@zeyolabs/kit 2026.11.8 → 2026.11.10

package/eslint-config.js

@@ -113,3 +113,71 @@ export const drizzleRules = {
 		'drizzle/enforce-update-with-where': ['error', { drizzleObjectName }],
 	},
 };
+
+/**
+ * Layer boundaries (see `standards/codex`): edges (remote functions, endpoints, hooks) reach the db
+ * only through managers; services never import managers; clients and libraries import nothing
+ * above them. Files are matched by name, so features keep `manager.server.ts`,
+ * `service.server.ts` and `client.server.ts` (or a `clients/` folder) and libraries live in `utils/`.
+ *
+ * - Starts as a warning so existing code can migrate; pass `severity: 'error'` once it is clean.
+ * - A file belongs to the first group it matches, in the order edge, service, client, library, so
+ *   `utils/clients/x.ts` is a client and gets only the client rules.
+ * - Flat config does not merge `no-restricted-imports` across entries. Put these rules LAST, and
+ *   pass your own restricted-import patterns as `extraPatterns` (added to every group).
+ * - Matching is by import specifier, so a barrel re-export bypasses it. An app with another layout
+ *   (e.g. `services/*.ts`) passes its own `globs` (which files are which layer) and `imports`
+ *   (which specifiers each layer is imported by). A green lint is not proof the boundaries hold.
+ * @param {{
+ *   severity?: 'error' | 'warn',
+ *   globs?: { client?: string[], edge?: string[], library?: string[], service?: string[] },
+ *   imports?: { client?: string[], manager?: string[], service?: string[] },
+ *   extraPatterns?: { group: string[], message?: string }[],
+ * }} [options]
+ */
+export function layerBoundaryRules(options = {}) {
+	const severity = options.severity ?? 'warn';
+	const extra = options.extraPatterns ?? [];
+	const globs = {
+		client: ['**/client.server.ts', '**/clients/**/*.ts'],
+		edge: ['**/*.remote.ts', '**/+server.ts', '**/+page.server.ts', '**/hooks.server.ts'],
+		library: ['**/utils/**/*.ts'],
+		service: ['**/service.server.ts'],
+		...options.globs,
+	};
+	const imports = {
+		client: ['**/client.server', '**/client.server.ts', '**/clients/**'],
+		manager: ['**/manager.server', '**/manager.server.ts'],
+		service: ['**/service.server', '**/service.server.ts'],
+		...options.imports,
+	};
+	const forbid = (group, message) => ({ group, message });
+	// First match wins: each group ignores the files of the groups before it.
+	const groups = [
+		[globs.edge, [forbid(imports.service, 'Edges call managers, not services (layer boundary).')]],
+		[
+			globs.service,
+			[forbid(imports.manager, 'Services must not import managers (layer boundary).')],
+		],
+		[
+			globs.client,
+			[
+				forbid(imports.manager, 'Clients must not import managers (layer boundary).'),
+				forbid(imports.service, 'Clients must not import services (layer boundary).'),
+			],
+		],
+		[
+			globs.library,
+			[
+				forbid(imports.manager, 'Libraries must not import managers (layer boundary).'),
+				forbid(imports.service, 'Libraries must not import services (layer boundary).'),
+				forbid(imports.client, 'Libraries must not import clients (layer boundary).'),
+			],
+		],
+	];
+	return groups.map(([files, patterns], index) => ({
+		files,
+		ignores: groups.slice(0, index).flatMap(([earlier]) => earlier),
+		rules: { 'no-restricted-imports': [severity, { patterns: [...patterns, ...extra] }] },
+	}));
+}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@zeyolabs/kit",
-	"version": "2026.11.8",
+	"version": "2026.11.10",
 	"description": "Shared SvelteKit-on-Cloudflare server toolkit: remote-function wrappers, passwordless auth (magic link + passkeys), email over a send_email binding or SMTP, Cloudflare context, monitoring, storage clients, utils and the ESLint config.",
 	"type": "module",
 	"repository": {

package/server/turnstile.ts

@@ -1,7 +1,10 @@
+import { FormResult } from '../utils/form';
+
+const SITEVERIFY_URL = 'https://challenges.cloudflare.com/turnstile/v0/siteverify';
+
 /**
  * Server-side verification of a Cloudflare Turnstile token against the siteverify API. Pure
- * `fetch`, no framework or binding dependency. Each app owns how it obtains the secret key and how
- * a rejection surfaces (see `apps/web/src/lib/server/turnstile.ts`).
+ * `fetch`, no framework or binding dependency. Prefer `Turnstile.verify` / `Turnstile.gate`.
  */
 export async function verifyTurnstile(
 	token: string,
@@ -10,10 +13,58 @@ export async function verifyTurnstile(
 ): Promise<boolean> {
 	const params = new URLSearchParams({ response: token, secret: secretKey });
 	if (ip) params.set('remoteip', ip);
-	const response = await fetch('https://challenges.cloudflare.com/turnstile/v0/siteverify', {
-		body: params,
-		method: 'POST',
-	});
+	const response = await fetch(SITEVERIFY_URL, { body: params, method: 'POST' });
 	const result = (await response.json()) as { success?: boolean };
 	return result.success === true;
 }
+
+/** Where a gate gets the request's secret key and client address. The app supplies both. */
+export type TurnstileGateOptions = {
+	/** Client address per call (SvelteKit's `getRequestEvent().getClientAddress()`); may be null. */
+	ip?: () => null | string | undefined;
+	/** The error shown when the check fails. */
+	message?: string;
+	/** The secret key: a string, or a function called per check (a Secrets Store binding, a loopback test key). */
+	secret: (() => Promise<string> | string) | string;
+};
+
+/**
+ * Turnstile helpers: a library (an object of static functions, no state, no bindings), like
+ * `Schema` and `FormResult`.
+ */
+export const Turnstile = {
+	/**
+	 * Gates a form handler behind Turnstile. The validated input carries `turnstileToken`; the gate
+	 * verifies it and strips it before calling the handler. A missing or rejected token returns
+	 * `FormResult.err(message)` and the handler never runs; a throwing `secret` or `fetch` also
+	 * stops the handler (fails closed).
+	 */
+	gate({
+		ip = () => null,
+		message = 'Bot check failed. Please try again.',
+		secret,
+	}: TurnstileGateOptions) {
+		return function gated<TData extends { turnstileToken: string }, TResult>(
+			handler: (data: Omit<TData, 'turnstileToken'>) => Promise<FormResult<TResult | void>>
+		): (data: TData) => Promise<FormResult<TResult | void>> {
+			return async ({ turnstileToken, ...data }: TData) => {
+				if (!(await Turnstile.verify(turnstileToken, ip(), secret))) return FormResult.err(message);
+				return handler(data as Omit<TData, 'turnstileToken'>);
+			};
+		};
+	},
+
+	/**
+	 * True only when siteverify accepts the token. An empty token is false without a request, and
+	 * `secret` is only resolved when there is a token to check.
+	 */
+	async verify(
+		token: string,
+		ip: null | string | undefined,
+		secret: (() => Promise<string> | string) | string
+	): Promise<boolean> {
+		if (!token) return false;
+		const key = typeof secret === 'function' ? await secret() : secret;
+		return verifyTurnstile(token, ip, key);
+	},
+};