@lunora/auth 1.0.0-alpha.2 → 1.0.0-alpha.21

package/dist/adapter.mjs

@@ -19,6 +19,7 @@ const lunoraAuthAdapter = (store) => createAdapterFactory({
         const [row] = await store.read(model, { limit: 1, where });
         return asRowOrNull(row);
       },
+      incrementOne: async ({ increment, model, set, where }) => asRowOrNull(await store.incrementOne(model, where, increment, set)),
       update: async ({ model, update, where }) => {
         const [row] = await store.update(model, where, update);
         return asRowOrNull(row);

package/dist/index.d.mts

@@ -1,6 +1,7 @@
 export { lunoraAuthAdapter, lunoraD1Adapter } from "./adapter.mjs";
-import { L as LunoraAuth, a as LunoraAuthOptions } from "./packem_shared/create-auth.d-M36jwG_Y.mjs";
-export { c as createAuth } from "./packem_shared/create-auth.d-M36jwG_Y.mjs";
+import { LunoraError } from '@lunora/errors';
+import { L as LunoraAuth, a as LunoraAuthOptions } from "./packem_shared/create-auth.d-Mwhb4gSc.mjs";
+export { c as createAuth, r as resolveAuthOptions } from "./packem_shared/create-auth.d-Mwhb4gSc.mjs";
 export { type LunoraAuthApiContext, LunoraAuthHeadersError, type WithAuthPluginsMiddleware, type WithAuthPluginsOptions, withAuthPlugins } from "./middleware.mjs";
 export { default as authTables } from "./schema.mjs";
 import { BetterAuthOptions } from 'better-auth';
@@ -90,6 +91,35 @@ interface AuthInvitation {
   role?: null | string;
   status?: null | string;
 }
+/** One team row (from the `organization` plugin with `teams.enabled`). */
+interface AuthTeam {
+  [key: string]: unknown;
+  createdAt?: AuthTimestamp;
+  id: string;
+  name?: null | string;
+  organizationId: string;
+}
+/** One team-membership row (teams). */
+interface AuthTeamMember {
+  [key: string]: unknown;
+  createdAt?: AuthTimestamp;
+  id: string;
+  teamId: string;
+  userId: string;
+}
+/**
+* One custom organization role (from the organization plugin's dynamic
+* access-control). `permission` is a JSON string of a `resource → actions[]` map
+* as stored; the studio parses it for display/editing.
+*/
+interface AuthOrgRole {
+  [key: string]: unknown;
+  createdAt?: AuthTimestamp;
+  id: string;
+  organizationId: string;
+  permission?: null | string;
+  role?: null | string;
+}
 /** One registered passkey. Credential secrets (`publicKey`) are stripped. */
 interface AuthPasskey {
   [key: string]: unknown;
@@ -123,6 +153,63 @@ interface AuthCapabilities {
   /** The `two-factor` plugin: per-user 2FA status / disable. */
   twoFactor: boolean;
 }
+/**
+* One app/plugin-defined field the create-user form should render, derived from
+* the merged better-auth `user` table (core + plugin + `additionalFields`). Only
+* user-settable columns are surfaced — server-managed flags (`input: false`),
+* foreign keys (`references`), and the core columns the form already handles
+* (`email`/`name`/`role`/ban state/…) are filtered out upstream.
+*/
+interface AuthUserFieldSpec {
+  /** Logical field name (the key passed back in `createUser`'s `data`). */
+  name: string;
+  /** Best-effort plugin id the field originates from (`username`, `phone-number`, …); `undefined` for app `additionalFields`. */
+  plugin?: string;
+  required: boolean;
+  /** Coarse input kind the studio maps to a control (checkbox / number / date / text). */
+  type: "boolean" | "date" | "number" | "string";
+  unique: boolean;
+}
+/**
+* A rich, read-only description of the deployment's auth configuration for the
+* studio's config panel and dynamic create-user form. Unlike
+* {@link AuthCapabilities} (five booleans that gate panels), this exposes *what*
+* is configured — enabled plugins, email/password + social sign-in, the
+* user-settable fields, organization sub-features (teams / custom roles), and
+* the session + rate-limit policy — without ever leaking a secret.
+*/
+interface AuthConfigInfo {
+  /** The same capability booleans {@link AuthAdmin.capabilities} returns, embedded so a single call drives the whole panel. */
+  capabilities: AuthCapabilities;
+  /** Whether email + password sign-in is enabled. */
+  emailAndPassword: boolean;
+  /** Organization plugin sub-features. */
+  organization: {
+    enabled: boolean; /** Custom roles / dynamic access control (`organizationRole` table present). */
+    roles: boolean;
+    /** Teams (`team` table present). */
+    teams: boolean;
+  };
+  /** Enabled better-auth plugin ids, sorted. */
+  plugins: string[];
+  /** Rate-limit policy (window is in seconds). */
+  rateLimit: {
+    enabled: boolean;
+    max?: number;
+    window?: number;
+  };
+  /** Session policy (all durations in seconds). */
+  session: {
+    cookieCache?: boolean;
+    expiresIn?: number;
+    freshAge?: number;
+    updateAge?: number;
+  };
+  /** Configured social/OAuth provider ids, sorted. */
+  socialProviders: string[];
+  /** User-settable extra fields for the create-user form (plugin + app `additionalFields`). */
+  userFields: AuthUserFieldSpec[];
+}
 /** A scalar value usable in an adapter `where` clause / filter. */
 type WhereValue = boolean | number | string;
 /** Filtering / paging options for {@link AuthAdmin.listUsers}. */
@@ -158,6 +245,17 @@ interface ImpersonationResult {
 * surfaces the underlying adapter error.
 */
 interface AuthAdmin {
+  /** Directly add an existing user as an org member (server-side, no invitation/acceptance). */
+  addMember: (input: {
+    organizationId: string;
+    role?: string;
+    userId: string;
+  }) => Promise<AuthMember>;
+  /** Add a user to a team. */
+  addTeamMember: (input: {
+    teamId: string;
+    userId: string;
+  }) => Promise<AuthTeamMember>;
   banUser: (input: {
     expiresInSeconds?: number;
     reason?: string;
@@ -167,6 +265,27 @@ interface AuthAdmin {
     invitationId: string;
   }) => Promise<void>;
   capabilities: () => Promise<AuthCapabilities>;
+  /** Rich, read-only description of the auth configuration (plugins, fields, session policy, …). */
+  config: () => Promise<AuthConfigInfo>;
+  /** Create an organization; optionally seed an `owner` member for `ownerId`. */
+  createOrganization: (input: {
+    logo?: string;
+    metadata?: Record<string, unknown>;
+    name: string;
+    ownerId?: string;
+    slug?: string;
+  }) => Promise<AuthOrganization>;
+  /** Create a custom org role with a permission grant (a `resource → actions[]` map). */
+  createOrgRole: (input: {
+    organizationId: string;
+    permission: Record<string, string[]>;
+    role: string;
+  }) => Promise<AuthOrgRole>;
+  /** Create a team under an organization. */
+  createTeam: (input: {
+    name: string;
+    organizationId: string;
+  }) => Promise<AuthTeam>;
   createUser: (input: {
     data?: Record<string, unknown>;
     email: string;
@@ -174,6 +293,14 @@ interface AuthAdmin {
     password?: string;
     role?: string | string[];
   }) => Promise<AuthAdminUser>;
+  /** Delete an organization and cascade-delete its members, invitations, teams, and custom roles. */
+  deleteOrganization: (input: {
+    organizationId: string;
+  }) => Promise<void>;
+  /** Delete a custom org role. */
+  deleteOrgRole: (input: {
+    roleId: string;
+  }) => Promise<void>;
   deletePasskey: (input: {
     passkeyId: string;
   }) => Promise<void>;
@@ -183,6 +310,13 @@ interface AuthAdmin {
   impersonateUser: (input: {
     userId: string;
   }) => Promise<ImpersonationResult>;
+  /** Create a pending email invitation to an org (no acceptance side effects). */
+  inviteMember: (input: {
+    email: string;
+    inviterId?: string;
+    organizationId: string;
+    role?: string;
+  }) => Promise<AuthInvitation>;
   listAccounts: (input: {
     userId: string;
   }) => Promise<AuthAccount[]>;
@@ -200,6 +334,12 @@ interface AuthAdmin {
     limit?: number;
     offset?: number;
   }) => Promise<AuthPage<AuthOrganization>>;
+  /** List an org's custom roles. */
+  listOrgRoles: (options: {
+    limit?: number;
+    offset?: number;
+    organizationId: string;
+  }) => Promise<AuthPage<AuthOrgRole>>;
   listPasskeys: (input: {
     userId: string;
   }) => Promise<AuthPasskey[]>;
@@ -208,10 +348,30 @@ interface AuthAdmin {
     offset?: number;
     userId?: string;
   }) => Promise<AuthPage<AuthAdminSession>>;
+  /** List a team's members. */
+  listTeamMembers: (options: {
+    limit?: number;
+    offset?: number;
+    teamId: string;
+  }) => Promise<AuthPage<AuthTeamMember>>;
+  /** List an org's teams. */
+  listTeams: (options: {
+    limit?: number;
+    offset?: number;
+    organizationId: string;
+  }) => Promise<AuthPage<AuthTeam>>;
   listUsers: (options: ListUsersOptions) => Promise<AuthPage<AuthAdminUser>>;
   removeMember: (input: {
     memberId: string;
   }) => Promise<void>;
+  /** Delete a team and its memberships. */
+  removeTeam: (input: {
+    teamId: string;
+  }) => Promise<void>;
+  /** Remove a member from a team. */
+  removeTeamMember: (input: {
+    teamMemberId: string;
+  }) => Promise<void>;
   removeUser: (input: {
     userId: string;
   }) => Promise<void>;
@@ -236,6 +396,29 @@ interface AuthAdmin {
     accountId: string;
     userId: string;
   }) => Promise<void>;
+  /** Change a member's role. */
+  updateMemberRole: (input: {
+    memberId: string;
+    role: string | string[];
+  }) => Promise<AuthMember>;
+  /** Update an organization's name/slug/logo/metadata. */
+  updateOrganization: (input: {
+    logo?: string;
+    metadata?: Record<string, unknown>;
+    name?: string;
+    organizationId: string;
+    slug?: string;
+  }) => Promise<AuthOrganization>;
+  /** Replace a custom org role's permission grant. */
+  updateOrgRole: (input: {
+    permission: Record<string, string[]>;
+    roleId: string;
+  }) => Promise<AuthOrgRole>;
+  /** Rename a team. */
+  updateTeam: (input: {
+    name: string;
+    teamId: string;
+  }) => Promise<AuthTeam>;
   updateUser: (input: {
     data: Record<string, unknown>;
     userId: string;
@@ -271,8 +454,7 @@ interface CreateAuthAdminOptions {
 * surface that `code` so the runtime can map it onto an HTTP status and the
 * studio can show a meaningful message instead of a generic 500.
 */
-declare class LunoraAuthAdminError extends Error {
-  readonly code: string;
+declare class LunoraAuthAdminError extends LunoraError {
   constructor(message: string, code: string);
 }
 /**
@@ -333,6 +515,12 @@ declare const ensureMigrated: (auth: LunoraAuth | {
 * Compile better-auth's migrations to a single SQL string. Useful for
 * `wrangler d1 execute --file -` in CI so the deploy step applies the schema
 * before the first user request.
+*
+* Compiles from the SAME resolved options `createAuth` runs with (via
+* `resolveAuthOptions`), not the raw caller options — so the schema includes the
+* `rateLimit` table the worker's default-on durable limiter writes to. Compiling
+* from the raw options would omit it, and the running worker would then write to
+* a table the migration never created.
 */
 declare const compileMigrationsSql: (options: LunoraAuthOptions) => Promise<string>;
 /**
@@ -378,9 +566,13 @@ declare const validateSessionPolicy: (policy: SessionPolicy) => SessionPolicy;
 * });
 * ```
 *
-* - `rolling` — balanced default: 7-day absolute expiry, rotated once per day.
-* - `strict` — short, security-sensitive: 1-hour expiry, 15-minute rotation.
-* - `longLived` — low-friction consumer apps: 30-day expiry, daily rotation.
+* - `rolling` — balanced default: 7-day absolute expiry, rotated once per day,
+*   with a 60s signed-cookie session cache so bursts of authenticated calls
+*   skip the per-request DB session read.
+* - `strict` — short, security-sensitive: 1-hour expiry, 15-minute rotation,
+*   cookie cache **off** (fast revocation / short freshness is the whole point).
+* - `longLived` — low-friction consumer apps: 30-day expiry, daily rotation,
+*   with the same 60s cookie cache as `rolling`.
 */
 declare const sessionPresets: Record<"longLived" | "rolling" | "strict", SessionPolicy>;
 export { type AuthAccount, type AuthAdmin, type AuthAdminSession, type AuthAdminUser, type AuthCapabilities, type AuthInvitation, type AuthMember, type AuthOrganization, type AuthPage, type AuthPasskey, type AuthTimestamp, type CreateAuthAdminOptions, DEFAULT_AUTH_BASE_PATH, type ImpersonationResult, type ListUsersOptions, type LunoraAuth, LunoraAuthAdminError, type LunoraAuthOptions, type SessionPolicy, compileMigrationsSql, createAuthAdmin, ensureMigrated, handleAuthRequest, sessionPresets, validateSessionPolicy };

package/dist/index.d.ts

@@ -1,6 +1,7 @@
 export { lunoraAuthAdapter, lunoraD1Adapter } from "./adapter.js";
-import { L as LunoraAuth, a as LunoraAuthOptions } from "./packem_shared/create-auth.d-M36jwG_Y.js";
-export { c as createAuth } from "./packem_shared/create-auth.d-M36jwG_Y.js";
+import { LunoraError } from '@lunora/errors';
+import { L as LunoraAuth, a as LunoraAuthOptions } from "./packem_shared/create-auth.d-Mwhb4gSc.js";
+export { c as createAuth, r as resolveAuthOptions } from "./packem_shared/create-auth.d-Mwhb4gSc.js";
 export { type LunoraAuthApiContext, LunoraAuthHeadersError, type WithAuthPluginsMiddleware, type WithAuthPluginsOptions, withAuthPlugins } from "./middleware.js";
 export { default as authTables } from "./schema.js";
 import { BetterAuthOptions } from 'better-auth';
@@ -90,6 +91,35 @@ interface AuthInvitation {
   role?: null | string;
   status?: null | string;
 }
+/** One team row (from the `organization` plugin with `teams.enabled`). */
+interface AuthTeam {
+  [key: string]: unknown;
+  createdAt?: AuthTimestamp;
+  id: string;
+  name?: null | string;
+  organizationId: string;
+}
+/** One team-membership row (teams). */
+interface AuthTeamMember {
+  [key: string]: unknown;
+  createdAt?: AuthTimestamp;
+  id: string;
+  teamId: string;
+  userId: string;
+}
+/**
+* One custom organization role (from the organization plugin's dynamic
+* access-control). `permission` is a JSON string of a `resource → actions[]` map
+* as stored; the studio parses it for display/editing.
+*/
+interface AuthOrgRole {
+  [key: string]: unknown;
+  createdAt?: AuthTimestamp;
+  id: string;
+  organizationId: string;
+  permission?: null | string;
+  role?: null | string;
+}
 /** One registered passkey. Credential secrets (`publicKey`) are stripped. */
 interface AuthPasskey {
   [key: string]: unknown;
@@ -123,6 +153,63 @@ interface AuthCapabilities {
   /** The `two-factor` plugin: per-user 2FA status / disable. */
   twoFactor: boolean;
 }
+/**
+* One app/plugin-defined field the create-user form should render, derived from
+* the merged better-auth `user` table (core + plugin + `additionalFields`). Only
+* user-settable columns are surfaced — server-managed flags (`input: false`),
+* foreign keys (`references`), and the core columns the form already handles
+* (`email`/`name`/`role`/ban state/…) are filtered out upstream.
+*/
+interface AuthUserFieldSpec {
+  /** Logical field name (the key passed back in `createUser`'s `data`). */
+  name: string;
+  /** Best-effort plugin id the field originates from (`username`, `phone-number`, …); `undefined` for app `additionalFields`. */
+  plugin?: string;
+  required: boolean;
+  /** Coarse input kind the studio maps to a control (checkbox / number / date / text). */
+  type: "boolean" | "date" | "number" | "string";
+  unique: boolean;
+}
+/**
+* A rich, read-only description of the deployment's auth configuration for the
+* studio's config panel and dynamic create-user form. Unlike
+* {@link AuthCapabilities} (five booleans that gate panels), this exposes *what*
+* is configured — enabled plugins, email/password + social sign-in, the
+* user-settable fields, organization sub-features (teams / custom roles), and
+* the session + rate-limit policy — without ever leaking a secret.
+*/
+interface AuthConfigInfo {
+  /** The same capability booleans {@link AuthAdmin.capabilities} returns, embedded so a single call drives the whole panel. */
+  capabilities: AuthCapabilities;
+  /** Whether email + password sign-in is enabled. */
+  emailAndPassword: boolean;
+  /** Organization plugin sub-features. */
+  organization: {
+    enabled: boolean; /** Custom roles / dynamic access control (`organizationRole` table present). */
+    roles: boolean;
+    /** Teams (`team` table present). */
+    teams: boolean;
+  };
+  /** Enabled better-auth plugin ids, sorted. */
+  plugins: string[];
+  /** Rate-limit policy (window is in seconds). */
+  rateLimit: {
+    enabled: boolean;
+    max?: number;
+    window?: number;
+  };
+  /** Session policy (all durations in seconds). */
+  session: {
+    cookieCache?: boolean;
+    expiresIn?: number;
+    freshAge?: number;
+    updateAge?: number;
+  };
+  /** Configured social/OAuth provider ids, sorted. */
+  socialProviders: string[];
+  /** User-settable extra fields for the create-user form (plugin + app `additionalFields`). */
+  userFields: AuthUserFieldSpec[];
+}
 /** A scalar value usable in an adapter `where` clause / filter. */
 type WhereValue = boolean | number | string;
 /** Filtering / paging options for {@link AuthAdmin.listUsers}. */
@@ -158,6 +245,17 @@ interface ImpersonationResult {
 * surfaces the underlying adapter error.
 */
 interface AuthAdmin {
+  /** Directly add an existing user as an org member (server-side, no invitation/acceptance). */
+  addMember: (input: {
+    organizationId: string;
+    role?: string;
+    userId: string;
+  }) => Promise<AuthMember>;
+  /** Add a user to a team. */
+  addTeamMember: (input: {
+    teamId: string;
+    userId: string;
+  }) => Promise<AuthTeamMember>;
   banUser: (input: {
     expiresInSeconds?: number;
     reason?: string;
@@ -167,6 +265,27 @@ interface AuthAdmin {
     invitationId: string;
   }) => Promise<void>;
   capabilities: () => Promise<AuthCapabilities>;
+  /** Rich, read-only description of the auth configuration (plugins, fields, session policy, …). */
+  config: () => Promise<AuthConfigInfo>;
+  /** Create an organization; optionally seed an `owner` member for `ownerId`. */
+  createOrganization: (input: {
+    logo?: string;
+    metadata?: Record<string, unknown>;
+    name: string;
+    ownerId?: string;
+    slug?: string;
+  }) => Promise<AuthOrganization>;
+  /** Create a custom org role with a permission grant (a `resource → actions[]` map). */
+  createOrgRole: (input: {
+    organizationId: string;
+    permission: Record<string, string[]>;
+    role: string;
+  }) => Promise<AuthOrgRole>;
+  /** Create a team under an organization. */
+  createTeam: (input: {
+    name: string;
+    organizationId: string;
+  }) => Promise<AuthTeam>;
   createUser: (input: {
     data?: Record<string, unknown>;
     email: string;
@@ -174,6 +293,14 @@ interface AuthAdmin {
     password?: string;
     role?: string | string[];
   }) => Promise<AuthAdminUser>;
+  /** Delete an organization and cascade-delete its members, invitations, teams, and custom roles. */
+  deleteOrganization: (input: {
+    organizationId: string;
+  }) => Promise<void>;
+  /** Delete a custom org role. */
+  deleteOrgRole: (input: {
+    roleId: string;
+  }) => Promise<void>;
   deletePasskey: (input: {
     passkeyId: string;
   }) => Promise<void>;
@@ -183,6 +310,13 @@ interface AuthAdmin {
   impersonateUser: (input: {
     userId: string;
   }) => Promise<ImpersonationResult>;
+  /** Create a pending email invitation to an org (no acceptance side effects). */
+  inviteMember: (input: {
+    email: string;
+    inviterId?: string;
+    organizationId: string;
+    role?: string;
+  }) => Promise<AuthInvitation>;
   listAccounts: (input: {
     userId: string;
   }) => Promise<AuthAccount[]>;
@@ -200,6 +334,12 @@ interface AuthAdmin {
     limit?: number;
     offset?: number;
   }) => Promise<AuthPage<AuthOrganization>>;
+  /** List an org's custom roles. */
+  listOrgRoles: (options: {
+    limit?: number;
+    offset?: number;
+    organizationId: string;
+  }) => Promise<AuthPage<AuthOrgRole>>;
   listPasskeys: (input: {
     userId: string;
   }) => Promise<AuthPasskey[]>;
@@ -208,10 +348,30 @@ interface AuthAdmin {
     offset?: number;
     userId?: string;
   }) => Promise<AuthPage<AuthAdminSession>>;
+  /** List a team's members. */
+  listTeamMembers: (options: {
+    limit?: number;
+    offset?: number;
+    teamId: string;
+  }) => Promise<AuthPage<AuthTeamMember>>;
+  /** List an org's teams. */
+  listTeams: (options: {
+    limit?: number;
+    offset?: number;
+    organizationId: string;
+  }) => Promise<AuthPage<AuthTeam>>;
   listUsers: (options: ListUsersOptions) => Promise<AuthPage<AuthAdminUser>>;
   removeMember: (input: {
     memberId: string;
   }) => Promise<void>;
+  /** Delete a team and its memberships. */
+  removeTeam: (input: {
+    teamId: string;
+  }) => Promise<void>;
+  /** Remove a member from a team. */
+  removeTeamMember: (input: {
+    teamMemberId: string;
+  }) => Promise<void>;
   removeUser: (input: {
     userId: string;
   }) => Promise<void>;
@@ -236,6 +396,29 @@ interface AuthAdmin {
     accountId: string;
     userId: string;
   }) => Promise<void>;
+  /** Change a member's role. */
+  updateMemberRole: (input: {
+    memberId: string;
+    role: string | string[];
+  }) => Promise<AuthMember>;
+  /** Update an organization's name/slug/logo/metadata. */
+  updateOrganization: (input: {
+    logo?: string;
+    metadata?: Record<string, unknown>;
+    name?: string;
+    organizationId: string;
+    slug?: string;
+  }) => Promise<AuthOrganization>;
+  /** Replace a custom org role's permission grant. */
+  updateOrgRole: (input: {
+    permission: Record<string, string[]>;
+    roleId: string;
+  }) => Promise<AuthOrgRole>;
+  /** Rename a team. */
+  updateTeam: (input: {
+    name: string;
+    teamId: string;
+  }) => Promise<AuthTeam>;
   updateUser: (input: {
     data: Record<string, unknown>;
     userId: string;
@@ -271,8 +454,7 @@ interface CreateAuthAdminOptions {
 * surface that `code` so the runtime can map it onto an HTTP status and the
 * studio can show a meaningful message instead of a generic 500.
 */
-declare class LunoraAuthAdminError extends Error {
-  readonly code: string;
+declare class LunoraAuthAdminError extends LunoraError {
   constructor(message: string, code: string);
 }
 /**
@@ -333,6 +515,12 @@ declare const ensureMigrated: (auth: LunoraAuth | {
 * Compile better-auth's migrations to a single SQL string. Useful for
 * `wrangler d1 execute --file -` in CI so the deploy step applies the schema
 * before the first user request.
+*
+* Compiles from the SAME resolved options `createAuth` runs with (via
+* `resolveAuthOptions`), not the raw caller options — so the schema includes the
+* `rateLimit` table the worker's default-on durable limiter writes to. Compiling
+* from the raw options would omit it, and the running worker would then write to
+* a table the migration never created.
 */
 declare const compileMigrationsSql: (options: LunoraAuthOptions) => Promise<string>;
 /**
@@ -378,9 +566,13 @@ declare const validateSessionPolicy: (policy: SessionPolicy) => SessionPolicy;
 * });
 * ```
 *
-* - `rolling` — balanced default: 7-day absolute expiry, rotated once per day.
-* - `strict` — short, security-sensitive: 1-hour expiry, 15-minute rotation.
-* - `longLived` — low-friction consumer apps: 30-day expiry, daily rotation.
+* - `rolling` — balanced default: 7-day absolute expiry, rotated once per day,
+*   with a 60s signed-cookie session cache so bursts of authenticated calls
+*   skip the per-request DB session read.
+* - `strict` — short, security-sensitive: 1-hour expiry, 15-minute rotation,
+*   cookie cache **off** (fast revocation / short freshness is the whole point).
+* - `longLived` — low-friction consumer apps: 30-day expiry, daily rotation,
+*   with the same 60s cookie cache as `rolling`.
 */
 declare const sessionPresets: Record<"longLived" | "rolling" | "strict", SessionPolicy>;
 export { type AuthAccount, type AuthAdmin, type AuthAdminSession, type AuthAdminUser, type AuthCapabilities, type AuthInvitation, type AuthMember, type AuthOrganization, type AuthPage, type AuthPasskey, type AuthTimestamp, type CreateAuthAdminOptions, DEFAULT_AUTH_BASE_PATH, type ImpersonationResult, type ListUsersOptions, type LunoraAuth, LunoraAuthAdminError, type LunoraAuthOptions, type SessionPolicy, compileMigrationsSql, createAuthAdmin, ensureMigrated, handleAuthRequest, sessionPresets, validateSessionPolicy };

package/dist/index.mjs

@@ -1,11 +1,11 @@
 export { lunoraAuthAdapter, lunoraD1Adapter } from './adapter.mjs';
-export { LunoraAuthAdminError, createAuthAdmin } from './packem_shared/LunoraAuthAdminError-BxrfEeA_.mjs';
-export { createAuth } from './packem_shared/createAuth-B-tvsvQU.mjs';
+export { LunoraAuthAdminError, createAuthAdmin } from './packem_shared/LunoraAuthAdminError-D4L7n6gN.mjs';
+export { createAuth, resolveAuthOptions } from './packem_shared/createAuth-BVMMllTm.mjs';
 export { DEFAULT_AUTH_BASE_PATH, handleAuthRequest } from './packem_shared/DEFAULT_AUTH_BASE_PATH-DjcUWEQl.mjs';
 export { LunoraAuthHeadersError, withAuthPlugins } from './middleware.mjs';
-export { compileMigrationsSql, ensureMigrated } from './packem_shared/compileMigrationsSql-wZH3oXDu.mjs';
+export { compileMigrationsSql, ensureMigrated } from './packem_shared/compileMigrationsSql-B9bj-mJv.mjs';
 export { default as authTables } from './schema.mjs';
-export { sessionPresets, validateSessionPolicy } from './packem_shared/sessionPresets-B95rXrd8.mjs';
+export { sessionPresets, validateSessionPolicy } from './packem_shared/sessionPresets-Dwwd74_J.mjs';
 export { createSqlAuthStore, d1Executor } from './sql-store.mjs';
 export { createMemoryAuthStore, matchesWhere } from './store.mjs';
 export { TURNSTILE_VERIFY_ENDPOINT, verifyTurnstile } from './turnstile.mjs';

package/dist/middleware.d.mts

@@ -1,4 +1,5 @@
-import { L as LunoraAuth } from "./packem_shared/create-auth.d-M36jwG_Y.mjs";
+import { LunoraError } from '@lunora/errors';
+import { L as LunoraAuth } from "./packem_shared/create-auth.d-Mwhb4gSc.mjs";
 import 'better-auth';
 /**
 * Structural mirror of `@lunora/server`'s `MiddlewareNext` — the continuation
@@ -22,7 +23,7 @@ interface MiddlewareNext<ContextIn> {
 * advisor lint — both treat a header-less `ctx.authApi.*` call as an
 * authorization bypass, so a call that trips the lint also trips this guard.
 */
-declare class LunoraAuthHeadersError extends Error {
+declare class LunoraAuthHeadersError extends LunoraError {
   /** The `ctx.authApi.&lt;method>` that was called without `headers`. */
   readonly method: string;
   constructor(method: string);

package/dist/middleware.d.ts

@@ -1,4 +1,5 @@
-import { L as LunoraAuth } from "./packem_shared/create-auth.d-M36jwG_Y.js";
+import { LunoraError } from '@lunora/errors';
+import { L as LunoraAuth } from "./packem_shared/create-auth.d-Mwhb4gSc.js";
 import 'better-auth';
 /**
 * Structural mirror of `@lunora/server`'s `MiddlewareNext` — the continuation
@@ -22,7 +23,7 @@ interface MiddlewareNext<ContextIn> {
 * advisor lint — both treat a header-less `ctx.authApi.*` call as an
 * authorization bypass, so a call that trips the lint also trips this guard.
 */
-declare class LunoraAuthHeadersError extends Error {
+declare class LunoraAuthHeadersError extends LunoraError {
   /** The `ctx.authApi.&lt;method>` that was called without `headers`. */
   readonly method: string;
   constructor(method: string);

package/dist/middleware.mjs

@@ -1,3 +1,5 @@
+import { LunoraError } from '@lunora/errors';
+
 const callHasHeaders = (argument) => {
   if (argument === void 0) {
     return false;
@@ -30,14 +32,15 @@ const guardAuthApi = (api) => {
     }
   });
 };
-class LunoraAuthHeadersError extends Error {
+class LunoraAuthHeadersError extends LunoraError {
   /** The `ctx.authApi.<method>` that was called without `headers`. */
   method;
   constructor(method) {
     super(
-      `@lunora/auth: ctx.authApi.${method}(…) was called without \`headers\`. better-auth treats a header-less call as a trusted server-to-server invocation and skips session authorization entirely — an authorization bypass. Pass the inbound request headers: ctx.authApi.${method}({ body, headers: request.headers }). If you genuinely intend an unauthenticated server-to-server call, opt out explicitly via ctx.authApi.withoutHeaders().<method>(…), or disable the guard for the whole middleware with withAuthPlugins(auth, { enforceHeaders: false }).`
+      "AUTH_HEADERS_MISSING",
+      `@lunora/auth: ctx.authApi.${method}(…) was called without \`headers\`. better-auth treats a header-less call as a trusted server-to-server invocation and skips session authorization entirely — an authorization bypass. Pass the inbound request headers: ctx.authApi.${method}({ body, headers: request.headers }). If you genuinely intend an unauthenticated server-to-server call, opt out explicitly via ctx.authApi.withoutHeaders().<method>(…), or disable the guard for the whole middleware with withAuthPlugins(auth, { enforceHeaders: false }).`,
+      { name: "LunoraAuthHeadersError" }
     );
-    this.name = "LunoraAuthHeadersError";
     this.method = method;
   }
 }