@baliola/auth-sdk 0.2.0 → 0.4.0

package/CHANGELOG.md

@@ -2,6 +2,16 @@
 
 All notable changes to `@baliola/auth-sdk` are documented here.
 
+## 0.4.0
+
+- feat(sdk): add `auth.getProfile()` → `GET /profile`. Returns `{ account, profile }` where `account` carries the **live** account status (read from the database, not the token) and `profile` is the account's profile record (`displayName`, `avatarUrl`, `primaryEmail`, `primaryPhone`) or `null` when none exists yet. New exported types: `Profile`, `ProfileResult`.
+- Server-side context: baliola-auth is re-scoped to a pure identity provider. The `/modules`, `/api-keys/*`, and `/admin/api-keys/*` endpoints are removed (metering/billing move to the Baliola Console backend), and the `GET /profile` response no longer carries `moduleAccess`. The SDK never called any of those endpoints, so there are no SDK-side removals.
+
+## 0.3.0
+
+- feat(sdk): add the custodial wallet namespace — `auth.wallet.getAddress()` (`GET /auth/wallet`, provisioned on first read) and `auth.wallet.signHash(hash)` (`POST /auth/wallet/sign`).
+- feat(sdk): add `createRemoteSigner` under the `./wallet` subpath — a viem-compatible account whose `signMessage({ raw })` delegates to `POST /auth/wallet/sign`, so the custodial private key never leaves baliola-auth.
+
 ## 0.2.0
 
 Distribution change and clean-ups; no method-level API changes.

package/README.md

@@ -95,6 +95,30 @@ auth.emailPassword.changePassword({ currentPassword, newPassword });
 auth.google.login({ idToken }); // → AuthSession
 ```
 
+### Custodial wallet (smart-account signer)
+
+```ts
+import { createAuthClient } from '@baliola/auth-sdk';
+import { createRemoteSigner } from '@baliola/auth-sdk/wallet';
+import { toSmartAccount } from '@baliola/smart-account-sdk';
+
+const auth = createAuthClient({ baseUrl });
+await auth.emailOtp.verifyLoginCode({ email, code }); // authenticated session
+
+const owner = await createRemoteSigner(auth);          // viem LocalAccount, signs server-side
+const account = await toSmartAccount({ owner, chain: 'macTestnet' });
+```
+
+The private key never leaves baliola-auth; `owner.signMessage({ raw })` calls `POST /auth/wallet/sign`.
+
+### Profile (identity read)
+
+```ts
+const { account, profile } = await auth.getProfile(); // GET /profile (authenticated)
+// account = { id, email, status }   — status is live, not a token-time snapshot
+// profile = { displayName, avatarUrl, primaryEmail, primaryPhone } | null
+```
+
 ### Session lifecycle
 
 ```ts

package/dist/client/index.d.ts

@@ -1,2 +1,2 @@
-import { a as GoogleNamespace, c as createAuthClient, i as EmailPasswordNamespace, l as AuthFetchInit, n as CreateAuthClientOptions, o as ProactiveRefreshConfig, r as EmailOtpNamespace, s as SubscribeOptions, t as AuthClient } from "../index-G-gqveGn.js";
-export { AuthClient, AuthFetchInit, CreateAuthClientOptions, EmailOtpNamespace, EmailPasswordNamespace, GoogleNamespace, ProactiveRefreshConfig, SubscribeOptions, createAuthClient };
+import { a as GoogleNamespace, c as WalletNamespace, f as AuthFetchInit, i as EmailPasswordNamespace, l as createAuthClient, n as CreateAuthClientOptions, o as ProactiveRefreshConfig, r as EmailOtpNamespace, s as SubscribeOptions, t as AuthClient } from "../index-B2RuGLX_.js";
+export { AuthClient, AuthFetchInit, CreateAuthClientOptions, EmailOtpNamespace, EmailPasswordNamespace, GoogleNamespace, ProactiveRefreshConfig, SubscribeOptions, WalletNamespace, createAuthClient };

package/dist/client/index.js

@@ -1,2 +1,2 @@
-import { t as createAuthClient } from "../client-BcyoQ5Cj.js";
+import { t as createAuthClient } from "../client-CX3XFmOA.js";
 export { createAuthClient };

package/dist/{client-BcyoQ5Cj.js → client-CX3XFmOA.js}

@@ -135,6 +135,28 @@ function createMethods(ctx) {
 				body: withClientId({ idToken: input.idToken })
 			}));
 		},
+		async getWalletAddress() {
+			return ctx.transport.request({
+				path: "/auth/wallet",
+				method: "GET",
+				authMode: "bearer+session"
+			});
+		},
+		async signWalletHash(hash) {
+			return ctx.transport.request({
+				path: "/auth/wallet/sign",
+				method: "POST",
+				authMode: "bearer+session",
+				body: { hash }
+			});
+		},
+		async getProfile() {
+			return ctx.transport.request({
+				path: "/profile",
+				method: "GET",
+				authMode: "bearer+session"
+			});
+		},
 		async logoutRequest() {
 			await ctx.transport.request({
 				path: "/auth/logout",
@@ -460,6 +482,11 @@ function createAuthClient(options) {
 			await setSession(session);
 			return session;
 		} },
+		wallet: {
+			getAddress: async () => (await methods.getWalletAddress()).address,
+			signHash: async (hash) => (await methods.signWalletHash(hash)).signature
+		},
+		getProfile: () => methods.getProfile(),
 		async refresh() {
 			return transport.refreshSession();
 		},

package/dist/{index-G-gqveGn.d.ts → index-B2RuGLX_.d.ts}

@@ -1,4 +1,4 @@
-import { c as ResendCodeResult, l as SendLoginCodeResult, n as AuthSession, r as ErrorHandler, s as RegisterResult, u as SessionChangeHandler } from "./session-Cs_P7ojF.js";
+import { c as ResendCodeResult, l as SendLoginCodeResult, n as AuthSession, r as ErrorHandler, s as RegisterResult, t as Account, u as SessionChangeHandler } from "./session-Cs_P7ojF.js";
 import { n as SessionStore } from "./sessionStore-BDdEpbL8.js";
 import { a as RegisterInput, c as SendLoginCodeInput, d as VerifyRegistrationCodeInput, i as LoginWithPasswordInput, l as SetPasswordInput, n as ChangePasswordInput, o as ResendLoginCodeInput, r as LoginWithGoogleInput, s as ResendRegistrationCodeInput, u as VerifyLoginCodeInput } from "./requests-eTORIjY5.js";
 
@@ -26,6 +26,20 @@ type AuthFetchInit = RequestInit & {
   disableRefresh?: boolean;
 };
 //#endregion
+//#region src/types/profile.d.ts
+/** The account's profile record; every field is user-editable and nullable. */
+type Profile = {
+  displayName: string | null;
+  avatarUrl: string | null;
+  primaryEmail: string | null;
+  primaryPhone: string | null;
+};
+/** Result of `auth.getProfile` — identity read for the token holder. */
+type ProfileResult = {
+  /** `status` is the live account status, not a token-time snapshot. */account: Account; /** `null` when the account has no profile row yet. */
+  profile: Profile | null;
+};
+//#endregion
 //#region src/client/index.d.ts
 type ProactiveRefreshConfig = false | {
   /** Refresh proactively if `expiresAt - now < leadTimeMs`. Defaults to 60_000 (60s). */leadTimeMs?: number;
@@ -119,10 +133,23 @@ type EmailPasswordNamespace = {
 type GoogleNamespace = {
   login(input: LoginWithGoogleInput): Promise<AuthSession>;
 };
+/** Custodial wallet (Console tier). */
+type WalletNamespace = {
+  /** The account's custodial EOA address (provisioned on first read). */getAddress(): Promise<string>; /** Sign a 32-byte userOp hash; returns a 65-byte recoverable signature. */
+  signHash(hash: string): Promise<string>;
+};
 type AuthClient = {
   emailOtp: EmailOtpNamespace;
   emailPassword: EmailPasswordNamespace;
   google: GoogleNamespace;
+  wallet: WalletNamespace;
+  /**
+   * Fetch the token holder's identity: account (id, email, live status) plus
+   * its profile record (`profile: null` when none exists yet).
+   *
+   * @throws AuthError on 401 (missing/expired session) and other API errors.
+   */
+  getProfile(): Promise<ProfileResult>;
   refresh(): Promise<AuthSession>;
   logout(): Promise<void>;
   getSession(): AuthSession | null;
@@ -139,4 +166,4 @@ type AuthClient = {
 };
 declare function createAuthClient(options: CreateAuthClientOptions): AuthClient;
 //#endregion
-export { GoogleNamespace as a, createAuthClient as c, EmailPasswordNamespace as i, AuthFetchInit as l, CreateAuthClientOptions as n, ProactiveRefreshConfig as o, EmailOtpNamespace as r, SubscribeOptions as s, AuthClient as t };
+export { GoogleNamespace as a, WalletNamespace as c, ProfileResult as d, AuthFetchInit as f, EmailPasswordNamespace as i, createAuthClient as l, CreateAuthClientOptions as n, ProactiveRefreshConfig as o, EmailOtpNamespace as r, SubscribeOptions as s, AuthClient as t, Profile as u };

package/dist/index.d.ts

@@ -1,7 +1,19 @@
 import { a as OtpInfo, c as ResendCodeResult, i as ErrorSource, l as SendLoginCodeResult, n as AuthSession, o as Project, r as ErrorHandler, s as RegisterResult, t as Account, u as SessionChangeHandler } from "./session-Cs_P7ojF.js";
-import { a as GoogleNamespace, c as createAuthClient, i as EmailPasswordNamespace, l as AuthFetchInit, n as CreateAuthClientOptions, o as ProactiveRefreshConfig, r as EmailOtpNamespace, s as SubscribeOptions, t as AuthClient } from "./index-G-gqveGn.js";
+import { a as GoogleNamespace, c as WalletNamespace, d as ProfileResult, f as AuthFetchInit, i as EmailPasswordNamespace, l as createAuthClient, n as CreateAuthClientOptions, o as ProactiveRefreshConfig, r as EmailOtpNamespace, s as SubscribeOptions, t as AuthClient, u as Profile } from "./index-B2RuGLX_.js";
 import { i as memoryStore, n as SessionStore, r as localStorageStore, t as LocalStorageStoreOptions } from "./sessionStore-BDdEpbL8.js";
 import { a as RegisterInput, c as SendLoginCodeInput, d as VerifyRegistrationCodeInput, i as LoginWithPasswordInput, l as SetPasswordInput, n as ChangePasswordInput, o as ResendLoginCodeInput, r as LoginWithGoogleInput, s as ResendRegistrationCodeInput, t as CaptchaArgs, u as VerifyLoginCodeInput } from "./requests-eTORIjY5.js";
 import { _ as authErrorFromFetchFailure, a as EmailAlreadyHasPasswordError, c as InvalidPasswordError, d as NoPasswordSetError, f as NoPendingOtpError, g as ResendCooldownError, h as RateLimitedError, i as CaptchaFailedError, l as MaxAttemptsError, m as OtpInvalidError, n as AuthError, o as InvalidCredentialsError, p as OtpExpiredError, r as AuthErrorInit, s as InvalidEmailError, t as AccountSuspendedError, u as MaxResendsError, v as authErrorFromResponse } from "./authError-C5g5jP5l.js";
 import { n as AccessTokenPayloadProject, t as AccessTokenPayload } from "./tokens-BXrPLi5B.js";
-export { type AccessTokenPayload, type AccessTokenPayloadProject, type Account, AccountSuspendedError, type AuthClient, AuthError, type AuthErrorInit, type AuthFetchInit, type AuthSession, type CaptchaArgs, CaptchaFailedError, type ChangePasswordInput, type CreateAuthClientOptions, EmailAlreadyHasPasswordError, type EmailOtpNamespace, type EmailPasswordNamespace, type ErrorHandler, type ErrorSource, type GoogleNamespace, InvalidCredentialsError, InvalidEmailError, InvalidPasswordError, type LocalStorageStoreOptions, type LoginWithGoogleInput, type LoginWithPasswordInput, MaxAttemptsError, MaxResendsError, NoPasswordSetError, NoPendingOtpError, OtpExpiredError, type OtpInfo, OtpInvalidError, type ProactiveRefreshConfig, type Project, RateLimitedError, type RegisterInput, type RegisterResult, type ResendCodeResult, ResendCooldownError, type ResendLoginCodeInput, type ResendRegistrationCodeInput, type SendLoginCodeInput, type SendLoginCodeResult, type SessionChangeHandler, type SessionStore, type SetPasswordInput, type SubscribeOptions, type VerifyLoginCodeInput, type VerifyRegistrationCodeInput, authErrorFromFetchFailure, authErrorFromResponse, createAuthClient, localStorageStore, memoryStore };
+
+//#region src/types/wallet.d.ts
+type WalletAddressResult = {
+  address: string;
+  isActive: boolean;
+  createdAt: string;
+};
+type SignHashResult = {
+  signature: string;
+  address: string;
+};
+//#endregion
+export { type AccessTokenPayload, type AccessTokenPayloadProject, type Account, AccountSuspendedError, type AuthClient, AuthError, type AuthErrorInit, type AuthFetchInit, type AuthSession, type CaptchaArgs, CaptchaFailedError, type ChangePasswordInput, type CreateAuthClientOptions, EmailAlreadyHasPasswordError, type EmailOtpNamespace, type EmailPasswordNamespace, type ErrorHandler, type ErrorSource, type GoogleNamespace, InvalidCredentialsError, InvalidEmailError, InvalidPasswordError, type LocalStorageStoreOptions, type LoginWithGoogleInput, type LoginWithPasswordInput, MaxAttemptsError, MaxResendsError, NoPasswordSetError, NoPendingOtpError, OtpExpiredError, type OtpInfo, OtpInvalidError, type ProactiveRefreshConfig, type Profile, type ProfileResult, type Project, RateLimitedError, type RegisterInput, type RegisterResult, type ResendCodeResult, ResendCooldownError, type ResendLoginCodeInput, type ResendRegistrationCodeInput, type SendLoginCodeInput, type SendLoginCodeResult, type SessionChangeHandler, type SessionStore, type SetPasswordInput, type SignHashResult, type SubscribeOptions, type VerifyLoginCodeInput, type VerifyRegistrationCodeInput, type WalletAddressResult, type WalletNamespace, authErrorFromFetchFailure, authErrorFromResponse, createAuthClient, localStorageStore, memoryStore };

package/dist/index.js

@@ -1,4 +1,4 @@
-import { t as createAuthClient } from "./client-BcyoQ5Cj.js";
+import { t as createAuthClient } from "./client-CX3XFmOA.js";
 import { _ as authErrorFromResponse, a as InvalidCredentialsError, c as MaxAttemptsError, d as NoPendingOtpError, f as OtpExpiredError, g as authErrorFromFetchFailure, h as ResendCooldownError, i as EmailAlreadyHasPasswordError, l as MaxResendsError, m as RateLimitedError, n as AuthError, o as InvalidEmailError, p as OtpInvalidError, r as CaptchaFailedError, s as InvalidPasswordError, t as AccountSuspendedError, u as NoPasswordSetError } from "./authError-DbEZJnC4.js";
 import { n as memoryStore, t as localStorageStore } from "./sessionStore-DD6lON9W.js";
 export { AccountSuspendedError, AuthError, CaptchaFailedError, EmailAlreadyHasPasswordError, InvalidCredentialsError, InvalidEmailError, InvalidPasswordError, MaxAttemptsError, MaxResendsError, NoPasswordSetError, NoPendingOtpError, OtpExpiredError, OtpInvalidError, RateLimitedError, ResendCooldownError, authErrorFromFetchFailure, authErrorFromResponse, createAuthClient, localStorageStore, memoryStore };

package/dist/wallet/index.d.ts

@@ -0,0 +1,19 @@
+import { t as AuthClient } from "../index-B2RuGLX_.js";
+import { LocalAccount } from "viem";
+
+//#region src/wallet/index.d.ts
+/** The account's custodial wallet address. */
+declare function getAddress(auth: AuthClient): Promise<string>;
+/**
+ * Build a viem `LocalAccount` backed by the server-side custodial signer. Drop
+ * it into the smart-account SDK as `toSmartAccount({ owner })`. Only
+ * `signMessage` is supported — the smart-account SDK signs userOps via
+ * `signMessage({ raw })`; `signTransaction`/`signTypedData` are not custodial
+ * operations and throw.
+ *
+ * @param auth An authenticated AuthClient.
+ * @returns A viem LocalAccount whose signing is performed by baliola-auth.
+ */
+declare function createRemoteSigner(auth: AuthClient): Promise<LocalAccount>;
+//#endregion
+export { createRemoteSigner, getAddress };

package/dist/wallet/index.js

@@ -0,0 +1,34 @@
+import { toAccount } from "viem/accounts";
+//#region src/wallet/index.ts
+/** The account's custodial wallet address. */
+async function getAddress(auth) {
+	return auth.wallet.getAddress();
+}
+/**
+* Build a viem `LocalAccount` backed by the server-side custodial signer. Drop
+* it into the smart-account SDK as `toSmartAccount({ owner })`. Only
+* `signMessage` is supported — the smart-account SDK signs userOps via
+* `signMessage({ raw })`; `signTransaction`/`signTypedData` are not custodial
+* operations and throw.
+*
+* @param auth An authenticated AuthClient.
+* @returns A viem LocalAccount whose signing is performed by baliola-auth.
+*/
+async function createRemoteSigner(auth) {
+	return toAccount({
+		address: await auth.wallet.getAddress(),
+		async signMessage({ message }) {
+			const raw = typeof message === "object" && message !== null && "raw" in message ? message.raw : message;
+			const hash = typeof raw === "string" ? raw : `0x${Buffer.from(raw).toString("hex")}`;
+			return await auth.wallet.signHash(hash);
+		},
+		async signTransaction() {
+			throw new Error("baliola remote signer: signTransaction is not supported");
+		},
+		async signTypedData() {
+			throw new Error("baliola remote signer: signTypedData is not supported");
+		}
+	});
+}
+//#endregion
+export { createRemoteSigner, getAddress };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@baliola/auth-sdk",
-  "version": "0.2.0",
+  "version": "0.4.0",
   "description": "Client SDK for Baliola Auth",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Baliola Development Team",
@@ -29,6 +29,10 @@
     "./types": {
       "types": "./dist/types/index.d.ts",
       "import": "./dist/types/index.js"
+    },
+    "./wallet": {
+      "types": "./dist/wallet/index.d.ts",
+      "import": "./dist/wallet/index.js"
     }
   },
   "files": [
@@ -48,13 +52,15 @@
   },
   "scripts": {
     "build": "tsdown",
-    "typecheck": "tsc --noEmit",
+    "typecheck": "bash scripts/typecheck.sh",
     "test": "bun test test/unit",
     "prepublishOnly": "bun run build"
   },
+  "peerDependencies": { "viem": "^2.47.6" },
   "devDependencies": {
     "@types/bun": "latest",
     "tsdown": "^0.21.10",
-    "typescript": "^5.7.0"
+    "typescript": "^5.7.0",
+    "viem": "^2.47.6"
   }
 }