@lunora/auth 1.0.0-alpha.4 → 1.0.0-alpha.40

package/dist/packem_shared/create-auth.d-De6IOirt.d.ts

@@ -0,0 +1,128 @@
+import { betterAuth, BetterAuthOptions } from 'better-auth';
+/**
+ * Lunora's options pass straight through to better-auth — the only thing we add
+ * is requiring `secret` up front so a misconfigured deployment fails loudly
+ * instead of at the first sign-in.
+ *
+ * For `database`, prefer `lunoraD1Adapter` (`database: lunoraD1Adapter(env.DB)`)
+ * over passing the raw `env.DB`. better-auth *does* accept a D1Database directly,
+ * but it then resolves its Kysely adapter via a runtime `await import(...)` inside
+ * `auth.$context` — and that import never settles under `@cloudflare/vite-plugin`'s
+ * worker runner, hanging every auth request in `pnpm dev`. The explicit adapter
+ * skips it, so dev and prod behave the same. (Raw `env.DB` is still correct for
+ * the migration-only instance — see `lunoraD1Adapter`'s note.)
+ *
+ * Session rotation / richer session policies are configured via the `session`
+ * field (a `SessionPolicy`); Lunora validates it for obviously-broken
+ * durations and forwards it verbatim to better-auth. See `sessionPresets`
+ * for ready-made rotation/expiry trade-offs.
+ *
+ * ## Serverless background tasks (Cloudflare Workers)
+ *
+ * better-auth runs some work *after* sending the response — most importantly the
+ * password-reset email, whose background send is what keeps reset responses
+ * constant-time (a timing-attack defence: the response doesn't reveal whether
+ * the account exists). On Cloudflare Workers a promise that isn't handed to
+ * `ctx.waitUntil` can be cancelled the moment the response returns, dropping
+ * that send and weakening the guarantee. Wire your request's `ctx.waitUntil`
+ * into better-auth's background handler so the work survives:
+ *
+ * ```ts
+ * // in your worker fetch handler, where `ctx: ExecutionContext` is in scope
+ * const auth = createAuth({
+ *     secret: env.AUTH_SECRET,
+ *     database: lunoraD1Adapter(env.DB),
+ *     advanced: {
+ *         backgroundTasks: { handler: (promise) => ctx.waitUntil(promise) },
+ *     },
+ * });
+ * ```
+ *
+ * (Lunora can't set this for you — `ctx.waitUntil` is per-request, but
+ * `createAuth` runs once at worker setup.)
+ */
+type LunoraAuthOptions = BetterAuthOptions;
+/**
+ * The full better-auth instance: `auth.handler` accepts a `Request` and
+ * returns a `Response` (used by `handleAuthRequest`); `auth.api`
+ * exposes the typed endpoint surface for server-side calls (e.g.
+ * `auth.api.getSession({ headers })` inside a query/mutation).
+ */
+type LunoraAuth = ReturnType<typeof betterAuth>;
+/**
+ * Resolve the caller's options into the exact shape `createAuth` hands to
+ * `betterAuth` — the hardened, default-filled options the running worker uses.
+ * Exported (and pure) so the migration path can compile the schema from the
+ * same resolved options: `compileMigrationsSql` routes through here, so the
+ * `rateLimit` table the worker's durable limiter writes to is included in the
+ * migration rather than silently omitted (it would be, if migrations saw the
+ * raw options while the worker ran the resolved ones).
+ *
+ * ## What it fills (each gated independently on caller silence)
+ *
+ * Secure-by-default cookies + secret-strength warning via {@link hardenAuthOptions},
+ * applied first so all hardening composes onto one options object.
+ *
+ * Rate limiting is ON by default for `/api/auth/*`.
+ *
+ * better-auth's own default is `rateLimit.enabled ?? isProduction`, and its
+ * `isProduction` is `"production" === "production"` resolved at
+ * module-load time. On Cloudflare Workers that check is unreliable: the
+ * runtime has no Node `process.env` (absent entirely without
+ * `nodejs_compat`, and even with it `NODE_ENV` is rarely `"production"` at
+ * request time). So better-auth would silently leave auth endpoints
+ * _unthrottled_ on a real deployment — the surprise we refuse to ship.
+ *
+ * We therefore default `enabled: true` whenever the caller hasn't made an
+ * explicit choice. We only fill the `enabled` flag and otherwise forward
+ * the caller's `rateLimit` verbatim, so better-auth's `window` (10s) / `max`
+ * (100) defaults and any custom rules still apply. Callers who genuinely
+ * want it off can pass `rateLimit: { enabled: false }` (e.g. when fronting
+ * auth with their own limiter), and any explicit `enabled` value wins.
+ *
+ * We also default `storage: "database"` — but only when rate limiting is not
+ * explicitly disabled (`enabled !== false`). Filling storage under a disabled
+ * limiter is harmless at runtime but makes `getAuthTables` emit an unused
+ * `rateLimit` table, so we skip it there.
+ *
+ * better-auth's own default is `storage: "memory"` — a per-isolate,
+ * non-durable counter. On Cloudflare Workers that means each isolate keeps
+ * its own tally, counters vanish on isolate recycle, and traffic spread
+ * across isolates never sums to the configured `max` — a limiter that
+ * reports "enabled" while never enforcing a global limit (the exact
+ * brute-force / credential-stuffing protection on `/sign-in`, OTP, and
+ * password-reset it is meant to buy). `storage: "database"` rides the counter
+ * through the configured `database` adapter — Lunora's store over the D1 auth
+ * tables — so the limit is durable *and* atomic (the store's native
+ * `incrementOne` gives a one-winner guarantee across isolates). Callers with
+ * their own durable store can pass an explicit `rateLimit: { storage: … }`
+ * (or `customStorage`), and any explicit value wins.
+ *
+ * Session cookie cache is ON by default too.
+ *
+ * Every authenticated call resolves identity through better-auth's
+ * `getSession`, which — without a cache — is a DB (D1) read on the hot path
+ * of every query/mutation/action that reads `ctx.auth` and of the WebSocket
+ * upgrade. better-auth's `session.cookieCache` carries the session payload in
+ * a short-lived signed cookie so `getSession` can answer without hitting the
+ * database until the cache window elapses. We default it on with a
+ * deliberately short 60s `maxAge` (better-auth's own default is 300s): long
+ * enough to erase the per-request read for a burst of calls, short enough
+ * that a revoked or role-changed session self-corrects within a minute.
+ * The one tradeoff — a revoked session stays valid until the cache expires —
+ * is bounded by that TTL; callers who need immediate revocation opt out with
+ * `session: { cookieCache: { enabled: false } }` (or the `strict` preset).
+ *
+ * Every explicit caller value is forwarded verbatim. The two `rateLimit` fills
+ * merge into a single `rateLimit` object so neither clobbers the other.
+ */
+declare const resolveAuthOptions: (options: LunoraAuthOptions) => LunoraAuthOptions;
+/**
+ * Create the auth instance. Thin wrapper around `betterAuth` that enforces
+ * the `secret` requirement at construction time so misconfigured deployments
+ * fail loudly at the first fetch rather than the first sign-in attempt, then
+ * hands {@link resolveAuthOptions}'s hardened, default-filled options to
+ * better-auth.
+ */
+declare const createAuth: (options: LunoraAuthOptions) => LunoraAuth;
+export { LunoraAuth as L, LunoraAuthOptions as a, createAuth as c, resolveAuthOptions as r };

package/dist/packem_shared/createAuth-DS6PL8Mb.mjs

@@ -0,0 +1 @@
+import{LunoraError as a}from"@lunora/errors";import{betterAuth as n}from"better-auth";import{validateSessionPolicy as c}from"./sessionPresets-DpEFjXKV.mjs";const i=32,l=e=>{const t=typeof e=="string"?e.trim().length:0;return t>0&&t<i},s=e=>typeof e=="string"?e.toLowerCase().startsWith("http://"):e&&typeof e=="object"?e.protocol==="http"?!0:e.protocol==="https"?!1:typeof e.fallback=="string"&&e.fallback.toLowerCase().startsWith("http://"):!1,u=e=>{if(l(e.secret)){const r=`@lunora/auth: AUTH_SECRET is only ${String(e.secret?.trim().length)} characters. Use at least ${String(i)} for a brute-force-resistant secret — generate one with \`openssl rand -hex 32\`.`;if(!s(e.baseURL))throw new a("INTERNAL",r);console.warn(r)}const t=e.advanced??{};return{...e,advanced:{...t,defaultCookieAttributes:t.defaultCookieAttributes??{httpOnly:!0,path:"/",sameSite:"lax"},...t.useSecureCookies===void 0?{useSecureCookies:!s(e.baseURL)}:{}}}},h=e=>{const t=u(e),r=t.rateLimit?.enabled===void 0,o=t.rateLimit?.storage===void 0&&t.rateLimit?.enabled!==!1;return{...t,...r||o?{rateLimit:{...t.rateLimit,...r?{enabled:!0}:{},...o?{storage:"database"}:{}}}:{},...t.session?.cookieCache===void 0?{session:{...t.session,cookieCache:{enabled:!0,maxAge:60}}}:{}}},m=e=>{if(!e.secret||e.secret.trim()==="")throw new a("INTERNAL",'@lunora/auth: `secret` is required. Set AUTH_SECRET locally in .dev.vars (`lunora env set AUTH_SECRET "$(openssl rand -hex 32)"`), and in production with `wrangler secret put AUTH_SECRET`.');return e.session&&c(e.session),n(h(e))};export{m as createAuth,h as resolveAuthOptions};

package/dist/packem_shared/emailGateDatabaseHooks-DzBD1Qoq.mjs

@@ -0,0 +1 @@
+import{LunoraError as i}from"@lunora/errors";import{APIError as u}from"better-auth/api";import{assertEmailAllowed as E}from"../email-guard.mjs";const m=a=>{switch(a){case 400:return"BAD_REQUEST";case 422:return"UNPROCESSABLE_ENTITY";case 429:return"TOO_MANY_REQUESTS";default:return"INTERNAL_SERVER_ERROR"}},n=a=>async(s,t)=>{const r=typeof s.email=="string"?s.email:void 0;if(r===void 0||r==="")return;let o;try{o=await E(r,a)}catch(e){throw e instanceof i?new u(m(e.status),{code:e.code,message:e.message}):e}a.onClassify?.(o,s,t)},b=(a={})=>({user:{create:{before:n(a)}}}),R=(a,s={})=>{const t=n(s),r=a.databaseHooks?.user?.create?.before,o=r?async(e,c)=>(await t(e,c),r(e,c)):t;return{...a,databaseHooks:{...a.databaseHooks,user:{...a.databaseHooks?.user,create:{...a.databaseHooks?.user?.create,before:o}}}}};export{b as emailGateDatabaseHooks,R as withEmailGate};

package/dist/packem_shared/sessionPresets-DpEFjXKV.mjs

@@ -0,0 +1 @@
+const r=s=>{const o=["expiresIn","updateAge","freshAge"];for(const n of o){const e=s[n];if(e!==void 0&&(typeof e!="number"||!Number.isFinite(e)||e<0))throw new TypeError(`@lunora/auth: \`session.${n}\` must be a non-negative, finite number of seconds`)}return s},i={longLived:{cookieCache:{enabled:!0,maxAge:60},expiresIn:2592e3,freshAge:86400,updateAge:86400},rolling:{cookieCache:{enabled:!0,maxAge:60},expiresIn:604800,freshAge:86400,updateAge:86400},strict:{cookieCache:{enabled:!1},expiresIn:3600,freshAge:300,updateAge:900}};export{i as sessionPresets,r as validateSessionPolicy};

package/dist/plugins-client.mjs

@@ -1,2 +1 @@
-export { passkeyClient } from '@better-auth/passkey/client';
-export { adminClient, anonymousClient, customSessionClient, deviceAuthorizationClient, emailOTPClient, genericOAuthClient, inferAdditionalFields, inferOrgAdditionalFields, jwtClient, lastLoginMethodClient, magicLinkClient, multiSessionClient, oidcClient, oneTimeTokenClient, organizationClient, phoneNumberClient, siweClient, twoFactorClient, usernameClient } from 'better-auth/client/plugins';
+import{passkeyClient as n}from"@better-auth/passkey/client";import{adminClient as l,anonymousClient as o,customSessionClient as C,deviceAuthorizationClient as a,emailOTPClient as r,genericOAuthClient as s,inferAdditionalFields as m,inferOrgAdditionalFields as d,jwtClient as u,lastLoginMethodClient as c,magicLinkClient as g,multiSessionClient as f,oidcClient as h,oneTimeTokenClient as p,organizationClient as A,phoneNumberClient as k,siweClient as w,twoFactorClient as F,usernameClient as O}from"better-auth/client/plugins";export{l as adminClient,o as anonymousClient,C as customSessionClient,a as deviceAuthorizationClient,r as emailOTPClient,s as genericOAuthClient,m as inferAdditionalFields,d as inferOrgAdditionalFields,u as jwtClient,c as lastLoginMethodClient,g as magicLinkClient,f as multiSessionClient,h as oidcClient,p as oneTimeTokenClient,A as organizationClient,n as passkeyClient,k as phoneNumberClient,w as siweClient,F as twoFactorClient,O as usernameClient};

package/dist/plugins.mjs

@@ -1,22 +1 @@
-export { passkey } from '@better-auth/passkey';
-export { captcha, mcp, withMcpAuth } from 'better-auth/plugins';
-export { createAccessControl } from 'better-auth/plugins/access';
-export { admin } from 'better-auth/plugins/admin';
-export { anonymous } from 'better-auth/plugins/anonymous';
-export { bearer } from 'better-auth/plugins/bearer';
-export { customSession } from 'better-auth/plugins/custom-session';
-export { deviceAuthorization } from 'better-auth/plugins/device-authorization';
-export { emailOTP } from 'better-auth/plugins/email-otp';
-export { genericOAuth } from 'better-auth/plugins/generic-oauth';
-export { haveIBeenPwned } from 'better-auth/plugins/haveibeenpwned';
-export { jwt } from 'better-auth/plugins/jwt';
-export { magicLink } from 'better-auth/plugins/magic-link';
-export { multiSession } from 'better-auth/plugins/multi-session';
-export { oAuthProxy } from 'better-auth/plugins/oauth-proxy';
-export { oidcProvider } from 'better-auth/plugins/oidc-provider';
-export { oneTimeToken } from 'better-auth/plugins/one-time-token';
-export { organization } from 'better-auth/plugins/organization';
-export { phoneNumber } from 'better-auth/plugins/phone-number';
-export { siwe } from 'better-auth/plugins/siwe';
-export { twoFactor } from 'better-auth/plugins/two-factor';
-export { username } from 'better-auth/plugins/username';
+import{passkey as e}from"@better-auth/passkey";import{captcha as m,mcp as p,withMcpAuth as x}from"better-auth/plugins";import{createAccessControl as i}from"better-auth/plugins/access";import{admin as a}from"better-auth/plugins/admin";import{anonymous as s}from"better-auth/plugins/anonymous";import{bearer as h}from"better-auth/plugins/bearer";import{customSession as w}from"better-auth/plugins/custom-session";import{deviceAuthorization as P}from"better-auth/plugins/device-authorization";import{emailOTP as k}from"better-auth/plugins/email-otp";import{genericOAuth as v}from"better-auth/plugins/generic-oauth";import{haveIBeenPwned as T}from"better-auth/plugins/haveibeenpwned";import{jwt as z}from"better-auth/plugins/jwt";import{magicLink as S}from"better-auth/plugins/magic-link";import{multiSession as B}from"better-auth/plugins/multi-session";import{oAuthProxy as F}from"better-auth/plugins/oauth-proxy";import{oidcProvider as L}from"better-auth/plugins/oidc-provider";import{oneTimeToken as N}from"better-auth/plugins/one-time-token";import{organization as D}from"better-auth/plugins/organization";import{phoneNumber as G}from"better-auth/plugins/phone-number";import{siwe as J}from"better-auth/plugins/siwe";import{twoFactor as Q}from"better-auth/plugins/two-factor";import{username as U}from"better-auth/plugins/username";export{a as admin,s as anonymous,h as bearer,m as captcha,i as createAccessControl,w as customSession,P as deviceAuthorization,k as emailOTP,v as genericOAuth,T as haveIBeenPwned,z as jwt,S as magicLink,p as mcp,B as multiSession,F as oAuthProxy,L as oidcProvider,N as oneTimeToken,D as organization,e as passkey,G as phoneNumber,J as siwe,Q as twoFactor,U as username,x as withMcpAuth};

package/dist/schema.d.mts

@@ -1,44 +1,44 @@
 import { TableDefinition } from '@lunora/server';
-import { a as LunoraAuthOptions } from "./packem_shared/create-auth.d-M36jwG_Y.mjs";
+import { a as LunoraAuthOptions } from "./packem_shared/create-auth.d-De6IOirt.mjs";
 import 'better-auth';
 /**
-* Derive Lunora table definitions from a better-auth config — the bridge that
-* makes the **full** better-auth plugin ecosystem first-class Lunora data.
-*
-* better-auth's own `getAuthTables(options)` already merges every configured
-* plugin's `schema` into one table map (core `user`/`session`/`account`/
-* `verification`, plus whatever the plugins on `options.plugins` add —
-* `organization`/`member`/`invitation`/`team`/`teamMember` from the
-* organization plugin, `role`/`banned`/… columns from admin, `passkey`,
-* `twoFactor`, `jwks`, …). This walks that map and emits an equivalent
-* `defineTable` for each, so adding a plugin to `options.plugins` automatically
-* surfaces its tables in the Lunora schema — no hand-written table definitions
-* to keep in sync.
-*
-* Spread the result into `defineSchema` alongside your app tables (the keys are
-* better-auth's real table names — `user`, `session`, … — left **unprefixed**
-* because better-auth's adapter addresses them by exactly those names). Because
-* the names are unprefixed, do **not** declare an app table that reuses one of
-* better-auth's reserved names in the same `defineSchema` — JS spread order
-* would let the later key win silently (unlike the plugin-extension path, which
-* throws on collision):
-*
-* ```ts
-* import { authTables } from "@lunora/auth";
-* const authOptions = { emailAndPassword: { enabled: true }, plugins: [organization(), admin()] };
-* export const schema = defineSchema({
-*     ...authTables(authOptions),
-*     todos: defineTable({ title: v.string() }),
-* });
-* ```
-*
-* Scope: this emits the table **shapes** (columns + types + nullability +
-* uniqueness + FK ids). It deliberately does not carry better-auth's
-* `defaultValue`/`onUpdate` (filled by better-auth's own write layer), `index`
-* hints, or `bigint` precision (`bigint` fields map to `v.number()`). Those only
-* matter once better-auth's writes are routed through Lunora's ORM — a separate
-* adapter follow-up; today the auth rows are still written by better-auth's D1
-* adapter and these tables make them typed + queryable via `ctx.db`.
-*/
+ * Derive Lunora table definitions from a better-auth config — the bridge that
+ * makes the **full** better-auth plugin ecosystem first-class Lunora data.
+ *
+ * better-auth's own `getAuthTables(options)` already merges every configured
+ * plugin's `schema` into one table map (core `user`/`session`/`account`/
+ * `verification`, plus whatever the plugins on `options.plugins` add —
+ * `organization`/`member`/`invitation`/`team`/`teamMember` from the
+ * organization plugin, `role`/`banned`/… columns from admin, `passkey`,
+ * `twoFactor`, `jwks`, …). This walks that map and emits an equivalent
+ * `defineTable` for each, so adding a plugin to `options.plugins` automatically
+ * surfaces its tables in the Lunora schema — no hand-written table definitions
+ * to keep in sync.
+ *
+ * Spread the result into `defineSchema` alongside your app tables (the keys are
+ * better-auth's real table names — `user`, `session`, … — left **unprefixed**
+ * because better-auth's adapter addresses them by exactly those names). Because
+ * the names are unprefixed, do **not** declare an app table that reuses one of
+ * better-auth's reserved names in the same `defineSchema` — JS spread order
+ * would let the later key win silently (unlike the plugin-extension path, which
+ * throws on collision):
+ *
+ * ```ts
+ * import { authTables } from "@lunora/auth";
+ * const authOptions = { emailAndPassword: { enabled: true }, plugins: [organization(), admin()] };
+ * export const schema = defineSchema({
+ *     ...authTables(authOptions),
+ *     todos: defineTable({ title: v.string() }),
+ * });
+ * ```
+ *
+ * Scope: this emits the table **shapes** (columns + types + nullability +
+ * uniqueness + FK ids). It deliberately does not carry better-auth's
+ * `defaultValue`/`onUpdate` (filled by better-auth's own write layer), `index`
+ * hints, or `bigint` precision (`bigint` fields map to `v.number()`). Those only
+ * matter once better-auth's writes are routed through Lunora's ORM — a separate
+ * adapter follow-up; today the auth rows are still written by better-auth's D1
+ * adapter and these tables make them typed + queryable via `ctx.db`.
+ */
 declare const authTables: (options: LunoraAuthOptions) => Record<string, TableDefinition>;
 export { authTables as default };

package/dist/schema.d.ts

@@ -1,44 +1,44 @@
 import { TableDefinition } from '@lunora/server';
-import { a as LunoraAuthOptions } from "./packem_shared/create-auth.d-M36jwG_Y.js";
+import { a as LunoraAuthOptions } from "./packem_shared/create-auth.d-De6IOirt.js";
 import 'better-auth';
 /**
-* Derive Lunora table definitions from a better-auth config — the bridge that
-* makes the **full** better-auth plugin ecosystem first-class Lunora data.
-*
-* better-auth's own `getAuthTables(options)` already merges every configured
-* plugin's `schema` into one table map (core `user`/`session`/`account`/
-* `verification`, plus whatever the plugins on `options.plugins` add —
-* `organization`/`member`/`invitation`/`team`/`teamMember` from the
-* organization plugin, `role`/`banned`/… columns from admin, `passkey`,
-* `twoFactor`, `jwks`, …). This walks that map and emits an equivalent
-* `defineTable` for each, so adding a plugin to `options.plugins` automatically
-* surfaces its tables in the Lunora schema — no hand-written table definitions
-* to keep in sync.
-*
-* Spread the result into `defineSchema` alongside your app tables (the keys are
-* better-auth's real table names — `user`, `session`, … — left **unprefixed**
-* because better-auth's adapter addresses them by exactly those names). Because
-* the names are unprefixed, do **not** declare an app table that reuses one of
-* better-auth's reserved names in the same `defineSchema` — JS spread order
-* would let the later key win silently (unlike the plugin-extension path, which
-* throws on collision):
-*
-* ```ts
-* import { authTables } from "@lunora/auth";
-* const authOptions = { emailAndPassword: { enabled: true }, plugins: [organization(), admin()] };
-* export const schema = defineSchema({
-*     ...authTables(authOptions),
-*     todos: defineTable({ title: v.string() }),
-* });
-* ```
-*
-* Scope: this emits the table **shapes** (columns + types + nullability +
-* uniqueness + FK ids). It deliberately does not carry better-auth's
-* `defaultValue`/`onUpdate` (filled by better-auth's own write layer), `index`
-* hints, or `bigint` precision (`bigint` fields map to `v.number()`). Those only
-* matter once better-auth's writes are routed through Lunora's ORM — a separate
-* adapter follow-up; today the auth rows are still written by better-auth's D1
-* adapter and these tables make them typed + queryable via `ctx.db`.
-*/
+ * Derive Lunora table definitions from a better-auth config — the bridge that
+ * makes the **full** better-auth plugin ecosystem first-class Lunora data.
+ *
+ * better-auth's own `getAuthTables(options)` already merges every configured
+ * plugin's `schema` into one table map (core `user`/`session`/`account`/
+ * `verification`, plus whatever the plugins on `options.plugins` add —
+ * `organization`/`member`/`invitation`/`team`/`teamMember` from the
+ * organization plugin, `role`/`banned`/… columns from admin, `passkey`,
+ * `twoFactor`, `jwks`, …). This walks that map and emits an equivalent
+ * `defineTable` for each, so adding a plugin to `options.plugins` automatically
+ * surfaces its tables in the Lunora schema — no hand-written table definitions
+ * to keep in sync.
+ *
+ * Spread the result into `defineSchema` alongside your app tables (the keys are
+ * better-auth's real table names — `user`, `session`, … — left **unprefixed**
+ * because better-auth's adapter addresses them by exactly those names). Because
+ * the names are unprefixed, do **not** declare an app table that reuses one of
+ * better-auth's reserved names in the same `defineSchema` — JS spread order
+ * would let the later key win silently (unlike the plugin-extension path, which
+ * throws on collision):
+ *
+ * ```ts
+ * import { authTables } from "@lunora/auth";
+ * const authOptions = { emailAndPassword: { enabled: true }, plugins: [organization(), admin()] };
+ * export const schema = defineSchema({
+ *     ...authTables(authOptions),
+ *     todos: defineTable({ title: v.string() }),
+ * });
+ * ```
+ *
+ * Scope: this emits the table **shapes** (columns + types + nullability +
+ * uniqueness + FK ids). It deliberately does not carry better-auth's
+ * `defaultValue`/`onUpdate` (filled by better-auth's own write layer), `index`
+ * hints, or `bigint` precision (`bigint` fields map to `v.number()`). Those only
+ * matter once better-auth's writes are routed through Lunora's ORM — a separate
+ * adapter follow-up; today the auth rows are still written by better-auth's D1
+ * adapter and these tables make them typed + queryable via `ctx.db`.
+ */
 declare const authTables: (options: LunoraAuthOptions) => Record<string, TableDefinition>;
 export { authTables as default };

package/dist/schema.mjs

@@ -1,62 +1 @@
-import { defineTable } from '@lunora/server';
-import { v } from '@lunora/values';
-import { getAuthTables } from 'better-auth/db';
-
-const baseValidator = (attribute) => {
-  if (attribute.references) {
-    return v.id(attribute.references.model);
-  }
-  const { type } = attribute;
-  if (Array.isArray(type)) {
-    return v.string();
-  }
-  switch (type) {
-    case "boolean": {
-      return v.boolean();
-    }
-    case "date": {
-      return v.date();
-    }
-    case "number": {
-      return v.number();
-    }
-    case "number[]": {
-      return v.array(v.number());
-    }
-    case "string": {
-      return v.string();
-    }
-    case "string[]": {
-      return v.array(v.string());
-    }
-    // "json" and anything unrecognised: keep the row shape permissive rather
-    // than fail schema generation on a plugin's exotic column type.
-    default: {
-      return v.any();
-    }
-  }
-};
-const fieldValidator = (attribute) => {
-  let validator = baseValidator(attribute);
-  if (attribute.required === false) {
-    validator = validator.nullable();
-  }
-  if (attribute.unique === true) {
-    validator = validator.unique();
-  }
-  return validator;
-};
-const authTables = (options) => {
-  const tables = getAuthTables(options);
-  const schema = {};
-  for (const table of Object.values(tables)) {
-    const shape = {};
-    for (const [fieldKey, attribute] of Object.entries(table.fields)) {
-      shape[attribute.fieldName ?? fieldKey] = fieldValidator(attribute);
-    }
-    schema[table.modelName] = defineTable(shape).externallyManaged();
-  }
-  return schema;
-};
-
-export { authTables as default };
+import{defineTable as i}from"@lunora/server";import{v as e}from"@lunora/values";import{getAuthTables as c}from"better-auth/db";const f=n=>{if(n.references)return e.id(n.references.model);const{type:r}=n;if(Array.isArray(r))return e.string();switch(r){case"boolean":return e.boolean();case"date":return e.date();case"number":return e.number();case"number[]":return e.array(e.number());case"string":return e.string();case"string[]":return e.array(e.string());default:return e.any()}},l=n=>{let r=f(n);return n.required===!1&&(r=r.nullable()),n.unique===!0&&(r=r.unique()),r},g=n=>{const r=c(n),t={};for(const a of Object.values(r)){const s={};for(const[o,u]of Object.entries(a.fields))s[u.fieldName??o]=l(u);t[a.modelName]=i(s).externallyManaged()}return t};export{g as default};

package/dist/sql-store.d.mts

@@ -12,40 +12,40 @@ interface D1Like {
   };
 }
 /**
-* The minimal SQL seam a {@link createSqlAuthStore} runs on — structurally the
-* same `{ all, run }` contract as `@lunora/d1`'s `D1Exec`, so a Lunora D1 binding
-* satisfies it directly (see {@link d1Executor}) and a `node:sqlite` handle does
-* too in tests. `all` runs reads and returns rows; `run` runs writes.
-*/
+ * The minimal SQL seam a {@link createSqlAuthStore} runs on — structurally the
+ * same `{ all, run }` contract as `@lunora/d1`'s `D1Exec`, so a Lunora D1 binding
+ * satisfies it directly (see {@link d1Executor}) and a `node:sqlite` handle does
+ * too in tests. `all` runs reads and returns rows; `run` runs writes.
+ */
 interface SqlExecutor {
   all: (sql: string, parameters: ReadonlyArray<unknown>) => Promise<Record<string, unknown>[]>;
   run: (sql: string, parameters: ReadonlyArray<unknown>) => Promise<void>;
 }
 /**
-* An {@link AuthStore} backed by a SQL database through the {@link SqlExecutor}
-* seam — the production counterpart to `createMemoryAuthStore`. Point it at the
-* same database that hosts Lunora's global (D1) tables (the ones `authTables(...)`
-* generates) and better-auth's reads/writes land there as ordinary rows Lunora
-* can also query. Assumes the auth tables already exist (Lunora owns the schema /
-* migrations); it never issues DDL.
-*
-* ```ts
-* const store = createSqlAuthStore(d1Executor(env.DB));
-* const auth = createAuth({ secret: env.AUTH_SECRET, database: lunoraAuthAdapter(store) });
-* ```
-*
-* Clause semantics match `createMemoryAuthStore` (operator parity is
-* covered by a cross-store agreement test) with one unavoidable caveat:
-* case-**insensitive** matching uses SQLite's ASCII-only `LOWER()`, whereas the
-* in-memory store uses JS full-Unicode `toLowerCase()`. They agree on ASCII
-* (emails, ids, tokens — the credential path); they can differ only for
-* case-insensitive comparison of non-ASCII text.
-*/
+ * An {@link AuthStore} backed by a SQL database through the {@link SqlExecutor}
+ * seam — the production counterpart to `createMemoryAuthStore`. Point it at the
+ * same database that hosts Lunora's global (D1) tables (the ones `authTables(...)`
+ * generates) and better-auth's reads/writes land there as ordinary rows Lunora
+ * can also query. Assumes the auth tables already exist (Lunora owns the schema /
+ * migrations); it never issues DDL.
+ *
+ * ```ts
+ * const store = createSqlAuthStore(d1Executor(env.DB));
+ * const auth = createAuth({ secret: env.AUTH_SECRET, database: lunoraAuthAdapter(store) });
+ * ```
+ *
+ * Clause semantics match `createMemoryAuthStore` (operator parity is
+ * covered by a cross-store agreement test) with one unavoidable caveat:
+ * case-**insensitive** matching uses SQLite's ASCII-only `LOWER()`, whereas the
+ * in-memory store uses JS full-Unicode `toLowerCase()`. They agree on ASCII
+ * (emails, ids, tokens — the credential path); they can differ only for
+ * case-insensitive comparison of non-ASCII text.
+ */
 declare const createSqlAuthStore: (executor: SqlExecutor) => AuthStore;
 /**
-* Wrap a Cloudflare D1 binding (`env.DB`) as a {@link SqlExecutor}, so
-* `createSqlAuthStore(d1Executor(env.DB))` routes better-auth onto D1 — the same
-* binding Lunora's `.global()` tables use.
-*/
+ * Wrap a Cloudflare D1 binding (`env.DB`) as a {@link SqlExecutor}, so
+ * `createSqlAuthStore(d1Executor(env.DB))` routes better-auth onto D1 — the same
+ * binding Lunora's `.global()` tables use.
+ */
 declare const d1Executor: (database: D1Like) => SqlExecutor;
 export { SqlExecutor, createSqlAuthStore, d1Executor };

package/dist/sql-store.d.ts

@@ -12,40 +12,40 @@ interface D1Like {
   };
 }
 /**
-* The minimal SQL seam a {@link createSqlAuthStore} runs on — structurally the
-* same `{ all, run }` contract as `@lunora/d1`'s `D1Exec`, so a Lunora D1 binding
-* satisfies it directly (see {@link d1Executor}) and a `node:sqlite` handle does
-* too in tests. `all` runs reads and returns rows; `run` runs writes.
-*/
+ * The minimal SQL seam a {@link createSqlAuthStore} runs on — structurally the
+ * same `{ all, run }` contract as `@lunora/d1`'s `D1Exec`, so a Lunora D1 binding
+ * satisfies it directly (see {@link d1Executor}) and a `node:sqlite` handle does
+ * too in tests. `all` runs reads and returns rows; `run` runs writes.
+ */
 interface SqlExecutor {
   all: (sql: string, parameters: ReadonlyArray<unknown>) => Promise<Record<string, unknown>[]>;
   run: (sql: string, parameters: ReadonlyArray<unknown>) => Promise<void>;
 }
 /**
-* An {@link AuthStore} backed by a SQL database through the {@link SqlExecutor}
-* seam — the production counterpart to `createMemoryAuthStore`. Point it at the
-* same database that hosts Lunora's global (D1) tables (the ones `authTables(...)`
-* generates) and better-auth's reads/writes land there as ordinary rows Lunora
-* can also query. Assumes the auth tables already exist (Lunora owns the schema /
-* migrations); it never issues DDL.
-*
-* ```ts
-* const store = createSqlAuthStore(d1Executor(env.DB));
-* const auth = createAuth({ secret: env.AUTH_SECRET, database: lunoraAuthAdapter(store) });
-* ```
-*
-* Clause semantics match `createMemoryAuthStore` (operator parity is
-* covered by a cross-store agreement test) with one unavoidable caveat:
-* case-**insensitive** matching uses SQLite's ASCII-only `LOWER()`, whereas the
-* in-memory store uses JS full-Unicode `toLowerCase()`. They agree on ASCII
-* (emails, ids, tokens — the credential path); they can differ only for
-* case-insensitive comparison of non-ASCII text.
-*/
+ * An {@link AuthStore} backed by a SQL database through the {@link SqlExecutor}
+ * seam — the production counterpart to `createMemoryAuthStore`. Point it at the
+ * same database that hosts Lunora's global (D1) tables (the ones `authTables(...)`
+ * generates) and better-auth's reads/writes land there as ordinary rows Lunora
+ * can also query. Assumes the auth tables already exist (Lunora owns the schema /
+ * migrations); it never issues DDL.
+ *
+ * ```ts
+ * const store = createSqlAuthStore(d1Executor(env.DB));
+ * const auth = createAuth({ secret: env.AUTH_SECRET, database: lunoraAuthAdapter(store) });
+ * ```
+ *
+ * Clause semantics match `createMemoryAuthStore` (operator parity is
+ * covered by a cross-store agreement test) with one unavoidable caveat:
+ * case-**insensitive** matching uses SQLite's ASCII-only `LOWER()`, whereas the
+ * in-memory store uses JS full-Unicode `toLowerCase()`. They agree on ASCII
+ * (emails, ids, tokens — the credential path); they can differ only for
+ * case-insensitive comparison of non-ASCII text.
+ */
 declare const createSqlAuthStore: (executor: SqlExecutor) => AuthStore;
 /**
-* Wrap a Cloudflare D1 binding (`env.DB`) as a {@link SqlExecutor}, so
-* `createSqlAuthStore(d1Executor(env.DB))` routes better-auth onto D1 — the same
-* binding Lunora's `.global()` tables use.
-*/
+ * Wrap a Cloudflare D1 binding (`env.DB`) as a {@link SqlExecutor}, so
+ * `createSqlAuthStore(d1Executor(env.DB))` routes better-auth onto D1 — the same
+ * binding Lunora's `.global()` tables use.
+ */
 declare const d1Executor: (database: D1Like) => SqlExecutor;
 export { SqlExecutor, createSqlAuthStore, d1Executor };