@elytracms/studio 0.0.1

package/dist/lib/auth/convex-auth-adapter.js

@@ -0,0 +1,171 @@
+import { actionRef, queryRef } from '../persistence/convex-client';
+/**
+ * Convex Auth implementation of the project-owned {@link AuthAdapter}
+ * (EC-150). Decision record (also in `convex/auth.ts`): **Convex Auth** over
+ * Clerk — self-contained on the Convex stack, sessions in our own tables, no
+ * extra vendor; reachable only through this adapter so a swap stays local.
+ *
+ * Flow (server side lives in `convex/auth.ts` + `convex/users.ts`):
+ * 1. `signIn` calls the `auth:signIn` action with the Password provider
+ *    (`flow: 'signIn'`); on success Convex returns a JWT + refresh token.
+ * 2. The JWT is set on the *shared* Convex client (`client.setAuth`), so every
+ *    subsequent persistence query/mutation runs authenticated and the
+ *    server-side `requireRole` guards see the caller.
+ * 3. `currentSession` restores the JWT from storage and asks `users:me`.
+ * 4. `signOut` calls `auth:signOut` and clears the JWT.
+ *
+ * v1 scope note: the stored JWT is short-lived and this adapter does not yet
+ * run the refresh-token loop (the official `@convex-dev/auth/react` client
+ * does); an expired session simply resolves to "signed out" and the user signs
+ * in again. Live-deployment hardening is EC-156. No live deployment exists in
+ * this repo — this file is typecheck-verified and exercised against the local
+ * adapter's shared interface.
+ */
+const TOKEN_STORAGE_PREFIX = 'elytra.convex-auth.jwt';
+/**
+ * Per-deployment token key (EC-179, vision AD-8). One project per backend, so a
+ * session is scoped to its deployment: signing into Aurora's backend must not
+ * carry a JWT to Northwind's. Keying the stored token by the deployment URL
+ * makes each backend's session independent — switching to a project on a
+ * not-yet-authenticated backend reads no token and the guard asks for sign-in.
+ * (A future shared external IdP — WorkOS/Clerk — would issue one identity valid
+ * on every deployment, collapsing this back to a single session.)
+ */
+export function tokenStorageKey(deploymentUrl) {
+    return deploymentUrl ? `${TOKEN_STORAGE_PREFIX}::${deploymentUrl}` : TOKEN_STORAGE_PREFIX;
+}
+/**
+ * Best-effort "is there a session for this deployment?" — a synchronous token
+ * presence check used to label per-backend projects in the switcher/launcher
+ * (EC-179). It does not validate the token (an expired one still redirects to
+ * sign-in on entry); it just answers "has the user signed into this backend?".
+ */
+export function hasStoredConvexSession(deploymentUrl, store = defaultStore()) {
+    return store.getItem(tokenStorageKey(deploymentUrl)) !== null;
+}
+function defaultStore() {
+    if (typeof window !== 'undefined' && window.sessionStorage)
+        return window.sessionStorage;
+    const memory = new Map();
+    return {
+        getItem: (key) => memory.get(key) ?? null,
+        setItem: (key, value) => void memory.set(key, value),
+        removeItem: (key) => void memory.delete(key),
+    };
+}
+export class ConvexAuthAdapter {
+    client;
+    store;
+    tokenKey;
+    constructor(client, store = defaultStore(), 
+    /** Deployment URL the token is scoped to (per-backend sessions, EC-179). */
+    deploymentUrl) {
+        this.client = client;
+        this.store = store;
+        this.tokenKey = tokenStorageKey(deploymentUrl);
+    }
+    async currentSession() {
+        const token = this.store.getItem(this.tokenKey);
+        if (!token)
+            return null;
+        this.client.setAuth(token);
+        try {
+            const me = (await this.client.query(queryRef('users:me'), {}));
+            if (!me) {
+                this.clearToken();
+                return null;
+            }
+            return { user: this.toUser(me) };
+        }
+        catch {
+            // Expired/invalid JWT or unreachable backend → treat as signed out.
+            this.clearToken();
+            return null;
+        }
+    }
+    async signIn(credentials) {
+        return this.authenticate('signIn', credentials);
+    }
+    async signUp(credentials) {
+        return this.authenticate('signUp', credentials);
+    }
+    /**
+     * Shared password flow (EC-150/EC-179). `signIn` and `signUp` differ only by
+     * the Convex Auth `flow` param; both return a token + load `users:me`.
+     */
+    async authenticate(flow, credentials) {
+        let result;
+        try {
+            result = (await this.client.action(actionRef('auth:signIn'), {
+                provider: 'password',
+                params: {
+                    email: credentials.email.trim().toLowerCase(),
+                    password: credentials.password,
+                    flow,
+                },
+            }));
+        }
+        catch (error) {
+            // Convex Auth surfaces credential/registration problems as thrown errors.
+            const message = error instanceof Error ? error.message : String(error);
+            if (flow === 'signUp' && /already|exists|InvalidAccountId/i.test(message)) {
+                return {
+                    ok: false,
+                    reason: 'account-exists',
+                    message: 'An account with this email already exists — sign in instead.',
+                };
+            }
+            if (/InvalidSecret|InvalidAccountId|credential|password/i.test(message)) {
+                return {
+                    ok: false,
+                    reason: 'invalid-credentials',
+                    message: flow === 'signUp'
+                        ? 'That email or password can’t be used (password too short?).'
+                        : 'Email or password is incorrect.',
+                };
+            }
+            const verb = flow === 'signUp' ? 'Sign-up' : 'Sign-in';
+            return { ok: false, reason: 'unavailable', message: `${verb} is currently unavailable.` };
+        }
+        if (!result.tokens) {
+            return {
+                ok: false,
+                reason: 'invalid-credentials',
+                message: 'Email or password is incorrect.',
+            };
+        }
+        this.store.setItem(this.tokenKey, result.tokens.token);
+        this.client.setAuth(result.tokens.token);
+        const me = (await this.client.query(queryRef('users:me'), {}));
+        if (!me) {
+            this.clearToken();
+            return { ok: false, reason: 'unavailable', message: 'Sign-in is currently unavailable.' };
+        }
+        return { ok: true, session: { user: this.toUser(me) } };
+    }
+    async signOut() {
+        try {
+            await this.client.action(actionRef('auth:signOut'), {});
+        }
+        catch {
+            // Already signed out / unreachable — clearing local state is what matters.
+        }
+        this.clearToken();
+    }
+    toUser(me) {
+        return {
+            id: me.id,
+            email: me.email,
+            ...(me.name ? { name: me.name } : {}),
+            // No global flags: project creation is config/CLI-owned (AD-11), so there
+            // is no in-studio `create-projects` capability. Per-project roles come
+            // from `projectMembers`.
+            globalFlags: [],
+        };
+    }
+    clearToken() {
+        this.store.removeItem(this.tokenKey);
+        this.client.clearAuth();
+    }
+}
+//# sourceMappingURL=convex-auth-adapter.js.map

package/dist/lib/auth/convex-auth-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"convex-auth-adapter.js","sourceRoot":"","sources":["../../../src/lib/auth/convex-auth-adapter.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAA;AAIlE;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,MAAM,oBAAoB,GAAG,wBAAwB,CAAA;AAErD;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAC,aAAsB;IACpD,OAAO,aAAa,CAAC,CAAC,CAAC,GAAG,oBAAoB,KAAK,aAAa,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAA;AAC3F,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,aAAqB,EACrB,QAAsB,YAAY,EAAE;IAEpC,OAAO,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC,KAAK,IAAI,CAAA;AAC/D,CAAC;AAYD,SAAS,YAAY;IACnB,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,MAAM,CAAC,cAAc;QAAE,OAAO,MAAM,CAAC,cAAc,CAAA;IACxF,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAA;IACxC,OAAO;QACL,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI;QACzC,OAAO,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC;QACpD,UAAU,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC;KAC7C,CAAA;AACH,CAAC;AAED,MAAM,OAAO,iBAAiB;IAIT;IACA;IAJF,QAAQ,CAAQ;IAEjC,YACmB,MAAwB,EACxB,QAAsB,YAAY,EAAE;IACrD,4EAA4E;IAC5E,aAAsB;QAHL,WAAM,GAAN,MAAM,CAAkB;QACxB,UAAK,GAAL,KAAK,CAA+B;QAIrD,IAAI,CAAC,QAAQ,GAAG,eAAe,CAAC,aAAa,CAAC,CAAA;IAChD,CAAC;IAED,KAAK,CAAC,cAAc;QAClB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAC/C,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAA;QACvB,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;QAC1B,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAoB,CAAA;YACjF,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,IAAI,CAAC,UAAU,EAAE,CAAA;gBACjB,OAAO,IAAI,CAAA;YACb,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAA;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,oEAAoE;YACpE,IAAI,CAAC,UAAU,EAAE,CAAA;YACjB,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,WAA8B;QACzC,OAAO,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAA;IACjD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,WAA8B;QACzC,OAAO,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAA;IACjD,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,YAAY,CACxB,IAAyB,EACzB,WAA8B;QAE9B,IAAI,MAA0B,CAAA;QAC9B,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,aAAa,CAAC,EAAE;gBAC3D,QAAQ,EAAE,UAAU;gBACpB,MAAM,EAAE;oBACN,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE;oBAC7C,QAAQ,EAAE,WAAW,CAAC,QAAQ;oBAC9B,IAAI;iBACL;aACF,CAAC,CAAuB,CAAA;QAC3B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,0EAA0E;YAC1E,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YACtE,IAAI,IAAI,KAAK,QAAQ,IAAI,kCAAkC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC1E,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,gBAAgB;oBACxB,OAAO,EAAE,8DAA8D;iBACxE,CAAA;YACH,CAAC;YACD,IAAI,qDAAqD,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBACxE,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,qBAAqB;oBAC7B,OAAO,EACL,IAAI,KAAK,QAAQ;wBACf,CAAC,CAAC,6DAA6D;wBAC/D,CAAC,CAAC,iCAAiC;iBACxC,CAAA;YACH,CAAC;YACD,MAAM,IAAI,GAAG,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAA;YACtD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,GAAG,IAAI,4BAA4B,EAAE,CAAA;QAC3F,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACnB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,qBAAqB;gBAC7B,OAAO,EAAE,iCAAiC;aAC3C,CAAA;QACH,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QACtD,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QACxC,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAoB,CAAA;QACjF,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,IAAI,CAAC,UAAU,EAAE,CAAA;YACjB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAA;QAC3F,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,CAAA;IACzD,CAAC;IAED,KAAK,CAAC,OAAO;QACX,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,EAAE,EAAE,CAAC,CAAA;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,2EAA2E;QAC7E,CAAC;QACD,IAAI,CAAC,UAAU,EAAE,CAAA;IACnB,CAAC;IAEO,MAAM,CAAC,EAAY;QACzB,OAAO;YACL,EAAE,EAAE,EAAE,CAAC,EAAE;YACT,KAAK,EAAE,EAAE,CAAC,KAAK;YACf,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrC,0EAA0E;YAC1E,uEAAuE;YACvE,yBAAyB;YACzB,WAAW,EAAE,EAAE;SAChB,CAAA;IACH,CAAC;IAEO,UAAU;QAChB,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACpC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAA;IACzB,CAAC;CACF"}

package/dist/lib/auth/dev-auto-login-adapter.d.ts

@@ -0,0 +1,25 @@
+import type { AuthAdapter, AuthSession, SignInCredentials, SignInResult } from './auth-adapter';
+/**
+ * Dev-only unattended-auth decorator (testing de-friction). Wraps any
+ * {@link AuthAdapter}: when no session can be restored, it transparently signs
+ * in with the configured dev credentials so the studio boots already
+ * authenticated for local/automated testing.
+ *
+ * This is **not** an auth bypass — it performs a real {@link AuthAdapter.signIn},
+ * so the resulting session is a genuine backend session and the server-side
+ * role guards still apply (a non-member or wrong password surfaces as the normal
+ * signed-out state, not silent access). It is only ever constructed in a dev
+ * build (see `resolveDevAutoLogin`), so it cannot reach production.
+ *
+ * Every method but {@link currentSession} delegates unchanged; `currentSession`
+ * adds the auto-sign-in fallback after the wrapped adapter reports no session.
+ */
+export declare class DevAutoLoginAdapter implements AuthAdapter {
+    private readonly inner;
+    private readonly credentials;
+    constructor(inner: AuthAdapter, credentials: SignInCredentials);
+    currentSession(): Promise<AuthSession | null>;
+    signIn(credentials: SignInCredentials): Promise<SignInResult>;
+    signUp(credentials: SignInCredentials): Promise<SignInResult>;
+    signOut(): Promise<void>;
+}

package/dist/lib/auth/dev-auto-login-adapter.js

@@ -0,0 +1,40 @@
+/**
+ * Dev-only unattended-auth decorator (testing de-friction). Wraps any
+ * {@link AuthAdapter}: when no session can be restored, it transparently signs
+ * in with the configured dev credentials so the studio boots already
+ * authenticated for local/automated testing.
+ *
+ * This is **not** an auth bypass — it performs a real {@link AuthAdapter.signIn},
+ * so the resulting session is a genuine backend session and the server-side
+ * role guards still apply (a non-member or wrong password surfaces as the normal
+ * signed-out state, not silent access). It is only ever constructed in a dev
+ * build (see `resolveDevAutoLogin`), so it cannot reach production.
+ *
+ * Every method but {@link currentSession} delegates unchanged; `currentSession`
+ * adds the auto-sign-in fallback after the wrapped adapter reports no session.
+ */
+export class DevAutoLoginAdapter {
+    inner;
+    credentials;
+    constructor(inner, credentials) {
+        this.inner = inner;
+        this.credentials = credentials;
+    }
+    async currentSession() {
+        const restored = await this.inner.currentSession();
+        if (restored)
+            return restored;
+        const result = await this.inner.signIn(this.credentials);
+        return result.ok ? result.session : null;
+    }
+    signIn(credentials) {
+        return this.inner.signIn(credentials);
+    }
+    signUp(credentials) {
+        return this.inner.signUp(credentials);
+    }
+    signOut() {
+        return this.inner.signOut();
+    }
+}
+//# sourceMappingURL=dev-auto-login-adapter.js.map

package/dist/lib/auth/dev-auto-login-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dev-auto-login-adapter.js","sourceRoot":"","sources":["../../../src/lib/auth/dev-auto-login-adapter.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,mBAAmB;IAEX;IACA;IAFnB,YACmB,KAAkB,EAClB,WAA8B;QAD9B,UAAK,GAAL,KAAK,CAAa;QAClB,gBAAW,GAAX,WAAW,CAAmB;IAC9C,CAAC;IAEJ,KAAK,CAAC,cAAc;QAClB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAA;QAClD,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAA;QAC7B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QACxD,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAA;IAC1C,CAAC;IAED,MAAM,CAAC,WAA8B;QACnC,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;IACvC,CAAC;IAED,MAAM,CAAC,WAA8B;QACnC,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;IACvC,CAAC;IAED,OAAO;QACL,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAA;IAC7B,CAAC;CACF"}

package/dist/lib/auth/index.d.ts

@@ -0,0 +1,28 @@
+import type { StudioBackendMode } from '../persistence/backend-mode';
+import type { AuthAdapter } from './auth-adapter';
+export type { AuthAdapter, AuthSession, AuthUser, SignInCredentials, SignInResult, } from './auth-adapter';
+export { LocalAuthAdapter, LOCAL_DEV_CREDENTIALS } from './local-auth-adapter';
+export type { SessionStore } from './local-auth-adapter';
+export { ConvexAuthAdapter } from './convex-auth-adapter';
+export { DevAutoLoginAdapter } from './dev-auto-login-adapter';
+export { SIGN_IN_PATH, isPublicPath, postSignInTarget, resolveRouteGuard, sessionPrincipal, } from './route-guard';
+export type { AuthStatus, RouteGuardDecision } from './route-guard';
+/**
+ * Select the auth backend (EC-150/EC-153), mirroring `selectPersistenceAdapter`
+ * exactly: Convex mode means Convex Auth (over the same shared client the
+ * persistence adapter uses, so the session JWT authenticates every call); the
+ * explicit playground mode means the deterministic local adapter with the
+ * seeded dev users. A misconfigured backend is a hard error here too — never
+ * a silent local fallback (the `BackendGate` renders it before this runs).
+ */
+export declare function selectAuthAdapter(): AuthAdapter;
+/** Mirrors `persistenceMode()` — auth and persistence always agree (EC-150). */
+export declare function authMode(): StudioBackendMode;
+/**
+ * Whether the user has a session on a given project's backend (EC-179). One
+ * project per backend, so this is the per-project sign-in state the switcher and
+ * launcher surface ("Sign in" vs "Open project"). Playground mode is a single
+ * local backend — always "signed in". Best-effort (token presence, see
+ * {@link hasStoredConvexSession}); entry still enforces a valid session.
+ */
+export declare function hasProjectSession(slug: string): boolean;

package/dist/lib/auth/index.js

@@ -0,0 +1,61 @@
+import { getConvexClient } from '../persistence/convex-client';
+import { resolveBackendConfig, resolveDevAutoLogin } from '../persistence/backend-mode';
+import { deploymentUrlForSlug, resolveDeploymentUrl } from '../workspace';
+import { ConvexAuthAdapter, hasStoredConvexSession } from './convex-auth-adapter';
+import { DevAutoLoginAdapter } from './dev-auto-login-adapter';
+import { LocalAuthAdapter } from './local-auth-adapter';
+export { LocalAuthAdapter, LOCAL_DEV_CREDENTIALS } from './local-auth-adapter';
+export { ConvexAuthAdapter } from './convex-auth-adapter';
+export { DevAutoLoginAdapter } from './dev-auto-login-adapter';
+export { SIGN_IN_PATH, isPublicPath, postSignInTarget, resolveRouteGuard, sessionPrincipal, } from './route-guard';
+/**
+ * Select the auth backend (EC-150/EC-153), mirroring `selectPersistenceAdapter`
+ * exactly: Convex mode means Convex Auth (over the same shared client the
+ * persistence adapter uses, so the session JWT authenticates every call); the
+ * explicit playground mode means the deterministic local adapter with the
+ * seeded dev users. A misconfigured backend is a hard error here too — never
+ * a silent local fallback (the `BackendGate` renders it before this runs).
+ */
+export function selectAuthAdapter() {
+    const config = resolveBackendConfig();
+    if (config.kind === 'convex') {
+        // The active project (EC-179) selects the deployment; the session token is
+        // scoped to that deployment URL so each backend keeps its own session.
+        const url = resolveDeploymentUrl(config.url);
+        const base = new ConvexAuthAdapter(getConvexClient(url), undefined, url);
+        return withDevAutoLogin(base);
+    }
+    if (config.kind === 'playground')
+        return new LocalAuthAdapter();
+    throw new Error(config.detail);
+}
+/**
+ * Dev-only: wrap an adapter so the studio auto-signs-in for unattended testing
+ * when `VITE_ELYTRA_DEV_LOGIN` is configured in a dev build. No-op otherwise
+ * (and dead-code-eliminated in production builds — see `resolveDevAutoLogin`).
+ */
+function withDevAutoLogin(adapter) {
+    const credentials = resolveDevAutoLogin();
+    return credentials ? new DevAutoLoginAdapter(adapter, credentials) : adapter;
+}
+/** Mirrors `persistenceMode()` — auth and persistence always agree (EC-150). */
+export function authMode() {
+    const config = resolveBackendConfig();
+    if (config.kind === 'misconfigured')
+        throw new Error(config.detail);
+    return config.kind;
+}
+/**
+ * Whether the user has a session on a given project's backend (EC-179). One
+ * project per backend, so this is the per-project sign-in state the switcher and
+ * launcher surface ("Sign in" vs "Open project"). Playground mode is a single
+ * local backend — always "signed in". Best-effort (token presence, see
+ * {@link hasStoredConvexSession}); entry still enforces a valid session.
+ */
+export function hasProjectSession(slug) {
+    const config = resolveBackendConfig();
+    if (config.kind !== 'convex')
+        return true;
+    return hasStoredConvexSession(deploymentUrlForSlug(slug, config.url));
+}
+//# sourceMappingURL=index.js.map

package/dist/lib/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/lib/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAA;AAC9D,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAA;AACvF,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAA;AAGzE,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAA;AACjF,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AASvD,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAA;AAE9E,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAA;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAC9D,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,eAAe,CAAA;AAGtB;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB;IAC/B,MAAM,MAAM,GAAG,oBAAoB,EAAE,CAAA;IACrC,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,2EAA2E;QAC3E,uEAAuE;QACvE,MAAM,GAAG,GAAG,oBAAoB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAC5C,MAAM,IAAI,GAAG,IAAI,iBAAiB,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,CAAA;QACxE,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAA;IAC/B,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY;QAAE,OAAO,IAAI,gBAAgB,EAAE,CAAA;IAC/D,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;AAChC,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,OAAoB;IAC5C,MAAM,WAAW,GAAG,mBAAmB,EAAE,CAAA;IACzC,OAAO,WAAW,CAAC,CAAC,CAAC,IAAI,mBAAmB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,OAAO,CAAA;AAC9E,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,QAAQ;IACtB,MAAM,MAAM,GAAG,oBAAoB,EAAE,CAAA;IACrC,IAAI,MAAM,CAAC,IAAI,KAAK,eAAe;QAAE,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IACnE,OAAO,MAAM,CAAC,IAAI,CAAA;AACpB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,MAAM,MAAM,GAAG,oBAAoB,EAAE,CAAA;IACrC,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IACzC,OAAO,sBAAsB,CAAC,oBAAoB,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAA;AACvE,CAAC"}

package/dist/lib/auth/local-auth-adapter.d.ts

@@ -0,0 +1,57 @@
+import type { AuthAdapter, AuthSession, SignInCredentials, SignInResult } from './auth-adapter';
+/**
+ * Deterministic local auth (EC-150) for the in-memory persistence mode: the
+ * whole sign-in → role-enforcement → sign-out flow works offline, in tests,
+ * and in fixtures with zero backend setup. User ids are the canonical
+ * `DEV_USERS` ids from `@elytracms/persistence`, which the seeded
+ * `projectMembers` fixtures reference — so `admin@example.com` is admin,
+ * `editor@…` editor, `viewer@…` viewer on every sample project.
+ *
+ * Dev credentials (fixed, documented, local-only):
+ * - admin@example.com  / elytra-admin
+ * - editor@example.com / elytra-editor
+ * - viewer@example.com / elytra-viewer
+ *
+ * Adminness is the `projectMembers` role, not a global flag — project creation
+ * is config/CLI-owned now (AD-11), so there is no in-studio `create-projects`
+ * capability to grant.
+ *
+ * The session survives reloads via injected storage (defaults to
+ * `sessionStorage` in the browser, an in-memory map elsewhere).
+ */
+export declare const LOCAL_DEV_CREDENTIALS: readonly [{
+    readonly user: {
+        readonly id: "user_admin";
+        readonly email: "admin@example.com";
+        readonly name: "Ada Admin";
+    };
+    readonly password: "elytra-admin";
+}, {
+    readonly user: {
+        readonly id: "user_editor";
+        readonly email: "editor@example.com";
+        readonly name: "Edi Editor";
+    };
+    readonly password: "elytra-editor";
+}, {
+    readonly user: {
+        readonly id: "user_viewer";
+        readonly email: "viewer@example.com";
+        readonly name: "Vio Viewer";
+    };
+    readonly password: "elytra-viewer";
+}];
+/** The storage slice the adapter needs (sessionStorage-compatible). */
+export interface SessionStore {
+    getItem(key: string): string | null;
+    setItem(key: string, value: string): void;
+    removeItem(key: string): void;
+}
+export declare class LocalAuthAdapter implements AuthAdapter {
+    private readonly store;
+    constructor(store?: SessionStore);
+    currentSession(): Promise<AuthSession | null>;
+    signIn(credentials: SignInCredentials): Promise<SignInResult>;
+    signUp(): Promise<SignInResult>;
+    signOut(): Promise<void>;
+}

package/dist/lib/auth/local-auth-adapter.js

@@ -0,0 +1,78 @@
+import { DEV_USERS } from '@elytracms/persistence';
+/**
+ * Deterministic local auth (EC-150) for the in-memory persistence mode: the
+ * whole sign-in → role-enforcement → sign-out flow works offline, in tests,
+ * and in fixtures with zero backend setup. User ids are the canonical
+ * `DEV_USERS` ids from `@elytracms/persistence`, which the seeded
+ * `projectMembers` fixtures reference — so `admin@example.com` is admin,
+ * `editor@…` editor, `viewer@…` viewer on every sample project.
+ *
+ * Dev credentials (fixed, documented, local-only):
+ * - admin@example.com  / elytra-admin
+ * - editor@example.com / elytra-editor
+ * - viewer@example.com / elytra-viewer
+ *
+ * Adminness is the `projectMembers` role, not a global flag — project creation
+ * is config/CLI-owned now (AD-11), so there is no in-studio `create-projects`
+ * capability to grant.
+ *
+ * The session survives reloads via injected storage (defaults to
+ * `sessionStorage` in the browser, an in-memory map elsewhere).
+ */
+export const LOCAL_DEV_CREDENTIALS = [
+    { user: DEV_USERS.admin, password: 'elytra-admin' },
+    { user: DEV_USERS.editor, password: 'elytra-editor' },
+    { user: DEV_USERS.viewer, password: 'elytra-viewer' },
+];
+const STORAGE_KEY = 'elytra.local-auth.user-id';
+function defaultStore() {
+    if (typeof window !== 'undefined' && window.sessionStorage)
+        return window.sessionStorage;
+    const memory = new Map();
+    return {
+        getItem: (key) => memory.get(key) ?? null,
+        setItem: (key, value) => void memory.set(key, value),
+        removeItem: (key) => void memory.delete(key),
+    };
+}
+export class LocalAuthAdapter {
+    store;
+    constructor(store = defaultStore()) {
+        this.store = store;
+    }
+    async currentSession() {
+        const userId = this.store.getItem(STORAGE_KEY);
+        if (!userId)
+            return null;
+        const entry = LOCAL_DEV_CREDENTIALS.find((c) => c.user.id === userId);
+        return entry ? { user: entry.user } : null;
+    }
+    async signIn(credentials) {
+        const email = credentials.email.trim().toLowerCase();
+        const entry = LOCAL_DEV_CREDENTIALS.find((c) => c.user.email === email);
+        if (!entry || entry.password !== credentials.password) {
+            // Deliberately identical for unknown email vs wrong password.
+            return {
+                ok: false,
+                reason: 'invalid-credentials',
+                message: 'Email or password is incorrect.',
+            };
+        }
+        this.store.setItem(STORAGE_KEY, entry.user.id);
+        return { ok: true, session: { user: entry.user } };
+    }
+    async signUp() {
+        // Playground mode has a fixed, documented set of dev users — there is no
+        // registration. Surfaced as a state, not a throw, so the sign-in screen can
+        // explain it.
+        return {
+            ok: false,
+            reason: 'unavailable',
+            message: 'Sign-up isn’t available in playground mode — use the dev credentials below.',
+        };
+    }
+    async signOut() {
+        this.store.removeItem(STORAGE_KEY);
+    }
+}
+//# sourceMappingURL=local-auth-adapter.js.map

package/dist/lib/auth/local-auth-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-auth-adapter.js","sourceRoot":"","sources":["../../../src/lib/auth/local-auth-adapter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAA;AAGlD;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE;IACnD,EAAE,IAAI,EAAE,SAAS,CAAC,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE;IACrD,EAAE,IAAI,EAAE,SAAS,CAAC,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE;CAC7C,CAAA;AAEV,MAAM,WAAW,GAAG,2BAA2B,CAAA;AAS/C,SAAS,YAAY;IACnB,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,MAAM,CAAC,cAAc;QAAE,OAAO,MAAM,CAAC,cAAc,CAAA;IACxF,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAA;IACxC,OAAO;QACL,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI;QACzC,OAAO,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC;QACpD,UAAU,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC;KAC7C,CAAA;AACH,CAAC;AAED,MAAM,OAAO,gBAAgB;IACV,KAAK,CAAc;IAEpC,YAAY,QAAsB,YAAY,EAAE;QAC9C,IAAI,CAAC,KAAK,GAAG,KAAK,CAAA;IACpB,CAAC;IAED,KAAK,CAAC,cAAc;QAClB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;QAC9C,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAA;QACxB,MAAM,KAAK,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,MAAM,CAAC,CAAA;QACrE,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;IAC5C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,WAA8B;QACzC,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;QACpD,MAAM,KAAK,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,CAAA;QACvE,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,QAAQ,KAAK,WAAW,CAAC,QAAQ,EAAE,CAAC;YACtD,8DAA8D;YAC9D,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,qBAAqB;gBAC7B,OAAO,EAAE,iCAAiC;aAC3C,CAAA;QACH,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAC9C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,CAAA;IACpD,CAAC;IAED,KAAK,CAAC,MAAM;QACV,yEAAyE;QACzE,4EAA4E;QAC5E,cAAc;QACd,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,aAAa;YACrB,OAAO,EAAE,6EAA6E;SACvF,CAAA;IACH,CAAC;IAED,KAAK,CAAC,OAAO;QACX,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,WAAW,CAAC,CAAA;IACpC,CAAC;CACF"}

package/dist/lib/auth/route-guard.d.ts

@@ -0,0 +1,33 @@
+import type { Principal } from '@elytracms/operations';
+import type { AuthSession } from './auth-adapter';
+/**
+ * Pure route-guard + principal-mapping logic (EC-150), kept free of React and
+ * router types so it is unit-testable and deterministic. The `__root` layout
+ * applies {@link resolveRouteGuard} on every location change.
+ */
+export declare const SIGN_IN_PATH = "/sign-in";
+export declare function isPublicPath(pathname: string): boolean;
+export type AuthStatus = 'loading' | 'signed-in' | 'signed-out';
+export type RouteGuardDecision = 
+/** Render the route. */
+{
+    readonly kind: 'allow';
+}
+/** Session still resolving — render the deterministic checking state. */
+ | {
+    readonly kind: 'pending';
+}
+/** Unauthenticated on a protected path → sign-in, preserving the target. */
+ | {
+    readonly kind: 'redirect-to-sign-in';
+    readonly redirect: string;
+}
+/** Authenticated user on the sign-in screen → send them home (or back). */
+ | {
+    readonly kind: 'redirect-home';
+};
+export declare function resolveRouteGuard(pathname: string, status: AuthStatus): RouteGuardDecision;
+/** Where to navigate after a successful sign-in. Rejects external targets. */
+export declare function postSignInTarget(redirect: string | undefined): string;
+/** Map a session onto the operations-layer {@link Principal}. */
+export declare function sessionPrincipal(session: AuthSession): Principal;

package/dist/lib/auth/route-guard.js

@@ -0,0 +1,51 @@
+/**
+ * Pure route-guard + principal-mapping logic (EC-150), kept free of React and
+ * router types so it is unit-testable and deterministic. The `__root` layout
+ * applies {@link resolveRouteGuard} on every location change.
+ */
+export const SIGN_IN_PATH = '/sign-in';
+/**
+ * Paths reachable without a session: the sign-in screen itself and the
+ * component styleguide (a static internal reference, not a project surface).
+ * Everything else — project surfaces, the launcher — requires a session.
+ */
+const PUBLIC_PATHS = new Set([SIGN_IN_PATH, '/styleguide']);
+export function isPublicPath(pathname) {
+    return PUBLIC_PATHS.has(normalize(pathname));
+}
+export function resolveRouteGuard(pathname, status) {
+    const path = normalize(pathname);
+    if (status === 'loading') {
+        // Public paths render immediately; protected ones wait for the session.
+        return isPublicPath(path) ? { kind: 'allow' } : { kind: 'pending' };
+    }
+    if (status === 'signed-out') {
+        if (isPublicPath(path))
+            return { kind: 'allow' };
+        return { kind: 'redirect-to-sign-in', redirect: path };
+    }
+    // signed-in
+    if (path === SIGN_IN_PATH)
+        return { kind: 'redirect-home' };
+    return { kind: 'allow' };
+}
+/** Where to navigate after a successful sign-in. Rejects external targets. */
+export function postSignInTarget(redirect) {
+    if (!redirect || !redirect.startsWith('/') || redirect.startsWith('//'))
+        return '/';
+    return normalize(redirect) === SIGN_IN_PATH ? '/' : redirect;
+}
+/** Map a session onto the operations-layer {@link Principal}. */
+export function sessionPrincipal(session) {
+    return {
+        id: session.user.id,
+        ...(session.user.name ? { name: session.user.name } : {}),
+        ...(session.user.globalFlags ? { roles: session.user.globalFlags } : {}),
+    };
+}
+function normalize(pathname) {
+    if (pathname.length > 1 && pathname.endsWith('/'))
+        return pathname.slice(0, -1);
+    return pathname;
+}
+//# sourceMappingURL=route-guard.js.map

package/dist/lib/auth/route-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"route-guard.js","sourceRoot":"","sources":["../../../src/lib/auth/route-guard.ts"],"names":[],"mappings":"AAGA;;;;GAIG;AAEH,MAAM,CAAC,MAAM,YAAY,GAAG,UAAU,CAAA;AAEtC;;;;GAIG;AACH,MAAM,YAAY,GAAwB,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC,CAAA;AAEhF,MAAM,UAAU,YAAY,CAAC,QAAgB;IAC3C,OAAO,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAA;AAC9C,CAAC;AAcD,MAAM,UAAU,iBAAiB,CAAC,QAAgB,EAAE,MAAkB;IACpE,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAA;IAChC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,wEAAwE;QACxE,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;IACrE,CAAC;IACD,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;QAC5B,IAAI,YAAY,CAAC,IAAI,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;QAChD,OAAO,EAAE,IAAI,EAAE,qBAAqB,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAA;IACxD,CAAC;IACD,YAAY;IACZ,IAAI,IAAI,KAAK,YAAY;QAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,CAAA;IAC3D,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;AAC1B,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,gBAAgB,CAAC,QAA4B;IAC3D,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,GAAG,CAAA;IACnF,OAAO,SAAS,CAAC,QAAQ,CAAC,KAAK,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAA;AAC9D,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,gBAAgB,CAAC,OAAoB;IACnD,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;QACnB,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzE,CAAA;AACH,CAAC;AAED,SAAS,SAAS,CAAC,QAAgB;IACjC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IAC/E,OAAO,QAAQ,CAAA;AACjB,CAAC"}

package/dist/lib/auth-errors.d.ts

@@ -0,0 +1,42 @@
+import type { OperationError } from './operations';
+/**
+ * Session-expiry detection + plain-language mapping (EC-177 gap 9).
+ *
+ * An expired Convex session surfaces as a raw backend blob thrown by the
+ * transport — e.g. `{"code":"Unauthenticated","message":"Could not verify
+ * OIDC token claim…"}` — which `toOperationError` can only normalize to an
+ * `unknown`/`backend-unavailable` `OperationError` whose message *is* that
+ * blob. Rendering it verbatim is editor-hostile, and the real problem (edits
+ * silently stop persisting) is invisible.
+ *
+ * This module is the one chokepoint that recognizes that shape on the
+ * structured `OperationError` (the seam every studio failure already flows
+ * through), so UI surfaces never string-match raw messages themselves: the
+ * shared banner asks {@link isSessionExpiredError} and renders the
+ * plain-language copy + a "Sign in again" action instead.
+ */
+/** Editor-facing copy: plain language, no auth/transport jargon. */
+export declare const SESSION_EXPIRED_MESSAGE = "You've been signed out, so your latest changes aren't being saved. Sign in again to keep editing \u2014 you'll come back to this screen.";
+export declare const SIGN_IN_AGAIN_LABEL = "Sign in again";
+/**
+ * Does this operation failure mean "the session is no longer valid"?
+ *
+ * Only the transport-shaped codes can carry the backend auth blob: structured
+ * studio-level failures (`validation`, `unauthorized` from the role hook,
+ * `not-found`, `conflict`) are never session expiry. Within those, detect the
+ * Convex unauthenticated shape: an embedded `{"code":"Unauthenticated"}`
+ * payload, the bare `Unauthenticated` server-error marker, or the OIDC claim
+ * message it ships with.
+ */
+export declare function isSessionExpiredError(error: OperationError): boolean;
+/**
+ * Where the "Sign in again" action navigates: the sign-in screen, carrying the
+ * current location so a successful sign-in returns the editor to the exact
+ * screen they were on (the sign-in route's `redirect` search param, EC-150).
+ * External/protocol-relative targets are rejected, mirroring
+ * `postSignInTarget`.
+ */
+export declare function signInHref(location: {
+    pathname: string;
+    search?: string;
+}): string;