@masheev/better-auth 0.0.0-stage → 1.7.5

package/dist/db/revoke-unproven-account-access.d.mts

@@ -0,0 +1,21 @@
+import { User } from "../types/models.mjs";
+import { GenericEndpointContext } from "@better-auth/core";
+
+//#region src/db/revoke-unproven-account-access.d.ts
+/**
+ * Strip every account link and session a pre-existing account accrued before
+ * control of its email was proven.
+ *
+ * An `emailVerified: false` row carries no proof that linked access belongs
+ * to the mailbox owner. When an email-primary proof (magic link, email OTP)
+ * resolves to such a row, deleting accounts and revoking standing sessions
+ * makes the verified owner inherit no password, OAuth link, or session that
+ * predates the proof. This helper also flips `emailVerified` after cleanup and
+ * returns the current user for the caller to use when minting the owner's
+ * session.
+ *
+ * @param userId - The pre-existing, not-yet-verified user being promoted.
+ */
+declare function revokeUnprovenAccountAccess(ctx: GenericEndpointContext, userId: string): Promise<User | null>;
+//#endregion
+export { revokeUnprovenAccountAccess };

package/dist/db/revoke-unproven-account-access.mjs

@@ -0,0 +1,58 @@
+import { BetterAuthError } from "@better-auth/core/error";
+//#region src/db/revoke-unproven-account-access.ts
+const cleanupLockExpiresInMs = 5e3;
+const cleanupLockWaitMs = 2e3;
+const cleanupLockPollMs = 250;
+const cleanupLockIdentifier = (userId) => `revoke-unproven-account-access:${userId}`;
+async function waitForCleanupLock(ctx, identifier) {
+	const deadline = Date.now() + cleanupLockWaitMs;
+	while (Date.now() < deadline) {
+		const lock = await ctx.context.internalAdapter.findVerificationValue(identifier);
+		if (!lock) return;
+		if (lock.expiresAt <= /* @__PURE__ */ new Date()) {
+			await ctx.context.internalAdapter.deleteVerificationByIdentifier(identifier);
+			return;
+		}
+		await new Promise((resolve) => setTimeout(resolve, cleanupLockPollMs));
+	}
+}
+/**
+* Strip every account link and session a pre-existing account accrued before
+* control of its email was proven.
+*
+* An `emailVerified: false` row carries no proof that linked access belongs
+* to the mailbox owner. When an email-primary proof (magic link, email OTP)
+* resolves to such a row, deleting accounts and revoking standing sessions
+* makes the verified owner inherit no password, OAuth link, or session that
+* predates the proof. This helper also flips `emailVerified` after cleanup and
+* returns the current user for the caller to use when minting the owner's
+* session.
+*
+* @param userId - The pre-existing, not-yet-verified user being promoted.
+*/
+async function revokeUnprovenAccountAccess(ctx, userId) {
+	const lockIdentifier = cleanupLockIdentifier(userId);
+	if (!await ctx.context.internalAdapter.reserveVerificationValue({
+		identifier: lockIdentifier,
+		value: userId,
+		expiresAt: new Date(Date.now() + cleanupLockExpiresInMs)
+	}).catch((error) => {
+		if (error instanceof BetterAuthError && error.message.includes("requires database-backed verification storage")) return true;
+		throw error;
+	})) {
+		await waitForCleanupLock(ctx, lockIdentifier);
+		return ctx.context.internalAdapter.findUserById(userId);
+	}
+	try {
+		const user = await ctx.context.internalAdapter.findUserById(userId);
+		if (!user || user.emailVerified) return user;
+		const accounts = await ctx.context.internalAdapter.findAccounts(userId);
+		for (const account of accounts) await ctx.context.internalAdapter.deleteAccount(account.id);
+		await ctx.context.internalAdapter.deleteUserSessions(userId);
+		return await ctx.context.internalAdapter.updateUser(userId, { emailVerified: true });
+	} finally {
+		await ctx.context.internalAdapter.deleteVerificationByIdentifier(lockIdentifier).catch(() => {});
+	}
+}
+//#endregion
+export { revokeUnprovenAccountAccess };

package/dist/db/schema.d.mts

@@ -0,0 +1,62 @@
+import { Account, Session as Session$1, User as User$1 } from "../types/models.mjs";
+import { BetterAuthOptions } from "@better-auth/core";
+import { BetterAuthPluginDBSchema, DBFieldAttribute } from "@better-auth/core/db";
+
+//#region src/db/schema.d.ts
+declare function parseUserOutput<T extends User$1>(options: BetterAuthOptions, user: T): T;
+/**
+ * Builds a synthetic user object that matches the shape of a real user
+ * returned from the database. This ensures enumeration protection works
+ * correctly by making synthetic and real user responses indistinguishable.
+ *
+ * The function iterates over the user output schema and:
+ * - Includes all fields that should be returned (returned !== false)
+ * - Uses provided values when available
+ * - Sets optional fields to null when no value is provided
+ * - Applies default values where defined
+ * - Always includes the 'id' field (not part of schema but always present)
+ */
+declare function buildSyntheticUserOutput(options: BetterAuthOptions, data: Record<string, unknown>): Record<string, unknown>;
+declare function parseSessionOutput<T extends Session$1>(options: BetterAuthOptions, session: T): T;
+declare function parseAccountOutput<T extends Account>(options: BetterAuthOptions, account: T): Omit<T, "idToken" | "accessToken" | "refreshToken" | "accessTokenExpiresAt" | "refreshTokenExpiresAt" | "password">;
+declare function parseInputData<T extends Record<string, any>>(data: T, schema: {
+  fields: Record<string, DBFieldAttribute>;
+  action?: ("create" | "update") | undefined;
+}): Partial<T>;
+declare function parseUserInput(options: BetterAuthOptions, user: Record<string, any> | undefined, action: "create" | "update"): Partial<Record<string, any>>;
+declare function parseAdditionalUserInputFromProviderProfile(options: BetterAuthOptions, profile: Record<string, unknown> | undefined, action: "create" | "update"): Partial<Record<string, unknown>>;
+declare function parseAdditionalUserInput(options: BetterAuthOptions, user?: Record<string, any> | undefined): Partial<Record<string, any>>;
+declare function parseAccountInput(options: BetterAuthOptions, account: Partial<Account>): Partial<Partial<{
+  id: string;
+  createdAt: Date;
+  updatedAt: Date;
+  providerId: string;
+  accountId: string;
+  userId: string;
+  accessToken?: string | null | undefined;
+  refreshToken?: string | null | undefined;
+  idToken?: string | null | undefined;
+  accessTokenExpiresAt?: Date | null | undefined;
+  refreshTokenExpiresAt?: Date | null | undefined;
+  scope?: string | null | undefined;
+  password?: string | null | undefined;
+}>>;
+declare function parseSessionInput(options: BetterAuthOptions, session: Partial<Session$1>, action?: "create" | "update"): Partial<Partial<{
+  id: string;
+  createdAt: Date;
+  updatedAt: Date;
+  userId: string;
+  expiresAt: Date;
+  token: string;
+  ipAddress?: string | null | undefined;
+  userAgent?: string | null | undefined;
+}>>;
+declare function getSessionDefaultFields(options: BetterAuthOptions): Record<string, any>;
+declare function mergeSchema<S extends BetterAuthPluginDBSchema>(schema: S, newSchema?: { [K in keyof S]?: {
+  modelName?: string | undefined;
+  fields?: {
+    [P: string]: string;
+  } | undefined;
+} | undefined } | undefined): S;
+//#endregion
+export { buildSyntheticUserOutput, getSessionDefaultFields, mergeSchema, parseAccountInput, parseAccountOutput, parseAdditionalUserInput, parseAdditionalUserInputFromProviderProfile, parseInputData, parseSessionInput, parseSessionOutput, parseUserInput, parseUserOutput };

package/dist/db/schema.mjs

@@ -0,0 +1,161 @@
+import { getAuthTables } from "@better-auth/core/db";
+import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
+import { filterOutputFields } from "@better-auth/core/utils/db";
+//#region src/db/schema.ts
+const cache = /* @__PURE__ */ new WeakMap();
+function getFields(options, modelName, mode) {
+	const cacheKey = `${modelName}:${mode}`;
+	if (!cache.has(options)) cache.set(options, /* @__PURE__ */ new Map());
+	const tableCache = cache.get(options);
+	if (tableCache.has(cacheKey)) return tableCache.get(cacheKey);
+	const coreSchema = mode === "output" ? getAuthTables(options)[modelName]?.fields ?? {} : {};
+	const additionalFields = modelName === "user" || modelName === "session" || modelName === "account" ? options[modelName]?.additionalFields : void 0;
+	let schema = {
+		...coreSchema,
+		...additionalFields ?? {}
+	};
+	for (const plugin of options.plugins || []) if (plugin.schema && plugin.schema[modelName]) schema = {
+		...schema,
+		...plugin.schema[modelName].fields
+	};
+	tableCache.set(cacheKey, schema);
+	return schema;
+}
+function parseUserOutput(options, user) {
+	return filterOutputFields(user, getFields(options, "user", "output"));
+}
+/**
+* Builds a synthetic user object that matches the shape of a real user
+* returned from the database. This ensures enumeration protection works
+* correctly by making synthetic and real user responses indistinguishable.
+*
+* The function iterates over the user output schema and:
+* - Includes all fields that should be returned (returned !== false)
+* - Uses provided values when available
+* - Sets optional fields to null when no value is provided
+* - Applies default values where defined
+* - Always includes the 'id' field (not part of schema but always present)
+*/
+function buildSyntheticUserOutput(options, data) {
+	const schema = getFields(options, "user", "output");
+	const result = {};
+	for (const key in schema) {
+		const fieldAttr = schema[key];
+		if (fieldAttr.returned === false) continue;
+		if (key in data && data[key] !== void 0) result[key] = data[key];
+		else if (fieldAttr.defaultValue !== void 0) result[key] = typeof fieldAttr.defaultValue === "function" ? fieldAttr.defaultValue() : fieldAttr.defaultValue;
+		else if (!fieldAttr.required) result[key] = null;
+	}
+	if ("id" in data) result.id = data.id;
+	return result;
+}
+function parseSessionOutput(options, session) {
+	return filterOutputFields(session, getFields(options, "session", "output"));
+}
+function parseAccountOutput(options, account) {
+	const { accessToken: _accessToken, refreshToken: _refreshToken, idToken: _idToken, accessTokenExpiresAt: _accessTokenExpiresAt, refreshTokenExpiresAt: _refreshTokenExpiresAt, password: _password, ...rest } = filterOutputFields(account, getFields(options, "account", "output"));
+	return rest;
+}
+function parseInputData(data, schema) {
+	const action = schema.action || "create";
+	const fields = schema.fields;
+	const parsedData = Object.create(null);
+	for (const key in fields) {
+		if (key in data) {
+			if (fields[key].input === false) {
+				if (fields[key].defaultValue !== void 0) {
+					if (action !== "update") {
+						parsedData[key] = fields[key].defaultValue;
+						continue;
+					}
+				}
+				if (data[key]) throw APIError.from("BAD_REQUEST", {
+					...BASE_ERROR_CODES.FIELD_NOT_ALLOWED,
+					message: `${key} is not allowed to be set`
+				});
+				continue;
+			}
+			if (fields[key].validator?.input && data[key] !== void 0) {
+				const result = fields[key].validator.input["~standard"].validate(data[key]);
+				if (result instanceof Promise) throw APIError.from("INTERNAL_SERVER_ERROR", BASE_ERROR_CODES.ASYNC_VALIDATION_NOT_SUPPORTED);
+				if ("issues" in result && result.issues) throw APIError.from("BAD_REQUEST", {
+					...BASE_ERROR_CODES.VALIDATION_ERROR,
+					message: result.issues[0]?.message || "Validation Error"
+				});
+				parsedData[key] = result.value;
+				continue;
+			}
+			if (fields[key].transform?.input && data[key] !== void 0) {
+				parsedData[key] = fields[key].transform?.input(data[key]);
+				continue;
+			}
+			parsedData[key] = data[key];
+			continue;
+		}
+		if (fields[key].defaultValue !== void 0 && action === "create") {
+			if (typeof fields[key].defaultValue === "function") {
+				parsedData[key] = fields[key].defaultValue();
+				continue;
+			}
+			parsedData[key] = fields[key].defaultValue;
+			continue;
+		}
+		if (fields[key].required && action === "create") throw APIError.from("BAD_REQUEST", {
+			...BASE_ERROR_CODES.MISSING_FIELD,
+			message: `${key} is required`
+		});
+	}
+	return parsedData;
+}
+function parseUserInput(options, user = {}, action) {
+	return parseInputData(user, {
+		fields: getFields(options, "user", "input"),
+		action
+	});
+}
+function parseAdditionalUserInputFromProviderProfile(options, profile = {}, action) {
+	const schema = getFields(options, "user", "input");
+	const allowedProfileFields = Object.create(null);
+	for (const key of Object.keys(profile)) {
+		if (schema[key]?.input === false) continue;
+		allowedProfileFields[key] = profile[key];
+	}
+	return parseInputData(allowedProfileFields, {
+		fields: schema,
+		action
+	});
+}
+function parseAdditionalUserInput(options, user) {
+	const schema = getFields(options, "user", "input");
+	return parseInputData(user || {}, { fields: schema });
+}
+function parseAccountInput(options, account) {
+	return parseInputData(account, { fields: getFields(options, "account", "input") });
+}
+function parseSessionInput(options, session, action) {
+	return parseInputData(session, {
+		fields: getFields(options, "session", "input"),
+		action
+	});
+}
+function getSessionDefaultFields(options) {
+	const fields = getFields(options, "session", "input");
+	const defaults = {};
+	for (const key in fields) if (fields[key].defaultValue !== void 0) defaults[key] = typeof fields[key].defaultValue === "function" ? fields[key].defaultValue() : fields[key].defaultValue;
+	return defaults;
+}
+function mergeSchema(schema, newSchema) {
+	if (!newSchema) return schema;
+	for (const table in newSchema) {
+		const newModelName = newSchema[table]?.modelName;
+		if (newModelName) schema[table].modelName = newModelName;
+		for (const field in schema[table].fields) {
+			const newField = newSchema[table]?.fields?.[field];
+			if (!newField) continue;
+			schema[table].fields[field].fieldName = newField;
+		}
+	}
+	return schema;
+}
+//#endregion
+export { buildSyntheticUserOutput, getSessionDefaultFields, mergeSchema, parseAccountInput, parseAccountOutput, parseAdditionalUserInput, parseAdditionalUserInputFromProviderProfile, parseInputData, parseSessionInput, parseSessionOutput, parseUserInput, parseUserOutput };

package/dist/db/to-zod.d.mts

@@ -0,0 +1,35 @@
+import { DBFieldAttribute } from "@better-auth/core/db";
+import * as z from "zod";
+
+//#region src/db/to-zod.d.ts
+declare function toZodSchema<Fields extends Record<string, DBFieldAttribute | never>, IsClientSide extends boolean>({
+  fields,
+  isClientSide
+}: {
+  fields: Fields;
+  /**
+   * If true, then any fields that have `input: false` will be removed from the schema to prevent user input.
+   */
+  isClientSide: IsClientSide;
+}): z.ZodObject<RemoveNeverProps<{ [key in keyof Fields]: FieldAttributeToSchema<Fields[key], IsClientSide> }>, z.core.$strip>;
+type FieldAttributeToSchema<Field extends DBFieldAttribute | Record<string, never>, isClientSide extends boolean = false> = Field extends {
+  type: any;
+} ? GetInput<isClientSide, Field, GetRequired<Field, GetType<Field>>> : Record<string, never>;
+type GetType<F extends DBFieldAttribute> = F extends {
+  type: "string";
+} ? z.ZodString : F extends {
+  type: "number";
+} ? z.ZodNumber : F extends {
+  type: "boolean";
+} ? z.ZodBoolean : F extends {
+  type: "date";
+} ? z.ZodDate : z.ZodAny;
+type GetRequired<F extends DBFieldAttribute, Schema extends z.core.SomeType> = F extends {
+  required: false;
+} ? z.ZodOptional<z.ZodNullable<Schema>> : Schema;
+type GetInput<isClientSide extends boolean, Field extends DBFieldAttribute, Schema extends z.core.SomeType> = Field extends {
+  input: false;
+} ? isClientSide extends true ? never : Schema : Schema;
+type RemoveNeverProps<T> = { [K in keyof T as [T[K]] extends [never] ? never : K]: T[K] };
+//#endregion
+export { FieldAttributeToSchema, toZodSchema };

package/dist/db/to-zod.mjs

@@ -0,0 +1,23 @@
+import * as z from "zod";
+//#region src/db/to-zod.ts
+function toZodSchema({ fields, isClientSide }) {
+	const zodFields = Object.keys(fields).reduce((acc, key) => {
+		const field = fields[key];
+		if (!field) return acc;
+		if (isClientSide && field.input === false) return acc;
+		let schema;
+		if (field.type === "json") schema = z.json ? z.json() : z.any();
+		else if (field.type === "string[]" || field.type === "number[]") schema = z.array(field.type === "string[]" ? z.string() : z.number());
+		else if (Array.isArray(field.type)) schema = z.any();
+		else schema = z[field.type]();
+		if (field?.required === false) schema = schema.nullish();
+		if (!isClientSide && field?.returned === false) return acc;
+		return {
+			...acc,
+			[key]: schema
+		};
+	}, {});
+	return z.object(zodFields);
+}
+//#endregion
+export { toZodSchema };

package/dist/db/verification-token-storage.mjs

@@ -0,0 +1,25 @@
+import { base64Url } from "@better-auth/utils/base64";
+import { createHash } from "@better-auth/utils/hash";
+//#region src/db/verification-token-storage.ts
+const defaultKeyHasher = async (identifier) => {
+	const hash = await createHash("SHA-256").digest(new TextEncoder().encode(identifier));
+	return base64Url.encode(new Uint8Array(hash), { padding: false });
+};
+async function processIdentifier(identifier, option) {
+	if (!option || option === "plain") return identifier;
+	if (option === "hashed") return defaultKeyHasher(identifier);
+	if (typeof option === "object" && "hash" in option) return option.hash(identifier);
+	return identifier;
+}
+function getStorageOption(identifier, config) {
+	if (!config) return;
+	if (typeof config === "object" && "default" in config) {
+		if (config.overrides) {
+			for (const [prefix, option] of Object.entries(config.overrides)) if (identifier.startsWith(prefix)) return option;
+		}
+		return config.default;
+	}
+	return config;
+}
+//#endregion
+export { getStorageOption, processIdentifier };

package/dist/db/with-hooks.d.mts

@@ -0,0 +1,37 @@
+import { BetterAuthOptions } from "@better-auth/core";
+import { BaseModelNames } from "@better-auth/core/db";
+import { DBAdapter, Where } from "@better-auth/core/db/adapter";
+
+//#region src/db/with-hooks.d.ts
+type DatabaseHooksEntry = {
+  source: string;
+  hooks: Exclude<BetterAuthOptions["databaseHooks"], undefined>;
+};
+declare function getWithHooks(adapter: DBAdapter<BetterAuthOptions>, ctx: {
+  options: BetterAuthOptions;
+  hooks: DatabaseHooksEntry[];
+}): {
+  createWithHooks: <T extends Record<string, any>>(data: T, model: BaseModelNames, customCreateFn?: {
+    fn: (data: Record<string, any>) => void | Promise<any>;
+    executeMainFn?: boolean;
+  } | undefined) => Promise<any>;
+  updateWithHooks: <T extends Record<string, any>>(data: any, where: Where[], model: BaseModelNames, customUpdateFn?: {
+    fn: (data: Record<string, any>) => void | Promise<any>;
+    executeMainFn?: boolean;
+  } | undefined) => Promise<any>;
+  updateManyWithHooks: <_T extends Record<string, any>>(data: any, where: Where[], model: BaseModelNames, customUpdateFn?: {
+    fn: (data: Record<string, any>) => void | Promise<any>;
+    executeMainFn?: boolean;
+  } | undefined) => Promise<any>;
+  deleteWithHooks: <T extends Record<string, any>>(where: Where[], model: BaseModelNames, customDeleteFn?: {
+    fn: (where: Where[]) => void | Promise<any>;
+    executeMainFn?: boolean;
+  } | undefined) => Promise<any>;
+  deleteManyWithHooks: <T extends Record<string, any>>(where: Where[], model: BaseModelNames, customDeleteFn?: {
+    fn: (where: Where[]) => void | Promise<any>;
+    executeMainFn?: boolean;
+  } | undefined) => Promise<any>;
+  consumeOneWithHooks: <T extends Record<string, any>>(model: BaseModelNames, hookWhere: Where[], consumeFn: () => Promise<T | null>, preSnapshot?: T | null) => Promise<T | null>;
+};
+//#endregion
+export { DatabaseHooksEntry, getWithHooks };

package/dist/db/with-hooks.mjs

@@ -0,0 +1,255 @@
+import { getCurrentAdapter, queueAfterTransactionHook, tryGetCurrentAuthEndpointContext } from "@better-auth/core/context";
+import { ATTR_CONTEXT, ATTR_DB_COLLECTION_NAME, ATTR_HOOK_TYPE, createWithSpan } from "@better-auth/core/instrumentation";
+//#region src/db/with-hooks.ts
+function getWithHooks(adapter, ctx) {
+	const withSpan = createWithSpan(ctx.options);
+	const hooksEntries = ctx.hooks;
+	async function createWithHooks(data, model, customCreateFn) {
+		const context = tryGetCurrentAuthEndpointContext();
+		let actualData = data;
+		for (const { source, hooks } of hooksEntries) {
+			const toRun = hooks[model]?.create?.before;
+			if (toRun) {
+				const result = await withSpan(`db create.before ${model}`, {
+					[ATTR_HOOK_TYPE]: "create.before",
+					[ATTR_DB_COLLECTION_NAME]: model,
+					[ATTR_CONTEXT]: source
+				}, () => toRun(actualData, context));
+				if (result === false) return null;
+				if (typeof result === "object" && "data" in result) actualData = {
+					...actualData,
+					...result.data
+				};
+			}
+		}
+		let created = null;
+		if (!customCreateFn || customCreateFn.executeMainFn) created = await (await getCurrentAdapter(adapter)).create({
+			model,
+			data: actualData,
+			forceAllowId: true
+		});
+		if (customCreateFn?.fn) created = await customCreateFn.fn(created ?? actualData);
+		for (const { source, hooks } of hooksEntries) {
+			const toRun = hooks[model]?.create?.after;
+			if (toRun) await queueAfterTransactionHook(async () => {
+				await withSpan(`db create.after ${model}`, {
+					[ATTR_HOOK_TYPE]: "create.after",
+					[ATTR_DB_COLLECTION_NAME]: model,
+					[ATTR_CONTEXT]: source
+				}, () => toRun(created, context));
+			});
+		}
+		return created;
+	}
+	async function updateWithHooks(data, where, model, customUpdateFn) {
+		const context = tryGetCurrentAuthEndpointContext();
+		let actualData = data;
+		for (const { source, hooks } of hooksEntries) {
+			const toRun = hooks[model]?.update?.before;
+			if (toRun) {
+				const result = await withSpan(`db update.before ${model}`, {
+					[ATTR_HOOK_TYPE]: "update.before",
+					[ATTR_DB_COLLECTION_NAME]: model,
+					[ATTR_CONTEXT]: source
+				}, () => toRun(data, context));
+				if (result === false) return null;
+				if (typeof result === "object" && "data" in result) actualData = {
+					...actualData,
+					...result.data
+				};
+			}
+		}
+		const customUpdated = customUpdateFn ? await customUpdateFn.fn(actualData) : null;
+		const updated = !customUpdateFn || customUpdateFn.executeMainFn ? await (await getCurrentAdapter(adapter)).update({
+			model,
+			update: actualData,
+			where
+		}) : customUpdated;
+		for (const { source, hooks } of hooksEntries) {
+			const toRun = hooks[model]?.update?.after;
+			if (toRun) await queueAfterTransactionHook(async () => {
+				await withSpan(`db update.after ${model}`, {
+					[ATTR_HOOK_TYPE]: "update.after",
+					[ATTR_DB_COLLECTION_NAME]: model,
+					[ATTR_CONTEXT]: source
+				}, () => toRun(updated, context));
+			});
+		}
+		return updated;
+	}
+	async function updateManyWithHooks(data, where, model, customUpdateFn) {
+		const context = tryGetCurrentAuthEndpointContext();
+		let actualData = data;
+		for (const { source, hooks } of hooksEntries) {
+			const toRun = hooks[model]?.update?.before;
+			if (toRun) {
+				const result = await withSpan(`db updateMany.before ${model}`, {
+					[ATTR_HOOK_TYPE]: "updateMany.before",
+					[ATTR_DB_COLLECTION_NAME]: model,
+					[ATTR_CONTEXT]: source
+				}, () => toRun(data, context));
+				if (result === false) return null;
+				if (typeof result === "object" && "data" in result) actualData = {
+					...actualData,
+					...result.data
+				};
+			}
+		}
+		const customUpdated = customUpdateFn ? await customUpdateFn.fn(actualData) : null;
+		const updated = !customUpdateFn || customUpdateFn.executeMainFn ? await (await getCurrentAdapter(adapter)).updateMany({
+			model,
+			update: actualData,
+			where
+		}) : customUpdated;
+		for (const { source, hooks } of hooksEntries) {
+			const toRun = hooks[model]?.update?.after;
+			if (toRun) await queueAfterTransactionHook(async () => {
+				await withSpan(`db updateMany.after ${model}`, {
+					[ATTR_HOOK_TYPE]: "updateMany.after",
+					[ATTR_DB_COLLECTION_NAME]: model,
+					[ATTR_CONTEXT]: source
+				}, () => toRun(updated, context));
+			});
+		}
+		return updated;
+	}
+	async function deleteWithHooks(where, model, customDeleteFn) {
+		const context = tryGetCurrentAuthEndpointContext();
+		let entityToDelete = null;
+		try {
+			entityToDelete = (await (await getCurrentAdapter(adapter)).findMany({
+				model,
+				where,
+				limit: 1
+			}))[0] || null;
+		} catch {}
+		if (entityToDelete) for (const { source, hooks } of hooksEntries) {
+			const toRun = hooks[model]?.delete?.before;
+			if (toRun) {
+				if (await withSpan(`db delete.before ${model}`, {
+					[ATTR_HOOK_TYPE]: "delete.before",
+					[ATTR_DB_COLLECTION_NAME]: model,
+					[ATTR_CONTEXT]: source
+				}, () => toRun(entityToDelete, context)) === false) return null;
+			}
+		}
+		const customDeleted = customDeleteFn ? await customDeleteFn.fn(where) : null;
+		const deleted = (!customDeleteFn || customDeleteFn.executeMainFn) && entityToDelete ? await (await getCurrentAdapter(adapter)).delete({
+			model,
+			where
+		}) : customDeleted;
+		if (entityToDelete) for (const { source, hooks } of hooksEntries) {
+			const toRun = hooks[model]?.delete?.after;
+			if (toRun) await queueAfterTransactionHook(async () => {
+				await withSpan(`db delete.after ${model}`, {
+					[ATTR_HOOK_TYPE]: "delete.after",
+					[ATTR_DB_COLLECTION_NAME]: model,
+					[ATTR_CONTEXT]: source
+				}, () => toRun(entityToDelete, context));
+			});
+		}
+		return deleted;
+	}
+	async function deleteManyWithHooks(where, model, customDeleteFn) {
+		const context = tryGetCurrentAuthEndpointContext();
+		let entitiesToDelete = [];
+		try {
+			entitiesToDelete = await (await getCurrentAdapter(adapter)).findMany({
+				model,
+				where
+			});
+		} catch {}
+		for (const entity of entitiesToDelete) for (const { source, hooks } of hooksEntries) {
+			const toRun = hooks[model]?.delete?.before;
+			if (toRun) {
+				if (await withSpan(`db delete.before ${model}`, {
+					[ATTR_HOOK_TYPE]: "delete.before",
+					[ATTR_DB_COLLECTION_NAME]: model,
+					[ATTR_CONTEXT]: source
+				}, () => toRun(entity, context)) === false) return null;
+			}
+		}
+		const customDeleted = customDeleteFn ? await customDeleteFn.fn(where) : null;
+		const deleted = !customDeleteFn || customDeleteFn.executeMainFn ? await (await getCurrentAdapter(adapter)).deleteMany({
+			model,
+			where
+		}) : customDeleted;
+		for (const entity of entitiesToDelete) for (const { source, hooks } of hooksEntries) {
+			const toRun = hooks[model]?.delete?.after;
+			if (toRun) await queueAfterTransactionHook(async () => {
+				await withSpan(`db delete.after ${model}`, {
+					[ATTR_HOOK_TYPE]: "delete.after",
+					[ATTR_DB_COLLECTION_NAME]: model,
+					[ATTR_CONTEXT]: source
+				}, () => toRun(entity, context));
+			});
+		}
+		return deleted;
+	}
+	/**
+	* Wraps an atomic consume operation in the plugin `delete.before` and
+	* `delete.after` hook lifecycle. The caller supplies a `consumeFn` that
+	* performs the actual single-row delete-and-return (typically the
+	* adapter's `consumeOne`). The first concurrent caller wins, subsequent
+	* racers resolve to `null` without firing `delete.after` hooks.
+	*
+	* `preSnapshot` lets the caller hand in a row it already fetched so
+	* `delete.before` hooks don't trigger a second read. Without it, the
+	* helper falls back to a best-effort `findMany` against `hookWhere`.
+	* The snapshot only feeds `delete.before`; the `consumeFn` return value
+	* is the race gate.
+	*
+	* Returning `false` from a `delete.before` hook aborts the consume and
+	* the helper resolves to `null` (no `consumeFn` call, no after hooks).
+	*/
+	async function consumeOneWithHooks(model, hookWhere, consumeFn, preSnapshot) {
+		const context = tryGetCurrentAuthEndpointContext();
+		const beforeHooks = hooksEntries.flatMap(({ source, hooks }) => {
+			const fn = hooks[model]?.delete?.before;
+			return fn ? [{
+				source,
+				fn
+			}] : [];
+		});
+		let snapshot = preSnapshot ?? null;
+		if (beforeHooks.length) {
+			if (!snapshot) try {
+				snapshot = (await (await getCurrentAdapter(adapter)).findMany({
+					model,
+					where: hookWhere,
+					limit: 1
+				}))[0] || null;
+			} catch {}
+			if (snapshot) {
+				for (const { source, fn } of beforeHooks) if (await withSpan(`db delete.before ${model}`, {
+					[ATTR_HOOK_TYPE]: "delete.before",
+					[ATTR_DB_COLLECTION_NAME]: model,
+					[ATTR_CONTEXT]: source
+				}, () => fn(snapshot, context)) === false) return null;
+			}
+		}
+		const consumed = await consumeFn();
+		if (!consumed) return null;
+		for (const { source, hooks } of hooksEntries) {
+			const toRun = hooks[model]?.delete?.after;
+			if (toRun) await queueAfterTransactionHook(async () => {
+				await withSpan(`db delete.after ${model}`, {
+					[ATTR_HOOK_TYPE]: "delete.after",
+					[ATTR_DB_COLLECTION_NAME]: model,
+					[ATTR_CONTEXT]: source
+				}, () => toRun(consumed, context));
+			});
+		}
+		return consumed;
+	}
+	return {
+		createWithHooks,
+		updateWithHooks,
+		updateManyWithHooks,
+		deleteWithHooks,
+		deleteManyWithHooks,
+		consumeOneWithHooks
+	};
+}
+//#endregion
+export { getWithHooks };