@lunora/auth 1.0.0-alpha.50 → 1.0.0-alpha.51

package/dist/adapter.d.mts

@@ -1,43 +1,4 @@
-import { createAdapterFactory } from 'better-auth/adapters';
-import { d1Executor } from "./sql-store.mjs";
-import { AuthStore } from "./store.mjs";
-/**
- * A better-auth database adapter backed by an {@link AuthStore} — the bridge
- * that routes better-auth's reads and writes through Lunora's data layer
- * instead of better-auth's built-in D1/Kysely adapter. Pass the result as
- * `createAuth({ database: lunoraAuthAdapter(store) })`; better-auth's
- * `createAdapterFactory` handles id generation, default values, field-name
- * mapping and output shaping, so this only translates the cleaned CRUD calls
- * onto the store.
- *
- * ```ts
- * const auth = createAuth({
- *     secret: env.AUTH_SECRET,
- *     emailAndPassword: { enabled: true },
- *     database: lunoraAuthAdapter(lunoraStore), // lunoraStore writes via ctx.db
- * });
- * ```
- *
- * Scope: the {@link AuthStore} interface is single-table CRUD. better-auth's
- * relational `join` reads (an advanced opt-in) are not handled — pair the
- * adapter with `disableJoins` or let better-auth fall back to per-table reads.
- */
-declare const lunoraAuthAdapter: (store: AuthStore) => ReturnType<typeof createAdapterFactory>;
-/**
- * One-liner for the common case: a better-auth `database` backed by a Cloudflare
- * D1 binding, via Lunora's SQL store — equivalent to
- * `lunoraAuthAdapter(createSqlAuthStore(d1Executor(d1)))`.
- *
- * Prefer this over passing the raw `env.DB` as `database`. With raw D1,
- * better-auth resolves its Kysely adapter through a runtime `await import(...)`
- * inside `auth.$context`, and that dynamic import never settles under
- * `@cloudflare/vite-plugin`'s worker runner — so it hangs *every* auth request
- * in `pnpm dev` (a standalone `wrangler dev` or a deployed worker bundle it
- * up-front, so they're unaffected — which makes the hang baffling to debug).
- * This explicit adapter skips that import entirely, so dev and prod behave the
- * same. The migration instance is the one exception — it wants raw `env.DB` so
- * `ensureMigrated`'s Kysely migrator can create the tables (its `$context` is
- * never resolved, so the hang doesn't apply there).
- */
-declare const lunoraD1Adapter: (d1: Parameters<typeof d1Executor>[0]) => ReturnType<typeof lunoraAuthAdapter>;
-export { lunoraAuthAdapter, lunoraD1Adapter };
+import 'better-auth/adapters';
+export { l as lunoraAuthAdapter, a as lunoraD1Adapter, b as lunoraDoAdapter } from "./packem_shared/adapter.d-CQD49h5g.mjs";
+import "./sql-store.mjs";
+import "./store.mjs";

package/dist/adapter.d.ts

@@ -1,43 +1,4 @@
-import { createAdapterFactory } from 'better-auth/adapters';
-import { d1Executor } from "./sql-store.js";
-import { AuthStore } from "./store.js";
-/**
- * A better-auth database adapter backed by an {@link AuthStore} — the bridge
- * that routes better-auth's reads and writes through Lunora's data layer
- * instead of better-auth's built-in D1/Kysely adapter. Pass the result as
- * `createAuth({ database: lunoraAuthAdapter(store) })`; better-auth's
- * `createAdapterFactory` handles id generation, default values, field-name
- * mapping and output shaping, so this only translates the cleaned CRUD calls
- * onto the store.
- *
- * ```ts
- * const auth = createAuth({
- *     secret: env.AUTH_SECRET,
- *     emailAndPassword: { enabled: true },
- *     database: lunoraAuthAdapter(lunoraStore), // lunoraStore writes via ctx.db
- * });
- * ```
- *
- * Scope: the {@link AuthStore} interface is single-table CRUD. better-auth's
- * relational `join` reads (an advanced opt-in) are not handled — pair the
- * adapter with `disableJoins` or let better-auth fall back to per-table reads.
- */
-declare const lunoraAuthAdapter: (store: AuthStore) => ReturnType<typeof createAdapterFactory>;
-/**
- * One-liner for the common case: a better-auth `database` backed by a Cloudflare
- * D1 binding, via Lunora's SQL store — equivalent to
- * `lunoraAuthAdapter(createSqlAuthStore(d1Executor(d1)))`.
- *
- * Prefer this over passing the raw `env.DB` as `database`. With raw D1,
- * better-auth resolves its Kysely adapter through a runtime `await import(...)`
- * inside `auth.$context`, and that dynamic import never settles under
- * `@cloudflare/vite-plugin`'s worker runner — so it hangs *every* auth request
- * in `pnpm dev` (a standalone `wrangler dev` or a deployed worker bundle it
- * up-front, so they're unaffected — which makes the hang baffling to debug).
- * This explicit adapter skips that import entirely, so dev and prod behave the
- * same. The migration instance is the one exception — it wants raw `env.DB` so
- * `ensureMigrated`'s Kysely migrator can create the tables (its `$context` is
- * never resolved, so the hang doesn't apply there).
- */
-declare const lunoraD1Adapter: (d1: Parameters<typeof d1Executor>[0]) => ReturnType<typeof lunoraAuthAdapter>;
-export { lunoraAuthAdapter, lunoraD1Adapter };
+import 'better-auth/adapters';
+export { l as lunoraAuthAdapter, a as lunoraD1Adapter, b as lunoraDoAdapter } from "./packem_shared/adapter.d-DiqyUMUb.js";
+import "./sql-store.js";
+import "./store.js";

package/dist/adapter.mjs

@@ -1 +1 @@
-import{createAdapterFactory as d}from"better-auth/adapters";import{createSqlAuthStore as c,d1Executor as l}from"./sql-store.mjs";const m=a=>a,o=a=>a??null,u=a=>a,i=a=>d({adapter:()=>({consumeOne:async({model:e,where:t})=>o(await a.consumeOne(e,t)),count:async({model:e,where:t})=>a.count(e,t??[]),create:async({data:e,model:t})=>m(await a.create(t,e)),delete:async({model:e,where:t})=>{await a.remove(e,t)},deleteMany:async({model:e,where:t})=>a.remove(e,t),findMany:async({limit:e,model:t,offset:r,sortBy:n,where:s})=>u(await a.read(t,{limit:e,offset:r,sortBy:n,where:s??[]})),findOne:async({model:e,where:t})=>{const[r]=await a.read(e,{limit:1,where:t});return o(r)},incrementOne:async({increment:e,model:t,set:r,where:n})=>o(await a.incrementOne(t,n,e,r)),update:async({model:e,update:t,where:r})=>{const[n]=await a.update(e,r,t);return o(n)},updateMany:async({model:e,update:t,where:r})=>(await a.update(e,r,t)).length}),config:{adapterId:"lunora",adapterName:"Lunora Adapter",supportsBooleans:!1,supportsDates:!1,supportsJSON:!1,supportsNumericIds:!1}}),y=a=>i(c(l(a)));export{i as lunoraAuthAdapter,y as lunoraD1Adapter};
+import"better-auth/adapters";import{s as p,l as e,w as l}from"./packem_shared/adapter-RvDcm0Zy.mjs";import"./sql-store.mjs";export{p as lunoraAuthAdapter,e as lunoraD1Adapter,l as lunoraDoAdapter};

package/dist/index.d.mts

@@ -1,9 +1,10 @@
-export { lunoraAuthAdapter, lunoraD1Adapter } from "./adapter.mjs";
+import { D as DoStorageLike } from "./packem_shared/adapter.d-CQD49h5g.mjs";
+export { l as lunoraAuthAdapter, a as lunoraD1Adapter, b as lunoraDoAdapter } from "./packem_shared/adapter.d-CQD49h5g.mjs";
 import { LunoraError } from '@lunora/errors';
 import { L as LunoraAuth, a as LunoraAuthOptions } from "./packem_shared/create-auth.d-De6IOirt.mjs";
 export { c as createAuth, r as resolveAuthOptions } from "./packem_shared/create-auth.d-De6IOirt.mjs";
-import { AppendAuthAuditEntry, AppendAuthAuditOptions, AuthAuditEvent } from "./audit.mjs";
-export { AUTH_AUDIT_TABLE, type AuthAuditEntry, type AuthAuditOutcome, type AuthAuditReader, type ReadAuthAuditOptions, appendAuthAuditEntry, createAuthAuditReader, ensureAuthAuditTable, readAuthAuditLog } from "./audit.mjs";
+import { AppendAuthAuditEntry, AppendAuthAuditOptions, AuthAuditEvent, AuthAuditReader } from "./audit.mjs";
+export { AUTH_AUDIT_TABLE, type AuthAuditEntry, type AuthAuditOutcome, type ReadAuthAuditOptions, appendAuthAuditEntry, createAuthAuditReader, ensureAuthAuditTable, readAuthAuditLog } from "./audit.mjs";
 import { createAuthMiddleware } from 'better-auth/api';
 import { SqlExecutor } from "./sql-store.mjs";
 export { createSqlAuthStore, d1Executor } from "./sql-store.mjs";
@@ -563,6 +564,174 @@ declare const withAuthAudit: <Options extends {
     after?: unknown;
   };
 }>(options: Options, config: AuthAuditHookConfig) => Options;
+/**
+ * The Durable Object state slice this class needs — structural so unit tests can
+ * pass a double without depending on the workers runtime.
+ */
+interface AuthDoState {
+  storage: DoStorageLike;
+}
+/** Path the worker calls to resolve a request's identity. Not part of `/api/auth/*`. */
+declare const RESOLVE_SESSION_PATH = "/__lunora/auth/session";
+/**
+ * Path the worker calls to read the audit log. Also not part of `/api/auth/*`.
+ *
+ * The audit table lives in this object like every other auth table, so the worker
+ * cannot query it directly — same constraint as the session route, same shared secret.
+ */
+declare const READ_AUDIT_PATH = "/__lunora/auth/audit";
+/** Header carrying the shared secret that authenticates the calling worker. */
+declare const INTERNAL_SECRET_HEADER = "x-lunora-auth-do-secret";
+/**
+ * Options for the auth DO, beyond the better-auth options themselves.
+ * @experimental
+ */
+interface AuthDoOptions {
+  /** Base path the auth routes are served under. Must match the worker's. */
+  basePath?: string;
+  /**
+   * Shared secret authenticating the worker on {@link RESOLVE_SESSION_PATH}.
+   *
+   * The DO binding is reachable from any worker bound to the namespace, so the
+   * binding alone is not an authorization boundary — same reasoning as
+   * `SessionDO`'s `SESSION_DO_SECRET`. When this is unset the internal route is
+   * refused outright rather than served unauthenticated: a missing secret is a
+   * misconfiguration, and answering identity questions to anyone is the one
+   * failure mode worth being loud about. `/api/auth/*` is unaffected — those
+   * routes carry their own credentials.
+   */
+  internalSecret?: string;
+}
+/**
+ * Base class for an app's auth Durable Object. Subclass it (or let codegen emit the
+ * subclass) and register the subclass in `wrangler.jsonc`.
+ *
+ * ```ts
+ * export class AuthDO extends LunoraAuthDO {
+ *     public constructor(state: DurableObjectState, env: Env) {
+ *         super(state, () => ({ secret: env.AUTH_SECRET, plugins: [scim({ … })] }), {
+ *             internalSecret: env.AUTH_DO_SECRET,
+ *         });
+ *     }
+ * }
+ * ```
+ * @experimental
+ */
+declare class LunoraAuthDO {
+  #private;
+  /**
+   * @param state The Durable Object state — its `storage` becomes better-auth's database.
+   * @param optionsFactory Builds the better-auth options. Called once, lazily, on the first request.
+   * @param options Auth-DO specific options (base path, internal secret).
+   */
+  constructor(state: AuthDoState, optionsFactory: () => LunoraAuthOptions, options?: AuthDoOptions);
+  /**
+   * Serve an auth request. Routes under `basePath` go to better-auth; the internal
+   * session route is handled here; anything else is a 404.
+   */
+  fetch(request: Request): Promise<Response>;
+}
+/**
+ * The `CREATE TABLE` / `CREATE INDEX` statements for a better-auth config, in
+ * execution order (every table before any index).
+ *
+ * All statements are `IF NOT EXISTS`, so this is safe to run on every cold start —
+ * which is how `LunoraAuthDO` uses it. It creates; it never alters or drops, so a
+ * schema that has already diverged is left alone rather than half-migrated.
+ *
+ * Physical names throughout: `modelName` for tables, `fieldName ?? key` for columns,
+ * and better-auth's own resolved `columns` / `name` for indexes — so an index name
+ * here is the name better-auth's introspection expects to find.
+ * @param options The better-auth options the DO will run — the plugin list decides which tables exist.
+ * @returns SQL statements to execute in order.
+ * @experimental
+ */
+declare const authDoSchemaStatements: (options: LunoraAuthOptions) => string[];
+/**
+ * `ALTER TABLE … ADD COLUMN` statements for columns the live schema is missing.
+ *
+ * ## Why this is needed at all
+ *
+ * {@link authDoSchemaStatements} is entirely `IF NOT EXISTS`, which makes it safe to
+ * re-run but blind to change: a *new table* appears on the next cold start, a *new
+ * column on an existing table* never does. That is not a hypothetical — enabling the
+ * `admin` plugin after first deploy adds `role` / `banned` / `banExpires` to `user`,
+ * and without this the object would keep serving a `user` table that cannot hold them.
+ *
+ * Additive only. Nothing here drops, renames, or retypes a column: a column that
+ * exists is left exactly as it is, so a schema someone has deliberately diverged is
+ * never "corrected" underneath them.
+ *
+ * ## What SQLite will not let us do
+ *
+ * `ADD COLUMN` cannot introduce a `NOT NULL` column without a default (existing rows
+ * would violate it immediately), and cannot introduce `UNIQUE`. So a required column
+ * with a static default is added with both; a required column *without* one is added
+ * **nullable**, which differs from what a fresh `CREATE TABLE` would produce. That is
+ * the deliberate trade: better-auth writes these fields on every insert, so nullable
+ * is harmless, whereas refusing to add the column at all would leave the object
+ * broken. Uniqueness is unaffected — better-auth expresses it as a separate index, and
+ * those are `IF NOT EXISTS`, so they are created by the statements above.
+ * @param options The better-auth options the DO runs, already resolved.
+ * @param existingColumns Physical column names currently present on a table; empty/absent for a table that does not exist yet (it will be created instead).
+ * @returns SQL statements to execute in order; empty when the live schema is current.
+ * @experimental
+ */
+declare const authDoColumnAdditions: (options: LunoraAuthOptions, existingColumns: (table: string) => Iterable<string>) => string[];
+/** The slice of a Durable Object namespace this needs — structural, so tests need no runtime. */
+interface AuthNamespaceLike {
+  get: (id: unknown) => {
+    fetch: (request: Request) => Promise<Response>;
+  };
+  idFromName: (name: string) => unknown;
+}
+/** What {@link createDoAuthWiring} needs, already resolved against `env`. */
+interface DoAuthWiringOptions {
+  /** Base path the auth routes are served under. Defaults to `/api/auth`. */
+  basePath?: string;
+  /**
+   * Shared secret presented on the object's internal session route. `undefined`
+   * means identity resolution fails closed — see {@link DoAuthWiring.resolveIdentity}.
+   */
+  internalSecret: string | undefined;
+  /** The bound namespace, or `undefined` when the binding is absent from `env`. */
+  namespace: AuthNamespaceLike | undefined;
+  /**
+   * Name of the object instance holding the auth tables. Defaults to `"auth"`.
+   *
+   * One object owns the whole auth schema, so this exists to let an app pick the
+   * name (or run separate objects per deployment/tenant) rather than being pinned to
+   * a hardcoded one.
+   */
+  objectName?: string;
+}
+/** The worker options DO-backed auth replaces. */
+interface DoAuthWiring {
+  /**
+   * Reads the audit log out of the object, so the studio's audit feed works in DO
+   * mode. Answers an empty page rather than throwing when the object is unreachable
+   * or no secret is configured — an unavailable feed should read as empty, not 500
+   * the studio.
+   */
+  auditReader: AuthAuditReader;
+  /** Forwards `/api/auth/*` to the object; `undefined` for anything else. */
+  authHandler: (request: Request) => Promise<Response | undefined>;
+  /** Resolves a request's identity by asking the object. `null` when anonymous, unreachable, or ungated. */
+  resolveIdentity: (request: Request) => Promise<null | {
+    userId: string;
+  }>;
+}
+/**
+ * Build the worker-side wiring for an auth Durable Object.
+ *
+ * Every failure path answers "not authenticated" rather than throwing: this runs on
+ * the request path for every request that touches `ctx.auth`, and a throw there would
+ * turn a misconfiguration into a 500 on traffic that has nothing to do with auth.
+ * @param options The resolved namespace, secret, and names.
+ * @returns The `authHandler` / `resolveIdentity` pair.
+ * @experimental
+ */
+declare const createDoAuthWiring: (options: DoAuthWiringOptions) => DoAuthWiring;
 /** better-auth's `databaseHooks` shape, derived so a rename upstream fails to compile rather than silently mis-hooking. */
 type DatabaseHooks = NonNullable<BetterAuthOptions["databaseHooks"]>;
 /** Config for the signup gate hooks: the base {@link EmailGateConfig} plus an optional classification tap. */
@@ -697,4 +866,4 @@ declare const validateSessionPolicy: (policy: SessionPolicy) => SessionPolicy;
  *   with the same 60s cookie cache as `rolling`.
  */
 declare const sessionPresets: Record<"longLived" | "rolling" | "strict", SessionPolicy>;
-export { type AppendAuthAuditEntry, type AppendAuthAuditOptions, type AuthAccount, type AuthAdmin, type AuthAdminSession, type AuthAdminUser, type AuthAuditEvent, type AuthAuditHookConfig, type AuthCapabilities, type AuthConfigInfo, type AuthInvitation, type AuthMember, type AuthOrgRole, type AuthOrganization, type AuthPage, type AuthPasskey, type AuthTeam, type AuthTeamMember, type AuthTimestamp, type AuthUserFieldSpec, type CreateAuthAdminOptions, DEFAULT_AUTH_BASE_PATH, type EmailClassification, type EmailGateConfig, type EmailGateHookConfig, type ImpersonationResult, type ListUsersOptions, type LunoraAuth, LunoraAuthAdminError, type LunoraAuthOptions, type SessionPolicy, type SqlExecutor, authAuditHook, buildAuditEntry, compileMigrationsSql, createAuthAdmin, emailGateDatabaseHooks, ensureMigrated, eventForPath, handleAuthRequest, sessionPresets, validateSessionPolicy, withAuthAudit, withEmailGate };
+export { READ_AUDIT_PATH as AUTH_DO_AUDIT_PATH, INTERNAL_SECRET_HEADER as AUTH_DO_SECRET_HEADER, RESOLVE_SESSION_PATH as AUTH_DO_SESSION_PATH, type AppendAuthAuditEntry, type AppendAuthAuditOptions, type AuthAccount, type AuthAdmin, type AuthAdminSession, type AuthAdminUser, type AuthAuditEvent, type AuthAuditHookConfig, type AuthAuditReader, type AuthCapabilities, type AuthConfigInfo, type AuthDoOptions, type AuthDoState, type AuthInvitation, type AuthMember, type AuthNamespaceLike, type AuthOrgRole, type AuthOrganization, type AuthPage, type AuthPasskey, type AuthTeam, type AuthTeamMember, type AuthTimestamp, type AuthUserFieldSpec, type CreateAuthAdminOptions, DEFAULT_AUTH_BASE_PATH, type DoAuthWiring, type DoAuthWiringOptions, type EmailClassification, type EmailGateConfig, type EmailGateHookConfig, type ImpersonationResult, type ListUsersOptions, type LunoraAuth, LunoraAuthAdminError, LunoraAuthDO, type LunoraAuthOptions, type SessionPolicy, type SqlExecutor, authAuditHook, authDoColumnAdditions, authDoSchemaStatements, buildAuditEntry, compileMigrationsSql, createAuthAdmin, createDoAuthWiring, emailGateDatabaseHooks, ensureMigrated, eventForPath, handleAuthRequest, sessionPresets, validateSessionPolicy, withAuthAudit, withEmailGate };

package/dist/index.d.ts

@@ -1,9 +1,10 @@
-export { lunoraAuthAdapter, lunoraD1Adapter } from "./adapter.js";
+import { D as DoStorageLike } from "./packem_shared/adapter.d-DiqyUMUb.js";
+export { l as lunoraAuthAdapter, a as lunoraD1Adapter, b as lunoraDoAdapter } from "./packem_shared/adapter.d-DiqyUMUb.js";
 import { LunoraError } from '@lunora/errors';
 import { L as LunoraAuth, a as LunoraAuthOptions } from "./packem_shared/create-auth.d-De6IOirt.js";
 export { c as createAuth, r as resolveAuthOptions } from "./packem_shared/create-auth.d-De6IOirt.js";
-import { AppendAuthAuditEntry, AppendAuthAuditOptions, AuthAuditEvent } from "./audit.js";
-export { AUTH_AUDIT_TABLE, type AuthAuditEntry, type AuthAuditOutcome, type AuthAuditReader, type ReadAuthAuditOptions, appendAuthAuditEntry, createAuthAuditReader, ensureAuthAuditTable, readAuthAuditLog } from "./audit.js";
+import { AppendAuthAuditEntry, AppendAuthAuditOptions, AuthAuditEvent, AuthAuditReader } from "./audit.js";
+export { AUTH_AUDIT_TABLE, type AuthAuditEntry, type AuthAuditOutcome, type ReadAuthAuditOptions, appendAuthAuditEntry, createAuthAuditReader, ensureAuthAuditTable, readAuthAuditLog } from "./audit.js";
 import { createAuthMiddleware } from 'better-auth/api';
 import { SqlExecutor } from "./sql-store.js";
 export { createSqlAuthStore, d1Executor } from "./sql-store.js";
@@ -563,6 +564,174 @@ declare const withAuthAudit: <Options extends {
     after?: unknown;
   };
 }>(options: Options, config: AuthAuditHookConfig) => Options;
+/**
+ * The Durable Object state slice this class needs — structural so unit tests can
+ * pass a double without depending on the workers runtime.
+ */
+interface AuthDoState {
+  storage: DoStorageLike;
+}
+/** Path the worker calls to resolve a request's identity. Not part of `/api/auth/*`. */
+declare const RESOLVE_SESSION_PATH = "/__lunora/auth/session";
+/**
+ * Path the worker calls to read the audit log. Also not part of `/api/auth/*`.
+ *
+ * The audit table lives in this object like every other auth table, so the worker
+ * cannot query it directly — same constraint as the session route, same shared secret.
+ */
+declare const READ_AUDIT_PATH = "/__lunora/auth/audit";
+/** Header carrying the shared secret that authenticates the calling worker. */
+declare const INTERNAL_SECRET_HEADER = "x-lunora-auth-do-secret";
+/**
+ * Options for the auth DO, beyond the better-auth options themselves.
+ * @experimental
+ */
+interface AuthDoOptions {
+  /** Base path the auth routes are served under. Must match the worker's. */
+  basePath?: string;
+  /**
+   * Shared secret authenticating the worker on {@link RESOLVE_SESSION_PATH}.
+   *
+   * The DO binding is reachable from any worker bound to the namespace, so the
+   * binding alone is not an authorization boundary — same reasoning as
+   * `SessionDO`'s `SESSION_DO_SECRET`. When this is unset the internal route is
+   * refused outright rather than served unauthenticated: a missing secret is a
+   * misconfiguration, and answering identity questions to anyone is the one
+   * failure mode worth being loud about. `/api/auth/*` is unaffected — those
+   * routes carry their own credentials.
+   */
+  internalSecret?: string;
+}
+/**
+ * Base class for an app's auth Durable Object. Subclass it (or let codegen emit the
+ * subclass) and register the subclass in `wrangler.jsonc`.
+ *
+ * ```ts
+ * export class AuthDO extends LunoraAuthDO {
+ *     public constructor(state: DurableObjectState, env: Env) {
+ *         super(state, () => ({ secret: env.AUTH_SECRET, plugins: [scim({ … })] }), {
+ *             internalSecret: env.AUTH_DO_SECRET,
+ *         });
+ *     }
+ * }
+ * ```
+ * @experimental
+ */
+declare class LunoraAuthDO {
+  #private;
+  /**
+   * @param state The Durable Object state — its `storage` becomes better-auth's database.
+   * @param optionsFactory Builds the better-auth options. Called once, lazily, on the first request.
+   * @param options Auth-DO specific options (base path, internal secret).
+   */
+  constructor(state: AuthDoState, optionsFactory: () => LunoraAuthOptions, options?: AuthDoOptions);
+  /**
+   * Serve an auth request. Routes under `basePath` go to better-auth; the internal
+   * session route is handled here; anything else is a 404.
+   */
+  fetch(request: Request): Promise<Response>;
+}
+/**
+ * The `CREATE TABLE` / `CREATE INDEX` statements for a better-auth config, in
+ * execution order (every table before any index).
+ *
+ * All statements are `IF NOT EXISTS`, so this is safe to run on every cold start —
+ * which is how `LunoraAuthDO` uses it. It creates; it never alters or drops, so a
+ * schema that has already diverged is left alone rather than half-migrated.
+ *
+ * Physical names throughout: `modelName` for tables, `fieldName ?? key` for columns,
+ * and better-auth's own resolved `columns` / `name` for indexes — so an index name
+ * here is the name better-auth's introspection expects to find.
+ * @param options The better-auth options the DO will run — the plugin list decides which tables exist.
+ * @returns SQL statements to execute in order.
+ * @experimental
+ */
+declare const authDoSchemaStatements: (options: LunoraAuthOptions) => string[];
+/**
+ * `ALTER TABLE … ADD COLUMN` statements for columns the live schema is missing.
+ *
+ * ## Why this is needed at all
+ *
+ * {@link authDoSchemaStatements} is entirely `IF NOT EXISTS`, which makes it safe to
+ * re-run but blind to change: a *new table* appears on the next cold start, a *new
+ * column on an existing table* never does. That is not a hypothetical — enabling the
+ * `admin` plugin after first deploy adds `role` / `banned` / `banExpires` to `user`,
+ * and without this the object would keep serving a `user` table that cannot hold them.
+ *
+ * Additive only. Nothing here drops, renames, or retypes a column: a column that
+ * exists is left exactly as it is, so a schema someone has deliberately diverged is
+ * never "corrected" underneath them.
+ *
+ * ## What SQLite will not let us do
+ *
+ * `ADD COLUMN` cannot introduce a `NOT NULL` column without a default (existing rows
+ * would violate it immediately), and cannot introduce `UNIQUE`. So a required column
+ * with a static default is added with both; a required column *without* one is added
+ * **nullable**, which differs from what a fresh `CREATE TABLE` would produce. That is
+ * the deliberate trade: better-auth writes these fields on every insert, so nullable
+ * is harmless, whereas refusing to add the column at all would leave the object
+ * broken. Uniqueness is unaffected — better-auth expresses it as a separate index, and
+ * those are `IF NOT EXISTS`, so they are created by the statements above.
+ * @param options The better-auth options the DO runs, already resolved.
+ * @param existingColumns Physical column names currently present on a table; empty/absent for a table that does not exist yet (it will be created instead).
+ * @returns SQL statements to execute in order; empty when the live schema is current.
+ * @experimental
+ */
+declare const authDoColumnAdditions: (options: LunoraAuthOptions, existingColumns: (table: string) => Iterable<string>) => string[];
+/** The slice of a Durable Object namespace this needs — structural, so tests need no runtime. */
+interface AuthNamespaceLike {
+  get: (id: unknown) => {
+    fetch: (request: Request) => Promise<Response>;
+  };
+  idFromName: (name: string) => unknown;
+}
+/** What {@link createDoAuthWiring} needs, already resolved against `env`. */
+interface DoAuthWiringOptions {
+  /** Base path the auth routes are served under. Defaults to `/api/auth`. */
+  basePath?: string;
+  /**
+   * Shared secret presented on the object's internal session route. `undefined`
+   * means identity resolution fails closed — see {@link DoAuthWiring.resolveIdentity}.
+   */
+  internalSecret: string | undefined;
+  /** The bound namespace, or `undefined` when the binding is absent from `env`. */
+  namespace: AuthNamespaceLike | undefined;
+  /**
+   * Name of the object instance holding the auth tables. Defaults to `"auth"`.
+   *
+   * One object owns the whole auth schema, so this exists to let an app pick the
+   * name (or run separate objects per deployment/tenant) rather than being pinned to
+   * a hardcoded one.
+   */
+  objectName?: string;
+}
+/** The worker options DO-backed auth replaces. */
+interface DoAuthWiring {
+  /**
+   * Reads the audit log out of the object, so the studio's audit feed works in DO
+   * mode. Answers an empty page rather than throwing when the object is unreachable
+   * or no secret is configured — an unavailable feed should read as empty, not 500
+   * the studio.
+   */
+  auditReader: AuthAuditReader;
+  /** Forwards `/api/auth/*` to the object; `undefined` for anything else. */
+  authHandler: (request: Request) => Promise<Response | undefined>;
+  /** Resolves a request's identity by asking the object. `null` when anonymous, unreachable, or ungated. */
+  resolveIdentity: (request: Request) => Promise<null | {
+    userId: string;
+  }>;
+}
+/**
+ * Build the worker-side wiring for an auth Durable Object.
+ *
+ * Every failure path answers "not authenticated" rather than throwing: this runs on
+ * the request path for every request that touches `ctx.auth`, and a throw there would
+ * turn a misconfiguration into a 500 on traffic that has nothing to do with auth.
+ * @param options The resolved namespace, secret, and names.
+ * @returns The `authHandler` / `resolveIdentity` pair.
+ * @experimental
+ */
+declare const createDoAuthWiring: (options: DoAuthWiringOptions) => DoAuthWiring;
 /** better-auth's `databaseHooks` shape, derived so a rename upstream fails to compile rather than silently mis-hooking. */
 type DatabaseHooks = NonNullable<BetterAuthOptions["databaseHooks"]>;
 /** Config for the signup gate hooks: the base {@link EmailGateConfig} plus an optional classification tap. */
@@ -697,4 +866,4 @@ declare const validateSessionPolicy: (policy: SessionPolicy) => SessionPolicy;
  *   with the same 60s cookie cache as `rolling`.
  */
 declare const sessionPresets: Record<"longLived" | "rolling" | "strict", SessionPolicy>;
-export { type AppendAuthAuditEntry, type AppendAuthAuditOptions, type AuthAccount, type AuthAdmin, type AuthAdminSession, type AuthAdminUser, type AuthAuditEvent, type AuthAuditHookConfig, type AuthCapabilities, type AuthConfigInfo, type AuthInvitation, type AuthMember, type AuthOrgRole, type AuthOrganization, type AuthPage, type AuthPasskey, type AuthTeam, type AuthTeamMember, type AuthTimestamp, type AuthUserFieldSpec, type CreateAuthAdminOptions, DEFAULT_AUTH_BASE_PATH, type EmailClassification, type EmailGateConfig, type EmailGateHookConfig, type ImpersonationResult, type ListUsersOptions, type LunoraAuth, LunoraAuthAdminError, type LunoraAuthOptions, type SessionPolicy, type SqlExecutor, authAuditHook, buildAuditEntry, compileMigrationsSql, createAuthAdmin, emailGateDatabaseHooks, ensureMigrated, eventForPath, handleAuthRequest, sessionPresets, validateSessionPolicy, withAuthAudit, withEmailGate };
+export { READ_AUDIT_PATH as AUTH_DO_AUDIT_PATH, INTERNAL_SECRET_HEADER as AUTH_DO_SECRET_HEADER, RESOLVE_SESSION_PATH as AUTH_DO_SESSION_PATH, type AppendAuthAuditEntry, type AppendAuthAuditOptions, type AuthAccount, type AuthAdmin, type AuthAdminSession, type AuthAdminUser, type AuthAuditEvent, type AuthAuditHookConfig, type AuthAuditReader, type AuthCapabilities, type AuthConfigInfo, type AuthDoOptions, type AuthDoState, type AuthInvitation, type AuthMember, type AuthNamespaceLike, type AuthOrgRole, type AuthOrganization, type AuthPage, type AuthPasskey, type AuthTeam, type AuthTeamMember, type AuthTimestamp, type AuthUserFieldSpec, type CreateAuthAdminOptions, DEFAULT_AUTH_BASE_PATH, type DoAuthWiring, type DoAuthWiringOptions, type EmailClassification, type EmailGateConfig, type EmailGateHookConfig, type ImpersonationResult, type ListUsersOptions, type LunoraAuth, LunoraAuthAdminError, LunoraAuthDO, type LunoraAuthOptions, type SessionPolicy, type SqlExecutor, authAuditHook, authDoColumnAdditions, authDoSchemaStatements, buildAuditEntry, compileMigrationsSql, createAuthAdmin, createDoAuthWiring, emailGateDatabaseHooks, ensureMigrated, eventForPath, handleAuthRequest, sessionPresets, validateSessionPolicy, withAuthAudit, withEmailGate };

package/dist/index.mjs

@@ -1 +1 @@
-import{lunoraAuthAdapter as t,lunoraD1Adapter as o}from"./adapter.mjs";import{LunoraAuthAdminError as i,createAuthAdmin as u}from"./packem_shared/LunoraAuthAdminError-CiHsF1qZ.mjs";import{AUTH_AUDIT_TABLE as l,appendAuthAuditEntry as m,createAuthAuditReader as s,ensureAuthAuditTable as d,readAuthAuditLog as h}from"./audit.mjs";import{authAuditHook as n,buildAuditEntry as f,eventForPath as x,withAuthAudit as E}from"./packem_shared/authAuditHook-Dx3sqf3G.mjs";import{createAuth as c,resolveAuthOptions as y}from"./packem_shared/createAuth-DS6PL8Mb.mjs";import{emailGateDatabaseHooks as S,withEmailGate as _}from"./packem_shared/emailGateDatabaseHooks-DzBD1Qoq.mjs";import{assertEmailAllowed as D,classifyEmail as H,emailGateMiddleware as P,loadEmailDomainLists as v}from"./email-guard.mjs";import{DEFAULT_AUTH_BASE_PATH as U,handleAuthRequest as b}from"./packem_shared/DEFAULT_AUTH_BASE_PATH-kIwlEt8i.mjs";import{LunoraAuthHeadersError as I,withAuthPlugins as R}from"./middleware.mjs";import{compileMigrationsSql as F,ensureMigrated as G}from"./packem_shared/compileMigrationsSql-C-2ALo6c.mjs";import{default as k}from"./schema.mjs";import{sessionPresets as O,validateSessionPolicy as V}from"./packem_shared/sessionPresets-DpEFjXKV.mjs";import{createSqlAuthStore as Y,d1Executor as j}from"./sql-store.mjs";import{createMemoryAuthStore as C,matchesWhere as J}from"./store.mjs";import{TURNSTILE_VERIFY_ENDPOINT as Q,verifyTurnstile as X}from"./turnstile.mjs";import{verifyTurnstileMiddleware as $}from"./turnstile-middleware.mjs";export{l as AUTH_AUDIT_TABLE,U as DEFAULT_AUTH_BASE_PATH,i as LunoraAuthAdminError,I as LunoraAuthHeadersError,Q as TURNSTILE_VERIFY_ENDPOINT,m as appendAuthAuditEntry,D as assertEmailAllowed,n as authAuditHook,k as authTables,f as buildAuditEntry,H as classifyEmail,F as compileMigrationsSql,c as createAuth,u as createAuthAdmin,s as createAuthAuditReader,C as createMemoryAuthStore,Y as createSqlAuthStore,j as d1Executor,S as emailGateDatabaseHooks,P as emailGateMiddleware,d as ensureAuthAuditTable,G as ensureMigrated,x as eventForPath,b as handleAuthRequest,v as loadEmailDomainLists,t as lunoraAuthAdapter,o as lunoraD1Adapter,J as matchesWhere,h as readAuthAuditLog,y as resolveAuthOptions,O as sessionPresets,V as validateSessionPolicy,X as verifyTurnstile,$ as verifyTurnstileMiddleware,E as withAuthAudit,R as withAuthPlugins,_ as withEmailGate};
+import{s as r,l as o,w as a}from"./packem_shared/adapter-RvDcm0Zy.mjs";import{LunoraAuthAdminError as u,createAuthAdmin as i}from"./packem_shared/LunoraAuthAdminError-CiHsF1qZ.mjs";import{AUTH_AUDIT_TABLE as m,appendAuthAuditEntry as l,createAuthAuditReader as d,ensureAuthAuditTable as h,readAuthAuditLog as E}from"./audit.mjs";import{authAuditHook as p,buildAuditEntry as T,eventForPath as f,withAuthAudit as _}from"./packem_shared/authAuditHook-Dx3sqf3G.mjs";import{READ_AUDIT_PATH as D,INTERNAL_SECRET_HEADER as S,RESOLVE_SESSION_PATH as H,LunoraAuthDO as c}from"./packem_shared/AUTH_DO_AUDIT_PATH-Cy_f9vvT.mjs";import{createAuth as L,resolveAuthOptions as P}from"./packem_shared/createAuth-DS6PL8Mb.mjs";import{authDoColumnAdditions as I,authDoSchemaStatements as O}from"./packem_shared/authDoColumnAdditions-B8BRbdzn.mjs";import{createDoAuthWiring as y}from"./packem_shared/createDoAuthWiring-Dd6AloWo.mjs";import{emailGateDatabaseHooks as g,withEmailGate as v}from"./packem_shared/emailGateDatabaseHooks-DzBD1Qoq.mjs";import{assertEmailAllowed as b,classifyEmail as q,emailGateMiddleware as C,loadEmailDomainLists as F}from"./email-guard.mjs";import{DEFAULT_AUTH_BASE_PATH as k,handleAuthRequest as B}from"./packem_shared/DEFAULT_AUTH_BASE_PATH-kIwlEt8i.mjs";import{LunoraAuthHeadersError as W,withAuthPlugins as Y}from"./middleware.mjs";import{compileMigrationsSql as z,ensureMigrated as J}from"./packem_shared/compileMigrationsSql-C-2ALo6c.mjs";import{default as Q}from"./schema.mjs";import{sessionPresets as Z,validateSessionPolicy as $}from"./packem_shared/sessionPresets-DpEFjXKV.mjs";import{createSqlAuthStore as te,d1Executor as re}from"./sql-store.mjs";import{createMemoryAuthStore as ae,matchesWhere as Ae}from"./store.mjs";import{TURNSTILE_VERIFY_ENDPOINT as ie,verifyTurnstile as se}from"./turnstile.mjs";import{verifyTurnstileMiddleware as le}from"./turnstile-middleware.mjs";export{m as AUTH_AUDIT_TABLE,D as AUTH_DO_AUDIT_PATH,S as AUTH_DO_SECRET_HEADER,H as AUTH_DO_SESSION_PATH,k as DEFAULT_AUTH_BASE_PATH,u as LunoraAuthAdminError,c as LunoraAuthDO,W as LunoraAuthHeadersError,ie as TURNSTILE_VERIFY_ENDPOINT,l as appendAuthAuditEntry,b as assertEmailAllowed,p as authAuditHook,I as authDoColumnAdditions,O as authDoSchemaStatements,Q as authTables,T as buildAuditEntry,q as classifyEmail,z as compileMigrationsSql,L as createAuth,i as createAuthAdmin,d as createAuthAuditReader,y as createDoAuthWiring,ae as createMemoryAuthStore,te as createSqlAuthStore,re as d1Executor,g as emailGateDatabaseHooks,C as emailGateMiddleware,h as ensureAuthAuditTable,J as ensureMigrated,f as eventForPath,B as handleAuthRequest,F as loadEmailDomainLists,r as lunoraAuthAdapter,o as lunoraD1Adapter,a as lunoraDoAdapter,Ae as matchesWhere,E as readAuthAuditLog,P as resolveAuthOptions,Z as sessionPresets,$ as validateSessionPolicy,se as verifyTurnstile,le as verifyTurnstileMiddleware,_ as withAuthAudit,Y as withAuthPlugins,v as withEmailGate};

package/dist/packem_shared/AUTH_DO_AUDIT_PATH-Cy_f9vvT.mjs

@@ -0,0 +1 @@
+import{w as i,d as h}from"./adapter-RvDcm0Zy.mjs";import{ensureAuthAuditTable as u,createAuthAuditReader as c}from"../audit.mjs";import{resolveAuthOptions as l,createAuth as d}from"./createAuth-DS6PL8Mb.mjs";import{authDoSchemaStatements as f,authDoColumnAdditions as m}from"./authDoColumnAdditions-B8BRbdzn.mjs";import{handleAuthRequest as A}from"./DEFAULT_AUTH_BASE_PATH-kIwlEt8i.mjs";const p=(o,t)=>{const s=Math.max(o.length,t.length);let e=o.length^t.length;for(let r=0;r<s;r+=1){const a=r<o.length?o.charCodeAt(r):0,n=r<t.length?t.charCodeAt(r):0;e|=a^n}return e===0},R="/__lunora/auth/session",E="/__lunora/auth/audit",_="x-lunora-auth-do-secret";class j{#e;#r;#t;#s;#o=!1;constructor(t,s,e={}){this.#t=t.storage,this.#r=s,this.#e=e}#a(){if(this.#s!==void 0)return this.#s;const t=this.#r();if(!this.#o){const s=l(t);for(const e of f(s))[...this.#t.sql.exec(e)];for(const e of m(s,r=>this.#i(r)))[...this.#t.sql.exec(e)];this.#o=!0}return this.#s=d({...t,database:i(this.#t)}),this.#s}#i(t){return[...this.#t.sql.exec("SELECT name FROM pragma_table_info(?)",t)].map(s=>String(s.name))}async#h(t){if(!this.#n(t))return Response.json({error:"unauthorized"},{status:401});const s=h(this.#t);await u(s);const e=await t.json(),r=await c(s).read(e??{});return Response.json({entries:r})}#n(t){const{internalSecret:s}=this.#e;if(s===void 0||s==="")return!1;const e=t.headers.get(_);return e!==null&&p(e,s)}async#u(t){if(!this.#n(t))return Response.json({error:"unauthorized"},{status:401});const s=(await this.#a().api.getSession({headers:t.headers}))?.user.id;return Response.json(s===void 0?{}:{userId:s})}async fetch(t){const s=new URL(t.url);if(s.pathname===R)return this.#u(t);if(s.pathname===E)return this.#h(t);const e=this.#a();return await A(e,t,this.#e.basePath)??Response.json({error:"not an auth route"},{status:404})}}export{_ as INTERNAL_SECRET_HEADER,j as LunoraAuthDO,E as READ_AUDIT_PATH,R as RESOLVE_SESSION_PATH};

package/dist/packem_shared/adapter-RvDcm0Zy.mjs

@@ -0,0 +1 @@
+import{createAdapterFactory as l}from"better-auth/adapters";import{createSqlAuthStore as c,d1Executor as m}from"../sql-store.mjs";const i=e=>({all:(a,r)=>Promise.resolve([...e.sql.exec(a,...r)]),run:(a,r)=>([...e.sql.exec(a,...r)],Promise.resolve())}),u=e=>async a=>e.transaction(a),p=e=>e,o=e=>e??null,w=e=>e,y=e=>({consumeOne:async({model:a,where:r})=>o(await e.consumeOne(a,r)),count:async({model:a,where:r})=>e.count(a,r??[]),create:async({data:a,model:r})=>p(await e.create(r,a)),delete:async({model:a,where:r})=>{await e.remove(a,r)},deleteMany:async({model:a,where:r})=>e.remove(a,r),findMany:async({limit:a,model:r,offset:n,sortBy:t,where:s})=>w(await e.read(r,{limit:a,offset:n,sortBy:t,where:s??[]})),findOne:async({model:a,where:r})=>{const[n]=await e.read(a,{limit:1,where:r});return o(n)},incrementOne:async({increment:a,model:r,set:n,where:t})=>o(await e.incrementOne(r,t,a,n)),update:async({model:a,update:r,where:n})=>{const[t]=await e.update(a,n,r);return o(t)},updateMany:async({model:a,update:r,where:n})=>(await e.update(a,n,r)).length}),d=(e,a)=>{const r=t=>s=>l({adapter:()=>y(e),config:{adapterId:"lunora",adapterName:"Lunora Adapter",transaction:t(s),supportsBooleans:!1,supportsDates:!1,supportsJSON:!1,supportsNumericIds:!1}})(s),n=()=>!1;return r(a?t=>async s=>a(async()=>s(r(n)(t))):n)},O=e=>d(c(m(e))),x=e=>d(c(i(e)),u(e));export{i as d,O as l,d as s,x as w};

package/dist/packem_shared/adapter.d-CQD49h5g.d.mts

@@ -0,0 +1,76 @@
+import { createAdapterFactory } from 'better-auth/adapters';
+import { d1Executor } from "../sql-store.mjs";
+import { AuthStore } from "../store.mjs";
+/**
+ * The slice of `DurableObjectStorage` this module uses.
+ *
+ * Structural on purpose: it keeps `@lunora/auth` free of a `@lunora/do` dependency
+ * and lets tests supply a double whose `transaction` has the same semantics.
+ */
+interface DoStorageLike {
+  /** Synchronous SQL over the object's SQLite. */
+  sql: {
+    exec: (query: string, ...bindings: unknown[]) => Iterable<Record<string, unknown>>;
+  };
+  /**
+   * The platform's async transaction primitive. Everything the closure executes
+   * against `sql` joins the transaction — it is connection-scoped, so no handle is
+   * threaded through — and a throw rolls the whole thing back.
+   */
+  transaction: <R>(closure: () => Promise<R>) => Promise<R>;
+}
+/**
+ * Runs `closure` atomically. Supplied by stores whose backend has real
+ * transactions — a Durable Object's storage does; D1 does not.
+ */
+type TransactionRunner = <R>(closure: () => Promise<R>) => Promise<R>;
+/**
+ * A better-auth database adapter backed by an {@link AuthStore} — the bridge
+ * that routes better-auth's reads and writes through Lunora's data layer
+ * instead of better-auth's built-in D1/Kysely adapter. Pass the result as
+ * `createAuth({ database: lunoraAuthAdapter(store) })`; better-auth's
+ * `createAdapterFactory` handles id generation, default values, field-name
+ * mapping and output shaping, so this only translates the cleaned CRUD calls
+ * onto the store.
+ *
+ * ```ts
+ * const auth = createAuth({
+ *     secret: env.AUTH_SECRET,
+ *     emailAndPassword: { enabled: true },
+ *     database: lunoraAuthAdapter(lunoraStore), // lunoraStore writes via ctx.db
+ * });
+ * ```
+ *
+ * Scope: the {@link AuthStore} interface is single-table CRUD. better-auth's
+ * relational `join` reads (an advanced opt-in) are not handled — pair the
+ * adapter with `disableJoins` or let better-auth fall back to per-table reads.
+ */
+declare const lunoraAuthAdapter: (store: AuthStore, runInTransaction?: TransactionRunner) => ReturnType<typeof createAdapterFactory>;
+/**
+ * One-liner for the common case: a better-auth `database` backed by a Cloudflare
+ * D1 binding, via Lunora's SQL store — equivalent to
+ * `lunoraAuthAdapter(createSqlAuthStore(d1Executor(d1)))`.
+ *
+ * Prefer this over passing the raw `env.DB` as `database`. With raw D1,
+ * better-auth resolves its Kysely adapter through a runtime `await import(...)`
+ * inside `auth.$context`, and that dynamic import never settles under
+ * `@cloudflare/vite-plugin`'s worker runner — so it hangs *every* auth request
+ * in `pnpm dev` (a standalone `wrangler dev` or a deployed worker bundle it
+ * up-front, so they're unaffected — which makes the hang baffling to debug).
+ * This explicit adapter skips that import entirely, so dev and prod behave the
+ * same. The migration instance is the one exception — it wants raw `env.DB` so
+ * `ensureMigrated`'s Kysely migrator can create the tables (its `$context` is
+ * never resolved, so the hang doesn't apply there).
+ */
+declare const lunoraD1Adapter: (d1: Parameters<typeof d1Executor>[0]) => ReturnType<typeof lunoraAuthAdapter>;
+/**
+ * Prototype: a better-auth `database` backed by a Durable Object's own SQLite —
+ * `lunoraAuthAdapter(createSqlAuthStore(doExecutor(storage)), doTransactionRunner(storage))`.
+ *
+ * Unlike `lunoraD1Adapter` this one exposes real transactions, so plugins that
+ * demand them (`@better-auth/scim`) accept it. Read the trade-offs in `do-store.ts`
+ * before reaching for it: the auth tables then live inside a single Durable Object.
+ * @experimental
+ */
+declare const lunoraDoAdapter: (storage: DoStorageLike) => ReturnType<typeof lunoraAuthAdapter>;
+export { DoStorageLike as D, lunoraD1Adapter as a, lunoraDoAdapter as b, lunoraAuthAdapter as l };

package/dist/packem_shared/adapter.d-DiqyUMUb.d.ts

@@ -0,0 +1,76 @@
+import { createAdapterFactory } from 'better-auth/adapters';
+import { d1Executor } from "../sql-store.js";
+import { AuthStore } from "../store.js";
+/**
+ * The slice of `DurableObjectStorage` this module uses.
+ *
+ * Structural on purpose: it keeps `@lunora/auth` free of a `@lunora/do` dependency
+ * and lets tests supply a double whose `transaction` has the same semantics.
+ */
+interface DoStorageLike {
+  /** Synchronous SQL over the object's SQLite. */
+  sql: {
+    exec: (query: string, ...bindings: unknown[]) => Iterable<Record<string, unknown>>;
+  };
+  /**
+   * The platform's async transaction primitive. Everything the closure executes
+   * against `sql` joins the transaction — it is connection-scoped, so no handle is
+   * threaded through — and a throw rolls the whole thing back.
+   */
+  transaction: <R>(closure: () => Promise<R>) => Promise<R>;
+}
+/**
+ * Runs `closure` atomically. Supplied by stores whose backend has real
+ * transactions — a Durable Object's storage does; D1 does not.
+ */
+type TransactionRunner = <R>(closure: () => Promise<R>) => Promise<R>;
+/**
+ * A better-auth database adapter backed by an {@link AuthStore} — the bridge
+ * that routes better-auth's reads and writes through Lunora's data layer
+ * instead of better-auth's built-in D1/Kysely adapter. Pass the result as
+ * `createAuth({ database: lunoraAuthAdapter(store) })`; better-auth's
+ * `createAdapterFactory` handles id generation, default values, field-name
+ * mapping and output shaping, so this only translates the cleaned CRUD calls
+ * onto the store.
+ *
+ * ```ts
+ * const auth = createAuth({
+ *     secret: env.AUTH_SECRET,
+ *     emailAndPassword: { enabled: true },
+ *     database: lunoraAuthAdapter(lunoraStore), // lunoraStore writes via ctx.db
+ * });
+ * ```
+ *
+ * Scope: the {@link AuthStore} interface is single-table CRUD. better-auth's
+ * relational `join` reads (an advanced opt-in) are not handled — pair the
+ * adapter with `disableJoins` or let better-auth fall back to per-table reads.
+ */
+declare const lunoraAuthAdapter: (store: AuthStore, runInTransaction?: TransactionRunner) => ReturnType<typeof createAdapterFactory>;
+/**
+ * One-liner for the common case: a better-auth `database` backed by a Cloudflare
+ * D1 binding, via Lunora's SQL store — equivalent to
+ * `lunoraAuthAdapter(createSqlAuthStore(d1Executor(d1)))`.
+ *
+ * Prefer this over passing the raw `env.DB` as `database`. With raw D1,
+ * better-auth resolves its Kysely adapter through a runtime `await import(...)`
+ * inside `auth.$context`, and that dynamic import never settles under
+ * `@cloudflare/vite-plugin`'s worker runner — so it hangs *every* auth request
+ * in `pnpm dev` (a standalone `wrangler dev` or a deployed worker bundle it
+ * up-front, so they're unaffected — which makes the hang baffling to debug).
+ * This explicit adapter skips that import entirely, so dev and prod behave the
+ * same. The migration instance is the one exception — it wants raw `env.DB` so
+ * `ensureMigrated`'s Kysely migrator can create the tables (its `$context` is
+ * never resolved, so the hang doesn't apply there).
+ */
+declare const lunoraD1Adapter: (d1: Parameters<typeof d1Executor>[0]) => ReturnType<typeof lunoraAuthAdapter>;
+/**
+ * Prototype: a better-auth `database` backed by a Durable Object's own SQLite —
+ * `lunoraAuthAdapter(createSqlAuthStore(doExecutor(storage)), doTransactionRunner(storage))`.
+ *
+ * Unlike `lunoraD1Adapter` this one exposes real transactions, so plugins that
+ * demand them (`@better-auth/scim`) accept it. Read the trade-offs in `do-store.ts`
+ * before reaching for it: the auth tables then live inside a single Durable Object.
+ * @experimental
+ */
+declare const lunoraDoAdapter: (storage: DoStorageLike) => ReturnType<typeof lunoraAuthAdapter>;
+export { DoStorageLike as D, lunoraD1Adapter as a, lunoraDoAdapter as b, lunoraAuthAdapter as l };

package/dist/packem_shared/authDoColumnAdditions-B8BRbdzn.mjs

@@ -0,0 +1 @@
+import{getAuthTablesWithResolvedIndexes as f,getDatabaseFieldIndexName as N}from"@better-auth/core/db/internal";const s=n=>`"${n.replaceAll('"','""')}"`,c=(n,e)=>{if(n==="id"||e.references?.field==="id")return"text";const{type:t}=e;if(Array.isArray(t))return"text";switch(t){case"boolean":return"integer";case"date":return"date";case"number":return"bigint"in e&&e.bigint===!0?"bigint":"integer";default:return"text"}},b=n=>{const{defaultValue:e,type:t,unique:r}=n;if(!(r===!0&&n.required===!1)&&!(e==null||typeof e=="function")){if(t==="boolean")return e===!0?"1":"0";if(t==="number"&&typeof e=="number"&&Number.isFinite(e))return String(e);if(t==="string"&&typeof e=="string")return`'${e.replaceAll("'","''")}'`}},p=(n,e)=>{const t=[];for(const[r,o]of Object.entries(e)){const i=o.unique===!0;if(!i&&o.index!==!0)continue;const l=o.fieldName??r,u=N(n,l,i);t.push(`CREATE ${i?"UNIQUE ":""}INDEX IF NOT EXISTS ${s(u)} ON ${s(n)} (${s(l)})`)}return t},E=(n,e)=>{const t=[s(n),c(n,e)],r=b(e);return e.required!==!1&&r!==void 0&&t.push("NOT NULL"),r!==void 0&&t.push(`DEFAULT ${r}`),t.join(" ")},T=(n,e)=>{const t=[s(n),c(n,e)];return e.required!==!1&&t.push("NOT NULL"),t.join(" ")},A=n=>{const{indexesByTable:e,tables:t}=f(n),r=[],o=[];for(const i of Object.values(t)){if(i.disableMigrations===!0)continue;const l=[`${s("id")} text NOT NULL PRIMARY KEY`,...Object.entries(i.fields).map(([u,a])=>T(a.fieldName??u,a))];r.push(`CREATE TABLE IF NOT EXISTS ${s(i.modelName)} (${l.join(", ")})`),o.push(...p(i.modelName,i.fields));for(const u of e.get(i.modelName)??[]){const a=u.unique===!0?"UNIQUE ":"",d=u.columns.map(m=>s(m)).join(", ");o.push(`CREATE ${a}INDEX IF NOT EXISTS ${s(u.name)} ON ${s(i.modelName)} (${d})`)}}return[...r,...o]},$=(n,e)=>{const{tables:t}=f(n),r=[];for(const o of Object.values(t)){if(o.disableMigrations===!0)continue;const i=new Set(e(o.modelName));if(i.size!==0)for(const[l,u]of Object.entries(o.fields)){const a=u.fieldName??l;i.has(a)||r.push(`ALTER TABLE ${s(o.modelName)} ADD COLUMN ${E(a,u)}`)}}return r};export{$ as authDoColumnAdditions,A as authDoSchemaStatements};

package/dist/packem_shared/createDoAuthWiring-Dd6AloWo.mjs

@@ -0,0 +1 @@
+import{INTERNAL_SECRET_HEADER as u,RESOLVE_SESSION_PATH as f,READ_AUDIT_PATH as w}from"./AUTH_DO_AUDIT_PATH-Cy_f9vvT.mjs";import{DEFAULT_AUTH_BASE_PATH as A}from"./DEFAULT_AUTH_BASE_PATH-kIwlEt8i.mjs";const m=c=>{const{basePath:d=A,internalSecret:a,namespace:i,objectName:h="auth"}=c,o=()=>{if(i)return i.get(i.idFromName(h))},l=async(t,e,s)=>{if(!a)return;const n=o();if(!n)return;const r=await n.fetch(new Request(new URL(t,e),{body:JSON.stringify(s),headers:{"content-type":"application/json",[u]:a},method:"POST"}));return r.ok?r:void 0};return{auditReader:{read:async t=>{const e=await l(w,"https://auth-do.invalid",t);return e?(await e.json())?.entries??[]:[]}},authHandler:async t=>{if(new URL(t.url).pathname.startsWith(d))return o()?.fetch(t)},resolveIdentity:async t=>{if(!a)return null;const e=o();if(!e)return null;const s=new Headers(t.headers);s.set(u,a);const n=await e.fetch(new Request(new URL(f,t.url),{headers:s}));if(!n.ok)return null;const r=await n.json();return r?.userId?{userId:r.userId}:null}}};export{m as createDoAuthWiring};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/auth",
-  "version": "1.0.0-alpha.50",
+  "version": "1.0.0-alpha.51",
   "description": "Auth for Lunora — a thin better-auth wrapper: email/password, OAuth, plugins, D1-backed",
   "keywords": [
     "auth",
@@ -104,7 +104,7 @@
     "@better-auth/passkey": "1.7.0-rc.2",
     "@better-auth/scim": "1.7.0-rc.2",
     "@lunora/errors": "1.0.0-alpha.8",
-    "@lunora/server": "1.0.0-alpha.44",
+    "@lunora/server": "1.0.0-alpha.45",
     "@lunora/values": "1.0.0-alpha.11",
     "@visulima/disposable-email-domains": "1.0.1",
     "@visulima/email-verifier": "1.0.1",