@lunora/auth 1.0.0-alpha.7 → 1.0.0-alpha.71

package/dist/packem_shared/create-auth.d-De6IOirt.d.mts

@@ -0,0 +1,128 @@
+import { betterAuth, BetterAuthOptions } from 'better-auth';
+/**
+ * Lunora's options pass straight through to better-auth — the only thing we add
+ * is requiring `secret` up front so a misconfigured deployment fails loudly
+ * instead of at the first sign-in.
+ *
+ * For `database`, prefer `lunoraD1Adapter` (`database: lunoraD1Adapter(env.DB)`)
+ * over passing the raw `env.DB`. better-auth *does* accept a D1Database directly,
+ * but it then resolves its Kysely adapter via a runtime `await import(...)` inside
+ * `auth.$context` — and that import never settles under `@cloudflare/vite-plugin`'s
+ * worker runner, hanging every auth request in `pnpm dev`. The explicit adapter
+ * skips it, so dev and prod behave the same. (Raw `env.DB` is still correct for
+ * the migration-only instance — see `lunoraD1Adapter`'s note.)
+ *
+ * Session rotation / richer session policies are configured via the `session`
+ * field (a `SessionPolicy`); Lunora validates it for obviously-broken
+ * durations and forwards it verbatim to better-auth. See `sessionPresets`
+ * for ready-made rotation/expiry trade-offs.
+ *
+ * ## Serverless background tasks (Cloudflare Workers)
+ *
+ * better-auth runs some work *after* sending the response — most importantly the
+ * password-reset email, whose background send is what keeps reset responses
+ * constant-time (a timing-attack defence: the response doesn't reveal whether
+ * the account exists). On Cloudflare Workers a promise that isn't handed to
+ * `ctx.waitUntil` can be cancelled the moment the response returns, dropping
+ * that send and weakening the guarantee. Wire your request's `ctx.waitUntil`
+ * into better-auth's background handler so the work survives:
+ *
+ * ```ts
+ * // in your worker fetch handler, where `ctx: ExecutionContext` is in scope
+ * const auth = createAuth({
+ *     secret: env.AUTH_SECRET,
+ *     database: lunoraD1Adapter(env.DB),
+ *     advanced: {
+ *         backgroundTasks: { handler: (promise) => ctx.waitUntil(promise) },
+ *     },
+ * });
+ * ```
+ *
+ * (Lunora can't set this for you — `ctx.waitUntil` is per-request, but
+ * `createAuth` runs once at worker setup.)
+ */
+type LunoraAuthOptions = BetterAuthOptions;
+/**
+ * The full better-auth instance: `auth.handler` accepts a `Request` and
+ * returns a `Response` (used by `handleAuthRequest`); `auth.api`
+ * exposes the typed endpoint surface for server-side calls (e.g.
+ * `auth.api.getSession({ headers })` inside a query/mutation).
+ */
+type LunoraAuth = ReturnType<typeof betterAuth>;
+/**
+ * Resolve the caller's options into the exact shape `createAuth` hands to
+ * `betterAuth` — the hardened, default-filled options the running worker uses.
+ * Exported (and pure) so the migration path can compile the schema from the
+ * same resolved options: `compileMigrationsSql` routes through here, so the
+ * `rateLimit` table the worker's durable limiter writes to is included in the
+ * migration rather than silently omitted (it would be, if migrations saw the
+ * raw options while the worker ran the resolved ones).
+ *
+ * ## What it fills (each gated independently on caller silence)
+ *
+ * Secure-by-default cookies + secret-strength warning via {@link hardenAuthOptions},
+ * applied first so all hardening composes onto one options object.
+ *
+ * Rate limiting is ON by default for `/api/auth/*`.
+ *
+ * better-auth's own default is `rateLimit.enabled ?? isProduction`, and its
+ * `isProduction` is `"production" === "production"` resolved at
+ * module-load time. On Cloudflare Workers that check is unreliable: the
+ * runtime has no Node `process.env` (absent entirely without
+ * `nodejs_compat`, and even with it `NODE_ENV` is rarely `"production"` at
+ * request time). So better-auth would silently leave auth endpoints
+ * _unthrottled_ on a real deployment — the surprise we refuse to ship.
+ *
+ * We therefore default `enabled: true` whenever the caller hasn't made an
+ * explicit choice. We only fill the `enabled` flag and otherwise forward
+ * the caller's `rateLimit` verbatim, so better-auth's `window` (10s) / `max`
+ * (100) defaults and any custom rules still apply. Callers who genuinely
+ * want it off can pass `rateLimit: { enabled: false }` (e.g. when fronting
+ * auth with their own limiter), and any explicit `enabled` value wins.
+ *
+ * We also default `storage: "database"` — but only when rate limiting is not
+ * explicitly disabled (`enabled !== false`). Filling storage under a disabled
+ * limiter is harmless at runtime but makes `getAuthTables` emit an unused
+ * `rateLimit` table, so we skip it there.
+ *
+ * better-auth's own default is `storage: "memory"` — a per-isolate,
+ * non-durable counter. On Cloudflare Workers that means each isolate keeps
+ * its own tally, counters vanish on isolate recycle, and traffic spread
+ * across isolates never sums to the configured `max` — a limiter that
+ * reports "enabled" while never enforcing a global limit (the exact
+ * brute-force / credential-stuffing protection on `/sign-in`, OTP, and
+ * password-reset it is meant to buy). `storage: "database"` rides the counter
+ * through the configured `database` adapter — Lunora's store over the D1 auth
+ * tables — so the limit is durable *and* atomic (the store's native
+ * `incrementOne` gives a one-winner guarantee across isolates). Callers with
+ * their own durable store can pass an explicit `rateLimit: { storage: … }`
+ * (or `customStorage`), and any explicit value wins.
+ *
+ * Session cookie cache is ON by default too.
+ *
+ * Every authenticated call resolves identity through better-auth's
+ * `getSession`, which — without a cache — is a DB (D1) read on the hot path
+ * of every query/mutation/action that reads `ctx.auth` and of the WebSocket
+ * upgrade. better-auth's `session.cookieCache` carries the session payload in
+ * a short-lived signed cookie so `getSession` can answer without hitting the
+ * database until the cache window elapses. We default it on with a
+ * deliberately short 60s `maxAge` (better-auth's own default is 300s): long
+ * enough to erase the per-request read for a burst of calls, short enough
+ * that a revoked or role-changed session self-corrects within a minute.
+ * The one tradeoff — a revoked session stays valid until the cache expires —
+ * is bounded by that TTL; callers who need immediate revocation opt out with
+ * `session: { cookieCache: { enabled: false } }` (or the `strict` preset).
+ *
+ * Every explicit caller value is forwarded verbatim. The two `rateLimit` fills
+ * merge into a single `rateLimit` object so neither clobbers the other.
+ */
+declare const resolveAuthOptions: (options: LunoraAuthOptions) => LunoraAuthOptions;
+/**
+ * Create the auth instance. Thin wrapper around `betterAuth` that enforces
+ * the `secret` requirement at construction time so misconfigured deployments
+ * fail loudly at the first fetch rather than the first sign-in attempt, then
+ * hands {@link resolveAuthOptions}'s hardened, default-filled options to
+ * better-auth.
+ */
+declare const createAuth: (options: LunoraAuthOptions) => LunoraAuth;
+export { LunoraAuth as L, LunoraAuthOptions as a, createAuth as c, resolveAuthOptions as r };

package/dist/packem_shared/create-auth.d-De6IOirt.d.ts

@@ -0,0 +1,128 @@
+import { betterAuth, BetterAuthOptions } from 'better-auth';
+/**
+ * Lunora's options pass straight through to better-auth — the only thing we add
+ * is requiring `secret` up front so a misconfigured deployment fails loudly
+ * instead of at the first sign-in.
+ *
+ * For `database`, prefer `lunoraD1Adapter` (`database: lunoraD1Adapter(env.DB)`)
+ * over passing the raw `env.DB`. better-auth *does* accept a D1Database directly,
+ * but it then resolves its Kysely adapter via a runtime `await import(...)` inside
+ * `auth.$context` — and that import never settles under `@cloudflare/vite-plugin`'s
+ * worker runner, hanging every auth request in `pnpm dev`. The explicit adapter
+ * skips it, so dev and prod behave the same. (Raw `env.DB` is still correct for
+ * the migration-only instance — see `lunoraD1Adapter`'s note.)
+ *
+ * Session rotation / richer session policies are configured via the `session`
+ * field (a `SessionPolicy`); Lunora validates it for obviously-broken
+ * durations and forwards it verbatim to better-auth. See `sessionPresets`
+ * for ready-made rotation/expiry trade-offs.
+ *
+ * ## Serverless background tasks (Cloudflare Workers)
+ *
+ * better-auth runs some work *after* sending the response — most importantly the
+ * password-reset email, whose background send is what keeps reset responses
+ * constant-time (a timing-attack defence: the response doesn't reveal whether
+ * the account exists). On Cloudflare Workers a promise that isn't handed to
+ * `ctx.waitUntil` can be cancelled the moment the response returns, dropping
+ * that send and weakening the guarantee. Wire your request's `ctx.waitUntil`
+ * into better-auth's background handler so the work survives:
+ *
+ * ```ts
+ * // in your worker fetch handler, where `ctx: ExecutionContext` is in scope
+ * const auth = createAuth({
+ *     secret: env.AUTH_SECRET,
+ *     database: lunoraD1Adapter(env.DB),
+ *     advanced: {
+ *         backgroundTasks: { handler: (promise) => ctx.waitUntil(promise) },
+ *     },
+ * });
+ * ```
+ *
+ * (Lunora can't set this for you — `ctx.waitUntil` is per-request, but
+ * `createAuth` runs once at worker setup.)
+ */
+type LunoraAuthOptions = BetterAuthOptions;
+/**
+ * The full better-auth instance: `auth.handler` accepts a `Request` and
+ * returns a `Response` (used by `handleAuthRequest`); `auth.api`
+ * exposes the typed endpoint surface for server-side calls (e.g.
+ * `auth.api.getSession({ headers })` inside a query/mutation).
+ */
+type LunoraAuth = ReturnType<typeof betterAuth>;
+/**
+ * Resolve the caller's options into the exact shape `createAuth` hands to
+ * `betterAuth` — the hardened, default-filled options the running worker uses.
+ * Exported (and pure) so the migration path can compile the schema from the
+ * same resolved options: `compileMigrationsSql` routes through here, so the
+ * `rateLimit` table the worker's durable limiter writes to is included in the
+ * migration rather than silently omitted (it would be, if migrations saw the
+ * raw options while the worker ran the resolved ones).
+ *
+ * ## What it fills (each gated independently on caller silence)
+ *
+ * Secure-by-default cookies + secret-strength warning via {@link hardenAuthOptions},
+ * applied first so all hardening composes onto one options object.
+ *
+ * Rate limiting is ON by default for `/api/auth/*`.
+ *
+ * better-auth's own default is `rateLimit.enabled ?? isProduction`, and its
+ * `isProduction` is `"production" === "production"` resolved at
+ * module-load time. On Cloudflare Workers that check is unreliable: the
+ * runtime has no Node `process.env` (absent entirely without
+ * `nodejs_compat`, and even with it `NODE_ENV` is rarely `"production"` at
+ * request time). So better-auth would silently leave auth endpoints
+ * _unthrottled_ on a real deployment — the surprise we refuse to ship.
+ *
+ * We therefore default `enabled: true` whenever the caller hasn't made an
+ * explicit choice. We only fill the `enabled` flag and otherwise forward
+ * the caller's `rateLimit` verbatim, so better-auth's `window` (10s) / `max`
+ * (100) defaults and any custom rules still apply. Callers who genuinely
+ * want it off can pass `rateLimit: { enabled: false }` (e.g. when fronting
+ * auth with their own limiter), and any explicit `enabled` value wins.
+ *
+ * We also default `storage: "database"` — but only when rate limiting is not
+ * explicitly disabled (`enabled !== false`). Filling storage under a disabled
+ * limiter is harmless at runtime but makes `getAuthTables` emit an unused
+ * `rateLimit` table, so we skip it there.
+ *
+ * better-auth's own default is `storage: "memory"` — a per-isolate,
+ * non-durable counter. On Cloudflare Workers that means each isolate keeps
+ * its own tally, counters vanish on isolate recycle, and traffic spread
+ * across isolates never sums to the configured `max` — a limiter that
+ * reports "enabled" while never enforcing a global limit (the exact
+ * brute-force / credential-stuffing protection on `/sign-in`, OTP, and
+ * password-reset it is meant to buy). `storage: "database"` rides the counter
+ * through the configured `database` adapter — Lunora's store over the D1 auth
+ * tables — so the limit is durable *and* atomic (the store's native
+ * `incrementOne` gives a one-winner guarantee across isolates). Callers with
+ * their own durable store can pass an explicit `rateLimit: { storage: … }`
+ * (or `customStorage`), and any explicit value wins.
+ *
+ * Session cookie cache is ON by default too.
+ *
+ * Every authenticated call resolves identity through better-auth's
+ * `getSession`, which — without a cache — is a DB (D1) read on the hot path
+ * of every query/mutation/action that reads `ctx.auth` and of the WebSocket
+ * upgrade. better-auth's `session.cookieCache` carries the session payload in
+ * a short-lived signed cookie so `getSession` can answer without hitting the
+ * database until the cache window elapses. We default it on with a
+ * deliberately short 60s `maxAge` (better-auth's own default is 300s): long
+ * enough to erase the per-request read for a burst of calls, short enough
+ * that a revoked or role-changed session self-corrects within a minute.
+ * The one tradeoff — a revoked session stays valid until the cache expires —
+ * is bounded by that TTL; callers who need immediate revocation opt out with
+ * `session: { cookieCache: { enabled: false } }` (or the `strict` preset).
+ *
+ * Every explicit caller value is forwarded verbatim. The two `rateLimit` fills
+ * merge into a single `rateLimit` object so neither clobbers the other.
+ */
+declare const resolveAuthOptions: (options: LunoraAuthOptions) => LunoraAuthOptions;
+/**
+ * Create the auth instance. Thin wrapper around `betterAuth` that enforces
+ * the `secret` requirement at construction time so misconfigured deployments
+ * fail loudly at the first fetch rather than the first sign-in attempt, then
+ * hands {@link resolveAuthOptions}'s hardened, default-filled options to
+ * better-auth.
+ */
+declare const createAuth: (options: LunoraAuthOptions) => LunoraAuth;
+export { LunoraAuth as L, LunoraAuthOptions as a, createAuth as c, resolveAuthOptions as r };

package/dist/packem_shared/createAuth-DRtd4q6u.mjs

@@ -0,0 +1 @@
+import{LunoraError as a}from"@lunora/errors";import{betterAuth as i}from"better-auth";import{validateSessionPolicy as l}from"./sessionPresets-DpEFjXKV.mjs";const n=32,c=e=>{const t=typeof e=="string"?e.trim().length:0;return t>0&&t<n},s=e=>typeof e=="string"?e.toLowerCase().startsWith("http://"):e&&typeof e=="object"?e.protocol==="http"?!0:e.protocol==="https"?!1:typeof e.fallback=="string"&&e.fallback.toLowerCase().startsWith("http://"):!1,h=new Set(["127.0.0.1","localhost"]),u=e=>{if(typeof e!="string")return;let t;try{t=new URL(e)}catch{return}if(!(t.protocol!=="http:"||!h.has(t.hostname)))return{allowedHosts:[t.hostname,`${t.hostname}:*`],fallback:e,protocol:"http"}},p=e=>{const t=u(e.baseURL)??e.baseURL;if(c(e.secret)){const o=`@lunora/auth: AUTH_SECRET is only ${String(e.secret?.trim().length)} characters. Use at least ${String(n)} for a brute-force-resistant secret — generate one with \`openssl rand -hex 32\`.`;if(!s(t))throw new a("INTERNAL",o);console.warn(o)}const r=e.advanced??{};return{...e,advanced:{...r,defaultCookieAttributes:r.defaultCookieAttributes??{httpOnly:!0,path:"/",sameSite:"lax"},...r.useSecureCookies===void 0?{useSecureCookies:!s(t)}:{}},baseURL:t}},d=e=>{const t=p(e),r=t.rateLimit?.enabled===void 0,o=t.rateLimit?.storage===void 0&&t.rateLimit?.enabled!==!1;return{...t,...r||o?{rateLimit:{...t.rateLimit,...r?{enabled:!0}:{},...o?{storage:"database"}:{}}}:{},...t.session?.cookieCache===void 0?{session:{...t.session,cookieCache:{enabled:!0,maxAge:60}}}:{}}},L=e=>{if(!e.secret||e.secret.trim()==="")throw new a("INTERNAL",'@lunora/auth: `secret` is required. Set AUTH_SECRET locally in .dev.vars (`lunora env set AUTH_SECRET "$(openssl rand -hex 32)"`), and in production with `wrangler secret put AUTH_SECRET`.');return e.session&&l(e.session),i(d(e))};export{L as createAuth,d as resolveAuthOptions};

package/dist/packem_shared/createDoAuthWiring-acnXUGZr.mjs

@@ -0,0 +1 @@
+import{INTERNAL_SECRET_HEADER as u,RESOLVE_SESSION_PATH as f,READ_AUDIT_PATH as w}from"./AUTH_DO_AUDIT_PATH-C4897amZ.mjs";import{DEFAULT_AUTH_BASE_PATH as A}from"./DEFAULT_AUTH_BASE_PATH-kIwlEt8i.mjs";const m=c=>{const{basePath:d=A,internalSecret:a,namespace:i,objectName:h="auth"}=c,o=()=>{if(i)return i.get(i.idFromName(h))},l=async(t,e,s)=>{if(!a)return;const n=o();if(!n)return;const r=await n.fetch(new Request(new URL(t,e),{body:JSON.stringify(s),headers:{"content-type":"application/json",[u]:a},method:"POST"}));return r.ok?r:void 0};return{auditReader:{read:async t=>{const e=await l(w,"https://auth-do.invalid",t);return e?(await e.json())?.entries??[]:[]}},authHandler:async t=>{if(new URL(t.url).pathname.startsWith(d))return o()?.fetch(t)},resolveIdentity:async t=>{if(!a)return null;const e=o();if(!e)return null;const s=new Headers(t.headers);s.set(u,a);const n=await e.fetch(new Request(new URL(f,t.url),{headers:s}));if(!n.ok)return null;const r=await n.json();return r?.userId?{userId:r.userId}:null}}};export{m as createDoAuthWiring};

package/dist/packem_shared/createLunoraAuthClient-CedinxXU.mjs

@@ -0,0 +1 @@
+import{oauthProviderClient as l}from"@better-auth/oauth-provider/client";import{passkeyClient as r}from"@better-auth/passkey/client";import{oneTapClient as p,organizationClient as h,twoFactorClient as m,magicLinkClient as C,emailOTPClient as c,adminClient as g,usernameClient as d,phoneNumberClient as L,multiSessionClient as b,anonymousClient as k,deviceAuthorizationClient as v,lastLoginMethodClient as y}from"better-auth/client/plugins";const P=(t={})=>{const n=[];return t.organization&&n.push(h()),t.twoFactor&&n.push(m()),t.passkey&&n.push(r()),t.magicLink&&n.push(C()),t.emailOtp&&n.push(c()),t.admin&&n.push(g()),t.username&&n.push(d()),t.phoneNumber&&n.push(L()),t.multiSession&&n.push(b()),t.anonymous&&n.push(k()),t.deviceAuthorization&&n.push(v()),t.lastLoginMethod&&n.push(y()),t.oauthProvider&&n.push(l()),n},z=()=>globalThis.location?.origin,w=(t,n={})=>{const{baseURL:o,extraPlugins:i=[],oneTapClientId:e,plugins:s,...a}=n,u=e===void 0||e===""?[]:[p({clientId:e})];return t({...a,baseURL:o??z(),plugins:[...P(s),...u,...i]})};export{w as createLunoraAuthClient,P as lunoraAuthPlugins};

package/dist/packem_shared/emailGateDatabaseHooks-DzBD1Qoq.mjs

@@ -0,0 +1 @@
+import{LunoraError as i}from"@lunora/errors";import{APIError as u}from"better-auth/api";import{assertEmailAllowed as E}from"../email-guard.mjs";const m=a=>{switch(a){case 400:return"BAD_REQUEST";case 422:return"UNPROCESSABLE_ENTITY";case 429:return"TOO_MANY_REQUESTS";default:return"INTERNAL_SERVER_ERROR"}},n=a=>async(s,t)=>{const r=typeof s.email=="string"?s.email:void 0;if(r===void 0||r==="")return;let o;try{o=await E(r,a)}catch(e){throw e instanceof i?new u(m(e.status),{code:e.code,message:e.message}):e}a.onClassify?.(o,s,t)},b=(a={})=>({user:{create:{before:n(a)}}}),R=(a,s={})=>{const t=n(s),r=a.databaseHooks?.user?.create?.before,o=r?async(e,c)=>(await t(e,c),r(e,c)):t;return{...a,databaseHooks:{...a.databaseHooks,user:{...a.databaseHooks?.user,create:{...a.databaseHooks?.user?.create,before:o}}}}};export{b as emailGateDatabaseHooks,R as withEmailGate};

package/dist/packem_shared/sessionPresets-DpEFjXKV.mjs

@@ -0,0 +1 @@
+const r=s=>{const o=["expiresIn","updateAge","freshAge"];for(const n of o){const e=s[n];if(e!==void 0&&(typeof e!="number"||!Number.isFinite(e)||e<0))throw new TypeError(`@lunora/auth: \`session.${n}\` must be a non-negative, finite number of seconds`)}return s},i={longLived:{cookieCache:{enabled:!0,maxAge:60},expiresIn:2592e3,freshAge:86400,updateAge:86400},rolling:{cookieCache:{enabled:!0,maxAge:60},expiresIn:604800,freshAge:86400,updateAge:86400},strict:{cookieCache:{enabled:!1},expiresIn:3600,freshAge:300,updateAge:900}};export{i as sessionPresets,r as validateSessionPolicy};

package/dist/packem_shared/uiConfig-BrYEFK3O.mjs

@@ -0,0 +1 @@
+import{createAuthEndpoint as p}from"better-auth/api";import{getAuthTables as g}from"better-auth/db";const l=i=>[...i].toSorted((o,e)=>o.localeCompare(e)),m=(i,o={})=>{const e=o.expose??{},t=new Set((i.plugins??[]).map(n=>n.id)),s=i.emailAndPassword?.enabled??!1,r=g(i),a=(i.plugins??[]).find(n=>n.id==="organization")?.options??{},d={allowUserToCreate:typeof a.allowUserToCreateOrganization=="function"?!0:a.allowUserToCreateOrganization!==!1,enabled:t.has("organization"),invitationLimit:a.invitationLimit,limit:a.organizationLimit,membershipLimit:a.membershipLimit,roles:!!r.organizationRole,teams:!!r.team};return{emailAndPassword:s,signUp:s&&i.emailAndPassword?.disableSignUp!==!0,...e.organization===!1?{}:{organization:d},...e.plugins===!1?{}:{plugins:l(t)},...e.socialProviders===!1?{}:{socialProviders:l(new Set([...Object.keys(i.socialProviders??{}),...o.extraProviders??[]]))}}},c=i=>p(i.path??"/ui-config",{metadata:{openapi:{description:"Public description of the enabled auth plugins and social providers.",responses:{200:{description:"The UI configuration."}}}},method:"GET"},o=>{const e=o;return Promise.resolve(e.json(m(e.context.options,i)))}),h=(i={})=>({endpoints:{getUiConfig:c(i)},id:"lunora-ui-config"});export{m as deriveUiConfig,h as uiConfig};

package/dist/plugins-client.d.mts

@@ -1,2 +1,69 @@
+import { organizationClient } from 'better-auth/client/plugins';
+export { adminClient, anonymousClient, customSessionClient, deviceAuthorizationClient, emailOTPClient, inferAdditionalFields, inferOrgAdditionalFields, jwtClient, lastLoginMethodClient, magicLinkClient, multiSessionClient, oneTapClient, oneTimeTokenClient, organizationClient, phoneNumberClient, siweClient, twoFactorClient, usernameClient } from 'better-auth/client/plugins';
+export { oauthProviderClient } from '@better-auth/oauth-provider/client';
 export { passkeyClient } from '@better-auth/passkey/client';
-export { adminClient, anonymousClient, customSessionClient, deviceAuthorizationClient, emailOTPClient, genericOAuthClient, inferAdditionalFields, inferOrgAdditionalFields, jwtClient, lastLoginMethodClient, magicLinkClient, multiSessionClient, oidcClient, oneTimeTokenClient, organizationClient, phoneNumberClient, siweClient, twoFactorClient, usernameClient } from 'better-auth/client/plugins';
+/**
+ * Which client plugins to include. Each defaults to `false`.
+ *
+ * These are the same names `@lunora/auth-ui` gates its cards on, so one object
+ * can drive both `createLunoraAuthClient` and `registerAuthClientPlugins` — a
+ * flow the UI can show but this cannot install would be a card that renders and
+ * then fails at call time.
+ *
+ * `oneTap` is absent on purpose: Google One Tap needs a client id, not a
+ * boolean, so it comes in through {@link CreateLunoraAuthClientOptions.oneTapClientId}.
+ */
+interface LunoraAuthPluginToggles {
+  admin?: boolean;
+  anonymous?: boolean;
+  deviceAuthorization?: boolean;
+  emailOtp?: boolean;
+  lastLoginMethod?: boolean;
+  magicLink?: boolean;
+  multiSession?: boolean;
+  oauthProvider?: boolean;
+  organization?: boolean;
+  passkey?: boolean;
+  phoneNumber?: boolean;
+  twoFactor?: boolean;
+  username?: boolean;
+}
+type LunoraAuthClientPlugin = ReturnType<typeof organizationClient>;
+declare const lunoraAuthPlugins: (toggles?: LunoraAuthPluginToggles) => LunoraAuthClientPlugin[];
+/** Options for {@link createLunoraAuthClient}; anything else is forwarded to `createAuthClient`. */
+interface CreateLunoraAuthClientOptions {
+  [option: string]: unknown;
+  /** Defaults to the current origin, which is right for a same-origin app. */
+  baseURL?: string;
+  /** Your own client plugins, appended after the standard set. */
+  extraPlugins?: LunoraAuthClientPlugin[];
+  /**
+   * Google OAuth client id. Setting it installs the One Tap client plugin —
+   * a boolean toggle can't, because the prompt is Google's and needs the id.
+   */
+  oneTapClientId?: string;
+  /** Which standard client plugins to include. */
+  plugins?: LunoraAuthPluginToggles;
+}
+/**
+ * Build a better-auth client with Lunora's standard plugin set from toggles.
+ *
+ * You pass your framework's `createAuthClient` in — `better-auth/react`,
+ * `/vue`, `/svelte`, or `/solid` — because the variant has to match the UI
+ * framework, and a helper that picked for you would either guess wrong or drag
+ * every variant into your bundle.
+ *
+ * ```ts
+ * import { createAuthClient } from "better-auth/react";
+ * import { createLunoraAuthClient } from "@lunora/auth/plugins/client";
+ *
+ * export const authClient = createLunoraAuthClient(createAuthClient, {
+ *     plugins: { organization: true, passkey: true, twoFactor: true },
+ * });
+ * ```
+ *
+ * Reach for {@link lunoraAuthPlugins} instead when you want to own the
+ * `createAuthClient` call and only borrow the plugin array.
+ */
+declare const createLunoraAuthClient: <TClient>(createAuthClient: (options: Record<string, unknown>) => TClient, options?: CreateLunoraAuthClientOptions) => TClient;
+export { type CreateLunoraAuthClientOptions, type LunoraAuthClientPlugin, type LunoraAuthPluginToggles, createLunoraAuthClient, lunoraAuthPlugins };

package/dist/plugins-client.d.ts

@@ -1,2 +1,69 @@
+import { organizationClient } from 'better-auth/client/plugins';
+export { adminClient, anonymousClient, customSessionClient, deviceAuthorizationClient, emailOTPClient, inferAdditionalFields, inferOrgAdditionalFields, jwtClient, lastLoginMethodClient, magicLinkClient, multiSessionClient, oneTapClient, oneTimeTokenClient, organizationClient, phoneNumberClient, siweClient, twoFactorClient, usernameClient } from 'better-auth/client/plugins';
+export { oauthProviderClient } from '@better-auth/oauth-provider/client';
 export { passkeyClient } from '@better-auth/passkey/client';
-export { adminClient, anonymousClient, customSessionClient, deviceAuthorizationClient, emailOTPClient, genericOAuthClient, inferAdditionalFields, inferOrgAdditionalFields, jwtClient, lastLoginMethodClient, magicLinkClient, multiSessionClient, oidcClient, oneTimeTokenClient, organizationClient, phoneNumberClient, siweClient, twoFactorClient, usernameClient } from 'better-auth/client/plugins';
+/**
+ * Which client plugins to include. Each defaults to `false`.
+ *
+ * These are the same names `@lunora/auth-ui` gates its cards on, so one object
+ * can drive both `createLunoraAuthClient` and `registerAuthClientPlugins` — a
+ * flow the UI can show but this cannot install would be a card that renders and
+ * then fails at call time.
+ *
+ * `oneTap` is absent on purpose: Google One Tap needs a client id, not a
+ * boolean, so it comes in through {@link CreateLunoraAuthClientOptions.oneTapClientId}.
+ */
+interface LunoraAuthPluginToggles {
+  admin?: boolean;
+  anonymous?: boolean;
+  deviceAuthorization?: boolean;
+  emailOtp?: boolean;
+  lastLoginMethod?: boolean;
+  magicLink?: boolean;
+  multiSession?: boolean;
+  oauthProvider?: boolean;
+  organization?: boolean;
+  passkey?: boolean;
+  phoneNumber?: boolean;
+  twoFactor?: boolean;
+  username?: boolean;
+}
+type LunoraAuthClientPlugin = ReturnType<typeof organizationClient>;
+declare const lunoraAuthPlugins: (toggles?: LunoraAuthPluginToggles) => LunoraAuthClientPlugin[];
+/** Options for {@link createLunoraAuthClient}; anything else is forwarded to `createAuthClient`. */
+interface CreateLunoraAuthClientOptions {
+  [option: string]: unknown;
+  /** Defaults to the current origin, which is right for a same-origin app. */
+  baseURL?: string;
+  /** Your own client plugins, appended after the standard set. */
+  extraPlugins?: LunoraAuthClientPlugin[];
+  /**
+   * Google OAuth client id. Setting it installs the One Tap client plugin —
+   * a boolean toggle can't, because the prompt is Google's and needs the id.
+   */
+  oneTapClientId?: string;
+  /** Which standard client plugins to include. */
+  plugins?: LunoraAuthPluginToggles;
+}
+/**
+ * Build a better-auth client with Lunora's standard plugin set from toggles.
+ *
+ * You pass your framework's `createAuthClient` in — `better-auth/react`,
+ * `/vue`, `/svelte`, or `/solid` — because the variant has to match the UI
+ * framework, and a helper that picked for you would either guess wrong or drag
+ * every variant into your bundle.
+ *
+ * ```ts
+ * import { createAuthClient } from "better-auth/react";
+ * import { createLunoraAuthClient } from "@lunora/auth/plugins/client";
+ *
+ * export const authClient = createLunoraAuthClient(createAuthClient, {
+ *     plugins: { organization: true, passkey: true, twoFactor: true },
+ * });
+ * ```
+ *
+ * Reach for {@link lunoraAuthPlugins} instead when you want to own the
+ * `createAuthClient` call and only borrow the plugin array.
+ */
+declare const createLunoraAuthClient: <TClient>(createAuthClient: (options: Record<string, unknown>) => TClient, options?: CreateLunoraAuthClientOptions) => TClient;
+export { type CreateLunoraAuthClientOptions, type LunoraAuthClientPlugin, type LunoraAuthPluginToggles, createLunoraAuthClient, lunoraAuthPlugins };

package/dist/plugins-client.mjs

@@ -1,2 +1 @@
-export { passkeyClient } from '@better-auth/passkey/client';
-export { adminClient, anonymousClient, customSessionClient, deviceAuthorizationClient, emailOTPClient, genericOAuthClient, inferAdditionalFields, inferOrgAdditionalFields, jwtClient, lastLoginMethodClient, magicLinkClient, multiSessionClient, oidcClient, oneTimeTokenClient, organizationClient, phoneNumberClient, siweClient, twoFactorClient, usernameClient } from 'better-auth/client/plugins';
+import{createLunoraAuthClient as n,lunoraAuthPlugins as t}from"./packem_shared/createLunoraAuthClient-CedinxXU.mjs";import{oauthProviderClient as l}from"@better-auth/oauth-provider/client";import{passkeyClient as C}from"@better-auth/passkey/client";import{adminClient as s,anonymousClient as m,customSessionClient as u,deviceAuthorizationClient as d,emailOTPClient as p,inferAdditionalFields as f,inferOrgAdditionalFields as h,jwtClient as c,lastLoginMethodClient as g,magicLinkClient as A,multiSessionClient as x,oneTapClient as T,oneTimeTokenClient as k,organizationClient as w,phoneNumberClient as F,siweClient as L,twoFactorClient as P,usernameClient as v}from"better-auth/client/plugins";export{s as adminClient,m as anonymousClient,n as createLunoraAuthClient,u as customSessionClient,d as deviceAuthorizationClient,p as emailOTPClient,f as inferAdditionalFields,h as inferOrgAdditionalFields,c as jwtClient,g as lastLoginMethodClient,t as lunoraAuthPlugins,A as magicLinkClient,x as multiSessionClient,l as oauthProviderClient,T as oneTapClient,k as oneTimeTokenClient,w as organizationClient,C as passkeyClient,F as phoneNumberClient,L as siweClient,P as twoFactorClient,v as usernameClient};

package/dist/plugins-enterprise-client.d.mts

@@ -0,0 +1,9 @@
+import { ssoClient } from '@better-auth/sso/client';
+export type { ssoClient } from '@better-auth/sso/client';
+/**
+ * The plugin instance `ssoClient()` returns. Exported so an app can type the array it
+ * passes to `createAuthClient` when it assembles plugins conditionally.
+ * @experimental
+ */
+type SSOClientPlugin = ReturnType<typeof ssoClient>;
+export { SSOClientPlugin };

package/dist/plugins-enterprise-client.d.ts

@@ -0,0 +1,9 @@
+import { ssoClient } from '@better-auth/sso/client';
+export type { ssoClient } from '@better-auth/sso/client';
+/**
+ * The plugin instance `ssoClient()` returns. Exported so an app can type the array it
+ * passes to `createAuthClient` when it assembles plugins conditionally.
+ * @experimental
+ */
+type SSOClientPlugin = ReturnType<typeof ssoClient>;
+export { SSOClientPlugin };

package/dist/plugins-enterprise-client.mjs

@@ -0,0 +1 @@
+import{ssoClient as r}from"@better-auth/sso/client";export{r as ssoClient};