@growth-labs/auth 0.2.4 → 0.3.1

package/dist/routes/logout.d.ts

@@ -2,6 +2,7 @@ interface LogoutContext {
     request: Request;
     url: URL;
     waitUntil?: (promise: Promise<unknown>) => void;
+    locals?: Record<string, unknown>;
 }
 export declare function GET(context: LogoutContext): Promise<Response>;
 export {};

package/dist/routes/logout.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"logout.d.ts","sourceRoot":"","sources":["../../src/routes/logout.ts"],"names":[],"mappings":"AAIA,UAAU,aAAa;IACtB,OAAO,EAAE,OAAO,CAAA;IAChB,GAAG,EAAE,GAAG,CAAA;IACR,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,CAAA;CAC/C;AAED,wBAAsB,GAAG,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC,CA0BnE"}
+{"version":3,"file":"logout.d.ts","sourceRoot":"","sources":["../../src/routes/logout.ts"],"names":[],"mappings":"AAKA,UAAU,aAAa;IACtB,OAAO,EAAE,OAAO,CAAA;IAChB,GAAG,EAAE,GAAG,CAAA;IACR,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,CAAA;IAC/C,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAChC;AAED,wBAAsB,GAAG,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC,CAoCnE"}

package/dist/routes/logout.js

@@ -1,4 +1,5 @@
 import { getConfig } from '../config-store.js';
+import { analyticsAvailable, emitAuthEvent } from '../utils/analytics.js';
 import { clearCookie, clearTokenCookies, getCookie } from '../utils/cookies.js';
 import { revokeToken } from '../utils/openauth.js';
 export async function GET(context) {
@@ -10,6 +11,15 @@ export async function GET(context) {
         const promise = revokeToken(refreshToken, clientId);
         context.waitUntil?.(promise);
     }
+    // Emit auth_logout (non-blocking) when the consumer has @growth-labs/analytics
+    // wired. Without analytics installed this is a no-op (analyticsAvailable
+    // returns false). Documented in packages-docs/event-registry.md.
+    if (analyticsAvailable(context)) {
+        const promise = emitAuthEvent(context, 'auth_logout', {
+            revoked: refreshToken ? 'true' : 'false',
+        });
+        context.waitUntil?.(promise);
+    }
     // Build redirect response
     const redirectUrl = new URL(options.logoutRedirect, context.url.origin).toString();
     const response = Response.redirect(redirectUrl, 302);

package/dist/routes/logout.js.map

@@ -1 +1 @@
-{"version":3,"file":"logout.js","sourceRoot":"","sources":["../../src/routes/logout.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAC/E,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAQlD,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,OAAsB;IAC/C,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,MAAM,YAAY,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,KAAK,CAAC,CAAA;IAC7E,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAA;IAEzD,kCAAkC;IAClC,IAAI,YAAY,EAAE,CAAC;QAClB,MAAM,OAAO,GAAG,WAAW,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAA;QACnD,OAAO,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,CAAA;IAC7B,CAAC;IAED,0BAA0B;IAC1B,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAA;IAClF,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,CAAA;IAEpD,oCAAoC;IACpC,MAAM,eAAe,GAAG,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;QACnD,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,OAAO,EAAE,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;KACtC,CAAC,CAAA;IAEF,iBAAiB,CAAC,eAAe,EAAE,OAAO,CAAC,CAAA;IAC3C,WAAW,CAAC,eAAe,EAAE,GAAG,OAAO,CAAC,YAAY,OAAO,CAAC,CAAA;IAE5D,OAAO,eAAe,CAAA;AACvB,CAAC"}
+{"version":3,"file":"logout.js","sourceRoot":"","sources":["../../src/routes/logout.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AACzE,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAC/E,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AASlD,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,OAAsB;IAC/C,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,MAAM,YAAY,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,KAAK,CAAC,CAAA;IAC7E,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAA;IAEzD,kCAAkC;IAClC,IAAI,YAAY,EAAE,CAAC;QAClB,MAAM,OAAO,GAAG,WAAW,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAA;QACnD,OAAO,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,CAAA;IAC7B,CAAC;IAED,+EAA+E;IAC/E,yEAAyE;IACzE,iEAAiE;IACjE,IAAI,kBAAkB,CAAC,OAA+C,CAAC,EAAE,CAAC;QACzE,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,EAAE,aAAa,EAAE;YACrD,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;SACxC,CAAC,CAAA;QACF,OAAO,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,CAAA;IAC7B,CAAC;IAED,0BAA0B;IAC1B,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAA;IAClF,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,CAAA;IAEpD,oCAAoC;IACpC,MAAM,eAAe,GAAG,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;QACnD,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,OAAO,EAAE,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;KACtC,CAAC,CAAA;IAEF,iBAAiB,CAAC,eAAe,EAAE,OAAO,CAAC,CAAA;IAC3C,WAAW,CAAC,eAAe,EAAE,GAAG,OAAO,CAAC,YAAY,OAAO,CAAC,CAAA;IAE5D,OAAO,eAAe,CAAA;AACvB,CAAC"}

package/dist/utils/identity.d.ts

@@ -0,0 +1,109 @@
+/**
+ * The literal prefix the issuer emits on every `sub` claim. Pinned as
+ * the contract for this package's auth flow. Any change is breaking
+ * and triggers a major bump.
+ */
+export declare const IDENTITY_SUBJECT_PREFIX = "user:";
+/** Stable error code for sub-format drift. */
+export declare const IDENTITY_SUB_FORMAT_DRIFT = "IDENTITY_SUB_FORMAT_DRIFT";
+export declare class IdentitySubFormatDriftError extends Error {
+    readonly observedSubject: string;
+    readonly code = "IDENTITY_SUB_FORMAT_DRIFT";
+    constructor(message: string, observedSubject: string);
+}
+/**
+ * Validate and unwrap a `sub` claim. Returns the bare ULID portion
+ * (the value Fronts stores in `users.identity_user_id` post-migration
+ * is the prefixed form; the bare ULID is the convenient handle for
+ * matching against business-side records that pre-date the prefix).
+ *
+ * Throws `IdentitySubFormatDriftError` when the subject does not match
+ * `user:<ULID>`. The error code `IDENTITY_SUB_FORMAT_DRIFT` is stable
+ * for observability matching.
+ */
+export declare function extractIdentityId(sub: string): string;
+/**
+ * Convenience: normalize either form to the canonical prefixed `sub`.
+ * Idempotent on already-prefixed input. Throws on invalid ULID.
+ *
+ * Useful inside a one-shot migration: pass each row's stored
+ * `identity_user_id` through this and write back the result.
+ */
+export declare function normalizeIdentitySubject(value: string): string;
+export interface BridgeMigrationOptions {
+    /** Table that holds the bridge column. Default: `users`. */
+    table?: string;
+    /** Column that stores the issuer subject. Default: `identity_user_id`. */
+    column?: string;
+}
+export interface BridgeMigrationStatement {
+    sql: string;
+    bindings?: readonly unknown[];
+}
+/**
+ * Build the read-only canary query consumers run before deploying the
+ * issuer subject-format change. Returns the count of rows that hold
+ * legacy unprefixed values. A non-zero count means some logins will
+ * throw `IdentityBridgeConflictError` until those rows are rewritten
+ * by `buildLegacyIdentitySubjectMigration`.
+ *
+ * ```sql
+ * SELECT COUNT(*) FROM users WHERE identity_user_id IS NOT NULL
+ *   AND identity_user_id NOT LIKE 'user:%';
+ * ```
+ */
+export declare function buildLegacyIdentitySubjectCanary(options?: BridgeMigrationOptions): BridgeMigrationStatement;
+/**
+ * Build the rewrite statement that prefixes legacy bare-ULID values to
+ * the canonical `user:<ULID>` form. Idempotent: rows whose value
+ * already starts with `user:` are not touched. Run as a one-shot
+ * migration BEFORE the issuer subject-format change goes live.
+ *
+ * ```sql
+ * UPDATE users
+ *   SET identity_user_id = 'user:' || identity_user_id
+ *   WHERE identity_user_id IS NOT NULL
+ *     AND identity_user_id NOT LIKE 'user:%';
+ * ```
+ *
+ * D1 / SQLite syntax. Adapt the concatenation operator (`||`) for
+ * other engines if you fork.
+ */
+export declare function buildLegacyIdentitySubjectMigration(options?: BridgeMigrationOptions): BridgeMigrationStatement;
+/**
+ * D1-binding-compatible: count legacy rows. Designed for consumer
+ * code like:
+ *
+ * ```ts
+ * const count = await findLegacyIdentitySubjects(env.SITE_DB)
+ * if (count > 0) throw new Error(`${count} rows need migration`)
+ * ```
+ */
+interface D1Like {
+    prepare(sql: string): {
+        first<T = unknown>(): Promise<T | null>;
+    };
+}
+export declare function findLegacyIdentitySubjects(db: D1Like, options?: BridgeMigrationOptions): Promise<number>;
+/**
+ * D1-binding-compatible: rewrite legacy rows in place. Returns the
+ * number of rows updated.
+ *
+ * ```ts
+ * const rewritten = await rewriteLegacyIdentitySubjects(env.SITE_DB)
+ * console.log(`Migrated ${rewritten} rows`)
+ * ```
+ */
+interface D1RunLike {
+    prepare(sql: string): {
+        run(): Promise<{
+            meta?: {
+                changes?: number;
+                rows_written?: number;
+            };
+        }>;
+    };
+}
+export declare function rewriteLegacyIdentitySubjects(db: D1RunLike, options?: BridgeMigrationOptions): Promise<number>;
+export {};
+//# sourceMappingURL=identity.d.ts.map

package/dist/utils/identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/utils/identity.ts"],"names":[],"mappings":"AAwBA;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,UAAU,CAAA;AAS9C,8CAA8C;AAC9C,eAAO,MAAM,yBAAyB,8BAA8B,CAAA;AAEpE,qBAAa,2BAA4B,SAAQ,KAAK;IAIpD,QAAQ,CAAC,eAAe,EAAE,MAAM;IAHjC,QAAQ,CAAC,IAAI,+BAA4B;gBAExC,OAAO,EAAE,MAAM,EACN,eAAe,EAAE,MAAM;CAKjC;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAsBrD;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAqB9D;AAID,MAAM,WAAW,sBAAsB;IACtC,4DAA4D;IAC5D,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,0EAA0E;IAC1E,MAAM,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,wBAAwB;IACxC,GAAG,EAAE,MAAM,CAAA;IACX,QAAQ,CAAC,EAAE,SAAS,OAAO,EAAE,CAAA;CAC7B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gCAAgC,CAC/C,OAAO,GAAE,sBAA2B,GAClC,wBAAwB,CAO1B;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,mCAAmC,CAClD,OAAO,GAAE,sBAA2B,GAClC,wBAAwB,CAS1B;AAED;;;;;;;;GAQG;AACH,UAAU,MAAM;IACf,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG;QACrB,KAAK,CAAC,CAAC,GAAG,OAAO,KAAK,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAA;KACvC,CAAA;CACD;AAED,wBAAsB,0BAA0B,CAC/C,EAAE,EAAE,MAAM,EACV,OAAO,GAAE,sBAA2B,GAClC,OAAO,CAAC,MAAM,CAAC,CAIjB;AAED;;;;;;;;GAQG;AACH,UAAU,SAAS;IAClB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG;QACrB,GAAG,IAAI,OAAO,CAAC;YAAE,IAAI,CAAC,EAAE;gBAAE,OAAO,CAAC,EAAE,MAAM,CAAC;gBAAC,YAAY,CAAC,EAAE,MAAM,CAAA;aAAE,CAAA;SAAE,CAAC,CAAA;KACtE,CAAA;CACD;AAED,wBAAsB,6BAA6B,CAClD,EAAE,EAAE,SAAS,EACb,OAAO,GAAE,sBAA2B,GAClC,OAAO,CAAC,MAAM,CAAC,CAIjB"}

package/dist/utils/identity.js

@@ -0,0 +1,159 @@
+// Identity-bridge helpers. The OpenAuth issuer this package targets emits
+// `sub` claims in the form `user:<ULID>` (e.g. `user:01KP8KA31Z3AGRCC578R9HXW0H`).
+// The unprefixed bare-ULID form was used in early issuer releases and is
+// no longer the contract.
+//
+// Two scenarios this module addresses:
+//
+// 1. **Sub-format drift detection.** A consumer's auth code that pulls
+//    the identity ID from a JWT should fail loudly if the issuer emits
+//    something that doesn't match the documented contract. Use
+//    `extractIdentityId` for the canonical extract-and-validate path.
+//
+// 2. **Legacy-row bridge migration.** A consumer that started using the
+//    issuer before the prefix change has rows in their `users` table
+//    whose `identity_user_id` column holds the bare ULID. After the
+//    issuer migration, every login by those users tries to bridge the
+//    new `user:<ULID>` to a row that holds the old `<ULID>` and throws
+//    `IdentityBridgeConflictError` from the consumer's bridge layer.
+//    `buildLegacyIdentitySubjectMigration` returns a parameterized SQL
+//    statement set the consumer can run as a one-shot data migration
+//    BEFORE deploying the issuer change. `findLegacyIdentitySubjects`
+//    is a canary query consumers can run any time to count remaining
+//    legacy rows.
+/**
+ * The literal prefix the issuer emits on every `sub` claim. Pinned as
+ * the contract for this package's auth flow. Any change is breaking
+ * and triggers a major bump.
+ */
+export const IDENTITY_SUBJECT_PREFIX = 'user:';
+/**
+ * Documented ULID shape: 26 chars of Crockford base32. The issuer
+ * uses ULIDv1 and never falls back to a generic UUID — pin the
+ * stricter pattern so drift is caught early.
+ */
+const ULID_PATTERN = /^[0-9A-HJKMNP-TV-Z]{26}$/;
+/** Stable error code for sub-format drift. */
+export const IDENTITY_SUB_FORMAT_DRIFT = 'IDENTITY_SUB_FORMAT_DRIFT';
+export class IdentitySubFormatDriftError extends Error {
+    observedSubject;
+    code = IDENTITY_SUB_FORMAT_DRIFT;
+    constructor(message, observedSubject) {
+        super(message);
+        this.observedSubject = observedSubject;
+        this.name = 'IdentitySubFormatDriftError';
+    }
+}
+/**
+ * Validate and unwrap a `sub` claim. Returns the bare ULID portion
+ * (the value Fronts stores in `users.identity_user_id` post-migration
+ * is the prefixed form; the bare ULID is the convenient handle for
+ * matching against business-side records that pre-date the prefix).
+ *
+ * Throws `IdentitySubFormatDriftError` when the subject does not match
+ * `user:<ULID>`. The error code `IDENTITY_SUB_FORMAT_DRIFT` is stable
+ * for observability matching.
+ */
+export function extractIdentityId(sub) {
+    if (typeof sub !== 'string' || sub.length === 0) {
+        throw new IdentitySubFormatDriftError('JWT sub claim is missing or not a string', String(sub));
+    }
+    if (!sub.startsWith(IDENTITY_SUBJECT_PREFIX)) {
+        throw new IdentitySubFormatDriftError(`JWT sub claim "${sub}" is missing the required "${IDENTITY_SUBJECT_PREFIX}" prefix. ` +
+            `The issuer contract pins the format as "${IDENTITY_SUBJECT_PREFIX}<ULID>". ` +
+            'If your issuer was migrated from an older release, see ' +
+            'packages-docs/auth-identity-bridge.md for the bridge-row migration helper.', sub);
+    }
+    const id = sub.slice(IDENTITY_SUBJECT_PREFIX.length);
+    if (!ULID_PATTERN.test(id)) {
+        throw new IdentitySubFormatDriftError(`JWT sub claim "${sub}" has the "${IDENTITY_SUBJECT_PREFIX}" prefix but the suffix ` +
+            'is not a valid 26-char Crockford base32 ULID.', sub);
+    }
+    return id;
+}
+/**
+ * Convenience: normalize either form to the canonical prefixed `sub`.
+ * Idempotent on already-prefixed input. Throws on invalid ULID.
+ *
+ * Useful inside a one-shot migration: pass each row's stored
+ * `identity_user_id` through this and write back the result.
+ */
+export function normalizeIdentitySubject(value) {
+    if (typeof value !== 'string' || value.length === 0) {
+        throw new IdentitySubFormatDriftError('value is missing or not a string', String(value));
+    }
+    if (value.startsWith(IDENTITY_SUBJECT_PREFIX)) {
+        const id = value.slice(IDENTITY_SUBJECT_PREFIX.length);
+        if (!ULID_PATTERN.test(id)) {
+            throw new IdentitySubFormatDriftError(`value "${value}" has the "${IDENTITY_SUBJECT_PREFIX}" prefix but the suffix is not a valid ULID.`, value);
+        }
+        return value;
+    }
+    if (!ULID_PATTERN.test(value)) {
+        throw new IdentitySubFormatDriftError(`value "${value}" is neither a prefixed "${IDENTITY_SUBJECT_PREFIX}<ULID>" nor a valid bare ULID.`, value);
+    }
+    return `${IDENTITY_SUBJECT_PREFIX}${value}`;
+}
+/**
+ * Build the read-only canary query consumers run before deploying the
+ * issuer subject-format change. Returns the count of rows that hold
+ * legacy unprefixed values. A non-zero count means some logins will
+ * throw `IdentityBridgeConflictError` until those rows are rewritten
+ * by `buildLegacyIdentitySubjectMigration`.
+ *
+ * ```sql
+ * SELECT COUNT(*) FROM users WHERE identity_user_id IS NOT NULL
+ *   AND identity_user_id NOT LIKE 'user:%';
+ * ```
+ */
+export function buildLegacyIdentitySubjectCanary(options = {}) {
+    const { table = 'users', column = 'identity_user_id' } = options;
+    assertSafeSqlIdentifier(table);
+    assertSafeSqlIdentifier(column);
+    return {
+        sql: `SELECT COUNT(*) AS legacy_count FROM ${table} WHERE ${column} IS NOT NULL AND ${column} NOT LIKE 'user:%'`,
+    };
+}
+/**
+ * Build the rewrite statement that prefixes legacy bare-ULID values to
+ * the canonical `user:<ULID>` form. Idempotent: rows whose value
+ * already starts with `user:` are not touched. Run as a one-shot
+ * migration BEFORE the issuer subject-format change goes live.
+ *
+ * ```sql
+ * UPDATE users
+ *   SET identity_user_id = 'user:' || identity_user_id
+ *   WHERE identity_user_id IS NOT NULL
+ *     AND identity_user_id NOT LIKE 'user:%';
+ * ```
+ *
+ * D1 / SQLite syntax. Adapt the concatenation operator (`||`) for
+ * other engines if you fork.
+ */
+export function buildLegacyIdentitySubjectMigration(options = {}) {
+    const { table = 'users', column = 'identity_user_id' } = options;
+    assertSafeSqlIdentifier(table);
+    assertSafeSqlIdentifier(column);
+    return {
+        sql: `UPDATE ${table} SET ${column} = 'user:' || ${column} ` +
+            `WHERE ${column} IS NOT NULL AND ${column} NOT LIKE 'user:%'`,
+    };
+}
+export async function findLegacyIdentitySubjects(db, options = {}) {
+    const { sql } = buildLegacyIdentitySubjectCanary(options);
+    const row = await db.prepare(sql).first();
+    return row?.legacy_count ?? 0;
+}
+export async function rewriteLegacyIdentitySubjects(db, options = {}) {
+    const { sql } = buildLegacyIdentitySubjectMigration(options);
+    const result = await db.prepare(sql).run();
+    return result?.meta?.changes ?? result?.meta?.rows_written ?? 0;
+}
+// ─── Internal ───
+function assertSafeSqlIdentifier(value) {
+    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(value)) {
+        throw new Error(`@growth-labs/auth: identifier "${value}" is not a safe SQL identifier ` +
+            '(letters, digits, underscores; must not start with a digit).');
+    }
+}
+//# sourceMappingURL=identity.js.map

package/dist/utils/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../src/utils/identity.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,mFAAmF;AACnF,yEAAyE;AACzE,0BAA0B;AAC1B,EAAE;AACF,uCAAuC;AACvC,EAAE;AACF,uEAAuE;AACvE,uEAAuE;AACvE,+DAA+D;AAC/D,sEAAsE;AACtE,EAAE;AACF,wEAAwE;AACxE,qEAAqE;AACrE,oEAAoE;AACpE,sEAAsE;AACtE,uEAAuE;AACvE,qEAAqE;AACrE,uEAAuE;AACvE,qEAAqE;AACrE,sEAAsE;AACtE,qEAAqE;AACrE,kBAAkB;AAElB;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,OAAO,CAAA;AAE9C;;;;GAIG;AACH,MAAM,YAAY,GAAG,0BAA0B,CAAA;AAE/C,8CAA8C;AAC9C,MAAM,CAAC,MAAM,yBAAyB,GAAG,2BAA2B,CAAA;AAEpE,MAAM,OAAO,2BAA4B,SAAQ,KAAK;IAI3C;IAHD,IAAI,GAAG,yBAAyB,CAAA;IACzC,YACC,OAAe,EACN,eAAuB;QAEhC,KAAK,CAAC,OAAO,CAAC,CAAA;QAFL,oBAAe,GAAf,eAAe,CAAQ;QAGhC,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAA;IAC1C,CAAC;CACD;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC5C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,2BAA2B,CAAC,0CAA0C,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAA;IAC/F,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,uBAAuB,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,2BAA2B,CACpC,kBAAkB,GAAG,8BAA8B,uBAAuB,YAAY;YACrF,2CAA2C,uBAAuB,WAAW;YAC7E,yDAAyD;YACzD,4EAA4E,EAC7E,GAAG,CACH,CAAA;IACF,CAAC;IACD,MAAM,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAA;IACpD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,2BAA2B,CACpC,kBAAkB,GAAG,cAAc,uBAAuB,0BAA0B;YACnF,+CAA+C,EAChD,GAAG,CACH,CAAA;IACF,CAAC;IACD,OAAO,EAAE,CAAA;AACV,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAAa;IACrD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,2BAA2B,CAAC,kCAAkC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;IACzF,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,CAAC,uBAAuB,CAAC,EAAE,CAAC;QAC/C,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAA;QACtD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,2BAA2B,CACpC,UAAU,KAAK,cAAc,uBAAuB,8CAA8C,EAClG,KAAK,CACL,CAAA;QACF,CAAC;QACD,OAAO,KAAK,CAAA;IACb,CAAC;IACD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,2BAA2B,CACpC,UAAU,KAAK,4BAA4B,uBAAuB,gCAAgC,EAClG,KAAK,CACL,CAAA;IACF,CAAC;IACD,OAAO,GAAG,uBAAuB,GAAG,KAAK,EAAE,CAAA;AAC5C,CAAC;AAgBD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,gCAAgC,CAC/C,UAAkC,EAAE;IAEpC,MAAM,EAAE,KAAK,GAAG,OAAO,EAAE,MAAM,GAAG,kBAAkB,EAAE,GAAG,OAAO,CAAA;IAChE,uBAAuB,CAAC,KAAK,CAAC,CAAA;IAC9B,uBAAuB,CAAC,MAAM,CAAC,CAAA;IAC/B,OAAO;QACN,GAAG,EAAE,wCAAwC,KAAK,UAAU,MAAM,oBAAoB,MAAM,oBAAoB;KAChH,CAAA;AACF,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,mCAAmC,CAClD,UAAkC,EAAE;IAEpC,MAAM,EAAE,KAAK,GAAG,OAAO,EAAE,MAAM,GAAG,kBAAkB,EAAE,GAAG,OAAO,CAAA;IAChE,uBAAuB,CAAC,KAAK,CAAC,CAAA;IAC9B,uBAAuB,CAAC,MAAM,CAAC,CAAA;IAC/B,OAAO;QACN,GAAG,EACF,UAAU,KAAK,QAAQ,MAAM,iBAAiB,MAAM,GAAG;YACvD,SAAS,MAAM,oBAAoB,MAAM,oBAAoB;KAC9D,CAAA;AACF,CAAC;AAiBD,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC/C,EAAU,EACV,UAAkC,EAAE;IAEpC,MAAM,EAAE,GAAG,EAAE,GAAG,gCAAgC,CAAC,OAAO,CAAC,CAAA;IACzD,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAA4B,CAAA;IACnE,OAAO,GAAG,EAAE,YAAY,IAAI,CAAC,CAAA;AAC9B,CAAC;AAiBD,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAClD,EAAa,EACb,UAAkC,EAAE;IAEpC,MAAM,EAAE,GAAG,EAAE,GAAG,mCAAmC,CAAC,OAAO,CAAC,CAAA;IAC5D,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAA;IAC1C,OAAO,MAAM,EAAE,IAAI,EAAE,OAAO,IAAI,MAAM,EAAE,IAAI,EAAE,YAAY,IAAI,CAAC,CAAA;AAChE,CAAC;AAED,mBAAmB;AAEnB,SAAS,uBAAuB,CAAC,KAAa;IAC7C,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CACd,kCAAkC,KAAK,iCAAiC;YACvE,8DAA8D,CAC/D,CAAA;IACF,CAAC;AACF,CAAC"}

package/dist/utils/index.d.ts

@@ -1,4 +1,5 @@
 export { emitAuthEvent, trackAuthEvent } from './analytics.js';
+export { type BridgeMigrationOptions, type BridgeMigrationStatement, buildLegacyIdentitySubjectCanary, buildLegacyIdentitySubjectMigration, extractIdentityId, findLegacyIdentitySubjects, IDENTITY_SUB_FORMAT_DRIFT, IDENTITY_SUBJECT_PREFIX, IdentitySubFormatDriftError, normalizeIdentitySubject, rewriteLegacyIdentitySubjects, } from './identity.js';
 export { getAuthorizationUrl, getMagicLinkUrl, getPasswordLoginUrl } from './openauth.js';
 export { generatePKCE } from './pkce.js';
 export { generateState, verifyState } from './state.js';

package/dist/utils/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAC9D,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AACzF,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AACxC,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AACvD,YAAY,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAC9D,OAAO,EACN,KAAK,sBAAsB,EAC3B,KAAK,wBAAwB,EAC7B,gCAAgC,EAChC,mCAAmC,EACnC,iBAAiB,EACjB,0BAA0B,EAC1B,yBAAyB,EACzB,uBAAuB,EACvB,2BAA2B,EAC3B,wBAAwB,EACxB,6BAA6B,GAC7B,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AACzF,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AACxC,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AACvD,YAAY,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA"}

package/dist/utils/index.js

@@ -1,4 +1,5 @@
 export { emitAuthEvent, trackAuthEvent } from './analytics.js';
+export { buildLegacyIdentitySubjectCanary, buildLegacyIdentitySubjectMigration, extractIdentityId, findLegacyIdentitySubjects, IDENTITY_SUB_FORMAT_DRIFT, IDENTITY_SUBJECT_PREFIX, IdentitySubFormatDriftError, normalizeIdentitySubject, rewriteLegacyIdentitySubjects, } from './identity.js';
 export { getAuthorizationUrl, getMagicLinkUrl, getPasswordLoginUrl } from './openauth.js';
 export { generatePKCE } from './pkce.js';
 export { generateState, verifyState } from './state.js';

package/dist/utils/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAC9D,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AACzF,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AACxC,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAC9D,OAAO,EAGN,gCAAgC,EAChC,mCAAmC,EACnC,iBAAiB,EACjB,0BAA0B,EAC1B,yBAAyB,EACzB,uBAAuB,EACvB,2BAA2B,EAC3B,wBAAwB,EACxB,6BAA6B,GAC7B,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AACzF,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AACxC,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@growth-labs/auth",
-  "version": "0.2.4",
+  "version": "0.3.1",
   "type": "module",
   "types": "./dist/index.d.ts",
   "exports": {
@@ -52,7 +52,7 @@
     "astro": "^6.0.0",
     "typescript": "^5.8.0",
     "vitest": "^3.0.0",
-    "@growth-labs/analytics": "0.2.1"
+    "@growth-labs/analytics": "0.2.2"
   },
   "scripts": {
     "build": "tsc",