@lunora/auth 1.0.0-alpha.233 → 1.0.0-alpha.235

package/dist/cimd-workers.d.mts

@@ -1,3 +1,35 @@
+/**
+ * The Cloudflare Workers transport for `cimd()` (Client ID Metadata Documents).
+ *
+ * `@better-auth/cimd` fetches a URL the client hands it — the `client_id` itself,
+ * and any `jwks_uri` the document names — so the fetch is server-side request
+ * forgery waiting to happen unless the transport keeps it on the public internet.
+ * The plugin therefore makes the application supply that transport, and asks it to
+ * resolve the host once, reject special-use addresses, pin the connection and
+ * refuse redirects.
+ *
+ * A Worker cannot pin a connection or see the resolved address. What it can do is
+ * run with the global_fetch_strictly_public compatibility flag, under which every
+ * global `fetch` goes out to the public internet and never to a private or
+ * special-use address, the Worker's own zone included. That is the guarantee
+ * Cloudflare's own `@cloudflare/workers-oauth-provider` builds its CIMD support on,
+ * and the one this transport requires: {@link workersCimdFetch} refuses to build
+ * without the flag, so a misconfigured deploy fails at startup instead of quietly
+ * fetching attacker-chosen internal URLs.
+ *
+ * It is weaker than the letter of cimd's contract — there is no DNS pinning, so a
+ * rebinding host still reaches *some* public address. An origin allowlist (the
+ * isMetadataDocumentUrlAllowed option) narrows that to hosts you trust, but it only
+ * gates the `client_id` fetch: oauth-provider fetches a document's `jwks_uri`
+ * through this same transport without consulting it. Add `jwks_uri` to cimd's
+ * originBoundFields so it must share the allowlisted `client_id` origin.
+ *
+ * On Node, use the default export of `@lunora/auth/cimd/node`, which
+ * does pin the connection.
+ *
+ * Kept off the package root (and out of `./plugins`) because it is Workers-only:
+ * the flag probe means nothing on any other runtime.
+ */
 import { ClientMetadataResourceFetch } from '@better-auth/oauth-provider';
 /**
  * Build the `fetchClientMetadataResource` transport for `cimd()` on Cloudflare

package/dist/cimd-workers.d.ts

@@ -1,3 +1,35 @@
+/**
+ * The Cloudflare Workers transport for `cimd()` (Client ID Metadata Documents).
+ *
+ * `@better-auth/cimd` fetches a URL the client hands it — the `client_id` itself,
+ * and any `jwks_uri` the document names — so the fetch is server-side request
+ * forgery waiting to happen unless the transport keeps it on the public internet.
+ * The plugin therefore makes the application supply that transport, and asks it to
+ * resolve the host once, reject special-use addresses, pin the connection and
+ * refuse redirects.
+ *
+ * A Worker cannot pin a connection or see the resolved address. What it can do is
+ * run with the global_fetch_strictly_public compatibility flag, under which every
+ * global `fetch` goes out to the public internet and never to a private or
+ * special-use address, the Worker's own zone included. That is the guarantee
+ * Cloudflare's own `@cloudflare/workers-oauth-provider` builds its CIMD support on,
+ * and the one this transport requires: {@link workersCimdFetch} refuses to build
+ * without the flag, so a misconfigured deploy fails at startup instead of quietly
+ * fetching attacker-chosen internal URLs.
+ *
+ * It is weaker than the letter of cimd's contract — there is no DNS pinning, so a
+ * rebinding host still reaches *some* public address. An origin allowlist (the
+ * isMetadataDocumentUrlAllowed option) narrows that to hosts you trust, but it only
+ * gates the `client_id` fetch: oauth-provider fetches a document's `jwks_uri`
+ * through this same transport without consulting it. Add `jwks_uri` to cimd's
+ * originBoundFields so it must share the allowlisted `client_id` origin.
+ *
+ * On Node, use the default export of `@lunora/auth/cimd/node`, which
+ * does pin the connection.
+ *
+ * Kept off the package root (and out of `./plugins`) because it is Workers-only:
+ * the flag probe means nothing on any other runtime.
+ */
 import { ClientMetadataResourceFetch } from '@better-auth/oauth-provider';
 /**
  * Build the `fetchClientMetadataResource` transport for `cimd()` on Cloudflare

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/auth",
-  "version": "1.0.0-alpha.233",
+  "version": "1.0.0-alpha.235",
   "description": "Auth for Lunora — a thin better-auth wrapper: email/password, OAuth, plugins, D1-backed",
   "keywords": [
     "auth",
@@ -117,11 +117,11 @@
     "@better-auth/passkey": "1.7.7",
     "@better-auth/scim": "1.7.7",
     "@lunora/errors": ">=1.0.0-alpha.51 <2.0.0-0",
-    "@lunora/values": "1.0.0-alpha.81",
+    "@lunora/values": "1.0.0-alpha.82",
     "@lunora/wire": "1.0.0-alpha.2",
-    "@visulima/disposable-email-domains": "1.1.25",
-    "@visulima/email-verifier": "1.0.42",
-    "@visulima/free-email-domains": "1.0.2",
+    "@visulima/disposable-email-domains": "2.0.10",
+    "@visulima/email-verifier": "1.0.54",
+    "@visulima/free-email-domains": "2.0.0",
     "@visulima/redact": "5.0.0"
   },
   "peerDependencies": {