@lunora/auth 1.0.0-alpha.37 → 1.0.0-alpha.39

package/dist/packem_shared/LunoraAuthAdminError-CReJPMkx.mjs

@@ -1,513 +0,0 @@
-import { LunoraError } from '@lunora/errors';
-import { getAuthTables } from 'better-auth/db';
-
-class LunoraAuthAdminError extends LunoraError {
-  constructor(message, code) {
-    super(code, message, { name: "LunoraAuthAdminError" });
-  }
-}
-const DEFAULT_LIMIT = 50;
-const MAX_LIMIT = 500;
-const DEFAULT_IMPERSONATION_SECONDS = 3600;
-const MAX_IMPERSONATION_SECONDS = DEFAULT_IMPERSONATION_SECONDS * 24;
-const MAX_BAN_SECONDS = 100 * 365 * 24 * 60 * 60;
-const INVITATION_TTL_MS = 48 * 60 * 60 * 1e3;
-const SENSITIVE_FIELDS = /* @__PURE__ */ new Set(["accessToken", "backupCodes", "idToken", "password", "publicKey", "refreshToken", "secret", "token"]);
-const clampLimit = (limit) => Math.min(Math.max(Math.trunc(limit ?? DEFAULT_LIMIT), 1), MAX_LIMIT);
-const clampOffset = (offset) => Math.max(0, Math.trunc(offset ?? 0));
-const normalizeRow = (row) => {
-  const out = {};
-  for (const [key, value] of Object.entries(row)) {
-    if (SENSITIVE_FIELDS.has(key)) {
-      continue;
-    }
-    out[key] = value instanceof Date ? value.getTime() : value;
-  }
-  return out;
-};
-const serializeRole = (role) => Array.isArray(role) ? role.join(",") : role;
-const slugify = (value) => value.toLowerCase().replaceAll(/[^\da-z]+/g, "-").replaceAll(/^-|-$/g, "");
-const CORE_USER_FIELDS = /* @__PURE__ */ new Set(["banExpires", "banned", "banReason", "createdAt", "email", "emailVerified", "id", "name", "role", "updatedAt"]);
-const USER_FIELD_PLUGIN = {
-  displayUsername: "username",
-  phoneNumber: "phone-number",
-  phoneNumberVerified: "phone-number",
-  username: "username"
-};
-const mapUserFieldType = (type) => {
-  if (type === "boolean") {
-    return "boolean";
-  }
-  if (type === "date") {
-    return "date";
-  }
-  if (type === "number") {
-    return "number";
-  }
-  return "string";
-};
-const buildUserFields = (userFields) => {
-  const out = [];
-  for (const [name, attribute] of Object.entries(userFields)) {
-    if (attribute.input === false || attribute.references !== void 0 || CORE_USER_FIELDS.has(name)) {
-      continue;
-    }
-    out.push({
-      name,
-      plugin: USER_FIELD_PLUGIN[name],
-      required: attribute.required === true,
-      type: mapUserFieldType(attribute.type),
-      unique: attribute.unique === true
-    });
-  }
-  return out;
-};
-const asAdminError = (error) => {
-  if (error instanceof LunoraAuthAdminError) {
-    return error;
-  }
-  const candidate = error;
-  const code = candidate?.body?.code ?? candidate?.code ?? "AUTH_ADMIN_ERROR";
-  const message = candidate?.body?.message ?? candidate?.message ?? "auth admin operation failed";
-  return new LunoraAuthAdminError(message, code);
-};
-const createAuthAdmin = (auth, options = {}) => {
-  const context = auth.$context;
-  const features = options.features ?? {};
-  const deriveCapabilities = (authOptions) => {
-    const ids = new Set((authOptions.plugins ?? []).map((plugin) => plugin.id));
-    const has = (id) => ids.has(id);
-    return {
-      accounts: features.accounts ?? true,
-      admin: features.admin ?? has("admin"),
-      organization: features.organization ?? has("organization"),
-      passkey: features.passkey ?? has("passkey"),
-      twoFactor: features.twoFactor ?? has("two-factor")
-    };
-  };
-  const withContext = async (function_) => {
-    try {
-      return await function_(await context);
-    } catch (error) {
-      throw asAdminError(error);
-    }
-  };
-  const toUser = (row) => normalizeRow(row);
-  const page = async (context_, model, options_) => {
-    const where = options_.where && options_.where.length > 0 ? options_.where : void 0;
-    const [rows, total] = await Promise.all([
-      context_.adapter.findMany({
-        limit: clampLimit(options_.limit),
-        model,
-        offset: clampOffset(options_.offset),
-        sortBy: options_.sortBy,
-        where
-      }),
-      context_.adapter.count({ model, where })
-    ]);
-    return { rows: rows.map((row) => normalizeRow(row)), total };
-  };
-  return {
-    banUser: ({ expiresInSeconds, reason, userId }) => withContext(async (context_) => {
-      let banExpires = null;
-      if (expiresInSeconds !== void 0) {
-        if (!Number.isInteger(expiresInSeconds) || expiresInSeconds <= 0) {
-          throw new LunoraAuthAdminError("expiresInSeconds must be a positive finite integer", "INVALID_BAN_SECONDS");
-        }
-        const seconds = Math.min(expiresInSeconds, MAX_BAN_SECONDS);
-        banExpires = new Date(Date.now() + seconds * 1e3);
-      }
-      const user = await context_.internalAdapter.updateUser(userId, {
-        // `null` (not `undefined`) for a permanent ban so the adapter clears any prior
-        // `banExpires` rather than skipping it — otherwise a temp-ban-then-permanent-ban
-        // escalation leaves the old expiry and the "permanent" ban silently lapses.
-        banExpires,
-        banned: true,
-        banReason: reason ?? "No reason"
-      });
-      await context_.internalAdapter.deleteUserSessions(userId);
-      return toUser(user);
-    }),
-    cancelInvitation: ({ invitationId }) => withContext(async (context_) => {
-      await context_.adapter.delete({ model: "invitation", where: [{ field: "id", value: invitationId }] });
-    }),
-    capabilities: () => withContext((context_) => Promise.resolve(deriveCapabilities(context_.options))),
-    // ── Directly add an existing user to an org (no invitation/acceptance). ──
-    addMember: ({ organizationId, role, userId }) => withContext(async (context_) => {
-      const member = await context_.adapter.create({
-        data: { createdAt: /* @__PURE__ */ new Date(), organizationId, role: role === void 0 || role === "" ? "member" : role, userId },
-        model: "member"
-      });
-      return normalizeRow(member);
-    }),
-    addTeamMember: ({ teamId, userId }) => withContext(async (context_) => {
-      const teamMember = await context_.adapter.create({
-        data: { createdAt: /* @__PURE__ */ new Date(), teamId, userId },
-        model: "teamMember"
-      });
-      return normalizeRow(teamMember);
-    }),
-    // Rich introspection for the config panel + dynamic create-user form. Reads
-    // only from the resolved better-auth options (no DB, no secrets).
-    config: () => withContext((context_) => {
-      const authOptions = context_.options;
-      const capabilities = deriveCapabilities(authOptions);
-      const ids = new Set((authOptions.plugins ?? []).map((plugin) => plugin.id));
-      const tables = getAuthTables(authOptions);
-      const session = authOptions.session ?? {};
-      const rateLimit = authOptions.rateLimit ?? {};
-      return Promise.resolve({
-        capabilities,
-        emailAndPassword: authOptions.emailAndPassword?.enabled ?? false,
-        organization: {
-          enabled: capabilities.organization,
-          roles: Boolean(tables["organizationRole"]),
-          teams: Boolean(tables["team"])
-        },
-        plugins: [...ids].toSorted((a, b) => a.localeCompare(b)),
-        rateLimit: { enabled: rateLimit.enabled ?? false, max: rateLimit.max, window: rateLimit.window },
-        session: {
-          cookieCache: session.cookieCache?.enabled,
-          expiresIn: session.expiresIn,
-          freshAge: session.freshAge,
-          updateAge: session.updateAge
-        },
-        socialProviders: Object.keys(authOptions.socialProviders ?? {}).toSorted((a, b) => a.localeCompare(b)),
-        userFields: buildUserFields(tables["user"]?.fields ?? {})
-      });
-    }),
-    createOrganization: ({ logo, metadata, name, ownerId, slug }) => withContext(async (context_) => {
-      const finalSlug = slug !== void 0 && slug !== "" ? slugify(slug) : slugify(name);
-      if (finalSlug === "") {
-        throw new LunoraAuthAdminError("could not derive a slug from the organization name", "ORG_SLUG_INVALID");
-      }
-      const existing = await context_.adapter.findOne({
-        model: "organization",
-        where: [{ field: "slug", value: finalSlug }]
-      });
-      if (existing) {
-        throw new LunoraAuthAdminError("an organization with this slug already exists", "ORG_SLUG_TAKEN");
-      }
-      const organization = await context_.adapter.create({
-        data: {
-          createdAt: /* @__PURE__ */ new Date(),
-          logo: logo === void 0 || logo === "" ? void 0 : logo,
-          metadata: metadata === void 0 ? void 0 : JSON.stringify(metadata),
-          name,
-          slug: finalSlug
-        },
-        model: "organization"
-      });
-      if (ownerId !== void 0 && ownerId !== "") {
-        await context_.adapter.create({
-          data: { createdAt: /* @__PURE__ */ new Date(), organizationId: organization.id, role: "owner", userId: ownerId },
-          model: "member"
-        });
-      }
-      return normalizeRow(organization);
-    }),
-    createOrgRole: ({ organizationId, permission, role }) => withContext(async (context_) => {
-      const created = await context_.adapter.create({
-        data: { createdAt: /* @__PURE__ */ new Date(), organizationId, permission: JSON.stringify(permission), role },
-        model: "organizationRole"
-      });
-      return normalizeRow(created);
-    }),
-    createTeam: ({ name, organizationId }) => withContext(async (context_) => {
-      const team = await context_.adapter.create({
-        data: { createdAt: /* @__PURE__ */ new Date(), name, organizationId },
-        model: "team"
-      });
-      return normalizeRow(team);
-    }),
-    deleteOrganization: ({ organizationId }) => withContext(async (context_) => {
-      const tables = getAuthTables(context_.options);
-      await context_.adapter.deleteMany({ model: "member", where: [{ field: "organizationId", value: organizationId }] });
-      await context_.adapter.deleteMany({ model: "invitation", where: [{ field: "organizationId", value: organizationId }] });
-      if (tables["team"]) {
-        const teams = await context_.adapter.findMany({
-          model: "team",
-          where: [{ field: "organizationId", value: organizationId }]
-        });
-        for (const team of teams) {
-          await context_.adapter.deleteMany({ model: "teamMember", where: [{ field: "teamId", value: team.id }] });
-        }
-        await context_.adapter.deleteMany({ model: "team", where: [{ field: "organizationId", value: organizationId }] });
-      }
-      if (tables["organizationRole"]) {
-        await context_.adapter.deleteMany({ model: "organizationRole", where: [{ field: "organizationId", value: organizationId }] });
-      }
-      await context_.adapter.delete({ model: "organization", where: [{ field: "id", value: organizationId }] });
-    }),
-    deleteOrgRole: ({ roleId }) => withContext(async (context_) => {
-      await context_.adapter.delete({ model: "organizationRole", where: [{ field: "id", value: roleId }] });
-    }),
-    // Create a pending email invitation. `inviterId` is DB-required; when the
-    // caller omits it, attribute the invite to the org's owner (else any member).
-    inviteMember: ({ email, inviterId, organizationId, role }) => withContext(async (context_) => {
-      let resolvedInviter = inviterId;
-      if (resolvedInviter === void 0 || resolvedInviter === "") {
-        const members = await context_.adapter.findMany({
-          model: "member",
-          where: [{ field: "organizationId", value: organizationId }]
-        });
-        const owner = members.find((member) => typeof member.role === "string" && member.role.includes("owner"));
-        resolvedInviter = (owner ?? members[0])?.userId;
-      }
-      if (resolvedInviter === void 0 || resolvedInviter === "") {
-        throw new LunoraAuthAdminError("provide an inviter — the organization has no members to attribute the invitation to", "INVITER_REQUIRED");
-      }
-      const invitation = await context_.adapter.create({
-        data: {
-          createdAt: /* @__PURE__ */ new Date(),
-          email: email.toLowerCase(),
-          expiresAt: new Date(Date.now() + INVITATION_TTL_MS),
-          inviterId: resolvedInviter,
-          organizationId,
-          role: role === void 0 || role === "" ? "member" : role,
-          status: "pending"
-        },
-        model: "invitation"
-      });
-      return normalizeRow(invitation);
-    }),
-    listOrgRoles: ({ limit, offset, organizationId }) => withContext(
-      (context_) => page(context_, "organizationRole", {
-        limit,
-        offset,
-        sortBy: { direction: "desc", field: "createdAt" },
-        where: [{ field: "organizationId", value: organizationId }]
-      })
-    ),
-    listTeamMembers: ({ limit, offset, teamId }) => withContext(
-      (context_) => page(context_, "teamMember", {
-        limit,
-        offset,
-        where: [{ field: "teamId", value: teamId }]
-      })
-    ),
-    listTeams: ({ limit, offset, organizationId }) => withContext(
-      (context_) => page(context_, "team", {
-        limit,
-        offset,
-        sortBy: { direction: "desc", field: "createdAt" },
-        where: [{ field: "organizationId", value: organizationId }]
-      })
-    ),
-    removeTeam: ({ teamId }) => withContext(async (context_) => {
-      await context_.adapter.deleteMany({ model: "teamMember", where: [{ field: "teamId", value: teamId }] });
-      await context_.adapter.delete({ model: "team", where: [{ field: "id", value: teamId }] });
-    }),
-    removeTeamMember: ({ teamMemberId }) => withContext(async (context_) => {
-      await context_.adapter.delete({ model: "teamMember", where: [{ field: "id", value: teamMemberId }] });
-    }),
-    updateMemberRole: ({ memberId, role }) => withContext(async (context_) => {
-      const member = await context_.adapter.update({
-        model: "member",
-        update: { role: serializeRole(role) },
-        where: [{ field: "id", value: memberId }]
-      });
-      return normalizeRow(member ?? { id: memberId, role: serializeRole(role) });
-    }),
-    updateOrganization: ({ logo, metadata, name, organizationId, slug }) => withContext(async (context_) => {
-      const update = {};
-      if (name !== void 0) {
-        update["name"] = name;
-      }
-      if (slug !== void 0 && slug !== "") {
-        update["slug"] = slugify(slug);
-      }
-      if (logo !== void 0) {
-        update["logo"] = logo === "" ? void 0 : logo;
-      }
-      if (metadata !== void 0) {
-        update["metadata"] = JSON.stringify(metadata);
-      }
-      if (Object.keys(update).length === 0) {
-        return normalizeRow({ id: organizationId });
-      }
-      const organization = await context_.adapter.update({
-        model: "organization",
-        update,
-        where: [{ field: "id", value: organizationId }]
-      });
-      return normalizeRow(organization ?? { id: organizationId });
-    }),
-    updateOrgRole: ({ permission, roleId }) => withContext(async (context_) => {
-      const updated = await context_.adapter.update({
-        model: "organizationRole",
-        update: { permission: JSON.stringify(permission), updatedAt: /* @__PURE__ */ new Date() },
-        where: [{ field: "id", value: roleId }]
-      });
-      return normalizeRow(updated ?? { id: roleId, permission: JSON.stringify(permission) });
-    }),
-    updateTeam: ({ name, teamId }) => withContext(async (context_) => {
-      const team = await context_.adapter.update({
-        model: "team",
-        update: { name, updatedAt: /* @__PURE__ */ new Date() },
-        where: [{ field: "id", value: teamId }]
-      });
-      return normalizeRow(team ?? { id: teamId, name });
-    }),
-    // The one op that genuinely builds a row rather than mutating one. Replicates
-    // the plugin's create-user handler over `internalAdapter` (lowercase + dedupe
-    // email, create the row, then link a credential account when a password is given).
-    createUser: ({ data, email, name, password, role }) => withContext(async (context_) => {
-      const normalizedEmail = email.toLowerCase();
-      if (await context_.internalAdapter.findUserByEmail(normalizedEmail)) {
-        throw new LunoraAuthAdminError("a user with this email already exists", "USER_ALREADY_EXISTS");
-      }
-      const user = await context_.internalAdapter.createUser({
-        email: normalizedEmail,
-        name,
-        role: role === void 0 ? void 0 : serializeRole(role),
-        ...data
-      });
-      if (password !== void 0 && password !== "") {
-        const hashed = await context_.password.hash(password);
-        await context_.internalAdapter.linkAccount({
-          accountId: user.id,
-          password: hashed,
-          providerId: "credential",
-          userId: user.id
-        });
-      }
-      return toUser(user);
-    }),
-    deletePasskey: ({ passkeyId }) => withContext(async (context_) => {
-      await context_.adapter.delete({ model: "passkey", where: [{ field: "id", value: passkeyId }] });
-    }),
-    disableTwoFactor: ({ userId }) => withContext(async (context_) => {
-      await context_.adapter.deleteMany({ model: "twoFactor", where: [{ field: "userId", value: userId }] });
-      await context_.internalAdapter.updateUser(userId, { twoFactorEnabled: false });
-    }),
-    impersonateUser: ({ userId }) => withContext(async (context_) => {
-      const user = await context_.internalAdapter.findUserById(userId);
-      if (!user) {
-        throw new LunoraAuthAdminError("user not found", "USER_NOT_FOUND");
-      }
-      const rawSeconds = options.impersonationSeconds;
-      let ttlSeconds = DEFAULT_IMPERSONATION_SECONDS;
-      if (rawSeconds !== void 0) {
-        if (!Number.isInteger(rawSeconds) || !Number.isFinite(rawSeconds) || rawSeconds <= 0) {
-          throw new LunoraAuthAdminError("impersonationSeconds must be a positive finite integer", "INVALID_IMPERSONATION_SECONDS");
-        }
-        ttlSeconds = Math.min(rawSeconds, MAX_IMPERSONATION_SECONDS);
-      }
-      const expiresAt = new Date(Date.now() + ttlSeconds * 1e3);
-      const session = await context_.internalAdapter.createSession(
-        userId,
-        true,
-        { expiresAt, impersonatedBy: options.impersonatedBy ?? userId },
-        true
-      );
-      return {
-        expiresAt: session.expiresAt instanceof Date ? session.expiresAt.getTime() : expiresAt.getTime(),
-        token: session.token,
-        user: toUser(user)
-      };
-    }),
-    listAccounts: ({ userId }) => withContext(async (context_) => {
-      const rows = await context_.adapter.findMany({ model: "account", where: [{ field: "userId", value: userId }] });
-      return rows.map((row) => normalizeRow(row));
-    }),
-    listInvitations: ({ limit, offset, organizationId }) => withContext(
-      (context_) => page(context_, "invitation", {
-        limit,
-        offset,
-        where: [{ field: "organizationId", value: organizationId }]
-      })
-    ),
-    listMembers: ({ limit, offset, organizationId }) => withContext(
-      (context_) => page(context_, "member", {
-        limit,
-        offset,
-        sortBy: { direction: "desc", field: "createdAt" },
-        where: [{ field: "organizationId", value: organizationId }]
-      })
-    ),
-    listOrganizations: ({ limit, offset }) => withContext((context_) => page(context_, "organization", { limit, offset, sortBy: { direction: "desc", field: "createdAt" } })),
-    listPasskeys: ({ userId }) => withContext(async (context_) => {
-      const rows = await context_.adapter.findMany({ model: "passkey", where: [{ field: "userId", value: userId }] });
-      return rows.map((row) => normalizeRow(row));
-    }),
-    listSessions: ({ limit, offset, userId }) => withContext(
-      (context_) => page(context_, "session", {
-        limit,
-        offset,
-        sortBy: { direction: "desc", field: "createdAt" },
-        where: userId === void 0 || userId === "" ? void 0 : [{ field: "userId", value: userId }]
-      })
-    ),
-    listUsers: ({ filterField, filterValue, limit, offset, search, searchField, sortBy, sortDirection }) => withContext((context_) => {
-      const where = [];
-      if (search !== void 0 && search !== "") {
-        where.push({ field: searchField ?? "email", operator: "contains", value: search });
-      }
-      if (filterValue !== void 0) {
-        where.push({ field: filterField ?? "email", operator: "eq", value: filterValue });
-      }
-      return page(context_, "user", {
-        limit,
-        offset,
-        sortBy: { direction: sortDirection ?? "desc", field: sortBy ?? "createdAt" },
-        where
-      });
-    }),
-    removeMember: ({ memberId }) => withContext(async (context_) => {
-      await context_.adapter.delete({ model: "member", where: [{ field: "id", value: memberId }] });
-    }),
-    removeUser: ({ userId }) => withContext(async (context_) => {
-      await context_.internalAdapter.deleteUserSessions(userId);
-      await context_.internalAdapter.deleteUser(userId);
-    }),
-    // Keyed on the session *id*, not its token: tokens are bearer credentials we
-    // deliberately never surface to the studio. Resolve the row to recover its
-    // token, then delete via `internalAdapter.deleteSession` — which also clears
-    // secondary (KV) storage, unlike a raw `adapter.delete` on the DB row.
-    revokeUserSession: ({ sessionId }) => withContext(async (context_) => {
-      const session = await context_.adapter.findOne({ model: "session", where: [{ field: "id", value: sessionId }] });
-      if (session?.token) {
-        await context_.internalAdapter.deleteSession(session.token);
-      }
-    }),
-    revokeUserSessions: ({ userId }) => withContext(async (context_) => {
-      await context_.internalAdapter.deleteUserSessions(userId);
-    }),
-    setRole: ({ role, userId }) => withContext(async (context_) => {
-      const user = await context_.internalAdapter.updateUser(userId, { role: serializeRole(role) });
-      return toUser(user);
-    }),
-    setUserPassword: ({ newPassword, userId }) => withContext(async (context_) => {
-      const min = context_.password.config.minPasswordLength;
-      const max = context_.password.config.maxPasswordLength;
-      if (newPassword.length < min) {
-        throw new LunoraAuthAdminError(`password must be at least ${min.toString()} characters`, "PASSWORD_TOO_SHORT");
-      }
-      if (newPassword.length > max) {
-        throw new LunoraAuthAdminError(`password must be at most ${max.toString()} characters`, "PASSWORD_TOO_LONG");
-      }
-      const hashed = await context_.password.hash(newPassword);
-      await context_.internalAdapter.updatePassword(userId, hashed);
-    }),
-    unbanUser: ({ userId }) => withContext(async (context_) => {
-      const user = await context_.internalAdapter.updateUser(userId, { banExpires: null, banned: false, banReason: null });
-      return toUser(user);
-    }),
-    unlinkAccount: ({ accountId, userId }) => withContext(async (context_) => {
-      await context_.adapter.delete({
-        model: "account",
-        where: [
-          { field: "id", value: accountId },
-          { connector: "AND", field: "userId", value: userId }
-        ]
-      });
-    }),
-    updateUser: ({ data, userId }) => withContext(async (context_) => {
-      const user = await context_.internalAdapter.updateUser(userId, data);
-      return toUser(user);
-    })
-  };
-};
-
-export { LunoraAuthAdminError, createAuthAdmin };

package/dist/packem_shared/authAuditHook-3OJKhpQV.mjs

@@ -1,119 +0,0 @@
-import { createAuthMiddleware } from 'better-auth/api';
-import { appendAuthAuditEntry } from '../audit.mjs';
-
-const eventForPath = (path) => {
-  const normalized = path.toLowerCase();
-  const ends = (suffix) => normalized === suffix || normalized.endsWith(suffix);
-  if (ends("/sign-up/email") || ends("/sign-up")) {
-    return "sign-up";
-  }
-  if (normalized.includes("/sign-in/")) {
-    return "sign-in";
-  }
-  if (ends("/sign-out")) {
-    return "sign-out";
-  }
-  if (ends("/change-password") || ends("/set-password")) {
-    return "password-change";
-  }
-  if (ends("/reset-password") || ends("/request-password-reset") || ends("/forget-password")) {
-    return "password-reset";
-  }
-  if (ends("/verify-email")) {
-    return "email-verification";
-  }
-  if (normalized.includes("/two-factor/enable") || normalized.includes("/totp/enable")) {
-    return "mfa-enable";
-  }
-  if (normalized.includes("/two-factor/disable") || normalized.includes("/totp/disable")) {
-    return "mfa-disable";
-  }
-  if (ends("/refresh-token") || ends("/token")) {
-    return "token-refresh";
-  }
-  if (ends("/revoke-session") || ends("/revoke-sessions") || ends("/revoke-other-sessions")) {
-    return "session-revoke";
-  }
-  if (ends("/link-social")) {
-    return "account-link";
-  }
-  if (ends("/unlink-account")) {
-    return "account-unlink";
-  }
-  return void 0;
-};
-const header = (context, name) => {
-  const value = context.headers?.get(name) ?? context.request?.headers.get(name);
-  return value ?? void 0;
-};
-const resolveIp = (context) => {
-  const forwarded = header(context, "x-forwarded-for");
-  return header(context, "cf-connecting-ip") ?? (forwarded === void 0 ? void 0 : forwarded.split(",")[0]?.trim()) ?? header(context, "x-real-ip");
-};
-const resolveActor = (context) => {
-  const source = context.context?.newSession ?? context.context?.session;
-  const actorId = source?.user?.id ?? source?.session?.userId;
-  const actorEmail = source?.user?.email;
-  return {
-    ...actorId === void 0 ? {} : { actorId },
-    ...actorEmail === void 0 ? {} : { actorEmail }
-  };
-};
-const resolveOutcome = (context) => {
-  const returned = context.context?.returned;
-  if (returned instanceof Error) {
-    return "failure";
-  }
-  if (typeof returned === "object" && returned !== null && "status" in returned) {
-    const status = Number(returned.status);
-    if (Number.isFinite(status) && status >= 400) {
-      return "failure";
-    }
-  }
-  return "success";
-};
-const buildAuditEntry = (context, now = Date.now()) => {
-  const event = context.path === void 0 ? void 0 : eventForPath(context.path);
-  if (event === void 0) {
-    return void 0;
-  }
-  const ip = resolveIp(context);
-  const userAgent = header(context, "user-agent");
-  return {
-    ...resolveActor(context),
-    event,
-    outcome: resolveOutcome(context),
-    ts: now,
-    ...ip === void 0 ? {} : { ip },
-    ...userAgent === void 0 ? {} : { userAgent },
-    detail: { path: context.path }
-  };
-};
-const authAuditHook = (config) => createAuthMiddleware(async (context) => {
-  try {
-    const entry = buildAuditEntry(context);
-    if (entry !== void 0) {
-      const persisted = await appendAuthAuditEntry(config.executor, entry, {
-        redactDetail: config.redactDetail,
-        retention: config.retention
-      });
-      if (config.onRecord !== void 0) {
-        await config.onRecord(persisted);
-      }
-    }
-  } catch (error) {
-    console.error("@lunora/auth: audit hook failed to record event", error);
-  }
-  return {};
-});
-const withAuthAudit = (options, config) => {
-  const audit = authAuditHook(config);
-  const existing = options.hooks?.after;
-  const after = existing ? async (context) => {
-    await existing(context);
-    return audit(context);
-  } : audit;
-  return { ...options, hooks: { ...options.hooks, after } };
-};
-
-export { authAuditHook, buildAuditEntry, eventForPath, withAuthAudit };

package/dist/packem_shared/compileMigrationsSql-Dl5N8z5q.mjs

@@ -1,29 +0,0 @@
-import { getMigrations } from 'better-auth/db/migration';
-import { resolveAuthOptions } from './createAuth-s4i7WhAh.mjs';
-
-const migrating = /* @__PURE__ */ new WeakMap();
-const ensureMigrated = async (auth) => {
-  const { options } = auth;
-  const inFlight = migrating.get(options);
-  if (inFlight) {
-    await inFlight;
-    return;
-  }
-  const run = (async () => {
-    const { runMigrations } = await getMigrations(options);
-    await runMigrations();
-  })();
-  migrating.set(options, run);
-  try {
-    await run;
-  } catch (error) {
-    migrating.delete(options);
-    throw error;
-  }
-};
-const compileMigrationsSql = async (options) => {
-  const { compileMigrations } = await getMigrations(resolveAuthOptions(options));
-  return compileMigrations();
-};
-
-export { compileMigrationsSql, ensureMigrated };