@ai-matrx/auth 0.2.0 → 0.2.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-matrx/auth",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "description": "AI Matrx sign-in, session and organizations for every app: sign in/out, session storage and refresh per platform (browser, Next.js, extension, desktop, Node), the current person, their organizations and favourites, the one active organization (held requests, never a list filter), and the credentials @ai-matrx/data and @ai-matrx/api read.",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -132,6 +132,16 @@
         "default": "./dist/matrx-oauth.cjs"
       }
     },
+    "./guest": {
+      "import": {
+        "types": "./dist/guest.d.ts",
+        "default": "./dist/guest.js"
+      },
+      "require": {
+        "types": "./dist/guest.d.cts",
+        "default": "./dist/guest.cjs"
+      }
+    },
     "./package.json": "./package.json"
   },
   "devDependencies": {
@@ -201,5 +211,5 @@
     "test": "vitest run",
     "verify:tarball": "node ./scripts/verify-tarball.mjs"
   },
-  "gitHead": "eeeafb1ae105f78c584681829e13dd69b200abc6"
+  "gitHead": "09da8756d7c80a6f2e611b1dd2d713efee4b0858"
 }

package/dist/session-DdQiStp6.d.cts

@@ -1,112 +0,0 @@
-import { SupabaseClient, User, Session, AuthChangeEvent, Provider, UserAttributes } from '@supabase/supabase-js';
-
-/**
- * @ai-matrx/auth — sign-in and session doors (moved from @ai-matrx/data/auth, 2026-10-09).
- *
- * auth owns Supabase sign-in; @ai-matrx/data reads the same client and session for its doors. A package or app asks these doors instead of reaching into
- * `client.auth.*`; the session leaves for `@ai-matrx/api` only as the `user` credential
- * (`sessionCredentials(client)`, the shape api's `CredentialsPort` takes, and the same port
- * `@ai-matrx/data`'s `createDb(...).credentials` returns), so api reads the token and never
- * signs anyone in.
- *
- *   const session = await getSession(supabase);            // Session | null
- *   const person  = await getPerson(supabase);             // User | null (verified by the server)
- *   const stop    = onSessionChange(supabase, (event, session) => …);
- *   await signInWithPassword(supabase, { email, password }); // throws SignInError
- *   const { url } = await signInWithOAuth(supabase, { provider: "google", redirectTo });
- *   await signOut(supabase);
- *   await updatePerson(supabase, { data: { full_name } });
- *
- * Every refusal throws `SignInError` carrying the auth server's own message, status and code.
- */
-
-/** Any supabase-js client (browser, server, route, extension) — only its `auth` is used here. */
-type AuthClient = Pick<SupabaseClient<any, any, any>, "auth">;
-/** A refusal from the auth server — its own message, plus status/code when it sent them. */
-declare class SignInError extends Error {
-    readonly door: string;
-    readonly status?: number;
-    readonly code?: string;
-    constructor(door: string, message: string, status?: number, code?: string);
-}
-/** The stored session (no network unless a refresh is due), or null when signed out. */
-declare function getSession(client: AuthClient): Promise<Session | null>;
-/**
- * Forget the cached person for this client, so the next {@link getPerson} asks the auth server.
- * Sign-in, sign-out, a profile edit and an organization switch already call this; call it yourself
- * only after changing the person outside this package.
- */
-declare function invalidatePerson(client: AuthClient): void;
-/**
- * The signed-in person, verified by the auth server, or null when signed out. The verified read is
- * kept per client until the session changes (sign-in, sign-out, profile edit, organization switch),
- * so repeated access checks cost zero extra auth-server calls; concurrent callers share one read.
- */
-declare function getPerson(client: AuthClient): Promise<User | null>;
-/** Hear every session change (sign-in, refresh, sign-out). Returns the unsubscribe. */
-declare function onSessionChange(client: AuthClient, cb: (event: AuthChangeEvent, session: Session | null) => void): () => void;
-declare function signInWithPassword(client: AuthClient, credentials: {
-    email: string;
-    password: string;
-} | {
-    phone: string;
-    password: string;
-}): Promise<{
-    session: Session;
-    person: User;
-}>;
-declare function signInWithOAuth(client: AuthClient, options: {
-    provider: Provider;
-    redirectTo?: string;
-    scopes?: string;
-    queryParams?: Record<string, string>;
-    skipBrowserRedirect?: boolean;
-}): Promise<{
-    provider: Provider;
-    url: string | null;
-}>;
-declare function signOut(client: AuthClient, scope?: "global" | "local" | "others"): Promise<void>;
-/** Change the signed-in person's email, phone, password or metadata. */
-declare function updatePerson(client: AuthClient, attributes: UserAttributes): Promise<User>;
-/** The slice of a client the session credential reads: its `auth`, when it has one. */
-interface SessionSourceLike {
-    auth?: {
-        getSession(): PromiseLike<{
-            data: {
-                session: {
-                    access_token: string;
-                } | null;
-            };
-        }>;
-        onAuthStateChange(cb: (event: string, session: unknown) => void): {
-            data: {
-                subscription: {
-                    unsubscribe(): void;
-                };
-            };
-        };
-    } | undefined;
-}
-/** The `user` credential port (structural; the shape `@ai-matrx/api`'s `CredentialsPort` takes). */
-interface UserCredentialsPort {
-    get(): Promise<{
-        kind: "user";
-        accessToken: string;
-    } | null>;
-    onChange?(cb: () => void): () => void;
-}
-/**
- * THE ONE session → credential mapping: the current access token as api's `user` credential,
- * re-read on every call (a refresh rotates it), with `onChange` on every session change.
- * A client with no `auth` is anonymous (null), never an error.
- */
-declare function sessionCredentials(client: SessionSourceLike): UserCredentialsPort;
-/** The session as `@ai-matrx/api`'s `user` credential — the name `@ai-matrx/data/auth` shipped. */
-declare const userCredentials: typeof sessionCredentials;
-/**
- * Refresh the session now (a long-lived script, a desktop app waking from sleep, a tab that was
- * frozen). Returns the new session; throws `SignInError` when the refresh token is refused.
- */
-declare function refreshSession(client: AuthClient): Promise<Session>;
-
-export { type AuthClient as A, type SessionSourceLike as S, type UserCredentialsPort as U, SignInError as a, getSession as b, signInWithOAuth as c, signInWithPassword as d, signOut as e, userCredentials as f, getPerson as g, invalidatePerson as i, onSessionChange as o, refreshSession as r, sessionCredentials as s, updatePerson as u };

package/dist/session-DdQiStp6.d.ts

@@ -1,112 +0,0 @@
-import { SupabaseClient, User, Session, AuthChangeEvent, Provider, UserAttributes } from '@supabase/supabase-js';
-
-/**
- * @ai-matrx/auth — sign-in and session doors (moved from @ai-matrx/data/auth, 2026-10-09).
- *
- * auth owns Supabase sign-in; @ai-matrx/data reads the same client and session for its doors. A package or app asks these doors instead of reaching into
- * `client.auth.*`; the session leaves for `@ai-matrx/api` only as the `user` credential
- * (`sessionCredentials(client)`, the shape api's `CredentialsPort` takes, and the same port
- * `@ai-matrx/data`'s `createDb(...).credentials` returns), so api reads the token and never
- * signs anyone in.
- *
- *   const session = await getSession(supabase);            // Session | null
- *   const person  = await getPerson(supabase);             // User | null (verified by the server)
- *   const stop    = onSessionChange(supabase, (event, session) => …);
- *   await signInWithPassword(supabase, { email, password }); // throws SignInError
- *   const { url } = await signInWithOAuth(supabase, { provider: "google", redirectTo });
- *   await signOut(supabase);
- *   await updatePerson(supabase, { data: { full_name } });
- *
- * Every refusal throws `SignInError` carrying the auth server's own message, status and code.
- */
-
-/** Any supabase-js client (browser, server, route, extension) — only its `auth` is used here. */
-type AuthClient = Pick<SupabaseClient<any, any, any>, "auth">;
-/** A refusal from the auth server — its own message, plus status/code when it sent them. */
-declare class SignInError extends Error {
-    readonly door: string;
-    readonly status?: number;
-    readonly code?: string;
-    constructor(door: string, message: string, status?: number, code?: string);
-}
-/** The stored session (no network unless a refresh is due), or null when signed out. */
-declare function getSession(client: AuthClient): Promise<Session | null>;
-/**
- * Forget the cached person for this client, so the next {@link getPerson} asks the auth server.
- * Sign-in, sign-out, a profile edit and an organization switch already call this; call it yourself
- * only after changing the person outside this package.
- */
-declare function invalidatePerson(client: AuthClient): void;
-/**
- * The signed-in person, verified by the auth server, or null when signed out. The verified read is
- * kept per client until the session changes (sign-in, sign-out, profile edit, organization switch),
- * so repeated access checks cost zero extra auth-server calls; concurrent callers share one read.
- */
-declare function getPerson(client: AuthClient): Promise<User | null>;
-/** Hear every session change (sign-in, refresh, sign-out). Returns the unsubscribe. */
-declare function onSessionChange(client: AuthClient, cb: (event: AuthChangeEvent, session: Session | null) => void): () => void;
-declare function signInWithPassword(client: AuthClient, credentials: {
-    email: string;
-    password: string;
-} | {
-    phone: string;
-    password: string;
-}): Promise<{
-    session: Session;
-    person: User;
-}>;
-declare function signInWithOAuth(client: AuthClient, options: {
-    provider: Provider;
-    redirectTo?: string;
-    scopes?: string;
-    queryParams?: Record<string, string>;
-    skipBrowserRedirect?: boolean;
-}): Promise<{
-    provider: Provider;
-    url: string | null;
-}>;
-declare function signOut(client: AuthClient, scope?: "global" | "local" | "others"): Promise<void>;
-/** Change the signed-in person's email, phone, password or metadata. */
-declare function updatePerson(client: AuthClient, attributes: UserAttributes): Promise<User>;
-/** The slice of a client the session credential reads: its `auth`, when it has one. */
-interface SessionSourceLike {
-    auth?: {
-        getSession(): PromiseLike<{
-            data: {
-                session: {
-                    access_token: string;
-                } | null;
-            };
-        }>;
-        onAuthStateChange(cb: (event: string, session: unknown) => void): {
-            data: {
-                subscription: {
-                    unsubscribe(): void;
-                };
-            };
-        };
-    } | undefined;
-}
-/** The `user` credential port (structural; the shape `@ai-matrx/api`'s `CredentialsPort` takes). */
-interface UserCredentialsPort {
-    get(): Promise<{
-        kind: "user";
-        accessToken: string;
-    } | null>;
-    onChange?(cb: () => void): () => void;
-}
-/**
- * THE ONE session → credential mapping: the current access token as api's `user` credential,
- * re-read on every call (a refresh rotates it), with `onChange` on every session change.
- * A client with no `auth` is anonymous (null), never an error.
- */
-declare function sessionCredentials(client: SessionSourceLike): UserCredentialsPort;
-/** The session as `@ai-matrx/api`'s `user` credential — the name `@ai-matrx/data/auth` shipped. */
-declare const userCredentials: typeof sessionCredentials;
-/**
- * Refresh the session now (a long-lived script, a desktop app waking from sleep, a tab that was
- * frozen). Returns the new session; throws `SignInError` when the refresh token is refused.
- */
-declare function refreshSession(client: AuthClient): Promise<Session>;
-
-export { type AuthClient as A, type SessionSourceLike as S, type UserCredentialsPort as U, SignInError as a, getSession as b, signInWithOAuth as c, signInWithPassword as d, signOut as e, userCredentials as f, getPerson as g, invalidatePerson as i, onSessionChange as o, refreshSession as r, sessionCredentials as s, updatePerson as u };

package/dist/storage-Dqnye4KF.d.cts

@@ -1,51 +0,0 @@
-/**
- * Session storage per platform — where a Supabase session lives between runs.
- *
- * supabase-js takes any `{ getItem, setItem, removeItem }` (sync or async). These are the ones
- * every Matrx client needs, written once:
- *
- *   browser   — `browserStorage("local")` (supabase-js's own default; `"session"` = this tab only)
- *   Next.js   — the cookie-backed clients in `@ai-matrx/auth/next` (the domain-wide auth cookie)
- *   extension — `extensionStorage()` over `chrome.storage.local` (shared by popup, side panel and
- *               service worker; `localStorage` does not exist in a service worker)
- *   desktop   — `keyValueStorage({ get, set, remove })` over the host's store (Tauri store, keychain)
- *   Node      — `fileStorage(path)` in `@ai-matrx/auth/node`, or `memoryStorage()` for a one-shot run
- *
- * None of these is ever silently swapped for another: a storage the platform does not have throws
- * a named error at creation, never a quiet in-memory fallback that signs the person out on reload.
- */
-/** The storage contract supabase-js reads (sync or async methods). */
-interface SessionStorage {
-    getItem(key: string): string | null | Promise<string | null>;
-    setItem(key: string, value: string): void | Promise<void>;
-    removeItem(key: string): void | Promise<void>;
-}
-declare class StorageUnavailableError extends Error {
-    readonly storage: string;
-    constructor(storage: string, reason: string);
-}
-/** In memory only: the session ends with the process (one-shot scripts, tests, server renders). */
-declare function memoryStorage(): SessionStorage & {
-    readonly size: () => number;
-};
-/** The browser's `localStorage` (shared by every tab of the origin) or `sessionStorage` (this tab). */
-declare function browserStorage(kind?: "local" | "session"): SessionStorage;
-/** The structural slice of `chrome.storage.<area>` read here (MV3 promise API). */
-interface ChromeStorageAreaLike {
-    get(keys: string): Promise<Record<string, unknown>>;
-    set(items: Record<string, unknown>): Promise<void>;
-    remove(keys: string): Promise<void>;
-}
-/**
- * A browser extension's `chrome.storage` area (default `local`): one session for the popup, side
- * panel, content scripts' relay and the service worker. Pass `area` to inject one (tests, Firefox).
- */
-declare function extensionStorage(area?: ChromeStorageAreaLike): SessionStorage;
-/** Any async key-value store the host owns (a desktop app's Tauri store or keychain). */
-declare function keyValueStorage(store: {
-    get(key: string): Promise<string | null | undefined>;
-    set(key: string, value: string): Promise<void>;
-    remove(key: string): Promise<void>;
-}): SessionStorage;
-
-export { type ChromeStorageAreaLike as C, type SessionStorage as S, StorageUnavailableError as a, browserStorage as b, extensionStorage as e, keyValueStorage as k, memoryStorage as m };

package/dist/storage-Dqnye4KF.d.ts

@@ -1,51 +0,0 @@
-/**
- * Session storage per platform — where a Supabase session lives between runs.
- *
- * supabase-js takes any `{ getItem, setItem, removeItem }` (sync or async). These are the ones
- * every Matrx client needs, written once:
- *
- *   browser   — `browserStorage("local")` (supabase-js's own default; `"session"` = this tab only)
- *   Next.js   — the cookie-backed clients in `@ai-matrx/auth/next` (the domain-wide auth cookie)
- *   extension — `extensionStorage()` over `chrome.storage.local` (shared by popup, side panel and
- *               service worker; `localStorage` does not exist in a service worker)
- *   desktop   — `keyValueStorage({ get, set, remove })` over the host's store (Tauri store, keychain)
- *   Node      — `fileStorage(path)` in `@ai-matrx/auth/node`, or `memoryStorage()` for a one-shot run
- *
- * None of these is ever silently swapped for another: a storage the platform does not have throws
- * a named error at creation, never a quiet in-memory fallback that signs the person out on reload.
- */
-/** The storage contract supabase-js reads (sync or async methods). */
-interface SessionStorage {
-    getItem(key: string): string | null | Promise<string | null>;
-    setItem(key: string, value: string): void | Promise<void>;
-    removeItem(key: string): void | Promise<void>;
-}
-declare class StorageUnavailableError extends Error {
-    readonly storage: string;
-    constructor(storage: string, reason: string);
-}
-/** In memory only: the session ends with the process (one-shot scripts, tests, server renders). */
-declare function memoryStorage(): SessionStorage & {
-    readonly size: () => number;
-};
-/** The browser's `localStorage` (shared by every tab of the origin) or `sessionStorage` (this tab). */
-declare function browserStorage(kind?: "local" | "session"): SessionStorage;
-/** The structural slice of `chrome.storage.<area>` read here (MV3 promise API). */
-interface ChromeStorageAreaLike {
-    get(keys: string): Promise<Record<string, unknown>>;
-    set(items: Record<string, unknown>): Promise<void>;
-    remove(keys: string): Promise<void>;
-}
-/**
- * A browser extension's `chrome.storage` area (default `local`): one session for the popup, side
- * panel, content scripts' relay and the service worker. Pass `area` to inject one (tests, Firefox).
- */
-declare function extensionStorage(area?: ChromeStorageAreaLike): SessionStorage;
-/** Any async key-value store the host owns (a desktop app's Tauri store or keychain). */
-declare function keyValueStorage(store: {
-    get(key: string): Promise<string | null | undefined>;
-    set(key: string, value: string): Promise<void>;
-    remove(key: string): Promise<void>;
-}): SessionStorage;
-
-export { type ChromeStorageAreaLike as C, type SessionStorage as S, StorageUnavailableError as a, browserStorage as b, extensionStorage as e, keyValueStorage as k, memoryStorage as m };