@lunora/auth 1.0.0-alpha.25 → 1.0.0-alpha.250

package/dist/packem_shared/worker.d-Dnw0s0_j.d.mts

@@ -0,0 +1,762 @@
+import "./adapter.d-CaPwF2v3.mjs";
+import { LunoraError } from '@lunora/errors';
+import { L as LunoraAuth, a as LunoraAuthOptions } from "./create-auth.d-DNGo48je.mjs";
+import { AuthAuditReader } from "../audit.mjs";
+import "../sql-store.mjs";
+/**
+ * A timestamp as it leaves the admin API: epoch-ms (better-auth stores `Date`s,
+ * which we normalize on output) or `null` when the column is unset.
+ */
+type AuthTimestamp = null | number;
+/**
+ * One user row as the admin API surfaces it. The fixed keys mirror better-auth's
+ * core `user` table plus the `admin()` plugin columns (`role`/`banned`/…); the
+ * index signature carries any app-defined `user.additionalFields` so callers
+ * (the studio) can render them generically. Password material never lives on
+ * this row (it's in the `account` table) and is never returned.
+ */
+interface AuthAdminUser {
+  [key: string]: unknown;
+  banExpires?: AuthTimestamp;
+  banned?: boolean | null;
+  banReason?: null | string;
+  createdAt?: AuthTimestamp;
+  email?: null | string;
+  emailVerified?: boolean | null;
+  id: string;
+  image?: null | string;
+  name?: null | string;
+  role?: null | string;
+  updatedAt?: AuthTimestamp;
+}
+/**
+ * One session row as the admin API surfaces it. Mirrors better-auth's `session`
+ * table; `impersonatedBy` is set when the session was minted by
+ * {@link AuthAdmin.impersonateUser}. The signing `token` is stripped — it's a
+ * bearer credential, and the only place we hand one back is the explicit
+ * impersonation flow.
+ */
+interface AuthAdminSession {
+  [key: string]: unknown;
+  createdAt?: AuthTimestamp;
+  expiresAt?: AuthTimestamp;
+  id: string;
+  impersonatedBy?: null | string;
+  ipAddress?: null | string;
+  userAgent?: null | string;
+  userId: string;
+}
+/** One linked account (a credential or OAuth provider). All token material is stripped. */
+interface AuthAccount {
+  [key: string]: unknown;
+  accountId?: null | string;
+  createdAt?: AuthTimestamp;
+  id: string;
+  providerId?: null | string;
+  scope?: null | string;
+  userId: string;
+}
+/** One organization row (from the `organization` plugin). */
+interface AuthOrganization {
+  [key: string]: unknown;
+  createdAt?: AuthTimestamp;
+  id: string;
+  name?: null | string;
+  slug?: null | string;
+}
+/** One organization membership row. */
+interface AuthMember {
+  [key: string]: unknown;
+  createdAt?: AuthTimestamp;
+  id: string;
+  organizationId: string;
+  role?: null | string;
+  userId: string;
+}
+/** One pending organization invitation. */
+interface AuthInvitation {
+  [key: string]: unknown;
+  email?: null | string;
+  expiresAt?: AuthTimestamp;
+  id: string;
+  organizationId: string;
+  role?: null | string;
+  status?: null | string;
+}
+/**
+ * One sign-up invitation (from the `inviteOnly` plugin). Distinct from
+ * {@link AuthInvitation}, which invites an existing account into an organization:
+ * this one is what lets an address create an account at all.
+ */
+interface AuthSignUpInvitation {
+  [key: string]: unknown;
+  /** When an account was created for this address; `null` while the invitation is unspent. */
+  acceptedAt?: AuthTimestamp;
+  createdAt?: AuthTimestamp;
+  email?: null | string;
+  expiresAt?: AuthTimestamp;
+  id: string;
+  invitedBy?: null | string;
+  /**
+   * The plaintext invitation token — present **only** on the row
+   * {@link AuthAdmin.createSignUpInvitation} returns, never on a listed one.
+   * The stored `tokenHash` is in {@link SENSITIVE_FIELDS}, so it cannot leave
+   * this plane by accident.
+   */
+  token?: string;
+}
+/** One team row (from the `organization` plugin with `teams.enabled`). */
+interface AuthTeam {
+  [key: string]: unknown;
+  createdAt?: AuthTimestamp;
+  id: string;
+  name?: null | string;
+  organizationId: string;
+}
+/** One team-membership row (teams). */
+interface AuthTeamMember {
+  [key: string]: unknown;
+  createdAt?: AuthTimestamp;
+  id: string;
+  teamId: string;
+  userId: string;
+}
+/**
+ * One custom organization role (from the organization plugin's dynamic
+ * access-control). `permission` is a JSON string of a `resource → actions[]` map
+ * as stored; the studio parses it for display/editing.
+ */
+interface AuthOrgRole {
+  [key: string]: unknown;
+  createdAt?: AuthTimestamp;
+  id: string;
+  organizationId: string;
+  permission?: null | string;
+  role?: null | string;
+}
+/** One registered passkey. Credential secrets (`publicKey`) are stripped. */
+interface AuthPasskey {
+  [key: string]: unknown;
+  createdAt?: AuthTimestamp;
+  deviceType?: null | string;
+  id: string;
+  name?: null | string;
+  userId: string;
+}
+/** A page of rows plus the unpaginated total. */
+interface AuthPage<T> {
+  rows: T[];
+  total: number;
+}
+/**
+ * Which admin surfaces a given auth instance supports, derived from the enabled
+ * better-auth plugins (and any {@link CreateAuthAdminOptions.features} overrides).
+ * The studio calls {@link AuthAdmin.capabilities} once and renders only the
+ * panels whose capability is `true` — so a deployment that doesn't enable, say,
+ * the `organization` plugin never shows an Organizations section.
+ */
+interface AuthCapabilities {
+  /** Linked-account browsing/unlinking — core (the `account` table always exists). */
+  accounts: boolean;
+  /** The `admin()` plugin: ban/role/impersonate/create/delete/set-password. */
+  admin: boolean;
+  /** The `inviteOnly` plugin: sign-up invitations. */
+  inviteOnly: boolean;
+  /** The `organization` plugin: orgs, members, invitations. */
+  organization: boolean;
+  /** The `@better-auth/passkey` plugin: per-user passkeys. */
+  passkey: boolean;
+  /** The `two-factor` plugin: per-user 2FA status / disable. */
+  twoFactor: boolean;
+}
+/**
+ * One app/plugin-defined field the create-user form should render, derived from
+ * the merged better-auth `user` table (core + plugin + `additionalFields`). Only
+ * user-settable columns are surfaced — server-managed flags (`input: false`),
+ * foreign keys (`references`), and the core columns the form already handles
+ * (`email`/`name`/`role`/ban state/…) are filtered out upstream.
+ */
+interface AuthUserFieldSpec {
+  /** Logical field name (the key passed back in `createUser`'s `data`). */
+  name: string;
+  /** Best-effort plugin id the field originates from (`username`, `phone-number`, …); `undefined` for app `additionalFields`. */
+  plugin?: string;
+  required: boolean;
+  /** Coarse input kind the studio maps to a control (checkbox / number / date / text). */
+  type: "boolean" | "date" | "number" | "string";
+  unique: boolean;
+}
+/**
+ * A rich, read-only description of the deployment's auth configuration for the
+ * studio's config panel and dynamic create-user form. Unlike
+ * {@link AuthCapabilities} (five booleans that gate panels), this exposes *what*
+ * is configured — enabled plugins, email/password + social sign-in, the
+ * user-settable fields, organization sub-features (teams / custom roles), and
+ * the session + rate-limit policy — without ever leaking a secret.
+ */
+interface AuthConfigInfo {
+  /** The same capability booleans {@link AuthAdmin.capabilities} returns, embedded so a single call drives the whole panel. */
+  capabilities: AuthCapabilities;
+  /** Whether email + password sign-in is enabled. */
+  emailAndPassword: boolean;
+  /** Organization plugin sub-features. */
+  organization: {
+    enabled: boolean;
+    /** Custom roles / dynamic access control (`organizationRole` table present). */
+    roles: boolean;
+    /** Teams (`team` table present). */
+    teams: boolean;
+  };
+  /** Enabled better-auth plugin ids, sorted. */
+  plugins: string[];
+  /** Rate-limit policy (window is in seconds). */
+  rateLimit: {
+    enabled: boolean;
+    max?: number;
+    window?: number;
+  };
+  /** Session policy (all durations in seconds). */
+  session: {
+    cookieCache?: boolean;
+    expiresIn?: number;
+    freshAge?: number;
+    updateAge?: number;
+  };
+  /** Configured social/OAuth provider ids, sorted. */
+  socialProviders: string[];
+  /** User-settable extra fields for the create-user form (plugin + app `additionalFields`). */
+  userFields: AuthUserFieldSpec[];
+}
+/** A scalar value usable in an adapter `where` clause / filter. */
+type WhereValue = boolean | number | string;
+/** Filtering / paging options for {@link AuthAdmin.listUsers}. */
+interface ListUsersOptions {
+  /** Column to filter on with `=` (defaults to `email` when `filterValue` is set). */
+  filterField?: string;
+  /** Exact-match filter value. */
+  filterValue?: WhereValue;
+  limit?: number;
+  offset?: number;
+  /** Substring search value (matched with `contains`). */
+  search?: string;
+  /** Column the `search` substring matches against (default `email`). */
+  searchField?: string;
+  /** Column to order by (default `createdAt`). */
+  sortBy?: string;
+  sortDirection?: "asc" | "desc";
+}
+/** The result of {@link AuthAdmin.impersonateUser}: a fresh session token to act as the target user. */
+interface ImpersonationResult {
+  expiresAt: AuthTimestamp;
+  /** Bearer session token for the impersonated user. The caller is responsible for using it (e.g. setting the cookie). */
+  token: string;
+  user: AuthAdminUser;
+}
+/**
+ * The full read + write surface the studio's auth dashboard drives, backed by
+ * better-auth's tables. Returned by {@link createAuthAdmin}. The runtime accepts
+ * a structurally-compatible object as its `authAdmin` option and exposes each
+ * method behind an admin-token-gated endpoint. Methods whose backing plugin is
+ * absent still exist (they're not conditionally omitted) but the studio gates
+ * them on {@link AuthAdmin.capabilities}; calling one for an unconfigured plugin
+ * surfaces the underlying adapter error.
+ */
+interface AuthAdmin {
+  /** Directly add an existing user as an org member (server-side, no invitation/acceptance). */
+  addMember: (input: {
+    organizationId: string;
+    role?: string;
+    userId: string;
+  }) => Promise<AuthMember>;
+  /** Add a user to a team. */
+  addTeamMember: (input: {
+    teamId: string;
+    userId: string;
+  }) => Promise<AuthTeamMember>;
+  banUser: (input: {
+    expiresInSeconds?: number;
+    reason?: string;
+    userId: string;
+  }) => Promise<AuthAdminUser>;
+  cancelInvitation: (input: {
+    invitationId: string;
+  }) => Promise<void>;
+  capabilities: () => Promise<AuthCapabilities>;
+  /** Rich, read-only description of the auth configuration (plugins, fields, session policy, …). */
+  config: () => Promise<AuthConfigInfo>;
+  /** Create an organization; optionally seed an `owner` member for `ownerId`. */
+  createOrganization: (input: {
+    logo?: string;
+    metadata?: Record<string, unknown>;
+    name: string;
+    ownerId?: string;
+    slug?: string;
+  }) => Promise<AuthOrganization>;
+  /** Create a custom org role with a permission grant (a `resource → actions[]` map). */
+  createOrgRole: (input: {
+    organizationId: string;
+    permission: Record<string, string[]>;
+    role: string;
+  }) => Promise<AuthOrgRole>;
+  /**
+   * Invite an address to sign up, or refresh an existing invitation for it.
+   * Needs the `inviteOnly` plugin — without it the row is written to a table
+   * nothing reads, which is why the studio gates the panel on
+   * {@link AuthCapabilities.inviteOnly}.
+   */
+  createSignUpInvitation: (input: {
+    email: string;
+    expiresInSeconds?: number;
+    invitedBy?: string;
+  }) => Promise<AuthSignUpInvitation>;
+  /** Create a team under an organization. */
+  createTeam: (input: {
+    name: string;
+    organizationId: string;
+  }) => Promise<AuthTeam>;
+  createUser: (input: {
+    data?: Record<string, unknown>;
+    email: string;
+    name: string;
+    password?: string;
+    role?: string | string[];
+  }) => Promise<AuthAdminUser>;
+  /** Delete an organization and cascade-delete its members, invitations, teams, and custom roles. */
+  deleteOrganization: (input: {
+    organizationId: string;
+  }) => Promise<void>;
+  /** Delete a custom org role. */
+  deleteOrgRole: (input: {
+    roleId: string;
+  }) => Promise<void>;
+  deletePasskey: (input: {
+    passkeyId: string;
+  }) => Promise<void>;
+  disableTwoFactor: (input: {
+    userId: string;
+  }) => Promise<void>;
+  impersonateUser: (input: {
+    userId: string;
+  }) => Promise<ImpersonationResult>;
+  /** Create a pending email invitation to an org (no acceptance side effects). */
+  inviteMember: (input: {
+    email: string;
+    inviterId?: string;
+    organizationId: string;
+    role?: string;
+  }) => Promise<AuthInvitation>;
+  listAccounts: (input: {
+    userId: string;
+  }) => Promise<AuthAccount[]>;
+  listInvitations: (options: {
+    limit?: number;
+    offset?: number;
+    organizationId: string;
+  }) => Promise<AuthPage<AuthInvitation>>;
+  listMembers: (options: {
+    limit?: number;
+    offset?: number;
+    organizationId: string;
+  }) => Promise<AuthPage<AuthMember>>;
+  listOrganizations: (options: {
+    limit?: number;
+    offset?: number;
+  }) => Promise<AuthPage<AuthOrganization>>;
+  /** List an org's custom roles. */
+  listOrgRoles: (options: {
+    limit?: number;
+    offset?: number;
+    organizationId: string;
+  }) => Promise<AuthPage<AuthOrgRole>>;
+  listPasskeys: (input: {
+    userId: string;
+  }) => Promise<AuthPasskey[]>;
+  listSessions: (options: {
+    limit?: number;
+    offset?: number;
+    userId?: string;
+  }) => Promise<AuthPage<AuthAdminSession>>;
+  /**
+   * Sign-up invitations, newest first. Unfiltered on purpose: "pending" is
+   * `acceptedAt === null && expiresAt > now`, and applying that after a page
+   * would let page 1 come back empty while pending rows sat on page 2. The
+   * caller has both columns and can label each row itself.
+   */
+  listSignUpInvitations: (options: {
+    limit?: number;
+    offset?: number;
+  }) => Promise<AuthPage<AuthSignUpInvitation>>;
+  /** List a team's members. */
+  listTeamMembers: (options: {
+    limit?: number;
+    offset?: number;
+    teamId: string;
+  }) => Promise<AuthPage<AuthTeamMember>>;
+  /** List an org's teams. */
+  listTeams: (options: {
+    limit?: number;
+    offset?: number;
+    organizationId: string;
+  }) => Promise<AuthPage<AuthTeam>>;
+  listUsers: (options: ListUsersOptions) => Promise<AuthPage<AuthAdminUser>>;
+  removeMember: (input: {
+    memberId: string;
+  }) => Promise<void>;
+  /** Delete a team and its memberships. */
+  removeTeam: (input: {
+    teamId: string;
+  }) => Promise<void>;
+  /** Remove a member from a team. */
+  removeTeamMember: (input: {
+    teamMemberId: string;
+  }) => Promise<void>;
+  removeUser: (input: {
+    userId: string;
+  }) => Promise<void>;
+  /** Withdraw a sign-up invitation. Not retroactive — an account already created keeps existing; use {@link AuthAdmin.removeUser} for that. */
+  revokeSignUpInvitation: (input: {
+    email: string;
+  }) => Promise<void>;
+  revokeUserSession: (input: {
+    sessionId: string;
+  }) => Promise<void>;
+  revokeUserSessions: (input: {
+    userId: string;
+  }) => Promise<void>;
+  setRole: (input: {
+    role: string | string[];
+    userId: string;
+  }) => Promise<AuthAdminUser>;
+  setUserPassword: (input: {
+    newPassword: string;
+    userId: string;
+  }) => Promise<void>;
+  unbanUser: (input: {
+    userId: string;
+  }) => Promise<AuthAdminUser>;
+  unlinkAccount: (input: {
+    accountId: string;
+    userId: string;
+  }) => Promise<void>;
+  /** Change a member's role. */
+  updateMemberRole: (input: {
+    memberId: string;
+    role: string | string[];
+  }) => Promise<AuthMember>;
+  /** Update an organization's name/slug/logo/metadata. */
+  updateOrganization: (input: {
+    logo?: string;
+    metadata?: Record<string, unknown>;
+    name?: string;
+    organizationId: string;
+    slug?: string;
+  }) => Promise<AuthOrganization>;
+  /** Replace a custom org role's permission grant. */
+  updateOrgRole: (input: {
+    permission: Record<string, string[]>;
+    roleId: string;
+  }) => Promise<AuthOrgRole>;
+  /** Rename a team. */
+  updateTeam: (input: {
+    name: string;
+    teamId: string;
+  }) => Promise<AuthTeam>;
+  updateUser: (input: {
+    data: Record<string, unknown>;
+    userId: string;
+  }) => Promise<AuthAdminUser>;
+}
+/** Options for {@link createAuthAdmin}. */
+interface CreateAuthAdminOptions {
+  /**
+   * Force individual {@link AuthCapabilities} on or off regardless of which
+   * plugins are detected — e.g. `{ impersonate: false }`-style opt-outs by
+   * setting `admin: false`, or hiding linked accounts with `accounts: false`.
+   * A capability is reported only when both its plugin is enabled *and* its
+   * override isn't `false`.
+   */
+  features?: Partial<AuthCapabilities>;
+  /**
+   * User id recorded as the impersonator on sessions minted by
+   * {@link AuthAdmin.impersonateUser}. Defaults to the impersonated user's own
+   * id (a self-reference) since the trusted admin plane has no acting user.
+   */
+  impersonatedBy?: string;
+  /**
+   * How long (in seconds) an impersonation session lives. Must be a positive
+   * finite integer. Capped at 24 × {@link DEFAULT_IMPERSONATION_SECONDS}
+   * (86 400 s / 24 h). Defaults to {@link DEFAULT_IMPERSONATION_SECONDS}
+   * (3 600 s / 1 h).
+   */
+  impersonationSeconds?: number;
+}
+/**
+ * A normalized failure from an admin operation. better-auth throws `APIError`s
+ * carrying a `body.code` (e.g. `USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL`); we
+ * surface that `code` so the runtime can map it onto an HTTP status and the
+ * studio can show a meaningful message instead of a generic 500.
+ */
+declare class LunoraAuthAdminError extends LunoraError {
+  constructor(message: string, code: string);
+}
+/**
+ * Build the studio's auth user-management plane on top of better-auth.
+ *
+ * Pass the result as the runtime's `authAdmin` option; the runtime exposes each
+ * method behind an admin-token-gated `/_lunora/admin/auth/*` endpoint. The set
+ * of usable surfaces is reported by {@link AuthAdmin.capabilities} — derived
+ * from the enabled better-auth plugins, so enabling `admin()`, `organization()`,
+ * `twoFactor()`, or the passkey plugin in the auth config is what lights up the
+ * matching dashboard panels.
+ *
+ * **Trust model — important.** These operations talk to better-auth's
+ * `internalAdapter` (and `adapter`/password hasher) **directly**, deliberately
+ * bypassing the plugins' own endpoints, which require the caller to hold an
+ * admin-role session. That session check is the wrong gate here: the runtime
+ * already authorizes every call with `LUNORA_ADMIN_TOKEN`, so this helper acts
+ * as a trusted server-side operator. It is therefore not an end-user-callable
+ * API — never expose it on a path that isn't admin-token gated.
+ *
+ * `auth.$context` is a promise (better-auth resolves the adapter, password
+ * config, etc. lazily); we memoize it so the first call pays the cost once.
+ */
+declare const createAuthAdmin: (auth: LunoraAuth, options?: CreateAuthAdminOptions) => AuthAdmin;
+/**
+ * The exact `.well-known` paths this auth configuration serves outside its base
+ * path: the protected-resource metadata for each MCP resource, and the
+ * authorization-server metadata for the issuer. Empty unless an
+ * `oauthProvider()` or `mcp()` plugin is configured.
+ * @throws LunoraError `AUTH_MCP_RESOURCE_AMBIGUOUS` — see {@link mcpResourceOf}.
+ */
+declare const authDiscoveryPaths: (options: LunoraAuthOptions) => ReadonlyArray<string>;
+/**
+ * Derive {@link authDiscoveryPaths} for an `.auth()` declaration, memoised on the
+ * declaration object. A generated worker builds its options again for every new
+ * `env` object, and calling `options(env)` each time would rebuild every plugin.
+ */
+declare const authDiscoveryPathsFor: <Env>(declaration: {
+  options: (env: Env) => LunoraAuthOptions;
+}, env: Env) => ReadonlyArray<string>;
+/**
+ * Serve an OAuth discovery document from `auth` when `request` asks for one of the
+ * paths {@link authDiscoveryPaths} derives from its options; `undefined` for
+ * anything else, so the caller's own 404 stands. A 404 from better-auth itself is
+ * also passed over as `undefined`.
+ */
+declare const handleAuthDiscoveryRequest: (auth: LunoraAuth, request: Request) => Promise<Response | undefined>;
+/** What one table looked like after a copy call. */
+interface AuthMoveTableReport {
+  /** Rows that collided with a row the pinned object holds on its own, kept as they are (only under `force`). */
+  conflicts: number;
+  /** Rows this call inserted into the target. */
+  copied: number;
+  /** Rows this call deleted from the target because the source deleted them since they were copied. */
+  deleted: number;
+  /** Rows in the source object. */
+  sourceRows: number;
+  table: string;
+  /** Rows in the target object after this call. */
+  targetRows: number;
+  /** Rows this call read that the target already held exactly. */
+  unchanged: number;
+  /** Rows this call updated in the target because the source changed them since they were copied. */
+  updated: number;
+}
+/** The answer to one copy call. */
+interface AuthMoveResult {
+  /** `true` once every table is copied and matches the source's fingerprint; otherwise call again. */
+  done: boolean;
+  tables: AuthMoveTableReport[];
+}
+/** The worker-side move between the un-pinned and the pinned auth object. */
+interface AuthJurisdictionMove {
+  /**
+   * Copy every table from the un-pinned object into the pinned one. Refuses, unless
+   * `force` is set, a pinned object holding users the copy did not write, and a row
+   * that collides with one.
+   */
+  copy: (options?: {
+    force?: boolean;
+  }) => Promise<AuthMoveResult>;
+  /**
+   * Drop every table in the un-pinned object. Refused unless every table was copied
+   * and still matches what was copied.
+   */
+  purge: () => Promise<{
+    dropped: string[];
+  }>;
+}
+/**
+ * The claims both built-in wirings (D1 and the auth Durable Object) put on the
+ * Lunora identity, derived from one better-auth `getSession` result. Each optional
+ * claim is absent — never `undefined`, `null` or `""` — when the session does not
+ * carry it, so the identity header stays minimal and an absent claim reads as absent.
+ */
+type SessionIdentity = {
+  /** Profile claim `ctx.auth.getIdentity()` is documented to carry. */
+  email?: string;
+  /**
+   * The session's expiry (epoch ms). The runtime forwards it as the socket's
+   * credential expiry (`x-lunora-identity-exp`); without it a signed-out, banned or
+   * lapsed user keeps streaming RLS-scoped rows over an already-open WebSocket.
+   */
+  expiresAtMs?: number;
+  /** Profile claim `ctx.auth.getIdentity()` is documented to carry. */
+  name?: string;
+  /**
+   * The session's active organization (`organization()` plugin), present only
+   * while the user is still a member of it. Named `orgId` because that is the claim
+   * the `@lunora/jwt-auth` presets emit, so tenant-scoped code reads one name
+   * whichever authority issued the identity.
+   */
+  orgId?: string;
+  /**
+   * better-auth's `admin()` column, comma-joined for several roles — what
+   * `rls(policies, { roles })` and `auth.can(...)` read. Only an administrator can
+   * write it.
+   */
+  role?: string;
+  /**
+   * The session's active team (`organization({ teams: { enabled: true } })`),
+   * present only while it belongs to `orgId` and the user is still on it.
+   */
+  teamId?: string;
+  userId: string;
+};
+/**
+ * Resolve a request's session to the Lunora identity: `ctx.auth.userId` plus the
+ * claims `ctx.auth.getIdentity()` returns. Both built-in wirings (the D1 resolver
+ * codegen emits and the auth Durable Object) call this.
+ *
+ * `orgId` / `teamId` are checked against the store before they are emitted, because
+ * the session's `activeOrganizationId` / `activeTeamId` outlive the membership they
+ * stand for. better-auth (1.7.7) clears them only on the caller's own current
+ * session: a member removed by someone else, the other sessions of a member who
+ * left, every member of a deleted organization, and anyone removed through
+ * `createAuthAdmin` or SCIM (which write the tables directly, past any endpoint
+ * hook) keep them. `setActiveOrganization` never clears `activeTeamId` either, so a
+ * switch leaves the previous organization's team behind. Checking here covers every
+ * one of those paths; clearing sessions on removal would cover only the endpoints,
+ * and the session cookie cache would still serve the old value on top.
+ *
+ * The cost is one `member` read (plus `team` and `teamMember` when a team is active)
+ * per resolution of a session that has an active organization, and the worker
+ * memoises resolutions per credential, so the claim can lag a removal by up to that
+ * memo window. A read that throws propagates rather than emitting an unchecked claim.
+ * @param auth The better-auth instance.
+ * @param headers The request headers carrying the session.
+ * @returns The identity, or `null` for an anonymous request.
+ */
+declare const resolveSessionIdentity: (auth: LunoraAuth, headers: Headers) => Promise<SessionIdentity | null>;
+/** The slice of a Durable Object namespace this needs — structural, so tests need no runtime. */
+interface AuthNamespaceLike {
+  get(this: void, id: unknown): {
+    fetch: (request: Request) => Promise<Response>;
+  };
+  idFromName(this: void, name: string): unknown;
+  /** Jurisdiction-restricted subnamespace. Optional only so older binding types still fit; {@link createDoAuthWiring} fails closed without it when a jurisdiction is set. */
+  jurisdiction?(this: void, jurisdiction: AuthJurisdiction): AuthNamespaceLike;
+}
+/**
+ * Cloudflare Durable Object data-residency jurisdiction. Widening union —
+ * Cloudflare adds values over time.
+ */
+type AuthJurisdiction = "eu" | "fedramp" | "us";
+/** What {@link createDoAuthWiring} needs, already resolved against `env`. */
+interface DoAuthWiringOptions {
+  /**
+   * The OAuth discovery paths the object serves outside `/api/auth` —
+   * `authDiscoveryPaths(options)` over the same auth options the object builds.
+   * Derived in the worker so a probe of any other path never costs a round-trip
+   * to the object. Empty or absent: nothing is forwarded.
+   */
+  discoveryPaths?: ReadonlyArray<string>;
+  /**
+   * Shared secret presented on the object's internal session route. `undefined`
+   * means identity resolution fails closed — see {@link DoAuthWiring.resolveIdentity}.
+   */
+  internalSecret: string | undefined;
+  /**
+   * Pin the auth object to a data-residency jurisdiction — pass the worker's
+   * `jurisdiction`. The object holds users, sessions, and credentials, so it must
+   * live where the rest of the app's data does. The same name maps to a different
+   * object per jurisdiction, so toggling this on an existing deployment starts a
+   * fresh, empty auth object.
+   */
+  jurisdiction?: AuthJurisdiction;
+  /** The bound namespace, or `undefined` when the binding is absent from `env`. */
+  namespace: AuthNamespaceLike | undefined;
+  /**
+   * Name of the object instance holding the auth tables. Defaults to `"auth"`.
+   *
+   * One object owns the whole auth schema, so this exists to let an app pick the
+   * name (or run separate objects per deployment/tenant) rather than being pinned to
+   * a hardcoded one.
+   */
+  objectName?: string;
+}
+/** The worker options DO-backed auth replaces. */
+interface DoAuthWiring {
+  /**
+   * Reads the audit log out of the object, so the studio's audit feed works in DO
+   * mode. Answers an empty page rather than throwing when the object is unreachable
+   * or no secret is configured — an unavailable feed should read as empty, not 500
+   * the studio.
+   */
+  auditReader: AuthAuditReader;
+  /**
+   * Forwards `/api/auth/*` to the object; `undefined` for anything else.
+   *
+   * The base path is fixed. It was configurable on both halves of DO-backed auth
+   * and settable on neither: codegen's `AuthDeclaration` has no field for it, so
+   * the emitted `createDoAuthWiring(...)` never passed one and an `AuthDO`
+   * subclass that set its own served nothing.
+   */
+  authHandler: (request: Request) => Promise<Response | undefined>;
+  /**
+   * Forwards a `GET`/`HEAD` for one of {@link DoAuthWiringOptions.discoveryPaths}
+   * to the object; `undefined` for anything else, and for the object's 404. The
+   * worker calls it only after the app's own routes missed.
+   */
+  discoveryHandler: (request: Request) => Promise<Response | undefined>;
+  /**
+   * Copy the auth tables from the un-pinned object into the pinned one, and later
+   * purge the un-pinned copy. Present only when a `jurisdiction` is set. Backs the
+   * worker's `copyAuthToJurisdiction` and `purgeUnpinnedAuth` admin ops.
+   */
+  jurisdictionMove?: AuthJurisdictionMove;
+  /**
+   * Resolves a request's identity by asking the object. `null` when anonymous,
+   * unreachable, or ungated.
+   *
+   * The claims are the D1 wiring's ({@link SessionIdentity}); each is absent when
+   * the session does not carry it.
+   */
+  resolveIdentity: (request: Request) => Promise<SessionIdentity | null>;
+}
+/**
+ * Build the worker-side wiring for an auth Durable Object.
+ *
+ * Every failure path answers "not authenticated" rather than throwing: this runs on
+ * the request path for every request that touches `ctx.auth`, and a throw there would
+ * turn a misconfiguration into a 500 on traffic that has nothing to do with auth.
+ * The exception is a `jurisdiction` the namespace cannot express, which throws here.
+ * @param options The resolved namespace, secret, and names.
+ * @returns The `authHandler` / `resolveIdentity` pair.
+ */
+declare const createDoAuthWiring: (options: DoAuthWiringOptions) => DoAuthWiring;
+/**
+ * Default basePath used by better-auth's client + handler. Override via the
+ * second argument if you mount the auth routes somewhere else.
+ */
+declare const DEFAULT_AUTH_BASE_PATH: string;
+/**
+ * Route an inbound `Request` to better-auth if the path falls under
+ * `basePath`; otherwise return `undefined` so the caller can continue dispatching.
+ *
+ * Better-auth handles arbitrarily nested paths (`/api/auth/sign-in/email`,
+ * `/api/auth/callback/github`, …), so we use prefix matching instead of the
+ * exact-path map `createWorker` consumes for top-level routes.
+ */
+declare const handleAuthRequest: (auth: LunoraAuth, request: Request, basePath?: string) => Promise<Response | undefined>;
+export { AuthAccount as A, createAuthAdmin as B, CreateAuthAdminOptions as C, DEFAULT_AUTH_BASE_PATH as D, createDoAuthWiring as E, handleAuthDiscoveryRequest as F, handleAuthRequest as G, resolveSessionIdentity as H, ImpersonationResult as I, ListUsersOptions as L, SessionIdentity as S, AuthAdmin as a, AuthAdminSession as b, AuthAdminUser as c, AuthCapabilities as d, AuthConfigInfo as e, AuthInvitation as f, AuthJurisdiction as g, AuthJurisdictionMove as h, AuthMember as i, AuthMoveResult as j, AuthMoveTableReport as k, AuthNamespaceLike as l, AuthOrgRole as m, AuthOrganization as n, AuthPage as o, AuthPasskey as p, AuthSignUpInvitation as q, AuthTeam as r, AuthTeamMember as s, AuthTimestamp as t, AuthUserFieldSpec as u, DoAuthWiring as v, DoAuthWiringOptions as w, LunoraAuthAdminError as x, authDiscoveryPaths as y, authDiscoveryPathsFor as z };