@mindfulauth/core 2.0.0-beta.9 → 3.0.0

package/dist/authScripts/VerifyMagicLinkScript.astro

@@ -0,0 +1,195 @@
+---
+// Mindful Auth - Verify Magic Link Script Component
+// Provides: Magic link verification with 2FA support
+---
+<script is:inline>
+// Verify Magic Link Script - Astro Optimized
+
+function getPathParams() {
+    const pathParts = window.location.pathname.split('/');
+    return {
+        recordid: pathParts[2],
+        token: pathParts[3]
+    };
+}
+
+async function handleVerifyMagicLinkSubmit(event) {
+    if (event) event.preventDefault();
+    
+    const form = document.querySelector('[data-mindfulauth-form="verify-magic-link"]');
+    if (!form) return;
+    const messageEl = document.querySelector('[data-mindfulauth-field="message"]');
+    if (!messageEl) return;
+    const twoFACodeEl = form.querySelector('[data-mindfulauth-field="twofa-code"]');
+    const submitBtn = form.querySelector('button[type="submit"]');
+
+    // Skip API call on localhost to prevent production logs pollution
+    const hostname = window.location.hostname;
+    if (hostname === 'localhost' || hostname === '127.0.0.1' || hostname.endsWith('.local')) {
+        messageEl.textContent = 'Magic link verification skipped on localhost.';
+        console.log('[Verify Magic Link] Skipping API call on localhost');
+        if (form) form.style.display = 'none';
+        return;
+    }
+
+    const { recordid, token } = getPathParams();
+
+    if (!recordid || !token) {
+        messageEl.textContent = "Invalid or expired magic link. Please request a new one.";
+        if (form) form.style.display = 'none';
+        return;
+    }
+
+    // Get Turnstile token
+    const turnstileToken = form.querySelector('[name="cf-turnstile-response"]')?.value;
+    if (!turnstileToken) {
+        messageEl.textContent = "Bot protection validation required.";
+        if (submitBtn) submitBtn.disabled = true;
+        return;
+    }
+
+    messageEl.textContent = "Verifying magic link...";
+    if (submitBtn) submitBtn.disabled = true;
+
+    try {
+        const requestBody = {
+            'cf-turnstile-response': turnstileToken
+        };
+
+        // Include 2FA code if provided
+        if (twoFACodeEl && twoFACodeEl.value) {
+            requestBody.twoFACode = twoFACodeEl.value;
+        }
+
+        const endpoint = `/auth/verify-magic-link/${recordid}/${token}`;
+        console.log('[Verify Magic Link] Making request to:', endpoint);
+        console.log('[Verify Magic Link] Request body:', requestBody);
+
+        const response = await window.apiFetch(endpoint, {
+            body: JSON.stringify(requestBody)
+        });
+
+        console.log('[Verify Magic Link] Response status:', response.status);
+        const result = await response.json();
+        console.log('[Verify Magic Link] Response body:', result);
+
+        // Check if 2FA is required
+        if (result.requires2FA) {
+            // Reset Turnstile to generate a fresh token for the 2FA submission
+            // (Turnstile tokens are single-use; first request consumed it)
+            window.turnstile?.reset();
+            
+            // Show the 2FA input field
+            const twoFAContainer = form.querySelector('[data-mindfulauth-field="twofa-code-container"]');
+            if (twoFAContainer) {
+                twoFAContainer.removeAttribute('hidden');
+                twoFAContainer.classList && twoFAContainer.classList.remove('hidden');
+                twoFAContainer.style.setProperty('display', 'block', 'important');
+                // Try common display values
+                if (window.getComputedStyle(twoFAContainer).display === 'none') {
+                    twoFAContainer.style.setProperty('display', 'flex', 'important');
+                }
+            }
+            if (twoFACodeEl) {
+                twoFACodeEl.focus();
+            }
+            messageEl.textContent = '2FA code is required to complete login.';
+            if (submitBtn) {
+                submitBtn.textContent = 'Verify 2FA Code';
+                submitBtn.disabled = false;
+            }
+            return;
+        }
+
+        if (result.success) {
+            console.log('[Verify Magic Link] Verification successful');
+            messageEl.textContent = result.message || 'Login successful! Redirecting...';
+            if (form) form.style.display = 'none';
+            
+            // Redirect to secure area (match login.js pattern)
+            if (result.redirect) {
+                console.log('[Verify Magic Link] Redirecting to:', result.redirect);
+                setTimeout(() => {
+                    window.location.assign(result.redirect);
+                }, 200);
+            }
+        } else {
+            console.error('[Verify Magic Link] Verification failed:', result.message);
+            throw new Error(result.message || 'Verification failed.');
+        }
+    } catch (error) {
+        console.error('[Verify Magic Link] Error:', error);
+        messageEl.textContent = `Error: ${error.message}`;
+        if (submitBtn) submitBtn.disabled = false;
+        window.turnstile?.reset();
+    }
+}
+
+// --- MAIN EXECUTION ---
+document.addEventListener('DOMContentLoaded', function() {
+    const form = document.querySelector('[data-mindfulauth-form="verify-magic-link"]');
+    if (!form) return;
+    
+    // Initialize message and disable button until Turnstile is ready
+    const messageEl = document.querySelector('[data-mindfulauth-field="message"]');
+    const submitBtn = form.querySelector('button[type="submit"]');
+    if (messageEl) {
+        messageEl.textContent = 'Loading bot protection...';
+    }
+    if (submitBtn) {
+        submitBtn.disabled = true;
+    }
+
+    // Initially hide 2FA field - it will be shown if needed
+    const twoFAContainer = form.querySelector('[data-mindfulauth-field="twofa-code-container"]');
+    if (twoFAContainer) {
+        twoFAContainer.style.display = 'none';
+    }
+
+    // Wait for Turnstile to be ready
+    let turnstileReady = false;
+    const checkTurnstile = setInterval(() => {
+        const turnstileToken = form.querySelector('[name="cf-turnstile-response"]')?.value;
+        if (turnstileToken) {
+            console.log('[Verify Magic Link] Turnstile token loaded - ready for user verification');
+            clearInterval(checkTurnstile);
+            turnstileReady = true;
+            const messageEl = document.querySelector('[data-mindfulauth-field="message"]');
+            if (messageEl) {
+                messageEl.textContent = 'Ready to verify. Click the button below to sign in.';
+            }
+            const submitBtn = form.querySelector('button[type="submit"]');
+            if (submitBtn) {
+                submitBtn.disabled = false;
+            }
+        }
+    }, 100);
+
+    // Check for Turnstile load every 500ms for up to 30 seconds
+    // (don't show error proactively - only if user tries to submit)
+    let turnstileCheckCount = 0;
+    const extendedCheckTurnstile = setInterval(() => {
+        const turnstileToken = form.querySelector('[name="cf-turnstile-response"]')?.value;
+        if (turnstileToken && !turnstileReady) {
+            clearInterval(extendedCheckTurnstile);
+            turnstileReady = true;
+            const messageEl = document.querySelector('[data-mindfulauth-field="message"]');
+            if (messageEl) {
+                messageEl.textContent = 'Ready to verify. Click the button below to sign in.';
+            }
+            const submitBtn = form.querySelector('button[type="submit"]');
+            if (submitBtn) {
+                submitBtn.disabled = false;
+            }
+        }
+        turnstileCheckCount++;
+        // Stop checking after 30 seconds
+        if (turnstileCheckCount > 60) {
+            clearInterval(extendedCheckTurnstile);
+        }
+    }, 500);
+
+    // Also handle explicit form submission (for 2FA code entry)
+    form.addEventListener('submit', handleVerifyMagicLinkSubmit);
+});
+</script>

package/dist/authScripts/index.d.ts

@@ -0,0 +1,13 @@
+export { default as MAuthMainScript } from './MainScript.astro';
+export { default as MAuthTurnstileInit } from './TurnstileInit.astro';
+export { default as MAuthLoginScript } from './LoginScript.astro';
+export { default as MAuthRegisterPasswordScript } from './RegisterPasswordScript.astro';
+export { default as MAuthForgotPasswordScript } from './ForgotPasswordScript.astro';
+export { default as MAuthMagicLoginScript } from './MagicLoginScript.astro';
+export { default as MAuthMagicRegisterScript } from './MagicRegisterScript.astro';
+export { default as MAuthResendVerificationScript } from './ResendVerificationScript.astro';
+export { default as MAuthResetPasswordScript } from './ResetPasswordScript.astro';
+export { default as MAuthVerifyEmailScript } from './VerifyEmailScript.astro';
+export { default as MAuthVerifyMagicLinkScript } from './VerifyMagicLinkScript.astro';
+export { default as MAuthSecurityScript } from './SecurityScript.astro';
+//# sourceMappingURL=index.d.ts.map

package/dist/authScripts/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/authScripts/index.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,OAAO,IAAI,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAAE,OAAO,IAAI,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,EAAE,OAAO,IAAI,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EAAE,OAAO,IAAI,2BAA2B,EAAE,MAAM,gCAAgC,CAAC;AACxF,OAAO,EAAE,OAAO,IAAI,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AACpF,OAAO,EAAE,OAAO,IAAI,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAC5E,OAAO,EAAE,OAAO,IAAI,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AAClF,OAAO,EAAE,OAAO,IAAI,6BAA6B,EAAE,MAAM,kCAAkC,CAAC;AAC5F,OAAO,EAAE,OAAO,IAAI,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AAClF,OAAO,EAAE,OAAO,IAAI,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAC9E,OAAO,EAAE,OAAO,IAAI,0BAA0B,EAAE,MAAM,+BAA+B,CAAC;AACtF,OAAO,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,wBAAwB,CAAC"}

package/dist/authScripts/index.js

@@ -0,0 +1,15 @@
+// Mindful Auth - Astro Components Barrel Export
+// Usage: import { MAuthLoginScript, MAuthTurnstileInit } from '@mindfulauth/authScripts';
+//    or: import MAuthLoginScript from '@mindfulauth/authScripts/LoginScript.astro';
+export { default as MAuthMainScript } from './MainScript.astro';
+export { default as MAuthTurnstileInit } from './TurnstileInit.astro';
+export { default as MAuthLoginScript } from './LoginScript.astro';
+export { default as MAuthRegisterPasswordScript } from './RegisterPasswordScript.astro';
+export { default as MAuthForgotPasswordScript } from './ForgotPasswordScript.astro';
+export { default as MAuthMagicLoginScript } from './MagicLoginScript.astro';
+export { default as MAuthMagicRegisterScript } from './MagicRegisterScript.astro';
+export { default as MAuthResendVerificationScript } from './ResendVerificationScript.astro';
+export { default as MAuthResetPasswordScript } from './ResetPasswordScript.astro';
+export { default as MAuthVerifyEmailScript } from './VerifyEmailScript.astro';
+export { default as MAuthVerifyMagicLinkScript } from './VerifyMagicLinkScript.astro';
+export { default as MAuthSecurityScript } from './SecurityScript.astro';

package/dist/components/MAuthEmailInput.astro

@@ -0,0 +1,12 @@
+---
+interface Props {
+    label?: string;
+    placeholder?: string;
+    class?: string;
+}
+const { label = 'Email', placeholder, class: classList } = Astro.props;
+---
+<div class={classList}>
+    <label>{label}</label>
+    <input type="email" name="email" required data-mindfulauth-field="email" placeholder={placeholder} />
+</div>

package/dist/components/MAuthForm.astro

@@ -0,0 +1,10 @@
+---
+interface Props {
+    formName: string;
+    class?: string;
+}
+const { formName, class: classList } = Astro.props;
+---
+<form method="post" data-mindfulauth-form={formName} class={classList}>
+    <slot />
+</form>

package/dist/components/MAuthMessage.astro

@@ -0,0 +1,8 @@
+---
+interface Props {
+    defaultText?: string;
+    class?: string;
+}
+const { defaultText = '', class: classList } = Astro.props;
+---
+<aside data-mindfulauth-field="message" class={classList}>{defaultText}</aside>

package/dist/components/MAuthNameInput.astro

@@ -0,0 +1,11 @@
+---
+interface Props {
+    label?: string;
+    class?: string;
+}
+const { label = 'Name', class: classList } = Astro.props;
+---
+<div class={classList}>
+    <label>{label}</label>
+    <input type="text" name="name" required data-mindfulauth-field="name" />
+</div>

package/dist/components/MAuthPasswordChangePending.astro

@@ -0,0 +1,8 @@
+---
+interface Props {
+    class?: string;
+}
+const { class: classList } = Astro.props;
+// Message container appears when a user is redirected to the forgot-password page with ?reason=password_change_required in the URL. The script displays a security warning message "Your account requires a password change for security reasons. Please complete the form below to set a new password.".
+---
+<div class={`hidden ${classList}`} data-mindfulauth-field="password-change-pending"></div>

package/dist/components/MAuthPasswordInput.astro

@@ -0,0 +1,12 @@
+---
+interface Props {
+    label: string;
+    fieldName?: 'password' | 'confirm-password' | 'new-password';
+    class?: string;
+}
+const { label, fieldName = 'password', class: classList } = Astro.props;
+---
+<div class={classList}>
+    <label>{label}</label>
+    <input type="password" name={fieldName} required data-mindfulauth-field={fieldName} minlength={8} />
+</div>

package/dist/components/MAuthSubmitButton.astro

@@ -0,0 +1,8 @@
+---
+interface Props {
+    label: string;
+    class?: string;
+}
+const { label, class: classList } = Astro.props;
+---
+<button type="submit" class={classList}>{label}</button>

package/dist/components/MAuthTurnstile.astro

@@ -0,0 +1,11 @@
+---
+interface Props {
+    theme?: 'light' | 'dark' | 'auto';
+    size?: 'flexible' | 'normal' | 'compact';
+    language?: 'auto' |  string;
+    appearance?: 'always' | 'execute' | 'interaction-only';
+    class?: string;
+}
+const { theme = 'light', size = 'flexible', language = 'auto', appearance = 'always', class: classList } = Astro.props;
+---
+<div data-mindfulauth-turnstile data-theme={theme} data-size={size} data-language={language} data-appearance={appearance} class={classList}></div>

package/dist/components/MAuthTwoFACodeInput.astro

@@ -0,0 +1,13 @@
+---
+interface Props {
+    name: string;
+    label?: string;
+    class?: string;
+}
+const { name, label = '2FA Code', class: classList } = Astro.props;
+---
+<div hidden data-mindfulauth-field="twofa-code-container" class={classList}>
+    <label>{label}</label>
+    <input type="text" name={name} inputmode="numeric" pattern="[0-9]{6}" maxlength="6" placeholder="Enter 6-digit code" data-mindfulauth-field="twofa-code" />
+    <small>Enter the 6-digit code from your authenticator app.</small>
+</div>

package/dist/components/MAuthTwoFASection.astro

@@ -0,0 +1,11 @@
+---
+interface Props {
+    class?: string;
+}
+const { class: classList } = Astro.props;
+---
+<div class={`hidden ${classList}`} data-mindfulauth-field="twofa-section">
+    <label>Authenticator Code</label>
+    <input type="text" name="twofa-code" pattern="[0-9]*" maxlength="6" placeholder="123456" inputmode="numeric" data-mindfulauth-field="twofa-code" />
+    <a href="#" data-mindfulauth-field="use-recovery-link">Use a recovery code instead</a>
+</div>

package/dist/components/index.d.ts

@@ -0,0 +1,11 @@
+export { default as MAuthForm } from './MAuthForm.astro';
+export { default as MAuthEmailInput } from './MAuthEmailInput.astro';
+export { default as MAuthPasswordInput } from './MAuthPasswordInput.astro';
+export { default as MAuthNameInput } from './MAuthNameInput.astro';
+export { default as MAuthTurnstile } from './MAuthTurnstile.astro';
+export { default as MAuthSubmitButton } from './MAuthSubmitButton.astro';
+export { default as MAuthMessage } from './MAuthMessage.astro';
+export { default as MAuthTwoFASection } from './MAuthTwoFASection.astro';
+export { default as MAuthTwoFACodeInput } from './MAuthTwoFACodeInput.astro';
+export { default as MAuthPasswordChangePending } from './MAuthPasswordChangePending.astro';
+//# sourceMappingURL=index.d.ts.map

package/dist/components/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/components/index.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,OAAO,IAAI,eAAe,EAAE,MAAM,yBAAyB,CAAC;AACrE,OAAO,EAAE,OAAO,IAAI,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAC3E,OAAO,EAAE,OAAO,IAAI,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,EAAE,OAAO,IAAI,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,EAAE,OAAO,IAAI,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AACzE,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAC/D,OAAO,EAAE,OAAO,IAAI,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AACzE,OAAO,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAC7E,OAAO,EAAE,OAAO,IAAI,0BAA0B,EAAE,MAAM,oCAAoC,CAAC"}

package/dist/components/index.js

@@ -0,0 +1,13 @@
+// Mindful Auth - Astro Components Barrel Export
+// Usage: import { MAuthForm, MAuthEmailInput } from '@mindfulauth/components';
+//    or: import MAuthForm from '@mindfulauth/components/MAuthForm.astro';
+export { default as MAuthForm } from './MAuthForm.astro';
+export { default as MAuthEmailInput } from './MAuthEmailInput.astro';
+export { default as MAuthPasswordInput } from './MAuthPasswordInput.astro';
+export { default as MAuthNameInput } from './MAuthNameInput.astro';
+export { default as MAuthTurnstile } from './MAuthTurnstile.astro';
+export { default as MAuthSubmitButton } from './MAuthSubmitButton.astro';
+export { default as MAuthMessage } from './MAuthMessage.astro';
+export { default as MAuthTwoFASection } from './MAuthTwoFASection.astro';
+export { default as MAuthTwoFACodeInput } from './MAuthTwoFACodeInput.astro';
+export { default as MAuthPasswordChangePending } from './MAuthPasswordChangePending.astro';

package/dist/core/auth-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-handler.d.ts","sourceRoot":"","sources":["../../src/core/auth-handler.ts"],"names":[],"mappings":"AAwEA,2EAA2E;AAC3E,wBAAsB,aAAa,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,EAAE,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CA6BpH;AAED,gEAAgE;AAChE,wBAAsB,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,EAAE,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAyDrH"}
+{"version":3,"file":"auth-handler.d.ts","sourceRoot":"","sources":["../../src/core/auth-handler.ts"],"names":[],"mappings":"AAoEA,2EAA2E;AAC3E,wBAAsB,aAAa,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,EAAE,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CA6BpH;AAED,gEAAgE;AAChE,wBAAsB,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,EAAE,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAyDrH"}

package/dist/core/auth-handler.js

@@ -1,12 +1,8 @@
 // Auth proxy handler for Mindful Auth
 // Forwards authentication requests to the central Mindful Auth service
-//
-// ASTRO 6 MIGRATION:
-// - Astro v6 removed context.locals.runtime.env. Env vars now import from 'cloudflare:workers'.
-// - Note: @cloudflare/workers-types must be installed and referenced in env.d.ts.
 import { env } from 'cloudflare:workers';
-import { CENTRAL_AUTH_ORIGIN, ALLOWED_AUTH_METHODS, MAX_BODY_SIZE_BYTES, AUTH_PROXY_TIMEOUT_MS } from './config';
-import { sanitizeEndpoint } from './security';
+import { CENTRAL_AUTH_ORIGIN, ALLOWED_AUTH_METHODS, MAX_BODY_SIZE_BYTES, AUTH_PROXY_TIMEOUT_MS } from './config.js';
+import { sanitizeEndpoint } from './security.js';
 const JSON_HEADERS = { 'Content-Type': 'application/json' };
 const jsonError = (error, status) => new Response(JSON.stringify({ error }), { status, headers: JSON_HEADERS });
 /** Build proxy headers from incoming request */

package/dist/core/auth.d.ts

@@ -1,4 +1,4 @@
-import type { SessionValidationResult } from './types';
+import type { SessionValidationResult } from './types.js';
 /** Validate session with Mindful Auth central service */
 export declare function validateSession(request: Request, tenantDomain: string, pathname: string, internalApiKey: string): Promise<SessionValidationResult>;
 /** Validate memberid in URL matches session (or just check structure if sessionRecordId is null) */

package/dist/core/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/core/auth.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,SAAS,CAAC;AAEvD,yDAAyD;AACzD,wBAAsB,eAAe,CACjC,OAAO,EAAE,OAAO,EAChB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,cAAc,EAAE,MAAM,GACvB,OAAO,CAAC,uBAAuB,CAAC,CAsClC;AAED,oGAAoG;AACpG,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,IAAI,GAAG;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAAE,CAerI"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/core/auth.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAE1D,yDAAyD;AACzD,wBAAsB,eAAe,CACjC,OAAO,EAAE,OAAO,EAChB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,cAAc,EAAE,MAAM,GACvB,OAAO,CAAC,uBAAuB,CAAC,CAsClC;AAED,oGAAoG;AACpG,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,IAAI,GAAG;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAAE,CAerI"}

package/dist/core/auth.js

@@ -1,5 +1,5 @@
 // Authentication and session validation for Mindful Auth
-import { CENTRAL_AUTH_ORIGIN, SESSION_VALIDATION_TIMEOUT_MS } from './config';
+import { CENTRAL_AUTH_ORIGIN, SESSION_VALIDATION_TIMEOUT_MS } from './config.js';
 /** Validate session with Mindful Auth central service */
 export async function validateSession(request, tenantDomain, pathname, internalApiKey) {
     const sessionId = request.headers.get('Cookie')?.match(/session_id=([^;]+)/)?.[1];

package/dist/core/config.d.ts

@@ -41,8 +41,7 @@ export declare const PUBLIC_PREFIXES: string[];
  * Astro 6's native security.csp in astro.config.mjs using hashes.
  * The remaining headers here cover transport security, framing, and permissions.
  *
- * Note: X-Frame-Options: SAMEORIGIN covers clickjacking protection
- * (equivalent to CSP frame-ancestors 'self', which cannot be set via meta tag).
+ * Note: X-Frame-Options: DENY prevents this portal from being embedded in iframes on any domain, protecting against clickjacking attacks.
  */
 export declare function GET_SECURITY_HEADERS(): Record<string, string>;
 //# sourceMappingURL=config.d.ts.map

package/dist/core/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/core/config.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,mBAAmB,gCAAgC,CAAC;AAGjE,eAAO,MAAM,oBAAoB,UAAkB,CAAC;AACpD,eAAO,MAAM,mBAAmB,UAAU,CAAC;AAC3C,eAAO,MAAM,qBAAqB,QAAQ,CAAC;AAC3C,eAAO,MAAM,6BAA6B,QAAQ,CAAC;AAenD;;;GAGG;AACH,wBAAgB,eAAe,IAAI,MAAM,EAAE,CAE1C;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,CAAC,EAAE;IAC1C,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB,GAAG,OAAO,OAAO,CAEjB;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,CAAC,EAAE;IAC1C,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAIzB;AAID,eAAO,MAAM,aAAa,UAQzB,CAAC;AAIF,eAAO,MAAM,eAAe,UAO3B,CAAC;AAMF;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAQ7D"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/core/config.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,mBAAmB,gCAAgC,CAAC;AAGjE,eAAO,MAAM,oBAAoB,UAAkB,CAAC;AACpD,eAAO,MAAM,mBAAmB,UAAU,CAAC;AAC3C,eAAO,MAAM,qBAAqB,QAAQ,CAAC;AAC3C,eAAO,MAAM,6BAA6B,QAAQ,CAAC;AAenD;;;GAGG;AACH,wBAAgB,eAAe,IAAI,MAAM,EAAE,CAE1C;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,CAAC,EAAE;IAC1C,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB,GAAG,OAAO,OAAO,CAEjB;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,CAAC,EAAE;IAC1C,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAIzB;AAID,eAAO,MAAM,aAAa,UAQzB,CAAC;AAIF,eAAO,MAAM,eAAe,UAO3B,CAAC;AAMF;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAU7D"}

package/dist/core/config.js

@@ -80,15 +80,16 @@ export const PUBLIC_PREFIXES = [
  * Astro 6's native security.csp in astro.config.mjs using hashes.
  * The remaining headers here cover transport security, framing, and permissions.
  *
- * Note: X-Frame-Options: SAMEORIGIN covers clickjacking protection
- * (equivalent to CSP frame-ancestors 'self', which cannot be set via meta tag).
+ * Note: X-Frame-Options: DENY prevents this portal from being embedded in iframes on any domain, protecting against clickjacking attacks.
  */
 export function GET_SECURITY_HEADERS() {
     return {
         'X-Content-Type-Options': 'nosniff',
-        'X-Frame-Options': 'SAMEORIGIN',
+        'X-Frame-Options': 'DENY',
         'Referrer-Policy': 'strict-origin-when-cross-origin',
-        'Strict-Transport-Security': 'max-age=31536000; includeSubDomains',
-        'Permissions-Policy': 'geolocation=(), microphone=(), camera=()',
+        'Strict-Transport-Security': 'max-age=31536000; includeSubDomains; preload',
+        'Permissions-Policy': 'geolocation=(), microphone=(), camera=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=()',
+        'Cross-Origin-Opener-Policy': 'same-origin',
+        'Cross-Origin-Resource-Policy': 'same-origin',
     };
 }

package/dist/core/csp.d.ts

@@ -1,12 +1,12 @@
 /**
- * Scans the mindfulauth/astro/ directory at build time and returns SHA-384
+ * Scans the mindfulauth/authScripts/ directory at build time and returns SHA-384
  * hashes for all <script is:inline> blocks found in .astro component files.
  *
  * Astro's static CSP analysis cannot resolve dynamically rendered components,
  * so hashes must be declared manually in astro.config.mjs. This function
  * computes them automatically so no manual maintenance is needed.
  *
- * When published as a package, this function resolves the astro/ directory
+ * When published as a package, this function resolves the authScripts/ directory
  * relative to its own location — no consumer configuration required.
  *
  * @example

package/dist/core/csp.js

@@ -8,14 +8,14 @@ import { join, dirname } from 'path';
 import { fileURLToPath } from 'url';
 const __dirname = dirname(fileURLToPath(import.meta.url));
 /**
- * Scans the mindfulauth/astro/ directory at build time and returns SHA-384
+ * Scans the mindfulauth/authScripts/ directory at build time and returns SHA-384
  * hashes for all <script is:inline> blocks found in .astro component files.
  *
  * Astro's static CSP analysis cannot resolve dynamically rendered components,
  * so hashes must be declared manually in astro.config.mjs. This function
  * computes them automatically so no manual maintenance is needed.
  *
- * When published as a package, this function resolves the astro/ directory
+ * When published as a package, this function resolves the authScripts/ directory
  * relative to its own location — no consumer configuration required.
  *
  * @example
@@ -25,7 +25,7 @@ const __dirname = dirname(fileURLToPath(import.meta.url));
  * scriptDirective: { hashes: getScriptHashes() }
  */
 export function getScriptHashes() {
-    const dir = join(__dirname, '../astro');
+    const dir = join(__dirname, '../authScripts');
     return readdirSync(dir)
         .filter(f => f.endsWith('.astro'))
         .flatMap(file => {

package/dist/core/index.d.ts

@@ -1,8 +1,6 @@
-export * from './types';
-export * from './config';
-export * from './auth';
-export * from './auth-handler';
-export * from './security';
-export * from './middleware';
-export * from './csp';
+export * from './types.js';
+export * from './config.js';
+export * from './auth.js';
+export * from './security.js';
+export * from './csp.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/core/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/core/index.ts"],"names":[],"mappings":"AAGA,cAAc,SAAS,CAAC;AAGxB,cAAc,UAAU,CAAC;AAGzB,cAAc,QAAQ,CAAC;AAGvB,cAAc,gBAAgB,CAAC;AAG/B,cAAc,YAAY,CAAC;AAG3B,cAAc,cAAc,CAAC;AAG7B,cAAc,OAAO,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/core/index.ts"],"names":[],"mappings":"AAGA,cAAc,YAAY,CAAC;AAG3B,cAAc,aAAa,CAAC;AAG5B,cAAc,WAAW,CAAC;AAM1B,cAAc,eAAe,CAAC;AAQ9B,cAAc,UAAU,CAAC"}

package/dist/core/index.js

@@ -1,15 +1,17 @@
 // Mindful Auth Core - Main exports
 // Types
-export * from './types';
+export * from './types.js';
 // Configuration
-export * from './config';
+export * from './config.js';
 // Authentication
-export * from './auth';
-// Auth handler for API routes
-export * from './auth-handler';
+export * from './auth.js';
+// Auth handler for API routes — NOT re-exported here.
+// auth-handler.ts imports 'cloudflare:workers' which is only available at runtime (SSR), not at config-load time. Import it directly where needed: import { handleAuthProxy } from './auth-handler.js';
 // Security utilities
-export * from './security';
-// Middleware  
-export * from './middleware';
+export * from './security.js';
+// Middleware — NOT re-exported here.
+// middleware.ts imports 'astro:middleware' and 'cloudflare:workers' which are
+// only available at runtime (SSR), not at config-load time.
+// Import it directly: import { onRequest } from './middleware.js';
 // Build-time CSP utilities
-export * from './csp';
+export * from './csp.js';

package/dist/core/middleware.js

@@ -7,9 +7,9 @@
 // - Dev mode bypass uses import.meta.env.DEV (build-time constant: true in dev, false in prod).
 import { defineMiddleware } from 'astro:middleware';
 import { env } from 'cloudflare:workers';
-import { PUBLIC_ROUTES, PUBLIC_PREFIXES, GET_SECURITY_HEADERS, GET_SKIP_ASSETS } from './config';
-import { sanitizePath } from './security';
-import { validateSession, validateMemberIdInUrl } from './auth';
+import { PUBLIC_ROUTES, PUBLIC_PREFIXES, GET_SECURITY_HEADERS, GET_SKIP_ASSETS } from './config.js';
+import { sanitizePath } from './security.js';
+import { validateSession, validateMemberIdInUrl } from './auth.js';
 /** Check if a path is a public route (no auth required) */
 function isPublicRoute(pathname) {
     return PUBLIC_ROUTES.includes(pathname) ||

package/dist/core/types.d.ts

@@ -1,11 +1,6 @@
 import type { MiddlewareHandler } from 'astro';
 export interface MindfulAuthLocals {
     recordId: string | null;
-    runtime?: {
-        env?: {
-            INTERNAL_API_KEY?: string;
-        };
-    };
 }
 declare global {
     namespace App {

package/dist/core/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/core/types.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,OAAO,CAAC;AAG/C,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,OAAO,CAAC,EAAE;QACR,GAAG,CAAC,EAAE;YACJ,gBAAgB,CAAC,EAAE,MAAM,CAAC;SAC3B,CAAC;KACH,CAAC;CACH;AAGD,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,GAAG,CAAC;QACZ,UAAU,MAAO,SAAQ,iBAAiB;SAAG;KAC9C;CACF;AAED,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,qBAAqB,GAAG,iBAAiB,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/core/types.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,OAAO,CAAC;AAG/C,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAGD,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,GAAG,CAAC;QACZ,UAAU,MAAO,SAAQ,iBAAiB;SAAG;KAC9C;CACF;AAED,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,qBAAqB,GAAG,iBAAiB,CAAC"}