@lunora/auth 1.0.0-alpha.112 → 1.0.0-alpha.113

package/README.md

@@ -141,7 +141,7 @@ const auth = createAuth({
 const recent = await readAuthAuditLog(executor, { event: "sign-in", limit: 100 });
 ```
 
-The free-form `detail` payload is scrubbed with `@visulima/redact` before it is persisted, so a token/password that leaks into an event's context never reaches the durable table. Retention defaults to unbounded (set `retention` to bound it). The store lives in the reserved `__lunora_auth_audit__` table (auto-hidden from the data browser).
+The built-in hook records only the request path in `detail`; it is free-form for entries you append yourself. Either way the payload is scrubbed with `@visulima/redact` before it is persisted, so a token/password that leaks into one never reaches the durable table. Retention defaults to unbounded (set `retention` to bound it). The store lives in the reserved `__lunora_auth_audit__` table (auto-hidden from the data browser).
 
 > This README covers the basics. For the full API, options, and guides, see the **[documentation](https://lunora.sh/docs/packages/auth)**.
 

package/dist/index.d.mts

@@ -805,11 +805,14 @@ interface DoAuthWiring {
    *
    * `expiresAtMs` (epoch ms) is the session's expiry, which the runtime forwards as
    * the socket's credential expiry so the DO can drop a subscriber whose session has
-   * lapsed; `role` is better-auth's `admin()` column, which RLS role grants read.
-   * Both are absent when the session carries neither.
+   * lapsed; `role` is better-auth's `admin()` column, which RLS role grants read;
+   * `email` and `name` are the profile claims `ctx.auth.getIdentity()` is documented
+   * to carry. Each is absent when the session does not carry it.
    */
   resolveIdentity: (request: Request) => Promise<null | {
+    email?: string;
     expiresAtMs?: number;
+    name?: string;
     role?: string;
     userId: string;
   }>;
@@ -921,7 +924,10 @@ declare const compileMigrationsSql: (options: LunoraAuthOptions) => Promise<stri
  * expire at the absolute `expiresIn` regardless of activity), `freshAge`
  * (freshness window, in seconds, for sensitive operations like account
  * deletion; `0` treats every session as fresh — not recommended), and
- * `cookieCache` (opt-in signed-cookie session cache to skip DB reads).
+ * `cookieCache` (signed-cookie session cache that skips DB reads —
+ * `createAuth` fills `{ enabled: true, maxAge: 60 }` when you leave it unset, so
+ * a revoked session keeps authenticating for up to that many seconds; pass
+ * `{ enabled: false }` where that window is unacceptable).
  *
  * See better-auth's `session` option for the full field list.
  */

package/dist/index.d.ts

@@ -805,11 +805,14 @@ interface DoAuthWiring {
    *
    * `expiresAtMs` (epoch ms) is the session's expiry, which the runtime forwards as
    * the socket's credential expiry so the DO can drop a subscriber whose session has
-   * lapsed; `role` is better-auth's `admin()` column, which RLS role grants read.
-   * Both are absent when the session carries neither.
+   * lapsed; `role` is better-auth's `admin()` column, which RLS role grants read;
+   * `email` and `name` are the profile claims `ctx.auth.getIdentity()` is documented
+   * to carry. Each is absent when the session does not carry it.
    */
   resolveIdentity: (request: Request) => Promise<null | {
+    email?: string;
     expiresAtMs?: number;
+    name?: string;
     role?: string;
     userId: string;
   }>;
@@ -921,7 +924,10 @@ declare const compileMigrationsSql: (options: LunoraAuthOptions) => Promise<stri
  * expire at the absolute `expiresIn` regardless of activity), `freshAge`
  * (freshness window, in seconds, for sensitive operations like account
  * deletion; `0` treats every session as fresh — not recommended), and
- * `cookieCache` (opt-in signed-cookie session cache to skip DB reads).
+ * `cookieCache` (signed-cookie session cache that skips DB reads —
+ * `createAuth` fills `{ enabled: true, maxAge: 60 }` when you leave it unset, so
+ * a revoked session keeps authenticating for up to that many seconds; pass
+ * `{ enabled: false }` where that window is unacceptable).
  *
  * See better-auth's `session` option for the full field list.
  */

package/dist/index.mjs

@@ -1 +1 @@
-import{l as r,a as o,b as a}from"./packem_shared/adapter-DA8DdALX.mjs";import{LunoraAuthAdminError as u,createAuthAdmin as i}from"./packem_shared/LunoraAuthAdminError-DtAKa22S.mjs";import{AUTH_AUDIT_TABLE as m,appendAuthAuditEntry as l,createAuthAuditReader as d,ensureAuthAuditTable as h,readAuthAuditLog as E}from"./audit.mjs";import{authAuditHook as p,buildAuditEntry as T,eventForPath as f,withAuthAudit as _}from"./packem_shared/authAuditHook-tG8gdR77.mjs";import{READ_AUDIT_PATH as D,INTERNAL_SECRET_HEADER as S,RESOLVE_SESSION_PATH as H,LunoraAuthDO as c}from"./packem_shared/AUTH_DO_AUDIT_PATH-BdKhdNhp.mjs";import{createAuth as L,resolveAuthOptions as P}from"./packem_shared/createAuth-CtTKaLZN.mjs";import{authDoColumnAdditions as I,authDoSchemaStatements as O}from"./packem_shared/authDoColumnAdditions-BCSs7qaN.mjs";import{createDoAuthWiring as N}from"./packem_shared/createDoAuthWiring-BGL6oAV_.mjs";import{emailGateDatabaseHooks as b,withEmailGate as g}from"./packem_shared/emailGateDatabaseHooks-CAygR3iq.mjs";import{assertEmailAllowed as M,classifyEmail as q,emailGateMiddleware as C,loadEmailDomainLists as F}from"./email-guard.mjs";import{DEFAULT_AUTH_BASE_PATH as k,handleAuthRequest as B}from"./packem_shared/DEFAULT_AUTH_BASE_PATH-DneiLGpv.mjs";import{LunoraAuthHeadersError as W,withAuthPlugins as Y}from"./middleware.mjs";import{compileMigrationsSql as z,ensureMigrated as J}from"./packem_shared/compileMigrationsSql-TvwFrqmu.mjs";import{default as Q}from"./schema.mjs";import{sessionPresets as Z,validateSessionPolicy as $}from"./packem_shared/sessionPresets-C867Mlo4.mjs";import{createSqlAuthStore as te,d1Executor as re}from"./sql-store.mjs";import{createMemoryAuthStore as ae,matchesWhere as Ae}from"./store.mjs";import{TURNSTILE_VERIFY_ENDPOINT as ie,verifyTurnstile as se}from"./turnstile.mjs";import{verifyTurnstileMiddleware as le}from"./turnstile-middleware.mjs";export{m as AUTH_AUDIT_TABLE,D as AUTH_DO_AUDIT_PATH,S as AUTH_DO_SECRET_HEADER,H as AUTH_DO_SESSION_PATH,k as DEFAULT_AUTH_BASE_PATH,u as LunoraAuthAdminError,c as LunoraAuthDO,W as LunoraAuthHeadersError,ie as TURNSTILE_VERIFY_ENDPOINT,l as appendAuthAuditEntry,M as assertEmailAllowed,p as authAuditHook,I as authDoColumnAdditions,O as authDoSchemaStatements,Q as authTables,T as buildAuditEntry,q as classifyEmail,z as compileMigrationsSql,L as createAuth,i as createAuthAdmin,d as createAuthAuditReader,N as createDoAuthWiring,ae as createMemoryAuthStore,te as createSqlAuthStore,re as d1Executor,b as emailGateDatabaseHooks,C as emailGateMiddleware,h as ensureAuthAuditTable,J as ensureMigrated,f as eventForPath,B as handleAuthRequest,F as loadEmailDomainLists,r as lunoraAuthAdapter,o as lunoraD1Adapter,a as lunoraDoAdapter,Ae as matchesWhere,E as readAuthAuditLog,P as resolveAuthOptions,Z as sessionPresets,$ as validateSessionPolicy,se as verifyTurnstile,le as verifyTurnstileMiddleware,_ as withAuthAudit,Y as withAuthPlugins,g as withEmailGate};
+import{l as r,a as o,b as a}from"./packem_shared/adapter-DA8DdALX.mjs";import{LunoraAuthAdminError as u,createAuthAdmin as i}from"./packem_shared/LunoraAuthAdminError-DtAKa22S.mjs";import{AUTH_AUDIT_TABLE as m,appendAuthAuditEntry as l,createAuthAuditReader as d,ensureAuthAuditTable as h,readAuthAuditLog as E}from"./audit.mjs";import{authAuditHook as p,buildAuditEntry as T,eventForPath as f,withAuthAudit as _}from"./packem_shared/authAuditHook-tG8gdR77.mjs";import{READ_AUDIT_PATH as D,INTERNAL_SECRET_HEADER as S,RESOLVE_SESSION_PATH as H,LunoraAuthDO as c}from"./packem_shared/AUTH_DO_AUDIT_PATH-DiXHh-vn.mjs";import{createAuth as L,resolveAuthOptions as P}from"./packem_shared/createAuth-CtTKaLZN.mjs";import{authDoColumnAdditions as I,authDoSchemaStatements as O}from"./packem_shared/authDoColumnAdditions-BCSs7qaN.mjs";import{createDoAuthWiring as N}from"./packem_shared/createDoAuthWiring-Ber4dHOy.mjs";import{emailGateDatabaseHooks as b,withEmailGate as g}from"./packem_shared/emailGateDatabaseHooks-CAygR3iq.mjs";import{assertEmailAllowed as M,classifyEmail as q,emailGateMiddleware as C,loadEmailDomainLists as F}from"./email-guard.mjs";import{DEFAULT_AUTH_BASE_PATH as k,handleAuthRequest as B}from"./packem_shared/DEFAULT_AUTH_BASE_PATH-DneiLGpv.mjs";import{LunoraAuthHeadersError as W,withAuthPlugins as Y}from"./middleware.mjs";import{compileMigrationsSql as z,ensureMigrated as J}from"./packem_shared/compileMigrationsSql-TvwFrqmu.mjs";import{default as Q}from"./schema.mjs";import{sessionPresets as Z,validateSessionPolicy as $}from"./packem_shared/sessionPresets-C867Mlo4.mjs";import{createSqlAuthStore as te,d1Executor as re}from"./sql-store.mjs";import{createMemoryAuthStore as ae,matchesWhere as Ae}from"./store.mjs";import{TURNSTILE_VERIFY_ENDPOINT as ie,verifyTurnstile as se}from"./turnstile.mjs";import{verifyTurnstileMiddleware as le}from"./turnstile-middleware.mjs";export{m as AUTH_AUDIT_TABLE,D as AUTH_DO_AUDIT_PATH,S as AUTH_DO_SECRET_HEADER,H as AUTH_DO_SESSION_PATH,k as DEFAULT_AUTH_BASE_PATH,u as LunoraAuthAdminError,c as LunoraAuthDO,W as LunoraAuthHeadersError,ie as TURNSTILE_VERIFY_ENDPOINT,l as appendAuthAuditEntry,M as assertEmailAllowed,p as authAuditHook,I as authDoColumnAdditions,O as authDoSchemaStatements,Q as authTables,T as buildAuditEntry,q as classifyEmail,z as compileMigrationsSql,L as createAuth,i as createAuthAdmin,d as createAuthAuditReader,N as createDoAuthWiring,ae as createMemoryAuthStore,te as createSqlAuthStore,re as d1Executor,b as emailGateDatabaseHooks,C as emailGateMiddleware,h as ensureAuthAuditTable,J as ensureMigrated,f as eventForPath,B as handleAuthRequest,F as loadEmailDomainLists,r as lunoraAuthAdapter,o as lunoraD1Adapter,a as lunoraDoAdapter,Ae as matchesWhere,E as readAuthAuditLog,P as resolveAuthOptions,Z as sessionPresets,$ as validateSessionPolicy,se as verifyTurnstile,le as verifyTurnstileMiddleware,_ as withAuthAudit,Y as withAuthPlugins,g as withEmailGate};

package/dist/packem_shared/AUTH_DO_AUDIT_PATH-DiXHh-vn.mjs

@@ -0,0 +1 @@
+import{b as u,d as h}from"./adapter-DA8DdALX.mjs";import{ensureAuthAuditTable as c,createAuthAuditReader as l}from"../audit.mjs";import{resolveAuthOptions as m,createAuth as d}from"./createAuth-CtTKaLZN.mjs";import{authDoSchemaStatements as p,authDoColumnAdditions as f}from"./authDoColumnAdditions-BCSs7qaN.mjs";import{handleAuthRequest as A}from"./DEFAULT_AUTH_BASE_PATH-DneiLGpv.mjs";const g=(n,e)=>{const s=Math.max(n.length,e.length);let t=n.length^e.length;for(let r=0;r<s;r+=1){const i=r<n.length?n.charCodeAt(r):0,o=r<e.length?e.charCodeAt(r):0;t|=i^o}return t===0},R="/__lunora/auth/session",y="/__lunora/auth/audit",S="x-lunora-auth-do-secret",b=n=>{if(n===null||typeof n!="object"||Array.isArray(n))return{error:"body must be a JSON object"};const e={};for(const[s,t]of Object.entries(n))if(s==="limit"||s==="sinceSeq"){if(typeof t!="number"||!Number.isFinite(t))return{error:`"${s}" must be a finite number`};e[s]=t}else if(s==="actorId"||s==="event"){if(typeof t!="string")return{error:`"${s}" must be a string`};e[s]=t}else return{error:`unknown audit read option "${s}"`};return{options:e}};class v{#s;#r;#t;#e;#n=!1;constructor(e,s,t={}){this.#t=e.storage,this.#r=s,this.#s=t}#o(){if(this.#e!==void 0)return this.#e;const e=this.#r();if(!this.#n){const s=m(e);for(const t of p(s))[...this.#t.sql.exec(t)];for(const t of f(s,r=>this.#a(r)))[...this.#t.sql.exec(t)];this.#n=!0}return this.#e=d({...e,database:u(this.#t)}),this.#e}#a(e){return[...this.#t.sql.exec("SELECT name FROM pragma_table_info(?)",e)].map(t=>String(t.name))}async#u(e){if(!this.#i(e))return Response.json({error:"unauthorized"},{status:401});let s;try{s=await e.json()}catch{return Response.json({error:"invalid body"},{status:400})}const t=b(s??{});if("error"in t)return Response.json({error:t.error},{status:400});const r=h(this.#t);await c(r);const i=await l(r).read(t.options);return Response.json({entries:i})}#i(e){const{internalSecret:s}=this.#s;if(s===void 0||s==="")return!1;const t=e.headers.get(S);return t!==null&&g(t,s)}async#h(e){if(!this.#i(e))return Response.json({error:"unauthorized"},{status:401});const t=await this.#o().api.getSession({headers:e.headers}),r=t?.user.id;if(r===void 0)return Response.json({});const i=t?.session.expiresAt,o=t?.user,a=o?.role;return Response.json({...typeof o?.email=="string"&&o.email.length>0?{email:o.email}:{},...i instanceof Date?{expiresAtMs:i.getTime()}:{},...typeof o?.name=="string"&&o.name.length>0?{name:o.name}:{},...typeof a=="string"&&a.length>0?{role:a}:{},userId:r})}async fetch(e){const s=new URL(e.url);if(s.pathname===R)return this.#h(e);if(s.pathname===y)return this.#u(e);const t=this.#o();return await A(t,e,this.#s.basePath)??Response.json({error:"not an auth route"},{status:404})}}export{S as INTERNAL_SECRET_HEADER,v as LunoraAuthDO,y as READ_AUDIT_PATH,R as RESOLVE_SESSION_PATH};

package/dist/packem_shared/createDoAuthWiring-Ber4dHOy.mjs

@@ -0,0 +1 @@
+import{INTERNAL_SECRET_HEADER as u,RESOLVE_SESSION_PATH as p,READ_AUDIT_PATH as f}from"./AUTH_DO_AUDIT_PATH-DiXHh-vn.mjs";import{DEFAULT_AUTH_BASE_PATH as h,isAuthRoutePath as A}from"./DEFAULT_AUTH_BASE_PATH-DneiLGpv.mjs";const g=l=>{const{basePath:c=h,internalSecret:a,namespace:o,objectName:d="auth"}=l,i=()=>{if(o)return o.get(o.idFromName(d))},m=async(t,n,r)=>{if(!a)return;const s=i();if(!s)return;const e=await s.fetch(new Request(new URL(t,n),{body:JSON.stringify(r),headers:{"content-type":"application/json",[u]:a},method:"POST"}));return e.ok?e:void 0};return{auditReader:{read:async t=>{const n=await m(f,"https://auth-do.invalid",t);return n?(await n.json())?.entries??[]:[]}},authHandler:async t=>{if(A(new URL(t.url).pathname,c))return i()?.fetch(t)},resolveIdentity:async t=>{if(!a)return null;const n=i();if(!n)return null;const r=new Headers(t.headers);r.set(u,a);const s=await n.fetch(new Request(new URL(p,t.url),{headers:r}));if(!s.ok)return null;const e=await s.json();return e?.userId?{...typeof e.email=="string"&&e.email.length>0?{email:e.email}:{},...typeof e.expiresAtMs=="number"&&Number.isFinite(e.expiresAtMs)?{expiresAtMs:e.expiresAtMs}:{},...typeof e.name=="string"&&e.name.length>0?{name:e.name}:{},...typeof e.role=="string"&&e.role.length>0?{role:e.role}:{},userId:e.userId}:null}}};export{g as createDoAuthWiring};

package/dist/turnstile-middleware.mjs

@@ -1 +1 @@
-import{LunoraError as i}from"@lunora/errors";import{verifyTurnstile as n}from"./turnstile.mjs";const f=e=>async({ctx:a,next:l})=>{const t=e.token(a);if(t===void 0||t==="")throw new i("FORBIDDEN",e.message??"turnstile token missing");let r;try{r=await n({expectedAction:e.expectedAction,expectedHostname:e.expectedHostname,fetch:e.fetch,remoteip:e.remoteip?.(a),secret:e.secret,token:t})}catch(c){if(console.error(`@lunora/auth: verifyTurnstileMiddleware siteverify threw; ${e.failOpen?"failing open":"failing closed"}`,c),e.failOpen)return l();throw new i("FORBIDDEN",e.message??"turnstile verification unavailable",{cause:c})}if(!r.success||e.validate!==void 0&&!e.validate(r))throw new i("FORBIDDEN",e.message??"turnstile verification failed",{data:r.errorCodes.length>0?{errorCodes:r.errorCodes}:void 0});return l()};export{f as verifyTurnstileMiddleware};
+import{LunoraError as i}from"@lunora/errors";import{verifyTurnstile as n}from"./turnstile.mjs";const f=e=>async({ctx:a,next:l})=>{const t=e.token(a);if(t===void 0||t==="")throw new i("FORBIDDEN",e.message??"turnstile token missing");let r;try{r=await n({expectedAction:e.expectedAction,expectedHostname:e.expectedHostname,fetch:e.fetch,remoteip:e.remoteip?.(a),secret:e.secret,token:t})}catch(c){if(console.error(`@lunora/auth: verifyTurnstileMiddleware siteverify threw; ${e.failOpen?"failing open":"failing closed"}`,c),e.failOpen)return l();throw new i("FORBIDDEN",e.message??"turnstile verification unavailable",{cause:c})}if(!r.success||e.validate!==void 0&&e.validate(r)!==!0)throw new i("FORBIDDEN",e.message??"turnstile verification failed",{data:r.errorCodes.length>0?{errorCodes:r.errorCodes}:void 0});return l()};export{f as verifyTurnstileMiddleware};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/auth",
-  "version": "1.0.0-alpha.112",
+  "version": "1.0.0-alpha.113",
   "description": "Auth for Lunora — a thin better-auth wrapper: email/password, OAuth, plugins, D1-backed",
   "keywords": [
     "auth",
@@ -103,8 +103,8 @@
     "@better-auth/oauth-provider": "1.7.1",
     "@better-auth/passkey": "1.7.1",
     "@better-auth/scim": "1.7.1",
-    "@lunora/errors": "1.0.0-alpha.29",
-    "@lunora/values": "1.0.0-alpha.37",
+    "@lunora/errors": "1.0.0-alpha.30",
+    "@lunora/values": "1.0.0-alpha.38",
     "@visulima/disposable-email-domains": "1.1.0",
     "@visulima/email-verifier": "1.0.2",
     "@visulima/free-email-domains": "1.0.1",

package/dist/packem_shared/AUTH_DO_AUDIT_PATH-BdKhdNhp.mjs

@@ -1 +0,0 @@
-import{b as a,d as u}from"./adapter-DA8DdALX.mjs";import{ensureAuthAuditTable as h,createAuthAuditReader as c}from"../audit.mjs";import{resolveAuthOptions as l,createAuth as d}from"./createAuth-CtTKaLZN.mjs";import{authDoSchemaStatements as p,authDoColumnAdditions as f}from"./authDoColumnAdditions-BCSs7qaN.mjs";import{handleAuthRequest as m}from"./DEFAULT_AUTH_BASE_PATH-DneiLGpv.mjs";const A=(o,e)=>{const s=Math.max(o.length,e.length);let t=o.length^e.length;for(let r=0;r<s;r+=1){const n=r<o.length?o.charCodeAt(r):0,i=r<e.length?e.charCodeAt(r):0;t|=n^i}return t===0},R="/__lunora/auth/session",g="/__lunora/auth/audit",y="x-lunora-auth-do-secret",S=o=>{if(o===null||typeof o!="object"||Array.isArray(o))return{error:"body must be a JSON object"};const e={};for(const[s,t]of Object.entries(o))if(s==="limit"||s==="sinceSeq"){if(typeof t!="number"||!Number.isFinite(t))return{error:`"${s}" must be a finite number`};e[s]=t}else if(s==="actorId"||s==="event"){if(typeof t!="string")return{error:`"${s}" must be a string`};e[s]=t}else return{error:`unknown audit read option "${s}"`};return{options:e}};class T{#s;#r;#t;#e;#o=!1;constructor(e,s,t={}){this.#t=e.storage,this.#r=s,this.#s=t}#n(){if(this.#e!==void 0)return this.#e;const e=this.#r();if(!this.#o){const s=l(e);for(const t of p(s))[...this.#t.sql.exec(t)];for(const t of f(s,r=>this.#a(r)))[...this.#t.sql.exec(t)];this.#o=!0}return this.#e=d({...e,database:a(this.#t)}),this.#e}#a(e){return[...this.#t.sql.exec("SELECT name FROM pragma_table_info(?)",e)].map(t=>String(t.name))}async#u(e){if(!this.#i(e))return Response.json({error:"unauthorized"},{status:401});let s;try{s=await e.json()}catch{return Response.json({error:"invalid body"},{status:400})}const t=S(s??{});if("error"in t)return Response.json({error:t.error},{status:400});const r=u(this.#t);await h(r);const n=await c(r).read(t.options);return Response.json({entries:n})}#i(e){const{internalSecret:s}=this.#s;if(s===void 0||s==="")return!1;const t=e.headers.get(y);return t!==null&&A(t,s)}async#h(e){if(!this.#i(e))return Response.json({error:"unauthorized"},{status:401});const t=await this.#n().api.getSession({headers:e.headers}),r=t?.user.id;if(r===void 0)return Response.json({});const n=t?.session.expiresAt,i=t?.user?.role;return Response.json({...n instanceof Date?{expiresAtMs:n.getTime()}:{},...typeof i=="string"&&i.length>0?{role:i}:{},userId:r})}async fetch(e){const s=new URL(e.url);if(s.pathname===R)return this.#h(e);if(s.pathname===g)return this.#u(e);const t=this.#n();return await m(t,e,this.#s.basePath)??Response.json({error:"not an auth route"},{status:404})}}export{y as INTERNAL_SECRET_HEADER,T as LunoraAuthDO,g as READ_AUDIT_PATH,R as RESOLVE_SESSION_PATH};

package/dist/packem_shared/createDoAuthWiring-BGL6oAV_.mjs

@@ -1 +0,0 @@
-import{INTERNAL_SECRET_HEADER as u,RESOLVE_SESSION_PATH as f,READ_AUDIT_PATH as h}from"./AUTH_DO_AUDIT_PATH-BdKhdNhp.mjs";import{DEFAULT_AUTH_BASE_PATH as A,isAuthRoutePath as y}from"./DEFAULT_AUTH_BASE_PATH-DneiLGpv.mjs";const w=c=>{const{basePath:d=A,internalSecret:o,namespace:a,objectName:l="auth"}=c,i=()=>{if(a)return a.get(a.idFromName(l))},p=async(t,r,n)=>{if(!o)return;const s=i();if(!s)return;const e=await s.fetch(new Request(new URL(t,r),{body:JSON.stringify(n),headers:{"content-type":"application/json",[u]:o},method:"POST"}));return e.ok?e:void 0};return{auditReader:{read:async t=>{const r=await p(h,"https://auth-do.invalid",t);return r?(await r.json())?.entries??[]:[]}},authHandler:async t=>{if(y(new URL(t.url).pathname,d))return i()?.fetch(t)},resolveIdentity:async t=>{if(!o)return null;const r=i();if(!r)return null;const n=new Headers(t.headers);n.set(u,o);const s=await r.fetch(new Request(new URL(f,t.url),{headers:n}));if(!s.ok)return null;const e=await s.json();return e?.userId?{...typeof e.expiresAtMs=="number"&&Number.isFinite(e.expiresAtMs)?{expiresAtMs:e.expiresAtMs}:{},...typeof e.role=="string"&&e.role.length>0?{role:e.role}:{},userId:e.userId}:null}}};export{w as createDoAuthWiring};