@lunora/auth 1.0.0-alpha.7 → 1.0.0-alpha.71

package/dist/turnstile-middleware.d.mts

@@ -2,79 +2,79 @@ import { Middleware } from '@lunora/server';
 import { FetchLike, TurnstileVerifyResult } from "./turnstile.mjs";
 interface VerifyTurnstileMiddlewareOptions<Context> {
   /**
-  * Assert the widget `action` the token was solved for (forwarded to
-  * {@link verifyTurnstile}). When set and the siteverify response's `action`
-  * does not match, the verdict is treated as a failure (403). Optional.
-  */
+   * Assert the widget `action` the token was solved for (forwarded to
+   * {@link verifyTurnstile}). When set and the siteverify response's `action`
+   * does not match, the verdict is treated as a failure (403). Optional.
+   */
   expectedAction?: string;
   /**
-  * Assert the `hostname` the challenge was solved on (forwarded to
-  * {@link verifyTurnstile}). When set and the siteverify response's `hostname`
-  * does not match, the verdict is treated as a failure (403). Set this when a
-  * single secret/sitekey is shared across multiple domains to stop a token
-  * harvested on one origin being replayed against this procedure. Optional.
-  */
+   * Assert the `hostname` the challenge was solved on (forwarded to
+   * {@link verifyTurnstile}). When set and the siteverify response's `hostname`
+   * does not match, the verdict is treated as a failure (403). Set this when a
+   * single secret/sitekey is shared across multiple domains to stop a token
+   * harvested on one origin being replayed against this procedure. Optional.
+   */
   expectedHostname?: string;
   /**
-  * Behavior when the siteverify call itself throws (network error, non-2xx).
-  * Defaults to `false` (**fail closed**: reject with 403). Set `true` only
-  * when degraded availability is preferable to denying traffic — a failing
-  * siteverify then admits every request. Mirrors `@lunora/ratelimit`'s
-  * `rateLimit` failure policy.
-  */
+   * Behavior when the siteverify call itself throws (network error, non-2xx).
+   * Defaults to `false` (**fail closed**: reject with 403). Set `true` only
+   * when degraded availability is preferable to denying traffic — a failing
+   * siteverify then admits every request. Mirrors `@lunora/ratelimit`'s
+   * `rateLimit` failure policy.
+   */
   failOpen?: boolean;
   /**
-  * Inject a `fetch` implementation (forwarded to {@link verifyTurnstile}).
-  * Primarily for tests.
-  */
+   * Inject a `fetch` implementation (forwarded to {@link verifyTurnstile}).
+   * Primarily for tests.
+   */
   fetch?: FetchLike;
   /** Override the error message thrown on a failed verdict. */
   message?: string;
   /**
-  * Selector that pulls the visitor IP from `ctx` (the procedure context has
-  * no raw `Headers`, so this must come from `args`/ctx). Optional.
-  */
+   * Selector that pulls the visitor IP from `ctx` (the procedure context has
+   * no raw `Headers`, so this must come from `args`/ctx). Optional.
+   */
   remoteip?: (context: Context) => string | undefined;
   /** Your Turnstile secret key (the `TURNSTILE_SECRET_KEY` env var). */
   secret: string;
   /**
-  * Selector that pulls the `cf-turnstile-response` token from `ctx`. The
-  * procedure context carries only the resolved identity, **not** the raw
-  * inbound `Headers` (see `withAuthPlugins` in `./middleware`), so the token
-  * must travel in the function `args` and be read out here.
-  */
+   * Selector that pulls the `cf-turnstile-response` token from `ctx`. The
+   * procedure context carries only the resolved identity, **not** the raw
+   * inbound `Headers` (see `withAuthPlugins` in `./middleware`), so the token
+   * must travel in the function `args` and be read out here.
+   */
   token: (context: Context) => string | undefined;
   /**
-  * Extra predicate run on a `success: true` verdict (after the built-in
-  * `expectedHostname`/`expectedAction` checks). Return `false` to reject the
-  * request with 403 — use it for any custom replay/abuse guard that needs the
-  * full verdict (e.g. matching `cdata`, or one hostname out of an allow-list).
-  */
+   * Extra predicate run on a `success: true` verdict (after the built-in
+   * `expectedHostname`/`expectedAction` checks). Return `false` to reject the
+   * request with 403 — use it for any custom replay/abuse guard that needs the
+   * full verdict (e.g. matching `cdata`, or one hostname out of an allow-list).
+   */
   validate?: (result: TurnstileVerifyResult) => boolean;
 }
 /**
-* Procedure middleware that enforces a Turnstile (CAPTCHA) check before the
-* handler runs. Attach it with `.use()`. It reads the token (and optional IP)
-* from `ctx` via the provided selectors — because the procedure context does
-* not carry raw request headers, the token must be passed through the function
-* `args`. To gate the better-auth sign-in/sign-up flow itself, prefer
-* better-auth's native `captcha` plugin (re-exported from `@lunora/auth/plugins`)
-* — this middleware is for non-auth Lunora procedures.
-*
-* On a `success: false` verdict (or a missing token) it throws a structural
-* `LunoraError` (`{ name: "LunoraError", code: "FORBIDDEN", status: 403 }`) —
-* the runtime maps it to the matching RPC/HTTP status without any runtime
-* import of `@lunora/server` (the `Middleware` import is type-only).
-*
-* **Failure policy:** if the siteverify call itself throws, the middleware
-* **fails closed by default** (logs and rejects with 403). Pass
-* `failOpen: true` to admit the request instead — mirrors `@lunora/ratelimit`.
-*
-* **Cross-origin replay:** a token solved on one origin can be replayed against
-* a different endpoint when a single secret/sitekey is shared across multiple
-* domains. Pass `expectedHostname` (and optionally `expectedAction`, or a custom
-* `validate(result)` predicate) to assert the siteverify response's `hostname`
-* /`action` and reject mismatches with 403.
-*/
+ * Procedure middleware that enforces a Turnstile (CAPTCHA) check before the
+ * handler runs. Attach it with `.use()`. It reads the token (and optional IP)
+ * from `ctx` via the provided selectors — because the procedure context does
+ * not carry raw request headers, the token must be passed through the function
+ * `args`. To gate the better-auth sign-in/sign-up flow itself, prefer
+ * better-auth's native `captcha` plugin (re-exported from `@lunora/auth/plugins`)
+ * — this middleware is for non-auth Lunora procedures.
+ *
+ * On a `success: false` verdict (or a missing token) it throws a structural
+ * `LunoraError` (`{ name: "LunoraError", code: "FORBIDDEN", status: 403 }`) —
+ * the runtime maps it to the matching RPC/HTTP status without any runtime
+ * import of `@lunora/server` (the `Middleware` import is type-only).
+ *
+ * **Failure policy:** if the siteverify call itself throws, the middleware
+ * **fails closed by default** (logs and rejects with 403). Pass
+ * `failOpen: true` to admit the request instead — mirrors `@lunora/ratelimit`.
+ *
+ * **Cross-origin replay:** a token solved on one origin can be replayed against
+ * a different endpoint when a single secret/sitekey is shared across multiple
+ * domains. Pass `expectedHostname` (and optionally `expectedAction`, or a custom
+ * `validate(result)` predicate) to assert the siteverify response's `hostname`
+ * /`action` and reject mismatches with 403.
+ */
 declare const verifyTurnstileMiddleware: <Context>(options: VerifyTurnstileMiddlewareOptions<Context>) => Middleware<Context, Context>;
 export { type VerifyTurnstileMiddlewareOptions, verifyTurnstileMiddleware };

package/dist/turnstile-middleware.d.ts

@@ -2,79 +2,79 @@ import { Middleware } from '@lunora/server';
 import { FetchLike, TurnstileVerifyResult } from "./turnstile.js";
 interface VerifyTurnstileMiddlewareOptions<Context> {
   /**
-  * Assert the widget `action` the token was solved for (forwarded to
-  * {@link verifyTurnstile}). When set and the siteverify response's `action`
-  * does not match, the verdict is treated as a failure (403). Optional.
-  */
+   * Assert the widget `action` the token was solved for (forwarded to
+   * {@link verifyTurnstile}). When set and the siteverify response's `action`
+   * does not match, the verdict is treated as a failure (403). Optional.
+   */
   expectedAction?: string;
   /**
-  * Assert the `hostname` the challenge was solved on (forwarded to
-  * {@link verifyTurnstile}). When set and the siteverify response's `hostname`
-  * does not match, the verdict is treated as a failure (403). Set this when a
-  * single secret/sitekey is shared across multiple domains to stop a token
-  * harvested on one origin being replayed against this procedure. Optional.
-  */
+   * Assert the `hostname` the challenge was solved on (forwarded to
+   * {@link verifyTurnstile}). When set and the siteverify response's `hostname`
+   * does not match, the verdict is treated as a failure (403). Set this when a
+   * single secret/sitekey is shared across multiple domains to stop a token
+   * harvested on one origin being replayed against this procedure. Optional.
+   */
   expectedHostname?: string;
   /**
-  * Behavior when the siteverify call itself throws (network error, non-2xx).
-  * Defaults to `false` (**fail closed**: reject with 403). Set `true` only
-  * when degraded availability is preferable to denying traffic — a failing
-  * siteverify then admits every request. Mirrors `@lunora/ratelimit`'s
-  * `rateLimit` failure policy.
-  */
+   * Behavior when the siteverify call itself throws (network error, non-2xx).
+   * Defaults to `false` (**fail closed**: reject with 403). Set `true` only
+   * when degraded availability is preferable to denying traffic — a failing
+   * siteverify then admits every request. Mirrors `@lunora/ratelimit`'s
+   * `rateLimit` failure policy.
+   */
   failOpen?: boolean;
   /**
-  * Inject a `fetch` implementation (forwarded to {@link verifyTurnstile}).
-  * Primarily for tests.
-  */
+   * Inject a `fetch` implementation (forwarded to {@link verifyTurnstile}).
+   * Primarily for tests.
+   */
   fetch?: FetchLike;
   /** Override the error message thrown on a failed verdict. */
   message?: string;
   /**
-  * Selector that pulls the visitor IP from `ctx` (the procedure context has
-  * no raw `Headers`, so this must come from `args`/ctx). Optional.
-  */
+   * Selector that pulls the visitor IP from `ctx` (the procedure context has
+   * no raw `Headers`, so this must come from `args`/ctx). Optional.
+   */
   remoteip?: (context: Context) => string | undefined;
   /** Your Turnstile secret key (the `TURNSTILE_SECRET_KEY` env var). */
   secret: string;
   /**
-  * Selector that pulls the `cf-turnstile-response` token from `ctx`. The
-  * procedure context carries only the resolved identity, **not** the raw
-  * inbound `Headers` (see `withAuthPlugins` in `./middleware`), so the token
-  * must travel in the function `args` and be read out here.
-  */
+   * Selector that pulls the `cf-turnstile-response` token from `ctx`. The
+   * procedure context carries only the resolved identity, **not** the raw
+   * inbound `Headers` (see `withAuthPlugins` in `./middleware`), so the token
+   * must travel in the function `args` and be read out here.
+   */
   token: (context: Context) => string | undefined;
   /**
-  * Extra predicate run on a `success: true` verdict (after the built-in
-  * `expectedHostname`/`expectedAction` checks). Return `false` to reject the
-  * request with 403 — use it for any custom replay/abuse guard that needs the
-  * full verdict (e.g. matching `cdata`, or one hostname out of an allow-list).
-  */
+   * Extra predicate run on a `success: true` verdict (after the built-in
+   * `expectedHostname`/`expectedAction` checks). Return `false` to reject the
+   * request with 403 — use it for any custom replay/abuse guard that needs the
+   * full verdict (e.g. matching `cdata`, or one hostname out of an allow-list).
+   */
   validate?: (result: TurnstileVerifyResult) => boolean;
 }
 /**
-* Procedure middleware that enforces a Turnstile (CAPTCHA) check before the
-* handler runs. Attach it with `.use()`. It reads the token (and optional IP)
-* from `ctx` via the provided selectors — because the procedure context does
-* not carry raw request headers, the token must be passed through the function
-* `args`. To gate the better-auth sign-in/sign-up flow itself, prefer
-* better-auth's native `captcha` plugin (re-exported from `@lunora/auth/plugins`)
-* — this middleware is for non-auth Lunora procedures.
-*
-* On a `success: false` verdict (or a missing token) it throws a structural
-* `LunoraError` (`{ name: "LunoraError", code: "FORBIDDEN", status: 403 }`) —
-* the runtime maps it to the matching RPC/HTTP status without any runtime
-* import of `@lunora/server` (the `Middleware` import is type-only).
-*
-* **Failure policy:** if the siteverify call itself throws, the middleware
-* **fails closed by default** (logs and rejects with 403). Pass
-* `failOpen: true` to admit the request instead — mirrors `@lunora/ratelimit`.
-*
-* **Cross-origin replay:** a token solved on one origin can be replayed against
-* a different endpoint when a single secret/sitekey is shared across multiple
-* domains. Pass `expectedHostname` (and optionally `expectedAction`, or a custom
-* `validate(result)` predicate) to assert the siteverify response's `hostname`
-* /`action` and reject mismatches with 403.
-*/
+ * Procedure middleware that enforces a Turnstile (CAPTCHA) check before the
+ * handler runs. Attach it with `.use()`. It reads the token (and optional IP)
+ * from `ctx` via the provided selectors — because the procedure context does
+ * not carry raw request headers, the token must be passed through the function
+ * `args`. To gate the better-auth sign-in/sign-up flow itself, prefer
+ * better-auth's native `captcha` plugin (re-exported from `@lunora/auth/plugins`)
+ * — this middleware is for non-auth Lunora procedures.
+ *
+ * On a `success: false` verdict (or a missing token) it throws a structural
+ * `LunoraError` (`{ name: "LunoraError", code: "FORBIDDEN", status: 403 }`) —
+ * the runtime maps it to the matching RPC/HTTP status without any runtime
+ * import of `@lunora/server` (the `Middleware` import is type-only).
+ *
+ * **Failure policy:** if the siteverify call itself throws, the middleware
+ * **fails closed by default** (logs and rejects with 403). Pass
+ * `failOpen: true` to admit the request instead — mirrors `@lunora/ratelimit`.
+ *
+ * **Cross-origin replay:** a token solved on one origin can be replayed against
+ * a different endpoint when a single secret/sitekey is shared across multiple
+ * domains. Pass `expectedHostname` (and optionally `expectedAction`, or a custom
+ * `validate(result)` predicate) to assert the siteverify response's `hostname`
+ * /`action` and reject mismatches with 403.
+ */
 declare const verifyTurnstileMiddleware: <Context>(options: VerifyTurnstileMiddlewareOptions<Context>) => Middleware<Context, Context>;
 export { type VerifyTurnstileMiddlewareOptions, verifyTurnstileMiddleware };

package/dist/turnstile-middleware.mjs

@@ -1,45 +1 @@
-import { verifyTurnstile } from './turnstile.mjs';
-
-const verifyTurnstileMiddleware = (options) => async ({ ctx, next }) => {
-  const token = options.token(ctx);
-  if (token === void 0 || token === "") {
-    throw Object.assign(new Error(options.message ?? "turnstile token missing"), {
-      code: "FORBIDDEN",
-      name: "LunoraError",
-      status: 403
-    });
-  }
-  let result;
-  try {
-    result = await verifyTurnstile({
-      expectedAction: options.expectedAction,
-      expectedHostname: options.expectedHostname,
-      fetch: options.fetch,
-      remoteip: options.remoteip?.(ctx),
-      secret: options.secret,
-      token
-    });
-  } catch (error) {
-    console.error(`@lunora/auth: verifyTurnstileMiddleware siteverify threw; ${options.failOpen ? "failing open" : "failing closed"}`, error);
-    if (options.failOpen) {
-      return next();
-    }
-    throw Object.assign(new Error(options.message ?? "turnstile verification unavailable"), {
-      cause: error,
-      code: "FORBIDDEN",
-      name: "LunoraError",
-      status: 403
-    });
-  }
-  if (!result.success || options.validate !== void 0 && !options.validate(result)) {
-    throw Object.assign(new Error(options.message ?? "turnstile verification failed"), {
-      code: "FORBIDDEN",
-      errorCodes: result.errorCodes,
-      name: "LunoraError",
-      status: 403
-    });
-  }
-  return next();
-};
-
-export { verifyTurnstileMiddleware };
+import{LunoraError as i}from"@lunora/errors";import{verifyTurnstile as a}from"./turnstile.mjs";const d=e=>async({ctx:o,next:n})=>{const r=e.token(o);if(r===void 0||r==="")throw new i("FORBIDDEN",e.message??"turnstile token missing");let t;try{t=await a({expectedAction:e.expectedAction,expectedHostname:e.expectedHostname,fetch:e.fetch,remoteip:e.remoteip?.(o),secret:e.secret,token:r})}catch(s){if(console.error(`@lunora/auth: verifyTurnstileMiddleware siteverify threw; ${e.failOpen?"failing open":"failing closed"}`,s),e.failOpen)return n();throw new i("FORBIDDEN",e.message??"turnstile verification unavailable",{cause:s})}if(!t.success||e.validate!==void 0&&!e.validate(t))throw new i("FORBIDDEN",e.message??"turnstile verification failed",{data:t.errorCodes.length>0?{errorCodes:t.errorCodes}:void 0});return n()};export{d as verifyTurnstileMiddleware};

package/dist/turnstile.d.mts

@@ -1,13 +1,3 @@
-/**
-* Cloudflare Turnstile server-side verification.
-*
-* Turnstile has **no Cloudflare binding** — verification is a single HTTPS POST
-* to the public `siteverify` endpoint with your secret key. The secret lives in
-* a plain env var / `.dev.vars` (conventionally `TURNSTILE_SECRET_KEY`), not in
-* `wrangler.jsonc`. This module is therefore pure, transport-agnostic, and
-* usable from any mutation/action — not just the auth flow.
-* @see https://developers.cloudflare.com/turnstile/get-started/server-side-validation/
-*/
 /** Cloudflare's public Turnstile `siteverify` endpoint. */
 declare const TURNSTILE_VERIFY_ENDPOINT = "https://challenges.cloudflare.com/turnstile/v0/siteverify";
 /** Minimal `fetch` shape we depend on, so callers can inject a stub in tests. */
@@ -18,32 +8,32 @@ type FetchLike = (input: string, init?: {
 }) => Promise<Response>;
 interface VerifyTurnstileOptions {
   /**
-  * Assert the widget `action` the token was solved for. Cloudflare echoes the
-  * customer-supplied `action` back in the siteverify response; when this is
-  * set and the returned `action` does not match, the verdict is downgraded to
-  * `success: false` (with error code `action-mismatch`). Leave unset to skip
-  * the check.
-  */
+   * Assert the widget `action` the token was solved for. Cloudflare echoes the
+   * customer-supplied `action` back in the siteverify response; when this is
+   * set and the returned `action` does not match, the verdict is downgraded to
+   * `success: false` (with error code `action-mismatch`). Leave unset to skip
+   * the check.
+   */
   expectedAction?: string;
   /**
-  * Assert the `hostname` the challenge was solved on. Cloudflare returns the
-  * solving hostname in the siteverify response; when this is set and the
-  * returned `hostname` does not match, the verdict is downgraded to
-  * `success: false` (with error code `hostname-mismatch`). Set this when a
-  * single secret/sitekey is shared across multiple domains to stop a token
-  * harvested on one origin from being replayed against another. Leave unset
-  * to skip the check.
-  */
+   * Assert the `hostname` the challenge was solved on. Cloudflare returns the
+   * solving hostname in the siteverify response; when this is set and the
+   * returned `hostname` does not match, the verdict is downgraded to
+   * `success: false` (with error code `hostname-mismatch`). Set this when a
+   * single secret/sitekey is shared across multiple domains to stop a token
+   * harvested on one origin from being replayed against another. Leave unset
+   * to skip the check.
+   */
   expectedHostname?: string;
   /**
-  * Inject a `fetch` implementation. Defaults to `globalThis.fetch`. Primarily
-  * for unit tests — production callers can omit it.
-  */
+   * Inject a `fetch` implementation. Defaults to `globalThis.fetch`. Primarily
+   * for unit tests — production callers can omit it.
+   */
   fetch?: FetchLike;
   /**
-  * The visitor's IP address, if known. Optional; Cloudflare uses it as an
-  * extra signal but verification works without it.
-  */
+   * The visitor's IP address, if known. Optional; Cloudflare uses it as an
+   * extra signal but verification works without it.
+   */
   remoteip?: string;
   /** Your Turnstile secret key (the `TURNSTILE_SECRET_KEY` env var). */
   secret: string;
@@ -51,13 +41,13 @@ interface VerifyTurnstileOptions {
   token: string;
 }
 /**
-* The normalized result of a Turnstile verification. Snake-cased fields from
-* Cloudflare (`error-codes`, `challenge_ts`) are mapped to camelCase.
-*
-* A `success: false` verdict is a **bot/invalid-token** outcome, not an error —
-* it is returned, never thrown. `verifyTurnstile` only throws on transport
-* failure (network error, non-2xx response).
-*/
+ * The normalized result of a Turnstile verification. Snake-cased fields from
+ * Cloudflare (`error-codes`, `challenge_ts`) are mapped to camelCase.
+ *
+ * A `success: false` verdict is a **bot/invalid-token** outcome, not an error —
+ * it is returned, never thrown. `verifyTurnstile` only throws on transport
+ * failure (network error, non-2xx response).
+ */
 interface TurnstileVerifyResult {
   /** The customer-supplied `action` the widget was rendered with, if any. */
   action?: string;
@@ -66,9 +56,9 @@ interface TurnstileVerifyResult {
   /** ISO timestamp of the challenge, if Cloudflare returned one. */
   challengeTs?: string;
   /**
-  * Cloudflare error codes for a failed verification (e.g.
-  * `"invalid-input-response"`, `"timeout-or-duplicate"`). Empty on success.
-  */
+   * Cloudflare error codes for a failed verification (e.g.
+   * `"invalid-input-response"`, `"timeout-or-duplicate"`). Empty on success.
+   */
   errorCodes: string[];
   /** Hostname the challenge was solved on, if Cloudflare returned one. */
   hostname?: string;
@@ -76,23 +66,16 @@ interface TurnstileVerifyResult {
   success: boolean;
 }
 /**
-* Verify a Turnstile token against Cloudflare's `siteverify` endpoint.
-*
-* POSTs `application/x-www-form-urlencoded` (`secret`, `response`=token, and an
-* optional `remoteip`) and returns the parsed verdict. A `success: false`
-* outcome (bot / invalid / expired token) is **returned**, not thrown — callers
-* decide how to react. The function throws a structural `LunoraError`-shaped
-* error (`{ name: "LunoraError", code: "SERVICE_UNAVAILABLE", status: 503 }`)
-* only when the siteverify call itself fails (network error or non-2xx), so a
-* "siteverify is down" failure is distinguishable from a "this is a bot"
-* verdict.
-*/
-declare const verifyTurnstile: ({
-  expectedAction,
-  expectedHostname,
-  fetch,
-  remoteip,
-  secret,
-  token
-}: VerifyTurnstileOptions) => Promise<TurnstileVerifyResult>;
+ * Verify a Turnstile token against Cloudflare's `siteverify` endpoint.
+ *
+ * POSTs `application/x-www-form-urlencoded` (`secret`, `response`=token, and an
+ * optional `remoteip`) and returns the parsed verdict. A `success: false`
+ * outcome (bot / invalid / expired token) is **returned**, not thrown — callers
+ * decide how to react. The function throws a structural `LunoraError`-shaped
+ * error (`{ name: "LunoraError", code: "SERVICE_UNAVAILABLE", status: 503 }`)
+ * only when the siteverify call itself fails (network error or non-2xx), so a
+ * "siteverify is down" failure is distinguishable from a "this is a bot"
+ * verdict.
+ */
+declare const verifyTurnstile: ({ expectedAction, expectedHostname, fetch, remoteip, secret, token }: VerifyTurnstileOptions) => Promise<TurnstileVerifyResult>;
 export { type FetchLike, TURNSTILE_VERIFY_ENDPOINT, type TurnstileVerifyResult, type VerifyTurnstileOptions, verifyTurnstile };

package/dist/turnstile.d.ts

@@ -1,13 +1,3 @@
-/**
-* Cloudflare Turnstile server-side verification.
-*
-* Turnstile has **no Cloudflare binding** — verification is a single HTTPS POST
-* to the public `siteverify` endpoint with your secret key. The secret lives in
-* a plain env var / `.dev.vars` (conventionally `TURNSTILE_SECRET_KEY`), not in
-* `wrangler.jsonc`. This module is therefore pure, transport-agnostic, and
-* usable from any mutation/action — not just the auth flow.
-* @see https://developers.cloudflare.com/turnstile/get-started/server-side-validation/
-*/
 /** Cloudflare's public Turnstile `siteverify` endpoint. */
 declare const TURNSTILE_VERIFY_ENDPOINT = "https://challenges.cloudflare.com/turnstile/v0/siteverify";
 /** Minimal `fetch` shape we depend on, so callers can inject a stub in tests. */
@@ -18,32 +8,32 @@ type FetchLike = (input: string, init?: {
 }) => Promise<Response>;
 interface VerifyTurnstileOptions {
   /**
-  * Assert the widget `action` the token was solved for. Cloudflare echoes the
-  * customer-supplied `action` back in the siteverify response; when this is
-  * set and the returned `action` does not match, the verdict is downgraded to
-  * `success: false` (with error code `action-mismatch`). Leave unset to skip
-  * the check.
-  */
+   * Assert the widget `action` the token was solved for. Cloudflare echoes the
+   * customer-supplied `action` back in the siteverify response; when this is
+   * set and the returned `action` does not match, the verdict is downgraded to
+   * `success: false` (with error code `action-mismatch`). Leave unset to skip
+   * the check.
+   */
   expectedAction?: string;
   /**
-  * Assert the `hostname` the challenge was solved on. Cloudflare returns the
-  * solving hostname in the siteverify response; when this is set and the
-  * returned `hostname` does not match, the verdict is downgraded to
-  * `success: false` (with error code `hostname-mismatch`). Set this when a
-  * single secret/sitekey is shared across multiple domains to stop a token
-  * harvested on one origin from being replayed against another. Leave unset
-  * to skip the check.
-  */
+   * Assert the `hostname` the challenge was solved on. Cloudflare returns the
+   * solving hostname in the siteverify response; when this is set and the
+   * returned `hostname` does not match, the verdict is downgraded to
+   * `success: false` (with error code `hostname-mismatch`). Set this when a
+   * single secret/sitekey is shared across multiple domains to stop a token
+   * harvested on one origin from being replayed against another. Leave unset
+   * to skip the check.
+   */
   expectedHostname?: string;
   /**
-  * Inject a `fetch` implementation. Defaults to `globalThis.fetch`. Primarily
-  * for unit tests — production callers can omit it.
-  */
+   * Inject a `fetch` implementation. Defaults to `globalThis.fetch`. Primarily
+   * for unit tests — production callers can omit it.
+   */
   fetch?: FetchLike;
   /**
-  * The visitor's IP address, if known. Optional; Cloudflare uses it as an
-  * extra signal but verification works without it.
-  */
+   * The visitor's IP address, if known. Optional; Cloudflare uses it as an
+   * extra signal but verification works without it.
+   */
   remoteip?: string;
   /** Your Turnstile secret key (the `TURNSTILE_SECRET_KEY` env var). */
   secret: string;
@@ -51,13 +41,13 @@ interface VerifyTurnstileOptions {
   token: string;
 }
 /**
-* The normalized result of a Turnstile verification. Snake-cased fields from
-* Cloudflare (`error-codes`, `challenge_ts`) are mapped to camelCase.
-*
-* A `success: false` verdict is a **bot/invalid-token** outcome, not an error —
-* it is returned, never thrown. `verifyTurnstile` only throws on transport
-* failure (network error, non-2xx response).
-*/
+ * The normalized result of a Turnstile verification. Snake-cased fields from
+ * Cloudflare (`error-codes`, `challenge_ts`) are mapped to camelCase.
+ *
+ * A `success: false` verdict is a **bot/invalid-token** outcome, not an error —
+ * it is returned, never thrown. `verifyTurnstile` only throws on transport
+ * failure (network error, non-2xx response).
+ */
 interface TurnstileVerifyResult {
   /** The customer-supplied `action` the widget was rendered with, if any. */
   action?: string;
@@ -66,9 +56,9 @@ interface TurnstileVerifyResult {
   /** ISO timestamp of the challenge, if Cloudflare returned one. */
   challengeTs?: string;
   /**
-  * Cloudflare error codes for a failed verification (e.g.
-  * `"invalid-input-response"`, `"timeout-or-duplicate"`). Empty on success.
-  */
+   * Cloudflare error codes for a failed verification (e.g.
+   * `"invalid-input-response"`, `"timeout-or-duplicate"`). Empty on success.
+   */
   errorCodes: string[];
   /** Hostname the challenge was solved on, if Cloudflare returned one. */
   hostname?: string;
@@ -76,23 +66,16 @@ interface TurnstileVerifyResult {
   success: boolean;
 }
 /**
-* Verify a Turnstile token against Cloudflare's `siteverify` endpoint.
-*
-* POSTs `application/x-www-form-urlencoded` (`secret`, `response`=token, and an
-* optional `remoteip`) and returns the parsed verdict. A `success: false`
-* outcome (bot / invalid / expired token) is **returned**, not thrown — callers
-* decide how to react. The function throws a structural `LunoraError`-shaped
-* error (`{ name: "LunoraError", code: "SERVICE_UNAVAILABLE", status: 503 }`)
-* only when the siteverify call itself fails (network error or non-2xx), so a
-* "siteverify is down" failure is distinguishable from a "this is a bot"
-* verdict.
-*/
-declare const verifyTurnstile: ({
-  expectedAction,
-  expectedHostname,
-  fetch,
-  remoteip,
-  secret,
-  token
-}: VerifyTurnstileOptions) => Promise<TurnstileVerifyResult>;
+ * Verify a Turnstile token against Cloudflare's `siteverify` endpoint.
+ *
+ * POSTs `application/x-www-form-urlencoded` (`secret`, `response`=token, and an
+ * optional `remoteip`) and returns the parsed verdict. A `success: false`
+ * outcome (bot / invalid / expired token) is **returned**, not thrown — callers
+ * decide how to react. The function throws a structural `LunoraError`-shaped
+ * error (`{ name: "LunoraError", code: "SERVICE_UNAVAILABLE", status: 503 }`)
+ * only when the siteverify call itself fails (network error or non-2xx), so a
+ * "siteverify is down" failure is distinguishable from a "this is a bot"
+ * verdict.
+ */
+declare const verifyTurnstile: ({ expectedAction, expectedHostname, fetch, remoteip, secret, token }: VerifyTurnstileOptions) => Promise<TurnstileVerifyResult>;
 export { type FetchLike, TURNSTILE_VERIFY_ENDPOINT, type TurnstileVerifyResult, type VerifyTurnstileOptions, verifyTurnstile };