@lunora/auth 1.0.0-alpha.20 → 1.0.0-alpha.22

package/dist/index.d.mts

@@ -91,6 +91,35 @@ interface AuthInvitation {
   role?: null | string;
   status?: null | string;
 }
+/** One team row (from the `organization` plugin with `teams.enabled`). */
+interface AuthTeam {
+  [key: string]: unknown;
+  createdAt?: AuthTimestamp;
+  id: string;
+  name?: null | string;
+  organizationId: string;
+}
+/** One team-membership row (teams). */
+interface AuthTeamMember {
+  [key: string]: unknown;
+  createdAt?: AuthTimestamp;
+  id: string;
+  teamId: string;
+  userId: string;
+}
+/**
+* One custom organization role (from the organization plugin's dynamic
+* access-control). `permission` is a JSON string of a `resource → actions[]` map
+* as stored; the studio parses it for display/editing.
+*/
+interface AuthOrgRole {
+  [key: string]: unknown;
+  createdAt?: AuthTimestamp;
+  id: string;
+  organizationId: string;
+  permission?: null | string;
+  role?: null | string;
+}
 /** One registered passkey. Credential secrets (`publicKey`) are stripped. */
 interface AuthPasskey {
   [key: string]: unknown;
@@ -124,6 +153,63 @@ interface AuthCapabilities {
   /** The `two-factor` plugin: per-user 2FA status / disable. */
   twoFactor: boolean;
 }
+/**
+* One app/plugin-defined field the create-user form should render, derived from
+* the merged better-auth `user` table (core + plugin + `additionalFields`). Only
+* user-settable columns are surfaced — server-managed flags (`input: false`),
+* foreign keys (`references`), and the core columns the form already handles
+* (`email`/`name`/`role`/ban state/…) are filtered out upstream.
+*/
+interface AuthUserFieldSpec {
+  /** Logical field name (the key passed back in `createUser`'s `data`). */
+  name: string;
+  /** Best-effort plugin id the field originates from (`username`, `phone-number`, …); `undefined` for app `additionalFields`. */
+  plugin?: string;
+  required: boolean;
+  /** Coarse input kind the studio maps to a control (checkbox / number / date / text). */
+  type: "boolean" | "date" | "number" | "string";
+  unique: boolean;
+}
+/**
+* A rich, read-only description of the deployment's auth configuration for the
+* studio's config panel and dynamic create-user form. Unlike
+* {@link AuthCapabilities} (five booleans that gate panels), this exposes *what*
+* is configured — enabled plugins, email/password + social sign-in, the
+* user-settable fields, organization sub-features (teams / custom roles), and
+* the session + rate-limit policy — without ever leaking a secret.
+*/
+interface AuthConfigInfo {
+  /** The same capability booleans {@link AuthAdmin.capabilities} returns, embedded so a single call drives the whole panel. */
+  capabilities: AuthCapabilities;
+  /** Whether email + password sign-in is enabled. */
+  emailAndPassword: boolean;
+  /** Organization plugin sub-features. */
+  organization: {
+    enabled: boolean; /** Custom roles / dynamic access control (`organizationRole` table present). */
+    roles: boolean;
+    /** Teams (`team` table present). */
+    teams: boolean;
+  };
+  /** Enabled better-auth plugin ids, sorted. */
+  plugins: string[];
+  /** Rate-limit policy (window is in seconds). */
+  rateLimit: {
+    enabled: boolean;
+    max?: number;
+    window?: number;
+  };
+  /** Session policy (all durations in seconds). */
+  session: {
+    cookieCache?: boolean;
+    expiresIn?: number;
+    freshAge?: number;
+    updateAge?: number;
+  };
+  /** Configured social/OAuth provider ids, sorted. */
+  socialProviders: string[];
+  /** User-settable extra fields for the create-user form (plugin + app `additionalFields`). */
+  userFields: AuthUserFieldSpec[];
+}
 /** A scalar value usable in an adapter `where` clause / filter. */
 type WhereValue = boolean | number | string;
 /** Filtering / paging options for {@link AuthAdmin.listUsers}. */
@@ -159,6 +245,17 @@ interface ImpersonationResult {
 * surfaces the underlying adapter error.
 */
 interface AuthAdmin {
+  /** Directly add an existing user as an org member (server-side, no invitation/acceptance). */
+  addMember: (input: {
+    organizationId: string;
+    role?: string;
+    userId: string;
+  }) => Promise<AuthMember>;
+  /** Add a user to a team. */
+  addTeamMember: (input: {
+    teamId: string;
+    userId: string;
+  }) => Promise<AuthTeamMember>;
   banUser: (input: {
     expiresInSeconds?: number;
     reason?: string;
@@ -168,6 +265,27 @@ interface AuthAdmin {
     invitationId: string;
   }) => Promise<void>;
   capabilities: () => Promise<AuthCapabilities>;
+  /** Rich, read-only description of the auth configuration (plugins, fields, session policy, …). */
+  config: () => Promise<AuthConfigInfo>;
+  /** Create an organization; optionally seed an `owner` member for `ownerId`. */
+  createOrganization: (input: {
+    logo?: string;
+    metadata?: Record<string, unknown>;
+    name: string;
+    ownerId?: string;
+    slug?: string;
+  }) => Promise<AuthOrganization>;
+  /** Create a custom org role with a permission grant (a `resource → actions[]` map). */
+  createOrgRole: (input: {
+    organizationId: string;
+    permission: Record<string, string[]>;
+    role: string;
+  }) => Promise<AuthOrgRole>;
+  /** Create a team under an organization. */
+  createTeam: (input: {
+    name: string;
+    organizationId: string;
+  }) => Promise<AuthTeam>;
   createUser: (input: {
     data?: Record<string, unknown>;
     email: string;
@@ -175,6 +293,14 @@ interface AuthAdmin {
     password?: string;
     role?: string | string[];
   }) => Promise<AuthAdminUser>;
+  /** Delete an organization and cascade-delete its members, invitations, teams, and custom roles. */
+  deleteOrganization: (input: {
+    organizationId: string;
+  }) => Promise<void>;
+  /** Delete a custom org role. */
+  deleteOrgRole: (input: {
+    roleId: string;
+  }) => Promise<void>;
   deletePasskey: (input: {
     passkeyId: string;
   }) => Promise<void>;
@@ -184,6 +310,13 @@ interface AuthAdmin {
   impersonateUser: (input: {
     userId: string;
   }) => Promise<ImpersonationResult>;
+  /** Create a pending email invitation to an org (no acceptance side effects). */
+  inviteMember: (input: {
+    email: string;
+    inviterId?: string;
+    organizationId: string;
+    role?: string;
+  }) => Promise<AuthInvitation>;
   listAccounts: (input: {
     userId: string;
   }) => Promise<AuthAccount[]>;
@@ -201,6 +334,12 @@ interface AuthAdmin {
     limit?: number;
     offset?: number;
   }) => Promise<AuthPage<AuthOrganization>>;
+  /** List an org's custom roles. */
+  listOrgRoles: (options: {
+    limit?: number;
+    offset?: number;
+    organizationId: string;
+  }) => Promise<AuthPage<AuthOrgRole>>;
   listPasskeys: (input: {
     userId: string;
   }) => Promise<AuthPasskey[]>;
@@ -209,10 +348,30 @@ interface AuthAdmin {
     offset?: number;
     userId?: string;
   }) => Promise<AuthPage<AuthAdminSession>>;
+  /** List a team's members. */
+  listTeamMembers: (options: {
+    limit?: number;
+    offset?: number;
+    teamId: string;
+  }) => Promise<AuthPage<AuthTeamMember>>;
+  /** List an org's teams. */
+  listTeams: (options: {
+    limit?: number;
+    offset?: number;
+    organizationId: string;
+  }) => Promise<AuthPage<AuthTeam>>;
   listUsers: (options: ListUsersOptions) => Promise<AuthPage<AuthAdminUser>>;
   removeMember: (input: {
     memberId: string;
   }) => Promise<void>;
+  /** Delete a team and its memberships. */
+  removeTeam: (input: {
+    teamId: string;
+  }) => Promise<void>;
+  /** Remove a member from a team. */
+  removeTeamMember: (input: {
+    teamMemberId: string;
+  }) => Promise<void>;
   removeUser: (input: {
     userId: string;
   }) => Promise<void>;
@@ -237,6 +396,29 @@ interface AuthAdmin {
     accountId: string;
     userId: string;
   }) => Promise<void>;
+  /** Change a member's role. */
+  updateMemberRole: (input: {
+    memberId: string;
+    role: string | string[];
+  }) => Promise<AuthMember>;
+  /** Update an organization's name/slug/logo/metadata. */
+  updateOrganization: (input: {
+    logo?: string;
+    metadata?: Record<string, unknown>;
+    name?: string;
+    organizationId: string;
+    slug?: string;
+  }) => Promise<AuthOrganization>;
+  /** Replace a custom org role's permission grant. */
+  updateOrgRole: (input: {
+    permission: Record<string, string[]>;
+    roleId: string;
+  }) => Promise<AuthOrgRole>;
+  /** Rename a team. */
+  updateTeam: (input: {
+    name: string;
+    teamId: string;
+  }) => Promise<AuthTeam>;
   updateUser: (input: {
     data: Record<string, unknown>;
     userId: string;

package/dist/index.d.ts

@@ -91,6 +91,35 @@ interface AuthInvitation {
   role?: null | string;
   status?: null | string;
 }
+/** One team row (from the `organization` plugin with `teams.enabled`). */
+interface AuthTeam {
+  [key: string]: unknown;
+  createdAt?: AuthTimestamp;
+  id: string;
+  name?: null | string;
+  organizationId: string;
+}
+/** One team-membership row (teams). */
+interface AuthTeamMember {
+  [key: string]: unknown;
+  createdAt?: AuthTimestamp;
+  id: string;
+  teamId: string;
+  userId: string;
+}
+/**
+* One custom organization role (from the organization plugin's dynamic
+* access-control). `permission` is a JSON string of a `resource → actions[]` map
+* as stored; the studio parses it for display/editing.
+*/
+interface AuthOrgRole {
+  [key: string]: unknown;
+  createdAt?: AuthTimestamp;
+  id: string;
+  organizationId: string;
+  permission?: null | string;
+  role?: null | string;
+}
 /** One registered passkey. Credential secrets (`publicKey`) are stripped. */
 interface AuthPasskey {
   [key: string]: unknown;
@@ -124,6 +153,63 @@ interface AuthCapabilities {
   /** The `two-factor` plugin: per-user 2FA status / disable. */
   twoFactor: boolean;
 }
+/**
+* One app/plugin-defined field the create-user form should render, derived from
+* the merged better-auth `user` table (core + plugin + `additionalFields`). Only
+* user-settable columns are surfaced — server-managed flags (`input: false`),
+* foreign keys (`references`), and the core columns the form already handles
+* (`email`/`name`/`role`/ban state/…) are filtered out upstream.
+*/
+interface AuthUserFieldSpec {
+  /** Logical field name (the key passed back in `createUser`'s `data`). */
+  name: string;
+  /** Best-effort plugin id the field originates from (`username`, `phone-number`, …); `undefined` for app `additionalFields`. */
+  plugin?: string;
+  required: boolean;
+  /** Coarse input kind the studio maps to a control (checkbox / number / date / text). */
+  type: "boolean" | "date" | "number" | "string";
+  unique: boolean;
+}
+/**
+* A rich, read-only description of the deployment's auth configuration for the
+* studio's config panel and dynamic create-user form. Unlike
+* {@link AuthCapabilities} (five booleans that gate panels), this exposes *what*
+* is configured — enabled plugins, email/password + social sign-in, the
+* user-settable fields, organization sub-features (teams / custom roles), and
+* the session + rate-limit policy — without ever leaking a secret.
+*/
+interface AuthConfigInfo {
+  /** The same capability booleans {@link AuthAdmin.capabilities} returns, embedded so a single call drives the whole panel. */
+  capabilities: AuthCapabilities;
+  /** Whether email + password sign-in is enabled. */
+  emailAndPassword: boolean;
+  /** Organization plugin sub-features. */
+  organization: {
+    enabled: boolean; /** Custom roles / dynamic access control (`organizationRole` table present). */
+    roles: boolean;
+    /** Teams (`team` table present). */
+    teams: boolean;
+  };
+  /** Enabled better-auth plugin ids, sorted. */
+  plugins: string[];
+  /** Rate-limit policy (window is in seconds). */
+  rateLimit: {
+    enabled: boolean;
+    max?: number;
+    window?: number;
+  };
+  /** Session policy (all durations in seconds). */
+  session: {
+    cookieCache?: boolean;
+    expiresIn?: number;
+    freshAge?: number;
+    updateAge?: number;
+  };
+  /** Configured social/OAuth provider ids, sorted. */
+  socialProviders: string[];
+  /** User-settable extra fields for the create-user form (plugin + app `additionalFields`). */
+  userFields: AuthUserFieldSpec[];
+}
 /** A scalar value usable in an adapter `where` clause / filter. */
 type WhereValue = boolean | number | string;
 /** Filtering / paging options for {@link AuthAdmin.listUsers}. */
@@ -159,6 +245,17 @@ interface ImpersonationResult {
 * surfaces the underlying adapter error.
 */
 interface AuthAdmin {
+  /** Directly add an existing user as an org member (server-side, no invitation/acceptance). */
+  addMember: (input: {
+    organizationId: string;
+    role?: string;
+    userId: string;
+  }) => Promise<AuthMember>;
+  /** Add a user to a team. */
+  addTeamMember: (input: {
+    teamId: string;
+    userId: string;
+  }) => Promise<AuthTeamMember>;
   banUser: (input: {
     expiresInSeconds?: number;
     reason?: string;
@@ -168,6 +265,27 @@ interface AuthAdmin {
     invitationId: string;
   }) => Promise<void>;
   capabilities: () => Promise<AuthCapabilities>;
+  /** Rich, read-only description of the auth configuration (plugins, fields, session policy, …). */
+  config: () => Promise<AuthConfigInfo>;
+  /** Create an organization; optionally seed an `owner` member for `ownerId`. */
+  createOrganization: (input: {
+    logo?: string;
+    metadata?: Record<string, unknown>;
+    name: string;
+    ownerId?: string;
+    slug?: string;
+  }) => Promise<AuthOrganization>;
+  /** Create a custom org role with a permission grant (a `resource → actions[]` map). */
+  createOrgRole: (input: {
+    organizationId: string;
+    permission: Record<string, string[]>;
+    role: string;
+  }) => Promise<AuthOrgRole>;
+  /** Create a team under an organization. */
+  createTeam: (input: {
+    name: string;
+    organizationId: string;
+  }) => Promise<AuthTeam>;
   createUser: (input: {
     data?: Record<string, unknown>;
     email: string;
@@ -175,6 +293,14 @@ interface AuthAdmin {
     password?: string;
     role?: string | string[];
   }) => Promise<AuthAdminUser>;
+  /** Delete an organization and cascade-delete its members, invitations, teams, and custom roles. */
+  deleteOrganization: (input: {
+    organizationId: string;
+  }) => Promise<void>;
+  /** Delete a custom org role. */
+  deleteOrgRole: (input: {
+    roleId: string;
+  }) => Promise<void>;
   deletePasskey: (input: {
     passkeyId: string;
   }) => Promise<void>;
@@ -184,6 +310,13 @@ interface AuthAdmin {
   impersonateUser: (input: {
     userId: string;
   }) => Promise<ImpersonationResult>;
+  /** Create a pending email invitation to an org (no acceptance side effects). */
+  inviteMember: (input: {
+    email: string;
+    inviterId?: string;
+    organizationId: string;
+    role?: string;
+  }) => Promise<AuthInvitation>;
   listAccounts: (input: {
     userId: string;
   }) => Promise<AuthAccount[]>;
@@ -201,6 +334,12 @@ interface AuthAdmin {
     limit?: number;
     offset?: number;
   }) => Promise<AuthPage<AuthOrganization>>;
+  /** List an org's custom roles. */
+  listOrgRoles: (options: {
+    limit?: number;
+    offset?: number;
+    organizationId: string;
+  }) => Promise<AuthPage<AuthOrgRole>>;
   listPasskeys: (input: {
     userId: string;
   }) => Promise<AuthPasskey[]>;
@@ -209,10 +348,30 @@ interface AuthAdmin {
     offset?: number;
     userId?: string;
   }) => Promise<AuthPage<AuthAdminSession>>;
+  /** List a team's members. */
+  listTeamMembers: (options: {
+    limit?: number;
+    offset?: number;
+    teamId: string;
+  }) => Promise<AuthPage<AuthTeamMember>>;
+  /** List an org's teams. */
+  listTeams: (options: {
+    limit?: number;
+    offset?: number;
+    organizationId: string;
+  }) => Promise<AuthPage<AuthTeam>>;
   listUsers: (options: ListUsersOptions) => Promise<AuthPage<AuthAdminUser>>;
   removeMember: (input: {
     memberId: string;
   }) => Promise<void>;
+  /** Delete a team and its memberships. */
+  removeTeam: (input: {
+    teamId: string;
+  }) => Promise<void>;
+  /** Remove a member from a team. */
+  removeTeamMember: (input: {
+    teamMemberId: string;
+  }) => Promise<void>;
   removeUser: (input: {
     userId: string;
   }) => Promise<void>;
@@ -237,6 +396,29 @@ interface AuthAdmin {
     accountId: string;
     userId: string;
   }) => Promise<void>;
+  /** Change a member's role. */
+  updateMemberRole: (input: {
+    memberId: string;
+    role: string | string[];
+  }) => Promise<AuthMember>;
+  /** Update an organization's name/slug/logo/metadata. */
+  updateOrganization: (input: {
+    logo?: string;
+    metadata?: Record<string, unknown>;
+    name?: string;
+    organizationId: string;
+    slug?: string;
+  }) => Promise<AuthOrganization>;
+  /** Replace a custom org role's permission grant. */
+  updateOrgRole: (input: {
+    permission: Record<string, string[]>;
+    roleId: string;
+  }) => Promise<AuthOrgRole>;
+  /** Rename a team. */
+  updateTeam: (input: {
+    name: string;
+    teamId: string;
+  }) => Promise<AuthTeam>;
   updateUser: (input: {
     data: Record<string, unknown>;
     userId: string;

package/dist/index.mjs

@@ -1,5 +1,5 @@
 export { lunoraAuthAdapter, lunoraD1Adapter } from './adapter.mjs';
-export { LunoraAuthAdminError, createAuthAdmin } from './packem_shared/LunoraAuthAdminError-BpVImgEy.mjs';
+export { LunoraAuthAdminError, createAuthAdmin } from './packem_shared/LunoraAuthAdminError-D4L7n6gN.mjs';
 export { createAuth, resolveAuthOptions } from './packem_shared/createAuth-BVMMllTm.mjs';
 export { DEFAULT_AUTH_BASE_PATH, handleAuthRequest } from './packem_shared/DEFAULT_AUTH_BASE_PATH-DjcUWEQl.mjs';
 export { LunoraAuthHeadersError, withAuthPlugins } from './middleware.mjs';

package/dist/packem_shared/LunoraAuthAdminError-D4L7n6gN.mjs

@@ -0,0 +1,510 @@
+import { LunoraError } from '@lunora/errors';
+import { getAuthTables } from 'better-auth/db';
+
+class LunoraAuthAdminError extends LunoraError {
+  constructor(message, code) {
+    super(code, message, { name: "LunoraAuthAdminError" });
+  }
+}
+const DEFAULT_LIMIT = 50;
+const MAX_LIMIT = 500;
+const DEFAULT_IMPERSONATION_SECONDS = 3600;
+const MAX_IMPERSONATION_SECONDS = DEFAULT_IMPERSONATION_SECONDS * 24;
+const MAX_BAN_SECONDS = 100 * 365 * 24 * 60 * 60;
+const INVITATION_TTL_MS = 48 * 60 * 60 * 1e3;
+const SENSITIVE_FIELDS = /* @__PURE__ */ new Set(["accessToken", "backupCodes", "idToken", "password", "publicKey", "refreshToken", "secret", "token"]);
+const clampLimit = (limit) => Math.min(Math.max(Math.trunc(limit ?? DEFAULT_LIMIT), 1), MAX_LIMIT);
+const clampOffset = (offset) => Math.max(0, Math.trunc(offset ?? 0));
+const normalizeRow = (row) => {
+  const out = {};
+  for (const [key, value] of Object.entries(row)) {
+    if (SENSITIVE_FIELDS.has(key)) {
+      continue;
+    }
+    out[key] = value instanceof Date ? value.getTime() : value;
+  }
+  return out;
+};
+const serializeRole = (role) => Array.isArray(role) ? role.join(",") : role;
+const slugify = (value) => value.toLowerCase().replaceAll(/[^\da-z]+/g, "-").replaceAll(/^-|-$/g, "");
+const CORE_USER_FIELDS = /* @__PURE__ */ new Set(["banExpires", "banned", "banReason", "createdAt", "email", "emailVerified", "id", "name", "role", "updatedAt"]);
+const USER_FIELD_PLUGIN = {
+  displayUsername: "username",
+  phoneNumber: "phone-number",
+  phoneNumberVerified: "phone-number",
+  username: "username"
+};
+const mapUserFieldType = (type) => {
+  if (type === "boolean") {
+    return "boolean";
+  }
+  if (type === "date") {
+    return "date";
+  }
+  if (type === "number") {
+    return "number";
+  }
+  return "string";
+};
+const buildUserFields = (userFields) => {
+  const out = [];
+  for (const [name, attribute] of Object.entries(userFields)) {
+    if (attribute.input === false || attribute.references !== void 0 || CORE_USER_FIELDS.has(name)) {
+      continue;
+    }
+    out.push({
+      name,
+      plugin: USER_FIELD_PLUGIN[name],
+      required: attribute.required === true,
+      type: mapUserFieldType(attribute.type),
+      unique: attribute.unique === true
+    });
+  }
+  return out;
+};
+const asAdminError = (error) => {
+  if (error instanceof LunoraAuthAdminError) {
+    return error;
+  }
+  const candidate = error;
+  const code = candidate?.body?.code ?? candidate?.code ?? "AUTH_ADMIN_ERROR";
+  const message = candidate?.body?.message ?? candidate?.message ?? "auth admin operation failed";
+  return new LunoraAuthAdminError(message, code);
+};
+const createAuthAdmin = (auth, options = {}) => {
+  const context = auth.$context;
+  const features = options.features ?? {};
+  const withContext = async (function_) => {
+    try {
+      return await function_(await context);
+    } catch (error) {
+      throw asAdminError(error);
+    }
+  };
+  const toUser = (row) => normalizeRow(row);
+  const page = async (context_, model, options_) => {
+    const where = options_.where && options_.where.length > 0 ? options_.where : void 0;
+    const [rows, total] = await Promise.all([
+      context_.adapter.findMany({
+        limit: clampLimit(options_.limit),
+        model,
+        offset: clampOffset(options_.offset),
+        sortBy: options_.sortBy,
+        where
+      }),
+      context_.adapter.count({ model, where })
+    ]);
+    return { rows: rows.map((row) => normalizeRow(row)), total };
+  };
+  return {
+    banUser: ({ expiresInSeconds, reason, userId }) => withContext(async (context_) => {
+      const seconds = typeof expiresInSeconds === "number" && Number.isFinite(expiresInSeconds) ? Math.min(Math.trunc(expiresInSeconds), MAX_BAN_SECONDS) : 0;
+      const banExpires = seconds > 0 ? new Date(Date.now() + seconds * 1e3) : void 0;
+      const user = await context_.internalAdapter.updateUser(userId, {
+        banExpires,
+        banned: true,
+        banReason: reason ?? "No reason"
+      });
+      await context_.internalAdapter.deleteUserSessions(userId);
+      return toUser(user);
+    }),
+    cancelInvitation: ({ invitationId }) => withContext(async (context_) => {
+      await context_.adapter.delete({ model: "invitation", where: [{ field: "id", value: invitationId }] });
+    }),
+    capabilities: () => withContext((context_) => {
+      const ids = new Set((context_.options.plugins ?? []).map((plugin) => plugin.id));
+      const has = (id) => ids.has(id);
+      return Promise.resolve({
+        accounts: features.accounts ?? true,
+        admin: features.admin ?? has("admin"),
+        organization: features.organization ?? has("organization"),
+        passkey: features.passkey ?? has("passkey"),
+        twoFactor: features.twoFactor ?? has("two-factor")
+      });
+    }),
+    // ── Directly add an existing user to an org (no invitation/acceptance). ──
+    addMember: ({ organizationId, role, userId }) => withContext(async (context_) => {
+      const member = await context_.adapter.create({
+        data: { createdAt: /* @__PURE__ */ new Date(), organizationId, role: role === void 0 || role === "" ? "member" : role, userId },
+        model: "member"
+      });
+      return normalizeRow(member);
+    }),
+    addTeamMember: ({ teamId, userId }) => withContext(async (context_) => {
+      const teamMember = await context_.adapter.create({
+        data: { createdAt: /* @__PURE__ */ new Date(), teamId, userId },
+        model: "teamMember"
+      });
+      return normalizeRow(teamMember);
+    }),
+    // Rich introspection for the config panel + dynamic create-user form. Reads
+    // only from the resolved better-auth options (no DB, no secrets).
+    config: () => withContext((context_) => {
+      const authOptions = context_.options;
+      const ids = new Set((authOptions.plugins ?? []).map((plugin) => plugin.id));
+      const has = (id) => ids.has(id);
+      const capabilities = {
+        accounts: features.accounts ?? true,
+        admin: features.admin ?? has("admin"),
+        organization: features.organization ?? has("organization"),
+        passkey: features.passkey ?? has("passkey"),
+        twoFactor: features.twoFactor ?? has("two-factor")
+      };
+      const tables = getAuthTables(authOptions);
+      const session = authOptions.session ?? {};
+      const rateLimit = authOptions.rateLimit ?? {};
+      return Promise.resolve({
+        capabilities,
+        emailAndPassword: authOptions.emailAndPassword?.enabled ?? false,
+        organization: {
+          enabled: capabilities.organization,
+          roles: Boolean(tables["organizationRole"]),
+          teams: Boolean(tables["team"])
+        },
+        plugins: [...ids].toSorted((a, b) => a.localeCompare(b)),
+        rateLimit: { enabled: rateLimit.enabled ?? false, max: rateLimit.max, window: rateLimit.window },
+        session: {
+          cookieCache: session.cookieCache?.enabled,
+          expiresIn: session.expiresIn,
+          freshAge: session.freshAge,
+          updateAge: session.updateAge
+        },
+        socialProviders: Object.keys(authOptions.socialProviders ?? {}).toSorted((a, b) => a.localeCompare(b)),
+        userFields: buildUserFields(tables["user"]?.fields ?? {})
+      });
+    }),
+    createOrganization: ({ logo, metadata, name, ownerId, slug }) => withContext(async (context_) => {
+      const finalSlug = slug !== void 0 && slug !== "" ? slugify(slug) : slugify(name);
+      if (finalSlug === "") {
+        throw new LunoraAuthAdminError("could not derive a slug from the organization name", "ORG_SLUG_INVALID");
+      }
+      const existing = await context_.adapter.findOne({
+        model: "organization",
+        where: [{ field: "slug", value: finalSlug }]
+      });
+      if (existing) {
+        throw new LunoraAuthAdminError("an organization with this slug already exists", "ORG_SLUG_TAKEN");
+      }
+      const organization = await context_.adapter.create({
+        data: {
+          createdAt: /* @__PURE__ */ new Date(),
+          logo: logo === void 0 || logo === "" ? void 0 : logo,
+          metadata: metadata === void 0 ? void 0 : JSON.stringify(metadata),
+          name,
+          slug: finalSlug
+        },
+        model: "organization"
+      });
+      if (ownerId !== void 0 && ownerId !== "") {
+        await context_.adapter.create({
+          data: { createdAt: /* @__PURE__ */ new Date(), organizationId: organization.id, role: "owner", userId: ownerId },
+          model: "member"
+        });
+      }
+      return normalizeRow(organization);
+    }),
+    createOrgRole: ({ organizationId, permission, role }) => withContext(async (context_) => {
+      const created = await context_.adapter.create({
+        data: { createdAt: /* @__PURE__ */ new Date(), organizationId, permission: JSON.stringify(permission), role },
+        model: "organizationRole"
+      });
+      return normalizeRow(created);
+    }),
+    createTeam: ({ name, organizationId }) => withContext(async (context_) => {
+      const team = await context_.adapter.create({
+        data: { createdAt: /* @__PURE__ */ new Date(), name, organizationId },
+        model: "team"
+      });
+      return normalizeRow(team);
+    }),
+    deleteOrganization: ({ organizationId }) => withContext(async (context_) => {
+      const tables = getAuthTables(context_.options);
+      await context_.adapter.deleteMany({ model: "member", where: [{ field: "organizationId", value: organizationId }] });
+      await context_.adapter.deleteMany({ model: "invitation", where: [{ field: "organizationId", value: organizationId }] });
+      if (tables["team"]) {
+        const teams = await context_.adapter.findMany({
+          model: "team",
+          where: [{ field: "organizationId", value: organizationId }]
+        });
+        for (const team of teams) {
+          await context_.adapter.deleteMany({ model: "teamMember", where: [{ field: "teamId", value: team.id }] });
+        }
+        await context_.adapter.deleteMany({ model: "team", where: [{ field: "organizationId", value: organizationId }] });
+      }
+      if (tables["organizationRole"]) {
+        await context_.adapter.deleteMany({ model: "organizationRole", where: [{ field: "organizationId", value: organizationId }] });
+      }
+      await context_.adapter.delete({ model: "organization", where: [{ field: "id", value: organizationId }] });
+    }),
+    deleteOrgRole: ({ roleId }) => withContext(async (context_) => {
+      await context_.adapter.delete({ model: "organizationRole", where: [{ field: "id", value: roleId }] });
+    }),
+    // Create a pending email invitation. `inviterId` is DB-required; when the
+    // caller omits it, attribute the invite to the org's owner (else any member).
+    inviteMember: ({ email, inviterId, organizationId, role }) => withContext(async (context_) => {
+      let resolvedInviter = inviterId;
+      if (resolvedInviter === void 0 || resolvedInviter === "") {
+        const members = await context_.adapter.findMany({
+          model: "member",
+          where: [{ field: "organizationId", value: organizationId }]
+        });
+        const owner = members.find((member) => typeof member.role === "string" && member.role.includes("owner"));
+        resolvedInviter = (owner ?? members[0])?.userId;
+      }
+      if (resolvedInviter === void 0 || resolvedInviter === "") {
+        throw new LunoraAuthAdminError("provide an inviter — the organization has no members to attribute the invitation to", "INVITER_REQUIRED");
+      }
+      const invitation = await context_.adapter.create({
+        data: {
+          createdAt: /* @__PURE__ */ new Date(),
+          email: email.toLowerCase(),
+          expiresAt: new Date(Date.now() + INVITATION_TTL_MS),
+          inviterId: resolvedInviter,
+          organizationId,
+          role: role === void 0 || role === "" ? "member" : role,
+          status: "pending"
+        },
+        model: "invitation"
+      });
+      return normalizeRow(invitation);
+    }),
+    listOrgRoles: ({ limit, offset, organizationId }) => withContext(
+      (context_) => page(context_, "organizationRole", {
+        limit,
+        offset,
+        sortBy: { direction: "desc", field: "createdAt" },
+        where: [{ field: "organizationId", value: organizationId }]
+      })
+    ),
+    listTeamMembers: ({ limit, offset, teamId }) => withContext(
+      (context_) => page(context_, "teamMember", {
+        limit,
+        offset,
+        where: [{ field: "teamId", value: teamId }]
+      })
+    ),
+    listTeams: ({ limit, offset, organizationId }) => withContext(
+      (context_) => page(context_, "team", {
+        limit,
+        offset,
+        sortBy: { direction: "desc", field: "createdAt" },
+        where: [{ field: "organizationId", value: organizationId }]
+      })
+    ),
+    removeTeam: ({ teamId }) => withContext(async (context_) => {
+      await context_.adapter.deleteMany({ model: "teamMember", where: [{ field: "teamId", value: teamId }] });
+      await context_.adapter.delete({ model: "team", where: [{ field: "id", value: teamId }] });
+    }),
+    removeTeamMember: ({ teamMemberId }) => withContext(async (context_) => {
+      await context_.adapter.delete({ model: "teamMember", where: [{ field: "id", value: teamMemberId }] });
+    }),
+    updateMemberRole: ({ memberId, role }) => withContext(async (context_) => {
+      const member = await context_.adapter.update({
+        model: "member",
+        update: { role: serializeRole(role) },
+        where: [{ field: "id", value: memberId }]
+      });
+      return normalizeRow(member ?? { id: memberId, role: serializeRole(role) });
+    }),
+    updateOrganization: ({ logo, metadata, name, organizationId, slug }) => withContext(async (context_) => {
+      const update = {};
+      if (name !== void 0) {
+        update["name"] = name;
+      }
+      if (slug !== void 0 && slug !== "") {
+        update["slug"] = slugify(slug);
+      }
+      if (logo !== void 0) {
+        update["logo"] = logo === "" ? void 0 : logo;
+      }
+      if (metadata !== void 0) {
+        update["metadata"] = JSON.stringify(metadata);
+      }
+      if (Object.keys(update).length === 0) {
+        return normalizeRow({ id: organizationId });
+      }
+      const organization = await context_.adapter.update({
+        model: "organization",
+        update,
+        where: [{ field: "id", value: organizationId }]
+      });
+      return normalizeRow(organization ?? { id: organizationId });
+    }),
+    updateOrgRole: ({ permission, roleId }) => withContext(async (context_) => {
+      const updated = await context_.adapter.update({
+        model: "organizationRole",
+        update: { permission: JSON.stringify(permission), updatedAt: /* @__PURE__ */ new Date() },
+        where: [{ field: "id", value: roleId }]
+      });
+      return normalizeRow(updated ?? { id: roleId, permission: JSON.stringify(permission) });
+    }),
+    updateTeam: ({ name, teamId }) => withContext(async (context_) => {
+      const team = await context_.adapter.update({
+        model: "team",
+        update: { name, updatedAt: /* @__PURE__ */ new Date() },
+        where: [{ field: "id", value: teamId }]
+      });
+      return normalizeRow(team ?? { id: teamId, name });
+    }),
+    // The one op that genuinely builds a row rather than mutating one. Replicates
+    // the plugin's create-user handler over `internalAdapter` (lowercase + dedupe
+    // email, create the row, then link a credential account when a password is given).
+    createUser: ({ data, email, name, password, role }) => withContext(async (context_) => {
+      const normalizedEmail = email.toLowerCase();
+      if (await context_.internalAdapter.findUserByEmail(normalizedEmail)) {
+        throw new LunoraAuthAdminError("a user with this email already exists", "USER_ALREADY_EXISTS");
+      }
+      const user = await context_.internalAdapter.createUser({
+        email: normalizedEmail,
+        name,
+        role: role === void 0 ? void 0 : serializeRole(role),
+        ...data
+      });
+      if (password !== void 0 && password !== "") {
+        const hashed = await context_.password.hash(password);
+        await context_.internalAdapter.linkAccount({
+          accountId: user.id,
+          password: hashed,
+          providerId: "credential",
+          userId: user.id
+        });
+      }
+      return toUser(user);
+    }),
+    deletePasskey: ({ passkeyId }) => withContext(async (context_) => {
+      await context_.adapter.delete({ model: "passkey", where: [{ field: "id", value: passkeyId }] });
+    }),
+    disableTwoFactor: ({ userId }) => withContext(async (context_) => {
+      await context_.adapter.deleteMany({ model: "twoFactor", where: [{ field: "userId", value: userId }] });
+      await context_.internalAdapter.updateUser(userId, { twoFactorEnabled: false });
+    }),
+    impersonateUser: ({ userId }) => withContext(async (context_) => {
+      const user = await context_.internalAdapter.findUserById(userId);
+      if (!user) {
+        throw new LunoraAuthAdminError("user not found", "USER_NOT_FOUND");
+      }
+      const rawSeconds = options.impersonationSeconds;
+      let ttlSeconds = DEFAULT_IMPERSONATION_SECONDS;
+      if (rawSeconds !== void 0) {
+        if (!Number.isInteger(rawSeconds) || !Number.isFinite(rawSeconds) || rawSeconds <= 0) {
+          throw new LunoraAuthAdminError("impersonationSeconds must be a positive finite integer", "INVALID_IMPERSONATION_SECONDS");
+        }
+        ttlSeconds = Math.min(rawSeconds, MAX_IMPERSONATION_SECONDS);
+      }
+      const expiresAt = new Date(Date.now() + ttlSeconds * 1e3);
+      const session = await context_.internalAdapter.createSession(
+        userId,
+        true,
+        { expiresAt, impersonatedBy: options.impersonatedBy ?? userId },
+        true
+      );
+      return {
+        expiresAt: session.expiresAt instanceof Date ? session.expiresAt.getTime() : expiresAt.getTime(),
+        token: session.token,
+        user: toUser(user)
+      };
+    }),
+    listAccounts: ({ userId }) => withContext(async (context_) => {
+      const rows = await context_.adapter.findMany({ model: "account", where: [{ field: "userId", value: userId }] });
+      return rows.map((row) => normalizeRow(row));
+    }),
+    listInvitations: ({ limit, offset, organizationId }) => withContext(
+      (context_) => page(context_, "invitation", {
+        limit,
+        offset,
+        where: [{ field: "organizationId", value: organizationId }]
+      })
+    ),
+    listMembers: ({ limit, offset, organizationId }) => withContext(
+      (context_) => page(context_, "member", {
+        limit,
+        offset,
+        sortBy: { direction: "desc", field: "createdAt" },
+        where: [{ field: "organizationId", value: organizationId }]
+      })
+    ),
+    listOrganizations: ({ limit, offset }) => withContext((context_) => page(context_, "organization", { limit, offset, sortBy: { direction: "desc", field: "createdAt" } })),
+    listPasskeys: ({ userId }) => withContext(async (context_) => {
+      const rows = await context_.adapter.findMany({ model: "passkey", where: [{ field: "userId", value: userId }] });
+      return rows.map((row) => normalizeRow(row));
+    }),
+    listSessions: ({ limit, offset, userId }) => withContext(
+      (context_) => page(context_, "session", {
+        limit,
+        offset,
+        sortBy: { direction: "desc", field: "createdAt" },
+        where: userId === void 0 || userId === "" ? void 0 : [{ field: "userId", value: userId }]
+      })
+    ),
+    listUsers: ({ filterField, filterValue, limit, offset, search, searchField, sortBy, sortDirection }) => withContext((context_) => {
+      const where = [];
+      if (search !== void 0 && search !== "") {
+        where.push({ field: searchField ?? "email", operator: "contains", value: search });
+      }
+      if (filterValue !== void 0) {
+        where.push({ field: filterField ?? "email", operator: "eq", value: filterValue });
+      }
+      return page(context_, "user", {
+        limit,
+        offset,
+        sortBy: { direction: sortDirection ?? "desc", field: sortBy ?? "createdAt" },
+        where
+      });
+    }),
+    removeMember: ({ memberId }) => withContext(async (context_) => {
+      await context_.adapter.delete({ model: "member", where: [{ field: "id", value: memberId }] });
+    }),
+    removeUser: ({ userId }) => withContext(async (context_) => {
+      await context_.internalAdapter.deleteUserSessions(userId);
+      await context_.internalAdapter.deleteUser(userId);
+    }),
+    // Keyed on the session *id*, not its token: tokens are bearer credentials we
+    // deliberately never surface to the studio. Resolve the row to recover its
+    // token, then delete via `internalAdapter.deleteSession` — which also clears
+    // secondary (KV) storage, unlike a raw `adapter.delete` on the DB row.
+    revokeUserSession: ({ sessionId }) => withContext(async (context_) => {
+      const session = await context_.adapter.findOne({ model: "session", where: [{ field: "id", value: sessionId }] });
+      if (session?.token) {
+        await context_.internalAdapter.deleteSession(session.token);
+      }
+    }),
+    revokeUserSessions: ({ userId }) => withContext(async (context_) => {
+      await context_.internalAdapter.deleteUserSessions(userId);
+    }),
+    setRole: ({ role, userId }) => withContext(async (context_) => {
+      const user = await context_.internalAdapter.updateUser(userId, { role: serializeRole(role) });
+      return toUser(user);
+    }),
+    setUserPassword: ({ newPassword, userId }) => withContext(async (context_) => {
+      const min = context_.password.config.minPasswordLength;
+      const max = context_.password.config.maxPasswordLength;
+      if (newPassword.length < min) {
+        throw new LunoraAuthAdminError(`password must be at least ${min.toString()} characters`, "PASSWORD_TOO_SHORT");
+      }
+      if (newPassword.length > max) {
+        throw new LunoraAuthAdminError(`password must be at most ${max.toString()} characters`, "PASSWORD_TOO_LONG");
+      }
+      const hashed = await context_.password.hash(newPassword);
+      await context_.internalAdapter.updatePassword(userId, hashed);
+    }),
+    unbanUser: ({ userId }) => withContext(async (context_) => {
+      const user = await context_.internalAdapter.updateUser(userId, { banExpires: null, banned: false, banReason: null });
+      return toUser(user);
+    }),
+    unlinkAccount: ({ accountId, userId }) => withContext(async (context_) => {
+      await context_.adapter.delete({
+        model: "account",
+        where: [
+          { field: "id", value: accountId },
+          { connector: "AND", field: "userId", value: userId }
+        ]
+      });
+    }),
+    updateUser: ({ data, userId }) => withContext(async (context_) => {
+      const user = await context_.internalAdapter.updateUser(userId, data);
+      return toUser(user);
+    })
+  };
+};
+
+export { LunoraAuthAdminError, createAuthAdmin };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/auth",
-  "version": "1.0.0-alpha.20",
+  "version": "1.0.0-alpha.22",
   "description": "Auth for Lunora — a thin better-auth wrapper: email/password, OAuth, plugins, D1-backed",
   "keywords": [
     "auth",

package/dist/packem_shared/LunoraAuthAdminError-BpVImgEy.mjs

@@ -1,248 +0,0 @@
-import { LunoraError } from '@lunora/errors';
-
-class LunoraAuthAdminError extends LunoraError {
-  constructor(message, code) {
-    super(code, message, { name: "LunoraAuthAdminError" });
-  }
-}
-const DEFAULT_LIMIT = 50;
-const MAX_LIMIT = 500;
-const DEFAULT_IMPERSONATION_SECONDS = 3600;
-const MAX_IMPERSONATION_SECONDS = DEFAULT_IMPERSONATION_SECONDS * 24;
-const MAX_BAN_SECONDS = 100 * 365 * 24 * 60 * 60;
-const SENSITIVE_FIELDS = /* @__PURE__ */ new Set(["accessToken", "backupCodes", "idToken", "password", "publicKey", "refreshToken", "secret", "token"]);
-const clampLimit = (limit) => Math.min(Math.max(Math.trunc(limit ?? DEFAULT_LIMIT), 1), MAX_LIMIT);
-const clampOffset = (offset) => Math.max(0, Math.trunc(offset ?? 0));
-const normalizeRow = (row) => {
-  const out = {};
-  for (const [key, value] of Object.entries(row)) {
-    if (SENSITIVE_FIELDS.has(key)) {
-      continue;
-    }
-    out[key] = value instanceof Date ? value.getTime() : value;
-  }
-  return out;
-};
-const serializeRole = (role) => Array.isArray(role) ? role.join(",") : role;
-const asAdminError = (error) => {
-  if (error instanceof LunoraAuthAdminError) {
-    return error;
-  }
-  const candidate = error;
-  const code = candidate?.body?.code ?? candidate?.code ?? "AUTH_ADMIN_ERROR";
-  const message = candidate?.body?.message ?? candidate?.message ?? "auth admin operation failed";
-  return new LunoraAuthAdminError(message, code);
-};
-const createAuthAdmin = (auth, options = {}) => {
-  const context = auth.$context;
-  const features = options.features ?? {};
-  const withContext = async (function_) => {
-    try {
-      return await function_(await context);
-    } catch (error) {
-      throw asAdminError(error);
-    }
-  };
-  const toUser = (row) => normalizeRow(row);
-  const page = async (context_, model, options_) => {
-    const where = options_.where && options_.where.length > 0 ? options_.where : void 0;
-    const [rows, total] = await Promise.all([
-      context_.adapter.findMany({
-        limit: clampLimit(options_.limit),
-        model,
-        offset: clampOffset(options_.offset),
-        sortBy: options_.sortBy,
-        where
-      }),
-      context_.adapter.count({ model, where })
-    ]);
-    return { rows: rows.map((row) => normalizeRow(row)), total };
-  };
-  return {
-    banUser: ({ expiresInSeconds, reason, userId }) => withContext(async (context_) => {
-      const seconds = typeof expiresInSeconds === "number" && Number.isFinite(expiresInSeconds) ? Math.min(Math.trunc(expiresInSeconds), MAX_BAN_SECONDS) : 0;
-      const banExpires = seconds > 0 ? new Date(Date.now() + seconds * 1e3) : void 0;
-      const user = await context_.internalAdapter.updateUser(userId, {
-        banExpires,
-        banned: true,
-        banReason: reason ?? "No reason"
-      });
-      await context_.internalAdapter.deleteUserSessions(userId);
-      return toUser(user);
-    }),
-    cancelInvitation: ({ invitationId }) => withContext(async (context_) => {
-      await context_.adapter.delete({ model: "invitation", where: [{ field: "id", value: invitationId }] });
-    }),
-    capabilities: () => withContext((context_) => {
-      const ids = new Set((context_.options.plugins ?? []).map((plugin) => plugin.id));
-      const has = (id) => ids.has(id);
-      return Promise.resolve({
-        accounts: features.accounts ?? true,
-        admin: features.admin ?? has("admin"),
-        organization: features.organization ?? has("organization"),
-        passkey: features.passkey ?? has("passkey"),
-        twoFactor: features.twoFactor ?? has("two-factor")
-      });
-    }),
-    // The one op that genuinely builds a row rather than mutating one. Replicates
-    // the plugin's create-user handler over `internalAdapter` (lowercase + dedupe
-    // email, create the row, then link a credential account when a password is given).
-    createUser: ({ data, email, name, password, role }) => withContext(async (context_) => {
-      const normalizedEmail = email.toLowerCase();
-      if (await context_.internalAdapter.findUserByEmail(normalizedEmail)) {
-        throw new LunoraAuthAdminError("a user with this email already exists", "USER_ALREADY_EXISTS");
-      }
-      const user = await context_.internalAdapter.createUser({
-        email: normalizedEmail,
-        name,
-        role: role === void 0 ? void 0 : serializeRole(role),
-        ...data
-      });
-      if (password !== void 0 && password !== "") {
-        const hashed = await context_.password.hash(password);
-        await context_.internalAdapter.linkAccount({
-          accountId: user.id,
-          password: hashed,
-          providerId: "credential",
-          userId: user.id
-        });
-      }
-      return toUser(user);
-    }),
-    deletePasskey: ({ passkeyId }) => withContext(async (context_) => {
-      await context_.adapter.delete({ model: "passkey", where: [{ field: "id", value: passkeyId }] });
-    }),
-    disableTwoFactor: ({ userId }) => withContext(async (context_) => {
-      await context_.adapter.deleteMany({ model: "twoFactor", where: [{ field: "userId", value: userId }] });
-      await context_.internalAdapter.updateUser(userId, { twoFactorEnabled: false });
-    }),
-    impersonateUser: ({ userId }) => withContext(async (context_) => {
-      const user = await context_.internalAdapter.findUserById(userId);
-      if (!user) {
-        throw new LunoraAuthAdminError("user not found", "USER_NOT_FOUND");
-      }
-      const rawSeconds = options.impersonationSeconds;
-      let ttlSeconds = DEFAULT_IMPERSONATION_SECONDS;
-      if (rawSeconds !== void 0) {
-        if (!Number.isInteger(rawSeconds) || !Number.isFinite(rawSeconds) || rawSeconds <= 0) {
-          throw new LunoraAuthAdminError("impersonationSeconds must be a positive finite integer", "INVALID_IMPERSONATION_SECONDS");
-        }
-        ttlSeconds = Math.min(rawSeconds, MAX_IMPERSONATION_SECONDS);
-      }
-      const expiresAt = new Date(Date.now() + ttlSeconds * 1e3);
-      const session = await context_.internalAdapter.createSession(
-        userId,
-        true,
-        { expiresAt, impersonatedBy: options.impersonatedBy ?? userId },
-        true
-      );
-      return {
-        expiresAt: session.expiresAt instanceof Date ? session.expiresAt.getTime() : expiresAt.getTime(),
-        token: session.token,
-        user: toUser(user)
-      };
-    }),
-    listAccounts: ({ userId }) => withContext(async (context_) => {
-      const rows = await context_.adapter.findMany({ model: "account", where: [{ field: "userId", value: userId }] });
-      return rows.map((row) => normalizeRow(row));
-    }),
-    listInvitations: ({ limit, offset, organizationId }) => withContext(
-      (context_) => page(context_, "invitation", {
-        limit,
-        offset,
-        where: [{ field: "organizationId", value: organizationId }]
-      })
-    ),
-    listMembers: ({ limit, offset, organizationId }) => withContext(
-      (context_) => page(context_, "member", {
-        limit,
-        offset,
-        sortBy: { direction: "desc", field: "createdAt" },
-        where: [{ field: "organizationId", value: organizationId }]
-      })
-    ),
-    listOrganizations: ({ limit, offset }) => withContext((context_) => page(context_, "organization", { limit, offset, sortBy: { direction: "desc", field: "createdAt" } })),
-    listPasskeys: ({ userId }) => withContext(async (context_) => {
-      const rows = await context_.adapter.findMany({ model: "passkey", where: [{ field: "userId", value: userId }] });
-      return rows.map((row) => normalizeRow(row));
-    }),
-    listSessions: ({ limit, offset, userId }) => withContext(
-      (context_) => page(context_, "session", {
-        limit,
-        offset,
-        sortBy: { direction: "desc", field: "createdAt" },
-        where: userId === void 0 || userId === "" ? void 0 : [{ field: "userId", value: userId }]
-      })
-    ),
-    listUsers: ({ filterField, filterValue, limit, offset, search, searchField, sortBy, sortDirection }) => withContext((context_) => {
-      const where = [];
-      if (search !== void 0 && search !== "") {
-        where.push({ field: searchField ?? "email", operator: "contains", value: search });
-      }
-      if (filterValue !== void 0) {
-        where.push({ field: filterField ?? "email", operator: "eq", value: filterValue });
-      }
-      return page(context_, "user", {
-        limit,
-        offset,
-        sortBy: { direction: sortDirection ?? "desc", field: sortBy ?? "createdAt" },
-        where
-      });
-    }),
-    removeMember: ({ memberId }) => withContext(async (context_) => {
-      await context_.adapter.delete({ model: "member", where: [{ field: "id", value: memberId }] });
-    }),
-    removeUser: ({ userId }) => withContext(async (context_) => {
-      await context_.internalAdapter.deleteUserSessions(userId);
-      await context_.internalAdapter.deleteUser(userId);
-    }),
-    // Keyed on the session *id*, not its token: tokens are bearer credentials we
-    // deliberately never surface to the studio. Resolve the row to recover its
-    // token, then delete via `internalAdapter.deleteSession` — which also clears
-    // secondary (KV) storage, unlike a raw `adapter.delete` on the DB row.
-    revokeUserSession: ({ sessionId }) => withContext(async (context_) => {
-      const session = await context_.adapter.findOne({ model: "session", where: [{ field: "id", value: sessionId }] });
-      if (session?.token) {
-        await context_.internalAdapter.deleteSession(session.token);
-      }
-    }),
-    revokeUserSessions: ({ userId }) => withContext(async (context_) => {
-      await context_.internalAdapter.deleteUserSessions(userId);
-    }),
-    setRole: ({ role, userId }) => withContext(async (context_) => {
-      const user = await context_.internalAdapter.updateUser(userId, { role: serializeRole(role) });
-      return toUser(user);
-    }),
-    setUserPassword: ({ newPassword, userId }) => withContext(async (context_) => {
-      const min = context_.password.config.minPasswordLength;
-      const max = context_.password.config.maxPasswordLength;
-      if (newPassword.length < min) {
-        throw new LunoraAuthAdminError(`password must be at least ${min.toString()} characters`, "PASSWORD_TOO_SHORT");
-      }
-      if (newPassword.length > max) {
-        throw new LunoraAuthAdminError(`password must be at most ${max.toString()} characters`, "PASSWORD_TOO_LONG");
-      }
-      const hashed = await context_.password.hash(newPassword);
-      await context_.internalAdapter.updatePassword(userId, hashed);
-    }),
-    unbanUser: ({ userId }) => withContext(async (context_) => {
-      const user = await context_.internalAdapter.updateUser(userId, { banExpires: null, banned: false, banReason: null });
-      return toUser(user);
-    }),
-    unlinkAccount: ({ accountId, userId }) => withContext(async (context_) => {
-      await context_.adapter.delete({
-        model: "account",
-        where: [
-          { field: "id", value: accountId },
-          { connector: "AND", field: "userId", value: userId }
-        ]
-      });
-    }),
-    updateUser: ({ data, userId }) => withContext(async (context_) => {
-      const user = await context_.internalAdapter.updateUser(userId, data);
-      return toUser(user);
-    })
-  };
-};
-
-export { LunoraAuthAdminError, createAuthAdmin };