@lunora/auth 1.0.0-alpha.106 → 1.0.0-alpha.108

package/dist/email-guard.d.mts

@@ -33,13 +33,6 @@ interface EmailGateConfig {
    * top of the built-in list. Wildcard/subdomain aware.
    */
   denyDomains?: ReadonlyArray<string>;
-  /**
-   * Reserved for callers that branch on free-vs-business (e.g. gate a feature
-   * behind a business email). Purely advisory — {@link EmailClassification}'s
-   * `emailClass` already reports `free`, so this flag exists for symmetry/intent
-   * and never blocks. Defaults to `false`.
-   */
-  flagFreeEmail?: boolean;
   /**
    * Opt-in MX deliverability verification. Off by default because it needs DNS
    * (`@visulima/email-verifier/checks/mx` → `node:dns`), which is not available
@@ -60,10 +53,18 @@ interface EmailGateConfig {
 /** Options for {@link emailGateMiddleware}: the base gate config plus how to read the email from `ctx`. */
 interface EmailGateMiddlewareOptions<Context> extends EmailGateConfig {
   /**
-   * Selector that pulls the signup email from `ctx`. The procedure context
-   * carries only the resolved identity, not the raw request body, so route the
-   * email through the function `args` and read it out here (mirrors
-   * `verifyTurnstileMiddleware`'s `token` selector).
+   * Selector that pulls the signup email off `ctx`. The procedure context
+   * carries only the resolved identity, not the raw request body, so the email
+   * travels in the function `args` — which the builder surfaces to middleware
+   * as `ctx.args` (validated, frozen). Mirrors `verifyTurnstileMiddleware`'s
+   * `token` selector:
+   *
+   * ```ts
+   * export const signUp = mutation
+   *     .input({ email: v.string() })
+   *     .use(emailGateMiddleware({ email: (ctx) => ctx.args.email }))
+   *     .mutation(async ({ args, ctx }) => { … });
+   * ```
    */
   email: (context: Context) => string | undefined;
   /**
@@ -111,7 +112,8 @@ declare const assertEmailAllowed: (email: string, config?: EmailGateConfig) => P
 /**
  * Lunora procedure middleware that gates a non-auth, signup-shaped
  * `mutation`/`action` on the email-domain policy. Attach it with `.use()`; it
- * reads the email from `ctx` via the `email` selector (route it through `args`)
+ * reads the email from `ctx` via the `email` selector (declare it with
+ * `.input(...)` and read it back as `ctx.args.email`)
  * and runs {@link assertEmailAllowed}, which throws a coded {@link LunoraError}
  * (`EMAIL_DOMAIN_BLOCKED` / `EMAIL_UNDELIVERABLE` / `VALIDATION_ERROR`) the
  * runtime maps to the matching status.

package/dist/email-guard.d.ts

@@ -33,13 +33,6 @@ interface EmailGateConfig {
    * top of the built-in list. Wildcard/subdomain aware.
    */
   denyDomains?: ReadonlyArray<string>;
-  /**
-   * Reserved for callers that branch on free-vs-business (e.g. gate a feature
-   * behind a business email). Purely advisory — {@link EmailClassification}'s
-   * `emailClass` already reports `free`, so this flag exists for symmetry/intent
-   * and never blocks. Defaults to `false`.
-   */
-  flagFreeEmail?: boolean;
   /**
    * Opt-in MX deliverability verification. Off by default because it needs DNS
    * (`@visulima/email-verifier/checks/mx` → `node:dns`), which is not available
@@ -60,10 +53,18 @@ interface EmailGateConfig {
 /** Options for {@link emailGateMiddleware}: the base gate config plus how to read the email from `ctx`. */
 interface EmailGateMiddlewareOptions<Context> extends EmailGateConfig {
   /**
-   * Selector that pulls the signup email from `ctx`. The procedure context
-   * carries only the resolved identity, not the raw request body, so route the
-   * email through the function `args` and read it out here (mirrors
-   * `verifyTurnstileMiddleware`'s `token` selector).
+   * Selector that pulls the signup email off `ctx`. The procedure context
+   * carries only the resolved identity, not the raw request body, so the email
+   * travels in the function `args` — which the builder surfaces to middleware
+   * as `ctx.args` (validated, frozen). Mirrors `verifyTurnstileMiddleware`'s
+   * `token` selector:
+   *
+   * ```ts
+   * export const signUp = mutation
+   *     .input({ email: v.string() })
+   *     .use(emailGateMiddleware({ email: (ctx) => ctx.args.email }))
+   *     .mutation(async ({ args, ctx }) => { … });
+   * ```
    */
   email: (context: Context) => string | undefined;
   /**
@@ -111,7 +112,8 @@ declare const assertEmailAllowed: (email: string, config?: EmailGateConfig) => P
 /**
  * Lunora procedure middleware that gates a non-auth, signup-shaped
  * `mutation`/`action` on the email-domain policy. Attach it with `.use()`; it
- * reads the email from `ctx` via the `email` selector (route it through `args`)
+ * reads the email from `ctx` via the `email` selector (declare it with
+ * `.input(...)` and read it back as `ctx.args.email`)
  * and runs {@link assertEmailAllowed}, which throws a coded {@link LunoraError}
  * (`EMAIL_DOMAIN_BLOCKED` / `EMAIL_UNDELIVERABLE` / `VALIDATION_ERROR`) the
  * runtime maps to the matching status.

package/dist/middleware.d.mts

@@ -148,23 +148,33 @@ interface LunoraAuthApiContext<Auth extends LunoraAuth> {
  * Lunora's procedure context does not currently carry the raw request headers
  * (only the resolved identity — see `AuthState` in `@lunora/server`), so
  * this middleware **cannot** pre-bind headers for you and does **not** do so.
- * You MUST pass the inbound `Headers` explicitly into **every** `ctx.authApi.*`
- * call, from a transport that has them — typically an HTTP action:
+ * You MUST pass `Headers` explicitly into **every** `ctx.authApi.*` call. A
+ * procedure has no inbound `Headers` object, so rebuild one from what the
+ * transport forwarded in `args`:
  *
  * ```ts
  * // lunora/orgs.ts
- * import { httpAction } from "@lunora/server";
- * import { withAuthPlugins } from "@lunora/auth/middleware";
- * import { auth } from "./auth.js";
+ * export const createOrg = mutation
+ *     .input({ cookie: v.string(), name: v.string() })
+ *     .use(withAuthPlugins(auth))
+ *     .mutation(async ({ args, ctx }) =>
+ *         ctx.authApi.createOrganization({
+ *             body: { name: args.name },
+ *             // Rebuilt from the transport — the middleware cannot pre-bind them.
+ *             headers: new Headers({ cookie: args.cookie }),
+ *         }),
+ *     );
+ * ```
  *
- * export const createOrg = httpAction(async (ctx, request) => {
- *     const { name } = await request.json();
+ * `ctx.authApi` is a PROCEDURE-context surface — this middleware installs it
+ * through the builder's `.use()` chain, which `httpAction` / `httpRoute` do not
+ * have (see `HttpActionCtx` in `@lunora/server`). An HTTP action already holds
+ * the real inbound `Headers`, so call the auth instance there directly:
  *
- *     // ctx.authApi is installed by withAuthPlugins(auth) on the builder.
- *     const org = await ctx.authApi.createOrganization({
- *         body: { name },
- *         headers: request.headers,
- *     });
+ * ```ts
+ * export const createOrgHttp = httpAction(async (ctx, request) => {
+ *     const { name } = await request.json();
+ *     const org = await auth.api.createOrganization({ body: { name }, headers: request.headers });
  *
  *     return Response.json(org);
  * });

package/dist/middleware.d.ts

@@ -148,23 +148,33 @@ interface LunoraAuthApiContext<Auth extends LunoraAuth> {
  * Lunora's procedure context does not currently carry the raw request headers
  * (only the resolved identity — see `AuthState` in `@lunora/server`), so
  * this middleware **cannot** pre-bind headers for you and does **not** do so.
- * You MUST pass the inbound `Headers` explicitly into **every** `ctx.authApi.*`
- * call, from a transport that has them — typically an HTTP action:
+ * You MUST pass `Headers` explicitly into **every** `ctx.authApi.*` call. A
+ * procedure has no inbound `Headers` object, so rebuild one from what the
+ * transport forwarded in `args`:
  *
  * ```ts
  * // lunora/orgs.ts
- * import { httpAction } from "@lunora/server";
- * import { withAuthPlugins } from "@lunora/auth/middleware";
- * import { auth } from "./auth.js";
+ * export const createOrg = mutation
+ *     .input({ cookie: v.string(), name: v.string() })
+ *     .use(withAuthPlugins(auth))
+ *     .mutation(async ({ args, ctx }) =>
+ *         ctx.authApi.createOrganization({
+ *             body: { name: args.name },
+ *             // Rebuilt from the transport — the middleware cannot pre-bind them.
+ *             headers: new Headers({ cookie: args.cookie }),
+ *         }),
+ *     );
+ * ```
  *
- * export const createOrg = httpAction(async (ctx, request) => {
- *     const { name } = await request.json();
+ * `ctx.authApi` is a PROCEDURE-context surface — this middleware installs it
+ * through the builder's `.use()` chain, which `httpAction` / `httpRoute` do not
+ * have (see `HttpActionCtx` in `@lunora/server`). An HTTP action already holds
+ * the real inbound `Headers`, so call the auth instance there directly:
  *
- *     // ctx.authApi is installed by withAuthPlugins(auth) on the builder.
- *     const org = await ctx.authApi.createOrganization({
- *         body: { name },
- *         headers: request.headers,
- *     });
+ * ```ts
+ * export const createOrgHttp = httpAction(async (ctx, request) => {
+ *     const { name } = await request.json();
+ *     const org = await auth.api.createOrganization({ body: { name }, headers: request.headers });
  *
  *     return Response.json(org);
  * });

package/dist/turnstile-middleware.d.mts

@@ -31,17 +31,26 @@ interface VerifyTurnstileMiddlewareOptions<Context> {
   /** Override the error message thrown on a failed verdict. */
   message?: string;
   /**
-   * Selector that pulls the visitor IP from `ctx` (the procedure context has
-   * no raw `Headers`, so this must come from `args`/ctx). Optional.
+   * Selector that pulls the visitor IP off `ctx` — typically `ctx.ip`, or
+   * `ctx.args.ip` when the caller sends it (the procedure context has no raw
+   * `Headers`). Optional.
    */
   remoteip?: (context: Context) => string | undefined;
   /** Your Turnstile secret key (the `TURNSTILE_SECRET_KEY` env var). */
   secret: string;
   /**
-   * Selector that pulls the `cf-turnstile-response` token from `ctx`. The
+   * Selector that pulls the `cf-turnstile-response` token off `ctx`. The
    * procedure context carries only the resolved identity, **not** the raw
    * inbound `Headers` (see `withAuthPlugins` in `./middleware`), so the token
-   * must travel in the function `args` and be read out here.
+   * travels in the function `args` — which the builder surfaces to middleware
+   * as `ctx.args` (validated, frozen):
+   *
+   * ```ts
+   * export const submit = mutation
+   *     .input({ message: v.string(), turnstileToken: v.string() })
+   *     .use(verifyTurnstileMiddleware({ secret: env.TURNSTILE_SECRET_KEY, token: (ctx) => ctx.args.turnstileToken }))
+   *     .mutation(async ({ args, ctx }) => { … });
+   * ```
    */
   token: (context: Context) => string | undefined;
   /**
@@ -56,8 +65,10 @@ interface VerifyTurnstileMiddlewareOptions<Context> {
  * Procedure middleware that enforces a Turnstile (CAPTCHA) check before the
  * handler runs. Attach it with `.use()`. It reads the token (and optional IP)
  * from `ctx` via the provided selectors — because the procedure context does
- * not carry raw request headers, the token must be passed through the function
- * `args`. To gate the better-auth sign-in/sign-up flow itself, prefer
+ * not carry raw request headers, the token is passed through the function
+ * `args` and read back as `ctx.args.<field>` (the builder surfaces the
+ * VALIDATED args on the middleware context, frozen). To gate the better-auth
+ * sign-in/sign-up flow itself, prefer
  * better-auth's native `captcha` plugin (re-exported from `@lunora/auth/plugins`)
  * — this middleware is for non-auth Lunora procedures.
  *

package/dist/turnstile-middleware.d.ts

@@ -31,17 +31,26 @@ interface VerifyTurnstileMiddlewareOptions<Context> {
   /** Override the error message thrown on a failed verdict. */
   message?: string;
   /**
-   * Selector that pulls the visitor IP from `ctx` (the procedure context has
-   * no raw `Headers`, so this must come from `args`/ctx). Optional.
+   * Selector that pulls the visitor IP off `ctx` — typically `ctx.ip`, or
+   * `ctx.args.ip` when the caller sends it (the procedure context has no raw
+   * `Headers`). Optional.
    */
   remoteip?: (context: Context) => string | undefined;
   /** Your Turnstile secret key (the `TURNSTILE_SECRET_KEY` env var). */
   secret: string;
   /**
-   * Selector that pulls the `cf-turnstile-response` token from `ctx`. The
+   * Selector that pulls the `cf-turnstile-response` token off `ctx`. The
    * procedure context carries only the resolved identity, **not** the raw
    * inbound `Headers` (see `withAuthPlugins` in `./middleware`), so the token
-   * must travel in the function `args` and be read out here.
+   * travels in the function `args` — which the builder surfaces to middleware
+   * as `ctx.args` (validated, frozen):
+   *
+   * ```ts
+   * export const submit = mutation
+   *     .input({ message: v.string(), turnstileToken: v.string() })
+   *     .use(verifyTurnstileMiddleware({ secret: env.TURNSTILE_SECRET_KEY, token: (ctx) => ctx.args.turnstileToken }))
+   *     .mutation(async ({ args, ctx }) => { … });
+   * ```
    */
   token: (context: Context) => string | undefined;
   /**
@@ -56,8 +65,10 @@ interface VerifyTurnstileMiddlewareOptions<Context> {
  * Procedure middleware that enforces a Turnstile (CAPTCHA) check before the
  * handler runs. Attach it with `.use()`. It reads the token (and optional IP)
  * from `ctx` via the provided selectors — because the procedure context does
- * not carry raw request headers, the token must be passed through the function
- * `args`. To gate the better-auth sign-in/sign-up flow itself, prefer
+ * not carry raw request headers, the token is passed through the function
+ * `args` and read back as `ctx.args.<field>` (the builder surfaces the
+ * VALIDATED args on the middleware context, frozen). To gate the better-auth
+ * sign-in/sign-up flow itself, prefer
  * better-auth's native `captcha` plugin (re-exported from `@lunora/auth/plugins`)
  * — this middleware is for non-auth Lunora procedures.
  *

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/auth",
-  "version": "1.0.0-alpha.106",
+  "version": "1.0.0-alpha.108",
   "description": "Auth for Lunora — a thin better-auth wrapper: email/password, OAuth, plugins, D1-backed",
   "keywords": [
     "auth",
@@ -103,8 +103,8 @@
     "@better-auth/oauth-provider": "1.7.1",
     "@better-auth/passkey": "1.7.1",
     "@better-auth/scim": "1.7.1",
-    "@lunora/errors": "1.0.0-alpha.26",
-    "@lunora/values": "1.0.0-alpha.34",
+    "@lunora/errors": "1.0.0-alpha.27",
+    "@lunora/values": "1.0.0-alpha.35",
     "@visulima/disposable-email-domains": "1.1.0",
     "@visulima/email-verifier": "1.0.2",
     "@visulima/free-email-domains": "1.0.1",