@graph8/sdk 0.373.0 → 0.374.0

package/dist/cli.js

@@ -36,8 +36,8 @@ __export(cli_exports, {
 });
 module.exports = __toCommonJS(cli_exports);
 var import_node_child_process = require("child_process");
-var import_node_fs10 = __toESM(require("fs"));
-var import_node_path11 = __toESM(require("path"));
+var import_node_fs11 = __toESM(require("fs"));
+var import_node_path12 = __toESM(require("path"));
 
 // src/agentSetup.ts
 var ALL_TARGETS = ["claude", "codex", "cursor"];
@@ -119,9 +119,9 @@ ${section}
 }
 function planAgentSetup(targets, read, catalog) {
   const plans = [];
-  const add = (target, path12, next) => {
-    const current = read(path12);
-    plans.push({ target, path: path12, content: next, action: current === null ? "create" : current === next ? "unchanged" : "update" });
+  const add = (target, path13, next) => {
+    const current = read(path13);
+    plans.push({ target, path: path13, content: next, action: current === null ? "create" : current === next ? "unchanged" : "update" });
   };
   for (const target of targets) {
     if (target === "claude") add(target, ".claude/skills/graph8-sdk/SKILL.md", claudeSkill(catalog));
@@ -158,7 +158,7 @@ var import_node_fs4 = __toESM(require("fs"));
 var import_node_path5 = __toESM(require("path"));
 
 // src/version.ts
-var SDK_VERSION = "0.373.0";
+var SDK_VERSION = "0.374.0";
 var SDK_CLIENT_ID = `js-sdk/${SDK_VERSION}`;
 
 // src/blocks/paths.ts
@@ -5618,7 +5618,7 @@ function warnIfTargetOrgIgnored(apiKey, headers) {
     );
   }
 }
-async function request(baseUrl, path12, apiKey, opts = {}) {
+async function request(baseUrl, path13, apiKey, opts = {}) {
   const {
     method = "GET",
     body,
@@ -5631,7 +5631,7 @@ async function request(baseUrl, path12, apiKey, opts = {}) {
     fetchImpl = fetch,
     sleepImpl = defaultSleep
   } = opts;
-  const url = baseUrl.replace(/\/+$/, "") + path12 + buildQuery(query);
+  const url = baseUrl.replace(/\/+$/, "") + path13 + buildQuery(query);
   const finalHeaders = {
     "Content-Type": "application/json",
     Authorization: `Bearer ${apiKey}`,
@@ -5992,7 +5992,7 @@ async function runDoctor(opts, reg, io, cwd) {
     await checkKey(call, blocks, key, line);
     await checkSubscription(call, key, line);
   }
-  checkRoute(root, blocks, opts.production === true, io.out, line);
+  checkRoute(root, blocks, opts.production === true, io.out, line, io.env);
   if (opts.stack) printFlows(opts, reg, io.out, line);
   else if (!opts.blocks.length) printAppScreens(root, reg, io.out);
   printChecklist(blocks, io.out);
@@ -6079,7 +6079,7 @@ var ROUTE_FILES = ["app/api/g8/[...path]/route.ts", "src/app/api/g8/[...path]/ro
 function findRoute(root) {
   return ROUTE_FILES.find((f) => import_node_fs7.default.existsSync(import_node_path8.default.join(root, f))) ?? null;
 }
-function checkRoute(root, blocks, production, out, line) {
+function checkRoute(root, blocks, production, out, line, env = {}) {
   const rel = findRoute(root);
   if (!rel) {
     if (production) line(false, `no proxy route found (${ROUTE_FILES[0]}): run doctor from the app's root or pass --dir`);
@@ -6094,6 +6094,7 @@ Proxy route (${rel})${production ? ", production gate" : ""}:`);
       facts.localPreview ? "`authorize` is not set: local preview (this computer, `next dev` only) is the only gate. Set `authorize` before going live; a production build refuses every call until you do" : "`authorize` is not set: the route refuses every call until you set it (check your app's session)"
     );
   } else line(true, "`authorize` is set");
+  checkAuthConfig(root, problem, out, env);
   if (facts.dangerouslyAllowUnauthenticated) problem("dangerouslyAllowUnauthenticated is on: anyone who can reach the route can use the key");
   if (facts.dangerouslyAllowAllPaths) problem("dangerouslyAllowAllPaths is on: every /api/v1 area is reachable from the browser");
   const need = derivePrefixes(blocks);
@@ -6109,6 +6110,21 @@ Proxy route (${rel})${production ? ", production gate" : ""}:`);
     if (extra.length && blocks.length) out(`warn  allowedPrefixes allows areas no installed block declares: ${extra.join(", ")}`);
   }
 }
+function checkAuthConfig(root, problem, out, env = {}) {
+  const rel = ["g8.auth.ts", "src/g8.auth.ts"].find((f) => import_node_fs7.default.existsSync(import_node_path8.default.join(root, f)));
+  if (!rel) return;
+  const source = import_node_fs7.default.readFileSync(import_node_path8.default.join(root, rel), "utf8");
+  const code = source.replace(/\/\*[\s\S]*?\*\//g, "").replace(/(^|[^:"'`])\/\/[^\n]*/g, "$1");
+  if (/\ballowAnonymous\s*\(/.test(code)) {
+    out(`warn  ${rel} uses allowAnonymous(): NO sign-in. Anyone who can reach this app can use its graph8 API key through /api/g8. Use a narrowly scoped key with a spend cap, or switch to a sign-in preset`);
+  }
+  if (/\bjwtAuth\s*\(/.test(code) && !/\bclaims\s*:/.test(code) && !/\b(audience|secret)\s*:/.test(code)) {
+    if (!readSetting("G8_JWT_AUDIENCE", root, env) && !readSetting("G8_JWT_SECRET", root, env)) {
+      out(`warn  ${rel} uses jwtAuth() with no audience: set G8_JWT_AUDIENCE (or a claims check), otherwise tokens your identity provider minted for other apps on the same tenant are accepted`);
+    }
+  }
+  if (source.includes("graph8:auth-todo")) problem(`${rel} still has the sessionAuth stub (graph8:auth-todo): it refuses everyone until you wire your session library`);
+}
 function fixPrefixes(root, blocks, io) {
   const rel = findRoute(root);
   if (!rel) {
@@ -6225,8 +6241,142 @@ async function pullOrgBrand(io, root) {
 }
 
 // src/blocks/create.ts
+var import_node_fs10 = __toESM(require("fs"));
+var import_node_path11 = __toESM(require("path"));
+
+// src/blocks/auth.ts
+var import_node_crypto2 = require("crypto");
 var import_node_fs9 = __toESM(require("fs"));
 var import_node_path10 = __toESM(require("path"));
+var AUTH_PRESETS = ["password", "basic", "jwt", "session", "anonymous"];
+var AUTH_CONFIG_FILE = "g8.auth.ts";
+var AUTH_ROUTE_FILE = "app/api/g8-auth/route.ts";
+function isAuthPreset(v) {
+  return AUTH_PRESETS.includes(v);
+}
+function usesSignInScreen(p) {
+  return p === "password" || p === "jwt" || p === "session";
+}
+var SUMMARY = {
+  password: "one shared team password, a signed HttpOnly session cookie and a sign-in screen",
+  basic: "HTTP Basic auth: the browser asks for a user and password on every page",
+  jwt: "your identity provider's JWT (OIDC: Auth0, Okta, Cognito, Keycloak, Clerk...), checked against its keys",
+  session: "your own session library (Clerk, NextAuth, Supabase...): wire one function in g8.auth.ts",
+  anonymous: "NO sign-in: anyone who can reach the app can use its key (public demos only)"
+};
+function authSummary(p) {
+  return SUMMARY[p];
+}
+var ENV = {
+  password: [
+    "# Sign-in (create --auth password): the team password (12+ characters) and the cookie signing secret",
+    "# (32+ random characters: openssl rand -base64 48). create wrote fresh values to .env.local.",
+    "G8_APP_PASSWORD=",
+    "G8_SESSION_SECRET="
+  ],
+  basic: ["# Sign-in (create --auth basic): user:password (12+ character passwords, no commas), comma-separated for several users.", "G8_BASIC_AUTH="],
+  jwt: [
+    "# Sign-in (create --auth jwt): your identity provider. See g8.auth.ts for examples.",
+    "G8_JWT_ISSUER=",
+    "G8_JWT_JWKS_URL=",
+    "G8_JWT_AUDIENCE=",
+    "G8_JWT_COOKIE=",
+    "# Or an HS256 secret instead of a JWKS (32+ characters):",
+    "G8_JWT_SECRET=",
+    "G8_SIGN_IN_URL=",
+    "G8_SIGN_OUT_URL="
+  ],
+  session: ["# Sign-in (create --auth session): where the sign-in screen sends people, and the Sign out link.", "G8_SIGN_IN_URL=", "G8_SIGN_OUT_URL="],
+  anonymous: []
+};
+function authEnvLines(p) {
+  return ENV[p];
+}
+function planAuthFiles(p, templatesRoot) {
+  const dir = import_node_path10.default.join(templatesRoot, "auth");
+  const read = (f) => render(import_node_fs9.default.readFileSync(import_node_path10.default.join(dir, f), "utf8"), { preset: p });
+  const files = [{ rel: AUTH_CONFIG_FILE, content: read(`g8.auth.${p}.ts.tmpl`) }];
+  if (usesSignInScreen(p)) files.push({ rel: AUTH_ROUTE_FILE, content: read("auth-route.ts.tmpl") });
+  if (p === "basic") files.push({ rel: "middleware.ts", content: read("middleware.ts.tmpl") });
+  return files;
+}
+var AUTHORIZE_HINT = /^[ \t]*\/\/ authorize: async \(request\) => \{[^\n]*\n/m;
+var LAST_IMPORT = /^import [^\n]+;\n(?![\s\S]*^import )/m;
+function applyAuthToRoute(source) {
+  if (!AUTHORIZE_HINT.test(source) || !LAST_IMPORT.test(source) || source.includes('from "@/g8.auth"')) return null;
+  return source.replace(LAST_IMPORT, (m) => `${m}import { appAuth } from "@/g8.auth";
+`).replace(AUTHORIZE_HINT, "  authorize: appAuth.authorize, // g8.auth.ts: who may use this route (npx @graph8/sdk create --auth)\n");
+}
+var LAYOUT_IMPORT = 'import { G8ConnectGate } from "@/components/g8/_foundation/connect-graph8";\n';
+var LAYOUT_BODY = /^([ \t]*)<AppShell>\n([\s\S]*?)^\1<\/AppShell>\n/m;
+function applyAuthToLayout(source) {
+  const m = LAYOUT_BODY.exec(source);
+  if (!m || !source.includes(LAYOUT_IMPORT)) return null;
+  const pad = m[1];
+  const inner = m[2].split("\n").map((l) => l ? `    ${l}` : l).join("\n");
+  const body = [
+    `${pad}{/* Sign-in (g8.auth.ts): the sign-in screen until the visitor is signed in. The proxy enforces it on the server. */}`,
+    `${pad}<BrandProvider brand={brand}>`,
+    `${pad}  <G8AuthGate>`,
+    `${pad}    <AppShell headerSlot={<G8SignOutButton />}>`,
+    `${inner}${pad}    </AppShell>`,
+    `${pad}  </G8AuthGate>`,
+    `${pad}</BrandProvider>`,
+    ""
+  ].join("\n");
+  const imports = `${LAYOUT_IMPORT}import { G8AuthGate, G8SignOutButton } from "@/components/g8/_foundation/auth-gate";
+import { BrandProvider } from "@/components/g8/_foundation/brand-provider";
+`;
+  return source.replace(LAYOUT_IMPORT, imports).replace(LAYOUT_BODY, body);
+}
+var GO_LIVE_ITEM = /^- \[ \] Set `authorize` in `app\/api\/g8\/\[\.\.\.path\]\/route\.ts`[^\n]*\n(?: {6}[^\n]*\n)*/m;
+function readmeSection(p) {
+  const vars2 = authEnvLines(p).filter((l) => !l.startsWith("#")).map((l) => `\`${l.replace(/=$/, "")}\``);
+  const lines = [
+    "## Sign-in",
+    "",
+    `This app was created with \`--auth ${p}\`: ${authSummary(p)}. \`g8.auth.ts\` holds the preset, and`,
+    "`app/api/g8/[...path]/route.ts` runs its `authorize` before it forwards any call with the server's graph8 API key.",
+    ""
+  ];
+  if (vars2.length) lines.push(`Server environment (\`.env.local\` while developing, your host's settings in production): ${vars2.join(", ")}.`, "");
+  if (p === "password") lines.push("`create` wrote a fresh team password and session secret to `.env.local` (git-ignored): read the password there, and set your own values on the host before deploying.", "");
+  if (p === "basic") lines.push("`create` wrote a fresh `admin:<random>` login to `.env.local` (git-ignored). `middleware.ts` makes the browser ask for it on every page. Serve the app over HTTPS only.", "");
+  if (p === "jwt") lines.push("Set the issuer (or JWKS URL), the audience and the cookie your provider uses; examples are in `g8.auth.ts`.", "");
+  if (p === "session") lines.push("Wire your session library in `g8.auth.ts` (Clerk, NextAuth and Supabase examples inside). Until then it refuses everyone and `doctor --production` fails.", "");
+  if (p === "anonymous") lines.push("**Warning: no sign-in.** Anyone who can reach the app can use its key through `/api/g8`. Use a narrowly scoped key with a spend cap, or switch preset in `g8.auth.ts`.", "");
+  lines.push('Switch preset or tune it (session length, extra JWT claim checks): `components/g8/_foundation/README.md`, "Sign-in presets".', "", "");
+  return lines.join("\n");
+}
+function applyAuthToReadme(source, p) {
+  if (!source.includes("\n## Go live\n") || !GO_LIVE_ITEM.test(source)) return null;
+  const item = p === "anonymous" ? "- [ ] `authorize` is set by `--auth anonymous`: NO sign-in. Make sure that is what you want (see Sign-in above).\n" : `- [x] \`authorize\` is set by the \`--auth ${p}\` preset (\`g8.auth.ts\`). Set its variables on your host (see Sign-in above).
+`;
+  return source.replace("\n## Go live\n", `
+${readmeSection(p)}## Go live
+`).replace(GO_LIVE_ITEM, item);
+}
+function applyAuthToEnvExample(source, p) {
+  const lines = authEnvLines(p);
+  return lines.length ? `${source.replace(/\n*$/, "\n")}${lines.join("\n")}
+` : source;
+}
+var secret = (bytes) => (0, import_node_crypto2.randomBytes)(bytes).toString("base64url");
+function writeAuthSecrets(root, p) {
+  const wanted = p === "password" ? { G8_APP_PASSWORD: secret(18), G8_SESSION_SECRET: secret(48) } : p === "basic" ? { G8_BASIC_AUTH: `admin:${secret(18)}` } : {};
+  const file = import_node_path10.default.join(root, ".env.local");
+  const current = import_node_fs9.default.existsSync(file) ? import_node_fs9.default.readFileSync(file, "utf8") : "";
+  const has = (name) => new RegExp(`^\\s*(?:export\\s+)?${name}\\s*=\\s*\\S`, "m").test(current);
+  const add = Object.entries(wanted).filter(([name]) => !has(name));
+  if (!add.length) return [];
+  const block = [`# Written by \`npx @graph8/sdk create --auth ${p}\` for local development. Set your own values on your host.`, ...add.map(([k, v]) => `${k}=${v}`)].join("\n");
+  import_node_fs9.default.writeFileSync(file, `${current ? `${current.replace(/\n*$/, "\n")}
+` : ""}${block}
+`, { encoding: "utf8", mode: 384 });
+  return add.map(([k]) => k);
+}
+
+// src/blocks/create.ts
 var CREATE_USAGE = `Usage: npx @graph8/sdk create <stack> <dir> [options]
 
 Scaffold a Next.js (App Router, TypeScript, Tailwind CSS v4) app for a stack and
@@ -6236,6 +6386,14 @@ install the stack's blocks into it. Run \`graph8-sdk list\` to see the stacks.
   --dry-run         print what would be written, write and install nothing
   --force           allow a non-empty <dir> (template files are overwritten, and graph8.json
                     is reset: blocks you added to that app earlier are no longer recorded)
+  --auth <preset>   scaffold sign-in so the app can go live (sets \`authorize\` on the proxy route):
+                      password   one shared team password, session cookie, sign-in screen
+                      basic      HTTP Basic auth on every page (the browser asks)
+                      jwt        your identity provider's JWT (OIDC JWKS or an HS256 secret)
+                      session    your own session library (Clerk, NextAuth, Supabase): wire g8.auth.ts
+                      anonymous  NO sign-in: anyone who can reach the app uses its key (public demos)
+                    Without --auth: local preview only, and a production build refuses /api/g8 until you
+                    set \`authorize\` yourself (unchanged).
 Then: \`npm run dev\` in <dir>, open http://localhost:3000 and paste a graph8 API key (local preview), and run
 \`npx @graph8/sdk doctor --stack <stack>\` (add --production before going live).
 
@@ -6278,6 +6436,12 @@ ${CREATE_USAGE}`);
 
 ${CREATE_USAGE}`);
       o.blocks = [...o.blocks ?? [], ...v.split(",").map((x) => x.trim()).filter(Boolean)];
+    } else if (flag === "--auth") {
+      const v = inline ?? argv[++i];
+      if (v === void 0 || !isAuthPreset(v)) throw new Error(`--auth must be one of ${AUTH_PRESETS.join(", ")}
+
+${CREATE_USAGE}`);
+      o.auth = v;
     } else if (flag === "--title") {
       const v = inline ?? argv[++i];
       if (v === void 0 || v.startsWith("--")) throw new Error(`--title needs a value
@@ -6333,23 +6497,23 @@ function packageManagerFromUserAgent(ua) {
   return name ?? "npm";
 }
 function appNameFor(dir) {
-  const base = import_node_path10.default.basename(import_node_path10.default.resolve(dir)).toLowerCase().replace(/[^a-z0-9._-]+/g, "-").replace(/^[._-]+|-+$/g, "");
+  const base = import_node_path11.default.basename(import_node_path11.default.resolve(dir)).toLowerCase().replace(/[^a-z0-9._-]+/g, "-").replace(/^[._-]+|-+$/g, "");
   return base || "g8-app";
 }
 var quoted = (p) => /^[\w@%+=:,./-]+$/.test(p) ? p : JSON.stringify(p);
 function walk(dir, base = dir) {
   const out = [];
-  for (const e of import_node_fs9.default.readdirSync(dir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
-    const full = import_node_path10.default.join(dir, e.name);
+  for (const e of import_node_fs10.default.readdirSync(dir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+    const full = import_node_path11.default.join(dir, e.name);
     if (e.isDirectory()) out.push(...walk(full, base));
-    else out.push(posix(import_node_path10.default.relative(base, full)));
+    else out.push(posix(import_node_path11.default.relative(base, full)));
   }
   return out;
 }
 function outputName(rel) {
   const noExt = rel.replace(/\.tmpl$/, "");
-  const dir = import_node_path10.default.posix.dirname(noExt);
-  const base = import_node_path10.default.posix.basename(noExt).replace(/^dot-/, ".");
+  const dir = import_node_path11.default.posix.dirname(noExt);
+  const base = import_node_path11.default.posix.basename(noExt).replace(/^dot-/, ".");
   return dir === "." ? base : `${dir}/${base}`;
 }
 function stackProblem(reg, stack) {
@@ -6371,7 +6535,7 @@ function stackProblem(reg, stack) {
     if (/[\[\]]/.test(n.path)) return `stack "${stack.id}" nav "${n.label}" uses ${n.path}: dynamic segments cannot be a sidebar link.`;
     if (seen.has(n.path)) return `stack "${stack.id}" has two nav entries at ${n.path}.`;
     seen.add(n.path);
-    if (n.page && (!reg.stacksRoot || !import_node_fs9.default.existsSync(import_node_path10.default.join(reg.stacksRoot, stack.id, n.page)))) {
+    if (n.page && (!reg.stacksRoot || !import_node_fs10.default.existsSync(import_node_path11.default.join(reg.stacksRoot, stack.id, n.page)))) {
       return `stack "${stack.id}" nav "${n.label}" uses page ${n.page}, which does not exist under stacks/${stack.id}/.`;
     }
   }
@@ -6384,14 +6548,14 @@ function homeProblem(stack) {
   return null;
 }
 function stackPageFile(reg, stack, n) {
-  return n.page && reg.stacksRoot ? import_node_path10.default.join(reg.stacksRoot, stack.id, n.page) : null;
+  return n.page && reg.stacksRoot ? import_node_path11.default.join(reg.stacksRoot, stack.id, n.page) : null;
 }
 function homeRedirect(stack) {
   if (stack.home) return stack.home === "/" ? null : stack.home;
   return stack.nav.length && !stack.nav.some((n) => n.path === "/") ? stack.nav[0].path : null;
 }
 function renderPages(reg, stack, templates) {
-  const pageTpl = import_node_fs9.default.readFileSync(import_node_path10.default.join(templates, "_pages", "route-page.tsx.tmpl"), "utf8");
+  const pageTpl = import_node_fs10.default.readFileSync(import_node_path11.default.join(templates, "_pages", "route-page.tsx.tmpl"), "utf8");
   const files = stack.nav.map((n) => {
     const block = findBlock(reg, n.block);
     const comp = block.components.find((c) => c.name === n.component);
@@ -6404,11 +6568,11 @@ function renderPages(reg, stack, templates) {
       importPath: componentImportPath(block, comp.file),
       propsJson: JSON.stringify(n.props ?? {}, null, 2)
     };
-    return { rel: pageFileFor(n.path), content: render(custom ? import_node_fs9.default.readFileSync(custom, "utf8") : pageTpl, vars2) };
+    return { rel: pageFileFor(n.path), content: render(custom ? import_node_fs10.default.readFileSync(custom, "utf8") : pageTpl, vars2) };
   });
   const to = homeRedirect(stack);
   if (to) {
-    const redirect = import_node_fs9.default.readFileSync(import_node_path10.default.join(templates, "_pages", "redirect-page.tsx.tmpl"), "utf8");
+    const redirect = import_node_fs10.default.readFileSync(import_node_path11.default.join(templates, "_pages", "redirect-page.tsx.tmpl"), "utf8");
     files.push({ rel: "app/page.tsx", content: render(redirect, { firstPathJson: JSON.stringify(to) }) });
   }
   return files;
@@ -6416,9 +6580,9 @@ function renderPages(reg, stack, templates) {
 function peerDependenciesFor(blocks, io, stack) {
   const peers = {};
   for (const b of blocks) for (const [name, range] of Object.entries(b.peerDependencies)) peers[name] ??= range;
-  const usesUi = blocks.some((b) => walk(b.root).some((f) => /\.(tsx?|jsx?)$/.test(f) && /["']@graph8\/sdk\/ui["'/]/.test(import_node_fs9.default.readFileSync(import_node_path10.default.join(b.root, f), "utf8"))));
-  if (usesUi && io.sdkPackageJson && import_node_fs9.default.existsSync(io.sdkPackageJson)) {
-    const sdk = JSON.parse(import_node_fs9.default.readFileSync(io.sdkPackageJson, "utf8"));
+  const usesUi = blocks.some((b) => walk(b.root).some((f) => /\.(tsx?|jsx?)$/.test(f) && /["']@graph8\/sdk\/ui["'/]/.test(import_node_fs10.default.readFileSync(import_node_path11.default.join(b.root, f), "utf8"))));
+  if (usesUi && io.sdkPackageJson && import_node_fs10.default.existsSync(io.sdkPackageJson)) {
+    const sdk = JSON.parse(import_node_fs10.default.readFileSync(io.sdkPackageJson, "utf8"));
     for (const [name, range] of Object.entries(sdk.peerDependencies ?? {})) peers[name] ??= range;
   }
   if (navUsesExtras(stack.nav)) peers["lucide-react"] ??= lucideRange(io);
@@ -6426,7 +6590,7 @@ function peerDependenciesFor(blocks, io, stack) {
 }
 function lucideRange(io) {
   try {
-    const sdk = JSON.parse(import_node_fs9.default.readFileSync(io.sdkPackageJson ?? "", "utf8"));
+    const sdk = JSON.parse(import_node_fs10.default.readFileSync(io.sdkPackageJson ?? "", "utf8"));
     return sdk.peerDependencies?.["lucide-react"] ?? ">=0.400.0";
   } catch {
     return ">=0.400.0";
@@ -6439,8 +6603,21 @@ function mergedPackageJson(rendered, peers) {
   return `${JSON.stringify(pkg, null, 2)}
 `;
 }
-function planCreate(reg, stack, appName, pm, io, app) {
-  const templates = import_node_path10.default.join(io.templatesRoot, "next-app");
+function withAuth(files, auth, templatesRoot) {
+  const patch = (rel, fn) => {
+    const f = files.find((x) => x.rel === rel);
+    if (!f) throw new Error(`--auth ${auth}: the template has no ${rel}`);
+    const next = fn(f.content);
+    if (next === null) throw new Error(`--auth ${auth}: ${rel} does not have the generated shape`);
+    f.content = next;
+  };
+  patch("README.md", (s) => applyAuthToReadme(s, auth));
+  patch(".env.local.example", (s) => applyAuthToEnvExample(s, auth));
+  if (usesSignInScreen(auth)) patch("app/layout.tsx", applyAuthToLayout);
+  return [...files, ...planAuthFiles(auth, templatesRoot)];
+}
+function planCreate(reg, stack, appName, pm, io, app, auth) {
+  const templates = import_node_path11.default.join(io.templatesRoot, "next-app");
   const blocks = resolveWithDeps(reg, stack.blocks);
   const devCommand = pm === "npm" ? "npm run dev" : `${pm} dev`;
   const vars2 = {
@@ -6457,7 +6634,7 @@ function planCreate(reg, stack, appName, pm, io, app) {
   };
   const files = [];
   for (const rel of walk(templates).filter((f) => !f.startsWith("_pages/"))) {
-    let content = render(import_node_fs9.default.readFileSync(import_node_path10.default.join(templates, rel), "utf8"), vars2);
+    let content = render(import_node_fs10.default.readFileSync(import_node_path11.default.join(templates, rel), "utf8"), vars2);
     if (rel === "package.json.tmpl") content = mergedPackageJson(content, peerDependenciesFor(blocks, io, stack));
     files.push({ rel: outputName(rel), content });
   }
@@ -6466,12 +6643,12 @@ function planCreate(reg, stack, appName, pm, io, app) {
   const ledger = { sdkVersion: SDK_VERSION, target: "components/g8", stack: stack.id, ...app ? { app } : {}, blocks: {} };
   files.push({ rel: "graph8.json", content: `${JSON.stringify(ledger, null, 2)}
 ` });
-  return files;
+  return auth ? withAuth(files, auth, io.templatesRoot) : files;
 }
 function dirProblem(abs, force) {
-  if (!import_node_fs9.default.existsSync(abs)) return null;
-  if (!import_node_fs9.default.statSync(abs).isDirectory()) return `${abs} exists and is not a directory.`;
-  if (force || import_node_fs9.default.readdirSync(abs).length === 0) return null;
+  if (!import_node_fs10.default.existsSync(abs)) return null;
+  if (!import_node_fs10.default.statSync(abs).isDirectory()) return `${abs} exists and is not a directory.`;
+  if (force || import_node_fs10.default.readdirSync(abs).length === 0) return null;
   return `${abs} is not empty. Pick a new directory, or pass --force to write into it (template files are overwritten).`;
 }
 function runCreate(given, reg, io, cwd) {
@@ -6505,7 +6682,7 @@ function runCreate(given, reg, io, cwd) {
   }
   const problem = stackProblem(reg, stack);
   if (problem) return io.err(problem), 1;
-  const abs = import_node_path10.default.resolve(cwd, opts.dir);
+  const abs = import_node_path11.default.resolve(cwd, opts.dir);
   const dirIssue = dirProblem(abs, opts.force);
   if (dirIssue) return io.err(dirIssue), 1;
   const brandIssue = opts.brand ? brandProblem(opts.brand, cwd) : null;
@@ -6513,7 +6690,7 @@ function runCreate(given, reg, io, cwd) {
   const pm = opts.packageManager ?? packageManagerFromUserAgent(io.userAgent);
   let files;
   try {
-    files = planCreate(reg, stack, appNameFor(opts.dir), pm, io, app);
+    files = planCreate(reg, stack, appNameFor(opts.dir), pm, io, app, opts.auth);
   } catch (e) {
     io.err(e.message);
     return 1;
@@ -6524,13 +6701,14 @@ function runCreate(given, reg, io, cwd) {
   if (opts.dryRun) {
     io.out(`would add blocks: ${blocks.map((b) => b.id).join(", ")}`);
     if (opts.brand) io.out(`would brand the app: ${Object.entries(opts.brand).map(([k, v]) => `${k} ${v}`).join(", ")}`);
+    if (opts.auth) io.out(`would set up sign-in (--auth ${opts.auth}): ${authSummary(opts.auth)}; authorize: appAuth.authorize in app/api/g8/[...path]/route.ts`);
     io.out(opts.install ? `would run: ${pm} install` : "would not install dependencies (--no-install)");
     return 0;
   }
   for (const f of files) {
-    const dest = import_node_path10.default.join(abs, f.rel);
-    import_node_fs9.default.mkdirSync(import_node_path10.default.dirname(dest), { recursive: true });
-    import_node_fs9.default.writeFileSync(dest, f.content, "utf8");
+    const dest = import_node_path11.default.join(abs, f.rel);
+    import_node_fs10.default.mkdirSync(import_node_path11.default.dirname(dest), { recursive: true });
+    import_node_fs10.default.writeFileSync(dest, f.content, "utf8");
   }
   return finish(opts, reg, stack, blocks, abs, pm, io, cwd);
 }
@@ -6542,6 +6720,10 @@ function finish(opts, reg, stack, blocks, abs, pm, io, cwd) {
       return code;
     }
   }
+  if (opts.auth) {
+    const code = finishAuth(opts.auth, abs, io);
+    if (code !== 0) return code;
+  }
   if (opts.brand) {
     io.out("branding the app (graph8-sdk brand)");
     const code = runBrand({ ...opts.brand, dir: abs }, io, cwd, stack.title);
@@ -6564,13 +6746,37 @@ function finish(opts, reg, stack, blocks, abs, pm, io, cwd) {
       "",
       `Done. Next:`,
       `  1. ${cd}${opts.install ? "" : `${pm} install && `}${pm === "npm" ? "npm run dev" : `${pm} dev`}`,
+      ...opts.auth ? authOutro(opts.auth, opts.dir) : [],
       `  2. open http://localhost:3000 and paste a graph8 API key in the Connect graph8 screen (local preview: only`,
-      `     this computer can reach the app's /api/g8 route), or set G8_API_KEY in ${import_node_path10.default.posix.join(opts.dir, ".env.local")}`,
+      `     this computer can reach the app's /api/g8 route), or set G8_API_KEY in ${import_node_path11.default.posix.join(opts.dir, ".env.local")}`,
       `  3. ${cd}npx @graph8/sdk doctor${opts.blocks ? "" : ` --stack ${stack.id}`}   (before going live: add --production)`
     ].join("\n")
   );
   return 0;
 }
+function finishAuth(auth, abs, io) {
+  const rel = "app/api/g8/[...path]/route.ts";
+  const file = import_node_path11.default.join(abs, rel);
+  const next = import_node_fs10.default.existsSync(file) ? applyAuthToRoute(import_node_fs10.default.readFileSync(file, "utf8")) : null;
+  if (next === null) {
+    io.err(`--auth ${auth}: ${rel} does not have the generated shape; set \`authorize: appAuth.authorize\` (import { appAuth } from "@/g8.auth") in it yourself.`);
+    return 1;
+  }
+  import_node_fs10.default.writeFileSync(file, next, "utf8");
+  io.out(`sign-in (--auth ${auth}): ${authSummary(auth)}`);
+  io.out(`update ${rel}  (authorize: appAuth.authorize, from g8.auth.ts)`);
+  const written = writeAuthSecrets(abs, auth);
+  if (written.length) io.out(`write .env.local  (fresh ${written.join(" and ")} for local development; git-ignored, not printed)`);
+  return 0;
+}
+function authOutro(auth, dir) {
+  const env = import_node_path11.default.posix.join(dir, ".env.local");
+  if (auth === "password") return [`     sign in with G8_APP_PASSWORD from ${env} (set your own G8_APP_PASSWORD and G8_SESSION_SECRET on your host)`];
+  if (auth === "basic") return [`     the browser asks for the G8_BASIC_AUTH user and password in ${env}`];
+  if (auth === "jwt") return [`     set your identity provider in ${env} (G8_JWT_ISSUER, G8_JWT_AUDIENCE, G8_JWT_COOKIE, G8_SIGN_IN_URL; see g8.auth.ts)`];
+  if (auth === "session") return ["     wire your session library in g8.auth.ts (Clerk, NextAuth, Supabase examples inside); until then it refuses everyone"];
+  return ["     WARNING: --auth anonymous: anyone who can reach this app can use its graph8 API key. Use a narrow key with a spend cap."];
+}
 
 // src/cli.ts
 var LIST_USAGE = `Usage: npx @graph8/sdk list [--json]
@@ -6595,7 +6801,7 @@ Run a command with --help for its options.
 
 ${INIT_AGENT_USAGE}`;
 function registryFor(io) {
-  const root = io.blocksRoot ?? process.env.G8_BLOCKS_DIR ?? import_node_path11.default.resolve(__dirname, "..", "blocks");
+  const root = io.blocksRoot ?? process.env.G8_BLOCKS_DIR ?? import_node_path12.default.resolve(__dirname, "..", "blocks");
   return loadRegistry(root);
 }
 function defaultSpawn(cmd, args, cwd) {
@@ -6669,13 +6875,13 @@ function runCreateCommand(rest, io) {
   if (wantsHelp(rest)) return io.out(CREATE_USAGE), 0;
   try {
     const opts = parseCreateArgs(rest);
-    const packageRoot = import_node_path11.default.resolve(__dirname, "..");
+    const packageRoot = import_node_path12.default.resolve(__dirname, "..");
     const cio = {
       out: io.out,
       err: io.err,
       spawn: io.spawn ?? defaultSpawn,
-      templatesRoot: io.templatesRoot ?? process.env.G8_TEMPLATES_DIR ?? import_node_path11.default.join(packageRoot, "templates"),
-      sdkPackageJson: import_node_path11.default.join(packageRoot, "package.json"),
+      templatesRoot: io.templatesRoot ?? process.env.G8_TEMPLATES_DIR ?? import_node_path12.default.join(packageRoot, "templates"),
+      sdkPackageJson: import_node_path12.default.join(packageRoot, "package.json"),
       userAgent: io.userAgent ?? process.env.npm_config_user_agent,
       orgBrand: io.orgBrand
     };
@@ -6688,13 +6894,13 @@ function runAddCommand(rest, io) {
   if (wantsHelp(rest)) return io.out(ADD_USAGE), 0;
   try {
     const opts = parseAddArgs(rest);
-    const packageRoot = import_node_path11.default.resolve(__dirname, "..");
+    const packageRoot = import_node_path12.default.resolve(__dirname, "..");
     const aio = {
       out: io.out,
       err: io.err,
       spawn: io.spawn ?? defaultSpawn,
-      templatesRoot: io.templatesRoot ?? process.env.G8_TEMPLATES_DIR ?? import_node_path11.default.join(packageRoot, "templates"),
-      sdkPackageJson: import_node_path11.default.join(packageRoot, "package.json")
+      templatesRoot: io.templatesRoot ?? process.env.G8_TEMPLATES_DIR ?? import_node_path12.default.join(packageRoot, "templates"),
+      sdkPackageJson: import_node_path12.default.join(packageRoot, "package.json")
     };
     return runAdd(opts, registryFor(io), aio, io.cwd);
   } catch (e) {
@@ -6738,8 +6944,8 @@ ${USAGE}`);
     return 1;
   }
   const read = (rel) => {
-    const full = import_node_path11.default.join(io.cwd, rel);
-    return import_node_fs10.default.existsSync(full) ? import_node_fs10.default.readFileSync(full, "utf8") : null;
+    const full = import_node_path12.default.join(io.cwd, rel);
+    return import_node_fs11.default.existsSync(full) ? import_node_fs11.default.readFileSync(full, "utf8") : null;
   };
   let plans;
   try {
@@ -6750,9 +6956,9 @@ ${USAGE}`);
   }
   for (const plan of plans) {
     if (!options.dryRun && plan.action !== "unchanged") {
-      const full = import_node_path11.default.join(io.cwd, plan.path);
-      import_node_fs10.default.mkdirSync(import_node_path11.default.dirname(full), { recursive: true });
-      import_node_fs10.default.writeFileSync(full, plan.content, "utf8");
+      const full = import_node_path12.default.join(io.cwd, plan.path);
+      import_node_fs11.default.mkdirSync(import_node_path12.default.dirname(full), { recursive: true });
+      import_node_fs11.default.writeFileSync(full, plan.content, "utf8");
     }
     io.out(`${options.dryRun ? "would " : ""}${plan.action === "unchanged" ? "keep" : plan.action} ${plan.path}  (${plan.target})`);
   }
@@ -6762,7 +6968,7 @@ ${USAGE}`);
 function brandRoot(command, rest, io) {
   const at = rest.findIndex((a) => a === "--dir" || a.startsWith("--dir="));
   const dir = at < 0 ? void 0 : rest[at].includes("=") ? rest[at].slice(6) : rest[at + 1];
-  return command === "brand" && dir ? import_node_path11.default.resolve(io.cwd, dir) : io.cwd;
+  return command === "brand" && dir ? import_node_path12.default.resolve(io.cwd, dir) : io.cwd;
 }
 async function runWithOrgBrand(command, rest, argv, io) {
   const wants = !wantsHelp(rest) && !rest.includes("--no-org-brand") && (command === "brand" || !rest.includes("--dry-run")) && (command === "create" || rest.includes("--from-org") || !rest.some((a) => a.startsWith("--") && a !== "--dir" && !a.startsWith("--dir=")));

package/dist/index.browser.js

@@ -991,7 +991,7 @@ var EXTERNAL_ROUTES = {
 };
 
 // src/version.ts
-var SDK_VERSION = "0.373.0";
+var SDK_VERSION = "0.374.0";
 var SDK_CLIENT_ID = `js-sdk/${SDK_VERSION}`;
 
 // src/errors.ts