@lunora/auth 1.0.0-alpha.14 → 1.0.0-alpha.140

package/dist/packem_shared/invite-only.d-DKyHHkkQ.d.mts

@@ -0,0 +1,126 @@
+import { BetterAuthPlugin } from 'better-auth';
+import { L as LunoraAuth } from "./create-auth.d-D1CKOFWc.mjs";
+/** One pending or spent sign-up invitation. */
+interface SignUpInvitation {
+  /** When an account was created for this address; `null` while the invitation is unspent. */
+  acceptedAt: Date | null;
+  createdAt: Date;
+  /** The invited address, lowercased — the only thing an invitation is matched on. */
+  email: string;
+  expiresAt: Date;
+  id: string;
+  /** Free-form attribution (a user id, an operator name); never read by the gate. */
+  invitedBy: null | string;
+}
+/**
+ * What {@link createSignUpInvitation} hands back: the stored row plus the one
+ * and only sight of the plaintext `token`. Nothing reads it back afterwards —
+ * the database holds a SHA-256 of it — so an invitation link that is lost is
+ * reissued, not recovered.
+ */
+interface IssuedSignUpInvitation extends SignUpInvitation {
+  /** Put this in the sign-up link as `?invite=…`. Never stored, never logged, never listed. */
+  token: string;
+}
+/** Options for {@link inviteOnly}. */
+interface InviteOnlyOptions {
+  /**
+   * Let the very first account through uninvited, so a fresh deployment can be
+   * bootstrapped without seeding a row.
+   *
+   * **Off by default.** The check is "the `user` table is empty", which two
+   * concurrent sign-ups can both observe, and the window it opens is the gap
+   * between deploying and the owner signing up — whoever finds the URL first
+   * gets an account on a deployment whose whole point is that nobody does. Seed
+   * the first invitation with {@link createSignUpInvitation} instead (a one-off
+   * call at worker init, or an internal mutation you run once).
+   * @default false
+   */
+  allowFirstUser?: boolean;
+}
+/**
+ * A better-auth server plugin that refuses to create an account for an address
+ * with no unspent invitation, and the `signUpInvitation` table those live in.
+ *
+ * Issue invitations with {@link createSignUpInvitation}; there is no HTTP
+ * endpoint for it on purpose. Who counts as an administrator is your
+ * application's question — call it from a mutation you already authorize, the
+ * same trust model `createAuthAdmin` documents.
+ *
+ * The return type is better-auth's own `BetterAuthPlugin` rather than the
+ * precise shape of the schema map, for the reason `./ui-config.ts` spells out:
+ * an anonymous inferred type is the difference between a build that emits
+ * declarations and one that fails in the bundler alone.
+ */
+declare const inviteOnly: (options?: InviteOnlyOptions) => BetterAuthPlugin;
+/**
+ * Invite `email` to sign up, or refresh an existing invitation for it.
+ *
+ * Re-inviting an address updates the row in place — a new expiry, and `acceptedAt`
+ * cleared — because `email` is unique. That is also how you re-open a seat after
+ * deleting the account that took it.
+ *
+ * This is a trusted server-side call with no authorization of its own; gate it
+ * the way you gate any other administrative action. Delivering the invitation is
+ * yours too: nothing here sends mail, so the returned row is the whole handoff.
+ *
+ * Nothing prunes the table — a spent or expired row stays until you delete it with
+ * {@link revokeSignUpInvitation}, which is also what keeps it a record of who was
+ * let in.
+ *
+ * Each call mints a **new token** and returns it in the clear, once. Only its
+ * SHA-256 is stored, so re-inviting an address invalidates the previous link, and
+ * a link that was never delivered is reissued rather than looked up.
+ */
+declare const createSignUpInvitation: (auth: LunoraAuth, input: {
+  email: string;
+  expiresInSeconds?: number;
+  invitedBy?: string;
+}) => Promise<IssuedSignUpInvitation>;
+/**
+ * The most recent invitations, newest first, up to a fixed ceiling of
+ * {@link MAX_LISTED}. `pendingOnly` drops the spent and the expired, which is the
+ * list an operator usually wants; the unfiltered form doubles as the record of who
+ * was let in.
+ *
+ * Deliberately not paged. "Pending" is two conditions, one of them a comparison
+ * against `now`, and filtering those after a page would let page 1 come back empty
+ * while pending invitations sat on page 2. An operator list that outgrows the
+ * ceiling wants a query against the `signUpInvitation` table, not an offset.
+ */
+declare const listSignUpInvitations: (auth: LunoraAuth, options?: {
+  pendingOnly?: boolean;
+}) => Promise<SignUpInvitation[]>;
+/**
+ * Withdraw the invitation for `email`. Deletes the row, so it also forgets a spent
+ * one — the account it created is untouched, and removing that is
+ * `AuthAdmin.removeUser`'s job.
+ *
+ * Not retroactive, and not atomic against a sign-up already in flight: better-auth
+ * creates the user without wrapping the `before` hook and the insert in one
+ * transaction, so a revoke landing between the two lets that one account through.
+ * There is no conditional consume in the adapter contract to close it with. Treat
+ * revocation as "no further sign-ups", and `AuthAdmin.removeUser` as the way to
+ * undo one that already happened.
+ */
+declare const revokeSignUpInvitation: (auth: LunoraAuth, input: {
+  email: string;
+}) => Promise<void>;
+/**
+ * Delete invitations that expired without being used, and report how many went.
+ *
+ * Only the dead ones: a spent invitation is the record of who was let in, and an
+ * unexpired one is still live, so both stay. Nothing calls this for you — an app
+ * that invites at any volume should put it on a cron; one that doesn't can leave
+ * the rows.
+ *
+ * Bounded by `limit` and therefore incremental: a backlog larger than one pass
+ * takes several. It reads a page and deletes row by row rather than issuing one
+ * ranged `deleteMany`, because a `lt` comparison against a `date` column is the
+ * kind of thing that behaves differently on each of the three adapters this
+ * package ships, and a prune job is not where that should be discovered.
+ */
+declare const pruneSignUpInvitations: (auth: LunoraAuth, options?: {
+  limit?: number;
+}) => Promise<number>;
+export { InviteOnlyOptions as I, SignUpInvitation as S, IssuedSignUpInvitation as a, createSignUpInvitation as c, inviteOnly as i, listSignUpInvitations as l, pruneSignUpInvitations as p, revokeSignUpInvitation as r };

package/dist/packem_shared/legacyIssuerCleanupStatements-D9Kf8OD1.mjs

@@ -0,0 +1 @@
+import{q as r}from"./quote-identifier-CGiYFBvY.mjs";const i="issuer",c=new RegExp(String.raw`\b${i}\b`,"iu"),u=e=>{const s=e.indexOf("(");if(s===-1)return"";let n=0;for(let t=s;t<e.length;t+=1){const o=e[t];if(o==="(")n+=1;else if(o===")"&&(n-=1,n===0))return e.slice(s+1,t)}return""},f=e=>[...e].includes(i),p=e=>[...e].filter(s=>c.test(u(s.sql??""))).map(s=>s.name),l=(e="account",s=[])=>[...[...s].map(n=>`DROP INDEX IF EXISTS ${r(n)}`),`ALTER TABLE ${r(e)} DROP COLUMN ${r(i)}`];export{p as indexesReferencingIssuer,l as legacyIssuerCleanupStatements,f as schemaDeclaresIssuer};

package/dist/packem_shared/on-cloudflare-edge-Dx6gFjBO.mjs

@@ -0,0 +1 @@
+const o=()=>globalThis.navigator?.userAgent==="Cloudflare-Workers";export{o};

package/dist/packem_shared/quote-identifier-CGiYFBvY.mjs

@@ -0,0 +1 @@
+const t=e=>`"${e.replaceAll('"','""')}"`;export{t as q};

package/dist/packem_shared/sessionPresets-C867Mlo4.mjs

@@ -0,0 +1 @@
+const t=n=>{const o=["expiresIn","updateAge","freshAge"];for(const s of o){const e=n[s];if(e!==void 0&&(typeof e!="number"||!Number.isFinite(e)||e<0))throw new TypeError(`@lunora/auth: \`session.${s}\` must be a non-negative, finite number of seconds`)}return n},i={longLived:{cookieCache:{enabled:!0,maxAge:60},expiresIn:2592e3,freshAge:86400,updateAge:86400},rolling:{cookieCache:{enabled:!0,maxAge:60},expiresIn:604800,freshAge:86400,updateAge:86400},strict:{cookieCache:{enabled:!1},expiresIn:3600,freshAge:300,updateAge:900}};export{i as sessionPresets,t as validateSessionPolicy};

package/dist/packem_shared/sql-store-CYa4HJsO.mjs

@@ -0,0 +1 @@
+const T="_creationTime",l=s=>`"${s.replaceAll('"','""')}"`,N=/no such column|column .{0,64}? does not exist/iu,g={params:[],sql:"0"},R=(s,r)=>r?{column:`LOWER(${s})`,placeholder:"LOWER(?)"}:{column:s,placeholder:"?"},M=(s,r,a,c)=>{if(typeof r!="string")return g;const t=R(s,c);return a==="contains"?{params:[r],sql:`instr(${t.column}, ${t.placeholder}) > 0`}:a==="starts_with"?{params:[r],sql:`instr(${t.column}, ${t.placeholder}) = 1`}:{params:[r,r],sql:`substr(${t.column}, -length(?)) = ${t.placeholder}`}},h=(s,r,a,c)=>{if(r===null)return{params:[],sql:`${s} IS ${c?"NOT ":""}NULL`};const t=R(s,a),n=c?"<>":"=";return{params:[r],sql:`${t.column} ${n} ${t.placeholder}`}},O=(s,r,a,c)=>{const t=Array.isArray(r)?r:[];if(t.length===0)return{params:[],sql:a?"1":"0"};const n=R(s,c),e=t.map(()=>n.placeholder).join(", ");return{params:[...t],sql:`${n.column} ${a?"NOT IN":"IN"} (${e})`}},L=s=>{const r=l(s.field),{mode:a,operator:c,value:t}=s,n=a==="insensitive";switch(c){case"contains":case"ends_with":case"starts_with":return M(r,t,c,n);case"gt":return{params:[t],sql:`${r} > ?`};case"gte":return{params:[t],sql:`${r} >= ?`};case"in":return O(r,t,!1,n);case"lt":return{params:[t],sql:`${r} < ?`};case"lte":return{params:[t],sql:`${r} <= ?`};case"ne":return h(r,t,n,!0);case"not_in":return O(r,t,!0,n);default:return h(r,t,n,!1)}},d=(s,r)=>{if(s.length===0)return;const a=s.map(c=>L(c));return{params:a.flatMap(c=>c.params),sql:a.map(c=>`(${c.sql})`).join(` ${r} `)}},E=s=>{const r=[d(s.filter(a=>a.connector!=="OR"),"AND"),d(s.filter(a=>a.connector==="OR"),"OR")].filter(a=>a!==void 0);return r.length===0?{params:[],sql:""}:{params:r.flatMap(a=>a.params),sql:r.map(a=>`(${a.sql})`).join(" AND ")}},$=s=>s.sql?` WHERE ${s.sql}`:"",S=s=>{const r=(t,n)=>{const e=E(n);return s.all(`SELECT * FROM ${l(t)}${$(e)}`,e.params)},a=new Map,c=async t=>{const n=a.get(t);if(n!==void 0)return n;try{await s.all(`SELECT ${l(t)}.${l(T)} FROM ${l(t)} LIMIT 0`,[])}catch(e){return N.test(e instanceof Error?e.message:String(e))&&a.set(t,!1),!1}return a.set(t,!0),!0};return{consumeOne:async(t,n)=>{const e=E(n),o=l(t),[i]=await s.all(`DELETE FROM ${o} WHERE rowid IN (SELECT rowid FROM ${o}${$(e)} LIMIT 1) RETURNING *`,e.params);return i},count:async(t,n)=>{const e=E(n),[o]=await s.all(`SELECT COUNT(*) AS __count FROM ${l(t)}${$(e)}`,e.params);return Number(o?.__count??0)},create:async(t,n)=>{const e=T in n||!await c(t)?n:{[T]:Date.now(),...n},o=Object.keys(e),i=o.map(()=>"?").join(", "),u=`INSERT INTO ${l(t)} (${o.map(m=>l(m)).join(", ")}) VALUES (${i})`;return await s.run(u,o.map(m=>e[m])),{...n}},incrementOne:async(t,n,e,o)=>{const i=l(t),u=Object.keys(e),m=o?Object.keys(o):[],f=E(n);if(u.length===0&&m.length===0){const[p]=await s.all(`SELECT * FROM ${i}${$(f)} LIMIT 1`,f.params);return p}const I=[...u.map(p=>`${l(p)} = COALESCE(${l(p)}, 0) + ?`),...m.map(p=>`${l(p)} = ?`)].join(", "),[w]=await s.all(`UPDATE ${i} SET ${I} WHERE rowid IN (SELECT rowid FROM ${i}${$(f)} LIMIT 1) RETURNING *`,[...u.map(p=>e[p]),...m.map(p=>o[p]),...f.params]);return w},read:async(t,n)=>{const e=E(n.where),o=[...e.params];let i=`SELECT * FROM ${l(t)}${$(e)}`;return n.sortBy&&(i+=` ORDER BY ${l(n.sortBy.field)} ${n.sortBy.direction==="asc"?"ASC":"DESC"}`),n.limit!==void 0&&(i+=" LIMIT ?",o.push(Math.trunc(n.limit))),n.offset&&(i+=`${n.limit===void 0?" LIMIT -1":""} OFFSET ?`,o.push(Math.trunc(n.offset))),s.all(i,o)},remove:async(t,n)=>{const e=E(n);return(await s.all(`DELETE FROM ${l(t)}${$(e)} RETURNING *`,e.params)).length},update:async(t,n,e)=>{const o=Object.keys(e);if(o.length===0)return r(t,n);const i=o.map(m=>`${l(m)} = ?`).join(", "),u=E(n);return s.all(`UPDATE ${l(t)} SET ${i}${$(u)} RETURNING *`,[...o.map(m=>e[m]),...u.params])}}},C=s=>({all:async(r,a)=>(await s.prepare(r).bind(...a).all()).results??[],run:async(r,a)=>{await s.prepare(r).bind(...a).run()}});export{T as C,S as c,C as d};

package/dist/packem_shared/uiConfig-B8pN6pks.mjs

@@ -0,0 +1 @@
+import{createAuthEndpoint as c}from"better-auth/api";import{getAuthTables as g}from"better-auth/db";const l=e=>[...e].toSorted((o,i)=>o.localeCompare(i)),m=(e,o={})=>{const i=o.expose??{},a=new Set((e.plugins??[]).map(t=>t.id)),r=e.emailAndPassword?.enabled??!1,s=g(e),n=(e.plugins??[]).find(t=>t.id==="organization")?.options??{},d={allowUserToCreate:typeof n.allowUserToCreateOrganization=="function"?!0:n.allowUserToCreateOrganization!==!1,enabled:a.has("organization"),invitationLimit:n.invitationLimit,limit:n.organizationLimit,membershipLimit:n.membershipLimit,roles:!!s.organizationRole,teams:!!s.team};return{emailAndPassword:r,signUp:r&&e.emailAndPassword?.disableSignUp!==!0,...i.organization===!1?{}:{organization:d},...i.plugins===!1?{}:{plugins:l(a)},...i.socialProviders===!1?{}:{socialProviders:l(new Set([...Object.keys(e.socialProviders??{}),...o.extraProviders??[]]))}}},p=e=>c(e.path??"/ui-config",{metadata:{openapi:{description:"Public description of the enabled auth plugins and social providers.",responses:{200:{description:"The UI configuration."}}}},method:"GET"},o=>{const i=o;return Promise.resolve(i.json(m(i.context.options,e)))}),h=(e={})=>({endpoints:{getUiConfig:p(e)},id:"lunora-ui-config"});export{m as deriveUiConfig,h as uiConfig};

package/dist/plugins-client.d.mts

@@ -1,2 +1,166 @@
+import { organizationClient } from 'better-auth/client/plugins';
+export { adminClient, anonymousClient, customSessionClient, deviceAuthorizationClient, emailOTPClient, inferAdditionalFields, inferOrgAdditionalFields, jwtClient, lastLoginMethodClient, magicLinkClient, multiSessionClient, oneTapClient, oneTimeTokenClient, organizationClient, phoneNumberClient, siweClient, twoFactorClient, usernameClient } from 'better-auth/client/plugins';
+export { apiKeyClient } from '@better-auth/api-key/client';
+export { oauthDeviceAuthorizationClient, oauthProviderClient } from '@better-auth/oauth-provider/client';
 export { passkeyClient } from '@better-auth/passkey/client';
-export { adminClient, anonymousClient, customSessionClient, deviceAuthorizationClient, emailOTPClient, genericOAuthClient, inferAdditionalFields, inferOrgAdditionalFields, jwtClient, lastLoginMethodClient, magicLinkClient, multiSessionClient, oidcClient, oneTimeTokenClient, organizationClient, phoneNumberClient, siweClient, twoFactorClient, usernameClient } from 'better-auth/client/plugins';
+/**
+ * Which client plugins to include. Each defaults to `false`.
+ *
+ * These are the same names `@lunora/auth-ui` gates its cards on, so one object
+ * can drive both `createLunoraAuthClient` and `registerAuthClientPlugins` — a
+ * flow the UI can show but this cannot install would be a card that renders and
+ * then fails at call time.
+ *
+ * `oneTap` is absent on purpose: Google One Tap needs a client id, not a
+ * boolean, so it comes in through {@link CreateLunoraAuthClientOptions.oneTapClientId}.
+ */
+interface LunoraAuthPluginToggles {
+  admin?: boolean;
+  anonymous?: boolean;
+  deviceAuthorization?: boolean;
+  emailOtp?: boolean;
+  lastLoginMethod?: boolean;
+  magicLink?: boolean;
+  multiSession?: boolean;
+  oauthProvider?: boolean;
+  organization?: boolean;
+  passkey?: boolean;
+  phoneNumber?: boolean;
+  twoFactor?: boolean;
+  username?: boolean;
+}
+type LunoraAuthClientPlugin = ReturnType<typeof organizationClient>;
+declare const lunoraAuthPlugins: (toggles?: LunoraAuthPluginToggles) => LunoraAuthClientPlugin[];
+/** Options for {@link createLunoraAuthClient}; anything else is forwarded to `createAuthClient`. */
+interface CreateLunoraAuthClientOptions {
+  [option: string]: unknown;
+  /** Defaults to the current origin, which is right for a same-origin app. */
+  baseURL?: string;
+  /** Your own client plugins, appended after the standard set. */
+  extraPlugins?: LunoraAuthClientPlugin[];
+  /**
+   * Google OAuth client id. Setting it installs the One Tap client plugin —
+   * a boolean toggle can't, because the prompt is Google's and needs the id.
+   */
+  oneTapClientId?: string;
+  /** Which standard client plugins to include. */
+  plugins?: LunoraAuthPluginToggles;
+}
+/**
+ * Build a better-auth client with Lunora's standard plugin set from toggles.
+ *
+ * You pass your framework's `createAuthClient` in — `better-auth/react`,
+ * `/vue`, `/svelte`, or `/solid` — because the variant has to match the UI
+ * framework, and a helper that picked for you would either guess wrong or drag
+ * every variant into your bundle.
+ *
+ * ```ts
+ * import { createAuthClient } from "better-auth/react";
+ * import { createLunoraAuthClient } from "@lunora/auth/plugins/client";
+ *
+ * export const authClient = createLunoraAuthClient(createAuthClient, {
+ *     plugins: { organization: true, passkey: true, twoFactor: true },
+ * });
+ * ```
+ *
+ * Reach for {@link lunoraAuthPlugins} instead when you want to own the
+ * `createAuthClient` call and only borrow the plugin array.
+ */
+declare const createLunoraAuthClient: <TClient>(createAuthClient: (options: Record<string, unknown>) => TClient, options?: CreateLunoraAuthClientOptions) => TClient;
+export {
+/**
+ * Client-side counterparts to the server plugins re-exported from
+ * `@lunora/auth/plugins`, surfaced under `@lunora/auth/plugins/client`.
+ *
+ * better-auth plugins come in two halves: a **server** plugin you pass to
+ * `betterAuth()` (re-exported from `@lunora/auth/plugins`) and a **client**
+ * plugin you pass to `createAuthClient()`. Both halves must be registered for a
+ * plugin's endpoints, inferred types, and client actions (e.g.
+ * `authClient.twoFactor.*`, `authClient.organization.*`, the `twoFactorRedirect`
+ * sign-in flow) to exist. This module is the client half so consumers don't have
+ * to reach into better-auth's `better-auth/client/plugins` subpath directly.
+ *
+ * # Wiring
+ *
+ * ```ts
+ * import { createAuthClient } from "better-auth/client"; // or a framework adapter
+ * import { organizationClient, twoFactorClient } from "@lunora/auth/plugins/client";
+ *
+ * export const authClient = createAuthClient({
+ *     baseURL: import.meta.env.VITE_AUTH_URL,
+ *     plugins: [
+ *         organizationClient(),
+ *         twoFactorClient({ onTwoFactorRedirect: () => location.assign("/2fa") }),
+ *     ],
+ * });
+ * ```
+ *
+ * Keep the client plugin list in parity with the server `plugins` array passed
+ * to `createAuth`: a server plugin without its client counterpart leaves
+ * those actions untyped/unavailable, and vice-versa.
+ */
+type CreateLunoraAuthClientOptions,
+/**
+ * Client-side counterparts to the server plugins re-exported from
+ * `@lunora/auth/plugins`, surfaced under `@lunora/auth/plugins/client`.
+ *
+ * better-auth plugins come in two halves: a **server** plugin you pass to
+ * `betterAuth()` (re-exported from `@lunora/auth/plugins`) and a **client**
+ * plugin you pass to `createAuthClient()`. Both halves must be registered for a
+ * plugin's endpoints, inferred types, and client actions (e.g.
+ * `authClient.twoFactor.*`, `authClient.organization.*`, the `twoFactorRedirect`
+ * sign-in flow) to exist. This module is the client half so consumers don't have
+ * to reach into better-auth's `better-auth/client/plugins` subpath directly.
+ *
+ * # Wiring
+ *
+ * ```ts
+ * import { createAuthClient } from "better-auth/client"; // or a framework adapter
+ * import { organizationClient, twoFactorClient } from "@lunora/auth/plugins/client";
+ *
+ * export const authClient = createAuthClient({
+ *     baseURL: import.meta.env.VITE_AUTH_URL,
+ *     plugins: [
+ *         organizationClient(),
+ *         twoFactorClient({ onTwoFactorRedirect: () => location.assign("/2fa") }),
+ *     ],
+ * });
+ * ```
+ *
+ * Keep the client plugin list in parity with the server `plugins` array passed
+ * to `createAuth`: a server plugin without its client counterpart leaves
+ * those actions untyped/unavailable, and vice-versa.
+ */
+type LunoraAuthClientPlugin,
+/**
+ * Client-side counterparts to the server plugins re-exported from
+ * `@lunora/auth/plugins`, surfaced under `@lunora/auth/plugins/client`.
+ *
+ * better-auth plugins come in two halves: a **server** plugin you pass to
+ * `betterAuth()` (re-exported from `@lunora/auth/plugins`) and a **client**
+ * plugin you pass to `createAuthClient()`. Both halves must be registered for a
+ * plugin's endpoints, inferred types, and client actions (e.g.
+ * `authClient.twoFactor.*`, `authClient.organization.*`, the `twoFactorRedirect`
+ * sign-in flow) to exist. This module is the client half so consumers don't have
+ * to reach into better-auth's `better-auth/client/plugins` subpath directly.
+ *
+ * # Wiring
+ *
+ * ```ts
+ * import { createAuthClient } from "better-auth/client"; // or a framework adapter
+ * import { organizationClient, twoFactorClient } from "@lunora/auth/plugins/client";
+ *
+ * export const authClient = createAuthClient({
+ *     baseURL: import.meta.env.VITE_AUTH_URL,
+ *     plugins: [
+ *         organizationClient(),
+ *         twoFactorClient({ onTwoFactorRedirect: () => location.assign("/2fa") }),
+ *     ],
+ * });
+ * ```
+ *
+ * Keep the client plugin list in parity with the server `plugins` array passed
+ * to `createAuth`: a server plugin without its client counterpart leaves
+ * those actions untyped/unavailable, and vice-versa.
+ */
+type LunoraAuthPluginToggles, createLunoraAuthClient, lunoraAuthPlugins };

package/dist/plugins-client.d.ts

@@ -1,2 +1,166 @@
+import { organizationClient } from 'better-auth/client/plugins';
+export { adminClient, anonymousClient, customSessionClient, deviceAuthorizationClient, emailOTPClient, inferAdditionalFields, inferOrgAdditionalFields, jwtClient, lastLoginMethodClient, magicLinkClient, multiSessionClient, oneTapClient, oneTimeTokenClient, organizationClient, phoneNumberClient, siweClient, twoFactorClient, usernameClient } from 'better-auth/client/plugins';
+export { apiKeyClient } from '@better-auth/api-key/client';
+export { oauthDeviceAuthorizationClient, oauthProviderClient } from '@better-auth/oauth-provider/client';
 export { passkeyClient } from '@better-auth/passkey/client';
-export { adminClient, anonymousClient, customSessionClient, deviceAuthorizationClient, emailOTPClient, genericOAuthClient, inferAdditionalFields, inferOrgAdditionalFields, jwtClient, lastLoginMethodClient, magicLinkClient, multiSessionClient, oidcClient, oneTimeTokenClient, organizationClient, phoneNumberClient, siweClient, twoFactorClient, usernameClient } from 'better-auth/client/plugins';
+/**
+ * Which client plugins to include. Each defaults to `false`.
+ *
+ * These are the same names `@lunora/auth-ui` gates its cards on, so one object
+ * can drive both `createLunoraAuthClient` and `registerAuthClientPlugins` — a
+ * flow the UI can show but this cannot install would be a card that renders and
+ * then fails at call time.
+ *
+ * `oneTap` is absent on purpose: Google One Tap needs a client id, not a
+ * boolean, so it comes in through {@link CreateLunoraAuthClientOptions.oneTapClientId}.
+ */
+interface LunoraAuthPluginToggles {
+  admin?: boolean;
+  anonymous?: boolean;
+  deviceAuthorization?: boolean;
+  emailOtp?: boolean;
+  lastLoginMethod?: boolean;
+  magicLink?: boolean;
+  multiSession?: boolean;
+  oauthProvider?: boolean;
+  organization?: boolean;
+  passkey?: boolean;
+  phoneNumber?: boolean;
+  twoFactor?: boolean;
+  username?: boolean;
+}
+type LunoraAuthClientPlugin = ReturnType<typeof organizationClient>;
+declare const lunoraAuthPlugins: (toggles?: LunoraAuthPluginToggles) => LunoraAuthClientPlugin[];
+/** Options for {@link createLunoraAuthClient}; anything else is forwarded to `createAuthClient`. */
+interface CreateLunoraAuthClientOptions {
+  [option: string]: unknown;
+  /** Defaults to the current origin, which is right for a same-origin app. */
+  baseURL?: string;
+  /** Your own client plugins, appended after the standard set. */
+  extraPlugins?: LunoraAuthClientPlugin[];
+  /**
+   * Google OAuth client id. Setting it installs the One Tap client plugin —
+   * a boolean toggle can't, because the prompt is Google's and needs the id.
+   */
+  oneTapClientId?: string;
+  /** Which standard client plugins to include. */
+  plugins?: LunoraAuthPluginToggles;
+}
+/**
+ * Build a better-auth client with Lunora's standard plugin set from toggles.
+ *
+ * You pass your framework's `createAuthClient` in — `better-auth/react`,
+ * `/vue`, `/svelte`, or `/solid` — because the variant has to match the UI
+ * framework, and a helper that picked for you would either guess wrong or drag
+ * every variant into your bundle.
+ *
+ * ```ts
+ * import { createAuthClient } from "better-auth/react";
+ * import { createLunoraAuthClient } from "@lunora/auth/plugins/client";
+ *
+ * export const authClient = createLunoraAuthClient(createAuthClient, {
+ *     plugins: { organization: true, passkey: true, twoFactor: true },
+ * });
+ * ```
+ *
+ * Reach for {@link lunoraAuthPlugins} instead when you want to own the
+ * `createAuthClient` call and only borrow the plugin array.
+ */
+declare const createLunoraAuthClient: <TClient>(createAuthClient: (options: Record<string, unknown>) => TClient, options?: CreateLunoraAuthClientOptions) => TClient;
+export {
+/**
+ * Client-side counterparts to the server plugins re-exported from
+ * `@lunora/auth/plugins`, surfaced under `@lunora/auth/plugins/client`.
+ *
+ * better-auth plugins come in two halves: a **server** plugin you pass to
+ * `betterAuth()` (re-exported from `@lunora/auth/plugins`) and a **client**
+ * plugin you pass to `createAuthClient()`. Both halves must be registered for a
+ * plugin's endpoints, inferred types, and client actions (e.g.
+ * `authClient.twoFactor.*`, `authClient.organization.*`, the `twoFactorRedirect`
+ * sign-in flow) to exist. This module is the client half so consumers don't have
+ * to reach into better-auth's `better-auth/client/plugins` subpath directly.
+ *
+ * # Wiring
+ *
+ * ```ts
+ * import { createAuthClient } from "better-auth/client"; // or a framework adapter
+ * import { organizationClient, twoFactorClient } from "@lunora/auth/plugins/client";
+ *
+ * export const authClient = createAuthClient({
+ *     baseURL: import.meta.env.VITE_AUTH_URL,
+ *     plugins: [
+ *         organizationClient(),
+ *         twoFactorClient({ onTwoFactorRedirect: () => location.assign("/2fa") }),
+ *     ],
+ * });
+ * ```
+ *
+ * Keep the client plugin list in parity with the server `plugins` array passed
+ * to `createAuth`: a server plugin without its client counterpart leaves
+ * those actions untyped/unavailable, and vice-versa.
+ */
+type CreateLunoraAuthClientOptions,
+/**
+ * Client-side counterparts to the server plugins re-exported from
+ * `@lunora/auth/plugins`, surfaced under `@lunora/auth/plugins/client`.
+ *
+ * better-auth plugins come in two halves: a **server** plugin you pass to
+ * `betterAuth()` (re-exported from `@lunora/auth/plugins`) and a **client**
+ * plugin you pass to `createAuthClient()`. Both halves must be registered for a
+ * plugin's endpoints, inferred types, and client actions (e.g.
+ * `authClient.twoFactor.*`, `authClient.organization.*`, the `twoFactorRedirect`
+ * sign-in flow) to exist. This module is the client half so consumers don't have
+ * to reach into better-auth's `better-auth/client/plugins` subpath directly.
+ *
+ * # Wiring
+ *
+ * ```ts
+ * import { createAuthClient } from "better-auth/client"; // or a framework adapter
+ * import { organizationClient, twoFactorClient } from "@lunora/auth/plugins/client";
+ *
+ * export const authClient = createAuthClient({
+ *     baseURL: import.meta.env.VITE_AUTH_URL,
+ *     plugins: [
+ *         organizationClient(),
+ *         twoFactorClient({ onTwoFactorRedirect: () => location.assign("/2fa") }),
+ *     ],
+ * });
+ * ```
+ *
+ * Keep the client plugin list in parity with the server `plugins` array passed
+ * to `createAuth`: a server plugin without its client counterpart leaves
+ * those actions untyped/unavailable, and vice-versa.
+ */
+type LunoraAuthClientPlugin,
+/**
+ * Client-side counterparts to the server plugins re-exported from
+ * `@lunora/auth/plugins`, surfaced under `@lunora/auth/plugins/client`.
+ *
+ * better-auth plugins come in two halves: a **server** plugin you pass to
+ * `betterAuth()` (re-exported from `@lunora/auth/plugins`) and a **client**
+ * plugin you pass to `createAuthClient()`. Both halves must be registered for a
+ * plugin's endpoints, inferred types, and client actions (e.g.
+ * `authClient.twoFactor.*`, `authClient.organization.*`, the `twoFactorRedirect`
+ * sign-in flow) to exist. This module is the client half so consumers don't have
+ * to reach into better-auth's `better-auth/client/plugins` subpath directly.
+ *
+ * # Wiring
+ *
+ * ```ts
+ * import { createAuthClient } from "better-auth/client"; // or a framework adapter
+ * import { organizationClient, twoFactorClient } from "@lunora/auth/plugins/client";
+ *
+ * export const authClient = createAuthClient({
+ *     baseURL: import.meta.env.VITE_AUTH_URL,
+ *     plugins: [
+ *         organizationClient(),
+ *         twoFactorClient({ onTwoFactorRedirect: () => location.assign("/2fa") }),
+ *     ],
+ * });
+ * ```
+ *
+ * Keep the client plugin list in parity with the server `plugins` array passed
+ * to `createAuth`: a server plugin without its client counterpart leaves
+ * those actions untyped/unavailable, and vice-versa.
+ */
+type LunoraAuthPluginToggles, createLunoraAuthClient, lunoraAuthPlugins };

package/dist/plugins-client.mjs

@@ -1,2 +1 @@
-export { passkeyClient } from '@better-auth/passkey/client';
-export { adminClient, anonymousClient, customSessionClient, deviceAuthorizationClient, emailOTPClient, genericOAuthClient, inferAdditionalFields, inferOrgAdditionalFields, jwtClient, lastLoginMethodClient, magicLinkClient, multiSessionClient, oidcClient, oneTimeTokenClient, organizationClient, phoneNumberClient, siweClient, twoFactorClient, usernameClient } from 'better-auth/client/plugins';
+import{createLunoraAuthClient as t,lunoraAuthPlugins as n}from"./packem_shared/createLunoraAuthClient-DhjhCwmM.mjs";import{apiKeyClient as l}from"@better-auth/api-key/client";import{oauthDeviceAuthorizationClient as a,oauthProviderClient as C}from"@better-auth/oauth-provider/client";import{passkeyClient as s}from"@better-auth/passkey/client";import{adminClient as d,anonymousClient as p,customSessionClient as h,deviceAuthorizationClient as f,emailOTPClient as c,inferAdditionalFields as A,inferOrgAdditionalFields as g,jwtClient as x,lastLoginMethodClient as T,magicLinkClient as k,multiSessionClient as v,oneTapClient as w,oneTimeTokenClient as y,organizationClient as z,phoneNumberClient as F,siweClient as L,twoFactorClient as P,usernameClient as O}from"better-auth/client/plugins";export{d as adminClient,p as anonymousClient,l as apiKeyClient,t as createLunoraAuthClient,h as customSessionClient,f as deviceAuthorizationClient,c as emailOTPClient,A as inferAdditionalFields,g as inferOrgAdditionalFields,x as jwtClient,T as lastLoginMethodClient,n as lunoraAuthPlugins,k as magicLinkClient,v as multiSessionClient,a as oauthDeviceAuthorizationClient,C as oauthProviderClient,w as oneTapClient,y as oneTimeTokenClient,z as organizationClient,s as passkeyClient,F as phoneNumberClient,L as siweClient,P as twoFactorClient,O as usernameClient};

package/dist/plugins-enterprise-client.d.mts

@@ -0,0 +1,15 @@
+import { ssoClient } from '@better-auth/sso/client';
+export type {
+/**
+ * Adds `authClient.signIn.sso({ email | domain | providerId })`. Registering the
+ * server `sso` plugin without this leaves those actions unavailable and untyped.
+ * @experimental
+ */
+ssoClient } from '@better-auth/sso/client';
+/**
+ * The plugin instance `ssoClient()` returns. Exported so an app can type the array it
+ * passes to `createAuthClient` when it assembles plugins conditionally.
+ * @experimental
+ */
+type SSOClientPlugin = ReturnType<typeof ssoClient>;
+export { SSOClientPlugin };

package/dist/plugins-enterprise-client.d.ts

@@ -0,0 +1,15 @@
+import { ssoClient } from '@better-auth/sso/client';
+export type {
+/**
+ * Adds `authClient.signIn.sso({ email | domain | providerId })`. Registering the
+ * server `sso` plugin without this leaves those actions unavailable and untyped.
+ * @experimental
+ */
+ssoClient } from '@better-auth/sso/client';
+/**
+ * The plugin instance `ssoClient()` returns. Exported so an app can type the array it
+ * passes to `createAuthClient` when it assembles plugins conditionally.
+ * @experimental
+ */
+type SSOClientPlugin = ReturnType<typeof ssoClient>;
+export { SSOClientPlugin };

package/dist/plugins-enterprise-client.mjs

@@ -0,0 +1 @@
+import{ssoClient as r}from"@better-auth/sso/client";export{r as ssoClient};