@raybase/core 0.0.2 → 0.3.3

package/dist/audit-archive.js

@@ -0,0 +1,178 @@
+import { dataStub } from "./db.js";
+export { sha256Hex } from "./internal.js";
+const dayMs = 24 * 60 * 60 * 1000;
+const defaultLimitBytes = 8 * 1024 * 1024;
+export const auditArchiveContentType = "application/x-ndjson; charset=utf-8";
+function metadataValue(metadata) {
+    if (metadata === null)
+        return null;
+    try {
+        return JSON.parse(metadata);
+    }
+    catch {
+        return metadata;
+    }
+}
+function assertIsoDate(value, name) {
+    if (!/^\d{4}-\d{2}-\d{2}T00:00:00\.000Z$/.test(value)) {
+        throw new Error(`${name} must be a UTC day boundary ISO timestamp`);
+    }
+    const date = new Date(value);
+    if (Number.isNaN(date.getTime()) || date.toISOString() !== value) {
+        throw new Error(`${name} must be a valid UTC timestamp`);
+    }
+    return date;
+}
+function sqliteTimestampToDate(value) {
+    const match = value.match(/^(\d{4})-(\d{2})-(\d{2}) \d{2}:\d{2}:\d{2}$/);
+    if (!match)
+        throw new Error(`Audit createdAt is not a SQLite UTC timestamp: ${value}`);
+    return new Date(`${match[1]}-${match[2]}-${match[3]}T00:00:00.000Z`);
+}
+function startOfUtcDay(date) {
+    return new Date(Date.UTC(date.getUTCFullYear(), date.getUTCMonth(), date.getUTCDate()));
+}
+function isoDay(date) {
+    return startOfUtcDay(date).toISOString();
+}
+export function validateAuditArchiveWindow(input, now = new Date()) {
+    const start = assertIsoDate(input.windowStart, "windowStart");
+    const end = assertIsoDate(input.windowEnd, "windowEnd");
+    if (end.getTime() - start.getTime() !== dayMs) {
+        throw new Error("Audit archive windows must be exactly one complete UTC day");
+    }
+    if (end.getTime() > now.getTime() - dayMs) {
+        throw new Error("Audit archive windowEnd must be at least 24 hours old");
+    }
+    return { windowStart: input.windowStart, windowEnd: input.windowEnd };
+}
+export function auditArchiveObjectKey(windowStart) {
+    const start = assertIsoDate(windowStart, "windowStart");
+    const year = String(start.getUTCFullYear()).padStart(4, "0");
+    const month = String(start.getUTCMonth() + 1).padStart(2, "0");
+    const day = String(start.getUTCDate()).padStart(2, "0");
+    return `audit/v1/year=${year}/month=${month}/day=${day}/raybase-audit-${year}-${month}-${day}.ndjson`;
+}
+export function isoToSqliteTimestamp(value) {
+    const date = new Date(value);
+    if (Number.isNaN(date.getTime()))
+        throw new Error(`Invalid timestamp: ${value}`);
+    return date.toISOString().slice(0, 19).replace("T", " ");
+}
+export function serializeAuditArchiveRows(rows) {
+    if (!rows.length)
+        return "";
+    return `${rows
+        .map((row) => JSON.stringify({
+        id: row.id,
+        actorId: row.actorId,
+        action: row.action,
+        targetType: row.targetType,
+        targetId: row.targetId,
+        metadata: metadataValue(row.metadata),
+        createdAt: row.createdAt
+    }))
+        .join("\n")}\n`;
+}
+export function auditArchiveEnabled(value) {
+    if (!value)
+        return false;
+    return ["1", "true", "yes", "on"].includes(value.trim().toLowerCase());
+}
+export function parseAuditHotDays(value) {
+    if (value === undefined || value.trim() === "")
+        return 1;
+    const days = Number(value);
+    if (!Number.isInteger(days) || days < 1) {
+        throw new Error("RAYBASE_AUDIT_HOT_DAYS must be a positive integer");
+    }
+    return days;
+}
+export async function nextAuditArchiveWindow(stub, now = new Date(), hotDays = 1) {
+    const cutoff = new Date(now.getTime() - hotDays * dayMs);
+    const row = await stub.first(`SELECT MIN("createdAt") as "createdAt" FROM "_audit" WHERE "createdAt" < ?`, [isoToSqliteTimestamp(cutoff.toISOString())]);
+    if (!row?.createdAt)
+        return null;
+    const start = sqliteTimestampToDate(row.createdAt);
+    const end = new Date(start.getTime() + dayMs);
+    if (end.getTime() > cutoff.getTime())
+        return null;
+    return { windowStart: isoDay(start), windowEnd: isoDay(end) };
+}
+function verifyR2Metadata(prepared, object, expectedSize) {
+    if (!object)
+        throw new Error(`Audit archive R2 object was not found after upload: ${prepared.objectKey}`);
+    const metadata = object.customMetadata ?? {};
+    const expected = {
+        "raybase-window-start": prepared.windowStart,
+        "raybase-window-end": prepared.windowEnd,
+        "raybase-row-count": String(prepared.rowCount),
+        "raybase-sha256": prepared.sha256
+    };
+    for (const [key, value] of Object.entries(expected)) {
+        if (metadata[key] !== value) {
+            throw new Error(`Audit archive R2 object metadata mismatch for ${key}`);
+        }
+    }
+    if (expectedSize !== null && object.size !== expectedSize) {
+        throw new Error(`Audit archive R2 object size mismatch for ${prepared.objectKey}`);
+    }
+}
+export async function archiveAuditToR2(env) {
+    if (!auditArchiveEnabled(env.RAYBASE_AUDIT_ARCHIVE_ENABLED)) {
+        return { ok: true, skipped: true, reason: "disabled", archived: false, pruned: false };
+    }
+    if (!env.RAYBASE_AUDIT_ARCHIVE) {
+        return { ok: true, skipped: true, reason: "missing-r2-binding", archived: false, pruned: false };
+    }
+    const stub = dataStub(env);
+    const hotDays = parseAuditHotDays(env.RAYBASE_AUDIT_HOT_DAYS);
+    const window = await nextAuditArchiveWindow(stub, new Date(), hotDays);
+    if (!window) {
+        return { ok: true, skipped: true, reason: "no-eligible-window", archived: false, pruned: false };
+    }
+    const prepared = await stub.prepareAuditArchive({ ...window, limitBytes: defaultLimitBytes });
+    if (prepared.empty) {
+        return { ok: true, skipped: true, reason: "empty-window", archived: false, pruned: false };
+    }
+    const bodySize = prepared.body === undefined ? null : new TextEncoder().encode(prepared.body).byteLength;
+    if (prepared.body !== undefined) {
+        await env.RAYBASE_AUDIT_ARCHIVE.put(prepared.objectKey, prepared.body, {
+            httpMetadata: { contentType: auditArchiveContentType },
+            customMetadata: {
+                "raybase-window-start": prepared.windowStart,
+                "raybase-window-end": prepared.windowEnd,
+                "raybase-row-count": String(prepared.rowCount),
+                "raybase-sha256": prepared.sha256
+            }
+        });
+    }
+    verifyR2Metadata(prepared, await env.RAYBASE_AUDIT_ARCHIVE.head(prepared.objectKey), bodySize);
+    await stub.confirmAuditArchive(prepared);
+    await stub.pruneAuditArchive({
+        windowStart: prepared.windowStart,
+        windowEnd: prepared.windowEnd,
+        objectKey: prepared.objectKey,
+        sha256: prepared.sha256
+    });
+    console.info("Raybase audit archive complete", {
+        windowStart: prepared.windowStart,
+        windowEnd: prepared.windowEnd,
+        objectKey: prepared.objectKey,
+        rowCount: prepared.rowCount
+    });
+    return {
+        ok: true,
+        skipped: false,
+        archived: true,
+        pruned: true,
+        windowStart: prepared.windowStart,
+        windowEnd: prepared.windowEnd,
+        objectKey: prepared.objectKey,
+        rowCount: prepared.rowCount,
+        firstCreatedAt: prepared.firstCreatedAt,
+        lastCreatedAt: prepared.lastCreatedAt,
+        sha256: prepared.sha256
+    };
+}
+//# sourceMappingURL=audit-archive.js.map

package/dist/audit-archive.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-archive.js","sourceRoot":"","sources":["../src/audit-archive.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAInC,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAE1C,MAAM,KAAK,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAClC,MAAM,iBAAiB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAE1C,MAAM,CAAC,MAAM,uBAAuB,GAAG,qCAAqC,CAAC;AAkF7E,SAAS,aAAa,CAAC,QAAuB;IAC5C,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAY,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,KAAa,EAAE,IAAY;IAChD,IAAI,CAAC,oCAAoC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,2CAA2C,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,KAAK,KAAK,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,gCAAgC,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAa;IAC1C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACzE,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,KAAK,EAAE,CAAC,CAAC;IACvF,OAAO,IAAI,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,aAAa,CAAC,IAAU;IAC/B,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,IAAI,CAAC,WAAW,EAAE,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;AAC1F,CAAC;AAED,SAAS,MAAM,CAAC,IAAU;IACxB,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,KAAiD,EAAE,MAAY,IAAI,IAAI,EAAE;IAClH,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;IAC9D,MAAM,GAAG,GAAG,aAAa,CAAC,KAAK,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IACxD,IAAI,GAAG,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,OAAO,EAAE,KAAK,KAAK,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAChF,CAAC;IACD,IAAI,GAAG,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,GAAG,KAAK,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,WAAmB;IACvD,MAAM,KAAK,GAAG,aAAa,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC7D,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC/D,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACxD,OAAO,iBAAiB,IAAI,UAAU,KAAK,QAAQ,GAAG,kBAAkB,IAAI,IAAI,KAAK,IAAI,GAAG,SAAS,CAAC;AACxG,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,KAAK,EAAE,CAAC,CAAC;IACjF,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,IAAgC;IACxE,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IAC5B,OAAO,GAAG,IAAI;SACX,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CACX,IAAI,CAAC,SAAS,CAAC;QACb,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,QAAQ,EAAE,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC;QACrC,SAAS,EAAE,GAAG,CAAC,SAAS;KACzB,CAAC,CACH;SACA,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACpB,CAAC;AAGD,MAAM,UAAU,mBAAmB,CAAC,KAAyB;IAC3D,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAyB;IACzD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,CAAC,CAAC;IACzD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,IAAqC,EACrC,MAAY,IAAI,IAAI,EAAE,EACtB,OAAO,GAAG,CAAC;IAEX,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,OAAO,GAAG,KAAK,CAAC,CAAC;IACzD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAC1B,4EAA4E,EAC5E,CAAC,oBAAoB,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAC7C,CAAC;IACF,IAAI,CAAC,GAAG,EAAE,SAAS;QAAE,OAAO,IAAI,CAAC;IAEjC,MAAM,KAAK,GAAG,qBAAqB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,CAAC;IAC9C,IAAI,GAAG,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE;QAAE,OAAO,IAAI,CAAC;IAClD,OAAO,EAAE,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;AAChE,CAAC;AAED,SAAS,gBAAgB,CAAC,QAA8B,EAAE,MAAuB,EAAE,YAA2B;IAC5G,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;IAC1G,MAAM,QAAQ,GAAG,MAAM,CAAC,cAAc,IAAI,EAAE,CAAC;IAC7C,MAAM,QAAQ,GAA2B;QACvC,sBAAsB,EAAE,QAAQ,CAAC,WAAW;QAC5C,oBAAoB,EAAE,QAAQ,CAAC,SAAS;QACxC,mBAAmB,EAAE,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC9C,gBAAgB,EAAE,QAAQ,CAAC,MAAM;KAClC,CAAC;IACF,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpD,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,KAAK,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,iDAAiD,GAAG,EAAE,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;IACD,IAAI,YAAY,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,6CAA6C,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;IACrF,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAA2B;IAChE,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,6BAA6B,CAAC,EAAE,CAAC;QAC5D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IACzF,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,qBAAqB,EAAE,CAAC;QAC/B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,oBAAoB,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IACnG,CAAC;IAED,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAqB,CAAC;IAC/C,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,IAAI,EAAE,IAAI,IAAI,EAAE,EAAE,OAAO,CAAC,CAAC;IACvE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,oBAAoB,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IACnG,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAC9F,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QACnB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC7F,CAAC;IAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC;IACzG,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,GAAG,CAAC,qBAAqB,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE;YACrE,YAAY,EAAE,EAAE,WAAW,EAAE,uBAAuB,EAAE;YACtD,cAAc,EAAE;gBACd,sBAAsB,EAAE,QAAQ,CAAC,WAAW;gBAC5C,oBAAoB,EAAE,QAAQ,CAAC,SAAS;gBACxC,mBAAmB,EAAE,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAC9C,gBAAgB,EAAE,QAAQ,CAAC,MAAM;aAClC;SACF,CAAC,CAAC;IACL,CAAC;IAED,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,CAAC,qBAAqB,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC/F,MAAM,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,IAAI,CAAC,iBAAiB,CAAC;QAC3B,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,MAAM,EAAE,QAAQ,CAAC,MAAM;KACxB,CAAC,CAAC;IAEH,OAAO,CAAC,IAAI,CAAC,gCAAgC,EAAE;QAC7C,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;KAC5B,CAAC,CAAC;IAEH,OAAO;QACL,EAAE,EAAE,IAAI;QACR,OAAO,EAAE,KAAK;QACd,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,IAAI;QACZ,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,cAAc,EAAE,QAAQ,CAAC,cAAc;QACvC,aAAa,EAAE,QAAQ,CAAC,aAAa;QACrC,MAAM,EAAE,QAAQ,CAAC,MAAM;KACxB,CAAC;AACJ,CAAC"}

package/dist/audit.d.ts

@@ -0,0 +1,54 @@
+import type { SqlExecutor } from "./db.js";
+import type { RaybasePrincipal } from "./principal.js";
+export type RaybaseAuditPrincipalRef = {
+    kind: "user" | "public" | "operator" | "service" | "agent";
+    id: string | null;
+    userId?: string | null;
+    membershipId?: string | null;
+    organizationId?: string | null;
+    appId?: string | null;
+    service?: string | null;
+};
+export type RaybaseAuditTarget = {
+    type: string;
+    id?: string | null;
+};
+export type RaybaseAuditSource = {
+    surface?: string;
+    route?: string;
+    requestId?: string;
+    moduleId?: string;
+    toolName?: string;
+    grantId?: string;
+    organizationId?: string | null;
+    appId?: string | null;
+    scope?: "platform" | "organization" | "app" | string;
+    [key: string]: unknown;
+};
+export type RaybaseAuditEvent = {
+    actor: RaybaseAuditPrincipalRef | RaybasePrincipal | null;
+    runAs?: RaybaseAuditPrincipalRef | RaybasePrincipal | null;
+    action: string;
+    target: RaybaseAuditTarget;
+    metadata?: unknown;
+    source?: RaybaseAuditSource;
+};
+export type RaybaseAuditContextEvent = Omit<RaybaseAuditEvent, "actor" | "runAs"> & {
+    actor?: RaybaseAuditEvent["actor"];
+    runAs?: RaybaseAuditEvent["runAs"];
+};
+export declare function recordAudit(db: SqlExecutor, event: RaybaseAuditEvent): Promise<void>;
+/** The `_audit` column values `recordAudit` writes for `event`, for callers that insert inside their own transaction. */
+export declare function auditRowValues(event: RaybaseAuditEvent): {
+    actorKind: string | null;
+    actorId: string | null;
+    runAsKind: string | null;
+    runAsId: string | null;
+    action: string;
+    targetType: string;
+    targetId: string | null;
+    metadata: string | null;
+};
+export declare function auditPrincipalRef(input: RaybaseAuditPrincipalRef | RaybasePrincipal | null | undefined): RaybaseAuditPrincipalRef | null;
+export declare function actorAuditRef(id: string | null, kind?: RaybaseAuditPrincipalRef["kind"]): RaybaseAuditPrincipalRef | null;
+//# sourceMappingURL=audit.d.ts.map

package/dist/audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../src/audit.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAGvD,MAAM,MAAM,wBAAwB,GAAG;IACrC,IAAI,EAAE,MAAM,GAAG,QAAQ,GAAG,UAAU,GAAG,SAAS,GAAG,OAAO,CAAC;IAC3D,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,KAAK,CAAC,EAAE,UAAU,GAAG,cAAc,GAAG,KAAK,GAAG,MAAM,CAAC;IACrD,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,KAAK,EAAE,wBAAwB,GAAG,gBAAgB,GAAG,IAAI,CAAC;IAC1D,KAAK,CAAC,EAAE,wBAAwB,GAAG,gBAAgB,GAAG,IAAI,CAAC;IAC3D,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,kBAAkB,CAAC;IAC3B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,kBAAkB,CAAC;CAC7B,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG,IAAI,CAAC,iBAAiB,EAAE,OAAO,GAAG,OAAO,CAAC,GAAG;IAClF,KAAK,CAAC,EAAE,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACnC,KAAK,CAAC,EAAE,iBAAiB,CAAC,OAAO,CAAC,CAAC;CACpC,CAAC;AAEF,wBAAsB,WAAW,CAAC,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAO1F;AAED,yHAAyH;AACzH,wBAAgB,cAAc,CAAC,KAAK,EAAE,iBAAiB,GAAG;IACxD,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB,CAaA;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,wBAAwB,GAAG,gBAAgB,GAAG,IAAI,GAAG,SAAS,GAAG,wBAAwB,GAAG,IAAI,CAwDxI;AAED,wBAAgB,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,EAAE,IAAI,GAAE,wBAAwB,CAAC,MAAM,CAAU,GAAG,wBAAwB,GAAG,IAAI,CAEjI"}

package/dist/audit.js

@@ -0,0 +1,95 @@
+import { randomId } from "./sql.js";
+export async function recordAudit(db, event) {
+    const row = auditRowValues(event);
+    await db.run(`INSERT INTO "_audit" ("id", "actorKind", "actorId", "runAsKind", "runAsId", "action", "targetType", "targetId", "metadata")
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`, [randomId("audit"), row.actorKind, row.actorId, row.runAsKind, row.runAsId, row.action, row.targetType, row.targetId, row.metadata]);
+}
+/** The `_audit` column values `recordAudit` writes for `event`, for callers that insert inside their own transaction. */
+export function auditRowValues(event) {
+    const actor = auditPrincipalRef(event.actor);
+    const runAs = event.runAs === undefined ? null : auditPrincipalRef(event.runAs);
+    return {
+        actorKind: actor?.kind ?? null,
+        actorId: actorStorageId(actor),
+        runAsKind: runAs?.kind ?? null,
+        runAsId: runAs?.id ?? null,
+        action: event.action,
+        targetType: event.target.type,
+        targetId: event.target.id ?? null,
+        metadata: event.metadata === undefined ? null : JSON.stringify(event.metadata)
+    };
+}
+export function auditPrincipalRef(input) {
+    if (!input)
+        return null;
+    if ("user" in input && input.kind === "user") {
+        const userId = input.userId ?? input.user.id;
+        return {
+            kind: "user",
+            id: input.membershipId ?? userId,
+            userId,
+            membershipId: input.membershipId,
+            organizationId: input.organizationId,
+            appId: input.appId
+        };
+    }
+    if ("user" in input && input.kind === "operator") {
+        const userId = input.userId ?? input.user.id;
+        return {
+            kind: "operator",
+            id: userId,
+            userId,
+            membershipId: input.membershipId,
+            organizationId: input.organizationId,
+            appId: input.appId
+        };
+    }
+    if (input.kind === "public") {
+        return {
+            kind: "public",
+            id: input.id,
+            organizationId: input.organizationId,
+            appId: input.appId
+        };
+    }
+    if (input.kind === "service") {
+        return {
+            kind: "service",
+            id: input.id ?? input.service ?? null,
+            service: input.service,
+            organizationId: input.organizationId,
+            appId: input.appId
+        };
+    }
+    if (input.kind === "agent" && "onBehalfOf" in input) {
+        // The agent is the actor; the person it ran for is kept on the ref so a
+        // ledger can show both without a join.
+        const user = input.onBehalfOf.kind === "user" ? input.onBehalfOf.user : null;
+        return {
+            kind: "agent",
+            id: input.agent,
+            userId: user ? input.userId ?? user.identityId ?? user.id : null,
+            membershipId: input.membershipId ?? null,
+            organizationId: input.organizationId,
+            appId: input.appId,
+            service: input.onBehalfOf.kind === "service" ? input.onBehalfOf.service : null
+        };
+    }
+    return input;
+}
+export function actorAuditRef(id, kind = "user") {
+    return id === null ? null : { kind, id };
+}
+function actorStorageId(ref) {
+    if (!ref)
+        return null;
+    if (ref.kind === "service" || ref.kind === "public")
+        return null;
+    // actorId references a user row. An agent row keeps the person it ran for
+    // there (null for service runs); the agent name travels in the ref id and
+    // in action audit metadata.
+    if (ref.kind === "agent")
+        return ref.userId ?? null;
+    return ref.userId ?? ref.id;
+}
+//# sourceMappingURL=audit.js.map

package/dist/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../src/audit.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AA4CpC,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,EAAe,EAAE,KAAwB;IACzE,MAAM,GAAG,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IAClC,MAAM,EAAE,CAAC,GAAG,CACV;wCACoC,EACpC,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,CACpI,CAAC;AACJ,CAAC;AAED,yHAAyH;AACzH,MAAM,UAAU,cAAc,CAAC,KAAwB;IAUrD,MAAM,KAAK,GAAG,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAChF,OAAO;QACL,SAAS,EAAE,KAAK,EAAE,IAAI,IAAI,IAAI;QAC9B,OAAO,EAAE,cAAc,CAAC,KAAK,CAAC;QAC9B,SAAS,EAAE,KAAK,EAAE,IAAI,IAAI,IAAI;QAC9B,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,IAAI;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI;QAC7B,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,IAAI,IAAI;QACjC,QAAQ,EAAE,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC;KAC/E,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAqE;IACrG,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC7C,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7C,OAAO;YACL,IAAI,EAAE,MAAM;YACZ,EAAE,EAAE,KAAK,CAAC,YAAY,IAAI,MAAM;YAChC,MAAM;YACN,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QACjD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7C,OAAO;YACL,IAAI,EAAE,UAAU;YAChB,EAAE,EAAE,MAAM;YACV,MAAM;YACN,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO;YACL,IAAI,EAAE,QAAQ;YACd,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO;YACL,IAAI,EAAE,SAAS;YACf,EAAE,EAAE,KAAK,CAAC,EAAE,IAAI,KAAK,CAAC,OAAO,IAAI,IAAI;YACrC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,YAAY,IAAI,KAAK,EAAE,CAAC;QACpD,wEAAwE;QACxE,uCAAuC;QACvC,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QAC7E,OAAO;YACL,IAAI,EAAE,OAAO;YACb,EAAE,EAAE,KAAK,CAAC,KAAK;YACf,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI;YAChE,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,IAAI;YACxC,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,OAAO,EAAE,KAAK,CAAC,UAAU,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI;SAC/E,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,EAAiB,EAAE,OAAyC,MAAM;IAC9F,OAAO,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;AAC3C,CAAC;AAED,SAAS,cAAc,CAAC,GAAoC;IAC1D,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACjE,0EAA0E;IAC1E,0EAA0E;IAC1E,4BAA4B;IAC5B,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,GAAG,CAAC,MAAM,IAAI,IAAI,CAAC;IACpD,OAAO,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,EAAE,CAAC;AAC9B,CAAC"}

package/dist/auth-logger.d.ts

@@ -0,0 +1,28 @@
+import type { BetterAuthOptions } from "better-auth";
+/**
+ * Better Auth's startup diagnostics, deduped per isolate.
+ *
+ * In the Workers runtime the environment arrives with the request, so
+ * `createRaybaseAuth` builds a fresh Better Auth instance on *every* request.
+ * A few of Better Auth's startup warnings are derived only from env and config,
+ * never from the request, so each rebuild re-emits the identical line. With the
+ * local fallback secret (`raybase-local-dev-secret`, 24 characters and ~89 bits
+ * of estimated entropy) that is two secret warnings on every request, plus the
+ * base-URL warning when no `BETTER_AUTH_URL` is set — enough to drown `raybase
+ * dev` logs while an idle app polls.
+ *
+ * This logger forwards everything Better Auth logs, unchanged, and drops only
+ * *exact repeats* of those boot-constant lines. The first emission in an isolate
+ * always prints, in every environment: a genuinely weak production secret still
+ * warns loudly, it just says so once per boot instead of once per request.
+ */
+/** Levels Better Auth hands to a custom `log` handler (`success` arrives as `info`). */
+export type RaybaseBetterAuthLogLevel = "debug" | "info" | "warn" | "error";
+export type RaybaseBetterAuthLogSink = (level: RaybaseBetterAuthLogLevel, message: string, args: unknown[]) => void;
+export declare function isRaybaseBetterAuthBootWarning(message: string): boolean;
+/** Test seam: forget what this isolate has already emitted. */
+export declare function resetRaybaseBetterAuthBootWarnings(): void;
+export declare function createRaybaseBetterAuthLogger(sink?: RaybaseBetterAuthLogSink): NonNullable<BetterAuthOptions["logger"]>;
+/** One shared instance; the dedupe state is module-level and isolate-wide anyway. */
+export declare const raybaseBetterAuthLogger: import("better-auth").Logger;
+//# sourceMappingURL=auth-logger.d.ts.map

package/dist/auth-logger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-logger.d.ts","sourceRoot":"","sources":["../src/auth-logger.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAErD;;;;;;;;;;;;;;;;GAgBG;AAEH,wFAAwF;AACxF,MAAM,MAAM,yBAAyB,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;AAE5E,MAAM,MAAM,wBAAwB,GAAG,CAAC,KAAK,EAAE,yBAAyB,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;AAkBpH,wBAAgB,8BAA8B,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAEvE;AAED,+DAA+D;AAC/D,wBAAgB,kCAAkC,IAAI,IAAI,CAEzD;AAkBD,wBAAgB,6BAA6B,CAAC,IAAI,GAAE,wBAAsC,GAAG,WAAW,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAUpI;AAED,qFAAqF;AACrF,eAAO,MAAM,uBAAuB,8BAAkC,CAAC"}

package/dist/auth-logger.js

@@ -0,0 +1,53 @@
+/**
+ * Message prefixes for warnings that can only ever say the same thing for the
+ * life of an isolate, because they are computed from env and config at
+ * construction time. Repeats carry no new information.
+ */
+const bootConstantWarningPrefixes = [
+    // secret length + entropy checks, single-secret form
+    "[better-auth] Warning: your BETTER_AUTH_SECRET",
+    // the same two checks, `secrets` array form
+    "[better-auth] Warning: the current secret",
+    // baseURL resolved from options/env only
+    "[better-auth] Base URL is not set."
+];
+const emittedBootWarnings = new Set();
+export function isRaybaseBetterAuthBootWarning(message) {
+    return bootConstantWarningPrefixes.some((prefix) => message.startsWith(prefix));
+}
+/** Test seam: forget what this isolate has already emitted. */
+export function resetRaybaseBetterAuthBootWarnings() {
+    emittedBootWarnings.clear();
+}
+/**
+ * Mirrors Better Auth's own plain-text log format. The Workers runtime reports
+ * no color support, so this is byte-for-byte what its default logger prints
+ * there today.
+ */
+function formatMessage(level, message) {
+    return `${new Date().toISOString()} ${level.toUpperCase()} [Better Auth]: ${message}`;
+}
+const consoleSink = (level, message, args) => {
+    const formatted = formatMessage(level, message);
+    if (level === "error")
+        console.error(formatted, ...args);
+    else if (level === "warn")
+        console.warn(formatted, ...args);
+    else
+        console.log(formatted, ...args);
+};
+export function createRaybaseBetterAuthLogger(sink = consoleSink) {
+    return {
+        log: (level, message, ...args) => {
+            if (isRaybaseBetterAuthBootWarning(message)) {
+                if (emittedBootWarnings.has(message))
+                    return;
+                emittedBootWarnings.add(message);
+            }
+            sink(level, message, args);
+        }
+    };
+}
+/** One shared instance; the dedupe state is module-level and isolate-wide anyway. */
+export const raybaseBetterAuthLogger = createRaybaseBetterAuthLogger();
+//# sourceMappingURL=auth-logger.js.map

package/dist/auth-logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-logger.js","sourceRoot":"","sources":["../src/auth-logger.ts"],"names":[],"mappings":"AAyBA;;;;GAIG;AACH,MAAM,2BAA2B,GAAG;IAClC,qDAAqD;IACrD,gDAAgD;IAChD,4CAA4C;IAC5C,2CAA2C;IAC3C,yCAAyC;IACzC,oCAAoC;CAC5B,CAAC;AAEX,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAU,CAAC;AAE9C,MAAM,UAAU,8BAA8B,CAAC,OAAe;IAC5D,OAAO,2BAA2B,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;AAClF,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,kCAAkC;IAChD,mBAAmB,CAAC,KAAK,EAAE,CAAC;AAC9B,CAAC;AAED;;;;GAIG;AACH,SAAS,aAAa,CAAC,KAAgC,EAAE,OAAe;IACtE,OAAO,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,KAAK,CAAC,WAAW,EAAE,mBAAmB,OAAO,EAAE,CAAC;AACxF,CAAC;AAED,MAAM,WAAW,GAA6B,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACrE,MAAM,SAAS,GAAG,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAChD,IAAI,KAAK,KAAK,OAAO;QAAE,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,CAAC;SACpD,IAAI,KAAK,KAAK,MAAM;QAAE,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,CAAC;;QACvD,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,CAAC;AACvC,CAAC,CAAC;AAEF,MAAM,UAAU,6BAA6B,CAAC,OAAiC,WAAW;IACxF,OAAO;QACL,GAAG,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,EAAE;YAC/B,IAAI,8BAA8B,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC5C,IAAI,mBAAmB,CAAC,GAAG,CAAC,OAAO,CAAC;oBAAE,OAAO;gBAC7C,mBAAmB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACnC,CAAC;YACD,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QAC7B,CAAC;KACF,CAAC;AACJ,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,MAAM,uBAAuB,GAAG,6BAA6B,EAAE,CAAC"}

package/dist/auth-password-secret.d.ts

@@ -0,0 +1,59 @@
+import { type BackupKdfDescriptor, type BackupPasswordSecretEventType, type BackupWrapParticipant, type RaybaseBackupPasswordSecretLifecycle } from "./backup-crypto.js";
+import type { SqlExecutor } from "./db.js";
+export declare const raybaseAuthPasswordSecretStateTableName = "_auth_password_secret_state";
+export declare const raybaseAuthPasswordProviderStateTableName = "_auth_password_provider_state";
+export declare const raybasePasswordSecretPurpose = "backup-key-provider";
+export declare const raybasePasswordSecretKdfProfile: {
+    readonly algorithm: "PBKDF2-SHA-256";
+    readonly version: 1;
+    readonly iterations: 600000;
+    readonly outputBytes: 32;
+    readonly saltBytes: 16;
+};
+export type RaybasePasswordSecretLifecycleRegistration = {
+    providerId: string;
+    lifecycle: RaybaseBackupPasswordSecretLifecycle;
+};
+export type RaybasePasswordSecretReadinessStatus = "ready" | "needs-login" | "change-destructive" | "reset-destructive" | "no-password-lifecycle";
+export type RaybasePasswordSecretReadiness = {
+    userId: string;
+    providerId: string;
+    providerVersion: string;
+    status: RaybasePasswordSecretReadinessStatus;
+    readyForNewBackups: boolean;
+    passwordVersion: number;
+    lastSuccessEvent: BackupPasswordSecretEventType | null;
+    lastSuccessAt: string | null;
+    lastFailureCode: string | null;
+    lastFailureAt: string | null;
+    destructiveResetAt: string | null;
+};
+export declare function deriveRaybasePasswordSecret(password: string, descriptor: Extract<BackupKdfDescriptor, {
+    algorithm: "PBKDF2-SHA-256";
+}>): Promise<Uint8Array>;
+/**
+ * Resolve selected ready subjects into fresh wrap-time KDF/state views. The
+ * caller must release the result immediately after `wrapDek` settles.
+ */
+export declare function createRaybasePasswordWrapParticipants(db: SqlExecutor, registration: RaybasePasswordSecretLifecycleRegistration, userIds: readonly string[]): Promise<{
+    participants: readonly BackupWrapParticipant[];
+    release(): void;
+}>;
+/**
+ * Runs only after Core has observed a successful password lifecycle operation.
+ * Every failure is reduced to an audit-safe code and swallowed so auth success
+ * is never rewritten as an HTTP failure.
+ */
+export declare function runRaybasePasswordSecretLifecycle(input: {
+    db: SqlExecutor;
+    registration?: RaybasePasswordSecretLifecycleRegistration;
+    event: BackupPasswordSecretEventType;
+    userId: string;
+    password: string;
+    previousPassword?: string;
+    environment?: string;
+    signal?: AbortSignal;
+}): Promise<"not-configured" | "succeeded" | "failed">;
+export declare function listRaybasePasswordSecretReadiness(db: SqlExecutor, registration: RaybasePasswordSecretLifecycleRegistration, userIds?: readonly string[]): Promise<RaybasePasswordSecretReadiness[]>;
+export declare function assertRaybasePasswordSecretParticipantsReady(db: SqlExecutor, registration: RaybasePasswordSecretLifecycleRegistration, requiredUserIds: readonly string[]): Promise<RaybasePasswordSecretReadiness[]>;
+//# sourceMappingURL=auth-password-secret.d.ts.map

package/dist/auth-password-secret.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-password-secret.d.ts","sourceRoot":"","sources":["../src/auth-password-secret.ts"],"names":[],"mappings":"AACA,OAAO,EAGL,KAAK,mBAAmB,EACxB,KAAK,6BAA6B,EAGlC,KAAK,qBAAqB,EAC1B,KAAK,oCAAoC,EAC1C,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAG3C,eAAO,MAAM,uCAAuC,gCAAgC,CAAC;AACrF,eAAO,MAAM,yCAAyC,kCAAkC,CAAC;AACzF,eAAO,MAAM,4BAA4B,wBAAwB,CAAC;AAElE,eAAO,MAAM,+BAA+B;;;;;;CAMlC,CAAC;AAEX,MAAM,MAAM,0CAA0C,GAAG;IACvD,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,oCAAoC,CAAC;CACjD,CAAC;AAEF,MAAM,MAAM,oCAAoC,GAC5C,OAAO,GACP,aAAa,GACb,oBAAoB,GACpB,mBAAmB,GACnB,uBAAuB,CAAC;AAE5B,MAAM,MAAM,8BAA8B,GAAG;IAC3C,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,oCAAoC,CAAC;IAC7C,kBAAkB,EAAE,OAAO,CAAC;IAC5B,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,EAAE,6BAA6B,GAAG,IAAI,CAAC;IACvD,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC,CAAC;AAyGF,wBAAsB,2BAA2B,CAC/C,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,OAAO,CAAC,mBAAmB,EAAE;IAAE,SAAS,EAAE,gBAAgB,CAAA;CAAE,CAAC,GACxE,OAAO,CAAC,UAAU,CAAC,CA0CrB;AAqHD;;;GAGG;AACH,wBAAsB,qCAAqC,CACzD,EAAE,EAAE,WAAW,EACf,YAAY,EAAE,0CAA0C,EACxD,OAAO,EAAE,SAAS,MAAM,EAAE,GACzB,OAAO,CAAC;IACT,YAAY,EAAE,SAAS,qBAAqB,EAAE,CAAC;IAC/C,OAAO,IAAI,IAAI,CAAC;CACjB,CAAC,CAkDD;AAuBD;;;;GAIG;AACH,wBAAsB,iCAAiC,CAAC,KAAK,EAAE;IAC7D,EAAE,EAAE,WAAW,CAAC;IAChB,YAAY,CAAC,EAAE,0CAA0C,CAAC;IAC1D,KAAK,EAAE,6BAA6B,CAAC;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB,GAAG,OAAO,CAAC,gBAAgB,GAAG,WAAW,GAAG,QAAQ,CAAC,CA0FrD;AA8CD,wBAAsB,kCAAkC,CACtD,EAAE,EAAE,WAAW,EACf,YAAY,EAAE,0CAA0C,EACxD,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,GAC1B,OAAO,CAAC,8BAA8B,EAAE,CAAC,CAsB3C;AAED,wBAAsB,4CAA4C,CAChE,EAAE,EAAE,WAAW,EACf,YAAY,EAAE,0CAA0C,EACxD,eAAe,EAAE,SAAS,MAAM,EAAE,GACjC,OAAO,CAAC,8BAA8B,EAAE,CAAC,CAY3C"}