@lunora/auth 1.0.0-alpha.4 → 1.0.0-alpha.41

package/dist/middleware.d.ts

@@ -1,11 +1,12 @@
-import { L as LunoraAuth } from "./packem_shared/create-auth.d-M36jwG_Y.js";
+import { LunoraError } from '@lunora/errors';
+import { L as LunoraAuth } from "./packem_shared/create-auth.d-De6IOirt.js";
 import 'better-auth';
 /**
-* Structural mirror of `@lunora/server`'s `MiddlewareNext` — the continuation
-* callback handed to a middleware. Repeated here so this package does not take
-* a runtime dependency on `@lunora/server`; the types are assignable from the
-* fully-typed builder.
-*/
+ * Structural mirror of `@lunora/server`'s `MiddlewareNext` — the continuation
+ * callback handed to a middleware. Repeated here so this package does not take
+ * a runtime dependency on `@lunora/server`; the types are assignable from the
+ * fully-typed builder.
+ */
 interface MiddlewareNext<ContextIn> {
   (): Promise<ContextIn>;
   <Extension extends Record<string, unknown>>(options: {
@@ -13,174 +14,174 @@ interface MiddlewareNext<ContextIn> {
   }): Promise<ContextIn & Extension>;
 }
 /**
-* Thrown by the runtime header guard when a privileged `ctx.authApi.*` endpoint
-* is invoked without a `headers` property on its argument object. Carries the
-* offending `method` name so callers can pinpoint the bad call site, and points
-* at the explicit escape hatches.
-*
-* This is the runtime sibling of the static `auth_api_call_without_headers`
-* advisor lint — both treat a header-less `ctx.authApi.*` call as an
-* authorization bypass, so a call that trips the lint also trips this guard.
-*/
-declare class LunoraAuthHeadersError extends Error {
+ * Thrown by the runtime header guard when a privileged `ctx.authApi.*` endpoint
+ * is invoked without a `headers` property on its argument object. Carries the
+ * offending `method` name so callers can pinpoint the bad call site, and points
+ * at the explicit escape hatches.
+ *
+ * This is the runtime sibling of the static `auth_api_call_without_headers`
+ * advisor lint — both treat a header-less `ctx.authApi.*` call as an
+ * authorization bypass, so a call that trips the lint also trips this guard.
+ */
+declare class LunoraAuthHeadersError extends LunoraError {
   /** The `ctx.authApi.&lt;method>` that was called without `headers`. */
   readonly method: string;
   constructor(method: string);
 }
 /**
-* Options for {@link withAuthPlugins}.
-*/
+ * Options for {@link withAuthPlugins}.
+ */
 interface WithAuthPluginsOptions {
   /**
-  * Whether to install the runtime header guard around `ctx.authApi`.
-  *
-  * **Defaults to `true` — the safe default.** When enabled, every
-  * `ctx.authApi.&lt;method>(…)` call that omits `headers` throws
-  * {@link LunoraAuthHeadersError} instead of silently running with full
-  * server-to-server privileges. For a deliberate, per-call unauthenticated
-  * invocation, use the explicit `ctx.authApi.withoutHeaders()` escape hatch
-  * rather than disabling the guard wholesale.
-  *
-  * Set to `false` only when you have audited every `ctx.authApi.*` call site
-  * and accept responsibility for passing headers yourself. This is the loud,
-  * all-or-nothing opt-out; prefer `withoutHeaders()` for one-offs.
-  */
+   * Whether to install the runtime header guard around `ctx.authApi`.
+   *
+   * **Defaults to `true` — the safe default.** When enabled, every
+   * `ctx.authApi.&lt;method>(…)` call that omits `headers` throws
+   * {@link LunoraAuthHeadersError} instead of silently running with full
+   * server-to-server privileges. For a deliberate, per-call unauthenticated
+   * invocation, use the explicit `ctx.authApi.withoutHeaders()` escape hatch
+   * rather than disabling the guard wholesale.
+   *
+   * Set to `false` only when you have audited every `ctx.authApi.*` call site
+   * and accept responsibility for passing headers yourself. This is the loud,
+   * all-or-nothing opt-out; prefer `withoutHeaders()` for one-offs.
+   */
   enforceHeaders?: boolean;
 }
 /**
-* The Lunora context extension this middleware installs. It does *not* replace
-* `ctx.auth` (the identity-only surface populated by the runtime — `userId` and
-* `getIdentity()`); instead it adds a sibling `ctx.authApi` that points at the
-* full better-auth plugin API surface.
-*
-* The shape of `authApi` is the shape of the better-auth instance's `api` —
-* a flat record of endpoint functions like `createOrganization`, `banUser`,
-* `listMembers`, … contributed by whichever plugins are configured on the auth
-* instance. Because the type is `Auth["api"]` and `LunoraAuth` is generic over
-* the auth instance, callers get end-to-end inference: the endpoints they see
-* are exactly the ones their auth instance loaded.
-*/
+ * The Lunora context extension this middleware installs. It does *not* replace
+ * `ctx.auth` (the identity-only surface populated by the runtime — `userId` and
+ * `getIdentity()`); instead it adds a sibling `ctx.authApi` that points at the
+ * full better-auth plugin API surface.
+ *
+ * The shape of `authApi` is the shape of the better-auth instance's `api` —
+ * a flat record of endpoint functions like `createOrganization`, `banUser`,
+ * `listMembers`, … contributed by whichever plugins are configured on the auth
+ * instance. Because the type is `Auth["api"]` and `LunoraAuth` is generic over
+ * the auth instance, callers get end-to-end inference: the endpoints they see
+ * are exactly the ones their auth instance loaded.
+ */
 interface LunoraAuthApiContext<Auth extends LunoraAuth> {
   /**
-  * The better-auth endpoint surface — every endpoint contributed by every
-  * plugin configured on the auth instance, ready to call directly:
-  *
-  * ```ts
-  * await ctx.authApi.createOrganization({ body: { name: "Acme" }, headers });
-  * await ctx.authApi.banUser({ body: { userId: "u_1" }, headers });
-  * ```
-  *
-  * # ⚠️ SECURITY: privileged surface — you MUST pass `headers`
-  *
-  * This is the **full, privileged** better-auth API (`auth.api`) — it
-  * includes admin/management endpoints such as `banUser`, `setRole`,
-  * impersonation, `createOrganization`, `removeMember`, … better-auth
-  * authorizes these calls from the caller's session in the `headers` you
-  * pass. Invoked **without** `headers`, better-auth treats the call as a
-  * trusted server-side invocation and **bypasses session authorization
-  * entirely** — any procedure that can reach `ctx.authApi` could then ban a
-  * user, escalate a role, or read another tenant's data.
-  *
-  * To stop that bypass at runtime, `withAuthPlugins` installs a guard around
-  * `ctx.authApi` by default: a header-less call to any endpoint throws
-  * {@link LunoraAuthHeadersError} rather than running with full privileges.
-  * The same `auth_api_call_without_headers` advisor lint catches it
-  * statically; the guard is the runtime backstop for the cases the lint
-  * can't see (dynamic method names, indirected calls). For the rare,
-  * deliberate unauthenticated server-to-server call, opt out explicitly with
-  * `ctx.authApi.withoutHeaders().&lt;method>(…)`.
-  *
-  * Lunora's procedure context carries only the resolved identity, not the
-  * raw inbound `Headers`, so this middleware CANNOT pre-bind them for you.
-  * Therefore: **thread the inbound `Headers` into every `ctx.authApi.*`
-  * call** (typically from an HTTP action — see {@link withAuthPlugins}). A
-  * header-less call is an authorization bypass, not a convenience.
-  */
+   * The better-auth endpoint surface — every endpoint contributed by every
+   * plugin configured on the auth instance, ready to call directly:
+   *
+   * ```ts
+   * await ctx.authApi.createOrganization({ body: { name: "Acme" }, headers });
+   * await ctx.authApi.banUser({ body: { userId: "u_1" }, headers });
+   * ```
+   *
+   * # ⚠️ SECURITY: privileged surface — you MUST pass `headers`
+   *
+   * This is the **full, privileged** better-auth API (`auth.api`) — it
+   * includes admin/management endpoints such as `banUser`, `setRole`,
+   * impersonation, `createOrganization`, `removeMember`, … better-auth
+   * authorizes these calls from the caller's session in the `headers` you
+   * pass. Invoked **without** `headers`, better-auth treats the call as a
+   * trusted server-side invocation and **bypasses session authorization
+   * entirely** — any procedure that can reach `ctx.authApi` could then ban a
+   * user, escalate a role, or read another tenant's data.
+   *
+   * To stop that bypass at runtime, `withAuthPlugins` installs a guard around
+   * `ctx.authApi` by default: a header-less call to any endpoint throws
+   * {@link LunoraAuthHeadersError} rather than running with full privileges.
+   * The same `auth_api_call_without_headers` advisor lint catches it
+   * statically; the guard is the runtime backstop for the cases the lint
+   * can't see (dynamic method names, indirected calls). For the rare,
+   * deliberate unauthenticated server-to-server call, opt out explicitly with
+   * `ctx.authApi.withoutHeaders().&lt;method>(…)`.
+   *
+   * Lunora's procedure context carries only the resolved identity, not the
+   * raw inbound `Headers`, so this middleware CANNOT pre-bind them for you.
+   * Therefore: **thread the inbound `Headers` into every `ctx.authApi.*`
+   * call** (typically from an HTTP action — see {@link withAuthPlugins}). A
+   * header-less call is an authorization bypass, not a convenience.
+   */
   readonly authApi: {
     /**
-    * Explicit, loud escape hatch from the runtime header guard. Returns
-    * the raw, **unguarded** `auth.api` surface — every endpoint reached
-    * through it runs as a trusted server-to-server call with session
-    * authorization skipped.
-    *
-    * ```ts
-    * // A scheduled job with no inbound request that must create the
-    * // system org. Audited and intentional:
-    * await ctx.authApi.withoutHeaders().createOrganization({ body: { name } });
-    * ```
-    *
-    * Use only for deliberate, audited unauthenticated calls. For ordinary
-    * request-driven calls, pass `headers` so authorization is enforced.
-    */
+     * Explicit, loud escape hatch from the runtime header guard. Returns
+     * the raw, **unguarded** `auth.api` surface — every endpoint reached
+     * through it runs as a trusted server-to-server call with session
+     * authorization skipped.
+     *
+     * ```ts
+     * // A scheduled job with no inbound request that must create the
+     * // system org. Audited and intentional:
+     * await ctx.authApi.withoutHeaders().createOrganization({ body: { name } });
+     * ```
+     *
+     * Use only for deliberate, audited unauthenticated calls. For ordinary
+     * request-driven calls, pass `headers` so authorization is enforced.
+     */
     withoutHeaders: () => Auth["api"];
   } & Auth["api"];
 }
 /**
-* Build a Lunora middleware that mounts a better-auth instance's plugin API
-* onto `ctx.authApi`. Compose it with `.use(...)` once per builder and every
-* downstream handler gets typed access to the plugin endpoints — no more
-* importing the auth instance directly from every query/mutation file.
-*
-* # ⚠️ SECURITY: headers are load-bearing for authorization
-*
-* `ctx.authApi` is the **full privileged** better-auth surface (`auth.api`):
-* `banUser`, `setRole`, impersonation, `createOrganization`, `removeMember`,
-* and so on. better-auth authorizes these from the caller's session carried in
-* the `headers` you pass. **Called without `headers`, better-auth treats the
-* invocation as a trusted server-side call and skips session authorization
-* altogether** — so a header-less `ctx.authApi.banUser(...)` from any procedure
-* runs with full privileges regardless of who the caller is. This is an
-* authorization bypass, not just a missing convenience.
-*
-* To make that bypass fail loudly instead of silently, this middleware wraps
-* `ctx.authApi` in a **runtime header guard by default**: any endpoint called
-* without a `headers` property throws {@link LunoraAuthHeadersError}. The guard
-* mirrors the static `auth_api_call_without_headers` advisor lint exactly, so
-* the two agree on what counts as a header-bearing call.
-*
-* - **Default (safe):** `withAuthPlugins(auth)` — header-less calls throw.
-* - **Per-call opt-out (preferred):** `ctx.authApi.withoutHeaders().banUser(…)`
-* for a deliberate, audited unauthenticated server-to-server call.
-* - **Whole-middleware opt-out (loud):** `withAuthPlugins(auth, { enforceHeaders: false })`
-* disables the guard entirely; only do this once every call site is audited.
-*
-* Lunora's procedure context does not currently carry the raw request headers
-* (only the resolved identity — see `AuthState` in `@lunora/server`), so
-* this middleware **cannot** pre-bind headers for you and does **not** do so.
-* You MUST pass the inbound `Headers` explicitly into **every** `ctx.authApi.*`
-* call, from a transport that has them — typically an HTTP action:
-*
-* ```ts
-* // lunora/orgs.ts
-* import { httpAction } from "@lunora/server";
-* import { withAuthPlugins } from "@lunora/auth/middleware";
-* import { auth } from "./auth.js";
-*
-* export const createOrg = httpAction(async (ctx, request) => {
-*     const { name } = await request.json();
-*
-*     // ctx.authApi is installed by withAuthPlugins(auth) on the builder.
-*     const org = await ctx.authApi.createOrganization({
-*         body: { name },
-*         headers: request.headers,
-*     });
-*
-*     return Response.json(org);
-* });
-* ```
-*
-* For internal server-to-server calls where there is no inbound request
-* (e.g. a scheduled job that creates the system org), opt out explicitly with
-* `ctx.authApi.withoutHeaders()` and authenticate with whatever bearer token
-* your auth instance is configured to honour.
-*/
+ * Build a Lunora middleware that mounts a better-auth instance's plugin API
+ * onto `ctx.authApi`. Compose it with `.use(...)` once per builder and every
+ * downstream handler gets typed access to the plugin endpoints — no more
+ * importing the auth instance directly from every query/mutation file.
+ *
+ * # ⚠️ SECURITY: headers are load-bearing for authorization
+ *
+ * `ctx.authApi` is the **full privileged** better-auth surface (`auth.api`):
+ * `banUser`, `setRole`, impersonation, `createOrganization`, `removeMember`,
+ * and so on. better-auth authorizes these from the caller's session carried in
+ * the `headers` you pass. **Called without `headers`, better-auth treats the
+ * invocation as a trusted server-side call and skips session authorization
+ * altogether** — so a header-less `ctx.authApi.banUser(...)` from any procedure
+ * runs with full privileges regardless of who the caller is. This is an
+ * authorization bypass, not just a missing convenience.
+ *
+ * To make that bypass fail loudly instead of silently, this middleware wraps
+ * `ctx.authApi` in a **runtime header guard by default**: any endpoint called
+ * without a `headers` property throws {@link LunoraAuthHeadersError}. The guard
+ * mirrors the static `auth_api_call_without_headers` advisor lint exactly, so
+ * the two agree on what counts as a header-bearing call.
+ *
+ * - **Default (safe):** `withAuthPlugins(auth)` — header-less calls throw.
+ * - **Per-call opt-out (preferred):** `ctx.authApi.withoutHeaders().banUser(…)`
+ * for a deliberate, audited unauthenticated server-to-server call.
+ * - **Whole-middleware opt-out (loud):** `withAuthPlugins(auth, { enforceHeaders: false })`
+ * disables the guard entirely; only do this once every call site is audited.
+ *
+ * Lunora's procedure context does not currently carry the raw request headers
+ * (only the resolved identity — see `AuthState` in `@lunora/server`), so
+ * this middleware **cannot** pre-bind headers for you and does **not** do so.
+ * You MUST pass the inbound `Headers` explicitly into **every** `ctx.authApi.*`
+ * call, from a transport that has them — typically an HTTP action:
+ *
+ * ```ts
+ * // lunora/orgs.ts
+ * import { httpAction } from "@lunora/server";
+ * import { withAuthPlugins } from "@lunora/auth/middleware";
+ * import { auth } from "./auth.js";
+ *
+ * export const createOrg = httpAction(async (ctx, request) => {
+ *     const { name } = await request.json();
+ *
+ *     // ctx.authApi is installed by withAuthPlugins(auth) on the builder.
+ *     const org = await ctx.authApi.createOrganization({
+ *         body: { name },
+ *         headers: request.headers,
+ *     });
+ *
+ *     return Response.json(org);
+ * });
+ * ```
+ *
+ * For internal server-to-server calls where there is no inbound request
+ * (e.g. a scheduled job that creates the system org), opt out explicitly with
+ * `ctx.authApi.withoutHeaders()` and authenticate with whatever bearer token
+ * your auth instance is configured to honour.
+ */
 /**
-* Shape of the middleware {@link withAuthPlugins} returns: a callable generic
-* over the incoming ctx so chaining `.use(...)` preserves whatever ctx fields
-* the upstream middleware already installed. Lives as its own interface
-* because TypeScript doesn't allow declaring `const fn: &lt;CtxIn>() => ...` —
-* the generic must live on a callable type alias or interface.
-*/
+ * Shape of the middleware {@link withAuthPlugins} returns: a callable generic
+ * over the incoming ctx so chaining `.use(...)` preserves whatever ctx fields
+ * the upstream middleware already installed. Lives as its own interface
+ * because TypeScript doesn't allow declaring `const fn: &lt;CtxIn>() => ...` —
+ * the generic must live on a callable type alias or interface.
+ */
 type WithAuthPluginsMiddleware<Auth extends LunoraAuth> = <ContextIn>(options: {
   ctx: ContextIn;
   next: MiddlewareNext<ContextIn>;

package/dist/middleware.mjs

@@ -1,53 +1 @@
-const callHasHeaders = (argument) => {
-  if (argument === void 0) {
-    return false;
-  }
-  if (typeof argument !== "object" || argument === null) {
-    return true;
-  }
-  const { headers } = argument;
-  return headers !== void 0 && headers !== null;
-};
-const guardAuthApi = (api) => {
-  const withoutHeaders = () => api;
-  return /* @__PURE__ */ new Proxy(api, {
-    // eslint-disable-next-line sonarjs/function-return-type -- a Proxy `get` trap is intrinsically polymorphic: it returns the synthetic `withoutHeaders`, the guarded endpoint wrapper, or any passthrough property value
-    get(target, property, receiver) {
-      if (property === "withoutHeaders" && !(property in target)) {
-        return withoutHeaders;
-      }
-      const value = Reflect.get(target, property, receiver);
-      if (typeof value !== "function" || typeof property !== "string") {
-        return value;
-      }
-      const method = property;
-      return (...arguments_) => {
-        if (!callHasHeaders(arguments_[0])) {
-          return Promise.reject(new LunoraAuthHeadersError(method));
-        }
-        return Reflect.apply(value, target, arguments_);
-      };
-    }
-  });
-};
-class LunoraAuthHeadersError extends Error {
-  /** The `ctx.authApi.<method>` that was called without `headers`. */
-  method;
-  constructor(method) {
-    super(
-      `@lunora/auth: ctx.authApi.${method}(…) was called without \`headers\`. better-auth treats a header-less call as a trusted server-to-server invocation and skips session authorization entirely — an authorization bypass. Pass the inbound request headers: ctx.authApi.${method}({ body, headers: request.headers }). If you genuinely intend an unauthenticated server-to-server call, opt out explicitly via ctx.authApi.withoutHeaders().<method>(…), or disable the guard for the whole middleware with withAuthPlugins(auth, { enforceHeaders: false }).`
-    );
-    this.name = "LunoraAuthHeadersError";
-    this.method = method;
-  }
-}
-const withAuthPlugins = (auth, options = {}) => {
-  const enforceHeaders = options.enforceHeaders ?? true;
-  const authApi = enforceHeaders ? guardAuthApi(auth.api) : auth.api;
-  return async ({ next }) => {
-    const extended = await next({ ctx: { authApi } });
-    return extended;
-  };
-};
-
-export { LunoraAuthHeadersError, withAuthPlugins };
+import{LunoraError as i}from"@lunora/errors";const h=e=>{if(e===void 0)return!1;if(typeof e!="object"||e===null)return!0;const{headers:t}=e;return t!=null},d=e=>{const t=()=>e;return new Proxy(e,{get(a,r,o){if(r==="withoutHeaders"&&!(r in a))return t;const s=Reflect.get(a,r,o);if(typeof s!="function"||typeof r!="string")return s;const u=r;return(...n)=>h(n[0])?Reflect.apply(s,a,n):Promise.reject(new c(u))}})};class c extends i{method;constructor(t){super("AUTH_HEADERS_MISSING",`@lunora/auth: ctx.authApi.${t}(…) was called without \`headers\`. better-auth treats a header-less call as a trusted server-to-server invocation and skips session authorization entirely — an authorization bypass. Pass the inbound request headers: ctx.authApi.${t}({ body, headers: request.headers }). If you genuinely intend an unauthenticated server-to-server call, opt out explicitly via ctx.authApi.withoutHeaders().<method>(…), or disable the guard for the whole middleware with withAuthPlugins(auth, { enforceHeaders: false }).`,{name:"LunoraAuthHeadersError"}),this.method=t}}const p=(e,t={})=>{const a=t.enforceHeaders??!0?d(e.api):e.api;return async({next:r})=>await r({ctx:{authApi:a}})};export{c as LunoraAuthHeadersError,p as withAuthPlugins};

package/dist/packem_shared/DEFAULT_AUTH_BASE_PATH-kIwlEt8i.mjs

@@ -0,0 +1 @@
+const s="/api/auth",r=async(h,t,n=s)=>{const a=new URL(t.url),e=n.endsWith("/")?n.slice(0,-1):n;if(!(a.pathname!==e&&!a.pathname.startsWith(`${e}/`)))return h.handler(t)};export{s as DEFAULT_AUTH_BASE_PATH,r as handleAuthRequest};

package/dist/packem_shared/LunoraAuthAdminError-BiNYZM9j.mjs

@@ -0,0 +1 @@
+import{LunoraError as S}from"@lunora/errors";import{getAuthTables as A}from"better-auth/db";class p extends S{constructor(u,w){super(w,u,{name:"LunoraAuthAdminError"})}}const O=50,M=500,z=3600,R=z*24,D=100*365*24*60*60,U=2880*60*1e3,N=new Set(["accessToken","backupCodes","idToken","password","publicKey","refreshToken","secret","token"]),k=s=>Math.min(Math.max(Math.trunc(s??O),1),M),T=s=>Math.max(0,Math.trunc(s??0)),c=s=>{const u={};for(const[w,m]of Object.entries(s))N.has(w)||(u[w]=m instanceof Date?m.getTime():m);return u},I=s=>Array.isArray(s)?s.join(","):s,b=s=>s.toLowerCase().replaceAll(/[^\da-z]+/g,"-").replaceAll(/^-|-$/g,""),x=new Set(["banExpires","banned","banReason","createdAt","email","emailVerified","id","name","role","updatedAt"]),E={displayUsername:"username",phoneNumber:"phone-number",phoneNumberVerified:"phone-number",username:"username"},_=s=>s==="boolean"?"boolean":s==="date"?"date":s==="number"?"number":"string",L=s=>{const u=[];for(const[w,m]of Object.entries(s))m.input===!1||m.references!==void 0||x.has(w)||u.push({name:w,plugin:E[w],required:m.required===!0,type:_(m.type),unique:m.unique===!0});return u},P=s=>{if(s instanceof p)return s;const u=s,w=u?.body?.code??u?.code??"AUTH_ADMIN_ERROR",m=u?.body?.message??u?.message??"auth admin operation failed";return new p(m,w)},F=(s,u={})=>{const w=s.$context,m=u.features??{},y=e=>{const a=new Set((e.plugins??[]).map(i=>i.id)),t=i=>a.has(i);return{accounts:m.accounts??!0,admin:m.admin??t("admin"),organization:m.organization??t("organization"),passkey:m.passkey??t("passkey"),twoFactor:m.twoFactor??t("two-factor")}},r=async e=>{try{return await e(await w)}catch(a){throw P(a)}},h=e=>c(e),g=async(e,a,t)=>{const i=t.where&&t.where.length>0?t.where:void 0,[n,o]=await Promise.all([e.adapter.findMany({limit:k(t.limit),model:a,offset:T(t.offset),sortBy:t.sortBy,where:i}),e.adapter.count({model:a,where:i})]);return{rows:n.map(d=>c(d)),total:o}};return{banUser:({expiresInSeconds:e,reason:a,userId:t})=>r(async i=>{let n=null;if(e!==void 0){if(!Number.isInteger(e)||e<=0)throw new p("expiresInSeconds must be a positive finite integer","INVALID_BAN_SECONDS");const d=Math.min(e,D);n=new Date(Date.now()+d*1e3)}const o=await i.internalAdapter.updateUser(t,{banExpires:n,banned:!0,banReason:a??"No reason"});return await i.internalAdapter.deleteUserSessions(t),h(o)}),cancelInvitation:({invitationId:e})=>r(async a=>{await a.adapter.delete({model:"invitation",where:[{field:"id",value:e}]})}),capabilities:()=>r(e=>Promise.resolve(y(e.options))),addMember:({organizationId:e,role:a,userId:t})=>r(async i=>{const n=await i.adapter.create({data:{createdAt:new Date,organizationId:e,role:a===void 0||a===""?"member":a,userId:t},model:"member"});return c(n)}),addTeamMember:({teamId:e,userId:a})=>r(async t=>{const i=await t.adapter.create({data:{createdAt:new Date,teamId:e,userId:a},model:"teamMember"});return c(i)}),config:()=>r(e=>{const a=e.options,t=y(a),i=new Set((a.plugins??[]).map(l=>l.id)),n=A(a),o=a.session??{},d=a.rateLimit??{};return Promise.resolve({capabilities:t,emailAndPassword:a.emailAndPassword?.enabled??!1,organization:{enabled:t.organization,roles:!!n.organizationRole,teams:!!n.team},plugins:[...i].toSorted((l,f)=>l.localeCompare(f)),rateLimit:{enabled:d.enabled??!1,max:d.max,window:d.window},session:{cookieCache:o.cookieCache?.enabled,expiresIn:o.expiresIn,freshAge:o.freshAge,updateAge:o.updateAge},socialProviders:Object.keys(a.socialProviders??{}).toSorted((l,f)=>l.localeCompare(f)),userFields:L(n.user?.fields??{})})}),createOrganization:({logo:e,metadata:a,name:t,ownerId:i,slug:n})=>r(async o=>{const d=b(n!==void 0&&n!==""?n:t);if(d==="")throw new p("could not derive a slug from the organization name","ORG_SLUG_INVALID");if(await o.adapter.findOne({model:"organization",where:[{field:"slug",value:d}]}))throw new p("an organization with this slug already exists","ORG_SLUG_TAKEN");const l=await o.adapter.create({data:{createdAt:new Date,logo:e===void 0||e===""?void 0:e,metadata:a===void 0?void 0:JSON.stringify(a),name:t,slug:d},model:"organization"});return i!==void 0&&i!==""&&await o.adapter.create({data:{createdAt:new Date,organizationId:l.id,role:"owner",userId:i},model:"member"}),c(l)}),createOrgRole:({organizationId:e,permission:a,role:t})=>r(async i=>{const n=await i.adapter.create({data:{createdAt:new Date,organizationId:e,permission:JSON.stringify(a),role:t},model:"organizationRole"});return c(n)}),createTeam:({name:e,organizationId:a})=>r(async t=>{const i=await t.adapter.create({data:{createdAt:new Date,name:e,organizationId:a},model:"team"});return c(i)}),deleteOrganization:({organizationId:e})=>r(async a=>{const t=A(a.options);if(await a.adapter.deleteMany({model:"member",where:[{field:"organizationId",value:e}]}),await a.adapter.deleteMany({model:"invitation",where:[{field:"organizationId",value:e}]}),t.team){const i=await a.adapter.findMany({model:"team",where:[{field:"organizationId",value:e}]});for(const n of i)await a.adapter.deleteMany({model:"teamMember",where:[{field:"teamId",value:n.id}]});await a.adapter.deleteMany({model:"team",where:[{field:"organizationId",value:e}]})}t.organizationRole&&await a.adapter.deleteMany({model:"organizationRole",where:[{field:"organizationId",value:e}]}),await a.adapter.delete({model:"organization",where:[{field:"id",value:e}]})}),deleteOrgRole:({roleId:e})=>r(async a=>{await a.adapter.delete({model:"organizationRole",where:[{field:"id",value:e}]})}),inviteMember:({email:e,inviterId:a,organizationId:t,role:i})=>r(async n=>{let o=a;if(o===void 0||o===""){const l=await n.adapter.findMany({model:"member",where:[{field:"organizationId",value:t}]});o=(l.find(f=>typeof f.role=="string"&&f.role.includes("owner"))??l[0])?.userId}if(o===void 0||o==="")throw new p("provide an inviter — the organization has no members to attribute the invitation to","INVITER_REQUIRED");const d=await n.adapter.create({data:{createdAt:new Date,email:e.toLowerCase(),expiresAt:new Date(Date.now()+U),inviterId:o,organizationId:t,role:i===void 0||i===""?"member":i,status:"pending"},model:"invitation"});return c(d)}),listOrgRoles:({limit:e,offset:a,organizationId:t})=>r(i=>g(i,"organizationRole",{limit:e,offset:a,sortBy:{direction:"desc",field:"createdAt"},where:[{field:"organizationId",value:t}]})),listTeamMembers:({limit:e,offset:a,teamId:t})=>r(i=>g(i,"teamMember",{limit:e,offset:a,where:[{field:"teamId",value:t}]})),listTeams:({limit:e,offset:a,organizationId:t})=>r(i=>g(i,"team",{limit:e,offset:a,sortBy:{direction:"desc",field:"createdAt"},where:[{field:"organizationId",value:t}]})),removeTeam:({teamId:e})=>r(async a=>{await a.adapter.deleteMany({model:"teamMember",where:[{field:"teamId",value:e}]}),await a.adapter.delete({model:"team",where:[{field:"id",value:e}]})}),removeTeamMember:({teamMemberId:e})=>r(async a=>{await a.adapter.delete({model:"teamMember",where:[{field:"id",value:e}]})}),updateMemberRole:({memberId:e,role:a})=>r(async t=>{const i=await t.adapter.update({model:"member",update:{role:I(a)},where:[{field:"id",value:e}]});return c(i??{id:e,role:I(a)})}),updateOrganization:({logo:e,metadata:a,name:t,organizationId:i,slug:n})=>r(async o=>{const d={};if(t!==void 0&&(d.name=t),n!==void 0&&n!==""&&(d.slug=b(n)),e!==void 0&&(d.logo=e===""?void 0:e),a!==void 0&&(d.metadata=JSON.stringify(a)),Object.keys(d).length===0)return c({id:i});const l=await o.adapter.update({model:"organization",update:d,where:[{field:"id",value:i}]});return c(l??{id:i})}),updateOrgRole:({permission:e,roleId:a})=>r(async t=>{const i=await t.adapter.update({model:"organizationRole",update:{permission:JSON.stringify(e),updatedAt:new Date},where:[{field:"id",value:a}]});return c(i??{id:a,permission:JSON.stringify(e)})}),updateTeam:({name:e,teamId:a})=>r(async t=>{const i=await t.adapter.update({model:"team",update:{name:e,updatedAt:new Date},where:[{field:"id",value:a}]});return c(i??{id:a,name:e})}),createUser:({data:e,email:a,name:t,password:i,role:n})=>r(async o=>{const d=a.toLowerCase();if(await o.internalAdapter.findUserByEmail(d))throw new p("a user with this email already exists","USER_ALREADY_EXISTS");const l=await o.internalAdapter.createUser({email:d,name:t,role:n===void 0?void 0:I(n),...e});if(i!==void 0&&i!==""){const f=await o.password.hash(i);await o.internalAdapter.linkAccount({accountId:l.id,password:f,providerId:"credential",userId:l.id})}return h(l)}),deletePasskey:({passkeyId:e})=>r(async a=>{await a.adapter.delete({model:"passkey",where:[{field:"id",value:e}]})}),disableTwoFactor:({userId:e})=>r(async a=>{await a.adapter.deleteMany({model:"twoFactor",where:[{field:"userId",value:e}]}),await a.internalAdapter.updateUser(e,{twoFactorEnabled:!1})}),impersonateUser:({userId:e})=>r(async a=>{const t=await a.internalAdapter.findUserById(e);if(!t)throw new p("user not found","USER_NOT_FOUND");const i=u.impersonationSeconds;let n=z;if(i!==void 0){if(!Number.isInteger(i)||!Number.isFinite(i)||i<=0)throw new p("impersonationSeconds must be a positive finite integer","INVALID_IMPERSONATION_SECONDS");n=Math.min(i,R)}const o=new Date(Date.now()+n*1e3),d=await a.internalAdapter.createSession(e,!0,{expiresAt:o,impersonatedBy:u.impersonatedBy??e},!0);return{expiresAt:d.expiresAt instanceof Date?d.expiresAt.getTime():o.getTime(),token:d.token,user:h(t)}}),listAccounts:({userId:e})=>r(async a=>(await a.adapter.findMany({model:"account",where:[{field:"userId",value:e}]})).map(t=>c(t))),listInvitations:({limit:e,offset:a,organizationId:t})=>r(i=>g(i,"invitation",{limit:e,offset:a,where:[{field:"organizationId",value:t}]})),listMembers:({limit:e,offset:a,organizationId:t})=>r(i=>g(i,"member",{limit:e,offset:a,sortBy:{direction:"desc",field:"createdAt"},where:[{field:"organizationId",value:t}]})),listOrganizations:({limit:e,offset:a})=>r(t=>g(t,"organization",{limit:e,offset:a,sortBy:{direction:"desc",field:"createdAt"}})),listPasskeys:({userId:e})=>r(async a=>(await a.adapter.findMany({model:"passkey",where:[{field:"userId",value:e}]})).map(t=>c(t))),listSessions:({limit:e,offset:a,userId:t})=>r(i=>g(i,"session",{limit:e,offset:a,sortBy:{direction:"desc",field:"createdAt"},where:t===void 0||t===""?void 0:[{field:"userId",value:t}]})),listUsers:({filterField:e,filterValue:a,limit:t,offset:i,search:n,searchField:o,sortBy:d,sortDirection:l})=>r(f=>{const v=[];return n!==void 0&&n!==""&&v.push({field:o??"email",operator:"contains",value:n}),a!==void 0&&v.push({field:e??"email",operator:"eq",value:a}),g(f,"user",{limit:t,offset:i,sortBy:{direction:l??"desc",field:d??"createdAt"},where:v})}),removeMember:({memberId:e})=>r(async a=>{await a.adapter.delete({model:"member",where:[{field:"id",value:e}]})}),removeUser:({userId:e})=>r(async a=>{await a.internalAdapter.deleteUserSessions(e),await a.internalAdapter.deleteUser(e)}),revokeUserSession:({sessionId:e})=>r(async a=>{const t=await a.adapter.findOne({model:"session",where:[{field:"id",value:e}]});t?.token&&await a.internalAdapter.deleteSession(t.token)}),revokeUserSessions:({userId:e})=>r(async a=>{await a.internalAdapter.deleteUserSessions(e)}),setRole:({role:e,userId:a})=>r(async t=>{const i=await t.internalAdapter.updateUser(a,{role:I(e)});return h(i)}),setUserPassword:({newPassword:e,userId:a})=>r(async t=>{const i=t.password.config.minPasswordLength,n=t.password.config.maxPasswordLength;if(e.length<i)throw new p(`password must be at least ${i.toString()} characters`,"PASSWORD_TOO_SHORT");if(e.length>n)throw new p(`password must be at most ${n.toString()} characters`,"PASSWORD_TOO_LONG");const o=await t.password.hash(e);await t.internalAdapter.updatePassword(a,o)}),unbanUser:({userId:e})=>r(async a=>{const t=await a.internalAdapter.updateUser(e,{banExpires:null,banned:!1,banReason:null});return h(t)}),unlinkAccount:({accountId:e,userId:a})=>r(async t=>{await t.adapter.delete({model:"account",where:[{field:"id",value:e},{connector:"AND",field:"userId",value:a}]})}),updateUser:({data:e,userId:a})=>r(async t=>{const i=await t.internalAdapter.updateUser(a,e);return h(i)})}};export{p as LunoraAuthAdminError,F as createAuthAdmin};

package/dist/packem_shared/authAuditHook-Dx3sqf3G.mjs

@@ -0,0 +1 @@
+import{createAuthMiddleware as a}from"better-auth/api";import{appendAuthAuditEntry as u}from"../audit.mjs";const c=r=>{const t=r.toLowerCase(),e=n=>t===n||t.endsWith(n);if(e("/sign-up/email")||e("/sign-up"))return"sign-up";if(t.includes("/sign-in/"))return"sign-in";if(e("/sign-out"))return"sign-out";if(e("/change-password")||e("/set-password"))return"password-change";if(e("/reset-password")||e("/request-password-reset")||e("/forget-password"))return"password-reset";if(e("/verify-email"))return"email-verification";if(t.includes("/two-factor/enable")||t.includes("/totp/enable"))return"mfa-enable";if(t.includes("/two-factor/disable")||t.includes("/totp/disable"))return"mfa-disable";if(e("/refresh-token")||e("/token"))return"token-refresh";if(e("/revoke-session")||e("/revoke-sessions")||e("/revoke-other-sessions"))return"session-revoke";if(e("/link-social"))return"account-link";if(e("/unlink-account"))return"account-unlink"},s=(r,t)=>r.headers?.get(t)??r.request?.headers.get(t)??void 0,d=r=>{const t=s(r,"x-forwarded-for");return s(r,"cf-connecting-ip")??(t===void 0?void 0:t.split(",")[0]?.trim())??s(r,"x-real-ip")},f=r=>{const t=r.context?.newSession??r.context?.session,e=t?.user?.id??t?.session?.userId,n=t?.user?.email;return{...e===void 0?{}:{actorId:e},...n===void 0?{}:{actorEmail:n}}},l=r=>{const t=r.context?.returned;if(t instanceof Error)return"failure";if(typeof t=="object"&&t!==null&&"status"in t){const e=Number(t.status);if(Number.isFinite(e)&&e>=400)return"failure"}return"success"},p=(r,t=Date.now())=>{const e=r.path===void 0?void 0:c(r.path);if(e===void 0)return;const n=d(r),o=s(r,"user-agent");return{...f(r),event:e,outcome:l(r),ts:t,...n===void 0?{}:{ip:n},...o===void 0?{}:{userAgent:o},detail:{path:r.path}}},h=r=>a(async t=>{try{const e=p(t);if(e!==void 0){const n=await u(r.executor,e,{redactDetail:r.redactDetail,retention:r.retention});r.onRecord!==void 0&&await r.onRecord(n)}}catch(e){console.error("@lunora/auth: audit hook failed to record event",e)}return{}}),k=(r,t)=>{const e=h(t),n=r.hooks?.after,o=n?async i=>(await n(i),e(i)):e;return{...r,hooks:{...r.hooks,after:o}}};export{h as authAuditHook,p as buildAuditEntry,c as eventForPath,k as withAuthAudit};

package/dist/packem_shared/compileMigrationsSql-ChiudSmt.mjs

@@ -0,0 +1 @@
+import{getMigrations as e}from"better-auth/db/migration";import{resolveAuthOptions as s}from"./createAuth-DS6PL8Mb.mjs";const o=new WeakMap,g=async i=>{const{options:t}=i,n=o.get(t);if(n){await n;return}const r=(async()=>{const{runMigrations:a}=await e(t);await a()})();o.set(t,r);try{await r}catch(a){throw o.delete(t),a}},w=async i=>{const{compileMigrations:t}=await e(s(i));return t()};export{w as compileMigrationsSql,g as ensureMigrated};

package/dist/packem_shared/create-auth.d-De6IOirt.d.mts

@@ -0,0 +1,128 @@
+import { betterAuth, BetterAuthOptions } from 'better-auth';
+/**
+ * Lunora's options pass straight through to better-auth — the only thing we add
+ * is requiring `secret` up front so a misconfigured deployment fails loudly
+ * instead of at the first sign-in.
+ *
+ * For `database`, prefer `lunoraD1Adapter` (`database: lunoraD1Adapter(env.DB)`)
+ * over passing the raw `env.DB`. better-auth *does* accept a D1Database directly,
+ * but it then resolves its Kysely adapter via a runtime `await import(...)` inside
+ * `auth.$context` — and that import never settles under `@cloudflare/vite-plugin`'s
+ * worker runner, hanging every auth request in `pnpm dev`. The explicit adapter
+ * skips it, so dev and prod behave the same. (Raw `env.DB` is still correct for
+ * the migration-only instance — see `lunoraD1Adapter`'s note.)
+ *
+ * Session rotation / richer session policies are configured via the `session`
+ * field (a `SessionPolicy`); Lunora validates it for obviously-broken
+ * durations and forwards it verbatim to better-auth. See `sessionPresets`
+ * for ready-made rotation/expiry trade-offs.
+ *
+ * ## Serverless background tasks (Cloudflare Workers)
+ *
+ * better-auth runs some work *after* sending the response — most importantly the
+ * password-reset email, whose background send is what keeps reset responses
+ * constant-time (a timing-attack defence: the response doesn't reveal whether
+ * the account exists). On Cloudflare Workers a promise that isn't handed to
+ * `ctx.waitUntil` can be cancelled the moment the response returns, dropping
+ * that send and weakening the guarantee. Wire your request's `ctx.waitUntil`
+ * into better-auth's background handler so the work survives:
+ *
+ * ```ts
+ * // in your worker fetch handler, where `ctx: ExecutionContext` is in scope
+ * const auth = createAuth({
+ *     secret: env.AUTH_SECRET,
+ *     database: lunoraD1Adapter(env.DB),
+ *     advanced: {
+ *         backgroundTasks: { handler: (promise) => ctx.waitUntil(promise) },
+ *     },
+ * });
+ * ```
+ *
+ * (Lunora can't set this for you — `ctx.waitUntil` is per-request, but
+ * `createAuth` runs once at worker setup.)
+ */
+type LunoraAuthOptions = BetterAuthOptions;
+/**
+ * The full better-auth instance: `auth.handler` accepts a `Request` and
+ * returns a `Response` (used by `handleAuthRequest`); `auth.api`
+ * exposes the typed endpoint surface for server-side calls (e.g.
+ * `auth.api.getSession({ headers })` inside a query/mutation).
+ */
+type LunoraAuth = ReturnType<typeof betterAuth>;
+/**
+ * Resolve the caller's options into the exact shape `createAuth` hands to
+ * `betterAuth` — the hardened, default-filled options the running worker uses.
+ * Exported (and pure) so the migration path can compile the schema from the
+ * same resolved options: `compileMigrationsSql` routes through here, so the
+ * `rateLimit` table the worker's durable limiter writes to is included in the
+ * migration rather than silently omitted (it would be, if migrations saw the
+ * raw options while the worker ran the resolved ones).
+ *
+ * ## What it fills (each gated independently on caller silence)
+ *
+ * Secure-by-default cookies + secret-strength warning via {@link hardenAuthOptions},
+ * applied first so all hardening composes onto one options object.
+ *
+ * Rate limiting is ON by default for `/api/auth/*`.
+ *
+ * better-auth's own default is `rateLimit.enabled ?? isProduction`, and its
+ * `isProduction` is `"production" === "production"` resolved at
+ * module-load time. On Cloudflare Workers that check is unreliable: the
+ * runtime has no Node `process.env` (absent entirely without
+ * `nodejs_compat`, and even with it `NODE_ENV` is rarely `"production"` at
+ * request time). So better-auth would silently leave auth endpoints
+ * _unthrottled_ on a real deployment — the surprise we refuse to ship.
+ *
+ * We therefore default `enabled: true` whenever the caller hasn't made an
+ * explicit choice. We only fill the `enabled` flag and otherwise forward
+ * the caller's `rateLimit` verbatim, so better-auth's `window` (10s) / `max`
+ * (100) defaults and any custom rules still apply. Callers who genuinely
+ * want it off can pass `rateLimit: { enabled: false }` (e.g. when fronting
+ * auth with their own limiter), and any explicit `enabled` value wins.
+ *
+ * We also default `storage: "database"` — but only when rate limiting is not
+ * explicitly disabled (`enabled !== false`). Filling storage under a disabled
+ * limiter is harmless at runtime but makes `getAuthTables` emit an unused
+ * `rateLimit` table, so we skip it there.
+ *
+ * better-auth's own default is `storage: "memory"` — a per-isolate,
+ * non-durable counter. On Cloudflare Workers that means each isolate keeps
+ * its own tally, counters vanish on isolate recycle, and traffic spread
+ * across isolates never sums to the configured `max` — a limiter that
+ * reports "enabled" while never enforcing a global limit (the exact
+ * brute-force / credential-stuffing protection on `/sign-in`, OTP, and
+ * password-reset it is meant to buy). `storage: "database"` rides the counter
+ * through the configured `database` adapter — Lunora's store over the D1 auth
+ * tables — so the limit is durable *and* atomic (the store's native
+ * `incrementOne` gives a one-winner guarantee across isolates). Callers with
+ * their own durable store can pass an explicit `rateLimit: { storage: … }`
+ * (or `customStorage`), and any explicit value wins.
+ *
+ * Session cookie cache is ON by default too.
+ *
+ * Every authenticated call resolves identity through better-auth's
+ * `getSession`, which — without a cache — is a DB (D1) read on the hot path
+ * of every query/mutation/action that reads `ctx.auth` and of the WebSocket
+ * upgrade. better-auth's `session.cookieCache` carries the session payload in
+ * a short-lived signed cookie so `getSession` can answer without hitting the
+ * database until the cache window elapses. We default it on with a
+ * deliberately short 60s `maxAge` (better-auth's own default is 300s): long
+ * enough to erase the per-request read for a burst of calls, short enough
+ * that a revoked or role-changed session self-corrects within a minute.
+ * The one tradeoff — a revoked session stays valid until the cache expires —
+ * is bounded by that TTL; callers who need immediate revocation opt out with
+ * `session: { cookieCache: { enabled: false } }` (or the `strict` preset).
+ *
+ * Every explicit caller value is forwarded verbatim. The two `rateLimit` fills
+ * merge into a single `rateLimit` object so neither clobbers the other.
+ */
+declare const resolveAuthOptions: (options: LunoraAuthOptions) => LunoraAuthOptions;
+/**
+ * Create the auth instance. Thin wrapper around `betterAuth` that enforces
+ * the `secret` requirement at construction time so misconfigured deployments
+ * fail loudly at the first fetch rather than the first sign-in attempt, then
+ * hands {@link resolveAuthOptions}'s hardened, default-filled options to
+ * better-auth.
+ */
+declare const createAuth: (options: LunoraAuthOptions) => LunoraAuth;
+export { LunoraAuth as L, LunoraAuthOptions as a, createAuth as c, resolveAuthOptions as r };