)){const s={};for(const[l,o]of Object.entries(t.fields))s[o.fieldName??l]=f(o);a[t.modelName]=i(s).externallyManaged()}return a};export{y as default};

package/dist/sql-store.d.mts

@@ -12,40 +12,40 @@ interface D1Like {
   };
 }
 /**
-* The minimal SQL seam a {@link createSqlAuthStore} runs on — structurally the
-* same `{ all, run }` contract as `@lunora/d1`'s `D1Exec`, so a Lunora D1 binding
-* satisfies it directly (see {@link d1Executor}) and a `node:sqlite` handle does
-* too in tests. `all` runs reads and returns rows; `run` runs writes.
-*/
+ * The minimal SQL seam a {@link createSqlAuthStore} runs on — structurally the
+ * same `{ all, run }` contract as `@lunora/d1`'s `D1Exec`, so a Lunora D1 binding
+ * satisfies it directly (see {@link d1Executor}) and a `node:sqlite` handle does
+ * too in tests. `all` runs reads and returns rows; `run` runs writes.
+ */
 interface SqlExecutor {
   all: (sql: string, parameters: ReadonlyArray<unknown>) => Promise<Record<string, unknown>[]>;
   run: (sql: string, parameters: ReadonlyArray<unknown>) => Promise<void>;
 }
 /**
-* An {@link AuthStore} backed by a SQL database through the {@link SqlExecutor}
-* seam — the production counterpart to `createMemoryAuthStore`. Point it at the
-* same database that hosts Lunora's global (D1) tables (the ones `authTables(...)`
-* generates) and better-auth's reads/writes land there as ordinary rows Lunora
-* can also query. Assumes the auth tables already exist (Lunora owns the schema /
-* migrations); it never issues DDL.
-*
-* ```ts
-* const store = createSqlAuthStore(d1Executor(env.DB));
-* const auth = createAuth({ secret: env.AUTH_SECRET, database: lunoraAuthAdapter(store) });
-* ```
-*
-* Clause semantics match `createMemoryAuthStore` (operator parity is
-* covered by a cross-store agreement test) with one unavoidable caveat:
-* case-**insensitive** matching uses SQLite's ASCII-only `LOWER()`, whereas the
-* in-memory store uses JS full-Unicode `toLowerCase()`. They agree on ASCII
-* (emails, ids, tokens — the credential path); they can differ only for
-* case-insensitive comparison of non-ASCII text.
-*/
+ * An {@link AuthStore} backed by a SQL database through the {@link SqlExecutor}
+ * seam — the production counterpart to `createMemoryAuthStore`. Point it at the
+ * same database that hosts Lunora's global (D1) tables (the ones `authTables(...)`
+ * generates) and better-auth's reads/writes land there as ordinary rows Lunora
+ * can also query. Assumes the auth tables already exist (Lunora owns the schema /
+ * migrations); it never issues DDL.
+ *
+ * ```ts
+ * const store = createSqlAuthStore(d1Executor(env.DB));
+ * const auth = createAuth({ secret: env.AUTH_SECRET, database: lunoraAuthAdapter(store) });
+ * ```
+ *
+ * Clause semantics match `createMemoryAuthStore` (operator parity is
+ * covered by a cross-store agreement test) with one unavoidable caveat:
+ * case-**insensitive** matching uses SQLite's ASCII-only `LOWER()`, whereas the
+ * in-memory store uses JS full-Unicode `toLowerCase()`. They agree on ASCII
+ * (emails, ids, tokens — the credential path); they can differ only for
+ * case-insensitive comparison of non-ASCII text.
+ */
 declare const createSqlAuthStore: (executor: SqlExecutor) => AuthStore;
 /**
-* Wrap a Cloudflare D1 binding (`env.DB`) as a {@link SqlExecutor}, so
-* `createSqlAuthStore(d1Executor(env.DB))` routes better-auth onto D1 — the same
-* binding Lunora's `.global()` tables use.
-*/
+ * Wrap a Cloudflare D1 binding (`env.DB`) as a {@link SqlExecutor}, so
+ * `createSqlAuthStore(d1Executor(env.DB))` routes better-auth onto D1 — the same
+ * binding Lunora's `.global()` tables use.
+ */
 declare const d1Executor: (database: D1Like) => SqlExecutor;
 export { SqlExecutor, createSqlAuthStore, d1Executor };