@lunora/auth 1.0.0-alpha.2 → 1.0.0-alpha.200

package/dist/adapter.d.mts

@@ -1,43 +1,4 @@
-import { createAdapterFactory } from 'better-auth/adapters';
-import { d1Executor } from "./sql-store.mjs";
-import { AuthStore } from "./store.mjs";
-/**
-* A better-auth database adapter backed by an {@link AuthStore} — the bridge
-* that routes better-auth's reads and writes through Lunora's data layer
-* instead of better-auth's built-in D1/Kysely adapter. Pass the result as
-* `createAuth({ database: lunoraAuthAdapter(store) })`; better-auth's
-* `createAdapterFactory` handles id generation, default values, field-name
-* mapping and output shaping, so this only translates the cleaned CRUD calls
-* onto the store.
-*
-* ```ts
-* const auth = createAuth({
-*     secret: env.AUTH_SECRET,
-*     emailAndPassword: { enabled: true },
-*     database: lunoraAuthAdapter(lunoraStore), // lunoraStore writes via ctx.db
-* });
-* ```
-*
-* Scope: the {@link AuthStore} interface is single-table CRUD. better-auth's
-* relational `join` reads (an advanced opt-in) are not handled — pair the
-* adapter with `disableJoins` or let better-auth fall back to per-table reads.
-*/
-declare const lunoraAuthAdapter: (store: AuthStore) => ReturnType<typeof createAdapterFactory>;
-/**
-* One-liner for the common case: a better-auth `database` backed by a Cloudflare
-* D1 binding, via Lunora's SQL store — equivalent to
-* `lunoraAuthAdapter(createSqlAuthStore(d1Executor(d1)))`.
-*
-* Prefer this over passing the raw `env.DB` as `database`. With raw D1,
-* better-auth resolves its Kysely adapter through a runtime `await import(...)`
-* inside `auth.$context`, and that dynamic import never settles under
-* `@cloudflare/vite-plugin`'s worker runner — so it hangs *every* auth request
-* in `pnpm dev` (a standalone `wrangler dev` or a deployed worker bundle it
-* up-front, so they're unaffected — which makes the hang baffling to debug).
-* This explicit adapter skips that import entirely, so dev and prod behave the
-* same. The migration instance is the one exception — it wants raw `env.DB` so
-* `ensureMigrated`'s Kysely migrator can create the tables (its `$context` is
-* never resolved, so the hang doesn't apply there).
-*/
-declare const lunoraD1Adapter: (d1: Parameters<typeof d1Executor>[0]) => ReturnType<typeof lunoraAuthAdapter>;
-export { lunoraAuthAdapter, lunoraD1Adapter };
+import 'better-auth/adapters';
+export { l as lunoraAuthAdapter, a as lunoraD1Adapter, b as lunoraDoAdapter } from "./packem_shared/adapter.d-CaPwF2v3.mjs";
+import "./sql-store.mjs";
+import "./store.mjs";

package/dist/adapter.d.ts

@@ -1,43 +1,4 @@
-import { createAdapterFactory } from 'better-auth/adapters';
-import { d1Executor } from "./sql-store.js";
-import { AuthStore } from "./store.js";
-/**
-* A better-auth database adapter backed by an {@link AuthStore} — the bridge
-* that routes better-auth's reads and writes through Lunora's data layer
-* instead of better-auth's built-in D1/Kysely adapter. Pass the result as
-* `createAuth({ database: lunoraAuthAdapter(store) })`; better-auth's
-* `createAdapterFactory` handles id generation, default values, field-name
-* mapping and output shaping, so this only translates the cleaned CRUD calls
-* onto the store.
-*
-* ```ts
-* const auth = createAuth({
-*     secret: env.AUTH_SECRET,
-*     emailAndPassword: { enabled: true },
-*     database: lunoraAuthAdapter(lunoraStore), // lunoraStore writes via ctx.db
-* });
-* ```
-*
-* Scope: the {@link AuthStore} interface is single-table CRUD. better-auth's
-* relational `join` reads (an advanced opt-in) are not handled — pair the
-* adapter with `disableJoins` or let better-auth fall back to per-table reads.
-*/
-declare const lunoraAuthAdapter: (store: AuthStore) => ReturnType<typeof createAdapterFactory>;
-/**
-* One-liner for the common case: a better-auth `database` backed by a Cloudflare
-* D1 binding, via Lunora's SQL store — equivalent to
-* `lunoraAuthAdapter(createSqlAuthStore(d1Executor(d1)))`.
-*
-* Prefer this over passing the raw `env.DB` as `database`. With raw D1,
-* better-auth resolves its Kysely adapter through a runtime `await import(...)`
-* inside `auth.$context`, and that dynamic import never settles under
-* `@cloudflare/vite-plugin`'s worker runner — so it hangs *every* auth request
-* in `pnpm dev` (a standalone `wrangler dev` or a deployed worker bundle it
-* up-front, so they're unaffected — which makes the hang baffling to debug).
-* This explicit adapter skips that import entirely, so dev and prod behave the
-* same. The migration instance is the one exception — it wants raw `env.DB` so
-* `ensureMigrated`'s Kysely migrator can create the tables (its `$context` is
-* never resolved, so the hang doesn't apply there).
-*/
-declare const lunoraD1Adapter: (d1: Parameters<typeof d1Executor>[0]) => ReturnType<typeof lunoraAuthAdapter>;
-export { lunoraAuthAdapter, lunoraD1Adapter };
+import 'better-auth/adapters';
+export { l as lunoraAuthAdapter, a as lunoraD1Adapter, b as lunoraDoAdapter } from "./packem_shared/adapter.d-CElAPJ1U.js";
+import "./sql-store.js";
+import "./store.js";

package/dist/adapter.mjs

@@ -1,47 +1 @@
-import { createAdapterFactory } from 'better-auth/adapters';
-import { createSqlAuthStore, d1Executor } from './sql-store.mjs';
-
-const asRow = (row) => row;
-const asRowOrNull = (row) => row ?? null;
-const asRows = (rows) => rows;
-const lunoraAuthAdapter = (store) => createAdapterFactory({
-  adapter: () => {
-    return {
-      consumeOne: async ({ model, where }) => asRowOrNull(await store.consumeOne(model, where)),
-      count: async ({ model, where }) => store.count(model, where ?? []),
-      create: async ({ data, model }) => asRow(await store.create(model, data)),
-      delete: async ({ model, where }) => {
-        await store.remove(model, where);
-      },
-      deleteMany: async ({ model, where }) => store.remove(model, where),
-      findMany: async ({ limit, model, offset, sortBy, where }) => asRows(await store.read(model, { limit, offset, sortBy, where: where ?? [] })),
-      findOne: async ({ model, where }) => {
-        const [row] = await store.read(model, { limit: 1, where });
-        return asRowOrNull(row);
-      },
-      update: async ({ model, update, where }) => {
-        const [row] = await store.update(model, where, update);
-        return asRowOrNull(row);
-      },
-      updateMany: async ({ model, update, where }) => {
-        const updated = await store.update(model, where, update);
-        return updated.length;
-      }
-    };
-  },
-  config: {
-    adapterId: "lunora",
-    adapterName: "Lunora Adapter",
-    // Conservative flags so the adapter is store-agnostic: better-auth
-    // serializes dates/booleans/json to primitives (string/number) before a
-    // write and parses them back after a read, so a store — in-memory or
-    // SQL — only ever handles primitives, never schema-aware codecs.
-    supportsBooleans: false,
-    supportsDates: false,
-    supportsJSON: false,
-    supportsNumericIds: false
-  }
-});
-const lunoraD1Adapter = (d1) => lunoraAuthAdapter(createSqlAuthStore(d1Executor(d1)));
-
-export { lunoraAuthAdapter, lunoraD1Adapter };
+import{l as t,a as p,b as e}from"./packem_shared/adapter-CG0Yv85f.mjs";import"./packem_shared/sql-store-CYa4HJsO.mjs";export{t as lunoraAuthAdapter,p as lunoraD1Adapter,e as lunoraDoAdapter};

package/dist/audit.d.mts

@@ -0,0 +1,142 @@
+import { SqlExecutor } from "./sql-store.mjs";
+import "./store.mjs";
+import 'better-auth/adapters';
+/** Reserved append-only table backing the Studio "Security / audit" page. Auto-hidden from the data browser by the `__lunora` prefix. */
+declare const AUTH_AUDIT_TABLE = "__lunora_auth_audit__";
+/**
+ * Well-known auth/security event types. A plain `string` is also accepted so
+ * plugins can record their own events without a union change — the union just
+ * gives autocomplete for the common ones.
+ */
+type AuthAuditEvent = "account-link" | "account-unlink" | "email-verification" | "mfa-disable" | "mfa-enable" | "password-change" | "password-reset" | "session-revoke" | "sign-in" | "sign-in-initiated" | "sign-out" | "sign-up" | "token-refresh" | (string & {});
+/** Whether the recorded operation succeeded or failed (e.g. a rejected sign-in). */
+type AuthAuditOutcome = "failure" | "success";
+/** One recorded auth/security event, in monotonic `seq` order. */
+interface AuthAuditEntry {
+  /** Redaction is applied to `detail`, not this — the actor's email is intentional forensic data. Absent for anonymous/pre-auth events. */
+  actorEmail?: string;
+  /** The acting user's id, when known. */
+  actorId?: string;
+  /** JSON-decoded extra context, with secrets/PII redacted at write time; absent when none was recorded. */
+  detail?: Record<string, unknown>;
+  /** Auth event type, e.g. `sign-in` / `password-change`. */
+  event: string;
+  /** Client IP the event originated from, when resolvable. */
+  ip?: string;
+  /** Whether the operation succeeded or failed. */
+  outcome: AuthAuditOutcome;
+  /** Monotonic per-database cursor — strictly increasing, never reused. */
+  seq: number;
+  /**
+   * The identifier (email or username) a sign-in-family request ATTEMPTED,
+   * read from the request body. Present for both successful and failed
+   * attempts — unlike `actorEmail` (which requires an authenticated
+   * session), this is what lets a FAILED credential-stuffing attempt be
+   * grouped by target. Same redaction exemption as `actorEmail`: a
+   * top-level column, not a `detail` key, because `AUDIT_REDACT_RULES`
+   * scrubs email-shaped values inside `detail` regardless of key name —
+   * putting it there would erase exactly this datum. Length-capped to 320
+   * chars (RFC 5321) since it carries attacker-controlled request-body text.
+   */
+  targetEmail?: string;
+  /** Wall-clock millis when the event was recorded. */
+  ts: number;
+  /** Client User-Agent, when present on the request. */
+  userAgent?: string;
+}
+/** Fields accepted when appending one event; `seq` is assigned by the table. */
+interface AppendAuthAuditEntry {
+  actorEmail?: string;
+  actorId?: string;
+  detail?: Record<string, unknown>;
+  event: string;
+  ip?: string;
+  outcome: AuthAuditOutcome;
+  /** See {@link AuthAuditEntry.targetEmail}. */
+  targetEmail?: string;
+  ts: number;
+  userAgent?: string;
+}
+/** Options for {@link appendAuthAuditEntry}. */
+interface AppendAuthAuditOptions {
+  /**
+   * Redact secrets/PII in the `detail` payload before persisting. Defaults to
+   * `true`. Set `false` only for a trusted, pre-scrubbed payload.
+   */
+  redactDetail?: boolean;
+  /**
+   * Keep only the most recent `retention` rows (trimmed after each append),
+   * mirroring the admin audit log's bounded retention. Omit for an unbounded
+   * trail (the compliance default) — deliberately NOT capped at 1000.
+   */
+  retention?: number;
+}
+/** Options for {@link readAuthAuditLog}. */
+interface ReadAuthAuditOptions {
+  /** Return only events for this actor id. */
+  actorId?: string;
+  /** Return only events of this type. */
+  event?: string;
+  /** Max rows to return, clamped to [1, 10000]. Defaults to 1000. */
+  limit?: number;
+  /**
+   * Return only events with `seq` strictly greater than this. Supplying it
+   * switches the page to oldest-first so the cursor walks forward; omit it for
+   * the newest-first feed.
+   */
+  sinceSeq?: number;
+}
+declare const ensureAuthAuditTable: (executor: SqlExecutor) => Promise<void>;
+/**
+ * Append one auth event, redacting its `detail` payload (unless disabled) and —
+ * when `retention` is set — trimming the log back to the most recent rows.
+ * Creates the table first so callers needn't. Returns the redacted, persisted
+ * entry (sans `seq`) so an export tap can forward exactly what was stored.
+ */
+declare const appendAuthAuditEntry: (executor: SqlExecutor, entry: AppendAuthAuditEntry, options?: AppendAuthAuditOptions) => Promise<AppendAuthAuditEntry>;
+/**
+ * Read audit events, optionally filtered by `actorId` / `event` and paged past
+ * `sinceSeq`, up to `limit` (clamped to [1, 10000]). Parses each row's `detail`
+ * JSON back into an object. Creates the table first so reads on a never-audited
+ * database return `[]` instead of throwing.
+ *
+ * Ordering follows the cursor: **without** `sinceSeq` the page is newest-first
+ * (`seq DESC`) — the feed the studio's Security panel renders. **With**
+ * `sinceSeq` it is oldest-first (`seq ASC`), because a lower bound is a forward
+ * walk: a descending page above the bound would hand back the newest rows and
+ * leave everything between the cursor and them unreachable once the caller
+ * advanced past it.
+ *
+ * `limit` is NaN-safe: a non-finite/non-number value (e.g. a caller passing
+ * `Number.NaN`, or an upstream boundary that failed to reject one) falls back
+ * to {@link DEFAULT_READ_LIMIT} rather than reaching `Math.min`/`Math.max`,
+ * which both propagate `NaN` and would otherwise bind it as the SQL `LIMIT`
+ * parameter. This is the library-level fix; `#readAudit` (`./auth-do`) also
+ * rejects a non-numeric `limit` at the boundary with a 400 — this clamp is the
+ * safety net for every OTHER caller of this function too.
+ */
+declare const readAuthAuditLog: (executor: SqlExecutor, options?: ReadAuthAuditOptions) => Promise<AuthAuditEntry[]>;
+/**
+ * The auth/security audit read plane the runtime's `authAuditReader` option
+ * accepts — a structurally-compatible `{ read }` object the worker calls behind
+ * its admin gate to back the studio's "Security / audit" page
+ * (`__lunora_admin__:getAuthAuditLog`).
+ */
+interface AuthAuditReader {
+  read: (options: ReadAuthAuditOptions) => Promise<AuthAuditEntry[]>;
+}
+/**
+ * Build the reader the runtime's `authAuditReader` option accepts, closing over
+ * the auth D1 `executor` (`d1Executor(env.DB)`) so an admin caller reads the same
+ * `__lunora_auth_audit__` table the hook writes. Filters/paging pass straight
+ * through to {@link readAuthAuditLog} (which clamps `limit`).
+ *
+ * ```ts
+ * export default createWorker({
+ *     authAuditReader: createAuthAuditReader(d1Executor(env.DB)),
+ *     // …
+ * });
+ * ```
+ */
+declare const createAuthAuditReader: (executor: SqlExecutor) => AuthAuditReader;
+export { AUTH_AUDIT_TABLE, type AppendAuthAuditEntry, type AppendAuthAuditOptions, type AuthAuditEntry, type AuthAuditEvent, type AuthAuditOutcome, type AuthAuditReader, type ReadAuthAuditOptions, appendAuthAuditEntry, createAuthAuditReader, ensureAuthAuditTable, readAuthAuditLog };

package/dist/audit.d.ts

@@ -0,0 +1,142 @@
+import { SqlExecutor } from "./sql-store.js";
+import "./store.js";
+import 'better-auth/adapters';
+/** Reserved append-only table backing the Studio "Security / audit" page. Auto-hidden from the data browser by the `__lunora` prefix. */
+declare const AUTH_AUDIT_TABLE = "__lunora_auth_audit__";
+/**
+ * Well-known auth/security event types. A plain `string` is also accepted so
+ * plugins can record their own events without a union change — the union just
+ * gives autocomplete for the common ones.
+ */
+type AuthAuditEvent = "account-link" | "account-unlink" | "email-verification" | "mfa-disable" | "mfa-enable" | "password-change" | "password-reset" | "session-revoke" | "sign-in" | "sign-in-initiated" | "sign-out" | "sign-up" | "token-refresh" | (string & {});
+/** Whether the recorded operation succeeded or failed (e.g. a rejected sign-in). */
+type AuthAuditOutcome = "failure" | "success";
+/** One recorded auth/security event, in monotonic `seq` order. */
+interface AuthAuditEntry {
+  /** Redaction is applied to `detail`, not this — the actor's email is intentional forensic data. Absent for anonymous/pre-auth events. */
+  actorEmail?: string;
+  /** The acting user's id, when known. */
+  actorId?: string;
+  /** JSON-decoded extra context, with secrets/PII redacted at write time; absent when none was recorded. */
+  detail?: Record<string, unknown>;
+  /** Auth event type, e.g. `sign-in` / `password-change`. */
+  event: string;
+  /** Client IP the event originated from, when resolvable. */
+  ip?: string;
+  /** Whether the operation succeeded or failed. */
+  outcome: AuthAuditOutcome;
+  /** Monotonic per-database cursor — strictly increasing, never reused. */
+  seq: number;
+  /**
+   * The identifier (email or username) a sign-in-family request ATTEMPTED,
+   * read from the request body. Present for both successful and failed
+   * attempts — unlike `actorEmail` (which requires an authenticated
+   * session), this is what lets a FAILED credential-stuffing attempt be
+   * grouped by target. Same redaction exemption as `actorEmail`: a
+   * top-level column, not a `detail` key, because `AUDIT_REDACT_RULES`
+   * scrubs email-shaped values inside `detail` regardless of key name —
+   * putting it there would erase exactly this datum. Length-capped to 320
+   * chars (RFC 5321) since it carries attacker-controlled request-body text.
+   */
+  targetEmail?: string;
+  /** Wall-clock millis when the event was recorded. */
+  ts: number;
+  /** Client User-Agent, when present on the request. */
+  userAgent?: string;
+}
+/** Fields accepted when appending one event; `seq` is assigned by the table. */
+interface AppendAuthAuditEntry {
+  actorEmail?: string;
+  actorId?: string;
+  detail?: Record<string, unknown>;
+  event: string;
+  ip?: string;
+  outcome: AuthAuditOutcome;
+  /** See {@link AuthAuditEntry.targetEmail}. */
+  targetEmail?: string;
+  ts: number;
+  userAgent?: string;
+}
+/** Options for {@link appendAuthAuditEntry}. */
+interface AppendAuthAuditOptions {
+  /**
+   * Redact secrets/PII in the `detail` payload before persisting. Defaults to
+   * `true`. Set `false` only for a trusted, pre-scrubbed payload.
+   */
+  redactDetail?: boolean;
+  /**
+   * Keep only the most recent `retention` rows (trimmed after each append),
+   * mirroring the admin audit log's bounded retention. Omit for an unbounded
+   * trail (the compliance default) — deliberately NOT capped at 1000.
+   */
+  retention?: number;
+}
+/** Options for {@link readAuthAuditLog}. */
+interface ReadAuthAuditOptions {
+  /** Return only events for this actor id. */
+  actorId?: string;
+  /** Return only events of this type. */
+  event?: string;
+  /** Max rows to return, clamped to [1, 10000]. Defaults to 1000. */
+  limit?: number;
+  /**
+   * Return only events with `seq` strictly greater than this. Supplying it
+   * switches the page to oldest-first so the cursor walks forward; omit it for
+   * the newest-first feed.
+   */
+  sinceSeq?: number;
+}
+declare const ensureAuthAuditTable: (executor: SqlExecutor) => Promise<void>;
+/**
+ * Append one auth event, redacting its `detail` payload (unless disabled) and —
+ * when `retention` is set — trimming the log back to the most recent rows.
+ * Creates the table first so callers needn't. Returns the redacted, persisted
+ * entry (sans `seq`) so an export tap can forward exactly what was stored.
+ */
+declare const appendAuthAuditEntry: (executor: SqlExecutor, entry: AppendAuthAuditEntry, options?: AppendAuthAuditOptions) => Promise<AppendAuthAuditEntry>;
+/**
+ * Read audit events, optionally filtered by `actorId` / `event` and paged past
+ * `sinceSeq`, up to `limit` (clamped to [1, 10000]). Parses each row's `detail`
+ * JSON back into an object. Creates the table first so reads on a never-audited
+ * database return `[]` instead of throwing.
+ *
+ * Ordering follows the cursor: **without** `sinceSeq` the page is newest-first
+ * (`seq DESC`) — the feed the studio's Security panel renders. **With**
+ * `sinceSeq` it is oldest-first (`seq ASC`), because a lower bound is a forward
+ * walk: a descending page above the bound would hand back the newest rows and
+ * leave everything between the cursor and them unreachable once the caller
+ * advanced past it.
+ *
+ * `limit` is NaN-safe: a non-finite/non-number value (e.g. a caller passing
+ * `Number.NaN`, or an upstream boundary that failed to reject one) falls back
+ * to {@link DEFAULT_READ_LIMIT} rather than reaching `Math.min`/`Math.max`,
+ * which both propagate `NaN` and would otherwise bind it as the SQL `LIMIT`
+ * parameter. This is the library-level fix; `#readAudit` (`./auth-do`) also
+ * rejects a non-numeric `limit` at the boundary with a 400 — this clamp is the
+ * safety net for every OTHER caller of this function too.
+ */
+declare const readAuthAuditLog: (executor: SqlExecutor, options?: ReadAuthAuditOptions) => Promise<AuthAuditEntry[]>;
+/**
+ * The auth/security audit read plane the runtime's `authAuditReader` option
+ * accepts — a structurally-compatible `{ read }` object the worker calls behind
+ * its admin gate to back the studio's "Security / audit" page
+ * (`__lunora_admin__:getAuthAuditLog`).
+ */
+interface AuthAuditReader {
+  read: (options: ReadAuthAuditOptions) => Promise<AuthAuditEntry[]>;
+}
+/**
+ * Build the reader the runtime's `authAuditReader` option accepts, closing over
+ * the auth D1 `executor` (`d1Executor(env.DB)`) so an admin caller reads the same
+ * `__lunora_auth_audit__` table the hook writes. Filters/paging pass straight
+ * through to {@link readAuthAuditLog} (which clamps `limit`).
+ *
+ * ```ts
+ * export default createWorker({
+ *     authAuditReader: createAuthAuditReader(d1Executor(env.DB)),
+ *     // …
+ * });
+ * ```
+ */
+declare const createAuthAuditReader: (executor: SqlExecutor) => AuthAuditReader;
+export { AUTH_AUDIT_TABLE, type AppendAuthAuditEntry, type AppendAuthAuditOptions, type AuthAuditEntry, type AuthAuditEvent, type AuthAuditOutcome, type AuthAuditReader, type ReadAuthAuditOptions, appendAuthAuditEntry, createAuthAuditReader, ensureAuthAuditTable, readAuthAuditLog };

package/dist/audit.mjs

@@ -0,0 +1,12 @@
+import{standardRules as N,piiRules as D,redact as $}from"@visulima/redact";const C=new Set(["auth","authorization","bearer","card","cc","cookie","credential","cvc","cvv","dsn","hmac","hotp","iban","jwt","kek","mnemonic","otp","pass","passcode","passphrase","passwd","password","pem","pin","pwd","salt","secret","session","sid","sig","signature","ssn","token","totp","verifier"]),x=new Set(["card","pass","pin","session"]),U=new Set(["access","api","client","encryption","master","priv","private","secret","signing"]),M=new Set(["2fa","auth","authorization","backup","factor","hotp","mfa","otp","pin","recovery","reset","security","totp","verification","verify"]),z=new Set(["card no","connection string","database url","one time"]),W=["accesskey","apikey","authorization","cookie","credential","mfacode","otpcode","passcode","passphrase","passwd","password","privatekey","secret","secretkey","sessionid","signature","token"],F=new Set(["again","b64","base","base64","bytes","confirm","confirmation","data","digest","encrypted","hash","hashed","header","hex","id","input","key","no","num","number","plain","plaintext","raw","repeat","str","string","text","value"]),G=new Set(["count","counts","length","limit","limits","size","tokens","total","usage"]),X=new Set(["max","min","num","total"]),S=4096,Z=128,j=16384,l="<REDACTED>",P="[redaction budget exceeded]",v=e=>e.replaceAll(/([a-z\d])([A-Z])/g,"$1 $2").replaceAll(/([A-Z]+)([A-Z][a-z])/g,"$1 $2").toLowerCase().split(/[^a-z\d]+/).filter(t=>t.length>0),y=e=>e.length>3&&e.endsWith("s")&&!e.endsWith("ss")?e.slice(0,-1):e,H=(e,t)=>{const n=y(e[t]),s=t>0?y(e[t-1]):void 0;if(C.has(n))return n;if(s!==void 0){if(n==="key"&&U.has(s))return"key";if(n==="code"&&M.has(s))return"code";if(z.has(`${s} ${n}`))return`${s} ${n}`}return W.some(a=>n.endsWith(a))?n:void 0},k=e=>{const t=v(e);if(t.length===0)return"none";const n=G.has(t.at(-1))||X.has(t[0]);for(let s=t.length-1;s>=0;s-=1){const a=H(t,s);if(a!==void 0)return n?"count-secret":t.slice(s+1).every(i=>F.has(i))?x.has(a)&&s===t.length-1?"scalar-secret":"secret":"none"}return"none"},V=e=>typeof e=="boolean"||e===null||e===void 0?e:l,q=e=>{const t=e.indexOf("://")+3,n=e.slice(t),s=n.split(/[?#]/,1)[0],a=s.lastIndexOf("@"),i=s.indexOf(":"),c=s.indexOf("/"),r=i!==-1&&/^\d+$/.test(s.slice(i+1,c===-1?void 0:c)),o=i!==-1&&!r&&(c===-1||i<c);if(a===-1&&o&&n.includes("@",s.length))return e.slice(0,t);const d=a!==-1&&(c===-1||a<c||i!==-1&&i<a&&!r);return`${e.slice(0,t)}${d?s.slice(a+1):s}`},B=/\b[a-z][\d+.a-z-]{1,15}:\/\/[^\s"'<>()[\]{}]+/gi,Y=/-----BEGIN ([A-Z ]{0,32}PRIVATE KEY)-----[\s\S]*?(?:-----END [A-Z ]{0,32}PRIVATE KEY-----|$)/g,K=/\b(Basic|Bearer|Digest)\s+[\w+/=.~-]{4,}/g,R=String.raw`%[\dA-Fa-f]{2}|\\(?:[bfnrt]|u[\dA-Fa-f]{4})`,I=[{body:String.raw`[\dA-Za-z]{10,}`,name:"Stripe secret or restricted key",prefix:String.raw`[rs]k_(?:live|test)_`},{body:String.raw`[\d+/=A-Za-z]{20,}`,name:"Stripe webhook secret",prefix:"whsec_"},{body:String.raw`[\dA-Za-z]{30,}`,name:"GitHub classic token (personal, OAuth, user/server-to-server, refresh)",prefix:"gh[oprsu]_"},{body:String.raw`\w{20,}`,name:"GitHub fine-grained token",prefix:"github_pat_"},{body:String.raw`[\w-]{20,}`,name:"GitLab personal, pipeline-trigger and deploy tokens",prefix:"gl(?:pat|ptt|dt)-"},{body:String.raw`[\dA-Za-z-]{10,}`,name:"Slack token",prefix:"xox[a-eprs]-"},{body:String.raw`\d-[\dA-Za-z-]{10,}`,name:"Slack app-level token",prefix:"xapp-"},{body:String.raw`[\dA-Z]{16}\b`,name:"AWS access-key id, long-lived and temporary",prefix:"(?:AKIA|ASIA)"},{body:String.raw`[\w-]{35}(?![\w-])`,name:"Google API key",prefix:"AIza"},{body:String.raw`[\w-]{24,}`,name:"Google OAuth client secret",prefix:"GOCSPX-"},{body:String.raw`[\w-]{20,}`,name:"Google OAuth access token",prefix:String.raw`ya29\.`},{body:String.raw`[\dA-Za-z]{36}\b`,name:"npm token",prefix:"npm_"},{body:String.raw`[\dA-Za-z]{30,}`,name:"Hugging Face token",prefix:"hf_"},{body:String.raw`[\dA-Fa-f]{32}\b`,name:"Shopify token",prefix:"shp(?:at|ca|pa|ss)_"},{body:String.raw`[\da-f]{64}\b`,name:"DigitalOcean token",prefix:"do[opr]_v1_"},{body:String.raw`[\w-]{20,}`,name:"OpenAI project/service/admin key, Anthropic key",prefix:"sk-(?:admin|ant|proj|svcacct)-"},{body:String.raw`[\dA-Za-z]{20}T3BlbkFJ[\dA-Za-z]{20}\b`,name:"OpenAI legacy key",prefix:"sk-"},{body:String.raw`[\w-]{22}\.[\w-]{43}(?![\w-])`,name:"SendGrid key",prefix:String.raw`SG\.`}],J=String.raw`(?<=^|[^\w-]|${R})eyJ[\w-]{2,}\.[\w-]{2,}\.[\w-]*`,Q=new RegExp([...I.map(({body:e,prefix:t})=>String.raw`(?<=^|[^\dA-Za-z]|${R})${t}${e}`),J].join("|"),"g"),ee=new RegExp([...I.map(({prefix:e})=>e),"eyJ"].join("|")),te=/(\s|^)(-u|--user|--password|--pass|--token|--api-key)(\s+|=)[^\s"']+/g,f=/(?<![\w.-])(\\?["']?)([A-Za-z_][\w.-]{0,63})\1[ \t]{0,4}([:=])[ \t]{0,4}/g,w=/(?:basic|bearer|digest|token)\s+[^\s"&'),;\]}]+|\\"(?:[^"\\\n]|\\[^"])*(?:\\")?|"[^\n"]*"?|'[^\n']*'?|[^\s"&'),;\]}]+/iy,b=/(?:[ \t]+(?![A-Za-z_][\w.-]{0,63}[:=])[^\s,;)\]}]+)*/y,ne=e=>{let t="",n=0;f.lastIndex=0;for(let s=f.exec(e);s!==null;s=f.exec(e)){const a=k(s[2]),i=s.index+s[0].length;w.lastIndex=i;const c=a==="none"?null:w.exec(e);if(c===null||a==="count-secret"&&/^["']?[\d.]+["']?$/.test(c[0])){f.lastIndex=Math.max(i,s.index+1);continue}const r=c[0],o=r.startsWith('\\"')?'\\"':r.startsWith('"')||r.startsWith("'")?r[0]:"";let d=i+r.length;o===""&&s[3]===":"&&(b.lastIndex=d,d+=b.exec(e)?.[0].length??0),t+=`${e.slice(n,i)}${o}${l}${r.length>o.length&&r.endsWith(o)?o:""}`,n=d,f.lastIndex=n}return t+e.slice(n)},se=/[:=@]|basic|bearer|digest|-u\b|--/i,re=e=>{const t=ee.test(e);if(!t&&!se.test(e))return e;const n=e.replaceAll(Y,`-----BEGIN $1-----${l}`).replaceAll(B,q).replaceAll(K,`$1 ${l}`);return ne((t?n.replaceAll(Q,l):n).replaceAll(te,`$1$2$3${l}`))},ae=(e,t)=>{if(t.remaining<=0)return P;const n=e.slice(0,S+Z);t.remaining-=n.length;const s=re(n);return s.length>S||e.length>n.length?`${s.slice(0,S)}…[truncated]`:s},ie=e=>e instanceof Error||e instanceof RegExp||e instanceof Map||e instanceof Set||e instanceof WeakMap||e instanceof WeakSet||e instanceof Promise||e instanceof ArrayBuffer||ArrayBuffer.isView(e),g=Symbol("no-json"),oe=e=>{const{toJSON:t}=e;if(typeof t!="function")return g;try{const n=t.call(e);return n===e?g:n}catch{return g}},ce=32,u=(e,t,n,s,a)=>{if(typeof e=="string")return s?l:ae(e,a);if(typeof e!="object"||e===null||!Array.isArray(e)&&ie(e))return e;if(t.has(e)||n>=ce)return l;const i=Array.isArray(e)?g:oe(e);if(i!==g){t.add(e);const r=u(i,t,n+1,s,a);return t.delete(e),r}t.add(e);const c=Array.isArray(e)?e.map(r=>u(r,t,n+1,s,a)):Object.fromEntries(Object.entries(e).map(([r,o])=>{const d=k(r);return d==="secret"||d==="scalar-secret"&&(typeof o!="object"||o===null)?[r,V(o)]:[r,u(o,t,n+1,d==="count-secret"&&(typeof o=="string"||Array.isArray(o)),a)]}));return t.delete(e),c},de=e=>u(e,new WeakSet,0,!1,{remaining:j}),E="__lunora_auth_audit__",le=[...N,...D],pe=1e3,Ae=1e4,A=null,m=e=>{if(typeof e=="string")return e;if(typeof e=="number"||typeof e=="bigint"||typeof e=="boolean")return String(e)},Ee=async e=>{await e.run(`CREATE TABLE IF NOT EXISTS "${E}" (
+            seq INTEGER PRIMARY KEY AUTOINCREMENT,
+            ts REAL NOT NULL,
+            event TEXT NOT NULL,
+            outcome TEXT NOT NULL,
+            actor_id TEXT,
+            actor_email TEXT,
+            target_email TEXT,
+            ip TEXT,
+            user_agent TEXT,
+            detail TEXT
+        )`,[]);try{await e.run(`ALTER TABLE "${E}" ADD COLUMN target_email TEXT`,[])}catch(t){if(!(t instanceof Error?t.message.toLowerCase():String(t).toLowerCase()).includes("duplicate column"))throw t}},_=new WeakMap,L=e=>{const t=_.get(e);if(t)return t;const n=Ee(e);return _.set(e,n),n.catch(()=>_.delete(e)),n},ue=async(e,t,n={})=>{await L(e);let s;return t.detail!==void 0&&(s=n.redactDetail===!1?t.detail:$(de(t.detail),le)),await e.run(`INSERT INTO "${E}" (ts, event, outcome, actor_id, actor_email, target_email, ip, user_agent, detail) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,[t.ts,t.event,t.outcome,t.actorId??A,t.actorEmail??A,t.targetEmail??A,t.ip??A,t.userAgent??A,s===void 0?A:JSON.stringify(s)]),typeof n.retention=="number"&&n.retention>0&&await e.run(`DELETE FROM "${E}" WHERE seq <= (SELECT MAX(seq) - ? FROM "${E}")`,[n.retention]),{...t,detail:s}},fe=async(e,t={})=>{await L(e);const n=Number.isFinite(t.limit)?Math.max(1,Math.min(t.limit,Ae)):pe,s=["seq > ?"],a=[t.sinceSeq??0],i=t.sinceSeq===void 0?"DESC":"ASC";return t.actorId!==void 0&&(s.push("actor_id = ?"),a.push(t.actorId)),t.event!==void 0&&(s.push("event = ?"),a.push(t.event)),a.push(n),(await e.all(`SELECT seq, ts, event, outcome, actor_id, actor_email, target_email, ip, user_agent, detail FROM "${E}" WHERE ${s.join(" AND ")} ORDER BY seq ${i} LIMIT ?`,a)).map(r=>{const o={event:m(r.event)??"",outcome:r.outcome==="failure"?"failure":"success",seq:Number(r.seq),ts:Number(r.ts)},d=[["actorId","actor_id"],["actorEmail","actor_email"],["targetEmail","target_email"],["ip","ip"],["userAgent","user_agent"]];for(const[p,O]of d){const T=m(r[O]);T!==void 0&&(o[p]=T)}const h=m(r.detail);if(h!==void 0)try{const p=JSON.parse(h);typeof p=="object"&&p!==null&&!Array.isArray(p)&&(o.detail=p)}catch{}return o})},Se=e=>({read:t=>fe(e,t)});export{E as AUTH_AUDIT_TABLE,ue as appendAuthAuditEntry,Se as createAuthAuditReader,L as ensureAuthAuditTable,fe as readAuthAuditLog};

package/dist/cimd-node.d.mts

@@ -0,0 +1 @@
+export { fetchClientMetadataResource as default } from '@better-auth/cimd/node';

package/dist/cimd-node.d.ts

@@ -0,0 +1 @@
+export { fetchClientMetadataResource as default } from '@better-auth/cimd/node';

package/dist/cimd-node.mjs

@@ -0,0 +1 @@
+import{fetchClientMetadataResource as a}from"@better-auth/cimd/node";export{a as default};

package/dist/cimd-workers.d.mts

@@ -0,0 +1,32 @@
+import { ClientMetadataResourceFetch } from '@better-auth/oauth-provider';
+/**
+ * Build the `fetchClientMetadataResource` transport for `cimd()` on Cloudflare
+ * Workers.
+ *
+ * ```ts
+ * import { cimd, jwt, mcp } from "@lunora/auth/plugins";
+ * import workersCimdFetch from "@lunora/auth/cimd/workers";
+ *
+ * plugins: [
+ *     jwt(),
+ *     mcp({ … }),
+ *     cimd({
+ *         fetchClientMetadataResource: workersCimdFetch(),
+ *         metadataProfile: "mcp-2026-07-28",
+ *         isMetadataDocumentUrlAllowed: (url) => new URL(url).origin === "https://claude.ai",
+ *         // The allowlist gates only the `client_id` fetch; bind `jwks_uri` to it too.
+ *         originBoundFields: ["post_logout_redirect_uris", "client_uri", "jwks_uri"],
+ *     }),
+ * ];
+ * ```
+ *
+ * The returned transport only issues `GET` / `HEAD` to `https:` URLs without
+ * credentials, and never follows a redirect: it fetches with `redirect: "manual"`
+ * (workerd does not implement `"error"`) and throws on any redirect status, which
+ * cimd reports as `invalid_client`. A `304` from a conditional revalidation passes
+ * through.
+ * @throws LunoraError `AUTH_CIMD_FETCH_NOT_PUBLIC` when the Worker runs without the
+ * `global_fetch_strictly_public` compatibility flag.
+ */
+declare const workersCimdFetch: () => ClientMetadataResourceFetch;
+export { workersCimdFetch as default };

package/dist/cimd-workers.d.ts

@@ -0,0 +1,32 @@
+import { ClientMetadataResourceFetch } from '@better-auth/oauth-provider';
+/**
+ * Build the `fetchClientMetadataResource` transport for `cimd()` on Cloudflare
+ * Workers.
+ *
+ * ```ts
+ * import { cimd, jwt, mcp } from "@lunora/auth/plugins";
+ * import workersCimdFetch from "@lunora/auth/cimd/workers";
+ *
+ * plugins: [
+ *     jwt(),
+ *     mcp({ … }),
+ *     cimd({
+ *         fetchClientMetadataResource: workersCimdFetch(),
+ *         metadataProfile: "mcp-2026-07-28",
+ *         isMetadataDocumentUrlAllowed: (url) => new URL(url).origin === "https://claude.ai",
+ *         // The allowlist gates only the `client_id` fetch; bind `jwks_uri` to it too.
+ *         originBoundFields: ["post_logout_redirect_uris", "client_uri", "jwks_uri"],
+ *     }),
+ * ];
+ * ```
+ *
+ * The returned transport only issues `GET` / `HEAD` to `https:` URLs without
+ * credentials, and never follows a redirect: it fetches with `redirect: "manual"`
+ * (workerd does not implement `"error"`) and throws on any redirect status, which
+ * cimd reports as `invalid_client`. A `304` from a conditional revalidation passes
+ * through.
+ * @throws LunoraError `AUTH_CIMD_FETCH_NOT_PUBLIC` when the Worker runs without the
+ * `global_fetch_strictly_public` compatibility flag.
+ */
+declare const workersCimdFetch: () => ClientMetadataResourceFetch;
+export { workersCimdFetch as default };

package/dist/cimd-workers.mjs

@@ -0,0 +1 @@
+import{LunoraError as c}from"@lunora/errors";const a="global_fetch_strictly_public",i=()=>{const{Cloudflare:t}=globalThis;return t?.compatibilityFlags?.[a]===!0},n=new Set([301,302,303,307,308]),l=t=>n.has(t.status)||t.type==="opaqueredirect",d=()=>{if(!i())throw new c("AUTH_CIMD_FETCH_NOT_PUBLIC",`CIMD needs the "${a}" compatibility flag, so metadata fetches cannot reach private addresses. Add it to "compatibility_flags" in wrangler.jsonc.`);return async(t,s)=>{const e=new Request(t,{...s,redirect:"manual"}),r=new URL(e.url);if(r.protocol!=="https:")throw new TypeError(`refusing to fetch a client metadata resource over ${r.protocol}`);if(r.username!==""||r.password!=="")throw new TypeError("refusing to fetch a client metadata resource URL that carries credentials");if(e.method!=="GET"&&e.method!=="HEAD")throw new TypeError(`refusing to ${e.method} a client metadata resource`);const o=await fetch(e);if(l(o))throw new TypeError("client metadata resource fetches must not follow redirects");return o}};export{d as default};