@isomorph.ai/app-sdk 1.13.0 → 1.13.2-rc.2026101101

package/README.md

@@ -183,6 +183,10 @@ and no second GET is sent. When the refresh fails, `identity.current()`
 answers `null` and listeners hear `null`, as before. On the page's own origin
 the identity GET is never renewed (it is the renewal). (1.5.3)
 
+## External OTP users
+
+Use `user.id` for ownership and database row rules. External users can sign in with a phone number and have no email. `user.name`, `user.phone`, `user.email` and the `emailVerified`/`phoneVerified` flags describe their profile; an optional contact is not verified automatically. `user.directory` identifies `company` or `external`. Database transactions also expose `current_setting('harbour.directory', true)` when a row rule needs that distinction.
+
 ## The signed-in user's groups
 
 `user.groups` — the company groups your identity provider sent at sign-in; use

package/dist/index.d.ts

@@ -13,7 +13,12 @@ export declare class IsomorphError extends Error {
 }
 export interface IsomorphUser {
     id: string;
-    email: string;
+    email?: string;
+    name?: string;
+    phone?: string;
+    directory?: 'company' | 'external';
+    emailVerified?: boolean;
+    phoneVerified?: boolean;
     /**
      * The company groups your identity provider sent at sign-in, `[]` when it
      * sent none. Use them for in-app roles: who may open the app at all is

package/dist/runtime.d.ts

@@ -11,7 +11,7 @@ export declare const GET_RUN_ACTION = "isomorph-jobs-get";
 export declare const CANCEL_RUN_ACTION = "isomorph-jobs-cancel";
 export interface ActionContext {
     signal: AbortSignal;
-    user: Pick<IsomorphUser, 'id' | 'email' | 'groups' | 'role'>;
+    user: IsomorphUser;
     tenant: string;
     app: string;
     requestId: string;

package/dist/runtime.js

@@ -54,6 +54,7 @@ import { createServer } from 'node:http';
 import { readFile, readdir, stat } from 'node:fs/promises';
 import { register } from 'node:module';
 import { join, resolve } from 'node:path';
+import { realpathSync } from 'node:fs';
 import { pathToFileURL } from 'node:url';
 import { createClient, IsomorphError } from './index.js';
 import { userGroupsFromHeader } from './user-groups.js';
@@ -488,11 +489,16 @@ export class Runtime {
         const controller = new AbortController();
         const abort = () => controller.abort();
         response.once('close', abort);
+        const directory = header(request, 'X-Harbour-Verified-Directory');
         const user = {
             id: header(request, 'X-Harbour-Verified-User-ID'),
             email: header(request, 'X-Harbour-Verified-User-Email'),
             groups: userGroupsFromHeader(header(request, 'X-Harbour-Verified-User-Groups')),
             role: userRole(header(request, 'X-Harbour-Verified-User-Role')),
+            ...(directory === 'company' || directory === 'external' ? { directory } : {}),
+            ...(header(request, 'X-Harbour-Verified-User-Name') ? { name: header(request, 'X-Harbour-Verified-User-Name') } : {}),
+            ...(header(request, 'X-Harbour-Verified-User-Phone') ? { phone: header(request, 'X-Harbour-Verified-User-Phone') } : {}),
+            ...(directory === 'external' ? { emailVerified: header(request, 'X-Harbour-Verified-Email-Verified') === 'true', phoneVerified: header(request, 'X-Harbour-Verified-Phone-Verified') === 'true' } : {}),
         };
         const streams = header(request, 'accept').toLowerCase().includes(PROGRESS_MEDIA_TYPE);
         let steps = 0;
@@ -629,7 +635,19 @@ export function runJobFromArguments(argv = process.argv.slice(2)) {
     }
     return undefined;
 }
-const entry = process.argv[1] ? pathToFileURL(process.argv[1]).href : '';
+// Node resolves this module's URL through any symlink in its path, while
+// process.argv[1] is the path the starter typed. On macOS /tmp and /var are
+// symlinks, so a gate or `isomorph dev` started from an app root under them
+// handed a path whose URL never matched, and the runtime loaded as a library
+// and exited 0 without a word (the gate reported "exited before it
+// answered", 2026-10-06). Compare the real path, as Node did.
+const entryPath = process.argv[1] ? (() => { try {
+    return realpathSync(process.argv[1]);
+}
+catch {
+    return process.argv[1];
+} })() : '';
+const entry = entryPath ? pathToFileURL(entryPath).href : '';
 if (import.meta.url === entry) {
     // Extensionless relative imports in the app's server code resolve to
     // their .ts files (runtime-hooks.ts); registered before any app module

package/dist/supabase-compat.d.ts

@@ -130,7 +130,7 @@ export declare class SupabaseCompatQueryBuilder<T, Result = T[], Head extends bo
 }
 export interface SupabaseCompatUser {
     id: string;
-    email: string;
+    email?: string;
     app_metadata: Record<string, unknown>;
     /** Isomorph's per-app user record (`IsomorphUser.appUser`) when it is an object. */
     user_metadata: Record<string, unknown>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@isomorph.ai/app-sdk",
-  "version": "1.13.0",
+  "version": "1.13.2-rc.2026101101",
   "type": "module",
   "repository": {
     "type": "git",