@lunora/auth 1.0.0-alpha.1 → 1.0.0-alpha.100

package/dist/adapter.d.mts

@@ -1,43 +1,4 @@
-import { createAdapterFactory } from 'better-auth/adapters';
-import { d1Executor } from "./sql-store.mjs";
-import { AuthStore } from "./store.mjs";
-/**
-* A better-auth database adapter backed by an {@link AuthStore} — the bridge
-* that routes better-auth's reads and writes through Lunora's data layer
-* instead of better-auth's built-in D1/Kysely adapter. Pass the result as
-* `createAuth({ database: lunoraAuthAdapter(store) })`; better-auth's
-* `createAdapterFactory` handles id generation, default values, field-name
-* mapping and output shaping, so this only translates the cleaned CRUD calls
-* onto the store.
-*
-* ```ts
-* const auth = createAuth({
-*     secret: env.AUTH_SECRET,
-*     emailAndPassword: { enabled: true },
-*     database: lunoraAuthAdapter(lunoraStore), // lunoraStore writes via ctx.db
-* });
-* ```
-*
-* Scope: the {@link AuthStore} interface is single-table CRUD. better-auth's
-* relational `join` reads (an advanced opt-in) are not handled — pair the
-* adapter with `disableJoins` or let better-auth fall back to per-table reads.
-*/
-declare const lunoraAuthAdapter: (store: AuthStore) => ReturnType<typeof createAdapterFactory>;
-/**
-* One-liner for the common case: a better-auth `database` backed by a Cloudflare
-* D1 binding, via Lunora's SQL store — equivalent to
-* `lunoraAuthAdapter(createSqlAuthStore(d1Executor(d1)))`.
-*
-* Prefer this over passing the raw `env.DB` as `database`. With raw D1,
-* better-auth resolves its Kysely adapter through a runtime `await import(...)`
-* inside `auth.$context`, and that dynamic import never settles under
-* `@cloudflare/vite-plugin`'s worker runner — so it hangs *every* auth request
-* in `pnpm dev` (a standalone `wrangler dev` or a deployed worker bundle it
-* up-front, so they're unaffected — which makes the hang baffling to debug).
-* This explicit adapter skips that import entirely, so dev and prod behave the
-* same. The migration instance is the one exception — it wants raw `env.DB` so
-* `ensureMigrated`'s Kysely migrator can create the tables (its `$context` is
-* never resolved, so the hang doesn't apply there).
-*/
-declare const lunoraD1Adapter: (d1: Parameters<typeof d1Executor>[0]) => ReturnType<typeof lunoraAuthAdapter>;
-export { lunoraAuthAdapter, lunoraD1Adapter };
+import 'better-auth/adapters';
+export { l as lunoraAuthAdapter, a as lunoraD1Adapter, b as lunoraDoAdapter } from "./packem_shared/adapter.d-DrD3bb1u.mjs";
+import "./sql-store.mjs";
+import "./store.mjs";

package/dist/adapter.d.ts

@@ -1,43 +1,4 @@
-import { createAdapterFactory } from 'better-auth/adapters';
-import { d1Executor } from "./sql-store.js";
-import { AuthStore } from "./store.js";
-/**
-* A better-auth database adapter backed by an {@link AuthStore} — the bridge
-* that routes better-auth's reads and writes through Lunora's data layer
-* instead of better-auth's built-in D1/Kysely adapter. Pass the result as
-* `createAuth({ database: lunoraAuthAdapter(store) })`; better-auth's
-* `createAdapterFactory` handles id generation, default values, field-name
-* mapping and output shaping, so this only translates the cleaned CRUD calls
-* onto the store.
-*
-* ```ts
-* const auth = createAuth({
-*     secret: env.AUTH_SECRET,
-*     emailAndPassword: { enabled: true },
-*     database: lunoraAuthAdapter(lunoraStore), // lunoraStore writes via ctx.db
-* });
-* ```
-*
-* Scope: the {@link AuthStore} interface is single-table CRUD. better-auth's
-* relational `join` reads (an advanced opt-in) are not handled — pair the
-* adapter with `disableJoins` or let better-auth fall back to per-table reads.
-*/
-declare const lunoraAuthAdapter: (store: AuthStore) => ReturnType<typeof createAdapterFactory>;
-/**
-* One-liner for the common case: a better-auth `database` backed by a Cloudflare
-* D1 binding, via Lunora's SQL store — equivalent to
-* `lunoraAuthAdapter(createSqlAuthStore(d1Executor(d1)))`.
-*
-* Prefer this over passing the raw `env.DB` as `database`. With raw D1,
-* better-auth resolves its Kysely adapter through a runtime `await import(...)`
-* inside `auth.$context`, and that dynamic import never settles under
-* `@cloudflare/vite-plugin`'s worker runner — so it hangs *every* auth request
-* in `pnpm dev` (a standalone `wrangler dev` or a deployed worker bundle it
-* up-front, so they're unaffected — which makes the hang baffling to debug).
-* This explicit adapter skips that import entirely, so dev and prod behave the
-* same. The migration instance is the one exception — it wants raw `env.DB` so
-* `ensureMigrated`'s Kysely migrator can create the tables (its `$context` is
-* never resolved, so the hang doesn't apply there).
-*/
-declare const lunoraD1Adapter: (d1: Parameters<typeof d1Executor>[0]) => ReturnType<typeof lunoraAuthAdapter>;
-export { lunoraAuthAdapter, lunoraD1Adapter };
+import 'better-auth/adapters';
+export { l as lunoraAuthAdapter, a as lunoraD1Adapter, b as lunoraDoAdapter } from "./packem_shared/adapter.d-2a61HAY2.js";
+import "./sql-store.js";
+import "./store.js";

package/dist/adapter.mjs

@@ -1,47 +1 @@
-import { createAdapterFactory } from 'better-auth/adapters';
-import { createSqlAuthStore, d1Executor } from './sql-store.mjs';
-
-const asRow = (row) => row;
-const asRowOrNull = (row) => row ?? null;
-const asRows = (rows) => rows;
-const lunoraAuthAdapter = (store) => createAdapterFactory({
-  adapter: () => {
-    return {
-      consumeOne: async ({ model, where }) => asRowOrNull(await store.consumeOne(model, where)),
-      count: async ({ model, where }) => store.count(model, where ?? []),
-      create: async ({ data, model }) => asRow(await store.create(model, data)),
-      delete: async ({ model, where }) => {
-        await store.remove(model, where);
-      },
-      deleteMany: async ({ model, where }) => store.remove(model, where),
-      findMany: async ({ limit, model, offset, sortBy, where }) => asRows(await store.read(model, { limit, offset, sortBy, where: where ?? [] })),
-      findOne: async ({ model, where }) => {
-        const [row] = await store.read(model, { limit: 1, where });
-        return asRowOrNull(row);
-      },
-      update: async ({ model, update, where }) => {
-        const [row] = await store.update(model, where, update);
-        return asRowOrNull(row);
-      },
-      updateMany: async ({ model, update, where }) => {
-        const updated = await store.update(model, where, update);
-        return updated.length;
-      }
-    };
-  },
-  config: {
-    adapterId: "lunora",
-    adapterName: "Lunora Adapter",
-    // Conservative flags so the adapter is store-agnostic: better-auth
-    // serializes dates/booleans/json to primitives (string/number) before a
-    // write and parses them back after a read, so a store — in-memory or
-    // SQL — only ever handles primitives, never schema-aware codecs.
-    supportsBooleans: false,
-    supportsDates: false,
-    supportsJSON: false,
-    supportsNumericIds: false
-  }
-});
-const lunoraD1Adapter = (d1) => lunoraAuthAdapter(createSqlAuthStore(d1Executor(d1)));
-
-export { lunoraAuthAdapter, lunoraD1Adapter };
+import{l as t,a as p,b as e}from"./packem_shared/adapter-DA8DdALX.mjs";import"./sql-store.mjs";export{t as lunoraAuthAdapter,p as lunoraD1Adapter,e as lunoraDoAdapter};

package/dist/audit.d.mts

@@ -0,0 +1,131 @@
+import { SqlExecutor } from "./sql-store.mjs";
+import "./store.mjs";
+import 'better-auth/adapters';
+/** Reserved append-only table backing the Studio "Security / audit" page. Auto-hidden from the data browser by the `__lunora` prefix. */
+declare const AUTH_AUDIT_TABLE = "__lunora_auth_audit__";
+/**
+ * Well-known auth/security event types. A plain `string` is also accepted so
+ * plugins can record their own events without a union change — the union just
+ * gives autocomplete for the common ones.
+ */
+type AuthAuditEvent = "account-link" | "account-unlink" | "email-verification" | "mfa-disable" | "mfa-enable" | "password-change" | "password-reset" | "session-revoke" | "sign-in" | "sign-in-initiated" | "sign-out" | "sign-up" | "token-refresh" | (string & {});
+/** Whether the recorded operation succeeded or failed (e.g. a rejected sign-in). */
+type AuthAuditOutcome = "failure" | "success";
+/** One recorded auth/security event, in monotonic `seq` order. */
+interface AuthAuditEntry {
+  /** Redaction is applied to `detail`, not this — the actor's email is intentional forensic data. Absent for anonymous/pre-auth events. */
+  actorEmail?: string;
+  /** The acting user's id, when known. */
+  actorId?: string;
+  /** JSON-decoded extra context, with secrets/PII redacted at write time; absent when none was recorded. */
+  detail?: Record<string, unknown>;
+  /** Auth event type, e.g. `sign-in` / `password-change`. */
+  event: string;
+  /** Client IP the event originated from, when resolvable. */
+  ip?: string;
+  /** Whether the operation succeeded or failed. */
+  outcome: AuthAuditOutcome;
+  /** Monotonic per-database cursor — strictly increasing, never reused. */
+  seq: number;
+  /**
+   * The identifier (email or username) a sign-in-family request ATTEMPTED,
+   * read from the request body. Present for both successful and failed
+   * attempts — unlike `actorEmail` (which requires an authenticated
+   * session), this is what lets a FAILED credential-stuffing attempt be
+   * grouped by target. Same redaction exemption as `actorEmail`: a
+   * top-level column, not a `detail` key, because `AUDIT_REDACT_RULES`
+   * scrubs email-shaped values inside `detail` regardless of key name —
+   * putting it there would erase exactly this datum. Length-capped to 320
+   * chars (RFC 5321) since it carries attacker-controlled request-body text.
+   */
+  targetEmail?: string;
+  /** Wall-clock millis when the event was recorded. */
+  ts: number;
+  /** Client User-Agent, when present on the request. */
+  userAgent?: string;
+}
+/** Fields accepted when appending one event; `seq` is assigned by the table. */
+interface AppendAuthAuditEntry {
+  actorEmail?: string;
+  actorId?: string;
+  detail?: Record<string, unknown>;
+  event: string;
+  ip?: string;
+  outcome: AuthAuditOutcome;
+  /** See {@link AuthAuditEntry.targetEmail}. */
+  targetEmail?: string;
+  ts: number;
+  userAgent?: string;
+}
+/** Options for {@link appendAuthAuditEntry}. */
+interface AppendAuthAuditOptions {
+  /**
+   * Redact secrets/PII in the `detail` payload before persisting. Defaults to
+   * `true`. Set `false` only for a trusted, pre-scrubbed payload.
+   */
+  redactDetail?: boolean;
+  /**
+   * Keep only the most recent `retention` rows (trimmed after each append),
+   * mirroring the admin audit log's bounded retention. Omit for an unbounded
+   * trail (the compliance default) — deliberately NOT capped at 1000.
+   */
+  retention?: number;
+}
+/** Options for {@link readAuthAuditLog}. */
+interface ReadAuthAuditOptions {
+  /** Return only events for this actor id. */
+  actorId?: string;
+  /** Return only events of this type. */
+  event?: string;
+  /** Max rows to return, clamped to [1, 10000]. Defaults to 1000. */
+  limit?: number;
+  /** Return only events with `seq` strictly greater than this (forward paging). */
+  sinceSeq?: number;
+}
+declare const ensureAuthAuditTable: (executor: SqlExecutor) => Promise<void>;
+/**
+ * Append one auth event, redacting its `detail` payload (unless disabled) and —
+ * when `retention` is set — trimming the log back to the most recent rows.
+ * Creates the table first so callers needn't. Returns the redacted, persisted
+ * entry (sans `seq`) so an export tap can forward exactly what was stored.
+ */
+declare const appendAuthAuditEntry: (executor: SqlExecutor, entry: AppendAuthAuditEntry, options?: AppendAuthAuditOptions) => Promise<AppendAuthAuditEntry>;
+/**
+ * Read audit events newest-first, optionally filtered by `actorId` / `event` and
+ * paged past `sinceSeq`, up to `limit` (clamped to [1, 10000]). Parses each row's
+ * `detail` JSON back into an object. Creates the table first so reads on a
+ * never-audited database return `[]` instead of throwing.
+ *
+ * `limit` is NaN-safe: a non-finite/non-number value (e.g. a caller passing
+ * `Number.NaN`, or an upstream boundary that failed to reject one) falls back
+ * to {@link DEFAULT_READ_LIMIT} rather than reaching `Math.min`/`Math.max`,
+ * which both propagate `NaN` and would otherwise bind it as the SQL `LIMIT`
+ * parameter. This is the library-level fix; `#readAudit` (`./auth-do`) also
+ * rejects a non-numeric `limit` at the boundary with a 400 — this clamp is the
+ * safety net for every OTHER caller of this function too.
+ */
+declare const readAuthAuditLog: (executor: SqlExecutor, options?: ReadAuthAuditOptions) => Promise<AuthAuditEntry[]>;
+/**
+ * The auth/security audit read plane the runtime's `authAuditReader` option
+ * accepts — a structurally-compatible `{ read }` object the worker calls behind
+ * its admin gate to back the studio's "Security / audit" page
+ * (`__lunora_admin__:getAuthAuditLog`).
+ */
+interface AuthAuditReader {
+  read: (options: ReadAuthAuditOptions) => Promise<AuthAuditEntry[]>;
+}
+/**
+ * Build the reader the runtime's `authAuditReader` option accepts, closing over
+ * the auth D1 `executor` (`d1Executor(env.DB)`) so an admin caller reads the same
+ * `__lunora_auth_audit__` table the hook writes. Filters/paging pass straight
+ * through to {@link readAuthAuditLog} (which clamps `limit`).
+ *
+ * ```ts
+ * export default createWorker({
+ *     authAuditReader: createAuthAuditReader(d1Executor(env.DB)),
+ *     // …
+ * });
+ * ```
+ */
+declare const createAuthAuditReader: (executor: SqlExecutor) => AuthAuditReader;
+export { AUTH_AUDIT_TABLE, type AppendAuthAuditEntry, type AppendAuthAuditOptions, type AuthAuditEntry, type AuthAuditEvent, type AuthAuditOutcome, type AuthAuditReader, type ReadAuthAuditOptions, appendAuthAuditEntry, createAuthAuditReader, ensureAuthAuditTable, readAuthAuditLog };

package/dist/audit.d.ts

@@ -0,0 +1,131 @@
+import { SqlExecutor } from "./sql-store.js";
+import "./store.js";
+import 'better-auth/adapters';
+/** Reserved append-only table backing the Studio "Security / audit" page. Auto-hidden from the data browser by the `__lunora` prefix. */
+declare const AUTH_AUDIT_TABLE = "__lunora_auth_audit__";
+/**
+ * Well-known auth/security event types. A plain `string` is also accepted so
+ * plugins can record their own events without a union change — the union just
+ * gives autocomplete for the common ones.
+ */
+type AuthAuditEvent = "account-link" | "account-unlink" | "email-verification" | "mfa-disable" | "mfa-enable" | "password-change" | "password-reset" | "session-revoke" | "sign-in" | "sign-in-initiated" | "sign-out" | "sign-up" | "token-refresh" | (string & {});
+/** Whether the recorded operation succeeded or failed (e.g. a rejected sign-in). */
+type AuthAuditOutcome = "failure" | "success";
+/** One recorded auth/security event, in monotonic `seq` order. */
+interface AuthAuditEntry {
+  /** Redaction is applied to `detail`, not this — the actor's email is intentional forensic data. Absent for anonymous/pre-auth events. */
+  actorEmail?: string;
+  /** The acting user's id, when known. */
+  actorId?: string;
+  /** JSON-decoded extra context, with secrets/PII redacted at write time; absent when none was recorded. */
+  detail?: Record<string, unknown>;
+  /** Auth event type, e.g. `sign-in` / `password-change`. */
+  event: string;
+  /** Client IP the event originated from, when resolvable. */
+  ip?: string;
+  /** Whether the operation succeeded or failed. */
+  outcome: AuthAuditOutcome;
+  /** Monotonic per-database cursor — strictly increasing, never reused. */
+  seq: number;
+  /**
+   * The identifier (email or username) a sign-in-family request ATTEMPTED,
+   * read from the request body. Present for both successful and failed
+   * attempts — unlike `actorEmail` (which requires an authenticated
+   * session), this is what lets a FAILED credential-stuffing attempt be
+   * grouped by target. Same redaction exemption as `actorEmail`: a
+   * top-level column, not a `detail` key, because `AUDIT_REDACT_RULES`
+   * scrubs email-shaped values inside `detail` regardless of key name —
+   * putting it there would erase exactly this datum. Length-capped to 320
+   * chars (RFC 5321) since it carries attacker-controlled request-body text.
+   */
+  targetEmail?: string;
+  /** Wall-clock millis when the event was recorded. */
+  ts: number;
+  /** Client User-Agent, when present on the request. */
+  userAgent?: string;
+}
+/** Fields accepted when appending one event; `seq` is assigned by the table. */
+interface AppendAuthAuditEntry {
+  actorEmail?: string;
+  actorId?: string;
+  detail?: Record<string, unknown>;
+  event: string;
+  ip?: string;
+  outcome: AuthAuditOutcome;
+  /** See {@link AuthAuditEntry.targetEmail}. */
+  targetEmail?: string;
+  ts: number;
+  userAgent?: string;
+}
+/** Options for {@link appendAuthAuditEntry}. */
+interface AppendAuthAuditOptions {
+  /**
+   * Redact secrets/PII in the `detail` payload before persisting. Defaults to
+   * `true`. Set `false` only for a trusted, pre-scrubbed payload.
+   */
+  redactDetail?: boolean;
+  /**
+   * Keep only the most recent `retention` rows (trimmed after each append),
+   * mirroring the admin audit log's bounded retention. Omit for an unbounded
+   * trail (the compliance default) — deliberately NOT capped at 1000.
+   */
+  retention?: number;
+}
+/** Options for {@link readAuthAuditLog}. */
+interface ReadAuthAuditOptions {
+  /** Return only events for this actor id. */
+  actorId?: string;
+  /** Return only events of this type. */
+  event?: string;
+  /** Max rows to return, clamped to [1, 10000]. Defaults to 1000. */
+  limit?: number;
+  /** Return only events with `seq` strictly greater than this (forward paging). */
+  sinceSeq?: number;
+}
+declare const ensureAuthAuditTable: (executor: SqlExecutor) => Promise<void>;
+/**
+ * Append one auth event, redacting its `detail` payload (unless disabled) and —
+ * when `retention` is set — trimming the log back to the most recent rows.
+ * Creates the table first so callers needn't. Returns the redacted, persisted
+ * entry (sans `seq`) so an export tap can forward exactly what was stored.
+ */
+declare const appendAuthAuditEntry: (executor: SqlExecutor, entry: AppendAuthAuditEntry, options?: AppendAuthAuditOptions) => Promise<AppendAuthAuditEntry>;
+/**
+ * Read audit events newest-first, optionally filtered by `actorId` / `event` and
+ * paged past `sinceSeq`, up to `limit` (clamped to [1, 10000]). Parses each row's
+ * `detail` JSON back into an object. Creates the table first so reads on a
+ * never-audited database return `[]` instead of throwing.
+ *
+ * `limit` is NaN-safe: a non-finite/non-number value (e.g. a caller passing
+ * `Number.NaN`, or an upstream boundary that failed to reject one) falls back
+ * to {@link DEFAULT_READ_LIMIT} rather than reaching `Math.min`/`Math.max`,
+ * which both propagate `NaN` and would otherwise bind it as the SQL `LIMIT`
+ * parameter. This is the library-level fix; `#readAudit` (`./auth-do`) also
+ * rejects a non-numeric `limit` at the boundary with a 400 — this clamp is the
+ * safety net for every OTHER caller of this function too.
+ */
+declare const readAuthAuditLog: (executor: SqlExecutor, options?: ReadAuthAuditOptions) => Promise<AuthAuditEntry[]>;
+/**
+ * The auth/security audit read plane the runtime's `authAuditReader` option
+ * accepts — a structurally-compatible `{ read }` object the worker calls behind
+ * its admin gate to back the studio's "Security / audit" page
+ * (`__lunora_admin__:getAuthAuditLog`).
+ */
+interface AuthAuditReader {
+  read: (options: ReadAuthAuditOptions) => Promise<AuthAuditEntry[]>;
+}
+/**
+ * Build the reader the runtime's `authAuditReader` option accepts, closing over
+ * the auth D1 `executor` (`d1Executor(env.DB)`) so an admin caller reads the same
+ * `__lunora_auth_audit__` table the hook writes. Filters/paging pass straight
+ * through to {@link readAuthAuditLog} (which clamps `limit`).
+ *
+ * ```ts
+ * export default createWorker({
+ *     authAuditReader: createAuthAuditReader(d1Executor(env.DB)),
+ *     // …
+ * });
+ * ```
+ */
+declare const createAuthAuditReader: (executor: SqlExecutor) => AuthAuditReader;
+export { AUTH_AUDIT_TABLE, type AppendAuthAuditEntry, type AppendAuthAuditOptions, type AuthAuditEntry, type AuthAuditEvent, type AuthAuditOutcome, type AuthAuditReader, type ReadAuthAuditOptions, appendAuthAuditEntry, createAuthAuditReader, ensureAuthAuditTable, readAuthAuditLog };

package/dist/audit.mjs

@@ -0,0 +1,12 @@
+import{standardRules as L,piiRules as f,redact as g}from"@visulima/redact";const o="__lunora_auth_audit__",R=[...L,...f],p=1e3,N=1e4,n=null,l=e=>{if(typeof e=="string")return e;if(typeof e=="number"||typeof e=="bigint"||typeof e=="boolean")return String(e)},h=async e=>{await e.run(`CREATE TABLE IF NOT EXISTS "${o}" (
+            seq INTEGER PRIMARY KEY AUTOINCREMENT,
+            ts REAL NOT NULL,
+            event TEXT NOT NULL,
+            outcome TEXT NOT NULL,
+            actor_id TEXT,
+            actor_email TEXT,
+            target_email TEXT,
+            ip TEXT,
+            user_agent TEXT,
+            detail TEXT
+        )`,[]);try{await e.run(`ALTER TABLE "${o}" ADD COLUMN target_email TEXT`,[])}catch(t){if(!(t instanceof Error?t.message.toLowerCase():String(t).toLowerCase()).includes("duplicate column"))throw t}},E=new WeakMap,m=e=>{const t=E.get(e);if(t)return t;const a=h(e);return E.set(e,a),a.catch(()=>E.delete(e)),a},D=async(e,t,a={})=>{await m(e);let i;return t.detail!==void 0&&(i=a.redactDetail===!1?t.detail:g(t.detail,R)),await e.run(`INSERT INTO "${o}" (ts, event, outcome, actor_id, actor_email, target_email, ip, user_agent, detail) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,[t.ts,t.event,t.outcome,t.actorId??n,t.actorEmail??n,t.targetEmail??n,t.ip??n,t.userAgent??n,i===void 0?n:JSON.stringify(i)]),typeof a.retention=="number"&&a.retention>0&&await e.run(`DELETE FROM "${o}" WHERE seq <= (SELECT MAX(seq) - ? FROM "${o}")`,[a.retention]),{...t,detail:i}},I=async(e,t={})=>{await m(e);const a=Number.isFinite(t.limit)?Math.max(1,Math.min(t.limit,N)):p,i=["seq > ?"],c=[t.sinceSeq??0];return t.actorId!==void 0&&(i.push("actor_id = ?"),c.push(t.actorId)),t.event!==void 0&&(i.push("event = ?"),c.push(t.event)),c.push(a),(await e.all(`SELECT seq, ts, event, outcome, actor_id, actor_email, target_email, ip, user_agent, detail FROM "${o}" WHERE ${i.join(" AND ")} ORDER BY seq DESC LIMIT ?`,c)).map(r=>{const u={event:l(r.event)??"",outcome:r.outcome==="failure"?"failure":"success",seq:Number(r.seq),ts:Number(r.ts)},A=[["actorId","actor_id"],["actorEmail","actor_email"],["targetEmail","target_email"],["ip","ip"],["userAgent","user_agent"]];for(const[s,_]of A){const T=l(r[_]);T!==void 0&&(u[s]=T)}const d=l(r.detail);if(d!==void 0)try{const s=JSON.parse(d);typeof s=="object"&&s!==null&&!Array.isArray(s)&&(u.detail=s)}catch{}return u})},O=e=>({read:t=>I(e,t)});export{o as AUTH_AUDIT_TABLE,D as appendAuthAuditEntry,O as createAuthAuditReader,m as ensureAuthAuditTable,I as readAuthAuditLog};

package/dist/email-guard.d.mts

@@ -0,0 +1,125 @@
+import { Middleware } from '@lunora/server';
+/**
+ * The resolved trust class of an email address' domain: `disposable` (a
+ * throwaway/temporary provider, or a caller `denyDomains` hit), `free` (a free
+ * consumer provider like Gmail — deliverable but not B2B), or `business`
+ * (anything else — a custom/company domain, or an `allowDomains` hit).
+ */
+type EmailClass = "business" | "disposable" | "free";
+/** Result of {@link classifyEmail} — the resolved class plus the normalized domain. */
+interface EmailClassification {
+  /** The normalized (lowercased, trimmed) domain, or `undefined` for a structurally invalid address. */
+  domain: string | undefined;
+  /** The resolved trust class. A structurally invalid address resolves to `business` with `domain: undefined`. */
+  emailClass: EmailClass;
+}
+/** Configuration for {@link classifyEmail} / {@link assertEmailAllowed} / {@link emailGateMiddleware}. */
+interface EmailGateConfig {
+  /**
+   * Domains that are always allowed and always classified `business`, even if
+   * they appear on the disposable or free lists. Wildcard/subdomain aware
+   * (`example.com` also allows `mail.example.com`). Your own hosted domains go
+   * here.
+   */
+  allowDomains?: ReadonlyArray<string>;
+  /**
+   * Reject disposable/throwaway signups. Defaults to `true` — the whole point
+   * of the gate. Set `false` to classify-only (surface `emailClass` without
+   * blocking).
+   */
+  blockDisposable?: boolean;
+  /**
+   * Extra domains to treat as disposable (blocked when `blockDisposable`), on
+   * top of the built-in list. Wildcard/subdomain aware.
+   */
+  denyDomains?: ReadonlyArray<string>;
+  /**
+   * Reserved for callers that branch on free-vs-business (e.g. gate a feature
+   * behind a business email). Purely advisory — {@link EmailClassification}'s
+   * `emailClass` already reports `free`, so this flag exists for symmetry/intent
+   * and never blocks. Defaults to `false`.
+   */
+  flagFreeEmail?: boolean;
+  /**
+   * Opt-in MX deliverability verification. Off by default because it needs DNS
+   * (`@visulima/email-verifier/checks/mx` → `node:dns`), which is not available
+   * on the default workerd path. When `true`, {@link assertEmailAllowed} rejects
+   * an address whose domain publishes no MX (or fallback A/AAAA) records with
+   * `EMAIL_UNDELIVERABLE`. The check is loaded via a dynamic import, so leaving
+   * this off keeps the DNS module out of the bundle entirely.
+   */
+  mx?: boolean;
+  /**
+   * Reject structurally invalid addresses up front (via
+   * `@visulima/email-verifier/checks/syntax`, pure-data/edge-safe). Defaults to
+   * `true`. When `false`, an unparseable address classifies as `business` with
+   * `domain: undefined` and is not rejected on syntax alone.
+   */
+  requireValidSyntax?: boolean;
+}
+/** Options for {@link emailGateMiddleware}: the base gate config plus how to read the email from `ctx`. */
+interface EmailGateMiddlewareOptions<Context> extends EmailGateConfig {
+  /**
+   * Selector that pulls the signup email from `ctx`. The procedure context
+   * carries only the resolved identity, not the raw request body, so route the
+   * email through the function `args` and read it out here (mirrors
+   * `verifyTurnstileMiddleware`'s `token` selector).
+   */
+  email: (context: Context) => string | undefined;
+  /**
+   * Called with the resolved classification once the gate passes, so app policy
+   * can branch on `free` vs `business` (e.g. gate a plan behind a business
+   * email). Never fires when the gate rejects.
+   */
+  onClassify?: (classification: EmailClassification, context: Context) => void;
+}
+/**
+ * Inject the built-in disposable + free domain lists into the lookup packages,
+ * once. Call this at worker init on workerd (where the packages' `node:fs`
+ * loader is unavailable) so {@link classifyEmail} has data to match against;
+ * {@link assertEmailAllowed} / {@link emailGateMiddleware} await it for you, so
+ * the gating path is always edge-safe. Idempotent — repeat calls share one load.
+ */
+declare const loadEmailDomainLists: () => Promise<void>;
+/**
+ * Classify an email address' domain as `disposable` / `free` / `business`,
+ * pure-data and edge-safe (no DNS, no filesystem). A structurally invalid
+ * address resolves to `{ domain: undefined, emailClass: "business" }` — use
+ * {@link assertEmailAllowed} (which can reject on syntax) for the gating path.
+ * `allowDomains` wins over both lists; `denyDomains` adds to the disposable list.
+ *
+ * The lookup relies on the built-in domain lists being loaded. On Node they
+ * auto-load from disk; on workerd, `await loadEmailDomainLists()` first (or use
+ * {@link assertEmailAllowed} / {@link emailGateMiddleware}, which await it).
+ *
+ * The returned/compared domain is IDNA-normalized (see {@link toAsciiDomain}) so
+ * a Unicode-form internationalized domain matches its `xn--` blocklist entry.
+ */
+declare const classifyEmail: (email: string, config?: EmailGateConfig) => EmailClassification;
+/**
+ * Classify `email` and enforce the gate, throwing a coded {@link LunoraError}
+ * when it fails: `VALIDATION_ERROR` (structurally invalid, only when
+ * `requireValidSyntax`, the default), `EMAIL_DOMAIN_BLOCKED` (disposable or
+ * deny-listed, only when `blockDisposable`, the default), or `EMAIL_UNDELIVERABLE`
+ * (no MX records, only when `mx: true`).
+ *
+ * Returns the {@link EmailClassification} on success so callers can branch on
+ * `free` vs `business`. Async only because of the opt-in MX step; with `mx` off
+ * it resolves without any network I/O.
+ */
+declare const assertEmailAllowed: (email: string, config?: EmailGateConfig) => Promise<EmailClassification>;
+/**
+ * Lunora procedure middleware that gates a non-auth, signup-shaped
+ * `mutation`/`action` on the email-domain policy. Attach it with `.use()`; it
+ * reads the email from `ctx` via the `email` selector (route it through `args`)
+ * and runs {@link assertEmailAllowed}, which throws a coded {@link LunoraError}
+ * (`EMAIL_DOMAIN_BLOCKED` / `EMAIL_UNDELIVERABLE` / `VALIDATION_ERROR`) the
+ * runtime maps to the matching status.
+ *
+ * To gate better-auth's native `/sign-up/email` endpoint instead, use
+ * `emailGateDatabaseHooks` / `withEmailGate` from `@lunora/auth` — those hook
+ * better-auth's own user-create path. The `Middleware` import is type-only, so
+ * this stays free of any runtime `@lunora/server` dependency.
+ */
+declare const emailGateMiddleware: <Context>(options: EmailGateMiddlewareOptions<Context>) => Middleware<Context, Context>;
+export { type EmailClass, type EmailClassification, type EmailGateConfig, type EmailGateMiddlewareOptions, assertEmailAllowed, classifyEmail, emailGateMiddleware, loadEmailDomainLists };