@lunora/auth 1.0.0-alpha.161 → 1.0.0-alpha.163

package/dist/audit.mjs

@@ -1,4 +1,4 @@
-import{standardRules as f,piiRules as g,redact as R}from"@visulima/redact";const c="__lunora_auth_audit__",N=[...f,...g],h=1e3,p=1e4,n=null,d=e=>{if(typeof e=="string")return e;if(typeof e=="number"||typeof e=="bigint"||typeof e=="boolean")return String(e)},I=async e=>{await e.run(`CREATE TABLE IF NOT EXISTS "${c}" (
+import{standardRules as D,piiRules as b,redact as $}from"@visulima/redact";const w=new Set(["auth","authorization","bearer","card","cc","cookie","credential","cvc","cvv","dsn","hmac","hotp","iban","jwt","kek","mnemonic","otp","pass","passcode","passphrase","passwd","password","pem","pin","pwd","salt","secret","session","sid","sig","signature","ssn","token","totp","verifier"]),C=new Set(["card","pass","pin","session"]),k=new Set(["access","api","client","encryption","master","priv","private","secret","signing"]),M=new Set(["2fa","auth","authorization","backup","factor","hotp","mfa","otp","pin","recovery","reset","security","totp","verification","verify"]),U=new Set(["card no","connection string","database url","one time"]),W=["accesskey","apikey","authorization","cookie","credential","mfacode","otpcode","passcode","passphrase","passwd","password","privatekey","secret","secretkey","sessionid","signature","token"],X=new Set(["again","b64","base","base64","bytes","confirm","confirmation","data","digest","encrypted","hash","hashed","header","hex","id","input","key","no","num","number","plain","plaintext","raw","repeat","str","string","text","value"]),F=new Set(["count","counts","length","limit","limits","size","tokens","total","usage"]),j=new Set(["max","min","num","total"]),S=4096,q=16384,d="<REDACTED>",x="[redaction budget exceeded]",z=t=>t.replaceAll(/([a-z\d])([A-Z])/g,"$1 $2").replaceAll(/([A-Z]+)([A-Z][a-z])/g,"$1 $2").toLowerCase().split(/[^a-z\d]+/).filter(e=>e.length>0),I=t=>t.length>3&&t.endsWith("s")&&!t.endsWith("ss")?t.slice(0,-1):t,B=(t,e)=>{const s=I(t[e]),n=e>0?I(t[e-1]):void 0;if(w.has(s))return s;if(n!==void 0){if(s==="key"&&k.has(n))return"key";if(s==="code"&&M.has(n))return"code";if(U.has(`${n} ${s}`))return`${n} ${s}`}return W.some(r=>s.endsWith(r))?s:void 0},R=t=>{const e=z(t);if(e.length===0)return"none";const s=F.has(e.at(-1))||j.has(e[0]);for(let n=e.length-1;n>=0;n-=1){const r=B(e,n);if(r!==void 0)return s?"count-secret":e.slice(n+1).every(a=>X.has(a))?C.has(r)&&n===e.length-1?"scalar-secret":"secret":"none"}return"none"},K=t=>typeof t=="boolean"||t===null||t===void 0?t:d,P=t=>{const e=t.indexOf("://")+3,s=t.slice(e),n=s.split(/[?#]/,1)[0],r=n.lastIndexOf("@"),a=n.indexOf(":"),c=n.indexOf("/"),i=a!==-1&&/^\d+$/.test(n.slice(a+1,c===-1?void 0:c)),o=a!==-1&&!i&&(c===-1||a<c);if(r===-1&&o&&s.includes("@",n.length))return t.slice(0,e);const l=r!==-1&&(c===-1||r<c||a!==-1&&a<r&&!i);return`${t.slice(0,e)}${l?n.slice(r+1):n}`},G=/\b[a-z][\d+.a-z-]{1,15}:\/\/[^\s"'<>()[\]{}]+/gi,V=/-----BEGIN ([A-Z ]{0,32}PRIVATE KEY)-----[\s\S]*?(?:-----END [A-Z ]{0,32}PRIVATE KEY-----|$)/g,Y=/\b(Basic|Bearer|Digest)\s+[\w+/=.~-]{4,}|\beyJ[\w-]{2,}\.[\w-]{2,}\.[\w-]*|\bAKIA[\dA-Z]{16}\b/g,H=/(\s|^)(-u|--user|--password|--pass|--token|--api-key)(\s+|=)[^\s"']+/g,f=/(?<![\w.-])(\\?["']?)([A-Za-z_][\w.-]{0,63})\1[ \t]{0,4}([:=])[ \t]{0,4}/g,L=/(?:basic|bearer|digest|token)\s+[^\s"&'),;\]}]+|\\"(?:[^"\\\n]|\\[^"])*(?:\\")?|"[^\n"]*"?|'[^\n']*'?|[^\s"&'),;\]}]+/iy,N=/(?:[ \t]+(?![A-Za-z_][\w.-]{0,63}[:=])[^\s,;)\]}]+)*/y,Z=t=>{let e="",s=0;f.lastIndex=0;for(let n=f.exec(t);n!==null;n=f.exec(t)){const r=R(n[2]),a=n.index+n[0].length;L.lastIndex=a;const c=r==="none"?null:L.exec(t);if(c===null||r==="count-secret"&&/^["']?[\d.]+["']?$/.test(c[0])){f.lastIndex=Math.max(a,n.index+1);continue}const i=c[0],o=i.startsWith('\\"')?'\\"':i.startsWith('"')||i.startsWith("'")?i[0]:"";let l=a+i.length;o===""&&n[3]===":"&&(N.lastIndex=l,l+=N.exec(t)?.[0].length??0),e+=`${t.slice(s,a)}${o}${d}${i.length>o.length&&i.endsWith(o)?o:""}`,s=l,f.lastIndex=s}return e+t.slice(s)},v=/[:=@]|basic|bearer|digest|eyJ|AKIA|-u\b|--/i,J=(t,e)=>{if(e.remaining<=0)return x;const s=t.length>S?`${t.slice(0,S)}…[truncated]`:t;return e.remaining-=s.length,v.test(s)?Z(s.replaceAll(V,`-----BEGIN $1-----${d}`).replaceAll(G,P).replaceAll(Y,(n,r)=>r===void 0?d:`${r} ${d}`).replaceAll(H,`$1$2$3${d}`)):s},Q=t=>t instanceof Error||t instanceof RegExp||t instanceof Map||t instanceof Set||t instanceof WeakMap||t instanceof WeakSet||t instanceof Promise||t instanceof ArrayBuffer||ArrayBuffer.isView(t),p=Symbol("no-json"),tt=t=>{const{toJSON:e}=t;if(typeof e!="function")return p;try{const s=e.call(t);return s===t?p:s}catch{return p}},et=32,T=(t,e,s,n,r)=>{if(typeof t=="string")return n?d:J(t,r);if(typeof t!="object"||t===null||!Array.isArray(t)&&Q(t))return t;if(e.has(t)||s>=et)return d;const a=Array.isArray(t)?p:tt(t);if(a!==p){e.add(t);const i=T(a,e,s+1,n,r);return e.delete(t),i}e.add(t);const c=Array.isArray(t)?t.map(i=>T(i,e,s+1,n,r)):Object.fromEntries(Object.entries(t).map(([i,o])=>{const l=R(i);return l==="secret"||l==="scalar-secret"&&(typeof o!="object"||o===null)?[i,K(o)]:[i,T(o,e,s+1,l==="count-secret"&&(typeof o=="string"||Array.isArray(o)),r)]}));return e.delete(t),c},st=t=>T(t,new WeakSet,0,!1,{remaining:q}),u="__lunora_auth_audit__",nt=[...D,...b],rt=1e3,it=1e4,A=null,h=t=>{if(typeof t=="string")return t;if(typeof t=="number"||typeof t=="bigint"||typeof t=="boolean")return String(t)},at=async t=>{await t.run(`CREATE TABLE IF NOT EXISTS "${u}" (
             seq INTEGER PRIMARY KEY AUTOINCREMENT,
             ts REAL NOT NULL,
             event TEXT NOT NULL,
@@ -9,4 +9,4 @@ import{standardRules as f,piiRules as g,redact as R}from"@visulima/redact";const
             ip TEXT,
             user_agent TEXT,
             detail TEXT
-        )`,[]);try{await e.run(`ALTER TABLE "${c}" ADD COLUMN target_email TEXT`,[])}catch(t){if(!(t instanceof Error?t.message.toLowerCase():String(t).toLowerCase()).includes("duplicate column"))throw t}},l=new WeakMap,m=e=>{const t=l.get(e);if(t)return t;const a=I(e);return l.set(e,a),a.catch(()=>l.delete(e)),a},D=async(e,t,a={})=>{await m(e);let i;return t.detail!==void 0&&(i=a.redactDetail===!1?t.detail:R(t.detail,N)),await e.run(`INSERT INTO "${c}" (ts, event, outcome, actor_id, actor_email, target_email, ip, user_agent, detail) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,[t.ts,t.event,t.outcome,t.actorId??n,t.actorEmail??n,t.targetEmail??n,t.ip??n,t.userAgent??n,i===void 0?n:JSON.stringify(i)]),typeof a.retention=="number"&&a.retention>0&&await e.run(`DELETE FROM "${c}" WHERE seq <= (SELECT MAX(seq) - ? FROM "${c}")`,[a.retention]),{...t,detail:i}},S=async(e,t={})=>{await m(e);const a=Number.isFinite(t.limit)?Math.max(1,Math.min(t.limit,p)):h,i=["seq > ?"],o=[t.sinceSeq??0],A=t.sinceSeq===void 0?"DESC":"ASC";return t.actorId!==void 0&&(i.push("actor_id = ?"),o.push(t.actorId)),t.event!==void 0&&(i.push("event = ?"),o.push(t.event)),o.push(a),(await e.all(`SELECT seq, ts, event, outcome, actor_id, actor_email, target_email, ip, user_agent, detail FROM "${c}" WHERE ${i.join(" AND ")} ORDER BY seq ${A} LIMIT ?`,o)).map(r=>{const u={event:d(r.event)??"",outcome:r.outcome==="failure"?"failure":"success",seq:Number(r.seq),ts:Number(r.ts)},_=[["actorId","actor_id"],["actorEmail","actor_email"],["targetEmail","target_email"],["ip","ip"],["userAgent","user_agent"]];for(const[s,L]of _){const T=d(r[L]);T!==void 0&&(u[s]=T)}const E=d(r.detail);if(E!==void 0)try{const s=JSON.parse(E);typeof s=="object"&&s!==null&&!Array.isArray(s)&&(u.detail=s)}catch{}return u})},O=e=>({read:t=>S(e,t)});export{c as AUTH_AUDIT_TABLE,D as appendAuthAuditEntry,O as createAuthAuditReader,m as ensureAuthAuditTable,S as readAuthAuditLog};
+        )`,[]);try{await t.run(`ALTER TABLE "${u}" ADD COLUMN target_email TEXT`,[])}catch(e){if(!(e instanceof Error?e.message.toLowerCase():String(e).toLowerCase()).includes("duplicate column"))throw e}},m=new WeakMap,y=t=>{const e=m.get(t);if(e)return e;const s=at(t);return m.set(t,s),s.catch(()=>m.delete(t)),s},lt=async(t,e,s={})=>{await y(t);let n;return e.detail!==void 0&&(n=s.redactDetail===!1?e.detail:$(st(e.detail),nt)),await t.run(`INSERT INTO "${u}" (ts, event, outcome, actor_id, actor_email, target_email, ip, user_agent, detail) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,[e.ts,e.event,e.outcome,e.actorId??A,e.actorEmail??A,e.targetEmail??A,e.ip??A,e.userAgent??A,n===void 0?A:JSON.stringify(n)]),typeof s.retention=="number"&&s.retention>0&&await t.run(`DELETE FROM "${u}" WHERE seq <= (SELECT MAX(seq) - ? FROM "${u}")`,[s.retention]),{...e,detail:n}},ot=async(t,e={})=>{await y(t);const s=Number.isFinite(e.limit)?Math.max(1,Math.min(e.limit,it)):rt,n=["seq > ?"],r=[e.sinceSeq??0],a=e.sinceSeq===void 0?"DESC":"ASC";return e.actorId!==void 0&&(n.push("actor_id = ?"),r.push(e.actorId)),e.event!==void 0&&(n.push("event = ?"),r.push(e.event)),r.push(s),(await t.all(`SELECT seq, ts, event, outcome, actor_id, actor_email, target_email, ip, user_agent, detail FROM "${u}" WHERE ${n.join(" AND ")} ORDER BY seq ${a} LIMIT ?`,r)).map(i=>{const o={event:h(i.event)??"",outcome:i.outcome==="failure"?"failure":"success",seq:Number(i.seq),ts:Number(i.ts)},l=[["actorId","actor_id"],["actorEmail","actor_email"],["targetEmail","target_email"],["ip","ip"],["userAgent","user_agent"]];for(const[E,O]of l){const g=h(i[O]);g!==void 0&&(o[E]=g)}const _=h(i.detail);if(_!==void 0)try{const E=JSON.parse(_);typeof E=="object"&&E!==null&&!Array.isArray(E)&&(o.detail=E)}catch{}return o})},dt=t=>({read:e=>ot(t,e)});export{u as AUTH_AUDIT_TABLE,lt as appendAuthAuditEntry,dt as createAuthAuditReader,y as ensureAuthAuditTable,ot as readAuthAuditLog};

package/dist/index.d.mts

@@ -847,11 +847,18 @@ declare const authDoSchemaStatements: (options: LunoraAuthOptions) => string[];
 declare const authDoColumnAdditions: (options: LunoraAuthOptions, existingColumns: (table: string) => Iterable<string>) => string[];
 /** The slice of a Durable Object namespace this needs — structural, so tests need no runtime. */
 interface AuthNamespaceLike {
-  get: (id: unknown) => {
+  get(this: void, id: unknown): {
     fetch: (request: Request) => Promise<Response>;
   };
-  idFromName: (name: string) => unknown;
+  idFromName(this: void, name: string): unknown;
+  /** Jurisdiction-restricted subnamespace. Optional only so older binding types still fit; {@link createDoAuthWiring} fails closed without it when a jurisdiction is set. */
+  jurisdiction?(this: void, jurisdiction: AuthJurisdiction): AuthNamespaceLike;
 }
+/**
+ * Cloudflare Durable Object data-residency jurisdiction. Widening union —
+ * Cloudflare adds values over time.
+ */
+type AuthJurisdiction = "eu" | "fedramp" | "us";
 /** What {@link createDoAuthWiring} needs, already resolved against `env`. */
 interface DoAuthWiringOptions {
   /**
@@ -859,6 +866,14 @@ interface DoAuthWiringOptions {
    * means identity resolution fails closed — see {@link DoAuthWiring.resolveIdentity}.
    */
   internalSecret: string | undefined;
+  /**
+   * Pin the auth object to a data-residency jurisdiction — pass the worker's
+   * `jurisdiction`. The object holds users, sessions, and credentials, so it must
+   * live where the rest of the app's data does. The same name maps to a different
+   * object per jurisdiction, so toggling this on an existing deployment starts a
+   * fresh, empty auth object.
+   */
+  jurisdiction?: AuthJurisdiction;
   /** The bound namespace, or `undefined` when the binding is absent from `env`. */
   namespace: AuthNamespaceLike | undefined;
   /**
@@ -912,6 +927,7 @@ interface DoAuthWiring {
  * Every failure path answers "not authenticated" rather than throwing: this runs on
  * the request path for every request that touches `ctx.auth`, and a throw there would
  * turn a misconfiguration into a 500 on traffic that has nothing to do with auth.
+ * The exception is a `jurisdiction` the namespace cannot express, which throws here.
  * @param options The resolved namespace, secret, and names.
  * @returns The `authHandler` / `resolveIdentity` pair.
  * @experimental
@@ -1076,4 +1092,4 @@ declare const validateSessionPolicy: (policy: SessionPolicy) => SessionPolicy;
  *   with the same 60s cookie cache as `rolling`.
  */
 declare const sessionPresets: Record<"longLived" | "rolling" | "strict", SessionPolicy>;
-export { READ_AUDIT_PATH as AUTH_DO_AUDIT_PATH, INTERNAL_SECRET_HEADER as AUTH_DO_SECRET_HEADER, RESOLVE_SESSION_PATH as AUTH_DO_SESSION_PATH, type AppendAuthAuditEntry, type AppendAuthAuditOptions, type AuthAccount, type AuthAdmin, type AuthAdminSession, type AuthAdminUser, type AuthAuditEvent, type AuthAuditHookConfig, type AuthAuditReader, type AuthCapabilities, type AuthConfigInfo, type AuthDoOptions, type AuthDoState, type AuthInvitation, type AuthMember, type AuthNamespaceLike, type AuthOrgRole, type AuthOrganization, type AuthPage, type AuthPasskey, type AuthSignUpInvitation, type AuthTeam, type AuthTeamMember, type AuthTimestamp, type AuthUserFieldSpec, type CreateAuthAdminOptions, DEFAULT_AUTH_BASE_PATH, type DoAuthWiring, type DoAuthWiringOptions, type EmailClassification, type EmailGateConfig, type EmailGateHookConfig, type ImpersonationResult, type ListUsersOptions, type LunoraAuth, LunoraAuthAdminError, LunoraAuthDO, type LunoraAuthOptions, type SessionPolicy, type SqlExecutor, authAuditHook, authDoColumnAdditions, authDoSchemaStatements, buildAuditEntry, compileMigrationsSql, createAuthAdmin, createDoAuthWiring, emailGateDatabaseHooks, ensureMigrated, eventForPath, handleAuthRequest, legacyIssuerCleanupStatements, sessionPresets, validateSessionPolicy, withAuthAudit, withEmailGate };
+export { READ_AUDIT_PATH as AUTH_DO_AUDIT_PATH, INTERNAL_SECRET_HEADER as AUTH_DO_SECRET_HEADER, RESOLVE_SESSION_PATH as AUTH_DO_SESSION_PATH, type AppendAuthAuditEntry, type AppendAuthAuditOptions, type AuthAccount, type AuthAdmin, type AuthAdminSession, type AuthAdminUser, type AuthAuditEvent, type AuthAuditHookConfig, type AuthAuditReader, type AuthCapabilities, type AuthConfigInfo, type AuthDoOptions, type AuthDoState, type AuthInvitation, type AuthJurisdiction, type AuthMember, type AuthNamespaceLike, type AuthOrgRole, type AuthOrganization, type AuthPage, type AuthPasskey, type AuthSignUpInvitation, type AuthTeam, type AuthTeamMember, type AuthTimestamp, type AuthUserFieldSpec, type CreateAuthAdminOptions, DEFAULT_AUTH_BASE_PATH, type DoAuthWiring, type DoAuthWiringOptions, type EmailClassification, type EmailGateConfig, type EmailGateHookConfig, type ImpersonationResult, type ListUsersOptions, type LunoraAuth, LunoraAuthAdminError, LunoraAuthDO, type LunoraAuthOptions, type SessionPolicy, type SqlExecutor, authAuditHook, authDoColumnAdditions, authDoSchemaStatements, buildAuditEntry, compileMigrationsSql, createAuthAdmin, createDoAuthWiring, emailGateDatabaseHooks, ensureMigrated, eventForPath, handleAuthRequest, legacyIssuerCleanupStatements, sessionPresets, validateSessionPolicy, withAuthAudit, withEmailGate };

package/dist/index.d.ts

@@ -847,11 +847,18 @@ declare const authDoSchemaStatements: (options: LunoraAuthOptions) => string[];
 declare const authDoColumnAdditions: (options: LunoraAuthOptions, existingColumns: (table: string) => Iterable<string>) => string[];
 /** The slice of a Durable Object namespace this needs — structural, so tests need no runtime. */
 interface AuthNamespaceLike {
-  get: (id: unknown) => {
+  get(this: void, id: unknown): {
     fetch: (request: Request) => Promise<Response>;
   };
-  idFromName: (name: string) => unknown;
+  idFromName(this: void, name: string): unknown;
+  /** Jurisdiction-restricted subnamespace. Optional only so older binding types still fit; {@link createDoAuthWiring} fails closed without it when a jurisdiction is set. */
+  jurisdiction?(this: void, jurisdiction: AuthJurisdiction): AuthNamespaceLike;
 }
+/**
+ * Cloudflare Durable Object data-residency jurisdiction. Widening union —
+ * Cloudflare adds values over time.
+ */
+type AuthJurisdiction = "eu" | "fedramp" | "us";
 /** What {@link createDoAuthWiring} needs, already resolved against `env`. */
 interface DoAuthWiringOptions {
   /**
@@ -859,6 +866,14 @@ interface DoAuthWiringOptions {
    * means identity resolution fails closed — see {@link DoAuthWiring.resolveIdentity}.
    */
   internalSecret: string | undefined;
+  /**
+   * Pin the auth object to a data-residency jurisdiction — pass the worker's
+   * `jurisdiction`. The object holds users, sessions, and credentials, so it must
+   * live where the rest of the app's data does. The same name maps to a different
+   * object per jurisdiction, so toggling this on an existing deployment starts a
+   * fresh, empty auth object.
+   */
+  jurisdiction?: AuthJurisdiction;
   /** The bound namespace, or `undefined` when the binding is absent from `env`. */
   namespace: AuthNamespaceLike | undefined;
   /**
@@ -912,6 +927,7 @@ interface DoAuthWiring {
  * Every failure path answers "not authenticated" rather than throwing: this runs on
  * the request path for every request that touches `ctx.auth`, and a throw there would
  * turn a misconfiguration into a 500 on traffic that has nothing to do with auth.
+ * The exception is a `jurisdiction` the namespace cannot express, which throws here.
  * @param options The resolved namespace, secret, and names.
  * @returns The `authHandler` / `resolveIdentity` pair.
  * @experimental
@@ -1076,4 +1092,4 @@ declare const validateSessionPolicy: (policy: SessionPolicy) => SessionPolicy;
  *   with the same 60s cookie cache as `rolling`.
  */
 declare const sessionPresets: Record<"longLived" | "rolling" | "strict", SessionPolicy>;
-export { READ_AUDIT_PATH as AUTH_DO_AUDIT_PATH, INTERNAL_SECRET_HEADER as AUTH_DO_SECRET_HEADER, RESOLVE_SESSION_PATH as AUTH_DO_SESSION_PATH, type AppendAuthAuditEntry, type AppendAuthAuditOptions, type AuthAccount, type AuthAdmin, type AuthAdminSession, type AuthAdminUser, type AuthAuditEvent, type AuthAuditHookConfig, type AuthAuditReader, type AuthCapabilities, type AuthConfigInfo, type AuthDoOptions, type AuthDoState, type AuthInvitation, type AuthMember, type AuthNamespaceLike, type AuthOrgRole, type AuthOrganization, type AuthPage, type AuthPasskey, type AuthSignUpInvitation, type AuthTeam, type AuthTeamMember, type AuthTimestamp, type AuthUserFieldSpec, type CreateAuthAdminOptions, DEFAULT_AUTH_BASE_PATH, type DoAuthWiring, type DoAuthWiringOptions, type EmailClassification, type EmailGateConfig, type EmailGateHookConfig, type ImpersonationResult, type ListUsersOptions, type LunoraAuth, LunoraAuthAdminError, LunoraAuthDO, type LunoraAuthOptions, type SessionPolicy, type SqlExecutor, authAuditHook, authDoColumnAdditions, authDoSchemaStatements, buildAuditEntry, compileMigrationsSql, createAuthAdmin, createDoAuthWiring, emailGateDatabaseHooks, ensureMigrated, eventForPath, handleAuthRequest, legacyIssuerCleanupStatements, sessionPresets, validateSessionPolicy, withAuthAudit, withEmailGate };
+export { READ_AUDIT_PATH as AUTH_DO_AUDIT_PATH, INTERNAL_SECRET_HEADER as AUTH_DO_SECRET_HEADER, RESOLVE_SESSION_PATH as AUTH_DO_SESSION_PATH, type AppendAuthAuditEntry, type AppendAuthAuditOptions, type AuthAccount, type AuthAdmin, type AuthAdminSession, type AuthAdminUser, type AuthAuditEvent, type AuthAuditHookConfig, type AuthAuditReader, type AuthCapabilities, type AuthConfigInfo, type AuthDoOptions, type AuthDoState, type AuthInvitation, type AuthJurisdiction, type AuthMember, type AuthNamespaceLike, type AuthOrgRole, type AuthOrganization, type AuthPage, type AuthPasskey, type AuthSignUpInvitation, type AuthTeam, type AuthTeamMember, type AuthTimestamp, type AuthUserFieldSpec, type CreateAuthAdminOptions, DEFAULT_AUTH_BASE_PATH, type DoAuthWiring, type DoAuthWiringOptions, type EmailClassification, type EmailGateConfig, type EmailGateHookConfig, type ImpersonationResult, type ListUsersOptions, type LunoraAuth, LunoraAuthAdminError, LunoraAuthDO, type LunoraAuthOptions, type SessionPolicy, type SqlExecutor, authAuditHook, authDoColumnAdditions, authDoSchemaStatements, buildAuditEntry, compileMigrationsSql, createAuthAdmin, createDoAuthWiring, emailGateDatabaseHooks, ensureMigrated, eventForPath, handleAuthRequest, legacyIssuerCleanupStatements, sessionPresets, validateSessionPolicy, withAuthAudit, withEmailGate };

package/dist/index.mjs

@@ -1 +1 @@
-import{l as r,a as o,b as a}from"./packem_shared/adapter-CG0Yv85f.mjs";import{LunoraAuthAdminError as A,createAuthAdmin as u}from"./packem_shared/LunoraAuthAdminError-uhKG1MgQ.mjs";import{AUTH_AUDIT_TABLE as n,appendAuthAuditEntry as m,createAuthAuditReader as l,ensureAuthAuditTable as p,readAuthAuditLog as d}from"./audit.mjs";import{authAuditHook as E,buildAuditEntry as f,eventForPath as T,withAuthAudit as S}from"./packem_shared/authAuditHook-DPTKdjBe.mjs";import{READ_AUDIT_PATH as _,INTERNAL_SECRET_HEADER as D,RESOLVE_SESSION_PATH as c,LunoraAuthDO as H}from"./packem_shared/AUTH_DO_AUDIT_PATH-u9QgGb_v.mjs";import{createAuth as U,resolveAuthOptions as R}from"./packem_shared/createAuth-8aUw8v8D.mjs";import{authDoColumnAdditions as v,authDoSchemaStatements as L}from"./packem_shared/authDoColumnAdditions-UwF3Rl41.mjs";import{createDoAuthWiring as O}from"./packem_shared/createDoAuthWiring-BekpJYhd.mjs";import{emailGateDatabaseHooks as N,withEmailGate as w}from"./packem_shared/emailGateDatabaseHooks-CAygR3iq.mjs";import{assertEmailAllowed as M,classifyEmail as C,emailGateMiddleware as k,loadEmailDomainLists as q}from"./email-guard.mjs";import{DEFAULT_AUTH_BASE_PATH as G,handleAuthRequest as B}from"./packem_shared/DEFAULT_AUTH_BASE_PATH-DneiLGpv.mjs";import{createSignUpInvitation as W,listSignUpInvitations as Y,pruneSignUpInvitations as j,revokeSignUpInvitation as z}from"./packem_shared/createSignUpInvitation-DHZL9fNl.mjs";import{legacyIssuerCleanupStatements as K}from"./packem_shared/legacyIssuerCleanupStatements-D9Kf8OD1.mjs";import{LunoraAuthHeadersError as X,withAuthPlugins as Z}from"./middleware.mjs";import{compileMigrationsSql as tt,ensureMigrated as et}from"./packem_shared/compileMigrationsSql-DKGrw7Lf.mjs";import{default as ot}from"./schema.mjs";import{sessionPresets as it,validateSessionPolicy as At}from"./packem_shared/sessionPresets-C867Mlo4.mjs";import{c as st,d as nt}from"./packem_shared/sql-store-CYa4HJsO.mjs";import{createMemoryAuthStore as lt,matchesWhere as pt}from"./store.mjs";import{TURNSTILE_VERIFY_ENDPOINT as ht,verifyTurnstile as Et}from"./turnstile.mjs";import{verifyTurnstileMiddleware as Tt}from"./turnstile-middleware.mjs";export{n as AUTH_AUDIT_TABLE,_ as AUTH_DO_AUDIT_PATH,D as AUTH_DO_SECRET_HEADER,c as AUTH_DO_SESSION_PATH,G as DEFAULT_AUTH_BASE_PATH,A as LunoraAuthAdminError,H as LunoraAuthDO,X as LunoraAuthHeadersError,ht as TURNSTILE_VERIFY_ENDPOINT,m as appendAuthAuditEntry,M as assertEmailAllowed,E as authAuditHook,v as authDoColumnAdditions,L as authDoSchemaStatements,ot as authTables,f as buildAuditEntry,C as classifyEmail,tt as compileMigrationsSql,U as createAuth,u as createAuthAdmin,l as createAuthAuditReader,O as createDoAuthWiring,lt as createMemoryAuthStore,W as createSignUpInvitation,st as createSqlAuthStore,nt as d1Executor,N as emailGateDatabaseHooks,k as emailGateMiddleware,p as ensureAuthAuditTable,et as ensureMigrated,T as eventForPath,B as handleAuthRequest,K as legacyIssuerCleanupStatements,Y as listSignUpInvitations,q as loadEmailDomainLists,r as lunoraAuthAdapter,o as lunoraD1Adapter,a as lunoraDoAdapter,pt as matchesWhere,j as pruneSignUpInvitations,d as readAuthAuditLog,R as resolveAuthOptions,z as revokeSignUpInvitation,it as sessionPresets,At as validateSessionPolicy,Et as verifyTurnstile,Tt as verifyTurnstileMiddleware,S as withAuthAudit,Z as withAuthPlugins,w as withEmailGate};
+import{l as r,a as o,b as a}from"./packem_shared/adapter-CG0Yv85f.mjs";import{LunoraAuthAdminError as A,createAuthAdmin as u}from"./packem_shared/LunoraAuthAdminError-uhKG1MgQ.mjs";import{AUTH_AUDIT_TABLE as n,appendAuthAuditEntry as m,createAuthAuditReader as l,ensureAuthAuditTable as p,readAuthAuditLog as d}from"./audit.mjs";import{authAuditHook as E,buildAuditEntry as f,eventForPath as T,withAuthAudit as S}from"./packem_shared/authAuditHook-DPTKdjBe.mjs";import{READ_AUDIT_PATH as _,INTERNAL_SECRET_HEADER as D,RESOLVE_SESSION_PATH as c,LunoraAuthDO as H}from"./packem_shared/AUTH_DO_AUDIT_PATH-u9QgGb_v.mjs";import{createAuth as U,resolveAuthOptions as R}from"./packem_shared/createAuth-8aUw8v8D.mjs";import{authDoColumnAdditions as v,authDoSchemaStatements as L}from"./packem_shared/authDoColumnAdditions-UwF3Rl41.mjs";import{createDoAuthWiring as O}from"./packem_shared/createDoAuthWiring-zfQiAS75.mjs";import{emailGateDatabaseHooks as N,withEmailGate as w}from"./packem_shared/emailGateDatabaseHooks-CAygR3iq.mjs";import{assertEmailAllowed as M,classifyEmail as C,emailGateMiddleware as k,loadEmailDomainLists as q}from"./email-guard.mjs";import{DEFAULT_AUTH_BASE_PATH as G,handleAuthRequest as B}from"./packem_shared/DEFAULT_AUTH_BASE_PATH-DneiLGpv.mjs";import{createSignUpInvitation as W,listSignUpInvitations as Y,pruneSignUpInvitations as j,revokeSignUpInvitation as z}from"./packem_shared/createSignUpInvitation-DHZL9fNl.mjs";import{legacyIssuerCleanupStatements as K}from"./packem_shared/legacyIssuerCleanupStatements-D9Kf8OD1.mjs";import{LunoraAuthHeadersError as X,withAuthPlugins as Z}from"./middleware.mjs";import{compileMigrationsSql as tt,ensureMigrated as et}from"./packem_shared/compileMigrationsSql-DKGrw7Lf.mjs";import{default as ot}from"./schema.mjs";import{sessionPresets as it,validateSessionPolicy as At}from"./packem_shared/sessionPresets-C867Mlo4.mjs";import{c as st,d as nt}from"./packem_shared/sql-store-CYa4HJsO.mjs";import{createMemoryAuthStore as lt,matchesWhere as pt}from"./store.mjs";import{TURNSTILE_VERIFY_ENDPOINT as ht,verifyTurnstile as Et}from"./turnstile.mjs";import{verifyTurnstileMiddleware as Tt}from"./turnstile-middleware.mjs";export{n as AUTH_AUDIT_TABLE,_ as AUTH_DO_AUDIT_PATH,D as AUTH_DO_SECRET_HEADER,c as AUTH_DO_SESSION_PATH,G as DEFAULT_AUTH_BASE_PATH,A as LunoraAuthAdminError,H as LunoraAuthDO,X as LunoraAuthHeadersError,ht as TURNSTILE_VERIFY_ENDPOINT,m as appendAuthAuditEntry,M as assertEmailAllowed,E as authAuditHook,v as authDoColumnAdditions,L as authDoSchemaStatements,ot as authTables,f as buildAuditEntry,C as classifyEmail,tt as compileMigrationsSql,U as createAuth,u as createAuthAdmin,l as createAuthAuditReader,O as createDoAuthWiring,lt as createMemoryAuthStore,W as createSignUpInvitation,st as createSqlAuthStore,nt as d1Executor,N as emailGateDatabaseHooks,k as emailGateMiddleware,p as ensureAuthAuditTable,et as ensureMigrated,T as eventForPath,B as handleAuthRequest,K as legacyIssuerCleanupStatements,Y as listSignUpInvitations,q as loadEmailDomainLists,r as lunoraAuthAdapter,o as lunoraD1Adapter,a as lunoraDoAdapter,pt as matchesWhere,j as pruneSignUpInvitations,d as readAuthAuditLog,R as resolveAuthOptions,z as revokeSignUpInvitation,it as sessionPresets,At as validateSessionPolicy,Et as verifyTurnstile,Tt as verifyTurnstileMiddleware,S as withAuthAudit,Z as withAuthPlugins,w as withEmailGate};

package/dist/packem_shared/createDoAuthWiring-zfQiAS75.mjs

@@ -0,0 +1 @@
+import{INTERNAL_SECRET_HEADER as d,RESOLVE_SESSION_PATH as f,READ_AUDIT_PATH as m}from"./AUTH_DO_AUDIT_PATH-u9QgGb_v.mjs";import{isAuthRoutePath as h,DEFAULT_AUTH_BASE_PATH as y}from"./DEFAULT_AUTH_BASE_PATH-DneiLGpv.mjs";const E=c=>{const{internalSecret:s,jurisdiction:a,objectName:l="auth"}=c;let{namespace:r}=c;if(r&&a!==void 0){if(typeof r.jurisdiction!="function")throw new TypeError(`@lunora/auth: Durable Object namespace does not support jurisdiction("${a}") — update @cloudflare/workers-types or remove the jurisdiction option`);r=r.jurisdiction(a)}const u=()=>{if(r)return r.get(r.idFromName(l))},p=async(t,n,o)=>{if(!s)return;const i=u();if(!i)return;const e=await i.fetch(new Request(new URL(t,n),{body:JSON.stringify(o),headers:{"content-type":"application/json",[d]:s},method:"POST"}));return e.ok?e:void 0};return{auditReader:{read:async t=>{const n=await p(m,"https://auth-do.invalid",t);return n?(await n.json())?.entries??[]:[]}},authHandler:async t=>{if(h(new URL(t.url).pathname,y))return u()?.fetch(t)},resolveIdentity:async t=>{if(!s)return null;const n=u();if(!n)return null;const o=new Headers(t.headers);o.set(d,s);const i=await n.fetch(new Request(new URL(f,t.url),{headers:o}));if(!i.ok)return null;const e=await i.json();return e?.userId?{...typeof e.email=="string"&&e.email.length>0?{email:e.email}:{},...typeof e.expiresAtMs=="number"&&Number.isFinite(e.expiresAtMs)?{expiresAtMs:e.expiresAtMs}:{},...typeof e.name=="string"&&e.name.length>0?{name:e.name}:{},...typeof e.role=="string"&&e.role.length>0?{role:e.role}:{},userId:e.userId}:null}}};export{E as createDoAuthWiring};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/auth",
-  "version": "1.0.0-alpha.161",
+  "version": "1.0.0-alpha.163",
   "description": "Auth for Lunora — a thin better-auth wrapper: email/password, OAuth, plugins, D1-backed",
   "keywords": [
     "auth",
@@ -103,8 +103,8 @@
     "@better-auth/oauth-provider": "1.7.3",
     "@better-auth/passkey": "1.7.3",
     "@better-auth/scim": "1.7.3",
-    "@lunora/errors": "1.0.0-alpha.41",
-    "@lunora/values": "1.0.0-alpha.51",
+    "@lunora/errors": "1.0.0-alpha.42",
+    "@lunora/values": "1.0.0-alpha.53",
     "@visulima/disposable-email-domains": "1.1.1",
     "@visulima/email-verifier": "1.0.9",
     "@visulima/free-email-domains": "1.0.1",

package/dist/packem_shared/createDoAuthWiring-BekpJYhd.mjs

@@ -1 +0,0 @@
-import{INTERNAL_SECRET_HEADER as u,RESOLVE_SESSION_PATH as m,READ_AUDIT_PATH as p}from"./AUTH_DO_AUDIT_PATH-u9QgGb_v.mjs";import{isAuthRoutePath as f,DEFAULT_AUTH_BASE_PATH as h}from"./DEFAULT_AUTH_BASE_PATH-DneiLGpv.mjs";const R=l=>{const{internalSecret:o,namespace:a,objectName:c="auth"}=l,i=()=>{if(a)return a.get(a.idFromName(c))},d=async(t,n,r)=>{if(!o)return;const s=i();if(!s)return;const e=await s.fetch(new Request(new URL(t,n),{body:JSON.stringify(r),headers:{"content-type":"application/json",[u]:o},method:"POST"}));return e.ok?e:void 0};return{auditReader:{read:async t=>{const n=await d(p,"https://auth-do.invalid",t);return n?(await n.json())?.entries??[]:[]}},authHandler:async t=>{if(f(new URL(t.url).pathname,h))return i()?.fetch(t)},resolveIdentity:async t=>{if(!o)return null;const n=i();if(!n)return null;const r=new Headers(t.headers);r.set(u,o);const s=await n.fetch(new Request(new URL(m,t.url),{headers:r}));if(!s.ok)return null;const e=await s.json();return e?.userId?{...typeof e.email=="string"&&e.email.length>0?{email:e.email}:{},...typeof e.expiresAtMs=="number"&&Number.isFinite(e.expiresAtMs)?{expiresAtMs:e.expiresAtMs}:{},...typeof e.name=="string"&&e.name.length>0?{name:e.name}:{},...typeof e.role=="string"&&e.role.length>0?{role:e.role}:{},userId:e.userId}:null}}};export{R as createDoAuthWiring};