@lunora/auth 1.0.0-alpha.14 → 1.0.0-alpha.16

package/dist/index.d.mts

@@ -1,4 +1,5 @@
 export { lunoraAuthAdapter, lunoraD1Adapter } from "./adapter.mjs";
+import { LunoraError } from '@lunora/errors';
 import { L as LunoraAuth, a as LunoraAuthOptions } from "./packem_shared/create-auth.d-Mwhb4gSc.mjs";
 export { c as createAuth, r as resolveAuthOptions } from "./packem_shared/create-auth.d-Mwhb4gSc.mjs";
 export { type LunoraAuthApiContext, LunoraAuthHeadersError, type WithAuthPluginsMiddleware, type WithAuthPluginsOptions, withAuthPlugins } from "./middleware.mjs";
@@ -271,8 +272,7 @@ interface CreateAuthAdminOptions {
 * surface that `code` so the runtime can map it onto an HTTP status and the
 * studio can show a meaningful message instead of a generic 500.
 */
-declare class LunoraAuthAdminError extends Error {
-  readonly code: string;
+declare class LunoraAuthAdminError extends LunoraError {
   constructor(message: string, code: string);
 }
 /**

package/dist/index.d.ts

@@ -1,4 +1,5 @@
 export { lunoraAuthAdapter, lunoraD1Adapter } from "./adapter.js";
+import { LunoraError } from '@lunora/errors';
 import { L as LunoraAuth, a as LunoraAuthOptions } from "./packem_shared/create-auth.d-Mwhb4gSc.js";
 export { c as createAuth, r as resolveAuthOptions } from "./packem_shared/create-auth.d-Mwhb4gSc.js";
 export { type LunoraAuthApiContext, LunoraAuthHeadersError, type WithAuthPluginsMiddleware, type WithAuthPluginsOptions, withAuthPlugins } from "./middleware.js";
@@ -271,8 +272,7 @@ interface CreateAuthAdminOptions {
 * surface that `code` so the runtime can map it onto an HTTP status and the
 * studio can show a meaningful message instead of a generic 500.
 */
-declare class LunoraAuthAdminError extends Error {
-  readonly code: string;
+declare class LunoraAuthAdminError extends LunoraError {
   constructor(message: string, code: string);
 }
 /**

package/dist/index.mjs

@@ -1,9 +1,9 @@
 export { lunoraAuthAdapter, lunoraD1Adapter } from './adapter.mjs';
-export { LunoraAuthAdminError, createAuthAdmin } from './packem_shared/LunoraAuthAdminError-BxrfEeA_.mjs';
-export { createAuth, resolveAuthOptions } from './packem_shared/createAuth-hRGxUJ9w.mjs';
+export { LunoraAuthAdminError, createAuthAdmin } from './packem_shared/LunoraAuthAdminError-BpVImgEy.mjs';
+export { createAuth, resolveAuthOptions } from './packem_shared/createAuth-BVMMllTm.mjs';
 export { DEFAULT_AUTH_BASE_PATH, handleAuthRequest } from './packem_shared/DEFAULT_AUTH_BASE_PATH-DjcUWEQl.mjs';
 export { LunoraAuthHeadersError, withAuthPlugins } from './middleware.mjs';
-export { compileMigrationsSql, ensureMigrated } from './packem_shared/compileMigrationsSql-cyE5U18R.mjs';
+export { compileMigrationsSql, ensureMigrated } from './packem_shared/compileMigrationsSql-B9bj-mJv.mjs';
 export { default as authTables } from './schema.mjs';
 export { sessionPresets, validateSessionPolicy } from './packem_shared/sessionPresets-Dwwd74_J.mjs';
 export { createSqlAuthStore, d1Executor } from './sql-store.mjs';

package/dist/middleware.d.mts

@@ -1,3 +1,4 @@
+import { LunoraError } from '@lunora/errors';
 import { L as LunoraAuth } from "./packem_shared/create-auth.d-Mwhb4gSc.mjs";
 import 'better-auth';
 /**
@@ -22,7 +23,7 @@ interface MiddlewareNext<ContextIn> {
 * advisor lint — both treat a header-less `ctx.authApi.*` call as an
 * authorization bypass, so a call that trips the lint also trips this guard.
 */
-declare class LunoraAuthHeadersError extends Error {
+declare class LunoraAuthHeadersError extends LunoraError {
   /** The `ctx.authApi.&lt;method>` that was called without `headers`. */
   readonly method: string;
   constructor(method: string);

package/dist/middleware.d.ts

@@ -1,3 +1,4 @@
+import { LunoraError } from '@lunora/errors';
 import { L as LunoraAuth } from "./packem_shared/create-auth.d-Mwhb4gSc.js";
 import 'better-auth';
 /**
@@ -22,7 +23,7 @@ interface MiddlewareNext<ContextIn> {
 * advisor lint — both treat a header-less `ctx.authApi.*` call as an
 * authorization bypass, so a call that trips the lint also trips this guard.
 */
-declare class LunoraAuthHeadersError extends Error {
+declare class LunoraAuthHeadersError extends LunoraError {
   /** The `ctx.authApi.&lt;method>` that was called without `headers`. */
   readonly method: string;
   constructor(method: string);

package/dist/middleware.mjs

@@ -1,3 +1,5 @@
+import { LunoraError } from '@lunora/errors';
+
 const callHasHeaders = (argument) => {
   if (argument === void 0) {
     return false;
@@ -30,14 +32,15 @@ const guardAuthApi = (api) => {
     }
   });
 };
-class LunoraAuthHeadersError extends Error {
+class LunoraAuthHeadersError extends LunoraError {
   /** The `ctx.authApi.<method>` that was called without `headers`. */
   method;
   constructor(method) {
     super(
-      `@lunora/auth: ctx.authApi.${method}(…) was called without \`headers\`. better-auth treats a header-less call as a trusted server-to-server invocation and skips session authorization entirely — an authorization bypass. Pass the inbound request headers: ctx.authApi.${method}({ body, headers: request.headers }). If you genuinely intend an unauthenticated server-to-server call, opt out explicitly via ctx.authApi.withoutHeaders().<method>(…), or disable the guard for the whole middleware with withAuthPlugins(auth, { enforceHeaders: false }).`
+      "AUTH_HEADERS_MISSING",
+      `@lunora/auth: ctx.authApi.${method}(…) was called without \`headers\`. better-auth treats a header-less call as a trusted server-to-server invocation and skips session authorization entirely — an authorization bypass. Pass the inbound request headers: ctx.authApi.${method}({ body, headers: request.headers }). If you genuinely intend an unauthenticated server-to-server call, opt out explicitly via ctx.authApi.withoutHeaders().<method>(…), or disable the guard for the whole middleware with withAuthPlugins(auth, { enforceHeaders: false }).`,
+      { name: "LunoraAuthHeadersError" }
     );
-    this.name = "LunoraAuthHeadersError";
     this.method = method;
   }
 }

package/dist/packem_shared/{LunoraAuthAdminError-BxrfEeA_.mjs → LunoraAuthAdminError-BpVImgEy.mjs}

@@ -1,9 +1,8 @@
-class LunoraAuthAdminError extends Error {
-  code;
+import { LunoraError } from '@lunora/errors';
+
+class LunoraAuthAdminError extends LunoraError {
   constructor(message, code) {
-    super(message);
-    this.name = "LunoraAuthAdminError";
-    this.code = code;
+    super(code, message, { name: "LunoraAuthAdminError" });
   }
 }
 const DEFAULT_LIMIT = 50;

package/dist/packem_shared/{compileMigrationsSql-cyE5U18R.mjs → compileMigrationsSql-B9bj-mJv.mjs}

@@ -1,5 +1,5 @@
 import { getMigrations } from 'better-auth/db/migration';
-import { resolveAuthOptions } from './createAuth-hRGxUJ9w.mjs';
+import { resolveAuthOptions } from './createAuth-BVMMllTm.mjs';
 
 const migrating = /* @__PURE__ */ new WeakMap();
 const ensureMigrated = async (auth) => {

package/dist/packem_shared/{createAuth-hRGxUJ9w.mjs → createAuth-BVMMllTm.mjs}

@@ -1,3 +1,4 @@
+import { LunoraError } from '@lunora/errors';
 import { betterAuth } from 'better-auth';
 import { validateSessionPolicy } from './sessionPresets-Dwwd74_J.mjs';
 
@@ -23,7 +24,7 @@ const isHttpsBaseUrl = (baseURL) => {
 };
 const isExplicitHttpBaseUrl = (baseURL) => {
   if (typeof baseURL === "string") {
-    return baseURL.startsWith("http://");
+    return baseURL.toLowerCase().startsWith("http://");
   }
   if (baseURL && typeof baseURL === "object") {
     if (baseURL.protocol === "http") {
@@ -32,7 +33,7 @@ const isExplicitHttpBaseUrl = (baseURL) => {
     if (baseURL.protocol === "https") {
       return false;
     }
-    return typeof baseURL.fallback === "string" && baseURL.fallback.startsWith("http://");
+    return typeof baseURL.fallback === "string" && baseURL.fallback.toLowerCase().startsWith("http://");
   }
   return false;
 };
@@ -40,7 +41,7 @@ const hardenAuthOptions = (options) => {
   if (isWeakSecret(options.secret)) {
     const message = `@lunora/auth: AUTH_SECRET is only ${String(options.secret?.trim().length)} characters. Use at least ${String(MIN_SECRET_LENGTH)} for a brute-force-resistant secret — generate one with \`openssl rand -hex 32\`.`;
     if (isHttpsBaseUrl(options.baseURL)) {
-      throw new Error(message);
+      throw new LunoraError("INTERNAL", message);
     }
     console.warn(message);
   }
@@ -72,7 +73,8 @@ const resolveAuthOptions = (options) => {
 };
 const createAuth = (options) => {
   if (!options.secret || options.secret.trim() === "") {
-    throw new Error(
+    throw new LunoraError(
+      "INTERNAL",
       '@lunora/auth: `secret` is required. Set AUTH_SECRET locally in .dev.vars (`lunora env set AUTH_SECRET "$(openssl rand -hex 32)"`), and in production with `wrangler secret put AUTH_SECRET`.'
     );
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/auth",
-  "version": "1.0.0-alpha.14",
+  "version": "1.0.0-alpha.16",
   "description": "Auth for Lunora — a thin better-auth wrapper: email/password, OAuth, plugins, D1-backed",
   "keywords": [
     "auth",
@@ -83,8 +83,9 @@
   },
   "dependencies": {
     "@better-auth/passkey": "^1.6.22",
-    "@lunora/server": "1.0.0-alpha.13",
-    "@lunora/values": "1.0.0-alpha.3",
+    "@lunora/errors": "1.0.0-alpha.1",
+    "@lunora/server": "1.0.0-alpha.14",
+    "@lunora/values": "1.0.0-alpha.4",
     "better-auth": "^1.6.22"
   },
   "engines": {