@lunora/auth 1.0.0-alpha.13 → 1.0.0-alpha.130

package/dist/sql-store.d.ts

@@ -12,40 +12,40 @@ interface D1Like {
   };
 }
 /**
-* The minimal SQL seam a {@link createSqlAuthStore} runs on — structurally the
-* same `{ all, run }` contract as `@lunora/d1`'s `D1Exec`, so a Lunora D1 binding
-* satisfies it directly (see {@link d1Executor}) and a `node:sqlite` handle does
-* too in tests. `all` runs reads and returns rows; `run` runs writes.
-*/
+ * The minimal SQL seam a {@link createSqlAuthStore} runs on — structurally the
+ * same `{ all, run }` contract as `@lunora/d1`'s `D1Exec`, so a Lunora D1 binding
+ * satisfies it directly (see {@link d1Executor}) and a `node:sqlite` handle does
+ * too in tests. `all` runs reads and returns rows; `run` runs writes.
+ */
 interface SqlExecutor {
   all: (sql: string, parameters: ReadonlyArray<unknown>) => Promise<Record<string, unknown>[]>;
   run: (sql: string, parameters: ReadonlyArray<unknown>) => Promise<void>;
 }
 /**
-* An {@link AuthStore} backed by a SQL database through the {@link SqlExecutor}
-* seam — the production counterpart to `createMemoryAuthStore`. Point it at the
-* same database that hosts Lunora's global (D1) tables (the ones `authTables(...)`
-* generates) and better-auth's reads/writes land there as ordinary rows Lunora
-* can also query. Assumes the auth tables already exist (Lunora owns the schema /
-* migrations); it never issues DDL.
-*
-* ```ts
-* const store = createSqlAuthStore(d1Executor(env.DB));
-* const auth = createAuth({ secret: env.AUTH_SECRET, database: lunoraAuthAdapter(store) });
-* ```
-*
-* Clause semantics match `createMemoryAuthStore` (operator parity is
-* covered by a cross-store agreement test) with one unavoidable caveat:
-* case-**insensitive** matching uses SQLite's ASCII-only `LOWER()`, whereas the
-* in-memory store uses JS full-Unicode `toLowerCase()`. They agree on ASCII
-* (emails, ids, tokens — the credential path); they can differ only for
-* case-insensitive comparison of non-ASCII text.
-*/
+ * An {@link AuthStore} backed by a SQL database through the {@link SqlExecutor}
+ * seam — the production counterpart to `createMemoryAuthStore`. Point it at the
+ * same database that hosts Lunora's global (D1) tables (the ones `authTables(...)`
+ * generates) and better-auth's reads/writes land there as ordinary rows Lunora
+ * can also query. Assumes the auth tables already exist (Lunora owns the schema /
+ * migrations); it never issues DDL.
+ *
+ * ```ts
+ * const store = createSqlAuthStore(d1Executor(env.DB));
+ * const auth = createAuth({ secret: env.AUTH_SECRET, database: lunoraAuthAdapter(store) });
+ * ```
+ *
+ * Clause semantics match `createMemoryAuthStore` (operator parity is
+ * covered by a cross-store agreement test) with one unavoidable caveat:
+ * case-**insensitive** matching uses SQLite's ASCII-only `LOWER()`, whereas the
+ * in-memory store uses JS full-Unicode `toLowerCase()`. They agree on ASCII
+ * (emails, ids, tokens — the credential path); they can differ only for
+ * case-insensitive comparison of non-ASCII text.
+ */
 declare const createSqlAuthStore: (executor: SqlExecutor) => AuthStore;
 /**
-* Wrap a Cloudflare D1 binding (`env.DB`) as a {@link SqlExecutor}, so
-* `createSqlAuthStore(d1Executor(env.DB))` routes better-auth onto D1 — the same
-* binding Lunora's `.global()` tables use.
-*/
+ * Wrap a Cloudflare D1 binding (`env.DB`) as a {@link SqlExecutor}, so
+ * `createSqlAuthStore(d1Executor(env.DB))` routes better-auth onto D1 — the same
+ * binding Lunora's `.global()` tables use.
+ */
 declare const d1Executor: (database: D1Like) => SqlExecutor;
 export { SqlExecutor, createSqlAuthStore, d1Executor };

package/dist/sql-store.mjs

@@ -1,184 +1 @@
-const quoteId = (name) => `"${name.replaceAll('"', '""')}"`;
-const NEVER = { params: [], sql: "0" };
-const sided = (column, insensitive) => insensitive ? { column: `LOWER(${column})`, placeholder: "LOWER(?)" } : { column, placeholder: "?" };
-const patternFragment = (column, value, operator, insensitive) => {
-  if (typeof value !== "string") {
-    return NEVER;
-  }
-  const side = sided(column, insensitive);
-  if (operator === "contains") {
-    return { params: [value], sql: `instr(${side.column}, ${side.placeholder}) > 0` };
-  }
-  if (operator === "starts_with") {
-    return { params: [value], sql: `instr(${side.column}, ${side.placeholder}) = 1` };
-  }
-  return { params: [value, value], sql: `substr(${side.column}, -length(?)) = ${side.placeholder}` };
-};
-const equalityFragment = (column, value, insensitive, negated) => {
-  if (value === null) {
-    return { params: [], sql: `${column} IS ${negated ? "NOT " : ""}NULL` };
-  }
-  const side = sided(column, insensitive);
-  const symbol = negated ? "<>" : "=";
-  return { params: [value], sql: `${side.column} ${symbol} ${side.placeholder}` };
-};
-const inFragment = (column, value, negated, insensitive) => {
-  const values = Array.isArray(value) ? value : [];
-  if (values.length === 0) {
-    return { params: [], sql: negated ? "1" : "0" };
-  }
-  const side = sided(column, insensitive);
-  const placeholders = values.map(() => side.placeholder).join(", ");
-  return { params: [...values], sql: `${side.column} ${negated ? "NOT IN" : "IN"} (${placeholders})` };
-};
-const compileClause = (clause) => {
-  const column = quoteId(clause.field);
-  const { mode, operator, value } = clause;
-  const insensitive = mode === "insensitive";
-  switch (operator) {
-    case "contains":
-    case "ends_with":
-    case "starts_with": {
-      return patternFragment(column, value, operator, insensitive);
-    }
-    case "gt": {
-      return { params: [value], sql: `${column} > ?` };
-    }
-    case "gte": {
-      return { params: [value], sql: `${column} >= ?` };
-    }
-    case "in": {
-      return inFragment(column, value, false, insensitive);
-    }
-    case "lt": {
-      return { params: [value], sql: `${column} < ?` };
-    }
-    case "lte": {
-      return { params: [value], sql: `${column} <= ?` };
-    }
-    case "ne": {
-      return equalityFragment(column, value, insensitive, true);
-    }
-    case "not_in": {
-      return inFragment(column, value, true, insensitive);
-    }
-    // "eq" and the default: null-aware equality.
-    default: {
-      return equalityFragment(column, value, insensitive, false);
-    }
-  }
-};
-const compileWhere = (where) => {
-  if (where.length === 0) {
-    return { params: [], sql: "" };
-  }
-  let accumulator = compileClause(where[0]);
-  for (const clause of where.slice(1)) {
-    const fragment = compileClause(clause);
-    const connector = clause.connector === "OR" ? "OR" : "AND";
-    accumulator = { params: [...accumulator.params, ...fragment.params], sql: `(${accumulator.sql} ${connector} ${fragment.sql})` };
-  }
-  return accumulator;
-};
-const whereSuffix = (fragment) => fragment.sql ? ` WHERE ${fragment.sql}` : "";
-const createSqlAuthStore = (executor) => {
-  const selectRows = (model, where) => {
-    const fragment = compileWhere(where);
-    return executor.all(`SELECT * FROM ${quoteId(model)}${whereSuffix(fragment)}`, fragment.params);
-  };
-  return {
-    consumeOne: async (model, where) => {
-      const fragment = compileWhere(where);
-      const table = quoteId(model);
-      const [row] = await executor.all(
-        `DELETE FROM ${table} WHERE rowid IN (SELECT rowid FROM ${table}${whereSuffix(fragment)} LIMIT 1) RETURNING *`,
-        fragment.params
-      );
-      return row;
-    },
-    count: async (model, where) => {
-      const fragment = compileWhere(where);
-      const [row] = await executor.all(`SELECT COUNT(*) AS __count FROM ${quoteId(model)}${whereSuffix(fragment)}`, fragment.params);
-      return Number(row?.["__count"] ?? 0);
-    },
-    create: async (model, data) => {
-      const columns = Object.keys(data);
-      const placeholders = columns.map(() => "?").join(", ");
-      const sql = `INSERT INTO ${quoteId(model)} (${columns.map((column) => quoteId(column)).join(", ")}) VALUES (${placeholders})`;
-      await executor.run(
-        sql,
-        columns.map((column) => data[column])
-      );
-      return { ...data };
-    },
-    incrementOne: async (model, where, increment, set) => {
-      const table = quoteId(model);
-      const incrementColumns = Object.keys(increment);
-      const setColumns = set ? Object.keys(set) : [];
-      const fragment = compileWhere(where);
-      if (incrementColumns.length === 0 && setColumns.length === 0) {
-        const [row2] = await executor.all(`SELECT * FROM ${table}${whereSuffix(fragment)} LIMIT 1`, fragment.params);
-        return row2;
-      }
-      const assignments = [
-        // COALESCE(col, 0) so a NULL counter advances from 0 rather than staying
-        // NULL (`NULL + ? = NULL` in SQLite/D1) — matches the memory store, which
-        // treats a non-numeric/absent counter as 0.
-        ...incrementColumns.map((column) => `${quoteId(column)} = COALESCE(${quoteId(column)}, 0) + ?`),
-        ...setColumns.map((column) => `${quoteId(column)} = ?`)
-      ].join(", ");
-      const [row] = await executor.all(
-        `UPDATE ${table} SET ${assignments} WHERE rowid IN (SELECT rowid FROM ${table}${whereSuffix(fragment)} LIMIT 1) RETURNING *`,
-        [...incrementColumns.map((column) => increment[column]), ...setColumns.map((column) => set[column]), ...fragment.params]
-      );
-      return row;
-    },
-    read: async (model, query) => {
-      const fragment = compileWhere(query.where);
-      const parameters = [...fragment.params];
-      let sql = `SELECT * FROM ${quoteId(model)}${whereSuffix(fragment)}`;
-      if (query.sortBy) {
-        sql += ` ORDER BY ${quoteId(query.sortBy.field)} ${query.sortBy.direction === "asc" ? "ASC" : "DESC"}`;
-      }
-      if (query.limit !== void 0) {
-        sql += " LIMIT ?";
-        parameters.push(Math.trunc(query.limit));
-      }
-      if (query.offset) {
-        sql += `${query.limit === void 0 ? " LIMIT -1" : ""} OFFSET ?`;
-        parameters.push(Math.trunc(query.offset));
-      }
-      return executor.all(sql, parameters);
-    },
-    remove: async (model, where) => {
-      const fragment = compileWhere(where);
-      const deleted = await executor.all(`DELETE FROM ${quoteId(model)}${whereSuffix(fragment)} RETURNING *`, fragment.params);
-      return deleted.length;
-    },
-    update: async (model, where, values) => {
-      const columns = Object.keys(values);
-      if (columns.length === 0) {
-        return selectRows(model, where);
-      }
-      const assignments = columns.map((column) => `${quoteId(column)} = ?`).join(", ");
-      const fragment = compileWhere(where);
-      return executor.all(`UPDATE ${quoteId(model)} SET ${assignments}${whereSuffix(fragment)} RETURNING *`, [
-        ...columns.map((column) => values[column]),
-        ...fragment.params
-      ]);
-    }
-  };
-};
-const d1Executor = (database) => {
-  return {
-    all: async (sql, parameters) => {
-      const result = await database.prepare(sql).bind(...parameters).all();
-      return result.results ?? [];
-    },
-    run: async (sql, parameters) => {
-      await database.prepare(sql).bind(...parameters).run();
-    }
-  };
-};
-
-export { createSqlAuthStore, d1Executor };
+const l=s=>`"${s.replaceAll('"','""')}"`,T="_creationTime",N=/no such column|column .{0,64}? does not exist/iu,g={params:[],sql:"0"},R=(s,r)=>r?{column:`LOWER(${s})`,placeholder:"LOWER(?)"}:{column:s,placeholder:"?"},M=(s,r,a,c)=>{if(typeof r!="string")return g;const t=R(s,c);return a==="contains"?{params:[r],sql:`instr(${t.column}, ${t.placeholder}) > 0`}:a==="starts_with"?{params:[r],sql:`instr(${t.column}, ${t.placeholder}) = 1`}:{params:[r,r],sql:`substr(${t.column}, -length(?)) = ${t.placeholder}`}},h=(s,r,a,c)=>{if(r===null)return{params:[],sql:`${s} IS ${c?"NOT ":""}NULL`};const t=R(s,a),n=c?"<>":"=";return{params:[r],sql:`${t.column} ${n} ${t.placeholder}`}},O=(s,r,a,c)=>{const t=Array.isArray(r)?r:[];if(t.length===0)return{params:[],sql:a?"1":"0"};const n=R(s,c),e=t.map(()=>n.placeholder).join(", ");return{params:[...t],sql:`${n.column} ${a?"NOT IN":"IN"} (${e})`}},L=s=>{const r=l(s.field),{mode:a,operator:c,value:t}=s,n=a==="insensitive";switch(c){case"contains":case"ends_with":case"starts_with":return M(r,t,c,n);case"gt":return{params:[t],sql:`${r} > ?`};case"gte":return{params:[t],sql:`${r} >= ?`};case"in":return O(r,t,!1,n);case"lt":return{params:[t],sql:`${r} < ?`};case"lte":return{params:[t],sql:`${r} <= ?`};case"ne":return h(r,t,n,!0);case"not_in":return O(r,t,!0,n);default:return h(r,t,n,!1)}},d=(s,r)=>{if(s.length===0)return;const a=s.map(c=>L(c));return{params:a.flatMap(c=>c.params),sql:a.map(c=>`(${c.sql})`).join(` ${r} `)}},E=s=>{const r=[d(s.filter(a=>a.connector!=="OR"),"AND"),d(s.filter(a=>a.connector==="OR"),"OR")].filter(a=>a!==void 0);return r.length===0?{params:[],sql:""}:{params:r.flatMap(a=>a.params),sql:r.map(a=>`(${a.sql})`).join(" AND ")}},$=s=>s.sql?` WHERE ${s.sql}`:"",S=s=>{const r=(t,n)=>{const e=E(n);return s.all(`SELECT * FROM ${l(t)}${$(e)}`,e.params)},a=new Map,c=async t=>{const n=a.get(t);if(n!==void 0)return n;try{await s.all(`SELECT ${l(t)}.${l(T)} FROM ${l(t)} LIMIT 0`,[])}catch(e){return N.test(e instanceof Error?e.message:String(e))&&a.set(t,!1),!1}return a.set(t,!0),!0};return{consumeOne:async(t,n)=>{const e=E(n),o=l(t),[i]=await s.all(`DELETE FROM ${o} WHERE rowid IN (SELECT rowid FROM ${o}${$(e)} LIMIT 1) RETURNING *`,e.params);return i},count:async(t,n)=>{const e=E(n),[o]=await s.all(`SELECT COUNT(*) AS __count FROM ${l(t)}${$(e)}`,e.params);return Number(o?.__count??0)},create:async(t,n)=>{const e=T in n||!await c(t)?n:{[T]:Date.now(),...n},o=Object.keys(e),i=o.map(()=>"?").join(", "),u=`INSERT INTO ${l(t)} (${o.map(m=>l(m)).join(", ")}) VALUES (${i})`;return await s.run(u,o.map(m=>e[m])),{...n}},incrementOne:async(t,n,e,o)=>{const i=l(t),u=Object.keys(e),m=o?Object.keys(o):[],f=E(n);if(u.length===0&&m.length===0){const[p]=await s.all(`SELECT * FROM ${i}${$(f)} LIMIT 1`,f.params);return p}const I=[...u.map(p=>`${l(p)} = COALESCE(${l(p)}, 0) + ?`),...m.map(p=>`${l(p)} = ?`)].join(", "),[w]=await s.all(`UPDATE ${i} SET ${I} WHERE rowid IN (SELECT rowid FROM ${i}${$(f)} LIMIT 1) RETURNING *`,[...u.map(p=>e[p]),...m.map(p=>o[p]),...f.params]);return w},read:async(t,n)=>{const e=E(n.where),o=[...e.params];let i=`SELECT * FROM ${l(t)}${$(e)}`;return n.sortBy&&(i+=` ORDER BY ${l(n.sortBy.field)} ${n.sortBy.direction==="asc"?"ASC":"DESC"}`),n.limit!==void 0&&(i+=" LIMIT ?",o.push(Math.trunc(n.limit))),n.offset&&(i+=`${n.limit===void 0?" LIMIT -1":""} OFFSET ?`,o.push(Math.trunc(n.offset))),s.all(i,o)},remove:async(t,n)=>{const e=E(n);return(await s.all(`DELETE FROM ${l(t)}${$(e)} RETURNING *`,e.params)).length},update:async(t,n,e)=>{const o=Object.keys(e);if(o.length===0)return r(t,n);const i=o.map(m=>`${l(m)} = ?`).join(", "),u=E(n);return s.all(`UPDATE ${l(t)} SET ${i}${$(u)} RETURNING *`,[...o.map(m=>e[m]),...u.params])}}},C=s=>({all:async(r,a)=>(await s.prepare(r).bind(...a).all()).results??[],run:async(r,a)=>{await s.prepare(r).bind(...a).run()}});export{S as createSqlAuthStore,C as d1Executor};

package/dist/store.d.mts

@@ -2,10 +2,10 @@ import { CustomAdapter } from 'better-auth/adapters';
 /** A stored auth row — an opaque bag of columns keyed by better-auth field name. */
 type AuthRow = Record<string, unknown>;
 /**
-* One normalized better-auth where clause. Derived from {@link CustomAdapter}'s
-* own method signature (rather than re-declared) so a better-auth change to the
-* clause shape surfaces as a compile error here, not a silent mis-match.
-*/
+ * One normalized better-auth where clause. Derived from {@link CustomAdapter}'s
+ * own method signature (rather than re-declared) so a better-auth change to the
+ * clause shape surfaces as a compile error here, not a silent mis-match.
+ */
 type AuthWhereClause = NonNullable<Parameters<CustomAdapter["findOne"]>[0]["where"]>[number];
 /** Read query handed to {@link AuthStore.read}: a where filter plus optional sort/window. */
 interface AuthQuery {
@@ -18,48 +18,48 @@ interface AuthQuery {
   where: ReadonlyArray<AuthWhereClause>;
 }
 /**
-* The minimal table-addressed store the `lunoraAuthAdapter` drives. This is the
-* seam a Lunora runtime binds to its ORM: back each method with `ctx.db` over
-* the global (D1) auth tables that `authTables(...)` generates, and better-auth's
-* reads/writes flow through Lunora's data layer (triggers, aggregates, OCC)
-* instead of better-auth's own adapter. Field names and table (`model`) names are
-* already the database names better-auth resolved from the schema, so a store
-* passes them straight through.
-*
-* {@link createMemoryAuthStore} is a reference in-memory implementation (also
-* what the tests run better-auth against); `createSqlAuthStore` is the SQL one.
-*/
+ * The minimal table-addressed store the `lunoraAuthAdapter` drives. This is the
+ * seam a Lunora runtime binds to its ORM: back each method with `ctx.db` over
+ * the global (D1) auth tables that `authTables(...)` generates, and better-auth's
+ * reads/writes flow through Lunora's data layer (triggers, aggregates, OCC)
+ * instead of better-auth's own adapter. Field names and table (`model`) names are
+ * already the database names better-auth resolved from the schema, so a store
+ * passes them straight through.
+ *
+ * {@link createMemoryAuthStore} is a reference in-memory implementation (also
+ * what the tests run better-auth against); `createSqlAuthStore` is the SQL one.
+ */
 interface AuthStore {
   /**
-  * Atomically delete **at most one** row in `model` matching `where` and
-  * return it (or `undefined` if none matched). Backs better-auth's
-  * single-use-token consume (OTP / magic-link / email-verification /
-  * password-reset): implementing it natively — one round trip that finds and
-  * deletes in a single statement — closes the read-then-delete race the
-  * factory's `findMany` + `deleteMany` fallback would otherwise leave open.
-  */
+   * Atomically delete **at most one** row in `model` matching `where` and
+   * return it (or `undefined` if none matched). Backs better-auth's
+   * single-use-token consume (OTP / magic-link / email-verification /
+   * password-reset): implementing it natively — one round trip that finds and
+   * deletes in a single statement — closes the read-then-delete race the
+   * factory's `findMany` + `deleteMany` fallback would otherwise leave open.
+   */
   consumeOne: (model: string, where: ReadonlyArray<AuthWhereClause>) => Promise<AuthRow | undefined>;
   /** Count rows in `model` matching `where` (empty `where` = all rows). */
   count: (model: string, where: ReadonlyArray<AuthWhereClause>) => Promise<number>;
   /** Insert `data` into `model`; return the stored row (the adapter pre-fills `id`). */
   create: (model: string, data: AuthRow) => Promise<AuthRow>;
   /**
-  * Atomically apply signed numeric deltas to **at most one** row in `model`
-  * matching `where`, then return the updated row (or `undefined` if the guard
-  * matched none). For each `increment` entry it applies `field = field + delta`
-  * (a negative delta decrements); the optional `set` map assigns absolute
-  * values in the same step. The `where` clause is both selector **and** guard
-  * — comparison operators are honoured, so a guard like
-  * `{ field: "count", operator: "lt", value: max }` only mutates the row while
-  * it still satisfies the predicate.
-  *
-  * Backs better-auth's durable (`storage: "database"`) rate limiter, whose
-  * counter rides these tables. Implementing it natively — one statement that
-  * guards, increments, and returns — gives the **one-winner-across-isolates**
-  * guarantee the read-then-update fallback cannot: on Workers two concurrent
-  * requests would otherwise both read `count=4` and both write `5`, letting a
-  * `max` of 5 pass 6+. Same race-closing rationale as {@link AuthStore.consumeOne}.
-  */
+   * Atomically apply signed numeric deltas to **at most one** row in `model`
+   * matching `where`, then return the updated row (or `undefined` if the guard
+   * matched none). For each `increment` entry it applies `field = field + delta`
+   * (a negative delta decrements); the optional `set` map assigns absolute
+   * values in the same step. The `where` clause is both selector **and** guard
+   * — comparison operators are honoured, so a guard like
+   * `{ field: "count", operator: "lt", value: max }` only mutates the row while
+   * it still satisfies the predicate.
+   *
+   * Backs better-auth's durable (`storage: "database"`) rate limiter, whose
+   * counter rides these tables. Implementing it natively — one statement that
+   * guards, increments, and returns — gives the **one-winner-across-isolates**
+   * guarantee the read-then-update fallback cannot: on Workers two concurrent
+   * requests would otherwise both read `count=4` and both write `5`, letting a
+   * `max` of 5 pass 6+. Same race-closing rationale as {@link AuthStore.consumeOne}.
+   */
   incrementOne: (model: string, where: ReadonlyArray<AuthWhereClause>, increment: Record<string, number>, set?: AuthRow) => Promise<AuthRow | undefined>;
   /** Read rows from `model` honouring the filter/sort/window in `query`. */
   read: (model: string, query: AuthQuery) => Promise<AuthRow[]>;
@@ -69,16 +69,34 @@ interface AuthStore {
   update: (model: string, where: ReadonlyArray<AuthWhereClause>, values: AuthRow) => Promise<AuthRow[]>;
 }
 /**
-* Evaluate a better-auth where clause list against a row. Clauses fold
-* left-to-right by their `connector` (`AND` by default, `OR` when set) — the
-* same precedence better-auth's own adapters use. An empty list matches every
-* row. Exported so any in-memory-style {@link AuthStore} can reuse it.
-*/
+ * Evaluate a better-auth where clause list against a row.
+ *
+ * better-auth hands an adapter a FLAT list in which each clause carries its own
+ * `connector` (`AND` by default). Every persistent adapter it ships resolves that
+ * by PARTITIONING: `AND(and-clauses) AND OR(or-clauses)`. The OR clauses are
+ * alternatives among themselves, never an escape hatch from the AND clauses —
+ * `@better-auth/kysely-adapter` pushes each group into its own `.where()` (two
+ * `.where()` calls are ANDed), `@better-auth/drizzle-adapter` ends in
+ * `and(andClause, orClause)`, and `@better-auth/prisma-adapter` emits
+ * `{ AND: […], OR: […] }`, which Prisma also ANDs.
+ *
+ * This used to fold the list left-associatively instead, so `[A, B(OR), C(OR)]`
+ * meant `A OR B OR C` — strictly BROADER than any of them. On a credential lookup
+ * that is an authentication bypass in shape: a row failing the primary condition
+ * is still returned because a secondary one matched. `@better-auth/memory-adapter`
+ * does fold left, but it is the only one and it re-evaluates `where[0]` inside the
+ * same loop; the persistent adapters are the contract worth mirroring, and they
+ * are also what a plugin author will have tested against.
+ *
+ * An empty list matches every row, and a list with no OR clause is unaffected —
+ * which is every clause list better-auth 1.7.1 itself builds. Exported so any
+ * in-memory-style {@link AuthStore} can reuse it.
+ */
 declare const matchesWhere: (row: AuthRow, where: ReadonlyArray<AuthWhereClause>) => boolean;
 /**
-* Reference in-memory {@link AuthStore} — used to run better-auth end to end in
-* tests, and a worked example of the contract a Lunora-`ctx.db`-backed store
-* fulfils. Not for production (state is per-instance and non-durable).
-*/
+ * Reference in-memory {@link AuthStore} — used to run better-auth end to end in
+ * tests, and a worked example of the contract a Lunora-`ctx.db`-backed store
+ * fulfils. Not for production (state is per-instance and non-durable).
+ */
 declare const createMemoryAuthStore: () => AuthStore;
 export { AuthQuery, type AuthRow, AuthStore, type AuthWhereClause, createMemoryAuthStore, matchesWhere };

package/dist/store.d.ts

@@ -2,10 +2,10 @@ import { CustomAdapter } from 'better-auth/adapters';
 /** A stored auth row — an opaque bag of columns keyed by better-auth field name. */
 type AuthRow = Record<string, unknown>;
 /**
-* One normalized better-auth where clause. Derived from {@link CustomAdapter}'s
-* own method signature (rather than re-declared) so a better-auth change to the
-* clause shape surfaces as a compile error here, not a silent mis-match.
-*/
+ * One normalized better-auth where clause. Derived from {@link CustomAdapter}'s
+ * own method signature (rather than re-declared) so a better-auth change to the
+ * clause shape surfaces as a compile error here, not a silent mis-match.
+ */
 type AuthWhereClause = NonNullable<Parameters<CustomAdapter["findOne"]>[0]["where"]>[number];
 /** Read query handed to {@link AuthStore.read}: a where filter plus optional sort/window. */
 interface AuthQuery {
@@ -18,48 +18,48 @@ interface AuthQuery {
   where: ReadonlyArray<AuthWhereClause>;
 }
 /**
-* The minimal table-addressed store the `lunoraAuthAdapter` drives. This is the
-* seam a Lunora runtime binds to its ORM: back each method with `ctx.db` over
-* the global (D1) auth tables that `authTables(...)` generates, and better-auth's
-* reads/writes flow through Lunora's data layer (triggers, aggregates, OCC)
-* instead of better-auth's own adapter. Field names and table (`model`) names are
-* already the database names better-auth resolved from the schema, so a store
-* passes them straight through.
-*
-* {@link createMemoryAuthStore} is a reference in-memory implementation (also
-* what the tests run better-auth against); `createSqlAuthStore` is the SQL one.
-*/
+ * The minimal table-addressed store the `lunoraAuthAdapter` drives. This is the
+ * seam a Lunora runtime binds to its ORM: back each method with `ctx.db` over
+ * the global (D1) auth tables that `authTables(...)` generates, and better-auth's
+ * reads/writes flow through Lunora's data layer (triggers, aggregates, OCC)
+ * instead of better-auth's own adapter. Field names and table (`model`) names are
+ * already the database names better-auth resolved from the schema, so a store
+ * passes them straight through.
+ *
+ * {@link createMemoryAuthStore} is a reference in-memory implementation (also
+ * what the tests run better-auth against); `createSqlAuthStore` is the SQL one.
+ */
 interface AuthStore {
   /**
-  * Atomically delete **at most one** row in `model` matching `where` and
-  * return it (or `undefined` if none matched). Backs better-auth's
-  * single-use-token consume (OTP / magic-link / email-verification /
-  * password-reset): implementing it natively — one round trip that finds and
-  * deletes in a single statement — closes the read-then-delete race the
-  * factory's `findMany` + `deleteMany` fallback would otherwise leave open.
-  */
+   * Atomically delete **at most one** row in `model` matching `where` and
+   * return it (or `undefined` if none matched). Backs better-auth's
+   * single-use-token consume (OTP / magic-link / email-verification /
+   * password-reset): implementing it natively — one round trip that finds and
+   * deletes in a single statement — closes the read-then-delete race the
+   * factory's `findMany` + `deleteMany` fallback would otherwise leave open.
+   */
   consumeOne: (model: string, where: ReadonlyArray<AuthWhereClause>) => Promise<AuthRow | undefined>;
   /** Count rows in `model` matching `where` (empty `where` = all rows). */
   count: (model: string, where: ReadonlyArray<AuthWhereClause>) => Promise<number>;
   /** Insert `data` into `model`; return the stored row (the adapter pre-fills `id`). */
   create: (model: string, data: AuthRow) => Promise<AuthRow>;
   /**
-  * Atomically apply signed numeric deltas to **at most one** row in `model`
-  * matching `where`, then return the updated row (or `undefined` if the guard
-  * matched none). For each `increment` entry it applies `field = field + delta`
-  * (a negative delta decrements); the optional `set` map assigns absolute
-  * values in the same step. The `where` clause is both selector **and** guard
-  * — comparison operators are honoured, so a guard like
-  * `{ field: "count", operator: "lt", value: max }` only mutates the row while
-  * it still satisfies the predicate.
-  *
-  * Backs better-auth's durable (`storage: "database"`) rate limiter, whose
-  * counter rides these tables. Implementing it natively — one statement that
-  * guards, increments, and returns — gives the **one-winner-across-isolates**
-  * guarantee the read-then-update fallback cannot: on Workers two concurrent
-  * requests would otherwise both read `count=4` and both write `5`, letting a
-  * `max` of 5 pass 6+. Same race-closing rationale as {@link AuthStore.consumeOne}.
-  */
+   * Atomically apply signed numeric deltas to **at most one** row in `model`
+   * matching `where`, then return the updated row (or `undefined` if the guard
+   * matched none). For each `increment` entry it applies `field = field + delta`
+   * (a negative delta decrements); the optional `set` map assigns absolute
+   * values in the same step. The `where` clause is both selector **and** guard
+   * — comparison operators are honoured, so a guard like
+   * `{ field: "count", operator: "lt", value: max }` only mutates the row while
+   * it still satisfies the predicate.
+   *
+   * Backs better-auth's durable (`storage: "database"`) rate limiter, whose
+   * counter rides these tables. Implementing it natively — one statement that
+   * guards, increments, and returns — gives the **one-winner-across-isolates**
+   * guarantee the read-then-update fallback cannot: on Workers two concurrent
+   * requests would otherwise both read `count=4` and both write `5`, letting a
+   * `max` of 5 pass 6+. Same race-closing rationale as {@link AuthStore.consumeOne}.
+   */
   incrementOne: (model: string, where: ReadonlyArray<AuthWhereClause>, increment: Record<string, number>, set?: AuthRow) => Promise<AuthRow | undefined>;
   /** Read rows from `model` honouring the filter/sort/window in `query`. */
   read: (model: string, query: AuthQuery) => Promise<AuthRow[]>;
@@ -69,16 +69,34 @@ interface AuthStore {
   update: (model: string, where: ReadonlyArray<AuthWhereClause>, values: AuthRow) => Promise<AuthRow[]>;
 }
 /**
-* Evaluate a better-auth where clause list against a row. Clauses fold
-* left-to-right by their `connector` (`AND` by default, `OR` when set) — the
-* same precedence better-auth's own adapters use. An empty list matches every
-* row. Exported so any in-memory-style {@link AuthStore} can reuse it.
-*/
+ * Evaluate a better-auth where clause list against a row.
+ *
+ * better-auth hands an adapter a FLAT list in which each clause carries its own
+ * `connector` (`AND` by default). Every persistent adapter it ships resolves that
+ * by PARTITIONING: `AND(and-clauses) AND OR(or-clauses)`. The OR clauses are
+ * alternatives among themselves, never an escape hatch from the AND clauses —
+ * `@better-auth/kysely-adapter` pushes each group into its own `.where()` (two
+ * `.where()` calls are ANDed), `@better-auth/drizzle-adapter` ends in
+ * `and(andClause, orClause)`, and `@better-auth/prisma-adapter` emits
+ * `{ AND: […], OR: […] }`, which Prisma also ANDs.
+ *
+ * This used to fold the list left-associatively instead, so `[A, B(OR), C(OR)]`
+ * meant `A OR B OR C` — strictly BROADER than any of them. On a credential lookup
+ * that is an authentication bypass in shape: a row failing the primary condition
+ * is still returned because a secondary one matched. `@better-auth/memory-adapter`
+ * does fold left, but it is the only one and it re-evaluates `where[0]` inside the
+ * same loop; the persistent adapters are the contract worth mirroring, and they
+ * are also what a plugin author will have tested against.
+ *
+ * An empty list matches every row, and a list with no OR clause is unaffected —
+ * which is every clause list better-auth 1.7.1 itself builds. Exported so any
+ * in-memory-style {@link AuthStore} can reuse it.
+ */
 declare const matchesWhere: (row: AuthRow, where: ReadonlyArray<AuthWhereClause>) => boolean;
 /**
-* Reference in-memory {@link AuthStore} — used to run better-auth end to end in
-* tests, and a worked example of the contract a Lunora-`ctx.db`-backed store
-* fulfils. Not for production (state is per-instance and non-durable).
-*/
+ * Reference in-memory {@link AuthStore} — used to run better-auth end to end in
+ * tests, and a worked example of the contract a Lunora-`ctx.db`-backed store
+ * fulfils. Not for production (state is per-instance and non-durable).
+ */
 declare const createMemoryAuthStore: () => AuthStore;
 export { AuthQuery, type AuthRow, AuthStore, type AuthWhereClause, createMemoryAuthStore, matchesWhere };