@lunora/auth 1.0.0-alpha.32 → 1.0.0-alpha.34

package/dist/schema.d.mts

@@ -1,44 +1,44 @@
 import { TableDefinition } from '@lunora/server';
-import { a as LunoraAuthOptions } from "./packem_shared/create-auth.d-Mwhb4gSc.mjs";
+import { a as LunoraAuthOptions } from "./packem_shared/create-auth.d-COcIS_KU.mjs";
 import 'better-auth';
 /**
-* Derive Lunora table definitions from a better-auth config — the bridge that
-* makes the **full** better-auth plugin ecosystem first-class Lunora data.
-*
-* better-auth's own `getAuthTables(options)` already merges every configured
-* plugin's `schema` into one table map (core `user`/`session`/`account`/
-* `verification`, plus whatever the plugins on `options.plugins` add —
-* `organization`/`member`/`invitation`/`team`/`teamMember` from the
-* organization plugin, `role`/`banned`/… columns from admin, `passkey`,
-* `twoFactor`, `jwks`, …). This walks that map and emits an equivalent
-* `defineTable` for each, so adding a plugin to `options.plugins` automatically
-* surfaces its tables in the Lunora schema — no hand-written table definitions
-* to keep in sync.
-*
-* Spread the result into `defineSchema` alongside your app tables (the keys are
-* better-auth's real table names — `user`, `session`, … — left **unprefixed**
-* because better-auth's adapter addresses them by exactly those names). Because
-* the names are unprefixed, do **not** declare an app table that reuses one of
-* better-auth's reserved names in the same `defineSchema` — JS spread order
-* would let the later key win silently (unlike the plugin-extension path, which
-* throws on collision):
-*
-* ```ts
-* import { authTables } from "@lunora/auth";
-* const authOptions = { emailAndPassword: { enabled: true }, plugins: [organization(), admin()] };
-* export const schema = defineSchema({
-*     ...authTables(authOptions),
-*     todos: defineTable({ title: v.string() }),
-* });
-* ```
-*
-* Scope: this emits the table **shapes** (columns + types + nullability +
-* uniqueness + FK ids). It deliberately does not carry better-auth's
-* `defaultValue`/`onUpdate` (filled by better-auth's own write layer), `index`
-* hints, or `bigint` precision (`bigint` fields map to `v.number()`). Those only
-* matter once better-auth's writes are routed through Lunora's ORM — a separate
-* adapter follow-up; today the auth rows are still written by better-auth's D1
-* adapter and these tables make them typed + queryable via `ctx.db`.
-*/
+ * Derive Lunora table definitions from a better-auth config — the bridge that
+ * makes the **full** better-auth plugin ecosystem first-class Lunora data.
+ *
+ * better-auth's own `getAuthTables(options)` already merges every configured
+ * plugin's `schema` into one table map (core `user`/`session`/`account`/
+ * `verification`, plus whatever the plugins on `options.plugins` add —
+ * `organization`/`member`/`invitation`/`team`/`teamMember` from the
+ * organization plugin, `role`/`banned`/… columns from admin, `passkey`,
+ * `twoFactor`, `jwks`, …). This walks that map and emits an equivalent
+ * `defineTable` for each, so adding a plugin to `options.plugins` automatically
+ * surfaces its tables in the Lunora schema — no hand-written table definitions
+ * to keep in sync.
+ *
+ * Spread the result into `defineSchema` alongside your app tables (the keys are
+ * better-auth's real table names — `user`, `session`, … — left **unprefixed**
+ * because better-auth's adapter addresses them by exactly those names). Because
+ * the names are unprefixed, do **not** declare an app table that reuses one of
+ * better-auth's reserved names in the same `defineSchema` — JS spread order
+ * would let the later key win silently (unlike the plugin-extension path, which
+ * throws on collision):
+ *
+ * ```ts
+ * import { authTables } from "@lunora/auth";
+ * const authOptions = { emailAndPassword: { enabled: true }, plugins: [organization(), admin()] };
+ * export const schema = defineSchema({
+ *     ...authTables(authOptions),
+ *     todos: defineTable({ title: v.string() }),
+ * });
+ * ```
+ *
+ * Scope: this emits the table **shapes** (columns + types + nullability +
+ * uniqueness + FK ids). It deliberately does not carry better-auth's
+ * `defaultValue`/`onUpdate` (filled by better-auth's own write layer), `index`
+ * hints, or `bigint` precision (`bigint` fields map to `v.number()`). Those only
+ * matter once better-auth's writes are routed through Lunora's ORM — a separate
+ * adapter follow-up; today the auth rows are still written by better-auth's D1
+ * adapter and these tables make them typed + queryable via `ctx.db`.
+ */
 declare const authTables: (options: LunoraAuthOptions) => Record<string, TableDefinition>;
 export { authTables as default };

package/dist/schema.d.ts

@@ -1,44 +1,44 @@
 import { TableDefinition } from '@lunora/server';
-import { a as LunoraAuthOptions } from "./packem_shared/create-auth.d-Mwhb4gSc.js";
+import { a as LunoraAuthOptions } from "./packem_shared/create-auth.d-COcIS_KU.js";
 import 'better-auth';
 /**
-* Derive Lunora table definitions from a better-auth config — the bridge that
-* makes the **full** better-auth plugin ecosystem first-class Lunora data.
-*
-* better-auth's own `getAuthTables(options)` already merges every configured
-* plugin's `schema` into one table map (core `user`/`session`/`account`/
-* `verification`, plus whatever the plugins on `options.plugins` add —
-* `organization`/`member`/`invitation`/`team`/`teamMember` from the
-* organization plugin, `role`/`banned`/… columns from admin, `passkey`,
-* `twoFactor`, `jwks`, …). This walks that map and emits an equivalent
-* `defineTable` for each, so adding a plugin to `options.plugins` automatically
-* surfaces its tables in the Lunora schema — no hand-written table definitions
-* to keep in sync.
-*
-* Spread the result into `defineSchema` alongside your app tables (the keys are
-* better-auth's real table names — `user`, `session`, … — left **unprefixed**
-* because better-auth's adapter addresses them by exactly those names). Because
-* the names are unprefixed, do **not** declare an app table that reuses one of
-* better-auth's reserved names in the same `defineSchema` — JS spread order
-* would let the later key win silently (unlike the plugin-extension path, which
-* throws on collision):
-*
-* ```ts
-* import { authTables } from "@lunora/auth";
-* const authOptions = { emailAndPassword: { enabled: true }, plugins: [organization(), admin()] };
-* export const schema = defineSchema({
-*     ...authTables(authOptions),
-*     todos: defineTable({ title: v.string() }),
-* });
-* ```
-*
-* Scope: this emits the table **shapes** (columns + types + nullability +
-* uniqueness + FK ids). It deliberately does not carry better-auth's
-* `defaultValue`/`onUpdate` (filled by better-auth's own write layer), `index`
-* hints, or `bigint` precision (`bigint` fields map to `v.number()`). Those only
-* matter once better-auth's writes are routed through Lunora's ORM — a separate
-* adapter follow-up; today the auth rows are still written by better-auth's D1
-* adapter and these tables make them typed + queryable via `ctx.db`.
-*/
+ * Derive Lunora table definitions from a better-auth config — the bridge that
+ * makes the **full** better-auth plugin ecosystem first-class Lunora data.
+ *
+ * better-auth's own `getAuthTables(options)` already merges every configured
+ * plugin's `schema` into one table map (core `user`/`session`/`account`/
+ * `verification`, plus whatever the plugins on `options.plugins` add —
+ * `organization`/`member`/`invitation`/`team`/`teamMember` from the
+ * organization plugin, `role`/`banned`/… columns from admin, `passkey`,
+ * `twoFactor`, `jwks`, …). This walks that map and emits an equivalent
+ * `defineTable` for each, so adding a plugin to `options.plugins` automatically
+ * surfaces its tables in the Lunora schema — no hand-written table definitions
+ * to keep in sync.
+ *
+ * Spread the result into `defineSchema` alongside your app tables (the keys are
+ * better-auth's real table names — `user`, `session`, … — left **unprefixed**
+ * because better-auth's adapter addresses them by exactly those names). Because
+ * the names are unprefixed, do **not** declare an app table that reuses one of
+ * better-auth's reserved names in the same `defineSchema` — JS spread order
+ * would let the later key win silently (unlike the plugin-extension path, which
+ * throws on collision):
+ *
+ * ```ts
+ * import { authTables } from "@lunora/auth";
+ * const authOptions = { emailAndPassword: { enabled: true }, plugins: [organization(), admin()] };
+ * export const schema = defineSchema({
+ *     ...authTables(authOptions),
+ *     todos: defineTable({ title: v.string() }),
+ * });
+ * ```
+ *
+ * Scope: this emits the table **shapes** (columns + types + nullability +
+ * uniqueness + FK ids). It deliberately does not carry better-auth's
+ * `defaultValue`/`onUpdate` (filled by better-auth's own write layer), `index`
+ * hints, or `bigint` precision (`bigint` fields map to `v.number()`). Those only
+ * matter once better-auth's writes are routed through Lunora's ORM — a separate
+ * adapter follow-up; today the auth rows are still written by better-auth's D1
+ * adapter and these tables make them typed + queryable via `ctx.db`.
+ */
 declare const authTables: (options: LunoraAuthOptions) => Record<string, TableDefinition>;
 export { authTables as default };

package/dist/sql-store.d.mts

@@ -12,40 +12,40 @@ interface D1Like {
   };
 }
 /**
-* The minimal SQL seam a {@link createSqlAuthStore} runs on — structurally the
-* same `{ all, run }` contract as `@lunora/d1`'s `D1Exec`, so a Lunora D1 binding
-* satisfies it directly (see {@link d1Executor}) and a `node:sqlite` handle does
-* too in tests. `all` runs reads and returns rows; `run` runs writes.
-*/
+ * The minimal SQL seam a {@link createSqlAuthStore} runs on — structurally the
+ * same `{ all, run }` contract as `@lunora/d1`'s `D1Exec`, so a Lunora D1 binding
+ * satisfies it directly (see {@link d1Executor}) and a `node:sqlite` handle does
+ * too in tests. `all` runs reads and returns rows; `run` runs writes.
+ */
 interface SqlExecutor {
   all: (sql: string, parameters: ReadonlyArray<unknown>) => Promise<Record<string, unknown>[]>;
   run: (sql: string, parameters: ReadonlyArray<unknown>) => Promise<void>;
 }
 /**
-* An {@link AuthStore} backed by a SQL database through the {@link SqlExecutor}
-* seam — the production counterpart to `createMemoryAuthStore`. Point it at the
-* same database that hosts Lunora's global (D1) tables (the ones `authTables(...)`
-* generates) and better-auth's reads/writes land there as ordinary rows Lunora
-* can also query. Assumes the auth tables already exist (Lunora owns the schema /
-* migrations); it never issues DDL.
-*
-* ```ts
-* const store = createSqlAuthStore(d1Executor(env.DB));
-* const auth = createAuth({ secret: env.AUTH_SECRET, database: lunoraAuthAdapter(store) });
-* ```
-*
-* Clause semantics match `createMemoryAuthStore` (operator parity is
-* covered by a cross-store agreement test) with one unavoidable caveat:
-* case-**insensitive** matching uses SQLite's ASCII-only `LOWER()`, whereas the
-* in-memory store uses JS full-Unicode `toLowerCase()`. They agree on ASCII
-* (emails, ids, tokens — the credential path); they can differ only for
-* case-insensitive comparison of non-ASCII text.
-*/
+ * An {@link AuthStore} backed by a SQL database through the {@link SqlExecutor}
+ * seam — the production counterpart to `createMemoryAuthStore`. Point it at the
+ * same database that hosts Lunora's global (D1) tables (the ones `authTables(...)`
+ * generates) and better-auth's reads/writes land there as ordinary rows Lunora
+ * can also query. Assumes the auth tables already exist (Lunora owns the schema /
+ * migrations); it never issues DDL.
+ *
+ * ```ts
+ * const store = createSqlAuthStore(d1Executor(env.DB));
+ * const auth = createAuth({ secret: env.AUTH_SECRET, database: lunoraAuthAdapter(store) });
+ * ```
+ *
+ * Clause semantics match `createMemoryAuthStore` (operator parity is
+ * covered by a cross-store agreement test) with one unavoidable caveat:
+ * case-**insensitive** matching uses SQLite's ASCII-only `LOWER()`, whereas the
+ * in-memory store uses JS full-Unicode `toLowerCase()`. They agree on ASCII
+ * (emails, ids, tokens — the credential path); they can differ only for
+ * case-insensitive comparison of non-ASCII text.
+ */
 declare const createSqlAuthStore: (executor: SqlExecutor) => AuthStore;
 /**
-* Wrap a Cloudflare D1 binding (`env.DB`) as a {@link SqlExecutor}, so
-* `createSqlAuthStore(d1Executor(env.DB))` routes better-auth onto D1 — the same
-* binding Lunora's `.global()` tables use.
-*/
+ * Wrap a Cloudflare D1 binding (`env.DB`) as a {@link SqlExecutor}, so
+ * `createSqlAuthStore(d1Executor(env.DB))` routes better-auth onto D1 — the same
+ * binding Lunora's `.global()` tables use.
+ */
 declare const d1Executor: (database: D1Like) => SqlExecutor;
 export { SqlExecutor, createSqlAuthStore, d1Executor };

package/dist/sql-store.d.ts

@@ -12,40 +12,40 @@ interface D1Like {
   };
 }
 /**
-* The minimal SQL seam a {@link createSqlAuthStore} runs on — structurally the
-* same `{ all, run }` contract as `@lunora/d1`'s `D1Exec`, so a Lunora D1 binding
-* satisfies it directly (see {@link d1Executor}) and a `node:sqlite` handle does
-* too in tests. `all` runs reads and returns rows; `run` runs writes.
-*/
+ * The minimal SQL seam a {@link createSqlAuthStore} runs on — structurally the
+ * same `{ all, run }` contract as `@lunora/d1`'s `D1Exec`, so a Lunora D1 binding
+ * satisfies it directly (see {@link d1Executor}) and a `node:sqlite` handle does
+ * too in tests. `all` runs reads and returns rows; `run` runs writes.
+ */
 interface SqlExecutor {
   all: (sql: string, parameters: ReadonlyArray<unknown>) => Promise<Record<string, unknown>[]>;
   run: (sql: string, parameters: ReadonlyArray<unknown>) => Promise<void>;
 }
 /**
-* An {@link AuthStore} backed by a SQL database through the {@link SqlExecutor}
-* seam — the production counterpart to `createMemoryAuthStore`. Point it at the
-* same database that hosts Lunora's global (D1) tables (the ones `authTables(...)`
-* generates) and better-auth's reads/writes land there as ordinary rows Lunora
-* can also query. Assumes the auth tables already exist (Lunora owns the schema /
-* migrations); it never issues DDL.
-*
-* ```ts
-* const store = createSqlAuthStore(d1Executor(env.DB));
-* const auth = createAuth({ secret: env.AUTH_SECRET, database: lunoraAuthAdapter(store) });
-* ```
-*
-* Clause semantics match `createMemoryAuthStore` (operator parity is
-* covered by a cross-store agreement test) with one unavoidable caveat:
-* case-**insensitive** matching uses SQLite's ASCII-only `LOWER()`, whereas the
-* in-memory store uses JS full-Unicode `toLowerCase()`. They agree on ASCII
-* (emails, ids, tokens — the credential path); they can differ only for
-* case-insensitive comparison of non-ASCII text.
-*/
+ * An {@link AuthStore} backed by a SQL database through the {@link SqlExecutor}
+ * seam — the production counterpart to `createMemoryAuthStore`. Point it at the
+ * same database that hosts Lunora's global (D1) tables (the ones `authTables(...)`
+ * generates) and better-auth's reads/writes land there as ordinary rows Lunora
+ * can also query. Assumes the auth tables already exist (Lunora owns the schema /
+ * migrations); it never issues DDL.
+ *
+ * ```ts
+ * const store = createSqlAuthStore(d1Executor(env.DB));
+ * const auth = createAuth({ secret: env.AUTH_SECRET, database: lunoraAuthAdapter(store) });
+ * ```
+ *
+ * Clause semantics match `createMemoryAuthStore` (operator parity is
+ * covered by a cross-store agreement test) with one unavoidable caveat:
+ * case-**insensitive** matching uses SQLite's ASCII-only `LOWER()`, whereas the
+ * in-memory store uses JS full-Unicode `toLowerCase()`. They agree on ASCII
+ * (emails, ids, tokens — the credential path); they can differ only for
+ * case-insensitive comparison of non-ASCII text.
+ */
 declare const createSqlAuthStore: (executor: SqlExecutor) => AuthStore;
 /**
-* Wrap a Cloudflare D1 binding (`env.DB`) as a {@link SqlExecutor}, so
-* `createSqlAuthStore(d1Executor(env.DB))` routes better-auth onto D1 — the same
-* binding Lunora's `.global()` tables use.
-*/
+ * Wrap a Cloudflare D1 binding (`env.DB`) as a {@link SqlExecutor}, so
+ * `createSqlAuthStore(d1Executor(env.DB))` routes better-auth onto D1 — the same
+ * binding Lunora's `.global()` tables use.
+ */
 declare const d1Executor: (database: D1Like) => SqlExecutor;
 export { SqlExecutor, createSqlAuthStore, d1Executor };

package/dist/store.d.mts

@@ -2,10 +2,10 @@ import { CustomAdapter } from 'better-auth/adapters';
 /** A stored auth row — an opaque bag of columns keyed by better-auth field name. */
 type AuthRow = Record<string, unknown>;
 /**
-* One normalized better-auth where clause. Derived from {@link CustomAdapter}'s
-* own method signature (rather than re-declared) so a better-auth change to the
-* clause shape surfaces as a compile error here, not a silent mis-match.
-*/
+ * One normalized better-auth where clause. Derived from {@link CustomAdapter}'s
+ * own method signature (rather than re-declared) so a better-auth change to the
+ * clause shape surfaces as a compile error here, not a silent mis-match.
+ */
 type AuthWhereClause = NonNullable<Parameters<CustomAdapter["findOne"]>[0]["where"]>[number];
 /** Read query handed to {@link AuthStore.read}: a where filter plus optional sort/window. */
 interface AuthQuery {
@@ -18,48 +18,48 @@ interface AuthQuery {
   where: ReadonlyArray<AuthWhereClause>;
 }
 /**
-* The minimal table-addressed store the `lunoraAuthAdapter` drives. This is the
-* seam a Lunora runtime binds to its ORM: back each method with `ctx.db` over
-* the global (D1) auth tables that `authTables(...)` generates, and better-auth's
-* reads/writes flow through Lunora's data layer (triggers, aggregates, OCC)
-* instead of better-auth's own adapter. Field names and table (`model`) names are
-* already the database names better-auth resolved from the schema, so a store
-* passes them straight through.
-*
-* {@link createMemoryAuthStore} is a reference in-memory implementation (also
-* what the tests run better-auth against); `createSqlAuthStore` is the SQL one.
-*/
+ * The minimal table-addressed store the `lunoraAuthAdapter` drives. This is the
+ * seam a Lunora runtime binds to its ORM: back each method with `ctx.db` over
+ * the global (D1) auth tables that `authTables(...)` generates, and better-auth's
+ * reads/writes flow through Lunora's data layer (triggers, aggregates, OCC)
+ * instead of better-auth's own adapter. Field names and table (`model`) names are
+ * already the database names better-auth resolved from the schema, so a store
+ * passes them straight through.
+ *
+ * {@link createMemoryAuthStore} is a reference in-memory implementation (also
+ * what the tests run better-auth against); `createSqlAuthStore` is the SQL one.
+ */
 interface AuthStore {
   /**
-  * Atomically delete **at most one** row in `model` matching `where` and
-  * return it (or `undefined` if none matched). Backs better-auth's
-  * single-use-token consume (OTP / magic-link / email-verification /
-  * password-reset): implementing it natively — one round trip that finds and
-  * deletes in a single statement — closes the read-then-delete race the
-  * factory's `findMany` + `deleteMany` fallback would otherwise leave open.
-  */
+   * Atomically delete **at most one** row in `model` matching `where` and
+   * return it (or `undefined` if none matched). Backs better-auth's
+   * single-use-token consume (OTP / magic-link / email-verification /
+   * password-reset): implementing it natively — one round trip that finds and
+   * deletes in a single statement — closes the read-then-delete race the
+   * factory's `findMany` + `deleteMany` fallback would otherwise leave open.
+   */
   consumeOne: (model: string, where: ReadonlyArray<AuthWhereClause>) => Promise<AuthRow | undefined>;
   /** Count rows in `model` matching `where` (empty `where` = all rows). */
   count: (model: string, where: ReadonlyArray<AuthWhereClause>) => Promise<number>;
   /** Insert `data` into `model`; return the stored row (the adapter pre-fills `id`). */
   create: (model: string, data: AuthRow) => Promise<AuthRow>;
   /**
-  * Atomically apply signed numeric deltas to **at most one** row in `model`
-  * matching `where`, then return the updated row (or `undefined` if the guard
-  * matched none). For each `increment` entry it applies `field = field + delta`
-  * (a negative delta decrements); the optional `set` map assigns absolute
-  * values in the same step. The `where` clause is both selector **and** guard
-  * — comparison operators are honoured, so a guard like
-  * `{ field: "count", operator: "lt", value: max }` only mutates the row while
-  * it still satisfies the predicate.
-  *
-  * Backs better-auth's durable (`storage: "database"`) rate limiter, whose
-  * counter rides these tables. Implementing it natively — one statement that
-  * guards, increments, and returns — gives the **one-winner-across-isolates**
-  * guarantee the read-then-update fallback cannot: on Workers two concurrent
-  * requests would otherwise both read `count=4` and both write `5`, letting a
-  * `max` of 5 pass 6+. Same race-closing rationale as {@link AuthStore.consumeOne}.
-  */
+   * Atomically apply signed numeric deltas to **at most one** row in `model`
+   * matching `where`, then return the updated row (or `undefined` if the guard
+   * matched none). For each `increment` entry it applies `field = field + delta`
+   * (a negative delta decrements); the optional `set` map assigns absolute
+   * values in the same step. The `where` clause is both selector **and** guard
+   * — comparison operators are honoured, so a guard like
+   * `{ field: "count", operator: "lt", value: max }` only mutates the row while
+   * it still satisfies the predicate.
+   *
+   * Backs better-auth's durable (`storage: "database"`) rate limiter, whose
+   * counter rides these tables. Implementing it natively — one statement that
+   * guards, increments, and returns — gives the **one-winner-across-isolates**
+   * guarantee the read-then-update fallback cannot: on Workers two concurrent
+   * requests would otherwise both read `count=4` and both write `5`, letting a
+   * `max` of 5 pass 6+. Same race-closing rationale as {@link AuthStore.consumeOne}.
+   */
   incrementOne: (model: string, where: ReadonlyArray<AuthWhereClause>, increment: Record<string, number>, set?: AuthRow) => Promise<AuthRow | undefined>;
   /** Read rows from `model` honouring the filter/sort/window in `query`. */
   read: (model: string, query: AuthQuery) => Promise<AuthRow[]>;
@@ -69,16 +69,16 @@ interface AuthStore {
   update: (model: string, where: ReadonlyArray<AuthWhereClause>, values: AuthRow) => Promise<AuthRow[]>;
 }
 /**
-* Evaluate a better-auth where clause list against a row. Clauses fold
-* left-to-right by their `connector` (`AND` by default, `OR` when set) — the
-* same precedence better-auth's own adapters use. An empty list matches every
-* row. Exported so any in-memory-style {@link AuthStore} can reuse it.
-*/
+ * Evaluate a better-auth where clause list against a row. Clauses fold
+ * left-to-right by their `connector` (`AND` by default, `OR` when set) — the
+ * same precedence better-auth's own adapters use. An empty list matches every
+ * row. Exported so any in-memory-style {@link AuthStore} can reuse it.
+ */
 declare const matchesWhere: (row: AuthRow, where: ReadonlyArray<AuthWhereClause>) => boolean;
 /**
-* Reference in-memory {@link AuthStore} — used to run better-auth end to end in
-* tests, and a worked example of the contract a Lunora-`ctx.db`-backed store
-* fulfils. Not for production (state is per-instance and non-durable).
-*/
+ * Reference in-memory {@link AuthStore} — used to run better-auth end to end in
+ * tests, and a worked example of the contract a Lunora-`ctx.db`-backed store
+ * fulfils. Not for production (state is per-instance and non-durable).
+ */
 declare const createMemoryAuthStore: () => AuthStore;
 export { AuthQuery, type AuthRow, AuthStore, type AuthWhereClause, createMemoryAuthStore, matchesWhere };

package/dist/store.d.ts

@@ -2,10 +2,10 @@ import { CustomAdapter } from 'better-auth/adapters';
 /** A stored auth row — an opaque bag of columns keyed by better-auth field name. */
 type AuthRow = Record<string, unknown>;
 /**
-* One normalized better-auth where clause. Derived from {@link CustomAdapter}'s
-* own method signature (rather than re-declared) so a better-auth change to the
-* clause shape surfaces as a compile error here, not a silent mis-match.
-*/
+ * One normalized better-auth where clause. Derived from {@link CustomAdapter}'s
+ * own method signature (rather than re-declared) so a better-auth change to the
+ * clause shape surfaces as a compile error here, not a silent mis-match.
+ */
 type AuthWhereClause = NonNullable<Parameters<CustomAdapter["findOne"]>[0]["where"]>[number];
 /** Read query handed to {@link AuthStore.read}: a where filter plus optional sort/window. */
 interface AuthQuery {
@@ -18,48 +18,48 @@ interface AuthQuery {
   where: ReadonlyArray<AuthWhereClause>;
 }
 /**
-* The minimal table-addressed store the `lunoraAuthAdapter` drives. This is the
-* seam a Lunora runtime binds to its ORM: back each method with `ctx.db` over
-* the global (D1) auth tables that `authTables(...)` generates, and better-auth's
-* reads/writes flow through Lunora's data layer (triggers, aggregates, OCC)
-* instead of better-auth's own adapter. Field names and table (`model`) names are
-* already the database names better-auth resolved from the schema, so a store
-* passes them straight through.
-*
-* {@link createMemoryAuthStore} is a reference in-memory implementation (also
-* what the tests run better-auth against); `createSqlAuthStore` is the SQL one.
-*/
+ * The minimal table-addressed store the `lunoraAuthAdapter` drives. This is the
+ * seam a Lunora runtime binds to its ORM: back each method with `ctx.db` over
+ * the global (D1) auth tables that `authTables(...)` generates, and better-auth's
+ * reads/writes flow through Lunora's data layer (triggers, aggregates, OCC)
+ * instead of better-auth's own adapter. Field names and table (`model`) names are
+ * already the database names better-auth resolved from the schema, so a store
+ * passes them straight through.
+ *
+ * {@link createMemoryAuthStore} is a reference in-memory implementation (also
+ * what the tests run better-auth against); `createSqlAuthStore` is the SQL one.
+ */
 interface AuthStore {
   /**
-  * Atomically delete **at most one** row in `model` matching `where` and
-  * return it (or `undefined` if none matched). Backs better-auth's
-  * single-use-token consume (OTP / magic-link / email-verification /
-  * password-reset): implementing it natively — one round trip that finds and
-  * deletes in a single statement — closes the read-then-delete race the
-  * factory's `findMany` + `deleteMany` fallback would otherwise leave open.
-  */
+   * Atomically delete **at most one** row in `model` matching `where` and
+   * return it (or `undefined` if none matched). Backs better-auth's
+   * single-use-token consume (OTP / magic-link / email-verification /
+   * password-reset): implementing it natively — one round trip that finds and
+   * deletes in a single statement — closes the read-then-delete race the
+   * factory's `findMany` + `deleteMany` fallback would otherwise leave open.
+   */
   consumeOne: (model: string, where: ReadonlyArray<AuthWhereClause>) => Promise<AuthRow | undefined>;
   /** Count rows in `model` matching `where` (empty `where` = all rows). */
   count: (model: string, where: ReadonlyArray<AuthWhereClause>) => Promise<number>;
   /** Insert `data` into `model`; return the stored row (the adapter pre-fills `id`). */
   create: (model: string, data: AuthRow) => Promise<AuthRow>;
   /**
-  * Atomically apply signed numeric deltas to **at most one** row in `model`
-  * matching `where`, then return the updated row (or `undefined` if the guard
-  * matched none). For each `increment` entry it applies `field = field + delta`
-  * (a negative delta decrements); the optional `set` map assigns absolute
-  * values in the same step. The `where` clause is both selector **and** guard
-  * — comparison operators are honoured, so a guard like
-  * `{ field: "count", operator: "lt", value: max }` only mutates the row while
-  * it still satisfies the predicate.
-  *
-  * Backs better-auth's durable (`storage: "database"`) rate limiter, whose
-  * counter rides these tables. Implementing it natively — one statement that
-  * guards, increments, and returns — gives the **one-winner-across-isolates**
-  * guarantee the read-then-update fallback cannot: on Workers two concurrent
-  * requests would otherwise both read `count=4` and both write `5`, letting a
-  * `max` of 5 pass 6+. Same race-closing rationale as {@link AuthStore.consumeOne}.
-  */
+   * Atomically apply signed numeric deltas to **at most one** row in `model`
+   * matching `where`, then return the updated row (or `undefined` if the guard
+   * matched none). For each `increment` entry it applies `field = field + delta`
+   * (a negative delta decrements); the optional `set` map assigns absolute
+   * values in the same step. The `where` clause is both selector **and** guard
+   * — comparison operators are honoured, so a guard like
+   * `{ field: "count", operator: "lt", value: max }` only mutates the row while
+   * it still satisfies the predicate.
+   *
+   * Backs better-auth's durable (`storage: "database"`) rate limiter, whose
+   * counter rides these tables. Implementing it natively — one statement that
+   * guards, increments, and returns — gives the **one-winner-across-isolates**
+   * guarantee the read-then-update fallback cannot: on Workers two concurrent
+   * requests would otherwise both read `count=4` and both write `5`, letting a
+   * `max` of 5 pass 6+. Same race-closing rationale as {@link AuthStore.consumeOne}.
+   */
   incrementOne: (model: string, where: ReadonlyArray<AuthWhereClause>, increment: Record<string, number>, set?: AuthRow) => Promise<AuthRow | undefined>;
   /** Read rows from `model` honouring the filter/sort/window in `query`. */
   read: (model: string, query: AuthQuery) => Promise<AuthRow[]>;
@@ -69,16 +69,16 @@ interface AuthStore {
   update: (model: string, where: ReadonlyArray<AuthWhereClause>, values: AuthRow) => Promise<AuthRow[]>;
 }
 /**
-* Evaluate a better-auth where clause list against a row. Clauses fold
-* left-to-right by their `connector` (`AND` by default, `OR` when set) — the
-* same precedence better-auth's own adapters use. An empty list matches every
-* row. Exported so any in-memory-style {@link AuthStore} can reuse it.
-*/
+ * Evaluate a better-auth where clause list against a row. Clauses fold
+ * left-to-right by their `connector` (`AND` by default, `OR` when set) — the
+ * same precedence better-auth's own adapters use. An empty list matches every
+ * row. Exported so any in-memory-style {@link AuthStore} can reuse it.
+ */
 declare const matchesWhere: (row: AuthRow, where: ReadonlyArray<AuthWhereClause>) => boolean;
 /**
-* Reference in-memory {@link AuthStore} — used to run better-auth end to end in
-* tests, and a worked example of the contract a Lunora-`ctx.db`-backed store
-* fulfils. Not for production (state is per-instance and non-durable).
-*/
+ * Reference in-memory {@link AuthStore} — used to run better-auth end to end in
+ * tests, and a worked example of the contract a Lunora-`ctx.db`-backed store
+ * fulfils. Not for production (state is per-instance and non-durable).
+ */
 declare const createMemoryAuthStore: () => AuthStore;
 export { AuthQuery, type AuthRow, AuthStore, type AuthWhereClause, createMemoryAuthStore, matchesWhere };