@lunora/auth 1.0.0-alpha.21 → 1.0.0-alpha.211

package/dist/turnstile-middleware.mjs

@@ -1,45 +1 @@
-import { verifyTurnstile } from './turnstile.mjs';
-
-const verifyTurnstileMiddleware = (options) => async ({ ctx, next }) => {
-  const token = options.token(ctx);
-  if (token === void 0 || token === "") {
-    throw Object.assign(new Error(options.message ?? "turnstile token missing"), {
-      code: "FORBIDDEN",
-      name: "LunoraError",
-      status: 403
-    });
-  }
-  let result;
-  try {
-    result = await verifyTurnstile({
-      expectedAction: options.expectedAction,
-      expectedHostname: options.expectedHostname,
-      fetch: options.fetch,
-      remoteip: options.remoteip?.(ctx),
-      secret: options.secret,
-      token
-    });
-  } catch (error) {
-    console.error(`@lunora/auth: verifyTurnstileMiddleware siteverify threw; ${options.failOpen ? "failing open" : "failing closed"}`, error);
-    if (options.failOpen) {
-      return next();
-    }
-    throw Object.assign(new Error(options.message ?? "turnstile verification unavailable"), {
-      cause: error,
-      code: "FORBIDDEN",
-      name: "LunoraError",
-      status: 403
-    });
-  }
-  if (!result.success || options.validate !== void 0 && !options.validate(result)) {
-    throw Object.assign(new Error(options.message ?? "turnstile verification failed"), {
-      code: "FORBIDDEN",
-      errorCodes: result.errorCodes,
-      name: "LunoraError",
-      status: 403
-    });
-  }
-  return next();
-};
-
-export { verifyTurnstileMiddleware };
+import{LunoraError as i}from"@lunora/errors";import{tagPerDispatchMiddleware as d}from"@lunora/server";import{verifyTurnstile as n}from"./turnstile.mjs";const u=e=>d(async({ctx:a,next:l})=>{const t=e.token(a);if(t===void 0||t==="")throw new i("FORBIDDEN",e.message??"turnstile token missing");let r;try{r=await n({expectedAction:e.expectedAction,expectedHostname:e.expectedHostname,fetch:e.fetch,remoteip:e.remoteip?.(a),secret:e.secret,token:t})}catch(c){if(console.error(`@lunora/auth: verifyTurnstileMiddleware siteverify threw; ${e.failOpen?"failing open":"failing closed"}`,c),e.failOpen)return l();throw new i("FORBIDDEN",e.message??"turnstile verification unavailable",{cause:c})}if(!r.success||e.validate!==void 0&&e.validate(r)!==!0)throw new i("FORBIDDEN",e.message??"turnstile verification failed",{data:r.errorCodes.length>0?{errorCodes:r.errorCodes}:void 0});return l()});export{u as verifyTurnstileMiddleware};

package/dist/turnstile.d.mts

@@ -1,13 +1,3 @@
-/**
-* Cloudflare Turnstile server-side verification.
-*
-* Turnstile has **no Cloudflare binding** — verification is a single HTTPS POST
-* to the public `siteverify` endpoint with your secret key. The secret lives in
-* a plain env var / `.dev.vars` (conventionally `TURNSTILE_SECRET_KEY`), not in
-* `wrangler.jsonc`. This module is therefore pure, transport-agnostic, and
-* usable from any mutation/action — not just the auth flow.
-* @see https://developers.cloudflare.com/turnstile/get-started/server-side-validation/
-*/
 /** Cloudflare's public Turnstile `siteverify` endpoint. */
 declare const TURNSTILE_VERIFY_ENDPOINT = "https://challenges.cloudflare.com/turnstile/v0/siteverify";
 /** Minimal `fetch` shape we depend on, so callers can inject a stub in tests. */
@@ -18,32 +8,32 @@ type FetchLike = (input: string, init?: {
 }) => Promise<Response>;
 interface VerifyTurnstileOptions {
   /**
-  * Assert the widget `action` the token was solved for. Cloudflare echoes the
-  * customer-supplied `action` back in the siteverify response; when this is
-  * set and the returned `action` does not match, the verdict is downgraded to
-  * `success: false` (with error code `action-mismatch`). Leave unset to skip
-  * the check.
-  */
+   * Assert the widget `action` the token was solved for. Cloudflare echoes the
+   * customer-supplied `action` back in the siteverify response; when this is
+   * set and the returned `action` does not match, the verdict is downgraded to
+   * `success: false` (with error code `action-mismatch`). Leave unset to skip
+   * the check.
+   */
   expectedAction?: string;
   /**
-  * Assert the `hostname` the challenge was solved on. Cloudflare returns the
-  * solving hostname in the siteverify response; when this is set and the
-  * returned `hostname` does not match, the verdict is downgraded to
-  * `success: false` (with error code `hostname-mismatch`). Set this when a
-  * single secret/sitekey is shared across multiple domains to stop a token
-  * harvested on one origin from being replayed against another. Leave unset
-  * to skip the check.
-  */
+   * Assert the `hostname` the challenge was solved on. Cloudflare returns the
+   * solving hostname in the siteverify response; when this is set and the
+   * returned `hostname` does not match, the verdict is downgraded to
+   * `success: false` (with error code `hostname-mismatch`). Set this when a
+   * single secret/sitekey is shared across multiple domains to stop a token
+   * harvested on one origin from being replayed against another. Leave unset
+   * to skip the check.
+   */
   expectedHostname?: string;
   /**
-  * Inject a `fetch` implementation. Defaults to `globalThis.fetch`. Primarily
-  * for unit tests — production callers can omit it.
-  */
+   * Inject a `fetch` implementation. Defaults to `globalThis.fetch`. Primarily
+   * for unit tests — production callers can omit it.
+   */
   fetch?: FetchLike;
   /**
-  * The visitor's IP address, if known. Optional; Cloudflare uses it as an
-  * extra signal but verification works without it.
-  */
+   * The visitor's IP address, if known. Optional; Cloudflare uses it as an
+   * extra signal but verification works without it.
+   */
   remoteip?: string;
   /** Your Turnstile secret key (the `TURNSTILE_SECRET_KEY` env var). */
   secret: string;
@@ -51,13 +41,13 @@ interface VerifyTurnstileOptions {
   token: string;
 }
 /**
-* The normalized result of a Turnstile verification. Snake-cased fields from
-* Cloudflare (`error-codes`, `challenge_ts`) are mapped to camelCase.
-*
-* A `success: false` verdict is a **bot/invalid-token** outcome, not an error —
-* it is returned, never thrown. `verifyTurnstile` only throws on transport
-* failure (network error, non-2xx response).
-*/
+ * The normalized result of a Turnstile verification. Snake-cased fields from
+ * Cloudflare (`error-codes`, `challenge_ts`) are mapped to camelCase.
+ *
+ * A `success: false` verdict is a **bot/invalid-token** outcome, not an error —
+ * it is returned, never thrown. `verifyTurnstile` only throws on transport
+ * failure (network error, non-2xx response).
+ */
 interface TurnstileVerifyResult {
   /** The customer-supplied `action` the widget was rendered with, if any. */
   action?: string;
@@ -66,9 +56,9 @@ interface TurnstileVerifyResult {
   /** ISO timestamp of the challenge, if Cloudflare returned one. */
   challengeTs?: string;
   /**
-  * Cloudflare error codes for a failed verification (e.g.
-  * `"invalid-input-response"`, `"timeout-or-duplicate"`). Empty on success.
-  */
+   * Cloudflare error codes for a failed verification (e.g.
+   * `"invalid-input-response"`, `"timeout-or-duplicate"`). Empty on success.
+   */
   errorCodes: string[];
   /** Hostname the challenge was solved on, if Cloudflare returned one. */
   hostname?: string;
@@ -76,23 +66,16 @@ interface TurnstileVerifyResult {
   success: boolean;
 }
 /**
-* Verify a Turnstile token against Cloudflare's `siteverify` endpoint.
-*
-* POSTs `application/x-www-form-urlencoded` (`secret`, `response`=token, and an
-* optional `remoteip`) and returns the parsed verdict. A `success: false`
-* outcome (bot / invalid / expired token) is **returned**, not thrown — callers
-* decide how to react. The function throws a structural `LunoraError`-shaped
-* error (`{ name: "LunoraError", code: "SERVICE_UNAVAILABLE", status: 503 }`)
-* only when the siteverify call itself fails (network error or non-2xx), so a
-* "siteverify is down" failure is distinguishable from a "this is a bot"
-* verdict.
-*/
-declare const verifyTurnstile: ({
-  expectedAction,
-  expectedHostname,
-  fetch,
-  remoteip,
-  secret,
-  token
-}: VerifyTurnstileOptions) => Promise<TurnstileVerifyResult>;
+ * Verify a Turnstile token against Cloudflare's `siteverify` endpoint.
+ *
+ * POSTs `application/x-www-form-urlencoded` (`secret`, `response`=token, and an
+ * optional `remoteip`) and returns the parsed verdict. A `success: false`
+ * outcome (bot / invalid / expired token) is **returned**, not thrown — callers
+ * decide how to react. The function throws a structural `LunoraError`-shaped
+ * error (`{ name: "LunoraError", code: "SERVICE_UNAVAILABLE", status: 503 }`)
+ * only when the siteverify call itself fails (network error or non-2xx), so a
+ * "siteverify is down" failure is distinguishable from a "this is a bot"
+ * verdict.
+ */
+declare const verifyTurnstile: ({ expectedAction, expectedHostname, fetch, remoteip, secret, token }: VerifyTurnstileOptions) => Promise<TurnstileVerifyResult>;
 export { type FetchLike, TURNSTILE_VERIFY_ENDPOINT, type TurnstileVerifyResult, type VerifyTurnstileOptions, verifyTurnstile };

package/dist/turnstile.d.ts

@@ -1,13 +1,3 @@
-/**
-* Cloudflare Turnstile server-side verification.
-*
-* Turnstile has **no Cloudflare binding** — verification is a single HTTPS POST
-* to the public `siteverify` endpoint with your secret key. The secret lives in
-* a plain env var / `.dev.vars` (conventionally `TURNSTILE_SECRET_KEY`), not in
-* `wrangler.jsonc`. This module is therefore pure, transport-agnostic, and
-* usable from any mutation/action — not just the auth flow.
-* @see https://developers.cloudflare.com/turnstile/get-started/server-side-validation/
-*/
 /** Cloudflare's public Turnstile `siteverify` endpoint. */
 declare const TURNSTILE_VERIFY_ENDPOINT = "https://challenges.cloudflare.com/turnstile/v0/siteverify";
 /** Minimal `fetch` shape we depend on, so callers can inject a stub in tests. */
@@ -18,32 +8,32 @@ type FetchLike = (input: string, init?: {
 }) => Promise<Response>;
 interface VerifyTurnstileOptions {
   /**
-  * Assert the widget `action` the token was solved for. Cloudflare echoes the
-  * customer-supplied `action` back in the siteverify response; when this is
-  * set and the returned `action` does not match, the verdict is downgraded to
-  * `success: false` (with error code `action-mismatch`). Leave unset to skip
-  * the check.
-  */
+   * Assert the widget `action` the token was solved for. Cloudflare echoes the
+   * customer-supplied `action` back in the siteverify response; when this is
+   * set and the returned `action` does not match, the verdict is downgraded to
+   * `success: false` (with error code `action-mismatch`). Leave unset to skip
+   * the check.
+   */
   expectedAction?: string;
   /**
-  * Assert the `hostname` the challenge was solved on. Cloudflare returns the
-  * solving hostname in the siteverify response; when this is set and the
-  * returned `hostname` does not match, the verdict is downgraded to
-  * `success: false` (with error code `hostname-mismatch`). Set this when a
-  * single secret/sitekey is shared across multiple domains to stop a token
-  * harvested on one origin from being replayed against another. Leave unset
-  * to skip the check.
-  */
+   * Assert the `hostname` the challenge was solved on. Cloudflare returns the
+   * solving hostname in the siteverify response; when this is set and the
+   * returned `hostname` does not match, the verdict is downgraded to
+   * `success: false` (with error code `hostname-mismatch`). Set this when a
+   * single secret/sitekey is shared across multiple domains to stop a token
+   * harvested on one origin from being replayed against another. Leave unset
+   * to skip the check.
+   */
   expectedHostname?: string;
   /**
-  * Inject a `fetch` implementation. Defaults to `globalThis.fetch`. Primarily
-  * for unit tests — production callers can omit it.
-  */
+   * Inject a `fetch` implementation. Defaults to `globalThis.fetch`. Primarily
+   * for unit tests — production callers can omit it.
+   */
   fetch?: FetchLike;
   /**
-  * The visitor's IP address, if known. Optional; Cloudflare uses it as an
-  * extra signal but verification works without it.
-  */
+   * The visitor's IP address, if known. Optional; Cloudflare uses it as an
+   * extra signal but verification works without it.
+   */
   remoteip?: string;
   /** Your Turnstile secret key (the `TURNSTILE_SECRET_KEY` env var). */
   secret: string;
@@ -51,13 +41,13 @@ interface VerifyTurnstileOptions {
   token: string;
 }
 /**
-* The normalized result of a Turnstile verification. Snake-cased fields from
-* Cloudflare (`error-codes`, `challenge_ts`) are mapped to camelCase.
-*
-* A `success: false` verdict is a **bot/invalid-token** outcome, not an error —
-* it is returned, never thrown. `verifyTurnstile` only throws on transport
-* failure (network error, non-2xx response).
-*/
+ * The normalized result of a Turnstile verification. Snake-cased fields from
+ * Cloudflare (`error-codes`, `challenge_ts`) are mapped to camelCase.
+ *
+ * A `success: false` verdict is a **bot/invalid-token** outcome, not an error —
+ * it is returned, never thrown. `verifyTurnstile` only throws on transport
+ * failure (network error, non-2xx response).
+ */
 interface TurnstileVerifyResult {
   /** The customer-supplied `action` the widget was rendered with, if any. */
   action?: string;
@@ -66,9 +56,9 @@ interface TurnstileVerifyResult {
   /** ISO timestamp of the challenge, if Cloudflare returned one. */
   challengeTs?: string;
   /**
-  * Cloudflare error codes for a failed verification (e.g.
-  * `"invalid-input-response"`, `"timeout-or-duplicate"`). Empty on success.
-  */
+   * Cloudflare error codes for a failed verification (e.g.
+   * `"invalid-input-response"`, `"timeout-or-duplicate"`). Empty on success.
+   */
   errorCodes: string[];
   /** Hostname the challenge was solved on, if Cloudflare returned one. */
   hostname?: string;
@@ -76,23 +66,16 @@ interface TurnstileVerifyResult {
   success: boolean;
 }
 /**
-* Verify a Turnstile token against Cloudflare's `siteverify` endpoint.
-*
-* POSTs `application/x-www-form-urlencoded` (`secret`, `response`=token, and an
-* optional `remoteip`) and returns the parsed verdict. A `success: false`
-* outcome (bot / invalid / expired token) is **returned**, not thrown — callers
-* decide how to react. The function throws a structural `LunoraError`-shaped
-* error (`{ name: "LunoraError", code: "SERVICE_UNAVAILABLE", status: 503 }`)
-* only when the siteverify call itself fails (network error or non-2xx), so a
-* "siteverify is down" failure is distinguishable from a "this is a bot"
-* verdict.
-*/
-declare const verifyTurnstile: ({
-  expectedAction,
-  expectedHostname,
-  fetch,
-  remoteip,
-  secret,
-  token
-}: VerifyTurnstileOptions) => Promise<TurnstileVerifyResult>;
+ * Verify a Turnstile token against Cloudflare's `siteverify` endpoint.
+ *
+ * POSTs `application/x-www-form-urlencoded` (`secret`, `response`=token, and an
+ * optional `remoteip`) and returns the parsed verdict. A `success: false`
+ * outcome (bot / invalid / expired token) is **returned**, not thrown — callers
+ * decide how to react. The function throws a structural `LunoraError`-shaped
+ * error (`{ name: "LunoraError", code: "SERVICE_UNAVAILABLE", status: 503 }`)
+ * only when the siteverify call itself fails (network error or non-2xx), so a
+ * "siteverify is down" failure is distinguishable from a "this is a bot"
+ * verdict.
+ */
+declare const verifyTurnstile: ({ expectedAction, expectedHostname, fetch, remoteip, secret, token }: VerifyTurnstileOptions) => Promise<TurnstileVerifyResult>;
 export { type FetchLike, TURNSTILE_VERIFY_ENDPOINT, type TurnstileVerifyResult, type VerifyTurnstileOptions, verifyTurnstile };

package/dist/turnstile.mjs

@@ -1,61 +1 @@
-const TURNSTILE_VERIFY_ENDPOINT = "https://challenges.cloudflare.com/turnstile/v0/siteverify";
-const asString = (value) => typeof value === "string" ? value : void 0;
-const asStringArray = (value) => Array.isArray(value) ? value.filter((entry) => typeof entry === "string") : [];
-const verifyTurnstile = async ({
-  expectedAction,
-  expectedHostname,
-  fetch = globalThis.fetch,
-  remoteip,
-  secret,
-  token
-}) => {
-  const body = new URLSearchParams({ response: token, secret });
-  if (remoteip !== void 0 && remoteip !== "") {
-    body.set("remoteip", remoteip);
-  }
-  let response;
-  try {
-    response = await fetch(TURNSTILE_VERIFY_ENDPOINT, {
-      body: body.toString(),
-      headers: { "content-type": "application/x-www-form-urlencoded" },
-      method: "POST"
-    });
-  } catch (error) {
-    throw Object.assign(new Error("turnstile siteverify request failed"), {
-      cause: error,
-      code: "SERVICE_UNAVAILABLE",
-      name: "LunoraError",
-      status: 503
-    });
-  }
-  if (!response.ok) {
-    throw Object.assign(new Error(`turnstile siteverify returned ${String(response.status)}`), {
-      code: "SERVICE_UNAVAILABLE",
-      name: "LunoraError",
-      status: 503
-    });
-  }
-  const raw = await response.json();
-  const action = asString(raw.action);
-  const hostname = asString(raw.hostname);
-  const errorCodes = asStringArray(raw["error-codes"]);
-  let success = raw.success === true;
-  if (success && expectedHostname !== void 0 && hostname !== expectedHostname) {
-    success = false;
-    errorCodes.push("hostname-mismatch");
-  }
-  if (success && expectedAction !== void 0 && action !== expectedAction) {
-    success = false;
-    errorCodes.push("action-mismatch");
-  }
-  return {
-    action,
-    cdata: asString(raw.cdata),
-    challengeTs: asString(raw.challenge_ts),
-    errorCodes,
-    hostname,
-    success
-  };
-};
-
-export { TURNSTILE_VERIFY_ENDPOINT, verifyTurnstile };
+import{LunoraError as l}from"@lunora/errors";const E="https://challenges.cloudflare.com/turnstile/v0/siteverify",a=t=>typeof t=="string"?t:void 0,m=t=>Array.isArray(t)?t.filter(e=>typeof e=="string"):[],S=async({expectedAction:t,expectedHostname:e,fetch:d=globalThis.fetch,remoteip:n,secret:y,token:w})=>{const h=new URLSearchParams({response:w,secret:y});n!==void 0&&n!==""&&h.set("remoteip",n);let o;try{o=await d(E,{body:h.toString(),headers:{"content-type":"application/x-www-form-urlencoded"},method:"POST"})}catch(c){throw new l("SERVICE_UNAVAILABLE","turnstile siteverify request failed",{cause:c,status:503})}if(!o.ok)throw new l("SERVICE_UNAVAILABLE",`turnstile siteverify returned ${String(o.status)}`,{status:503});let r;try{r=await o.json()}catch(c){throw new l("SERVICE_UNAVAILABLE","turnstile siteverify returned a non-JSON body",{cause:c,status:503})}const u=a(r.action),f=a(r.hostname),i=m(r["error-codes"]);let s=r.success===!0;return s&&e!==void 0&&f!==e&&(s=!1,i.push("hostname-mismatch")),s&&t!==void 0&&u!==t&&(s=!1,i.push("action-mismatch")),{action:u,cdata:a(r.cdata),challengeTs:a(r.challenge_ts),errorCodes:i,hostname:f,success:s}};export{E as TURNSTILE_VERIFY_ENDPOINT,S as verifyTurnstile};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/auth",
-  "version": "1.0.0-alpha.21",
+  "version": "1.0.0-alpha.211",
   "description": "Auth for Lunora — a thin better-auth wrapper: email/password, OAuth, plugins, D1-backed",
   "keywords": [
     "auth",
@@ -48,10 +48,34 @@
       "types": "./dist/plugins-client.d.ts",
       "import": "./dist/plugins-client.mjs"
     },
+    "./plugins/enterprise": {
+      "types": "./dist/plugins-enterprise.d.ts",
+      "import": "./dist/plugins-enterprise.mjs"
+    },
+    "./plugins/enterprise/client": {
+      "types": "./dist/plugins-enterprise-client.d.ts",
+      "import": "./dist/plugins-enterprise-client.mjs"
+    },
+    "./cimd/node": {
+      "types": "./dist/cimd-node.d.ts",
+      "import": "./dist/cimd-node.mjs"
+    },
+    "./cimd/workers": {
+      "types": "./dist/cimd-workers.d.ts",
+      "import": "./dist/cimd-workers.mjs"
+    },
     "./middleware": {
       "types": "./dist/middleware.d.ts",
       "import": "./dist/middleware.mjs"
     },
+    "./audit": {
+      "types": "./dist/audit.d.ts",
+      "import": "./dist/audit.mjs"
+    },
+    "./email-guard": {
+      "types": "./dist/email-guard.d.ts",
+      "import": "./dist/email-guard.mjs"
+    },
     "./turnstile": {
       "types": "./dist/turnstile.d.ts",
       "import": "./dist/turnstile.mjs"
@@ -82,11 +106,29 @@
     "access": "public"
   },
   "dependencies": {
-    "@better-auth/passkey": "^1.6.23",
-    "@lunora/errors": "1.0.0-alpha.1",
-    "@lunora/server": "1.0.0-alpha.16",
-    "@lunora/values": "1.0.0-alpha.4",
-    "better-auth": "^1.6.23"
+    "@better-auth/api-key": "1.7.7",
+    "@better-auth/cimd": "1.7.7",
+    "@better-auth/mcp": "1.7.7",
+    "@better-auth/oauth-provider": "1.7.7",
+    "@better-auth/passkey": "1.7.7",
+    "@better-auth/scim": "1.7.7",
+    "@lunora/errors": ">=1.0.0-alpha.51 <2.0.0-0",
+    "@lunora/values": "1.0.0-alpha.64",
+    "@visulima/disposable-email-domains": "1.1.25",
+    "@visulima/email-verifier": "1.0.42",
+    "@visulima/free-email-domains": "1.0.2",
+    "@visulima/redact": "5.0.0"
+  },
+  "peerDependencies": {
+    "@better-auth/core": ">=1.7.3 <2.0.0-0",
+    "@better-auth/sso": ">=1.7.3 <2.0.0-0",
+    "@lunora/server": ">=1.0.0-alpha.24 <2.0.0-0",
+    "better-auth": ">=1.7.3 <2.0.0-0"
+  },
+  "peerDependenciesMeta": {
+    "@better-auth/sso": {
+      "optional": true
+    }
   },
   "engines": {
     "node": "^22.15.0 || >=24.11.0"

package/dist/packem_shared/DEFAULT_AUTH_BASE_PATH-DjcUWEQl.mjs

@@ -1,11 +0,0 @@
-const DEFAULT_AUTH_BASE_PATH = "/api/auth";
-const handleAuthRequest = async (auth, request, basePath = DEFAULT_AUTH_BASE_PATH) => {
-  const url = new URL(request.url);
-  const base = basePath.endsWith("/") ? basePath.slice(0, -1) : basePath;
-  if (url.pathname !== base && !url.pathname.startsWith(`${base}/`)) {
-    return void 0;
-  }
-  return auth.handler(request);
-};
-
-export { DEFAULT_AUTH_BASE_PATH, handleAuthRequest };