@lunora/auth 1.0.0-alpha.22 → 1.0.0-alpha.221

package/dist/middleware.d.ts

@@ -1,12 +1,12 @@
 import { LunoraError } from '@lunora/errors';
-import { L as LunoraAuth } from "./packem_shared/create-auth.d-Mwhb4gSc.js";
+import { L as LunoraAuth } from "./packem_shared/create-auth.d-D1CKOFWc.js";
 import 'better-auth';
 /**
-* Structural mirror of `@lunora/server`'s `MiddlewareNext` — the continuation
-* callback handed to a middleware. Repeated here so this package does not take
-* a runtime dependency on `@lunora/server`; the types are assignable from the
-* fully-typed builder.
-*/
+ * Structural mirror of `@lunora/server`'s `MiddlewareNext` — the continuation
+ * callback handed to a middleware. Repeated here so this package does not take
+ * a runtime dependency on `@lunora/server`; the types are assignable from the
+ * fully-typed builder.
+ */
 interface MiddlewareNext<ContextIn> {
   (): Promise<ContextIn>;
   <Extension extends Record<string, unknown>>(options: {
@@ -14,174 +14,184 @@ interface MiddlewareNext<ContextIn> {
   }): Promise<ContextIn & Extension>;
 }
 /**
-* Thrown by the runtime header guard when a privileged `ctx.authApi.*` endpoint
-* is invoked without a `headers` property on its argument object. Carries the
-* offending `method` name so callers can pinpoint the bad call site, and points
-* at the explicit escape hatches.
-*
-* This is the runtime sibling of the static `auth_api_call_without_headers`
-* advisor lint — both treat a header-less `ctx.authApi.*` call as an
-* authorization bypass, so a call that trips the lint also trips this guard.
-*/
+ * Thrown by the runtime header guard when a privileged `ctx.authApi.*` endpoint
+ * is invoked without a `headers` property on its argument object. Carries the
+ * offending `method` name so callers can pinpoint the bad call site, and points
+ * at the explicit escape hatches.
+ *
+ * This is the runtime sibling of the static `auth_api_call_without_headers`
+ * advisor lint — both treat a header-less `ctx.authApi.*` call as an
+ * authorization bypass, so a call that trips the lint also trips this guard.
+ */
 declare class LunoraAuthHeadersError extends LunoraError {
-  /** The `ctx.authApi.&lt;method>` that was called without `headers`. */
+  /** The `ctx.authApi.<method>` that was called without `headers`. */
   readonly method: string;
   constructor(method: string);
 }
 /**
-* Options for {@link withAuthPlugins}.
-*/
+ * Options for {@link withAuthPlugins}.
+ */
 interface WithAuthPluginsOptions {
   /**
-  * Whether to install the runtime header guard around `ctx.authApi`.
-  *
-  * **Defaults to `true` — the safe default.** When enabled, every
-  * `ctx.authApi.&lt;method>(…)` call that omits `headers` throws
-  * {@link LunoraAuthHeadersError} instead of silently running with full
-  * server-to-server privileges. For a deliberate, per-call unauthenticated
-  * invocation, use the explicit `ctx.authApi.withoutHeaders()` escape hatch
-  * rather than disabling the guard wholesale.
-  *
-  * Set to `false` only when you have audited every `ctx.authApi.*` call site
-  * and accept responsibility for passing headers yourself. This is the loud,
-  * all-or-nothing opt-out; prefer `withoutHeaders()` for one-offs.
-  */
+   * Whether to install the runtime header guard around `ctx.authApi`.
+   *
+   * **Defaults to `true` — the safe default.** When enabled, every
+   * `ctx.authApi.<method>(…)` call that omits `headers` throws
+   * {@link LunoraAuthHeadersError} instead of silently running with full
+   * server-to-server privileges. For a deliberate, per-call unauthenticated
+   * invocation, use the explicit `ctx.authApi.withoutHeaders()` escape hatch
+   * rather than disabling the guard wholesale.
+   *
+   * Set to `false` only when you have audited every `ctx.authApi.*` call site
+   * and accept responsibility for passing headers yourself. This is the loud,
+   * all-or-nothing opt-out; prefer `withoutHeaders()` for one-offs.
+   */
   enforceHeaders?: boolean;
 }
 /**
-* The Lunora context extension this middleware installs. It does *not* replace
-* `ctx.auth` (the identity-only surface populated by the runtime — `userId` and
-* `getIdentity()`); instead it adds a sibling `ctx.authApi` that points at the
-* full better-auth plugin API surface.
-*
-* The shape of `authApi` is the shape of the better-auth instance's `api` —
-* a flat record of endpoint functions like `createOrganization`, `banUser`,
-* `listMembers`, … contributed by whichever plugins are configured on the auth
-* instance. Because the type is `Auth["api"]` and `LunoraAuth` is generic over
-* the auth instance, callers get end-to-end inference: the endpoints they see
-* are exactly the ones their auth instance loaded.
-*/
+ * The Lunora context extension this middleware installs. It does *not* replace
+ * `ctx.auth` (the identity-only surface populated by the runtime — `userId` and
+ * `getIdentity()`); instead it adds a sibling `ctx.authApi` that points at the
+ * full better-auth plugin API surface.
+ *
+ * The shape of `authApi` is the shape of the better-auth instance's `api` —
+ * a flat record of endpoint functions like `createOrganization`, `banUser`,
+ * `listMembers`, … contributed by whichever plugins are configured on the auth
+ * instance. Because the type is `Auth["api"]` and `LunoraAuth` is generic over
+ * the auth instance, callers get end-to-end inference: the endpoints they see
+ * are exactly the ones their auth instance loaded.
+ */
 interface LunoraAuthApiContext<Auth extends LunoraAuth> {
   /**
-  * The better-auth endpoint surface — every endpoint contributed by every
-  * plugin configured on the auth instance, ready to call directly:
-  *
-  * ```ts
-  * await ctx.authApi.createOrganization({ body: { name: "Acme" }, headers });
-  * await ctx.authApi.banUser({ body: { userId: "u_1" }, headers });
-  * ```
-  *
-  * # ⚠️ SECURITY: privileged surface — you MUST pass `headers`
-  *
-  * This is the **full, privileged** better-auth API (`auth.api`) — it
-  * includes admin/management endpoints such as `banUser`, `setRole`,
-  * impersonation, `createOrganization`, `removeMember`, … better-auth
-  * authorizes these calls from the caller's session in the `headers` you
-  * pass. Invoked **without** `headers`, better-auth treats the call as a
-  * trusted server-side invocation and **bypasses session authorization
-  * entirely** — any procedure that can reach `ctx.authApi` could then ban a
-  * user, escalate a role, or read another tenant's data.
-  *
-  * To stop that bypass at runtime, `withAuthPlugins` installs a guard around
-  * `ctx.authApi` by default: a header-less call to any endpoint throws
-  * {@link LunoraAuthHeadersError} rather than running with full privileges.
-  * The same `auth_api_call_without_headers` advisor lint catches it
-  * statically; the guard is the runtime backstop for the cases the lint
-  * can't see (dynamic method names, indirected calls). For the rare,
-  * deliberate unauthenticated server-to-server call, opt out explicitly with
-  * `ctx.authApi.withoutHeaders().&lt;method>(…)`.
-  *
-  * Lunora's procedure context carries only the resolved identity, not the
-  * raw inbound `Headers`, so this middleware CANNOT pre-bind them for you.
-  * Therefore: **thread the inbound `Headers` into every `ctx.authApi.*`
-  * call** (typically from an HTTP action — see {@link withAuthPlugins}). A
-  * header-less call is an authorization bypass, not a convenience.
-  */
+   * The better-auth endpoint surface — every endpoint contributed by every
+   * plugin configured on the auth instance, ready to call directly:
+   *
+   * ```ts
+   * await ctx.authApi.createOrganization({ body: { name: "Acme" }, headers });
+   * await ctx.authApi.banUser({ body: { userId: "u_1" }, headers });
+   * ```
+   *
+   * # ⚠️ SECURITY: privileged surface — you MUST pass `headers`
+   *
+   * This is the **full, privileged** better-auth API (`auth.api`) — it
+   * includes admin/management endpoints such as `banUser`, `setRole`,
+   * impersonation, `createOrganization`, `removeMember`, … better-auth
+   * authorizes these calls from the caller's session in the `headers` you
+   * pass. Invoked **without** `headers`, better-auth treats the call as a
+   * trusted server-side invocation and **bypasses session authorization
+   * entirely** — any procedure that can reach `ctx.authApi` could then ban a
+   * user, escalate a role, or read another tenant's data.
+   *
+   * To stop that bypass at runtime, `withAuthPlugins` installs a guard around
+   * `ctx.authApi` by default: a header-less call to any endpoint throws
+   * {@link LunoraAuthHeadersError} rather than running with full privileges.
+   * The same `auth_api_call_without_headers` advisor lint catches it
+   * statically; the guard is the runtime backstop for the cases the lint
+   * can't see (dynamic method names, indirected calls). For the rare,
+   * deliberate unauthenticated server-to-server call, opt out explicitly with
+   * `ctx.authApi.withoutHeaders().<method>(…)`.
+   *
+   * Lunora's procedure context carries only the resolved identity, not the
+   * raw inbound `Headers`, so this middleware CANNOT pre-bind them for you.
+   * Therefore: **thread the inbound `Headers` into every `ctx.authApi.*`
+   * call** (typically from an HTTP action — see {@link withAuthPlugins}). A
+   * header-less call is an authorization bypass, not a convenience.
+   */
   readonly authApi: {
     /**
-    * Explicit, loud escape hatch from the runtime header guard. Returns
-    * the raw, **unguarded** `auth.api` surface — every endpoint reached
-    * through it runs as a trusted server-to-server call with session
-    * authorization skipped.
-    *
-    * ```ts
-    * // A scheduled job with no inbound request that must create the
-    * // system org. Audited and intentional:
-    * await ctx.authApi.withoutHeaders().createOrganization({ body: { name } });
-    * ```
-    *
-    * Use only for deliberate, audited unauthenticated calls. For ordinary
-    * request-driven calls, pass `headers` so authorization is enforced.
-    */
+     * Explicit, loud escape hatch from the runtime header guard. Returns
+     * the raw, **unguarded** `auth.api` surface — every endpoint reached
+     * through it runs as a trusted server-to-server call with session
+     * authorization skipped.
+     *
+     * ```ts
+     * // A scheduled job with no inbound request that must create the
+     * // system org. Audited and intentional:
+     * await ctx.authApi.withoutHeaders().createOrganization({ body: { name } });
+     * ```
+     *
+     * Use only for deliberate, audited unauthenticated calls. For ordinary
+     * request-driven calls, pass `headers` so authorization is enforced.
+     */
     withoutHeaders: () => Auth["api"];
   } & Auth["api"];
 }
 /**
-* Build a Lunora middleware that mounts a better-auth instance's plugin API
-* onto `ctx.authApi`. Compose it with `.use(...)` once per builder and every
-* downstream handler gets typed access to the plugin endpoints — no more
-* importing the auth instance directly from every query/mutation file.
-*
-* # ⚠️ SECURITY: headers are load-bearing for authorization
-*
-* `ctx.authApi` is the **full privileged** better-auth surface (`auth.api`):
-* `banUser`, `setRole`, impersonation, `createOrganization`, `removeMember`,
-* and so on. better-auth authorizes these from the caller's session carried in
-* the `headers` you pass. **Called without `headers`, better-auth treats the
-* invocation as a trusted server-side call and skips session authorization
-* altogether** — so a header-less `ctx.authApi.banUser(...)` from any procedure
-* runs with full privileges regardless of who the caller is. This is an
-* authorization bypass, not just a missing convenience.
-*
-* To make that bypass fail loudly instead of silently, this middleware wraps
-* `ctx.authApi` in a **runtime header guard by default**: any endpoint called
-* without a `headers` property throws {@link LunoraAuthHeadersError}. The guard
-* mirrors the static `auth_api_call_without_headers` advisor lint exactly, so
-* the two agree on what counts as a header-bearing call.
-*
-* - **Default (safe):** `withAuthPlugins(auth)` — header-less calls throw.
-* - **Per-call opt-out (preferred):** `ctx.authApi.withoutHeaders().banUser(…)`
-* for a deliberate, audited unauthenticated server-to-server call.
-* - **Whole-middleware opt-out (loud):** `withAuthPlugins(auth, { enforceHeaders: false })`
-* disables the guard entirely; only do this once every call site is audited.
-*
-* Lunora's procedure context does not currently carry the raw request headers
-* (only the resolved identity — see `AuthState` in `@lunora/server`), so
-* this middleware **cannot** pre-bind headers for you and does **not** do so.
-* You MUST pass the inbound `Headers` explicitly into **every** `ctx.authApi.*`
-* call, from a transport that has them — typically an HTTP action:
-*
-* ```ts
-* // lunora/orgs.ts
-* import { httpAction } from "@lunora/server";
-* import { withAuthPlugins } from "@lunora/auth/middleware";
-* import { auth } from "./auth.js";
-*
-* export const createOrg = httpAction(async (ctx, request) => {
-*     const { name } = await request.json();
-*
-*     // ctx.authApi is installed by withAuthPlugins(auth) on the builder.
-*     const org = await ctx.authApi.createOrganization({
-*         body: { name },
-*         headers: request.headers,
-*     });
-*
-*     return Response.json(org);
-* });
-* ```
-*
-* For internal server-to-server calls where there is no inbound request
-* (e.g. a scheduled job that creates the system org), opt out explicitly with
-* `ctx.authApi.withoutHeaders()` and authenticate with whatever bearer token
-* your auth instance is configured to honour.
-*/
+ * Build a Lunora middleware that mounts a better-auth instance's plugin API
+ * onto `ctx.authApi`. Compose it with `.use(...)` once per builder and every
+ * downstream handler gets typed access to the plugin endpoints — no more
+ * importing the auth instance directly from every query/mutation file.
+ *
+ * # ⚠️ SECURITY: headers are load-bearing for authorization
+ *
+ * `ctx.authApi` is the **full privileged** better-auth surface (`auth.api`):
+ * `banUser`, `setRole`, impersonation, `createOrganization`, `removeMember`,
+ * and so on. better-auth authorizes these from the caller's session carried in
+ * the `headers` you pass. **Called without `headers`, better-auth treats the
+ * invocation as a trusted server-side call and skips session authorization
+ * altogether** — so a header-less `ctx.authApi.banUser(...)` from any procedure
+ * runs with full privileges regardless of who the caller is. This is an
+ * authorization bypass, not just a missing convenience.
+ *
+ * To make that bypass fail loudly instead of silently, this middleware wraps
+ * `ctx.authApi` in a **runtime header guard by default**: any endpoint called
+ * without a `headers` property throws {@link LunoraAuthHeadersError}. The guard
+ * mirrors the static `auth_api_call_without_headers` advisor lint exactly, so
+ * the two agree on what counts as a header-bearing call.
+ *
+ * - **Default (safe):** `withAuthPlugins(auth)` — header-less calls throw.
+ * - **Per-call opt-out (preferred):** `ctx.authApi.withoutHeaders().banUser(…)`
+ * for a deliberate, audited unauthenticated server-to-server call.
+ * - **Whole-middleware opt-out (loud):** `withAuthPlugins(auth, { enforceHeaders: false })`
+ * disables the guard entirely; only do this once every call site is audited.
+ *
+ * Lunora's procedure context does not currently carry the raw request headers
+ * (only the resolved identity — see `AuthState` in `@lunora/server`), so
+ * this middleware **cannot** pre-bind headers for you and does **not** do so.
+ * You MUST pass `Headers` explicitly into **every** `ctx.authApi.*` call. A
+ * procedure has no inbound `Headers` object, so rebuild one from what the
+ * transport forwarded in `args`:
+ *
+ * ```ts
+ * // lunora/orgs.ts
+ * export const createOrg = mutation
+ *     .input({ cookie: v.string(), name: v.string() })
+ *     .use(withAuthPlugins(auth))
+ *     .mutation(async ({ args, ctx }) =>
+ *         ctx.authApi.createOrganization({
+ *             body: { name: args.name },
+ *             // Rebuilt from the transport — the middleware cannot pre-bind them.
+ *             headers: new Headers({ cookie: args.cookie }),
+ *         }),
+ *     );
+ * ```
+ *
+ * `ctx.authApi` is a PROCEDURE-context surface — this middleware installs it
+ * through the builder's `.use()` chain, which `httpAction` / `httpRoute` do not
+ * have (see `HttpActionCtx` in `@lunora/server`). An HTTP action already holds
+ * the real inbound `Headers`, so call the auth instance there directly:
+ *
+ * ```ts
+ * export const createOrgHttp = httpAction(async (ctx, request) => {
+ *     const { name } = await request.json();
+ *     const org = await auth.api.createOrganization({ body: { name }, headers: request.headers });
+ *
+ *     return Response.json(org);
+ * });
+ * ```
+ *
+ * For internal server-to-server calls where there is no inbound request
+ * (e.g. a scheduled job that creates the system org), opt out explicitly with
+ * `ctx.authApi.withoutHeaders()` and authenticate with whatever bearer token
+ * your auth instance is configured to honour.
+ */
 /**
-* Shape of the middleware {@link withAuthPlugins} returns: a callable generic
-* over the incoming ctx so chaining `.use(...)` preserves whatever ctx fields
-* the upstream middleware already installed. Lives as its own interface
-* because TypeScript doesn't allow declaring `const fn: &lt;CtxIn>() => ...` —
-* the generic must live on a callable type alias or interface.
-*/
+ * Shape of the middleware {@link withAuthPlugins} returns: a callable generic
+ * over the incoming ctx so chaining `.use(...)` preserves whatever ctx fields
+ * the upstream middleware already installed. Lives as its own interface
+ * because TypeScript doesn't allow declaring `const fn: <CtxIn>() => ...` —
+ * the generic must live on a callable type alias or interface.
+ */
 type WithAuthPluginsMiddleware<Auth extends LunoraAuth> = <ContextIn>(options: {
   ctx: ContextIn;
   next: MiddlewareNext<ContextIn>;

package/dist/middleware.mjs

@@ -1,56 +1 @@
-import { LunoraError } from '@lunora/errors';
-
-const callHasHeaders = (argument) => {
-  if (argument === void 0) {
-    return false;
-  }
-  if (typeof argument !== "object" || argument === null) {
-    return true;
-  }
-  const { headers } = argument;
-  return headers !== void 0 && headers !== null;
-};
-const guardAuthApi = (api) => {
-  const withoutHeaders = () => api;
-  return /* @__PURE__ */ new Proxy(api, {
-    // eslint-disable-next-line sonarjs/function-return-type -- a Proxy `get` trap is intrinsically polymorphic: it returns the synthetic `withoutHeaders`, the guarded endpoint wrapper, or any passthrough property value
-    get(target, property, receiver) {
-      if (property === "withoutHeaders" && !(property in target)) {
-        return withoutHeaders;
-      }
-      const value = Reflect.get(target, property, receiver);
-      if (typeof value !== "function" || typeof property !== "string") {
-        return value;
-      }
-      const method = property;
-      return (...arguments_) => {
-        if (!callHasHeaders(arguments_[0])) {
-          return Promise.reject(new LunoraAuthHeadersError(method));
-        }
-        return Reflect.apply(value, target, arguments_);
-      };
-    }
-  });
-};
-class LunoraAuthHeadersError extends LunoraError {
-  /** The `ctx.authApi.<method>` that was called without `headers`. */
-  method;
-  constructor(method) {
-    super(
-      "AUTH_HEADERS_MISSING",
-      `@lunora/auth: ctx.authApi.${method}(…) was called without \`headers\`. better-auth treats a header-less call as a trusted server-to-server invocation and skips session authorization entirely — an authorization bypass. Pass the inbound request headers: ctx.authApi.${method}({ body, headers: request.headers }). If you genuinely intend an unauthenticated server-to-server call, opt out explicitly via ctx.authApi.withoutHeaders().<method>(…), or disable the guard for the whole middleware with withAuthPlugins(auth, { enforceHeaders: false }).`,
-      { name: "LunoraAuthHeadersError" }
-    );
-    this.method = method;
-  }
-}
-const withAuthPlugins = (auth, options = {}) => {
-  const enforceHeaders = options.enforceHeaders ?? true;
-  const authApi = enforceHeaders ? guardAuthApi(auth.api) : auth.api;
-  return async ({ next }) => {
-    const extended = await next({ ctx: { authApi } });
-    return extended;
-  };
-};
-
-export { LunoraAuthHeadersError, withAuthPlugins };
+import{LunoraError as d}from"@lunora/errors";const h=e=>{if(e===void 0)return!1;if(typeof e!="object"||e===null)return!0;const{headers:t}=e;return t!=null},c=(e,t)=>{const n=()=>e;return new Proxy(e,{get(s,r,o){if(r==="withoutHeaders"&&!(r in s))return n;const a=Reflect.get(s,r,o);if(typeof a!="function"||typeof r!="string")return a;const i=r;return(...u)=>t&&!h(u[0])?Promise.reject(new l(i)):Reflect.apply(a,s,u)}})};class l extends d{method;constructor(t){super("AUTH_HEADERS_MISSING",`@lunora/auth: ctx.authApi.${t}(…) was called without \`headers\`. better-auth treats a header-less call as a trusted server-to-server invocation and skips session authorization entirely — an authorization bypass. Pass the inbound request headers: ctx.authApi.${t}({ body, headers: request.headers }). If you genuinely intend an unauthenticated server-to-server call, opt out explicitly via ctx.authApi.withoutHeaders().<method>(…), or disable the guard for the whole middleware with withAuthPlugins(auth, { enforceHeaders: false }).`,{name:"LunoraAuthHeadersError"}),this.method=t}}const w=(e,t={})=>{const n=t.enforceHeaders??!0,s=c(e.api,n);return async({next:r})=>await r({ctx:{authApi:s}})};export{l as LunoraAuthHeadersError,w as withAuthPlugins};

package/dist/migrate.d.mts

@@ -0,0 +1,47 @@
+import { a as LunoraAuthOptions, L as LunoraAuth } from "./packem_shared/create-auth.d-D1CKOFWc.mjs";
+import 'better-auth';
+/**
+ * Apply better-auth's required schema (`user`, `session`, `account`,
+ * `verification`) to the configured database. Idempotent — better-auth
+ * diffs the existing schema and only runs the missing DDL.
+ *
+ * Cached per `options` reference so the diff cost (one PRAGMA-style sweep
+ * per table) doesn't fire on every request. In Cloudflare Workers the same
+ * `env.DB` binding is reused across invocations within a single isolate, so
+ * caching against the options object — which captures the binding — is
+ * sufficient.
+ *
+ * For production you should prefer pre-applying the schema at deploy time
+ * via `compileMigrationsSql` + `wrangler d1 execute`; this helper exists for
+ * dev/playground and small deployments.
+ */
+declare const ensureMigrated: (auth: LunoraAuth | {
+  options: LunoraAuthOptions;
+}) => Promise<void>;
+/**
+ * Compile better-auth's migrations to a single SQL string. Useful for
+ * `wrangler d1 execute --file -` in CI so the deploy step applies the schema
+ * before the first user request.
+ *
+ * Compiles from the SAME resolved options `createAuth` runs with (via
+ * `resolveAuthOptions`), not the raw caller options — so the schema includes the
+ * `rateLimit` table the worker's default-on durable limiter writes to. Compiling
+ * from the raw options would omit it, and the running worker would then write to
+ * a table the migration never created.
+ *
+ * **Upgrading a database created by an older `@lunora/auth`.** This compiles DDL without
+ * reading the database, so it cannot know whether the `account.issuer` column better-auth
+ * 1.7.0 required and 1.7.3 reverted is present — and SQLite has no `DROP COLUMN IF EXISTS`
+ * to make that moot. `ensureMigrated` handles it automatically; on this path, run
+ * `legacyIssuerCleanupStatements()` once against a database that still has the column.
+ * Leaving it in place fails every sign-up with `NOT NULL constraint failed: account.issuer`.
+ */
+declare const compileMigrationsSql: (options: LunoraAuthOptions) => Promise<string>;
+/**
+ * The migration-only auth instance: the same validated, hardened options as `createAuth`, but
+ * through the full `better-auth` entry so `database` may be the raw D1 binding the Kysely
+ * migrator drives. Hand it to {@link ensureMigrated}; never serve requests from it. Lives here
+ * so the migrator's Kysely edge stays out of the runtime bundle.
+ */
+declare const createMigrationAuth: (options: LunoraAuthOptions) => LunoraAuth;
+export { compileMigrationsSql, createMigrationAuth, ensureMigrated };

package/dist/migrate.d.ts

@@ -0,0 +1,47 @@
+import { a as LunoraAuthOptions, L as LunoraAuth } from "./packem_shared/create-auth.d-D1CKOFWc.js";
+import 'better-auth';
+/**
+ * Apply better-auth's required schema (`user`, `session`, `account`,
+ * `verification`) to the configured database. Idempotent — better-auth
+ * diffs the existing schema and only runs the missing DDL.
+ *
+ * Cached per `options` reference so the diff cost (one PRAGMA-style sweep
+ * per table) doesn't fire on every request. In Cloudflare Workers the same
+ * `env.DB` binding is reused across invocations within a single isolate, so
+ * caching against the options object — which captures the binding — is
+ * sufficient.
+ *
+ * For production you should prefer pre-applying the schema at deploy time
+ * via `compileMigrationsSql` + `wrangler d1 execute`; this helper exists for
+ * dev/playground and small deployments.
+ */
+declare const ensureMigrated: (auth: LunoraAuth | {
+  options: LunoraAuthOptions;
+}) => Promise<void>;
+/**
+ * Compile better-auth's migrations to a single SQL string. Useful for
+ * `wrangler d1 execute --file -` in CI so the deploy step applies the schema
+ * before the first user request.
+ *
+ * Compiles from the SAME resolved options `createAuth` runs with (via
+ * `resolveAuthOptions`), not the raw caller options — so the schema includes the
+ * `rateLimit` table the worker's default-on durable limiter writes to. Compiling
+ * from the raw options would omit it, and the running worker would then write to
+ * a table the migration never created.
+ *
+ * **Upgrading a database created by an older `@lunora/auth`.** This compiles DDL without
+ * reading the database, so it cannot know whether the `account.issuer` column better-auth
+ * 1.7.0 required and 1.7.3 reverted is present — and SQLite has no `DROP COLUMN IF EXISTS`
+ * to make that moot. `ensureMigrated` handles it automatically; on this path, run
+ * `legacyIssuerCleanupStatements()` once against a database that still has the column.
+ * Leaving it in place fails every sign-up with `NOT NULL constraint failed: account.issuer`.
+ */
+declare const compileMigrationsSql: (options: LunoraAuthOptions) => Promise<string>;
+/**
+ * The migration-only auth instance: the same validated, hardened options as `createAuth`, but
+ * through the full `better-auth` entry so `database` may be the raw D1 binding the Kysely
+ * migrator drives. Hand it to {@link ensureMigrated}; never serve requests from it. Lives here
+ * so the migrator's Kysely edge stays out of the runtime bundle.
+ */
+declare const createMigrationAuth: (options: LunoraAuthOptions) => LunoraAuth;
+export { compileMigrationsSql, createMigrationAuth, ensureMigrated };

package/dist/migrate.mjs

@@ -0,0 +1 @@
+import{getAuthTablesWithResolvedIndexes as w,invalidateSchemaChecks as y}from"@better-auth/core/db/internal";import{LunoraError as R}from"@lunora/errors";import{betterAuth as _}from"better-auth";import{getMigrations as l}from"better-auth/db/migration";import{q as c}from"./packem_shared/quote-identifier-CGiYFBvY.mjs";import{resolveAuthOptions as A,prepareAuthOptions as M}from"./packem_shared/createAuth-B-Pq7nmN.mjs";import{schemaDeclaresIssuer as x,legacyIssuerCleanupStatements as T,indexesReferencingIssuer as N}from"./packem_shared/legacyIssuerCleanupStatements-D9Kf8OD1.mjs";const C=/pragma_index_list\s*\(/iu,D=/sqlite_master/iu,S=/^["`[]|["\]`]$/gu,O=/\s+/u,P=/create\s+unique\s+index/iu,L=/\bwhere\b/iu,U=t=>C.test(t)&&D.test(t),q=t=>(t.trim().split(O)[0]??"").replaceAll(S,"").trim(),v=t=>{const e=t.indexOf("(");if(e===-1)return{columns:[],tail:""};let s=0;for(let n=e;n<t.length;n+=1){const a=t[n];if(a==="(")s+=1;else if(a===")"&&(s-=1,s===0))return{columns:t.slice(e+1,n).split(",").map(o=>q(o)).filter(o=>o!==""),tail:t.slice(n+1)}}return{columns:[],tail:""}},W=async t=>{const e=t.prepare("SELECT name, tbl_name, sql FROM sqlite_master WHERE type = 'index'"),{results:s}=await e.all(),n=[];for(const a of s??[]){const o=a.name,r=a.tbl_name,i=a.sql;if(typeof o!="string"||typeof r!="string")continue;if(typeof i!="string"){n.push({columnPosition:0,indexName:o,isPartial:0,isUnique:1,tableName:r});continue}const d=P.test(i)?1:0,{columns:h,tail:b}=v(i),E=L.test(b)?1:0;for(const[g,I]of h.entries())n.push({columnName:I,columnPosition:g,indexName:o,isPartial:E,isUnique:d,tableName:r})}return n},F=t=>{const e=async()=>{const n=await W(t);return{meta:{},results:n,success:!0}},s={all:e,bind:()=>s,run:e};return s},H=t=>new Proxy(t,{get(e,s,n){if(s==="prepare")return o=>U(o)?F(e):e.prepare(o);const a=Reflect.get(e,s,n);return typeof a=="function"?a.bind(e):a}}),m=t=>typeof t=="object"&&t!==null&&typeof t.prepare=="function"&&typeof t.batch=="function",p=t=>{const{database:e}=t;if(!(e&&typeof e!="function"))throw new R("AUTH_MIGRATOR_UNSUPPORTED",e?"@lunora/auth: this auth instance's `database` is a custom adapter, which better-auth's migrator cannot drive.":"@lunora/auth: this auth instance has no `database`, so better-auth's migrator has nothing to introspect.")},f=t=>m(t.database)?{...t,database:H(t.database)}:t,$=async(t,e)=>{const s=c("t");try{return await t.prepare(`SELECT ${s}.${c("issuer")} FROM ${c(e)} AS ${s} LIMIT 0`).run(),!0}catch{return!1}},Q=async t=>{const{database:e}=t,{tables:s}=w(t),{account:n}=s;if(n!==void 0&&!x(Object.entries(n.fields).map(([a,o])=>o.fieldName??a))&&m(e)&&await $(e,n.modelName))try{const{results:a}=await e.prepare("SELECT name, sql FROM sqlite_master WHERE type = 'index' AND tbl_name = ?").bind(n.modelName).all();await e.batch(T(n.modelName,N(a)).map(o=>e.prepare(o)))}catch(a){console.error("@lunora/auth: could not drop the reverted `account.issuer` column; if it is still present, sign-ups will fail until it is removed.",a)}},j=t=>{const{database:e}=t;typeof e=="object"&&e!==null&&y(e)},u=new WeakMap,J=async t=>{const{options:e}=t;p(e);const s=u.get(e);if(s){await s;return}const n=(async()=>{const{runMigrations:a}=await l(f(e));await a(),await Q(e),j(e)})();u.set(e,n);try{await n}catch(a){throw u.delete(e),a}},V=async t=>{const e=A(t);p(e);const{compileMigrations:s}=await l(f(e));return s()},Z=t=>_(M(t));export{V as compileMigrationsSql,Z as createMigrationAuth,J as ensureMigrated};

package/dist/packem_shared/AUTH_DO_AUDIT_PATH-DNM3G5GI.mjs

@@ -0,0 +1 @@
+import{I as R,L as _,R as S,a as T}from"./auth-do-nKx0bUTe.mjs";import"./adapter-CBZ17jKi.mjs";import"../audit.mjs";import"./createAuth-B-Pq7nmN.mjs";import"./authDiscoveryPaths-B14lM14u.mjs";import"./authDoColumnAdditions-UwF3Rl41.mjs";import"./DEFAULT_AUTH_BASE_PATH-DneiLGpv.mjs";import"./legacyIssuerCleanupStatements-D9Kf8OD1.mjs";export{R as INTERNAL_SECRET_HEADER,_ as LunoraAuthDO,S as READ_AUDIT_PATH,T as RESOLVE_SESSION_PATH};

package/dist/packem_shared/DEFAULT_AUTH_BASE_PATH-DneiLGpv.mjs

@@ -0,0 +1 @@
+const e="/api/auth",u=(n,t)=>{const r=t.endsWith("/")?t.slice(0,-1):t;return n===r||n.startsWith(`${r}/`)},o=async(n,t,r=e)=>{const s=new URL(t.url);if(u(s.pathname,r))return n.handler(t)};export{e as DEFAULT_AUTH_BASE_PATH,o as handleAuthRequest,u as isAuthRoutePath};

package/dist/packem_shared/LunoraAuthAdminError-uhKG1MgQ.mjs

@@ -0,0 +1 @@
+import{LunoraError as M}from"@lunora/errors";import{getAuthTables as b}from"better-auth/db";import{revokeSignUpInvitation as U,createSignUpInvitation as R}from"./createSignUpInvitation-DHZL9fNl.mjs";class f extends M{constructor(c,h){super(h,c,{name:"LunoraAuthAdminError"})}}const N=50,D=500,O=3600,E=O*24,T=100*365*24*60*60,z=2880*60*1e3,k=[{field:"userId",model:"member"},{field:"userId",model:"teamMember"},{field:"userId",model:"passkey"},{field:"userId",model:"twoFactor"},{field:"userId",model:"oauthAccessToken"},{field:"userId",model:"oauthRefreshToken"},{field:"userId",model:"oauthConsent"},{field:"userId",model:"deviceCode"},{field:"userId",model:"walletAddress"},{field:"inviterId",model:"invitation"}],L=new Set(["accessToken","backupCodes","idToken","password","publicKey","refreshToken","secret","token","tokenHash"]),C=o=>Math.min(Math.max(Math.trunc(o??N),1),D),P=o=>Math.max(0,Math.trunc(o??0)),u=o=>{const c={};for(const[h,l]of Object.entries(o))L.has(h)||(c[h]=l instanceof Date?l.getTime():l);return c},g=o=>Array.isArray(o)?o.join(","):o,S=o=>o.toLowerCase().replaceAll(/[^\da-z]+/g,"-").replaceAll(/^-|-$/g,""),B=new Set(["banExpires","banned","banReason","createdAt","email","emailVerified","id","name","role","updatedAt"]),F={displayUsername:"username",phoneNumber:"phone-number",phoneNumberVerified:"phone-number",username:"username"},G=o=>o==="boolean"||o==="date"||o==="number"?o:"string",V=o=>{const c=[];for(const[h,l]of Object.entries(o))l.input===!1||l.references!==void 0||B.has(h)||c.push({name:h,plugin:F[h],required:l.required===!0,type:G(l.type),unique:l.unique===!0});return c},I=o=>typeof o=="string"&&o.includes("owner"),_=async(o,c)=>{const l=(await o.adapter.findMany({model:"member",where:[{field:"userId",value:c}]})).filter(p=>I(p.role)&&typeof p.organizationId=="string").map(p=>p.organizationId);if(l.length===0)return;const A=await Promise.all(l.map(async p=>o.adapter.findMany({model:"member",where:[{field:"organizationId",value:p}]}))),n=l.find((p,v)=>!A[v]?.some(e=>e.userId!==c&&I(e.role)));if(n!==void 0)throw new f(`user is the last owner of organization ${n} — transfer ownership or delete the organization first`,"LAST_ORGANIZATION_OWNER")},j=o=>{if(o instanceof f)return o;const c=o,h=c?.body?.code??c?.code??"AUTH_ADMIN_ERROR",l=c?.body?.message??c?.message??"auth admin operation failed";return new f(l,h)},W=(o,c={})=>{const h=o.$context,l=c.features??{},A=e=>{const a=new Set((e.plugins??[]).map(i=>i.id)),t=i=>a.has(i);return{accounts:l.accounts??!0,admin:l.admin??t("admin"),inviteOnly:l.inviteOnly??t("lunora-invite-only"),organization:l.organization??t("organization"),passkey:l.passkey??t("passkey"),twoFactor:l.twoFactor??t("two-factor")}},n=async e=>{try{return await e(await h)}catch(a){throw j(a)}},p=e=>u(e),v=async(e,a,t)=>{const i=t.where&&t.where.length>0?t.where:void 0,[r,s]=await Promise.all([e.adapter.findMany({limit:C(t.limit),model:a,offset:P(t.offset),sortBy:t.sortBy,where:i}),e.adapter.count({model:a,where:i})]);return{rows:r.map(d=>u(d)),total:s}};return{banUser:({expiresInSeconds:e,reason:a,userId:t})=>n(async i=>{let r=null;if(e!==void 0){if(!Number.isInteger(e)||e<=0)throw new f("expiresInSeconds must be a positive finite integer","INVALID_BAN_SECONDS");const d=Math.min(e,T);r=new Date(Date.now()+d*1e3)}const s=await i.internalAdapter.updateUser(t,{banExpires:r,banned:!0,banReason:a??"No reason"});return await i.internalAdapter.deleteUserSessions(t),p(s)}),cancelInvitation:({invitationId:e})=>n(async a=>{await a.adapter.delete({model:"invitation",where:[{field:"id",value:e}]})}),capabilities:()=>n(e=>Promise.resolve(A(e.options))),addMember:({organizationId:e,role:a,userId:t})=>n(async i=>{const r=await i.adapter.create({data:{createdAt:new Date,organizationId:e,role:a===void 0||a===""?"member":a,userId:t},model:"member"});return u(r)}),addTeamMember:({teamId:e,userId:a})=>n(async t=>{const i=await t.adapter.create({data:{createdAt:new Date,teamId:e,userId:a},model:"teamMember"});return u(i)}),config:()=>n(e=>{const a=e.options,t=A(a),i=new Set((a.plugins??[]).map(m=>m.id)),r=b(a),s=a.session??{},d=a.rateLimit??{};return Promise.resolve({capabilities:t,emailAndPassword:a.emailAndPassword?.enabled??!1,organization:{enabled:t.organization,roles:!!r.organizationRole,teams:!!r.team},plugins:[...i].toSorted((m,w)=>m.localeCompare(w)),rateLimit:{enabled:d.enabled??!1,max:d.max,window:d.window},session:{cookieCache:s.cookieCache?.enabled,expiresIn:s.expiresIn,freshAge:s.freshAge,updateAge:s.updateAge},socialProviders:Object.keys(a.socialProviders??{}).toSorted((m,w)=>m.localeCompare(w)),userFields:V(r.user?.fields??{})})}),createOrganization:({logo:e,metadata:a,name:t,ownerId:i,slug:r})=>n(async s=>{const d=S(r!==void 0&&r!==""?r:t);if(d==="")throw new f("could not derive a slug from the organization name","ORG_SLUG_INVALID");if(await s.adapter.findOne({model:"organization",where:[{field:"slug",value:d}]}))throw new f("an organization with this slug already exists","ORG_SLUG_TAKEN");const w=await s.adapter.create({data:{createdAt:new Date,logo:e===void 0||e===""?void 0:e,metadata:a===void 0?void 0:JSON.stringify(a),name:t,slug:d},model:"organization"});return i!==void 0&&i!==""&&await s.adapter.create({data:{createdAt:new Date,organizationId:w.id,role:"owner",userId:i},model:"member"}),u(w)}),createOrgRole:({organizationId:e,permission:a,role:t})=>n(async i=>{const r=await i.adapter.create({data:{createdAt:new Date,organizationId:e,permission:JSON.stringify(a),role:t},model:"organizationRole"});return u(r)}),createTeam:({name:e,organizationId:a})=>n(async t=>{const i=await t.adapter.create({data:{createdAt:new Date,name:e,organizationId:a},model:"team"});return u(i)}),deleteOrganization:({organizationId:e})=>n(async a=>{const t=b(a.options);if(await a.adapter.deleteMany({model:"member",where:[{field:"organizationId",value:e}]}),await a.adapter.deleteMany({model:"invitation",where:[{field:"organizationId",value:e}]}),t.team){const i=await a.adapter.findMany({model:"team",where:[{field:"organizationId",value:e}]});for(const r of i)await a.adapter.deleteMany({model:"teamMember",where:[{field:"teamId",value:r.id}]});await a.adapter.deleteMany({model:"team",where:[{field:"organizationId",value:e}]})}t.organizationRole&&await a.adapter.deleteMany({model:"organizationRole",where:[{field:"organizationId",value:e}]}),await a.adapter.delete({model:"organization",where:[{field:"id",value:e}]})}),deleteOrgRole:({roleId:e})=>n(async a=>{await a.adapter.delete({model:"organizationRole",where:[{field:"id",value:e}]})}),inviteMember:({email:e,inviterId:a,organizationId:t,role:i})=>n(async r=>{let s=a;if(s===void 0||s===""){const m=await r.adapter.findMany({model:"member",where:[{field:"organizationId",value:t}]});s=(m.find(y=>typeof y.role=="string"&&y.role.includes("owner"))??m[0])?.userId}if(s===void 0||s==="")throw new f("provide an inviter — the organization has no members to attribute the invitation to","INVITER_REQUIRED");const d=await r.adapter.create({data:{createdAt:new Date,email:e.toLowerCase(),expiresAt:new Date(Date.now()+z),inviterId:s,organizationId:t,role:i===void 0||i===""?"member":i,status:"pending"},model:"invitation"});return u(d)}),listOrgRoles:({limit:e,offset:a,organizationId:t})=>n(i=>v(i,"organizationRole",{limit:e,offset:a,sortBy:{direction:"desc",field:"createdAt"},where:[{field:"organizationId",value:t}]})),listTeamMembers:({limit:e,offset:a,teamId:t})=>n(i=>v(i,"teamMember",{limit:e,offset:a,where:[{field:"teamId",value:t}]})),listTeams:({limit:e,offset:a,organizationId:t})=>n(i=>v(i,"team",{limit:e,offset:a,sortBy:{direction:"desc",field:"createdAt"},where:[{field:"organizationId",value:t}]})),removeTeam:({teamId:e})=>n(async a=>{await a.adapter.deleteMany({model:"teamMember",where:[{field:"teamId",value:e}]}),await a.adapter.delete({model:"team",where:[{field:"id",value:e}]})}),removeTeamMember:({teamMemberId:e})=>n(async a=>{await a.adapter.delete({model:"teamMember",where:[{field:"id",value:e}]})}),updateMemberRole:({memberId:e,role:a})=>n(async t=>{const i=await t.adapter.update({model:"member",update:{role:g(a)},where:[{field:"id",value:e}]});return u(i??{id:e,role:g(a)})}),updateOrganization:({logo:e,metadata:a,name:t,organizationId:i,slug:r})=>n(async s=>{const d={};if(t!==void 0&&(d.name=t),r!==void 0&&r!==""&&(d.slug=S(r)),e!==void 0&&(d.logo=e===""?void 0:e),a!==void 0&&(d.metadata=JSON.stringify(a)),Object.keys(d).length===0)return u({id:i});const m=await s.adapter.update({model:"organization",update:d,where:[{field:"id",value:i}]});return u(m??{id:i})}),updateOrgRole:({permission:e,roleId:a})=>n(async t=>{const i=await t.adapter.update({model:"organizationRole",update:{permission:JSON.stringify(e),updatedAt:new Date},where:[{field:"id",value:a}]});return u(i??{id:a,permission:JSON.stringify(e)})}),updateTeam:({name:e,teamId:a})=>n(async t=>{const i=await t.adapter.update({model:"team",update:{name:e,updatedAt:new Date},where:[{field:"id",value:a}]});return u(i??{id:a,name:e})}),createUser:({data:e,email:a,name:t,password:i,role:r})=>n(async s=>{const d=a.toLowerCase();if(await s.internalAdapter.findUserByEmail(d))throw new f("a user with this email already exists","USER_ALREADY_EXISTS");const m={...e};delete m.isAnonymous;const w=await s.internalAdapter.createUser({email:d,name:t,role:r===void 0?void 0:g(r),...m},{method:"admin"});if(i!==void 0&&i!==""){const y=await s.password.hash(i);await s.internalAdapter.linkAccount({accountId:w.id,password:y,providerId:"credential",userId:w.id})}return p(w)}),deletePasskey:({passkeyId:e})=>n(async a=>{await a.adapter.delete({model:"passkey",where:[{field:"id",value:e}]})}),disableTwoFactor:({userId:e})=>n(async a=>{await a.adapter.deleteMany({model:"twoFactor",where:[{field:"userId",value:e}]}),await a.internalAdapter.updateUser(e,{twoFactorEnabled:!1})}),impersonateUser:({userId:e})=>n(async a=>{const t=await a.internalAdapter.findUserById(e);if(!t)throw new f("user not found","USER_NOT_FOUND");const i=c.impersonationSeconds;let r=O;if(i!==void 0){if(!Number.isInteger(i)||!Number.isFinite(i)||i<=0)throw new f("impersonationSeconds must be a positive finite integer","INVALID_IMPERSONATION_SECONDS");r=Math.min(i,E)}const s=new Date(Date.now()+r*1e3),d=await a.internalAdapter.createSession(e,!0,{expiresAt:s,impersonatedBy:c.impersonatedBy??e},!0);return{expiresAt:d.expiresAt instanceof Date?d.expiresAt.getTime():s.getTime(),token:d.token,user:p(t)}}),listAccounts:({userId:e})=>n(async a=>(await a.adapter.findMany({model:"account",where:[{field:"userId",value:e}]})).map(i=>u(i))),listInvitations:({limit:e,offset:a,organizationId:t})=>n(i=>v(i,"invitation",{limit:e,offset:a,where:[{field:"organizationId",value:t}]})),createSignUpInvitation:({email:e,expiresInSeconds:a,invitedBy:t})=>n(async()=>{const i=await R(o,{email:e,expiresInSeconds:a,invitedBy:t});return{...u({...i}),token:i.token}}),listSignUpInvitations:({limit:e,offset:a})=>n(t=>v(t,"signUpInvitation",{limit:e,offset:a,sortBy:{direction:"desc",field:"createdAt"}})),revokeSignUpInvitation:({email:e})=>n(async()=>U(o,{email:e})),listMembers:({limit:e,offset:a,organizationId:t})=>n(i=>v(i,"member",{limit:e,offset:a,sortBy:{direction:"desc",field:"createdAt"},where:[{field:"organizationId",value:t}]})),listOrganizations:({limit:e,offset:a})=>n(t=>v(t,"organization",{limit:e,offset:a,sortBy:{direction:"desc",field:"createdAt"}})),listPasskeys:({userId:e})=>n(async a=>(await a.adapter.findMany({model:"passkey",where:[{field:"userId",value:e}]})).map(i=>u(i))),listSessions:({limit:e,offset:a,userId:t})=>n(i=>v(i,"session",{limit:e,offset:a,sortBy:{direction:"desc",field:"createdAt"},where:t===void 0||t===""?void 0:[{field:"userId",value:t}]})),listUsers:({filterField:e,filterValue:a,limit:t,offset:i,search:r,searchField:s,sortBy:d,sortDirection:m})=>n(w=>{const y=[];return r!==void 0&&r!==""&&y.push({field:s??"email",operator:"contains",value:r}),a!==void 0&&y.push({field:e??"email",operator:"eq",value:a}),v(w,"user",{limit:t,offset:i,sortBy:{direction:m??"desc",field:d??"createdAt"},where:y})}),removeMember:({memberId:e})=>n(async a=>{await a.adapter.delete({model:"member",where:[{field:"id",value:e}]})}),removeUser:({userId:e})=>n(async a=>{const t=b(a.options);t.member&&await _(a,e),await Promise.all(k.filter(({model:i})=>t[i]).map(({field:i,model:r})=>a.adapter.deleteMany({model:r,where:[{field:i,value:e}]}))),await a.internalAdapter.deleteUserSessions(e),await a.internalAdapter.deleteUser(e)}),revokeUserSession:({sessionId:e})=>n(async a=>{const t=await a.adapter.findOne({model:"session",where:[{field:"id",value:e}]});t?.token&&await a.internalAdapter.deleteSession(t.token)}),revokeUserSessions:({userId:e})=>n(async a=>{await a.internalAdapter.deleteUserSessions(e)}),setRole:({role:e,userId:a})=>n(async t=>{const i=await t.internalAdapter.updateUser(a,{role:g(e)});return p(i)}),setUserPassword:({newPassword:e,userId:a})=>n(async t=>{const i=t.password.config.minPasswordLength,r=t.password.config.maxPasswordLength;if(e.length<i)throw new f(`password must be at least ${i.toString()} characters`,"PASSWORD_TOO_SHORT");if(e.length>r)throw new f(`password must be at most ${r.toString()} characters`,"PASSWORD_TOO_LONG");if(!await t.internalAdapter.findUserById(a))throw new f("user not found","USER_NOT_FOUND");const d=(await t.internalAdapter.findAccounts(a)).some(w=>w.providerId==="credential");if(!d&&t.options.emailAndPassword?.enabled!==!0)throw new f("email/password sign-in is disabled for this deployment","EMAIL_PASSWORD_DISABLED");const m=await t.password.hash(e);d?await t.internalAdapter.updatePassword(a,m):await t.internalAdapter.linkAccount({accountId:a,password:m,providerId:"credential",userId:a})}),unbanUser:({userId:e})=>n(async a=>{const t=await a.internalAdapter.updateUser(e,{banExpires:null,banned:!1,banReason:null});return p(t)}),unlinkAccount:({accountId:e,userId:a})=>n(async t=>{await t.adapter.delete({model:"account",where:[{field:"id",value:e},{connector:"AND",field:"userId",value:a}]})}),updateUser:({data:e,userId:a})=>n(async t=>{const i=await t.internalAdapter.updateUser(a,e);return p(i)})}};export{f as LunoraAuthAdminError,W as createAuthAdmin};

package/dist/packem_shared/adapter-CBZ17jKi.mjs

@@ -0,0 +1,2 @@
+import{createAdapterFactory as m}from"better-auth/adapters";import{checksSchema as p,registerSchemaCheck as f,createSchemaCheck as h,getExpectedSchema as y,diffSchema as b,formatSchemaFinding as w}from"@better-auth/core/db/internal";import{q as S}from"./quote-identifier-CGiYFBvY.mjs";import{C as g,d as x,c as u}from"./sql-store-uMubPYI9.mjs";const A=e=>({all:(a,t)=>Promise.resolve([...e.sql.exec(a,...t)]),run:(a,t)=>([...e.sql.exec(a,...t)],Promise.resolve())}),O=e=>async a=>e.transaction(a),M=e=>({parameters:[],sql:`PRAGMA table_info(${S(e)})`}),q=e=>({parameters:[e],sql:"SELECT * FROM pragma_table_info(?)"}),I=e=>{const a=String(e.name),t=e.dflt_value;return{hasDefault:t!=null||a===g,name:a,nullable:Number(e.notnull??0)===0}},v=async(e,a,t)=>{const{parameters:n,sql:r}=a(t),s=await e.all(r,n);if(s.length!==0)return{columns:s.map(o=>I(o)),name:t}},C=e=>{const a=["@lunora/auth: the auth tables do not match the better-auth options this app runs.",...e.map(t=>`  - ${w(t,"database")}`),"Fix the schema, not the adapter. better-auth's own tables are created by `ensureMigrated(...)` or by","`compileMigrationsSql(...)` at deploy time; tables you declared yourself come from `authTables(options)`","in `lunora/schema.ts` plus `lunora migrate`. `npx auth migrate` does not apply to a Lunora app."];console.error(a.join(`
+`))},T=async(e,a,t)=>{const n=y(e),r=Object.entries(n).filter(([,c])=>!c.disableMigrations).map(([c])=>c),s=await Promise.all(r.map(async c=>v(a,t,c))),o=b(n,s.filter(c=>c!==void 0));return o.length>0&&C(o),o},i=(e,a)=>t=>{const n=e(t);if(p(t)){const{database:r,executor:s,tableInfo:o}=a;f(n,h(async()=>T(t,s,o),"database",r))}return n},E=e=>e,l=e=>e??null,N=e=>e,R=e=>({consumeOne:async({model:a,where:t})=>l(await e.consumeOne(a,t)),count:async({model:a,where:t})=>e.count(a,t??[]),create:async({data:a,model:t})=>E(await e.create(t,a)),delete:async({model:a,where:t})=>{await e.remove(a,t)},deleteMany:async({model:a,where:t})=>e.remove(a,t),findMany:async({limit:a,model:t,offset:n,sortBy:r,where:s})=>N(await e.read(t,{limit:a,offset:n,sortBy:r,where:s??[]})),findOne:async({model:a,where:t})=>{const[n]=await e.read(a,{limit:1,where:t});return l(n)},incrementOne:async({increment:a,model:t,set:n,where:r})=>l(await e.incrementOne(t,r,a,n)),update:async({model:a,update:t,where:n})=>{const[r]=await e.update(a,n,t);return l(r)},updateMany:async({model:a,update:t,where:n})=>(await e.update(a,n,t)).length}),d=(e,a)=>{const t=r=>s=>m({adapter:()=>R(e),config:{adapterId:"lunora",adapterName:"Lunora Adapter",transaction:r(s),supportsBooleans:!1,supportsDates:!1,supportsJSON:!1,supportsNumericIds:!1}})(s),n=()=>!1;return t(a?r=>async s=>a(async()=>s(t(n)(r))):n)},k=e=>{const a=x(e);return i(d(u(a)),{database:e,executor:a,tableInfo:M})},L=e=>{const a=A(e);return i(d(u(a),O(e)),{database:e,executor:a,tableInfo:q})};export{k as a,L as b,A as d,d as l};