@lunora/auth 1.0.0-alpha.4 → 1.0.0-alpha.41

package/dist/turnstile.mjs

@@ -1,61 +1 @@
-const TURNSTILE_VERIFY_ENDPOINT = "https://challenges.cloudflare.com/turnstile/v0/siteverify";
-const asString = (value) => typeof value === "string" ? value : void 0;
-const asStringArray = (value) => Array.isArray(value) ? value.filter((entry) => typeof entry === "string") : [];
-const verifyTurnstile = async ({
-  expectedAction,
-  expectedHostname,
-  fetch = globalThis.fetch,
-  remoteip,
-  secret,
-  token
-}) => {
-  const body = new URLSearchParams({ response: token, secret });
-  if (remoteip !== void 0 && remoteip !== "") {
-    body.set("remoteip", remoteip);
-  }
-  let response;
-  try {
-    response = await fetch(TURNSTILE_VERIFY_ENDPOINT, {
-      body: body.toString(),
-      headers: { "content-type": "application/x-www-form-urlencoded" },
-      method: "POST"
-    });
-  } catch (error) {
-    throw Object.assign(new Error("turnstile siteverify request failed"), {
-      cause: error,
-      code: "SERVICE_UNAVAILABLE",
-      name: "LunoraError",
-      status: 503
-    });
-  }
-  if (!response.ok) {
-    throw Object.assign(new Error(`turnstile siteverify returned ${String(response.status)}`), {
-      code: "SERVICE_UNAVAILABLE",
-      name: "LunoraError",
-      status: 503
-    });
-  }
-  const raw = await response.json();
-  const action = asString(raw.action);
-  const hostname = asString(raw.hostname);
-  const errorCodes = asStringArray(raw["error-codes"]);
-  let success = raw.success === true;
-  if (success && expectedHostname !== void 0 && hostname !== expectedHostname) {
-    success = false;
-    errorCodes.push("hostname-mismatch");
-  }
-  if (success && expectedAction !== void 0 && action !== expectedAction) {
-    success = false;
-    errorCodes.push("action-mismatch");
-  }
-  return {
-    action,
-    cdata: asString(raw.cdata),
-    challengeTs: asString(raw.challenge_ts),
-    errorCodes,
-    hostname,
-    success
-  };
-};
-
-export { TURNSTILE_VERIFY_ENDPOINT, verifyTurnstile };
+import{LunoraError as l}from"@lunora/errors";const y="https://challenges.cloudflare.com/turnstile/v0/siteverify",o=t=>typeof t=="string"?t:void 0,w=t=>Array.isArray(t)?t.filter(r=>typeof r=="string"):[],A=async({expectedAction:t,expectedHostname:r,fetch:f=globalThis.fetch,remoteip:n,secret:m,token:p})=>{const h=new URLSearchParams({response:p,secret:m});n!==void 0&&n!==""&&h.set("remoteip",n);let a;try{a=await f(y,{body:h.toString(),headers:{"content-type":"application/x-www-form-urlencoded"},method:"POST"})}catch(c){throw new l("SERVICE_UNAVAILABLE","turnstile siteverify request failed",{cause:c,status:503})}if(!a.ok)throw new l("SERVICE_UNAVAILABLE",`turnstile siteverify returned ${String(a.status)}`,{status:503});let e;try{e=await a.json()}catch(c){throw new l("SERVICE_UNAVAILABLE","turnstile siteverify returned a non-JSON body",{cause:c,status:503})}const u=o(e.action),d=o(e.hostname),i=w(e["error-codes"]);let s=e.success===!0;return s&&r!==void 0&&d!==r&&(s=!1,i.push("hostname-mismatch")),s&&t!==void 0&&u!==t&&(s=!1,i.push("action-mismatch")),{action:u,cdata:o(e.cdata),challengeTs:o(e.challenge_ts),errorCodes:i,hostname:d,success:s}};export{y as TURNSTILE_VERIFY_ENDPOINT,A as verifyTurnstile};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/auth",
-  "version": "1.0.0-alpha.4",
+  "version": "1.0.0-alpha.41",
   "description": "Auth for Lunora — a thin better-auth wrapper: email/password, OAuth, plugins, D1-backed",
   "keywords": [
     "auth",
@@ -25,7 +25,7 @@
     "directory": "packages/auth"
   },
   "files": [
-    "dist",
+    "./dist",
     "__assets__",
     "README.md",
     "LICENSE.md"
@@ -52,6 +52,14 @@
       "types": "./dist/middleware.d.ts",
       "import": "./dist/middleware.mjs"
     },
+    "./audit": {
+      "types": "./dist/audit.d.ts",
+      "import": "./dist/audit.mjs"
+    },
+    "./email-guard": {
+      "types": "./dist/email-guard.d.ts",
+      "import": "./dist/email-guard.mjs"
+    },
     "./turnstile": {
       "types": "./dist/turnstile.d.ts",
       "import": "./dist/turnstile.mjs"
@@ -82,10 +90,15 @@
     "access": "public"
   },
   "dependencies": {
-    "@better-auth/passkey": "^1.6.19",
-    "@lunora/server": "1.0.0-alpha.3",
-    "@lunora/values": "1.0.0-alpha.2",
-    "better-auth": "^1.6.19"
+    "@better-auth/passkey": "1.6.23",
+    "@lunora/errors": "1.0.0-alpha.8",
+    "@lunora/server": "1.0.0-alpha.35",
+    "@lunora/values": "1.0.0-alpha.11",
+    "@visulima/disposable-email-domains": "1.0.1",
+    "@visulima/email-verifier": "1.0.1",
+    "@visulima/free-email-domains": "1.0.0",
+    "@visulima/redact": "3.0.0",
+    "better-auth": "1.6.23"
   },
   "engines": {
     "node": "^22.15.0 || >=24.11.0"

package/dist/packem_shared/DEFAULT_AUTH_BASE_PATH-DjcUWEQl.mjs

@@ -1,11 +0,0 @@
-const DEFAULT_AUTH_BASE_PATH = "/api/auth";
-const handleAuthRequest = async (auth, request, basePath = DEFAULT_AUTH_BASE_PATH) => {
-  const url = new URL(request.url);
-  const base = basePath.endsWith("/") ? basePath.slice(0, -1) : basePath;
-  if (url.pathname !== base && !url.pathname.startsWith(`${base}/`)) {
-    return void 0;
-  }
-  return auth.handler(request);
-};
-
-export { DEFAULT_AUTH_BASE_PATH, handleAuthRequest };

package/dist/packem_shared/LunoraAuthAdminError-BxrfEeA_.mjs

@@ -1,249 +0,0 @@
-class LunoraAuthAdminError extends Error {
-  code;
-  constructor(message, code) {
-    super(message);
-    this.name = "LunoraAuthAdminError";
-    this.code = code;
-  }
-}
-const DEFAULT_LIMIT = 50;
-const MAX_LIMIT = 500;
-const DEFAULT_IMPERSONATION_SECONDS = 3600;
-const MAX_IMPERSONATION_SECONDS = DEFAULT_IMPERSONATION_SECONDS * 24;
-const MAX_BAN_SECONDS = 100 * 365 * 24 * 60 * 60;
-const SENSITIVE_FIELDS = /* @__PURE__ */ new Set(["accessToken", "backupCodes", "idToken", "password", "publicKey", "refreshToken", "secret", "token"]);
-const clampLimit = (limit) => Math.min(Math.max(Math.trunc(limit ?? DEFAULT_LIMIT), 1), MAX_LIMIT);
-const clampOffset = (offset) => Math.max(0, Math.trunc(offset ?? 0));
-const normalizeRow = (row) => {
-  const out = {};
-  for (const [key, value] of Object.entries(row)) {
-    if (SENSITIVE_FIELDS.has(key)) {
-      continue;
-    }
-    out[key] = value instanceof Date ? value.getTime() : value;
-  }
-  return out;
-};
-const serializeRole = (role) => Array.isArray(role) ? role.join(",") : role;
-const asAdminError = (error) => {
-  if (error instanceof LunoraAuthAdminError) {
-    return error;
-  }
-  const candidate = error;
-  const code = candidate?.body?.code ?? candidate?.code ?? "AUTH_ADMIN_ERROR";
-  const message = candidate?.body?.message ?? candidate?.message ?? "auth admin operation failed";
-  return new LunoraAuthAdminError(message, code);
-};
-const createAuthAdmin = (auth, options = {}) => {
-  const context = auth.$context;
-  const features = options.features ?? {};
-  const withContext = async (function_) => {
-    try {
-      return await function_(await context);
-    } catch (error) {
-      throw asAdminError(error);
-    }
-  };
-  const toUser = (row) => normalizeRow(row);
-  const page = async (context_, model, options_) => {
-    const where = options_.where && options_.where.length > 0 ? options_.where : void 0;
-    const [rows, total] = await Promise.all([
-      context_.adapter.findMany({
-        limit: clampLimit(options_.limit),
-        model,
-        offset: clampOffset(options_.offset),
-        sortBy: options_.sortBy,
-        where
-      }),
-      context_.adapter.count({ model, where })
-    ]);
-    return { rows: rows.map((row) => normalizeRow(row)), total };
-  };
-  return {
-    banUser: ({ expiresInSeconds, reason, userId }) => withContext(async (context_) => {
-      const seconds = typeof expiresInSeconds === "number" && Number.isFinite(expiresInSeconds) ? Math.min(Math.trunc(expiresInSeconds), MAX_BAN_SECONDS) : 0;
-      const banExpires = seconds > 0 ? new Date(Date.now() + seconds * 1e3) : void 0;
-      const user = await context_.internalAdapter.updateUser(userId, {
-        banExpires,
-        banned: true,
-        banReason: reason ?? "No reason"
-      });
-      await context_.internalAdapter.deleteUserSessions(userId);
-      return toUser(user);
-    }),
-    cancelInvitation: ({ invitationId }) => withContext(async (context_) => {
-      await context_.adapter.delete({ model: "invitation", where: [{ field: "id", value: invitationId }] });
-    }),
-    capabilities: () => withContext((context_) => {
-      const ids = new Set((context_.options.plugins ?? []).map((plugin) => plugin.id));
-      const has = (id) => ids.has(id);
-      return Promise.resolve({
-        accounts: features.accounts ?? true,
-        admin: features.admin ?? has("admin"),
-        organization: features.organization ?? has("organization"),
-        passkey: features.passkey ?? has("passkey"),
-        twoFactor: features.twoFactor ?? has("two-factor")
-      });
-    }),
-    // The one op that genuinely builds a row rather than mutating one. Replicates
-    // the plugin's create-user handler over `internalAdapter` (lowercase + dedupe
-    // email, create the row, then link a credential account when a password is given).
-    createUser: ({ data, email, name, password, role }) => withContext(async (context_) => {
-      const normalizedEmail = email.toLowerCase();
-      if (await context_.internalAdapter.findUserByEmail(normalizedEmail)) {
-        throw new LunoraAuthAdminError("a user with this email already exists", "USER_ALREADY_EXISTS");
-      }
-      const user = await context_.internalAdapter.createUser({
-        email: normalizedEmail,
-        name,
-        role: role === void 0 ? void 0 : serializeRole(role),
-        ...data
-      });
-      if (password !== void 0 && password !== "") {
-        const hashed = await context_.password.hash(password);
-        await context_.internalAdapter.linkAccount({
-          accountId: user.id,
-          password: hashed,
-          providerId: "credential",
-          userId: user.id
-        });
-      }
-      return toUser(user);
-    }),
-    deletePasskey: ({ passkeyId }) => withContext(async (context_) => {
-      await context_.adapter.delete({ model: "passkey", where: [{ field: "id", value: passkeyId }] });
-    }),
-    disableTwoFactor: ({ userId }) => withContext(async (context_) => {
-      await context_.adapter.deleteMany({ model: "twoFactor", where: [{ field: "userId", value: userId }] });
-      await context_.internalAdapter.updateUser(userId, { twoFactorEnabled: false });
-    }),
-    impersonateUser: ({ userId }) => withContext(async (context_) => {
-      const user = await context_.internalAdapter.findUserById(userId);
-      if (!user) {
-        throw new LunoraAuthAdminError("user not found", "USER_NOT_FOUND");
-      }
-      const rawSeconds = options.impersonationSeconds;
-      let ttlSeconds = DEFAULT_IMPERSONATION_SECONDS;
-      if (rawSeconds !== void 0) {
-        if (!Number.isInteger(rawSeconds) || !Number.isFinite(rawSeconds) || rawSeconds <= 0) {
-          throw new LunoraAuthAdminError("impersonationSeconds must be a positive finite integer", "INVALID_IMPERSONATION_SECONDS");
-        }
-        ttlSeconds = Math.min(rawSeconds, MAX_IMPERSONATION_SECONDS);
-      }
-      const expiresAt = new Date(Date.now() + ttlSeconds * 1e3);
-      const session = await context_.internalAdapter.createSession(
-        userId,
-        true,
-        { expiresAt, impersonatedBy: options.impersonatedBy ?? userId },
-        true
-      );
-      return {
-        expiresAt: session.expiresAt instanceof Date ? session.expiresAt.getTime() : expiresAt.getTime(),
-        token: session.token,
-        user: toUser(user)
-      };
-    }),
-    listAccounts: ({ userId }) => withContext(async (context_) => {
-      const rows = await context_.adapter.findMany({ model: "account", where: [{ field: "userId", value: userId }] });
-      return rows.map((row) => normalizeRow(row));
-    }),
-    listInvitations: ({ limit, offset, organizationId }) => withContext(
-      (context_) => page(context_, "invitation", {
-        limit,
-        offset,
-        where: [{ field: "organizationId", value: organizationId }]
-      })
-    ),
-    listMembers: ({ limit, offset, organizationId }) => withContext(
-      (context_) => page(context_, "member", {
-        limit,
-        offset,
-        sortBy: { direction: "desc", field: "createdAt" },
-        where: [{ field: "organizationId", value: organizationId }]
-      })
-    ),
-    listOrganizations: ({ limit, offset }) => withContext((context_) => page(context_, "organization", { limit, offset, sortBy: { direction: "desc", field: "createdAt" } })),
-    listPasskeys: ({ userId }) => withContext(async (context_) => {
-      const rows = await context_.adapter.findMany({ model: "passkey", where: [{ field: "userId", value: userId }] });
-      return rows.map((row) => normalizeRow(row));
-    }),
-    listSessions: ({ limit, offset, userId }) => withContext(
-      (context_) => page(context_, "session", {
-        limit,
-        offset,
-        sortBy: { direction: "desc", field: "createdAt" },
-        where: userId === void 0 || userId === "" ? void 0 : [{ field: "userId", value: userId }]
-      })
-    ),
-    listUsers: ({ filterField, filterValue, limit, offset, search, searchField, sortBy, sortDirection }) => withContext((context_) => {
-      const where = [];
-      if (search !== void 0 && search !== "") {
-        where.push({ field: searchField ?? "email", operator: "contains", value: search });
-      }
-      if (filterValue !== void 0) {
-        where.push({ field: filterField ?? "email", operator: "eq", value: filterValue });
-      }
-      return page(context_, "user", {
-        limit,
-        offset,
-        sortBy: { direction: sortDirection ?? "desc", field: sortBy ?? "createdAt" },
-        where
-      });
-    }),
-    removeMember: ({ memberId }) => withContext(async (context_) => {
-      await context_.adapter.delete({ model: "member", where: [{ field: "id", value: memberId }] });
-    }),
-    removeUser: ({ userId }) => withContext(async (context_) => {
-      await context_.internalAdapter.deleteUserSessions(userId);
-      await context_.internalAdapter.deleteUser(userId);
-    }),
-    // Keyed on the session *id*, not its token: tokens are bearer credentials we
-    // deliberately never surface to the studio. Resolve the row to recover its
-    // token, then delete via `internalAdapter.deleteSession` — which also clears
-    // secondary (KV) storage, unlike a raw `adapter.delete` on the DB row.
-    revokeUserSession: ({ sessionId }) => withContext(async (context_) => {
-      const session = await context_.adapter.findOne({ model: "session", where: [{ field: "id", value: sessionId }] });
-      if (session?.token) {
-        await context_.internalAdapter.deleteSession(session.token);
-      }
-    }),
-    revokeUserSessions: ({ userId }) => withContext(async (context_) => {
-      await context_.internalAdapter.deleteUserSessions(userId);
-    }),
-    setRole: ({ role, userId }) => withContext(async (context_) => {
-      const user = await context_.internalAdapter.updateUser(userId, { role: serializeRole(role) });
-      return toUser(user);
-    }),
-    setUserPassword: ({ newPassword, userId }) => withContext(async (context_) => {
-      const min = context_.password.config.minPasswordLength;
-      const max = context_.password.config.maxPasswordLength;
-      if (newPassword.length < min) {
-        throw new LunoraAuthAdminError(`password must be at least ${min.toString()} characters`, "PASSWORD_TOO_SHORT");
-      }
-      if (newPassword.length > max) {
-        throw new LunoraAuthAdminError(`password must be at most ${max.toString()} characters`, "PASSWORD_TOO_LONG");
-      }
-      const hashed = await context_.password.hash(newPassword);
-      await context_.internalAdapter.updatePassword(userId, hashed);
-    }),
-    unbanUser: ({ userId }) => withContext(async (context_) => {
-      const user = await context_.internalAdapter.updateUser(userId, { banExpires: null, banned: false, banReason: null });
-      return toUser(user);
-    }),
-    unlinkAccount: ({ accountId, userId }) => withContext(async (context_) => {
-      await context_.adapter.delete({
-        model: "account",
-        where: [
-          { field: "id", value: accountId },
-          { connector: "AND", field: "userId", value: userId }
-        ]
-      });
-    }),
-    updateUser: ({ data, userId }) => withContext(async (context_) => {
-      const user = await context_.internalAdapter.updateUser(userId, data);
-      return toUser(user);
-    })
-  };
-};
-
-export { LunoraAuthAdminError, createAuthAdmin };

package/dist/packem_shared/compileMigrationsSql-wZH3oXDu.mjs

@@ -1,28 +0,0 @@
-import { getMigrations } from 'better-auth/db/migration';
-
-const migrating = /* @__PURE__ */ new WeakMap();
-const ensureMigrated = async (auth) => {
-  const { options } = auth;
-  const inFlight = migrating.get(options);
-  if (inFlight) {
-    await inFlight;
-    return;
-  }
-  const run = (async () => {
-    const { runMigrations } = await getMigrations(options);
-    await runMigrations();
-  })();
-  migrating.set(options, run);
-  try {
-    await run;
-  } catch (error) {
-    migrating.delete(options);
-    throw error;
-  }
-};
-const compileMigrationsSql = async (options) => {
-  const { compileMigrations } = await getMigrations(options);
-  return compileMigrations();
-};
-
-export { compileMigrationsSql, ensureMigrated };

package/dist/packem_shared/create-auth.d-M36jwG_Y.d.mts

@@ -1,58 +0,0 @@
-import { betterAuth, BetterAuthOptions } from 'better-auth';
-/**
-* Lunora's options pass straight through to better-auth — the only thing we add
-* is requiring `secret` up front so a misconfigured deployment fails loudly
-* instead of at the first sign-in.
-*
-* For `database`, prefer `lunoraD1Adapter` (`database: lunoraD1Adapter(env.DB)`)
-* over passing the raw `env.DB`. better-auth *does* accept a D1Database directly,
-* but it then resolves its Kysely adapter via a runtime `await import(...)` inside
-* `auth.$context` — and that import never settles under `@cloudflare/vite-plugin`'s
-* worker runner, hanging every auth request in `pnpm dev`. The explicit adapter
-* skips it, so dev and prod behave the same. (Raw `env.DB` is still correct for
-* the migration-only instance — see `lunoraD1Adapter`'s note.)
-*
-* Session rotation / richer session policies are configured via the `session`
-* field (a `SessionPolicy`); Lunora validates it for obviously-broken
-* durations and forwards it verbatim to better-auth. See `sessionPresets`
-* for ready-made rotation/expiry trade-offs.
-*
-* ## Serverless background tasks (Cloudflare Workers)
-*
-* better-auth runs some work *after* sending the response — most importantly the
-* password-reset email, whose background send is what keeps reset responses
-* constant-time (a timing-attack defence: the response doesn't reveal whether
-* the account exists). On Cloudflare Workers a promise that isn't handed to
-* `ctx.waitUntil` can be cancelled the moment the response returns, dropping
-* that send and weakening the guarantee. Wire your request's `ctx.waitUntil`
-* into better-auth's background handler so the work survives:
-*
-* ```ts
-* // in your worker fetch handler, where `ctx: ExecutionContext` is in scope
-* const auth = createAuth({
-*     secret: env.AUTH_SECRET,
-*     database: lunoraD1Adapter(env.DB),
-*     advanced: {
-*         backgroundTasks: { handler: (promise) => ctx.waitUntil(promise) },
-*     },
-* });
-* ```
-*
-* (Lunora can't set this for you — `ctx.waitUntil` is per-request, but
-* `createAuth` runs once at worker setup.)
-*/
-type LunoraAuthOptions = BetterAuthOptions;
-/**
-* The full better-auth instance: `auth.handler` accepts a `Request` and
-* returns a `Response` (used by `handleAuthRequest`); `auth.api`
-* exposes the typed endpoint surface for server-side calls (e.g.
-* `auth.api.getSession({ headers })` inside a query/mutation).
-*/
-type LunoraAuth = ReturnType<typeof betterAuth>;
-/**
-* Create the auth instance. Thin wrapper around `betterAuth` that enforces
-* the `secret` requirement at construction time so misconfigured deployments
-* fail loudly at the first fetch rather than the first sign-in attempt.
-*/
-declare const createAuth: (options: LunoraAuthOptions) => LunoraAuth;
-export { LunoraAuth as L, LunoraAuthOptions as a, createAuth as c };

package/dist/packem_shared/create-auth.d-M36jwG_Y.d.ts

@@ -1,58 +0,0 @@
-import { betterAuth, BetterAuthOptions } from 'better-auth';
-/**
-* Lunora's options pass straight through to better-auth — the only thing we add
-* is requiring `secret` up front so a misconfigured deployment fails loudly
-* instead of at the first sign-in.
-*
-* For `database`, prefer `lunoraD1Adapter` (`database: lunoraD1Adapter(env.DB)`)
-* over passing the raw `env.DB`. better-auth *does* accept a D1Database directly,
-* but it then resolves its Kysely adapter via a runtime `await import(...)` inside
-* `auth.$context` — and that import never settles under `@cloudflare/vite-plugin`'s
-* worker runner, hanging every auth request in `pnpm dev`. The explicit adapter
-* skips it, so dev and prod behave the same. (Raw `env.DB` is still correct for
-* the migration-only instance — see `lunoraD1Adapter`'s note.)
-*
-* Session rotation / richer session policies are configured via the `session`
-* field (a `SessionPolicy`); Lunora validates it for obviously-broken
-* durations and forwards it verbatim to better-auth. See `sessionPresets`
-* for ready-made rotation/expiry trade-offs.
-*
-* ## Serverless background tasks (Cloudflare Workers)
-*
-* better-auth runs some work *after* sending the response — most importantly the
-* password-reset email, whose background send is what keeps reset responses
-* constant-time (a timing-attack defence: the response doesn't reveal whether
-* the account exists). On Cloudflare Workers a promise that isn't handed to
-* `ctx.waitUntil` can be cancelled the moment the response returns, dropping
-* that send and weakening the guarantee. Wire your request's `ctx.waitUntil`
-* into better-auth's background handler so the work survives:
-*
-* ```ts
-* // in your worker fetch handler, where `ctx: ExecutionContext` is in scope
-* const auth = createAuth({
-*     secret: env.AUTH_SECRET,
-*     database: lunoraD1Adapter(env.DB),
-*     advanced: {
-*         backgroundTasks: { handler: (promise) => ctx.waitUntil(promise) },
-*     },
-* });
-* ```
-*
-* (Lunora can't set this for you — `ctx.waitUntil` is per-request, but
-* `createAuth` runs once at worker setup.)
-*/
-type LunoraAuthOptions = BetterAuthOptions;
-/**
-* The full better-auth instance: `auth.handler` accepts a `Request` and
-* returns a `Response` (used by `handleAuthRequest`); `auth.api`
-* exposes the typed endpoint surface for server-side calls (e.g.
-* `auth.api.getSession({ headers })` inside a query/mutation).
-*/
-type LunoraAuth = ReturnType<typeof betterAuth>;
-/**
-* Create the auth instance. Thin wrapper around `betterAuth` that enforces
-* the `secret` requirement at construction time so misconfigured deployments
-* fail loudly at the first fetch rather than the first sign-in attempt.
-*/
-declare const createAuth: (options: LunoraAuthOptions) => LunoraAuth;
-export { LunoraAuth as L, LunoraAuthOptions as a, createAuth as c };

package/dist/packem_shared/createAuth-B-tvsvQU.mjs

@@ -1,56 +0,0 @@
-import { betterAuth } from 'better-auth';
-import { validateSessionPolicy } from './sessionPresets-B95rXrd8.mjs';
-
-const MIN_SECRET_LENGTH = 32;
-const isWeakSecret = (secret) => {
-  const trimmedLength = typeof secret === "string" ? secret.trim().length : 0;
-  return trimmedLength > 0 && trimmedLength < MIN_SECRET_LENGTH;
-};
-const isHttpsBaseUrl = (baseURL) => {
-  if (typeof baseURL === "string") {
-    return baseURL.startsWith("https://");
-  }
-  if (baseURL && typeof baseURL === "object") {
-    if (baseURL.protocol === "https") {
-      return true;
-    }
-    if (baseURL.protocol === "http") {
-      return false;
-    }
-    return typeof baseURL.fallback === "string" && baseURL.fallback.startsWith("https://");
-  }
-  return false;
-};
-const hardenAuthOptions = (options) => {
-  if (isWeakSecret(options.secret)) {
-    const message = `@lunora/auth: AUTH_SECRET is only ${String(options.secret?.trim().length)} characters. Use at least ${String(MIN_SECRET_LENGTH)} for a brute-force-resistant secret — generate one with \`openssl rand -hex 32\`.`;
-    if (isHttpsBaseUrl(options.baseURL)) {
-      throw new Error(message);
-    }
-    console.warn(message);
-  }
-  const advanced = options.advanced ?? {};
-  return {
-    ...options,
-    advanced: {
-      ...advanced,
-      defaultCookieAttributes: advanced.defaultCookieAttributes ?? { httpOnly: true, path: "/", sameSite: "lax" },
-      ...advanced.useSecureCookies === void 0 && isHttpsBaseUrl(options.baseURL) ? { useSecureCookies: true } : {}
-    }
-  };
-};
-const createAuth = (options) => {
-  if (!options.secret || options.secret.trim() === "") {
-    throw new Error(
-      '@lunora/auth: `secret` is required. Set AUTH_SECRET locally in .dev.vars (`lunora env set AUTH_SECRET "$(openssl rand -hex 32)"`), and in production with `wrangler secret put AUTH_SECRET`.'
-    );
-  }
-  if (options.session) {
-    validateSessionPolicy(options.session);
-  }
-  const hardened = hardenAuthOptions(options);
-  const resolvedOptions = hardened.rateLimit?.enabled === void 0 ? { ...hardened, rateLimit: { ...hardened.rateLimit, enabled: true } } : hardened;
-  return betterAuth(resolvedOptions);
-};
-
-export { createAuth };

package/dist/packem_shared/sessionPresets-B95rXrd8.mjs

@@ -1,35 +0,0 @@
-const MINUTE = 60;
-const HOUR = 60 * MINUTE;
-const DAY = 24 * HOUR;
-const validateSessionPolicy = (policy) => {
-  const durationFields = ["expiresIn", "updateAge", "freshAge"];
-  for (const field of durationFields) {
-    const value = policy[field];
-    if (value === void 0) {
-      continue;
-    }
-    if (typeof value !== "number" || !Number.isFinite(value) || value < 0) {
-      throw new TypeError(`@lunora/auth: \`session.${field}\` must be a non-negative, finite number of seconds`);
-    }
-  }
-  return policy;
-};
-const sessionPresets = {
-  longLived: {
-    expiresIn: 30 * DAY,
-    freshAge: DAY,
-    updateAge: DAY
-  },
-  rolling: {
-    expiresIn: 7 * DAY,
-    freshAge: DAY,
-    updateAge: DAY
-  },
-  strict: {
-    expiresIn: HOUR,
-    freshAge: 5 * MINUTE,
-    updateAge: 15 * MINUTE
-  }
-};
-
-export { sessionPresets, validateSessionPolicy };