@lunora/auth 1.0.0-alpha.84 → 1.0.0-alpha.86

package/dist/plugins-enterprise.d.mts

@@ -1525,7 +1525,7 @@ declare const initiateSLO: (options?: SSOOptions) => import("better-call").Stric
 declare module "@better-auth/core" {
   interface BetterAuthPluginRegistry<AuthOptions, Options> {
     sso: {
-      creator: typeof sso;
+      creator: typeof sso$1;
     };
   }
 }
@@ -1547,7 +1547,7 @@ type SSOEndpoints<O extends SSOOptions> = {
   updateSSOProvider: ReturnType<typeof updateSSOProvider>;
   deleteSSOProvider: ReturnType<typeof deleteSSOProvider>;
 };
-declare function sso<O extends SSOOptions & {
+declare function sso$1<O extends SSOOptions & {
   domainVerification?: {
     enabled: true;
   };
@@ -1561,7 +1561,7 @@ declare function sso<O extends SSOOptions & {
   };
   options: NoInfer<O>;
 };
-declare function sso<O extends SSOOptions>(options?: O | undefined): {
+declare function sso$1<O extends SSOOptions>(options?: O | undefined): {
   id: "sso";
   version: string;
   endpoints: SSOEndpoints<O>;
@@ -1571,14 +1571,6 @@ declare function sso<O extends SSOOptions>(options?: O | undefined): {
   };
   options: NoInfer<O>;
 };
-export {
-/**
- * The OIDC provider configuration accepted by `registerSSOProvider` — exported so a
- * caller can type the config it builds (from env, a tenant record, …) before handing it
- * over.
- * @experimental
- */
-type OIDCConfig,
 /**
  * Enterprise SSO — OIDC / OAuth2 / SAML 2.0 providers registered per email domain or
  * per organization, with `provisionUser` / `organizationProvisioning` hooks for
@@ -1587,10 +1579,21 @@ type OIDCConfig,
  * Two defaults are worth setting deliberately, both documented on the package's docs
  * page: `domainVerification` is **off**, so an unverified `domain` still routes
  * sign-in; and `/sso/register` is session-only, so any signed-in user may register a
- * provider unless you narrow `providersLimit`.
+ * provider unless you narrow `providersLimit`. This wrapper does not change either
+ * default — it only warns once, at construction, when `domainVerification` is not
+ * explicitly enabled, naming both exposures. Every option is forwarded to
+ * `@better-auth/sso` untouched.
  *
  * SAML loads on workerd but its assertion-verify path (pure-JS RSA) has not been
  * measured against a Worker CPU budget — treat OIDC/OAuth2 as the supported mode.
  * @experimental
  */
-sso };
+declare const sso: typeof sso$1;
+export {
+/**
+ * The OIDC provider configuration accepted by `registerSSOProvider` — exported so a
+ * caller can type the config it builds (from env, a tenant record, …) before handing it
+ * over.
+ * @experimental
+ */
+type OIDCConfig, sso };

package/dist/plugins-enterprise.d.ts

@@ -1525,7 +1525,7 @@ declare const initiateSLO: (options?: SSOOptions) => import("better-call").Stric
 declare module "@better-auth/core" {
   interface BetterAuthPluginRegistry<AuthOptions, Options> {
     sso: {
-      creator: typeof sso;
+      creator: typeof sso$1;
     };
   }
 }
@@ -1547,7 +1547,7 @@ type SSOEndpoints<O extends SSOOptions> = {
   updateSSOProvider: ReturnType<typeof updateSSOProvider>;
   deleteSSOProvider: ReturnType<typeof deleteSSOProvider>;
 };
-declare function sso<O extends SSOOptions & {
+declare function sso$1<O extends SSOOptions & {
   domainVerification?: {
     enabled: true;
   };
@@ -1561,7 +1561,7 @@ declare function sso<O extends SSOOptions & {
   };
   options: NoInfer<O>;
 };
-declare function sso<O extends SSOOptions>(options?: O | undefined): {
+declare function sso$1<O extends SSOOptions>(options?: O | undefined): {
   id: "sso";
   version: string;
   endpoints: SSOEndpoints<O>;
@@ -1571,14 +1571,6 @@ declare function sso<O extends SSOOptions>(options?: O | undefined): {
   };
   options: NoInfer<O>;
 };
-export {
-/**
- * The OIDC provider configuration accepted by `registerSSOProvider` — exported so a
- * caller can type the config it builds (from env, a tenant record, …) before handing it
- * over.
- * @experimental
- */
-type OIDCConfig,
 /**
  * Enterprise SSO — OIDC / OAuth2 / SAML 2.0 providers registered per email domain or
  * per organization, with `provisionUser` / `organizationProvisioning` hooks for
@@ -1587,10 +1579,21 @@ type OIDCConfig,
  * Two defaults are worth setting deliberately, both documented on the package's docs
  * page: `domainVerification` is **off**, so an unverified `domain` still routes
  * sign-in; and `/sso/register` is session-only, so any signed-in user may register a
- * provider unless you narrow `providersLimit`.
+ * provider unless you narrow `providersLimit`. This wrapper does not change either
+ * default — it only warns once, at construction, when `domainVerification` is not
+ * explicitly enabled, naming both exposures. Every option is forwarded to
+ * `@better-auth/sso` untouched.
  *
  * SAML loads on workerd but its assertion-verify path (pure-JS RSA) has not been
  * measured against a Worker CPU budget — treat OIDC/OAuth2 as the supported mode.
  * @experimental
  */
-sso };
+declare const sso: typeof sso$1;
+export {
+/**
+ * The OIDC provider configuration accepted by `registerSSOProvider` — exported so a
+ * caller can type the config it builds (from env, a tenant record, …) before handing it
+ * over.
+ * @experimental
+ */
+type OIDCConfig, sso };

package/dist/plugins-enterprise.mjs

@@ -1 +1 @@
-import{sso as s}from"@better-auth/sso";export{s as sso};
+import{sso as o}from"@better-auth/sso";const n=i=>{i?.domainVerification?.enabled!==!0&&console.warn("@lunora/auth: sso() is installed without `domainVerification: { enabled: true }` — an unverified `domain` still routes sign-in, so any signed-in user can register an identity provider for a domain they do not own. `/sso/register` is also session-only; narrow `providersLimit` if you keep verification off. Pass `domainVerification: { enabled: true }` once your deployment can prove domain ownership.")},r=(i=>(n(i),o(i)));export{r as sso};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/auth",
-  "version": "1.0.0-alpha.84",
+  "version": "1.0.0-alpha.86",
   "description": "Auth for Lunora — a thin better-auth wrapper: email/password, OAuth, plugins, D1-backed",
   "keywords": [
     "auth",
@@ -103,7 +103,7 @@
     "@better-auth/passkey": "1.7.0-rc.2",
     "@better-auth/scim": "1.7.0-rc.2",
     "@lunora/errors": "1.0.0-alpha.22",
-    "@lunora/server": "1.0.0-alpha.76",
+    "@lunora/server": "1.0.0-alpha.78",
     "@lunora/values": "1.0.0-alpha.27",
     "@visulima/disposable-email-domains": "1.1.0",
     "@visulima/email-verifier": "1.0.2",