@lunora/auth 1.0.0-alpha.2 → 1.0.0-alpha.200

package/dist/packem_shared/invite-only.d-DKyHHkkQ.d.mts

@@ -0,0 +1,126 @@
+import { BetterAuthPlugin } from 'better-auth';
+import { L as LunoraAuth } from "./create-auth.d-D1CKOFWc.mjs";
+/** One pending or spent sign-up invitation. */
+interface SignUpInvitation {
+  /** When an account was created for this address; `null` while the invitation is unspent. */
+  acceptedAt: Date | null;
+  createdAt: Date;
+  /** The invited address, lowercased — the only thing an invitation is matched on. */
+  email: string;
+  expiresAt: Date;
+  id: string;
+  /** Free-form attribution (a user id, an operator name); never read by the gate. */
+  invitedBy: null | string;
+}
+/**
+ * What {@link createSignUpInvitation} hands back: the stored row plus the one
+ * and only sight of the plaintext `token`. Nothing reads it back afterwards —
+ * the database holds a SHA-256 of it — so an invitation link that is lost is
+ * reissued, not recovered.
+ */
+interface IssuedSignUpInvitation extends SignUpInvitation {
+  /** Put this in the sign-up link as `?invite=…`. Never stored, never logged, never listed. */
+  token: string;
+}
+/** Options for {@link inviteOnly}. */
+interface InviteOnlyOptions {
+  /**
+   * Let the very first account through uninvited, so a fresh deployment can be
+   * bootstrapped without seeding a row.
+   *
+   * **Off by default.** The check is "the `user` table is empty", which two
+   * concurrent sign-ups can both observe, and the window it opens is the gap
+   * between deploying and the owner signing up — whoever finds the URL first
+   * gets an account on a deployment whose whole point is that nobody does. Seed
+   * the first invitation with {@link createSignUpInvitation} instead (a one-off
+   * call at worker init, or an internal mutation you run once).
+   * @default false
+   */
+  allowFirstUser?: boolean;
+}
+/**
+ * A better-auth server plugin that refuses to create an account for an address
+ * with no unspent invitation, and the `signUpInvitation` table those live in.
+ *
+ * Issue invitations with {@link createSignUpInvitation}; there is no HTTP
+ * endpoint for it on purpose. Who counts as an administrator is your
+ * application's question — call it from a mutation you already authorize, the
+ * same trust model `createAuthAdmin` documents.
+ *
+ * The return type is better-auth's own `BetterAuthPlugin` rather than the
+ * precise shape of the schema map, for the reason `./ui-config.ts` spells out:
+ * an anonymous inferred type is the difference between a build that emits
+ * declarations and one that fails in the bundler alone.
+ */
+declare const inviteOnly: (options?: InviteOnlyOptions) => BetterAuthPlugin;
+/**
+ * Invite `email` to sign up, or refresh an existing invitation for it.
+ *
+ * Re-inviting an address updates the row in place — a new expiry, and `acceptedAt`
+ * cleared — because `email` is unique. That is also how you re-open a seat after
+ * deleting the account that took it.
+ *
+ * This is a trusted server-side call with no authorization of its own; gate it
+ * the way you gate any other administrative action. Delivering the invitation is
+ * yours too: nothing here sends mail, so the returned row is the whole handoff.
+ *
+ * Nothing prunes the table — a spent or expired row stays until you delete it with
+ * {@link revokeSignUpInvitation}, which is also what keeps it a record of who was
+ * let in.
+ *
+ * Each call mints a **new token** and returns it in the clear, once. Only its
+ * SHA-256 is stored, so re-inviting an address invalidates the previous link, and
+ * a link that was never delivered is reissued rather than looked up.
+ */
+declare const createSignUpInvitation: (auth: LunoraAuth, input: {
+  email: string;
+  expiresInSeconds?: number;
+  invitedBy?: string;
+}) => Promise<IssuedSignUpInvitation>;
+/**
+ * The most recent invitations, newest first, up to a fixed ceiling of
+ * {@link MAX_LISTED}. `pendingOnly` drops the spent and the expired, which is the
+ * list an operator usually wants; the unfiltered form doubles as the record of who
+ * was let in.
+ *
+ * Deliberately not paged. "Pending" is two conditions, one of them a comparison
+ * against `now`, and filtering those after a page would let page 1 come back empty
+ * while pending invitations sat on page 2. An operator list that outgrows the
+ * ceiling wants a query against the `signUpInvitation` table, not an offset.
+ */
+declare const listSignUpInvitations: (auth: LunoraAuth, options?: {
+  pendingOnly?: boolean;
+}) => Promise<SignUpInvitation[]>;
+/**
+ * Withdraw the invitation for `email`. Deletes the row, so it also forgets a spent
+ * one — the account it created is untouched, and removing that is
+ * `AuthAdmin.removeUser`'s job.
+ *
+ * Not retroactive, and not atomic against a sign-up already in flight: better-auth
+ * creates the user without wrapping the `before` hook and the insert in one
+ * transaction, so a revoke landing between the two lets that one account through.
+ * There is no conditional consume in the adapter contract to close it with. Treat
+ * revocation as "no further sign-ups", and `AuthAdmin.removeUser` as the way to
+ * undo one that already happened.
+ */
+declare const revokeSignUpInvitation: (auth: LunoraAuth, input: {
+  email: string;
+}) => Promise<void>;
+/**
+ * Delete invitations that expired without being used, and report how many went.
+ *
+ * Only the dead ones: a spent invitation is the record of who was let in, and an
+ * unexpired one is still live, so both stay. Nothing calls this for you — an app
+ * that invites at any volume should put it on a cron; one that doesn't can leave
+ * the rows.
+ *
+ * Bounded by `limit` and therefore incremental: a backlog larger than one pass
+ * takes several. It reads a page and deletes row by row rather than issuing one
+ * ranged `deleteMany`, because a `lt` comparison against a `date` column is the
+ * kind of thing that behaves differently on each of the three adapters this
+ * package ships, and a prune job is not where that should be discovered.
+ */
+declare const pruneSignUpInvitations: (auth: LunoraAuth, options?: {
+  limit?: number;
+}) => Promise<number>;
+export { InviteOnlyOptions as I, SignUpInvitation as S, IssuedSignUpInvitation as a, createSignUpInvitation as c, inviteOnly as i, listSignUpInvitations as l, pruneSignUpInvitations as p, revokeSignUpInvitation as r };

package/dist/packem_shared/legacyIssuerCleanupStatements-D9Kf8OD1.mjs

@@ -0,0 +1 @@
+import{q as r}from"./quote-identifier-CGiYFBvY.mjs";const i="issuer",c=new RegExp(String.raw`\b${i}\b`,"iu"),u=e=>{const s=e.indexOf("(");if(s===-1)return"";let n=0;for(let t=s;t<e.length;t+=1){const o=e[t];if(o==="(")n+=1;else if(o===")"&&(n-=1,n===0))return e.slice(s+1,t)}return""},f=e=>[...e].includes(i),p=e=>[...e].filter(s=>c.test(u(s.sql??""))).map(s=>s.name),l=(e="account",s=[])=>[...[...s].map(n=>`DROP INDEX IF EXISTS ${r(n)}`),`ALTER TABLE ${r(e)} DROP COLUMN ${r(i)}`];export{p as indexesReferencingIssuer,l as legacyIssuerCleanupStatements,f as schemaDeclaresIssuer};

package/dist/packem_shared/mcp-CgX1hTOv.mjs

@@ -0,0 +1 @@
+import{mcp as o,requireMcpAuth as s}from"@better-auth/mcp";import{LunoraError as c}from"@lunora/errors";import{MCP_RESOURCE_KEY as u,protectedResourcePath as i,authorizationServerPath as n}from"./authDiscoveryPaths-B14lM14u.mjs";import{DEFAULT_AUTH_BASE_PATH as p}from"./DEFAULT_AUTH_BASE_PATH-DneiLGpv.mjs";const a=e=>{if(!(typeof e=="string"&&URL.canParse(e)))throw new c("AUTH_MCP_RESOURCE_INVALID",`requireMcpAuth needs \`resource\` set to the absolute URL passed to mcp({ resource }), got ${JSON.stringify(e)}. Without it no issued token's audience matches and every request is refused.`)},d=e=>{const r=o(e);return Object.defineProperty(r,u,{value:e.resource}),r},E=(e,r,t)=>(a(t.resource),s(e,r,t)),P=(e,r=p)=>[i(e),n(r)];export{d as mcp,P as mcpDiscoveryPaths,E as requireMcpAuth};

package/dist/packem_shared/on-cloudflare-edge-Dx6gFjBO.mjs

@@ -0,0 +1 @@
+const o=()=>globalThis.navigator?.userAgent==="Cloudflare-Workers";export{o};

package/dist/packem_shared/quote-identifier-CGiYFBvY.mjs

@@ -0,0 +1 @@
+const t=e=>`"${e.replaceAll('"','""')}"`;export{t as q};

package/dist/packem_shared/sessionPresets-C867Mlo4.mjs

@@ -0,0 +1 @@
+const t=n=>{const o=["expiresIn","updateAge","freshAge"];for(const s of o){const e=n[s];if(e!==void 0&&(typeof e!="number"||!Number.isFinite(e)||e<0))throw new TypeError(`@lunora/auth: \`session.${s}\` must be a non-negative, finite number of seconds`)}return n},i={longLived:{cookieCache:{enabled:!0,maxAge:60},expiresIn:2592e3,freshAge:86400,updateAge:86400},rolling:{cookieCache:{enabled:!0,maxAge:60},expiresIn:604800,freshAge:86400,updateAge:86400},strict:{cookieCache:{enabled:!1},expiresIn:3600,freshAge:300,updateAge:900}};export{i as sessionPresets,t as validateSessionPolicy};

package/dist/packem_shared/sql-store-CYa4HJsO.mjs

@@ -0,0 +1 @@
+const T="_creationTime",l=s=>`"${s.replaceAll('"','""')}"`,N=/no such column|column .{0,64}? does not exist/iu,g={params:[],sql:"0"},R=(s,r)=>r?{column:`LOWER(${s})`,placeholder:"LOWER(?)"}:{column:s,placeholder:"?"},M=(s,r,a,c)=>{if(typeof r!="string")return g;const t=R(s,c);return a==="contains"?{params:[r],sql:`instr(${t.column}, ${t.placeholder}) > 0`}:a==="starts_with"?{params:[r],sql:`instr(${t.column}, ${t.placeholder}) = 1`}:{params:[r,r],sql:`substr(${t.column}, -length(?)) = ${t.placeholder}`}},h=(s,r,a,c)=>{if(r===null)return{params:[],sql:`${s} IS ${c?"NOT ":""}NULL`};const t=R(s,a),n=c?"<>":"=";return{params:[r],sql:`${t.column} ${n} ${t.placeholder}`}},O=(s,r,a,c)=>{const t=Array.isArray(r)?r:[];if(t.length===0)return{params:[],sql:a?"1":"0"};const n=R(s,c),e=t.map(()=>n.placeholder).join(", ");return{params:[...t],sql:`${n.column} ${a?"NOT IN":"IN"} (${e})`}},L=s=>{const r=l(s.field),{mode:a,operator:c,value:t}=s,n=a==="insensitive";switch(c){case"contains":case"ends_with":case"starts_with":return M(r,t,c,n);case"gt":return{params:[t],sql:`${r} > ?`};case"gte":return{params:[t],sql:`${r} >= ?`};case"in":return O(r,t,!1,n);case"lt":return{params:[t],sql:`${r} < ?`};case"lte":return{params:[t],sql:`${r} <= ?`};case"ne":return h(r,t,n,!0);case"not_in":return O(r,t,!0,n);default:return h(r,t,n,!1)}},d=(s,r)=>{if(s.length===0)return;const a=s.map(c=>L(c));return{params:a.flatMap(c=>c.params),sql:a.map(c=>`(${c.sql})`).join(` ${r} `)}},E=s=>{const r=[d(s.filter(a=>a.connector!=="OR"),"AND"),d(s.filter(a=>a.connector==="OR"),"OR")].filter(a=>a!==void 0);return r.length===0?{params:[],sql:""}:{params:r.flatMap(a=>a.params),sql:r.map(a=>`(${a.sql})`).join(" AND ")}},$=s=>s.sql?` WHERE ${s.sql}`:"",S=s=>{const r=(t,n)=>{const e=E(n);return s.all(`SELECT * FROM ${l(t)}${$(e)}`,e.params)},a=new Map,c=async t=>{const n=a.get(t);if(n!==void 0)return n;try{await s.all(`SELECT ${l(t)}.${l(T)} FROM ${l(t)} LIMIT 0`,[])}catch(e){return N.test(e instanceof Error?e.message:String(e))&&a.set(t,!1),!1}return a.set(t,!0),!0};return{consumeOne:async(t,n)=>{const e=E(n),o=l(t),[i]=await s.all(`DELETE FROM ${o} WHERE rowid IN (SELECT rowid FROM ${o}${$(e)} LIMIT 1) RETURNING *`,e.params);return i},count:async(t,n)=>{const e=E(n),[o]=await s.all(`SELECT COUNT(*) AS __count FROM ${l(t)}${$(e)}`,e.params);return Number(o?.__count??0)},create:async(t,n)=>{const e=T in n||!await c(t)?n:{[T]:Date.now(),...n},o=Object.keys(e),i=o.map(()=>"?").join(", "),u=`INSERT INTO ${l(t)} (${o.map(m=>l(m)).join(", ")}) VALUES (${i})`;return await s.run(u,o.map(m=>e[m])),{...n}},incrementOne:async(t,n,e,o)=>{const i=l(t),u=Object.keys(e),m=o?Object.keys(o):[],f=E(n);if(u.length===0&&m.length===0){const[p]=await s.all(`SELECT * FROM ${i}${$(f)} LIMIT 1`,f.params);return p}const I=[...u.map(p=>`${l(p)} = COALESCE(${l(p)}, 0) + ?`),...m.map(p=>`${l(p)} = ?`)].join(", "),[w]=await s.all(`UPDATE ${i} SET ${I} WHERE rowid IN (SELECT rowid FROM ${i}${$(f)} LIMIT 1) RETURNING *`,[...u.map(p=>e[p]),...m.map(p=>o[p]),...f.params]);return w},read:async(t,n)=>{const e=E(n.where),o=[...e.params];let i=`SELECT * FROM ${l(t)}${$(e)}`;return n.sortBy&&(i+=` ORDER BY ${l(n.sortBy.field)} ${n.sortBy.direction==="asc"?"ASC":"DESC"}`),n.limit!==void 0&&(i+=" LIMIT ?",o.push(Math.trunc(n.limit))),n.offset&&(i+=`${n.limit===void 0?" LIMIT -1":""} OFFSET ?`,o.push(Math.trunc(n.offset))),s.all(i,o)},remove:async(t,n)=>{const e=E(n);return(await s.all(`DELETE FROM ${l(t)}${$(e)} RETURNING *`,e.params)).length},update:async(t,n,e)=>{const o=Object.keys(e);if(o.length===0)return r(t,n);const i=o.map(m=>`${l(m)} = ?`).join(", "),u=E(n);return s.all(`UPDATE ${l(t)} SET ${i}${$(u)} RETURNING *`,[...o.map(m=>e[m]),...u.params])}}},C=s=>({all:async(r,a)=>(await s.prepare(r).bind(...a).all()).results??[],run:async(r,a)=>{await s.prepare(r).bind(...a).run()}});export{T as C,S as c,C as d};

package/dist/packem_shared/uiConfig-B8pN6pks.mjs

@@ -0,0 +1 @@
+import{createAuthEndpoint as c}from"better-auth/api";import{getAuthTables as g}from"better-auth/db";const l=e=>[...e].toSorted((o,i)=>o.localeCompare(i)),m=(e,o={})=>{const i=o.expose??{},a=new Set((e.plugins??[]).map(t=>t.id)),r=e.emailAndPassword?.enabled??!1,s=g(e),n=(e.plugins??[]).find(t=>t.id==="organization")?.options??{},d={allowUserToCreate:typeof n.allowUserToCreateOrganization=="function"?!0:n.allowUserToCreateOrganization!==!1,enabled:a.has("organization"),invitationLimit:n.invitationLimit,limit:n.organizationLimit,membershipLimit:n.membershipLimit,roles:!!s.organizationRole,teams:!!s.team};return{emailAndPassword:r,signUp:r&&e.emailAndPassword?.disableSignUp!==!0,...i.organization===!1?{}:{organization:d},...i.plugins===!1?{}:{plugins:l(a)},...i.socialProviders===!1?{}:{socialProviders:l(new Set([...Object.keys(e.socialProviders??{}),...o.extraProviders??[]]))}}},p=e=>c(e.path??"/ui-config",{metadata:{openapi:{description:"Public description of the enabled auth plugins and social providers.",responses:{200:{description:"The UI configuration."}}}},method:"GET"},o=>{const i=o;return Promise.resolve(i.json(m(i.context.options,e)))}),h=(e={})=>({endpoints:{getUiConfig:p(e)},id:"lunora-ui-config"});export{m as deriveUiConfig,h as uiConfig};

package/dist/plugins-client.d.mts

@@ -1,2 +1,251 @@
+import { organizationClient } from 'better-auth/client/plugins';
+export { adminClient, anonymousClient, customSessionClient, deviceAuthorizationClient, emailOTPClient, inferAdditionalFields, inferOrgAdditionalFields, jwtClient, lastLoginMethodClient, magicLinkClient, multiSessionClient, oneTapClient, oneTimeTokenClient, organizationClient, phoneNumberClient, siweClient, twoFactorClient, usernameClient } from 'better-auth/client/plugins';
+export { apiKeyClient } from '@better-auth/api-key/client';
+export { oauthDeviceAuthorizationClient, oauthProviderClient } from '@better-auth/oauth-provider/client';
 export { passkeyClient } from '@better-auth/passkey/client';
-export { adminClient, anonymousClient, customSessionClient, deviceAuthorizationClient, emailOTPClient, genericOAuthClient, inferAdditionalFields, inferOrgAdditionalFields, jwtClient, lastLoginMethodClient, magicLinkClient, multiSessionClient, oidcClient, oneTimeTokenClient, organizationClient, phoneNumberClient, siweClient, twoFactorClient, usernameClient } from 'better-auth/client/plugins';
+/**
+ * Which client plugins to include. Each defaults to `false`.
+ *
+ * These are the same names `@lunora/auth-ui` gates its cards on, so one object
+ * can drive both `createLunoraAuthClient` and `registerAuthClientPlugins` — a
+ * flow the UI can show but this cannot install would be a card that renders and
+ * then fails at call time.
+ *
+ * `oneTap` is absent on purpose: Google One Tap needs a client id, not a
+ * boolean, so it comes in through {@link CreateLunoraAuthClientOptions.oneTapClientId}.
+ */
+interface LunoraAuthPluginToggles {
+  admin?: boolean;
+  anonymous?: boolean;
+  deviceAuthorization?: boolean;
+  emailOtp?: boolean;
+  lastLoginMethod?: boolean;
+  magicLink?: boolean;
+  multiSession?: boolean;
+  oauthProvider?: boolean;
+  organization?: boolean;
+  passkey?: boolean;
+  phoneNumber?: boolean;
+  twoFactor?: boolean;
+  username?: boolean;
+}
+type LunoraAuthClientPlugin = ReturnType<typeof organizationClient>;
+declare const lunoraAuthPlugins: (toggles?: LunoraAuthPluginToggles) => LunoraAuthClientPlugin[];
+/** Options for {@link createLunoraAuthClient}; anything else is forwarded to `createAuthClient`. */
+interface CreateLunoraAuthClientOptions {
+  [option: string]: unknown;
+  /** Defaults to the current origin, which is right for a same-origin app. */
+  baseURL?: string;
+  /** Your own client plugins, appended after the standard set. */
+  extraPlugins?: LunoraAuthClientPlugin[];
+  /**
+   * Google OAuth client id. Setting it installs the One Tap client plugin —
+   * a boolean toggle can't, because the prompt is Google's and needs the id.
+   */
+  oneTapClientId?: string;
+  /** Which standard client plugins to include. */
+  plugins?: LunoraAuthPluginToggles;
+}
+/**
+ * What {@link lunoraSessionSync} returns: a better-auth client plugin, typed
+ * narrowly rather than as `BetterAuthClientPlugin` — widening a plugin to that
+ * type collapses better-auth's session inference on the client it joins.
+ */
+interface LunoraSessionSyncPlugin {
+  fetchPlugins: {
+    hooks: {
+      onSuccess: (context: {
+        request: {
+          method?: string;
+        };
+      }) => void;
+    };
+    id: string;
+    name: string;
+  }[];
+  id: "lunora-session-sync";
+}
+/**
+ * Tell every `LunoraClient` in the page, and in the browser's other tabs on the
+ * same origin, that the auth session may have changed, so each asks
+ * `/get-session` who is signed in now. A tab on another origin that shares the
+ * cookie is not reached: it switches on its next socket reconnect, and the
+ * worker's replay check keeps its writes safe meanwhile.
+ *
+ * Needed for a **cookie** session: a sign-in or sign-out sets or clears an
+ * `HttpOnly` cookie in a request the Lunora client never sees, and nothing it
+ * can observe changes. Until it re-resolves, its live queries keep showing the
+ * previous user's rows over a socket still authenticated as them.
+ * {@link lunoraSessionSync} (installed by {@link createLunoraAuthClient}) and
+ * `@lunora/auth-ui` call it for you; call it yourself after a session change
+ * made any other way.
+ *
+ * Resolves once every client in this tab has re-resolved (or failed to), so
+ * code that reads `client.currentIdentity()` next can `await` it; the other
+ * tabs re-resolve on their own. Never rejects.
+ */
+declare const notifyLunoraSessionChange: () => Promise<void>;
+/**
+ * A better-auth client plugin that, after every successful auth request that
+ * can change the session (anything but a `GET` — sign-in, sign-up, sign-out,
+ * 2FA, account switch, session revocation), calls
+ * {@link notifyLunoraSessionChange}.
+ *
+ * {@link createLunoraAuthClient} always installs it. Add it yourself when you
+ * call `createAuthClient` directly:
+ *
+ * ```ts
+ * export const authClient = createAuthClient({ plugins: [lunoraSessionSync()] });
+ * ```
+ */
+declare const lunoraSessionSync: () => LunoraSessionSyncPlugin;
+/**
+ * Build a better-auth client with Lunora's standard plugin set from toggles.
+ *
+ * You pass your framework's `createAuthClient` in — `better-auth/react`,
+ * `/vue`, `/svelte`, or `/solid` — because the variant has to match the UI
+ * framework, and a helper that picked for you would either guess wrong or drag
+ * every variant into your bundle.
+ *
+ * ```ts
+ * import { createAuthClient } from "better-auth/react";
+ * import { createLunoraAuthClient } from "@lunora/auth/plugins/client";
+ *
+ * export const authClient = createLunoraAuthClient(createAuthClient, {
+ *     plugins: { organization: true, passkey: true, twoFactor: true },
+ * });
+ * ```
+ *
+ * Reach for {@link lunoraAuthPlugins} instead when you want to own the
+ * `createAuthClient` call and only borrow the plugin array.
+ */
+declare const createLunoraAuthClient: <TClient>(createAuthClient: (options: Record<string, unknown>) => TClient, options?: CreateLunoraAuthClientOptions) => TClient;
+export {
+/**
+ * Client-side counterparts to the server plugins re-exported from
+ * `@lunora/auth/plugins`, surfaced under `@lunora/auth/plugins/client`.
+ *
+ * better-auth plugins come in two halves: a **server** plugin you pass to
+ * `betterAuth()` (re-exported from `@lunora/auth/plugins`) and a **client**
+ * plugin you pass to `createAuthClient()`. Both halves must be registered for a
+ * plugin's endpoints, inferred types, and client actions (e.g.
+ * `authClient.twoFactor.*`, `authClient.organization.*`, the `twoFactorRedirect`
+ * sign-in flow) to exist. This module is the client half so consumers don't have
+ * to reach into better-auth's `better-auth/client/plugins` subpath directly.
+ *
+ * # Wiring
+ *
+ * ```ts
+ * import { createAuthClient } from "better-auth/client"; // or a framework adapter
+ * import { organizationClient, twoFactorClient } from "@lunora/auth/plugins/client";
+ *
+ * export const authClient = createAuthClient({
+ *     baseURL: import.meta.env.VITE_AUTH_URL,
+ *     plugins: [
+ *         organizationClient(),
+ *         twoFactorClient({ onTwoFactorRedirect: () => location.assign("/2fa") }),
+ *     ],
+ * });
+ * ```
+ *
+ * Keep the client plugin list in parity with the server `plugins` array passed
+ * to `createAuth`: a server plugin without its client counterpart leaves
+ * those actions untyped/unavailable, and vice-versa.
+ */
+type CreateLunoraAuthClientOptions,
+/**
+ * Client-side counterparts to the server plugins re-exported from
+ * `@lunora/auth/plugins`, surfaced under `@lunora/auth/plugins/client`.
+ *
+ * better-auth plugins come in two halves: a **server** plugin you pass to
+ * `betterAuth()` (re-exported from `@lunora/auth/plugins`) and a **client**
+ * plugin you pass to `createAuthClient()`. Both halves must be registered for a
+ * plugin's endpoints, inferred types, and client actions (e.g.
+ * `authClient.twoFactor.*`, `authClient.organization.*`, the `twoFactorRedirect`
+ * sign-in flow) to exist. This module is the client half so consumers don't have
+ * to reach into better-auth's `better-auth/client/plugins` subpath directly.
+ *
+ * # Wiring
+ *
+ * ```ts
+ * import { createAuthClient } from "better-auth/client"; // or a framework adapter
+ * import { organizationClient, twoFactorClient } from "@lunora/auth/plugins/client";
+ *
+ * export const authClient = createAuthClient({
+ *     baseURL: import.meta.env.VITE_AUTH_URL,
+ *     plugins: [
+ *         organizationClient(),
+ *         twoFactorClient({ onTwoFactorRedirect: () => location.assign("/2fa") }),
+ *     ],
+ * });
+ * ```
+ *
+ * Keep the client plugin list in parity with the server `plugins` array passed
+ * to `createAuth`: a server plugin without its client counterpart leaves
+ * those actions untyped/unavailable, and vice-versa.
+ */
+type LunoraAuthClientPlugin,
+/**
+ * Client-side counterparts to the server plugins re-exported from
+ * `@lunora/auth/plugins`, surfaced under `@lunora/auth/plugins/client`.
+ *
+ * better-auth plugins come in two halves: a **server** plugin you pass to
+ * `betterAuth()` (re-exported from `@lunora/auth/plugins`) and a **client**
+ * plugin you pass to `createAuthClient()`. Both halves must be registered for a
+ * plugin's endpoints, inferred types, and client actions (e.g.
+ * `authClient.twoFactor.*`, `authClient.organization.*`, the `twoFactorRedirect`
+ * sign-in flow) to exist. This module is the client half so consumers don't have
+ * to reach into better-auth's `better-auth/client/plugins` subpath directly.
+ *
+ * # Wiring
+ *
+ * ```ts
+ * import { createAuthClient } from "better-auth/client"; // or a framework adapter
+ * import { organizationClient, twoFactorClient } from "@lunora/auth/plugins/client";
+ *
+ * export const authClient = createAuthClient({
+ *     baseURL: import.meta.env.VITE_AUTH_URL,
+ *     plugins: [
+ *         organizationClient(),
+ *         twoFactorClient({ onTwoFactorRedirect: () => location.assign("/2fa") }),
+ *     ],
+ * });
+ * ```
+ *
+ * Keep the client plugin list in parity with the server `plugins` array passed
+ * to `createAuth`: a server plugin without its client counterpart leaves
+ * those actions untyped/unavailable, and vice-versa.
+ */
+type LunoraAuthPluginToggles,
+/**
+ * Client-side counterparts to the server plugins re-exported from
+ * `@lunora/auth/plugins`, surfaced under `@lunora/auth/plugins/client`.
+ *
+ * better-auth plugins come in two halves: a **server** plugin you pass to
+ * `betterAuth()` (re-exported from `@lunora/auth/plugins`) and a **client**
+ * plugin you pass to `createAuthClient()`. Both halves must be registered for a
+ * plugin's endpoints, inferred types, and client actions (e.g.
+ * `authClient.twoFactor.*`, `authClient.organization.*`, the `twoFactorRedirect`
+ * sign-in flow) to exist. This module is the client half so consumers don't have
+ * to reach into better-auth's `better-auth/client/plugins` subpath directly.
+ *
+ * # Wiring
+ *
+ * ```ts
+ * import { createAuthClient } from "better-auth/client"; // or a framework adapter
+ * import { organizationClient, twoFactorClient } from "@lunora/auth/plugins/client";
+ *
+ * export const authClient = createAuthClient({
+ *     baseURL: import.meta.env.VITE_AUTH_URL,
+ *     plugins: [
+ *         organizationClient(),
+ *         twoFactorClient({ onTwoFactorRedirect: () => location.assign("/2fa") }),
+ *     ],
+ * });
+ * ```
+ *
+ * Keep the client plugin list in parity with the server `plugins` array passed
+ * to `createAuth`: a server plugin without its client counterpart leaves
+ * those actions untyped/unavailable, and vice-versa.
+ */
+type LunoraSessionSyncPlugin, createLunoraAuthClient, lunoraAuthPlugins, lunoraSessionSync, notifyLunoraSessionChange };

package/dist/plugins-client.d.ts

@@ -1,2 +1,251 @@
+import { organizationClient } from 'better-auth/client/plugins';
+export { adminClient, anonymousClient, customSessionClient, deviceAuthorizationClient, emailOTPClient, inferAdditionalFields, inferOrgAdditionalFields, jwtClient, lastLoginMethodClient, magicLinkClient, multiSessionClient, oneTapClient, oneTimeTokenClient, organizationClient, phoneNumberClient, siweClient, twoFactorClient, usernameClient } from 'better-auth/client/plugins';
+export { apiKeyClient } from '@better-auth/api-key/client';
+export { oauthDeviceAuthorizationClient, oauthProviderClient } from '@better-auth/oauth-provider/client';
 export { passkeyClient } from '@better-auth/passkey/client';
-export { adminClient, anonymousClient, customSessionClient, deviceAuthorizationClient, emailOTPClient, genericOAuthClient, inferAdditionalFields, inferOrgAdditionalFields, jwtClient, lastLoginMethodClient, magicLinkClient, multiSessionClient, oidcClient, oneTimeTokenClient, organizationClient, phoneNumberClient, siweClient, twoFactorClient, usernameClient } from 'better-auth/client/plugins';
+/**
+ * Which client plugins to include. Each defaults to `false`.
+ *
+ * These are the same names `@lunora/auth-ui` gates its cards on, so one object
+ * can drive both `createLunoraAuthClient` and `registerAuthClientPlugins` — a
+ * flow the UI can show but this cannot install would be a card that renders and
+ * then fails at call time.
+ *
+ * `oneTap` is absent on purpose: Google One Tap needs a client id, not a
+ * boolean, so it comes in through {@link CreateLunoraAuthClientOptions.oneTapClientId}.
+ */
+interface LunoraAuthPluginToggles {
+  admin?: boolean;
+  anonymous?: boolean;
+  deviceAuthorization?: boolean;
+  emailOtp?: boolean;
+  lastLoginMethod?: boolean;
+  magicLink?: boolean;
+  multiSession?: boolean;
+  oauthProvider?: boolean;
+  organization?: boolean;
+  passkey?: boolean;
+  phoneNumber?: boolean;
+  twoFactor?: boolean;
+  username?: boolean;
+}
+type LunoraAuthClientPlugin = ReturnType<typeof organizationClient>;
+declare const lunoraAuthPlugins: (toggles?: LunoraAuthPluginToggles) => LunoraAuthClientPlugin[];
+/** Options for {@link createLunoraAuthClient}; anything else is forwarded to `createAuthClient`. */
+interface CreateLunoraAuthClientOptions {
+  [option: string]: unknown;
+  /** Defaults to the current origin, which is right for a same-origin app. */
+  baseURL?: string;
+  /** Your own client plugins, appended after the standard set. */
+  extraPlugins?: LunoraAuthClientPlugin[];
+  /**
+   * Google OAuth client id. Setting it installs the One Tap client plugin —
+   * a boolean toggle can't, because the prompt is Google's and needs the id.
+   */
+  oneTapClientId?: string;
+  /** Which standard client plugins to include. */
+  plugins?: LunoraAuthPluginToggles;
+}
+/**
+ * What {@link lunoraSessionSync} returns: a better-auth client plugin, typed
+ * narrowly rather than as `BetterAuthClientPlugin` — widening a plugin to that
+ * type collapses better-auth's session inference on the client it joins.
+ */
+interface LunoraSessionSyncPlugin {
+  fetchPlugins: {
+    hooks: {
+      onSuccess: (context: {
+        request: {
+          method?: string;
+        };
+      }) => void;
+    };
+    id: string;
+    name: string;
+  }[];
+  id: "lunora-session-sync";
+}
+/**
+ * Tell every `LunoraClient` in the page, and in the browser's other tabs on the
+ * same origin, that the auth session may have changed, so each asks
+ * `/get-session` who is signed in now. A tab on another origin that shares the
+ * cookie is not reached: it switches on its next socket reconnect, and the
+ * worker's replay check keeps its writes safe meanwhile.
+ *
+ * Needed for a **cookie** session: a sign-in or sign-out sets or clears an
+ * `HttpOnly` cookie in a request the Lunora client never sees, and nothing it
+ * can observe changes. Until it re-resolves, its live queries keep showing the
+ * previous user's rows over a socket still authenticated as them.
+ * {@link lunoraSessionSync} (installed by {@link createLunoraAuthClient}) and
+ * `@lunora/auth-ui` call it for you; call it yourself after a session change
+ * made any other way.
+ *
+ * Resolves once every client in this tab has re-resolved (or failed to), so
+ * code that reads `client.currentIdentity()` next can `await` it; the other
+ * tabs re-resolve on their own. Never rejects.
+ */
+declare const notifyLunoraSessionChange: () => Promise<void>;
+/**
+ * A better-auth client plugin that, after every successful auth request that
+ * can change the session (anything but a `GET` — sign-in, sign-up, sign-out,
+ * 2FA, account switch, session revocation), calls
+ * {@link notifyLunoraSessionChange}.
+ *
+ * {@link createLunoraAuthClient} always installs it. Add it yourself when you
+ * call `createAuthClient` directly:
+ *
+ * ```ts
+ * export const authClient = createAuthClient({ plugins: [lunoraSessionSync()] });
+ * ```
+ */
+declare const lunoraSessionSync: () => LunoraSessionSyncPlugin;
+/**
+ * Build a better-auth client with Lunora's standard plugin set from toggles.
+ *
+ * You pass your framework's `createAuthClient` in — `better-auth/react`,
+ * `/vue`, `/svelte`, or `/solid` — because the variant has to match the UI
+ * framework, and a helper that picked for you would either guess wrong or drag
+ * every variant into your bundle.
+ *
+ * ```ts
+ * import { createAuthClient } from "better-auth/react";
+ * import { createLunoraAuthClient } from "@lunora/auth/plugins/client";
+ *
+ * export const authClient = createLunoraAuthClient(createAuthClient, {
+ *     plugins: { organization: true, passkey: true, twoFactor: true },
+ * });
+ * ```
+ *
+ * Reach for {@link lunoraAuthPlugins} instead when you want to own the
+ * `createAuthClient` call and only borrow the plugin array.
+ */
+declare const createLunoraAuthClient: <TClient>(createAuthClient: (options: Record<string, unknown>) => TClient, options?: CreateLunoraAuthClientOptions) => TClient;
+export {
+/**
+ * Client-side counterparts to the server plugins re-exported from
+ * `@lunora/auth/plugins`, surfaced under `@lunora/auth/plugins/client`.
+ *
+ * better-auth plugins come in two halves: a **server** plugin you pass to
+ * `betterAuth()` (re-exported from `@lunora/auth/plugins`) and a **client**
+ * plugin you pass to `createAuthClient()`. Both halves must be registered for a
+ * plugin's endpoints, inferred types, and client actions (e.g.
+ * `authClient.twoFactor.*`, `authClient.organization.*`, the `twoFactorRedirect`
+ * sign-in flow) to exist. This module is the client half so consumers don't have
+ * to reach into better-auth's `better-auth/client/plugins` subpath directly.
+ *
+ * # Wiring
+ *
+ * ```ts
+ * import { createAuthClient } from "better-auth/client"; // or a framework adapter
+ * import { organizationClient, twoFactorClient } from "@lunora/auth/plugins/client";
+ *
+ * export const authClient = createAuthClient({
+ *     baseURL: import.meta.env.VITE_AUTH_URL,
+ *     plugins: [
+ *         organizationClient(),
+ *         twoFactorClient({ onTwoFactorRedirect: () => location.assign("/2fa") }),
+ *     ],
+ * });
+ * ```
+ *
+ * Keep the client plugin list in parity with the server `plugins` array passed
+ * to `createAuth`: a server plugin without its client counterpart leaves
+ * those actions untyped/unavailable, and vice-versa.
+ */
+type CreateLunoraAuthClientOptions,
+/**
+ * Client-side counterparts to the server plugins re-exported from
+ * `@lunora/auth/plugins`, surfaced under `@lunora/auth/plugins/client`.
+ *
+ * better-auth plugins come in two halves: a **server** plugin you pass to
+ * `betterAuth()` (re-exported from `@lunora/auth/plugins`) and a **client**
+ * plugin you pass to `createAuthClient()`. Both halves must be registered for a
+ * plugin's endpoints, inferred types, and client actions (e.g.
+ * `authClient.twoFactor.*`, `authClient.organization.*`, the `twoFactorRedirect`
+ * sign-in flow) to exist. This module is the client half so consumers don't have
+ * to reach into better-auth's `better-auth/client/plugins` subpath directly.
+ *
+ * # Wiring
+ *
+ * ```ts
+ * import { createAuthClient } from "better-auth/client"; // or a framework adapter
+ * import { organizationClient, twoFactorClient } from "@lunora/auth/plugins/client";
+ *
+ * export const authClient = createAuthClient({
+ *     baseURL: import.meta.env.VITE_AUTH_URL,
+ *     plugins: [
+ *         organizationClient(),
+ *         twoFactorClient({ onTwoFactorRedirect: () => location.assign("/2fa") }),
+ *     ],
+ * });
+ * ```
+ *
+ * Keep the client plugin list in parity with the server `plugins` array passed
+ * to `createAuth`: a server plugin without its client counterpart leaves
+ * those actions untyped/unavailable, and vice-versa.
+ */
+type LunoraAuthClientPlugin,
+/**
+ * Client-side counterparts to the server plugins re-exported from
+ * `@lunora/auth/plugins`, surfaced under `@lunora/auth/plugins/client`.
+ *
+ * better-auth plugins come in two halves: a **server** plugin you pass to
+ * `betterAuth()` (re-exported from `@lunora/auth/plugins`) and a **client**
+ * plugin you pass to `createAuthClient()`. Both halves must be registered for a
+ * plugin's endpoints, inferred types, and client actions (e.g.
+ * `authClient.twoFactor.*`, `authClient.organization.*`, the `twoFactorRedirect`
+ * sign-in flow) to exist. This module is the client half so consumers don't have
+ * to reach into better-auth's `better-auth/client/plugins` subpath directly.
+ *
+ * # Wiring
+ *
+ * ```ts
+ * import { createAuthClient } from "better-auth/client"; // or a framework adapter
+ * import { organizationClient, twoFactorClient } from "@lunora/auth/plugins/client";
+ *
+ * export const authClient = createAuthClient({
+ *     baseURL: import.meta.env.VITE_AUTH_URL,
+ *     plugins: [
+ *         organizationClient(),
+ *         twoFactorClient({ onTwoFactorRedirect: () => location.assign("/2fa") }),
+ *     ],
+ * });
+ * ```
+ *
+ * Keep the client plugin list in parity with the server `plugins` array passed
+ * to `createAuth`: a server plugin without its client counterpart leaves
+ * those actions untyped/unavailable, and vice-versa.
+ */
+type LunoraAuthPluginToggles,
+/**
+ * Client-side counterparts to the server plugins re-exported from
+ * `@lunora/auth/plugins`, surfaced under `@lunora/auth/plugins/client`.
+ *
+ * better-auth plugins come in two halves: a **server** plugin you pass to
+ * `betterAuth()` (re-exported from `@lunora/auth/plugins`) and a **client**
+ * plugin you pass to `createAuthClient()`. Both halves must be registered for a
+ * plugin's endpoints, inferred types, and client actions (e.g.
+ * `authClient.twoFactor.*`, `authClient.organization.*`, the `twoFactorRedirect`
+ * sign-in flow) to exist. This module is the client half so consumers don't have
+ * to reach into better-auth's `better-auth/client/plugins` subpath directly.
+ *
+ * # Wiring
+ *
+ * ```ts
+ * import { createAuthClient } from "better-auth/client"; // or a framework adapter
+ * import { organizationClient, twoFactorClient } from "@lunora/auth/plugins/client";
+ *
+ * export const authClient = createAuthClient({
+ *     baseURL: import.meta.env.VITE_AUTH_URL,
+ *     plugins: [
+ *         organizationClient(),
+ *         twoFactorClient({ onTwoFactorRedirect: () => location.assign("/2fa") }),
+ *     ],
+ * });
+ * ```
+ *
+ * Keep the client plugin list in parity with the server `plugins` array passed
+ * to `createAuth`: a server plugin without its client counterpart leaves
+ * those actions untyped/unavailable, and vice-versa.
+ */
+type LunoraSessionSyncPlugin, createLunoraAuthClient, lunoraAuthPlugins, lunoraSessionSync, notifyLunoraSessionChange };