@ai-matrx/auth 0.0.0 → 0.1.1

package/dist/credentials.js

@@ -0,0 +1,47 @@
+// src/credentials.ts
+var MATRX_HEADERS = {
+  authorization: "Authorization",
+  fingerprint: "X-Fingerprint-ID",
+  organization: "X-Organization-Id",
+  actingUser: "X-Matrx-User-Id",
+  requestId: "X-Request-Id"
+};
+var API_KEY_PREFIX = "mx_";
+function credentialToHeaders(credential) {
+  if (credential === null) return {};
+  switch (credential.kind) {
+    case "user":
+      return { [MATRX_HEADERS.authorization]: `Bearer ${credential.accessToken}` };
+    case "guest":
+      return { [MATRX_HEADERS.fingerprint]: credential.fingerprintId };
+    case "scoped":
+      return { [MATRX_HEADERS.authorization]: `Bearer ${credential.token}` };
+    case "service": {
+      const header = credential.secretHeader ?? MATRX_HEADERS.authorization;
+      const headers = header.toLowerCase() === "authorization" ? { [MATRX_HEADERS.authorization]: `Bearer ${credential.secret}` } : { [header]: credential.secret };
+      if (credential.actingUserId) headers[MATRX_HEADERS.actingUser] = credential.actingUserId;
+      return headers;
+    }
+    case "api_key": {
+      if (!credential.apiKey.startsWith(API_KEY_PREFIX)) {
+        throw new Error(
+          `credentialToHeaders: an api_key credential must start with "${API_KEY_PREFIX}" (AI Matrx API keys look like mx_live_...)`
+        );
+      }
+      return { [MATRX_HEADERS.authorization]: `Bearer ${credential.apiKey}` };
+    }
+  }
+}
+function toCredentialsPort(setting) {
+  if (setting === void 0 || setting === null) return { get: async () => null };
+  if (typeof setting === "function") return { get: async () => setting() };
+  if ("get" in setting && typeof setting.get === "function") return setting;
+  const fixed = setting;
+  return { get: async () => fixed };
+}
+export {
+  API_KEY_PREFIX,
+  MATRX_HEADERS,
+  credentialToHeaders,
+  toCredentialsPort
+};

package/dist/index.cjs

@@ -0,0 +1,189 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var src_exports = {};
+__export(src_exports, {
+  SecretKeyRefusedError: () => SecretKeyRefusedError,
+  SignInError: () => SignInError,
+  StorageUnavailableError: () => StorageUnavailableError,
+  browserStorage: () => browserStorage,
+  createAuthClient: () => createAuthClient,
+  extensionStorage: () => extensionStorage,
+  getPerson: () => getPerson,
+  getSession: () => getSession,
+  keyValueStorage: () => keyValueStorage,
+  memoryStorage: () => memoryStorage,
+  onSessionChange: () => onSessionChange,
+  refreshSession: () => refreshSession,
+  sessionCredentials: () => sessionCredentials,
+  signInWithOAuth: () => signInWithOAuth,
+  signInWithPassword: () => signInWithPassword,
+  signOut: () => signOut,
+  updatePerson: () => updatePerson,
+  userCredentials: () => userCredentials
+});
+module.exports = __toCommonJS(src_exports);
+
+// src/session.ts
+var SignInError = class extends Error {
+  door;
+  status;
+  code;
+  constructor(door, message, status, code) {
+    super(`${door}: ${message}`);
+    this.name = "SignInError";
+    this.door = door;
+    if (status !== void 0) this.status = status;
+    if (code !== void 0) this.code = code;
+  }
+};
+function check(door, data, error) {
+  if (error) throw new SignInError(door, error.message, error.status, error.code);
+  return data;
+}
+async function getSession(client) {
+  const { data, error } = await client.auth.getSession();
+  return check("getSession", data, error).session;
+}
+async function getPerson(client) {
+  const { data, error } = await client.auth.getUser();
+  if (error && (error.name === "AuthSessionMissingError" || error.status === 401)) return null;
+  return check("getPerson", data, error).user;
+}
+function onSessionChange(client, cb) {
+  const { data } = client.auth.onAuthStateChange(cb);
+  return () => data.subscription.unsubscribe();
+}
+async function signInWithPassword(client, credentials) {
+  const { data, error } = await client.auth.signInWithPassword(credentials);
+  const ok = check("signInWithPassword", data, error);
+  return { session: ok.session, person: ok.user };
+}
+async function signInWithOAuth(client, options) {
+  const { provider, ...rest } = options;
+  const { data, error } = await client.auth.signInWithOAuth({ provider, options: rest });
+  const ok = check("signInWithOAuth", data, error);
+  return { provider: ok.provider, url: ok.url ?? null };
+}
+async function signOut(client, scope = "global") {
+  const { error } = await client.auth.signOut({ scope });
+  check("signOut", null, error);
+}
+async function updatePerson(client, attributes) {
+  const { data, error } = await client.auth.updateUser(attributes);
+  return check("updatePerson", data, error).user;
+}
+function sessionCredentials(client) {
+  return {
+    async get() {
+      if (!client.auth) return null;
+      const { data } = await client.auth.getSession();
+      return data.session ? { kind: "user", accessToken: data.session.access_token } : null;
+    },
+    onChange(cb) {
+      if (!client.auth) return () => {
+      };
+      const { data } = client.auth.onAuthStateChange(() => cb());
+      return () => data.subscription.unsubscribe();
+    }
+  };
+}
+var userCredentials = sessionCredentials;
+async function refreshSession(client) {
+  const { data, error } = await client.auth.refreshSession();
+  const ok = check("refreshSession", data, error);
+  if (!ok.session) throw new SignInError("refreshSession", "no session came back from the refresh");
+  return ok.session;
+}
+
+// src/storage.ts
+var StorageUnavailableError = class extends Error {
+  storage;
+  constructor(storage, reason) {
+    super(`${storage} session storage is not available here: ${reason}`);
+    this.name = "StorageUnavailableError";
+    this.storage = storage;
+  }
+};
+function memoryStorage() {
+  const items = /* @__PURE__ */ new Map();
+  return {
+    getItem: (key) => items.get(key) ?? null,
+    setItem: (key, value) => {
+      items.set(key, value);
+    },
+    removeItem: (key) => {
+      items.delete(key);
+    },
+    size: () => items.size
+  };
+}
+function browserStorage(kind = "local") {
+  const name = kind === "local" ? "localStorage" : "sessionStorage";
+  const store = globalThis[name];
+  if (!store) throw new StorageUnavailableError(name, "this runtime has no window storage (server, worker or Node)");
+  return {
+    getItem: (key) => store.getItem(key),
+    setItem: (key, value) => store.setItem(key, value),
+    removeItem: (key) => store.removeItem(key)
+  };
+}
+function extensionStorage(area) {
+  const chromeLike = globalThis.chrome;
+  const store = area ?? chromeLike?.storage?.local;
+  if (!store) throw new StorageUnavailableError("chrome.storage.local", "this is not a browser extension context");
+  return {
+    getItem: async (key) => {
+      const value = (await store.get(key))[key];
+      return typeof value === "string" ? value : null;
+    },
+    setItem: async (key, value) => {
+      await store.set({ [key]: value });
+    },
+    removeItem: async (key) => {
+      await store.remove(key);
+    }
+  };
+}
+function keyValueStorage(store) {
+  return {
+    getItem: async (key) => await store.get(key) ?? null,
+    setItem: (key, value) => store.set(key, value),
+    removeItem: (key) => store.remove(key)
+  };
+}
+
+// src/client.ts
+var import_supabase_js = require("@supabase/supabase-js");
+var SecretKeyRefusedError = class extends Error {
+  constructor() {
+    super("createAuthClient: a secret (service-role) key signs in nobody \u2014 pass the publishable key");
+    this.name = "SecretKeyRefusedError";
+  }
+};
+function createAuthClient(options) {
+  if (/^sb_secret_/.test(options.key)) throw new SecretKeyRefusedError();
+  const persist = options.persist ?? true;
+  const auth = { persistSession: persist, autoRefreshToken: persist };
+  if (options.storage) auth["storage"] = options.storage;
+  if (options.storageKey) auth["storageKey"] = options.storageKey;
+  if (options.detectSessionInUrl !== void 0) auth["detectSessionInUrl"] = options.detectSessionInUrl;
+  return (0, import_supabase_js.createClient)(options.url, options.key, { auth });
+}

package/dist/index.d.cts

@@ -0,0 +1,86 @@
+export { A as AuthClient, S as SessionSourceLike, a as SignInError, U as UserCredentialsPort, g as getPerson, b as getSession, o as onSessionChange, r as refreshSession, s as sessionCredentials, c as signInWithOAuth, d as signInWithPassword, e as signOut, u as updatePerson, f as userCredentials } from './session-DhRO4euL.cjs';
+import { SupabaseClient } from '@supabase/supabase-js';
+export { AuthChangeEvent, Session, User, UserAttributes } from '@supabase/supabase-js';
+export { CredentialsPort, MatrxCredential, MatrxCredentialKind } from './credentials.cjs';
+
+/**
+ * Session storage per platform — where a Supabase session lives between runs.
+ *
+ * supabase-js takes any `{ getItem, setItem, removeItem }` (sync or async). These are the ones
+ * every Matrx client needs, written once:
+ *
+ *   browser   — `browserStorage("local")` (supabase-js's own default; `"session"` = this tab only)
+ *   Next.js   — the cookie-backed clients in `@ai-matrx/auth/next` (the domain-wide auth cookie)
+ *   extension — `extensionStorage()` over `chrome.storage.local` (shared by popup, side panel and
+ *               service worker; `localStorage` does not exist in a service worker)
+ *   desktop   — `keyValueStorage({ get, set, remove })` over the host's store (Tauri store, keychain)
+ *   Node      — `fileStorage(path)` in `@ai-matrx/auth/node`, or `memoryStorage()` for a one-shot run
+ *
+ * None of these is ever silently swapped for another: a storage the platform does not have throws
+ * a named error at creation, never a quiet in-memory fallback that signs the person out on reload.
+ */
+/** The storage contract supabase-js reads (sync or async methods). */
+interface SessionStorage {
+    getItem(key: string): string | null | Promise<string | null>;
+    setItem(key: string, value: string): void | Promise<void>;
+    removeItem(key: string): void | Promise<void>;
+}
+declare class StorageUnavailableError extends Error {
+    readonly storage: string;
+    constructor(storage: string, reason: string);
+}
+/** In memory only: the session ends with the process (one-shot scripts, tests, server renders). */
+declare function memoryStorage(): SessionStorage & {
+    readonly size: () => number;
+};
+/** The browser's `localStorage` (shared by every tab of the origin) or `sessionStorage` (this tab). */
+declare function browserStorage(kind?: "local" | "session"): SessionStorage;
+/** The structural slice of `chrome.storage.<area>` read here (MV3 promise API). */
+interface ChromeStorageAreaLike {
+    get(keys: string): Promise<Record<string, unknown>>;
+    set(items: Record<string, unknown>): Promise<void>;
+    remove(keys: string): Promise<void>;
+}
+/**
+ * A browser extension's `chrome.storage` area (default `local`): one session for the popup, side
+ * panel, content scripts' relay and the service worker. Pass `area` to inject one (tests, Firefox).
+ */
+declare function extensionStorage(area?: ChromeStorageAreaLike): SessionStorage;
+/** Any async key-value store the host owns (a desktop app's Tauri store or keychain). */
+declare function keyValueStorage(store: {
+    get(key: string): Promise<string | null | undefined>;
+    set(key: string, value: string): Promise<void>;
+    remove(key: string): Promise<void>;
+}): SessionStorage;
+
+/**
+ * `createAuthClient` — the one Supabase client factory OUTSIDE Next.js (Next apps use
+ * `@ai-matrx/auth/next`, whose cookie clients carry the domain-wide auth cookie).
+ *
+ *   const supabase = createAuthClient({ url, key, storage: extensionStorage() });
+ *
+ * The session persists in `storage` and refreshes itself (`autoRefreshToken`) unless `persist`
+ * is false (a one-shot script). The same client is what `@ai-matrx/data` and
+ * `@ai-matrx/api` (through `sessionCredentials`) read — one sign-in drives all three.
+ */
+
+interface CreateAuthClientOptions {
+    /** The database URL (always `https://db.matrxserver.com` for the platform). */
+    readonly url: string;
+    /** The publishable key. Never a secret key: that is a service role, not a person. */
+    readonly key: string;
+    /** Where the session lives. Default: supabase-js's own (browser `localStorage`). */
+    readonly storage?: SessionStorage | undefined;
+    /** The storage key (default: supabase-js's per-project key). */
+    readonly storageKey?: string | undefined;
+    /** False = sign in for this run only: no storage write, no background refresh. Default true. */
+    readonly persist?: boolean | undefined;
+    /** Read OAuth / magic-link tokens from the URL on load (browser apps). Default: supabase-js's. */
+    readonly detectSessionInUrl?: boolean | undefined;
+}
+declare class SecretKeyRefusedError extends Error {
+    constructor();
+}
+declare function createAuthClient<Database = any>(options: CreateAuthClientOptions): SupabaseClient<Database>;
+
+export { type ChromeStorageAreaLike, type CreateAuthClientOptions, SecretKeyRefusedError, type SessionStorage, StorageUnavailableError, browserStorage, createAuthClient, extensionStorage, keyValueStorage, memoryStorage };

package/dist/index.d.ts

@@ -0,0 +1,86 @@
+export { A as AuthClient, S as SessionSourceLike, a as SignInError, U as UserCredentialsPort, g as getPerson, b as getSession, o as onSessionChange, r as refreshSession, s as sessionCredentials, c as signInWithOAuth, d as signInWithPassword, e as signOut, u as updatePerson, f as userCredentials } from './session-DhRO4euL.js';
+import { SupabaseClient } from '@supabase/supabase-js';
+export { AuthChangeEvent, Session, User, UserAttributes } from '@supabase/supabase-js';
+export { CredentialsPort, MatrxCredential, MatrxCredentialKind } from './credentials.js';
+
+/**
+ * Session storage per platform — where a Supabase session lives between runs.
+ *
+ * supabase-js takes any `{ getItem, setItem, removeItem }` (sync or async). These are the ones
+ * every Matrx client needs, written once:
+ *
+ *   browser   — `browserStorage("local")` (supabase-js's own default; `"session"` = this tab only)
+ *   Next.js   — the cookie-backed clients in `@ai-matrx/auth/next` (the domain-wide auth cookie)
+ *   extension — `extensionStorage()` over `chrome.storage.local` (shared by popup, side panel and
+ *               service worker; `localStorage` does not exist in a service worker)
+ *   desktop   — `keyValueStorage({ get, set, remove })` over the host's store (Tauri store, keychain)
+ *   Node      — `fileStorage(path)` in `@ai-matrx/auth/node`, or `memoryStorage()` for a one-shot run
+ *
+ * None of these is ever silently swapped for another: a storage the platform does not have throws
+ * a named error at creation, never a quiet in-memory fallback that signs the person out on reload.
+ */
+/** The storage contract supabase-js reads (sync or async methods). */
+interface SessionStorage {
+    getItem(key: string): string | null | Promise<string | null>;
+    setItem(key: string, value: string): void | Promise<void>;
+    removeItem(key: string): void | Promise<void>;
+}
+declare class StorageUnavailableError extends Error {
+    readonly storage: string;
+    constructor(storage: string, reason: string);
+}
+/** In memory only: the session ends with the process (one-shot scripts, tests, server renders). */
+declare function memoryStorage(): SessionStorage & {
+    readonly size: () => number;
+};
+/** The browser's `localStorage` (shared by every tab of the origin) or `sessionStorage` (this tab). */
+declare function browserStorage(kind?: "local" | "session"): SessionStorage;
+/** The structural slice of `chrome.storage.<area>` read here (MV3 promise API). */
+interface ChromeStorageAreaLike {
+    get(keys: string): Promise<Record<string, unknown>>;
+    set(items: Record<string, unknown>): Promise<void>;
+    remove(keys: string): Promise<void>;
+}
+/**
+ * A browser extension's `chrome.storage` area (default `local`): one session for the popup, side
+ * panel, content scripts' relay and the service worker. Pass `area` to inject one (tests, Firefox).
+ */
+declare function extensionStorage(area?: ChromeStorageAreaLike): SessionStorage;
+/** Any async key-value store the host owns (a desktop app's Tauri store or keychain). */
+declare function keyValueStorage(store: {
+    get(key: string): Promise<string | null | undefined>;
+    set(key: string, value: string): Promise<void>;
+    remove(key: string): Promise<void>;
+}): SessionStorage;
+
+/**
+ * `createAuthClient` — the one Supabase client factory OUTSIDE Next.js (Next apps use
+ * `@ai-matrx/auth/next`, whose cookie clients carry the domain-wide auth cookie).
+ *
+ *   const supabase = createAuthClient({ url, key, storage: extensionStorage() });
+ *
+ * The session persists in `storage` and refreshes itself (`autoRefreshToken`) unless `persist`
+ * is false (a one-shot script). The same client is what `@ai-matrx/data` and
+ * `@ai-matrx/api` (through `sessionCredentials`) read — one sign-in drives all three.
+ */
+
+interface CreateAuthClientOptions {
+    /** The database URL (always `https://db.matrxserver.com` for the platform). */
+    readonly url: string;
+    /** The publishable key. Never a secret key: that is a service role, not a person. */
+    readonly key: string;
+    /** Where the session lives. Default: supabase-js's own (browser `localStorage`). */
+    readonly storage?: SessionStorage | undefined;
+    /** The storage key (default: supabase-js's per-project key). */
+    readonly storageKey?: string | undefined;
+    /** False = sign in for this run only: no storage write, no background refresh. Default true. */
+    readonly persist?: boolean | undefined;
+    /** Read OAuth / magic-link tokens from the URL on load (browser apps). Default: supabase-js's. */
+    readonly detectSessionInUrl?: boolean | undefined;
+}
+declare class SecretKeyRefusedError extends Error {
+    constructor();
+}
+declare function createAuthClient<Database = any>(options: CreateAuthClientOptions): SupabaseClient<Database>;
+
+export { type ChromeStorageAreaLike, type CreateAuthClientOptions, SecretKeyRefusedError, type SessionStorage, StorageUnavailableError, browserStorage, createAuthClient, extensionStorage, keyValueStorage, memoryStorage };

package/dist/index.js

@@ -0,0 +1,166 @@
+// src/session.ts
+var SignInError = class extends Error {
+  door;
+  status;
+  code;
+  constructor(door, message, status, code) {
+    super(`${door}: ${message}`);
+    this.name = "SignInError";
+    this.door = door;
+    if (status !== void 0) this.status = status;
+    if (code !== void 0) this.code = code;
+  }
+};
+function check(door, data, error) {
+  if (error) throw new SignInError(door, error.message, error.status, error.code);
+  return data;
+}
+async function getSession(client) {
+  const { data, error } = await client.auth.getSession();
+  return check("getSession", data, error).session;
+}
+async function getPerson(client) {
+  const { data, error } = await client.auth.getUser();
+  if (error && (error.name === "AuthSessionMissingError" || error.status === 401)) return null;
+  return check("getPerson", data, error).user;
+}
+function onSessionChange(client, cb) {
+  const { data } = client.auth.onAuthStateChange(cb);
+  return () => data.subscription.unsubscribe();
+}
+async function signInWithPassword(client, credentials) {
+  const { data, error } = await client.auth.signInWithPassword(credentials);
+  const ok = check("signInWithPassword", data, error);
+  return { session: ok.session, person: ok.user };
+}
+async function signInWithOAuth(client, options) {
+  const { provider, ...rest } = options;
+  const { data, error } = await client.auth.signInWithOAuth({ provider, options: rest });
+  const ok = check("signInWithOAuth", data, error);
+  return { provider: ok.provider, url: ok.url ?? null };
+}
+async function signOut(client, scope = "global") {
+  const { error } = await client.auth.signOut({ scope });
+  check("signOut", null, error);
+}
+async function updatePerson(client, attributes) {
+  const { data, error } = await client.auth.updateUser(attributes);
+  return check("updatePerson", data, error).user;
+}
+function sessionCredentials(client) {
+  return {
+    async get() {
+      if (!client.auth) return null;
+      const { data } = await client.auth.getSession();
+      return data.session ? { kind: "user", accessToken: data.session.access_token } : null;
+    },
+    onChange(cb) {
+      if (!client.auth) return () => {
+      };
+      const { data } = client.auth.onAuthStateChange(() => cb());
+      return () => data.subscription.unsubscribe();
+    }
+  };
+}
+var userCredentials = sessionCredentials;
+async function refreshSession(client) {
+  const { data, error } = await client.auth.refreshSession();
+  const ok = check("refreshSession", data, error);
+  if (!ok.session) throw new SignInError("refreshSession", "no session came back from the refresh");
+  return ok.session;
+}
+
+// src/storage.ts
+var StorageUnavailableError = class extends Error {
+  storage;
+  constructor(storage, reason) {
+    super(`${storage} session storage is not available here: ${reason}`);
+    this.name = "StorageUnavailableError";
+    this.storage = storage;
+  }
+};
+function memoryStorage() {
+  const items = /* @__PURE__ */ new Map();
+  return {
+    getItem: (key) => items.get(key) ?? null,
+    setItem: (key, value) => {
+      items.set(key, value);
+    },
+    removeItem: (key) => {
+      items.delete(key);
+    },
+    size: () => items.size
+  };
+}
+function browserStorage(kind = "local") {
+  const name = kind === "local" ? "localStorage" : "sessionStorage";
+  const store = globalThis[name];
+  if (!store) throw new StorageUnavailableError(name, "this runtime has no window storage (server, worker or Node)");
+  return {
+    getItem: (key) => store.getItem(key),
+    setItem: (key, value) => store.setItem(key, value),
+    removeItem: (key) => store.removeItem(key)
+  };
+}
+function extensionStorage(area) {
+  const chromeLike = globalThis.chrome;
+  const store = area ?? chromeLike?.storage?.local;
+  if (!store) throw new StorageUnavailableError("chrome.storage.local", "this is not a browser extension context");
+  return {
+    getItem: async (key) => {
+      const value = (await store.get(key))[key];
+      return typeof value === "string" ? value : null;
+    },
+    setItem: async (key, value) => {
+      await store.set({ [key]: value });
+    },
+    removeItem: async (key) => {
+      await store.remove(key);
+    }
+  };
+}
+function keyValueStorage(store) {
+  return {
+    getItem: async (key) => await store.get(key) ?? null,
+    setItem: (key, value) => store.set(key, value),
+    removeItem: (key) => store.remove(key)
+  };
+}
+
+// src/client.ts
+import { createClient } from "@supabase/supabase-js";
+var SecretKeyRefusedError = class extends Error {
+  constructor() {
+    super("createAuthClient: a secret (service-role) key signs in nobody \u2014 pass the publishable key");
+    this.name = "SecretKeyRefusedError";
+  }
+};
+function createAuthClient(options) {
+  if (/^sb_secret_/.test(options.key)) throw new SecretKeyRefusedError();
+  const persist = options.persist ?? true;
+  const auth = { persistSession: persist, autoRefreshToken: persist };
+  if (options.storage) auth["storage"] = options.storage;
+  if (options.storageKey) auth["storageKey"] = options.storageKey;
+  if (options.detectSessionInUrl !== void 0) auth["detectSessionInUrl"] = options.detectSessionInUrl;
+  return createClient(options.url, options.key, { auth });
+}
+export {
+  SecretKeyRefusedError,
+  SignInError,
+  StorageUnavailableError,
+  browserStorage,
+  createAuthClient,
+  extensionStorage,
+  getPerson,
+  getSession,
+  keyValueStorage,
+  memoryStorage,
+  onSessionChange,
+  refreshSession,
+  sessionCredentials,
+  signInWithOAuth,
+  signInWithPassword,
+  signOut,
+  updatePerson,
+  userCredentials
+};