@lunora/auth 1.0.0-alpha.32 → 1.0.0-alpha.34

package/dist/packem_shared/create-auth.d-Mwhb4gSc.d.mts

@@ -1,128 +0,0 @@
-import { betterAuth, BetterAuthOptions } from 'better-auth';
-/**
-* Lunora's options pass straight through to better-auth — the only thing we add
-* is requiring `secret` up front so a misconfigured deployment fails loudly
-* instead of at the first sign-in.
-*
-* For `database`, prefer `lunoraD1Adapter` (`database: lunoraD1Adapter(env.DB)`)
-* over passing the raw `env.DB`. better-auth *does* accept a D1Database directly,
-* but it then resolves its Kysely adapter via a runtime `await import(...)` inside
-* `auth.$context` — and that import never settles under `@cloudflare/vite-plugin`'s
-* worker runner, hanging every auth request in `pnpm dev`. The explicit adapter
-* skips it, so dev and prod behave the same. (Raw `env.DB` is still correct for
-* the migration-only instance — see `lunoraD1Adapter`'s note.)
-*
-* Session rotation / richer session policies are configured via the `session`
-* field (a `SessionPolicy`); Lunora validates it for obviously-broken
-* durations and forwards it verbatim to better-auth. See `sessionPresets`
-* for ready-made rotation/expiry trade-offs.
-*
-* ## Serverless background tasks (Cloudflare Workers)
-*
-* better-auth runs some work *after* sending the response — most importantly the
-* password-reset email, whose background send is what keeps reset responses
-* constant-time (a timing-attack defence: the response doesn't reveal whether
-* the account exists). On Cloudflare Workers a promise that isn't handed to
-* `ctx.waitUntil` can be cancelled the moment the response returns, dropping
-* that send and weakening the guarantee. Wire your request's `ctx.waitUntil`
-* into better-auth's background handler so the work survives:
-*
-* ```ts
-* // in your worker fetch handler, where `ctx: ExecutionContext` is in scope
-* const auth = createAuth({
-*     secret: env.AUTH_SECRET,
-*     database: lunoraD1Adapter(env.DB),
-*     advanced: {
-*         backgroundTasks: { handler: (promise) => ctx.waitUntil(promise) },
-*     },
-* });
-* ```
-*
-* (Lunora can't set this for you — `ctx.waitUntil` is per-request, but
-* `createAuth` runs once at worker setup.)
-*/
-type LunoraAuthOptions = BetterAuthOptions;
-/**
-* The full better-auth instance: `auth.handler` accepts a `Request` and
-* returns a `Response` (used by `handleAuthRequest`); `auth.api`
-* exposes the typed endpoint surface for server-side calls (e.g.
-* `auth.api.getSession({ headers })` inside a query/mutation).
-*/
-type LunoraAuth = ReturnType<typeof betterAuth>;
-/**
-* Resolve the caller's options into the exact shape `createAuth` hands to
-* `betterAuth` — the hardened, default-filled options the running worker uses.
-* Exported (and pure) so the migration path can compile the schema from the
-* same resolved options: `compileMigrationsSql` routes through here, so the
-* `rateLimit` table the worker's durable limiter writes to is included in the
-* migration rather than silently omitted (it would be, if migrations saw the
-* raw options while the worker ran the resolved ones).
-*
-* ## What it fills (each gated independently on caller silence)
-*
-* Secure-by-default cookies + secret-strength warning via {@link hardenAuthOptions},
-* applied first so all hardening composes onto one options object.
-*
-* Rate limiting is ON by default for `/api/auth/*`.
-*
-* better-auth's own default is `rateLimit.enabled ?? isProduction`, and its
-* `isProduction` is `"development" === "production"` resolved at
-* module-load time. On Cloudflare Workers that check is unreliable: the
-* runtime has no Node `process.env` (absent entirely without
-* `nodejs_compat`, and even with it `NODE_ENV` is rarely `"production"` at
-* request time). So better-auth would silently leave auth endpoints
-* _unthrottled_ on a real deployment — the surprise we refuse to ship.
-*
-* We therefore default `enabled: true` whenever the caller hasn't made an
-* explicit choice. We only fill the `enabled` flag and otherwise forward
-* the caller's `rateLimit` verbatim, so better-auth's `window` (10s) / `max`
-* (100) defaults and any custom rules still apply. Callers who genuinely
-* want it off can pass `rateLimit: { enabled: false }` (e.g. when fronting
-* auth with their own limiter), and any explicit `enabled` value wins.
-*
-* We also default `storage: "database"` — but only when rate limiting is not
-* explicitly disabled (`enabled !== false`). Filling storage under a disabled
-* limiter is harmless at runtime but makes `getAuthTables` emit an unused
-* `rateLimit` table, so we skip it there.
-*
-* better-auth's own default is `storage: "memory"` — a per-isolate,
-* non-durable counter. On Cloudflare Workers that means each isolate keeps
-* its own tally, counters vanish on isolate recycle, and traffic spread
-* across isolates never sums to the configured `max` — a limiter that
-* reports "enabled" while never enforcing a global limit (the exact
-* brute-force / credential-stuffing protection on `/sign-in`, OTP, and
-* password-reset it is meant to buy). `storage: "database"` rides the counter
-* through the configured `database` adapter — Lunora's store over the D1 auth
-* tables — so the limit is durable *and* atomic (the store's native
-* `incrementOne` gives a one-winner guarantee across isolates). Callers with
-* their own durable store can pass an explicit `rateLimit: { storage: … }`
-* (or `customStorage`), and any explicit value wins.
-*
-* Session cookie cache is ON by default too.
-*
-* Every authenticated call resolves identity through better-auth's
-* `getSession`, which — without a cache — is a DB (D1) read on the hot path
-* of every query/mutation/action that reads `ctx.auth` and of the WebSocket
-* upgrade. better-auth's `session.cookieCache` carries the session payload in
-* a short-lived signed cookie so `getSession` can answer without hitting the
-* database until the cache window elapses. We default it on with a
-* deliberately short 60s `maxAge` (better-auth's own default is 300s): long
-* enough to erase the per-request read for a burst of calls, short enough
-* that a revoked or role-changed session self-corrects within a minute.
-* The one tradeoff — a revoked session stays valid until the cache expires —
-* is bounded by that TTL; callers who need immediate revocation opt out with
-* `session: { cookieCache: { enabled: false } }` (or the `strict` preset).
-*
-* Every explicit caller value is forwarded verbatim. The two `rateLimit` fills
-* merge into a single `rateLimit` object so neither clobbers the other.
-*/
-declare const resolveAuthOptions: (options: LunoraAuthOptions) => LunoraAuthOptions;
-/**
-* Create the auth instance. Thin wrapper around `betterAuth` that enforces
-* the `secret` requirement at construction time so misconfigured deployments
-* fail loudly at the first fetch rather than the first sign-in attempt, then
-* hands {@link resolveAuthOptions}'s hardened, default-filled options to
-* better-auth.
-*/
-declare const createAuth: (options: LunoraAuthOptions) => LunoraAuth;
-export { LunoraAuth as L, LunoraAuthOptions as a, createAuth as c, resolveAuthOptions as r };

package/dist/packem_shared/create-auth.d-Mwhb4gSc.d.ts

@@ -1,128 +0,0 @@
-import { betterAuth, BetterAuthOptions } from 'better-auth';
-/**
-* Lunora's options pass straight through to better-auth — the only thing we add
-* is requiring `secret` up front so a misconfigured deployment fails loudly
-* instead of at the first sign-in.
-*
-* For `database`, prefer `lunoraD1Adapter` (`database: lunoraD1Adapter(env.DB)`)
-* over passing the raw `env.DB`. better-auth *does* accept a D1Database directly,
-* but it then resolves its Kysely adapter via a runtime `await import(...)` inside
-* `auth.$context` — and that import never settles under `@cloudflare/vite-plugin`'s
-* worker runner, hanging every auth request in `pnpm dev`. The explicit adapter
-* skips it, so dev and prod behave the same. (Raw `env.DB` is still correct for
-* the migration-only instance — see `lunoraD1Adapter`'s note.)
-*
-* Session rotation / richer session policies are configured via the `session`
-* field (a `SessionPolicy`); Lunora validates it for obviously-broken
-* durations and forwards it verbatim to better-auth. See `sessionPresets`
-* for ready-made rotation/expiry trade-offs.
-*
-* ## Serverless background tasks (Cloudflare Workers)
-*
-* better-auth runs some work *after* sending the response — most importantly the
-* password-reset email, whose background send is what keeps reset responses
-* constant-time (a timing-attack defence: the response doesn't reveal whether
-* the account exists). On Cloudflare Workers a promise that isn't handed to
-* `ctx.waitUntil` can be cancelled the moment the response returns, dropping
-* that send and weakening the guarantee. Wire your request's `ctx.waitUntil`
-* into better-auth's background handler so the work survives:
-*
-* ```ts
-* // in your worker fetch handler, where `ctx: ExecutionContext` is in scope
-* const auth = createAuth({
-*     secret: env.AUTH_SECRET,
-*     database: lunoraD1Adapter(env.DB),
-*     advanced: {
-*         backgroundTasks: { handler: (promise) => ctx.waitUntil(promise) },
-*     },
-* });
-* ```
-*
-* (Lunora can't set this for you — `ctx.waitUntil` is per-request, but
-* `createAuth` runs once at worker setup.)
-*/
-type LunoraAuthOptions = BetterAuthOptions;
-/**
-* The full better-auth instance: `auth.handler` accepts a `Request` and
-* returns a `Response` (used by `handleAuthRequest`); `auth.api`
-* exposes the typed endpoint surface for server-side calls (e.g.
-* `auth.api.getSession({ headers })` inside a query/mutation).
-*/
-type LunoraAuth = ReturnType<typeof betterAuth>;
-/**
-* Resolve the caller's options into the exact shape `createAuth` hands to
-* `betterAuth` — the hardened, default-filled options the running worker uses.
-* Exported (and pure) so the migration path can compile the schema from the
-* same resolved options: `compileMigrationsSql` routes through here, so the
-* `rateLimit` table the worker's durable limiter writes to is included in the
-* migration rather than silently omitted (it would be, if migrations saw the
-* raw options while the worker ran the resolved ones).
-*
-* ## What it fills (each gated independently on caller silence)
-*
-* Secure-by-default cookies + secret-strength warning via {@link hardenAuthOptions},
-* applied first so all hardening composes onto one options object.
-*
-* Rate limiting is ON by default for `/api/auth/*`.
-*
-* better-auth's own default is `rateLimit.enabled ?? isProduction`, and its
-* `isProduction` is `"development" === "production"` resolved at
-* module-load time. On Cloudflare Workers that check is unreliable: the
-* runtime has no Node `process.env` (absent entirely without
-* `nodejs_compat`, and even with it `NODE_ENV` is rarely `"production"` at
-* request time). So better-auth would silently leave auth endpoints
-* _unthrottled_ on a real deployment — the surprise we refuse to ship.
-*
-* We therefore default `enabled: true` whenever the caller hasn't made an
-* explicit choice. We only fill the `enabled` flag and otherwise forward
-* the caller's `rateLimit` verbatim, so better-auth's `window` (10s) / `max`
-* (100) defaults and any custom rules still apply. Callers who genuinely
-* want it off can pass `rateLimit: { enabled: false }` (e.g. when fronting
-* auth with their own limiter), and any explicit `enabled` value wins.
-*
-* We also default `storage: "database"` — but only when rate limiting is not
-* explicitly disabled (`enabled !== false`). Filling storage under a disabled
-* limiter is harmless at runtime but makes `getAuthTables` emit an unused
-* `rateLimit` table, so we skip it there.
-*
-* better-auth's own default is `storage: "memory"` — a per-isolate,
-* non-durable counter. On Cloudflare Workers that means each isolate keeps
-* its own tally, counters vanish on isolate recycle, and traffic spread
-* across isolates never sums to the configured `max` — a limiter that
-* reports "enabled" while never enforcing a global limit (the exact
-* brute-force / credential-stuffing protection on `/sign-in`, OTP, and
-* password-reset it is meant to buy). `storage: "database"` rides the counter
-* through the configured `database` adapter — Lunora's store over the D1 auth
-* tables — so the limit is durable *and* atomic (the store's native
-* `incrementOne` gives a one-winner guarantee across isolates). Callers with
-* their own durable store can pass an explicit `rateLimit: { storage: … }`
-* (or `customStorage`), and any explicit value wins.
-*
-* Session cookie cache is ON by default too.
-*
-* Every authenticated call resolves identity through better-auth's
-* `getSession`, which — without a cache — is a DB (D1) read on the hot path
-* of every query/mutation/action that reads `ctx.auth` and of the WebSocket
-* upgrade. better-auth's `session.cookieCache` carries the session payload in
-* a short-lived signed cookie so `getSession` can answer without hitting the
-* database until the cache window elapses. We default it on with a
-* deliberately short 60s `maxAge` (better-auth's own default is 300s): long
-* enough to erase the per-request read for a burst of calls, short enough
-* that a revoked or role-changed session self-corrects within a minute.
-* The one tradeoff — a revoked session stays valid until the cache expires —
-* is bounded by that TTL; callers who need immediate revocation opt out with
-* `session: { cookieCache: { enabled: false } }` (or the `strict` preset).
-*
-* Every explicit caller value is forwarded verbatim. The two `rateLimit` fills
-* merge into a single `rateLimit` object so neither clobbers the other.
-*/
-declare const resolveAuthOptions: (options: LunoraAuthOptions) => LunoraAuthOptions;
-/**
-* Create the auth instance. Thin wrapper around `betterAuth` that enforces
-* the `secret` requirement at construction time so misconfigured deployments
-* fail loudly at the first fetch rather than the first sign-in attempt, then
-* hands {@link resolveAuthOptions}'s hardened, default-filled options to
-* better-auth.
-*/
-declare const createAuth: (options: LunoraAuthOptions) => LunoraAuth;
-export { LunoraAuth as L, LunoraAuthOptions as a, createAuth as c, resolveAuthOptions as r };