@baliola/auth-sdk 0.2.0 → 0.4.1

package/CHANGELOG.md

@@ -2,14 +2,42 @@
 
 All notable changes to `@baliola/auth-sdk` are documented here.
 
+## 0.4.1
+
+- chore(sdk): internal cleanup, no public API change. Removed dead code (the
+  unused `bearer-only-passthrough` auth-header mode, the throw-only
+  `refreshResponseShape` type helper, and the redundant `stripUndefined` body
+  helper, since the transport already drops `undefined` keys via
+  `JSON.stringify`), narrowed the internal request method union to the verbs
+  actually used (GET / POST), and deduplicated internal wire types against the
+  public `RegisterResult` / `ResendCodeResult`.
+- chore(packaging): `viem` is now declared an **optional** peer dependency
+  (`peerDependenciesMeta`). It is only needed by the `./wallet` subpath, so
+  consumers who never import a wallet no longer have it auto-installed by npm 7+
+  and no longer see a missing-peer warning. Wallet users must install `viem`
+  themselves, which the wallet setup already required.
+- Repo: this package moved out of the `baliola-auth` backend monorepo into its
+  own repository at `baliola/baliola-auth-sdk`. Package name, npm scope, and
+  every import path are unchanged.
+
+## 0.4.0
+
+- feat(sdk): add `auth.getProfile()` → `GET /profile`. Returns `{ account, profile }` where `account` carries the **live** account status (read from the database, not the token) and `profile` is the account's profile record (`displayName`, `avatarUrl`, `primaryEmail`, `primaryPhone`) or `null` when none exists yet. New exported types: `Profile`, `ProfileResult`.
+- Server-side context: baliola-auth is re-scoped to a pure identity provider. The `/modules`, `/api-keys/*`, and `/admin/api-keys/*` endpoints are removed (metering/billing move to the Baliola Console backend), and the `GET /profile` response no longer carries `moduleAccess`. The SDK never called any of those endpoints, so there are no SDK-side removals.
+
+## 0.3.0
+
+- feat(sdk): add the custodial wallet namespace: `auth.wallet.getAddress()` (`GET /auth/wallet`, provisioned on first read) and `auth.wallet.signHash(hash)` (`POST /auth/wallet/sign`).
+- feat(sdk): add `createRemoteSigner` under the `./wallet` subpath, a viem-compatible account whose `signMessage({ raw })` delegates to `POST /auth/wallet/sign`, so the custodial private key never leaves baliola-auth.
+
 ## 0.2.0
 
 Distribution change and clean-ups; no method-level API changes.
 
-- chore(release): publish to **public npm** (`https://registry.npmjs.org`) instead of GitHub Packages. Installing no longer requires a Personal Access Token, an `.npmrc` registry override, or SSO authorization — plain `bun add @baliola/auth-sdk` works in every environment.
+- chore(release): publish to **public npm** (`https://registry.npmjs.org`) instead of GitHub Packages. Installing no longer requires a Personal Access Token, an `.npmrc` registry override, or SSO authorization. Plain `bun add @baliola/auth-sdk` works in every environment.
 - docs: rewrite `README.md`, `docs/install.md`, `docs/ciSetup.md`, and `docs/troubleshooting.md` to reflect public-npm install. CI snippets no longer need build secrets.
 - Consumers previously installing from GitHub Packages should remove any `@baliola:registry=https://npm.pkg.github.com` entries from `~/.npmrc` and project-local `.npmrc` files before upgrading.
-- fix(types): realign `AccessTokenPayload` with the server's current JWT shape. The flat `projectId?: string | null` / `projectName?: string | null` pair is replaced by `projects: AccessTokenPayloadProject[]` (each entry carries `{ id, name, clientId }`). Type-only change — affects consumers that decode the JWT manually and reference this type. A scoped login (`clientId` supplied) yields a single-entry array; a central login yields every project the account has active roles in.
+- fix(types): realign `AccessTokenPayload` with the server's current JWT shape. The flat `projectId?: string | null` / `projectName?: string | null` pair is replaced by `projects: AccessTokenPayloadProject[]` (each entry carries `{ id, name, clientId }`). Type-only change, affecting consumers that decode the JWT manually and reference this type. A scoped login (`clientId` supplied) yields a single-entry array; a central login yields every project the account has active roles in.
 - chore!: remove the `./internal` subpath export and the `internal/` source folder (`createValidateCache`, `newIdempotencyKey`, `consumeHeaders`). Those helpers targeted the retired `/internal/api-keys/*` endpoints and the static "internal token" concept. Service-to-service callers now authenticate with an admin-tier API key (`baliola_admin_…`) against `/admin/api-keys/*`; cache + idempotency helpers for that surface will ship in a dedicated admin SDK.
 
 ## 0.1.0
@@ -18,7 +46,7 @@ Breaking redesign of the auth API and SDK surface to eliminate dev confusion bet
 
 ### Breaking changes
 
-- feat(sdk)!: replace the flat method surface with namespaced flows — `auth.emailOtp.*`, `auth.emailPassword.*`, `auth.google.*`. The namespaces match the DB provider names (`email_otp`, `email_password`).
+- feat(sdk)!: replace the flat method surface with namespaced flows: `auth.emailOtp.*`, `auth.emailPassword.*`, `auth.google.*`. The namespaces match the DB provider names (`email_otp`, `email_password`).
 - feat(sdk)!: rename verb-overloaded methods so each one's purpose is unambiguous at the call site:
   - `auth.requestEmailOtp` → `auth.emailOtp.sendLoginCode`
   - `auth.verifyEmailOtp` → `auth.emailOtp.verifyLoginCode`
@@ -29,14 +57,14 @@ Breaking redesign of the auth API and SDK surface to eliminate dev confusion bet
   - `auth.changePassword` → `auth.emailPassword.changePassword`
   - `auth.loginWithGoogle` → `auth.google.login`
 - feat(sdk)!: verify-code methods take `{ email, code }` instead of `{ email, otp }`.
-- feat(sdk)!: `auth.emailPassword.register` no longer branches on `'otp_sent' | 'linked'` — it always sends a verification OTP and returns `{ otp: OtpInfo }`. The single-step "linked" path is removed.
-- feat(sdk)!: send/resend/register success responses replace `expiresInMinutes` with a structured `OtpInfo` payload — `expiresInSeconds`, `expiresAt`, `canResendInSeconds`, `resendsRemaining`.
+- feat(sdk)!: `auth.emailPassword.register` no longer branches on `'otp_sent' | 'linked'`. It always sends a verification OTP and returns `{ otp: OtpInfo }`. The single-step "linked" path is removed.
+- feat(sdk)!: send/resend/register success responses replace `expiresInMinutes` with a structured `OtpInfo` payload: `expiresInSeconds`, `expiresAt`, `canResendInSeconds`, `resendsRemaining`.
 - feat(sdk)!: backend endpoint paths renamed to match the namespaces: `POST /auth/email-otp/send-login-code`, `/auth/email-otp/verify-login-code`, `/auth/email-otp/resend-login-code`, `/auth/email-password/register`, `/auth/email-password/verify-registration-code`, `/auth/email-password/resend-registration-code`, etc.
 
 ### New features
 
-- feat(sdk): add typed error subclasses under `AuthError` — `OtpInvalidError` (with `attemptsRemaining`, `canResendInSeconds`), `OtpExpiredError`, `MaxAttemptsError` (with `retryAfterSeconds`), `NoPendingOtpError`, `ResendCooldownError` (with `canResendInSeconds`), `MaxResendsError`, `InvalidCredentialsError`, `NoPasswordSetError`, `AccountSuspendedError`, `EmailAlreadyHasPasswordError`, `CaptchaFailedError`, `RateLimitedError` (with `retryAfterSeconds`, `retryAfterHuman`), `InvalidPasswordError` (with `reason`), `InvalidEmailError`. Branch on `instanceof` for TS narrowing, or `err.code` for stable string matching. Backend responses now carry the structured context fields via `error.details` so the SDK lifts them into the typed properties.
-- feat(sdk): add dedicated resend methods — `auth.emailOtp.resendLoginCode` and `auth.emailPassword.resendRegistrationCode`. Each enforces its own resend cooldown (`OTP_RESEND_COOLDOWN_SECONDS`, default 60s) and per-OTP cap (`OTP_MAX_RESENDS`, default 3) on top of the per-OTP attempts limit.
+- feat(sdk): add typed error subclasses under `AuthError`: `OtpInvalidError` (with `attemptsRemaining`, `canResendInSeconds`), `OtpExpiredError`, `MaxAttemptsError` (with `retryAfterSeconds`), `NoPendingOtpError`, `ResendCooldownError` (with `canResendInSeconds`), `MaxResendsError`, `InvalidCredentialsError`, `NoPasswordSetError`, `AccountSuspendedError`, `EmailAlreadyHasPasswordError`, `CaptchaFailedError`, `RateLimitedError` (with `retryAfterSeconds`, `retryAfterHuman`), `InvalidPasswordError` (with `reason`), `InvalidEmailError`. Branch on `instanceof` for TS narrowing, or `err.code` for stable string matching. Backend responses now carry the structured context fields via `error.details` so the SDK lifts them into the typed properties.
+- feat(sdk): add dedicated resend methods: `auth.emailOtp.resendLoginCode` and `auth.emailPassword.resendRegistrationCode`. Each enforces its own resend cooldown (`OTP_RESEND_COOLDOWN_SECONDS`, default 60s) and per-OTP cap (`OTP_MAX_RESENDS`, default 3) on top of the per-OTP attempts limit.
 - feat(sdk): add `captchaToken` option on every public unauthenticated entrypoint (`sendLoginCode`, `resendLoginCode`, `register`, `resendRegistrationCode`, `login`). Backend verifies via Cloudflare Turnstile when `TURNSTILE_SECRET_KEY` is set; dev bypass when unset; server-to-server clients can be allowlisted via `CAPTCHA_BYPASS_CLIENT_IDS`.
 - feat(sdk): `auth.emailOtp.sendLoginCode` response includes `flow: 'login' | 'signup'` and `methods: ('password' | 'passwordless')[]` so the UI can adapt to the account state without an extra round-trip.
 
@@ -47,30 +75,29 @@ Breaking redesign of the auth API and SDK surface to eliminate dev confusion bet
 
 ## 0.0.5
 
-- feat(sdk): add cross-tab session sync via `BroadcastChannel` — when one tab logs in, logs out, or refreshes the access token, every other tab on the same origin updates its in-memory mirror in real time.
+- feat(sdk): add cross-tab session sync via `BroadcastChannel`. When one tab logs in, logs out, or refreshes the access token, every other tab on the same origin updates its in-memory mirror in real time.
 - feat(sdk): add `auth.fetch({ requireAuth: true })` per-call option that throws `AuthError(401)` before sending when no session is loaded.
 - feat(sdk): add `auth.fetch({ disableRefresh: true })` per-call option that skips both proactive and reactive refresh, letting a 401 propagate to the caller.
 
 ## 0.0.4
 
-- feat(sdk): add `changePassword({ currentPassword, newPassword })` paired with `POST /auth/email-password/change-password` server route — verifies the current password, rotates the bcrypt hash, revokes every other session for the account (caller stays signed in), and sends a confirmation email out-of-band.
+- feat(sdk): add `changePassword({ currentPassword, newPassword })` paired with `POST /auth/email-password/change-password` server route. It verifies the current password, rotates the bcrypt hash, revokes every other session for the account (caller stays signed in), and sends a confirmation email out-of-band.
 - chore(auth): relax password policy to require only 8+ characters and at least one uppercase letter (number and special-character requirements dropped).
 
 ## 0.0.3
 
-- chore(sdk): bump version to 0.0.3
-- feat(sdk): expose `Project.allowedOrigins` on `AuthSession`
+- feat(sdk): expose `Project.allowedOrigins` on `AuthSession`, so a consumer can read the origins a project accepts without a second call.
 
 ## 0.0.2
 
-- chore(sdk): bump version to 0.0.2
-- refactor(sdk): drop pre-release version labels from public JSDoc
-- docs(sdk): inline install in README and move roadmap to ROADMAP.md
-- docs(sdk): add user install, troubleshooting, and CI setup guides
-- docs(sdk): add README with usage and configuration reference
-- test(sdk): add unit tests for client, transport, and store
-- feat(sdk): implement auth client with auto-refresh, session mirror, and consumer fetch helper
+The first usable release. 0.0.1 published the package shell; this one puts a working client inside it.
+
+- feat(sdk): implement the auth client, with proactive and reactive access-token refresh, the in-memory session mirror, and the `auth.fetch` helper that attaches the access token for consumers.
+- refactor(sdk): drop pre-release version labels from public JSDoc, so published docs no longer advertise a version that moves every release.
+- docs(sdk): add the README API reference plus the install, troubleshooting, and CI setup guides, and move the roadmap out to `ROADMAP.md`.
 
 ## 0.0.1
 
-- feat(sdk): scaffold `@baliola/auth-sdk` package config
+- feat(sdk): scaffold the `@baliola/auth-sdk` package config. Package shell and build only, no client implementation yet.
+
+These 0.0.x releases went to GitHub Packages, not public npm. 0.2.0 moved distribution to public npm, and nothing below 0.2.0 is installable from the public registry.

package/README.md

@@ -2,7 +2,12 @@
 
 Client SDK for the Baliola Auth service. Two clearly separated email flows (passwordless OTP, password + verification OTP) plus Google login, with typed methods, typed errors, auto-refresh, and cross-tab sync.
 
-For deeper detail see [docs/concepts.md](./docs/concepts.md).
+Guides:
+
+- [docs/concepts.md](./docs/concepts.md): flows, session mirror, refresh, cross-tab sync, errors.
+- [docs/install.md](./docs/install.md): install and first call.
+- [docs/ciSetup.md](./docs/ciSetup.md): installing this SDK in your own pipeline.
+- [docs/troubleshooting.md](./docs/troubleshooting.md): install and build symptoms.
 
 ## Install
 
@@ -18,11 +23,14 @@ Published to public npm under the `@baliola` scope — no registry config or aut
 
 ## Quick start
 
+`AUTH_URL` below is the base URL of the Baliola Auth deployment you are targeting. It differs per
+environment. Baliola developers: the per-environment values are in the internal integration docs.
+
 ```ts
 import { createAuthClient, localStorageStore, OtpInvalidError } from '@baliola/auth-sdk';
 
 const auth = createAuthClient({
-  baseUrl: 'https://baliola-auth.baliola.dev',
+  baseUrl: AUTH_URL,
   clientId: 'your-project-client-id', // omit for a central multi-project login
   store: localStorageStore(), // omit for in-memory (server-side / tests)
 });
@@ -95,6 +103,30 @@ auth.emailPassword.changePassword({ currentPassword, newPassword });
 auth.google.login({ idToken }); // → AuthSession
 ```
 
+### Custodial wallet (smart-account signer)
+
+```ts
+import { createAuthClient } from '@baliola/auth-sdk';
+import { createRemoteSigner } from '@baliola/auth-sdk/wallet';
+import { toSmartAccount } from '@baliola/smart-account-sdk';
+
+const auth = createAuthClient({ baseUrl });
+await auth.emailOtp.verifyLoginCode({ email, code }); // authenticated session
+
+const owner = await createRemoteSigner(auth);          // viem LocalAccount, signs server-side
+const account = await toSmartAccount({ owner, chain: 'macTestnet' });
+```
+
+The private key never leaves baliola-auth; `owner.signMessage({ raw })` calls `POST /auth/wallet/sign`.
+
+### Profile (identity read)
+
+```ts
+const { account, profile } = await auth.getProfile(); // GET /profile (authenticated)
+// account = { id, email, status }   — status is live, not a token-time snapshot
+// profile = { displayName, avatarUrl, primaryEmail, primaryPhone } | null
+```
+
 ### Session lifecycle
 
 ```ts
@@ -210,7 +242,7 @@ Cross-tab sync (login / logout / refresh) is automatic via `BroadcastChannel`, r
 
 ```ts
 createAuthClient({
-  baseUrl: 'https://baliola-auth.baliola.dev', // required, no trailing slash
+  baseUrl: AUTH_URL, // required, no trailing slash
   clientId: 'your-project-client-id', // optional; scopes the session to one project. Omit for a central login that carries every project the account has active roles in.
   store: memoryStore(), // default; or localStorageStore() / custom
   fetch: globalThis.fetch, // override for tests / interceptors
@@ -239,6 +271,8 @@ if (session) {
 }
 ```
 
+`decodeJwt` reads claims without checking the signature, which is fine on the client where the token came from your own session. A service that trusts the token for authorization must verify it: the tokens are EdDSA (Ed25519), issuer `baliola-auth`, and the public keys are served at `GET /.well-known/jwks.json` on the same `baseUrl`.
+
 ## Sample response shapes
 
 **`auth.emailOtp.sendLoginCode` success:**
@@ -273,7 +307,7 @@ if (session) {
 
 ```json
 {
-  "accessToken": "eyJhbGciOiJIUzI1NiIs...",
+  "accessToken": "eyJhbGciOiJFZERTQSIs...",
   "refreshToken": "session-uuid",
   "expiresIn": 3600,
   "account": { "id": "...", "email": "user@example.com", "status": "active" },

package/dist/{authError-DbEZJnC4.js → authError-CYUAl2Jt.js}

@@ -32,6 +32,7 @@ var AuthError = class extends Error {
 		Object.setPrototypeOf(this, new.target.prototype);
 	}
 };
+/** Concrete subclasses with structured fields lifted from `details` */
 var OtpInvalidError = class extends AuthError {
 	attemptsRemaining;
 	canResendInSeconds;

package/dist/{authError-C5g5jP5l.d.ts → authError-DgPEjTfW.d.ts}

@@ -30,6 +30,7 @@ declare class AuthError extends Error {
   readonly cause?: unknown;
   constructor(init: AuthErrorInit);
 }
+/** Concrete subclasses with structured fields lifted from `details` */
 declare class OtpInvalidError extends AuthError {
   readonly attemptsRemaining: number;
   readonly canResendInSeconds: number;

package/dist/client/index.d.ts

@@ -1,2 +1,2 @@
-import { a as GoogleNamespace, c as createAuthClient, i as EmailPasswordNamespace, l as AuthFetchInit, n as CreateAuthClientOptions, o as ProactiveRefreshConfig, r as EmailOtpNamespace, s as SubscribeOptions, t as AuthClient } from "../index-G-gqveGn.js";
-export { AuthClient, AuthFetchInit, CreateAuthClientOptions, EmailOtpNamespace, EmailPasswordNamespace, GoogleNamespace, ProactiveRefreshConfig, SubscribeOptions, createAuthClient };
+import { a as GoogleNamespace, c as WalletNamespace, f as AuthFetchInit, i as EmailPasswordNamespace, l as createAuthClient, n as CreateAuthClientOptions, o as ProactiveRefreshConfig, r as EmailOtpNamespace, s as SubscribeOptions, t as AuthClient } from "../index-B2RuGLX_.js";
+export { AuthClient, AuthFetchInit, CreateAuthClientOptions, EmailOtpNamespace, EmailPasswordNamespace, GoogleNamespace, ProactiveRefreshConfig, SubscribeOptions, WalletNamespace, createAuthClient };

package/dist/client/index.js

@@ -1,2 +1,2 @@
-import { t as createAuthClient } from "../client-BcyoQ5Cj.js";
+import { t as createAuthClient } from "../client-DU_DerYi.js";
 export { createAuthClient };

package/dist/{client-BcyoQ5Cj.js → client-DU_DerYi.js}

@@ -1,4 +1,4 @@
-import { _ as authErrorFromResponse, g as authErrorFromFetchFailure, n as AuthError } from "./authError-DbEZJnC4.js";
+import { _ as authErrorFromResponse, g as authErrorFromFetchFailure, n as AuthError } from "./authError-CYUAl2Jt.js";
 import { n as memoryStore } from "./sessionStore-DD6lON9W.js";
 //#region src/client/methods.ts
 function toAuthSession(data) {
@@ -23,21 +23,17 @@ function createMethods(ctx) {
 			clientId: ctx.clientId
 		};
 	};
-	const stripUndefined = (body) => {
-		const out = {};
-		for (const [k, v] of Object.entries(body)) if (v !== void 0) out[k] = v;
-		return out;
-	};
 	return {
+		/** emailOtp.* (passwordless) */
 		async sendLoginCode(input) {
 			return ctx.transport.request({
 				path: "/auth/email-otp/send-login-code",
 				method: "POST",
 				authMode: "none",
-				body: stripUndefined(withClientId({
+				body: withClientId({
 					email: input.email,
 					captchaToken: input.captchaToken
-				}))
+				})
 			});
 		},
 		async verifyLoginCode(input) {
@@ -56,22 +52,23 @@ function createMethods(ctx) {
 				path: "/auth/email-otp/resend-login-code",
 				method: "POST",
 				authMode: "none",
-				body: stripUndefined(withClientId({
+				body: withClientId({
 					email: input.email,
 					captchaToken: input.captchaToken
-				}))
+				})
 			});
 		},
+		/** emailPassword.* (password flow) */
 		async register(input) {
 			return ctx.transport.request({
 				path: "/auth/email-password/register",
 				method: "POST",
 				authMode: "none",
-				body: stripUndefined(withClientId({
+				body: withClientId({
 					email: input.email,
 					password: input.password,
 					captchaToken: input.captchaToken
-				}))
+				})
 			});
 		},
 		async verifyRegistrationCode(input) {
@@ -90,10 +87,10 @@ function createMethods(ctx) {
 				path: "/auth/email-password/resend-registration-code",
 				method: "POST",
 				authMode: "none",
-				body: stripUndefined(withClientId({
+				body: withClientId({
 					email: input.email,
 					captchaToken: input.captchaToken
-				}))
+				})
 			});
 		},
 		async loginWithPassword(input) {
@@ -101,11 +98,11 @@ function createMethods(ctx) {
 				path: "/auth/email-password/login",
 				method: "POST",
 				authMode: "none",
-				body: stripUndefined(withClientId({
+				body: withClientId({
 					email: input.email,
 					password: input.password,
 					captchaToken: input.captchaToken
-				}))
+				})
 			}));
 		},
 		async setPassword(input) {
@@ -127,6 +124,7 @@ function createMethods(ctx) {
 				}
 			});
 		},
+		/** google.* */
 		async loginWithGoogle(input) {
 			return toAuthSession(await ctx.transport.request({
 				path: "/auth/google/login",
@@ -135,20 +133,37 @@ function createMethods(ctx) {
 				body: withClientId({ idToken: input.idToken })
 			}));
 		},
+		/** wallet.* */
+		async getWalletAddress() {
+			return ctx.transport.request({
+				path: "/auth/wallet",
+				method: "GET",
+				authMode: "bearer+session"
+			});
+		},
+		async signWalletHash(hash) {
+			return ctx.transport.request({
+				path: "/auth/wallet/sign",
+				method: "POST",
+				authMode: "bearer+session",
+				body: { hash }
+			});
+		},
+		/** profile */
+		async getProfile() {
+			return ctx.transport.request({
+				path: "/profile",
+				method: "GET",
+				authMode: "bearer+session"
+			});
+		},
+		/** session lifecycle */
 		async logoutRequest() {
 			await ctx.transport.request({
 				path: "/auth/logout",
 				method: "POST",
 				authMode: "bearer+session"
 			});
-		},
-		/**
-		* Type-only helper: declares the refresh response shape so consumers
-		* pulling the inferred Methods type don't break. Refresh itself is
-		* handled by transport.refreshSession() to keep stampede protection.
-		*/
-		refreshResponseShape() {
-			throw new Error("refreshResponseShape is a type-only helper");
 		}
 	};
 }
@@ -180,9 +195,6 @@ function createTransport(options) {
 			case "session-only":
 				headers.set("X-Session-ID", session.refreshToken);
 				break;
-			case "bearer-only-passthrough":
-				headers.set("Authorization", `Bearer ${session.accessToken}`);
-				break;
 			case "none": break;
 		}
 		return headers;
@@ -460,6 +472,11 @@ function createAuthClient(options) {
 			await setSession(session);
 			return session;
 		} },
+		wallet: {
+			getAddress: async () => (await methods.getWalletAddress()).address,
+			signHash: async (hash) => (await methods.signWalletHash(hash)).signature
+		},
+		getProfile: () => methods.getProfile(),
 		async refresh() {
 			return transport.refreshSession();
 		},

package/dist/errors/index.d.ts

@@ -1,2 +1,2 @@
-import { _ as authErrorFromFetchFailure, a as EmailAlreadyHasPasswordError, c as InvalidPasswordError, d as NoPasswordSetError, f as NoPendingOtpError, g as ResendCooldownError, h as RateLimitedError, i as CaptchaFailedError, l as MaxAttemptsError, m as OtpInvalidError, n as AuthError, o as InvalidCredentialsError, p as OtpExpiredError, r as AuthErrorInit, s as InvalidEmailError, t as AccountSuspendedError, u as MaxResendsError, v as authErrorFromResponse } from "../authError-C5g5jP5l.js";
+import { _ as authErrorFromFetchFailure, a as EmailAlreadyHasPasswordError, c as InvalidPasswordError, d as NoPasswordSetError, f as NoPendingOtpError, g as ResendCooldownError, h as RateLimitedError, i as CaptchaFailedError, l as MaxAttemptsError, m as OtpInvalidError, n as AuthError, o as InvalidCredentialsError, p as OtpExpiredError, r as AuthErrorInit, s as InvalidEmailError, t as AccountSuspendedError, u as MaxResendsError, v as authErrorFromResponse } from "../authError-DgPEjTfW.js";
 export { AccountSuspendedError, AuthError, type AuthErrorInit, CaptchaFailedError, EmailAlreadyHasPasswordError, InvalidCredentialsError, InvalidEmailError, InvalidPasswordError, MaxAttemptsError, MaxResendsError, NoPasswordSetError, NoPendingOtpError, OtpExpiredError, OtpInvalidError, RateLimitedError, ResendCooldownError, authErrorFromFetchFailure, authErrorFromResponse };

package/dist/errors/index.js

@@ -1,2 +1,2 @@
-import { _ as authErrorFromResponse, a as InvalidCredentialsError, c as MaxAttemptsError, d as NoPendingOtpError, f as OtpExpiredError, g as authErrorFromFetchFailure, h as ResendCooldownError, i as EmailAlreadyHasPasswordError, l as MaxResendsError, m as RateLimitedError, n as AuthError, o as InvalidEmailError, p as OtpInvalidError, r as CaptchaFailedError, s as InvalidPasswordError, t as AccountSuspendedError, u as NoPasswordSetError } from "../authError-DbEZJnC4.js";
+import { _ as authErrorFromResponse, a as InvalidCredentialsError, c as MaxAttemptsError, d as NoPendingOtpError, f as OtpExpiredError, g as authErrorFromFetchFailure, h as ResendCooldownError, i as EmailAlreadyHasPasswordError, l as MaxResendsError, m as RateLimitedError, n as AuthError, o as InvalidEmailError, p as OtpInvalidError, r as CaptchaFailedError, s as InvalidPasswordError, t as AccountSuspendedError, u as NoPasswordSetError } from "../authError-CYUAl2Jt.js";
 export { AccountSuspendedError, AuthError, CaptchaFailedError, EmailAlreadyHasPasswordError, InvalidCredentialsError, InvalidEmailError, InvalidPasswordError, MaxAttemptsError, MaxResendsError, NoPasswordSetError, NoPendingOtpError, OtpExpiredError, OtpInvalidError, RateLimitedError, ResendCooldownError, authErrorFromFetchFailure, authErrorFromResponse };

package/dist/{index-G-gqveGn.d.ts → index-B2RuGLX_.d.ts}

@@ -1,4 +1,4 @@
-import { c as ResendCodeResult, l as SendLoginCodeResult, n as AuthSession, r as ErrorHandler, s as RegisterResult, u as SessionChangeHandler } from "./session-Cs_P7ojF.js";
+import { c as ResendCodeResult, l as SendLoginCodeResult, n as AuthSession, r as ErrorHandler, s as RegisterResult, t as Account, u as SessionChangeHandler } from "./session-Cs_P7ojF.js";
 import { n as SessionStore } from "./sessionStore-BDdEpbL8.js";
 import { a as RegisterInput, c as SendLoginCodeInput, d as VerifyRegistrationCodeInput, i as LoginWithPasswordInput, l as SetPasswordInput, n as ChangePasswordInput, o as ResendLoginCodeInput, r as LoginWithGoogleInput, s as ResendRegistrationCodeInput, u as VerifyLoginCodeInput } from "./requests-eTORIjY5.js";
 
@@ -26,6 +26,20 @@ type AuthFetchInit = RequestInit & {
   disableRefresh?: boolean;
 };
 //#endregion
+//#region src/types/profile.d.ts
+/** The account's profile record; every field is user-editable and nullable. */
+type Profile = {
+  displayName: string | null;
+  avatarUrl: string | null;
+  primaryEmail: string | null;
+  primaryPhone: string | null;
+};
+/** Result of `auth.getProfile` — identity read for the token holder. */
+type ProfileResult = {
+  /** `status` is the live account status, not a token-time snapshot. */account: Account; /** `null` when the account has no profile row yet. */
+  profile: Profile | null;
+};
+//#endregion
 //#region src/client/index.d.ts
 type ProactiveRefreshConfig = false | {
   /** Refresh proactively if `expiresAt - now < leadTimeMs`. Defaults to 60_000 (60s). */leadTimeMs?: number;
@@ -119,10 +133,23 @@ type EmailPasswordNamespace = {
 type GoogleNamespace = {
   login(input: LoginWithGoogleInput): Promise<AuthSession>;
 };
+/** Custodial wallet (Console tier). */
+type WalletNamespace = {
+  /** The account's custodial EOA address (provisioned on first read). */getAddress(): Promise<string>; /** Sign a 32-byte userOp hash; returns a 65-byte recoverable signature. */
+  signHash(hash: string): Promise<string>;
+};
 type AuthClient = {
   emailOtp: EmailOtpNamespace;
   emailPassword: EmailPasswordNamespace;
   google: GoogleNamespace;
+  wallet: WalletNamespace;
+  /**
+   * Fetch the token holder's identity: account (id, email, live status) plus
+   * its profile record (`profile: null` when none exists yet).
+   *
+   * @throws AuthError on 401 (missing/expired session) and other API errors.
+   */
+  getProfile(): Promise<ProfileResult>;
   refresh(): Promise<AuthSession>;
   logout(): Promise<void>;
   getSession(): AuthSession | null;
@@ -139,4 +166,4 @@ type AuthClient = {
 };
 declare function createAuthClient(options: CreateAuthClientOptions): AuthClient;
 //#endregion
-export { GoogleNamespace as a, createAuthClient as c, EmailPasswordNamespace as i, AuthFetchInit as l, CreateAuthClientOptions as n, ProactiveRefreshConfig as o, EmailOtpNamespace as r, SubscribeOptions as s, AuthClient as t };
+export { GoogleNamespace as a, WalletNamespace as c, ProfileResult as d, AuthFetchInit as f, EmailPasswordNamespace as i, createAuthClient as l, CreateAuthClientOptions as n, ProactiveRefreshConfig as o, EmailOtpNamespace as r, SubscribeOptions as s, AuthClient as t, Profile as u };

package/dist/index.d.ts

@@ -1,7 +1,19 @@
 import { a as OtpInfo, c as ResendCodeResult, i as ErrorSource, l as SendLoginCodeResult, n as AuthSession, o as Project, r as ErrorHandler, s as RegisterResult, t as Account, u as SessionChangeHandler } from "./session-Cs_P7ojF.js";
-import { a as GoogleNamespace, c as createAuthClient, i as EmailPasswordNamespace, l as AuthFetchInit, n as CreateAuthClientOptions, o as ProactiveRefreshConfig, r as EmailOtpNamespace, s as SubscribeOptions, t as AuthClient } from "./index-G-gqveGn.js";
+import { a as GoogleNamespace, c as WalletNamespace, d as ProfileResult, f as AuthFetchInit, i as EmailPasswordNamespace, l as createAuthClient, n as CreateAuthClientOptions, o as ProactiveRefreshConfig, r as EmailOtpNamespace, s as SubscribeOptions, t as AuthClient, u as Profile } from "./index-B2RuGLX_.js";
 import { i as memoryStore, n as SessionStore, r as localStorageStore, t as LocalStorageStoreOptions } from "./sessionStore-BDdEpbL8.js";
 import { a as RegisterInput, c as SendLoginCodeInput, d as VerifyRegistrationCodeInput, i as LoginWithPasswordInput, l as SetPasswordInput, n as ChangePasswordInput, o as ResendLoginCodeInput, r as LoginWithGoogleInput, s as ResendRegistrationCodeInput, t as CaptchaArgs, u as VerifyLoginCodeInput } from "./requests-eTORIjY5.js";
-import { _ as authErrorFromFetchFailure, a as EmailAlreadyHasPasswordError, c as InvalidPasswordError, d as NoPasswordSetError, f as NoPendingOtpError, g as ResendCooldownError, h as RateLimitedError, i as CaptchaFailedError, l as MaxAttemptsError, m as OtpInvalidError, n as AuthError, o as InvalidCredentialsError, p as OtpExpiredError, r as AuthErrorInit, s as InvalidEmailError, t as AccountSuspendedError, u as MaxResendsError, v as authErrorFromResponse } from "./authError-C5g5jP5l.js";
+import { _ as authErrorFromFetchFailure, a as EmailAlreadyHasPasswordError, c as InvalidPasswordError, d as NoPasswordSetError, f as NoPendingOtpError, g as ResendCooldownError, h as RateLimitedError, i as CaptchaFailedError, l as MaxAttemptsError, m as OtpInvalidError, n as AuthError, o as InvalidCredentialsError, p as OtpExpiredError, r as AuthErrorInit, s as InvalidEmailError, t as AccountSuspendedError, u as MaxResendsError, v as authErrorFromResponse } from "./authError-DgPEjTfW.js";
 import { n as AccessTokenPayloadProject, t as AccessTokenPayload } from "./tokens-BXrPLi5B.js";
-export { type AccessTokenPayload, type AccessTokenPayloadProject, type Account, AccountSuspendedError, type AuthClient, AuthError, type AuthErrorInit, type AuthFetchInit, type AuthSession, type CaptchaArgs, CaptchaFailedError, type ChangePasswordInput, type CreateAuthClientOptions, EmailAlreadyHasPasswordError, type EmailOtpNamespace, type EmailPasswordNamespace, type ErrorHandler, type ErrorSource, type GoogleNamespace, InvalidCredentialsError, InvalidEmailError, InvalidPasswordError, type LocalStorageStoreOptions, type LoginWithGoogleInput, type LoginWithPasswordInput, MaxAttemptsError, MaxResendsError, NoPasswordSetError, NoPendingOtpError, OtpExpiredError, type OtpInfo, OtpInvalidError, type ProactiveRefreshConfig, type Project, RateLimitedError, type RegisterInput, type RegisterResult, type ResendCodeResult, ResendCooldownError, type ResendLoginCodeInput, type ResendRegistrationCodeInput, type SendLoginCodeInput, type SendLoginCodeResult, type SessionChangeHandler, type SessionStore, type SetPasswordInput, type SubscribeOptions, type VerifyLoginCodeInput, type VerifyRegistrationCodeInput, authErrorFromFetchFailure, authErrorFromResponse, createAuthClient, localStorageStore, memoryStore };
+
+//#region src/types/wallet.d.ts
+type WalletAddressResult = {
+  address: string;
+  isActive: boolean;
+  createdAt: string;
+};
+type SignHashResult = {
+  signature: string;
+  address: string;
+};
+//#endregion
+export { type AccessTokenPayload, type AccessTokenPayloadProject, type Account, AccountSuspendedError, type AuthClient, AuthError, type AuthErrorInit, type AuthFetchInit, type AuthSession, type CaptchaArgs, CaptchaFailedError, type ChangePasswordInput, type CreateAuthClientOptions, EmailAlreadyHasPasswordError, type EmailOtpNamespace, type EmailPasswordNamespace, type ErrorHandler, type ErrorSource, type GoogleNamespace, InvalidCredentialsError, InvalidEmailError, InvalidPasswordError, type LocalStorageStoreOptions, type LoginWithGoogleInput, type LoginWithPasswordInput, MaxAttemptsError, MaxResendsError, NoPasswordSetError, NoPendingOtpError, OtpExpiredError, type OtpInfo, OtpInvalidError, type ProactiveRefreshConfig, type Profile, type ProfileResult, type Project, RateLimitedError, type RegisterInput, type RegisterResult, type ResendCodeResult, ResendCooldownError, type ResendLoginCodeInput, type ResendRegistrationCodeInput, type SendLoginCodeInput, type SendLoginCodeResult, type SessionChangeHandler, type SessionStore, type SetPasswordInput, type SignHashResult, type SubscribeOptions, type VerifyLoginCodeInput, type VerifyRegistrationCodeInput, type WalletAddressResult, type WalletNamespace, authErrorFromFetchFailure, authErrorFromResponse, createAuthClient, localStorageStore, memoryStore };

package/dist/index.js

@@ -1,4 +1,4 @@
-import { t as createAuthClient } from "./client-BcyoQ5Cj.js";
-import { _ as authErrorFromResponse, a as InvalidCredentialsError, c as MaxAttemptsError, d as NoPendingOtpError, f as OtpExpiredError, g as authErrorFromFetchFailure, h as ResendCooldownError, i as EmailAlreadyHasPasswordError, l as MaxResendsError, m as RateLimitedError, n as AuthError, o as InvalidEmailError, p as OtpInvalidError, r as CaptchaFailedError, s as InvalidPasswordError, t as AccountSuspendedError, u as NoPasswordSetError } from "./authError-DbEZJnC4.js";
+import { t as createAuthClient } from "./client-DU_DerYi.js";
+import { _ as authErrorFromResponse, a as InvalidCredentialsError, c as MaxAttemptsError, d as NoPendingOtpError, f as OtpExpiredError, g as authErrorFromFetchFailure, h as ResendCooldownError, i as EmailAlreadyHasPasswordError, l as MaxResendsError, m as RateLimitedError, n as AuthError, o as InvalidEmailError, p as OtpInvalidError, r as CaptchaFailedError, s as InvalidPasswordError, t as AccountSuspendedError, u as NoPasswordSetError } from "./authError-CYUAl2Jt.js";
 import { n as memoryStore, t as localStorageStore } from "./sessionStore-DD6lON9W.js";
 export { AccountSuspendedError, AuthError, CaptchaFailedError, EmailAlreadyHasPasswordError, InvalidCredentialsError, InvalidEmailError, InvalidPasswordError, MaxAttemptsError, MaxResendsError, NoPasswordSetError, NoPendingOtpError, OtpExpiredError, OtpInvalidError, RateLimitedError, ResendCooldownError, authErrorFromFetchFailure, authErrorFromResponse, createAuthClient, localStorageStore, memoryStore };

package/dist/wallet/index.d.ts

@@ -0,0 +1,19 @@
+import { t as AuthClient } from "../index-B2RuGLX_.js";
+import { LocalAccount } from "viem";
+
+//#region src/wallet/index.d.ts
+/** The account's custodial wallet address. */
+declare function getAddress(auth: AuthClient): Promise<string>;
+/**
+ * Build a viem `LocalAccount` backed by the server-side custodial signer. Drop
+ * it into the smart-account SDK as `toSmartAccount({ owner })`. Only
+ * `signMessage` is supported — the smart-account SDK signs userOps via
+ * `signMessage({ raw })`; `signTransaction`/`signTypedData` are not custodial
+ * operations and throw.
+ *
+ * @param auth An authenticated AuthClient.
+ * @returns A viem LocalAccount whose signing is performed by baliola-auth.
+ */
+declare function createRemoteSigner(auth: AuthClient): Promise<LocalAccount>;
+//#endregion
+export { createRemoteSigner, getAddress };

package/dist/wallet/index.js

@@ -0,0 +1,34 @@
+import { toAccount } from "viem/accounts";
+//#region src/wallet/index.ts
+/** The account's custodial wallet address. */
+async function getAddress(auth) {
+	return auth.wallet.getAddress();
+}
+/**
+* Build a viem `LocalAccount` backed by the server-side custodial signer. Drop
+* it into the smart-account SDK as `toSmartAccount({ owner })`. Only
+* `signMessage` is supported — the smart-account SDK signs userOps via
+* `signMessage({ raw })`; `signTransaction`/`signTypedData` are not custodial
+* operations and throw.
+*
+* @param auth An authenticated AuthClient.
+* @returns A viem LocalAccount whose signing is performed by baliola-auth.
+*/
+async function createRemoteSigner(auth) {
+	return toAccount({
+		address: await auth.wallet.getAddress(),
+		async signMessage({ message }) {
+			const raw = typeof message === "object" && message !== null && "raw" in message ? message.raw : message;
+			const hash = typeof raw === "string" ? raw : `0x${Buffer.from(raw).toString("hex")}`;
+			return await auth.wallet.signHash(hash);
+		},
+		async signTransaction() {
+			throw new Error("baliola remote signer: signTransaction is not supported");
+		},
+		async signTypedData() {
+			throw new Error("baliola remote signer: signTypedData is not supported");
+		}
+	});
+}
+//#endregion
+export { createRemoteSigner, getAddress };

package/package.json

@@ -1,7 +1,20 @@
 {
   "name": "@baliola/auth-sdk",
-  "version": "0.2.0",
+  "version": "0.4.1",
   "description": "Client SDK for Baliola Auth",
+  "keywords": [
+    "auth",
+    "authentication",
+    "passwordless",
+    "otp",
+    "email-otp",
+    "jwt",
+    "session",
+    "sdk",
+    "typescript",
+    "esm",
+    "baliola"
+  ],
   "license": "SEE LICENSE IN LICENSE",
   "author": "Baliola Development Team",
   "type": "module",
@@ -29,6 +42,10 @@
     "./types": {
       "types": "./dist/types/index.d.ts",
       "import": "./dist/types/index.js"
+    },
+    "./wallet": {
+      "types": "./dist/wallet/index.d.ts",
+      "import": "./dist/wallet/index.js"
     }
   },
   "files": [
@@ -37,24 +54,47 @@
     "README.md",
     "CHANGELOG.md"
   ],
+  "engines": {
+    "node": ">=20.3.0"
+  },
   "publishConfig": {
     "registry": "https://registry.npmjs.org",
     "access": "public"
   },
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/baliola/baliola-auth.git",
-    "directory": "sdk"
+    "url": "git+https://github.com/baliola/baliola-auth-sdk.git"
+  },
+  "homepage": "https://github.com/baliola/baliola-auth-sdk#readme",
+  "bugs": {
+    "url": "https://github.com/baliola/baliola-auth-sdk/issues"
   },
   "scripts": {
     "build": "tsdown",
-    "typecheck": "tsc --noEmit",
+    "typecheck": "bash scripts/typecheck.sh",
     "test": "bun test test/unit",
+    "lint": "eslint",
+    "lint:fix": "eslint --fix",
+    "format": "prettier --write \"{src,test}/**/*.ts\" \"*.ts\"",
+    "format:check": "prettier --check \"{src,test}/**/*.ts\" \"*.ts\"",
     "prepublishOnly": "bun run build"
   },
+  "peerDependencies": { "viem": "^2.47.6" },
+  "peerDependenciesMeta": { "viem": { "optional": true } },
   "devDependencies": {
-    "@types/bun": "latest",
+    "@eslint/js": "^10.0.1",
+    "@types/bun": "^1.4.0",
+    "eslint": "^10.7.0",
+    "eslint-config-prettier": "^10.1.8",
+    "eslint-plugin-import-x": "^4.17.1",
+    "eslint-plugin-prettier": "^5.5.6",
+    "eslint-plugin-unused-imports": "^4.4.1",
+    "globals": "^17.7.0",
+    "jiti": "^2.7.0",
+    "prettier": "3.8.1",
     "tsdown": "^0.21.10",
-    "typescript": "^5.7.0"
+    "typescript": "^5.7.0",
+    "typescript-eslint": "^8.64.0",
+    "viem": "^2.47.6"
   }
 }