@lunora/auth 1.0.0-alpha.21 → 1.0.0-alpha.211

package/dist/plugins-enterprise.mjs

@@ -0,0 +1 @@
+import{sso as o}from"@better-auth/sso";const n=i=>{i?.domainVerification?.enabled!==!0&&console.warn("@lunora/auth: sso() is installed without `domainVerification: { enabled: true }` — an unverified `domain` still routes sign-in, so any signed-in user can register an identity provider for a domain they do not own. `/sso/register` is also session-only; narrow `providersLimit` if you keep verification off. Pass `domainVerification: { enabled: true }` once your deployment can prove domain ownership.")},r=(i=>(n(i),o(i)));export{r as sso};

package/dist/plugins.d.mts

@@ -1,5 +1,35 @@
+export {
+/**
+ * Close self-serve sign-up to invited addresses only: an account is created only
+ * for an email an administrator has invited with `createSignUpInvitation`.
+ * Declares the `signUpInvitation` table it reads. Lunora's own, not a better-auth
+ * re-export.
+ */
+type I as InviteOnlyOptions,
+/**
+ * Close self-serve sign-up to invited addresses only: an account is created only
+ * for an email an administrator has invited with `createSignUpInvitation`.
+ * Declares the `signUpInvitation` table it reads. Lunora's own, not a better-auth
+ * re-export.
+ */
+type a as IssuedSignUpInvitation,
+/**
+ * Close self-serve sign-up to invited addresses only: an account is created only
+ * for an email an administrator has invited with `createSignUpInvitation`.
+ * Declares the `signUpInvitation` table it reads. Lunora's own, not a better-auth
+ * re-export.
+ */
+type S as SignUpInvitation, i as inviteOnly } from "./packem_shared/invite-only.d-DKyHHkkQ.mjs";
+import { RequireMcpAuthOptions, McpOptions, mcp as mcp$1, requireMcpAuth as requireMcpAuth$1 } from '@better-auth/mcp';
+export { createMcpProtectedRequestHandler } from '@better-auth/mcp';
+import { BetterAuthPlugin } from 'better-auth';
+export { apiKey } from '@better-auth/api-key';
+export { cimd } from '@better-auth/cimd';
+export { oauthDeviceAuthorization, oauthProvider } from '@better-auth/oauth-provider';
 export { passkey } from '@better-auth/passkey';
-export { captcha, mcp, withMcpAuth } from 'better-auth/plugins';
+export { scim } from '@better-auth/scim';
+export { createInsufficientScopeError } from 'better-auth/oauth2';
+export { captcha, lastLoginMethod, oneTap } from 'better-auth/plugins';
 export { createAccessControl } from 'better-auth/plugins/access';
 export { admin } from 'better-auth/plugins/admin';
 export { anonymous } from 'better-auth/plugins/anonymous';
@@ -13,10 +43,145 @@ export { jwt } from 'better-auth/plugins/jwt';
 export { magicLink } from 'better-auth/plugins/magic-link';
 export { multiSession } from 'better-auth/plugins/multi-session';
 export { oAuthProxy } from 'better-auth/plugins/oauth-proxy';
-export { oidcProvider } from 'better-auth/plugins/oidc-provider';
 export { oneTimeToken } from 'better-auth/plugins/one-time-token';
 export { organization } from 'better-auth/plugins/organization';
 export { phoneNumber } from 'better-auth/plugins/phone-number';
 export { siwe } from 'better-auth/plugins/siwe';
 export { twoFactor } from 'better-auth/plugins/two-factor';
 export { username } from 'better-auth/plugins/username';
+import "./packem_shared/create-auth.d-D1CKOFWc.mjs";
+/** better-auth's `requireMcpAuth` options, with `resource` required. */
+type LunoraRequireMcpAuthOptions = {
+  /**
+   * The protected-resource URL tokens must be bound to — the same value passed
+   * to `mcp({ resource })`.
+   */
+  resource: string;
+} & RequireMcpAuthOptions;
+/** The auth instance shape better-auth's `requireMcpAuth` accepts. */
+type McpAuthInstance = Parameters<typeof requireMcpAuth$1>[0];
+/** The protected handler: receives the request and the verified token claims. */
+type McpProtectedHandler = Parameters<typeof requireMcpAuth$1>[1];
+/**
+ * The MCP authorization server: better-auth's `oauthProvider` configured for MCP,
+ * serving the RFC 9728 protected-resource metadata for `resource`. Lunora's
+ * worker serves that document and the authorization-server metadata outside the
+ * auth base path on its own; that needs this `mcp`, not `@better-auth/mcp`'s.
+ */
+declare const mcp: (options: McpOptions) => ReturnType<typeof mcp$1>;
+/**
+ * Protect an MCP route on the same deployment as the authorization server.
+ * Verifies the bearer token's signature, issuer, audience and expiry, and hands
+ * the verified claims to `handler`.
+ * @throws LunoraError when `resource` is missing, empty or not an absolute URL.
+ */
+declare const requireMcpAuth: (auth: McpAuthInstance, handler: McpProtectedHandler, options: LunoraRequireMcpAuthOptions) => ((request: Request) => Promise<Response>);
+/**
+ * The two `.well-known` paths an MCP client fetches before it authorizes:
+ * the RFC 9728 protected-resource metadata for `resource` (where the 401
+ * challenge points), then the RFC 8414 authorization-server metadata for the
+ * issuer.
+ *
+ * The Lunora worker already serves both for an `.auth()` declaration with
+ * `mcp()`; this is for routing them yourself, e.g. in front of a hand-built
+ * worker. Pass `authBasePath` when `createAuth` was given a `basePath` other
+ * than `/api/auth`.
+ * @throws TypeError when `resource` is not an absolute URL.
+ */
+declare const mcpDiscoveryPaths: (resource: string, authBasePath?: string) => ReadonlyArray<string>;
+/** Organization sub-features a UI branches on. */
+interface UiConfigOrganization {
+  /** Whether an ordinary user may create one at all. */
+  allowUserToCreate: boolean;
+  enabled: boolean;
+  /** Max invitations per organization, when configured. */
+  invitationLimit?: number;
+  /** Max organizations one user may belong to, when configured. */
+  limit?: number;
+  /** Max members per organization, when configured. */
+  membershipLimit?: number;
+  /** Custom roles / dynamic access control are configured. */
+  roles: boolean;
+  /** Teams are enabled. */
+  teams: boolean;
+}
+/** The public payload `GET {basePath}/ui-config` returns. */
+interface UiConfigPayload {
+  /** Whether email + password sign-in is enabled. */
+  emailAndPassword: boolean;
+  /** Absent when `expose.organization` is false — see {@link UiConfigOptions.expose}. */
+  organization?: UiConfigOrganization;
+  /** Enabled better-auth plugin ids, sorted. Absent when not disclosed. */
+  plugins?: string[];
+  /** Whether self-serve sign-up is open. */
+  signUp: boolean;
+  /** Configured social/OAuth provider ids, sorted. Absent when not disclosed. */
+  socialProviders?: string[];
+}
+/** Options for {@link uiConfig}. */
+interface UiConfigOptions {
+  /**
+   * Omit fields from the payload. Everything is published by default; set a
+   * key to `false` for a deployment that would rather not enumerate, say, its
+   * plugin set to anonymous callers.
+   *
+   * The field is **omitted, not emptied**. An empty `plugins: []` is
+   * indistinguishable from "this deployment runs no plugins", and the client
+   * ANDs the server's answer with its own registration — so emptying it would
+   * silently switch off every gated card instead of merely withholding the
+   * list. Absent means "not disclosed", and the client falls back to what
+   * `client.ts` registered.
+   */
+  expose?: {
+    organization?: boolean;
+    plugins?: boolean;
+    socialProviders?: boolean;
+  };
+  /**
+   * Extra provider ids to advertise beyond `socialProviders`. Providers wired
+   * through the `genericOAuth` plugin live in that plugin's own options rather
+   * than in `socialProviders`, so they cannot be derived here — list them if
+   * you want buttons for them.
+   */
+  extraProviders?: string[];
+  /**
+   * Path the endpoint mounts at, relative to the auth basePath.
+   * @default "/ui-config"
+   */
+  path?: string;
+}
+/**
+ * A better-auth server plugin publishing {@link UiConfigPayload} at
+ * `GET {basePath}/ui-config`.
+ *
+ * There is no client half: the payload is fetched with a plain `fetch` by
+ * whatever renders your auth screens, so it works before a client exists and
+ * from a framework this package knows nothing about.
+ *
+ * The return type is better-auth's own `BetterAuthPlugin` rather than the precise
+ * shape of the endpoint map. That is deliberate: `createAuthEndpoint`'s inferred
+ * type is anonymous, and naming it is the difference between a build that emits
+ * declarations and one that fails only in the bundler — after `tsc` and the
+ * tests have both gone green. `BetterAuthPlugin` is what `createAuth({ plugins })`
+ * consumes anyway.
+ */
+declare const uiConfig: (options?: UiConfigOptions) => BetterAuthPlugin;
+export { type LunoraRequireMcpAuthOptions,
+/**
+ * Publish which plugins and social providers this deployment enabled, at
+ * `GET {basePath}/ui-config`, so an auth UI configures itself instead of making
+ * you restate the list client-side. Lunora's own, not a better-auth re-export.
+ */
+type UiConfigOptions,
+/**
+ * Publish which plugins and social providers this deployment enabled, at
+ * `GET {basePath}/ui-config`, so an auth UI configures itself instead of making
+ * you restate the list client-side. Lunora's own, not a better-auth re-export.
+ */
+type UiConfigOrganization,
+/**
+ * Publish which plugins and social providers this deployment enabled, at
+ * `GET {basePath}/ui-config`, so an auth UI configures itself instead of making
+ * you restate the list client-side. Lunora's own, not a better-auth re-export.
+ */
+type UiConfigPayload, mcp, mcpDiscoveryPaths, requireMcpAuth, uiConfig };

package/dist/plugins.d.ts

@@ -1,5 +1,35 @@
+export {
+/**
+ * Close self-serve sign-up to invited addresses only: an account is created only
+ * for an email an administrator has invited with `createSignUpInvitation`.
+ * Declares the `signUpInvitation` table it reads. Lunora's own, not a better-auth
+ * re-export.
+ */
+type I as InviteOnlyOptions,
+/**
+ * Close self-serve sign-up to invited addresses only: an account is created only
+ * for an email an administrator has invited with `createSignUpInvitation`.
+ * Declares the `signUpInvitation` table it reads. Lunora's own, not a better-auth
+ * re-export.
+ */
+type a as IssuedSignUpInvitation,
+/**
+ * Close self-serve sign-up to invited addresses only: an account is created only
+ * for an email an administrator has invited with `createSignUpInvitation`.
+ * Declares the `signUpInvitation` table it reads. Lunora's own, not a better-auth
+ * re-export.
+ */
+type S as SignUpInvitation, i as inviteOnly } from "./packem_shared/invite-only.d-CsPJWAwM.js";
+import { RequireMcpAuthOptions, McpOptions, mcp as mcp$1, requireMcpAuth as requireMcpAuth$1 } from '@better-auth/mcp';
+export { createMcpProtectedRequestHandler } from '@better-auth/mcp';
+import { BetterAuthPlugin } from 'better-auth';
+export { apiKey } from '@better-auth/api-key';
+export { cimd } from '@better-auth/cimd';
+export { oauthDeviceAuthorization, oauthProvider } from '@better-auth/oauth-provider';
 export { passkey } from '@better-auth/passkey';
-export { captcha, mcp, withMcpAuth } from 'better-auth/plugins';
+export { scim } from '@better-auth/scim';
+export { createInsufficientScopeError } from 'better-auth/oauth2';
+export { captcha, lastLoginMethod, oneTap } from 'better-auth/plugins';
 export { createAccessControl } from 'better-auth/plugins/access';
 export { admin } from 'better-auth/plugins/admin';
 export { anonymous } from 'better-auth/plugins/anonymous';
@@ -13,10 +43,145 @@ export { jwt } from 'better-auth/plugins/jwt';
 export { magicLink } from 'better-auth/plugins/magic-link';
 export { multiSession } from 'better-auth/plugins/multi-session';
 export { oAuthProxy } from 'better-auth/plugins/oauth-proxy';
-export { oidcProvider } from 'better-auth/plugins/oidc-provider';
 export { oneTimeToken } from 'better-auth/plugins/one-time-token';
 export { organization } from 'better-auth/plugins/organization';
 export { phoneNumber } from 'better-auth/plugins/phone-number';
 export { siwe } from 'better-auth/plugins/siwe';
 export { twoFactor } from 'better-auth/plugins/two-factor';
 export { username } from 'better-auth/plugins/username';
+import "./packem_shared/create-auth.d-D1CKOFWc.js";
+/** better-auth's `requireMcpAuth` options, with `resource` required. */
+type LunoraRequireMcpAuthOptions = {
+  /**
+   * The protected-resource URL tokens must be bound to — the same value passed
+   * to `mcp({ resource })`.
+   */
+  resource: string;
+} & RequireMcpAuthOptions;
+/** The auth instance shape better-auth's `requireMcpAuth` accepts. */
+type McpAuthInstance = Parameters<typeof requireMcpAuth$1>[0];
+/** The protected handler: receives the request and the verified token claims. */
+type McpProtectedHandler = Parameters<typeof requireMcpAuth$1>[1];
+/**
+ * The MCP authorization server: better-auth's `oauthProvider` configured for MCP,
+ * serving the RFC 9728 protected-resource metadata for `resource`. Lunora's
+ * worker serves that document and the authorization-server metadata outside the
+ * auth base path on its own; that needs this `mcp`, not `@better-auth/mcp`'s.
+ */
+declare const mcp: (options: McpOptions) => ReturnType<typeof mcp$1>;
+/**
+ * Protect an MCP route on the same deployment as the authorization server.
+ * Verifies the bearer token's signature, issuer, audience and expiry, and hands
+ * the verified claims to `handler`.
+ * @throws LunoraError when `resource` is missing, empty or not an absolute URL.
+ */
+declare const requireMcpAuth: (auth: McpAuthInstance, handler: McpProtectedHandler, options: LunoraRequireMcpAuthOptions) => ((request: Request) => Promise<Response>);
+/**
+ * The two `.well-known` paths an MCP client fetches before it authorizes:
+ * the RFC 9728 protected-resource metadata for `resource` (where the 401
+ * challenge points), then the RFC 8414 authorization-server metadata for the
+ * issuer.
+ *
+ * The Lunora worker already serves both for an `.auth()` declaration with
+ * `mcp()`; this is for routing them yourself, e.g. in front of a hand-built
+ * worker. Pass `authBasePath` when `createAuth` was given a `basePath` other
+ * than `/api/auth`.
+ * @throws TypeError when `resource` is not an absolute URL.
+ */
+declare const mcpDiscoveryPaths: (resource: string, authBasePath?: string) => ReadonlyArray<string>;
+/** Organization sub-features a UI branches on. */
+interface UiConfigOrganization {
+  /** Whether an ordinary user may create one at all. */
+  allowUserToCreate: boolean;
+  enabled: boolean;
+  /** Max invitations per organization, when configured. */
+  invitationLimit?: number;
+  /** Max organizations one user may belong to, when configured. */
+  limit?: number;
+  /** Max members per organization, when configured. */
+  membershipLimit?: number;
+  /** Custom roles / dynamic access control are configured. */
+  roles: boolean;
+  /** Teams are enabled. */
+  teams: boolean;
+}
+/** The public payload `GET {basePath}/ui-config` returns. */
+interface UiConfigPayload {
+  /** Whether email + password sign-in is enabled. */
+  emailAndPassword: boolean;
+  /** Absent when `expose.organization` is false — see {@link UiConfigOptions.expose}. */
+  organization?: UiConfigOrganization;
+  /** Enabled better-auth plugin ids, sorted. Absent when not disclosed. */
+  plugins?: string[];
+  /** Whether self-serve sign-up is open. */
+  signUp: boolean;
+  /** Configured social/OAuth provider ids, sorted. Absent when not disclosed. */
+  socialProviders?: string[];
+}
+/** Options for {@link uiConfig}. */
+interface UiConfigOptions {
+  /**
+   * Omit fields from the payload. Everything is published by default; set a
+   * key to `false` for a deployment that would rather not enumerate, say, its
+   * plugin set to anonymous callers.
+   *
+   * The field is **omitted, not emptied**. An empty `plugins: []` is
+   * indistinguishable from "this deployment runs no plugins", and the client
+   * ANDs the server's answer with its own registration — so emptying it would
+   * silently switch off every gated card instead of merely withholding the
+   * list. Absent means "not disclosed", and the client falls back to what
+   * `client.ts` registered.
+   */
+  expose?: {
+    organization?: boolean;
+    plugins?: boolean;
+    socialProviders?: boolean;
+  };
+  /**
+   * Extra provider ids to advertise beyond `socialProviders`. Providers wired
+   * through the `genericOAuth` plugin live in that plugin's own options rather
+   * than in `socialProviders`, so they cannot be derived here — list them if
+   * you want buttons for them.
+   */
+  extraProviders?: string[];
+  /**
+   * Path the endpoint mounts at, relative to the auth basePath.
+   * @default "/ui-config"
+   */
+  path?: string;
+}
+/**
+ * A better-auth server plugin publishing {@link UiConfigPayload} at
+ * `GET {basePath}/ui-config`.
+ *
+ * There is no client half: the payload is fetched with a plain `fetch` by
+ * whatever renders your auth screens, so it works before a client exists and
+ * from a framework this package knows nothing about.
+ *
+ * The return type is better-auth's own `BetterAuthPlugin` rather than the precise
+ * shape of the endpoint map. That is deliberate: `createAuthEndpoint`'s inferred
+ * type is anonymous, and naming it is the difference between a build that emits
+ * declarations and one that fails only in the bundler — after `tsc` and the
+ * tests have both gone green. `BetterAuthPlugin` is what `createAuth({ plugins })`
+ * consumes anyway.
+ */
+declare const uiConfig: (options?: UiConfigOptions) => BetterAuthPlugin;
+export { type LunoraRequireMcpAuthOptions,
+/**
+ * Publish which plugins and social providers this deployment enabled, at
+ * `GET {basePath}/ui-config`, so an auth UI configures itself instead of making
+ * you restate the list client-side. Lunora's own, not a better-auth re-export.
+ */
+type UiConfigOptions,
+/**
+ * Publish which plugins and social providers this deployment enabled, at
+ * `GET {basePath}/ui-config`, so an auth UI configures itself instead of making
+ * you restate the list client-side. Lunora's own, not a better-auth re-export.
+ */
+type UiConfigOrganization,
+/**
+ * Publish which plugins and social providers this deployment enabled, at
+ * `GET {basePath}/ui-config`, so an auth UI configures itself instead of making
+ * you restate the list client-side. Lunora's own, not a better-auth re-export.
+ */
+type UiConfigPayload, mcp, mcpDiscoveryPaths, requireMcpAuth, uiConfig };

package/dist/plugins.mjs

@@ -1,22 +1 @@
-export { passkey } from '@better-auth/passkey';
-export { captcha, mcp, withMcpAuth } from 'better-auth/plugins';
-export { createAccessControl } from 'better-auth/plugins/access';
-export { admin } from 'better-auth/plugins/admin';
-export { anonymous } from 'better-auth/plugins/anonymous';
-export { bearer } from 'better-auth/plugins/bearer';
-export { customSession } from 'better-auth/plugins/custom-session';
-export { deviceAuthorization } from 'better-auth/plugins/device-authorization';
-export { emailOTP } from 'better-auth/plugins/email-otp';
-export { genericOAuth } from 'better-auth/plugins/generic-oauth';
-export { haveIBeenPwned } from 'better-auth/plugins/haveibeenpwned';
-export { jwt } from 'better-auth/plugins/jwt';
-export { magicLink } from 'better-auth/plugins/magic-link';
-export { multiSession } from 'better-auth/plugins/multi-session';
-export { oAuthProxy } from 'better-auth/plugins/oauth-proxy';
-export { oidcProvider } from 'better-auth/plugins/oidc-provider';
-export { oneTimeToken } from 'better-auth/plugins/one-time-token';
-export { organization } from 'better-auth/plugins/organization';
-export { phoneNumber } from 'better-auth/plugins/phone-number';
-export { siwe } from 'better-auth/plugins/siwe';
-export { twoFactor } from 'better-auth/plugins/two-factor';
-export { username } from 'better-auth/plugins/username';
+import{inviteOnly as e}from"./packem_shared/createSignUpInvitation-DHZL9fNl.mjs";import{mcp as m,mcpDiscoveryPaths as p,requireMcpAuth as f}from"./packem_shared/mcp-CgX1hTOv.mjs";import{uiConfig as x}from"./packem_shared/uiConfig-B8pN6pks.mjs";import{apiKey as a}from"@better-auth/api-key";import{cimd as s}from"@better-auth/cimd";import{createMcpProtectedRequestHandler as h}from"@better-auth/mcp";import{oauthDeviceAuthorization as l,oauthProvider as v}from"@better-auth/oauth-provider";import{passkey as A}from"@better-auth/passkey";import{scim as g}from"@better-auth/scim";import{createInsufficientScopeError as T}from"better-auth/oauth2";import{captcha as z,lastLoginMethod as M,oneTap as O}from"better-auth/plugins";import{createAccessControl as b}from"better-auth/plugins/access";import{admin as C}from"better-auth/plugins/admin";import{anonymous as I}from"better-auth/plugins/anonymous";import{bearer as j}from"better-auth/plugins/bearer";import{customSession as E}from"better-auth/plugins/custom-session";import{deviceAuthorization as H}from"better-auth/plugins/device-authorization";import{emailOTP as N}from"better-auth/plugins/email-otp";import{genericOAuth as G}from"better-auth/plugins/generic-oauth";import{haveIBeenPwned as Q}from"better-auth/plugins/haveibeenpwned";import{jwt as V}from"better-auth/plugins/jwt";import{magicLink as X}from"better-auth/plugins/magic-link";import{multiSession as Z}from"better-auth/plugins/multi-session";import{oAuthProxy as $}from"better-auth/plugins/oauth-proxy";import{oneTimeToken as ro}from"better-auth/plugins/one-time-token";import{organization as to}from"better-auth/plugins/organization";import{phoneNumber as po}from"better-auth/plugins/phone-number";import{siwe as io}from"better-auth/plugins/siwe";import{twoFactor as no}from"better-auth/plugins/two-factor";import{username as co}from"better-auth/plugins/username";export{C as admin,I as anonymous,a as apiKey,j as bearer,z as captcha,s as cimd,b as createAccessControl,T as createInsufficientScopeError,h as createMcpProtectedRequestHandler,E as customSession,H as deviceAuthorization,N as emailOTP,G as genericOAuth,Q as haveIBeenPwned,e as inviteOnly,V as jwt,M as lastLoginMethod,X as magicLink,m as mcp,p as mcpDiscoveryPaths,Z as multiSession,$ as oAuthProxy,l as oauthDeviceAuthorization,v as oauthProvider,O as oneTap,ro as oneTimeToken,to as organization,A as passkey,po as phoneNumber,f as requireMcpAuth,g as scim,io as siwe,no as twoFactor,x as uiConfig,co as username};

package/dist/schema.d.mts

@@ -1,44 +1,44 @@
 import { TableDefinition } from '@lunora/server';
-import { a as LunoraAuthOptions } from "./packem_shared/create-auth.d-Mwhb4gSc.mjs";
+import { a as LunoraAuthOptions } from "./packem_shared/create-auth.d-D1CKOFWc.mjs";
 import 'better-auth';
 /**
-* Derive Lunora table definitions from a better-auth config — the bridge that
-* makes the **full** better-auth plugin ecosystem first-class Lunora data.
-*
-* better-auth's own `getAuthTables(options)` already merges every configured
-* plugin's `schema` into one table map (core `user`/`session`/`account`/
-* `verification`, plus whatever the plugins on `options.plugins` add —
-* `organization`/`member`/`invitation`/`team`/`teamMember` from the
-* organization plugin, `role`/`banned`/… columns from admin, `passkey`,
-* `twoFactor`, `jwks`, …). This walks that map and emits an equivalent
-* `defineTable` for each, so adding a plugin to `options.plugins` automatically
-* surfaces its tables in the Lunora schema — no hand-written table definitions
-* to keep in sync.
-*
-* Spread the result into `defineSchema` alongside your app tables (the keys are
-* better-auth's real table names — `user`, `session`, … — left **unprefixed**
-* because better-auth's adapter addresses them by exactly those names). Because
-* the names are unprefixed, do **not** declare an app table that reuses one of
-* better-auth's reserved names in the same `defineSchema` — JS spread order
-* would let the later key win silently (unlike the plugin-extension path, which
-* throws on collision):
-*
-* ```ts
-* import { authTables } from "@lunora/auth";
-* const authOptions = { emailAndPassword: { enabled: true }, plugins: [organization(), admin()] };
-* export const schema = defineSchema({
-*     ...authTables(authOptions),
-*     todos: defineTable({ title: v.string() }),
-* });
-* ```
-*
-* Scope: this emits the table **shapes** (columns + types + nullability +
-* uniqueness + FK ids). It deliberately does not carry better-auth's
-* `defaultValue`/`onUpdate` (filled by better-auth's own write layer), `index`
-* hints, or `bigint` precision (`bigint` fields map to `v.number()`). Those only
-* matter once better-auth's writes are routed through Lunora's ORM — a separate
-* adapter follow-up; today the auth rows are still written by better-auth's D1
-* adapter and these tables make them typed + queryable via `ctx.db`.
-*/
+ * Derive Lunora table definitions from a better-auth config — the bridge that
+ * makes the **full** better-auth plugin ecosystem first-class Lunora data.
+ *
+ * better-auth's own `getAuthTables(options)` already merges every configured
+ * plugin's `schema` into one table map (core `user`/`session`/`account`/
+ * `verification`, plus whatever the plugins on `options.plugins` add —
+ * `organization`/`member`/`invitation`/`team`/`teamMember` from the
+ * organization plugin, `role`/`banned`/… columns from admin, `passkey`,
+ * `twoFactor`, `jwks`, …). This walks that map and emits an equivalent
+ * `defineTable` for each, so adding a plugin to `options.plugins` automatically
+ * surfaces its tables in the Lunora schema — no hand-written table definitions
+ * to keep in sync.
+ *
+ * Spread the result into `defineSchema` alongside your app tables (the keys are
+ * better-auth's real table names — `user`, `session`, … — left **unprefixed**
+ * because better-auth's adapter addresses them by exactly those names). Because
+ * the names are unprefixed, do **not** declare an app table that reuses one of
+ * better-auth's reserved names in the same `defineSchema` — JS spread order
+ * would let the later key win silently (unlike the plugin-extension path, which
+ * throws on collision):
+ *
+ * ```ts
+ * import { authTables } from "@lunora/auth";
+ * const authOptions = { emailAndPassword: { enabled: true }, plugins: [organization(), admin()] };
+ * export const schema = defineSchema({
+ *     ...authTables(authOptions),
+ *     todos: defineTable({ title: v.string() }),
+ * });
+ * ```
+ *
+ * Scope: this emits the table **shapes** (columns + types + nullability +
+ * uniqueness + FK ids). It deliberately does not carry better-auth's
+ * `defaultValue`/`onUpdate` (filled by better-auth's own write layer), `index`
+ * hints, or `bigint` precision (`bigint` fields map to `v.number()`). Those only
+ * matter once better-auth's writes are routed through Lunora's ORM — a separate
+ * adapter follow-up; today the auth rows are still written by better-auth's D1
+ * adapter and these tables make them typed + queryable via `ctx.db`.
+ */
 declare const authTables: (options: LunoraAuthOptions) => Record<string, TableDefinition>;
 export { authTables as default };

package/dist/schema.d.ts

@@ -1,44 +1,44 @@
 import { TableDefinition } from '@lunora/server';
-import { a as LunoraAuthOptions } from "./packem_shared/create-auth.d-Mwhb4gSc.js";
+import { a as LunoraAuthOptions } from "./packem_shared/create-auth.d-D1CKOFWc.js";
 import 'better-auth';
 /**
-* Derive Lunora table definitions from a better-auth config — the bridge that
-* makes the **full** better-auth plugin ecosystem first-class Lunora data.
-*
-* better-auth's own `getAuthTables(options)` already merges every configured
-* plugin's `schema` into one table map (core `user`/`session`/`account`/
-* `verification`, plus whatever the plugins on `options.plugins` add —
-* `organization`/`member`/`invitation`/`team`/`teamMember` from the
-* organization plugin, `role`/`banned`/… columns from admin, `passkey`,
-* `twoFactor`, `jwks`, …). This walks that map and emits an equivalent
-* `defineTable` for each, so adding a plugin to `options.plugins` automatically
-* surfaces its tables in the Lunora schema — no hand-written table definitions
-* to keep in sync.
-*
-* Spread the result into `defineSchema` alongside your app tables (the keys are
-* better-auth's real table names — `user`, `session`, … — left **unprefixed**
-* because better-auth's adapter addresses them by exactly those names). Because
-* the names are unprefixed, do **not** declare an app table that reuses one of
-* better-auth's reserved names in the same `defineSchema` — JS spread order
-* would let the later key win silently (unlike the plugin-extension path, which
-* throws on collision):
-*
-* ```ts
-* import { authTables } from "@lunora/auth";
-* const authOptions = { emailAndPassword: { enabled: true }, plugins: [organization(), admin()] };
-* export const schema = defineSchema({
-*     ...authTables(authOptions),
-*     todos: defineTable({ title: v.string() }),
-* });
-* ```
-*
-* Scope: this emits the table **shapes** (columns + types + nullability +
-* uniqueness + FK ids). It deliberately does not carry better-auth's
-* `defaultValue`/`onUpdate` (filled by better-auth's own write layer), `index`
-* hints, or `bigint` precision (`bigint` fields map to `v.number()`). Those only
-* matter once better-auth's writes are routed through Lunora's ORM — a separate
-* adapter follow-up; today the auth rows are still written by better-auth's D1
-* adapter and these tables make them typed + queryable via `ctx.db`.
-*/
+ * Derive Lunora table definitions from a better-auth config — the bridge that
+ * makes the **full** better-auth plugin ecosystem first-class Lunora data.
+ *
+ * better-auth's own `getAuthTables(options)` already merges every configured
+ * plugin's `schema` into one table map (core `user`/`session`/`account`/
+ * `verification`, plus whatever the plugins on `options.plugins` add —
+ * `organization`/`member`/`invitation`/`team`/`teamMember` from the
+ * organization plugin, `role`/`banned`/… columns from admin, `passkey`,
+ * `twoFactor`, `jwks`, …). This walks that map and emits an equivalent
+ * `defineTable` for each, so adding a plugin to `options.plugins` automatically
+ * surfaces its tables in the Lunora schema — no hand-written table definitions
+ * to keep in sync.
+ *
+ * Spread the result into `defineSchema` alongside your app tables (the keys are
+ * better-auth's real table names — `user`, `session`, … — left **unprefixed**
+ * because better-auth's adapter addresses them by exactly those names). Because
+ * the names are unprefixed, do **not** declare an app table that reuses one of
+ * better-auth's reserved names in the same `defineSchema` — JS spread order
+ * would let the later key win silently (unlike the plugin-extension path, which
+ * throws on collision):
+ *
+ * ```ts
+ * import { authTables } from "@lunora/auth";
+ * const authOptions = { emailAndPassword: { enabled: true }, plugins: [organization(), admin()] };
+ * export const schema = defineSchema({
+ *     ...authTables(authOptions),
+ *     todos: defineTable({ title: v.string() }),
+ * });
+ * ```
+ *
+ * Scope: this emits the table **shapes** (columns + types + nullability +
+ * uniqueness + FK ids). It deliberately does not carry better-auth's
+ * `defaultValue`/`onUpdate` (filled by better-auth's own write layer), `index`
+ * hints, or `bigint` precision (`bigint` fields map to `v.number()`). Those only
+ * matter once better-auth's writes are routed through Lunora's ORM — a separate
+ * adapter follow-up; today the auth rows are still written by better-auth's D1
+ * adapter and these tables make them typed + queryable via `ctx.db`.
+ */
 declare const authTables: (options: LunoraAuthOptions) => Record<string, TableDefinition>;
 export { authTables as default };

package/dist/schema.mjs

@@ -1,62 +1 @@
-import { defineTable } from '@lunora/server';
-import { v } from '@lunora/values';
-import { getAuthTables } from 'better-auth/db';
-
-const baseValidator = (attribute) => {
-  if (attribute.references) {
-    return v.id(attribute.references.model);
-  }
-  const { type } = attribute;
-  if (Array.isArray(type)) {
-    return v.string();
-  }
-  switch (type) {
-    case "boolean": {
-      return v.boolean();
-    }
-    case "date": {
-      return v.date();
-    }
-    case "number": {
-      return v.number();
-    }
-    case "number[]": {
-      return v.array(v.number());
-    }
-    case "string": {
-      return v.string();
-    }
-    case "string[]": {
-      return v.array(v.string());
-    }
-    // "json" and anything unrecognised: keep the row shape permissive rather
-    // than fail schema generation on a plugin's exotic column type.
-    default: {
-      return v.any();
-    }
-  }
-};
-const fieldValidator = (attribute) => {
-  let validator = baseValidator(attribute);
-  if (attribute.required === false) {
-    validator = validator.nullable();
-  }
-  if (attribute.unique === true) {
-    validator = validator.unique();
-  }
-  return validator;
-};
-const authTables = (options) => {
-  const tables = getAuthTables(options);
-  const schema = {};
-  for (const table of Object.values(tables)) {
-    const shape = {};
-    for (const [fieldKey, attribute] of Object.entries(table.fields)) {
-      shape[attribute.fieldName ?? fieldKey] = fieldValidator(attribute);
-    }
-    schema[table.modelName] = defineTable(shape).externallyManaged();
-  }
-  return schema;
-};
-
-export { authTables as default };
+import{defineTable as i}from"@lunora/server";import{v as e}from"@lunora/values";import{getAuthTables as u}from"better-auth/db";const c=n=>{if(n.references)return e.id(n.references.model);const{type:r}=n;if(Array.isArray(r))return e.string();switch(r){case"boolean":return e.boolean();case"date":return e.date();case"number":return e.number();case"number[]":return e.array(e.number());case"string":return e.string();case"string[]":return e.array(e.string());default:return e.any()}},f=n=>{let r=c(n);return n.required===!1&&(r=r.nullable()),n.unique===!0&&(r=r.unique()),r},y=n=>{const r=u(n),a={};for(const t of Object.values(r)){const s={};for(const[l,o]of Object.entries(t.fields))s[o.fieldName??l]=f(o);a[t.modelName]=i(s).externallyManaged()}return a};export{y as default};