@storyshelf/auth 0.5.3

package/dist/auth-tables.mjs

@@ -0,0 +1,122 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { integer, sqliteTable, text } from "drizzle-orm/sqlite-core";
+//#region src/auth-tables.ts
+/**
+* Auth table definitions: drizzle handles for the Better Auth base models.
+*
+* Keys are camelCase (repo convention); columns snake_case. Field names match
+* Better Auth defaults exactly, so the bridge needs no name translation.
+* Custom modelName/fieldName options are unsupported in v1 (fail fast).
+* DDL for drivers is vendored separately (see E3); these defs are the source
+* of truth the DDL must match (the strict schema checker enforces it).
+*/
+/** Narrow `user` table definition (Better Auth base model). */
+const authUser = sqliteTable("user", {
+	id: text("id").primaryKey(),
+	name: text("name").notNull(),
+	email: text("email").notNull().unique(),
+	emailVerified: integer("email_verified", { mode: "boolean" }).notNull().default(false),
+	image: text("image"),
+	createdAt: text("created_at").notNull(),
+	updatedAt: text("updated_at").notNull()
+});
+/** Narrow `session` table definition (Better Auth base model). */
+const authSession = sqliteTable("session", {
+	id: text("id").primaryKey(),
+	userId: text("user_id").notNull().references(() => authUser.id, { onDelete: "cascade" }),
+	token: text("token").notNull().unique(),
+	expiresAt: text("expires_at").notNull(),
+	ipAddress: text("ip_address"),
+	userAgent: text("user_agent"),
+	createdAt: text("created_at").notNull(),
+	updatedAt: text("updated_at").notNull()
+});
+/** Narrow `account` table definition (Better Auth base model). */
+const authAccount = sqliteTable("account", {
+	id: text("id").primaryKey(),
+	userId: text("user_id").notNull().references(() => authUser.id, { onDelete: "cascade" }),
+	accountId: text("account_id").notNull(),
+	providerId: text("provider_id").notNull(),
+	accessToken: text("access_token"),
+	refreshToken: text("refresh_token"),
+	idToken: text("id_token"),
+	accessTokenExpiresAt: text("access_token_expires_at"),
+	refreshTokenExpiresAt: text("refresh_token_expires_at"),
+	scope: text("scope"),
+	expiresAt: text("expires_at"),
+	password: text("password"),
+	createdAt: text("created_at").notNull(),
+	updatedAt: text("updated_at").notNull()
+});
+/** Narrow `verification` table definition (Better Auth base model). */
+const authVerification = sqliteTable("verification", {
+	id: text("id").primaryKey(),
+	identifier: text("identifier").notNull(),
+	value: text("value").notNull(),
+	expiresAt: text("expires_at").notNull(),
+	createdAt: text("created_at").notNull(),
+	updatedAt: text("updated_at").notNull()
+});
+/** Narrow `passkey` table definition (passkey plugin model). */ const authPasskey = sqliteTable("passkey", {
+	id: text("id").primaryKey(),
+	name: text("name"),
+	publicKey: text("public_key").notNull(),
+	userId: text("user_id").notNull().references(() => authUser.id, { onDelete: "cascade" }),
+	credentialID: text("credential_id").notNull(),
+	counter: integer("counter").notNull(),
+	deviceType: text("device_type").notNull(),
+	backedUp: integer("backed_up", { mode: "boolean" }).notNull().default(false),
+	transports: text("transports"),
+	aaguid: text("aaguid"),
+	createdAt: text("created_at").notNull(),
+	updatedAt: text("updated_at")
+});
+/** Narrow `ssoProvider` table definition (SSO plugin model). */
+const authSsoProvider = sqliteTable("ssoProvider", {
+	id: text("id").primaryKey(),
+	issuer: text("issuer").notNull(),
+	oidcConfig: text("oidc_config"),
+	samlConfig: text("saml_config"),
+	userId: text("user_id").notNull().references(() => authUser.id, { onDelete: "cascade" }),
+	providerId: text("provider_id").notNull().unique(),
+	organizationId: text("organization_id"),
+	domain: text("domain").notNull()
+});
+/** Table handles for the Better Auth base models, keyed by model name. */
+const baseAuthTables = {
+	user: authUser,
+	session: authSession,
+	account: authAccount,
+	verification: authVerification,
+	passkey: authPasskey,
+	ssoProvider: authSsoProvider
+};
+/** Date-valued fields per base model (ISO strings at rest, Dates in flight). */
+const baseAuthDateFields = {
+	user: ["createdAt", "updatedAt"],
+	session: [
+		"expiresAt",
+		"createdAt",
+		"updatedAt"
+	],
+	account: [
+		"accessTokenExpiresAt",
+		"refreshTokenExpiresAt",
+		"expiresAt",
+		"createdAt",
+		"updatedAt"
+	],
+	verification: [
+		"expiresAt",
+		"createdAt",
+		"updatedAt"
+	],
+	passkey: ["createdAt", "updatedAt"],
+	ssoProvider: []
+};
+//#endregion
+export { authAccount, authPasskey, authSession, authSsoProvider, authUser, authVerification, baseAuthDateFields, baseAuthTables };
+
+//# sourceMappingURL=auth-tables.mjs.map

package/dist/auth-tables.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-tables.mjs","names":[],"sources":["../src/auth-tables.ts"],"sourcesContent":["/**\n * Auth table definitions: drizzle handles for the Better Auth base models.\n *\n * Keys are camelCase (repo convention); columns snake_case. Field names match\n * Better Auth defaults exactly, so the bridge needs no name translation.\n * Custom modelName/fieldName options are unsupported in v1 (fail fast).\n * DDL for drivers is vendored separately (see E3); these defs are the source\n * of truth the DDL must match (the strict schema checker enforces it).\n */\nimport { integer, sqliteTable, text } from \"drizzle-orm/sqlite-core\";\n\n/** Narrow `user` table definition (Better Auth base model). */\nexport const authUser = sqliteTable(\"user\", {\n  id: text(\"id\").primaryKey(),\n  name: text(\"name\").notNull(),\n  email: text(\"email\").notNull().unique(),\n  emailVerified: integer(\"email_verified\", { mode: \"boolean\" }).notNull().default(false),\n  image: text(\"image\"),\n  createdAt: text(\"created_at\").notNull(),\n  updatedAt: text(\"updated_at\").notNull(),\n});\n\n/** Narrow `session` table definition (Better Auth base model). */\nexport const authSession = sqliteTable(\"session\", {\n  id: text(\"id\").primaryKey(),\n  userId: text(\"user_id\")\n    .notNull()\n    .references(() => authUser.id, { onDelete: \"cascade\" }),\n  token: text(\"token\").notNull().unique(),\n  expiresAt: text(\"expires_at\").notNull(),\n  ipAddress: text(\"ip_address\"),\n  userAgent: text(\"user_agent\"),\n  createdAt: text(\"created_at\").notNull(),\n  updatedAt: text(\"updated_at\").notNull(),\n});\n\n/** Narrow `account` table definition (Better Auth base model). */\nexport const authAccount = sqliteTable(\"account\", {\n  id: text(\"id\").primaryKey(),\n  userId: text(\"user_id\")\n    .notNull()\n    .references(() => authUser.id, { onDelete: \"cascade\" }),\n  accountId: text(\"account_id\").notNull(),\n  providerId: text(\"provider_id\").notNull(),\n  accessToken: text(\"access_token\"),\n  refreshToken: text(\"refresh_token\"),\n  idToken: text(\"id_token\"),\n  accessTokenExpiresAt: text(\"access_token_expires_at\"),\n  refreshTokenExpiresAt: text(\"refresh_token_expires_at\"),\n  scope: text(\"scope\"),\n  expiresAt: text(\"expires_at\"),\n  password: text(\"password\"),\n  createdAt: text(\"created_at\").notNull(),\n  updatedAt: text(\"updated_at\").notNull(),\n});\n\n/** Narrow `verification` table definition (Better Auth base model). */\nexport const authVerification = sqliteTable(\"verification\", {\n  id: text(\"id\").primaryKey(),\n  identifier: text(\"identifier\").notNull(),\n  value: text(\"value\").notNull(),\n  expiresAt: text(\"expires_at\").notNull(),\n  createdAt: text(\"created_at\").notNull(),\n  updatedAt: text(\"updated_at\").notNull(),\n});\n\n/** Narrow `passkey` table definition (passkey plugin model). */ export const authPasskey =\n  sqliteTable(\"passkey\", {\n    id: text(\"id\").primaryKey(),\n    name: text(\"name\"),\n    publicKey: text(\"public_key\").notNull(),\n    userId: text(\"user_id\")\n      .notNull()\n      .references(() => authUser.id, { onDelete: \"cascade\" }),\n    credentialID: text(\"credential_id\").notNull(),\n    counter: integer(\"counter\").notNull(),\n    deviceType: text(\"device_type\").notNull(),\n    backedUp: integer(\"backed_up\", { mode: \"boolean\" }).notNull().default(false),\n    transports: text(\"transports\"),\n    aaguid: text(\"aaguid\"),\n    createdAt: text(\"created_at\").notNull(),\n    // Nullable by design: the plugin's verify-registration create omits\n    // `updatedAt` (its model schema has no such field), so the bridge writes\n    // null. Counter updates never touch it either.\n    updatedAt: text(\"updated_at\"),\n  });\n\n/** Narrow `ssoProvider` table definition (SSO plugin model). */\nexport const authSsoProvider = sqliteTable(\"ssoProvider\", {\n  id: text(\"id\").primaryKey(),\n  issuer: text(\"issuer\").notNull(),\n  oidcConfig: text(\"oidc_config\"),\n  samlConfig: text(\"saml_config\"),\n  userId: text(\"user_id\")\n    .notNull()\n    .references(() => authUser.id, { onDelete: \"cascade\" }),\n  providerId: text(\"provider_id\").notNull().unique(),\n  organizationId: text(\"organization_id\"),\n  domain: text(\"domain\").notNull(),\n});\n\n/** Table handles for the Better Auth base models, keyed by model name. */\nexport const baseAuthTables = {\n  user: authUser,\n  session: authSession,\n  account: authAccount,\n  verification: authVerification,\n  passkey: authPasskey,\n  ssoProvider: authSsoProvider,\n};\n\n/** Date-valued fields per base model (ISO strings at rest, Dates in flight). */\nexport const baseAuthDateFields: Record<string, string[]> = {\n  user: [\"createdAt\", \"updatedAt\"],\n  session: [\"expiresAt\", \"createdAt\", \"updatedAt\"],\n  account: [\"accessTokenExpiresAt\", \"refreshTokenExpiresAt\", \"expiresAt\", \"createdAt\", \"updatedAt\"],\n  verification: [\"expiresAt\", \"createdAt\", \"updatedAt\"],\n  passkey: [\"createdAt\", \"updatedAt\"],\n  // No timestamps: the SSO plugin never writes them (register create sends\n  // no createdAt/updatedAt; defaultSSO entries write no rows at all).\n  ssoProvider: [],\n};\n"],"mappings":";;;;;;;;;;;;;;;AAYA,MAAa,WAAW,YAAY,QAAQ;CAC1C,IAAI,KAAK,IAAI,CAAC,CAAC,WAAW;CAC1B,MAAM,KAAK,MAAM,CAAC,CAAC,QAAQ;CAC3B,OAAO,KAAK,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,OAAO;CACtC,eAAe,QAAQ,kBAAkB,EAAE,MAAM,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,QAAQ,KAAK;CACrF,OAAO,KAAK,OAAO;CACnB,WAAW,KAAK,YAAY,CAAC,CAAC,QAAQ;CACtC,WAAW,KAAK,YAAY,CAAC,CAAC,QAAQ;AACxC,CAAC;;AAGD,MAAa,cAAc,YAAY,WAAW;CAChD,IAAI,KAAK,IAAI,CAAC,CAAC,WAAW;CAC1B,QAAQ,KAAK,SAAS,CAAC,CACpB,QAAQ,CAAC,CACT,iBAAiB,SAAS,IAAI,EAAE,UAAU,UAAU,CAAC;CACxD,OAAO,KAAK,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,OAAO;CACtC,WAAW,KAAK,YAAY,CAAC,CAAC,QAAQ;CACtC,WAAW,KAAK,YAAY;CAC5B,WAAW,KAAK,YAAY;CAC5B,WAAW,KAAK,YAAY,CAAC,CAAC,QAAQ;CACtC,WAAW,KAAK,YAAY,CAAC,CAAC,QAAQ;AACxC,CAAC;;AAGD,MAAa,cAAc,YAAY,WAAW;CAChD,IAAI,KAAK,IAAI,CAAC,CAAC,WAAW;CAC1B,QAAQ,KAAK,SAAS,CAAC,CACpB,QAAQ,CAAC,CACT,iBAAiB,SAAS,IAAI,EAAE,UAAU,UAAU,CAAC;CACxD,WAAW,KAAK,YAAY,CAAC,CAAC,QAAQ;CACtC,YAAY,KAAK,aAAa,CAAC,CAAC,QAAQ;CACxC,aAAa,KAAK,cAAc;CAChC,cAAc,KAAK,eAAe;CAClC,SAAS,KAAK,UAAU;CACxB,sBAAsB,KAAK,yBAAyB;CACpD,uBAAuB,KAAK,0BAA0B;CACtD,OAAO,KAAK,OAAO;CACnB,WAAW,KAAK,YAAY;CAC5B,UAAU,KAAK,UAAU;CACzB,WAAW,KAAK,YAAY,CAAC,CAAC,QAAQ;CACtC,WAAW,KAAK,YAAY,CAAC,CAAC,QAAQ;AACxC,CAAC;;AAGD,MAAa,mBAAmB,YAAY,gBAAgB;CAC1D,IAAI,KAAK,IAAI,CAAC,CAAC,WAAW;CAC1B,YAAY,KAAK,YAAY,CAAC,CAAC,QAAQ;CACvC,OAAO,KAAK,OAAO,CAAC,CAAC,QAAQ;CAC7B,WAAW,KAAK,YAAY,CAAC,CAAC,QAAQ;CACtC,WAAW,KAAK,YAAY,CAAC,CAAC,QAAQ;CACtC,WAAW,KAAK,YAAY,CAAC,CAAC,QAAQ;AACxC,CAAC;iEAEgE,MAAa,cAC5E,YAAY,WAAW;CACrB,IAAI,KAAK,IAAI,CAAC,CAAC,WAAW;CAC1B,MAAM,KAAK,MAAM;CACjB,WAAW,KAAK,YAAY,CAAC,CAAC,QAAQ;CACtC,QAAQ,KAAK,SAAS,CAAC,CACpB,QAAQ,CAAC,CACT,iBAAiB,SAAS,IAAI,EAAE,UAAU,UAAU,CAAC;CACxD,cAAc,KAAK,eAAe,CAAC,CAAC,QAAQ;CAC5C,SAAS,QAAQ,SAAS,CAAC,CAAC,QAAQ;CACpC,YAAY,KAAK,aAAa,CAAC,CAAC,QAAQ;CACxC,UAAU,QAAQ,aAAa,EAAE,MAAM,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,QAAQ,KAAK;CAC3E,YAAY,KAAK,YAAY;CAC7B,QAAQ,KAAK,QAAQ;CACrB,WAAW,KAAK,YAAY,CAAC,CAAC,QAAQ;CAItC,WAAW,KAAK,YAAY;AAC9B,CAAC;;AAGH,MAAa,kBAAkB,YAAY,eAAe;CACxD,IAAI,KAAK,IAAI,CAAC,CAAC,WAAW;CAC1B,QAAQ,KAAK,QAAQ,CAAC,CAAC,QAAQ;CAC/B,YAAY,KAAK,aAAa;CAC9B,YAAY,KAAK,aAAa;CAC9B,QAAQ,KAAK,SAAS,CAAC,CACpB,QAAQ,CAAC,CACT,iBAAiB,SAAS,IAAI,EAAE,UAAU,UAAU,CAAC;CACxD,YAAY,KAAK,aAAa,CAAC,CAAC,QAAQ,CAAC,CAAC,OAAO;CACjD,gBAAgB,KAAK,iBAAiB;CACtC,QAAQ,KAAK,QAAQ,CAAC,CAAC,QAAQ;AACjC,CAAC;;AAGD,MAAa,iBAAiB;CAC5B,MAAM;CACN,SAAS;CACT,SAAS;CACT,cAAc;CACd,SAAS;CACT,aAAa;AACf;;AAGA,MAAa,qBAA+C;CAC1D,MAAM,CAAC,aAAa,WAAW;CAC/B,SAAS;EAAC;EAAa;EAAa;CAAW;CAC/C,SAAS;EAAC;EAAwB;EAAyB;EAAa;EAAa;CAAW;CAChG,cAAc;EAAC;EAAa;EAAa;CAAW;CACpD,SAAS,CAAC,aAAa,WAAW;CAGlC,aAAa,CAAC;AAChB"}

package/dist/bootstrap.d.mts

@@ -0,0 +1,15 @@
+import __tsdown_shims_path from 'node:path';
+import __tsdown_shims_url from 'node:url';
+import { DatabaseAdapter } from "@storyshelf/core/adapter/database";
+//#region src/bootstrap.d.ts
+/** Input for {@link ensurePasswordAdmin}. */
+interface PasswordAdminInput {
+  email: string;
+  name?: string;
+  password: string;
+}
+/** Provision (or refresh the credential of) the env-driven local admin. */
+declare function ensurePasswordAdmin(db: DatabaseAdapter, input: PasswordAdminInput): Promise<void>;
+//#endregion
+export { PasswordAdminInput, ensurePasswordAdmin };
+//# sourceMappingURL=bootstrap.d.mts.map

package/dist/bootstrap.mjs

@@ -0,0 +1,40 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { ensureEngineIdentity, tableColumn } from "./invites.mjs";
+import { ulid } from "@storyshelf/core/utils";
+import { eq } from "drizzle-orm";
+//#region src/bootstrap.ts
+/** Find the env admin row, or stage it (admin role, no credential yet). */
+async function stagePasswordAdmin(db, email, name, now) {
+	const existing = (await db.list(db.tables.users, {
+		where: eq(tableColumn(db.tables.users, "email"), email),
+		limit: 1
+	}))[0];
+	if (existing) return existing;
+	return await db.insert(db.tables.users, {
+		id: ulid(),
+		email,
+		name,
+		avatarUrl: null,
+		role: "admin",
+		lastLoginAt: null,
+		createdAt: now,
+		passwordHash: null,
+		displayNameOverride: null,
+		authProvider: "local",
+		disabled: false
+	});
+}
+/** Provision (or refresh the credential of) the env-driven local admin. */
+async function ensurePasswordAdmin(db, input) {
+	const email = input.email.trim().toLowerCase();
+	if (input.password.length < 12) throw new Error("Password must be at least 12 characters");
+	const now = (/* @__PURE__ */ new Date()).toISOString();
+	const shelfUser = await stagePasswordAdmin(db, email, input.name ?? "Admin", now);
+	await ensureEngineIdentity(db, shelfUser, input.password);
+}
+//#endregion
+export { ensurePasswordAdmin };
+
+//# sourceMappingURL=bootstrap.mjs.map

package/dist/bootstrap.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootstrap.mjs","names":[],"sources":["../src/bootstrap.ts"],"sourcesContent":["/**\n * Development bootstrap: provision a local admin from environment credentials.\n *\n * Replaces the dropped shared-password tier for `dev-server`/`fly-app`:\n * with `AUTH_PASSWORD` set, the first boot creates an admin identity and\n * every boot aligns its engine credential with the env value (same\n * always-from-env semantics the shared tier had). Production deployments\n * use the invite flow instead.\n */\nimport type { DatabaseAdapter } from \"@storyshelf/core/adapter/database\";\nimport { ulid } from \"@storyshelf/core/utils\";\nimport { eq } from \"drizzle-orm\";\nimport { ensureEngineIdentity, MIN_PASSWORD_LENGTH, tableColumn } from \"./invites.ts\";\n\n/** Input for {@link ensurePasswordAdmin}. */\nexport interface PasswordAdminInput {\n  email: string;\n  name?: string;\n  password: string;\n}\n\n/** Find the env admin row, or stage it (admin role, no credential yet). */\nasync function stagePasswordAdmin(\n  db: DatabaseAdapter,\n  email: string,\n  name: string,\n  now: string,\n): Promise<Record<string, unknown>> {\n  const rows: Record<string, unknown>[] = await db.list(db.tables.users, {\n    where: eq(tableColumn(db.tables.users, \"email\"), email),\n    limit: 1,\n  });\n  const existing = rows[0];\n  if (existing) {\n    return existing;\n  }\n  return await db.insert(db.tables.users, {\n    id: ulid(),\n    email,\n    name,\n    avatarUrl: null,\n    role: \"admin\",\n    lastLoginAt: null,\n    createdAt: now,\n    passwordHash: null,\n    displayNameOverride: null,\n    authProvider: \"local\",\n    disabled: false,\n  });\n}\n\n/** Provision (or refresh the credential of) the env-driven local admin. */\nexport async function ensurePasswordAdmin(\n  db: DatabaseAdapter,\n  input: PasswordAdminInput,\n): Promise<void> {\n  const email = input.email.trim().toLowerCase();\n  if (input.password.length < MIN_PASSWORD_LENGTH) {\n    throw new Error(\"Password must be at least 12 characters\");\n  }\n  const now = new Date().toISOString();\n  const shelfUser = await stagePasswordAdmin(db, email, input.name ?? \"Admin\", now);\n  await ensureEngineIdentity(db, shelfUser, input.password);\n}\n"],"mappings":";;;;;;;;AAsBA,eAAe,mBACb,IACA,OACA,MACA,KACkC;CAKlC,MAAM,YAAW,MAJ6B,GAAG,KAAK,GAAG,OAAO,OAAO;EACrE,OAAO,GAAG,YAAY,GAAG,OAAO,OAAO,OAAO,GAAG,KAAK;EACtD,OAAO;CACT,CAAC,EAAA,CACqB;CACtB,IAAI,UACF,OAAO;CAET,OAAO,MAAM,GAAG,OAAO,GAAG,OAAO,OAAO;EACtC,IAAI,KAAK;EACT;EACA;EACA,WAAW;EACX,MAAM;EACN,aAAa;EACb,WAAW;EACX,cAAc;EACd,qBAAqB;EACrB,cAAc;EACd,UAAU;CACZ,CAAC;AACH;;AAGA,eAAsB,oBACpB,IACA,OACe;CACf,MAAM,QAAQ,MAAM,MAAM,KAAK,CAAC,CAAC,YAAY;CAC7C,IAAI,MAAM,SAAS,SAAA,IACjB,MAAM,IAAI,MAAM,yCAAyC;CAE3D,MAAM,uBAAM,IAAI,KAAK,EAAA,CAAE,YAAY;CACnC,MAAM,YAAY,MAAM,mBAAmB,IAAI,OAAO,MAAM,QAAQ,SAAS,GAAG;CAChF,MAAM,qBAAqB,IAAI,WAAW,MAAM,QAAQ;AAC1D"}

package/dist/config.d.mts

@@ -0,0 +1,27 @@
+import __tsdown_shims_path from 'node:path';
+import __tsdown_shims_url from 'node:url';
+import { ShelfAuthOptions } from "./engine.mjs";
+import { z } from "zod";
+//#region src/config.d.ts
+/** Extract the variable name from an `{env:NAME}` ref, or null. */
+declare function parseEnvRef(value: string): string | null;
+/**
+ * Customer-owned secret backend (Vault/AWS/GCP/...). Called once per boot
+ * with the ref names missing from `process.env`; return the values you hold.
+ */
+interface ResolveSecrets {
+  (names: string[]): Promise<Record<string, string | undefined>> | Record<string, string | undefined>;
+}
+/** Input for {@link resolveAuthOptions} (refs allowed in any string field). */
+interface RawShelfAuthOptions extends Omit<ShelfAuthOptions, "plugins"> {
+  /** Secret backend fallback for refs missing from `process.env`. */
+  resolveSecrets?: ResolveSecrets;
+  /** Custom Better Auth plugins (never validated; passed through by reference). */
+  plugins?: ShelfAuthOptions["plugins"];
+}
+/** Zod schema validating shelf auth options (before secret resolution). */
+declare const authOptionsSchema: z.ZodType<Omit<ShelfAuthOptions, "plugins">>;
+declare function resolveAuthOptions(input: RawShelfAuthOptions): Promise<ShelfAuthOptions>;
+//#endregion
+export { RawShelfAuthOptions, ResolveSecrets, authOptionsSchema, parseEnvRef, resolveAuthOptions };
+//# sourceMappingURL=config.d.mts.map

package/dist/config.mjs

@@ -0,0 +1,204 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { z } from "zod";
+//#region src/config.ts
+/**
+* Auth config-as-code: validated, secret-safe engine options.
+*
+* Servers declare auth in code; secrets stay out of it via `{env:NAME}`
+* refs resolved at boot from `process.env` first, then the customer-owned
+* `resolveSecrets` hook (Vault/AWS/GCP/...). Precedence everywhere:
+* explicit literal > `{env}` ref > schema default, and code (`defaultSSO`,
+* recipes) > DB rows > plugin defaults at sign-in time.
+*/
+/** `{env:NAME}` reference (whole-string match; surrounding text is literal). */
+const ENV_REF = /^\{env:(?<name>[A-Za-z_][A-Za-z0-9_]*)\}$/u;
+/** Extract the variable name from an `{env:NAME}` ref, or null. */
+function parseEnvRef(value) {
+	return ENV_REF.exec(value)?.groups?.["name"] ?? null;
+}
+const socialSchema = z.object({
+	id: z.enum([
+		"github",
+		"gitlab",
+		"google",
+		"microsoft",
+		"cognito"
+	]),
+	label: z.string().min(1),
+	clientId: z.string().min(1),
+	clientSecret: z.string().optional(),
+	extra: z.record(z.string(), z.string().optional()).optional()
+});
+const oauthSchema = z.object({
+	id: z.string().min(1),
+	label: z.string().min(1),
+	clientId: z.string().min(1),
+	clientSecret: z.string().optional(),
+	discoveryUrl: z.string().optional(),
+	authorizationUrl: z.string().optional(),
+	tokenUrl: z.string().optional(),
+	userInfoUrl: z.string().optional(),
+	scopes: z.array(z.string().min(1)).optional()
+});
+const ssoOidcSchema = z.object({
+	issuer: z.string().min(1),
+	discoveryUrl: z.string().optional(),
+	clientId: z.string().min(1),
+	clientSecret: z.string().optional(),
+	scopes: z.array(z.string().min(1)).optional(),
+	pkce: z.boolean().optional()
+});
+const ssoSamlSchema = z.object({
+	issuer: z.string().min(1),
+	entryPoint: z.string().min(1),
+	cert: z.union([z.string(), z.array(z.string())]).optional(),
+	metadataXml: z.string().optional(),
+	entityID: z.string().optional(),
+	audience: z.string().optional(),
+	wantAssertionsSigned: z.boolean().optional()
+});
+const ssoGroupsSchema = z.object({
+	claim: z.union([z.string().min(1), z.array(z.string().min(1)).min(1)]).optional(),
+	admins: z.array(z.string().min(1)).optional()
+});
+const ssoProviderSchema = z.object({
+	id: z.string().min(1),
+	label: z.string().min(1),
+	domain: z.string().min(1),
+	oidc: ssoOidcSchema.optional(),
+	saml: ssoSamlSchema.optional(),
+	groups: ssoGroupsSchema.optional()
+});
+const passkeysSchema = z.object({
+	rpID: z.string().min(1).optional(),
+	rpName: z.string().min(1).optional(),
+	origin: z.union([z.string().min(1), z.array(z.string().min(1))]).optional()
+});
+/** Zod schema validating shelf auth options (before secret resolution). */
+const authOptionsSchema = z.object({
+	db: z.custom((value) => typeof value === "object" && value !== null),
+	secret: z.string().min(1),
+	baseURL: z.string().url(),
+	emailPassword: z.boolean().optional(),
+	emailSender: z.custom((value) => typeof value === "object" && value !== null).optional(),
+	fromEmail: z.string().min(1).optional(),
+	onAuthSystemEvent: z.custom((value) => typeof value === "function").optional(),
+	logger: z.custom((value) => typeof value === "object" && value !== null).optional(),
+	social: z.array(socialSchema).optional(),
+	oauth: z.array(oauthSchema).optional(),
+	sso: z.object({
+		providers: z.array(ssoProviderSchema).min(1),
+		disableImplicitSignUp: z.boolean().optional()
+	}).optional(),
+	passkeys: passkeysSchema.optional(),
+	sessionExpiresInDays: z.number().int().positive().optional()
+}).strict();
+function formatIssues(error) {
+	return error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; ");
+}
+function collectFromValue(value, into) {
+	if (Array.isArray(value)) {
+		for (const entry of value) collectEnvNames(entry, into);
+		return;
+	}
+	if (typeof value === "object" && value !== null) for (const entry of Object.values(value)) collectEnvNames(entry, into);
+}
+function collectEnvNames(value, into) {
+	if (typeof value === "string") {
+		const name = parseEnvRef(value);
+		if (name) into.add(name);
+		return;
+	}
+	collectFromValue(value, into);
+}
+function substituteEnvNames(value, secrets) {
+	if (typeof value === "string") {
+		const name = parseEnvRef(value);
+		return name ? secrets.get(name) ?? value : value;
+	}
+	if (Array.isArray(value)) return value.map((entry) => substituteEnvNames(entry, secrets));
+	if (typeof value === "object" && value !== null) return Object.fromEntries(Object.entries(value).map(([key, entry]) => [key, substituteEnvNames(entry, secrets)]));
+	return value;
+}
+/** Split ref names into env-held and hook-needed sets. */
+function partitionSecretNames(names) {
+	const secrets = /* @__PURE__ */ new Map();
+	const missing = [];
+	for (const name of names) {
+		const fromEnv = process.env[name];
+		if (fromEnv) secrets.set(name, fromEnv);
+		else missing.push(name);
+	}
+	return {
+		secrets,
+		missing
+	};
+}
+/** Fill hook-provided values into the secret map. */
+async function fillFromHook(secrets, missing, hook) {
+	if (missing.length === 0 || !hook) return;
+	const provided = await hook(missing);
+	for (const name of missing) if (provided[name]) secrets.set(name, provided[name]);
+}
+/** Resolve `{env:NAME}` refs from the environment, then the hook. */
+async function resolveSecretValues(names, hook) {
+	const { secrets, missing } = partitionSecretNames(names);
+	await fillFromHook(secrets, missing, hook);
+	const unsettled = [...names].filter((name) => !secrets.has(name));
+	if (unsettled.length > 0) throw new Error(`Shelf auth secrets missing: ${unsettled.join(", ")} (set the env vars or provide resolveSecrets)`);
+	return secrets;
+}
+/**
+* Secret-bearing subtrees: `db` (live adapter with circular drizzle handles),
+* `emailSender` (live transport), `logger` (pino instance), `onAuthSystemEvent`
+* (host callback), and `plugins` (class instances) pass through by reference
+* and are never walked or cloned — refs only make sense in plain config data.
+*/
+function secretSubtrees(options) {
+	const { db: _db, emailSender: _sender, logger: _logger, onAuthSystemEvent: _hook, ...rest } = options;
+	return rest;
+}
+function parseRawOptions(input) {
+	const { resolveSecrets, plugins, ...rest } = input;
+	const parsed = authOptionsSchema.safeParse(rest);
+	if (!parsed.success) throw new Error(`Invalid shelf auth options: ${formatIssues(parsed.error)}`);
+	return {
+		options: parsed.data,
+		plugins,
+		resolveSecrets
+	};
+}
+/**
+* Validate auth options and resolve `{env:NAME}` secret refs.
+*
+* @param input - Raw options (refs allowed in any string field) plus the
+* optional customer-owned `resolveSecrets` fallback.
+* @returns Engine-ready options for {@link createShelfAuth}.
+*/
+/** Collect `{env:}` refs and resolve their values (empty when none). */
+async function collectSecrets(options, hook) {
+	const names = /* @__PURE__ */ new Set();
+	collectEnvNames(secretSubtrees(options), names);
+	if (names.size === 0) return {};
+	const values = await resolveSecretValues(names, hook);
+	return substituteEnvNames(secretSubtrees(options), values);
+}
+async function resolveAuthOptions(input) {
+	const { options, plugins, resolveSecrets } = parseRawOptions(input);
+	const secrets = await collectSecrets(options, resolveSecrets);
+	const resolved = {
+		...options,
+		...secrets
+	};
+	if (resolved.secret.length < 32) throw new Error("Shelf auth requires a secret of at least 32 characters");
+	return {
+		...resolved,
+		...plugins ? { plugins } : {}
+	};
+}
+//#endregion
+export { authOptionsSchema, parseEnvRef, resolveAuthOptions };
+
+//# sourceMappingURL=config.mjs.map

package/dist/config.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.mjs","names":[],"sources":["../src/config.ts"],"sourcesContent":["/**\n * Auth config-as-code: validated, secret-safe engine options.\n *\n * Servers declare auth in code; secrets stay out of it via `{env:NAME}`\n * refs resolved at boot from `process.env` first, then the customer-owned\n * `resolveSecrets` hook (Vault/AWS/GCP/...). Precedence everywhere:\n * explicit literal > `{env}` ref > schema default, and code (`defaultSSO`,\n * recipes) > DB rows > plugin defaults at sign-in time.\n */\nimport { z } from \"zod\";\nimport type {\n  ShelfAuthOptions,\n  ShelfOAuthProvider,\n  ShelfPasskeyOptions,\n  ShelfSocialProvider,\n  ShelfSSOGroupSync,\n  ShelfSSOOidc,\n  ShelfSSOProvider,\n  ShelfSSOSaml,\n} from \"./engine.ts\";\n\n/** `{env:NAME}` reference (whole-string match; surrounding text is literal). */\nconst ENV_REF = /^\\{env:(?<name>[A-Za-z_][A-Za-z0-9_]*)\\}$/u;\n\n/** Extract the variable name from an `{env:NAME}` ref, or null. */\nexport function parseEnvRef(value: string): string | null {\n  return ENV_REF.exec(value)?.groups?.[\"name\"] ?? null;\n}\n\n/**\n * Customer-owned secret backend (Vault/AWS/GCP/...). Called once per boot\n * with the ref names missing from `process.env`; return the values you hold.\n */\nexport interface ResolveSecrets {\n  (\n    names: string[],\n  ): Promise<Record<string, string | undefined>> | Record<string, string | undefined>;\n}\n\n/** Input for {@link resolveAuthOptions} (refs allowed in any string field). */\nexport interface RawShelfAuthOptions extends Omit<ShelfAuthOptions, \"plugins\"> {\n  /** Secret backend fallback for refs missing from `process.env`. */\n  resolveSecrets?: ResolveSecrets;\n  /** Custom Better Auth plugins (never validated; passed through by reference). */\n  plugins?: ShelfAuthOptions[\"plugins\"];\n}\n\nconst socialSchema: z.ZodType<ShelfSocialProvider> = z.object({\n  id: z.enum([\"github\", \"gitlab\", \"google\", \"microsoft\", \"cognito\"]),\n  label: z.string().min(1),\n  clientId: z.string().min(1),\n  clientSecret: z.string().optional(),\n  extra: z.record(z.string(), z.string().optional()).optional(),\n});\n\nconst oauthSchema: z.ZodType<ShelfOAuthProvider> = z.object({\n  id: z.string().min(1),\n  label: z.string().min(1),\n  clientId: z.string().min(1),\n  clientSecret: z.string().optional(),\n  discoveryUrl: z.string().optional(),\n  authorizationUrl: z.string().optional(),\n  tokenUrl: z.string().optional(),\n  userInfoUrl: z.string().optional(),\n  scopes: z.array(z.string().min(1)).optional(),\n});\n\nconst ssoOidcSchema: z.ZodType<ShelfSSOOidc> = z.object({\n  issuer: z.string().min(1),\n  discoveryUrl: z.string().optional(),\n  clientId: z.string().min(1),\n  clientSecret: z.string().optional(),\n  scopes: z.array(z.string().min(1)).optional(),\n  pkce: z.boolean().optional(),\n});\n\nconst ssoSamlSchema: z.ZodType<ShelfSSOSaml> = z.object({\n  issuer: z.string().min(1),\n  entryPoint: z.string().min(1),\n  cert: z.union([z.string(), z.array(z.string())]).optional(),\n  metadataXml: z.string().optional(),\n  entityID: z.string().optional(),\n  audience: z.string().optional(),\n  wantAssertionsSigned: z.boolean().optional(),\n});\n\nconst ssoGroupsSchema: z.ZodType<ShelfSSOGroupSync> = z.object({\n  claim: z.union([z.string().min(1), z.array(z.string().min(1)).min(1)]).optional(),\n  admins: z.array(z.string().min(1)).optional(),\n});\n\nconst ssoProviderSchema: z.ZodType<ShelfSSOProvider> = z.object({\n  id: z.string().min(1),\n  label: z.string().min(1),\n  domain: z.string().min(1),\n  oidc: ssoOidcSchema.optional(),\n  saml: ssoSamlSchema.optional(),\n  groups: ssoGroupsSchema.optional(),\n});\n\nconst passkeysSchema: z.ZodType<ShelfPasskeyOptions> = z.object({\n  rpID: z.string().min(1).optional(),\n  rpName: z.string().min(1).optional(),\n  origin: z.union([z.string().min(1), z.array(z.string().min(1))]).optional(),\n});\n\n/** Zod schema validating shelf auth options (before secret resolution). */\nexport const authOptionsSchema = z\n  .object({\n    db: z.custom<ShelfAuthOptions[\"db\"]>((value) => typeof value === \"object\" && value !== null),\n    // Any non-empty string (refs resolve later); the 32-char floor applies\n    // to the resolved value (same threshold as the engine boot check).\n    secret: z.string().min(1),\n    // oxlint-disable-next-line typescript/no-deprecated -- z.string().url() kept for zod v3 API compat\n    baseURL: z.string().url(),\n    emailPassword: z.boolean().optional(),\n    emailSender: z\n      .custom<ShelfAuthOptions[\"emailSender\"]>(\n        (value) => typeof value === \"object\" && value !== null,\n      )\n      .optional(),\n    fromEmail: z.string().min(1).optional(),\n    onAuthSystemEvent: z\n      .custom<ShelfAuthOptions[\"onAuthSystemEvent\"]>((value) => typeof value === \"function\")\n      .optional(),\n    logger: z\n      .custom<ShelfAuthOptions[\"logger\"]>((value) => typeof value === \"object\" && value !== null)\n      .optional(),\n    social: z.array(socialSchema).optional(),\n    oauth: z.array(oauthSchema).optional(),\n    sso: z\n      .object({\n        providers: z.array(ssoProviderSchema).min(1),\n        disableImplicitSignUp: z.boolean().optional(),\n      })\n      .optional(),\n    passkeys: passkeysSchema.optional(),\n    sessionExpiresInDays: z.number().int().positive().optional(),\n  })\n  .strict() as z.ZodType<Omit<ShelfAuthOptions, \"plugins\">>;\n\nfunction formatIssues(error: z.ZodError): string {\n  return error.issues.map((i) => `${i.path.join(\".\")}: ${i.message}`).join(\"; \");\n}\n\nfunction collectFromValue(value: unknown, into: Set<string>): void {\n  if (Array.isArray(value)) {\n    for (const entry of value) {\n      collectEnvNames(entry, into);\n    }\n    return;\n  }\n  if (typeof value === \"object\" && value !== null) {\n    for (const entry of Object.values(value)) {\n      collectEnvNames(entry, into);\n    }\n  }\n}\n\nfunction collectEnvNames(value: unknown, into: Set<string>): void {\n  if (typeof value === \"string\") {\n    const name = parseEnvRef(value);\n    if (name) {\n      into.add(name);\n    }\n    return;\n  }\n  collectFromValue(value, into);\n}\n\nfunction substituteEnvNames(value: unknown, secrets: Map<string, string>): unknown {\n  if (typeof value === \"string\") {\n    const name = parseEnvRef(value);\n    return name ? (secrets.get(name) ?? value) : value;\n  }\n  if (Array.isArray(value)) {\n    return value.map((entry) => substituteEnvNames(entry, secrets));\n  }\n  if (typeof value === \"object\" && value !== null) {\n    return Object.fromEntries(\n      Object.entries(value).map(([key, entry]) => [key, substituteEnvNames(entry, secrets)]),\n    );\n  }\n  return value;\n}\n\n/** Split ref names into env-held and hook-needed sets. */\nfunction partitionSecretNames(names: Set<string>): {\n  secrets: Map<string, string>;\n  missing: string[];\n} {\n  const secrets = new Map<string, string>();\n  const missing: string[] = [];\n  for (const name of names) {\n    const fromEnv = process.env[name];\n    if (fromEnv) {\n      secrets.set(name, fromEnv);\n    } else {\n      missing.push(name);\n    }\n  }\n  return { secrets, missing };\n}\n\n/** Fill hook-provided values into the secret map. */\nasync function fillFromHook(\n  secrets: Map<string, string>,\n  missing: string[],\n  hook: ResolveSecrets | undefined,\n): Promise<void> {\n  if (missing.length === 0 || !hook) {\n    return;\n  }\n  const provided = await hook(missing);\n  for (const name of missing) {\n    if (provided[name]) {\n      secrets.set(name, provided[name]);\n    }\n  }\n}\n\n/** Resolve `{env:NAME}` refs from the environment, then the hook. */\nasync function resolveSecretValues(\n  names: Set<string>,\n  hook: ResolveSecrets | undefined,\n): Promise<Map<string, string>> {\n  const { secrets, missing } = partitionSecretNames(names);\n  await fillFromHook(secrets, missing, hook);\n  const unsettled = [...names].filter((name) => !secrets.has(name));\n  if (unsettled.length > 0) {\n    throw new Error(\n      `Shelf auth secrets missing: ${unsettled.join(\", \")} (set the env vars or provide resolveSecrets)`,\n    );\n  }\n  return secrets;\n}\n\n/**\n * Secret-bearing subtrees: `db` (live adapter with circular drizzle handles),\n * `emailSender` (live transport), `logger` (pino instance), `onAuthSystemEvent`\n * (host callback), and `plugins` (class instances) pass through by reference\n * and are never walked or cloned — refs only make sense in plain config data.\n */\nfunction secretSubtrees(options: Omit<ShelfAuthOptions, \"plugins\">): Record<string, unknown> {\n  const {\n    db: _db,\n    emailSender: _sender,\n    logger: _logger,\n    onAuthSystemEvent: _hook,\n    ...rest\n  } = options as Omit<ShelfAuthOptions, \"plugins\"> & {\n    db: unknown;\n    emailSender: unknown;\n    logger: unknown;\n    onAuthSystemEvent: unknown;\n  };\n  return rest;\n}\n\nfunction parseRawOptions(input: RawShelfAuthOptions): {\n  options: Omit<ShelfAuthOptions, \"plugins\">;\n  plugins: ShelfAuthOptions[\"plugins\"];\n  resolveSecrets: ResolveSecrets | undefined;\n} {\n  const { resolveSecrets, plugins, ...rest } = input;\n  const parsed = authOptionsSchema.safeParse(rest);\n  if (!parsed.success) {\n    throw new Error(`Invalid shelf auth options: ${formatIssues(parsed.error)}`);\n  }\n  return { options: parsed.data, plugins, resolveSecrets };\n}\n\n/**\n * Validate auth options and resolve `{env:NAME}` secret refs.\n *\n * @param input - Raw options (refs allowed in any string field) plus the\n * optional customer-owned `resolveSecrets` fallback.\n * @returns Engine-ready options for {@link createShelfAuth}.\n */\n/** Collect `{env:}` refs and resolve their values (empty when none). */\nasync function collectSecrets(\n  options: Omit<ShelfAuthOptions, \"plugins\">,\n  hook: ResolveSecrets | undefined,\n): Promise<Record<string, unknown>> {\n  const names = new Set<string>();\n  collectEnvNames(secretSubtrees(options), names);\n  if (names.size === 0) {\n    return {};\n  }\n  const values = await resolveSecretValues(names, hook);\n  return substituteEnvNames(secretSubtrees(options), values) as Record<string, unknown>;\n}\n\nexport async function resolveAuthOptions(input: RawShelfAuthOptions): Promise<ShelfAuthOptions> {\n  const { options, plugins, resolveSecrets } = parseRawOptions(input);\n  const secrets = await collectSecrets(options, resolveSecrets);\n  const resolved = { ...options, ...secrets } as Omit<ShelfAuthOptions, \"plugins\">;\n  if (resolved.secret.length < 32) {\n    throw new Error(\"Shelf auth requires a secret of at least 32 characters\");\n  }\n  return { ...resolved, ...(plugins ? { plugins } : {}) };\n}\n"],"mappings":";;;;;;;;;;;;;;;AAsBA,MAAM,UAAU;;AAGhB,SAAgB,YAAY,OAA8B;CACxD,OAAO,QAAQ,KAAK,KAAK,CAAC,EAAE,SAAS,WAAW;AAClD;AAoBA,MAAM,eAA+C,EAAE,OAAO;CAC5D,IAAI,EAAE,KAAK;EAAC;EAAU;EAAU;EAAU;EAAa;CAAS,CAAC;CACjE,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACvB,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CAC1B,cAAc,EAAE,OAAO,CAAC,CAAC,SAAS;CAClC,OAAO,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;AAC9D,CAAC;AAED,MAAM,cAA6C,EAAE,OAAO;CAC1D,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACpB,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACvB,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CAC1B,cAAc,EAAE,OAAO,CAAC,CAAC,SAAS;CAClC,cAAc,EAAE,OAAO,CAAC,CAAC,SAAS;CAClC,kBAAkB,EAAE,OAAO,CAAC,CAAC,SAAS;CACtC,UAAU,EAAE,OAAO,CAAC,CAAC,SAAS;CAC9B,aAAa,EAAE,OAAO,CAAC,CAAC,SAAS;CACjC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;AAC9C,CAAC;AAED,MAAM,gBAAyC,EAAE,OAAO;CACtD,QAAQ,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACxB,cAAc,EAAE,OAAO,CAAC,CAAC,SAAS;CAClC,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CAC1B,cAAc,EAAE,OAAO,CAAC,CAAC,SAAS;CAClC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;CAC5C,MAAM,EAAE,QAAQ,CAAC,CAAC,SAAS;AAC7B,CAAC;AAED,MAAM,gBAAyC,EAAE,OAAO;CACtD,QAAQ,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACxB,YAAY,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CAC5B,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;CAC1D,aAAa,EAAE,OAAO,CAAC,CAAC,SAAS;CACjC,UAAU,EAAE,OAAO,CAAC,CAAC,SAAS;CAC9B,UAAU,EAAE,OAAO,CAAC,CAAC,SAAS;CAC9B,sBAAsB,EAAE,QAAQ,CAAC,CAAC,SAAS;AAC7C,CAAC;AAED,MAAM,kBAAgD,EAAE,OAAO;CAC7D,OAAO,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;CAChF,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;AAC9C,CAAC;AAED,MAAM,oBAAiD,EAAE,OAAO;CAC9D,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACpB,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACvB,QAAQ,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACxB,MAAM,cAAc,SAAS;CAC7B,MAAM,cAAc,SAAS;CAC7B,QAAQ,gBAAgB,SAAS;AACnC,CAAC;AAED,MAAM,iBAAiD,EAAE,OAAO;CAC9D,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;CACjC,QAAQ,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;CACnC,QAAQ,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;AAC5E,CAAC;;AAGD,MAAa,oBAAoB,EAC9B,OAAO;CACN,IAAI,EAAE,QAAgC,UAAU,OAAO,UAAU,YAAY,UAAU,IAAI;CAG3F,QAAQ,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CAExB,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI;CACxB,eAAe,EAAE,QAAQ,CAAC,CAAC,SAAS;CACpC,aAAa,EACV,QACE,UAAU,OAAO,UAAU,YAAY,UAAU,IACpD,CAAC,CACA,SAAS;CACZ,WAAW,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;CACtC,mBAAmB,EAChB,QAA+C,UAAU,OAAO,UAAU,UAAU,CAAC,CACrF,SAAS;CACZ,QAAQ,EACL,QAAoC,UAAU,OAAO,UAAU,YAAY,UAAU,IAAI,CAAC,CAC1F,SAAS;CACZ,QAAQ,EAAE,MAAM,YAAY,CAAC,CAAC,SAAS;CACvC,OAAO,EAAE,MAAM,WAAW,CAAC,CAAC,SAAS;CACrC,KAAK,EACF,OAAO;EACN,WAAW,EAAE,MAAM,iBAAiB,CAAC,CAAC,IAAI,CAAC;EAC3C,uBAAuB,EAAE,QAAQ,CAAC,CAAC,SAAS;CAC9C,CAAC,CAAC,CACD,SAAS;CACZ,UAAU,eAAe,SAAS;CAClC,sBAAsB,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS;AAC7D,CAAC,CAAC,CACD,OAAO;AAEV,SAAS,aAAa,OAA2B;CAC/C,OAAO,MAAM,OAAO,KAAK,MAAM,GAAG,EAAE,KAAK,KAAK,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,KAAK,IAAI;AAC/E;AAEA,SAAS,iBAAiB,OAAgB,MAAyB;CACjE,IAAI,MAAM,QAAQ,KAAK,GAAG;EACxB,KAAK,MAAM,SAAS,OAClB,gBAAgB,OAAO,IAAI;EAE7B;CACF;CACA,IAAI,OAAO,UAAU,YAAY,UAAU,MACzC,KAAK,MAAM,SAAS,OAAO,OAAO,KAAK,GACrC,gBAAgB,OAAO,IAAI;AAGjC;AAEA,SAAS,gBAAgB,OAAgB,MAAyB;CAChE,IAAI,OAAO,UAAU,UAAU;EAC7B,MAAM,OAAO,YAAY,KAAK;EAC9B,IAAI,MACF,KAAK,IAAI,IAAI;EAEf;CACF;CACA,iBAAiB,OAAO,IAAI;AAC9B;AAEA,SAAS,mBAAmB,OAAgB,SAAuC;CACjF,IAAI,OAAO,UAAU,UAAU;EAC7B,MAAM,OAAO,YAAY,KAAK;EAC9B,OAAO,OAAQ,QAAQ,IAAI,IAAI,KAAK,QAAS;CAC/C;CACA,IAAI,MAAM,QAAQ,KAAK,GACrB,OAAO,MAAM,KAAK,UAAU,mBAAmB,OAAO,OAAO,CAAC;CAEhE,IAAI,OAAO,UAAU,YAAY,UAAU,MACzC,OAAO,OAAO,YACZ,OAAO,QAAQ,KAAK,CAAC,CAAC,KAAK,CAAC,KAAK,WAAW,CAAC,KAAK,mBAAmB,OAAO,OAAO,CAAC,CAAC,CACvF;CAEF,OAAO;AACT;;AAGA,SAAS,qBAAqB,OAG5B;CACA,MAAM,0BAAU,IAAI,IAAoB;CACxC,MAAM,UAAoB,CAAC;CAC3B,KAAK,MAAM,QAAQ,OAAO;EACxB,MAAM,UAAU,QAAQ,IAAI;EAC5B,IAAI,SACF,QAAQ,IAAI,MAAM,OAAO;OAEzB,QAAQ,KAAK,IAAI;CAErB;CACA,OAAO;EAAE;EAAS;CAAQ;AAC5B;;AAGA,eAAe,aACb,SACA,SACA,MACe;CACf,IAAI,QAAQ,WAAW,KAAK,CAAC,MAC3B;CAEF,MAAM,WAAW,MAAM,KAAK,OAAO;CACnC,KAAK,MAAM,QAAQ,SACjB,IAAI,SAAS,OACX,QAAQ,IAAI,MAAM,SAAS,KAAK;AAGtC;;AAGA,eAAe,oBACb,OACA,MAC8B;CAC9B,MAAM,EAAE,SAAS,YAAY,qBAAqB,KAAK;CACvD,MAAM,aAAa,SAAS,SAAS,IAAI;CACzC,MAAM,YAAY,CAAC,GAAG,KAAK,CAAC,CAAC,QAAQ,SAAS,CAAC,QAAQ,IAAI,IAAI,CAAC;CAChE,IAAI,UAAU,SAAS,GACrB,MAAM,IAAI,MACR,+BAA+B,UAAU,KAAK,IAAI,EAAE,8CACtD;CAEF,OAAO;AACT;;;;;;;AAQA,SAAS,eAAe,SAAqE;CAC3F,MAAM,EACJ,IAAI,KACJ,aAAa,SACb,QAAQ,SACR,mBAAmB,OACnB,GAAG,SACD;CAMJ,OAAO;AACT;AAEA,SAAS,gBAAgB,OAIvB;CACA,MAAM,EAAE,gBAAgB,SAAS,GAAG,SAAS;CAC7C,MAAM,SAAS,kBAAkB,UAAU,IAAI;CAC/C,IAAI,CAAC,OAAO,SACV,MAAM,IAAI,MAAM,+BAA+B,aAAa,OAAO,KAAK,GAAG;CAE7E,OAAO;EAAE,SAAS,OAAO;EAAM;EAAS;CAAe;AACzD;;;;;;;;;AAUA,eAAe,eACb,SACA,MACkC;CAClC,MAAM,wBAAQ,IAAI,IAAY;CAC9B,gBAAgB,eAAe,OAAO,GAAG,KAAK;CAC9C,IAAI,MAAM,SAAS,GACjB,OAAO,CAAC;CAEV,MAAM,SAAS,MAAM,oBAAoB,OAAO,IAAI;CACpD,OAAO,mBAAmB,eAAe,OAAO,GAAG,MAAM;AAC3D;AAEA,eAAsB,mBAAmB,OAAuD;CAC9F,MAAM,EAAE,SAAS,SAAS,mBAAmB,gBAAgB,KAAK;CAClE,MAAM,UAAU,MAAM,eAAe,SAAS,cAAc;CAC5D,MAAM,WAAW;EAAE,GAAG;EAAS,GAAG;CAAQ;CAC1C,IAAI,SAAS,OAAO,SAAS,IAC3B,MAAM,IAAI,MAAM,wDAAwD;CAE1E,OAAO;EAAE,GAAG;EAAU,GAAI,UAAU,EAAE,QAAQ,IAAI,CAAC;CAAG;AACxD"}

package/dist/db-bridge.d.mts

@@ -0,0 +1,20 @@
+import __tsdown_shims_path from 'node:path';
+import __tsdown_shims_url from 'node:url';
+import { Table } from "drizzle-orm";
+import { DBAdapterInstance } from "better-auth";
+import { DatabaseAdapter } from "@storyshelf/core/adapter/database";
+//#region src/db-bridge.d.ts
+/** Model→table registry plus per-model date fields. */
+interface AuthBridgeSchema {
+  /** Drizzle table handles keyed by Better Auth model name. */
+  tables: Record<string, Table>;
+  /** Date-valued fields per model (ISO at rest, Date in flight). */
+  dateFields: Record<string, readonly string[]>;
+  /** Id generator for creates missing an id (defaults to ULID). */
+  generateId?: (model: string) => string;
+}
+/** Build the Better Auth database adapter over a shelf database. */
+declare function createShelfDbBridge(db: DatabaseAdapter, schema: AuthBridgeSchema): DBAdapterInstance;
+//#endregion
+export { AuthBridgeSchema, createShelfDbBridge };
+//# sourceMappingURL=db-bridge.d.mts.map