@remit/auth-service 0.0.9 → 0.0.11

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@remit/auth-service",
-  "version": "0.0.9",
-  "description": "better-auth identity service for the Postgres-parity stack (pg-parity)",
+  "version": "0.0.11",
+  "description": "better-auth identity service for the self-host stack",
   "type": "module",
   "main": "src/index.ts",
   "types": "src/index.ts",
@@ -23,14 +23,9 @@
     "test:typecheck": "tsgo --noEmit -p tsconfig.json",
     "test:run": "node --import tsx --experimental-test-coverage --test-coverage-include='src/**' --test-coverage-exclude='src/**/*.test.ts' --test-coverage-exclude='src/**/*.test.tsx' --test-coverage-lines=94 --test 'src/**/*.test.ts'",
     "test": "npm run test:typecheck && npm run test:run",
-    "auth:schema:generate": "npx @better-auth/cli generate --config src/auth.gen.ts --output src/schema/auth-schema.ts -y",
-    "auth:schema:push": "npx drizzle-kit push",
     "fix": "biome check --write src"
   },
   "devDependencies": {
-    "@better-auth/cli": "^1.4.21",
-    "drizzle-kit": "^0.31.1",
-    "embedded-postgres": "^18.4.0-beta.17",
     "tsx": "*"
   },
   "dependencies": {
@@ -38,7 +33,6 @@
     "better-sqlite3": "^12.11.1",
     "drizzle-orm": "^0.45.2",
     "jose": "^6.2.3",
-    "pg": "^8.0.0",
     "@types/better-sqlite3": "^7.6.13"
   },
   "license": "MIT",

package/src/auth.ts

@@ -2,20 +2,14 @@ import type { Auth as BetterAuthInstance } from "better-auth";
 import { betterAuth } from "better-auth";
 import { drizzleAdapter } from "better-auth/adapters/drizzle";
 import { jwt } from "better-auth/plugins";
-import { drizzle as drizzlePg } from "drizzle-orm/node-postgres";
-import pg from "pg";
-import { createInstanceOwnerStore } from "./instance-owner.js";
-import * as authSchema from "./schema/auth-schema.js";
 import * as authSchemaSqlite from "./schema/auth-schema-sqlite.js";
 
 export interface AuthConfig {
 	/**
-	 * The relational backend better-auth runs on, off `DATA_BACKEND` (RFC 036).
-	 * `pg` (the default) reads `connectionString` as a Postgres URL; `sqlite`
-	 * reads it as the path to the shared database file (D3), and drives the
-	 * SQLite identity schema through the drizzle adapter's `sqlite` provider.
+	 * Path to the shared database file (RFC 036 D3). The identity tables live
+	 * beside the app tables and are driven through the drizzle adapter's
+	 * `sqlite` provider.
 	 */
-	provider?: "pg" | "sqlite";
 	connectionString: string;
 	secret: string;
 	baseURL: string;
@@ -28,31 +22,22 @@ export interface AuthConfig {
 	selfSignUpEnabled: boolean;
 }
 
-// The drizzle adapter better-auth runs against, chosen by backend. better-sqlite3
-// and its drizzle driver are imported dynamically so the Postgres path never
-// loads the native binding, and the module stays out of any bundle that never
-// runs on SQLite. On SQLite the auth connection sets the same WAL/busy_timeout
+// The drizzle adapter better-auth runs against. better-sqlite3 and its drizzle
+// driver are imported dynamically so the module stays out of any bundle that
+// never opens the database. The auth connection sets the same WAL/busy_timeout
 // coordination every writer uses (RFC 036 D3) — it shares the file with the app
 // tables through its own connection.
 const buildAuthAdapter = async (config: AuthConfig) => {
-	if (config.provider === "sqlite") {
-		const { default: Database } = await import("better-sqlite3");
-		const { drizzle } = await import("drizzle-orm/better-sqlite3");
-		const sqlite = new Database(config.connectionString);
-		sqlite.pragma("journal_mode = WAL");
-		sqlite.pragma("busy_timeout = 5000");
-		sqlite.pragma("synchronous = NORMAL");
-		sqlite.pragma("foreign_keys = ON");
-		return drizzleAdapter(drizzle(sqlite, { schema: authSchemaSqlite }), {
-			provider: "sqlite",
-			schema: authSchemaSqlite,
-		});
-	}
-
-	const pool = new pg.Pool({ connectionString: config.connectionString });
-	return drizzleAdapter(drizzlePg(pool, { schema: authSchema }), {
-		provider: "pg",
-		schema: authSchema,
+	const { default: Database } = await import("better-sqlite3");
+	const { drizzle } = await import("drizzle-orm/better-sqlite3");
+	const sqlite = new Database(config.connectionString);
+	sqlite.pragma("journal_mode = WAL");
+	sqlite.pragma("busy_timeout = 5000");
+	sqlite.pragma("synchronous = NORMAL");
+	sqlite.pragma("foreign_keys = ON");
+	return drizzleAdapter(drizzle(sqlite, { schema: authSchemaSqlite }), {
+		provider: "sqlite",
+		schema: authSchemaSqlite,
 	});
 };
 
@@ -64,7 +49,7 @@ const intEnv = (name: string, fallback: number): number => {
 };
 
 /**
- * Build a better-auth instance bound to the pg-parity Postgres.
+ * Build a better-auth instance bound to the self-host database file.
  *
  * RS256 is deliberate: the edge tier (APISIX, or the dev-server verifier)
  * follows JWKS key rotation offline, so signing must be asymmetric. The JWKS is
@@ -81,10 +66,6 @@ export const createAuth = async (
 	config: AuthConfig,
 ): Promise<BetterAuthInstance> => {
 	const database = await buildAuthAdapter(config);
-	const instanceOwnerStore = await createInstanceOwnerStore({
-		provider: config.provider === "sqlite" ? "sqlite" : "pg",
-		connectionString: config.connectionString,
-	});
 
 	return betterAuth({
 		secret: config.secret,
@@ -124,19 +105,6 @@ export const createAuth = async (
 		session: { modelName: "auth_session" },
 		account: { modelName: "auth_account" },
 		verification: { modelName: "auth_verification" },
-		// RFC 037 D8: the instance owner is whoever registers first. Every
-		// successful user creation (self-signup or OAuth) attempts the claim;
-		// the singleton row's primary key is the conditional write, so only the
-		// first one to land keeps it.
-		databaseHooks: {
-			user: {
-				create: {
-					after: async (user) => {
-						await instanceOwnerStore.claimIfUnclaimed(user.id);
-					},
-				},
-			},
-		},
 		plugins: [
 			jwt({
 				schema: { jwks: { modelName: "auth_jwks" } },

package/src/config.ts

@@ -29,29 +29,22 @@ export const resolveSelfSignUpEnabled = (
 };
 
 export interface DataConnectionConfig {
-	provider: "pg" | "sqlite";
 	connectionString: string;
 }
 
 /**
- * Resolve which relational backend identity data lives on, from the same env
- * vars the rest of the self-host stack reads (RFC 036 D5). On
- * `DATA_BACKEND=sqlite` the identity tables share the app database file, so
- * the locator is `SQLITE_DB_PATH`; otherwise it is the Postgres URL.
+ * Resolve where identity data lives, from the same env vars the rest of the
+ * self-host stack reads (RFC 036 D5). The identity tables share the app
+ * database file, so the locator is `SQLITE_DB_PATH`.
  */
-export const resolveDataConnectionConfig = (): DataConnectionConfig => {
-	const provider = process.env.DATA_BACKEND === "sqlite" ? "sqlite" : "pg";
-	const connectionString =
-		provider === "sqlite"
-			? required("SQLITE_DB_PATH", process.env.SQLITE_DB_PATH)
-			: required("PG_CONNECTION_URL", process.env.PG_CONNECTION_URL);
-	return { provider, connectionString };
-};
+export const resolveDataConnectionConfig = (): DataConnectionConfig => ({
+	connectionString: required("SQLITE_DB_PATH", process.env.SQLITE_DB_PATH),
+});
 
 /**
  * Resolve the better-auth config from the environment. Callers reach this only
- * on the self-host relational backends (Postgres or SQLite); the Cognito/AWS
- * path never touches better-auth.
+ * on the self-host relational backend; the Cognito/AWS path never touches
+ * better-auth.
  */
 export const resolveAuthConfig = (): AuthConfig => {
 	const baseURL = required("BETTER_AUTH_URL", process.env.BETTER_AUTH_URL);

package/src/index.ts

@@ -11,11 +11,6 @@ export {
 	resolveVerifierConfig,
 	type VerifierConfig,
 } from "./config.js";
-export {
-	createInstanceOwnerStore,
-	type InstanceOwnerStore,
-	isInstanceOwner,
-} from "./instance-owner.js";
 export {
 	createJwtVerifier,
 	extractBearerToken,

package/src/schema/auth-schema-sqlite.ts

@@ -1,9 +1,15 @@
-// SQLite twin of auth-schema.ts (RFC 036 D5). Same five better-auth identity
-// tables in the SQLite dialect — the shape better-auth's drizzle adapter emits
-// with `provider: "sqlite"`: `sqliteTable`, `text` unchanged, `boolean` and
-// `timestamp` mapped to `integer` (mode boolean / timestamp). Used only to
-// generate the committed sqlite migrations (deploy/vps/migrations-sqlite/auth);
-// the Postgres schema stays the source for the pg migrations.
+// The five better-auth identity tables, in the shape better-auth's drizzle
+// adapter emits with `provider: "sqlite"`. Used to generate the committed
+// sqlite migrations (deploy/vps/migrations-sqlite/auth).
+//
+// Hand-maintained, deliberately. The `@better-auth/cli generate` command no
+// longer emits this shape: it writes `mode: "timestamp_ms"` where these columns
+// store seconds, and a SQL `DEFAULT (cast(unixepoch('subsecond') * 1000 as
+// integer))` where these use a JS-side `$defaultFn` and the committed migration
+// has no DEFAULT clause. Taking its output would reinterpret every timestamp on
+// every deployed instance and rewrite all five tables. Match better-auth's
+// runtime expectations by hand when a version bump changes them, and let
+// vps-migrations-drift.sqlite.test.ts catch the migration side.
 import { relations } from "drizzle-orm";
 import { index, integer, sqliteTable, text } from "drizzle-orm/sqlite-core";
 

package/src/schema/meta-schema-sqlite.ts

@@ -1,7 +1,5 @@
-// SQLite twin of meta-schema.ts. Same shape in the SQLite dialect — used only
-// to generate the committed SQLite migrations
-// (deploy/vps/migrations-sqlite/meta); the Postgres schema stays the source
-// for the pg migrations.
+// The instance-owner singleton, used to generate the committed SQLite
+// migrations (deploy/vps/migrations-sqlite/meta).
 import { sql } from "drizzle-orm";
 import { check, integer, sqliteTable, text } from "drizzle-orm/sqlite-core";
 

package/src/signup.test.ts

@@ -29,7 +29,7 @@ describe("resolveSelfSignUpEnabled", () => {
 });
 
 const baseConfig = {
-	connectionString: "postgresql://remit:remit@localhost:5432/remit_test",
+	connectionString: ":memory:",
 	secret: "signup-test-secret-value-32chars-minimum",
 	baseURL: "http://localhost:3000",
 };
@@ -45,9 +45,8 @@ describe("createAuth self-signup gate", () => {
 		assert.equal(closed.options.emailAndPassword?.disableSignUp, true);
 	});
 
-	it("selects the sqlite drizzle provider when configured", async () => {
+	it("drives the sqlite drizzle provider", async () => {
 		const auth = await createAuth({
-			provider: "sqlite",
 			connectionString: ":memory:",
 			secret: baseConfig.secret,
 			baseURL: baseConfig.baseURL,

package/src/verifier.ts

@@ -1,10 +1,10 @@
 // JWT-verification-only slice of this package's barrel. The full barrel
-// (`index.ts`) re-exports `createAuth` from `./auth.js`, which constructs a
-// `pg.Pool` + `drizzle-orm/node-postgres` at module scope, and `toNodeHandler`
-// from `better-auth/node` — neither needed to verify a token, both dragging a
-// Postgres client into any Lambda bundle that only checks a bearer token (see
-// #1242's FAQ, #1244/#1247). `config.ts`'s `AuthConfig` import from `./auth.js`
-// is type-only and erases at build, so this stays free of that chain.
+// (`index.ts`) re-exports `createAuth` from `./auth.js` and `toNodeHandler`
+// from `better-auth/node` — neither needed to verify a token, both dragging the
+// whole better-auth server graph into any Lambda bundle that only checks a
+// bearer token (see #1242's FAQ, #1244/#1247). `config.ts`'s `AuthConfig`
+// import from `./auth.js` is type-only and erases at build, so this stays free
+// of that chain.
 
 export {
 	AUTH_BASE_PATH,

package/drizzle.config.ts

@@ -1,24 +0,0 @@
-const url =
-	process.env.DATABASE_URL ??
-	process.env.PG_CONNECTION_URL ??
-	"postgresql://remit:remit@localhost:5432/remit_dev";
-
-/**
- * The better-auth identity tables share the pg-parity database with the entity
- * schema (remit-drizzle-service). `tablesFilter` scopes drizzle-kit to only the
- * auth tables so a push here never proposes dropping the entity tables it does
- * not know about.
- */
-export default {
-	dialect: "postgresql",
-	schema: "./src/schema/auth-schema.ts",
-	out: "./.drizzle",
-	dbCredentials: { url },
-	tablesFilter: [
-		"auth_user",
-		"auth_session",
-		"auth_account",
-		"auth_verification",
-		"auth_jwks",
-	],
-};

package/src/auth.gen.ts

@@ -1,35 +0,0 @@
-import type { Auth as BetterAuthInstance } from "better-auth";
-import { betterAuth } from "better-auth";
-import { drizzleAdapter } from "better-auth/adapters/drizzle";
-import { jwt } from "better-auth/plugins";
-import { drizzle } from "drizzle-orm/node-postgres";
-import pg from "pg";
-
-/**
- * Schema-generation-only config for `@better-auth/cli generate`. It mirrors the
- * plugin set of the real `createAuth` so the emitted Drizzle schema matches what
- * runtime expects, but omits the schema import to break the generate-time
- * chicken-and-egg (the schema file is this command's output).
- */
-const pool = new pg.Pool({
-	connectionString:
-		process.env.PG_CONNECTION_URL ??
-		"postgresql://remit:remit@localhost:5432/remit_dev",
-});
-
-export const auth = betterAuth({
-	secret: "schema-generation-only",
-	baseURL: "http://localhost",
-	database: drizzleAdapter(drizzle(pool), { provider: "pg" }),
-	emailAndPassword: { enabled: true },
-	user: { modelName: "auth_user" },
-	session: { modelName: "auth_session" },
-	account: { modelName: "auth_account" },
-	verification: { modelName: "auth_verification" },
-	plugins: [
-		jwt({
-			schema: { jwks: { modelName: "auth_jwks" } },
-			jwks: { keyPairConfig: { alg: "RS256", modulusLength: 2048 } },
-		}),
-	],
-}) as unknown as BetterAuthInstance;

package/src/instance-owner.pg.test.ts

@@ -1,151 +0,0 @@
-import assert from "node:assert/strict";
-import { rmSync } from "node:fs";
-import { after, before, describe, it } from "node:test";
-import { pushSchema } from "drizzle-kit/api";
-import { drizzle } from "drizzle-orm/node-postgres";
-import EmbeddedPostgres from "embedded-postgres";
-import { Pool } from "pg";
-import { createAuth } from "./auth.js";
-import {
-	createInstanceOwnerStore,
-	type InstanceOwnerStore,
-} from "./instance-owner.js";
-import * as authSchema from "./schema/auth-schema.js";
-import * as metaSchema from "./schema/meta-schema.js";
-
-/**
- * Real Postgres coverage for RFC 037 D8, using a self-contained embedded
- * server (the same tool `drizzle-service`'s pg repo tests use, `before`/
- * `after`-scoped the same way) rather than a container — no external service
- * required, so this runs in CI unattended. Proves the earlier failure —
- * nothing ever migrated `instance_owner` on Postgres, so every registration
- * 500s — is closed: this pushes the exact `auth-schema.ts` + `meta-schema.ts`
- * tables (the same shape `deploy/vps/migrations/meta` migrates to) and drives
- * real signups through `createAuth`.
- */
-describe("createAuth claims ownership on registration — postgres (RFC 037 D8)", () => {
-	const combinedSchema = { ...authSchema, ...metaSchema };
-	const port = 55600 + Math.floor(Math.random() * 400);
-	const databaseDir = `/tmp/auth-service-test-pg-${port}-${Date.now()}`;
-	const pg = new EmbeddedPostgres({
-		databaseDir,
-		user: "test",
-		password: "test",
-		port,
-		persistent: false,
-	});
-	const connectionString = `postgresql://test:test@localhost:${port}/postgres`;
-	let store: InstanceOwnerStore;
-	let testPool: Pool;
-
-	before(async () => {
-		await pg.initialise();
-		await pg.start();
-
-		const db = drizzle(connectionString, { schema: combinedSchema });
-		const write = process.stdout.write.bind(process.stdout);
-		process.stdout.write = (() => true) as typeof process.stdout.write;
-		try {
-			const { apply } = await pushSchema(
-				combinedSchema,
-				db as unknown as Parameters<typeof pushSchema>[1],
-			);
-			await apply();
-		} finally {
-			process.stdout.write = write;
-		}
-
-		store = await createInstanceOwnerStore({
-			provider: "pg",
-			connectionString,
-		});
-		testPool = new Pool({ connectionString });
-	});
-
-	after(async () => {
-		await testPool.end();
-		await store.close();
-		await pg.stop();
-		try {
-			rmSync(databaseDir, { recursive: true, force: true });
-		} catch {
-			// best-effort cleanup
-		}
-	});
-
-	const signUp = (
-		auth: Awaited<ReturnType<typeof createAuth>>,
-		email: string,
-	) =>
-		auth.handler(
-			new Request("http://localhost:3000/api/auth/sign-up/email", {
-				method: "POST",
-				headers: { "content-type": "application/json" },
-				body: JSON.stringify({
-					email,
-					password: "a-sufficiently-long-password",
-					name: email,
-				}),
-			}),
-		);
-
-	const resetTables = async (): Promise<void> => {
-		await testPool.query("DELETE FROM instance_owner");
-		await testPool.query("DELETE FROM auth_user");
-	};
-
-	const insertUser = (id: string, email: string, createdAt: Date) =>
-		testPool.query(
-			"INSERT INTO auth_user (id, name, email, email_verified, created_at, updated_at) VALUES ($1, $2, $3, false, $4, $4)",
-			[id, email, email, createdAt],
-		);
-
-	it("the first real Postgres signup succeeds and claims ownership; the second does not", async () => {
-		const auth = await createAuth({
-			provider: "pg",
-			connectionString,
-			secret: "instance-owner-pg-test-secret-value-32chars-minimum",
-			baseURL: "http://localhost:3000",
-			selfSignUpEnabled: true,
-		});
-
-		const first = await signUp(auth, "first@example.com");
-		assert.equal(first.status, 200);
-		const firstBody = (await first.json()) as { user: { id: string } };
-
-		const second = await signUp(auth, "second@example.com");
-		assert.equal(second.status, 200);
-		const secondBody = (await second.json()) as { user: { id: string } };
-
-		assert.equal(await store.isOwner(firstBody.user.id), true);
-		assert.equal(await store.isOwner(secondBody.user.id), false);
-	});
-
-	// The two cases below exercise `CLAIM_EARLIEST_USER_SQL_PG` directly — the
-	// pg twin of the sqlite gate tests — so a typo in the pg `WHERE` cannot ship
-	// silently and degrade the pg path to a bare conditional insert.
-	it("a hook resolving out of order does not override the true first registrant", async () => {
-		await resetTables();
-		await insertUser("first-registered", "first@example.com", new Date(1000));
-		await insertUser("second-registered", "second@example.com", new Date(2000));
-
-		// second-registered's hook lands first — simulating it winning a race —
-		// but it registered after first-registered, so it must not become owner.
-		await store.claimIfUnclaimed("second-registered");
-		await store.claimIfUnclaimed("first-registered");
-
-		assert.equal(await store.isOwner("first-registered"), true);
-		assert.equal(await store.isOwner("second-registered"), false);
-	});
-
-	it("a claim for a user that was never committed (a rolled-back registration) does not land", async () => {
-		await resetTables();
-
-		await store.claimIfUnclaimed("rolled-back-user");
-		assert.equal(await store.isOwner("rolled-back-user"), false);
-
-		await insertUser("real-user", "real@example.com", new Date(1000));
-		await store.claimIfUnclaimed("real-user");
-		assert.equal(await store.isOwner("real-user"), true);
-	});
-});

package/src/instance-owner.test.ts

@@ -1,335 +0,0 @@
-import assert from "node:assert/strict";
-import { mkdirSync, mkdtempSync, rmSync } from "node:fs";
-import { join } from "node:path";
-import { after, afterEach, describe, it } from "node:test";
-import { fileURLToPath } from "node:url";
-import Database from "better-sqlite3";
-import { pushSQLiteSchema } from "drizzle-kit/api";
-import { drizzle } from "drizzle-orm/better-sqlite3";
-import { createAuth } from "./auth.js";
-import {
-	_setInstanceOwnerStoreForTest,
-	createInstanceOwnerStore,
-	type InstanceOwnerStore,
-	isInstanceOwner,
-} from "./instance-owner.js";
-import * as authSchemaSqlite from "./schema/auth-schema-sqlite.js";
-import * as metaSchemaSqlite from "./schema/meta-schema-sqlite.js";
-
-const combinedSchema = { ...authSchemaSqlite, ...metaSchemaSqlite };
-
-const tmpRoot = join(
-	fileURLToPath(new URL(".", import.meta.url)),
-	"..",
-	".tmp",
-	"instance-owner",
-);
-
-after(() => {
-	rmSync(tmpRoot, { recursive: true, force: true });
-});
-
-const makeDbPath = (): string => {
-	mkdirSync(tmpRoot, { recursive: true });
-	return join(mkdtempSync(join(tmpRoot, "db-")), "app.db");
-};
-
-/**
- * Provision a fresh sqlite file with the auth + meta tables so a test can
- * exercise the real dialect a self-host deployment runs — the pushed shape
- * derives from the same drizzle table objects the committed migrations do
- * (see the drift guard in drizzle-service).
- */
-const provisionSchema = async (dbPath: string): Promise<void> => {
-	const sqlite = new Database(dbPath);
-	const db = drizzle(sqlite, { schema: combinedSchema });
-	const write = process.stdout.write.bind(process.stdout);
-	process.stdout.write = (() => true) as typeof process.stdout.write;
-	let statementsToExecute: string[];
-	try {
-		({ statementsToExecute } = await pushSQLiteSchema(
-			combinedSchema,
-			db as unknown as Parameters<typeof pushSQLiteSchema>[1],
-		));
-	} finally {
-		process.stdout.write = write;
-	}
-	for (const statement of statementsToExecute) sqlite.exec(statement);
-	sqlite.close();
-};
-
-const insertUser = (
-	dbPath: string,
-	id: string,
-	email: string,
-	createdAtMs: number = Date.now(),
-): void => {
-	const sqlite = new Database(dbPath);
-	sqlite
-		.prepare(
-			"INSERT INTO auth_user (id, name, email, email_verified, created_at, updated_at) VALUES (?, ?, ?, 0, ?, ?)",
-		)
-		.run(id, email, email, createdAtMs, createdAtMs);
-	sqlite.close();
-};
-
-const userIdByEmail = (dbPath: string, email: string): string => {
-	const sqlite = new Database(dbPath);
-	const row = sqlite
-		.prepare("SELECT id FROM auth_user WHERE email = ?")
-		.get(email) as { id: string } | undefined;
-	sqlite.close();
-	if (!row) throw new Error(`no such user: ${email}`);
-	return row.id;
-};
-
-describe("createInstanceOwnerStore (sqlite)", () => {
-	it("claims ownership for the first-registered user and ignores later claims", async () => {
-		const dbPath = makeDbPath();
-		await provisionSchema(dbPath);
-		insertUser(dbPath, "user-1", "first@example.com", 1000);
-		insertUser(dbPath, "user-2", "second@example.com", 2000);
-		const store = await createInstanceOwnerStore({
-			provider: "sqlite",
-			connectionString: dbPath,
-		});
-
-		await store.claimIfUnclaimed("user-1");
-		await store.claimIfUnclaimed("user-2");
-
-		assert.equal(await store.isOwner("user-1"), true);
-		assert.equal(await store.isOwner("user-2"), false);
-		await store.close();
-	});
-
-	it("produces exactly one owner under concurrent first claims", async () => {
-		const dbPath = makeDbPath();
-		await provisionSchema(dbPath);
-		insertUser(dbPath, "user-a", "a@example.com", 1000);
-		insertUser(dbPath, "user-b", "b@example.com", 1000);
-		const store = await createInstanceOwnerStore({
-			provider: "sqlite",
-			connectionString: dbPath,
-		});
-
-		await Promise.all([
-			store.claimIfUnclaimed("user-a"),
-			store.claimIfUnclaimed("user-b"),
-		]);
-
-		const aIsOwner = await store.isOwner("user-a");
-		const bIsOwner = await store.isOwner("user-b");
-		assert.notEqual(aIsOwner, bIsOwner);
-		await store.close();
-	});
-
-	it("a hook resolving out of order does not override the true first registrant", async () => {
-		const dbPath = makeDbPath();
-		await provisionSchema(dbPath);
-		insertUser(dbPath, "first-registered", "first@example.com", 1000);
-		insertUser(dbPath, "second-registered", "second@example.com", 2000);
-		const store = await createInstanceOwnerStore({
-			provider: "sqlite",
-			connectionString: dbPath,
-		});
-
-		// second-registered's hook lands first — simulating it winning a race —
-		// but it registered after first-registered, so it must not become owner.
-		await store.claimIfUnclaimed("second-registered");
-		await store.claimIfUnclaimed("first-registered");
-
-		assert.equal(await store.isOwner("first-registered"), true);
-		assert.equal(await store.isOwner("second-registered"), false);
-		await store.close();
-	});
-
-	it("a claim for a user that was never committed (a rolled-back registration) does not land", async () => {
-		const dbPath = makeDbPath();
-		await provisionSchema(dbPath);
-		const store = await createInstanceOwnerStore({
-			provider: "sqlite",
-			connectionString: dbPath,
-		});
-
-		await store.claimIfUnclaimed("rolled-back-user");
-		assert.equal(await store.isOwner("rolled-back-user"), false);
-
-		insertUser(dbPath, "real-user", "real@example.com", 1000);
-		await store.claimIfUnclaimed("real-user");
-		assert.equal(await store.isOwner("real-user"), true);
-		await store.close();
-	});
-
-	it("claiming again for the already-claimed owner is a harmless no-op", async () => {
-		const dbPath = makeDbPath();
-		await provisionSchema(dbPath);
-		insertUser(dbPath, "user-1", "first@example.com", 1000);
-		const store = await createInstanceOwnerStore({
-			provider: "sqlite",
-			connectionString: dbPath,
-		});
-
-		await store.claimIfUnclaimed("user-1");
-		await store.claimIfUnclaimed("user-1");
-		await store.claimIfUnclaimed("user-1");
-
-		assert.equal(await store.isOwner("user-1"), true);
-		await store.close();
-	});
-
-	it("REMIT_OWNER_EMAIL resolves to a user and ignores the stored claim", async () => {
-		const dbPath = makeDbPath();
-		await provisionSchema(dbPath);
-		insertUser(dbPath, "user-1", "first@example.com", 1000);
-		insertUser(dbPath, "user-2", "second@example.com", 2000);
-		const store = await createInstanceOwnerStore({
-			provider: "sqlite",
-			connectionString: dbPath,
-		});
-		await store.claimIfUnclaimed("user-1");
-		assert.equal(await store.isOwner("user-1"), true);
-
-		assert.equal(await store.isOwner("user-1", "second@example.com"), false);
-		assert.equal(await store.isOwner("user-2", "second@example.com"), true);
-		await store.close();
-	});
-
-	it("REMIT_OWNER_EMAIL naming no account makes every caller a non-owner", async () => {
-		const dbPath = makeDbPath();
-		await provisionSchema(dbPath);
-		insertUser(dbPath, "user-1", "first@example.com", 1000);
-		const store = await createInstanceOwnerStore({
-			provider: "sqlite",
-			connectionString: dbPath,
-		});
-		await store.claimIfUnclaimed("user-1");
-		assert.equal(await store.isOwner("user-1"), true);
-
-		assert.equal(await store.isOwner("user-1", "nobody@example.com"), false);
-		await store.close();
-	});
-});
-
-describe("isInstanceOwner", () => {
-	afterEach(() => {
-		_setInstanceOwnerStoreForTest(null);
-		delete process.env.REMIT_OWNER_EMAIL;
-	});
-
-	it("passes REMIT_OWNER_EMAIL through to the store when set", async () => {
-		const calls: Array<string | undefined> = [];
-		const stub: InstanceOwnerStore = {
-			claimIfUnclaimed: async () => {},
-			isOwner: async (_userId, ownerEmail) => {
-				calls.push(ownerEmail);
-				return ownerEmail === "owner@example.com";
-			},
-			close: async () => {},
-		};
-		_setInstanceOwnerStoreForTest(stub);
-		process.env.REMIT_OWNER_EMAIL = "owner@example.com";
-
-		assert.equal(await isInstanceOwner("user-1"), true);
-		assert.deepEqual(calls, ["owner@example.com"]);
-	});
-
-	it("omits ownerEmail when REMIT_OWNER_EMAIL is unset", async () => {
-		let received: string | undefined = "unset";
-		const stub: InstanceOwnerStore = {
-			claimIfUnclaimed: async () => {},
-			isOwner: async (_userId, ownerEmail) => {
-				received = ownerEmail;
-				return false;
-			},
-			close: async () => {},
-		};
-		_setInstanceOwnerStoreForTest(stub);
-
-		await isInstanceOwner("user-1");
-
-		assert.equal(received, undefined);
-	});
-});
-
-describe("createAuth claims ownership on registration (RFC 037 D8)", () => {
-	const baseConfig = {
-		secret: "instance-owner-test-secret-value-32chars-minimum",
-		baseURL: "http://localhost:3000",
-		selfSignUpEnabled: true,
-	};
-
-	const signUp = (
-		auth: Awaited<ReturnType<typeof createAuth>>,
-		email: string,
-	) =>
-		auth.handler(
-			new Request("http://localhost:3000/api/auth/sign-up/email", {
-				method: "POST",
-				headers: { "content-type": "application/json" },
-				body: JSON.stringify({
-					email,
-					password: "a-sufficiently-long-password",
-					name: email,
-				}),
-			}),
-		);
-
-	it("the first successful registration claims ownership; the second does not", async () => {
-		const dbPath = makeDbPath();
-		await provisionSchema(dbPath);
-		const auth = await createAuth({
-			...baseConfig,
-			provider: "sqlite",
-			connectionString: dbPath,
-		});
-
-		const first = await signUp(auth, "first@example.com");
-		assert.equal(first.status, 200);
-		const second = await signUp(auth, "second@example.com");
-		assert.equal(second.status, 200);
-
-		const store = await createInstanceOwnerStore({
-			provider: "sqlite",
-			connectionString: dbPath,
-		});
-		assert.equal(
-			await store.isOwner(userIdByEmail(dbPath, "first@example.com")),
-			true,
-		);
-		assert.equal(
-			await store.isOwner(userIdByEmail(dbPath, "second@example.com")),
-			false,
-		);
-		await store.close();
-	});
-
-	it("concurrent first registrations produce exactly one owner", async () => {
-		const dbPath = makeDbPath();
-		await provisionSchema(dbPath);
-		const auth = await createAuth({
-			...baseConfig,
-			provider: "sqlite",
-			connectionString: dbPath,
-		});
-
-		const [first, second] = await Promise.all([
-			signUp(auth, "racer-a@example.com"),
-			signUp(auth, "racer-b@example.com"),
-		]);
-		assert.equal(first.status, 200);
-		assert.equal(second.status, 200);
-
-		const store = await createInstanceOwnerStore({
-			provider: "sqlite",
-			connectionString: dbPath,
-		});
-		const aIsOwner = await store.isOwner(
-			userIdByEmail(dbPath, "racer-a@example.com"),
-		);
-		const bIsOwner = await store.isOwner(
-			userIdByEmail(dbPath, "racer-b@example.com"),
-		);
-		assert.notEqual(aIsOwner, bIsOwner);
-		await store.close();
-	});
-});

package/src/instance-owner.ts

@@ -1,150 +0,0 @@
-import { eq } from "drizzle-orm";
-import { drizzle as drizzlePg } from "drizzle-orm/node-postgres";
-import pg from "pg";
-import type { DataConnectionConfig } from "./config.js";
-import { resolveDataConnectionConfig } from "./config.js";
-import { auth_user as auth_user_pg } from "./schema/auth-schema.js";
-import { auth_user as auth_user_sqlite } from "./schema/auth-schema-sqlite.js";
-import { instance_owner as instance_owner_pg } from "./schema/meta-schema.js";
-import { instance_owner as instance_owner_sqlite } from "./schema/meta-schema-sqlite.js";
-
-const OWNER_ROW_ID = 1;
-
-/**
- * Gated on `userId` being `auth_user`'s own earliest row right now, not
- * merely "no owner claimed yet" — hook-completion order is not write order,
- * so a later registrant's hook can otherwise settle first. It also covers
- * better-auth queuing `create.after` to run even when the surrounding
- * transaction rolled back (the OAuth create-user-and-account path shares one
- * transaction): a rolled-back id matches no committed row, so the claim
- * resolves to nothing. The primary key stays as a backstop for a tie on
- * `created_at`, resolved identically on both sides by the `id ASC` sort.
- */
-const CLAIM_EARLIEST_USER_SQL_PG = `
-	INSERT INTO instance_owner (id, user_id, claimed_at)
-	SELECT ${OWNER_ROW_ID}, $1, $2
-	WHERE $1 = (SELECT id FROM auth_user ORDER BY created_at ASC, id ASC LIMIT 1)
-	ON CONFLICT (id) DO NOTHING
-`;
-
-const CLAIM_EARLIEST_USER_SQL_SQLITE = `
-	INSERT INTO instance_owner (id, user_id, claimed_at)
-	SELECT ${OWNER_ROW_ID}, ?, ?
-	WHERE ? = (SELECT id FROM auth_user ORDER BY created_at ASC, id ASC LIMIT 1)
-	ON CONFLICT (id) DO NOTHING
-`;
-
-export interface InstanceOwnerStore {
-	/**
-	 * Attempt to claim ownership for `userId`. A no-op unless `userId` is
-	 * genuinely the earliest-created row in `auth_user` and no owner is
-	 * claimed yet — see `CLAIM_EARLIEST_USER_SQL_PG` above for why that is
-	 * stricter than "no owner claimed yet" alone.
-	 */
-	claimIfUnclaimed(userId: string): Promise<void>;
-	/**
-	 * `ownerEmail`, when given, is `REMIT_OWNER_EMAIL` resolved to a user and
-	 * compared directly — the stored claim is never consulted, so an email
-	 * with no matching account makes every caller a non-owner.
-	 */
-	isOwner(userId: string, ownerEmail?: string): Promise<boolean>;
-	close(): Promise<void>;
-}
-
-const buildPgStore = (connectionString: string): InstanceOwnerStore => {
-	const pool = new pg.Pool({ connectionString });
-	const db = drizzlePg(pool);
-
-	return {
-		async claimIfUnclaimed(userId) {
-			await pool.query(CLAIM_EARLIEST_USER_SQL_PG, [userId, new Date()]);
-		},
-		async isOwner(userId, ownerEmail) {
-			if (ownerEmail) {
-				const [user] = await db
-					.select({ id: auth_user_pg.id })
-					.from(auth_user_pg)
-					.where(eq(auth_user_pg.email, ownerEmail.toLowerCase()));
-				return user?.id === userId;
-			}
-			const [row] = await db
-				.select({ userId: instance_owner_pg.userId })
-				.from(instance_owner_pg)
-				.where(eq(instance_owner_pg.id, OWNER_ROW_ID));
-			return row?.userId === userId;
-		},
-		async close() {
-			await pool.end();
-		},
-	};
-};
-
-const buildSqliteStore = async (
-	connectionString: string,
-): Promise<InstanceOwnerStore> => {
-	const { default: Database } = await import("better-sqlite3");
-	const { drizzle } = await import("drizzle-orm/better-sqlite3");
-	const sqlite = new Database(connectionString);
-	sqlite.pragma("journal_mode = WAL");
-	sqlite.pragma("busy_timeout = 5000");
-	const db = drizzle(sqlite);
-
-	return {
-		async claimIfUnclaimed(userId) {
-			sqlite
-				.prepare(CLAIM_EARLIEST_USER_SQL_SQLITE)
-				.run(userId, Date.now(), userId);
-		},
-		async isOwner(userId, ownerEmail) {
-			if (ownerEmail) {
-				const [user] = await db
-					.select({ id: auth_user_sqlite.id })
-					.from(auth_user_sqlite)
-					.where(eq(auth_user_sqlite.email, ownerEmail.toLowerCase()));
-				return user?.id === userId;
-			}
-			const [row] = await db
-				.select({ userId: instance_owner_sqlite.userId })
-				.from(instance_owner_sqlite)
-				.where(eq(instance_owner_sqlite.id, OWNER_ROW_ID));
-			return row?.userId === userId;
-		},
-		async close() {
-			sqlite.close();
-		},
-	};
-};
-
-export const createInstanceOwnerStore = (
-	config: DataConnectionConfig,
-): Promise<InstanceOwnerStore> =>
-	config.provider === "sqlite"
-		? buildSqliteStore(config.connectionString)
-		: Promise.resolve(buildPgStore(config.connectionString));
-
-let defaultStore: Promise<InstanceOwnerStore> | null = null;
-
-const getDefaultStore = (): Promise<InstanceOwnerStore> => {
-	if (!defaultStore) {
-		defaultStore = createInstanceOwnerStore(resolveDataConnectionConfig());
-	}
-	return defaultStore;
-};
-
-/** Test-only override for the memoized default store. Pass null to reset. */
-export const _setInstanceOwnerStoreForTest = (
-	store: InstanceOwnerStore | null,
-): void => {
-	defaultStore = store ? Promise.resolve(store) : null;
-};
-
-/**
- * Whether `userId` may trigger a standalone self-update (RFC 037 D8). Set
- * `REMIT_OWNER_EMAIL` overrides the stored claim entirely, including when it
- * names an account other than the one that claimed ownership.
- */
-export const isInstanceOwner = async (userId: string): Promise<boolean> => {
-	const store = await getDefaultStore();
-	const ownerEmail = process.env.REMIT_OWNER_EMAIL?.trim();
-	return store.isOwner(userId, ownerEmail || undefined);
-};

package/src/schema/auth-schema.ts

@@ -1,101 +0,0 @@
-import { relations } from "drizzle-orm";
-import { boolean, index, pgTable, text, timestamp } from "drizzle-orm/pg-core";
-
-export const auth_user = pgTable("auth_user", {
-	id: text("id").primaryKey(),
-	name: text("name").notNull(),
-	email: text("email").notNull().unique(),
-	emailVerified: boolean("email_verified").default(false).notNull(),
-	image: text("image"),
-	createdAt: timestamp("created_at").defaultNow().notNull(),
-	updatedAt: timestamp("updated_at")
-		.defaultNow()
-		.$onUpdate(() => /* @__PURE__ */ new Date())
-		.notNull(),
-});
-
-export const auth_session = pgTable(
-	"auth_session",
-	{
-		id: text("id").primaryKey(),
-		expiresAt: timestamp("expires_at").notNull(),
-		token: text("token").notNull().unique(),
-		createdAt: timestamp("created_at").defaultNow().notNull(),
-		updatedAt: timestamp("updated_at")
-			.$onUpdate(() => /* @__PURE__ */ new Date())
-			.notNull(),
-		ipAddress: text("ip_address"),
-		userAgent: text("user_agent"),
-		userId: text("user_id")
-			.notNull()
-			.references(() => auth_user.id, { onDelete: "cascade" }),
-	},
-	(table) => [index("auth_session_userId_idx").on(table.userId)],
-);
-
-export const auth_account = pgTable(
-	"auth_account",
-	{
-		id: text("id").primaryKey(),
-		accountId: text("account_id").notNull(),
-		providerId: text("provider_id").notNull(),
-		userId: text("user_id")
-			.notNull()
-			.references(() => auth_user.id, { onDelete: "cascade" }),
-		accessToken: text("access_token"),
-		refreshToken: text("refresh_token"),
-		idToken: text("id_token"),
-		accessTokenExpiresAt: timestamp("access_token_expires_at"),
-		refreshTokenExpiresAt: timestamp("refresh_token_expires_at"),
-		scope: text("scope"),
-		password: text("password"),
-		createdAt: timestamp("created_at").defaultNow().notNull(),
-		updatedAt: timestamp("updated_at")
-			.$onUpdate(() => /* @__PURE__ */ new Date())
-			.notNull(),
-	},
-	(table) => [index("auth_account_userId_idx").on(table.userId)],
-);
-
-export const auth_verification = pgTable(
-	"auth_verification",
-	{
-		id: text("id").primaryKey(),
-		identifier: text("identifier").notNull(),
-		value: text("value").notNull(),
-		expiresAt: timestamp("expires_at").notNull(),
-		createdAt: timestamp("created_at").defaultNow().notNull(),
-		updatedAt: timestamp("updated_at")
-			.defaultNow()
-			.$onUpdate(() => /* @__PURE__ */ new Date())
-			.notNull(),
-	},
-	(table) => [index("auth_verification_identifier_idx").on(table.identifier)],
-);
-
-export const auth_jwks = pgTable("auth_jwks", {
-	id: text("id").primaryKey(),
-	publicKey: text("public_key").notNull(),
-	privateKey: text("private_key").notNull(),
-	createdAt: timestamp("created_at").notNull(),
-	expiresAt: timestamp("expires_at"),
-});
-
-export const auth_userRelations = relations(auth_user, ({ many }) => ({
-	auth_sessions: many(auth_session),
-	auth_accounts: many(auth_account),
-}));
-
-export const auth_sessionRelations = relations(auth_session, ({ one }) => ({
-	auth_user: one(auth_user, {
-		fields: [auth_session.userId],
-		references: [auth_user.id],
-	}),
-}));
-
-export const auth_accountRelations = relations(auth_account, ({ one }) => ({
-	auth_user: one(auth_user, {
-		fields: [auth_account.userId],
-		references: [auth_user.id],
-	}),
-}));

package/src/schema/meta-schema.ts

@@ -1,12 +0,0 @@
-import { sql } from "drizzle-orm";
-import { check, integer, pgTable, text, timestamp } from "drizzle-orm/pg-core";
-
-export const instance_owner = pgTable(
-	"instance_owner",
-	{
-		id: integer("id").primaryKey().default(1),
-		userId: text("user_id").notNull(),
-		claimedAt: timestamp("claimed_at").defaultNow().notNull(),
-	},
-	(table) => [check("instance_owner_singleton", sql`${table.id} = 1`)],
-);