@storyshelf/auth 0.5.3

package/dist/db-bridge.mjs

@@ -0,0 +1,208 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { applySelect, toDriverRow, toModelRow } from "./db-values.mjs";
+import { buildCondition, buildOrderBy } from "./db-where.mjs";
+import { ulid } from "@storyshelf/core/utils";
+import { getTableColumns } from "drizzle-orm";
+//#region src/db-bridge.ts
+function tableFor(schema, model) {
+	const table = schema.tables[model];
+	if (!table) throw new Error(`Unknown auth model "${model}"`);
+	return table;
+}
+function datesFor(schema, model) {
+	return schema.dateFields[model] ?? [];
+}
+function defaultGenerateId() {
+	return ulid();
+}
+function whereOf(table, where) {
+	if (!where || where.length === 0) return;
+	return buildCondition(table, where);
+}
+async function findFirst(store, schema, model, where) {
+	const table = tableFor(schema, model);
+	const row = (await store.list(table, {
+		where: whereOf(table, where),
+		limit: 1
+	}))[0];
+	return row ? toModelRow(row, datesFor(schema, model)) : null;
+}
+async function updateById(store, schema, model, id, update) {
+	const table = tableFor(schema, model);
+	if (!await store.get(table, id)) return null;
+	const updated = await store.update(table, id, toDriverRow(update));
+	return toModelRow(updated, datesFor(schema, model));
+}
+async function opCreate(store, schema, input) {
+	const table = tableFor(schema, input.model);
+	const generate = schema.generateId ?? defaultGenerateId;
+	const data = input.data["id"] === void 0 || input.data["id"] === null ? {
+		...input.data,
+		id: generate(input.model)
+	} : input.data;
+	const inserted = await store.insert(table, toDriverRow(data));
+	return toModelRow(inserted, datesFor(schema, input.model));
+}
+async function opUpdate(store, schema, input) {
+	const row = await findFirst(store, schema, input.model, input.where);
+	if (!row || typeof row["id"] !== "string") return null;
+	return await updateById(store, schema, input.model, row["id"], input.update);
+}
+async function opUpdateMany(store, schema, input) {
+	const table = tableFor(schema, input.model);
+	const ids = (await store.list(table, { where: whereOf(table, input.where) })).map((row) => row["id"]).filter((id) => typeof id === "string");
+	await Promise.all(ids.map(async (id) => await updateById(store, schema, input.model, id, input.update)));
+	return ids.length;
+}
+async function opDeleteMany(store, schema, input) {
+	const table = tableFor(schema, input.model);
+	const ids = (await store.list(table, { where: whereOf(table, input.where) })).map((row) => row["id"]).filter((id) => typeof id === "string");
+	await Promise.all(ids.map(async (id) => {
+		await store.remove(table, id);
+	}));
+	return ids.length;
+}
+async function opConsumeOne(store, schema, input) {
+	const row = await findFirst(store, schema, input.model, input.where);
+	if (!row || typeof row["id"] !== "string") return null;
+	await store.remove(tableFor(schema, input.model), row["id"]);
+	return row;
+}
+async function opIncrementOne(store, schema, input) {
+	const row = await findFirst(store, schema, input.model, input.where);
+	if (!row || typeof row["id"] !== "string") return null;
+	const deltas = Object.fromEntries(Object.entries(input.increment).map(([field, delta]) => {
+		const current = row[field];
+		return [field, (typeof current === "number" ? current : 0) + delta];
+	}));
+	return await updateById(store, schema, input.model, row["id"], {
+		...deltas,
+		...input.set
+	});
+}
+function hasColumn(table, field) {
+	return getTableColumns(table)[field] !== void 0;
+}
+async function joinMany(store, schema, parentModel, parentId, joinedModel, limit) {
+	const table = tableFor(schema, joinedModel);
+	const opts = { limit };
+	const where = whereOf(table, [{
+		field: `${parentModel}Id`,
+		value: parentId
+	}]);
+	if (where) opts.where = where;
+	return (await store.list(table, opts)).map((row) => toModelRow(row, datesFor(schema, joinedModel)));
+}
+async function joinRelation(store, schema, parentModel, parent, joinedModel, limit) {
+	if (hasColumn(tableFor(schema, joinedModel), `${parentModel}Id`)) return await joinMany(store, schema, parentModel, parent["id"], joinedModel, limit);
+	if (typeof parent[`${joinedModel}Id`] === "string") return await findFirst(store, schema, joinedModel, [{
+		field: "id",
+		value: parent[`${joinedModel}Id`]
+	}]);
+	throw new Error(`Unknown auth relation "${parentModel}.${joinedModel}"`);
+}
+async function attachJoins(store, schema, parentModel, parent, join) {
+	if (!join) return {};
+	const attached = {};
+	const entries = Object.entries(join);
+	await Promise.all(entries.map(async ([joinedModel, joinAttr]) => {
+		const limit = typeof joinAttr === "object" ? joinAttr.limit : void 0;
+		attached[joinedModel] = await joinRelation(store, schema, parentModel, parent, joinedModel, limit);
+	}));
+	return attached;
+}
+async function listRows(store, schema, input) {
+	const table = tableFor(schema, input.model);
+	const opts = {
+		limit: input.limit,
+		offset: input.offset
+	};
+	const where = whereOf(table, input.where);
+	if (where) opts.where = where;
+	const orderBy = buildOrderBy(table, input.sortBy);
+	if (orderBy) opts.orderBy = orderBy;
+	return await store.list(table, opts);
+}
+async function opFindMany(store, schema, input) {
+	const rows = await listRows(store, schema, input);
+	return await Promise.all(rows.map(async (row) => {
+		const withJoins = input.join ? {
+			...row,
+			...await attachJoins(store, schema, input.model, row, input.join)
+		} : row;
+		return applySelect(toModelRow(withJoins, datesFor(schema, input.model)), input.select);
+	}));
+}
+async function opFindOne(store, schema, input) {
+	const row = await findFirst(store, schema, input.model, input.where);
+	if (!row) return null;
+	const withJoins = input.join ? {
+		...row,
+		...await attachJoins(store, schema, input.model, row, input.join)
+	} : row;
+	return applySelect(withJoins, input.select);
+}
+/** Read operations bound to one store. */
+function bindQueryOps(store, schema) {
+	return {
+		findOne: async (input) => await opFindOne(store, schema, input),
+		findMany: async (input) => await opFindMany(store, schema, input),
+		count: async (input) => {
+			const table = tableFor(schema, input.model);
+			return await store.count(table, whereOf(table, input.where));
+		}
+	};
+}
+/** Write operations bound to one store (transaction-aware where marked). */
+function bindMutationOps(store, schema, db) {
+	return {
+		create: async (input) => await opCreate(store, schema, input),
+		update: async (input) => await opUpdate(store, schema, input),
+		updateMany: async (input) => await opUpdateMany(store, schema, input),
+		delete: async (input) => {
+			const row = await findFirst(store, schema, input.model, input.where);
+			if (row && typeof row["id"] === "string") await store.remove(tableFor(schema, input.model), row["id"]);
+		},
+		deleteMany: async (input) => await opDeleteMany(store, schema, input),
+		consumeOne: async (input) => {
+			if (store === db && db.transact) return await db.transact(async (tx) => await opConsumeOne(tx, schema, input));
+			return await opConsumeOne(store, schema, input);
+		},
+		incrementOne: async (input) => {
+			if (store === db && db.transact) return await db.transact(async (tx) => await opIncrementOne(tx, schema, input));
+			return await opIncrementOne(store, schema, input);
+		}
+	};
+}
+/** Build the Better Auth database adapter over a shelf database. */
+function createShelfDbBridge(db, schema) {
+	return (_options) => {
+		const ops = {
+			...bindQueryOps(db, schema),
+			...bindMutationOps(db, schema, db)
+		};
+		return {
+			...ops,
+			transaction: async (callback) => {
+				if (db.transact) return await db.transact(async (tx) => {
+					return await callback({
+						...bindQueryOps(tx, schema),
+						...bindMutationOps(tx, schema, db)
+					});
+				});
+				return await callback(ops);
+			},
+			options: {
+				adapterName: "storyshelf",
+				supportsDates: false,
+				supportsJSON: false
+			}
+		};
+	};
+}
+//#endregion
+export { createShelfDbBridge };
+
+//# sourceMappingURL=db-bridge.mjs.map

package/dist/db-bridge.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"db-bridge.mjs","names":[],"sources":["../src/db-bridge.ts"],"sourcesContent":["import type { DatabaseAdapter, ListOptions, TxStore } from \"@storyshelf/core/adapter/database\";\nimport { ulid } from \"@storyshelf/core/utils\";\n/**\n * Opaque Better Auth database bridge over the shelf DatabaseAdapter.\n *\n * Better Auth talks to `DBAdapterInstance` (create/findOne/findMany/count/\n * update/updateMany/delete/deleteMany/consumeOne/incrementOne/transaction);\n * this maps each call onto {@link DatabaseAdapter} CRUD over an explicit\n * model→table registry. No dialect knowledge: sqlite, Turso, and Postgres\n * drivers all work untouched, present and future.\n */\nimport type { DBAdapterInstance, DBTransactionAdapter, Where } from \"better-auth\";\nimport type { SQL, Table } from \"drizzle-orm\";\nimport { getTableColumns } from \"drizzle-orm\";\nimport { applySelect, toDriverRow, toModelRow } from \"./db-values.ts\";\nimport { buildCondition, buildOrderBy } from \"./db-where.ts\";\n\n/** Model→table registry plus per-model date fields. */\nexport interface AuthBridgeSchema {\n  /** Drizzle table handles keyed by Better Auth model name. */\n  tables: Record<string, Table>;\n  /** Date-valued fields per model (ISO at rest, Date in flight). */\n  dateFields: Record<string, readonly string[]>;\n  /** Id generator for creates missing an id (defaults to ULID). */\n  generateId?: (model: string) => string;\n}\n\n/** CRUD surface the bridge is built over (adapter or transaction store). */\ntype CrudStore = Pick<TxStore, \"insert\" | \"update\" | \"get\" | \"remove\" | \"list\" | \"count\">;\n\ninterface OpInput {\n  model: string;\n}\n\nfunction tableFor(schema: AuthBridgeSchema, model: string): Table {\n  const table = schema.tables[model];\n  if (!table) {\n    throw new Error(`Unknown auth model \"${model}\"`);\n  }\n  return table;\n}\n\nfunction datesFor(schema: AuthBridgeSchema, model: string): readonly string[] {\n  return schema.dateFields[model] ?? [];\n}\n\nfunction defaultGenerateId(): string {\n  return ulid();\n}\n\nfunction whereOf(table: Table, where: readonly Where[] | undefined): SQL | undefined {\n  if (!where || where.length === 0) {\n    return undefined;\n  }\n  return buildCondition(table, where);\n}\n\nasync function findFirst(\n  store: CrudStore,\n  schema: AuthBridgeSchema,\n  model: string,\n  where: readonly Where[] | undefined,\n): Promise<Record<string, unknown> | null> {\n  const table = tableFor(schema, model);\n  const rows = (await store.list(table, { where: whereOf(table, where), limit: 1 })) as Record<\n    string,\n    unknown\n  >[];\n  const row = rows[0];\n  return row ? toModelRow(row, datesFor(schema, model)) : null;\n}\n\nasync function updateById(\n  store: CrudStore,\n  schema: AuthBridgeSchema,\n  model: string,\n  id: string,\n  update: Record<string, unknown>,\n): Promise<Record<string, unknown> | null> {\n  const table = tableFor(schema, model);\n  const existing = await store.get(table, id);\n  if (!existing) {\n    return null;\n  }\n  const updated = await store.update(table, id, toDriverRow(update));\n  return toModelRow(updated, datesFor(schema, model));\n}\n\nasync function opCreate(\n  store: CrudStore,\n  schema: AuthBridgeSchema,\n  input: OpInput & { data: Record<string, unknown> },\n): Promise<Record<string, unknown>> {\n  const table = tableFor(schema, input.model);\n  const generate = schema.generateId ?? defaultGenerateId;\n  const data =\n    input.data[\"id\"] === undefined || input.data[\"id\"] === null\n      ? { ...input.data, id: generate(input.model) }\n      : input.data;\n  const inserted = await store.insert(table, toDriverRow(data));\n  return toModelRow(inserted, datesFor(schema, input.model));\n}\n\nasync function opUpdate(\n  store: CrudStore,\n  schema: AuthBridgeSchema,\n  input: OpInput & { where: Where[]; update: Record<string, unknown> },\n): Promise<Record<string, unknown> | null> {\n  const row = await findFirst(store, schema, input.model, input.where);\n  if (!row || typeof row[\"id\"] !== \"string\") {\n    return null;\n  }\n  return await updateById(store, schema, input.model, row[\"id\"], input.update);\n}\n\nasync function opUpdateMany(\n  store: CrudStore,\n  schema: AuthBridgeSchema,\n  input: OpInput & { where: Where[]; update: Record<string, unknown> },\n): Promise<number> {\n  const table = tableFor(schema, input.model);\n  const rows = (await store.list(table, {\n    where: whereOf(table, input.where),\n  })) as Record<string, unknown>[];\n  const ids = rows.map((row) => row[\"id\"]).filter((id): id is string => typeof id === \"string\");\n  await Promise.all(\n    ids.map(async (id) => await updateById(store, schema, input.model, id, input.update)),\n  );\n  return ids.length;\n}\n\nasync function opDeleteMany(\n  store: CrudStore,\n  schema: AuthBridgeSchema,\n  input: OpInput & { where: Where[] },\n): Promise<number> {\n  const table = tableFor(schema, input.model);\n  const rows = (await store.list(table, {\n    where: whereOf(table, input.where),\n  })) as Record<string, unknown>[];\n  const ids = rows.map((row) => row[\"id\"]).filter((id): id is string => typeof id === \"string\");\n  await Promise.all(\n    ids.map(async (id) => {\n      await store.remove(table, id);\n    }),\n  );\n  return ids.length;\n}\n\nasync function opConsumeOne(\n  store: CrudStore,\n  schema: AuthBridgeSchema,\n  input: OpInput & { where: Where[] },\n): Promise<Record<string, unknown> | null> {\n  // Runs directly on the given store: the top-level binding wraps this in\n  // `transact` for atomicity, while transaction-scoped bindings pass the\n  // ambient `tx` so Better Auth's own transaction wrapper never nests a\n  // second `begin` on single-connection drivers (sqlite).\n  const row = await findFirst(store, schema, input.model, input.where);\n  if (!row || typeof row[\"id\"] !== \"string\") {\n    return null;\n  }\n  await store.remove(tableFor(schema, input.model), row[\"id\"]);\n  return row;\n}\n\nasync function opIncrementOne(\n  store: CrudStore,\n  schema: AuthBridgeSchema,\n  input: OpInput & {\n    where: Where[];\n    increment: Record<string, number>;\n    set?: Record<string, unknown>;\n  },\n): Promise<Record<string, unknown> | null> {\n  const row = await findFirst(store, schema, input.model, input.where);\n  if (!row || typeof row[\"id\"] !== \"string\") {\n    return null;\n  }\n  const deltas = Object.fromEntries(\n    Object.entries(input.increment).map(([field, delta]) => {\n      const current = row[field];\n      return [field, (typeof current === \"number\" ? current : 0) + delta];\n    }),\n  );\n  return await updateById(store, schema, input.model, row[\"id\"], {\n    ...deltas,\n    ...input.set,\n  });\n}\n\nfunction hasColumn(table: Table, field: string): boolean {\n  return getTableColumns(table)[field] !== undefined;\n}\n\nasync function joinMany(\n  store: CrudStore,\n  schema: AuthBridgeSchema,\n  parentModel: string,\n  parentId: unknown,\n  joinedModel: string,\n  limit: number | undefined,\n): Promise<Record<string, unknown>[]> {\n  const table = tableFor(schema, joinedModel);\n  const opts: ListOptions = { limit };\n  const where = whereOf(table, [{ field: `${parentModel}Id`, value: parentId as never }]);\n  if (where) {\n    opts.where = where;\n  }\n  const rows = (await store.list(table, opts)) as Record<string, unknown>[];\n  return rows.map((row) => toModelRow(row, datesFor(schema, joinedModel)));\n}\n\nasync function joinRelation(\n  store: CrudStore,\n  schema: AuthBridgeSchema,\n  parentModel: string,\n  parent: Record<string, unknown>,\n  joinedModel: string,\n  limit: number | undefined,\n): Promise<Record<string, unknown>[] | Record<string, unknown> | null> {\n  const table = tableFor(schema, joinedModel);\n  if (hasColumn(table, `${parentModel}Id`)) {\n    return await joinMany(store, schema, parentModel, parent[\"id\"], joinedModel, limit);\n  }\n  if (typeof parent[`${joinedModel}Id`] === \"string\") {\n    return await findFirst(store, schema, joinedModel, [\n      { field: \"id\", value: parent[`${joinedModel}Id`] as never },\n    ]);\n  }\n  throw new Error(`Unknown auth relation \"${parentModel}.${joinedModel}\"`);\n}\n\nasync function attachJoins(\n  store: CrudStore,\n  schema: AuthBridgeSchema,\n  parentModel: string,\n  parent: Record<string, unknown>,\n  join: Record<string, boolean | { limit?: number }> | undefined,\n): Promise<Record<string, unknown>> {\n  if (!join) {\n    return {};\n  }\n  const attached: Record<string, unknown> = {};\n  const entries = Object.entries(join);\n  await Promise.all(\n    entries.map(async ([joinedModel, joinAttr]) => {\n      const limit = typeof joinAttr === \"object\" ? joinAttr.limit : undefined;\n      attached[joinedModel] = await joinRelation(\n        store,\n        schema,\n        parentModel,\n        parent,\n        joinedModel,\n        limit,\n      );\n    }),\n  );\n  return attached;\n}\n\ntype FindManyInput = OpInput & {\n  where?: Where[];\n  limit?: number;\n  offset?: number;\n  sortBy?: { field: string; direction: \"asc\" | \"desc\" };\n  select?: string[];\n  join?: Record<string, boolean | { limit?: number }>;\n};\n\nasync function listRows(\n  store: CrudStore,\n  schema: AuthBridgeSchema,\n  input: FindManyInput,\n): Promise<Record<string, unknown>[]> {\n  const table = tableFor(schema, input.model);\n  const opts: ListOptions = { limit: input.limit, offset: input.offset };\n  const where = whereOf(table, input.where);\n  if (where) {\n    opts.where = where;\n  }\n  const orderBy = buildOrderBy(table, input.sortBy);\n  if (orderBy) {\n    opts.orderBy = orderBy;\n  }\n  const listed: Record<string, unknown>[] = await store.list(table, opts);\n  return listed;\n}\n\nasync function opFindMany(\n  store: CrudStore,\n  schema: AuthBridgeSchema,\n  input: FindManyInput,\n): Promise<Record<string, unknown>[]> {\n  const rows = await listRows(store, schema, input);\n  return await Promise.all(\n    rows.map(async (row) => {\n      const withJoins = input.join\n        ? { ...row, ...(await attachJoins(store, schema, input.model, row, input.join)) }\n        : row;\n      return applySelect(toModelRow(withJoins, datesFor(schema, input.model)), input.select);\n    }),\n  );\n}\n\n/** One bound operation set (adapter top-level or transaction store). */\ninterface JoinSpec {\n  join?: Record<string, boolean | { limit?: number }>;\n}\n\ninterface BoundOps {\n  create(input: OpInput & { data: Record<string, unknown> }): Promise<Record<string, unknown>>;\n  findOne(\n    input: OpInput & { where: Where[]; select?: string[] } & JoinSpec,\n  ): Promise<Record<string, unknown> | null>;\n  findMany(\n    input: OpInput & {\n      where?: Where[];\n      limit?: number;\n      offset?: number;\n      sortBy?: { field: string; direction: \"asc\" | \"desc\" };\n      select?: string[];\n    } & JoinSpec,\n  ): Promise<Record<string, unknown>[]>;\n  count(input: OpInput & { where?: Where[] }): Promise<number>;\n  update(\n    input: OpInput & { where: Where[]; update: Record<string, unknown> },\n  ): Promise<Record<string, unknown> | null>;\n  updateMany(input: OpInput & { where: Where[]; update: Record<string, unknown> }): Promise<number>;\n  delete(input: OpInput & { where: Where[] }): Promise<void>;\n  deleteMany(input: OpInput & { where: Where[] }): Promise<number>;\n  consumeOne(input: OpInput & { where: Where[] }): Promise<Record<string, unknown> | null>;\n  incrementOne(\n    input: OpInput & {\n      where: Where[];\n      increment: Record<string, number>;\n      set?: Record<string, unknown>;\n    },\n  ): Promise<Record<string, unknown> | null>;\n}\n\nasync function opFindOne(\n  store: CrudStore,\n  schema: AuthBridgeSchema,\n  input: OpInput & { where: Where[]; select?: string[] } & JoinSpec,\n): Promise<Record<string, unknown> | null> {\n  const row = await findFirst(store, schema, input.model, input.where);\n  if (!row) {\n    return null;\n  }\n  const withJoins = input.join\n    ? { ...row, ...(await attachJoins(store, schema, input.model, row, input.join)) }\n    : row;\n  return applySelect(withJoins, input.select);\n}\n\n/** Read operations bound to one store. */\nfunction bindQueryOps(\n  store: CrudStore,\n  schema: AuthBridgeSchema,\n): Pick<BoundOps, \"findOne\" | \"findMany\" | \"count\"> {\n  return {\n    findOne: async (\n      input: OpInput & { where: Where[]; select?: string[] } & JoinSpec,\n    ): Promise<Record<string, unknown> | null> => await opFindOne(store, schema, input),\n    findMany: async (\n      input: OpInput & {\n        where?: Where[];\n        limit?: number;\n        offset?: number;\n        sortBy?: { field: string; direction: \"asc\" | \"desc\" };\n        select?: string[];\n      } & JoinSpec,\n    ): Promise<Record<string, unknown>[]> => await opFindMany(store, schema, input),\n    count: async (input: OpInput & { where?: Where[] }): Promise<number> => {\n      const table = tableFor(schema, input.model);\n      return await store.count(table, whereOf(table, input.where));\n    },\n  };\n}\n\n/** Write operations bound to one store (transaction-aware where marked). */\nfunction bindMutationOps(\n  store: CrudStore,\n  schema: AuthBridgeSchema,\n  db: DatabaseAdapter,\n): Omit<BoundOps, \"findOne\" | \"findMany\" | \"count\"> {\n  return {\n    create: async (\n      input: OpInput & { data: Record<string, unknown> },\n    ): Promise<Record<string, unknown>> => await opCreate(store, schema, input),\n    update: async (\n      input: OpInput & { where: Where[]; update: Record<string, unknown> },\n    ): Promise<Record<string, unknown> | null> => await opUpdate(store, schema, input),\n    updateMany: async (\n      input: OpInput & { where: Where[]; update: Record<string, unknown> },\n    ): Promise<number> => await opUpdateMany(store, schema, input),\n    delete: async (input: OpInput & { where: Where[] }): Promise<void> => {\n      const row = await findFirst(store, schema, input.model, input.where);\n      if (row && typeof row[\"id\"] === \"string\") {\n        await store.remove(tableFor(schema, input.model), row[\"id\"]);\n      }\n    },\n    deleteMany: async (input: OpInput & { where: Where[] }): Promise<number> =>\n      await opDeleteMany(store, schema, input),\n    consumeOne: async (\n      input: OpInput & { where: Where[] },\n    ): Promise<Record<string, unknown> | null> => {\n      // Atomic at the top level when the driver offers transact; inside a\n      // Better Auth transaction `store` is the ambient `tx`, which must run\n      // directly (a second `begin` fails on single-connection sqlite).\n      if (store === db && db.transact) {\n        return await db.transact(async (tx) => await opConsumeOne(tx, schema, input));\n      }\n      return await opConsumeOne(store, schema, input);\n    },\n    incrementOne: async (\n      input: OpInput & {\n        where: Where[];\n        increment: Record<string, number>;\n        set?: Record<string, unknown>;\n      },\n    ): Promise<Record<string, unknown> | null> => {\n      if (store === db && db.transact) {\n        return await db.transact(async (tx) => await opIncrementOne(tx, schema, input));\n      }\n      return await opIncrementOne(store, schema, input);\n    },\n  };\n}\n\n/** Build the Better Auth database adapter over a shelf database. */\nexport function createShelfDbBridge(\n  db: DatabaseAdapter,\n  schema: AuthBridgeSchema,\n): DBAdapterInstance {\n  return (_options: unknown) => {\n    const ops: BoundOps = { ...bindQueryOps(db, schema), ...bindMutationOps(db, schema, db) };\n    return {\n      ...ops,\n      transaction: async <R>(callback: (trx: DBTransactionAdapter) => Promise<R>): Promise<R> => {\n        if (db.transact) {\n          return await db.transact(async (tx) => {\n            const txOps: BoundOps = {\n              ...bindQueryOps(tx, schema),\n              ...bindMutationOps(tx, schema, db),\n            };\n            return await callback(txOps as never);\n          });\n        }\n        return await callback(ops as never);\n      },\n      options: { adapterName: \"storyshelf\", supportsDates: false, supportsJSON: false },\n    } as never;\n  };\n}\n"],"mappings":";;;;;;;;AAkCA,SAAS,SAAS,QAA0B,OAAsB;CAChE,MAAM,QAAQ,OAAO,OAAO;CAC5B,IAAI,CAAC,OACH,MAAM,IAAI,MAAM,uBAAuB,MAAM,EAAE;CAEjD,OAAO;AACT;AAEA,SAAS,SAAS,QAA0B,OAAkC;CAC5E,OAAO,OAAO,WAAW,UAAU,CAAC;AACtC;AAEA,SAAS,oBAA4B;CACnC,OAAO,KAAK;AACd;AAEA,SAAS,QAAQ,OAAc,OAAsD;CACnF,IAAI,CAAC,SAAS,MAAM,WAAW,GAC7B;CAEF,OAAO,eAAe,OAAO,KAAK;AACpC;AAEA,eAAe,UACb,OACA,QACA,OACA,OACyC;CACzC,MAAM,QAAQ,SAAS,QAAQ,KAAK;CAKpC,MAAM,OAAM,MAJQ,MAAM,KAAK,OAAO;EAAE,OAAO,QAAQ,OAAO,KAAK;EAAG,OAAO;CAAE,CAAC,EAAA,CAI/D;CACjB,OAAO,MAAM,WAAW,KAAK,SAAS,QAAQ,KAAK,CAAC,IAAI;AAC1D;AAEA,eAAe,WACb,OACA,QACA,OACA,IACA,QACyC;CACzC,MAAM,QAAQ,SAAS,QAAQ,KAAK;CAEpC,IAAI,CAAC,MADkB,MAAM,IAAI,OAAO,EAAE,GAExC,OAAO;CAET,MAAM,UAAU,MAAM,MAAM,OAAO,OAAO,IAAI,YAAY,MAAM,CAAC;CACjE,OAAO,WAAW,SAAS,SAAS,QAAQ,KAAK,CAAC;AACpD;AAEA,eAAe,SACb,OACA,QACA,OACkC;CAClC,MAAM,QAAQ,SAAS,QAAQ,MAAM,KAAK;CAC1C,MAAM,WAAW,OAAO,cAAc;CACtC,MAAM,OACJ,MAAM,KAAK,UAAU,KAAA,KAAa,MAAM,KAAK,UAAU,OACnD;EAAE,GAAG,MAAM;EAAM,IAAI,SAAS,MAAM,KAAK;CAAE,IAC3C,MAAM;CACZ,MAAM,WAAW,MAAM,MAAM,OAAO,OAAO,YAAY,IAAI,CAAC;CAC5D,OAAO,WAAW,UAAU,SAAS,QAAQ,MAAM,KAAK,CAAC;AAC3D;AAEA,eAAe,SACb,OACA,QACA,OACyC;CACzC,MAAM,MAAM,MAAM,UAAU,OAAO,QAAQ,MAAM,OAAO,MAAM,KAAK;CACnE,IAAI,CAAC,OAAO,OAAO,IAAI,UAAU,UAC/B,OAAO;CAET,OAAO,MAAM,WAAW,OAAO,QAAQ,MAAM,OAAO,IAAI,OAAO,MAAM,MAAM;AAC7E;AAEA,eAAe,aACb,OACA,QACA,OACiB;CACjB,MAAM,QAAQ,SAAS,QAAQ,MAAM,KAAK;CAI1C,MAAM,OAAM,MAHQ,MAAM,KAAK,OAAO,EACpC,OAAO,QAAQ,OAAO,MAAM,KAAK,EACnC,CAAC,EAAA,CACgB,KAAK,QAAQ,IAAI,KAAK,CAAC,CAAC,QAAQ,OAAqB,OAAO,OAAO,QAAQ;CAC5F,MAAM,QAAQ,IACZ,IAAI,IAAI,OAAO,OAAO,MAAM,WAAW,OAAO,QAAQ,MAAM,OAAO,IAAI,MAAM,MAAM,CAAC,CACtF;CACA,OAAO,IAAI;AACb;AAEA,eAAe,aACb,OACA,QACA,OACiB;CACjB,MAAM,QAAQ,SAAS,QAAQ,MAAM,KAAK;CAI1C,MAAM,OAAM,MAHQ,MAAM,KAAK,OAAO,EACpC,OAAO,QAAQ,OAAO,MAAM,KAAK,EACnC,CAAC,EAAA,CACgB,KAAK,QAAQ,IAAI,KAAK,CAAC,CAAC,QAAQ,OAAqB,OAAO,OAAO,QAAQ;CAC5F,MAAM,QAAQ,IACZ,IAAI,IAAI,OAAO,OAAO;EACpB,MAAM,MAAM,OAAO,OAAO,EAAE;CAC9B,CAAC,CACH;CACA,OAAO,IAAI;AACb;AAEA,eAAe,aACb,OACA,QACA,OACyC;CAKzC,MAAM,MAAM,MAAM,UAAU,OAAO,QAAQ,MAAM,OAAO,MAAM,KAAK;CACnE,IAAI,CAAC,OAAO,OAAO,IAAI,UAAU,UAC/B,OAAO;CAET,MAAM,MAAM,OAAO,SAAS,QAAQ,MAAM,KAAK,GAAG,IAAI,KAAK;CAC3D,OAAO;AACT;AAEA,eAAe,eACb,OACA,QACA,OAKyC;CACzC,MAAM,MAAM,MAAM,UAAU,OAAO,QAAQ,MAAM,OAAO,MAAM,KAAK;CACnE,IAAI,CAAC,OAAO,OAAO,IAAI,UAAU,UAC/B,OAAO;CAET,MAAM,SAAS,OAAO,YACpB,OAAO,QAAQ,MAAM,SAAS,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW;EACtD,MAAM,UAAU,IAAI;EACpB,OAAO,CAAC,QAAQ,OAAO,YAAY,WAAW,UAAU,KAAK,KAAK;CACpE,CAAC,CACH;CACA,OAAO,MAAM,WAAW,OAAO,QAAQ,MAAM,OAAO,IAAI,OAAO;EAC7D,GAAG;EACH,GAAG,MAAM;CACX,CAAC;AACH;AAEA,SAAS,UAAU,OAAc,OAAwB;CACvD,OAAO,gBAAgB,KAAK,CAAC,CAAC,WAAW,KAAA;AAC3C;AAEA,eAAe,SACb,OACA,QACA,aACA,UACA,aACA,OACoC;CACpC,MAAM,QAAQ,SAAS,QAAQ,WAAW;CAC1C,MAAM,OAAoB,EAAE,MAAM;CAClC,MAAM,QAAQ,QAAQ,OAAO,CAAC;EAAE,OAAO,GAAG,YAAY;EAAK,OAAO;CAAkB,CAAC,CAAC;CACtF,IAAI,OACF,KAAK,QAAQ;CAGf,QAAO,MADa,MAAM,KAAK,OAAO,IAAI,EAAA,CAC9B,KAAK,QAAQ,WAAW,KAAK,SAAS,QAAQ,WAAW,CAAC,CAAC;AACzE;AAEA,eAAe,aACb,OACA,QACA,aACA,QACA,aACA,OACqE;CAErE,IAAI,UADU,SAAS,QAAQ,WACb,GAAG,GAAG,YAAY,GAAG,GACrC,OAAO,MAAM,SAAS,OAAO,QAAQ,aAAa,OAAO,OAAO,aAAa,KAAK;CAEpF,IAAI,OAAO,OAAO,GAAG,YAAY,SAAS,UACxC,OAAO,MAAM,UAAU,OAAO,QAAQ,aAAa,CACjD;EAAE,OAAO;EAAM,OAAO,OAAO,GAAG,YAAY;CAAc,CAC5D,CAAC;CAEH,MAAM,IAAI,MAAM,0BAA0B,YAAY,GAAG,YAAY,EAAE;AACzE;AAEA,eAAe,YACb,OACA,QACA,aACA,QACA,MACkC;CAClC,IAAI,CAAC,MACH,OAAO,CAAC;CAEV,MAAM,WAAoC,CAAC;CAC3C,MAAM,UAAU,OAAO,QAAQ,IAAI;CACnC,MAAM,QAAQ,IACZ,QAAQ,IAAI,OAAO,CAAC,aAAa,cAAc;EAC7C,MAAM,QAAQ,OAAO,aAAa,WAAW,SAAS,QAAQ,KAAA;EAC9D,SAAS,eAAe,MAAM,aAC5B,OACA,QACA,aACA,QACA,aACA,KACF;CACF,CAAC,CACH;CACA,OAAO;AACT;AAWA,eAAe,SACb,OACA,QACA,OACoC;CACpC,MAAM,QAAQ,SAAS,QAAQ,MAAM,KAAK;CAC1C,MAAM,OAAoB;EAAE,OAAO,MAAM;EAAO,QAAQ,MAAM;CAAO;CACrE,MAAM,QAAQ,QAAQ,OAAO,MAAM,KAAK;CACxC,IAAI,OACF,KAAK,QAAQ;CAEf,MAAM,UAAU,aAAa,OAAO,MAAM,MAAM;CAChD,IAAI,SACF,KAAK,UAAU;CAGjB,OAAO,MADyC,MAAM,KAAK,OAAO,IAAI;AAExE;AAEA,eAAe,WACb,OACA,QACA,OACoC;CACpC,MAAM,OAAO,MAAM,SAAS,OAAO,QAAQ,KAAK;CAChD,OAAO,MAAM,QAAQ,IACnB,KAAK,IAAI,OAAO,QAAQ;EACtB,MAAM,YAAY,MAAM,OACpB;GAAE,GAAG;GAAK,GAAI,MAAM,YAAY,OAAO,QAAQ,MAAM,OAAO,KAAK,MAAM,IAAI;EAAG,IAC9E;EACJ,OAAO,YAAY,WAAW,WAAW,SAAS,QAAQ,MAAM,KAAK,CAAC,GAAG,MAAM,MAAM;CACvF,CAAC,CACH;AACF;AAsCA,eAAe,UACb,OACA,QACA,OACyC;CACzC,MAAM,MAAM,MAAM,UAAU,OAAO,QAAQ,MAAM,OAAO,MAAM,KAAK;CACnE,IAAI,CAAC,KACH,OAAO;CAET,MAAM,YAAY,MAAM,OACpB;EAAE,GAAG;EAAK,GAAI,MAAM,YAAY,OAAO,QAAQ,MAAM,OAAO,KAAK,MAAM,IAAI;CAAG,IAC9E;CACJ,OAAO,YAAY,WAAW,MAAM,MAAM;AAC5C;;AAGA,SAAS,aACP,OACA,QACkD;CAClD,OAAO;EACL,SAAS,OACP,UAC4C,MAAM,UAAU,OAAO,QAAQ,KAAK;EAClF,UAAU,OACR,UAOuC,MAAM,WAAW,OAAO,QAAQ,KAAK;EAC9E,OAAO,OAAO,UAA0D;GACtE,MAAM,QAAQ,SAAS,QAAQ,MAAM,KAAK;GAC1C,OAAO,MAAM,MAAM,MAAM,OAAO,QAAQ,OAAO,MAAM,KAAK,CAAC;EAC7D;CACF;AACF;;AAGA,SAAS,gBACP,OACA,QACA,IACkD;CAClD,OAAO;EACL,QAAQ,OACN,UACqC,MAAM,SAAS,OAAO,QAAQ,KAAK;EAC1E,QAAQ,OACN,UAC4C,MAAM,SAAS,OAAO,QAAQ,KAAK;EACjF,YAAY,OACV,UACoB,MAAM,aAAa,OAAO,QAAQ,KAAK;EAC7D,QAAQ,OAAO,UAAuD;GACpE,MAAM,MAAM,MAAM,UAAU,OAAO,QAAQ,MAAM,OAAO,MAAM,KAAK;GACnE,IAAI,OAAO,OAAO,IAAI,UAAU,UAC9B,MAAM,MAAM,OAAO,SAAS,QAAQ,MAAM,KAAK,GAAG,IAAI,KAAK;EAE/D;EACA,YAAY,OAAO,UACjB,MAAM,aAAa,OAAO,QAAQ,KAAK;EACzC,YAAY,OACV,UAC4C;GAI5C,IAAI,UAAU,MAAM,GAAG,UACrB,OAAO,MAAM,GAAG,SAAS,OAAO,OAAO,MAAM,aAAa,IAAI,QAAQ,KAAK,CAAC;GAE9E,OAAO,MAAM,aAAa,OAAO,QAAQ,KAAK;EAChD;EACA,cAAc,OACZ,UAK4C;GAC5C,IAAI,UAAU,MAAM,GAAG,UACrB,OAAO,MAAM,GAAG,SAAS,OAAO,OAAO,MAAM,eAAe,IAAI,QAAQ,KAAK,CAAC;GAEhF,OAAO,MAAM,eAAe,OAAO,QAAQ,KAAK;EAClD;CACF;AACF;;AAGA,SAAgB,oBACd,IACA,QACmB;CACnB,QAAQ,aAAsB;EAC5B,MAAM,MAAgB;GAAE,GAAG,aAAa,IAAI,MAAM;GAAG,GAAG,gBAAgB,IAAI,QAAQ,EAAE;EAAE;EACxF,OAAO;GACL,GAAG;GACH,aAAa,OAAU,aAAoE;IACzF,IAAI,GAAG,UACL,OAAO,MAAM,GAAG,SAAS,OAAO,OAAO;KAKrC,OAAO,MAAM,SAAS;MAHpB,GAAG,aAAa,IAAI,MAAM;MAC1B,GAAG,gBAAgB,IAAI,QAAQ,EAAE;KAET,CAAU;IACtC,CAAC;IAEH,OAAO,MAAM,SAAS,GAAY;GACpC;GACA,SAAS;IAAE,aAAa;IAAc,eAAe;IAAO,cAAc;GAAM;EAClF;CACF;AACF"}

package/dist/db-values.mjs

@@ -0,0 +1,41 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/db-values.ts
+/**
+* Value conversion between Better Auth models and driver rows.
+*
+* Better Auth speaks Dates; our TEXT columns store ISO strings. All
+* conversion is explicit per-field (declared date fields) — no heuristics.
+*/
+/** Convert one inbound value to its driver representation. */
+function toDriverValue(value) {
+	if (value instanceof Date) return value.toISOString();
+	return value;
+}
+/** Drop undefined keys (matches the repo's withoutUndefined convention). */
+function stripUndefined(values) {
+	return Object.fromEntries(Object.entries(values).filter((pair) => pair[1] !== void 0));
+}
+/** Convert a model row to its driver representation (Dates to ISO). */
+function toDriverRow(values) {
+	return stripUndefined(Object.fromEntries(Object.entries(values).map(([field, value]) => [field, toDriverValue(value)])));
+}
+/** Revive ISO strings back to Dates for declared date fields. */
+function toModelRow(row, dateFields) {
+	const out = { ...row };
+	for (const field of dateFields) {
+		const value = out[field];
+		if (typeof value === "string") out[field] = new Date(value);
+	}
+	return out;
+}
+/** Project a row down to the requested model fields, if any. */
+function applySelect(row, select) {
+	if (!select || select.length === 0) return row;
+	return Object.fromEntries(select.map((field) => [field, row[field]]));
+}
+//#endregion
+export { applySelect, stripUndefined, toDriverRow, toDriverValue, toModelRow };
+
+//# sourceMappingURL=db-values.mjs.map

package/dist/db-values.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"db-values.mjs","names":[],"sources":["../src/db-values.ts"],"sourcesContent":["/**\n * Value conversion between Better Auth models and driver rows.\n *\n * Better Auth speaks Dates; our TEXT columns store ISO strings. All\n * conversion is explicit per-field (declared date fields) — no heuristics.\n */\n\n/** Convert one inbound value to its driver representation. */\nexport function toDriverValue(value: unknown): unknown {\n  if (value instanceof Date) {\n    return value.toISOString();\n  }\n  return value;\n}\n\n/** Drop undefined keys (matches the repo's withoutUndefined convention). */\nexport function stripUndefined(values: Record<string, unknown>): Record<string, unknown> {\n  return Object.fromEntries(Object.entries(values).filter((pair) => pair[1] !== undefined));\n}\n\n/** Convert a model row to its driver representation (Dates to ISO). */\nexport function toDriverRow(values: Record<string, unknown>): Record<string, unknown> {\n  return stripUndefined(\n    Object.fromEntries(\n      Object.entries(values).map(([field, value]) => [field, toDriverValue(value)]),\n    ),\n  );\n}\n\n/** Revive ISO strings back to Dates for declared date fields. */\nexport function toModelRow(\n  row: Record<string, unknown>,\n  dateFields: readonly string[],\n): Record<string, unknown> {\n  const out = { ...row };\n  for (const field of dateFields) {\n    const value = out[field];\n    if (typeof value === \"string\") {\n      out[field] = new Date(value);\n    }\n  }\n  return out;\n}\n\n/** Project a row down to the requested model fields, if any. */\nexport function applySelect(\n  row: Record<string, unknown>,\n  select: readonly string[] | undefined,\n): Record<string, unknown> {\n  if (!select || select.length === 0) {\n    return row;\n  }\n  return Object.fromEntries(select.map((field) => [field, row[field]]));\n}\n"],"mappings":";;;;;;;;;;;AAQA,SAAgB,cAAc,OAAyB;CACrD,IAAI,iBAAiB,MACnB,OAAO,MAAM,YAAY;CAE3B,OAAO;AACT;;AAGA,SAAgB,eAAe,QAA0D;CACvF,OAAO,OAAO,YAAY,OAAO,QAAQ,MAAM,CAAC,CAAC,QAAQ,SAAS,KAAK,OAAO,KAAA,CAAS,CAAC;AAC1F;;AAGA,SAAgB,YAAY,QAA0D;CACpF,OAAO,eACL,OAAO,YACL,OAAO,QAAQ,MAAM,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,OAAO,cAAc,KAAK,CAAC,CAAC,CAC9E,CACF;AACF;;AAGA,SAAgB,WACd,KACA,YACyB;CACzB,MAAM,MAAM,EAAE,GAAG,IAAI;CACrB,KAAK,MAAM,SAAS,YAAY;EAC9B,MAAM,QAAQ,IAAI;EAClB,IAAI,OAAO,UAAU,UACnB,IAAI,SAAS,IAAI,KAAK,KAAK;CAE/B;CACA,OAAO;AACT;;AAGA,SAAgB,YACd,KACA,QACyB;CACzB,IAAI,CAAC,UAAU,OAAO,WAAW,GAC/B,OAAO;CAET,OAAO,OAAO,YAAY,OAAO,KAAK,UAAU,CAAC,OAAO,IAAI,MAAM,CAAC,CAAC;AACtE"}

package/dist/db-where.mjs

@@ -0,0 +1,85 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { and, asc, desc, eq, getTableColumns, gt, gte, inArray, lt, lte, ne, not, or, sql } from "drizzle-orm";
+//#region src/db-where.ts
+function columnOf(table, field) {
+	const column = getTableColumns(table)[field];
+	if (!column) throw new Error(`Unknown auth field "${field}"`);
+	return column;
+}
+function lowered(column) {
+	return sql`lower(${column})`;
+}
+/** Escape LIKE metacharacters so user input matches literally. */
+function escapeLike(value) {
+	return value.replaceAll("\\", "\\\\").replaceAll("%", "\\%").replaceAll("_", "\\_");
+}
+function patternValue(operator, value) {
+	const literal = escapeLike(value);
+	if (operator === "contains") return `%${literal}%`;
+	if (operator === "starts_with") return `${literal}%`;
+	return `%${literal}`;
+}
+/** LIKE with an explicit escape (sqlite has no default escape character). */
+function likeEscaped(target, pattern) {
+	return sql`${target} LIKE ${pattern} ESCAPE '\\'`;
+}
+function singleCondition(table, item) {
+	const column = columnOf(table, item.field);
+	const operator = item.operator ?? "eq";
+	const raw = typeof item.value === "string" && item.mode === "insensitive" ? item.value.toLowerCase() : item.value;
+	const target = typeof item.value === "string" && item.mode === "insensitive" ? lowered(column) : column;
+	const value = toDriverScalar(raw);
+	switch (operator) {
+		case "eq": return eq(target, value);
+		case "ne": return ne(target, value);
+		case "lt": return lt(target, value);
+		case "lte": return lte(target, value);
+		case "gt": return gt(target, value);
+		case "gte": return gte(target, value);
+		case "in": return inArray(target, toArray(value));
+		case "not_in": return not(inArray(target, toArray(value)));
+		case "contains":
+		case "starts_with":
+		case "ends_with": return likeEscaped(target, patternValue(operator, String(raw ?? "")));
+		default: throw new Error(`Unsupported auth where operator "${String(operator)}"`);
+	}
+}
+function toArray(value) {
+	if (!Array.isArray(value)) throw new TypeError("Auth where `in` operator needs an array value");
+	return value;
+}
+function toDriverScalar(value) {
+	if (value instanceof Date) return value.toISOString();
+	return value;
+}
+/** Split items into AND-groups at OR connectors (SQL precedence). */
+function splitOrGroups(table, where) {
+	const groups = [];
+	let current = [];
+	for (const [index, item] of where.entries()) {
+		if (index > 0 && item.connector === "OR") {
+			groups.push(current);
+			current = [];
+		}
+		current.push(singleCondition(table, item));
+	}
+	groups.push(current);
+	return groups;
+}
+/** Combine Where[] items with their connectors into one condition. */
+function buildCondition(table, where) {
+	if (where.length === 0) return;
+	return or(...splitOrGroups(table, where).map((group) => and(...group)));
+}
+/** Build an order-by clause from a sort descriptor. */
+function buildOrderBy(table, sortBy) {
+	if (!sortBy) return;
+	const column = columnOf(table, sortBy.field);
+	return sortBy.direction === "desc" ? desc(column) : asc(column);
+}
+//#endregion
+export { buildCondition, buildOrderBy };
+
+//# sourceMappingURL=db-where.mjs.map

package/dist/db-where.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"db-where.mjs","names":[],"sources":["../src/db-where.ts"],"sourcesContent":["/**\n * Better Auth Where[] to drizzle conditions.\n *\n * Operators covered: eq, ne, lt, lte, gt, gte, in, not_in, contains,\n * starts_with, ends_with. Connectors AND/OR (default AND). Case-insensitive\n * mode lowers both sides (portable across sqlite and Postgres). Unknown\n * fields fail fast — silent ignores would corrupt auth lookups.\n */\nimport type { Where } from \"better-auth\";\nimport type { SQL, Table } from \"drizzle-orm\";\nimport {\n  and,\n  asc,\n  desc,\n  eq,\n  getTableColumns,\n  gt,\n  gte,\n  inArray,\n  lt,\n  lte,\n  ne,\n  not,\n  or,\n  sql,\n} from \"drizzle-orm\";\n\nfunction columnOf(table: Table, field: string): SQL {\n  const column = getTableColumns(table)[field] as SQL | undefined;\n  if (!column) {\n    throw new Error(`Unknown auth field \"${field}\"`);\n  }\n  return column;\n}\n\nfunction lowered(column: SQL): SQL {\n  return sql`lower(${column})`;\n}\n\n/** Escape LIKE metacharacters so user input matches literally. */\nfunction escapeLike(value: string): string {\n  return value.replaceAll(\"\\\\\", \"\\\\\\\\\").replaceAll(\"%\", \"\\\\%\").replaceAll(\"_\", \"\\\\_\");\n}\n\nfunction patternValue(operator: string, value: string): string {\n  const literal = escapeLike(value);\n  if (operator === \"contains\") {\n    return `%${literal}%`;\n  }\n  if (operator === \"starts_with\") {\n    return `${literal}%`;\n  }\n  return `%${literal}`;\n}\n\n/** LIKE with an explicit escape (sqlite has no default escape character). */\nfunction likeEscaped(target: SQL, pattern: string): SQL {\n  return sql`${target} LIKE ${pattern} ESCAPE '\\\\'`;\n}\n\nfunction singleCondition(table: Table, item: Where): SQL {\n  const column = columnOf(table, item.field);\n  const operator = item.operator ?? \"eq\";\n  const raw =\n    typeof item.value === \"string\" && item.mode === \"insensitive\"\n      ? item.value.toLowerCase()\n      : item.value;\n  const target =\n    typeof item.value === \"string\" && item.mode === \"insensitive\" ? lowered(column) : column;\n  const value = toDriverScalar(raw);\n  switch (operator) {\n    case \"eq\":\n      return eq(target, value);\n    case \"ne\":\n      return ne(target, value);\n    case \"lt\":\n      return lt(target, value as string | number);\n    case \"lte\":\n      return lte(target, value as string | number);\n    case \"gt\":\n      return gt(target, value as string | number);\n    case \"gte\":\n      return gte(target, value as string | number);\n    case \"in\":\n      return inArray(target, toArray(value));\n    case \"not_in\":\n      return not(inArray(target, toArray(value)));\n    case \"contains\":\n    case \"starts_with\":\n    case \"ends_with\":\n      return likeEscaped(target, patternValue(operator, String(raw ?? \"\")));\n    default:\n      throw new Error(`Unsupported auth where operator \"${String(operator)}\"`);\n  }\n}\n\nfunction toArray(value: unknown): (string | number)[] {\n  if (!Array.isArray(value)) {\n    throw new TypeError(\"Auth where `in` operator needs an array value\");\n  }\n  return value as (string | number)[];\n}\n\nfunction toDriverScalar(value: Where[\"value\"]): unknown {\n  if (value instanceof Date) {\n    return value.toISOString();\n  }\n  return value;\n}\n\n/** Split items into AND-groups at OR connectors (SQL precedence). */\nfunction splitOrGroups(table: Table, where: readonly Where[]): SQL[][] {\n  const groups: SQL[][] = [];\n  let current: SQL[] = [];\n  for (const [index, item] of where.entries()) {\n    if (index > 0 && item.connector === \"OR\") {\n      groups.push(current);\n      current = [];\n    }\n    current.push(singleCondition(table, item));\n  }\n  groups.push(current);\n  return groups;\n}\n\n/** Combine Where[] items with their connectors into one condition. */\nexport function buildCondition(table: Table, where: readonly Where[]): SQL | undefined {\n  if (where.length === 0) {\n    return undefined;\n  }\n  return or(...splitOrGroups(table, where).map((group) => and(...group)));\n}\n\n/** Build an order-by clause from a sort descriptor. */\nexport function buildOrderBy(\n  table: Table,\n  sortBy: { field: string; direction: \"asc\" | \"desc\" } | undefined,\n): SQL | undefined {\n  if (!sortBy) {\n    return undefined;\n  }\n  const column = columnOf(table, sortBy.field);\n  return sortBy.direction === \"desc\" ? desc(column) : asc(column);\n}\n"],"mappings":";;;;;AA2BA,SAAS,SAAS,OAAc,OAAoB;CAClD,MAAM,SAAS,gBAAgB,KAAK,CAAC,CAAC;CACtC,IAAI,CAAC,QACH,MAAM,IAAI,MAAM,uBAAuB,MAAM,EAAE;CAEjD,OAAO;AACT;AAEA,SAAS,QAAQ,QAAkB;CACjC,OAAO,GAAG,SAAS,OAAO;AAC5B;;AAGA,SAAS,WAAW,OAAuB;CACzC,OAAO,MAAM,WAAW,MAAM,MAAM,CAAC,CAAC,WAAW,KAAK,KAAK,CAAC,CAAC,WAAW,KAAK,KAAK;AACpF;AAEA,SAAS,aAAa,UAAkB,OAAuB;CAC7D,MAAM,UAAU,WAAW,KAAK;CAChC,IAAI,aAAa,YACf,OAAO,IAAI,QAAQ;CAErB,IAAI,aAAa,eACf,OAAO,GAAG,QAAQ;CAEpB,OAAO,IAAI;AACb;;AAGA,SAAS,YAAY,QAAa,SAAsB;CACtD,OAAO,GAAG,GAAG,OAAO,QAAQ,QAAQ;AACtC;AAEA,SAAS,gBAAgB,OAAc,MAAkB;CACvD,MAAM,SAAS,SAAS,OAAO,KAAK,KAAK;CACzC,MAAM,WAAW,KAAK,YAAY;CAClC,MAAM,MACJ,OAAO,KAAK,UAAU,YAAY,KAAK,SAAS,gBAC5C,KAAK,MAAM,YAAY,IACvB,KAAK;CACX,MAAM,SACJ,OAAO,KAAK,UAAU,YAAY,KAAK,SAAS,gBAAgB,QAAQ,MAAM,IAAI;CACpF,MAAM,QAAQ,eAAe,GAAG;CAChC,QAAQ,UAAR;EACE,KAAK,MACH,OAAO,GAAG,QAAQ,KAAK;EACzB,KAAK,MACH,OAAO,GAAG,QAAQ,KAAK;EACzB,KAAK,MACH,OAAO,GAAG,QAAQ,KAAwB;EAC5C,KAAK,OACH,OAAO,IAAI,QAAQ,KAAwB;EAC7C,KAAK,MACH,OAAO,GAAG,QAAQ,KAAwB;EAC5C,KAAK,OACH,OAAO,IAAI,QAAQ,KAAwB;EAC7C,KAAK,MACH,OAAO,QAAQ,QAAQ,QAAQ,KAAK,CAAC;EACvC,KAAK,UACH,OAAO,IAAI,QAAQ,QAAQ,QAAQ,KAAK,CAAC,CAAC;EAC5C,KAAK;EACL,KAAK;EACL,KAAK,aACH,OAAO,YAAY,QAAQ,aAAa,UAAU,OAAO,OAAO,EAAE,CAAC,CAAC;EACtE,SACE,MAAM,IAAI,MAAM,oCAAoC,OAAO,QAAQ,EAAE,EAAE;CAC3E;AACF;AAEA,SAAS,QAAQ,OAAqC;CACpD,IAAI,CAAC,MAAM,QAAQ,KAAK,GACtB,MAAM,IAAI,UAAU,+CAA+C;CAErE,OAAO;AACT;AAEA,SAAS,eAAe,OAAgC;CACtD,IAAI,iBAAiB,MACnB,OAAO,MAAM,YAAY;CAE3B,OAAO;AACT;;AAGA,SAAS,cAAc,OAAc,OAAkC;CACrE,MAAM,SAAkB,CAAC;CACzB,IAAI,UAAiB,CAAC;CACtB,KAAK,MAAM,CAAC,OAAO,SAAS,MAAM,QAAQ,GAAG;EAC3C,IAAI,QAAQ,KAAK,KAAK,cAAc,MAAM;GACxC,OAAO,KAAK,OAAO;GACnB,UAAU,CAAC;EACb;EACA,QAAQ,KAAK,gBAAgB,OAAO,IAAI,CAAC;CAC3C;CACA,OAAO,KAAK,OAAO;CACnB,OAAO;AACT;;AAGA,SAAgB,eAAe,OAAc,OAA0C;CACrF,IAAI,MAAM,WAAW,GACnB;CAEF,OAAO,GAAG,GAAG,cAAc,OAAO,KAAK,CAAC,CAAC,KAAK,UAAU,IAAI,GAAG,KAAK,CAAC,CAAC;AACxE;;AAGA,SAAgB,aACd,OACA,QACiB;CACjB,IAAI,CAAC,QACH;CAEF,MAAM,SAAS,SAAS,OAAO,OAAO,KAAK;CAC3C,OAAO,OAAO,cAAc,SAAS,KAAK,MAAM,IAAI,IAAI,MAAM;AAChE"}

package/dist/engine.d.mts

@@ -0,0 +1,208 @@
+import __tsdown_shims_path from 'node:path';
+import __tsdown_shims_url from 'node:url';
+import { BetterAuthPlugin } from "better-auth";
+import { DatabaseAdapter } from "@storyshelf/core/adapter/database";
+import { EmailSender } from "@storyshelf/core/adapter/email-sender";
+import { Auth } from "@storyshelf/core/auth";
+import { Logger } from "@storyshelf/core/logger";
+//#region src/engine.d.ts
+/** Provider id minted on every engine identity (method attribution is future work). */
+declare const ENGINE_PROVIDER_ID = "better-auth";
+/** Options for {@link createShelfAuth}. */
+interface ShelfAuthOptions {
+  /** Shelf database (any driver; auth tables migrate via driver DDL). */
+  db: DatabaseAdapter;
+  /** Session/cookie signing secret (non-empty; Better Auth validates strength). */
+  secret: string;
+  /** Public base URL issuing auth responses (callback + cookie scope). */
+  baseURL: string;
+  /** Enable email/password login. Defaults to true. */
+  emailPassword?: boolean;
+  /**
+   * Email transport shared with notification channels. When set, invite
+   * links are emailed best-effort and password-reset requests send mail;
+   * when unset, invites stay out-of-band links and resets stay re-invite.
+   */
+  emailSender?: EmailSender;
+  /** Sender address for auth mail (defaults to `storyshelf@<baseURL host>`). */
+  fromEmail?: string;
+  /**
+   * System-event hook for host-owned fan-out (e.g. `sys:user-created`,
+   * `sys:invite-issued` to admin channels). Best-effort: failures are
+   * logged and swallowed, never break auth flows.
+   */
+  onAuthSystemEvent?: (event: "sys:user-created" | "sys:invite-issued", data: Record<string, unknown>) => unknown;
+  /** Host-owned logger for auth diagnostics (explicit override only). */
+  logger?: Logger;
+  /** Native social providers (GitHub, Google, Entra, Cognito...), each one button. */
+  social?: ShelfSocialProvider[];
+  /** OAuth/OIDC providers, each rendered as one login button. Defaults to none. */
+  oauth?: ShelfOAuthProvider[];
+  /** WebAuthn passkeys (profile enrollment; sign-in ceremony is E8). Defaults to off. */
+  passkeys?: ShelfPasskeyOptions;
+  /** Domain-routed SSO (OIDC discovery + SAML via samlify). Defaults to none. */
+  sso?: ShelfSSOOptions;
+  /** Extra Better Auth plugins (passkey, SSO, ...). Defaults to none. */
+  plugins?: BetterAuthPlugin[];
+  /** Session lifetime in days. Defaults to 7 (current parity). */
+  sessionExpiresInDays?: number;
+}
+/** One OAuth/OIDC login method (Keycloak preset or explicit endpoints). */
+interface ShelfOAuthProvider {
+  /** Stable id used in routes and descriptors (e.g. "keycloak"). */
+  id: string;
+  /** Human label rendered on the login button. */
+  label: string;
+  /** OAuth client ID registered with the provider. */
+  clientId: string;
+  /** OAuth client secret (omit for public clients). */
+  clientSecret?: string;
+  /** OIDC discovery URL; prefer over explicit endpoints when available. */
+  discoveryUrl?: string;
+  /** Explicit endpoint overrides (skip discovery for these). */
+  authorizationUrl?: string;
+  /** Explicit endpoint overrides (skip discovery for these). */
+  tokenUrl?: string;
+  /** Explicit endpoint overrides (skip discovery for these). */
+  userInfoUrl?: string;
+  /** OAuth scopes. Defaults to `["openid", "email", "profile"]`. */
+  scopes?: string[];
+}
+/** One native social login method (Better Auth built-in provider). */
+interface ShelfSocialProvider {
+  /** Better Auth provider key (e.g. "github", "microsoft", "cognito"). */
+  id: "github" | "gitlab" | "google" | "microsoft" | "cognito";
+  /** Human label rendered on the login button. */
+  label: string;
+  /** OAuth client ID registered with the provider. */
+  clientId: string;
+  /** OAuth client secret (omit for public clients). */
+  clientSecret?: string;
+  /** Provider-specific options (tenantId, domain, region, userPoolId, issuer...). */
+  extra?: Record<string, string | undefined>;
+}
+/** WebAuthn passkey config (profile enrollment; sign-in ceremony is E8). */
+interface ShelfPasskeyOptions {
+  /**
+   * Relying-party id. Defaults to the baseURL hostname.
+   *
+   * WebAuthn needs a secure context: `localhost` (any port) or HTTPS.
+   * Plain-HTTP LAN/IP deployments cannot use passkeys — the UI hides
+   * passkey affordances there (see `passkey-ceremony.ts`).
+   */
+  rpID?: string;
+  /** Human-readable site title. Defaults to "StoryShelf". */
+  rpName?: string;
+  /** Allowed origins (no trailing slash). Defaults to the baseURL origin. */
+  origin?: string | string[];
+}
+/** OIDC SSO connection (discovery-based, resolved by email domain). */
+interface ShelfSSOOidc {
+  /** IdP issuer (e.g. the Keycloak realm URL). */
+  issuer: string;
+  /** Discovery document URL. Defaults to `issuer + /.well-known/openid-configuration`. */
+  discoveryUrl?: string;
+  /** OAuth client ID registered with the provider. */
+  clientId: string;
+  /** OAuth client secret (omit for public clients). */
+  clientSecret?: string;
+  /** OAuth scopes. Defaults to `["openid", "email", "profile"]`. */
+  scopes?: string[];
+  /** Use PKCE. Defaults to true. */
+  pkce?: boolean;
+}
+/** SAML SSO connection (samlify via the SSO plugin; never hand-rolled XML). */
+interface ShelfSSOSaml {
+  /** SP entity ID (our audience; also the metadata default). */
+  issuer: string;
+  /** IdP SSO URL (required by the plugin type; unused when `metadataXml` is set). */
+  entryPoint: string;
+  /** IdP signing cert(s), PEM (ignored when `metadataXml` is set). */
+  cert?: string | string[];
+  /** IdP metadata XML (preferred: carries entity ID, endpoints, and certs). */
+  metadataXml?: string;
+  /** IdP entity ID (required without `metadataXml`). */
+  entityID?: string;
+  /** Expected audience (defaults to the SP issuer). */
+  audience?: string;
+  /** Reject unsigned assertions. Defaults to false. */
+  wantAssertionsSigned?: boolean;
+}
+/** IdP group sync for one SSO provider (site role + project memberships). */
+interface ShelfSSOGroupSync {
+  /**
+   * Claim (OIDC) or attribute (SAML) name(s) carrying group memberships.
+   * First hit wins across names; arrays pass through, a lone string counts
+   * as one group (never whitespace-split). Defaults to `["groups"]`.
+   */
+  claim?: string | string[];
+  /**
+   * Exact group names granting the site `admin` role. Full reconcile:
+   * members not matched reset to `member` on every SSO sign-in.
+   * Defaults to none (roles untouched).
+   */
+  admins?: string[];
+}
+/** One domain-routed SSO login method (OIDC, SAML, or both). */
+interface ShelfSSOProvider {
+  /** Stable id used in routes and descriptors (e.g. "acme-sso"). */
+  id: string;
+  /** Human label rendered on the login button. */
+  label: string;
+  /** Email domain routing key (e.g. "acme.example"). */
+  domain: string;
+  /** OIDC connection. Defaults to none. */
+  oidc?: ShelfSSOOidc;
+  /** SAML connection. Defaults to none. */
+  saml?: ShelfSSOSaml;
+  /** IdP group sync. Defaults to none (no group reads, roles untouched). */
+  groups?: ShelfSSOGroupSync;
+}
+/** Domain-routed SSO (OIDC discovery + SAML). Defaults to none. */
+interface ShelfSSOOptions {
+  /** SSO providers, each rendered as one login button. */
+  providers: ShelfSSOProvider[];
+  /** Require explicit sign-up confirmation for new SSO users. Defaults to false. */
+  disableImplicitSignUp?: boolean;
+}
+/** Session user fields the shelf reads back. */
+interface EngineSessionUser {
+  id: string;
+  email: string;
+  name: string;
+  image?: string | null;
+}
+/** Subset of the Better Auth instance surface the shelf uses. */
+interface ShelfAuthInstance {
+  /** HTTP handler (mount at `/api/auth/*`). */
+  handler: (request: Request) => Response | Promise<Response>;
+  api: {
+    /** Resolve the session user from request headers (null when anonymous). */
+    getSession(input: {
+      headers: Headers;
+    }): Promise<{
+      user: EngineSessionUser;
+    } | null>;
+    /** Revoke the session carried by the headers. */
+    signOut(input: {
+      headers: Headers;
+    }): Promise<unknown>;
+  };
+}
+/** Engine handle: raw instance for mounting plus the Auth singleton. */
+interface ShelfAuth {
+  /** Better Auth instance (mount `auth.handler`, call `auth.api.*`). */
+  auth: ShelfAuthInstance;
+  /** Auth singleton (check/destroySession, invites, sessions, descriptors). */
+  adapter: Auth;
+}
+/**
+ * Create the shelf auth engine over any DatabaseAdapter.
+ *
+ * Returns the raw instance (mount `auth.handler`, call `auth.api.*`) plus
+ * the Auth singleton (check/destroySession, invites, descriptors).
+ */
+declare function createShelfAuth(options: ShelfAuthOptions): ShelfAuth;
+//#endregion
+export { ENGINE_PROVIDER_ID, EngineSessionUser, ShelfAuth, ShelfAuthInstance, ShelfAuthOptions, ShelfOAuthProvider, ShelfPasskeyOptions, ShelfSSOGroupSync, ShelfSSOOidc, ShelfSSOOptions, ShelfSSOProvider, ShelfSSOSaml, ShelfSocialProvider, createShelfAuth };
+//# sourceMappingURL=engine.d.mts.map