@ai-matrx/auth 0.3.7 → 0.3.8

package/CHANGELOG.md

@@ -1,10 +1,19 @@
 # Changelog — @ai-matrx/auth
 
-## 0.3.7
+### Unreleased
+
+- **New subpath `@ai-matrx/auth/claims`; `/credentials` gains `sessionCredentials` / `userCredentials` (2026-10-17).** The claims read (`getClaimsUser`, `createClaimsCache`, the signing-key pins and refusal tests) and the session -> credential mapping (moved to `src/session-credentials.ts`, still re-exported by the root) without the root, so a sibling's server-side entry (`@ai-matrx/data` `/db`, `/access`, `/script`, `/short-link`) never imports `@ai-matrx/auth` whole. Additive; the root's exports are unchanged. Consumer action: none.
+
+## 0.3.8
 
 UNVERIFIED: this release has no Unreleased entry and the source comparison could not be made (the caller supplied no source comparison). Whether source changed is unknown; consumer action is unknown.
 Check the package's gitHead on npm against this version's gitHead: `git diff <previous gitHead> <this gitHead> -- apps/shared/auth/src`.
 
+## 0.3.7
+
+Automatic changed-only republish (docs/metadata drift since the last published version; verified: `git diff cd85c8a24f 02e0da3204 -- apps/shared/auth/src`
+has no shipped-source changes outside tests, fixtures and docs). No consumer action required.
+
 ## 0.3.6
 ### Unreleased
 - New `@ai-matrx/auth/browser` (`createBrowserSupabase`, shared code path with `createNextSupabase().browserClient()`).

package/dist/{active-organization-B6s9ONIe.d.cts → active-organization-Djm9QJt8.d.cts}

@@ -68,41 +68,7 @@ declare function signInWithOAuth(client: AuthClient, options: {
 declare function signOut(client: AuthClient, scope?: "global" | "local" | "others"): Promise<void>;
 /** Change the signed-in person's email, phone, password or metadata. */
 declare function updatePerson(client: AuthClient, attributes: UserAttributes): Promise<User>;
-/** The slice of a client the session credential reads: its `auth`, when it has one. */
-interface SessionSourceLike {
-    auth?: {
-        getSession(): PromiseLike<{
-            data: {
-                session: {
-                    access_token: string;
-                } | null;
-            };
-        }>;
-        onAuthStateChange(cb: (event: string, session: unknown) => void): {
-            data: {
-                subscription: {
-                    unsubscribe(): void;
-                };
-            };
-        };
-    } | undefined;
-}
-/** The `user` credential port (structural; the shape `@ai-matrx/api`'s `CredentialsPort` takes). */
-interface UserCredentialsPort {
-    get(): Promise<{
-        kind: "user";
-        accessToken: string;
-    } | null>;
-    onChange?(cb: () => void): () => void;
-}
-/**
- * THE ONE session → credential mapping: the current access token as api's `user` credential,
- * re-read on every call (a refresh rotates it), with `onChange` on every session change.
- * A client with no `auth` is anonymous (null), never an error.
- */
-declare function sessionCredentials(client: SessionSourceLike): UserCredentialsPort;
-/** The session as `@ai-matrx/api`'s `user` credential — the name `@ai-matrx/data/auth` shipped. */
-declare const userCredentials: typeof sessionCredentials;
+
 /**
  * Refresh the session now (a long-lived script, a desktop app waking from sleep, a tab that was
  * frozen). Returns the new session; throws `SignInError` when the refresh token is refused.
@@ -653,4 +619,4 @@ declare function storageHeldOrganization(storage: Pick<Storage, "getItem" | "set
 declare function memoryHeldOrganization(): HeldOrganizationStore;
 declare function createActiveOrganization(options: CreateActiveOrganizationOptions): ActiveOrganization;
 
-export { createNotAMemberRefusalNotice as $, type AuthClient as A, NoActiveOrganizationError as B, type CachedActiveOrganization as C, NotAMemberError as D, type NotAMemberRefusalNotice as E, ORGANIZATION_ENTITY_TYPE as F, ORGANIZATION_RESOLUTION_TIMEOUT_MS as G, type HeldOrganizationStore as H, type OrganizationBootstrapGate as I, type OrganizationLapse as J, type OrganizationMembership as K, LINK_ORGANIZATION_QUERY_KEY as L, type OrganizationRefusal as M, NOT_A_MEMBER_RECHECK_GAP_MS as N, type OrganizationsDb as O, type OrganizationRung as P, type ParentOrganization as Q, type ReadMembershipsOptions as R, type SessionSourceLike as S, type ResolveWithLinkInput as T, type UserCredentialsPort as U, type ResolvedOrganization as V, type ResolvedWithLink as W, adminSeatReplacesUserContext as X, classifyLinkOrganizationValue as Y, classifyOrganizationRefusal as Z, createActiveOrganization as _, SignInError as a, createOrganizationBootstrapGate as a0, decideLinkOrganization as a1, isNotAMemberRefusal as a2, linkOrganizationMalformedMessage as a3, linkOrganizationNotAMemberMessage as a4, linkOrganizationOfferMessage as a5, linkOrganizationSwitchAnnouncement as a6, memoryHeldOrganization as a7, oldestMembership as a8, orderOrganizations as a9, organizationMatches as aa, readAccountOrganizationChoices as ab, readLinkOrganizationParam as ac, readMemberships as ad, readOrganizationFavourites as ae, resolveActiveOrganization as af, resolveActiveOrganizationLazily as ag, resolveAdminSeat as ah, resolveChildOrganizationId as ai, resolveOrganizationWithLink as aj, setOrganizationFavourite as ak, storageHeldOrganization as al, toAccountOrganizationChoices as am, writeLastActiveOrganization as an, writeStartupOrganization as ao, getSession as b, signInWithOAuth as c, signInWithPassword as d, signOut as e, userCredentials as f, getPerson as g, type AccountOrganizationChoices as h, invalidatePerson as i, type ActiveOrganization as j, type ActiveOrganizationSnapshot as k, type ActiveOrganizationStatus as l, type AdminSeat as m, type AdminSeatInput as n, onSessionChange as o, type ArchiveFilter as p, type CreateActiveOrganizationOptions as q, refreshSession as r, sessionCredentials as s, type LadderInput as t, updatePerson as u, type LinkOrganizationDecision as v, type LinkOrganizationDecisionInput as w, type LinkOrganizationMembership as x, type LinkOrganizationMessages as y, type LinkOrganizationParam as z };
+export { linkOrganizationMalformedMessage as $, type AuthClient as A, ORGANIZATION_ENTITY_TYPE as B, type CachedActiveOrganization as C, ORGANIZATION_RESOLUTION_TIMEOUT_MS as D, type OrganizationBootstrapGate as E, type OrganizationLapse as F, type OrganizationMembership as G, type HeldOrganizationStore as H, type OrganizationRefusal as I, type OrganizationRung as J, type ResolveWithLinkInput as K, LINK_ORGANIZATION_QUERY_KEY as L, type ResolvedOrganization as M, NOT_A_MEMBER_RECHECK_GAP_MS as N, type OrganizationsDb as O, type ParentOrganization as P, type ResolvedWithLink as Q, type ReadMembershipsOptions as R, SignInError as S, adminSeatReplacesUserContext as T, classifyLinkOrganizationValue as U, classifyOrganizationRefusal as V, createActiveOrganization as W, createNotAMemberRefusalNotice as X, createOrganizationBootstrapGate as Y, decideLinkOrganization as Z, isNotAMemberRefusal as _, getSession as a, linkOrganizationNotAMemberMessage as a0, linkOrganizationOfferMessage as a1, linkOrganizationSwitchAnnouncement as a2, memoryHeldOrganization as a3, oldestMembership as a4, orderOrganizations as a5, organizationMatches as a6, readAccountOrganizationChoices as a7, readLinkOrganizationParam as a8, readMemberships as a9, readOrganizationFavourites as aa, resolveActiveOrganization as ab, resolveActiveOrganizationLazily as ac, resolveAdminSeat as ad, resolveChildOrganizationId as ae, resolveOrganizationWithLink as af, setOrganizationFavourite as ag, storageHeldOrganization as ah, toAccountOrganizationChoices as ai, writeLastActiveOrganization as aj, writeStartupOrganization as ak, signInWithPassword as b, signOut as c, type AccountOrganizationChoices as d, type ActiveOrganization as e, type ActiveOrganizationSnapshot as f, getPerson as g, type ActiveOrganizationStatus as h, invalidatePerson as i, type AdminSeat as j, type AdminSeatInput as k, type ArchiveFilter as l, type CreateActiveOrganizationOptions as m, type LadderInput as n, onSessionChange as o, type LinkOrganizationDecision as p, type LinkOrganizationDecisionInput as q, refreshSession as r, signInWithOAuth as s, type LinkOrganizationMembership as t, updatePerson as u, type LinkOrganizationMessages as v, type LinkOrganizationParam as w, NoActiveOrganizationError as x, NotAMemberError as y, type NotAMemberRefusalNotice as z };

package/dist/{active-organization-B6s9ONIe.d.ts → active-organization-Djm9QJt8.d.ts}

@@ -68,41 +68,7 @@ declare function signInWithOAuth(client: AuthClient, options: {
 declare function signOut(client: AuthClient, scope?: "global" | "local" | "others"): Promise<void>;
 /** Change the signed-in person's email, phone, password or metadata. */
 declare function updatePerson(client: AuthClient, attributes: UserAttributes): Promise<User>;
-/** The slice of a client the session credential reads: its `auth`, when it has one. */
-interface SessionSourceLike {
-    auth?: {
-        getSession(): PromiseLike<{
-            data: {
-                session: {
-                    access_token: string;
-                } | null;
-            };
-        }>;
-        onAuthStateChange(cb: (event: string, session: unknown) => void): {
-            data: {
-                subscription: {
-                    unsubscribe(): void;
-                };
-            };
-        };
-    } | undefined;
-}
-/** The `user` credential port (structural; the shape `@ai-matrx/api`'s `CredentialsPort` takes). */
-interface UserCredentialsPort {
-    get(): Promise<{
-        kind: "user";
-        accessToken: string;
-    } | null>;
-    onChange?(cb: () => void): () => void;
-}
-/**
- * THE ONE session → credential mapping: the current access token as api's `user` credential,
- * re-read on every call (a refresh rotates it), with `onChange` on every session change.
- * A client with no `auth` is anonymous (null), never an error.
- */
-declare function sessionCredentials(client: SessionSourceLike): UserCredentialsPort;
-/** The session as `@ai-matrx/api`'s `user` credential — the name `@ai-matrx/data/auth` shipped. */
-declare const userCredentials: typeof sessionCredentials;
+
 /**
  * Refresh the session now (a long-lived script, a desktop app waking from sleep, a tab that was
  * frozen). Returns the new session; throws `SignInError` when the refresh token is refused.
@@ -653,4 +619,4 @@ declare function storageHeldOrganization(storage: Pick<Storage, "getItem" | "set
 declare function memoryHeldOrganization(): HeldOrganizationStore;
 declare function createActiveOrganization(options: CreateActiveOrganizationOptions): ActiveOrganization;
 
-export { createNotAMemberRefusalNotice as $, type AuthClient as A, NoActiveOrganizationError as B, type CachedActiveOrganization as C, NotAMemberError as D, type NotAMemberRefusalNotice as E, ORGANIZATION_ENTITY_TYPE as F, ORGANIZATION_RESOLUTION_TIMEOUT_MS as G, type HeldOrganizationStore as H, type OrganizationBootstrapGate as I, type OrganizationLapse as J, type OrganizationMembership as K, LINK_ORGANIZATION_QUERY_KEY as L, type OrganizationRefusal as M, NOT_A_MEMBER_RECHECK_GAP_MS as N, type OrganizationsDb as O, type OrganizationRung as P, type ParentOrganization as Q, type ReadMembershipsOptions as R, type SessionSourceLike as S, type ResolveWithLinkInput as T, type UserCredentialsPort as U, type ResolvedOrganization as V, type ResolvedWithLink as W, adminSeatReplacesUserContext as X, classifyLinkOrganizationValue as Y, classifyOrganizationRefusal as Z, createActiveOrganization as _, SignInError as a, createOrganizationBootstrapGate as a0, decideLinkOrganization as a1, isNotAMemberRefusal as a2, linkOrganizationMalformedMessage as a3, linkOrganizationNotAMemberMessage as a4, linkOrganizationOfferMessage as a5, linkOrganizationSwitchAnnouncement as a6, memoryHeldOrganization as a7, oldestMembership as a8, orderOrganizations as a9, organizationMatches as aa, readAccountOrganizationChoices as ab, readLinkOrganizationParam as ac, readMemberships as ad, readOrganizationFavourites as ae, resolveActiveOrganization as af, resolveActiveOrganizationLazily as ag, resolveAdminSeat as ah, resolveChildOrganizationId as ai, resolveOrganizationWithLink as aj, setOrganizationFavourite as ak, storageHeldOrganization as al, toAccountOrganizationChoices as am, writeLastActiveOrganization as an, writeStartupOrganization as ao, getSession as b, signInWithOAuth as c, signInWithPassword as d, signOut as e, userCredentials as f, getPerson as g, type AccountOrganizationChoices as h, invalidatePerson as i, type ActiveOrganization as j, type ActiveOrganizationSnapshot as k, type ActiveOrganizationStatus as l, type AdminSeat as m, type AdminSeatInput as n, onSessionChange as o, type ArchiveFilter as p, type CreateActiveOrganizationOptions as q, refreshSession as r, sessionCredentials as s, type LadderInput as t, updatePerson as u, type LinkOrganizationDecision as v, type LinkOrganizationDecisionInput as w, type LinkOrganizationMembership as x, type LinkOrganizationMessages as y, type LinkOrganizationParam as z };
+export { linkOrganizationMalformedMessage as $, type AuthClient as A, ORGANIZATION_ENTITY_TYPE as B, type CachedActiveOrganization as C, ORGANIZATION_RESOLUTION_TIMEOUT_MS as D, type OrganizationBootstrapGate as E, type OrganizationLapse as F, type OrganizationMembership as G, type HeldOrganizationStore as H, type OrganizationRefusal as I, type OrganizationRung as J, type ResolveWithLinkInput as K, LINK_ORGANIZATION_QUERY_KEY as L, type ResolvedOrganization as M, NOT_A_MEMBER_RECHECK_GAP_MS as N, type OrganizationsDb as O, type ParentOrganization as P, type ResolvedWithLink as Q, type ReadMembershipsOptions as R, SignInError as S, adminSeatReplacesUserContext as T, classifyLinkOrganizationValue as U, classifyOrganizationRefusal as V, createActiveOrganization as W, createNotAMemberRefusalNotice as X, createOrganizationBootstrapGate as Y, decideLinkOrganization as Z, isNotAMemberRefusal as _, getSession as a, linkOrganizationNotAMemberMessage as a0, linkOrganizationOfferMessage as a1, linkOrganizationSwitchAnnouncement as a2, memoryHeldOrganization as a3, oldestMembership as a4, orderOrganizations as a5, organizationMatches as a6, readAccountOrganizationChoices as a7, readLinkOrganizationParam as a8, readMemberships as a9, readOrganizationFavourites as aa, resolveActiveOrganization as ab, resolveActiveOrganizationLazily as ac, resolveAdminSeat as ad, resolveChildOrganizationId as ae, resolveOrganizationWithLink as af, setOrganizationFavourite as ag, storageHeldOrganization as ah, toAccountOrganizationChoices as ai, writeLastActiveOrganization as aj, writeStartupOrganization as ak, signInWithPassword as b, signOut as c, type AccountOrganizationChoices as d, type ActiveOrganization as e, type ActiveOrganizationSnapshot as f, getPerson as g, type ActiveOrganizationStatus as h, invalidatePerson as i, type AdminSeat as j, type AdminSeatInput as k, type ArchiveFilter as l, type CreateActiveOrganizationOptions as m, type LadderInput as n, onSessionChange as o, type LinkOrganizationDecision as p, type LinkOrganizationDecisionInput as q, refreshSession as r, signInWithOAuth as s, type LinkOrganizationMembership as t, updatePerson as u, type LinkOrganizationMessages as v, type LinkOrganizationParam as w, NoActiveOrganizationError as x, NotAMemberError as y, type NotAMemberRefusalNotice as z };

package/dist/claims.cjs

@@ -0,0 +1,188 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/claims.ts
+var claims_exports = {};
+__export(claims_exports, {
+  PROJECT_SIGNING_KEYS: () => PROJECT_SIGNING_KEYS,
+  PROJECT_SIGNING_KEY_AUTHORITIES: () => PROJECT_SIGNING_KEY_AUTHORITIES,
+  accountFlagsFor: () => accountFlagsFor,
+  confirmUnverifiableSession: () => confirmUnverifiableSession,
+  createClaimsCache: () => createClaimsCache,
+  getClaimsUser: () => getClaimsUser,
+  isAuthTransportFailure: () => isAuthTransportFailure,
+  isSignedOutError: () => isSignedOutError,
+  isUnverifiableTokenError: () => isUnverifiableTokenError,
+  isUnverifiableTokenRefusal: () => isUnverifiableTokenRefusal,
+  looksLikeJwt: () => looksLikeJwt,
+  pinnedSigningKeysFor: () => pinnedSigningKeysFor,
+  profileFromClaims: () => profileFromClaims,
+  userFromClaims: () => userFromClaims
+});
+module.exports = __toCommonJS(claims_exports);
+var import_supabase_js = require("@supabase/supabase-js");
+async function getClaimsUser(client, jwt, options) {
+  const { data, error } = options ? await client.auth.getClaims(jwt, options) : await client.auth.getClaims(jwt);
+  if (error) {
+    if (isSignedOutError(error)) return { data: { user: null }, error: null };
+    return { data: { user: null }, error };
+  }
+  if (!data?.claims) return { data: { user: null }, error: null };
+  const user = userFromClaims(data.claims);
+  if (!user) {
+    return {
+      data: { user: null },
+      error: new import_supabase_js.AuthError("Verified token carries no `sub` claim", 401, "bad_jwt")
+    };
+  }
+  return { data: { user }, error: null };
+}
+var BUDGET_EXHAUSTED_STATUS = 408;
+var BUDGET_EXHAUSTED_CODE = "auth_budget_exhausted";
+function isAuthTransportFailure(error) {
+  if (!error || typeof error !== "object") return false;
+  const name = String(error.name ?? "");
+  if (name === "AuthRetryableFetchError" || name === "TimeoutError" || name === "AbortError") return true;
+  const status = error.status;
+  if (status === 0 || status === 504 || status === 503) return true;
+  return status === BUDGET_EXHAUSTED_STATUS || error.code === BUDGET_EXHAUSTED_CODE;
+}
+function isSignedOutError(error) {
+  return error instanceof import_supabase_js.AuthSessionMissingError || error.name === "AuthSessionMissingError" || error.code === "session_not_found";
+}
+function userFromClaims(claims) {
+  if (!claims || typeof claims.sub !== "string") return null;
+  return {
+    ...claims,
+    id: claims.sub,
+    app_metadata: claims.app_metadata ?? {},
+    user_metadata: claims.user_metadata ?? {}
+  };
+}
+function looksLikeJwt(token) {
+  const parts = token.split(".");
+  if (parts.length !== 3) return false;
+  try {
+    for (const part of parts.slice(0, 2)) {
+      const normalized = part.replace(/-/g, "+").replace(/_/g, "/");
+      const binary = atob(normalized.padEnd(Math.ceil(normalized.length / 4) * 4, "="));
+      const bytes = Uint8Array.from(binary, (char) => char.charCodeAt(0));
+      JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+    }
+    return true;
+  } catch {
+    return false;
+  }
+}
+function profileFromClaims(claims) {
+  if (!claims) return null;
+  const text = (value) => typeof value === "string" && value.length > 0 ? value : null;
+  const id = text(claims["sub"]);
+  if (!id) return null;
+  const raw = claims["user_metadata"];
+  const meta = raw && typeof raw === "object" && !Array.isArray(raw) ? raw : {};
+  return {
+    id,
+    email: text(claims["email"]),
+    full_name: (typeof meta["full_name"] === "string" ? meta["full_name"] : null) ?? (typeof meta["name"] === "string" ? meta["name"] : null),
+    avatar_url: typeof meta["avatar_url"] === "string" ? meta["avatar_url"] : null,
+    ...typeof meta["email_verified"] === "boolean" && { email_verified: meta["email_verified"] }
+  };
+}
+function accountFlagsFor(claims) {
+  if (!claims) return { isGuest: false, hasAccount: false };
+  const isGuest = claims.is_anonymous === true;
+  return { isGuest, hasAccount: !isGuest };
+}
+var PROJECT_SIGNING_KEY_AUTHORITIES = [
+  "db.matrxserver.com",
+  "brsgrqvjdzwihsvnfqkf.supabase.co"
+];
+var PROJECT_SIGNING_KEYS = [
+  {
+    alg: "ES256",
+    crv: "P-256",
+    ext: true,
+    key_ops: ["verify"],
+    kid: "a00aed0b-202c-483a-91ff-fc74719a3bb2",
+    kty: "EC",
+    use: "sig",
+    x: "guqOsgjJqGVU6g_K0iIXKrzixlkeXKOqkPUQCconp6U",
+    y: "39zQtkzlfQuPf_MtIhYmMdxNQpIR2Pkl11AToywaslY"
+  }
+];
+function pinnedSigningKeysFor(supabaseUrl) {
+  if (!supabaseUrl) return [];
+  let host;
+  try {
+    host = new URL(supabaseUrl).host.toLowerCase();
+  } catch {
+    return [];
+  }
+  return PROJECT_SIGNING_KEY_AUTHORITIES.includes(host) ? PROJECT_SIGNING_KEYS : [];
+}
+function isUnverifiableTokenRefusal(result) {
+  if (result.status !== 401) return false;
+  if (result.error?.code !== "PGRST301") return false;
+  return !/expired/i.test(result.error?.message ?? "");
+}
+function isUnverifiableTokenError(error) {
+  if (!error) return false;
+  const name = String(error.name ?? "");
+  if (name === "AuthRetryableFetchError" || name === "TimeoutError" || name === "AbortError") return false;
+  if (name === "AuthSessionMissingError" || error.code === "session_not_found") return false;
+  const status = error.status;
+  if (status === 0 || status === 408 || status === 503 || status === 504) return false;
+  if (/expired/i.test(error.message ?? "")) return false;
+  return error.code === "bad_jwt" || name === "AuthInvalidJwtError";
+}
+async function confirmUnverifiableSession(auth, supabaseUrl) {
+  try {
+    const { error } = await auth.getClaims(void 0, { jwks: { keys: pinnedSigningKeysFor(supabaseUrl) } });
+    return isUnverifiableTokenError(error);
+  } catch {
+    return false;
+  }
+}
+function createClaimsCache(client, options) {
+  const ttl = options.ttlMs ?? 2e3;
+  let cached = null;
+  let inflight = null;
+  let listening = false;
+  return () => {
+    if (!listening) {
+      listening = true;
+      client.auth.onAuthStateChange((event) => {
+        if (event === "SIGNED_OUT" || event === "SIGNED_IN" || event === "TOKEN_REFRESHED" || event === "USER_UPDATED") {
+          cached = null;
+        }
+      });
+    }
+    if (cached && cached.expiresAt > Date.now()) return Promise.resolve(cached.value);
+    if (inflight) return inflight;
+    inflight = getClaimsUser(client, void 0, { jwks: { keys: pinnedSigningKeysFor(options.supabaseUrl) } }).then((result) => {
+      if (isUnverifiableTokenError(result.error)) options.onUnverifiable?.();
+      cached = { value: result, expiresAt: Date.now() + ttl };
+      return result;
+    }).finally(() => {
+      inflight = null;
+    });
+    return inflight;
+  };
+}

package/dist/{claims-Vno769TE.d.cts → claims.d.cts}

@@ -148,4 +148,4 @@ declare function createClaimsCache(client: ClaimsCapableClient & {
     };
 }, options: ClaimsCacheOptions): () => Promise<ClaimsResult>;
 
-export { type ApiClaimsUser as A, type ClaimsCapableClient as C, PROJECT_SIGNING_KEYS as P, type ClaimsCacheOptions as a, type ClaimsProfile as b, type ClaimsResult as c, PROJECT_SIGNING_KEY_AUTHORITIES as d, accountFlagsFor as e, confirmUnverifiableSession as f, createClaimsCache as g, getClaimsUser as h, isAuthTransportFailure as i, isSignedOutError as j, isUnverifiableTokenError as k, isUnverifiableTokenRefusal as l, looksLikeJwt as m, profileFromClaims as n, pinnedSigningKeysFor as p, userFromClaims as u };
+export { type ApiClaimsUser, type ClaimsCacheOptions, type ClaimsCapableClient, type ClaimsProfile, type ClaimsResult, PROJECT_SIGNING_KEYS, PROJECT_SIGNING_KEY_AUTHORITIES, accountFlagsFor, confirmUnverifiableSession, createClaimsCache, getClaimsUser, isAuthTransportFailure, isSignedOutError, isUnverifiableTokenError, isUnverifiableTokenRefusal, looksLikeJwt, pinnedSigningKeysFor, profileFromClaims, userFromClaims };

package/dist/{claims-Vno769TE.d.ts → claims.d.ts}

@@ -148,4 +148,4 @@ declare function createClaimsCache(client: ClaimsCapableClient & {
     };
 }, options: ClaimsCacheOptions): () => Promise<ClaimsResult>;
 
-export { type ApiClaimsUser as A, type ClaimsCapableClient as C, PROJECT_SIGNING_KEYS as P, type ClaimsCacheOptions as a, type ClaimsProfile as b, type ClaimsResult as c, PROJECT_SIGNING_KEY_AUTHORITIES as d, accountFlagsFor as e, confirmUnverifiableSession as f, createClaimsCache as g, getClaimsUser as h, isAuthTransportFailure as i, isSignedOutError as j, isUnverifiableTokenError as k, isUnverifiableTokenRefusal as l, looksLikeJwt as m, profileFromClaims as n, pinnedSigningKeysFor as p, userFromClaims as u };
+export { type ApiClaimsUser, type ClaimsCacheOptions, type ClaimsCapableClient, type ClaimsProfile, type ClaimsResult, PROJECT_SIGNING_KEYS, PROJECT_SIGNING_KEY_AUTHORITIES, accountFlagsFor, confirmUnverifiableSession, createClaimsCache, getClaimsUser, isAuthTransportFailure, isSignedOutError, isUnverifiableTokenError, isUnverifiableTokenRefusal, looksLikeJwt, pinnedSigningKeysFor, profileFromClaims, userFromClaims };

package/dist/claims.js

@@ -0,0 +1,170 @@
+// src/claims.ts
+import {
+  AuthError,
+  AuthSessionMissingError
+} from "@supabase/supabase-js";
+async function getClaimsUser(client, jwt, options) {
+  const { data, error } = options ? await client.auth.getClaims(jwt, options) : await client.auth.getClaims(jwt);
+  if (error) {
+    if (isSignedOutError(error)) return { data: { user: null }, error: null };
+    return { data: { user: null }, error };
+  }
+  if (!data?.claims) return { data: { user: null }, error: null };
+  const user = userFromClaims(data.claims);
+  if (!user) {
+    return {
+      data: { user: null },
+      error: new AuthError("Verified token carries no `sub` claim", 401, "bad_jwt")
+    };
+  }
+  return { data: { user }, error: null };
+}
+var BUDGET_EXHAUSTED_STATUS = 408;
+var BUDGET_EXHAUSTED_CODE = "auth_budget_exhausted";
+function isAuthTransportFailure(error) {
+  if (!error || typeof error !== "object") return false;
+  const name = String(error.name ?? "");
+  if (name === "AuthRetryableFetchError" || name === "TimeoutError" || name === "AbortError") return true;
+  const status = error.status;
+  if (status === 0 || status === 504 || status === 503) return true;
+  return status === BUDGET_EXHAUSTED_STATUS || error.code === BUDGET_EXHAUSTED_CODE;
+}
+function isSignedOutError(error) {
+  return error instanceof AuthSessionMissingError || error.name === "AuthSessionMissingError" || error.code === "session_not_found";
+}
+function userFromClaims(claims) {
+  if (!claims || typeof claims.sub !== "string") return null;
+  return {
+    ...claims,
+    id: claims.sub,
+    app_metadata: claims.app_metadata ?? {},
+    user_metadata: claims.user_metadata ?? {}
+  };
+}
+function looksLikeJwt(token) {
+  const parts = token.split(".");
+  if (parts.length !== 3) return false;
+  try {
+    for (const part of parts.slice(0, 2)) {
+      const normalized = part.replace(/-/g, "+").replace(/_/g, "/");
+      const binary = atob(normalized.padEnd(Math.ceil(normalized.length / 4) * 4, "="));
+      const bytes = Uint8Array.from(binary, (char) => char.charCodeAt(0));
+      JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+    }
+    return true;
+  } catch {
+    return false;
+  }
+}
+function profileFromClaims(claims) {
+  if (!claims) return null;
+  const text = (value) => typeof value === "string" && value.length > 0 ? value : null;
+  const id = text(claims["sub"]);
+  if (!id) return null;
+  const raw = claims["user_metadata"];
+  const meta = raw && typeof raw === "object" && !Array.isArray(raw) ? raw : {};
+  return {
+    id,
+    email: text(claims["email"]),
+    full_name: (typeof meta["full_name"] === "string" ? meta["full_name"] : null) ?? (typeof meta["name"] === "string" ? meta["name"] : null),
+    avatar_url: typeof meta["avatar_url"] === "string" ? meta["avatar_url"] : null,
+    ...typeof meta["email_verified"] === "boolean" && { email_verified: meta["email_verified"] }
+  };
+}
+function accountFlagsFor(claims) {
+  if (!claims) return { isGuest: false, hasAccount: false };
+  const isGuest = claims.is_anonymous === true;
+  return { isGuest, hasAccount: !isGuest };
+}
+var PROJECT_SIGNING_KEY_AUTHORITIES = [
+  "db.matrxserver.com",
+  "brsgrqvjdzwihsvnfqkf.supabase.co"
+];
+var PROJECT_SIGNING_KEYS = [
+  {
+    alg: "ES256",
+    crv: "P-256",
+    ext: true,
+    key_ops: ["verify"],
+    kid: "a00aed0b-202c-483a-91ff-fc74719a3bb2",
+    kty: "EC",
+    use: "sig",
+    x: "guqOsgjJqGVU6g_K0iIXKrzixlkeXKOqkPUQCconp6U",
+    y: "39zQtkzlfQuPf_MtIhYmMdxNQpIR2Pkl11AToywaslY"
+  }
+];
+function pinnedSigningKeysFor(supabaseUrl) {
+  if (!supabaseUrl) return [];
+  let host;
+  try {
+    host = new URL(supabaseUrl).host.toLowerCase();
+  } catch {
+    return [];
+  }
+  return PROJECT_SIGNING_KEY_AUTHORITIES.includes(host) ? PROJECT_SIGNING_KEYS : [];
+}
+function isUnverifiableTokenRefusal(result) {
+  if (result.status !== 401) return false;
+  if (result.error?.code !== "PGRST301") return false;
+  return !/expired/i.test(result.error?.message ?? "");
+}
+function isUnverifiableTokenError(error) {
+  if (!error) return false;
+  const name = String(error.name ?? "");
+  if (name === "AuthRetryableFetchError" || name === "TimeoutError" || name === "AbortError") return false;
+  if (name === "AuthSessionMissingError" || error.code === "session_not_found") return false;
+  const status = error.status;
+  if (status === 0 || status === 408 || status === 503 || status === 504) return false;
+  if (/expired/i.test(error.message ?? "")) return false;
+  return error.code === "bad_jwt" || name === "AuthInvalidJwtError";
+}
+async function confirmUnverifiableSession(auth, supabaseUrl) {
+  try {
+    const { error } = await auth.getClaims(void 0, { jwks: { keys: pinnedSigningKeysFor(supabaseUrl) } });
+    return isUnverifiableTokenError(error);
+  } catch {
+    return false;
+  }
+}
+function createClaimsCache(client, options) {
+  const ttl = options.ttlMs ?? 2e3;
+  let cached = null;
+  let inflight = null;
+  let listening = false;
+  return () => {
+    if (!listening) {
+      listening = true;
+      client.auth.onAuthStateChange((event) => {
+        if (event === "SIGNED_OUT" || event === "SIGNED_IN" || event === "TOKEN_REFRESHED" || event === "USER_UPDATED") {
+          cached = null;
+        }
+      });
+    }
+    if (cached && cached.expiresAt > Date.now()) return Promise.resolve(cached.value);
+    if (inflight) return inflight;
+    inflight = getClaimsUser(client, void 0, { jwks: { keys: pinnedSigningKeysFor(options.supabaseUrl) } }).then((result) => {
+      if (isUnverifiableTokenError(result.error)) options.onUnverifiable?.();
+      cached = { value: result, expiresAt: Date.now() + ttl };
+      return result;
+    }).finally(() => {
+      inflight = null;
+    });
+    return inflight;
+  };
+}
+export {
+  PROJECT_SIGNING_KEYS,
+  PROJECT_SIGNING_KEY_AUTHORITIES,
+  accountFlagsFor,
+  confirmUnverifiableSession,
+  createClaimsCache,
+  getClaimsUser,
+  isAuthTransportFailure,
+  isSignedOutError,
+  isUnverifiableTokenError,
+  isUnverifiableTokenRefusal,
+  looksLikeJwt,
+  pinnedSigningKeysFor,
+  profileFromClaims,
+  userFromClaims
+};

package/dist/credentials.cjs

@@ -23,9 +23,31 @@ __export(credentials_exports, {
   API_KEY_PREFIX: () => API_KEY_PREFIX,
   MATRX_HEADERS: () => MATRX_HEADERS,
   credentialToHeaders: () => credentialToHeaders,
-  toCredentialsPort: () => toCredentialsPort
+  sessionCredentials: () => sessionCredentials,
+  toCredentialsPort: () => toCredentialsPort,
+  userCredentials: () => userCredentials
 });
 module.exports = __toCommonJS(credentials_exports);
+
+// src/session-credentials.ts
+function sessionCredentials(client) {
+  return {
+    async get() {
+      if (!client.auth) return null;
+      const { data } = await client.auth.getSession();
+      return data.session ? { kind: "user", accessToken: data.session.access_token } : null;
+    },
+    onChange(cb) {
+      if (!client.auth) return () => {
+      };
+      const { data } = client.auth.onAuthStateChange(() => cb());
+      return () => data.subscription.unsubscribe();
+    }
+  };
+}
+var userCredentials = sessionCredentials;
+
+// src/credentials.ts
 var MATRX_HEADERS = {
   authorization: "Authorization",
   fingerprint: "X-Fingerprint-ID",

package/dist/credentials.d.cts

@@ -1,3 +1,39 @@
+/** The slice of a client the session credential reads: its `auth`, when it has one. */
+interface SessionSourceLike {
+    auth?: {
+        getSession(): PromiseLike<{
+            data: {
+                session: {
+                    access_token: string;
+                } | null;
+            };
+        }>;
+        onAuthStateChange(cb: (event: string, session: unknown) => void): {
+            data: {
+                subscription: {
+                    unsubscribe(): void;
+                };
+            };
+        };
+    } | undefined;
+}
+/** The `user` credential port (structural; the shape `@ai-matrx/api`'s `CredentialsPort` takes). */
+interface UserCredentialsPort {
+    get(): Promise<{
+        kind: "user";
+        accessToken: string;
+    } | null>;
+    onChange?(cb: () => void): () => void;
+}
+/**
+ * THE ONE session → credential mapping: the current access token as api's `user` credential,
+ * re-read on every call (a refresh rotates it), with `onChange` on every session change.
+ * A client with no `auth` is anonymous (null), never an error.
+ */
+declare function sessionCredentials(client: SessionSourceLike): UserCredentialsPort;
+/** The session as `@ai-matrx/api`'s `user` credential — the name `@ai-matrx/data/auth` shipped. */
+declare const userCredentials: typeof sessionCredentials;
+
 /**
  * The credentials port — the ONE credential→header mapping for every client
  * of every AI Matrx server (package lines v3 §3.4; API-key lane C16).
@@ -86,4 +122,4 @@ type CredentialsSetting = MatrxCredential | null | (() => MatrxCredential | null
 /** Normalize the ONE credentials setting into a `CredentialsPort`. */
 declare function toCredentialsPort(setting: CredentialsSetting | undefined): CredentialsPort;
 
-export { API_KEY_PREFIX, type CredentialsPort, type CredentialsSetting, MATRX_HEADERS, type MatrxCredential, type MatrxCredentialKind, credentialToHeaders, toCredentialsPort };
+export { API_KEY_PREFIX, type CredentialsPort, type CredentialsSetting, MATRX_HEADERS, type MatrxCredential, type MatrxCredentialKind, type SessionSourceLike, type UserCredentialsPort, credentialToHeaders, sessionCredentials, toCredentialsPort, userCredentials };

package/dist/credentials.d.ts

@@ -1,3 +1,39 @@
+/** The slice of a client the session credential reads: its `auth`, when it has one. */
+interface SessionSourceLike {
+    auth?: {
+        getSession(): PromiseLike<{
+            data: {
+                session: {
+                    access_token: string;
+                } | null;
+            };
+        }>;
+        onAuthStateChange(cb: (event: string, session: unknown) => void): {
+            data: {
+                subscription: {
+                    unsubscribe(): void;
+                };
+            };
+        };
+    } | undefined;
+}
+/** The `user` credential port (structural; the shape `@ai-matrx/api`'s `CredentialsPort` takes). */
+interface UserCredentialsPort {
+    get(): Promise<{
+        kind: "user";
+        accessToken: string;
+    } | null>;
+    onChange?(cb: () => void): () => void;
+}
+/**
+ * THE ONE session → credential mapping: the current access token as api's `user` credential,
+ * re-read on every call (a refresh rotates it), with `onChange` on every session change.
+ * A client with no `auth` is anonymous (null), never an error.
+ */
+declare function sessionCredentials(client: SessionSourceLike): UserCredentialsPort;
+/** The session as `@ai-matrx/api`'s `user` credential — the name `@ai-matrx/data/auth` shipped. */
+declare const userCredentials: typeof sessionCredentials;
+
 /**
  * The credentials port — the ONE credential→header mapping for every client
  * of every AI Matrx server (package lines v3 §3.4; API-key lane C16).
@@ -86,4 +122,4 @@ type CredentialsSetting = MatrxCredential | null | (() => MatrxCredential | null
 /** Normalize the ONE credentials setting into a `CredentialsPort`. */
 declare function toCredentialsPort(setting: CredentialsSetting | undefined): CredentialsPort;
 
-export { API_KEY_PREFIX, type CredentialsPort, type CredentialsSetting, MATRX_HEADERS, type MatrxCredential, type MatrxCredentialKind, credentialToHeaders, toCredentialsPort };
+export { API_KEY_PREFIX, type CredentialsPort, type CredentialsSetting, MATRX_HEADERS, type MatrxCredential, type MatrxCredentialKind, type SessionSourceLike, type UserCredentialsPort, credentialToHeaders, sessionCredentials, toCredentialsPort, userCredentials };

package/dist/credentials.js

@@ -1,3 +1,21 @@
+// src/session-credentials.ts
+function sessionCredentials(client) {
+  return {
+    async get() {
+      if (!client.auth) return null;
+      const { data } = await client.auth.getSession();
+      return data.session ? { kind: "user", accessToken: data.session.access_token } : null;
+    },
+    onChange(cb) {
+      if (!client.auth) return () => {
+      };
+      const { data } = client.auth.onAuthStateChange(() => cb());
+      return () => data.subscription.unsubscribe();
+    }
+  };
+}
+var userCredentials = sessionCredentials;
+
 // src/credentials.ts
 var MATRX_HEADERS = {
   authorization: "Authorization",
@@ -43,5 +61,7 @@ export {
   API_KEY_PREFIX,
   MATRX_HEADERS,
   credentialToHeaders,
-  toCredentialsPort
+  sessionCredentials,
+  toCredentialsPort,
+  userCredentials
 };

package/dist/index.cjs

@@ -64,6 +64,24 @@ __export(src_exports, {
 });
 module.exports = __toCommonJS(src_exports);
 
+// src/session-credentials.ts
+function sessionCredentials(client) {
+  return {
+    async get() {
+      if (!client.auth) return null;
+      const { data } = await client.auth.getSession();
+      return data.session ? { kind: "user", accessToken: data.session.access_token } : null;
+    },
+    onChange(cb) {
+      if (!client.auth) return () => {
+      };
+      const { data } = client.auth.onAuthStateChange(() => cb());
+      return () => data.subscription.unsubscribe();
+    }
+  };
+}
+var userCredentials = sessionCredentials;
+
 // src/claims.ts
 var import_supabase_js = require("@supabase/supabase-js");
 async function getClaimsUser(client, jwt, options) {
@@ -543,22 +561,6 @@ async function updatePerson(client, attributes) {
   invalidatePerson(client);
   return check("updatePerson", data, error).user;
 }
-function sessionCredentials(client) {
-  return {
-    async get() {
-      if (!client.auth) return null;
-      const { data } = await client.auth.getSession();
-      return data.session ? { kind: "user", accessToken: data.session.access_token } : null;
-    },
-    onChange(cb) {
-      if (!client.auth) return () => {
-      };
-      const { data } = client.auth.onAuthStateChange(() => cb());
-      return () => data.subscription.unsubscribe();
-    }
-  };
-}
-var userCredentials = sessionCredentials;
 async function refreshSession(client) {
   const { data, error } = await client.auth.refreshSession();
   const ok = check("refreshSession", data, error);

package/dist/index.d.cts

@@ -1,11 +1,11 @@
-import { H as HeldOrganizationStore, A as AuthClient } from './active-organization-B6s9ONIe.cjs';
-export { S as SessionSourceLike, a as SignInError, U as UserCredentialsPort, g as getPerson, b as getSession, i as invalidatePerson, o as onSessionChange, r as refreshSession, s as sessionCredentials, c as signInWithOAuth, d as signInWithPassword, e as signOut, u as updatePerson, f as userCredentials } from './active-organization-B6s9ONIe.cjs';
+import { H as HeldOrganizationStore, A as AuthClient } from './active-organization-Djm9QJt8.cjs';
+export { S as SignInError, g as getPerson, a as getSession, i as invalidatePerson, o as onSessionChange, r as refreshSession, s as signInWithOAuth, b as signInWithPassword, c as signOut, u as updatePerson } from './active-organization-Djm9QJt8.cjs';
 import { S as SessionStorage, M as MatrxOAuthClient } from './matrx-oauth-_Ji8X5Wm.cjs';
 export { C as ChromeStorageAreaLike, a as StorageUnavailableError, b as browserStorage, e as extensionStorage, k as keyValueStorage, m as memoryStorage } from './matrx-oauth-_Ji8X5Wm.cjs';
 import { SupabaseClient, User } from '@supabase/supabase-js';
 export { AuthChangeEvent, Session, User, UserAttributes } from '@supabase/supabase-js';
-export { CredentialsPort, MatrxCredential, MatrxCredentialKind } from './credentials.cjs';
-export { A as ApiClaimsUser, a as ClaimsCacheOptions, C as ClaimsCapableClient, b as ClaimsProfile, c as ClaimsResult, P as PROJECT_SIGNING_KEYS, d as PROJECT_SIGNING_KEY_AUTHORITIES, e as accountFlagsFor, f as confirmUnverifiableSession, g as createClaimsCache, h as getClaimsUser, i as isAuthTransportFailure, j as isSignedOutError, k as isUnverifiableTokenError, l as isUnverifiableTokenRefusal, m as looksLikeJwt, p as pinnedSigningKeysFor, n as profileFromClaims, u as userFromClaims } from './claims-Vno769TE.cjs';
+export { CredentialsPort, MatrxCredential, MatrxCredentialKind, SessionSourceLike, UserCredentialsPort, sessionCredentials, userCredentials } from './credentials.cjs';
+export { ApiClaimsUser, ClaimsCacheOptions, ClaimsCapableClient, ClaimsProfile, ClaimsResult, PROJECT_SIGNING_KEYS, PROJECT_SIGNING_KEY_AUTHORITIES, accountFlagsFor, confirmUnverifiableSession, createClaimsCache, getClaimsUser, isAuthTransportFailure, isSignedOutError, isUnverifiableTokenError, isUnverifiableTokenRefusal, looksLikeJwt, pinnedSigningKeysFor, profileFromClaims, userFromClaims } from './claims.cjs';
 
 /** How long a request may wait for the first auth report before going anyway. */
 declare const SESSION_ATTACH_BUDGET_MS = 3000;

package/dist/index.d.ts

@@ -1,11 +1,11 @@
-import { H as HeldOrganizationStore, A as AuthClient } from './active-organization-B6s9ONIe.js';
-export { S as SessionSourceLike, a as SignInError, U as UserCredentialsPort, g as getPerson, b as getSession, i as invalidatePerson, o as onSessionChange, r as refreshSession, s as sessionCredentials, c as signInWithOAuth, d as signInWithPassword, e as signOut, u as updatePerson, f as userCredentials } from './active-organization-B6s9ONIe.js';
+import { H as HeldOrganizationStore, A as AuthClient } from './active-organization-Djm9QJt8.js';
+export { S as SignInError, g as getPerson, a as getSession, i as invalidatePerson, o as onSessionChange, r as refreshSession, s as signInWithOAuth, b as signInWithPassword, c as signOut, u as updatePerson } from './active-organization-Djm9QJt8.js';
 import { S as SessionStorage, M as MatrxOAuthClient } from './matrx-oauth-_Ji8X5Wm.js';
 export { C as ChromeStorageAreaLike, a as StorageUnavailableError, b as browserStorage, e as extensionStorage, k as keyValueStorage, m as memoryStorage } from './matrx-oauth-_Ji8X5Wm.js';
 import { SupabaseClient, User } from '@supabase/supabase-js';
 export { AuthChangeEvent, Session, User, UserAttributes } from '@supabase/supabase-js';
-export { CredentialsPort, MatrxCredential, MatrxCredentialKind } from './credentials.js';
-export { A as ApiClaimsUser, a as ClaimsCacheOptions, C as ClaimsCapableClient, b as ClaimsProfile, c as ClaimsResult, P as PROJECT_SIGNING_KEYS, d as PROJECT_SIGNING_KEY_AUTHORITIES, e as accountFlagsFor, f as confirmUnverifiableSession, g as createClaimsCache, h as getClaimsUser, i as isAuthTransportFailure, j as isSignedOutError, k as isUnverifiableTokenError, l as isUnverifiableTokenRefusal, m as looksLikeJwt, p as pinnedSigningKeysFor, n as profileFromClaims, u as userFromClaims } from './claims-Vno769TE.js';
+export { CredentialsPort, MatrxCredential, MatrxCredentialKind, SessionSourceLike, UserCredentialsPort, sessionCredentials, userCredentials } from './credentials.js';
+export { ApiClaimsUser, ClaimsCacheOptions, ClaimsCapableClient, ClaimsProfile, ClaimsResult, PROJECT_SIGNING_KEYS, PROJECT_SIGNING_KEY_AUTHORITIES, accountFlagsFor, confirmUnverifiableSession, createClaimsCache, getClaimsUser, isAuthTransportFailure, isSignedOutError, isUnverifiableTokenError, isUnverifiableTokenRefusal, looksLikeJwt, pinnedSigningKeysFor, profileFromClaims, userFromClaims } from './claims.js';
 
 /** How long a request may wait for the first auth report before going anyway. */
 declare const SESSION_ATTACH_BUDGET_MS = 3000;

package/dist/index.js

@@ -1,3 +1,21 @@
+// src/session-credentials.ts
+function sessionCredentials(client) {
+  return {
+    async get() {
+      if (!client.auth) return null;
+      const { data } = await client.auth.getSession();
+      return data.session ? { kind: "user", accessToken: data.session.access_token } : null;
+    },
+    onChange(cb) {
+      if (!client.auth) return () => {
+      };
+      const { data } = client.auth.onAuthStateChange(() => cb());
+      return () => data.subscription.unsubscribe();
+    }
+  };
+}
+var userCredentials = sessionCredentials;
+
 // src/claims.ts
 import {
   AuthError,
@@ -480,22 +498,6 @@ async function updatePerson(client, attributes) {
   invalidatePerson(client);
   return check("updatePerson", data, error).user;
 }
-function sessionCredentials(client) {
-  return {
-    async get() {
-      if (!client.auth) return null;
-      const { data } = await client.auth.getSession();
-      return data.session ? { kind: "user", accessToken: data.session.access_token } : null;
-    },
-    onChange(cb) {
-      if (!client.auth) return () => {
-      };
-      const { data } = client.auth.onAuthStateChange(() => cb());
-      return () => data.subscription.unsubscribe();
-    }
-  };
-}
-var userCredentials = sessionCredentials;
 async function refreshSession(client) {
   const { data, error } = await client.auth.refreshSession();
   const ok = check("refreshSession", data, error);

package/dist/next.d.cts

@@ -3,7 +3,7 @@ import { DatabaseLike, NextBrowserClient } from './browser.cjs';
 import { b as AuthCookieValue, A as AuthCookie, a as AuthCookieOptions } from './auth-cookie-QPVLJJwP.cjs';
 export { C as CreateAuthCookieArgs, M as MATRX_AUTH_COOKIE, c as createAuthCookie } from './auth-cookie-QPVLJJwP.cjs';
 import { SupabaseClient } from '@supabase/supabase-js';
-import { C as ClaimsCapableClient, A as ApiClaimsUser } from './claims-Vno769TE.cjs';
+import { ClaimsCapableClient, ApiClaimsUser } from './claims.cjs';
 
 /**
  * @ai-matrx/data/next — the Next.js Supabase binding.

package/dist/next.d.ts

@@ -3,7 +3,7 @@ import { DatabaseLike, NextBrowserClient } from './browser.js';
 import { b as AuthCookieValue, A as AuthCookie, a as AuthCookieOptions } from './auth-cookie-QPVLJJwP.js';
 export { C as CreateAuthCookieArgs, M as MATRX_AUTH_COOKIE, c as createAuthCookie } from './auth-cookie-QPVLJJwP.js';
 import { SupabaseClient } from '@supabase/supabase-js';
-import { C as ClaimsCapableClient, A as ApiClaimsUser } from './claims-Vno769TE.js';
+import { ClaimsCapableClient, ApiClaimsUser } from './claims.js';
 
 /**
  * @ai-matrx/data/next — the Next.js Supabase binding.

package/dist/organizations.d.cts

@@ -1,5 +1,5 @@
-import { O as OrganizationsDb } from './active-organization-B6s9ONIe.cjs';
-export { h as AccountOrganizationChoices, j as ActiveOrganization, k as ActiveOrganizationSnapshot, l as ActiveOrganizationStatus, m as AdminSeat, n as AdminSeatInput, p as ArchiveFilter, C as CachedActiveOrganization, q as CreateActiveOrganizationOptions, H as HeldOrganizationStore, L as LINK_ORGANIZATION_QUERY_KEY, t as LadderInput, v as LinkOrganizationDecision, w as LinkOrganizationDecisionInput, x as LinkOrganizationMembership, y as LinkOrganizationMessages, z as LinkOrganizationParam, N as NOT_A_MEMBER_RECHECK_GAP_MS, B as NoActiveOrganizationError, D as NotAMemberError, E as NotAMemberRefusalNotice, F as ORGANIZATION_ENTITY_TYPE, G as ORGANIZATION_RESOLUTION_TIMEOUT_MS, I as OrganizationBootstrapGate, J as OrganizationLapse, K as OrganizationMembership, M as OrganizationRefusal, P as OrganizationRung, Q as ParentOrganization, R as ReadMembershipsOptions, T as ResolveWithLinkInput, V as ResolvedOrganization, W as ResolvedWithLink, X as adminSeatReplacesUserContext, Y as classifyLinkOrganizationValue, Z as classifyOrganizationRefusal, _ as createActiveOrganization, $ as createNotAMemberRefusalNotice, a0 as createOrganizationBootstrapGate, a1 as decideLinkOrganization, a2 as isNotAMemberRefusal, a3 as linkOrganizationMalformedMessage, a4 as linkOrganizationNotAMemberMessage, a5 as linkOrganizationOfferMessage, a6 as linkOrganizationSwitchAnnouncement, a7 as memoryHeldOrganization, a8 as oldestMembership, a9 as orderOrganizations, aa as organizationMatches, ab as readAccountOrganizationChoices, ac as readLinkOrganizationParam, ad as readMemberships, ae as readOrganizationFavourites, af as resolveActiveOrganization, ag as resolveActiveOrganizationLazily, ah as resolveAdminSeat, ai as resolveChildOrganizationId, aj as resolveOrganizationWithLink, ak as setOrganizationFavourite, al as storageHeldOrganization, am as toAccountOrganizationChoices, an as writeLastActiveOrganization, ao as writeStartupOrganization } from './active-organization-B6s9ONIe.cjs';
+import { O as OrganizationsDb } from './active-organization-Djm9QJt8.cjs';
+export { d as AccountOrganizationChoices, e as ActiveOrganization, f as ActiveOrganizationSnapshot, h as ActiveOrganizationStatus, j as AdminSeat, k as AdminSeatInput, l as ArchiveFilter, C as CachedActiveOrganization, m as CreateActiveOrganizationOptions, H as HeldOrganizationStore, L as LINK_ORGANIZATION_QUERY_KEY, n as LadderInput, p as LinkOrganizationDecision, q as LinkOrganizationDecisionInput, t as LinkOrganizationMembership, v as LinkOrganizationMessages, w as LinkOrganizationParam, N as NOT_A_MEMBER_RECHECK_GAP_MS, x as NoActiveOrganizationError, y as NotAMemberError, z as NotAMemberRefusalNotice, B as ORGANIZATION_ENTITY_TYPE, D as ORGANIZATION_RESOLUTION_TIMEOUT_MS, E as OrganizationBootstrapGate, F as OrganizationLapse, G as OrganizationMembership, I as OrganizationRefusal, J as OrganizationRung, P as ParentOrganization, R as ReadMembershipsOptions, K as ResolveWithLinkInput, M as ResolvedOrganization, Q as ResolvedWithLink, T as adminSeatReplacesUserContext, U as classifyLinkOrganizationValue, V as classifyOrganizationRefusal, W as createActiveOrganization, X as createNotAMemberRefusalNotice, Y as createOrganizationBootstrapGate, Z as decideLinkOrganization, _ as isNotAMemberRefusal, $ as linkOrganizationMalformedMessage, a0 as linkOrganizationNotAMemberMessage, a1 as linkOrganizationOfferMessage, a2 as linkOrganizationSwitchAnnouncement, a3 as memoryHeldOrganization, a4 as oldestMembership, a5 as orderOrganizations, a6 as organizationMatches, a7 as readAccountOrganizationChoices, a8 as readLinkOrganizationParam, a9 as readMemberships, aa as readOrganizationFavourites, ab as resolveActiveOrganization, ac as resolveActiveOrganizationLazily, ad as resolveAdminSeat, ae as resolveChildOrganizationId, af as resolveOrganizationWithLink, ag as setOrganizationFavourite, ah as storageHeldOrganization, ai as toAccountOrganizationChoices, aj as writeLastActiveOrganization, ak as writeStartupOrganization } from './active-organization-Djm9QJt8.cjs';
 import '@supabase/supabase-js';
 
 /**

package/dist/organizations.d.ts

@@ -1,5 +1,5 @@
-import { O as OrganizationsDb } from './active-organization-B6s9ONIe.js';
-export { h as AccountOrganizationChoices, j as ActiveOrganization, k as ActiveOrganizationSnapshot, l as ActiveOrganizationStatus, m as AdminSeat, n as AdminSeatInput, p as ArchiveFilter, C as CachedActiveOrganization, q as CreateActiveOrganizationOptions, H as HeldOrganizationStore, L as LINK_ORGANIZATION_QUERY_KEY, t as LadderInput, v as LinkOrganizationDecision, w as LinkOrganizationDecisionInput, x as LinkOrganizationMembership, y as LinkOrganizationMessages, z as LinkOrganizationParam, N as NOT_A_MEMBER_RECHECK_GAP_MS, B as NoActiveOrganizationError, D as NotAMemberError, E as NotAMemberRefusalNotice, F as ORGANIZATION_ENTITY_TYPE, G as ORGANIZATION_RESOLUTION_TIMEOUT_MS, I as OrganizationBootstrapGate, J as OrganizationLapse, K as OrganizationMembership, M as OrganizationRefusal, P as OrganizationRung, Q as ParentOrganization, R as ReadMembershipsOptions, T as ResolveWithLinkInput, V as ResolvedOrganization, W as ResolvedWithLink, X as adminSeatReplacesUserContext, Y as classifyLinkOrganizationValue, Z as classifyOrganizationRefusal, _ as createActiveOrganization, $ as createNotAMemberRefusalNotice, a0 as createOrganizationBootstrapGate, a1 as decideLinkOrganization, a2 as isNotAMemberRefusal, a3 as linkOrganizationMalformedMessage, a4 as linkOrganizationNotAMemberMessage, a5 as linkOrganizationOfferMessage, a6 as linkOrganizationSwitchAnnouncement, a7 as memoryHeldOrganization, a8 as oldestMembership, a9 as orderOrganizations, aa as organizationMatches, ab as readAccountOrganizationChoices, ac as readLinkOrganizationParam, ad as readMemberships, ae as readOrganizationFavourites, af as resolveActiveOrganization, ag as resolveActiveOrganizationLazily, ah as resolveAdminSeat, ai as resolveChildOrganizationId, aj as resolveOrganizationWithLink, ak as setOrganizationFavourite, al as storageHeldOrganization, am as toAccountOrganizationChoices, an as writeLastActiveOrganization, ao as writeStartupOrganization } from './active-organization-B6s9ONIe.js';
+import { O as OrganizationsDb } from './active-organization-Djm9QJt8.js';
+export { d as AccountOrganizationChoices, e as ActiveOrganization, f as ActiveOrganizationSnapshot, h as ActiveOrganizationStatus, j as AdminSeat, k as AdminSeatInput, l as ArchiveFilter, C as CachedActiveOrganization, m as CreateActiveOrganizationOptions, H as HeldOrganizationStore, L as LINK_ORGANIZATION_QUERY_KEY, n as LadderInput, p as LinkOrganizationDecision, q as LinkOrganizationDecisionInput, t as LinkOrganizationMembership, v as LinkOrganizationMessages, w as LinkOrganizationParam, N as NOT_A_MEMBER_RECHECK_GAP_MS, x as NoActiveOrganizationError, y as NotAMemberError, z as NotAMemberRefusalNotice, B as ORGANIZATION_ENTITY_TYPE, D as ORGANIZATION_RESOLUTION_TIMEOUT_MS, E as OrganizationBootstrapGate, F as OrganizationLapse, G as OrganizationMembership, I as OrganizationRefusal, J as OrganizationRung, P as ParentOrganization, R as ReadMembershipsOptions, K as ResolveWithLinkInput, M as ResolvedOrganization, Q as ResolvedWithLink, T as adminSeatReplacesUserContext, U as classifyLinkOrganizationValue, V as classifyOrganizationRefusal, W as createActiveOrganization, X as createNotAMemberRefusalNotice, Y as createOrganizationBootstrapGate, Z as decideLinkOrganization, _ as isNotAMemberRefusal, $ as linkOrganizationMalformedMessage, a0 as linkOrganizationNotAMemberMessage, a1 as linkOrganizationOfferMessage, a2 as linkOrganizationSwitchAnnouncement, a3 as memoryHeldOrganization, a4 as oldestMembership, a5 as orderOrganizations, a6 as organizationMatches, a7 as readAccountOrganizationChoices, a8 as readLinkOrganizationParam, a9 as readMemberships, aa as readOrganizationFavourites, ab as resolveActiveOrganization, ac as resolveActiveOrganizationLazily, ad as resolveAdminSeat, ae as resolveChildOrganizationId, af as resolveOrganizationWithLink, ag as setOrganizationFavourite, ah as storageHeldOrganization, ai as toAccountOrganizationChoices, aj as writeLastActiveOrganization, ak as writeStartupOrganization } from './active-organization-Djm9QJt8.js';
 import '@supabase/supabase-js';
 
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-matrx/auth",
-  "version": "0.3.7",
+  "version": "0.3.8",
   "description": "AI Matrx sign-in, session and organizations for every app: sign in/out, session storage and refresh per platform (browser, Next.js, extension, desktop, Node), the current person, their organizations and favourites, the one active organization (held requests, never a list filter), and the credentials @ai-matrx/data and @ai-matrx/api read.",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -62,6 +62,16 @@
         "default": "./dist/credentials.cjs"
       }
     },
+    "./claims": {
+      "import": {
+        "types": "./dist/claims.d.ts",
+        "default": "./dist/claims.js"
+      },
+      "require": {
+        "types": "./dist/claims.d.cts",
+        "default": "./dist/claims.cjs"
+      }
+    },
     "./session-identity": {
       "import": {
         "types": "./dist/session-identity.d.ts",
@@ -221,5 +231,5 @@
     "test": "vitest run",
     "verify:tarball": "node ./scripts/verify-tarball.mjs"
   },
-  "gitHead": "02e0da320427a864e9ac16d9296ba86ff08599af"
+  "gitHead": "b887d4308f04cff5b70036c6f94054e51598bb56"
 }