qarpeo 0.0.0-alpha.10

package/dist/runtime/server/utils/tenant.mjs

@@ -0,0 +1,285 @@
+import { createError } from "nuxt/server";
+import { getDomainCache, getMultitenantConfig, normalizeDomain } from "./domains.mjs";
+const devTenantsStore = /* @__PURE__ */ new Map();
+devTenantsStore.set("default", {
+  id: "tenant_default",
+  slug: "default",
+  name: "Default Organization",
+  plan: "pro",
+  createdAt: Date.now(),
+  updatedAt: Date.now()
+});
+const DEFAULT_RESERVED_SLUGS = [
+  "admin",
+  "api",
+  "app",
+  "auth",
+  "cms",
+  "dashboard",
+  "mail",
+  "static",
+  "studio",
+  "www"
+];
+export function extractHostname(event) {
+  const req = event.node?.req;
+  const rawHost = req?.headers?.["x-forwarded-host"] || req?.headers?.host || "localhost";
+  const host = Array.isArray(rawHost) ? rawHost[0] : rawHost;
+  return host.split(":")[0].toLowerCase().trim();
+}
+export function extractSubdomain(host, rootDomains) {
+  for (const root of rootDomains) {
+    const cleanRoot = root.toLowerCase().trim();
+    if (host === cleanRoot || host === `www.${cleanRoot}`) {
+      return null;
+    }
+    if (host.endsWith(`.${cleanRoot}`)) {
+      const sub = host.slice(0, host.length - cleanRoot.length - 1);
+      if (!sub.includes(".")) {
+        return sub;
+      }
+    }
+  }
+  return null;
+}
+let tenantsMigrated = false;
+async function ensureTenantsTableMigrated(db) {
+  if (tenantsMigrated || !db) return;
+  try {
+    await db.run("ALTER TABLE _qarpeo_tenants ADD COLUMN organization_id TEXT");
+  } catch {
+  }
+  tenantsMigrated = true;
+}
+export async function getTenantBySlug(slug, event) {
+  const cleanSlug = slug.toLowerCase().trim();
+  for (const t of devTenantsStore.values()) {
+    if (t.slug.toLowerCase() === cleanSlug) return t;
+  }
+  try {
+    const db = event?.context?.db;
+    if (db) {
+      await ensureTenantsTableMigrated(db);
+      const rows = await db.all(`SELECT * FROM _qarpeo_tenants WHERE slug = ? LIMIT 1`, [cleanSlug]);
+      if (rows?.[0]) {
+        const row = rows[0];
+        const rec = {
+          id: row.id,
+          slug: row.slug,
+          name: row.name,
+          plan: row.plan || "free",
+          organizationId: row.organization_id || void 0,
+          customDomain: row.custom_domain,
+          logoUrl: row.logo_url,
+          metadata: row.metadata_json ? JSON.parse(row.metadata_json) : {},
+          createdAt: row.created_at,
+          updatedAt: row.updated_at
+        };
+        devTenantsStore.set(rec.id, rec);
+        return rec;
+      }
+    }
+  } catch {
+  }
+  return null;
+}
+export async function getTenantById(id, event) {
+  if (devTenantsStore.has(id)) {
+    return devTenantsStore.get(id);
+  }
+  try {
+    const db = event?.context?.db;
+    if (db) {
+      await ensureTenantsTableMigrated(db);
+      const rows = await db.all(`SELECT * FROM _qarpeo_tenants WHERE id = ? LIMIT 1`, [id]);
+      if (rows?.[0]) {
+        const row = rows[0];
+        const rec = {
+          id: row.id,
+          slug: row.slug,
+          name: row.name,
+          plan: row.plan || "free",
+          organizationId: row.organization_id || void 0,
+          customDomain: row.custom_domain,
+          logoUrl: row.logo_url,
+          metadata: row.metadata_json ? JSON.parse(row.metadata_json) : {},
+          createdAt: row.created_at,
+          updatedAt: row.updated_at
+        };
+        devTenantsStore.set(rec.id, rec);
+        return rec;
+      }
+    }
+  } catch {
+  }
+  return null;
+}
+export async function getTenantByOrganization(orgId, event) {
+  if (!orgId) return null;
+  for (const t of devTenantsStore.values()) {
+    if (t.organizationId && t.organizationId === orgId) return t;
+  }
+  try {
+    const db = event?.context?.db;
+    if (db) {
+      await ensureTenantsTableMigrated(db);
+      const rows = await db.all(`SELECT * FROM _qarpeo_tenants WHERE organization_id = ? LIMIT 1`, [
+        orgId
+      ]);
+      if (rows?.[0]) {
+        const row = rows[0];
+        const rec = {
+          id: row.id,
+          slug: row.slug,
+          name: row.name,
+          plan: row.plan || "free",
+          organizationId: row.organization_id || void 0,
+          customDomain: row.custom_domain,
+          logoUrl: row.logo_url,
+          metadata: row.metadata_json ? JSON.parse(row.metadata_json) : {},
+          createdAt: row.created_at,
+          updatedAt: row.updated_at
+        };
+        devTenantsStore.set(rec.id, rec);
+        return rec;
+      }
+    }
+  } catch {
+  }
+  return null;
+}
+export async function saveTenant(tenant, event) {
+  devTenantsStore.set(tenant.id, tenant);
+  try {
+    const db = event?.context?.db;
+    if (db) {
+      await ensureTenantsTableMigrated(db);
+      await db.run(
+        `INSERT OR REPLACE INTO _qarpeo_tenants
+         (id, slug, name, plan, organization_id, custom_domain, logo_url, metadata_json, created_at, updated_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+        [
+          tenant.id,
+          tenant.slug,
+          tenant.name,
+          tenant.plan || "free",
+          tenant.organizationId || null,
+          tenant.customDomain || null,
+          tenant.logoUrl || null,
+          JSON.stringify(tenant.metadata || {}),
+          tenant.createdAt,
+          tenant.updatedAt
+        ]
+      );
+    }
+  } catch {
+  }
+  return tenant;
+}
+export async function listTenants(event) {
+  try {
+    const db = event?.context?.db;
+    if (db) {
+      await ensureTenantsTableMigrated(db);
+      const rows = await db.all(`SELECT * FROM _qarpeo_tenants ORDER BY created_at DESC`);
+      if (rows && rows.length > 0) {
+        return rows.map((row) => ({
+          id: row.id,
+          slug: row.slug,
+          name: row.name,
+          plan: row.plan || "free",
+          organizationId: row.organization_id || void 0,
+          customDomain: row.custom_domain,
+          logoUrl: row.logo_url,
+          metadata: row.metadata_json ? JSON.parse(row.metadata_json) : {},
+          createdAt: row.created_at,
+          updatedAt: row.updated_at
+        }));
+      }
+    }
+  } catch {
+  }
+  if (devTenantsStore.size === 0) {
+    devTenantsStore.set("tenant_default", {
+      id: "tenant_default",
+      slug: "default",
+      name: "Default Organization",
+      plan: "pro",
+      createdAt: Date.now() - 864e5 * 7,
+      updatedAt: Date.now()
+    });
+  }
+  return Array.from(devTenantsStore.values());
+}
+export async function resolveTenant(event) {
+  const req = event.node?.req;
+  const headers = req?.headers || {};
+  const config = getMultitenantConfig(event);
+  const headerName = (config.headerName || "x-tenant-id").toLowerCase();
+  const headerVal = headers[headerName];
+  if (headerVal && typeof headerVal === "string") {
+    const fromId = await getTenantById(headerVal, event);
+    if (fromId) {
+      setTenant(event, fromId);
+      return fromId;
+    }
+    const fromSlug = await getTenantBySlug(headerVal, event);
+    if (fromSlug) {
+      setTenant(event, fromSlug);
+      return fromSlug;
+    }
+  }
+  const host = extractHostname(event);
+  const rawRootDomains = config.rootDomains || [];
+  const rootDomains = (Array.isArray(rawRootDomains) ? rawRootDomains : [rawRootDomains]).filter(
+    Boolean
+  );
+  const reservedSlugs = config.reservedSlugs || DEFAULT_RESERVED_SLUGS;
+  const sub = extractSubdomain(host, rootDomains);
+  if (sub && !reservedSlugs.includes(sub)) {
+    const tenant = await getTenantBySlug(sub, event);
+    if (tenant) {
+      setTenant(event, tenant);
+      return tenant;
+    }
+  }
+  const normHost = normalizeDomain(host);
+  const cachedTenantId = await getDomainCache(normHost, event);
+  if (cachedTenantId) {
+    const tenant = await getTenantById(cachedTenantId, event);
+    if (tenant) {
+      setTenant(event, tenant);
+      return tenant;
+    }
+  }
+  if (process.env.NODE_ENV !== "production" && host === "localhost") {
+    const def = devTenantsStore.get("tenant_default") || null;
+    if (def) {
+      setTenant(event, def);
+      return def;
+    }
+  }
+  return null;
+}
+export function setTenant(event, tenant) {
+  if (!event.context) {
+    ;
+    event.context = {};
+  }
+  ;
+  event.context.tenant = tenant;
+}
+export function getTenant(event) {
+  return event?.context?.tenant || null;
+}
+export function useTenant(event) {
+  const tenant = getTenant(event);
+  if (!tenant) {
+    throw createError({
+      statusCode: 404,
+      statusMessage: "Tenant Not Found",
+      message: "The requested tenant organization could not be found for this domain."
+    });
+  }
+  return tenant;
+}

package/dist/runtime/server/utils/totp.d.ts

@@ -0,0 +1,33 @@
+import { timingSafeEqualString } from "./crypto";
+export { timingSafeEqualString };
+export declare function generateBase32Secret(length?: number): string;
+export declare function base32ToBytes(base32: string): Uint8Array;
+export declare function generateTOTPCode(secret: string, timeStep?: number): Promise<string>;
+/** Validates a 6-digit TOTP code with +/- 1 step drift tolerance (90-second validity). */
+export declare function verifyTOTPCode(secret: string, userCode: string, timeStep?: number): Promise<boolean>;
+export declare function hashBackupCode(code: string): Promise<string>;
+export declare function generateBackupCodes(count?: number): Promise<{
+    rawCodes: string[];
+    hashedCodes: string[];
+}>;
+/** Verifies a cleartext backup code against a list of SHA-256 hashed codes in constant time. */
+export declare function verifyBackupCode(rawCode: string, hashedCodes: string[]): Promise<{
+    valid: boolean;
+    matchingHash?: string;
+}>;
+/** Builds standard otpauth URL for Google Authenticator / 1Password. */
+export declare function buildOTPAuthURL(options: {
+    issuer: string;
+    accountName: string;
+    secret: string;
+}): string;
+/**
+ * Generates the otpauth:// URL for a TOTP secret. The client is responsible for rendering the QR
+ * code from this URL (e.g. via qrcode-vue or a native QR renderer) — the server returns the URL
+ * rather than an SVG so authenticator apps always receive a clean, scannable code.
+ */
+export declare function generateTOTPUrl(options: {
+    issuer: string;
+    accountName: string;
+    secret: string;
+}): string;

package/dist/runtime/server/utils/totp.mjs

@@ -0,0 +1,112 @@
+import { timingSafeEqualString } from "./crypto.mjs";
+export { timingSafeEqualString };
+const BASE32_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
+export function generateBase32Secret(length = 20) {
+  const randomBytes = new Uint8Array(length);
+  crypto.getRandomValues(randomBytes);
+  let secret = "";
+  for (let i = 0; i < randomBytes.length; i++) {
+    secret += BASE32_ALPHABET[randomBytes[i] % 32];
+  }
+  return secret;
+}
+export function base32ToBytes(base32) {
+  const cleaned = base32.toUpperCase().replace(/=+$/, "");
+  let bits = 0;
+  let value = 0;
+  const output = [];
+  for (let i = 0; i < cleaned.length; i++) {
+    const idx = BASE32_ALPHABET.indexOf(cleaned[i]);
+    if (idx === -1) continue;
+    value = value << 5 | idx;
+    bits += 5;
+    if (bits >= 8) {
+      output.push(value >>> bits - 8 & 255);
+      bits -= 8;
+    }
+  }
+  return new Uint8Array(output);
+}
+export async function generateTOTPCode(secret, timeStep = 30) {
+  const keyBytes = base32ToBytes(secret);
+  const counter = Math.floor(Date.now() / 1e3 / timeStep);
+  const counterBuffer = new ArrayBuffer(8);
+  const view = new DataView(counterBuffer);
+  view.setBigUint64(0, BigInt(counter));
+  const cryptoKey = await crypto.subtle.importKey(
+    "raw",
+    keyBytes,
+    { name: "HMAC", hash: { name: "SHA-1" } },
+    false,
+    ["sign"]
+  );
+  const signature = await crypto.subtle.sign("HMAC", cryptoKey, counterBuffer);
+  const sigBytes = new Uint8Array(signature);
+  const offset = sigBytes[sigBytes.length - 1] & 15;
+  const codeInt = (sigBytes[offset] & 127) << 24 | (sigBytes[offset + 1] & 255) << 16 | (sigBytes[offset + 2] & 255) << 8 | sigBytes[offset + 3] & 255;
+  const otp = codeInt % 1e6;
+  return otp.toString().padStart(6, "0");
+}
+export async function verifyTOTPCode(secret, userCode, timeStep = 30) {
+  const cleanCode = userCode.trim();
+  if (cleanCode.length !== 6) return false;
+  const keyBytes = base32ToBytes(secret);
+  const currentStep = Math.floor(Date.now() / 1e3 / timeStep);
+  const cryptoKey = await crypto.subtle.importKey(
+    "raw",
+    keyBytes,
+    { name: "HMAC", hash: { name: "SHA-1" } },
+    false,
+    ["sign"]
+  );
+  for (const stepOffset of [-1, 0, 1]) {
+    const step = currentStep + stepOffset;
+    const counterBuffer = new ArrayBuffer(8);
+    const view = new DataView(counterBuffer);
+    view.setBigUint64(0, BigInt(step));
+    const signature = await crypto.subtle.sign("HMAC", cryptoKey, counterBuffer);
+    const sigBytes = new Uint8Array(signature);
+    const offset = sigBytes[sigBytes.length - 1] & 15;
+    const codeInt = (sigBytes[offset] & 127) << 24 | (sigBytes[offset + 1] & 255) << 16 | (sigBytes[offset + 2] & 255) << 8 | sigBytes[offset + 3] & 255;
+    const expectedCode = (codeInt % 1e6).toString().padStart(6, "0");
+    if (expectedCode === cleanCode) {
+      return true;
+    }
+  }
+  return false;
+}
+export async function hashBackupCode(code) {
+  const clean = code.trim().toUpperCase();
+  const encoder = new TextEncoder();
+  const hashBuffer = await crypto.subtle.digest("SHA-256", encoder.encode(clean));
+  return Array.from(new Uint8Array(hashBuffer)).map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+export async function generateBackupCodes(count = 8) {
+  const rawCodes = [];
+  const hashedCodes = [];
+  for (let i = 0; i < count; i++) {
+    const bytes = new Uint8Array(5);
+    crypto.getRandomValues(bytes);
+    const code = Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("").slice(0, 8).toUpperCase();
+    rawCodes.push(code);
+    hashedCodes.push(await hashBackupCode(code));
+  }
+  return { rawCodes, hashedCodes };
+}
+export async function verifyBackupCode(rawCode, hashedCodes) {
+  const inputHash = await hashBackupCode(rawCode);
+  for (const storedHash of hashedCodes) {
+    if (timingSafeEqualString(inputHash, storedHash)) {
+      return { valid: true, matchingHash: storedHash };
+    }
+  }
+  return { valid: false };
+}
+export function buildOTPAuthURL(options) {
+  const { issuer, accountName, secret } = options;
+  const label = encodeURIComponent(`${issuer}:${accountName}`);
+  return `otpauth://totp/${label}?secret=${secret}&issuer=${encodeURIComponent(issuer)}&algorithm=SHA1&digits=6&period=30`;
+}
+export function generateTOTPUrl(options) {
+  return buildOTPAuthURL(options);
+}

package/dist/runtime/server/utils/tracker.d.ts

@@ -0,0 +1,72 @@
+/**
+ * @file Tracker.ts Tier 2 Analytics — structured event tracking helpers backed by Cloudflare
+ *   Analytics Engine. Wraps the raw `cf.analytics` binding with fixed blob/double schema for
+ *   consistent querying. Schema (fixed slots): blobs[0] — event type: "pageview" | custom name
+ *   blobs[1] — path blobs[2] — referrer blobs[3] — country (from CF-IPCountry header) blobs[4] —
+ *   device type: "mobile" | "desktop" | "bot" blobs[5] — user agent (truncated to 256 chars)
+ *   blobs[6] — privacy-safe session ID (SHA-256 of IP + UA, base36, no PII stored) blobs[7] —
+ *   authenticated user ID (if available) doubles[0] — response time ms (0 if not known) doubles[1]
+ *   — HTTP status code (0 if not applicable) indexes[0] — site ID / hostname for multi-site
+ *   filtering
+ */
+import type { RequestEvent } from "nuxt/server";
+export interface TrackPageviewOptions {
+    /** Override the path (defaults to event URL path). */
+    path?: string;
+    /** Override the referrer (defaults to Referer header). */
+    referrer?: string;
+    /** Authenticated user ID to associate with this pageview. */
+    userId?: string;
+    /** Response time in milliseconds. */
+    responseTime?: number;
+    /** HTTP status code. */
+    status?: number;
+    /** Override the site ID (defaults to runtimeConfig or hostname). */
+    siteId?: string;
+    /** CF AE binding name override. */
+    binding?: string;
+}
+export interface TrackEventOptions {
+    /** Key-value metadata attached as additional blob data (serialised as JSON in blobs[8]). */
+    meta?: Record<string, string | number | boolean>;
+    /** Authenticated user ID. */
+    userId?: string;
+    /** Site ID. */
+    siteId?: string;
+    /** CF AE binding name override. */
+    binding?: string;
+}
+/**
+ * Track a pageview event against the Cloudflare Analytics Engine. Safe to call fire-and-forget —
+ * never throws or blocks response.
+ *
+ * @param event H3 request event
+ * @param options Optional tracking overrides
+ */
+export declare function trackPageview(event: RequestEvent, options?: TrackPageviewOptions): void;
+/**
+ * Track a named custom business event against the Cloudflare Analytics Engine. Safe to call
+ * fire-and-forget — never throws or blocks response.
+ *
+ * @param event H3 request event
+ * @param name Event name (e.g. "signup", "checkout", "upgrade")
+ * @param options Optional metadata and overrides
+ */
+export declare function trackEvent(event: RequestEvent, name: string, options?: TrackEventOptions): void;
+/**
+ * Returns a tracker instance bound to the current H3 event. Useful when you want to call
+ * `trackPageview` / `trackEvent` multiple times without passing the event every time.
+ *
+ * @example
+ *   ;```ts
+ *   const tracker = useTracker(event)
+ *   tracker.trackPageview()
+ *   tracker.trackEvent("signup", { meta: { plan: "pro" } })
+ *   ```
+ */
+export declare function useTracker(event: RequestEvent): {
+    /** Track a pageview for the current request. */
+    trackPageview: (options?: TrackPageviewOptions) => void;
+    /** Track a custom named event. */
+    trackEvent: (name: string, options?: TrackEventOptions) => void;
+};

package/dist/runtime/server/utils/tracker.mjs

@@ -0,0 +1,139 @@
+import { createHash } from "node:crypto";
+import { getAnalyticsBinding } from "../../analytics.mjs";
+function buildSessionId(ip, ua) {
+  return createHash("sha256").update(`${ip}|${ua}`).digest("base64url").slice(0, 16);
+}
+function detectDevice(ua) {
+  const lc = ua.toLowerCase();
+  if (/bot|crawl|spider|slurp|facebookexternalhit|twitterbot|whatsapp|linkedinbot/i.test(lc))
+    return "bot";
+  if (/mobile|android|iphone|ipad|ipod|blackberry|windows phone/i.test(lc)) return "mobile";
+  return "desktop";
+}
+function extractPath(url) {
+  try {
+    return new URL(url).pathname;
+  } catch {
+    return url.split("?")[0] || "/";
+  }
+}
+function resolveSiteId(event, override) {
+  if (override) return override;
+  try {
+    const rc = event.context?.nitro?.runtimeConfig ?? event.$config;
+    const configured = rc?.qarpeo?.analytics?.siteId;
+    if (configured) return configured;
+  } catch {
+  }
+  return event.node?.req?.headers?.host || "unknown";
+}
+function resolveAnalyticsBinding(event, override) {
+  if (override) return override;
+  try {
+    const rc = event.context?.nitro?.runtimeConfig ?? event.$config;
+    return rc?.qarpeo?.analytics?.binding || "ANALYTICS";
+  } catch {
+    return "ANALYTICS";
+  }
+}
+export function trackPageview(event, options = {}) {
+  try {
+    const req = event.node?.req;
+    const headers = req?.headers || {};
+    const getHeader = (name) => (Array.isArray(headers[name]) ? headers[name][0] : headers[name]) || "";
+    const ua = getHeader("user-agent").slice(0, 256);
+    const ip = getHeader("cf-connecting-ip") || getHeader("x-forwarded-for").split(",")[0].trim() || req?.socket?.remoteAddress || "unknown";
+    const country = getHeader("cf-ipcountry") || "XX";
+    const referrer = options.referrer ?? getHeader("referer");
+    const path = options.path ?? extractPath(req?.url || "/");
+    const device = detectDevice(ua);
+    const sessionId = buildSessionId(ip, ua);
+    const siteId = resolveSiteId(event, options.siteId);
+    const bindingName = resolveAnalyticsBinding(event, options.binding);
+    const ae = getAnalyticsBinding(bindingName, event);
+    ae.writeDataPoint({
+      blobs: [
+        "pageview",
+        // [0] event type
+        path,
+        // [1] path
+        referrer,
+        // [2] referrer
+        country,
+        // [3] country
+        device,
+        // [4] device
+        ua,
+        // [5] user agent
+        sessionId,
+        // [6] session fingerprint
+        options.userId || ""
+        // [7] user ID
+      ],
+      doubles: [
+        options.responseTime ?? 0,
+        // [0] response time ms
+        options.status ?? 0
+        // [1] HTTP status code
+      ],
+      indexes: [siteId]
+      // [0] site ID
+    });
+  } catch {
+  }
+}
+export function trackEvent(event, name, options = {}) {
+  try {
+    const req = event.node?.req;
+    const headers = req?.headers || {};
+    const getHeader = (h) => (Array.isArray(headers[h]) ? headers[h][0] : headers[h]) || "";
+    const ua = getHeader("user-agent").slice(0, 256);
+    const ip = getHeader("cf-connecting-ip") || getHeader("x-forwarded-for").split(",")[0].trim() || "unknown";
+    const country = getHeader("cf-ipcountry") || "XX";
+    const path = extractPath(req?.url || "/");
+    const device = detectDevice(ua);
+    const sessionId = buildSessionId(ip, ua);
+    const siteId = resolveSiteId(event, options.siteId);
+    const bindingName = resolveAnalyticsBinding(event, options.binding);
+    const metaJson = options.meta ? JSON.stringify(options.meta).slice(0, 512) : "";
+    const ae = getAnalyticsBinding(bindingName, event);
+    ae.writeDataPoint({
+      blobs: [
+        name,
+        // [0] event type / name
+        path,
+        // [1] path where event occurred
+        "",
+        // [2] referrer (n/a for events)
+        country,
+        // [3] country
+        device,
+        // [4] device
+        ua,
+        // [5] user agent
+        sessionId,
+        // [6] session fingerprint
+        options.userId || "",
+        // [7] user ID
+        metaJson
+        // [8] metadata JSON
+      ],
+      doubles: [
+        0,
+        // [0] response time (n/a)
+        0
+        // [1] status code (n/a)
+      ],
+      indexes: [siteId]
+    });
+  } catch {
+  }
+}
+export function useTracker(event) {
+  return {
+    /** Track a pageview for the current request. */
+    trackPageview: (options = {}) => trackPageview(event, options),
+    /** Track a custom named event. */
+    trackEvent: (name, options = {}) => trackEvent(event, name, options)
+  };
+}

package/dist/runtime/server/utils/turnstile.d.ts

@@ -0,0 +1,17 @@
+export interface TurnstileVerificationResult {
+    success: boolean;
+    errorCodes?: string[];
+    challengeTs?: string;
+    hostname?: string;
+    action?: string;
+    cdata?: string;
+}
+/**
+ * Validates a Cloudflare Turnstile token using Cloudflare's siteverify API.
+ * Reads secret key from NUXT_TURNSTILE_SECRET_KEY, TURNSTILE_SECRET_KEY, or qarpeo.auth.turnstile.secretKey.
+ */
+export declare function verifyTurnstileToken(event: any, token?: string, remoteIp?: string): Promise<TurnstileVerificationResult>;
+/**
+ * Enforces Cloudflare Turnstile verification. Throws 403 Forbidden if invalid.
+ */
+export declare function requireTurnstile(event: any, token?: string): Promise<void>;