@lunora/auth 1.0.0-alpha.5 → 1.0.0-alpha.50

package/dist/plugins-enterprise.mjs

@@ -0,0 +1 @@
+import{sso as s}from"@better-auth/sso";export{s as sso};

package/dist/plugins.d.mts

@@ -1,5 +1,8 @@
+export { mcp, mcpHandler, requireMcpAuth } from '@better-auth/mcp';
+export { oauthProvider } from '@better-auth/oauth-provider';
 export { passkey } from '@better-auth/passkey';
-export { captcha, mcp, withMcpAuth } from 'better-auth/plugins';
+export { scim } from '@better-auth/scim';
+export { captcha } from 'better-auth/plugins';
 export { createAccessControl } from 'better-auth/plugins/access';
 export { admin } from 'better-auth/plugins/admin';
 export { anonymous } from 'better-auth/plugins/anonymous';
@@ -13,7 +16,6 @@ export { jwt } from 'better-auth/plugins/jwt';
 export { magicLink } from 'better-auth/plugins/magic-link';
 export { multiSession } from 'better-auth/plugins/multi-session';
 export { oAuthProxy } from 'better-auth/plugins/oauth-proxy';
-export { oidcProvider } from 'better-auth/plugins/oidc-provider';
 export { oneTimeToken } from 'better-auth/plugins/one-time-token';
 export { organization } from 'better-auth/plugins/organization';
 export { phoneNumber } from 'better-auth/plugins/phone-number';

package/dist/plugins.d.ts

@@ -1,5 +1,8 @@
+export { mcp, mcpHandler, requireMcpAuth } from '@better-auth/mcp';
+export { oauthProvider } from '@better-auth/oauth-provider';
 export { passkey } from '@better-auth/passkey';
-export { captcha, mcp, withMcpAuth } from 'better-auth/plugins';
+export { scim } from '@better-auth/scim';
+export { captcha } from 'better-auth/plugins';
 export { createAccessControl } from 'better-auth/plugins/access';
 export { admin } from 'better-auth/plugins/admin';
 export { anonymous } from 'better-auth/plugins/anonymous';
@@ -13,7 +16,6 @@ export { jwt } from 'better-auth/plugins/jwt';
 export { magicLink } from 'better-auth/plugins/magic-link';
 export { multiSession } from 'better-auth/plugins/multi-session';
 export { oAuthProxy } from 'better-auth/plugins/oauth-proxy';
-export { oidcProvider } from 'better-auth/plugins/oidc-provider';
 export { oneTimeToken } from 'better-auth/plugins/one-time-token';
 export { organization } from 'better-auth/plugins/organization';
 export { phoneNumber } from 'better-auth/plugins/phone-number';

package/dist/plugins.mjs

@@ -1,22 +1 @@
-export { passkey } from '@better-auth/passkey';
-export { captcha, mcp, withMcpAuth } from 'better-auth/plugins';
-export { createAccessControl } from 'better-auth/plugins/access';
-export { admin } from 'better-auth/plugins/admin';
-export { anonymous } from 'better-auth/plugins/anonymous';
-export { bearer } from 'better-auth/plugins/bearer';
-export { customSession } from 'better-auth/plugins/custom-session';
-export { deviceAuthorization } from 'better-auth/plugins/device-authorization';
-export { emailOTP } from 'better-auth/plugins/email-otp';
-export { genericOAuth } from 'better-auth/plugins/generic-oauth';
-export { haveIBeenPwned } from 'better-auth/plugins/haveibeenpwned';
-export { jwt } from 'better-auth/plugins/jwt';
-export { magicLink } from 'better-auth/plugins/magic-link';
-export { multiSession } from 'better-auth/plugins/multi-session';
-export { oAuthProxy } from 'better-auth/plugins/oauth-proxy';
-export { oidcProvider } from 'better-auth/plugins/oidc-provider';
-export { oneTimeToken } from 'better-auth/plugins/one-time-token';
-export { organization } from 'better-auth/plugins/organization';
-export { phoneNumber } from 'better-auth/plugins/phone-number';
-export { siwe } from 'better-auth/plugins/siwe';
-export { twoFactor } from 'better-auth/plugins/two-factor';
-export { username } from 'better-auth/plugins/username';
+import{mcp as e,mcpHandler as t,requireMcpAuth as m}from"@better-auth/mcp";import{oauthProvider as x}from"@better-auth/oauth-provider";import{passkey as i}from"@better-auth/passkey";import{scim as a}from"@better-auth/scim";import{captcha as s}from"better-auth/plugins";import{createAccessControl as h}from"better-auth/plugins/access";import{admin as A}from"better-auth/plugins/admin";import{anonymous as w}from"better-auth/plugins/anonymous";import{bearer as g}from"better-auth/plugins/bearer";import{customSession as v}from"better-auth/plugins/custom-session";import{deviceAuthorization as T}from"better-auth/plugins/device-authorization";import{emailOTP as z}from"better-auth/plugins/email-otp";import{genericOAuth as S}from"better-auth/plugins/generic-oauth";import{haveIBeenPwned as q}from"better-auth/plugins/haveibeenpwned";import{jwt as C}from"better-auth/plugins/jwt";import{magicLink as H}from"better-auth/plugins/magic-link";import{multiSession as L}from"better-auth/plugins/multi-session";import{oAuthProxy as N}from"better-auth/plugins/oauth-proxy";import{oneTimeToken as E}from"better-auth/plugins/one-time-token";import{organization as J}from"better-auth/plugins/organization";import{phoneNumber as Q}from"better-auth/plugins/phone-number";import{siwe as U}from"better-auth/plugins/siwe";import{twoFactor as W}from"better-auth/plugins/two-factor";import{username as Y}from"better-auth/plugins/username";export{A as admin,w as anonymous,g as bearer,s as captcha,h as createAccessControl,v as customSession,T as deviceAuthorization,z as emailOTP,S as genericOAuth,q as haveIBeenPwned,C as jwt,H as magicLink,e as mcp,t as mcpHandler,L as multiSession,N as oAuthProxy,x as oauthProvider,E as oneTimeToken,J as organization,i as passkey,Q as phoneNumber,m as requireMcpAuth,a as scim,U as siwe,W as twoFactor,Y as username};

package/dist/schema.d.mts

@@ -1,44 +1,44 @@
 import { TableDefinition } from '@lunora/server';
-import { a as LunoraAuthOptions } from "./packem_shared/create-auth.d-M36jwG_Y.mjs";
+import { a as LunoraAuthOptions } from "./packem_shared/create-auth.d-De6IOirt.mjs";
 import 'better-auth';
 /**
-* Derive Lunora table definitions from a better-auth config — the bridge that
-* makes the **full** better-auth plugin ecosystem first-class Lunora data.
-*
-* better-auth's own `getAuthTables(options)` already merges every configured
-* plugin's `schema` into one table map (core `user`/`session`/`account`/
-* `verification`, plus whatever the plugins on `options.plugins` add —
-* `organization`/`member`/`invitation`/`team`/`teamMember` from the
-* organization plugin, `role`/`banned`/… columns from admin, `passkey`,
-* `twoFactor`, `jwks`, …). This walks that map and emits an equivalent
-* `defineTable` for each, so adding a plugin to `options.plugins` automatically
-* surfaces its tables in the Lunora schema — no hand-written table definitions
-* to keep in sync.
-*
-* Spread the result into `defineSchema` alongside your app tables (the keys are
-* better-auth's real table names — `user`, `session`, … — left **unprefixed**
-* because better-auth's adapter addresses them by exactly those names). Because
-* the names are unprefixed, do **not** declare an app table that reuses one of
-* better-auth's reserved names in the same `defineSchema` — JS spread order
-* would let the later key win silently (unlike the plugin-extension path, which
-* throws on collision):
-*
-* ```ts
-* import { authTables } from "@lunora/auth";
-* const authOptions = { emailAndPassword: { enabled: true }, plugins: [organization(), admin()] };
-* export const schema = defineSchema({
-*     ...authTables(authOptions),
-*     todos: defineTable({ title: v.string() }),
-* });
-* ```
-*
-* Scope: this emits the table **shapes** (columns + types + nullability +
-* uniqueness + FK ids). It deliberately does not carry better-auth's
-* `defaultValue`/`onUpdate` (filled by better-auth's own write layer), `index`
-* hints, or `bigint` precision (`bigint` fields map to `v.number()`). Those only
-* matter once better-auth's writes are routed through Lunora's ORM — a separate
-* adapter follow-up; today the auth rows are still written by better-auth's D1
-* adapter and these tables make them typed + queryable via `ctx.db`.
-*/
+ * Derive Lunora table definitions from a better-auth config — the bridge that
+ * makes the **full** better-auth plugin ecosystem first-class Lunora data.
+ *
+ * better-auth's own `getAuthTables(options)` already merges every configured
+ * plugin's `schema` into one table map (core `user`/`session`/`account`/
+ * `verification`, plus whatever the plugins on `options.plugins` add —
+ * `organization`/`member`/`invitation`/`team`/`teamMember` from the
+ * organization plugin, `role`/`banned`/… columns from admin, `passkey`,
+ * `twoFactor`, `jwks`, …). This walks that map and emits an equivalent
+ * `defineTable` for each, so adding a plugin to `options.plugins` automatically
+ * surfaces its tables in the Lunora schema — no hand-written table definitions
+ * to keep in sync.
+ *
+ * Spread the result into `defineSchema` alongside your app tables (the keys are
+ * better-auth's real table names — `user`, `session`, … — left **unprefixed**
+ * because better-auth's adapter addresses them by exactly those names). Because
+ * the names are unprefixed, do **not** declare an app table that reuses one of
+ * better-auth's reserved names in the same `defineSchema` — JS spread order
+ * would let the later key win silently (unlike the plugin-extension path, which
+ * throws on collision):
+ *
+ * ```ts
+ * import { authTables } from "@lunora/auth";
+ * const authOptions = { emailAndPassword: { enabled: true }, plugins: [organization(), admin()] };
+ * export const schema = defineSchema({
+ *     ...authTables(authOptions),
+ *     todos: defineTable({ title: v.string() }),
+ * });
+ * ```
+ *
+ * Scope: this emits the table **shapes** (columns + types + nullability +
+ * uniqueness + FK ids). It deliberately does not carry better-auth's
+ * `defaultValue`/`onUpdate` (filled by better-auth's own write layer), `index`
+ * hints, or `bigint` precision (`bigint` fields map to `v.number()`). Those only
+ * matter once better-auth's writes are routed through Lunora's ORM — a separate
+ * adapter follow-up; today the auth rows are still written by better-auth's D1
+ * adapter and these tables make them typed + queryable via `ctx.db`.
+ */
 declare const authTables: (options: LunoraAuthOptions) => Record<string, TableDefinition>;
 export { authTables as default };

package/dist/schema.d.ts

@@ -1,44 +1,44 @@
 import { TableDefinition } from '@lunora/server';
-import { a as LunoraAuthOptions } from "./packem_shared/create-auth.d-M36jwG_Y.js";
+import { a as LunoraAuthOptions } from "./packem_shared/create-auth.d-De6IOirt.js";
 import 'better-auth';
 /**
-* Derive Lunora table definitions from a better-auth config — the bridge that
-* makes the **full** better-auth plugin ecosystem first-class Lunora data.
-*
-* better-auth's own `getAuthTables(options)` already merges every configured
-* plugin's `schema` into one table map (core `user`/`session`/`account`/
-* `verification`, plus whatever the plugins on `options.plugins` add —
-* `organization`/`member`/`invitation`/`team`/`teamMember` from the
-* organization plugin, `role`/`banned`/… columns from admin, `passkey`,
-* `twoFactor`, `jwks`, …). This walks that map and emits an equivalent
-* `defineTable` for each, so adding a plugin to `options.plugins` automatically
-* surfaces its tables in the Lunora schema — no hand-written table definitions
-* to keep in sync.
-*
-* Spread the result into `defineSchema` alongside your app tables (the keys are
-* better-auth's real table names — `user`, `session`, … — left **unprefixed**
-* because better-auth's adapter addresses them by exactly those names). Because
-* the names are unprefixed, do **not** declare an app table that reuses one of
-* better-auth's reserved names in the same `defineSchema` — JS spread order
-* would let the later key win silently (unlike the plugin-extension path, which
-* throws on collision):
-*
-* ```ts
-* import { authTables } from "@lunora/auth";
-* const authOptions = { emailAndPassword: { enabled: true }, plugins: [organization(), admin()] };
-* export const schema = defineSchema({
-*     ...authTables(authOptions),
-*     todos: defineTable({ title: v.string() }),
-* });
-* ```
-*
-* Scope: this emits the table **shapes** (columns + types + nullability +
-* uniqueness + FK ids). It deliberately does not carry better-auth's
-* `defaultValue`/`onUpdate` (filled by better-auth's own write layer), `index`
-* hints, or `bigint` precision (`bigint` fields map to `v.number()`). Those only
-* matter once better-auth's writes are routed through Lunora's ORM — a separate
-* adapter follow-up; today the auth rows are still written by better-auth's D1
-* adapter and these tables make them typed + queryable via `ctx.db`.
-*/
+ * Derive Lunora table definitions from a better-auth config — the bridge that
+ * makes the **full** better-auth plugin ecosystem first-class Lunora data.
+ *
+ * better-auth's own `getAuthTables(options)` already merges every configured
+ * plugin's `schema` into one table map (core `user`/`session`/`account`/
+ * `verification`, plus whatever the plugins on `options.plugins` add —
+ * `organization`/`member`/`invitation`/`team`/`teamMember` from the
+ * organization plugin, `role`/`banned`/… columns from admin, `passkey`,
+ * `twoFactor`, `jwks`, …). This walks that map and emits an equivalent
+ * `defineTable` for each, so adding a plugin to `options.plugins` automatically
+ * surfaces its tables in the Lunora schema — no hand-written table definitions
+ * to keep in sync.
+ *
+ * Spread the result into `defineSchema` alongside your app tables (the keys are
+ * better-auth's real table names — `user`, `session`, … — left **unprefixed**
+ * because better-auth's adapter addresses them by exactly those names). Because
+ * the names are unprefixed, do **not** declare an app table that reuses one of
+ * better-auth's reserved names in the same `defineSchema` — JS spread order
+ * would let the later key win silently (unlike the plugin-extension path, which
+ * throws on collision):
+ *
+ * ```ts
+ * import { authTables } from "@lunora/auth";
+ * const authOptions = { emailAndPassword: { enabled: true }, plugins: [organization(), admin()] };
+ * export const schema = defineSchema({
+ *     ...authTables(authOptions),
+ *     todos: defineTable({ title: v.string() }),
+ * });
+ * ```
+ *
+ * Scope: this emits the table **shapes** (columns + types + nullability +
+ * uniqueness + FK ids). It deliberately does not carry better-auth's
+ * `defaultValue`/`onUpdate` (filled by better-auth's own write layer), `index`
+ * hints, or `bigint` precision (`bigint` fields map to `v.number()`). Those only
+ * matter once better-auth's writes are routed through Lunora's ORM — a separate
+ * adapter follow-up; today the auth rows are still written by better-auth's D1
+ * adapter and these tables make them typed + queryable via `ctx.db`.
+ */
 declare const authTables: (options: LunoraAuthOptions) => Record<string, TableDefinition>;
 export { authTables as default };

package/dist/schema.mjs

@@ -1,62 +1 @@
-import { defineTable } from '@lunora/server';
-import { v } from '@lunora/values';
-import { getAuthTables } from 'better-auth/db';
-
-const baseValidator = (attribute) => {
-  if (attribute.references) {
-    return v.id(attribute.references.model);
-  }
-  const { type } = attribute;
-  if (Array.isArray(type)) {
-    return v.string();
-  }
-  switch (type) {
-    case "boolean": {
-      return v.boolean();
-    }
-    case "date": {
-      return v.date();
-    }
-    case "number": {
-      return v.number();
-    }
-    case "number[]": {
-      return v.array(v.number());
-    }
-    case "string": {
-      return v.string();
-    }
-    case "string[]": {
-      return v.array(v.string());
-    }
-    // "json" and anything unrecognised: keep the row shape permissive rather
-    // than fail schema generation on a plugin's exotic column type.
-    default: {
-      return v.any();
-    }
-  }
-};
-const fieldValidator = (attribute) => {
-  let validator = baseValidator(attribute);
-  if (attribute.required === false) {
-    validator = validator.nullable();
-  }
-  if (attribute.unique === true) {
-    validator = validator.unique();
-  }
-  return validator;
-};
-const authTables = (options) => {
-  const tables = getAuthTables(options);
-  const schema = {};
-  for (const table of Object.values(tables)) {
-    const shape = {};
-    for (const [fieldKey, attribute] of Object.entries(table.fields)) {
-      shape[attribute.fieldName ?? fieldKey] = fieldValidator(attribute);
-    }
-    schema[table.modelName] = defineTable(shape).externallyManaged();
-  }
-  return schema;
-};
-
-export { authTables as default };
+import{defineTable as i}from"@lunora/server";import{v as e}from"@lunora/values";import{getAuthTables as c}from"better-auth/db";const f=n=>{if(n.references)return e.id(n.references.model);const{type:r}=n;if(Array.isArray(r))return e.string();switch(r){case"boolean":return e.boolean();case"date":return e.date();case"number":return e.number();case"number[]":return e.array(e.number());case"string":return e.string();case"string[]":return e.array(e.string());default:return e.any()}},l=n=>{let r=f(n);return n.required===!1&&(r=r.nullable()),n.unique===!0&&(r=r.unique()),r},g=n=>{const r=c(n),t={};for(const a of Object.values(r)){const s={};for(const[o,u]of Object.entries(a.fields))s[u.fieldName??o]=l(u);t[a.modelName]=i(s).externallyManaged()}return t};export{g as default};

package/dist/sql-store.d.mts

@@ -12,40 +12,40 @@ interface D1Like {
   };
 }
 /**
-* The minimal SQL seam a {@link createSqlAuthStore} runs on — structurally the
-* same `{ all, run }` contract as `@lunora/d1`'s `D1Exec`, so a Lunora D1 binding
-* satisfies it directly (see {@link d1Executor}) and a `node:sqlite` handle does
-* too in tests. `all` runs reads and returns rows; `run` runs writes.
-*/
+ * The minimal SQL seam a {@link createSqlAuthStore} runs on — structurally the
+ * same `{ all, run }` contract as `@lunora/d1`'s `D1Exec`, so a Lunora D1 binding
+ * satisfies it directly (see {@link d1Executor}) and a `node:sqlite` handle does
+ * too in tests. `all` runs reads and returns rows; `run` runs writes.
+ */
 interface SqlExecutor {
   all: (sql: string, parameters: ReadonlyArray<unknown>) => Promise<Record<string, unknown>[]>;
   run: (sql: string, parameters: ReadonlyArray<unknown>) => Promise<void>;
 }
 /**
-* An {@link AuthStore} backed by a SQL database through the {@link SqlExecutor}
-* seam — the production counterpart to `createMemoryAuthStore`. Point it at the
-* same database that hosts Lunora's global (D1) tables (the ones `authTables(...)`
-* generates) and better-auth's reads/writes land there as ordinary rows Lunora
-* can also query. Assumes the auth tables already exist (Lunora owns the schema /
-* migrations); it never issues DDL.
-*
-* ```ts
-* const store = createSqlAuthStore(d1Executor(env.DB));
-* const auth = createAuth({ secret: env.AUTH_SECRET, database: lunoraAuthAdapter(store) });
-* ```
-*
-* Clause semantics match `createMemoryAuthStore` (operator parity is
-* covered by a cross-store agreement test) with one unavoidable caveat:
-* case-**insensitive** matching uses SQLite's ASCII-only `LOWER()`, whereas the
-* in-memory store uses JS full-Unicode `toLowerCase()`. They agree on ASCII
-* (emails, ids, tokens — the credential path); they can differ only for
-* case-insensitive comparison of non-ASCII text.
-*/
+ * An {@link AuthStore} backed by a SQL database through the {@link SqlExecutor}
+ * seam — the production counterpart to `createMemoryAuthStore`. Point it at the
+ * same database that hosts Lunora's global (D1) tables (the ones `authTables(...)`
+ * generates) and better-auth's reads/writes land there as ordinary rows Lunora
+ * can also query. Assumes the auth tables already exist (Lunora owns the schema /
+ * migrations); it never issues DDL.
+ *
+ * ```ts
+ * const store = createSqlAuthStore(d1Executor(env.DB));
+ * const auth = createAuth({ secret: env.AUTH_SECRET, database: lunoraAuthAdapter(store) });
+ * ```
+ *
+ * Clause semantics match `createMemoryAuthStore` (operator parity is
+ * covered by a cross-store agreement test) with one unavoidable caveat:
+ * case-**insensitive** matching uses SQLite's ASCII-only `LOWER()`, whereas the
+ * in-memory store uses JS full-Unicode `toLowerCase()`. They agree on ASCII
+ * (emails, ids, tokens — the credential path); they can differ only for
+ * case-insensitive comparison of non-ASCII text.
+ */
 declare const createSqlAuthStore: (executor: SqlExecutor) => AuthStore;
 /**
-* Wrap a Cloudflare D1 binding (`env.DB`) as a {@link SqlExecutor}, so
-* `createSqlAuthStore(d1Executor(env.DB))` routes better-auth onto D1 — the same
-* binding Lunora's `.global()` tables use.
-*/
+ * Wrap a Cloudflare D1 binding (`env.DB`) as a {@link SqlExecutor}, so
+ * `createSqlAuthStore(d1Executor(env.DB))` routes better-auth onto D1 — the same
+ * binding Lunora's `.global()` tables use.
+ */
 declare const d1Executor: (database: D1Like) => SqlExecutor;
 export { SqlExecutor, createSqlAuthStore, d1Executor };

package/dist/sql-store.d.ts

@@ -12,40 +12,40 @@ interface D1Like {
   };
 }
 /**
-* The minimal SQL seam a {@link createSqlAuthStore} runs on — structurally the
-* same `{ all, run }` contract as `@lunora/d1`'s `D1Exec`, so a Lunora D1 binding
-* satisfies it directly (see {@link d1Executor}) and a `node:sqlite` handle does
-* too in tests. `all` runs reads and returns rows; `run` runs writes.
-*/
+ * The minimal SQL seam a {@link createSqlAuthStore} runs on — structurally the
+ * same `{ all, run }` contract as `@lunora/d1`'s `D1Exec`, so a Lunora D1 binding
+ * satisfies it directly (see {@link d1Executor}) and a `node:sqlite` handle does
+ * too in tests. `all` runs reads and returns rows; `run` runs writes.
+ */
 interface SqlExecutor {
   all: (sql: string, parameters: ReadonlyArray<unknown>) => Promise<Record<string, unknown>[]>;
   run: (sql: string, parameters: ReadonlyArray<unknown>) => Promise<void>;
 }
 /**
-* An {@link AuthStore} backed by a SQL database through the {@link SqlExecutor}
-* seam — the production counterpart to `createMemoryAuthStore`. Point it at the
-* same database that hosts Lunora's global (D1) tables (the ones `authTables(...)`
-* generates) and better-auth's reads/writes land there as ordinary rows Lunora
-* can also query. Assumes the auth tables already exist (Lunora owns the schema /
-* migrations); it never issues DDL.
-*
-* ```ts
-* const store = createSqlAuthStore(d1Executor(env.DB));
-* const auth = createAuth({ secret: env.AUTH_SECRET, database: lunoraAuthAdapter(store) });
-* ```
-*
-* Clause semantics match `createMemoryAuthStore` (operator parity is
-* covered by a cross-store agreement test) with one unavoidable caveat:
-* case-**insensitive** matching uses SQLite's ASCII-only `LOWER()`, whereas the
-* in-memory store uses JS full-Unicode `toLowerCase()`. They agree on ASCII
-* (emails, ids, tokens — the credential path); they can differ only for
-* case-insensitive comparison of non-ASCII text.
-*/
+ * An {@link AuthStore} backed by a SQL database through the {@link SqlExecutor}
+ * seam — the production counterpart to `createMemoryAuthStore`. Point it at the
+ * same database that hosts Lunora's global (D1) tables (the ones `authTables(...)`
+ * generates) and better-auth's reads/writes land there as ordinary rows Lunora
+ * can also query. Assumes the auth tables already exist (Lunora owns the schema /
+ * migrations); it never issues DDL.
+ *
+ * ```ts
+ * const store = createSqlAuthStore(d1Executor(env.DB));
+ * const auth = createAuth({ secret: env.AUTH_SECRET, database: lunoraAuthAdapter(store) });
+ * ```
+ *
+ * Clause semantics match `createMemoryAuthStore` (operator parity is
+ * covered by a cross-store agreement test) with one unavoidable caveat:
+ * case-**insensitive** matching uses SQLite's ASCII-only `LOWER()`, whereas the
+ * in-memory store uses JS full-Unicode `toLowerCase()`. They agree on ASCII
+ * (emails, ids, tokens — the credential path); they can differ only for
+ * case-insensitive comparison of non-ASCII text.
+ */
 declare const createSqlAuthStore: (executor: SqlExecutor) => AuthStore;
 /**
-* Wrap a Cloudflare D1 binding (`env.DB`) as a {@link SqlExecutor}, so
-* `createSqlAuthStore(d1Executor(env.DB))` routes better-auth onto D1 — the same
-* binding Lunora's `.global()` tables use.
-*/
+ * Wrap a Cloudflare D1 binding (`env.DB`) as a {@link SqlExecutor}, so
+ * `createSqlAuthStore(d1Executor(env.DB))` routes better-auth onto D1 — the same
+ * binding Lunora's `.global()` tables use.
+ */
 declare const d1Executor: (database: D1Like) => SqlExecutor;
 export { SqlExecutor, createSqlAuthStore, d1Executor };

package/dist/sql-store.mjs

@@ -1,162 +1 @@
-const quoteId = (name) => `"${name.replaceAll('"', '""')}"`;
-const NEVER = { params: [], sql: "0" };
-const sided = (column, insensitive) => insensitive ? { column: `LOWER(${column})`, placeholder: "LOWER(?)" } : { column, placeholder: "?" };
-const patternFragment = (column, value, operator, insensitive) => {
-  if (typeof value !== "string") {
-    return NEVER;
-  }
-  const side = sided(column, insensitive);
-  if (operator === "contains") {
-    return { params: [value], sql: `instr(${side.column}, ${side.placeholder}) > 0` };
-  }
-  if (operator === "starts_with") {
-    return { params: [value], sql: `instr(${side.column}, ${side.placeholder}) = 1` };
-  }
-  return { params: [value, value], sql: `substr(${side.column}, -length(?)) = ${side.placeholder}` };
-};
-const equalityFragment = (column, value, insensitive, negated) => {
-  if (value === null) {
-    return { params: [], sql: `${column} IS ${negated ? "NOT " : ""}NULL` };
-  }
-  const side = sided(column, insensitive);
-  const symbol = negated ? "<>" : "=";
-  return { params: [value], sql: `${side.column} ${symbol} ${side.placeholder}` };
-};
-const inFragment = (column, value, negated, insensitive) => {
-  const values = Array.isArray(value) ? value : [];
-  if (values.length === 0) {
-    return { params: [], sql: negated ? "1" : "0" };
-  }
-  const side = sided(column, insensitive);
-  const placeholders = values.map(() => side.placeholder).join(", ");
-  return { params: [...values], sql: `${side.column} ${negated ? "NOT IN" : "IN"} (${placeholders})` };
-};
-const compileClause = (clause) => {
-  const column = quoteId(clause.field);
-  const { mode, operator, value } = clause;
-  const insensitive = mode === "insensitive";
-  switch (operator) {
-    case "contains":
-    case "ends_with":
-    case "starts_with": {
-      return patternFragment(column, value, operator, insensitive);
-    }
-    case "gt": {
-      return { params: [value], sql: `${column} > ?` };
-    }
-    case "gte": {
-      return { params: [value], sql: `${column} >= ?` };
-    }
-    case "in": {
-      return inFragment(column, value, false, insensitive);
-    }
-    case "lt": {
-      return { params: [value], sql: `${column} < ?` };
-    }
-    case "lte": {
-      return { params: [value], sql: `${column} <= ?` };
-    }
-    case "ne": {
-      return equalityFragment(column, value, insensitive, true);
-    }
-    case "not_in": {
-      return inFragment(column, value, true, insensitive);
-    }
-    // "eq" and the default: null-aware equality.
-    default: {
-      return equalityFragment(column, value, insensitive, false);
-    }
-  }
-};
-const compileWhere = (where) => {
-  if (where.length === 0) {
-    return { params: [], sql: "" };
-  }
-  let accumulator = compileClause(where[0]);
-  for (const clause of where.slice(1)) {
-    const fragment = compileClause(clause);
-    const connector = clause.connector === "OR" ? "OR" : "AND";
-    accumulator = { params: [...accumulator.params, ...fragment.params], sql: `(${accumulator.sql} ${connector} ${fragment.sql})` };
-  }
-  return accumulator;
-};
-const whereSuffix = (fragment) => fragment.sql ? ` WHERE ${fragment.sql}` : "";
-const createSqlAuthStore = (executor) => {
-  const selectRows = (model, where) => {
-    const fragment = compileWhere(where);
-    return executor.all(`SELECT * FROM ${quoteId(model)}${whereSuffix(fragment)}`, fragment.params);
-  };
-  return {
-    consumeOne: async (model, where) => {
-      const fragment = compileWhere(where);
-      const table = quoteId(model);
-      const [row] = await executor.all(
-        `DELETE FROM ${table} WHERE rowid IN (SELECT rowid FROM ${table}${whereSuffix(fragment)} LIMIT 1) RETURNING *`,
-        fragment.params
-      );
-      return row;
-    },
-    count: async (model, where) => {
-      const fragment = compileWhere(where);
-      const [row] = await executor.all(`SELECT COUNT(*) AS __count FROM ${quoteId(model)}${whereSuffix(fragment)}`, fragment.params);
-      return Number(row?.["__count"] ?? 0);
-    },
-    create: async (model, data) => {
-      const columns = Object.keys(data);
-      const placeholders = columns.map(() => "?").join(", ");
-      const sql = `INSERT INTO ${quoteId(model)} (${columns.map((column) => quoteId(column)).join(", ")}) VALUES (${placeholders})`;
-      await executor.run(
-        sql,
-        columns.map((column) => data[column])
-      );
-      return { ...data };
-    },
-    read: async (model, query) => {
-      const fragment = compileWhere(query.where);
-      const parameters = [...fragment.params];
-      let sql = `SELECT * FROM ${quoteId(model)}${whereSuffix(fragment)}`;
-      if (query.sortBy) {
-        sql += ` ORDER BY ${quoteId(query.sortBy.field)} ${query.sortBy.direction === "asc" ? "ASC" : "DESC"}`;
-      }
-      if (query.limit !== void 0) {
-        sql += " LIMIT ?";
-        parameters.push(Math.trunc(query.limit));
-      }
-      if (query.offset) {
-        sql += `${query.limit === void 0 ? " LIMIT -1" : ""} OFFSET ?`;
-        parameters.push(Math.trunc(query.offset));
-      }
-      return executor.all(sql, parameters);
-    },
-    remove: async (model, where) => {
-      const fragment = compileWhere(where);
-      const deleted = await executor.all(`DELETE FROM ${quoteId(model)}${whereSuffix(fragment)} RETURNING *`, fragment.params);
-      return deleted.length;
-    },
-    update: async (model, where, values) => {
-      const columns = Object.keys(values);
-      if (columns.length === 0) {
-        return selectRows(model, where);
-      }
-      const assignments = columns.map((column) => `${quoteId(column)} = ?`).join(", ");
-      const fragment = compileWhere(where);
-      return executor.all(`UPDATE ${quoteId(model)} SET ${assignments}${whereSuffix(fragment)} RETURNING *`, [
-        ...columns.map((column) => values[column]),
-        ...fragment.params
-      ]);
-    }
-  };
-};
-const d1Executor = (database) => {
-  return {
-    all: async (sql, parameters) => {
-      const result = await database.prepare(sql).bind(...parameters).all();
-      return result.results ?? [];
-    },
-    run: async (sql, parameters) => {
-      await database.prepare(sql).bind(...parameters).run();
-    }
-  };
-};
-
-export { createSqlAuthStore, d1Executor };
+const c=r=>`"${r.replaceAll('"','""')}"`,I={params:[],sql:"0"},E=(r,e)=>e?{column:`LOWER(${r})`,placeholder:"LOWER(?)"}:{column:r,placeholder:"?"},N=(r,e,s,n)=>{if(typeof e!="string")return I;const a=E(r,n);return s==="contains"?{params:[e],sql:`instr(${a.column}, ${a.placeholder}) > 0`}:s==="starts_with"?{params:[e],sql:`instr(${a.column}, ${a.placeholder}) = 1`}:{params:[e,e],sql:`substr(${a.column}, -length(?)) = ${a.placeholder}`}},R=(r,e,s,n)=>{if(e===null)return{params:[],sql:`${r} IS ${n?"NOT ":""}NULL`};const a=E(r,s),t=n?"<>":"=";return{params:[e],sql:`${a.column} ${t} ${a.placeholder}`}},T=(r,e,s,n)=>{const a=Array.isArray(e)?e:[];if(a.length===0)return{params:[],sql:s?"1":"0"};const t=E(r,n),l=a.map(()=>t.placeholder).join(", ");return{params:[...a],sql:`${t.column} ${s?"NOT IN":"IN"} (${l})`}},d=r=>{const e=c(r.field),{mode:s,operator:n,value:a}=r,t=s==="insensitive";switch(n){case"contains":case"ends_with":case"starts_with":return N(e,a,n,t);case"gt":return{params:[a],sql:`${e} > ?`};case"gte":return{params:[a],sql:`${e} >= ?`};case"in":return T(e,a,!1,t);case"lt":return{params:[a],sql:`${e} < ?`};case"lte":return{params:[a],sql:`${e} <= ?`};case"ne":return R(e,a,t,!0);case"not_in":return T(e,a,!0,t);default:return R(e,a,t,!1)}},p=r=>{if(r.length===0)return{params:[],sql:""};let e=d(r[0]);for(const s of r.slice(1)){const n=d(s),a=s.connector==="OR"?"OR":"AND";e={params:[...e.params,...n.params],sql:`(${e.sql} ${a} ${n.sql})`}}return e},$=r=>r.sql?` WHERE ${r.sql}`:"",f=r=>{const e=(s,n)=>{const a=p(n);return r.all(`SELECT * FROM ${c(s)}${$(a)}`,a.params)};return{consumeOne:async(s,n)=>{const a=p(n),t=c(s),[l]=await r.all(`DELETE FROM ${t} WHERE rowid IN (SELECT rowid FROM ${t}${$(a)} LIMIT 1) RETURNING *`,a.params);return l},count:async(s,n)=>{const a=p(n),[t]=await r.all(`SELECT COUNT(*) AS __count FROM ${c(s)}${$(a)}`,a.params);return Number(t?.__count??0)},create:async(s,n)=>{const a=Object.keys(n),t=a.map(()=>"?").join(", "),l=`INSERT INTO ${c(s)} (${a.map(o=>c(o)).join(", ")}) VALUES (${t})`;return await r.run(l,a.map(o=>n[o])),{...n}},incrementOne:async(s,n,a,t)=>{const l=c(s),o=Object.keys(a),i=t?Object.keys(t):[],m=p(n);if(o.length===0&&i.length===0){const[u]=await r.all(`SELECT * FROM ${l}${$(m)} LIMIT 1`,m.params);return u}const h=[...o.map(u=>`${c(u)} = COALESCE(${c(u)}, 0) + ?`),...i.map(u=>`${c(u)} = ?`)].join(", "),[O]=await r.all(`UPDATE ${l} SET ${h} WHERE rowid IN (SELECT rowid FROM ${l}${$(m)} LIMIT 1) RETURNING *`,[...o.map(u=>a[u]),...i.map(u=>t[u]),...m.params]);return O},read:async(s,n)=>{const a=p(n.where),t=[...a.params];let l=`SELECT * FROM ${c(s)}${$(a)}`;return n.sortBy&&(l+=` ORDER BY ${c(n.sortBy.field)} ${n.sortBy.direction==="asc"?"ASC":"DESC"}`),n.limit!==void 0&&(l+=" LIMIT ?",t.push(Math.trunc(n.limit))),n.offset&&(l+=`${n.limit===void 0?" LIMIT -1":""} OFFSET ?`,t.push(Math.trunc(n.offset))),r.all(l,t)},remove:async(s,n)=>{const a=p(n);return(await r.all(`DELETE FROM ${c(s)}${$(a)} RETURNING *`,a.params)).length},update:async(s,n,a)=>{const t=Object.keys(a);if(t.length===0)return e(s,n);const l=t.map(i=>`${c(i)} = ?`).join(", "),o=p(n);return r.all(`UPDATE ${c(s)} SET ${l}${$(o)} RETURNING *`,[...t.map(i=>a[i]),...o.params])}}},q=r=>({all:async(e,s)=>(await r.prepare(e).bind(...s).all()).results??[],run:async(e,s)=>{await r.prepare(e).bind(...s).run()}});export{f as createSqlAuthStore,q as d1Executor};