better-ship 0.25.0 → 0.27.0

package/dist/auth-secondary-storage-b9ptwPSB.d.ts

@@ -0,0 +1,37 @@
+import { Xt as AppError } from "./index-DUFS0SJ_.js";
+import { DurableObject } from "cloudflare:workers";
+//#region src/infrastructure/cloudflare/auth-secondary-storage.d.ts
+/** The supplied TTL cannot produce a valid expiry timestamp. Retrying the same input cannot fix it. */
+declare class InvalidTtlError extends AppError {
+  readonly _tag = "InvalidTtlError";
+  readonly classification = "terminal";
+  constructor();
+}
+/** The stored value cannot be incremented safely. The failed operation leaves it unchanged. */
+declare class InvalidCounterError extends AppError {
+  readonly _tag = "InvalidCounterError";
+  readonly classification = "terminal";
+  constructor();
+}
+/**
+ * Store one Better Auth secondary storage key per object. Export this class from the application's Worker entrypoint.
+ * Schedule cleanup at the caller's expiry; reads enforce expiry even when the alarm runs late.
+ * Requires compatibility date 2026-02-24 or later so deleteAll also removes the alarm atomically.
+ */
+declare class AuthSecondaryStorage extends DurableObject {
+  /** Return null for absent or expired values, even when the cleanup alarm has not run. */
+  get(): Promise<string | null>;
+  /** Replace the value and its expiry. Omit ttl to keep the value until deletion. */
+  set(value: string, ttl?: number): Promise<void>;
+  /** Remove the value and its cleanup alarm before answering. */
+  delete(): Promise<void>;
+  /** Consume the value once. Concurrent callers receive null after the first successful consumption. */
+  getAndDelete(): Promise<string | null>;
+  /** Increment atomically. Apply ttl only when creating a counter or replacing an expired counter. */
+  increment(ttl: number): Promise<number>;
+  /** Delete expired data. An old alarm must not delete a value whose expiry was extended. */
+  alarm(): Promise<void>;
+}
+//#endregion
+export { InvalidCounterError as n, InvalidTtlError as r, AuthSecondaryStorage as t };
+//# sourceMappingURL=auth-secondary-storage-b9ptwPSB.d.ts.map

package/dist/auth-secondary-storage-b9ptwPSB.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-secondary-storage-b9ptwPSB.d.ts","names":[],"sources":["../src/infrastructure/cloudflare/auth-secondary-storage.ts"],"mappings":";;;;cAWa,wBAAwB;WAC1B;WACA;EAET;;;cAMW,4BAA4B;WAC9B;WACA;EAET;;;;;;;cAUW,6BAA6B;;EAElC,OAAO;;EAMP,IAAI,eAAe,eAAe;;EAUlC,UAAU;;EAKV,gBAAgB;;EAQhB,UAAU,cAAc;;EAef,SAAS"}

package/dist/better-auth/secondary-storage.d.ts

@@ -1,4 +1,4 @@
-import { AuthSecondaryStorage } from "../cloudflare/auth-secondary-storage.js";
+import { t as AuthSecondaryStorage } from "../auth-secondary-storage-b9ptwPSB.js";
 import { BetterAuthOptions } from "better-auth";
 //#region src/infrastructure/better-auth/secondary-storage.d.ts
 type SecondaryStorage = NonNullable<BetterAuthOptions['secondaryStorage']>;

package/dist/bin/notify-ci.d.ts

@@ -0,0 +1 @@
+export {}

package/dist/bin/notify-ci.js

@@ -0,0 +1,24 @@
+#!/usr/bin/env node
+import { a as parseCiRun, i as buildCiMessage, n as postSlackMessage } from "../slack-webhook-j1FCPeu8.js";
+import { execFileSync } from "node:child_process";
+
+//#region src/infrastructure/slack/notify-ci.ts
+const webhookUrl = process.env.SLACK_WEBHOOK_URL;
+if (webhookUrl === void 0 || webhookUrl === "") console.log("Slack notification skipped: SLACK_WEBHOOK_URL is unset.");
+else {
+	const run = parseCiRun(process.env);
+	const git = (format) => execFileSync("git", [
+		"log",
+		"-1",
+		`--format=${format}`,
+		run.commitSha
+	], { encoding: "utf8" }).trim();
+	await postSlackMessage(webhookUrl, buildCiMessage(run, {
+		subject: git("%s"),
+		author: git("%an")
+	}));
+	console.log("Slack notification sent.");
+}
+
+//#endregion
+//# sourceMappingURL=notify-ci.js.map

package/dist/bin/notify-ci.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"notify-ci.js","names":[],"sources":["../../src/infrastructure/slack/notify-ci.ts"],"sourcesContent":["#!/usr/bin/env node\n// Entry point of `better-ship-notify-ci`. Ported from suparelay and better-ship `.depot/scripts/notify-slack.sh`.\nimport { execFileSync } from 'node:child_process'\n\nimport { buildCiMessage, parseCiRun } from './ci-message.ts'\nimport { postSlackMessage } from './slack-webhook.ts'\n\nconst webhookUrl = process.env.SLACK_WEBHOOK_URL\nif (webhookUrl === undefined || webhookUrl === '') {\n  console.log('Slack notification skipped: SLACK_WEBHOOK_URL is unset.')\n} else {\n  const run = parseCiRun(process.env)\n  const git = (format: string) =>\n    execFileSync('git', ['log', '-1', `--format=${format}`, run.commitSha], {\n      encoding: 'utf8',\n    }).trim()\n  await postSlackMessage(\n    webhookUrl,\n    buildCiMessage(run, { subject: git('%s'), author: git('%an') }),\n  )\n  console.log('Slack notification sent.')\n}\n"],"mappings":";;;;;AAOA,MAAM,aAAa,QAAQ,IAAI;AAC/B,IAAI,eAAe,UAAa,eAAe,IAC7C,QAAQ,IAAI,yDAAyD;KAChE;CACL,MAAM,MAAM,WAAW,QAAQ,GAAG;CAClC,MAAM,OAAO,WACX,aAAa,OAAO;EAAC;EAAO;EAAM,YAAY;EAAU,IAAI;CAAS,GAAG,EACtE,UAAU,OACZ,CAAC,CAAC,CAAC,KAAK;CACV,MAAM,iBACJ,YACA,eAAe,KAAK;EAAE,SAAS,IAAI,IAAI;EAAG,QAAQ,IAAI,KAAK;CAAE,CAAC,CAChE;CACA,QAAQ,IAAI,0BAA0B;AACxC"}

package/dist/client-Dv1Ch7yY.js

@@ -0,0 +1,20 @@
+import Stripe from "stripe";
+
+//#region src/infrastructure/stripe/client.ts
+/** Default SDK retries; client configuration and individual requests can override this value. */
+const STRIPE_REQUEST_OPTIONS = Object.freeze({ maxNetworkRetries: 2 });
+/**
+* Construct a native Stripe client with fetch transport and two SDK retries by default.
+* Native configuration overrides these defaults. Inject the client into application services.
+*/
+function createStripeClient(secretKey, options = {}) {
+	return new Stripe(secretKey, {
+		httpClient: Stripe.createFetchHttpClient(),
+		...STRIPE_REQUEST_OPTIONS,
+		...options
+	});
+}
+
+//#endregion
+export { createStripeClient as n, STRIPE_REQUEST_OPTIONS as t };
+//# sourceMappingURL=client-Dv1Ch7yY.js.map

package/dist/client-Dv1Ch7yY.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-Dv1Ch7yY.js","names":[],"sources":["../src/infrastructure/stripe/client.ts"],"sourcesContent":["import Stripe from 'stripe'\n\n/** Default SDK retries; client configuration and individual requests can override this value. */\nexport const STRIPE_REQUEST_OPTIONS = Object.freeze({ maxNetworkRetries: 2 })\n\n/**\n * Construct a native Stripe client with fetch transport and two SDK retries by default.\n * Native configuration overrides these defaults. Inject the client into application services.\n */\nexport function createStripeClient(secretKey: string, options: Stripe.StripeConfig = {}): Stripe {\n  return new Stripe(secretKey, {\n    httpClient: Stripe.createFetchHttpClient(),\n    ...STRIPE_REQUEST_OPTIONS,\n    ...options,\n  })\n}\n"],"mappings":";;;;AAGA,MAAa,yBAAyB,OAAO,OAAO,EAAE,mBAAmB,EAAE,CAAC;;;;;AAM5E,SAAgB,mBAAmB,WAAmB,UAA+B,CAAC,GAAW;CAC/F,OAAO,IAAI,OAAO,WAAW;EAC3B,YAAY,OAAO,sBAAsB;EACzC,GAAG;EACH,GAAG;CACL,CAAC;AACH"}

package/dist/cloudflare/auth-secondary-storage.d.ts

@@ -1,36 +1,2 @@
-import { Xt as AppError } from "../index-DUFS0SJ_.js";
-import { DurableObject } from "cloudflare:workers";
-//#region src/infrastructure/cloudflare/auth-secondary-storage.d.ts
-/** The supplied TTL cannot produce a valid expiry timestamp. Retrying the same input cannot fix it. */
-export declare class InvalidTtlError extends AppError {
-  readonly _tag = "InvalidTtlError";
-  readonly classification = "terminal";
-  constructor();
-}
-/** The stored value cannot be incremented safely. The failed operation leaves it unchanged. */
-export declare class InvalidCounterError extends AppError {
-  readonly _tag = "InvalidCounterError";
-  readonly classification = "terminal";
-  constructor();
-}
-/**
- * Store one Better Auth secondary storage key per object. Export this class from the application's Worker entrypoint.
- * Schedule cleanup at the caller's expiry; reads enforce expiry even when the alarm runs late.
- * Requires compatibility date 2026-02-24 or later so deleteAll also removes the alarm atomically.
- */
-export declare class AuthSecondaryStorage extends DurableObject {
-  /** Return null for absent or expired values, even when the cleanup alarm has not run. */
-  get(): Promise<string | null>;
-  /** Replace the value and its expiry. Omit ttl to keep the value until deletion. */
-  set(value: string, ttl?: number): Promise<void>;
-  /** Remove the value and its cleanup alarm before answering. */
-  delete(): Promise<void>;
-  /** Consume the value once. Concurrent callers receive null after the first successful consumption. */
-  getAndDelete(): Promise<string | null>;
-  /** Increment atomically. Apply ttl only when creating a counter or replacing an expired counter. */
-  increment(ttl: number): Promise<number>;
-  /** Delete expired data. An old alarm must not delete a value whose expiry was extended. */
-  alarm(): Promise<void>;
-}
-//#endregion
-//# sourceMappingURL=auth-secondary-storage.d.ts.map
+import { n as InvalidCounterError, r as InvalidTtlError, t as AuthSecondaryStorage } from "../auth-secondary-storage-b9ptwPSB.js";
+export { AuthSecondaryStorage, InvalidCounterError, InvalidTtlError };

package/dist/cloudflare/durable-object-client.js

@@ -1,5 +1,5 @@
 import { b as shouldRetryFailure, v as isAbortError } from "../core-BiN6S_cm.js";
-import { DurableObjectCallError, classifyDurableObjectError, isClassifiedDurableObjectError } from "./durable-object-errors.js";
+import { i as isClassifiedDurableObjectError, n as DurableObjectCallError, r as classifyDurableObjectError } from "../durable-object-errors-DkMFXQnK.js";
 import { Result } from "better-result";
 
 //#region src/infrastructure/cloudflare/durable-object-client.ts

package/dist/cloudflare/durable-object-errors.js

@@ -1,48 +1,3 @@
-import { _ as isTransientCloudflareRuntimeError, g as isCloudflareRetryableError, h as isCloudflareOverloadedError, nt as AppError, v as isAbortError, y as isTransientTransportError } from "../core-BiN6S_cm.js";
-import { z } from "zod";
+import { a as isDurableObjectCallError, i as isClassifiedDurableObjectError, n as DurableObjectCallError, r as classifyDurableObjectError, t as DURABLE_OBJECT_CALL_ERROR } from "../durable-object-errors-DkMFXQnK.js";
 
-//#region src/infrastructure/cloudflare/durable-object-errors.ts
-/** Stable tag for a failed Durable Object call. */
-const DURABLE_OBJECT_CALL_ERROR = "DurableObjectCallError";
-const RemoteClassifiedErrorSchema = z.object({
-	_tag: z.string(),
-	classification: z.enum([
-		"transient",
-		"terminal",
-		"unknown"
-	]),
-	remote: z.literal(true)
-});
-const RemoteCallErrorSchema = RemoteClassifiedErrorSchema.extend({
-	_tag: z.literal(DURABLE_OBJECT_CALL_ERROR),
-	cause: z.unknown()
-});
-/** Recognize a judged local or remote error without admitting its tag to the public error table. */
-function isClassifiedDurableObjectError(cause) {
-	return cause instanceof AppError || cause instanceof Error && RemoteClassifiedErrorSchema.safeParse(cause).success;
-}
-/** Classify the error itself. Its cause remains diagnostic evidence, not a second retry decision. */
-function classifyDurableObjectError(cause) {
-	if (isAbortError(cause)) return "terminal";
-	if (isClassifiedDurableObjectError(cause)) return cause.classification;
-	if (isCloudflareOverloadedError(cause)) return "terminal";
-	if (isCloudflareRetryableError(cause) || isTransientCloudflareRuntimeError(cause) || isTransientTransportError(cause)) return "transient";
-	return "unknown";
-}
-/** Identify a local call error or its validated Workers RPC representation. */
-function isDurableObjectCallError(cause) {
-	return cause instanceof DurableObjectCallError || cause instanceof Error && RemoteCallErrorSchema.safeParse(cause).success;
-}
-/** A call failed after retries stopped. Classification does not establish repeat safety. */
-var DurableObjectCallError = class extends AppError {
-	_tag = DURABLE_OBJECT_CALL_ERROR;
-	classification;
-	constructor(args) {
-		super("Durable Object call failed", { cause: args.cause });
-		this.classification = classifyDurableObjectError(args.cause);
-	}
-};
-
-//#endregion
-export { DURABLE_OBJECT_CALL_ERROR, DurableObjectCallError, classifyDurableObjectError, isClassifiedDurableObjectError, isDurableObjectCallError };
-//# sourceMappingURL=durable-object-errors.js.map
+export { DURABLE_OBJECT_CALL_ERROR, DurableObjectCallError, classifyDurableObjectError, isClassifiedDurableObjectError, isDurableObjectCallError };

package/dist/cloudflare/kv-client.js

@@ -1,5 +1,5 @@
 import { l as spreadJitterMs, s as exponentialDelayCapMs } from "../core-BiN6S_cm.js";
-import { KVError, decideKVRetry, isKVPutRateLimitError } from "./kv-errors.js";
+import { i as isKVPutRateLimitError, n as decideKVRetry, t as KVError } from "../kv-errors-BUTpFy0t.js";
 import { Result } from "better-result";
 
 //#region src/infrastructure/cloudflare/kv-client.ts

package/dist/cloudflare/kv-errors.js

@@ -1,144 +1,3 @@
-import { g as isCloudflareRetryableError, h as isCloudflareOverloadedError, nt as AppError, y as isTransientTransportError } from "../core-BiN6S_cm.js";
+import { a as isRetryableKVError, i as isKVPutRateLimitError, n as decideKVRetry, o as isTerminalKVError, r as extractKVMeta, s as isTransientKVError, t as KVError } from "../kv-errors-BUTpFy0t.js";
 
-//#region src/infrastructure/cloudflare/kv-errors.ts
-/** Extract Typist's verified KV message formats, including nested causes. */
-function extractKVMeta(cause) {
-	const message = getDeepErrorMessage(cause);
-	if (!message) return void 0;
-	const statusMatch = message.match(/\bKV\s+(GET|PUT|DELETE|LIST)\s+failed:\s+(\d{3})\b/);
-	const operation = statusMatch?.[1];
-	const status = statusMatch ? Number(statusMatch[2]) : void 0;
-	if (/Key name cannot be empty/i.test(message)) return {
-		kind: "invalid_key",
-		message,
-		status,
-		operation
-	};
-	if (/exceeds key length limit/i.test(message)) return {
-		kind: "key_too_large",
-		message,
-		status,
-		operation
-	};
-	if (/Invalid expiration_ttl/i.test(message)) return {
-		kind: "invalid_expiration_ttl",
-		message,
-		status,
-		operation
-	};
-	if (/Invalid expiration of/i.test(message)) return {
-		kind: "invalid_expiration",
-		message,
-		status,
-		operation
-	};
-	if (/Invalid cache_ttl/i.test(message)) return {
-		kind: "invalid_cache_ttl",
-		message,
-		status,
-		operation
-	};
-	if (/Invalid key_count_limit/i.test(message)) return {
-		kind: "invalid_list_limit",
-		message,
-		status,
-		operation
-	};
-	if (/value.*(too large|exceeds)|exceeds.*value/i.test(message)) return {
-		kind: "value_too_large",
-		message,
-		status,
-		operation
-	};
-	if (status === 429) return {
-		kind: "rate_limited",
-		message,
-		status,
-		operation
-	};
-	if (status !== void 0 && status >= 500) return {
-		kind: "server_error",
-		message,
-		status,
-		operation
-	};
-	if (status !== void 0 && status >= 400) return {
-		kind: "client_error",
-		message,
-		status,
-		operation
-	};
-}
-/** Identify recognized KV failures that another attempt cannot resolve. */
-function isTerminalKVError(cause) {
-	const meta = extractKVMeta(cause);
-	if (!meta) return false;
-	if (meta.kind === "rate_limited" || meta.kind === "server_error") return false;
-	if (meta.status === 408) return false;
-	return true;
-}
-/** Identify a PUT rate limit that requires at least one second before retrying. */
-function isKVPutRateLimitError(cause) {
-	const meta = extractKVMeta(cause);
-	return meta?.operation === "PUT" && meta.kind === "rate_limited";
-}
-/** Identify PUT rate limits, server failures, and request timeouts. */
-function isTransientKVError(cause) {
-	const meta = extractKVMeta(cause);
-	if (!meta) return false;
-	return isKVPutRateLimitError(cause) || meta.kind === "server_error" || meta.status === 408;
-}
-/** Apply Typist's KV, overload, platform, and transport checks in their original order. */
-function isRetryableKVError(cause) {
-	if (isTerminalKVError(cause)) return false;
-	if (isTransientKVError(cause)) return true;
-	if (isCloudflareOverloadedError(cause)) return false;
-	return isCloudflareRetryableError(cause) || isTransientTransportError(cause);
-}
-/** Return the existing retry decision and minimum delay in milliseconds. */
-function decideKVRetry(cause) {
-	if (!isRetryableKVError(cause)) return { retry: false };
-	return {
-		retry: true,
-		retryAfterMs: isKVPutRateLimitError(cause) ? 1e3 : 0
-	};
-}
-/** A final KV failure with Typist's diagnostics and Better Ship's error classification. */
-var KVError = class extends AppError {
-	_tag = "KVError";
-	classification;
-	retryable;
-	operation;
-	key;
-	cause;
-	kv;
-	context;
-	constructor(args) {
-		const kv = extractKVMeta(args.cause);
-		const causeMessage = getDeepErrorMessage(args.cause) || String(args.cause);
-		const keyContext = args.key === void 0 ? "" : ` for key "${args.key}"`;
-		super(`KV ${args.operation} failed${keyContext}: ${causeMessage}`, { cause: args.cause });
-		this.operation = args.operation;
-		this.key = args.key;
-		this.cause = args.cause;
-		this.kv = kv;
-		this.context = {
-			operation: args.operation,
-			key: args.key,
-			kv
-		};
-		this.retryable = isRetryableKVError(args.cause);
-		this.classification = isTerminalKVError(args.cause) ? "terminal" : this.retryable ? "transient" : "unknown";
-	}
-};
-function getDeepErrorMessage(cause) {
-	if (typeof cause === "string") return cause;
-	if (cause === null || cause === void 0) return "";
-	if (typeof cause === "number" || typeof cause === "boolean" || typeof cause === "bigint") return String(cause);
-	if (typeof cause !== "object") return "";
-	return `${"message" in cause && typeof cause.message === "string" ? cause.message : ""} ${"cause" in cause ? getDeepErrorMessage(cause.cause) : ""}`.trim();
-}
-
-//#endregion
-export { KVError, decideKVRetry, extractKVMeta, isKVPutRateLimitError, isRetryableKVError, isTerminalKVError, isTransientKVError };
-//# sourceMappingURL=kv-errors.js.map
+export { KVError, decideKVRetry, extractKVMeta, isKVPutRateLimitError, isRetryableKVError, isTerminalKVError, isTransientKVError };

package/dist/cloudflare/r2-client.js

@@ -1,5 +1,5 @@
 import { nt as AppError, v as isAbortError } from "../core-BiN6S_cm.js";
-import { R2Error, R2JsonError } from "./r2-errors.js";
+import { n as R2JsonError, t as R2Error } from "../r2-errors-rk7n7rvk.js";
 
 //#region src/infrastructure/cloudflare/r2-client.ts
 /**

package/dist/cloudflare/r2-errors.js

@@ -1,90 +1,3 @@
-import { nt as AppError, u as classifyBoundaryError, v as isAbortError } from "../core-BiN6S_cm.js";
-import { z } from "zod";
+import { n as R2JsonError, t as R2Error } from "../r2-errors-rk7n7rvk.js";
 
-//#region src/infrastructure/cloudflare/r2-errors.ts
-const R2FailureSchema = z.object({
-	code: z.number().int().positive(),
-	action: z.string().optional()
-});
-const classifications = /* @__PURE__ */ new Map([
-	[10001, "transient"],
-	[10043, "transient"],
-	[10054, "transient"],
-	[10058, "transient"],
-	[10013, "transient"],
-	[10002, "terminal"],
-	[10003, "terminal"],
-	[10018, "terminal"],
-	[10035, "terminal"],
-	[10042, "terminal"],
-	[10005, "terminal"],
-	[10006, "terminal"],
-	[10008, "terminal"],
-	[10009, "terminal"],
-	[10073, "terminal"],
-	[10007, "terminal"],
-	[10020, "terminal"],
-	[100100, "terminal"],
-	[10012, "terminal"],
-	[10069, "terminal"],
-	[10033, "terminal"],
-	[10014, "terminal"],
-	[10037, "terminal"],
-	[10039, "terminal"],
-	[10031, "terminal"],
-	[10011, "terminal"],
-	[10024, "terminal"],
-	[10025, "terminal"],
-	[10048, "terminal"]
-]);
-function extractR2Failure(cause) {
-	if (!(cause instanceof Error)) return void 0;
-	const parsed = R2FailureSchema.safeParse(cause);
-	if (parsed.success) return parsed.data;
-	const match = /\((\d{5,6})\)\s*$/.exec(cause.message);
-	return match?.[1] === void 0 ? void 0 : { code: Number(match[1]) };
-}
-function classifyR2Code(cause) {
-	const failure = extractR2Failure(cause);
-	return failure === void 0 ? void 0 : classifications.get(failure.code) ?? "unknown";
-}
-function classifyR2Error(cause) {
-	if (isAbortError(cause)) return "terminal";
-	if (cause instanceof AppError) return cause.classification;
-	return classifyBoundaryError({
-		cause,
-		classifyBoundary: classifyR2Code,
-		includeCloudflare: true
-	});
-}
-/** A raw binding failure after one attempt. Classification does not establish whether a mutation committed. */
-var R2Error = class extends AppError {
-	_tag = "R2Error";
-	classification;
-	operation;
-	r2;
-	cause;
-	constructor(input) {
-		super(`R2 ${input.operation} failed`, { cause: input.cause });
-		this.operation = input.operation;
-		this.cause = input.cause;
-		this.r2 = extractR2Failure(input.cause);
-		this.classification = classifyR2Error(input.cause);
-	}
-};
-/** JSON serialization or syntax failed. Binding and body-read failures use R2Error. */
-var R2JsonError = class extends AppError {
-	_tag = "R2JsonError";
-	classification = "terminal";
-	operation;
-	cause;
-	constructor(input) {
-		super(`R2 JSON ${input.operation} failed`, { cause: input.cause });
-		this.operation = input.operation;
-		this.cause = input.cause;
-	}
-};
-
-//#endregion
-export { R2Error, R2JsonError };
-//# sourceMappingURL=r2-errors.js.map
+export { R2Error, R2JsonError };

package/dist/cloudflare/turnstile.d.ts

@@ -0,0 +1,57 @@
+import { Xt as AppError, Zt as FailureClassification } from "../index-DUFS0SJ_.js";
+//#region src/infrastructure/cloudflare/turnstile/turnstile.error.d.ts
+/**
+ * Siteverify did not produce a verdict.
+ * A rejected token is not this error. The caller logs it once.
+ */
+export declare class TurnstileVerificationError extends AppError {
+  readonly _tag = "TurnstileVerificationError";
+  readonly classification: FailureClassification;
+  readonly errorCodes: readonly string[];
+  constructor(args: {
+    readonly classification: FailureClassification;
+    readonly errorCodes: readonly string[];
+    readonly cause: unknown;
+  });
+}
+//#endregion
+//#region src/infrastructure/cloudflare/turnstile/turnstile.d.ts
+/** The values siteverify needs. The secret stays in the caller. */
+type TurnstileCheck = {
+  readonly secretKey: string;
+  readonly token: string;
+  /** Visitor address from `CF-Connecting-IP`. Omit it when the request has none. */
+  readonly remoteIp?: string;
+  /** Widget action. A present, different action rejects. A missing action does not. */
+  readonly expectedAction?: string;
+  /** Allowed widget hostnames. A testing-key success skips this list. */
+  readonly expectedHostnames?: readonly string[];
+  /** UUID reused for this call's retries. Omit it and the call mints one. */
+  readonly idempotencyKey?: string;
+};
+/** A solved challenge, or a refusal siteverify already decided. */
+type TurnstileVerdict = {
+  readonly _tag: 'Accepted';
+  readonly hostname: string;
+  readonly challengeTs: string;
+  readonly action?: string;
+} | {
+  readonly _tag: 'Rejected';
+  readonly errorCodes: readonly string[];
+};
+/** Deadline and fetch overrides. Production calls omit this argument. */
+type TurnstileVerifyOptions = {
+  /** Replaces global `fetch`. A test uses it for a response the testing secret cannot return. */
+  readonly fetch?: typeof fetch;
+  /** Siteverify deadline in milliseconds. The default is 10 seconds. */
+  readonly timeoutMs?: number;
+};
+/**
+ * Ask siteverify whether this token is a solved challenge.
+ * A rejection is a verdict. No verdict throws `TurnstileVerificationError`.
+ * A transient failure retries twice with the same idempotency key.
+ */
+export declare function verifyTurnstile(check: TurnstileCheck, options?: TurnstileVerifyOptions): Promise<TurnstileVerdict>;
+//#endregion
+export type { TurnstileCheck, TurnstileVerdict, TurnstileVerifyOptions };
+//# sourceMappingURL=turnstile.d.ts.map

package/dist/cloudflare/turnstile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"turnstile.d.ts","names":[],"sources":["../../src/infrastructure/cloudflare/turnstile/turnstile.error.ts","../../src/infrastructure/cloudflare/turnstile/turnstile.ts"],"mappings":";;;;;;qBAMa,mCAAmC;WACrC;WACA,gBAAgB;WAChB;EAET,YAAY;aACD,gBAAgB;aAChB;aACA;;;;;;KCoCD;WACD;WACA;;WAEA;;WAEA;;WAEA;;WAEA;;;KAIC;WAEG;WACA;WACA;WACA;;WAGA;WACA;;;KAIH;;WAED,eAAe;;WAEf;;;;;;;wBAmBW,gBACpB,OAAO,gBACP,UAAS,yBACR,QAAQ"}