@mars-stack/core 0.4.0

package/dist/chunk-QAH2Y5WK.js

@@ -0,0 +1,93 @@
+// src/database/index.ts
+var DatabaseError = class extends Error {
+  constructor(message, hint) {
+    super(message);
+    this.name = "DatabaseError";
+    this.hint = hint;
+  }
+};
+var ERROR_PATTERNS = [
+  {
+    test: (msg) => msg.includes("Can't reach database") || msg.includes("Connection refused") || msg.includes("ECONNREFUSED"),
+    message: "Cannot connect to the database",
+    hint: "Is your database running? Try:\n  \u2192 yarn dev          (starts embedded local Postgres)\n  \u2192 Check your DATABASE_URL in .env\n  \u2192 If using Neon/Supabase, check your connection string and network"
+  },
+  {
+    test: (msg) => msg.includes("denied access") || msg.includes("password authentication failed") || msg.includes("authentication failed"),
+    message: "Database authentication failed",
+    hint: "Check your DATABASE_URL credentials.\n  \u2192 Ensure the username and password match your database config"
+  },
+  {
+    test: (msg, code) => msg.includes("does not exist") || msg.includes("not available") || code === "P1003",
+    message: "Database does not exist",
+    hint: "The database has not been created yet. Run:\n  \u2192 yarn db:push               (push schema and create tables)\n  \u2192 Or: yarn db:migrate dev     (run migrations)"
+  },
+  {
+    test: (msg, code) => msg.includes("table") && msg.includes("does not exist") || code === "P2021",
+    message: "Database tables are missing",
+    hint: "The database exists but tables haven't been created. Run:\n  \u2192 yarn db:push               (push schema to database)\n  \u2192 Or: yarn db:migrate dev     (run migrations)"
+  },
+  {
+    test: (_msg, code) => code === "P2002",
+    message: "Unique constraint violation",
+    hint: "A record with that value already exists."
+  },
+  {
+    test: (msg) => msg.includes("timed out") || msg.includes("ETIMEDOUT"),
+    message: "Database connection timed out",
+    hint: "The database is not responding. Check:\n  \u2192 Is your database host reachable?\n  \u2192 Are you behind a firewall or VPN?\n  \u2192 If using a cloud provider, check the dashboard for status"
+  },
+  {
+    test: (msg) => msg.includes("SSL") || msg.includes("sslmode"),
+    message: "Database SSL connection error",
+    hint: "Your database requires SSL. Ensure your DATABASE_URL includes:\n  \u2192 ?sslmode=require            (for Neon, Supabase, etc.)"
+  }
+];
+function formatDatabaseError(error) {
+  if (error instanceof DatabaseError) return error;
+  const message = error instanceof Error ? error.message : String(error);
+  const code = error?.code;
+  for (const pattern of ERROR_PATTERNS) {
+    if (pattern.test(message, code)) {
+      return new DatabaseError(pattern.message, pattern.hint);
+    }
+  }
+  return new DatabaseError(
+    "An unexpected database error occurred",
+    "Check the full error log above for details. Common fixes:\n  \u2192 Ensure database is running\n  \u2192 yarn db:push                (ensure schema is up to date)\n  \u2192 Check DATABASE_URL in .env"
+  );
+}
+function isDatabaseError(error) {
+  if (error instanceof DatabaseError) return true;
+  const name = error?.name || "";
+  return name.startsWith("PrismaClient");
+}
+function createPrismaProxy(factory) {
+  let client = null;
+  function getClient() {
+    if (client) return client;
+    const instance = factory();
+    if (process.env.NODE_ENV !== "production") {
+      const g = globalThis;
+      if (!g.__marsjs_prisma) {
+        g.__marsjs_prisma = instance;
+      }
+      client = g.__marsjs_prisma;
+    } else {
+      client = instance;
+    }
+    return client;
+  }
+  return new Proxy({}, {
+    get(_target, prop) {
+      const c = getClient();
+      const value = c[prop];
+      if (typeof value === "function") {
+        return value.bind(c);
+      }
+      return value;
+    }
+  });
+}
+
+export { DatabaseError, createPrismaProxy, formatDatabaseError, isDatabaseError };

package/dist/chunk-QWMN5UJC.js

@@ -0,0 +1,76 @@
+import { AUTH_RESPONSES, validateOwnership } from './chunk-ZA46T6GX.js';
+import { NextResponse } from 'next/server';
+
+function createAuthMiddleware(config) {
+  function withAuth(handler) {
+    return async (request, context) => {
+      try {
+        const session = await config.verifySession();
+        if (!session) return AUTH_RESPONSES.UNAUTHORIZED();
+        const authenticatedRequest = request;
+        authenticatedRequest.session = session;
+        return await handler(authenticatedRequest, context);
+      } catch (error) {
+        console.error("Authentication error:", error);
+        return AUTH_RESPONSES.SERVER_ERROR();
+      }
+    };
+  }
+  function withAuthNoParams(handler) {
+    return async (request) => {
+      try {
+        const session = await config.verifySession();
+        if (!session) return AUTH_RESPONSES.UNAUTHORIZED();
+        const authenticatedRequest = request;
+        authenticatedRequest.session = session;
+        return await handler(authenticatedRequest);
+      } catch (error) {
+        console.error("Authentication error:", error);
+        return AUTH_RESPONSES.SERVER_ERROR();
+      }
+    };
+  }
+  function withAuthSimple(handler) {
+    return async (_request) => {
+      try {
+        const session = await config.verifySession();
+        if (!session) return AUTH_RESPONSES.UNAUTHORIZED();
+        return await handler();
+      } catch (error) {
+        console.error("Authentication error:", error);
+        return AUTH_RESPONSES.SERVER_ERROR();
+      }
+    };
+  }
+  function withRole(allowedRoles, handler) {
+    return withAuth(async (request, context) => {
+      const dbRole = await config.findUserRole(request.session.userId);
+      if (!dbRole || !allowedRoles.includes(dbRole)) {
+        return AUTH_RESPONSES.FORBIDDEN();
+      }
+      request.session.role = dbRole;
+      return await handler(request, context);
+    });
+  }
+  function withOwnership(getResourceUserId, handler) {
+    return withAuth(async (request, context) => {
+      const resourceUserId = await getResourceUserId(request, context);
+      if (!resourceUserId) {
+        return NextResponse.json({ error: "Resource not found" }, { status: 404 });
+      }
+      if (!validateOwnership(resourceUserId, request.session.userId)) {
+        return AUTH_RESPONSES.FORBIDDEN();
+      }
+      return await handler(request, context);
+    });
+  }
+  return {
+    withAuth,
+    withAuthNoParams,
+    withAuthSimple,
+    withRole,
+    withOwnership
+  };
+}
+
+export { createAuthMiddleware };

package/dist/chunk-ROQV54MU.js

@@ -0,0 +1,117 @@
+import pino from 'pino';
+
+// src/logger/index.ts
+var SecurityEventType = /* @__PURE__ */ ((SecurityEventType2) => {
+  SecurityEventType2["LOGIN_SUCCESS"] = "login_success";
+  SecurityEventType2["LOGIN_FAILURE"] = "login_failure";
+  SecurityEventType2["LOGOUT"] = "logout";
+  SecurityEventType2["SESSION_EXPIRED"] = "session_expired";
+  SecurityEventType2["ACCOUNT_CREATED"] = "account_created";
+  SecurityEventType2["ACCOUNT_LOCKED"] = "account_locked";
+  SecurityEventType2["ACCOUNT_UNLOCKED"] = "account_unlocked";
+  SecurityEventType2["EMAIL_VERIFIED"] = "email_verified";
+  SecurityEventType2["PASSWORD_CHANGED"] = "password_changed";
+  SecurityEventType2["PASSWORD_RESET_REQUESTED"] = "password_reset_requested";
+  SecurityEventType2["PASSWORD_RESET_COMPLETED"] = "password_reset_completed";
+  SecurityEventType2["CSRF_VIOLATION"] = "csrf_violation";
+  SecurityEventType2["RATE_LIMIT_EXCEEDED"] = "rate_limit_exceeded";
+  SecurityEventType2["SUSPICIOUS_LOGIN"] = "suspicious_login";
+  SecurityEventType2["MULTIPLE_FAILED_LOGINS"] = "multiple_failed_logins";
+  SecurityEventType2["SESSION_HIJACK_ATTEMPT"] = "session_hijack_attempt";
+  SecurityEventType2["ADMIN_LOGIN"] = "admin_login";
+  SecurityEventType2["ADMIN_ACTION"] = "admin_action";
+  SecurityEventType2["PRIVILEGE_ESCALATION_ATTEMPT"] = "privilege_escalation_attempt";
+  SecurityEventType2["SECURITY_HEADER_VIOLATION"] = "security_header_violation";
+  SecurityEventType2["INVALID_TOKEN"] = "invalid_token";
+  SecurityEventType2["EXPIRED_TOKEN"] = "expired_token";
+  return SecurityEventType2;
+})(SecurityEventType || {});
+function createLogger(config) {
+  const logger = pino({
+    level: process.env.LOG_LEVEL || "info",
+    formatters: {
+      level: (label) => ({ level: label })
+    },
+    timestamp: pino.stdTimeFunctions.isoTime
+  });
+  const serviceName = config.serviceName.toLowerCase().replace(/\s+/g, "-");
+  const appLogger = logger.child({ service: serviceName });
+  const authLogger = logger.child({ service: serviceName, domain: "auth" });
+  const securityLogger = logger.child({ service: serviceName, domain: "security" });
+  const apiLogger = logger.child({ service: serviceName, domain: "api" });
+  const logSecurityEvent = {
+    loginSuccess: (event) => {
+      securityLogger.info({ event_type: "login_success" /* LOGIN_SUCCESS */, ...event }, "User login successful");
+    },
+    loginFailure: (event) => {
+      securityLogger.warn({ event_type: "login_failure" /* LOGIN_FAILURE */, ...event }, `Login failed: ${event.reason}`);
+    },
+    logout: (event) => {
+      securityLogger.info({ event_type: "logout" /* LOGOUT */, ...event }, "User logout");
+    },
+    accountCreated: (event) => {
+      securityLogger.info({ event_type: "account_created" /* ACCOUNT_CREATED */, ...event }, "New account created");
+    },
+    accountLocked: (event) => {
+      securityLogger.error(
+        { event_type: "account_locked" /* ACCOUNT_LOCKED */, ...event },
+        `Account locked after ${event.failedAttempts} failed attempts`
+      );
+    },
+    emailVerified: (event) => {
+      securityLogger.info({ event_type: "email_verified" /* EMAIL_VERIFIED */, ...event }, "Email verified");
+    },
+    passwordChanged: (event) => {
+      securityLogger.info(
+        { event_type: "password_changed" /* PASSWORD_CHANGED */, ...event },
+        `Password changed via ${event.method}`
+      );
+    },
+    csrfViolation: (event) => {
+      securityLogger.error(
+        { event_type: "csrf_violation" /* CSRF_VIOLATION */, ...event },
+        `CSRF violation detected on ${event.endpoint || "unknown endpoint"}`
+      );
+    },
+    rateLimitExceeded: (event) => {
+      securityLogger.warn(
+        { event_type: "rate_limit_exceeded" /* RATE_LIMIT_EXCEEDED */, ...event },
+        `Rate limit exceeded for ${event.limitType}: ${event.identifier}`
+      );
+    },
+    suspiciousLogin: (event) => {
+      securityLogger.error(
+        { event_type: "suspicious_login" /* SUSPICIOUS_LOGIN */, ...event },
+        `Suspicious login detected: ${event.reason}`
+      );
+    },
+    adminLogin: (event) => {
+      securityLogger.info(
+        { event_type: "admin_login" /* ADMIN_LOGIN */, ...event, requires_audit: true },
+        "Admin user login"
+      );
+    },
+    adminAction: (event) => {
+      securityLogger.info(
+        { event_type: "admin_action" /* ADMIN_ACTION */, ...event, requires_audit: true },
+        `Admin action: ${event.action}`
+      );
+    },
+    invalidToken: (event) => {
+      securityLogger.warn(
+        { event_type: "invalid_token" /* INVALID_TOKEN */, ...event },
+        `Invalid ${event.tokenType} token`
+      );
+    }
+  };
+  return {
+    logger,
+    appLogger,
+    authLogger,
+    securityLogger,
+    apiLogger,
+    logSecurityEvent
+  };
+}
+
+export { SecurityEventType, createLogger };

package/dist/chunk-U4NZQ366.js

@@ -0,0 +1,46 @@
+import { isDatabaseError, formatDatabaseError } from './chunk-QAH2Y5WK.js';
+import { NextResponse } from 'next/server';
+import { z } from 'zod';
+
+function logDatabaseError(logger, error, endpoint) {
+  const separator = "\u2500".repeat(60);
+  const lines = [
+    "",
+    separator,
+    `  DATABASE ERROR on ${endpoint}`,
+    separator,
+    "",
+    `  ${error.message}`,
+    "",
+    "  How to fix:",
+    ...error.hint.split("\n").map((line) => `  ${line}`),
+    "",
+    separator,
+    ""
+  ];
+  logger.error(lines.join("\n"));
+}
+function createApiErrorHandler(config) {
+  function handleApiError(error, options) {
+    const { endpoint, fallbackMessage = "An unexpected error occurred" } = options;
+    if (error instanceof z.ZodError) {
+      return NextResponse.json({ error: error.issues[0].message }, { status: 400 });
+    }
+    if (isDatabaseError(error)) {
+      const dbError = formatDatabaseError(error);
+      logDatabaseError(config.logger, dbError, endpoint);
+      return NextResponse.json(
+        { error: "Service temporarily unavailable. Please try again later." },
+        { status: 503 }
+      );
+    }
+    config.logger.error(
+      { error: error instanceof Error ? error.message : String(error), endpoint },
+      `Unhandled error on ${endpoint}`
+    );
+    return NextResponse.json({ error: fallbackMessage }, { status: 500 });
+  }
+  return { handleApiError };
+}
+
+export { createApiErrorHandler };

package/dist/chunk-WBJOIENS.js

@@ -0,0 +1,22 @@
+// src/auth/link-utils.ts
+function normalizeEmailFromQueryParam(rawEmail) {
+  return rawEmail.trim().replace(/ /g, "+");
+}
+function buildEmailVerificationUrl({
+  baseUrl,
+  token
+}) {
+  return new URL(`/verify/${token}`, baseUrl).toString();
+}
+function buildPasswordResetUrl({
+  baseUrl,
+  token,
+  email
+}) {
+  const url = new URL("/reset-password", baseUrl);
+  url.searchParams.set("token", token);
+  url.searchParams.set("email", email);
+  return url.toString();
+}
+
+export { buildEmailVerificationUrl, buildPasswordResetUrl, normalizeEmailFromQueryParam };

package/dist/chunk-WO6FHJHG.js

@@ -0,0 +1,29 @@
+import 'server-only';
+import { z } from 'zod';
+
+// src/auth/password.ts
+var PASSWORD_PREHASH_DOMAIN = "mars-password-v1";
+async function sha256Prehash(password) {
+  const payload = `${PASSWORD_PREHASH_DOMAIN}:${password}`;
+  const data = new TextEncoder().encode(payload);
+  const digest = await crypto.subtle.digest("SHA-256", data);
+  return Array.from(new Uint8Array(digest)).map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+var passwordSchema = z.string().min(8, "Password must be at least 8 characters").max(100, "Password must be less than 100 characters").regex(/[A-Z]/, "Password must contain at least one uppercase letter").regex(/[a-z]/, "Password must contain at least one lowercase letter").regex(/[0-9]/, "Password must contain at least one number").regex(/[^A-Za-z0-9]/, "Password must contain at least one special character").refine(
+  (password) => !password.toLowerCase().includes("password"),
+  "Password cannot contain 'password'"
+).refine((password) => !password.includes("123"), "Password cannot contain sequential numbers");
+async function hashPassword(password) {
+  const { hash } = await import('bcryptjs');
+  const prehashed = await sha256Prehash(password);
+  return hash(prehashed, 12);
+}
+async function verifyPassword(plainPassword, hashedPassword) {
+  const { compare } = await import('bcryptjs');
+  const prehashed = await sha256Prehash(plainPassword);
+  const matches = await compare(prehashed, hashedPassword);
+  if (matches) return true;
+  return compare(plainPassword, hashedPassword);
+}
+
+export { hashPassword, passwordSchema, verifyPassword };

package/dist/chunk-Z5BEKPJI.js

@@ -0,0 +1,96 @@
+import 'server-only';
+import { z } from 'zod';
+
+// src/env/index.ts
+var emptyToUndefined = z.literal("").transform(() => void 0);
+function optionalString() {
+  return emptyToUndefined.or(z.string());
+}
+function optionalUrl() {
+  return emptyToUndefined.or(z.string().url());
+}
+function optionalEmail() {
+  return emptyToUndefined.or(z.string().email());
+}
+function getEnvironment() {
+  if (process.env.VERCEL_ENV === "production") return "production";
+  if (process.env.VERCEL_ENV === "preview") return "staging";
+  return "development";
+}
+function createEnvValidator(config) {
+  const isBuildTime = process.env.NODE_ENV === "production" && (!process.env.VERCEL_ENV || process.env.NEXT_PHASE === "phase-production-build");
+  function buildEnvSchema() {
+    const isDev = process.env.NODE_ENV === "development";
+    const isProd = process.env.NODE_ENV === "production";
+    const jwtSecretSchema = isBuildTime ? optionalString().optional() : z.string().min(32).refine(
+      (s) => new Set(s.split("")).size >= 16,
+      "JWT_SECRET should have at least 16 unique characters for sufficient entropy"
+    );
+    const base = {
+      DATABASE_URL: isBuildTime || isDev ? optionalUrl().optional() : z.string().url(),
+      APP_URL: optionalUrl().optional(),
+      JWT_SECRET: jwtSecretSchema,
+      LOG_LEVEL: optionalString().optional(),
+      COMING_SOON: optionalString().optional()
+    };
+    if (config.features.auth) {
+      base.GOOGLE_CLIENT_ID = optionalString().optional();
+      base.GOOGLE_CLIENT_SECRET = optionalString().optional();
+    }
+    const emailProvider = config.services.email?.provider;
+    if (emailProvider && emailProvider !== "console") {
+      base.SENDGRID_API_KEY = isProd && !isBuildTime ? z.string().min(1, "SENDGRID_API_KEY required when email provider is sendgrid") : optionalString().optional();
+      base.SENDGRID_FROM_EMAIL = optionalEmail().optional();
+    }
+    const storageProvider = config.services.storage?.provider;
+    if (storageProvider === "vercel") {
+      base.BLOB_READ_WRITE_TOKEN = isProd && !isBuildTime ? z.string().min(1, "BLOB_READ_WRITE_TOKEN required when storage provider is vercel") : optionalString().optional();
+    } else if (storageProvider === "s3") {
+      base.AWS_ACCESS_KEY_ID = isProd && !isBuildTime ? z.string().min(1, "AWS_ACCESS_KEY_ID required when storage provider is s3") : optionalString().optional();
+      base.AWS_SECRET_ACCESS_KEY = isProd && !isBuildTime ? z.string().min(1, "AWS_SECRET_ACCESS_KEY required when storage provider is s3") : optionalString().optional();
+      base.AWS_REGION = optionalString().optional();
+      base.S3_BUCKET_NAME = isProd && !isBuildTime ? z.string().min(1, "S3_BUCKET_NAME required when storage provider is s3") : optionalString().optional();
+    }
+    const paymentsProvider = config.services.payments?.provider;
+    if (paymentsProvider && paymentsProvider !== "none") {
+      base.STRIPE_SECRET_KEY = isProd && !isBuildTime ? z.string().min(1, "STRIPE_SECRET_KEY required when payments provider is configured") : optionalString().optional();
+      base.STRIPE_WEBHOOK_SECRET = isProd && !isBuildTime ? z.string().min(1, "STRIPE_WEBHOOK_SECRET required when payments provider is configured") : optionalString().optional();
+      base.NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY = optionalString().optional();
+    }
+    base.UPSTASH_REDIS_REST_URL = optionalUrl().optional();
+    base.UPSTASH_REDIS_REST_TOKEN = optionalString().optional();
+    base.KV_REST_API_URL = optionalUrl().optional();
+    base.KV_REST_API_TOKEN = optionalString().optional();
+    return z.object(base);
+  }
+  let _env = null;
+  function parseEnv() {
+    const result = buildEnvSchema().safeParse(process.env);
+    if (result.success) return result.data;
+    const issues = result.error.issues.map((i) => `  \u2192 ${i.path.join(".")}: ${i.message}`).join("\n");
+    throw new Error(
+      `Environment validation failed:
+${issues}
+
+Check your .env file. Run \`mars doctor\` to diagnose.`
+    );
+  }
+  const env = new Proxy({}, {
+    get(_target, prop) {
+      if (!_env) {
+        _env = parseEnv();
+      }
+      return _env[prop];
+    }
+  });
+  function validateJWTSecret() {
+    const secret = env.JWT_SECRET;
+    if (!secret) {
+      throw new Error("JWT_SECRET is required at runtime");
+    }
+    return secret;
+  }
+  return { env, validateJWTSecret, getEnvironment };
+}
+
+export { createEnvValidator, getEnvironment };

package/dist/chunk-ZA46T6GX.js

@@ -0,0 +1,24 @@
+import { constantTimeEqual } from './chunk-MXQ66RUN.js';
+import 'server-only';
+import { NextResponse } from 'next/server';
+
+var NO_STORE_HEADERS = {
+  "Cache-Control": "no-store, no-cache",
+  Pragma: "no-cache"
+};
+var AUTH_RESPONSES = {
+  UNAUTHORIZED: () => NextResponse.json(
+    { error: "Authentication required" },
+    { status: 401, headers: NO_STORE_HEADERS }
+  ),
+  FORBIDDEN: () => NextResponse.json({ error: "Access denied" }, { status: 403, headers: NO_STORE_HEADERS }),
+  SERVER_ERROR: () => NextResponse.json(
+    { error: "Internal server error" },
+    { status: 500, headers: NO_STORE_HEADERS }
+  )
+};
+function validateOwnership(resourceUserId, sessionUserId) {
+  return constantTimeEqual(resourceUserId, sessionUserId);
+}
+
+export { AUTH_RESPONSES, validateOwnership };

package/dist/configure-mars.d.ts

@@ -0,0 +1,104 @@
+import type { MarsAppConfig, PrismaLike } from './types';
+interface ConfigureMarsOptions {
+    appConfig: MarsAppConfig;
+    prisma: PrismaLike;
+    signInRoute: string;
+}
+export declare function configureMars(options: ConfigureMarsOptions): {
+    logger: import("pino").Logger<never, boolean>;
+    appLogger: import("pino").Logger<never, boolean>;
+    authLogger: import("pino").Logger<never, boolean>;
+    securityLogger: import("pino").Logger<never, boolean>;
+    apiLogger: import("pino").Logger<never, boolean>;
+    logSecurityEvent: {
+        loginSuccess: (event: Omit<import(".").SecurityEvent, "type">) => void;
+        loginFailure: (event: Omit<import(".").SecurityEvent, "type"> & {
+            reason: string;
+        }) => void;
+        logout: (event: Omit<import(".").SecurityEvent, "type">) => void;
+        accountCreated: (event: Omit<import(".").SecurityEvent, "type">) => void;
+        accountLocked: (event: Omit<import(".").SecurityEvent, "type"> & {
+            failedAttempts: number;
+        }) => void;
+        emailVerified: (event: Omit<import(".").SecurityEvent, "type">) => void;
+        passwordChanged: (event: Omit<import(".").SecurityEvent, "type"> & {
+            method: "reset" | "change";
+        }) => void;
+        csrfViolation: (event: Omit<import(".").SecurityEvent, "type"> & {
+            endpoint?: string;
+        }) => void;
+        rateLimitExceeded: (event: Omit<import(".").SecurityEvent, "type"> & {
+            identifier: string;
+            limitType: string;
+        }) => void;
+        suspiciousLogin: (event: Omit<import(".").SecurityEvent, "type"> & {
+            reason: string;
+        }) => void;
+        adminLogin: (event: Omit<import(".").SecurityEvent, "type">) => void;
+        adminAction: (event: Omit<import(".").SecurityEvent, "type"> & {
+            action: string;
+            targetUserId?: string;
+        }) => void;
+        invalidToken: (event: Omit<import(".").SecurityEvent, "type"> & {
+            tokenType: string;
+        }) => void;
+    };
+    sendEmail: (params: import(".").SendEmailParams) => Promise<void>;
+    env: Record<string, unknown>;
+    validateJWTSecret: () => string;
+    getEnvironment: typeof import("./env/index").getEnvironment;
+    createSession: (user: {
+        id: string;
+        email: string;
+        name: string;
+        role: string;
+        emailVerified: boolean;
+        credentialTag: string;
+    }) => Promise<void>;
+    getSession: () => Promise<import(".").SessionPayload | null>;
+    updateSession: () => Promise<void>;
+    deleteSession: () => Promise<void>;
+    verifySession: () => Promise<import(".").SessionPayload>;
+    verifySessionForAPI: () => Promise<import(".").SessionPayload | null>;
+    getCurrentUser: () => Promise<{
+        id: string;
+        email: string;
+        name: string;
+        role: string;
+        emailVerified: boolean;
+    } | null>;
+    generateCSRFToken: (sessionFingerprint?: string) => Promise<string>;
+    verifyCSRFToken: (token: string, expectedFingerprint?: string) => Promise<boolean>;
+    requireCSRFToken: (sessionFingerprint?: string) => Promise<string>;
+    validateCSRFRequest: (request: import("next/server").NextRequest, sessionFingerprint?: string) => Promise<boolean>;
+    withAuth: (handler: import("./auth/middleware").AuthenticatedAPIHandler) => (request: import("next/server").NextRequest, context: {
+        params: Promise<{
+            [key: string]: string;
+        }>;
+    }) => Promise<import("next/server").NextResponse>;
+    withAuthNoParams: (handler: import("./auth/middleware").AuthenticatedAPIHandlerNoParams) => (request: import("next/server").NextRequest) => Promise<import("next/server").NextResponse>;
+    withAuthSimple: (handler: import("./auth/middleware").AuthenticatedAPIHandlerSimple) => (_request: import("next/server").NextRequest) => Promise<import("next/server").NextResponse>;
+    withRole: (allowedRoles: string[], handler: import("./auth/middleware").AuthenticatedAPIHandler) => (request: import("next/server").NextRequest, context: {
+        params: Promise<{
+            [key: string]: string;
+        }>;
+    }) => Promise<import("next/server").NextResponse>;
+    withOwnership: (getResourceUserId: (request: import("./auth/middleware").AuthenticatedRequest, context: {
+        params: Promise<{
+            [key: string]: string;
+        }>;
+    }) => Promise<string | null | undefined>, handler: import("./auth/middleware").AuthenticatedAPIHandler) => (request: import("next/server").NextRequest, context: {
+        params: Promise<{
+            [key: string]: string;
+        }>;
+    }) => Promise<import("next/server").NextResponse>;
+    handleApiError: (error: unknown, options: import("./api-error/index").ApiErrorOptions) => import("next/server").NextResponse;
+    buildOrganizationJsonLd: () => Record<string, unknown>;
+    buildWebSiteJsonLd: () => Record<string, unknown>;
+    buildSiteNavigationJsonLd: (items: import("./seo/index").SiteNavItem[]) => Record<string, unknown>;
+    buildBreadcrumbListJsonLd: (items: import("./seo/index").BreadcrumbItem[]) => Record<string, unknown>;
+    buildArticleJsonLd: (article: import("./seo/index").ArticleJsonLdInput) => Record<string, unknown>;
+    getBaseUrl: (request?: Request) => string;
+};
+export {};
+//# sourceMappingURL=configure-mars.d.ts.map

package/dist/configure-mars.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"configure-mars.d.ts","sourceRoot":"","sources":["../src/configure-mars.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAYzD,UAAU,oBAAoB;IAC5B,SAAS,EAAE,aAAa,CAAC;IACzB,MAAM,EAAE,UAAU,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;CACrB;AAoDD,wBAAgB,aAAa,CAAC,OAAO,EAAE,oBAAoB;;;;;;;;;;;;;;;;;;;;;oBAqCvC,CAAC;;;;;;;;;;;;wBAmCX,CAAR;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iFA3FE,0CAA2B,EAAC;;;;KAGpB;iGAmBV,0CAAoB;6FAkBX,2CAAqB;;;;;;;;;;;;;;;;;;;;;2BAoCA,OAAO,KAAG,MAAM;EAmF/C"}

package/dist/database/index.d.ts

@@ -0,0 +1,8 @@
+export declare class DatabaseError extends Error {
+    readonly hint: string;
+    constructor(message: string, hint: string);
+}
+export declare function formatDatabaseError(error: unknown): DatabaseError;
+export declare function isDatabaseError(error: unknown): boolean;
+export declare function createPrismaProxy<T extends object>(factory: () => T): T;
+//# sourceMappingURL=index.d.ts.map

package/dist/database/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/database/index.ts"],"names":[],"mappings":"AAAA,qBAAa,aAAc,SAAQ,KAAK;IACtC,SAAgB,IAAI,EAAE,MAAM,CAAC;gBAEjB,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM;CAK1C;AAqED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,aAAa,CAmBjE;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAIvD;AAED,wBAAgB,iBAAiB,CAAC,CAAC,SAAS,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,CA+BvE"}

package/dist/database/index.js

@@ -0,0 +1 @@
+export { DatabaseError, createPrismaProxy, formatDatabaseError, isDatabaseError } from '../chunk-QAH2Y5WK.js';

package/dist/email/index.d.ts

@@ -0,0 +1,25 @@
+import type { SendEmailParams, EmailServiceError } from './types';
+export type { SendEmailParams, EmailServiceError };
+export interface EmailProvider {
+    send(params: SendEmailParams): Promise<void>;
+}
+interface EmailServiceConfig {
+    provider: string;
+    appName: string;
+}
+export declare function formatConsoleEmail(params: SendEmailParams): string;
+/**
+ * Creates an email service backed by the configured provider (SendGrid, Resend, or console).
+ * Provider selection is determined by the `config.provider` string; unknown providers
+ * fall back to the console logger.
+ *
+ * @param config - Configuration with provider name and app display name
+ * @returns An object with a `sendEmail` method
+ * @example
+ * const email = createEmailService({ provider: 'resend', appName: 'Acme' });
+ * await email.sendEmail({ to: 'user@example.com', subject: 'Hello', html: '<p>Hi</p>' });
+ */
+export declare function createEmailService(config: EmailServiceConfig): {
+    sendEmail: (params: SendEmailParams) => Promise<void>;
+};
+//# sourceMappingURL=index.d.ts.map

package/dist/email/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/email/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAGlE,YAAY,EAAE,eAAe,EAAE,iBAAiB,EAAE,CAAC;AAEnD,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9C;AAED,UAAU,kBAAkB;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB;AA2ED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,eAAe,GAAG,MAAM,CA0BlE;AAgBD;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,kBAAkB;wBAI1B,eAAe,KAAG,OAAO,CAAC,IAAI,CAAC;EAKjE"}

package/dist/email/index.js

@@ -0,0 +1,2 @@
+export { createEmailService, formatConsoleEmail } from '../chunk-HOSMMQMA.js';
+import '../chunk-CTYAVMOF.js';