@columnus/shared 0.1.47

package/dist/apiProfileSlug.d.ts

@@ -0,0 +1,11 @@
+/** URL-safe profile slug for `api.columnus.read.{slug}.*` (plan 004). */
+export declare const API_PROFILE_SLUG_RE: RegExp;
+export declare function isApiProfileSlug(slug: string): boolean;
+/** Derive a slug from a human display name. */
+export declare function slugifyApiProfileName(name: string): string;
+export declare function assertApiProfileSlug(slug: string): void;
+/** Reject profile slug edits after create (plan 006 D13). */
+export declare function profileSlugChangeError(existingSlug: string, nextSlug: string | undefined): string | undefined;
+export declare function assertProfileSlugUnchanged(existingSlug: string, nextSlug: string | undefined): void;
+/** Convex module path segment (`columnus/read/{segment}/…`). Hyphens are invalid in paths. */
+export declare function apiProfileSlugToConvexModuleSegment(slug: string): string;

package/dist/apiProfileSlug.js

@@ -0,0 +1,39 @@
+// packages/@columnus/shared/src/apiProfileSlug.ts
+var API_PROFILE_SLUG_RE = /^[a-z][a-z0-9-]{0,47}$/;
+function isApiProfileSlug(slug) {
+  return API_PROFILE_SLUG_RE.test(slug);
+}
+function slugifyApiProfileName(name) {
+  const lowered = name.trim().toLowerCase();
+  const hyphenated = lowered.replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").replace(/-+/g, "-");
+  let slug = hyphenated.slice(0, 48);
+  if (!slug) slug = "profile";
+  if (!/^[a-z]/.test(slug)) slug = `p-${slug}`.slice(0, 48);
+  return slug.slice(0, 48);
+}
+function assertApiProfileSlug(slug) {
+  if (!isApiProfileSlug(slug)) {
+    throw new Error(
+      "Profile slug must start with a letter and contain only lowercase letters, numbers, and hyphens (max 48 characters)."
+    );
+  }
+}
+function profileSlugChangeError(existingSlug, nextSlug) {
+  if (nextSlug === void 0) return void 0;
+  const trimmed = nextSlug.trim();
+  if (trimmed && trimmed !== existingSlug) {
+    return "Profile slug cannot be changed after creation";
+  }
+  return void 0;
+}
+function assertProfileSlugUnchanged(existingSlug, nextSlug) {
+  const message = profileSlugChangeError(existingSlug, nextSlug);
+  if (message) throw new Error(message);
+}
+function apiProfileSlugToConvexModuleSegment(slug) {
+  return slug.replace(/-/g, "_");
+}
+
+export { API_PROFILE_SLUG_RE, apiProfileSlugToConvexModuleSegment, assertApiProfileSlug, assertProfileSlugUnchanged, isApiProfileSlug, profileSlugChangeError, slugifyApiProfileName };
+//# sourceMappingURL=apiProfileSlug.js.map
+//# sourceMappingURL=apiProfileSlug.js.map

package/dist/apiProfileSlug.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/apiProfileSlug.ts"],"names":[],"mappings":";AACO,IAAM,mBAAA,GAAsB;AAE5B,SAAS,iBAAiB,IAAA,EAAuB;AACtD,EAAA,OAAO,mBAAA,CAAoB,KAAK,IAAI,CAAA;AACtC;AAGO,SAAS,sBAAsB,IAAA,EAAsB;AAC1D,EAAA,MAAM,OAAA,GAAU,IAAA,CAAK,IAAA,EAAK,CAAE,WAAA,EAAY;AACxC,EAAA,MAAM,UAAA,GAAa,OAAA,CAChB,OAAA,CAAQ,aAAA,EAAe,GAAG,CAAA,CAC1B,OAAA,CAAQ,UAAA,EAAY,EAAE,CAAA,CACtB,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA;AACrB,EAAA,IAAI,IAAA,GAAO,UAAA,CAAW,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AACjC,EAAA,IAAI,CAAC,MAAM,IAAA,GAAO,SAAA;AAClB,EAAA,IAAI,CAAC,QAAA,CAAS,IAAA,CAAK,IAAI,CAAA,EAAG,IAAA,GAAO,CAAA,EAAA,EAAK,IAAI,CAAA,CAAA,CAAG,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AACxD,EAAA,OAAO,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AACzB;AAEO,SAAS,qBAAqB,IAAA,EAAoB;AACvD,EAAA,IAAI,CAAC,gBAAA,CAAiB,IAAI,CAAA,EAAG;AAC3B,IAAA,MAAM,IAAI,KAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AACF;AAGO,SAAS,sBAAA,CACd,cACA,QAAA,EACoB;AACpB,EAAA,IAAI,QAAA,KAAa,QAAW,OAAO,MAAA;AACnC,EAAA,MAAM,OAAA,GAAU,SAAS,IAAA,EAAK;AAC9B,EAAA,IAAI,OAAA,IAAW,YAAY,YAAA,EAAc;AACvC,IAAA,OAAO,+CAAA;AAAA,EACT;AACA,EAAA,OAAO,MAAA;AACT;AAEO,SAAS,0BAAA,CACd,cACA,QAAA,EACM;AACN,EAAA,MAAM,OAAA,GAAU,sBAAA,CAAuB,YAAA,EAAc,QAAQ,CAAA;AAC7D,EAAA,IAAI,OAAA,EAAS,MAAM,IAAI,KAAA,CAAM,OAAO,CAAA;AACtC;AAGO,SAAS,oCAAoC,IAAA,EAAsB;AACxE,EAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA;AAC/B","file":"apiProfileSlug.js","sourcesContent":["/** URL-safe profile slug for `api.columnus.read.{slug}.*` (plan 004). */\nexport const API_PROFILE_SLUG_RE = /^[a-z][a-z0-9-]{0,47}$/;\n\nexport function isApiProfileSlug(slug: string): boolean {\n  return API_PROFILE_SLUG_RE.test(slug);\n}\n\n/** Derive a slug from a human display name. */\nexport function slugifyApiProfileName(name: string): string {\n  const lowered = name.trim().toLowerCase();\n  const hyphenated = lowered\n    .replace(/[^a-z0-9]+/g, \"-\")\n    .replace(/^-+|-+$/g, \"\")\n    .replace(/-+/g, \"-\");\n  let slug = hyphenated.slice(0, 48);\n  if (!slug) slug = \"profile\";\n  if (!/^[a-z]/.test(slug)) slug = `p-${slug}`.slice(0, 48);\n  return slug.slice(0, 48);\n}\n\nexport function assertApiProfileSlug(slug: string): void {\n  if (!isApiProfileSlug(slug)) {\n    throw new Error(\n      \"Profile slug must start with a letter and contain only lowercase letters, numbers, and hyphens (max 48 characters).\",\n    );\n  }\n}\n\n/** Reject profile slug edits after create (plan 006 D13). */\nexport function profileSlugChangeError(\n  existingSlug: string,\n  nextSlug: string | undefined,\n): string | undefined {\n  if (nextSlug === undefined) return undefined;\n  const trimmed = nextSlug.trim();\n  if (trimmed && trimmed !== existingSlug) {\n    return \"Profile slug cannot be changed after creation\";\n  }\n  return undefined;\n}\n\nexport function assertProfileSlugUnchanged(\n  existingSlug: string,\n  nextSlug: string | undefined,\n): void {\n  const message = profileSlugChangeError(existingSlug, nextSlug);\n  if (message) throw new Error(message);\n}\n\n/** Convex module path segment (`columnus/read/{segment}/…`). Hyphens are invalid in paths. */\nexport function apiProfileSlugToConvexModuleSegment(slug: string): string {\n  return slug.replace(/-/g, \"_\");\n}\n"]}

package/dist/apiToken.d.ts

@@ -0,0 +1,6 @@
+/** Read API token prefix (see plans/done/004-api-read-access.md). */
+export declare const API_TOKEN_PREFIX = "col_";
+export declare function isApiTokenFormat(token: string): boolean;
+export declare function apiTokenPrefix(token: string): string;
+export declare function generateApiToken(): string;
+export declare function hashApiToken(token: string): Promise<string>;

package/dist/apiToken.js

@@ -0,0 +1,35 @@
+// packages/@columnus/shared/src/apiToken.ts
+var API_TOKEN_PREFIX = "col_";
+var TOKEN_BODY_RE = /^col_[A-Za-z0-9_-]{20,}$/;
+function isApiTokenFormat(token) {
+  return TOKEN_BODY_RE.test(token.trim());
+}
+function apiTokenPrefix(token) {
+  const trimmed = token.trim();
+  if (trimmed.length <= API_TOKEN_PREFIX.length + 4)
+    return trimmed.slice(0, API_TOKEN_PREFIX.length + 4);
+  return `${trimmed.slice(0, API_TOKEN_PREFIX.length + 7)}\u2026`;
+}
+function generateApiToken() {
+  const bytes = new Uint8Array(24);
+  crypto.getRandomValues(bytes);
+  const body = base64UrlEncode(bytes);
+  return `${API_TOKEN_PREFIX}${body}`;
+}
+async function hashApiToken(token) {
+  const data = new TextEncoder().encode(token.trim());
+  const digest = await crypto.subtle.digest("SHA-256", data);
+  return hexEncode(new Uint8Array(digest));
+}
+function base64UrlEncode(bytes) {
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+}
+function hexEncode(bytes) {
+  return [...bytes].map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+
+export { API_TOKEN_PREFIX, apiTokenPrefix, generateApiToken, hashApiToken, isApiTokenFormat };
+//# sourceMappingURL=apiToken.js.map
+//# sourceMappingURL=apiToken.js.map

package/dist/apiToken.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/apiToken.ts"],"names":[],"mappings":";AACO,IAAM,gBAAA,GAAmB;AAEhC,IAAM,aAAA,GAAgB,0BAAA;AAEf,SAAS,iBAAiB,KAAA,EAAwB;AACvD,EAAA,OAAO,aAAA,CAAc,IAAA,CAAK,KAAA,CAAM,IAAA,EAAM,CAAA;AACxC;AAEO,SAAS,eAAe,KAAA,EAAuB;AACpD,EAAA,MAAM,OAAA,GAAU,MAAM,IAAA,EAAK;AAC3B,EAAA,IAAI,OAAA,CAAQ,MAAA,IAAU,gBAAA,CAAiB,MAAA,GAAS,CAAA;AAC9C,IAAA,OAAO,OAAA,CAAQ,KAAA,CAAM,CAAA,EAAG,gBAAA,CAAiB,SAAS,CAAC,CAAA;AACrD,EAAA,OAAO,GAAG,OAAA,CAAQ,KAAA,CAAM,GAAG,gBAAA,CAAiB,MAAA,GAAS,CAAC,CAAC,CAAA,MAAA,CAAA;AACzD;AAEO,SAAS,gBAAA,GAA2B;AACzC,EAAA,MAAM,KAAA,GAAQ,IAAI,UAAA,CAAW,EAAE,CAAA;AAC/B,EAAA,MAAA,CAAO,gBAAgB,KAAK,CAAA;AAC5B,EAAA,MAAM,IAAA,GAAO,gBAAgB,KAAK,CAAA;AAClC,EAAA,OAAO,CAAA,EAAG,gBAAgB,CAAA,EAAG,IAAI,CAAA,CAAA;AACnC;AAEA,eAAsB,aAAa,KAAA,EAAgC;AACjE,EAAA,MAAM,OAAO,IAAI,WAAA,GAAc,MAAA,CAAO,KAAA,CAAM,MAAM,CAAA;AAClD,EAAA,MAAM,SAAS,MAAM,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,WAAW,IAAI,CAAA;AACzD,EAAA,OAAO,SAAA,CAAU,IAAI,UAAA,CAAW,MAAM,CAAC,CAAA;AACzC;AAEA,SAAS,gBAAgB,KAAA,EAA2B;AAClD,EAAA,IAAI,MAAA,GAAS,EAAA;AACb,EAAA,KAAA,MAAW,IAAA,IAAQ,KAAA,EAAO,MAAA,IAAU,MAAA,CAAO,aAAa,IAAI,CAAA;AAC5D,EAAA,OAAO,IAAA,CAAK,MAAM,CAAA,CAAE,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAAE,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAAE,OAAA,CAAQ,QAAQ,EAAE,CAAA;AAChF;AAEA,SAAS,UAAU,KAAA,EAA2B;AAC5C,EAAA,OAAO,CAAC,GAAG,KAAK,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,QAAA,CAAS,EAAE,EAAE,QAAA,CAAS,CAAA,EAAG,GAAG,CAAC,CAAA,CAAE,KAAK,EAAE,CAAA;AACvE","file":"apiToken.js","sourcesContent":["/** Read API token prefix (see plans/done/004-api-read-access.md). */\nexport const API_TOKEN_PREFIX = \"col_\";\n\nconst TOKEN_BODY_RE = /^col_[A-Za-z0-9_-]{20,}$/;\n\nexport function isApiTokenFormat(token: string): boolean {\n  return TOKEN_BODY_RE.test(token.trim());\n}\n\nexport function apiTokenPrefix(token: string): string {\n  const trimmed = token.trim();\n  if (trimmed.length <= API_TOKEN_PREFIX.length + 4)\n    return trimmed.slice(0, API_TOKEN_PREFIX.length + 4);\n  return `${trimmed.slice(0, API_TOKEN_PREFIX.length + 7)}…`;\n}\n\nexport function generateApiToken(): string {\n  const bytes = new Uint8Array(24);\n  crypto.getRandomValues(bytes);\n  const body = base64UrlEncode(bytes);\n  return `${API_TOKEN_PREFIX}${body}`;\n}\n\nexport async function hashApiToken(token: string): Promise<string> {\n  const data = new TextEncoder().encode(token.trim());\n  const digest = await crypto.subtle.digest(\"SHA-256\", data);\n  return hexEncode(new Uint8Array(digest));\n}\n\nfunction base64UrlEncode(bytes: Uint8Array): string {\n  let binary = \"\";\n  for (const byte of bytes) binary += String.fromCharCode(byte);\n  return btoa(binary).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/g, \"\");\n}\n\nfunction hexEncode(bytes: Uint8Array): string {\n  return [...bytes].map((b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n"]}

package/dist/betterAuthSession.d.ts

@@ -0,0 +1,8 @@
+export declare function isConvexJwt(token: string): boolean;
+export declare function isJwtExpired(token: string, skewSec?: number): boolean;
+export type SignInViaEmailOtpOptions = {
+    siteUrl: string;
+    email: string;
+    otp?: string;
+};
+export declare function signInViaEmailOtp({ siteUrl, email, otp, }: SignInViaEmailOtpOptions): Promise<string>;

package/dist/betterAuthSession.js

@@ -0,0 +1,57 @@
+// packages/@columnus/shared/src/betterAuthSession.ts
+function isConvexJwt(token) {
+  return token.split(".").length === 3;
+}
+function isJwtExpired(token, skewSec = 60) {
+  const parts = token.split(".");
+  if (parts.length !== 3) return true;
+  try {
+    const payload = JSON.parse(Buffer.from(parts[1] ?? "", "base64url").toString("utf8"));
+    if (typeof payload.exp !== "number") return true;
+    return payload.exp <= Math.floor(Date.now() / 1e3) + skewSec;
+  } catch {
+    return true;
+  }
+}
+async function signInViaEmailOtp({
+  siteUrl,
+  email,
+  otp = process.env.DEV_OTP_CODE?.trim() || "000000"
+}) {
+  const base = siteUrl.replace(/\/$/, "");
+  const sendRes = await fetch(`${base}/api/auth/email-otp/send-verification-otp`, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ email, type: "sign-in" })
+  });
+  if (!sendRes.ok) {
+    throw new Error(`send-verification-otp failed: ${sendRes.status} ${await sendRes.text()}`);
+  }
+  const signInRes = await fetch(`${base}/api/auth/sign-in/email-otp`, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ email, otp })
+  });
+  if (!signInRes.ok) {
+    throw new Error(`sign-in/email-otp failed: ${signInRes.status} ${await signInRes.text()}`);
+  }
+  const body = await signInRes.json();
+  if (!body.token) {
+    throw new Error("sign-in/email-otp response missing token");
+  }
+  const convexTokenRes = await fetch(`${base}/api/auth/convex/token`, {
+    headers: { Authorization: `Bearer ${body.token}` }
+  });
+  if (!convexTokenRes.ok) {
+    throw new Error(`convex/token failed: ${convexTokenRes.status} ${await convexTokenRes.text()}`);
+  }
+  const convexBody = await convexTokenRes.json();
+  if (!convexBody.token) {
+    throw new Error("convex/token response missing token");
+  }
+  return convexBody.token;
+}
+
+export { isConvexJwt, isJwtExpired, signInViaEmailOtp };
+//# sourceMappingURL=betterAuthSession.js.map
+//# sourceMappingURL=betterAuthSession.js.map

package/dist/betterAuthSession.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/betterAuthSession.ts"],"names":[],"mappings":";AAAO,SAAS,YAAY,KAAA,EAAwB;AAClD,EAAA,OAAO,KAAA,CAAM,KAAA,CAAM,GAAG,CAAA,CAAE,MAAA,KAAW,CAAA;AACrC;AAEO,SAAS,YAAA,CAAa,KAAA,EAAe,OAAA,GAAU,EAAA,EAAa;AACjE,EAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,CAAM,GAAG,CAAA;AAC7B,EAAA,IAAI,KAAA,CAAM,MAAA,KAAW,CAAA,EAAG,OAAO,IAAA;AAC/B,EAAA,IAAI;AACF,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,IAAA,CAAK,KAAA,CAAM,CAAC,CAAA,IAAK,EAAA,EAAI,WAAW,CAAA,CAAE,QAAA,CAAS,MAAM,CAAC,CAAA;AAGpF,IAAA,IAAI,OAAO,OAAA,CAAQ,GAAA,KAAQ,QAAA,EAAU,OAAO,IAAA;AAC5C,IAAA,OAAO,OAAA,CAAQ,OAAO,IAAA,CAAK,KAAA,CAAM,KAAK,GAAA,EAAI,GAAI,GAAI,CAAA,GAAI,OAAA;AAAA,EACxD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAQA,eAAsB,iBAAA,CAAkB;AAAA,EACtC,OAAA;AAAA,EACA,KAAA;AAAA,EACA,GAAA,GAAM,OAAA,CAAQ,GAAA,CAAI,YAAA,EAAc,MAAK,IAAK;AAC5C,CAAA,EAA8C;AAC5C,EAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA;AAEtC,EAAA,MAAM,OAAA,GAAU,MAAM,KAAA,CAAM,CAAA,EAAG,IAAI,CAAA,yCAAA,CAAA,EAA6C;AAAA,IAC9E,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAmB;AAAA,IAC9C,MAAM,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,IAAA,EAAM,WAAW;AAAA,GAChD,CAAA;AACD,EAAA,IAAI,CAAC,QAAQ,EAAA,EAAI;AACf,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,8BAAA,EAAiC,OAAA,CAAQ,MAAM,IAAI,MAAM,OAAA,CAAQ,IAAA,EAAM,CAAA,CAAE,CAAA;AAAA,EAC3F;AAEA,EAAA,MAAM,SAAA,GAAY,MAAM,KAAA,CAAM,CAAA,EAAG,IAAI,CAAA,2BAAA,CAAA,EAA+B;AAAA,IAClE,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAmB;AAAA,IAC9C,MAAM,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,KAAK;AAAA,GACpC,CAAA;AACD,EAAA,IAAI,CAAC,UAAU,EAAA,EAAI;AACjB,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,0BAAA,EAA6B,SAAA,CAAU,MAAM,IAAI,MAAM,SAAA,CAAU,IAAA,EAAM,CAAA,CAAE,CAAA;AAAA,EAC3F;AAEA,EAAA,MAAM,IAAA,GAAQ,MAAM,SAAA,CAAU,IAAA,EAAK;AACnC,EAAA,IAAI,CAAC,KAAK,KAAA,EAAO;AACf,IAAA,MAAM,IAAI,MAAM,0CAA0C,CAAA;AAAA,EAC5D;AAEA,EAAA,MAAM,cAAA,GAAiB,MAAM,KAAA,CAAM,CAAA,EAAG,IAAI,CAAA,sBAAA,CAAA,EAA0B;AAAA,IAClE,SAAS,EAAE,aAAA,EAAe,CAAA,OAAA,EAAU,IAAA,CAAK,KAAK,CAAA,CAAA;AAAG,GAClD,CAAA;AACD,EAAA,IAAI,CAAC,eAAe,EAAA,EAAI;AACtB,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,qBAAA,EAAwB,cAAA,CAAe,MAAM,IAAI,MAAM,cAAA,CAAe,IAAA,EAAM,CAAA,CAAE,CAAA;AAAA,EAChG;AACA,EAAA,MAAM,UAAA,GAAc,MAAM,cAAA,CAAe,IAAA,EAAK;AAC9C,EAAA,IAAI,CAAC,WAAW,KAAA,EAAO;AACrB,IAAA,MAAM,IAAI,MAAM,qCAAqC,CAAA;AAAA,EACvD;AACA,EAAA,OAAO,UAAA,CAAW,KAAA;AACpB","file":"betterAuthSession.js","sourcesContent":["export function isConvexJwt(token: string): boolean {\n  return token.split(\".\").length === 3;\n}\n\nexport function isJwtExpired(token: string, skewSec = 60): boolean {\n  const parts = token.split(\".\");\n  if (parts.length !== 3) return true;\n  try {\n    const payload = JSON.parse(Buffer.from(parts[1] ?? \"\", \"base64url\").toString(\"utf8\")) as {\n      exp?: number;\n    };\n    if (typeof payload.exp !== \"number\") return true;\n    return payload.exp <= Math.floor(Date.now() / 1000) + skewSec;\n  } catch {\n    return true;\n  }\n}\n\nexport type SignInViaEmailOtpOptions = {\n  siteUrl: string;\n  email: string;\n  otp?: string;\n};\n\nexport async function signInViaEmailOtp({\n  siteUrl,\n  email,\n  otp = process.env.DEV_OTP_CODE?.trim() || \"000000\",\n}: SignInViaEmailOtpOptions): Promise<string> {\n  const base = siteUrl.replace(/\\/$/, \"\");\n\n  const sendRes = await fetch(`${base}/api/auth/email-otp/send-verification-otp`, {\n    method: \"POST\",\n    headers: { \"content-type\": \"application/json\" },\n    body: JSON.stringify({ email, type: \"sign-in\" }),\n  });\n  if (!sendRes.ok) {\n    throw new Error(`send-verification-otp failed: ${sendRes.status} ${await sendRes.text()}`);\n  }\n\n  const signInRes = await fetch(`${base}/api/auth/sign-in/email-otp`, {\n    method: \"POST\",\n    headers: { \"content-type\": \"application/json\" },\n    body: JSON.stringify({ email, otp }),\n  });\n  if (!signInRes.ok) {\n    throw new Error(`sign-in/email-otp failed: ${signInRes.status} ${await signInRes.text()}`);\n  }\n\n  const body = (await signInRes.json()) as { token?: string };\n  if (!body.token) {\n    throw new Error(\"sign-in/email-otp response missing token\");\n  }\n\n  const convexTokenRes = await fetch(`${base}/api/auth/convex/token`, {\n    headers: { Authorization: `Bearer ${body.token}` },\n  });\n  if (!convexTokenRes.ok) {\n    throw new Error(`convex/token failed: ${convexTokenRes.status} ${await convexTokenRes.text()}`);\n  }\n  const convexBody = (await convexTokenRes.json()) as { token?: string };\n  if (!convexBody.token) {\n    throw new Error(\"convex/token response missing token\");\n  }\n  return convexBody.token;\n}\n"]}

package/dist/bffHost.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Trusted request host headers for Columnus BFF tenant resolution (D35/D41).
+ * Prefer Forwarded / X-Forwarded-Host when present, else Host.
+ * Always trust these headers in the web/BFF process — operators must not expose
+ * the container publicly without Traefik/Coolify/tunnel in front.
+ */
+export type RequestHostHeaders = {
+    /** RFC 7239 `Forwarded` header value. */
+    forwarded?: string | null;
+    /** `X-Forwarded-Host` header value. */
+    xForwardedHost?: string | null;
+    /** `Host` header value. */
+    host?: string | null;
+};
+export type TrustedHostResult = {
+    ok: true;
+    hostname: string;
+} | {
+    ok: false;
+    error: string;
+};
+/**
+ * Extract a single host value from a header that may be multi-valued.
+ * Returns null when empty; rejects comma-separated lists as ambiguous.
+ */
+export declare function singleHeaderHostValue(raw: string | null | undefined): TrustedHostResult | null;
+/**
+ * Parse the `host=` parameter from an RFC 7239 Forwarded header entry.
+ * Quoted values are unescaped; ports are stripped via hostnameFromHostHeader.
+ */
+export declare function hostFromForwardedHeader(forwarded: string): TrustedHostResult | null;
+/**
+ * Resolve the trusted request hostname for tenant identity (D3/D35/D41).
+ * Never accepts a client-supplied tenant slug — only host headers.
+ */
+export declare function extractTrustedHostname(headers: RequestHostHeaders): TrustedHostResult;

package/dist/bffHost.js

@@ -0,0 +1,74 @@
+// packages/@columnus/shared/src/tenantHosts.ts
+var RESERVED_TENANT_SLUGS = ["manage", "deploy", "www"];
+new Set(RESERVED_TENANT_SLUGS);
+function hostnameFromHostHeader(host) {
+  const trimmed = host.trim().toLowerCase();
+  if (!trimmed) return "";
+  if (trimmed.startsWith("[")) {
+    const end = trimmed.indexOf("]");
+    return end === -1 ? trimmed : trimmed.slice(1, end);
+  }
+  const colon = trimmed.lastIndexOf(":");
+  if (colon > -1 && /^\d+$/.test(trimmed.slice(colon + 1))) {
+    return trimmed.slice(0, colon);
+  }
+  return trimmed;
+}
+
+// packages/@columnus/shared/src/bffHost.ts
+function singleHeaderHostValue(raw) {
+  if (raw == null) return null;
+  const trimmed = raw.trim();
+  if (!trimmed) return null;
+  if (trimmed.includes(",")) {
+    return { ok: false, error: "ambiguous multi-value host header" };
+  }
+  const hostname = hostnameFromHostHeader(trimmed);
+  if (!hostname) return { ok: false, error: "empty hostname" };
+  return { ok: true, hostname };
+}
+function hostFromForwardedHeader(forwarded) {
+  const trimmed = forwarded.trim();
+  if (!trimmed) return null;
+  const entries = trimmed.split(",");
+  const hosts = [];
+  for (const entry of entries) {
+    const host = hostParamFromForwardedEntry(entry);
+    if (host) hosts.push(host);
+  }
+  if (hosts.length === 0) return null;
+  const unique = new Set(hosts.map((h) => hostnameFromHostHeader(h)).filter(Boolean));
+  if (unique.size > 1) {
+    return { ok: false, error: "ambiguous multi-value Forwarded host" };
+  }
+  const [hostname] = unique;
+  if (!hostname) return { ok: false, error: "empty hostname" };
+  return { ok: true, hostname };
+}
+function hostParamFromForwardedEntry(entry) {
+  for (const part of entry.split(";")) {
+    const eq = part.indexOf("=");
+    if (eq === -1) continue;
+    const key = part.slice(0, eq).trim().toLowerCase();
+    if (key !== "host") continue;
+    let value = part.slice(eq + 1).trim();
+    if (value.startsWith('"') && value.endsWith('"') && value.length >= 2) {
+      value = value.slice(1, -1).replace(/\\(.)/g, "$1");
+    }
+    return value || null;
+  }
+  return null;
+}
+function extractTrustedHostname(headers) {
+  const fromForwarded = headers.forwarded != null && headers.forwarded.trim() !== "" ? hostFromForwardedHeader(headers.forwarded) : null;
+  if (fromForwarded) return fromForwarded;
+  const fromXfh = singleHeaderHostValue(headers.xForwardedHost);
+  if (fromXfh) return fromXfh;
+  const fromHost = singleHeaderHostValue(headers.host);
+  if (fromHost) return fromHost;
+  return { ok: false, error: "missing Host header" };
+}
+
+export { extractTrustedHostname, hostFromForwardedHeader, singleHeaderHostValue };
+//# sourceMappingURL=bffHost.js.map
+//# sourceMappingURL=bffHost.js.map

package/dist/bffHost.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/tenantHosts.ts","../src/bffHost.ts"],"names":[],"mappings":";AACO,IAAM,qBAAA,GAAwB,CAAC,QAAA,EAAU,QAAA,EAAU,KAAK,CAAA;AAErC,IAAI,GAAA,CAAY,qBAAqB;AAqBxD,SAAS,uBAAuB,IAAA,EAAsB;AAC3D,EAAA,MAAM,OAAA,GAAU,IAAA,CAAK,IAAA,EAAK,CAAE,WAAA,EAAY;AACxC,EAAA,IAAI,CAAC,SAAS,OAAO,EAAA;AAErB,EAAA,IAAI,OAAA,CAAQ,UAAA,CAAW,GAAG,CAAA,EAAG;AAC3B,IAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,OAAA,CAAQ,GAAG,CAAA;AAC/B,IAAA,OAAO,QAAQ,EAAA,GAAK,OAAA,GAAU,OAAA,CAAQ,KAAA,CAAM,GAAG,GAAG,CAAA;AAAA,EACpD;AACA,EAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,WAAA,CAAY,GAAG,CAAA;AACrC,EAAA,IAAI,KAAA,GAAQ,MAAM,OAAA,CAAQ,IAAA,CAAK,QAAQ,KAAA,CAAM,KAAA,GAAQ,CAAC,CAAC,CAAA,EAAG;AACxD,IAAA,OAAO,OAAA,CAAQ,KAAA,CAAM,CAAA,EAAG,KAAK,CAAA;AAAA,EAC/B;AACA,EAAA,OAAO,OAAA;AACT;;;ACdO,SAAS,sBAAsB,GAAA,EAA0D;AAC9F,EAAA,IAAI,GAAA,IAAO,MAAM,OAAO,IAAA;AACxB,EAAA,MAAM,OAAA,GAAU,IAAI,IAAA,EAAK;AACzB,EAAA,IAAI,CAAC,SAAS,OAAO,IAAA;AACrB,EAAA,IAAI,OAAA,CAAQ,QAAA,CAAS,GAAG,CAAA,EAAG;AACzB,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,mCAAA,EAAoC;AAAA,EACjE;AACA,EAAA,MAAM,QAAA,GAAW,uBAAuB,OAAO,CAAA;AAC/C,EAAA,IAAI,CAAC,QAAA,EAAU,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,OAAO,gBAAA,EAAiB;AAC3D,EAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,QAAA,EAAS;AAC9B;AAMO,SAAS,wBAAwB,SAAA,EAA6C;AACnF,EAAA,MAAM,OAAA,GAAU,UAAU,IAAA,EAAK;AAC/B,EAAA,IAAI,CAAC,SAAS,OAAO,IAAA;AAErB,EAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,KAAA,CAAM,GAAG,CAAA;AACjC,EAAA,MAAM,QAAkB,EAAC;AACzB,EAAA,KAAA,MAAW,SAAS,OAAA,EAAS;AAC3B,IAAA,MAAM,IAAA,GAAO,4BAA4B,KAAK,CAAA;AAC9C,IAAA,IAAI,IAAA,EAAM,KAAA,CAAM,IAAA,CAAK,IAAI,CAAA;AAAA,EAC3B;AACA,EAAA,IAAI,KAAA,CAAM,MAAA,KAAW,CAAA,EAAG,OAAO,IAAA;AAC/B,EAAA,MAAM,MAAA,GAAS,IAAI,GAAA,CAAI,KAAA,CAAM,GAAA,CAAI,CAAC,CAAA,KAAM,sBAAA,CAAuB,CAAC,CAAC,CAAA,CAAE,MAAA,CAAO,OAAO,CAAC,CAAA;AAClF,EAAA,IAAI,MAAA,CAAO,OAAO,CAAA,EAAG;AACnB,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,sCAAA,EAAuC;AAAA,EACpE;AACA,EAAA,MAAM,CAAC,QAAQ,CAAA,GAAI,MAAA;AACnB,EAAA,IAAI,CAAC,QAAA,EAAU,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,OAAO,gBAAA,EAAiB;AAC3D,EAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,QAAA,EAAS;AAC9B;AAEA,SAAS,4BAA4B,KAAA,EAA8B;AAEjE,EAAA,KAAA,MAAW,IAAA,IAAQ,KAAA,CAAM,KAAA,CAAM,GAAG,CAAA,EAAG;AACnC,IAAA,MAAM,EAAA,GAAK,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AAC3B,IAAA,IAAI,OAAO,EAAA,EAAI;AACf,IAAA,MAAM,GAAA,GAAM,KAAK,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,CAAE,IAAA,GAAO,WAAA,EAAY;AACjD,IAAA,IAAI,QAAQ,MAAA,EAAQ;AACpB,IAAA,IAAI,QAAQ,IAAA,CAAK,KAAA,CAAM,EAAA,GAAK,CAAC,EAAE,IAAA,EAAK;AACpC,IAAA,IAAI,KAAA,CAAM,UAAA,CAAW,GAAG,CAAA,IAAK,KAAA,CAAM,SAAS,GAAG,CAAA,IAAK,KAAA,CAAM,MAAA,IAAU,CAAA,EAAG;AACrE,MAAA,KAAA,GAAQ,MAAM,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,CAAE,OAAA,CAAQ,UAAU,IAAI,CAAA;AAAA,IACnD;AACA,IAAA,OAAO,KAAA,IAAS,IAAA;AAAA,EAClB;AACA,EAAA,OAAO,IAAA;AACT;AAMO,SAAS,uBAAuB,OAAA,EAAgD;AACrF,EAAA,MAAM,aAAA,GACJ,OAAA,CAAQ,SAAA,IAAa,IAAA,IAAQ,OAAA,CAAQ,SAAA,CAAU,IAAA,EAAK,KAAM,EAAA,GACtD,uBAAA,CAAwB,OAAA,CAAQ,SAAS,CAAA,GACzC,IAAA;AACN,EAAA,IAAI,eAAe,OAAO,aAAA;AAE1B,EAAA,MAAM,OAAA,GAAU,qBAAA,CAAsB,OAAA,CAAQ,cAAc,CAAA;AAC5D,EAAA,IAAI,SAAS,OAAO,OAAA;AAEpB,EAAA,MAAM,QAAA,GAAW,qBAAA,CAAsB,OAAA,CAAQ,IAAI,CAAA;AACnD,EAAA,IAAI,UAAU,OAAO,QAAA;AAErB,EAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,qBAAA,EAAsB;AACnD","file":"bffHost.js","sourcesContent":["/** Reserved first labels under `*.columnus.app` / `*.columnus.localhost` — not tenants. */\nexport const RESERVED_TENANT_SLUGS = [\"manage\", \"deploy\", \"www\"] as const;\n\nconst RESERVED_SLUG_SET = new Set<string>(RESERVED_TENANT_SLUGS);\n\n/** Lowercase slug: letters/digits with optional hyphen segments (e.g. `app`, `acme-prod`). */\nexport const TENANT_SLUG_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;\n\nexport function isReservedTenantSlug(slug: string): boolean {\n  const normalized = slug.trim().toLowerCase();\n  if (!normalized) return true;\n  if (RESERVED_SLUG_SET.has(normalized)) return true;\n  if (normalized.startsWith(\"preview-\")) return true;\n  return false;\n}\n\nexport function isValidTenantSlug(slug: string): boolean {\n  const trimmed = slug.trim();\n  // Require already-lowercase slugs (hosts are normalized before parse).\n  if (!TENANT_SLUG_RE.test(trimmed)) return false;\n  return !isReservedTenantSlug(trimmed);\n}\n\n/** Strip optional port from a Host header or `window.location.host` value. */\nexport function hostnameFromHostHeader(host: string): string {\n  const trimmed = host.trim().toLowerCase();\n  if (!trimmed) return \"\";\n  // IPv6 bracket form is not used for tenant hosts; strip :port for hostname:port.\n  if (trimmed.startsWith(\"[\")) {\n    const end = trimmed.indexOf(\"]\");\n    return end === -1 ? trimmed : trimmed.slice(1, end);\n  }\n  const colon = trimmed.lastIndexOf(\":\");\n  if (colon > -1 && /^\\d+$/.test(trimmed.slice(colon + 1))) {\n    return trimmed.slice(0, colon);\n  }\n  return trimmed;\n}\n\n/**\n * Extract tenant slug from a hostname.\n * Supports `{slug}.columnus.app` and `{slug}.columnus.localhost`.\n * Returns null for apex, reserved, invalid, or unrecognized hosts.\n */\nexport function tenantSlugFromHost(host: string): string | null {\n  const hostname = hostnameFromHostHeader(host);\n  const match = hostname.match(/^([a-z0-9-]+)\\.columnus\\.(app|localhost)$/);\n  if (!match) return null;\n  const slug = match[1];\n  if (!slug || !isValidTenantSlug(slug)) return null;\n  return slug;\n}\n\nexport type TenantPublicHostEnv = \"prod\" | \"local\";\n\n/** Public hostname for a tenant slug (no scheme). */\nexport function tenantPublicHost(slug: string, env: TenantPublicHostEnv = \"prod\"): string {\n  const normalized = slug.trim().toLowerCase();\n  return env === \"local\" ? `${normalized}.columnus.localhost` : `${normalized}.columnus.app`;\n}\n\n/** Preview tenant slug: `preview-<label>` (e.g. `preview-12`). */\nexport const PREVIEW_TENANT_SLUG_RE = /^preview-[a-z0-9]+(?:-[a-z0-9]+)*$/;\n\nexport function isValidPreviewTenantSlug(slug: string): boolean {\n  return PREVIEW_TENANT_SLUG_RE.test(slug.trim().toLowerCase());\n}\n\n/**\n * Extract preview tenant slug from hostname (`preview-12.columnus.app`).\n * Returns null for non-preview or invalid hosts.\n */\nexport function previewSlugFromHost(host: string): string | null {\n  const hostname = hostnameFromHostHeader(host);\n  const match = hostname.match(/^(preview-[a-z0-9-]+)\\.columnus\\.(app|localhost)$/);\n  if (!match) return null;\n  const slug = match[1];\n  if (!slug || !isValidPreviewTenantSlug(slug)) return null;\n  return slug;\n}\n\n/**\n * Resolve either a standard tenant slug or a registered preview slug from a host.\n * Does not check Management DB — only host shape.\n */\nexport function anyTenantSlugFromHost(host: string): string | null {\n  return tenantSlugFromHost(host) ?? previewSlugFromHost(host);\n}\n","import { hostnameFromHostHeader } from \"./tenantHosts.ts\";\n\n/**\n * Trusted request host headers for Columnus BFF tenant resolution (D35/D41).\n * Prefer Forwarded / X-Forwarded-Host when present, else Host.\n * Always trust these headers in the web/BFF process — operators must not expose\n * the container publicly without Traefik/Coolify/tunnel in front.\n */\nexport type RequestHostHeaders = {\n  /** RFC 7239 `Forwarded` header value. */\n  forwarded?: string | null;\n  /** `X-Forwarded-Host` header value. */\n  xForwardedHost?: string | null;\n  /** `Host` header value. */\n  host?: string | null;\n};\n\nexport type TrustedHostResult = { ok: true; hostname: string } | { ok: false; error: string };\n\n/**\n * Extract a single host value from a header that may be multi-valued.\n * Returns null when empty; rejects comma-separated lists as ambiguous.\n */\nexport function singleHeaderHostValue(raw: string | null | undefined): TrustedHostResult | null {\n  if (raw == null) return null;\n  const trimmed = raw.trim();\n  if (!trimmed) return null;\n  if (trimmed.includes(\",\")) {\n    return { ok: false, error: \"ambiguous multi-value host header\" };\n  }\n  const hostname = hostnameFromHostHeader(trimmed);\n  if (!hostname) return { ok: false, error: \"empty hostname\" };\n  return { ok: true, hostname };\n}\n\n/**\n * Parse the `host=` parameter from an RFC 7239 Forwarded header entry.\n * Quoted values are unescaped; ports are stripped via hostnameFromHostHeader.\n */\nexport function hostFromForwardedHeader(forwarded: string): TrustedHostResult | null {\n  const trimmed = forwarded.trim();\n  if (!trimmed) return null;\n\n  const entries = trimmed.split(\",\");\n  const hosts: string[] = [];\n  for (const entry of entries) {\n    const host = hostParamFromForwardedEntry(entry);\n    if (host) hosts.push(host);\n  }\n  if (hosts.length === 0) return null;\n  const unique = new Set(hosts.map((h) => hostnameFromHostHeader(h)).filter(Boolean));\n  if (unique.size > 1) {\n    return { ok: false, error: \"ambiguous multi-value Forwarded host\" };\n  }\n  const [hostname] = unique;\n  if (!hostname) return { ok: false, error: \"empty hostname\" };\n  return { ok: true, hostname };\n}\n\nfunction hostParamFromForwardedEntry(entry: string): string | null {\n  // Parameters are `;`-separated; values may be quoted.\n  for (const part of entry.split(\";\")) {\n    const eq = part.indexOf(\"=\");\n    if (eq === -1) continue;\n    const key = part.slice(0, eq).trim().toLowerCase();\n    if (key !== \"host\") continue;\n    let value = part.slice(eq + 1).trim();\n    if (value.startsWith('\"') && value.endsWith('\"') && value.length >= 2) {\n      value = value.slice(1, -1).replace(/\\\\(.)/g, \"$1\");\n    }\n    return value || null;\n  }\n  return null;\n}\n\n/**\n * Resolve the trusted request hostname for tenant identity (D3/D35/D41).\n * Never accepts a client-supplied tenant slug — only host headers.\n */\nexport function extractTrustedHostname(headers: RequestHostHeaders): TrustedHostResult {\n  const fromForwarded =\n    headers.forwarded != null && headers.forwarded.trim() !== \"\"\n      ? hostFromForwardedHeader(headers.forwarded)\n      : null;\n  if (fromForwarded) return fromForwarded;\n\n  const fromXfh = singleHeaderHostValue(headers.xForwardedHost);\n  if (fromXfh) return fromXfh;\n\n  const fromHost = singleHeaderHostValue(headers.host);\n  if (fromHost) return fromHost;\n\n  return { ok: false, error: \"missing Host header\" };\n}\n"]}