@storyshelf/auth 0.5.3

package/dist/presets/social.d.mts

@@ -0,0 +1,34 @@
+import __tsdown_shims_path from 'node:path';
+import __tsdown_shims_url from 'node:url';
+import { ShelfSocialProvider } from "../engine.mjs";
+//#region src/presets/social.d.ts
+/** Client credentials shared by the OAuth social presets. */
+interface SocialClientOptions {
+  clientId: string;
+  clientSecret?: string;
+  label?: string;
+}
+/** GitHub social login (`github`). */
+declare function githubPreset(options: SocialClientOptions): ShelfSocialProvider;
+/** GitLab social login (`gitlab`; `issuer` for self-managed instances). */
+declare function gitlabPreset(options: SocialClientOptions & {
+  issuer?: string;
+}): ShelfSocialProvider;
+/** Google social login (`google`). */
+declare function googlePreset(options: SocialClientOptions): ShelfSocialProvider;
+/** Microsoft Entra ID social login (`microsoft`; `tenantId` or `common`). */
+declare function entraPreset(options: SocialClientOptions & {
+  tenantId?: string;
+}): ShelfSocialProvider;
+/** Amazon Cognito User Pool social login (`cognito`). */
+declare function cognitoPreset(options: {
+  domain: string;
+  region: string;
+  userPoolId: string;
+  clientId: string;
+  clientSecret?: string;
+  label?: string;
+}): ShelfSocialProvider;
+//#endregion
+export { SocialClientOptions, cognitoPreset, entraPreset, githubPreset, gitlabPreset, googlePreset };
+//# sourceMappingURL=social.d.mts.map

package/dist/presets/social.mjs

@@ -0,0 +1,60 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/presets/social.ts
+/** GitHub social login (`github`). */
+function githubPreset(options) {
+	return {
+		id: "github",
+		label: options.label ?? "GitHub",
+		clientId: options.clientId,
+		clientSecret: options.clientSecret
+	};
+}
+/** GitLab social login (`gitlab`; `issuer` for self-managed instances). */
+function gitlabPreset(options) {
+	return {
+		id: "gitlab",
+		label: options.label ?? "GitLab",
+		clientId: options.clientId,
+		clientSecret: options.clientSecret,
+		extra: { issuer: options.issuer }
+	};
+}
+/** Google social login (`google`). */
+function googlePreset(options) {
+	return {
+		id: "google",
+		label: options.label ?? "Google",
+		clientId: options.clientId,
+		clientSecret: options.clientSecret
+	};
+}
+/** Microsoft Entra ID social login (`microsoft`; `tenantId` or `common`). */
+function entraPreset(options) {
+	return {
+		id: "microsoft",
+		label: options.label ?? "Microsoft",
+		clientId: options.clientId,
+		clientSecret: options.clientSecret,
+		extra: { tenantId: options.tenantId }
+	};
+}
+/** Amazon Cognito User Pool social login (`cognito`). */
+function cognitoPreset(options) {
+	return {
+		id: "cognito",
+		label: options.label ?? "Cognito",
+		clientId: options.clientId,
+		clientSecret: options.clientSecret,
+		extra: {
+			domain: options.domain,
+			region: options.region,
+			userPoolId: options.userPoolId
+		}
+	};
+}
+//#endregion
+export { cognitoPreset, entraPreset, githubPreset, gitlabPreset, googlePreset };
+
+//# sourceMappingURL=social.mjs.map

package/dist/presets/social.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"social.mjs","names":[],"sources":["../../src/presets/social.ts"],"sourcesContent":["/**\n * Native social provider recipes: option bags for Better Auth built-ins.\n *\n * Each preset returns a {@link ShelfSocialProvider} for\n * `createShelfAuth({ social })`. Native providers own their protocol\n * (PKCE, token exchange, profile mapping) — the shelf only supplies\n * credentials, so these recipes are pure config with no network behavior.\n */\nimport type { ShelfSocialProvider } from \"../engine.ts\";\n\n/** Client credentials shared by the OAuth social presets. */\nexport interface SocialClientOptions {\n  clientId: string;\n  clientSecret?: string;\n  label?: string;\n}\n\n/** GitHub social login (`github`). */\nexport function githubPreset(options: SocialClientOptions): ShelfSocialProvider {\n  return {\n    id: \"github\",\n    label: options.label ?? \"GitHub\",\n    clientId: options.clientId,\n    clientSecret: options.clientSecret,\n  };\n}\n\n/** GitLab social login (`gitlab`; `issuer` for self-managed instances). */\nexport function gitlabPreset(\n  options: SocialClientOptions & { issuer?: string },\n): ShelfSocialProvider {\n  return {\n    id: \"gitlab\",\n    label: options.label ?? \"GitLab\",\n    clientId: options.clientId,\n    clientSecret: options.clientSecret,\n    extra: { issuer: options.issuer },\n  };\n}\n\n/** Google social login (`google`). */\nexport function googlePreset(options: SocialClientOptions): ShelfSocialProvider {\n  return {\n    id: \"google\",\n    label: options.label ?? \"Google\",\n    clientId: options.clientId,\n    clientSecret: options.clientSecret,\n  };\n}\n\n/** Microsoft Entra ID social login (`microsoft`; `tenantId` or `common`). */\nexport function entraPreset(\n  options: SocialClientOptions & { tenantId?: string },\n): ShelfSocialProvider {\n  return {\n    id: \"microsoft\",\n    label: options.label ?? \"Microsoft\",\n    clientId: options.clientId,\n    clientSecret: options.clientSecret,\n    extra: { tenantId: options.tenantId },\n  };\n}\n\n/** Amazon Cognito User Pool social login (`cognito`). */\nexport function cognitoPreset(options: {\n  domain: string;\n  region: string;\n  userPoolId: string;\n  clientId: string;\n  clientSecret?: string;\n  label?: string;\n}): ShelfSocialProvider {\n  return {\n    id: \"cognito\",\n    label: options.label ?? \"Cognito\",\n    clientId: options.clientId,\n    clientSecret: options.clientSecret,\n    extra: { domain: options.domain, region: options.region, userPoolId: options.userPoolId },\n  };\n}\n"],"mappings":";;;;;AAkBA,SAAgB,aAAa,SAAmD;CAC9E,OAAO;EACL,IAAI;EACJ,OAAO,QAAQ,SAAS;EACxB,UAAU,QAAQ;EAClB,cAAc,QAAQ;CACxB;AACF;;AAGA,SAAgB,aACd,SACqB;CACrB,OAAO;EACL,IAAI;EACJ,OAAO,QAAQ,SAAS;EACxB,UAAU,QAAQ;EAClB,cAAc,QAAQ;EACtB,OAAO,EAAE,QAAQ,QAAQ,OAAO;CAClC;AACF;;AAGA,SAAgB,aAAa,SAAmD;CAC9E,OAAO;EACL,IAAI;EACJ,OAAO,QAAQ,SAAS;EACxB,UAAU,QAAQ;EAClB,cAAc,QAAQ;CACxB;AACF;;AAGA,SAAgB,YACd,SACqB;CACrB,OAAO;EACL,IAAI;EACJ,OAAO,QAAQ,SAAS;EACxB,UAAU,QAAQ;EAClB,cAAc,QAAQ;EACtB,OAAO,EAAE,UAAU,QAAQ,SAAS;CACtC;AACF;;AAGA,SAAgB,cAAc,SAON;CACtB,OAAO;EACL,IAAI;EACJ,OAAO,QAAQ,SAAS;EACxB,UAAU,QAAQ;EAClB,cAAc,QAAQ;EACtB,OAAO;GAAE,QAAQ,QAAQ;GAAQ,QAAQ,QAAQ;GAAQ,YAAY,QAAQ;EAAW;CAC1F;AACF"}

package/dist/presets/sso.d.mts

@@ -0,0 +1,72 @@
+import __tsdown_shims_path from 'node:path';
+import __tsdown_shims_url from 'node:url';
+import { ShelfSSOProvider } from "../engine.mjs";
+//#region src/presets/sso.d.ts
+/** Client credentials shared by the OIDC SSO presets. */
+interface SSOClientOptions {
+  /** Email domain routing key (e.g. "acme.example"). */
+  domain: string;
+  clientId: string;
+  clientSecret?: string;
+  label?: string;
+  /** Stable provider id. Defaults to the preset name. */
+  id?: string;
+  /** OIDC claim name(s) carrying groups. Defaults to `["groups"]`. */
+  groupsClaim?: string | string[];
+  /** Exact group names granting the site `admin` role (full reconcile). */
+  adminGroups?: string[];
+}
+/** Group sync shared by the SAML preset. */
+interface SAMLGroupOptions {
+  /**
+   * SAML attribute name carrying groups (surfaced under the same name).
+   * Defaults to `"groups"`.
+   */
+  groupsAttribute?: string;
+  /** Exact group names granting the site `admin` role (full reconcile). */
+  adminGroups?: string[];
+}
+/** IdP metadata for the SAML preset (XML preferred, explicit fields otherwise). */
+interface SAMLIdPOptions {
+  /** IdP SSO URL (required by the plugin type; unused when `metadataXml` is set). */
+  entryPoint: string;
+  /** IdP metadata XML (preferred: carries entity ID, endpoints, and certs). */
+  metadataXml?: string;
+  /** IdP entity ID (required without `metadataXml`). */
+  entityID?: string;
+  /** IdP signing cert(s), PEM (ignored when `metadataXml` is set). */
+  cert?: string | string[];
+}
+/** Generic SAML recipe (any IdP with an SSO URL or metadata XML). */
+declare function samlPreset(options: SAMLIdPOptions & SAMLGroupOptions & {
+  domain: string;
+  /** SP entity ID (our audience). */
+  issuer: string;
+  label?: string;
+  id?: string;
+}): ShelfSSOProvider;
+/** Keycloak realm SSO (OIDC discovery over the realm URL). */
+declare function ssoKeycloakPreset(realmUrl: string, options: SSOClientOptions): ShelfSSOProvider;
+/** Okta SSO (custom authorization server, OIDC discovery). */
+declare function ssoOktaPreset(options: SSOClientOptions & {
+  authorizationServerId: string;
+}): ShelfSSOProvider;
+/** Auth0 SSO (OIDC discovery over the tenant domain). */
+declare function ssoAuth0Preset(options: SSOClientOptions & {
+  tenant: string;
+}): ShelfSSOProvider;
+/** Google Workspace SSO (OIDC discovery; `domain` is the Workspace domain). */
+declare function ssoGooglePreset(options: SSOClientOptions): ShelfSSOProvider;
+/** Microsoft Entra ID SSO (OIDC discovery over the tenant issuer). */
+declare function ssoEntraPreset(options: SSOClientOptions & {
+  tenantId?: string;
+}): ShelfSSOProvider;
+/** IdP callback URLs for one SSO provider (hand these to the IdP admin). */
+declare function ssoCallbackUrls(baseURL: string, providerId: string): {
+  acs: string;
+  metadata: string;
+  oidcCallback: string;
+};
+//#endregion
+export { SAMLGroupOptions, SAMLIdPOptions, SSOClientOptions, samlPreset, ssoAuth0Preset, ssoCallbackUrls, ssoEntraPreset, ssoGooglePreset, ssoKeycloakPreset, ssoOktaPreset };
+//# sourceMappingURL=sso.d.mts.map

package/dist/presets/sso.mjs

@@ -0,0 +1,136 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/presets/sso.ts
+/** Build the `groups` entry when either knob is set (else no group reads). */
+function groupSyncOf(options) {
+	if (options.claim === void 0 && options.admins === void 0) return;
+	return {
+		...options.claim === void 0 ? {} : { claim: options.claim },
+		...options.admins === void 0 ? {} : { admins: options.admins }
+	};
+}
+/** Resolve the IdP authority, failing fast when it is under-specified. */
+function samlAuthority(options) {
+	if (options.metadataXml !== void 0) return {
+		metadataXml: options.metadataXml,
+		entityID: options.entityID
+	};
+	if (options.entityID === void 0) throw new Error("Shelf SSO SAML needs entityID or metadataXml");
+	return { entityID: options.entityID };
+}
+/** Generic SAML recipe (any IdP with an SSO URL or metadata XML). */
+function samlPreset(options) {
+	const authority = samlAuthority(options);
+	const syncing = options.adminGroups !== void 0 || options.groupsAttribute !== void 0;
+	const attribute = options.groupsAttribute ?? "groups";
+	return {
+		id: options.id ?? "saml",
+		label: options.label ?? "SSO",
+		domain: options.domain,
+		saml: {
+			issuer: options.issuer,
+			entryPoint: options.entryPoint,
+			...options.cert === void 0 ? {} : { cert: options.cert },
+			...authority.metadataXml === void 0 ? {} : { metadataXml: authority.metadataXml },
+			...authority.entityID === void 0 ? {} : { entityID: authority.entityID }
+		},
+		...syncing ? { groups: {
+			claim: [attribute],
+			...options.adminGroups === void 0 ? {} : { admins: options.adminGroups }
+		} } : {}
+	};
+}
+/** Keycloak realm SSO (OIDC discovery over the realm URL). */
+function ssoKeycloakPreset(realmUrl, options) {
+	return {
+		id: options.id ?? "keycloak",
+		label: options.label ?? "Keycloak",
+		domain: options.domain,
+		oidc: {
+			issuer: realmUrl,
+			clientId: options.clientId,
+			clientSecret: options.clientSecret
+		},
+		...oidcGroupsOf(options)
+	};
+}
+/** OIDC `groups` entry for the client-option presets. */
+function oidcGroupsOf(options) {
+	const groups = groupSyncOf({
+		claim: options.groupsClaim,
+		admins: options.adminGroups
+	});
+	return groups === void 0 ? {} : { groups };
+}
+/** Okta SSO (custom authorization server, OIDC discovery). */
+function ssoOktaPreset(options) {
+	const issuer = `https://${options.domain}/oauth2/${options.authorizationServerId}`;
+	return {
+		id: options.id ?? "okta",
+		label: options.label ?? "Okta",
+		domain: options.domain,
+		oidc: {
+			issuer,
+			clientId: options.clientId,
+			clientSecret: options.clientSecret
+		},
+		...oidcGroupsOf(options)
+	};
+}
+/** Auth0 SSO (OIDC discovery over the tenant domain). */
+function ssoAuth0Preset(options) {
+	return {
+		id: options.id ?? "auth0",
+		label: options.label ?? "Auth0",
+		domain: options.domain,
+		oidc: {
+			issuer: `https://${options.tenant}/`,
+			clientId: options.clientId,
+			clientSecret: options.clientSecret
+		},
+		...oidcGroupsOf(options)
+	};
+}
+/** Google Workspace SSO (OIDC discovery; `domain` is the Workspace domain). */
+function ssoGooglePreset(options) {
+	return {
+		id: options.id ?? "google-workspace",
+		label: options.label ?? "Google",
+		domain: options.domain,
+		oidc: {
+			issuer: "https://accounts.google.com",
+			clientId: options.clientId,
+			clientSecret: options.clientSecret
+		},
+		...oidcGroupsOf(options)
+	};
+}
+/** Microsoft Entra ID SSO (OIDC discovery over the tenant issuer). */
+function ssoEntraPreset(options) {
+	const tenant = options.tenantId ?? "common";
+	return {
+		id: options.id ?? "entra",
+		label: options.label ?? "Microsoft",
+		domain: options.domain,
+		oidc: {
+			issuer: `https://login.microsoftonline.com/${tenant}/v2.0`,
+			clientId: options.clientId,
+			clientSecret: options.clientSecret
+		},
+		...oidcGroupsOf(options)
+	};
+}
+/** IdP callback URLs for one SSO provider (hand these to the IdP admin). */
+function ssoCallbackUrls(baseURL, providerId) {
+	const root = baseURL.replace(/\/+$/u, "");
+	return {
+		acs: `${root}/api/auth/sso/saml2/sp/acs/${providerId}`,
+		metadata: `${root}/api/auth/sso/saml2/sp/metadata?providerId=${providerId}`,
+		oidcCallback: `${root}/api/auth/sso/callback/${providerId}`
+	};
+}
+//#endregion
+export { samlPreset, ssoAuth0Preset, ssoCallbackUrls, ssoEntraPreset, ssoGooglePreset, ssoKeycloakPreset, ssoOktaPreset };
+
+//# sourceMappingURL=sso.mjs.map

package/dist/presets/sso.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"sso.mjs","names":[],"sources":["../../src/presets/sso.ts"],"sourcesContent":["/**\n * SSO recipes: code-driven provider entries for the Better Auth SSO plugin.\n *\n * Each preset returns a {@link ShelfSSOProvider} for\n * `createShelfAuth({ sso: { providers } })`. Providers resolve by email\n * domain at sign-in; OIDC entries use IdP discovery, SAML entries use\n * samlify through the plugin (never hand-rolled XML).\n *\n * IdP-side configuration per provider (replace `{baseURL}` and `{id}`):\n * - ACS (reply) URL: `{baseURL}/api/auth/sso/saml2/sp/acs/{id}`\n * - SP metadata: `{baseURL}/api/auth/sso/saml2/sp/metadata?providerId={id}`\n * - OIDC callback: `{baseURL}/api/auth/sso/callback/{id}`\n */\nimport type { ShelfSSOGroupSync, ShelfSSOProvider } from \"../engine.ts\";\n\n/** Client credentials shared by the OIDC SSO presets. */\nexport interface SSOClientOptions {\n  /** Email domain routing key (e.g. \"acme.example\"). */\n  domain: string;\n  clientId: string;\n  clientSecret?: string;\n  label?: string;\n  /** Stable provider id. Defaults to the preset name. */\n  id?: string;\n  /** OIDC claim name(s) carrying groups. Defaults to `[\"groups\"]`. */\n  groupsClaim?: string | string[];\n  /** Exact group names granting the site `admin` role (full reconcile). */\n  adminGroups?: string[];\n}\n\n/** Group sync shared by the SAML preset. */\nexport interface SAMLGroupOptions {\n  /**\n   * SAML attribute name carrying groups (surfaced under the same name).\n   * Defaults to `\"groups\"`.\n   */\n  groupsAttribute?: string;\n  /** Exact group names granting the site `admin` role (full reconcile). */\n  adminGroups?: string[];\n}\n\n/** Build the `groups` entry when either knob is set (else no group reads). */\nfunction groupSyncOf(options: {\n  claim?: string | string[];\n  admins?: string[];\n}): ShelfSSOGroupSync | undefined {\n  if (options.claim === undefined && options.admins === undefined) {\n    return undefined;\n  }\n  return {\n    ...(options.claim === undefined ? {} : { claim: options.claim }),\n    ...(options.admins === undefined ? {} : { admins: options.admins }),\n  };\n}\n\n/** IdP metadata for the SAML preset (XML preferred, explicit fields otherwise). */\nexport interface SAMLIdPOptions {\n  /** IdP SSO URL (required by the plugin type; unused when `metadataXml` is set). */\n  entryPoint: string;\n  /** IdP metadata XML (preferred: carries entity ID, endpoints, and certs). */\n  metadataXml?: string;\n  /** IdP entity ID (required without `metadataXml`). */\n  entityID?: string;\n  /** IdP signing cert(s), PEM (ignored when `metadataXml` is set). */\n  cert?: string | string[];\n}\n\n/** Resolve the IdP authority, failing fast when it is under-specified. */\nfunction samlAuthority(options: SAMLIdPOptions): { metadataXml?: string; entityID?: string } {\n  if (options.metadataXml !== undefined) {\n    return { metadataXml: options.metadataXml, entityID: options.entityID };\n  }\n  if (options.entityID === undefined) {\n    throw new Error(\"Shelf SSO SAML needs entityID or metadataXml\");\n  }\n  return { entityID: options.entityID };\n}\n\n/** Generic SAML recipe (any IdP with an SSO URL or metadata XML). */\nexport function samlPreset(\n  options: SAMLIdPOptions &\n    SAMLGroupOptions & {\n      domain: string;\n      /** SP entity ID (our audience). */\n      issuer: string;\n      label?: string;\n      id?: string;\n    },\n): ShelfSSOProvider {\n  const authority = samlAuthority(options);\n  const syncing = options.adminGroups !== undefined || options.groupsAttribute !== undefined;\n  const attribute = options.groupsAttribute ?? \"groups\";\n  return {\n    id: options.id ?? \"saml\",\n    label: options.label ?? \"SSO\",\n    domain: options.domain,\n    saml: {\n      issuer: options.issuer,\n      entryPoint: options.entryPoint,\n      ...(options.cert === undefined ? {} : { cert: options.cert }),\n      ...(authority.metadataXml === undefined ? {} : { metadataXml: authority.metadataXml }),\n      ...(authority.entityID === undefined ? {} : { entityID: authority.entityID }),\n    },\n    ...(syncing\n      ? {\n          groups: {\n            claim: [attribute],\n            ...(options.adminGroups === undefined ? {} : { admins: options.adminGroups }),\n          },\n        }\n      : {}),\n  };\n}\n\n/** Keycloak realm SSO (OIDC discovery over the realm URL). */\nexport function ssoKeycloakPreset(realmUrl: string, options: SSOClientOptions): ShelfSSOProvider {\n  return {\n    id: options.id ?? \"keycloak\",\n    label: options.label ?? \"Keycloak\",\n    domain: options.domain,\n    oidc: {\n      issuer: realmUrl,\n      clientId: options.clientId,\n      clientSecret: options.clientSecret,\n    },\n    ...oidcGroupsOf(options),\n  };\n}\n\n/** OIDC `groups` entry for the client-option presets. */\nfunction oidcGroupsOf(options: SSOClientOptions): Pick<ShelfSSOProvider, \"groups\"> {\n  const groups = groupSyncOf({ claim: options.groupsClaim, admins: options.adminGroups });\n  return groups === undefined ? {} : { groups };\n}\n\n/** Okta SSO (custom authorization server, OIDC discovery). */\nexport function ssoOktaPreset(\n  options: SSOClientOptions & { authorizationServerId: string },\n): ShelfSSOProvider {\n  const issuer = `https://${options.domain}/oauth2/${options.authorizationServerId}`;\n  return {\n    id: options.id ?? \"okta\",\n    label: options.label ?? \"Okta\",\n    domain: options.domain,\n    oidc: { issuer, clientId: options.clientId, clientSecret: options.clientSecret },\n    ...oidcGroupsOf(options),\n  };\n}\n\n/** Auth0 SSO (OIDC discovery over the tenant domain). */\nexport function ssoAuth0Preset(options: SSOClientOptions & { tenant: string }): ShelfSSOProvider {\n  return {\n    id: options.id ?? \"auth0\",\n    label: options.label ?? \"Auth0\",\n    domain: options.domain,\n    oidc: {\n      issuer: `https://${options.tenant}/`,\n      clientId: options.clientId,\n      clientSecret: options.clientSecret,\n    },\n    ...oidcGroupsOf(options),\n  };\n}\n\n/** Google Workspace SSO (OIDC discovery; `domain` is the Workspace domain). */\nexport function ssoGooglePreset(options: SSOClientOptions): ShelfSSOProvider {\n  return {\n    id: options.id ?? \"google-workspace\",\n    label: options.label ?? \"Google\",\n    domain: options.domain,\n    oidc: {\n      issuer: \"https://accounts.google.com\",\n      clientId: options.clientId,\n      clientSecret: options.clientSecret,\n    },\n    ...oidcGroupsOf(options),\n  };\n}\n\n/** Microsoft Entra ID SSO (OIDC discovery over the tenant issuer). */\nexport function ssoEntraPreset(\n  options: SSOClientOptions & { tenantId?: string },\n): ShelfSSOProvider {\n  const tenant = options.tenantId ?? \"common\";\n  return {\n    id: options.id ?? \"entra\",\n    label: options.label ?? \"Microsoft\",\n    domain: options.domain,\n    oidc: {\n      issuer: `https://login.microsoftonline.com/${tenant}/v2.0`,\n      clientId: options.clientId,\n      clientSecret: options.clientSecret,\n    },\n    ...oidcGroupsOf(options),\n  };\n}\n\n/** IdP callback URLs for one SSO provider (hand these to the IdP admin). */\nexport function ssoCallbackUrls(\n  baseURL: string,\n  providerId: string,\n): { acs: string; metadata: string; oidcCallback: string } {\n  const root = baseURL.replace(/\\/+$/u, \"\");\n  return {\n    acs: `${root}/api/auth/sso/saml2/sp/acs/${providerId}`,\n    metadata: `${root}/api/auth/sso/saml2/sp/metadata?providerId=${providerId}`,\n    oidcCallback: `${root}/api/auth/sso/callback/${providerId}`,\n  };\n}\n"],"mappings":";;;;;AA0CA,SAAS,YAAY,SAGa;CAChC,IAAI,QAAQ,UAAU,KAAA,KAAa,QAAQ,WAAW,KAAA,GACpD;CAEF,OAAO;EACL,GAAI,QAAQ,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,QAAQ,MAAM;EAC9D,GAAI,QAAQ,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,QAAQ,OAAO;CACnE;AACF;;AAeA,SAAS,cAAc,SAAsE;CAC3F,IAAI,QAAQ,gBAAgB,KAAA,GAC1B,OAAO;EAAE,aAAa,QAAQ;EAAa,UAAU,QAAQ;CAAS;CAExE,IAAI,QAAQ,aAAa,KAAA,GACvB,MAAM,IAAI,MAAM,8CAA8C;CAEhE,OAAO,EAAE,UAAU,QAAQ,SAAS;AACtC;;AAGA,SAAgB,WACd,SAQkB;CAClB,MAAM,YAAY,cAAc,OAAO;CACvC,MAAM,UAAU,QAAQ,gBAAgB,KAAA,KAAa,QAAQ,oBAAoB,KAAA;CACjF,MAAM,YAAY,QAAQ,mBAAmB;CAC7C,OAAO;EACL,IAAI,QAAQ,MAAM;EAClB,OAAO,QAAQ,SAAS;EACxB,QAAQ,QAAQ;EAChB,MAAM;GACJ,QAAQ,QAAQ;GAChB,YAAY,QAAQ;GACpB,GAAI,QAAQ,SAAS,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM,QAAQ,KAAK;GAC3D,GAAI,UAAU,gBAAgB,KAAA,IAAY,CAAC,IAAI,EAAE,aAAa,UAAU,YAAY;GACpF,GAAI,UAAU,aAAa,KAAA,IAAY,CAAC,IAAI,EAAE,UAAU,UAAU,SAAS;EAC7E;EACA,GAAI,UACA,EACE,QAAQ;GACN,OAAO,CAAC,SAAS;GACjB,GAAI,QAAQ,gBAAgB,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,QAAQ,YAAY;EAC7E,EACF,IACA,CAAC;CACP;AACF;;AAGA,SAAgB,kBAAkB,UAAkB,SAA6C;CAC/F,OAAO;EACL,IAAI,QAAQ,MAAM;EAClB,OAAO,QAAQ,SAAS;EACxB,QAAQ,QAAQ;EAChB,MAAM;GACJ,QAAQ;GACR,UAAU,QAAQ;GAClB,cAAc,QAAQ;EACxB;EACA,GAAG,aAAa,OAAO;CACzB;AACF;;AAGA,SAAS,aAAa,SAA6D;CACjF,MAAM,SAAS,YAAY;EAAE,OAAO,QAAQ;EAAa,QAAQ,QAAQ;CAAY,CAAC;CACtF,OAAO,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO;AAC9C;;AAGA,SAAgB,cACd,SACkB;CAClB,MAAM,SAAS,WAAW,QAAQ,OAAO,UAAU,QAAQ;CAC3D,OAAO;EACL,IAAI,QAAQ,MAAM;EAClB,OAAO,QAAQ,SAAS;EACxB,QAAQ,QAAQ;EAChB,MAAM;GAAE;GAAQ,UAAU,QAAQ;GAAU,cAAc,QAAQ;EAAa;EAC/E,GAAG,aAAa,OAAO;CACzB;AACF;;AAGA,SAAgB,eAAe,SAAkE;CAC/F,OAAO;EACL,IAAI,QAAQ,MAAM;EAClB,OAAO,QAAQ,SAAS;EACxB,QAAQ,QAAQ;EAChB,MAAM;GACJ,QAAQ,WAAW,QAAQ,OAAO;GAClC,UAAU,QAAQ;GAClB,cAAc,QAAQ;EACxB;EACA,GAAG,aAAa,OAAO;CACzB;AACF;;AAGA,SAAgB,gBAAgB,SAA6C;CAC3E,OAAO;EACL,IAAI,QAAQ,MAAM;EAClB,OAAO,QAAQ,SAAS;EACxB,QAAQ,QAAQ;EAChB,MAAM;GACJ,QAAQ;GACR,UAAU,QAAQ;GAClB,cAAc,QAAQ;EACxB;EACA,GAAG,aAAa,OAAO;CACzB;AACF;;AAGA,SAAgB,eACd,SACkB;CAClB,MAAM,SAAS,QAAQ,YAAY;CACnC,OAAO;EACL,IAAI,QAAQ,MAAM;EAClB,OAAO,QAAQ,SAAS;EACxB,QAAQ,QAAQ;EAChB,MAAM;GACJ,QAAQ,qCAAqC,OAAO;GACpD,UAAU,QAAQ;GAClB,cAAc,QAAQ;EACxB;EACA,GAAG,aAAa,OAAO;CACzB;AACF;;AAGA,SAAgB,gBACd,SACA,YACyD;CACzD,MAAM,OAAO,QAAQ,QAAQ,SAAS,EAAE;CACxC,OAAO;EACL,KAAK,GAAG,KAAK,6BAA6B;EAC1C,UAAU,GAAG,KAAK,6CAA6C;EAC/D,cAAc,GAAG,KAAK,yBAAyB;CACjD;AACF"}

package/dist/sessions.d.mts

@@ -0,0 +1,23 @@
+import __tsdown_shims_path from 'node:path';
+import __tsdown_shims_url from 'node:url';
+import { DatabaseAdapter } from "@storyshelf/core/adapter/database";
+//#region src/sessions.d.ts
+/** One device session for the profile page. */
+interface EngineSessionInfo {
+  id: string;
+  token: string;
+  ipAddress: string | null;
+  userAgent: string | null;
+  createdAt: string;
+  expiresAt: string;
+}
+/**
+ * Raw session token from a possibly-signed cookie value (`token.signature`).
+ * Single shared parser: cookies, CSRF binding, and table lookups must agree.
+ */
+declare function unsignedToken(value: string): string;
+/** Active sessions for a user, newest first (expired rows are dropped). */
+declare function listUserSessions(db: DatabaseAdapter, userId: string): Promise<EngineSessionInfo[]>;
+//#endregion
+export { EngineSessionInfo, listUserSessions, unsignedToken };
+//# sourceMappingURL=sessions.d.mts.map

package/dist/sessions.mjs

@@ -0,0 +1,51 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { baseAuthTables } from "./auth-tables.mjs";
+import { tableColumn } from "./invites.mjs";
+import { eq } from "drizzle-orm";
+//#region src/sessions.ts
+/**
+* Raw session token from a possibly-signed cookie value (`token.signature`).
+* Single shared parser: cookies, CSRF binding, and table lookups must agree.
+*/
+function unsignedToken(value) {
+	return value.split(".")[0] ?? "";
+}
+/** Delete every session row for a user (eager revocation on disable). */
+async function deleteUserSessions(db, userId) {
+	const rows = await db.list(baseAuthTables.session, { where: eq(tableColumn(baseAuthTables.session, "userId"), userId) });
+	await Promise.all(rows.map(async (row) => {
+		await db.remove(baseAuthTables.session, String(row["id"]));
+	}));
+	return rows.length;
+}
+/** Delete one session by token (accepts the signed cookie value or raw token). */
+async function deleteSessionByToken(db, token) {
+	const raw = token.split(".")[0] ?? "";
+	if (!raw) return false;
+	const row = (await db.list(baseAuthTables.session, {
+		where: eq(tableColumn(baseAuthTables.session, "token"), raw),
+		limit: 1
+	}))[0];
+	if (!row) return false;
+	await db.remove(baseAuthTables.session, String(row["id"]));
+	return true;
+}
+/** Active sessions for a user, newest first (expired rows are dropped). */
+async function listUserSessions(db, userId) {
+	const rows = await db.list(baseAuthTables.session, { where: eq(tableColumn(baseAuthTables.session, "userId"), userId) });
+	const now = Date.now();
+	return rows.filter((row) => new Date(String(row["expiresAt"])).getTime() > now).map((row) => ({
+		id: String(row["id"]),
+		token: String(row["token"]),
+		ipAddress: row["ipAddress"] ?? null,
+		userAgent: row["userAgent"] ?? null,
+		createdAt: String(row["createdAt"]),
+		expiresAt: String(row["expiresAt"])
+	})).toSorted((a, b) => a.createdAt === b.createdAt ? a.id.localeCompare(b.id) : a.createdAt < b.createdAt ? 1 : -1);
+}
+//#endregion
+export { deleteSessionByToken, deleteUserSessions, listUserSessions, unsignedToken };
+
+//# sourceMappingURL=sessions.mjs.map

package/dist/sessions.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessions.mjs","names":[],"sources":["../src/sessions.ts"],"sourcesContent":["/**\n * Shelf-side session inventory for the profile device list.\n *\n * Listing reads our `session` table directly (full rows, including tokens\n * for revoke + current-device matching). Mutations go through engine\n * endpoints (`/revoke-session` is ownership-checked server-side,\n * `/revoke-other-sessions` keeps the caller), never raw deletes.\n */\nimport type { DatabaseAdapter } from \"@storyshelf/core/adapter/database\";\nimport { eq } from \"drizzle-orm\";\nimport { baseAuthTables } from \"./auth-tables.ts\";\nimport { tableColumn } from \"./invites.ts\";\n\n/** One device session for the profile page. */\nexport interface EngineSessionInfo {\n  id: string;\n  token: string;\n  ipAddress: string | null;\n  userAgent: string | null;\n  createdAt: string;\n  expiresAt: string;\n}\n\n/**\n * Raw session token from a possibly-signed cookie value (`token.signature`).\n * Single shared parser: cookies, CSRF binding, and table lookups must agree.\n */\nexport function unsignedToken(value: string): string {\n  return value.split(\".\")[0] ?? \"\";\n}\n\n/** Delete every session row for a user (eager revocation on disable). */\nexport async function deleteUserSessions(db: DatabaseAdapter, userId: string): Promise<number> {\n  const rows = (await db.list(baseAuthTables.session, {\n    where: eq(tableColumn(baseAuthTables.session, \"userId\"), userId),\n  })) as Record<string, unknown>[];\n  await Promise.all(\n    rows.map(async (row) => {\n      await db.remove(baseAuthTables.session, String(row[\"id\"]));\n    }),\n  );\n  return rows.length;\n}\n\n/** Delete one session by token (accepts the signed cookie value or raw token). */\nexport async function deleteSessionByToken(db: DatabaseAdapter, token: string): Promise<boolean> {\n  const raw = token.split(\".\")[0] ?? \"\";\n  if (!raw) {\n    return false;\n  }\n  const rows = (await db.list(baseAuthTables.session, {\n    where: eq(tableColumn(baseAuthTables.session, \"token\"), raw),\n    limit: 1,\n  })) as Record<string, unknown>[];\n  const row = rows[0];\n  if (!row) {\n    return false;\n  }\n  await db.remove(baseAuthTables.session, String(row[\"id\"]));\n  return true;\n}\n\n/** Active sessions for a user, newest first (expired rows are dropped). */\nexport async function listUserSessions(\n  db: DatabaseAdapter,\n  userId: string,\n): Promise<EngineSessionInfo[]> {\n  const rows = (await db.list(baseAuthTables.session, {\n    where: eq(tableColumn(baseAuthTables.session, \"userId\"), userId),\n  })) as Record<string, unknown>[];\n  const now = Date.now();\n  return rows\n    .filter((row) => new Date(String(row[\"expiresAt\"])).getTime() > now)\n    .map((row) => ({\n      id: String(row[\"id\"]),\n      token: String(row[\"token\"]),\n      ipAddress: (row[\"ipAddress\"] as string | null) ?? null,\n      userAgent: (row[\"userAgent\"] as string | null) ?? null,\n      createdAt: String(row[\"createdAt\"]),\n      expiresAt: String(row[\"expiresAt\"]),\n    }))\n    .toSorted((a, b) =>\n      a.createdAt === b.createdAt ? a.id.localeCompare(b.id) : a.createdAt < b.createdAt ? 1 : -1,\n    );\n}\n"],"mappings":";;;;;;;;;;;AA2BA,SAAgB,cAAc,OAAuB;CACnD,OAAO,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM;AAChC;;AAGA,eAAsB,mBAAmB,IAAqB,QAAiC;CAC7F,MAAM,OAAQ,MAAM,GAAG,KAAK,eAAe,SAAS,EAClD,OAAO,GAAG,YAAY,eAAe,SAAS,QAAQ,GAAG,MAAM,EACjE,CAAC;CACD,MAAM,QAAQ,IACZ,KAAK,IAAI,OAAO,QAAQ;EACtB,MAAM,GAAG,OAAO,eAAe,SAAS,OAAO,IAAI,KAAK,CAAC;CAC3D,CAAC,CACH;CACA,OAAO,KAAK;AACd;;AAGA,eAAsB,qBAAqB,IAAqB,OAAiC;CAC/F,MAAM,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM;CACnC,IAAI,CAAC,KACH,OAAO;CAMT,MAAM,OAAM,MAJQ,GAAG,KAAK,eAAe,SAAS;EAClD,OAAO,GAAG,YAAY,eAAe,SAAS,OAAO,GAAG,GAAG;EAC3D,OAAO;CACT,CAAC,EAAA,CACgB;CACjB,IAAI,CAAC,KACH,OAAO;CAET,MAAM,GAAG,OAAO,eAAe,SAAS,OAAO,IAAI,KAAK,CAAC;CACzD,OAAO;AACT;;AAGA,eAAsB,iBACpB,IACA,QAC8B;CAC9B,MAAM,OAAQ,MAAM,GAAG,KAAK,eAAe,SAAS,EAClD,OAAO,GAAG,YAAY,eAAe,SAAS,QAAQ,GAAG,MAAM,EACjE,CAAC;CACD,MAAM,MAAM,KAAK,IAAI;CACrB,OAAO,KACJ,QAAQ,QAAQ,IAAI,KAAK,OAAO,IAAI,YAAY,CAAC,CAAC,CAAC,QAAQ,IAAI,GAAG,CAAC,CACnE,KAAK,SAAS;EACb,IAAI,OAAO,IAAI,KAAK;EACpB,OAAO,OAAO,IAAI,QAAQ;EAC1B,WAAY,IAAI,gBAAkC;EAClD,WAAY,IAAI,gBAAkC;EAClD,WAAW,OAAO,IAAI,YAAY;EAClC,WAAW,OAAO,IAAI,YAAY;CACpC,EAAE,CAAC,CACF,UAAU,GAAG,MACZ,EAAE,cAAc,EAAE,YAAY,EAAE,GAAG,cAAc,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,YAAY,IAAI,EAC3F;AACJ"}

package/package.json

@@ -0,0 +1,82 @@
+{
+  "name": "@storyshelf/auth",
+  "version": "0.5.3",
+  "description": "Better Auth engine for StoryShelf: opaque DBAdapter bridge, shelf factory, and auth presets.",
+  "keywords": [
+    "auth",
+    "better-auth",
+    "self-hosted",
+    "storybook"
+  ],
+  "homepage": "https://github.com/GuptaSiddhant/StoryShelf#readme",
+  "bugs": {
+    "url": "https://github.com/GuptaSiddhant/StoryShelf/issues"
+  },
+  "license": "MIT",
+  "author": {
+    "name": "Siddhant Gupta",
+    "url": "https://guptasiddhant.com"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/GuptaSiddhant/StoryShelf.git",
+    "directory": "packages/auth"
+  },
+  "files": [
+    "dist"
+  ],
+  "type": "module",
+  "sideEffects": false,
+  "types": "./dist/index.d.mts",
+  "exports": {
+    ".": {
+      "source": "./src/index.ts",
+      "default": "./dist/index.mjs"
+    },
+    "./package.json": "./package.json"
+  },
+  "publishConfig": {
+    "exports": {
+      ".": "./dist/index.mjs",
+      "./package.json": "./package.json"
+    },
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsdown",
+    "dev": "tsdown -w",
+    "fmt": "oxfmt ./src",
+    "lint": "oxlint --type-aware --type-check ./src",
+    "test": "vitest run",
+    "prepublishOnly": "nub run build"
+  },
+  "dependencies": {
+    "@better-auth/passkey": "1.7.6",
+    "@better-auth/sso": "1.7.6",
+    "@storyshelf/core": "0.5.3",
+    "better-auth": "1.7.6",
+    "drizzle-orm": "^0.44.0",
+    "zod": "^4.2.0"
+  },
+  "devDependencies": {
+    "@storyshelf/db-postgres": "0.5.3",
+    "@storyshelf/db-sqlite": "0.5.3",
+    "@types/node": "^26.0.0",
+    "@vitest/coverage-v8": "^4.0.0",
+    "oxfmt": "^0.65.0",
+    "oxlint": "^1.80.0",
+    "oxlint-tsgolint": "^7.0.2001",
+    "tsdown": "^0.22.14",
+    "typescript": "^7.0.2",
+    "vitest": "^5.0.0"
+  },
+  "jsr": {
+    "runtimeCompat": {
+      "node": true,
+      "deno": true,
+      "browser": false,
+      "workerd": false,
+      "bun": true
+    }
+  }
+}